sru request for sun-java5

  * New upstream bug fix release. LP: #255011.
    - Including security related changes.
      CVE-2008-3115, CVE-2008-3114, CVE-2008-3113, CVE-2008-3112,
      CVE-2008-3111, CVE-2008-3110, CVE-2008-3109, CVE-2008-3108,
      CVE-2008-3107, CVE-2008-3106, CVE-2008-3105, CVE-2008-3104,
      CVE-2008-3103, CVE-2008-3102.
    - Fix locking assertion failure. LP: #86103.

for dapper-proposed:

sun-java5 (1.5.0-16-0ubuntu0.6.06) dapper-proposed; urgency=low

  * CVE's addressed in this upstream release:
      CVE-2008-3115, CVE-2008-3114, CVE-2008-3113, CVE-2008-3112,
      CVE-2008-3111, CVE-2008-3110, CVE-2008-3109, CVE-2008-3108,
      CVE-2008-3107, CVE-2008-3106, CVE-2008-3105, CVE-2008-3104,
      CVE-2008-3103, CVE-2008-3102.
  * Fix locking assertion failure. Closes: #402165.
  * Update sv translation for debconf template (Martin Bagge). Closes: #488183.
  * JB-bin.postinst.in: Call java -client -Xshare:dump with -Xmx1m, if the
    memory is available. Closes: #390296.
  * Ignore errors during activation of class data sharing. Closes: #402067.

  [ Following changes based on sun-java6 patch by Philipp Hahn]
  * Don't remove alternatives on upgrade. Closes: #465970.
  * debian/control: Add Pre-Depends: debconf for bin-package.
    convert to UTF-8.
  * debian/JB-doc.postinst.in: /chown/s/./:/.
  * debian/*.menu.in: s/Apps/Applications/.

Accepted into -proposed, please test and give feedback here. Please see https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you in advance!

Accepted into dapper-proposed as well.

For the intrepid task, do we actually need to keep sun-java5, and thus should update it here as well, or just drop the package entirely?

Matthias,

I believe that's entirely up to you as the maintainer. Java 5 would reach "End of Service Life" (EOSL) on October 30, 2009 and Sun already encourages to "Migrate to the latest Java SE release" http://java.sun.com/javase/downloads/index_jdk5.jsp so in theory this should make it into Intrepid too.

IMHO if the package is readily available for Dapper and Hardy, there's no reason for not making it available on Intrepid that by definition, in my mind at least, should have the "latest and greatest" packages.

Java developers usually have to use the earliest JDK version with which they want their product to remain compatible with, to verify that compatibility. As such, there's certainly a large group of people who would find it very useful for Java 5 to remain in Intrepid and beyond, who will need to pursue manual installs if it is dropped. If the maintenance burden isn't prohibitive, it would certainly be very useful to retain as long as possible.

I've just realized an additional point. Owing to evolution of interfaces that are included in the JDK, such as JDBC, there are projects such as Hibernate which *cannot* be compiled with JDK 6, and must use JDK 5 (because JDK 6 added methods to interfaces). So, yes, there's significant benefit in retaining Java 5 until its End of Service Life.

keep it for intrepid; then remove it in jaunty. End of Service life means we won't get any updates anymore, and leave our users without fixes for the time they run the release.

Should this bug still be open against Intrepid? sun-java5 1.5.0-16-3 seems to fix this, although it doesn't refer to this bug report.

keeping it open, so I know I have to revisit it / remove the package from jaunty after the next (1.5.0-17) release.

this bug was targeted to intrepid, though - if you want to track this bug for jaunty, this should be 'wontfix' now for intrepid.

Intrepid has 1.5.0-16, so does Jaunty. Should this package be removed from Jaunty?

Also, anyone who could give the dapper/hardy-proposed versions a quick test to check that they still by and large work?

hardy-proposed package confirmed. The following has been tested:
- stand-alone application
- applet in firefox3
- applet in firefox2
- applet in konqueror

dapper-proposed packages looks good as well. Tested:
- stand-alone applications
- applets in firefox

@pitti
Do you want me to perform any more validation-testing on this?

Could this be marked as verification-done; or should more tests be performed?

Copied to hardy-updates.

As for the dapper update, I removed it since it was sitting in dapper-proposed for half a year without a bug # reference, thus it fell victim to my SRU cleanup. I'll upload a no-change upload to -updates.

sun-java5 (1.5.0-16-0ubuntu0.6.06.1) dapper-updates; urgency=low

  * No-change upload to -updates, after passed verification. (LP: #255011)

 -- Martin Pitt <email address hidden> Wed, 28 Jan 2009 12:17:41 +0000

sun-java5 (1.5.0-16-0ubuntu0.6.06) dapper-proposed; urgency=low

  * CVE's addressed in this upstream release:
      CVE-2008-3115, CVE-2008-3114, CVE-2008-3113, CVE-2008-3112,
      CVE-2008-3111, CVE-2008-3110, CVE-2008-3109, CVE-2008-3108,
      CVE-2008-3107, CVE-2008-3106, CVE-2008-3105, CVE-2008-3104,
      CVE-2008-3103, CVE-2008-3102.
  * Fix locking assertion failure. Closes: #402165.
  * Update sv translation for debconf template (Martin Bagge). Closes: #488183.
  * JB-bin.postinst.in: Call java -client -Xshare:dump with -Xmx1m, if the
    memory is available. Closes: #390296.
  * Ignore errors during activation of class data sharing. Closes: #402067.

  [ Following changes based on sun-java6 patch by Philipp Hahn]
  * Don't remove alternatives on upgrade. Closes: #465970.
  * debian/control: Add Pre-Depends: debconf for bin-package.
    convert to UTF-8.
  * debian/JB-doc.postinst.in: /chown/s/./:/.
  * debian/*.menu.in: s/Apps/Applications/.

 -- Matthias Klose <email address hidden> Tue, 5 Aug 2008 16:51:38 +0000