On 10/15/2018 11:37 AM, Mark Thomas wrote:
On 15/10/18 18:53, Berneburg, Cris J. - US wrote:
Hi Folks
What has anyone been thinking about the upcoming Oracle Java 11 release /
support stuff? Frankly, I'm confused by it all and am still trying to wrap my
brain around it. I have concerns about the potential implications for my
little project, and also wonder about Tomcat at large.
No JRE - huh? How do we run Java apps w/o a Java runtime? Wouldn't installing
a JDK in production be kind of a security issue? I can imagine security
departments not being thrilled about that. Does Tomcat support being run on an
OpenJRE?
The argument for a JRE vs a JDK is that the JDK includes a compiler. The
only reason Tomcat can run on a JRE and still support JSPs (which
require compilation) is that Tomcat includes a Java compiler. I don't
think the security argument holds much water.
OpenJDK is very close to the Oracle JDK these days. I regularly run
Tomcat's unit tests with the latest OpenJDK and have yet to find an
issue that is OpenJDK specific.
I asked Gil Tene about this a couple of weeks ago. Gil is a co-founder
of Azul Systems, an OpenJDK committer, and on the Executive Committee of
the JCP. My understanding from him is that there is no JDK development
outside of the OpenJDK. The Oracle developers that work on the JDK
commit directly to OpenJDK. Oracle might add some other things when
they package their edition of the JDK for distribution, but the JDK
itself is the same one from OpenJDK.
The main problem with the rapid release cycle and six month support is
that due to late adoption, many of the bugs in a given Java release are
only discovered after more than six months of the release date. That
means that the free support will end while bugs and vulnerabilities are
being discovered, forcing many organizations to pay for support.
Azul Systems provide their own packaging of the OpenJDK, under the name
Azul Zulu [1]. They offer a longer support than the Oracle one, and add
a Medium Term Support period. I've been planning to test it out but
haven't gotten a chance to do so yet.
Tomcat runs happily (and is supported) on a JRE.
If the JRE has passed the Java TCK then Tomcat should run on it. I don't
think there is an official Tomcat position but my expectation is if a
Tomcat bug (as opposed to a Java bug) appears when running on any Java
implementation that has passed the TCK then the Tomcat team would treat
that as a Tomcat bug and fix it. The caveat is that any such fix is a
lot easier if we have access to that particular version of Java and a
platform to run it on.
Are there any implications for Tomcat?
Not directly. Jakarta EE will need to make a decision about minimum Java
versions and the like for the next round of spec updates. I expect
they'll settle on Java 11 but that discussion hasn't really started yet.
I'd be more concerned that Oracle are starting to charge for production
usage. That alone would be enough for me to switch to OpenJDK.
I haven't yet got around to installing a Java 11 GA release. I'm still
using one of the final EA releases. I'm currently intending to only
install OpenJDK for Java 11 onwards. I'm not expecting this to cause me
any issues.
+1
I am imagining spending all my time being taken up by Java upgrades with
subsequent builds, regression testing, red tape, and deployments, without
delivering any actual new value to our customer. :-\
I'd plan to stick to the LTS releases.
+1
Igal
[1] https://www.azul.com/downloads/zulu/
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org
