On Wed, 5 Sep 2012, Pat Riehecky wrote: > On 09/05/2012 11:07 AM, Dr Andrew C Aitchison wrote: >> On Tue, 4 Sep 2012, Pat Riehecky wrote: >> >> > Synopsis: Important: java-1.6.0-openjdk security update >> > Issue Date: 2012-09-03 >> > CVE Numbers: CVE-2012-1682 >> > CVE-2012-0547 >> > >> > These packages provide the OpenJDK 6 Java Runtime Environment and the >> > OpenJDK 6 Software Development Kit. >> >> Is this update as well as, or instead of an update to the Sun/Oracle >> jdk package which Scientific Linux 5 has shipped for the past few >> years (IIRC this was not a RHEL package) ? >> >> I know that these are not (and IIRC have never been) included in SL6 >> and that there are signature problems. >> I can get similar packages direct from Oracle >> http://www.oracle.com/technetwork/java/javase/downloads/jre6u35-downloads-1836473.html >> if I know not to expect them from SL. > This is the openjdk version of that same update. Openjdk is packaged by > upstream. True, but not an answer to my question. SL5.8 shipped with the Sun jdk and java-1.6.0-sun-compat http://listserv.fnal.gov/scripts/wa.exe?A2=ind1204&L=SCIENTIFIC-LINUX-USERS&P=R15298&D=0&H=0&I=-3&O=T&T=0&m=11628 When you announced the security update to jdk-1.6.0_33-fcs and java-1.6.0-sun-compat-1.6.0.33-3.sl5.jpp http://listserv.fnal.gov/scripts/wa.exe?A2=ind1206&L=scientific-linux-users&T=0&P=10114 you mentioned that moving to openjdk was an option, but neither there nor in http://listserv.fnal.gov/scripts/wa.exe?A2=ind1207&L=scientific-linux-errata&T=0&P=75 when these packages went live did you say that that would be the last Sun jdk release for SL5. Have I missed an announcement that 1.6.0_33 is the last Sun java package that will be released by SL for SL5 ? I'd understand if you are dropping it, but it would be helpful to know for sure. I'm in two minds about suggesting a dummy package in the spirit of http://ftp.scientificlinux.org/linux/scientific/obsolete/40rolling/i386/apt/SRPMS.updates/mozilla-1.7.13-1.4.9.SWITCH.TO.SEAMONKEY.1.src.rpm This could enforce the transition awau from Sun/Oracle java, but would break the Sun/Oracle jdk package for those who need to download it direct from Oracle for some reason. Thanks for clarifying, -- Dr. Andrew C. Aitchison Computer Officer, DPMMS, Cambridge [log in to unmask] http://www.dpmms.cam.ac.uk/~werdna