LSB Java support and Java updates

On Mon, Nov 17, 2008 at 03:37:42PM +0100, Dallman, John wrote:
> Wichmann, Mats D wrote:
> > Dallman, John wrote:
> > > It's good to see Java support appearing in LSB 4.0. How will
> > > the updating of the JRE be handled? Buffer-overflow exploits
> > > and the like are discovered in JREs reasonably frequently,
> > > and Sun releases updates. Will the LSB JRE be capable of
> > > automatically updating, or will it be frozen on a particular
> > > version?
> > It won't be version-frozen, at least at this point.
>
> That's good. Our legal people are getting antsy about the idea of
> software that requires a particular patch level of a JRE, once
> that JRE is known to have exploitable security holes.
>

I can't imagine any way that we would be freezing on a specific patch
level of the JRE. One of the reasons why Java going to be Trial Use
in LSB 4.0 is because we need to make sure we really have locked
gotten right the requirements for certifying the Java component.

Certainly one of the methods will be to include the passing the TCK,
which can be made available via the Open JDK license, or via other
licensing arragements that can be made. The TCK could be run by the
distribution requesting certification, or it could be run by the
provider of the JRE. In the latter case, there are some interesting
questions about whether the JRE has to be run on exactly the same OS
revision as the one which is receiving LSB certification, or whether a
certain amount of flexibility will be allowed here. The Sun folks
have argued that they have run into problems where a JRE has run into
problems caused by differences in the OS environment, and that's
probably true. However, because there maybe issues relating the
availability of the TCK (which is **not** open source, and for which
each project has to go indvidually to Sun to request), we may end up
being more flexible than what Sun might allow for the purposes of LSB
certification.

(i.e., if Distribution X uses a JRE that was originally intended for
Distribution Y, and for whatever reason Distribution X can not obtain
the TCK, and the JRE passed the TCK on Distribution Y and is therefore
allowed to use the Java steaming coffee cup logo, we might allow
distribution X to use that as evidence that it passes the Java
requirement for LSB. This wouldn't allow distribution X to use Sun's
Java trademark, of course; only Sun has the right to require this. So
this is part of what we will need to get ironed out.)

- Ted