4 ms·
You'd be better off using JDK builds from your distro's repos.
by IceWreck 5y ago
You'd be better off using JDK builds from your distro's repos.
- ptx 5y agoMaybe. Debian says[1] that their OpenJDK package will get "security updates on a best effort basis, but users should not expect to see updates for every quarterly upstream security update." I'm not sure what that means, exactly. Will the Debian package have unpatched security vulnerabilities for several months at a time? [1] https://www.debian.org/releases/bullseye/amd64/release-notes/ch-information.en.html https://www.debian.org/releases/bullseye/amd64/release-notes...
- IceWreck 5y agoYou could use Alma Linux / Rocky Linux or any other RHEL likes which will get updates as long as RHEL does.
- nick__m 5y agoI think that means that the Debian maintainers appear to be understaffed and you should use the Correto or Zulu repository if you care about security updates.
- seba_dos1 5y agoThis applies to OpenJDK 17 in bullseye specifically, which is a special case because it wasn't released yet when bullseye was being released. There's the previous LTS version of OpenJDK (11) available in bullseye as well.
- ptx 5y agoAh, I didn't realize they had both 11 and 17 in Bullseye. I guess Debian users should stick to Java 11 then, which is presumably covered by security updates as usual? Is this documented somewhere?
- chrisseaton 5y agoMany systems either don't provide a modern JDK at all (for example macOS), or provide a pretty old JDK (for example I think Debian Stable only provides 11.)