[Mageia-dev] Removal of sun java

nicolas vigier boklm at mars-attacks.org
Fri Mar 30 16:00:22 CEST 2012


On Fri, 30 Mar 2012, Colin Guthrie wrote:

> 'Twas brillig, and Guillaume Rousse at 30/03/12 10:17 did gyre and gimble:
> > Using task-obsolete is fine:
> > - its purpose is crystal-clear
> > - if I don't want it, I don't install it
> > 
> > Adding an obsolete tag in openjdk to remove sun jdk now, for security
> > concernes, whereas we had suffered a useless mess of at least four
> > available java environnement at once for years uselessly (excepted for
> > blindly applying jpackage project practices), doesn't seems quite similar.
> 
> Well think of it this way (assuming I have the facts vaguely straight):
> 
> Forget about Cauldron and mga2
> 
> We're providing a known insecure version to mga1 users.
> 
> We need to find a way to update mga1 somehow right? Or do we want to
> just abandon them?
> 
> Assuming we do not want to abandon them, what do we do? I'd suggest
> shipping a new empty package that replaces it with a README.urpmi
> telling them to go to Sun directly is the most responsible thing for us
> to do. If they do not have a JRE installed, and they have packages that
> require one, then they should be prompted to install e.g. openjdk to
> satisfy package deps. That should work OK right?

I think an empty package is not a good idea, it would be better to
obsolete it in task-obsolete :
 - it's more clear that the package is obsoleted and is not a regular
   update. Users installing an empty package as update would only see that
   it is removed but not updated when it's already removed.
 - package is really removed and no longer listed as installed in rpm
   database
 - it's easy to add task-obsolete in urpmi skip.list for people who
   don't want unmaintained packages to be automatically removed



More information about the Mageia-dev mailing list