Thanks Mark

mt> The argument for a JRE vs a JDK is that the JDK includes
mt> a compiler. The only reason Tomcat can run on a JRE and
mt> still support JSPs (which require compilation) is that
mt> Tomcat includes a Java compiler. I don't think the
mt> security argument holds much water.

I had not thought of that, and you're right (literally technically speaking).

RAMBLE: However, if I try to look at it from a point of view of a large 
bureaucracy, of which I am largely ignorant, I would not be surprised if there 
is a policy against dev kits and IDE's on production servers for security sake. 
 Tomcat (whisper: with built-in compiler) is approved, but is the JDK allowed?  
Guess I can ask.  Yeah, it's potentially a "distinction without a difference".  
Well, unless there are other tools in the JDK that can pose security risks in 
addition to the Java compiler.

mt> OpenJDK is very close to the Oracle JDK these days. I
mt> regularly run Tomcat's unit tests with the latest OpenJDK
mt> and have yet to find an issue that is OpenJDK specific.
mt>
mt> Tomcat runs happily (and is supported) on a JRE.
mt>
mt> If the JRE has passed the Java TCK then Tomcat should run
mt> on it. I don't think there is an official Tomcat position
mt> but my expectation is if a Tomcat bug (as opposed to a
mt> Java bug) appears when running on any Java implementation
mt> that has passed the TCK then the Tomcat team would treat
mt> that as a Tomcat bug and fix it.

All good to know.

cjb> I am imagining spending all my time being taken up by
cjb> Java upgrades with subsequent builds, regression testing,
cjb> red tape, and deployments

mt> I'd plan to stick to the LTS releases.

Meh, not my call.  Whatever the Powers That Be decide for the production 
environment, I'll probably match that in dev.  If they decide LT$ is the way to 
go, using the JDK will cost nothing for my dev environment anyway.  But if 
OpenJDK and frequent updates are selected ... phooey.

--
Cris Berneburg
CACI Lead Software Engineer


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org

Reply via email to