Hacker News Reader

Comment by solarkraft | Hacker News Reader

Does the OpenJDK project not offer open source, pre-built binaries already?

There are many OpenJDK(-based) distributions out there, mostly built from the OpenJDK {8, 11} Update Releases sources. AdoptOpenJDK provides one of those distributions.

Most of the actual backport work is done by the OpenJDK participants, notably people from Red Hat (like me), SAP, Amazon, Azul and others. Oracle does not participate in OpenJDK 8u/11u directly, opting to maintain their separate tree, from which they build Oracle JDK 8u/11u available under the commercial license. There is also a security collaboration between many companies (OpenJDK Vulnerability Group), which drops its deliverables in relevant source trees.

At one point, I tried to draw this map to show the bird's eye view on the landscape: https://shipilev.net/jdk-updates/map/ -- you can find AdoptOpenJDK there.

What gets people confused is http://openjdk.java.net/ linking to Oracle distribution (either at jdk.java.net, or Oracle site). That might be seen as "OpenJDK providing the binaries", but it is actually not: it links to one of the distribution providers.

Well, maybe not directly, but the code you diligently backport does come mostly from Oracle. ;)

Granted, Oracle does contribute lots of code. As the result, lots of Oracle-created code gets backported too. That said, I see people backport a lot of code/tests that they wrote themselves, and/or with the help of non-Oracle contributors. For example, Red Hat, SAP, Huawei backport a lot of code to maintain the target platforms they own (e.g. AArch64 and PPC), or their components (e.g. diagnostics support, Shenandoah), or their build environments. While I understand the desire to pitch Oracle here, it would be awkward to do so by undervaluing the contributions of others at the same time.

I am not undervaluing anyone's contribution. Many companies contribute a lot of valuable work, and we at Oracle are thrilled to cooperate with them and actively encourage them to contribute more, but Oracle does currently contribute ~90% of the work on OpenJDK. So many companies and independent developers deserve full credit, but Oracle is in a separate category, contributing as much as all others combined, several times over. This explains why Oracle has opted to offer only paid support for those opting to stay on old JDK versions: this is how Oracle funds lion's share of OpenJDK's development.

BTW, the recommended path is free perpetual support by using the current JDK version that, under the new gradual release model, means you'll never have to do another major upgrade again. Staying on old JDK versions will be more expensive, even if you're using a free distribution.

Oracle is in a separate category, no question there.

It was my mistake to mention other vendors in the thread that is about AdoptOpenJDK. I just wanted to show where the AdoptOpenJDK sits in the larger OpenJDK ecosystem: they are important builders and distributors.

> the recommended path is free perpetual support by using the current JDK version that, under the new gradual release model, means you'll never have to do another major upgrade again.

Implying applications always receive continued development...

This has always been true, and also true for those that stick to LTS. If you want to receive security patches, you need to update your JDK. BTW, as the new deployment approach is to create a custom minimal runtime and bundle it with your app, your application may not need security patches, depending on what it does.

I think they do, but Oracle recently announced they won't be backporting security patches to older versions of the open source OpenJDK distributions. As I understand it AdoptOpenJDK is a third party effort to continue supporting the free verisions of older versions of java after Oracle abandons them.

No. It's a source-only project. Various companies and organization provide both certified and uncertified builds. There are certified builds from Oracle, Red Hat, SAP, Azul (Amazon and Alibaba provide builds of OpenJDK forks), and uncertified builds from Adopt (that also provides OpenJ9 distributions, which are very much not OpenJDK).

Yes, they do here

https://adoptopenjdk.net/upstream.html

Note that these are different binaries, build by RedHat not by AdoptOpenJDK. They are distributed there because the Java 8 and Java 11 OpenJDK projects are not allowed to post builds on https://jdk.java.net.

Oracle does not provide Java 8, so they are unreliable vendor. It's better to use more reliable sources which do not drop the version that the whole world still uses and will use for many years.

Reply on news.ycombinator.com