6 ms·

Canonical to remove all Sun JDK packages from the Partner archive

115 points by smn 15y ago

moonboots 15y ago
An Oracle developer's comment on why the DLJ was retired: http://robilad.livejournal.com/90792.html http://robilad.livejournal.com/90792.html I think this won't have a big impact on Java development or use on Ubuntu. Ubuntu's bundled Sun java lagged behind the Oracle official releases, so it wasn't much different from OpenJDK. Disabling the Java browser plugin by default should have always been the sensible option. The plugin has always seemed like an infrequently used security liability.
- ntkachov 15y ago
  Personally I've always had problems with OpenJDK on Ubuntu. Eclipse just doesn't run the same on the OpenJDK as it does on the SunJDK.
  - bad_user 15y ago
    It happens to me too and considering my past experience with Eclipse I don't think OpenJDK is to be blamed - I just uninstalled Eclipse and went with IntelliJ IDEA. Works fine.
- rlpb 15y ago
  Unfortunately, Android development requires the Sun JDK: http://source.android.com/source/initializing.html http://source.android.com/source/initializing.html AIUI, Ubuntu is the primary development platform for Android, (information on the same page), so perhaps Google will produce some kind of solution for this.
  - ansible 15y ago
    I've used OpenJDK to build Gingerbread, and it seemed to work OK, but it wasn't extensively tested. Recently, I'd installed Sun's Java because I wanted minimal hiccups with building ICS. I guess we'll either have to install it manually, or give OpenJDK another try. Ugh. I try so hard these days not to install software manually.
- sciurus 15y ago
  This is an annoying situation. If Oracle won't allow third-party distribution of the JRE and JDK, they should maintain apt and yum repositories of their own. I'm not sure how they benefit from barring the effort of volunteers who made their software easier to use. I use Sun's JRE because OpenJDK's browser plugin does not work with the management interface of some hardware I use. I'm struggling to find a mailing list I can subscribe to in order to keep up with the updates I'll now have to manually download and install.
- obtu 15y ago
  robilad (Dalibor Topic) is the guy who spearheaded the GCJ and Classpath effort that led to Sun's JDK being GPL-ed. I don't know how I feel about him working at Oracle; is he more useful inside or outside?
freehunter 15y ago
This seems like an good thing, but man is that an awful way of going about this. Forcibly removing the packages during a software update is shady enough, but pushing out blank packages that will cause a user's system to produce issues that the user might not know how to fix, or a reason for the failure? Ubuntu has pretty much always been the "set it and forget it" distro. Problems are often introduced in upgrading to a new release, but once you've installed a release you generally don't get it broken with a routine update. Many people have installed Ubuntu on non-techies' machines in order to not need to do maintenance on them. Unless I'm misunderstanding, all those machines now need to be manually updated to avoid being broken? I know the blame goes back to Oracle, but Canonical could have handled the issue better. In this case, it seems they're breaking the system to spite Oracle.
- viraptor 15y ago
  Can you describe any better way that: - complies with the licensing - keeps users secure - will not require additional effort from the user I can't find one that doesn't involve showing some message and stopping mid-upgrade, which would cause lots of issues for automatic deployment.
  - norswap 15y ago
    I have one: 1) Display a big bold red message on the user's console or package manager explaining what is happening. 2) Offer to install openJDK as a default action. 3) Profit ?
    - mdeslaur 15y ago
      Once the browser plugin gets uninstalled by the package update, visiting a web site that requires a Java plugin will cause the browser to automatically suggest installing OpenJDK/icedtea-plugin.
      - saurik 15y ago
        Multiple times in this discussion thread you have talked about the plugin, but the comment about forcibly removing (as opposed to just disabling) has to do with the JDK, not the plugin. Yes: interactive systems where a user is staring at a web browser designed to download and install plugins is a simple situation to handle. However, servers that are running mail processing backends or websites are entirely different animals.
xer0 15y ago
To go in the Description field of your bookmark: (quote) If you are currently using the Oracle Java packages from the partner archive, you have two options: 1- Install the OpenJDK packages that are provided in the main Ubuntu archive. (icedtea6-plugin for the browser plugin, openjdk-6-jdk or openjdk-6-jre for the virtual machine) 2- Manually install Oracle's Java software from their web site [4].
fredsanford 15y ago
Hey, it looks like the garbage collector finally got around to doing its job... :) OK, it's a stretch, but... (If Java had true garbage collection, most programs would delete themselves upon execution. -- Robert Sewell)
- prasinous 15y ago
  Re: Sewell, wouldn't that make Java the inverse of a quine?
lysium 15y ago
Remotely deleting stuff on your user's computers reminds me of the Kindle. You just don't do that if you still want people to trust you. Instead, an automatic transition to OpenJDK should be put in place. With this, your java package at least still does java, albeit in a maybe incompatible way.
- mdeslaur 15y ago
  Once the browser plugin gets uninstalled by the package update, visiting a web site that requires a Java plugin will cause the browser to automatically suggest installing OpenJDK/icedtea-plugin.
  - cleaver 15y ago
    That sounds like good behaviour for the browser plugin, but removing the entire JDK would be annoying if you used Eclipse. I suspect that non-plugin use of the JDK would not be as impacted by the security issues.
    - rlpb 15y ago
      Fortunately, Eclipse users are generally going to be in a position to fix the problem, or they can even pin the packages in advance if they want to remain vulnerable. On the other hand, any other resolution would lead to compromised users not able to fix the problem.
    - modoc 15y ago
      And would BREAK things if you run Tomcat/JBoss/Glassfish/etc... Seriously the idea of running a package update that would erase key requirements to running my production J2EE apps is totally insane. I guess I'll stick with RHEL. For all it's issues, they've never talked about silently deleting my JDK.....
      - buntoo 15y ago
        redhat also removes packages when they cant update them https://rhn.redhat.com/errata/RHSA-2011-0368.html https://rhn.redhat.com/errata/RHSA-2011-0368.html https://rhn.redhat.com/errata/RHSA-2008-1045.html https://rhn.redhat.com/errata/RHSA-2008-1045.html
sciurus 15y ago
Since this is a licensing issue, Ubuntu isn't the only distribution dealing with this. Here is the announcement from Debian Project News: The release of Java update 29 from Oracle marks not only security updates, but a change to the licensing, removing Debian's ability to distribute the non-free JVM. The clause in the Java license under which we were able to distribute Java, the DLJ, has been removed. As a result, the sun-java6 package is no longer suitable for the archive, and has been removed, as documented in Debian Bug #646524 [2]. Sylvestre Ledru suggests [3] that sun-java6 installs be migrated to openjdk, the open-source alternative, using the following command: "apt-get --purge remove sun-java6-jre && apt-get install openjdk-7-jre" Kai WasserbÃ¤ch has also been pointed out elsewhere [4] that this upgrade path might not be suitable for all Java programs, and special attention should be paid to re-testing installed Java applications on OpenJDK. 2 : http://bugs.debian.org/646524 3 : http://sylvestre.ledru.info/blog/sylvestre/2011/10/25/removal_of_sun_java6_from_debian 4 : http://www.carbon-project.org/Removal_of_sun_java6_and_ElsterOnline.html
- ryanpers 15y ago
  The notion of replacing the sun java6 with a openjdk7 is extremely laughable. If you have a high performance java server app, openjdk just doesnt cut it.
  - mdeslaur 15y ago
    You do know that Oracle's JDK 7 is based on openjdk7, right?
    - sigzero 15y ago
      "based on" doesn't mean they are on par by any means.
  - nodata 15y ago
    Don't just laugh at it - make a suggestion. What do you suggest they do?
    - 15y ago
philjackson 15y ago
Richard Stallman doesn't seem so crazy now, does he?
- saurik 15y ago
  Oracle isn't demanding Ubuntu actively remove Java from user's computers: Ubuntu has simply decided to do so; they could keep distributing the old version, or even distribute no version at all. Meanwhile, the driving factor behind the license change is "use OpenJDK instead", which would be a step in the right direction with regard to RMS's issues with Java. Oracle is not the problem here: Ubuntu is.
  - bad_user 15y ago
    This reminds me of a quote from the movie Analyze This (2002): Jelly: Anyway, two of the witnesses decided not to testify and the third guy, well, he commited suicide. Dr. Ben Sobel: How? Jelly: He stabbed himself in the back four times and threw himself off a bridge. Oracle isn't demanding Ubuntu actively remove Java from user's computers Except that it makes it impossible to do otherwise, as security (a hallmark of desktop Linux) is compromised. Technical users that need to keep their servers up will know how to workaround this, while mom and dad won't care. Despite the backlash, I think this is the right choice.
    - saurik 15y ago
      Yes, I know how to work around this. No, I do think it is reasonable that I might be forced to work around this while I'm in the middle of doing what should have been a routine security upgrade; remember: the original package is gone, and Ubuntu's Java packages have extra supporting material (such as dpkg-alternatives logic) that is missing from Sun's. It should also be noted/realized that many Ubuntu users even use the "unattended-updates" package that is provided by the distribution, which means that at some point in the middle of the night all of their software is just going to stop working with no notice. Apple isn't even this insane, and people give them all sorts of flak for theoretically having the ability to remotely wipe apps from peoples' phones.
hmottestad 15y ago
And thus the first nail in the java coffin. Or at least the Oracle version. Anyone know why Oracle doesn't want people to use java? (and by people I mean linux users and by java I mean their version).
- cpeterso 15y ago
  Oracle wants people to use Solaris.
  - obtu 15y ago
    Not really, they're developing BtrFS for example.
- flomo 15y ago
  This seems to be an inconvenience for the minuscule number of of Linux desktop users who need Java applets. But Linux server admins won't have a problem installing Oracle Java from Oracle if that's what they need to do.
- Stormbringer 15y ago
  Monetising Java has always been problematic. Linux/GPL people have always been stroppy. Making sure everyone has the latest version is a hard enough problem even without politics. The take home lesson is that getting your language onto every desktop is hard and probably not worth the effort. Which is sad because the best thing about Java was always how it was OS agnostic. People always used to say about Java "write once, run anywhere"... but that was wrong. It was better than that. It was _compile_ once, run anywhere. I recently grabbed some of my old (1996) Java code from storage and then ran it on my desktop. The desktop was using a different OS, different chip architecture, everything was different from the machine it was originally compiled on. After 15 years it still ran perfectly. C is a "write once run anywhere" language, but you have to recompile it for each different platform, which often turns out to be non-trivial. There's no way I could take C code from a Windows 386 machine and run it on a Mac or Linux multi-core 64bit machine over a decade later.
  - 15y ago
ryanpers 15y ago
As a developer who had need to run high performance Java, I gotta say your #1 option is just not an option. OpenJDK with icedtea isn't even remotely close to a replacement. I understand that Oracle is forcing your hand, but the lack of compassion and sympathy and the ignorant insulting "recommendations" is really off putting.
- deleted 15y ago
  [deleted]
Jach 15y ago
So I don't know how Gentoo is currently planning on doing this, but one thing I've noticed with several packages is that if you try and install it, it will exit with a message telling you to go download it from the company however they want you to and stick it in Gentoo's downloaded source directory. (Actually it already does this for the sun-jdk package.) Can't Ubuntu do something similar? Silently removing the package from the repository is one thing and relatively fine; silently removing the actual binaries is another thing and out of the question. That JVM being available may be incredibly important, you have no idea what it's being used for or how susceptible it is to theoretical 0-day JVM vulnerabilities.
foxylad 15y ago
Redhat's response to the DLJ retirement: https://access.redhat.com/kb/docs/DOC-64765 https://access.redhat.com/kb/docs/DOC-64765 Basically they have bought a binary code license (BCL) which gets around the problem. Does this apply to Fedora too?
fauigerzigerk 15y ago
[...] so that the Sun JDK will be removed from all users machines when they do a software update A ridiculous solution... Oracle has retired the “Operating System Distributor License for Java” ... to a ridiculous problem.
BonoboBoner 15y ago
I have to accept not having the latest default JDK on my OSX dev machine... and now my server as well? "Run anywhere (we want you to)"?

115 points by smn 15y ago

An Oracle developer's comment on why the DLJ was retired: http://robilad.livejournal.com/90792.html http://robilad.livejournal.com/90792.html I think this won't have a big impact on Java development or use on Ubuntu. Ubuntu's bundled Sun java lagged behind the Oracle official releases, so it wasn't much different from OpenJDK. Disabling the Java browser plugin by default should have always been the sensible option. The plugin has always seemed like an infrequently used security liability.

ntkachov 15y ago
Personally I've always had problems with OpenJDK on Ubuntu. Eclipse just doesn't run the same on the OpenJDK as it does on the SunJDK.
- bad_user 15y ago
  It happens to me too and considering my past experience with Eclipse I don't think OpenJDK is to be blamed - I just uninstalled Eclipse and went with IntelliJ IDEA. Works fine.
rlpb 15y ago
Unfortunately, Android development requires the Sun JDK: http://source.android.com/source/initializing.html http://source.android.com/source/initializing.html AIUI, Ubuntu is the primary development platform for Android, (information on the same page), so perhaps Google will produce some kind of solution for this.
- ansible 15y ago
  I've used OpenJDK to build Gingerbread, and it seemed to work OK, but it wasn't extensively tested. Recently, I'd installed Sun's Java because I wanted minimal hiccups with building ICS. I guess we'll either have to install it manually, or give OpenJDK another try. Ugh. I try so hard these days not to install software manually.
sciurus 15y ago
This is an annoying situation. If Oracle won't allow third-party distribution of the JRE and JDK, they should maintain apt and yum repositories of their own. I'm not sure how they benefit from barring the effort of volunteers who made their software easier to use. I use Sun's JRE because OpenJDK's browser plugin does not work with the management interface of some hardware I use. I'm struggling to find a mailing list I can subscribe to in order to keep up with the updates I'll now have to manually download and install.
obtu 15y ago
robilad (Dalibor Topic) is the guy who spearheaded the GCJ and Classpath effort that led to Sun's JDK being GPL-ed. I don't know how I feel about him working at Oracle; is he more useful inside or outside?

freehunter 15y ago

This seems like an good thing, but man is that an awful way of going about this. Forcibly removing the packages during a software update is shady enough, but pushing out blank packages that will cause a user's system to produce issues that the user might not know how to fix, or a reason for the failure? Ubuntu has pretty much always been the "set it and forget it" distro. Problems are often introduced in upgrading to a new release, but once you've installed a release you generally don't get it broken with a routine update. Many people have installed Ubuntu on non-techies' machines in order to not need to do maintenance on them. Unless I'm misunderstanding, all those machines now need to be manually updated to avoid being broken? I know the blame goes back to Oracle, but Canonical could have handled the issue better. In this case, it seems they're breaking the system to spite Oracle.

viraptor 15y ago
Can you describe any better way that: - complies with the licensing - keeps users secure - will not require additional effort from the user I can't find one that doesn't involve showing some message and stopping mid-upgrade, which would cause lots of issues for automatic deployment.
- norswap 15y ago
  I have one: 1) Display a big bold red message on the user's console or package manager explaining what is happening. 2) Offer to install openJDK as a default action. 3) Profit ?
  - mdeslaur 15y ago
    Once the browser plugin gets uninstalled by the package update, visiting a web site that requires a Java plugin will cause the browser to automatically suggest installing OpenJDK/icedtea-plugin.
    - saurik 15y ago
      Multiple times in this discussion thread you have talked about the plugin, but the comment about forcibly removing (as opposed to just disabling) has to do with the JDK, not the plugin. Yes: interactive systems where a user is staring at a web browser designed to download and install plugins is a simple situation to handle. However, servers that are running mail processing backends or websites are entirely different animals.

xer0 15y ago

To go in the Description field of your bookmark: (quote) If you are currently using the Oracle Java packages from the partner archive, you have two options: 1- Install the OpenJDK packages that are provided in the main Ubuntu archive. (icedtea6-plugin for the browser plugin, openjdk-6-jdk or openjdk-6-jre for the virtual machine) 2- Manually install Oracle's Java software from their web site [4].

fredsanford 15y ago

Hey, it looks like the garbage collector finally got around to doing its job... :) OK, it's a stretch, but... (If Java had true garbage collection, most programs would delete themselves upon execution. -- Robert Sewell)

prasinous 15y ago
Re: Sewell, wouldn't that make Java the inverse of a quine?

lysium 15y ago

Remotely deleting stuff on your user's computers reminds me of the Kindle. You just don't do that if you still want people to trust you. Instead, an automatic transition to OpenJDK should be put in place. With this, your java package at least still does java, albeit in a maybe incompatible way.

mdeslaur 15y ago
Once the browser plugin gets uninstalled by the package update, visiting a web site that requires a Java plugin will cause the browser to automatically suggest installing OpenJDK/icedtea-plugin.
- cleaver 15y ago
  That sounds like good behaviour for the browser plugin, but removing the entire JDK would be annoying if you used Eclipse. I suspect that non-plugin use of the JDK would not be as impacted by the security issues.
  - rlpb 15y ago
    Fortunately, Eclipse users are generally going to be in a position to fix the problem, or they can even pin the packages in advance if they want to remain vulnerable. On the other hand, any other resolution would lead to compromised users not able to fix the problem.
  - modoc 15y ago
    And would BREAK things if you run Tomcat/JBoss/Glassfish/etc... Seriously the idea of running a package update that would erase key requirements to running my production J2EE apps is totally insane. I guess I'll stick with RHEL. For all it's issues, they've never talked about silently deleting my JDK.....
    - buntoo 15y ago
      redhat also removes packages when they cant update them https://rhn.redhat.com/errata/RHSA-2011-0368.html https://rhn.redhat.com/errata/RHSA-2011-0368.html https://rhn.redhat.com/errata/RHSA-2008-1045.html https://rhn.redhat.com/errata/RHSA-2008-1045.html

sciurus 15y ago

Since this is a licensing issue, Ubuntu isn't the only distribution dealing with this. Here is the announcement from Debian Project News: The release of Java update 29 from Oracle marks not only security updates, but a change to the licensing, removing Debian's ability to distribute the non-free JVM. The clause in the Java license under which we were able to distribute Java, the DLJ, has been removed. As a result, the sun-java6 package is no longer suitable for the archive, and has been removed, as documented in Debian Bug #646524 [2]. Sylvestre Ledru suggests [3] that sun-java6 installs be migrated to openjdk, the open-source alternative, using the following command: "apt-get --purge remove sun-java6-jre && apt-get install openjdk-7-jre" Kai WasserbÃ¤ch has also been pointed out elsewhere [4] that this upgrade path might not be suitable for all Java programs, and special attention should be paid to re-testing installed Java applications on OpenJDK. 2 : http://bugs.debian.org/646524 3 : http://sylvestre.ledru.info/blog/sylvestre/2011/10/25/removal_of_sun_java6_from_debian 4 : http://www.carbon-project.org/Removal_of_sun_java6_and_ElsterOnline.html

ryanpers 15y ago
The notion of replacing the sun java6 with a openjdk7 is extremely laughable. If you have a high performance java server app, openjdk just doesnt cut it.
- mdeslaur 15y ago
  You do know that Oracle's JDK 7 is based on openjdk7, right?
  - sigzero 15y ago
    "based on" doesn't mean they are on par by any means.
- nodata 15y ago
  Don't just laugh at it - make a suggestion. What do you suggest they do?
  - 15y ago

philjackson 15y ago

Richard Stallman doesn't seem so crazy now, does he?

saurik 15y ago
Oracle isn't demanding Ubuntu actively remove Java from user's computers: Ubuntu has simply decided to do so; they could keep distributing the old version, or even distribute no version at all. Meanwhile, the driving factor behind the license change is "use OpenJDK instead", which would be a step in the right direction with regard to RMS's issues with Java. Oracle is not the problem here: Ubuntu is.
- bad_user 15y ago
  This reminds me of a quote from the movie Analyze This (2002): Jelly: Anyway, two of the witnesses decided not to testify and the third guy, well, he commited suicide. Dr. Ben Sobel: How? Jelly: He stabbed himself in the back four times and threw himself off a bridge. Oracle isn't demanding Ubuntu actively remove Java from user's computers Except that it makes it impossible to do otherwise, as security (a hallmark of desktop Linux) is compromised. Technical users that need to keep their servers up will know how to workaround this, while mom and dad won't care. Despite the backlash, I think this is the right choice.
  - saurik 15y ago
    Yes, I know how to work around this. No, I do think it is reasonable that I might be forced to work around this while I'm in the middle of doing what should have been a routine security upgrade; remember: the original package is gone, and Ubuntu's Java packages have extra supporting material (such as dpkg-alternatives logic) that is missing from Sun's. It should also be noted/realized that many Ubuntu users even use the "unattended-updates" package that is provided by the distribution, which means that at some point in the middle of the night all of their software is just going to stop working with no notice. Apple isn't even this insane, and people give them all sorts of flak for theoretically having the ability to remotely wipe apps from peoples' phones.

hmottestad 15y ago

And thus the first nail in the java coffin. Or at least the Oracle version. Anyone know why Oracle doesn't want people to use java? (and by people I mean linux users and by java I mean their version).

cpeterso 15y ago
Oracle wants people to use Solaris.
- obtu 15y ago
  Not really, they're developing BtrFS for example.
flomo 15y ago
This seems to be an inconvenience for the minuscule number of of Linux desktop users who need Java applets. But Linux server admins won't have a problem installing Oracle Java from Oracle if that's what they need to do.
Stormbringer 15y ago
Monetising Java has always been problematic. Linux/GPL people have always been stroppy. Making sure everyone has the latest version is a hard enough problem even without politics. The take home lesson is that getting your language onto every desktop is hard and probably not worth the effort. Which is sad because the best thing about Java was always how it was OS agnostic. People always used to say about Java "write once, run anywhere"... but that was wrong. It was better than that. It was _compile_ once, run anywhere. I recently grabbed some of my old (1996) Java code from storage and then ran it on my desktop. The desktop was using a different OS, different chip architecture, everything was different from the machine it was originally compiled on. After 15 years it still ran perfectly. C is a "write once run anywhere" language, but you have to recompile it for each different platform, which often turns out to be non-trivial. There's no way I could take C code from a Windows 386 machine and run it on a Mac or Linux multi-core 64bit machine over a decade later.
- 15y ago

ryanpers 15y ago

As a developer who had need to run high performance Java, I gotta say your #1 option is just not an option. OpenJDK with icedtea isn't even remotely close to a replacement. I understand that Oracle is forcing your hand, but the lack of compassion and sympathy and the ignorant insulting "recommendations" is really off putting.

deleted 15y ago
[deleted]

Jach 15y ago

So I don't know how Gentoo is currently planning on doing this, but one thing I've noticed with several packages is that if you try and install it, it will exit with a message telling you to go download it from the company however they want you to and stick it in Gentoo's downloaded source directory. (Actually it already does this for the sun-jdk package.) Can't Ubuntu do something similar? Silently removing the package from the repository is one thing and relatively fine; silently removing the actual binaries is another thing and out of the question. That JVM being available may be incredibly important, you have no idea what it's being used for or how susceptible it is to theoretical 0-day JVM vulnerabilities.

foxylad 15y ago

Redhat's response to the DLJ retirement: https://access.redhat.com/kb/docs/DOC-64765 https://access.redhat.com/kb/docs/DOC-64765 Basically they have bought a binary code license (BCL) which gets around the problem. Does this apply to Fedora too?

fauigerzigerk 15y ago

[...] so that the Sun JDK will be removed from all users machines when they do a software update A ridiculous solution... Oracle has retired the “Operating System Distributor License for Java” ... to a ridiculous problem.

BonoboBoner 15y ago

I have to accept not having the latest default JDK on my OSX dev machine... and now my server as well? "Run anywhere (we want you to)"?