Re: [Buildroot] [PATCH v2 1/1] package/openjdk{-bin}: security bump versions to 11.0.19+7 and 17.0.7+7

[Thomas Petazzoni via buildroot <buildroot@buildroot.org>]

Hello Adam,

On Mon, 28 Aug 2023 12:56:28 -0600
Adam Duskett <aduskett@gmail.com> wrote:

> For details, see the announcements:
> https://mail.openjdk.org/pipermail/jdk-updates-dev/2023-April/021900.html
> https://mail.openjdk.org/pipermail/jdk-updates-dev/2023-April/021899.html

>  ifeq ($(BR2_PACKAGE_OPENJDK_VERSION_17),y)
>  OPENJDK_VERSION_MAJOR = 17
> -OPENJDK_VERSION_MINOR = 0.7+7
> +OPENJDK_VERSION_MINOR = 0.8+7
>  else
>  OPENJDK_VERSION_MAJOR = 11
> -OPENJDK_VERSION_MINOR = 0.19+7
> +OPENJDK_VERSION_MINOR = 0.20+8
>  endif
>  OPENJDK_VERSION = $(OPENJDK_VERSION_MAJOR).$(OPENJDK_VERSION_MINOR)
>  OPENJDK_SITE = $(call github,openjdk,jdk$(OPENJDK_VERSION_MAJOR)u,jdk-$(OPENJDK_VERSION))

Something is wrong between your commit log/description and what the
commit is doing. The commit log is pointing to a bump to 11.0.19+7, but
we're already at 11.0.19+7 in Buildroot (your patch is updating to
11.0.20+8), and the commit log points to a bump to 17.0.7+7, but we're
already at 17.0.7+7 in Buildroot (your patch is updating to 17.0.8+7).

And therefore, the changelogs that you point to in your commit log,
that describe several CVEs as being fixed are not relevant to your
commit: they are related to the versions already in Buildroot.

Could you double check this?

Thomas
-- 
Thomas Petazzoni, co-owner and CEO, Bootlin
Embedded Linux and Kernel engineering and training
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot