-
Notifications
You must be signed in to change notification settings - Fork 474
Remove OpenJDK 17 #495
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Remove OpenJDK 17 #495
Conversation
There no longer exist "official" (or even semi-official) vanilla builds of OpenJDK 17 suitable for our use or for publishing as "OpenJDK" (https://jdk.java.net/17/).
FYI to affected maintainers:
I would also suggest taking a look at docker-library/docs#2142 (which explains better why this isn't something we really can fix for this repository 😞). |
Thanks for the heads-up, @tianon! So it sounds like we downstream maintainers need to select one of the other images to base ours on? What a mess (looking at you, Oracle). |
Thanks for creating this issue. It will also help on our side when we eventually get the "what happened to openjdk-17 images?" questions. |
Ugh, ok. So it looks like we should be able to switch to coretto or temurin without any major impact. I expect there's going to be concerns from downstream users but I can point them back here. |
To clarify... this only affects 17+ correct? It will be a much less risky change if I can leave 11 and 8 on openjdk images. |
Just in time before our major release 👍 |
point latest to eclipse-temurin-17 See docker-library/openjdk#495
Yeah, that's correct - just the builds provided by Oracle (which is anything other than 8 and 11). However, as you might've seen with the vanilla builds of 8 and 11, they're not updated on an extreme priority (understandably, given they're vanilla builds provided with no expectation of support), so maybe just keep that in mind. 🙂 |
point latest to eclipse-temurin-17 See docker-library/openjdk#495
point latest to eclipse-temurin-17 See docker-library/openjdk#495
point latest to eclipse-temurin-17 See docker-library/openjdk#495
@tianon Are these are the security vulnerabilities in 17.0.2 that are motivating a quick push to 17.0.3? |
@cap10morgan I'm not sure what you mean in this context 😅 I do believe that 17.0.3 contains security updates, but this PR (and the |
@tianon Yeah I get that openjdk won't get 17.0.3. But it seemed like there was some urgency to update to 17.0.3 (more than just the usual "oh there's a new patch release out"), so just wanted to clarify if this was the source of the urgency. But perhaps I misunderstood. |
Thank you for tagging us in this PR! It would seem that TomEE will be moving to Temurin. |
@cap10morgan CVE-2022-21449 might be a good reason to make 17.0.3 available soon, but it's unclear to me if it affects only Oracle builds. |
@syphr42 I don't think they do only affect Oracle builds. It's just that Oracle is alone in not releasing a fixed version. |
Oh, it was the description of #493 that sent me down this "it's motivated by fixing some security vulns" rabbit hole. Sorry, should have commented over there. :) |
Changes: - docker-library/openjdk@dd758df: Update 18 to 18.0.1.1 - docker-library/openjdk@4136ba8: Merge pull request docker-library/openjdk#495 from infosiftr/remove-17
There no longer exist "official" (or even semi-official) vanilla builds of OpenJDK 17 suitable for our use or for publishing as "OpenJDK" (https://jdk.java.net/17/).
#493 (comment)