OpenJDK SRU exception

[Tiago Daitx]

On behalf of the Ubuntu Foundations Team, I am requesting an SRU
exception for OpenJDK. Our plan is to release OpenJDK 10 as the
default JRE/JDK [1] for Bionic, and then move the default JRE/JDK in
main to OpenJDK 11 in September/October 2018 as an SRU.

= Proposed Plan =
Bionic will be released with OpenJDK 10 as the default JRE/JDK and
OpenJDK 11 will replace it once it reaches GA.

OpenJDK 8 will be moved to universe and remain available there for
18.04, to provide migration time for packages that can't be build with
OpenJDK 10 or 11.

OpenJDK 8 will remain in main in 16.04 LTS (which reaches EOL in April 2021).

= Rationale =
Oracle will end upstream security support for OpenJDK 8 in September
2018 [2].  Red Hat has indicated that they will provide support until
October 2020 [3,4].  Canonical is committed to working with fellow
distributors of OpenJDK 8 to provide security support through the end
of Ubuntu 16.04 LTS’s supported lifecycle in April 2021, but would
prefer not to extend its maintenance costs a further two years beyond
this by including OpenJDK 8 in main in Bionic.

Meanwhile, the OpenJDK project has moved to a 6-month release cycle
with an LTS version every 3 years [2].

The first LTS version is OpenJDK 11, to be released on September 2018
and supported by Oracle until September 2021. Since it is an LTS
release, we expect the OpenJDK community will align around this
version to extend support beyond the end of Oracle’s security support
period.


If we are going to switch to OpenJDK 11 in bionic once released, we
want to avoid OpenJDK 8 as the default JRE/JDK in Bionic at release
time because any additional interface delta that exists between 8 and
11 not only exposes the archive to breakage, it also exposes external
consumers of the JDK to breakage.  In comparison, the interface delta
between OpenJDK 10 and OpenJDK 11 is expected to be fairly small,
especially in comparison with the delta between OpenJDK 8 and OpenJDK
9 that we already know is large.  We should therefore release with
OpenJDK 10 as the default JDK in 18.04, transitioning to OpenJDK 11
when it is released.

= Technical details =

There are 24 packages in bionic/main with a build dependency on
OpenJDK 8 (the current default-jdk). Of these there are 8 FTBFS with
default-jdk set to openjdk-9 and 10 FTBFS with default-jdk set to
openjdk-10. These will be fixed before Bionic’s release.

= Affected packages in main =
$ sort -u \
<(reverse-depends -b -r bionic -c main -l default-jdk) \
<(reverse-depends -b -r bionic -c main -l default-jdk-headless)
apport
automake-1.15
awstats
brltty
ca-certificates-java
ceph
commons-pool
db5.3
erlang
gettext
hsqldb1.8.0
java-atk-wrapper
libcommons-collections3-java
libcommons-dbcp-java
liblouisutdml
libphonenumber
libreoffice
libreoffice-l10n
lintian
protobuf
sonic
taglibs-standard
tomcat8
xapian-bindings


= Other =
I made a timeline to visualize the release and EOL dates of OpenJDK
and Ubuntu [5].

Debian is also affected by the new OpenJDK release cycle [6].

Regards,
Tiago


[1] Default JRE/JDK as in packages default-jre and default-jdk (as
well as the associated -headless packages)
[2] http://www.oracle.com/technetwork/java/eol-135779.html
Note: do not confuse the Oracle proprietary JDK support dates with the
OpenJDK support they provide, the proprietary support runs longer by a
couple/few years.
[3] http://mail.openjdk.java.net/pipermail/jdk-dev/2017-November/000175.html
[4] https://access.redhat.com/articles/1299013
[5] https://time.graphics/line/39488
[6] https://lists.debian.org/debian-java/2017/11/msg00028.html


-- 
Tiago Stürmer Daitx
Software Engineer
tiago.daitx at canonical.com

PGP Key: 4096R/F5B213BE (hkp://keyserver.ubuntu.com)
Fingerprint = 45D0 FE5A 8109 1E91 866E  8CA4 1931 8D5E F5B2 13BE