I see that this message crossed in the post with your announcement in SCIENTIFIC-LINUX-USERS that the Sun Java updates are available in ftp://ftp.scientificlinux.org/linux/scientific/5rolling/testing/i386/java/ ftp://ftp.scientificlinux.org/linux/scientific/5rolling/testing/x86_64/java/ Thank you. On Thu, 6 Sep 2012, Dr Andrew C Aitchison wrote: > On Wed, 5 Sep 2012, Pat Riehecky wrote: >> On 09/05/2012 11:07 AM, Dr Andrew C Aitchison wrote: >>> On Tue, 4 Sep 2012, Pat Riehecky wrote: >>> >>> > Synopsis: Important: java-1.6.0-openjdk security update >>> > Issue Date: 2012-09-03 >>> > CVE Numbers: CVE-2012-1682 >>> > CVE-2012-0547 >>> > >>> > These packages provide the OpenJDK 6 Java Runtime Environment and the >>> > OpenJDK 6 Software Development Kit. >>> >>> Is this update as well as, or instead of an update to the Sun/Oracle >>> jdk package which Scientific Linux 5 has shipped for the past few >>> years (IIRC this was not a RHEL package) ? >>> >>> I know that these are not (and IIRC have never been) included in SL6 >>> and that there are signature problems. >>> I can get similar packages direct from Oracle >>> http://www.oracle.com/technetwork/java/javase/downloads/jre6u35-downloads-1836473.html >>> if I know not to expect them from SL. > >> This is the openjdk version of that same update. Openjdk is packaged by >> upstream. > > True, but not an answer to my question. > > SL5.8 shipped with the Sun jdk and java-1.6.0-sun-compat > http://listserv.fnal.gov/scripts/wa.exe?A2=ind1204&L=SCIENTIFIC-LINUX-USERS&P=R15298&D=0&H=0&I=-3&O=T&T=0&m=11628 > > When you announced the security update to jdk-1.6.0_33-fcs and > java-1.6.0-sun-compat-1.6.0.33-3.sl5.jpp > http://listserv.fnal.gov/scripts/wa.exe?A2=ind1206&L=scientific-linux-users&T=0&P=10114 > you mentioned that moving to openjdk was an option, but neither there > nor in > http://listserv.fnal.gov/scripts/wa.exe?A2=ind1207&L=scientific-linux-errata&T=0&P=75 > when these packages went live did you say that that would be the last > Sun jdk release for SL5. > > Have I missed an announcement that 1.6.0_33 is the last Sun > java package that will be released by SL for SL5 ? > I'd understand if you are dropping it, but it would be helpful > to know for sure. > > I'm in two minds about suggesting a dummy package in the spirit of > http://ftp.scientificlinux.org/linux/scientific/obsolete/40rolling/i386/apt/SRPMS.updates/mozilla-1.7.13-1.4.9.SWITCH.TO.SEAMONKEY.1.src.rpm > This could enforce the transition awau from Sun/Oracle java, > but would break the Sun/Oracle jdk package for those who need to > download it direct from Oracle for some reason. > > Thanks for clarifying, > > -- Dr. Andrew C. Aitchison Computer Officer, DPMMS, Cambridge [log in to unmask] http://www.dpmms.cam.ac.uk/~werdna
