We can keep it, but mark it as insecure.

I've constrained this to 10.0.1 -> 10.0.2 since I'm not sure how to deal with the insecure mark.

I'm referring to meta. knownVulnerabilities , here are some examles: https://search.nix.gsc.io/?q=knownVulnerabilities%20%3D&i=nope&files=&repos=
That results in an error message like this, but still allows the user to bypass it if a working build is more important to them.

Known issues:
 - CVE-2013-1953

You can install it anyway by whitelisting this package, using the
following methods:

a) for `nixos-rebuild` you can add ‘autotrace-0.31.1’ to
   `nixpkgs.config.permittedInsecurePackages` in the configuration.nix,
   like so:

     {
       nixpkgs.config.permittedInsecurePackages = [
         "autotrace-0.31.1"
       ];
     }

b) For `nix-env`, `nix-build`, `nix-shell` or any other Nix command you can add
‘autotrace-0.31.1’ to `permittedInsecurePackages` in
~/.config/nixpkgs/config.nix, like so:

     {
       permittedInsecurePackages = [
         "autotrace-0.31.1"
       ];
     }

Right, I know about the option, but the way the oraclejdks are set up, this would require duplicating the content of the general package since it has no meta parameterization or passthrough.

@andir any opinions here? I think it's still important to get this into 18.03 before it's EOL'd completely.

@samueldr thanks for the ping. We should definitly get the fixes in to 18.03.

@srhb How about just changing the PSU release to something like shown below? It is probably not the pretties we could come up with but that should get the job done.

{ callPackage, ... }@_args:
let
  drv = import ./jdk-linux-base.nix {
    productVersion = "8";
    patchVersion = "172";
    downloadUrl = http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html;
    sha256.i686-linux = "0csskx8xis0dr1948j76fgrwwsj4gzdbjqfi7if4v4j62b9i0hqa";
    sha256.x86_64-linux = "0inkx73rwv7cvn9lqcr3hmnm0sr89h1fh29yamikb4dn02a0p818";
    sha256.armv7l-linux = "1576cb0rlc42dsnmh388gy1wjas7ac6g135s8h74x8sm4b56qpln";
    sha256.aarch64-linux = "0zpkmq8zxmpifawj611fg67srki63haz02rm6xwfc5qm2lxx5g6s";
    jceName = "jce_policy-8.zip";
    jceDownloadUrl = http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html;
    sha256JCE = "0n8b6b8qmwb14lllk2lk1q1ahd3za9fnjigz5xn65mpg48whl0pk";
  };
  args = removeAttrs _args ["callPackage"];
in
(callPackage drv args).overrideAttrs (attrs: {
  meta = attrs.meta // {
    knownVulnerabilities = [ "CVE-XXX-YYYYY" ];
  };
})

Thanks @andir, I had something similar but was unable to test it since Oracles website apparently has some draconic requirements before you can even get at the archived versions.

I propose clicking the button and getting the 10.0.1 -> 10.0.2 bump done and raising a separate issue for marking the psu release insecure. I'll leave oracle backports to others in the future to avoid similar hold-ups. Apologies. :)