On Tue, Jun 28, 2022 at 03:05:32PM +0200, Ralf Corsépius wrote:
Am 28.06.22 um 14:51 schrieb Zbigniew Jędrzejewski-Szmek:
> On Tue, Jun 28, 2022 at 02:41:42PM +0200, Kevin Kofler via devel wrote:
> > > It certainly is not true that the feedback was not considered by FESCo:
> > > there was a long discussion on IRC, and FESCo members also participated
in
> > > the mailing list thread.
> >
> > Yet, the outcome is diametrically opposed to the mailing list consensus.
>
> I don't think it makes sense to restart the discussion here. I disagree
And I disagree with you.
OK.
This decision is such kind of harmful to Fedora, this decision should
be
reverted. This decision communicates the attitude of FESCO not caring about
security, maintainablity and further related topics.
> Personally, I see a lot of value in having Java packaged
> for Fedora, and use it for my stuff.
So do I, but this doesn't invalidate the the thought of "bundling" and
"static linkage" being a prime security risk.
We can treat this as an experiment. The hope is that Java upstream is
big enough to be able to release updates for any CVEs in a timely manner,
and that the RHEL/Fedora maintainers are able to provide updates in a timely
manner. If it turns out this is not the case, we can unbundle again.
(Pfff, people are so angry about this… I would prefer to unbundle anything
too. But sometimes a big upstream is just too big to fight on every front.)
Zbyszek