On Tue, Jun 28, 2022 at 03:05:32PM +0200, Ralf Corsépius wrote: > > > Am 28.06.22 um 14:51 schrieb Zbigniew Jędrzejewski-Szmek: > > On Tue, Jun 28, 2022 at 02:41:42PM +0200, Kevin Kofler via devel wrote: > > > > > It certainly is not true that the feedback was not considered by FESCo: > > > > there was a long discussion on IRC, and FESCo members also participated in > > > > the mailing list thread. > > > > > > Yet, the outcome is diametrically opposed to the mailing list consensus. > > > > I don't think it makes sense to restart the discussion here. I disagree > > And I disagree with you. OK. > This decision is such kind of harmful to Fedora, this decision should be > reverted. This decision communicates the attitude of FESCO not caring about > security, maintainablity and further related topics. > > > Personally, I see a lot of value in having Java packaged > > for Fedora, and use it for my stuff. > > So do I, but this doesn't invalidate the the thought of "bundling" and > "static linkage" being a prime security risk. We can treat this as an experiment. The hope is that Java upstream is big enough to be able to release updates for any CVEs in a timely manner, and that the RHEL/Fedora maintainers are able to provide updates in a timely manner. If it turns out this is not the case, we can unbundle again. (Pfff, people are so angry about this… I would prefer to unbundle anything too. But sometimes a big upstream is just too big to fight on every front.) Zbyszek _______________________________________________ devel mailing list -- devel@xxxxxxxxxxxxxxxxxxxxxxx To unsubscribe send an email to devel-leave@xxxxxxxxxxxxxxxxxxxxxxx Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/devel@xxxxxxxxxxxxxxxxxxxxxxx Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
