1. Forum
  2. Usenet
  3. LINUX.DEBIAN.SECURITY

  • Reintroducing openjdk-8 for Bullseye?

    From Graham Inggs@21:1/5 to All on Thu Apr 9 21:10:01 2020
    Dear Security Team

    The package nvidia-cuda-toolkit (non-free) ships some Java-based
    visual tools; Nvidia Visual Profiler and Nsight Eclipse Edition, which
    require the OpenJDK 8 JRE.

    When Debian switched default-jre, we started to ship Nvidia's bundled
    JRE as nvidia-openjdk-8-jre (see #900300).

    As of nvidia-cuda-toolkit 10.1.243, upstream stopped shipping the
    bundle JRE, and expect users to download it directly from Oracle. We
    are considering our options, and one which is very attractive for us
    is for openjdk-8 to be reintroduced for Bullseye, but the question is
    who gets to maintain it?

    Please let us know your thoughts.

    Regards
    Graham

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Florian Weimer@21:1/5 to All on Thu Apr 9 21:20:01 2020
    * Graham Inggs:

    As of nvidia-cuda-toolkit 10.1.243, upstream stopped shipping the
    bundle JRE, and expect users to download it directly from Oracle. We
    are considering our options, and one which is very attractive for us
    is for openjdk-8 to be reintroduced for Bullseye, but the question is
    who gets to maintain it?

    Why did they stop providing the bundled JDK? Do the AdoptOpenJDK
    builds work? If not, then why would a Debian build of openjdk-8 be
    any different?

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Ihor Antonov@21:1/5 to All on Thu Apr 9 22:10:02 2020
    This is a multi-part message in MIME format.

    On Thursday, April 9, 2020 12:11:12 PM PDT Florian Weimer wrote:
    * Graham Inggs:
    As of nvidia-cuda-toolkit 10.1.243, upstream stopped shipping the
    bundle JRE, and expect users to download it directly from Oracle. We
    are considering our options, and one which is very attractive for us
    is for openjdk-8 to be reintroduced for Bullseye, but the question is
    who gets to maintain it?

    Why did they stop providing the bundled JDK? Do the AdoptOpenJDK
    builds work? If not, then why would a Debian build of openjdk-8 be
    any different?

    JDK 8 is already EOL, current JDK LTS release is 11. I would advice against putting an EOLed product into a not yet released Bullseye

    Java has pretty good backwards compatibility so code that works on JDK 8 should work on
    JDK 11

    Just my 2 cents.

    --
    Ihor Antonov
    https://useplaintext.email

    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0//EN" "http://www.w3.org/TR/REC-html40/strict.dtd">
    <html><head><meta name="qrichtext" content="1" /><style type="text/css">
    p, li { white-space: pre-wrap; }
    </style></head><body style=" font-family:'Noto Sans'; font-size:9pt; font-weight:400; font-style:normal;">
    <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">On Thursday, April 9, 2020 12:11:12 PM PDT Florian Weimer wrote:</p>
    <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">&gt; * Graham Inggs:</p>
    <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">&gt; &gt; As of nvidia-cuda-toolkit 10.1.243, upstream stopped shipping the</p>
    <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">&gt; &gt; bundle JRE, and expect users to download it directly from Oracle. We</p>
    <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">&gt; &gt; are considering our options, and one which is very attractive for us</p>
    <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">&gt; &gt; is for openjdk-8 to be reintroduced for Bullseye, but the question is</p>
    <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">&gt; &gt; who gets to maintain it?</p>
    <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">&gt; </p>
    <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">&gt; Why did they stop providing the bundled JDK? Do the AdoptOpenJDK</p>
    <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">&gt; builds work? If not, then why would a Debian build of openjdk-8 be</p>
    <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">&gt; any different?</p>
    <p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; ">&nbsp;</p>
    <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">JDK 8 is already EOL, current JDK LTS release is 11. I would advice against </p>
    <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">putting an EOLed product into a not yet released Bullseye</p>
    <p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; ">&nbsp;</p>
    <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">Java has pretty good backwards compatibility so code that works on JDK 8 should work on JDK 11</p>
    <p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; ">&nbsp;</p>
    <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">Just my 2 cents.</p>
    <p style="-qt-paragraph-type:empty; margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; ">&nbsp;</p>
    <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">-- </p>
    <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">Ihor Antonov</p>
    <p style=" margin-top:0px; margin-bottom:0px; margin-left:0px; margin-right:0px; -qt-block-indent:0; text-indent:0px; -qt-user-state:0;">https://useplaintext.email</p></body></html>

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Andreas Beckmann@21:1/5 to Graham Inggs on Thu Apr 9 23:00:02 2020
    On 09/04/2020 22.12, Graham Inggs wrote:
    I don't know about the AdoptOpenJDK builds, but Visual Profiler and
    Nsight do work with openjdk-8 8u252-b07-1 from unstable.

    [1] https://docs.nvidia.com/cuda/archive/10.1/cuda-toolkit-release-notes/index.html

    The version previously bundled by nvidia with nvidia-cuda-toolkit (up to 10.1.168) is an ancient 8u77 amd64 build, packaged as
    nvidia-openjdk-8-jre in non-free.

    For the purposes of src:nvidia-cuda-toolkit, a stripped down version of openjdk-8 should be sufficient: only amd64 and ppc64el builds, only -jre
    (no -jdk), and it could be moved to contrib to reduce exposure even further.



    Andreas

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)
  • From Graham Inggs@21:1/5 to Florian Weimer on Thu Apr 9 22:30:01 2020
    On Thu, 9 Apr 2020 at 21:11, Florian Weimer <fw@deneb.enyo.de> wrote:
    Why did they stop providing the bundled JDK?

    From their release notes [1]:

    Oracle JDK 8 JRE, required by Nsight Eclipse Edition and Visual
    Profiler, are no longer included in the CUDA Toolkit as of version
    10.1 Update 2, due to Oracle upgrade licensing changes.

    Do the AdoptOpenJDK
    builds work? If not, then why would a Debian build of openjdk-8 be
    any different?

    I don't know about the AdoptOpenJDK builds, but Visual Profiler and
    Nsight do work with openjdk-8 8u252-b07-1 from unstable.


    [1] https://docs.nvidia.com/cuda/archive/10.1/cuda-toolkit-release-notes/index.html

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)