Add java25 checks

Signed-off-by: Appu <appu@google.com>

Author: loosebazooka

.github/workflows/ci.yaml

@@ -20,7 +20,7 @@ jobs:
     strategy:
       matrix:
         # sigstore-java still supports Java 11, however, we test it with conformance-tests only
-        java-version: [17, 21]
+        java-version: [17, 21, 25]
       fail-fast: false
 
     concurrency:

build-logic/jvm/src/main/kotlin/build-logic.java.gradle.kts

@@ -25,7 +25,7 @@ tasks.configureEach<JavaExec> {
 
 spotless {
     java {
-        googleJavaFormat("1.24.0")
+        googleJavaFormat("1.35.0")
         licenseHeaderFile("$rootDir/config/licenseHeader")
         // Note if submodule needs to add more exclusions, it should list ALL of them since
         // Spotless does not have "addTargetExclude" method

build-logic/jvm/src/main/kotlin/build-logic.testing.gradle.kts

@@ -22,4 +22,7 @@ tasks.withType<Test>().configureEach {
     if (project.hasProperty("skipStaging")) {
         systemProperty("sigstore-java.test.skipStaging", project.findProperty("skipStaging")!!)
     }
+    if (buildParameters.testJdkVersion >= 23) {
+        jvmArgs("--sun-misc-unsafe-memory-access=deny")
+    }
 }

fuzzing/oss_fuzz_build.sh

@@ -3,7 +3,8 @@
 # TODO: this should be a gradle plugin
 
 # build the fuzzing classes and extract dependencies into $OUT
-./gradlew :fuzzing:copyToFuzzOut -x test -PfuzzOut="$OUT"
+# Exclude spotlessCheck because GJF 1.35.0+ requires JDK 21+ to run, which would crash the build in CIFuzz (currently running on JDK 17).
+./gradlew :fuzzing:copyToFuzzOut -x test -x spotlessCheck -PfuzzOut="$OUT"
 ALL_JARS=""
 for jarfile in $(find $OUT -name *.jar)
 do

sigstore-java/build.gradle.kts

@@ -91,12 +91,12 @@ spotless {
         )
     }
     format("conscrypt", com.diffplug.gradle.spotless.JavaExtension::class.java) {
-        googleJavaFormat("1.24.0")
+        googleJavaFormat("1.35.0")
         licenseHeaderFile("$rootDir/config/conscryptLicenseHeader")
         target("src/*/java/dev/sigstore/encryption/certificates/transparency/*.java")
     }
     format("webPki", com.diffplug.gradle.spotless.JavaExtension::class.java) {
-        googleJavaFormat("1.24.0")
+        googleJavaFormat("1.35.0")
         licenseHeaderFile("$rootDir/config/webPKILicenseHeader")
         target("src/*/java/dev/sigstore/json/canonicalizer/*.java")
     }