| 2 Nov 2024 |
 emily | and if you could update the manual section to not reference it in that one too that'd be great | 02:07:16 |
 Tomodachi94 (they/them) | In reply to@emilazy:matrix.org
sure, maybe just roll it into the oraclejdk drop? Maybe. I'm going to hunt for CVEs for it as well, so there's slightly stronger justification | 02:07:43 |
| emily | probably not many people filing CVEs for a proprietary Java Card devkit I imagine | 02:08:04 |
| Tomodachi94 (they/them) | * Maybe. I'm going to hunt for CVEs for javacard-devkit as well, so there's slightly stronger justification | 02:08:05 |
| emily | IMO the justification is: it depends on a package being removed for being an unmaintained security disaster, is many years of out of date compared to what we could be packaging (there are modern Linux versions: https://www.oracle.com/java/technologies/javacard-downloads.html#sdk-sim), and it has been untouched since 2018 so there is no reason to expect that the former two will be resolved (and it's not your job to do so) | 02:09:54 |
| Tomodachi94 (they/them) | Yeah fair. I'm finding 3 CVEs for the hardware itself, but nothing for the devkit | 02:09:55 |
| Tomodachi94 (they/them) | (meant to be in reply to your message before justification) | 02:10:56 |
| Tomodachi94 (they/them) | shakes fist at Atlassian Confluence & Crowd & Jira, and Docear packages for having an obscured dependency on oraclejre | 02:19:21 |
| emily | oh boy | 02:21:40 |
| emily | Atlassian only supports the Oracle JRE (JRASERVER-46152).
| 02:21:49 |
| emily | 🤡 | 02:21:51 |
| Tomodachi94 (they/them) | So much for dropping OracleJDK/JRE 🤡 | 02:22:20 |
| emily | are you sure? | 02:22:27 |
| emily | you assume that these packages are, themselves, maintained | 02:22:40 |
| emily | damn apparently at least one of them is | 02:22:59 |
| emily | anyway, Atlassian definitely won't support running on an Oracle JDK from 2021 | 02:23:14 |
