Skip to content

Remove OpenJDK 17 #495

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
May 2, 2022
Merged

Remove OpenJDK 17 #495

merged 1 commit into from
May 2, 2022

Conversation

tianon
Copy link
Member

@tianon tianon commented Apr 26, 2022

There no longer exist "official" (or even semi-official) vanilla builds of OpenJDK 17 suitable for our use or for publishing as "OpenJDK" (https://jdk.java.net/17/).

#493 (comment)

There no longer exist "official" (or even semi-official) vanilla builds of OpenJDK 17 suitable for our use or for publishing as "OpenJDK" (https://jdk.java.net/17/).
@tianon
Copy link
Member Author

tianon commented Apr 27, 2022

FYI to affected maintainers:

I would also suggest taking a look at docker-library/docs#2142 (which explains better why this isn't something we really can fix for this repository 😞).

@cap10morgan
Copy link

Thanks for the heads-up, @tianon! So it sounds like we downstream maintainers need to select one of the other images to base ours on? What a mess (looking at you, Oracle).

@joakime
Copy link

joakime commented Apr 27, 2022

Thanks for creating this issue.

It will also help on our side when we eventually get the "what happened to openjdk-17 images?" questions.
We can now point them here.

@headius
Copy link

headius commented Apr 28, 2022

Ugh, ok. So it looks like we should be able to switch to coretto or temurin without any major impact. I expect there's going to be concerns from downstream users but I can point them back here.

@headius
Copy link

headius commented Apr 28, 2022

To clarify... this only affects 17+ correct? It will be a much less risky change if I can leave 11 and 8 on openjdk images.

@nicolas-albert
Copy link

Just in time before our major release 👍
I switch convertigo base to tomcat:9-jdk17-temurin.
We already use Temurin for our Eclipse based studio without issues.
Thanks for the mention !

@tianon
Copy link
Member Author

tianon commented Apr 28, 2022

To clarify... this only affects 17+ correct? It will be a much less risky change if I can leave 11 and 8 on openjdk images.

Yeah, that's correct - just the builds provided by Oracle (which is anything other than 8 and 11). However, as you might've seen with the vanilla builds of 8 and 11, they're not updated on an extreme priority (understandably, given they're vanilla builds provided with no expectation of support), so maybe just keep that in mind. 🙂

carlossg added a commit to carlossg/docker-maven that referenced this pull request Apr 28, 2022
point latest to eclipse-temurin-17

See docker-library/openjdk#495
headius added a commit to headius/docker-jruby that referenced this pull request Apr 28, 2022
carlossg added a commit to carlossg/docker-maven that referenced this pull request Apr 28, 2022
point latest to eclipse-temurin-17

See docker-library/openjdk#495
carlossg added a commit to carlossg/official-images that referenced this pull request Apr 28, 2022
point latest to eclipse-temurin-17

See docker-library/openjdk#495
@cap10morgan
Copy link

@tianon Are these are the security vulnerabilities in 17.0.2 that are motivating a quick push to 17.0.3?

@tianon
Copy link
Member Author

tianon commented Apr 28, 2022

@cap10morgan I'm not sure what you mean in this context 😅

I do believe that 17.0.3 contains security updates, but this PR (and the openjdk official image) will not be receiving 17.0.3. 😬 🙈

@cap10morgan
Copy link

@tianon Yeah I get that openjdk won't get 17.0.3. But it seemed like there was some urgency to update to 17.0.3 (more than just the usual "oh there's a new patch release out"), so just wanted to clarify if this was the source of the urgency. But perhaps I misunderstood.

@scriptmonkey
Copy link

FYI to affected maintainers:
* tomee: @lordofthejars @otaviojava @jgallimore @scriptmonkey

Thank you for tagging us in this PR! It would seem that TomEE will be moving to Temurin.

@syphr42
Copy link

syphr42 commented Apr 29, 2022

@cap10morgan CVE-2022-21449 might be a good reason to make 17.0.3 available soon, but it's unclear to me if it affects only Oracle builds.

@cap10morgan
Copy link

@syphr42 I don't think they do only affect Oracle builds. It's just that Oracle is alone in not releasing a fixed version.

@cap10morgan
Copy link

@tianon Yeah I get that openjdk won't get 17.0.3. But it seemed like there was some urgency to update to 17.0.3 (more than just the usual "oh there's a new patch release out"), so just wanted to clarify if this was the source of the urgency. But perhaps I misunderstood.

Oh, it was the description of #493 that sent me down this "it's motivated by fixing some security vulns" rabbit hole. Sorry, should have commented over there. :)

@tianon tianon merged commit 4136ba8 into docker-library:master May 2, 2022
@tianon tianon deleted the remove-17 branch May 2, 2022 17:43
docker-library-bot added a commit to docker-library-bot/official-images that referenced this pull request May 2, 2022
Changes:

- docker-library/openjdk@dd758df: Update 18 to 18.0.1.1
- docker-library/openjdk@4136ba8: Merge pull request docker-library/openjdk#495 from infosiftr/remove-17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants