Add Java25 container

sdks/java/container/build.gradle

@@ -83,5 +83,6 @@ task pushAll {
   dependsOn ":sdks:java:container:java11:docker"
   dependsOn ":sdks:java:container:java17:docker"
   dependsOn ":sdks:java:container:java21:docker"
+  dependsOn ":sdks:java:container:java25:docker"
   dependsOn ":sdks:java:container:distroless:pushAll"
 }

sdks/java/container/distroless/build.gradle

@@ -26,7 +26,8 @@ configurations {
     dockerDependency
 }
 
-task pushAll {
-    dependsOn ":sdks:java:container:distroless:java17:docker"
-    dependsOn ":sdks:java:container:distroless:java21:docker"
+tasks.register('pushAll') {
+  dependsOn ":sdks:java:container:distroless:java17:docker"
+  dependsOn ":sdks:java:container:distroless:java21:docker"
+  // TODO(#35627) add Java25 distroless container once gcr.io/distroless includes java25
 }

sdks/java/container/java25/build.gradle

@@ -0,0 +1,28 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * License); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an AS IS BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+project.ext {
+    imageJavaVersion = '25'
+}
+
+// Load the main build script which contains all build logic.
+apply from: "../common.gradle"
+
+dependencies {
+    dockerDependency project(path: ":sdks:java:container:agent")
+}

sdks/java/container/java25/java25-security.properties

@@ -0,0 +1,48 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements.  See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License.  You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Java 21 java.security properties file override for JVM
+# base properties derived from:
+# openjdk version "21-ea" 2023-09-19
+# OpenJDK Runtime Environment (build 21-ea+23-1988)
+# OpenJDK 64-Bit Server VM (build 21-ea+23-1988, mixed mode, sharing)
+
+# Java has now disabled TLSv1 and TLSv1.1. We specifically put it in the
+# legacy algorithms list to allow it to be used if something better is not
+# available (e.g. TLSv1.2). This will prevent breakages for existing users
+# (for example JDBC with MySQL). See
+# https://bugs.java.com/bugdatabase/view_bug.do?bug_id=JDK-8202343
+# for additional details.
+jdk.tls.disabledAlgorithms=SSLv3, DTLSv1.0, RC4, DES, \
+    MD5withRSA, DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \
+    ECDH
+
+# The raw value from 21-ea for legacyAlgorithms is
+#  NULL, anon, RC4, DES, 3DES_EDE_CBC
+# Because these values are in disabledAlgorithms, it is erroneous to include
+# them in legacy (they are disabled in Java 8, 11, and 17 as well). Here we 
+# only include TLSv1 and TLSv1.1 which were removed from disabledAlgorithms
+jdk.tls.legacyAlgorithms=TLSv1, TLSv1.1
+
+# /dev/random blocks in virtualized environments due to lack of
+# good entropy sources, which makes SecureRandom use impractical.
+# In particular, that affects the performance of HTTPS that relies
+# on SecureRandom.
+#
+# Due to that, /dev/urandom is used as the default.
+#
+# See http://www.2uo.de/myths-about-urandom/ for some background
+# on security of /dev/urandom on Linux.
+securerandom.source=file:/dev/./urandom

sdks/java/container/java25/option-jamm.json

@@ -0,0 +1,12 @@
+{
+  "name": "jamm",
+  "enabled": true,
+  "options": {
+    "java_arguments": [
+      "--add-modules=jamm",
+      "--module-path=/opt/apache/beam/jars/jamm.jar",
+      "--add-opens=java.base/java.lang=jamm",
+      "--add-opens=java.base/java.util=jamm"
+    ]
+  }
+}

sdks/java/container/java25/option-java25-security.json

@@ -0,0 +1,9 @@
+{
+  "name": "java-security",
+  "enabled": true,
+  "options": {
+    "properties": {
+      "java.security.properties": "/opt/apache/beam/options/java25-security.properties"
+    }
+  }
+}

sdks/java/core/src/main/java/org/apache/beam/sdk/util/construction/Environments.java

@@ -97,7 +97,8 @@ public class Environments {
   public enum JavaVersion {
     java11("java11", "11", 11),
     java17("java17", "17", 17),
-    java21("java21", "21", 21);
+    java21("java21", "21", 21),
+    java25("java25", "25", 25);
 
     // Legacy name, as used in container image
     private final String legacyName;
@@ -135,7 +136,7 @@ public static JavaVersion forSpecification(String specification) {
         specification = specification.substring(2);
       }
       int specificationInt = Integer.parseInt(specification);
-      JavaVersion fallback = java21;
+      JavaVersion fallback = java25;
       int minDistance = Integer.MAX_VALUE;
       for (JavaVersion candidate : JavaVersion.values()) {
         int distance = candidate.specificationInt - specificationInt;

sdks/java/core/src/test/java/org/apache/beam/sdk/util/construction/EnvironmentsTest.java

@@ -298,21 +298,21 @@ public void testLtsJavaVersion() {
     assertEquals("java17", JavaVersion.java17.legacyName());
     assertEquals(JavaVersion.java21, JavaVersion.forSpecification("21"));
     assertEquals("java21", JavaVersion.java21.legacyName());
+    assertEquals(JavaVersion.java25, JavaVersion.forSpecification("25"));
+    assertEquals("java25", JavaVersion.java25.legacyName());
   }
 
   @Test
   public void testNonLtsJavaVersion() {
     assertEquals(JavaVersion.java11, JavaVersion.forSpecification("9"));
     assertEquals(JavaVersion.java11, JavaVersion.forSpecification("10"));
     assertEquals(JavaVersion.java17, JavaVersion.forSpecification("12"));
-    assertEquals(JavaVersion.java17, JavaVersion.forSpecification("13"));
-    assertEquals(JavaVersion.java17, JavaVersion.forSpecification("14"));
-    assertEquals(JavaVersion.java17, JavaVersion.forSpecification("15"));
     assertEquals(JavaVersion.java17, JavaVersion.forSpecification("16"));
     assertEquals(JavaVersion.java21, JavaVersion.forSpecification("18"));
-    assertEquals(JavaVersion.java21, JavaVersion.forSpecification("19"));
     assertEquals(JavaVersion.java21, JavaVersion.forSpecification("20"));
-    assertEquals(JavaVersion.java21, JavaVersion.forSpecification("22"));
+    assertEquals(JavaVersion.java25, JavaVersion.forSpecification("22"));
+    assertEquals(JavaVersion.java25, JavaVersion.forSpecification("24"));
+    assertEquals(JavaVersion.java25, JavaVersion.forSpecification("26"));
   }
 
   @Test(expected = UnsupportedOperationException.class)

settings.gradle.kts

@@ -170,6 +170,7 @@ include(":sdks:java:container:agent")
 include(":sdks:java:container:java11")
 include(":sdks:java:container:java17")
 include(":sdks:java:container:java21")
+include(":sdks:java:container:java25")
 include(":sdks:java:container:distroless")
 include(":sdks:java:container:distroless:java17")
 include(":sdks:java:container:distroless:java21")