diff --git a/sdks/java/container/build.gradle b/sdks/java/container/build.gradle index 711b34b38b82..09fdb189e917 100644 --- a/sdks/java/container/build.gradle +++ b/sdks/java/container/build.gradle @@ -83,5 +83,6 @@ task pushAll { dependsOn ":sdks:java:container:java11:docker" dependsOn ":sdks:java:container:java17:docker" dependsOn ":sdks:java:container:java21:docker" + dependsOn ":sdks:java:container:java25:docker" dependsOn ":sdks:java:container:distroless:pushAll" } diff --git a/sdks/java/container/distroless/build.gradle b/sdks/java/container/distroless/build.gradle index f2e0cd4f45f3..381924fae8ed 100644 --- a/sdks/java/container/distroless/build.gradle +++ b/sdks/java/container/distroless/build.gradle @@ -26,7 +26,8 @@ configurations { dockerDependency } -task pushAll { - dependsOn ":sdks:java:container:distroless:java17:docker" - dependsOn ":sdks:java:container:distroless:java21:docker" +tasks.register('pushAll') { + dependsOn ":sdks:java:container:distroless:java17:docker" + dependsOn ":sdks:java:container:distroless:java21:docker" + // TODO(#35627) add Java25 distroless container once gcr.io/distroless includes java25 } diff --git a/sdks/java/container/java25/build.gradle b/sdks/java/container/java25/build.gradle new file mode 100644 index 000000000000..268c76077075 --- /dev/null +++ b/sdks/java/container/java25/build.gradle @@ -0,0 +1,28 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * License); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an AS IS BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +project.ext { + imageJavaVersion = '25' +} + +// Load the main build script which contains all build logic. +apply from: "../common.gradle" + +dependencies { + dockerDependency project(path: ":sdks:java:container:agent") +} diff --git a/sdks/java/container/java25/java25-security.properties b/sdks/java/container/java25/java25-security.properties new file mode 100644 index 000000000000..390cba510187 --- /dev/null +++ b/sdks/java/container/java25/java25-security.properties @@ -0,0 +1,48 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +# Java 21 java.security properties file override for JVM +# base properties derived from: +# openjdk version "21-ea" 2023-09-19 +# OpenJDK Runtime Environment (build 21-ea+23-1988) +# OpenJDK 64-Bit Server VM (build 21-ea+23-1988, mixed mode, sharing) + +# Java has now disabled TLSv1 and TLSv1.1. We specifically put it in the +# legacy algorithms list to allow it to be used if something better is not +# available (e.g. TLSv1.2). This will prevent breakages for existing users +# (for example JDBC with MySQL). See +# https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8202343 +# for additional details. +jdk.tls.disabledAlgorithms=SSLv3, DTLSv1.0, RC4, DES, \ + MD5withRSA, DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \ + ECDH + +# The raw value from 21-ea for legacyAlgorithms is +# NULL, anon, RC4, DES, 3DES_EDE_CBC +# Because these values are in disabledAlgorithms, it is erroneous to include +# them in legacy (they are disabled in Java 8, 11, and 17 as well). Here we +# only include TLSv1 and TLSv1.1 which were removed from disabledAlgorithms +jdk.tls.legacyAlgorithms=TLSv1, TLSv1.1 + +# /dev/random blocks in virtualized environments due to lack of +# good entropy sources, which makes SecureRandom use impractical. +# In particular, that affects the performance of HTTPS that relies +# on SecureRandom. +# +# Due to that, /dev/urandom is used as the default. +# +# See http://www.2uo.de/myths-about-urandom/ for some background +# on security of /dev/urandom on Linux. +securerandom.source=file:/dev/./urandom \ No newline at end of file diff --git a/sdks/java/container/java25/option-jamm.json b/sdks/java/container/java25/option-jamm.json new file mode 100644 index 000000000000..5647ff66be5c --- /dev/null +++ b/sdks/java/container/java25/option-jamm.json @@ -0,0 +1,12 @@ +{ + "name": "jamm", + "enabled": true, + "options": { + "java_arguments": [ + "--add-modules=jamm", + "--module-path=/opt/apache/beam/jars/jamm.jar", + "--add-opens=java.base/java.lang=jamm", + "--add-opens=java.base/java.util=jamm" + ] + } +} \ No newline at end of file diff --git a/sdks/java/container/java25/option-java25-security.json b/sdks/java/container/java25/option-java25-security.json new file mode 100644 index 000000000000..0376f14532b2 --- /dev/null +++ b/sdks/java/container/java25/option-java25-security.json @@ -0,0 +1,9 @@ +{ + "name": "java-security", + "enabled": true, + "options": { + "properties": { + "java.security.properties": "/opt/apache/beam/options/java25-security.properties" + } + } +} diff --git a/sdks/java/core/src/main/java/org/apache/beam/sdk/util/construction/Environments.java b/sdks/java/core/src/main/java/org/apache/beam/sdk/util/construction/Environments.java index 05ecb21fd956..3020428de47f 100644 --- a/sdks/java/core/src/main/java/org/apache/beam/sdk/util/construction/Environments.java +++ b/sdks/java/core/src/main/java/org/apache/beam/sdk/util/construction/Environments.java @@ -97,7 +97,8 @@ public class Environments { public enum JavaVersion { java11("java11", "11", 11), java17("java17", "17", 17), - java21("java21", "21", 21); + java21("java21", "21", 21), + java25("java25", "25", 25); // Legacy name, as used in container image private final String legacyName; @@ -135,7 +136,7 @@ public static JavaVersion forSpecification(String specification) { specification = specification.substring(2); } int specificationInt = Integer.parseInt(specification); - JavaVersion fallback = java21; + JavaVersion fallback = java25; int minDistance = Integer.MAX_VALUE; for (JavaVersion candidate : JavaVersion.values()) { int distance = candidate.specificationInt - specificationInt; diff --git a/sdks/java/core/src/test/java/org/apache/beam/sdk/util/construction/EnvironmentsTest.java b/sdks/java/core/src/test/java/org/apache/beam/sdk/util/construction/EnvironmentsTest.java index 410b52cba23b..f12a2a77f99b 100644 --- a/sdks/java/core/src/test/java/org/apache/beam/sdk/util/construction/EnvironmentsTest.java +++ b/sdks/java/core/src/test/java/org/apache/beam/sdk/util/construction/EnvironmentsTest.java @@ -298,6 +298,8 @@ public void testLtsJavaVersion() { assertEquals("java17", JavaVersion.java17.legacyName()); assertEquals(JavaVersion.java21, JavaVersion.forSpecification("21")); assertEquals("java21", JavaVersion.java21.legacyName()); + assertEquals(JavaVersion.java25, JavaVersion.forSpecification("25")); + assertEquals("java25", JavaVersion.java25.legacyName()); } @Test @@ -305,14 +307,12 @@ public void testNonLtsJavaVersion() { assertEquals(JavaVersion.java11, JavaVersion.forSpecification("9")); assertEquals(JavaVersion.java11, JavaVersion.forSpecification("10")); assertEquals(JavaVersion.java17, JavaVersion.forSpecification("12")); - assertEquals(JavaVersion.java17, JavaVersion.forSpecification("13")); - assertEquals(JavaVersion.java17, JavaVersion.forSpecification("14")); - assertEquals(JavaVersion.java17, JavaVersion.forSpecification("15")); assertEquals(JavaVersion.java17, JavaVersion.forSpecification("16")); assertEquals(JavaVersion.java21, JavaVersion.forSpecification("18")); - assertEquals(JavaVersion.java21, JavaVersion.forSpecification("19")); assertEquals(JavaVersion.java21, JavaVersion.forSpecification("20")); - assertEquals(JavaVersion.java21, JavaVersion.forSpecification("22")); + assertEquals(JavaVersion.java25, JavaVersion.forSpecification("22")); + assertEquals(JavaVersion.java25, JavaVersion.forSpecification("24")); + assertEquals(JavaVersion.java25, JavaVersion.forSpecification("26")); } @Test(expected = UnsupportedOperationException.class) diff --git a/settings.gradle.kts b/settings.gradle.kts index c867e7ae2314..72c5194ec93d 100644 --- a/settings.gradle.kts +++ b/settings.gradle.kts @@ -170,6 +170,7 @@ include(":sdks:java:container:agent") include(":sdks:java:container:java11") include(":sdks:java:container:java17") include(":sdks:java:container:java21") +include(":sdks:java:container:java25") include(":sdks:java:container:distroless") include(":sdks:java:container:distroless:java17") include(":sdks:java:container:distroless:java21")