Ubuntu: Java packages in Partner archive to be removed on 2012-02-16 | Hacker News Reader

Ubuntu: Java packages in Partner archive to be removed on 2012-02-16

lists.ubuntu.com

82 pointsphilips47 comments

They offer a solution for the transition: https://wiki.ubuntu.com/LucidLynx/ReleaseNotes/Java6Transiti...

I've been aware of the removal, but I think this is the first time I've seen the actual reason for this. Thanks for sharing this link.

I was pretty floored the first time I was diagnosing a server problem and it turned out an Ubuntu update had pulled the Sun Java out from underneath the Tomcat server that was running and replaced it with OpenJDK, which didn't work for the big webapps that were running. That was last year, though - maybe that was it moving to partner and now it is moving again? I wish they would restrict this funny business to distro upgrades, which people expect to break things.

Do you usually let ubuntu upgrade packages automatically on live systems? I am not a server admin but that seems like a plan for constant random breakage...

They usually only provide security upgrades.

I guess this technically was a security update -- that version of Java had known vulnerabilities that they could not distribute fixes for. (Because of Oracle's license changes.)

I do, how else can I be safe(ish) from having my server attacked by some random 0day just because I didn't happen to check the advisories for every single daemon I use every week?

Or you can get "push notifications" of security updates via SMTP, https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-an... :)

Ubuntu has two levels of updates. Security updates and just updates. The former is just that, security fixes. I'm not even sure what the hell the latter is supposed to be. "Random upgrades to versions of random things we think you should be running?" That's like taking a Windows server and randomly pulling installers from Microsoft's site and installing them willy-nilly. Of course bad things will happen.

I never use the latter, ever.

Ubuntu has a well defined update policy and process. It couldn't be farther from "randomly pulling installers... and installing them willy-nilly". It's documented at https://wiki.ubuntu.com/StableReleaseUpdates

Here is an excerpt describing what's eligible for an upgrade-

"Stable release updates will, in general, only be issued in order to fix high-impact bugs. Examples of such bugs include:

Bugs which may, under realistic circumstances, directly cause a security vulnerability. These are done by the security team and are documented at SecurityTeam/UpdateProcedures.

Bugs which represent severe regressions from the previous release of Ubuntu. This includes packages which are totally unusable, like being uninstallable or crashing on startup.

Bugs which may, under realistic circumstances, directly cause a loss of user data

Bugs which do not fit under above categories, but (1) have an obviously safe patch and (2) affect an application rather than critical infrastructure packages (like X.org or the kernel)."

If you don't trust the packages Ubuntu provides as updates, why do you trust the packages they initially provided with the release? I think that in most cases the updates are going through a more rigorous QA process than the initial packages.

What strategy are people taking on this?

Perhaps it is time to revive the java-package debian package:

http://wiki.debian.org/JavaPackage http://packages.debian.org/lenny/java-package

I forked it here and will be looking into it later today: https://github.com/philips/java-package

This is very annoying.

The process of doing a Linux install / upgrade of Java from the packages provided on the Oracle website is a real pain since they don't have their own apt repo or even provide a .deb.

OpenJDK may be a fine replacement for many use cases but it's really not a 100% drop in replacement. Minecraft requires Oracle Java for one , and I'd hate to think what would happen if you were using ubuntu to host anything important that required it.

This is the sort of stuff that ruins the ubuntu's UX.

It surprises me Oracle doesn't provide a .deb for their JRE/JDK: they do for Virtualbox (they even have a repo). So why not for the JRE/JDK?

VirtualBox provided an apt repo before Oracle (or was it Sun?) bought them. So they already had the infrastructure set up for providing apt packages. No reason to dismantle it after the acquisition. In contrast, I don't think Oracle/Sun have ever provided debs for Java, so doing so now would require an investment of time, effort, and community collaboration to ensure that their debs incorporate themselves correctly into the system (via "update-alternatives" and such things).

AFAIK, OpenJDK is not yet supported for Android development. There are at least issues with the compatibility test suite, and perhaps others. We're going to be installing Oracle Java 6 to our development machines, at least for the short term.

This is for Ubuntu < 11.10. They're already gone in the 11.10 repositories. I just went through the ordeal of manually installing and setting up JDK6 and JDK7 alongside OpenJDK. Here's how, along with some useful update-alternatives scripts:

1. Download from Oracles' site http://www.oracle.com/java. extract, and copy the extracted folder to /usr/lib/jvm (where openjdk is installed by default).

2. Change the default-jvm soft link to the new jdk:

> cd /usr/lib/jvm

> sudo rm default-jvm

> sudo ln -s jdk1.6.0_30 default-jvm

3. In .profile or .bash_profile add:

export JAVA_HOME=/usr/lib/jvm/default-jvm

(no need to add $JAVA_HOME/bin to your PATH, update-alternatives takes care of that by linking it to /usr/bin)

4. Add the new JDK to /etc/alternatives with update-alternatives command. The trick here is to slave all the jdk1.6.0_30/bin supporting programs to jdk1.6.0_30/bin/java, so that changing from one java to another also changes all the supporting programs as well. Without slaving them, you have to call update-alternatives --config on all of them separately, and there are quite a few as can be seen in the scripts below.

https://raw.github.com/byrongibson/scripts/master/install/ja...

That's it. This lets you install JDK6 and JDK7 side-by-side with OpenJDK (which I apt-get installed first, fwiw), and switch between them with a quick update-alternatives --config, and changing of the default-java soft link.

Doing it this way lets you install any number of JDK versions or minor versions side-by-side, and easily switch among them, or upgrade from one to another, and switch back if the new version borked whatever you were running on it.

Of course, no more automatic security updates, so you have to keep an eye on that and download the new Oracle JDK minor/update versions when they're released, but on the other hand it's much easier to roll back if an update breaks something, since the prior working version is still there and just and update-alternatives away.

Sorry, but that is way to complicated.

I remembered there was an unofficial repository for Mandrake once upon a time (about Mandrake 8 or so) which had a bunch of software that allowed you to watch DVDs, play MP3s, etc. (They also had hotgirl). It was hosted by a bunch of crazy people (I seem to recall them being French).

So what I just really want to know is if anybody knows of an alternative repository?

It's actually really simple, it just looks complicated on the first pass. Try it, on a virtual machine test box if necessary, you'll see. 90% of the work in this method is getting the update-alternatives scripts right, and that's already done. And the ability to painlessly rollback is more than worth it.

By too complicated I mean I have to think about it, because Ubuntu broke something that previously worked.

The best solution is to get somebody Oracle can't block to put them into a repository.

Thank you.

Why is this easier than making ~/lib/java-latest softlinked to ~/lib/jdk1.6.0_30 then just re-linking to the one you want to use while having export JAVA_HOME=~/lib/java-latest in ~/*rc .

At least this way it isn't ubuntu specific and you don't have to know about update-alternatives (first time for me hearing of that).

You could do that too, only problem I can think of is if you also want to install OpenJDK from the Ubuntu repos.

Presuming that, in addition to what you said, you also add your new $JAVA_HOME/bin to your $PATH, then you'll have a namespace collision in your PATH between $JAVA_HOME/bin/java and /usr/bin/java (OpenJDK linked via /etc/alternatives/java via /usr/lib/jvm/openjdk/bin/java, which is the default install setup for openjdk, on 11.10 at least).

If you're installing OpenJDK manually too, instead of via repo, or not at all, then keeping all your jdk's in ~/lib might be a better option overall.

IMHO the headline should be changed to something like "openjdk packages are favoured over sun-java-* packages, which will be removed ...".

It's nothing to do with favouritism, Ubuntu are not licenced to distribute it any more:

As of August 24th 2011, we no longer have permission to redistribute new Java packages as Oracle has retired the "Operating System Distributor License for Java".

For the people using OracleJDK, what are the advantages it has over OpenJDK? Are the differences less in JDK7 vs JDK6?

It actually works :)

In theory it shouldn't matter which JVM interprent the code. In practice those that are not OracleJDK crash.

Doesn't this tell a lot about how much (unit) testing is undergoing in Java-land?

If a Ruby VM were to change its behaviour so to cause crashes, dozens of project will start to see red in one or two test cases. From that, it is easy to pin down the problem to 10 lines of code and report it upstream. In Java-land (and, sadly, many other lands) applications suddenly crash and nobody knows why.

Well we're not talking simple methods that are breaking. It's generally UI stuff that is under specified or places where the Oracle JVM uses native code, etc.

Not all problems in computers are evidence of no unit-testing.

In this case it is simply that a bunch of groups (especially gcj but properly also icedtea) published half-completed implementations of a standard and declared it was good enough to use because it didn't come from Sun.

I'm using OpenJDK for Java 7 right now, but I'm heavily considering moving to the Oracle version. I keep reading that they're the same codebase, but while that may be, they're hardly the same release. OpenJDK uses these IcedTea releases that don't map to Oracle's "u" releases at all.

As of now, IcedTea is lagging behind Oracle JDK 7u2 and it's not clear when it'll catch up. 7u2 has some important bug fixes and invokedynamic performance enhancements. So, it seems like the better release to go with.

I'd like to hear detailed examples of people having problems with OpenJDK. I hear a lot of anecdotal examples, but I've had no problems using it for a wide range of things. The only thing I've heard with enough authority that I buy is that there are problems building Android with the OpenJDK toolset.

For one my game doesn't work on openjdk/icedtea. cuberealms.com/game

have they figured out audio yet? jmx stuff seems to be broken, or at least it is a pain to get it to play with pulseaudio... but chalk this up to the other kabillion problems with linux audio i guess, heh.

OpenJDK Doesn't work with the supermicro ipmi-KVM tool. It's been brought up, but closed as wontfix.

None of the IntelliJ IDEs work properly with OpenJDK.

This was previously discussed at http://news.ycombinator.com/item?id=3357623

Note that back in December they were planning to push "empty packages to the archive, so that the Sun JDK will be removed from all users machines when they do a software update". Now they've changed their minds: "In order to prevent unexpected failures, we will not be pushing out empty packages before removing them from the archive."

I'm confused. According to the Wikipedia article on Java, the source code is released under GPL. Isn't this enough for Canonical to host and distribute the binaries?

Apparently, there's the open-source, Free Software OpenJDK, which is freely distributable and which Canonical still distributes, but there's also the official Java binaries released by Sun/Oracle which are under a more restrictive licence. The official binaries for Java 6 are close enough to the OpenJDK implementation that most things run, and the official binaries for Java 7 are actually based on OpenJDK 7, but there's still differences.

I've heard of Java-based production systems that were broken by a minor point-release of the official Java binaries, so it's not surprising to me that people would be skittish about switching to an entire other implementation.

http://blogs.oracle.com/henrik/entry/moving_to_openjdk_as_th... Note that the RI has a very specific purpose (eg, to serve as the RI) and is generally not updated except when/if the specification is revised.

So OpenJDK may be adequate as a RI, but will be unstable to use in a production environment.

We apologize for any inconvenience this may cause, and thank you for your understanding.

Urgh... Couldn't they have phrased this any differently? The only thing that's missing is "Please hold. Your call is important to us."

Differently? How? Honest question: What's wrong with apologizing and expecting the users to understand there's nothing else they can do?

Provide a link to an alternative directory, or at the very least a script.

They provide a link to a Java 6 Transition wiki in the end of the e-mail.

How do I add that to apt-get sources?

Trite sentences actually devalue what the speaker is saying.

How many times have we heard that sentence and thought that the speaker was not sincere at all? Now, when a somebody uses it, all those insincere utterances will come to your mind with all the accompanying bad feelings.

It is good to see people apologising for inconveniences but, please, take fifteen seconds to think of a sentence that does not sound like a canned reply.

Create a local 'apt' repository for Ubuntu Java packages: https://github.com/flexiondotorg/oab-java6

Just tried it earlier today on 11.10. Worked fine.

would be a great opportunity for someone to write a wrapper script that downloads updates, etc... sucks that oracle can't just let distros figure it out for their respective systems... i guess apple takes the tack of being slow on java, so whatever.

Reply on news.ycombinator.com