There are now several providers of builds of OpenJDK. In this presentation, we look at what aspects of a JDK distribution you should consider when making a choice.

1. © Copyright Azul Systems 2020
© Copyright Azul Systems 2015
@speakjava
How To Choose A JDK
Simon Ritter
Deputy CTO, Azul Systems
1

2. © Copyright Azul Systems 2020 2

3. © Copyright Azul Systems 2020
Java Platform Module System (JPMS)
 The core Java libraries are now a set of modules (JEP 220)
– 75 OpenJDK modules:
 24 Java SE
 2 aggregator modules
 1 smartcard (???)
 48 JDK
 Most internal APIs now encapsulated (JEP 260)
– sun.misc.Unsafe
– Some can be used with command line options
3

4. © Copyright Azul Systems 2020
JDK 9 Onwards And Compatibility
4
"Clean applications that just depend on java.se
should just work" - Oracle

5. © Copyright Azul Systems 2020
JDK 9: The Clean Up Starts
 Java has had deprecation since JDK 1.1
 453 deprecated elements in JDK 8
 Zero removed
 JDK 9
 6 methods removed from standard class libraries
 1 class removed from JAAS
 Redundant features eliminated (jhat, hprof agent)
 JDK 10
 1 package, 6 classes, 9 methods and 1 field
 More features will be removed in the future
 CMS GC, Nashorn and Pack200 all deprecated. Others?
5

6. © Copyright Azul Systems 2020
JDK 11: Modules Removed
– The java.se.ee aggregator-module has been removed
 java.corba
 java.transaction
 java.activation
 java.xml.bind
 java.xml.ws
 java.xml.ws.annotation
– Modules turned off in JDK 9
 Both compilation and runtime
6

7. © Copyright Azul Systems 2020
Compatibility Not Guaranteed
 New versions of Java may include breaking changes
– Anything for removal will be deprecated first
– Minimum of one release warning
 Could be only six months
7

8. © Copyright Azul Systems 2020
Moving Java Forward Faster

9. © Copyright Azul Systems 2020
OpenJDK: New Release Model
 A new version of the JDK is released every six months
– March and September
– 2018: JDK 10 and 11, 2019: JDK 12 and 13
– Continuing this year with JDK 14 and JDK 15
 OpenJDK development is more agile
– Previous target was a release every two years
 Features are only included when ready
– Targeted for a release when feature complete
9

10. © Copyright Azul Systems 2020
Long Term Support Releases
 Long term support for all releases is not practical
– One Long Term Support (LTS) release every three years
– For the Oracle JDK binary
 JDK 8 was classified as an LTS release
 Last JDK 8 public update in January 2019 for commercial users
 Non-commercial users get updates until December 2020
 JDK 11 is an LTS release
 JDK 9, 10, 12 and 13 were feature releases
 Updated only until next release
10

11. © Copyright Azul Systems 2020
Oracle JDK Binaries
 Traditional Oracle branded binary (java.oracle.com)
– Oracle Binary Code License (FoU restrictions)
 New Oracle OpenJDK binary (jdk.java.net)
– GPLv2 with CPE license (no restrictions)
– Security and bug fix updates only for six months
 Only until next JDK release
 Two scheduled updates
11

12. © Copyright Azul Systems 2020
Converged Binaries
Oracle JDK
OpenJDK
Java SE
JDK 10 and earlier
Java SE
OpenJDK
& Oracle JDK
JDK 11 and later

13. © Copyright Azul Systems 2020
Converged Binaries (JDK 11)
 Some closed-source parts of the JDK open-sourced
– Flight recorder
– Mission control
– Others
 Other closed-source parts removed
– Browser Plugin (Oracle support ceased March 2019)
– Java Web Start
– JavaFX
13

14. © Copyright Azul Systems 2020
Java Updates
 Oracle JDK binary has LTS versions (JDK 11, 17, etc.)
– Oracle OpenJDK only updated for six months
 Oracle JDK 11 released under a different license (OTNLA)
– Free for development and testing
– Requires a Java SE subscription for use in production
 JDK 8 can be used indefinitely for free
– But only JDK8u202 and earlier
– License for JDK8u211 and later is OTNLA
– If you download and use in production you can get audited
14

15. © Copyright Azul Systems 2020
Java Security
 CVE: Common Vulnerabilities and Exposures
 CVSS: Common Vulnerability Scoring System
 Base Score between 0 and 10
 Combination of Access Vector, Attack Complexity, Authentication
15
*All Software Platforms, including Java
High
Critical

16. © Copyright Azul Systems 2020
How Important Are Updates?
CPU Date Highest CVSS Impacted JDK
Versions
January 2020
October 2019
July 2019
8.1
6.8 (multiple)
6.8
7,8,11,13
7,8,11,13
7,8,11,12
April 2019 9.0 8
January 2019 6.1 6,7,8,11
October 2018 9.0 8,11
July 2018 5.9 6,7,8,10
April 2018 8.3 6,7,8,9,10
January 2018 8.3 (multiple) 6,7,8,9
October 2017 9.6 (multiple) 6,7,8,9
July 2017 9.6 (multiple) 7,8
April 2017 8.3 (multiple) 6,7,8
January 2017 9.6 (multiple) 7,8

17. © Copyright Azul Systems 2020
OpenJDK Vulnerability Group
 Secure, private forum
– Trusted members of OpenJDK
– Receive reports of vulnerabilities and review them
– Collaborate on producing fixes
– Co-ordinate release of fixes
 Main OpenJDK distributors represented
 Oracle, Red Hat, Azul, Amazon, IBM, AdoptOpenJDK, SAP,
BellSoft, Twitter

18. © Copyright Azul Systems 2020
JCP Golden Triangle
Specifications (JSRs)
Reference
Implementation (RI)
Technology
Compatibility Kit
(TCK)
Can you build it?
Is the spec.
unambiguous?
Does the RI conform to the spec?

19. © Copyright Azul Systems 2020
JDK Testing
 Java Standard Edition (SE)
– The specification
 JSR 379, 383, 384, 386, 388, 389, 390
– Reference implementation
 OpenJDK
– Technology Compatibility Kit (TCK)
 Sometimes referred to as the Java Compatibility Kit (JCK)
 Over 150,000 tests
 Licensed under Oracle Community TCK License Agreement (OCTLA)
19

20. © Copyright Azul Systems 2020
CPU and PSU
 Oracle provide two versions of each update
 Critical Patch Update (CPU)
– Only security related patches
– Designed for quick roll out with minimal testing
– Ensure maximum level of security protection
 Patch Set Update (PSU)
– All updates: Security, bug-fix, enhancement
– User can run full regression tests before deployment
– Ensure maximum level of stability
20

21. © Copyright Azul Systems 2020
Alternative OpenJDK
Binaries

22. © Copyright Azul Systems 2020

23. © Copyright Azul Systems 2020
AdoptOpenJDK
 Started in 2017
 Free community builds of OpenJDK and OpenJ9
 Supporting some more esoteric platforms
– AIX on PPC
– Solaris on SPARC and x64
– Linux on S390
 Many commercial sponsors (including Azul as platinum)
23

24. © Copyright Azul Systems 2020
Zulu Community
 Azul’s FREE binary distribution of OpenJDK
– Passes all TCK tests
 JDK 7, 8, 9, 10, 11, 12 and 13 available
– JDK 14 and 15 in Early Access
 Wide platform support:
– Intel 64-bit Windows, Mac, Linux
– Intel 32-bit Windows and Linux
– ARM 32 and 64-bit
24
www.azul.com/downloads/zulu

25. © Copyright Azul Systems 2020
Zulu Enterprise
 Enhanced build of OpenJDK source code
 Fully TCK tested
 JDK 6, 7, 8 and 11
 TLS1.3, Flight Recorder backports
 Wide platform support:
 Intel 64-bit Windows, Mac, Linux
 Intel 32-bit Windows and Linux
 Verified non-contaminating (GPL) builds
 24x7x365 support call logging
– Follow-the-sun resolution
25

26. © Copyright Azul Systems 2020
Summary

27. © Copyright Azul Systems 2020
Choosing Your Java Distribution
 Does the provider deliver:
– TCK tested binaries?
– Updates within a time defined by an SLA?
– All security patches and bug fixes for all updates?
– CPUs, PSUs or both?
– Is there someone to call if you have a problem?
27

28. © Copyright Azul Systems 2020
© Copyright Azul Systems 2015
@speakjava
Thank You
Simon Ritter
Deputy CTO, Azul Systems
28