Am Tue, Jan 26, 2021 at 04:36:13PM +0100 schrieb Matthias Klose: > On 12/2/20 5:42 PM, Holger Levsen wrote: > > On Fri, Nov 20, 2020 at 08:40:22AM +0000, Holger Levsen wrote: > >>> Thanks for the upload. > >> :) note however that "#975016: OpenJDK 15 support state for Bullseye" is > >> still > >> open... > > > > ping, has there been any progress on this? > > chatting with Moritz from the security team, we found four options: > > 1) Ship a snapshot of OpenJDK 17 in bullseye. The package is > marked as a snapshot build. Mention in debian-security-support > and the Release Notes, that the package is unsupported. The > package should be updated to the final OpenJDK 17 release via > debian-security (final release is expected in October 2021). > I volunteer to do that, I also volunteer to prepare follow-up > updates, but unlikely for every security update which is > expected every three months. > > 2) Like option 1), but find somebody committing to constant security > updates. Mentioning in debian-security-support and the Release > Notes is not needed. > > 3) Provide OpenJDK 17 in the same archive area as planned for all > the go dependencies. I don't know what would be involved with > that. > > 4) Provide OpenJDK 17 in bullseye-backports only. I don't know > how it can land there. The backports section also might not be > enabled for everybody.
Ack, ideally we can come up with someone committing to 2), but those are all workable options. Cheers, Moritz