Skip to content

chore: use Java 21 for building sigstore-java #1044

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Nov 10, 2025
Merged

chore: use Java 21 for building sigstore-java #1044

merged 1 commit into from
Nov 10, 2025

Conversation

@vlsi
Copy link
Collaborator

@vlsi vlsi commented Aug 7, 2025

Summary

This change bumps JDK we use when building the project, and it is mainly to avoid known bugs in the toolchain.

The resulting binaries should still be compatible with Java 11.

At the same time, the commit skips "./gradlew test" checks for Java 11, and we still execute tests with Java 11 via conformance.yml.

It would allow us to bump testing libraries as some of them require Java 17.

Release Note

  • Require Java 21 when building sigstore-java. The resulting artifacts are still compatible with Java 11

Documentation

NONE

@vlsi vlsi added the chore label Aug 7, 2025
@vlsi vlsi force-pushed the build_jdk21 branch 3 times, most recently from 8710430 to 3fab0dd Compare August 7, 2025 06:36
@vlsi
Copy link
Collaborator Author

vlsi commented Aug 7, 2025 

> Task :sigstore-java:forbiddenApisMain
Forbidden method invocation: java.net.URL#<init>(java.lang.String) [Deprecated in Java 21]
  in dev.sigstore.tuf.SigstoreTufClient$Builder (SigstoreTufClient.java:77)
Forbidden method invocation: java.net.URL#<init>(java.lang.String) [Deprecated in Java 21]
  in dev.sigstore.tuf.SigstoreTufClient$Builder (SigstoreTufClient.java:92)
Forbidden method invocation: java.net.URL#<init>(java.lang.String) [Deprecated in Java 21]
  in dev.sigstore.tuf.SigstoreTufClient$Builder (SigstoreTufClient.java:132)
Forbidden method invocation: java.net.URL#<init>(java.lang.String) [Deprecated in Java 21]
  in dev.sigstore.tuf.SigstoreTufClient$Builder (SigstoreTufClient.java:133)
Forbidden method invocation: java.net.URL#<init>(java.lang.String) [Deprecated in Java 21]

Should we prefer using URI in sigstore-java public APIs like public Builder tufMirror(URL mirror, RootProvider trustedRoot) {?

new URI has a new checked exception URISyntaxException which we probably need to wrap with the existing MalformedURLException

@loosebazooka
Copy link
Member

loosebazooka commented Aug 7, 2025

Should we prefer using URI in sigstore-java public APIs

sure go for it.

@loosebazooka
Copy link
Member

loosebazooka commented Aug 12, 2025

I can adjust for and fix this problem with URI/URL.

@loosebazooka
Copy link
Member

loosebazooka commented Aug 13, 2025

There's some confusion in sigstore-testkit/src/main/kotlin/dev/sigstore/testkit/BaseGradleTest.kt, I'm not super sure how to resolve testing compatibility.

@loosebazooka loosebazooka mentioned this pull request Aug 13, 2025
Merged
@vlsi vlsi force-pushed the build_jdk21 branch 3 times, most recently from 62b3400 to 8834302 Compare November 10, 2025 07:50
@vlsi
Copy link
Collaborator Author

vlsi commented Nov 10, 2025 •
edited
Loading

Looks like ossfuzz hard-codes Java 17 in its builder image: https://github.com/google/oss-fuzz/tree/ce8bd4360b38fd6a4f83c27de5ecee2d0fe24e49/infra/base-images/base-builder-jvm

It sounds like an unfortunate decision.

See:

@vlsi vlsi force-pushed the build_jdk21 branch 4 times, most recently from 65cc790 to 4ec4b08 Compare November 10, 2025 09:04
@vlsi
chore: use Java 21 for building sigstore-java
24dad1e 
This change bumps JDK we use when building the project, and it is mainly
to avoid known bugs in the toolchain.

The resulting binaries should still be compatible with Java 11.

At the same time, the commit skips "./gradlew test" checks for Java 11,
and we still execute tests with Java 11 via conformance.yml.

It would allow us to bump testing libraries as some of them require Java 17.

Signed-off-by: Vladimir Sitnikov <[email protected]>
@vlsi
Copy link
Collaborator Author

vlsi commented Nov 10, 2025

@loosebazooka , I think this is workable except build (11) is still in "required CI checks".
WDYT of replacing "build (11)" required check with "build (21)"?

@vlsi vlsi merged commit 7082fbe into sigstore:main Nov 10, 2025
15 checks passed
@loosebazooka
Copy link
Member

loosebazooka commented Nov 10, 2025

I don't know how this passed on this PR with gradle 7.X. I'll have to go update that test to skip gradle 7.X for java 21+

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@loosebazooka loosebazooka loosebazooka approved these changes

Assignees

No one assigned

Labels

chore

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@vlsi @loosebazooka