/marvin opt-in
/status needs_reviewer

Hi! I'm an experimental bot. My goal is to guide this PR through its stages, hopefully ending with a merge. You can read up on the usage here.

/status needs_merger

I hope I'm doing it all right. Not only with the bot, but with the workflow in general.

Since this is a backport, have you looked at the changelog and made sure that there are no potentially breaking changes? We do not want to disrupt anybody's workflow on a stable system.

@timokau since this is a point release of JDK, I wouldn't expect any breaking changes, only bugfixes and security patches. https://foojay.io/java-11/?quarter=102020&tab=highlights&version=11.0.9 confirms my suspicions - lots of bugfixes, some security patches.

@timokau @kisik21 I guess the only thing which may generate some trouble is: https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8233228

At least this popped in one of my projects.

@asbachb citing the issue you linked:

The risk level of this change is minimal as users can change the security properties to re-enable all or some of the curves. The risk level to the release is minimal as it's very localized to the security APIs.

Can we somehow provide documentation for users to do that on their own if they need those curves?

@kisik21 I guess normally you'd adjust java.security file. I think in NixOs there's currently no way todo adjustments to that file via configuration. So the only way for an end user would be to pass a system argument java.security.properties to set an own java.security file.

I guess same would apply to #102839

Then I guess we can merge this one too. Maybe the update disabling less secure curves will make some users migrate to stronger cryptography? 😸

since this is a point release of JDK, I wouldn't expect any breaking changes

That's reasonable, but it can't hurt to double check. openjdk is a very central package, and not all projects assign the same meaning to "point release".

Thanks for checking! I think the issue you linked is fine, since its a very minor regression and security-relevant.