So many JDKs ... Which one to use and what does it threaten with?

Original author: Fernando Almeida
  • Transfer

From the translator: The decision to translate this article did not come by itself - rather, it is a necessary measure :). We, as vendors of the CUBA framework, are treated with an enviable regularity. Of course, this is also an extremely important topic for us, and in response to recent changes, we raised test benches on both Oracle JDK and OpenJDK - this measure currently protects our users from unforeseen licensing expenses. However, this topic is not yet closed, and we continue to closely monitor developments, and, who knows, we may have to add stands for some other JDK assemblies next year ...


The article under the cat is captivating by the fact that it succinctly describes the problems and the most popular JDK with their features.


Recently, Oracle announced that the evolution of Java will change dramatically due to the transition to the "Release Train" - a new approach to rolling out versions. This change also brought about changes in terms of versioning, which will now not be implemented for everyone, but only for LTS versions . The champions java community explained the innovations being introduced, a detailed document is available online .


Even with this news, there are still questions: what JDK builds are now available? Will they be free or commercial? Before answering this question, it is important to understand what requirements are placed on the JDK as a product. In fact, there is only one primary source code for the JDK. He is here . Anyone can use the source code to build their own build and place it somewhere on the network. However, there is a separate certification procedure that must be passed in order for the JDK assembly to be considered valid. The certification is done by the Java Community Process (JCP), which is provided by the Technology Compatibility Kit (TCK). If an organization creates a new OpenJDK build that responds to TCK, it is considered "Java SE compatible."


Keep in mind that the assembly cannot be called "Java SE" if the company that performed the assembly did not purchase a commercial license from Oracle. For example, AdoptOpenJDK assemblies that pass TCK are not "Java SE", but are "Java SE compliant". It should also be borne in mind that certification is now based “on parole” - the results are not sent to the JCP / Oracle for verification and are classified information. In short, every vendor that has taken the OpenJDK sources and compiled a version spawns another separate JDK build.


OpenJDKbilds


So, without further ado, we recommend that you familiarize yourself with the following JDKs that are ready for use:


Oracle jdk


This is the main supplier of Java 11 (the release has already taken place). This is a commercial version with paid support. It can be downloaded for free and used only directly for development. It is impossible to use it in production without paying Oracle (so for many people who are not interested in licensing issues this is a trap). Oracle plans to provide paid support until 2026 and beyond. Unlike how it was before, the Oracle JDK build is not “better” than OpenJDK (as many are both at the same security patch level).


Oracle OpenJDK Build


There is a free non-branded version of OpenJDK , licensed under the GPL with Classpath Extension (suitable for commercial use). These build versions are only available for 6 months after release. For Java 11, Java 11.0.0 and two security patches, 11.0.1 and 11.0.2 are expected. To continue using the version of OpenJDK and its patches from Oracle, you need to switch to Java 12 no later than one month after launch. Please note that the procedure for providing security patches is different from the procedure for providing support, which includes payment for processing error reports.


AdoptOpenJDK


These are also free and non-branded OpenJDK builds licensed under the GPL with Classpath Extension, but unlike Oracle’s OpenJDK builds, these build versions will last longer for major versions such as Java 11. Java 11 versions will be released for 4 years one year after the next major release. AdoptOpenJDK is community oriented. While other teams create and publish security fixes for the original OpenJDK repository, they will release builds. Both IBM and Red Hat have indicated that they intend to release such patches.


AdoptOpenJDK OpenJ9


In addition to the standard OpenJDK builds, AdoptOpenJDK will also provide versions with OpenJ9 instead of HotSpot. OpenJ9 was originally an IBM JVM, but now OpenJ9 is open source. And, by the way, this option is the most worthy of study.


Red Hat OpenJDK


Red Hat provides OpenJDK build versions on Red Hat Enterprise Linux (RHEL), which is a commercial product with paid support. Red Hat does a pretty good job with security fixes in OpenJDK. In the past, Red Hat was responsible for Java 6 and 7 security updates. The Red Hat build is more integrated with the operating system, so it cannot be called a typical OpenJDK build (there is no end-user JDK).


Azul zulu


Zulu is a branded version of OpenJDK with paid commercial support. In addition, while Azul provides some elements of Zulu for free as part of the Zulu Community, they do not have any special obligations regarding the availability of these assemblies. Azul has a fairly large-scale plan for supporting Zulu, which includes support for Java 9, 13 and 15 , unlike other vendors.


Amazon corretto


This is the newest of all the options described. Corretto is a free version of the OpenJDK build with long-term support, running TCK. It is distributed under standard licensing terms for all versions of OpenJDK: GPL + CE. Amazon will create its own patches and launch Corretto on AWS, so it will be used quite actively (and has already been added to some products). Java 8 support is planned at least until June 2023.


In the process of converting the original OpenJDK into different versions of the assembly, the manufacturer can add various utilities or brand the product, if this does not prevent certification (TCK). For example, you cannot add a new public method to the API or new language resources.


There are other JDK implementations, such as IBM and SAPMachine. However, these build versions are not as frequently used, so they are not mentioned in this article. More information can be found here and here .


Conclusion


Personally, I don’t see a particular problem in having multiple versions of the JDK, since they all need to be certified (TCK). What is really worth worrying about is using one of the proprietary JDK and the free version of the assembly from Oracle, in order to avoid a headache in the future. If you use only basic functions (for example, your business is not particularly dependent on security updates), Oracle's OpenJDK assemblies (NOT OracleJDK) are more suitable for you, since they are constantly updated (within 6 months after the release), and you can use the JDK in production without any problems. If your business has cloud services (or AWS), AWS Corretto, which is already usable on Amazon Linux and Docker , is a good choice .

Only registered users can participate in the survey. Sign in , please.

And which JDK are you using (or are you going to switch)?


Also popular now: