Eradication of old java

[Mark Felder]

On Mon, Jul 13, 2015, at 10:52, Jung-uk Kim wrote:
> On 07/12/2015 15:31, Mark Felder wrote:
> > 
> > 
> > On Sun, Jul 12, 2015, at 14:09, Xin Li wrote:
> >> 
> >> On 7/12/15 10:38, Mark Felder wrote:
> >>> How long before we start to eradicate old java from the ports
> >>> tree? I'm actually in the process of updating a couple ports of
> >>> mine to require Java 1.8 now that it is supported, vs 1.6 as
> >>> users currently are being required to use.
> >>> 
> >>> Java 6 was EoL last year, Java 7 in April this year.
> >>> 
> >>> I'm considering doing a search of the ports tree to gather
> >>> some info and see how many can just have the java requirement
> >>> bumped.
> >> 
> >> I think we should move this discussion to -java@ and/or
> >> maintainers -- there is no known security issues and it's better
> >> to give it more public exposure.
> >> 
> >> My suggestion would be to deprecate both Java 6 and 7 now and
> >> remove them after a few (3?) months if there is nobody
> >> volunteering to maintain them.
> >> 
> >> (IIRC Java 6 have some security settings that e.g. IPMI console 
> >> applications require, but I doubt if FreeBSD users actually use
> >> these because such applications usually ships with some native
> >> binary blobs)
> >> 
> > 
> > Is Java 6 and 7 still receiving updates through OpenJDK upstream?
> > As far as I'm aware they are not, so the next batch of CVEs that
> > come out put those users in a bad position.
> > 
> > Can java@ team provide any details?
> 
> Both OpenJDK6 and OpenJDK7 are actively maintained.  For example,
> there will be OpenJDK6 b36 soon:
> 
> https://java.net/jira/browse/OPENJDK6-60
> 
> Jung-uk Kim
>

So it is only Oracle's non-OpenJDK distribution of Java 6 and Java 7
that is ceasing public updates?