Add java25 checks

Upgrade mock-oauth2-server to 5.0.2 and skip tests on JDK16 and below using
JUnit 5 annotations for mock-oauth-server

Signed-off-by: Appu <appu@google.com>

Author: loosebazooka

.github/workflows/ci.yaml

@@ -20,7 +20,7 @@ jobs:
     strategy:
       matrix:
         # sigstore-java still supports Java 11, however, we test it with conformance-tests only
-        java-version: [17, 21]
+        java-version: [17, 21, 25]
       fail-fast: false
 
     concurrency:

build-logic/jvm/src/main/kotlin/build-logic.java.gradle.kts

@@ -25,7 +25,7 @@ tasks.configureEach<JavaExec> {
 
 spotless {
     java {
-        googleJavaFormat("1.24.0")
+        googleJavaFormat("1.35.0")
         licenseHeaderFile("$rootDir/config/licenseHeader")
         // Note if submodule needs to add more exclusions, it should list ALL of them since
         // Spotless does not have "addTargetExclude" method

build-logic/jvm/src/main/kotlin/build-logic.testing.gradle.kts

@@ -22,4 +22,7 @@ tasks.withType<Test>().configureEach {
     if (project.hasProperty("skipStaging")) {
         systemProperty("sigstore-java.test.skipStaging", project.findProperty("skipStaging")!!)
     }
+    if (buildParameters.testJdkVersion >= 23) {
+        jvmArgs("--sun-misc-unsafe-memory-access=deny")
+    }
 }

fuzzing/oss_fuzz_build.sh

@@ -3,7 +3,8 @@
 # TODO: this should be a gradle plugin
 
 # build the fuzzing classes and extract dependencies into $OUT
-./gradlew :fuzzing:copyToFuzzOut -x test -PfuzzOut="$OUT"
+# Exclude spotlessCheck because GJF 1.35.0+ requires JDK 21+ to run, which would crash the build in CIFuzz (currently running on JDK 17).
+./gradlew :fuzzing:copyToFuzzOut -x test -x spotlessCheck -PfuzzOut="$OUT"
 ALL_JARS=""
 for jarfile in $(find $OUT -name *.jar)
 do

sigstore-java/build.gradle.kts

@@ -10,6 +10,14 @@ plugins {
 
 description = "A Java client for signing and verifying using Sigstore"
 
+// allow java17 test dependencies even if test java version is < 17 (like 11)
+configurations.testCompileClasspath {
+    attributes.attribute(TargetJvmVersion.TARGET_JVM_VERSION_ATTRIBUTE, 17)
+}
+configurations.testRuntimeClasspath.configure {
+    attributes.attribute(TargetJvmVersion.TARGET_JVM_VERSION_ATTRIBUTE, 17)
+}
+
 dependencies {
     compileOnly("org.immutables:gson:2.12.2")
     compileOnly("org.immutables:value-annotations:2.12.2")
@@ -50,7 +58,7 @@ dependencies {
     testImplementation("org.mockito:mockito-core")
     testImplementation("org.mockito:mockito-junit-jupiter")
 
-    testImplementation("no.nav.security:mock-oauth2-server:0.5.10")
+    testImplementation("no.nav.security:mock-oauth2-server:5.0.2")
     testImplementation("com.squareup.okhttp3:mockwebserver:5.4.0")
     testImplementation("net.sourceforge.htmlunit:htmlunit:2.70.0")
 
@@ -91,12 +99,12 @@ spotless {
         )
     }
     format("conscrypt", com.diffplug.gradle.spotless.JavaExtension::class.java) {
-        googleJavaFormat("1.24.0")
+        googleJavaFormat("1.35.0")
         licenseHeaderFile("$rootDir/config/conscryptLicenseHeader")
         target("src/*/java/dev/sigstore/encryption/certificates/transparency/*.java")
     }
     format("webPki", com.diffplug.gradle.spotless.JavaExtension::class.java) {
-        googleJavaFormat("1.24.0")
+        googleJavaFormat("1.35.0")
         licenseHeaderFile("$rootDir/config/webPKILicenseHeader")
         target("src/*/java/dev/sigstore/json/canonicalizer/*.java")
     }

sigstore-java/src/test/java/dev/sigstore/fulcio/client/FulcioClientTest.java

@@ -31,10 +31,13 @@
 import java.util.function.Function;
 import java.util.stream.Stream;
 import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.condition.EnabledForJreRange;
+import org.junit.jupiter.api.condition.JRE;
 import org.junit.jupiter.api.extension.ExtendWith;
 import org.junit.jupiter.params.ParameterizedTest;
 import org.junit.jupiter.params.provider.MethodSource;
 
+@EnabledForJreRange(min = JRE.JAVA_17)
 public class FulcioClientTest {
 
   static Stream<org.junit.jupiter.api.Named<Function<FulcioWrapper, FulcioClient>>> clients() {

sigstore-java/src/test/java/dev/sigstore/oidc/client/WebOidcClientNonceTest.java

@@ -18,34 +18,25 @@
 import com.gargoylesoftware.htmlunit.WebClient;
 import com.google.common.io.Resources;
 import dev.sigstore.trustroot.Service;
-import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.util.Map;
 import no.nav.security.mock.oauth2.MockOAuth2Server;
 import no.nav.security.mock.oauth2.OAuth2Config;
-import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.condition.EnabledForJreRange;
+import org.junit.jupiter.api.condition.JRE;
 
+@EnabledForJreRange(min = JRE.JAVA_17)
 public class WebOidcClientNonceTest {
 
-  private MockOAuth2Server server;
-
-  @AfterEach
-  void teardown() throws IOException {
-    if (server != null) {
-      server.shutdown();
-    }
-  }
-
   @Test
   void testNonceVerificationSuccess() throws Exception {
     String config =
         Resources.toString(
             Resources.getResource("dev/sigstore/oidc/server/config.json"), StandardCharsets.UTF_8);
-    server = new MockOAuth2Server(OAuth2Config.Companion.fromJson(config));
+    var server = new MockOAuth2Server(OAuth2Config.Companion.fromJson(config));
     server.start();
-
     try (var webClient = new WebClient()) {
       var oidcClient =
           WebOidcClient.builder()
@@ -55,6 +46,8 @@ void testNonceVerificationSuccess() throws Exception {
 
       var token = oidcClient.getIDToken(Map.of());
       Assertions.assertNotNull(token.getIdToken());
+    } finally {
+      server.shutdown();
     }
   }
 
@@ -64,9 +57,8 @@ void testNonceVerificationFailure_MismatchedNonce() throws Exception {
         Resources.toString(
             Resources.getResource("dev/sigstore/oidc/server/config-bad-nonce.json"),
             StandardCharsets.UTF_8);
-    server = new MockOAuth2Server(OAuth2Config.Companion.fromJson(config));
+    var server = new MockOAuth2Server(OAuth2Config.Companion.fromJson(config));
     server.start();
-
     try (var webClient = new WebClient()) {
       var oidcClient =
           WebOidcClient.builder()
@@ -81,6 +73,8 @@ void testNonceVerificationFailure_MismatchedNonce() throws Exception {
                 oidcClient.getIDToken(Map.of());
               });
       Assertions.assertTrue(exception.getMessage().contains("nonce in id token does not match"));
+    } finally {
+      server.shutdown();
     }
   }
 }

sigstore-java/src/test/java/dev/sigstore/oidc/client/WebOidcClientTest.java

@@ -23,9 +23,12 @@
 import java.util.Map;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.condition.EnabledForJreRange;
+import org.junit.jupiter.api.condition.JRE;
 import org.junit.jupiter.api.extension.RegisterExtension;
 import org.slf4j.event.Level;
 
+@EnabledForJreRange(min = JRE.JAVA_17)
 public class WebOidcClientTest {
 
   @RegisterExtension

sigstore-java/src/test/resources/dev/sigstore/oidc/server/config-bad-nonce.json

@@ -11,8 +11,8 @@
       "tokenExpiry": 120,
       "requestMappings": [
         {
-          "requestParam": "scope",
-          "match": "openid email",
+          "requestParam": "client_id",
+          "match": "sigstore",
           "claims": {
             "audience": "sigstore",
             "email": "test.person@test.com",

sigstore-java/src/test/resources/dev/sigstore/oidc/server/config.json

@@ -11,8 +11,8 @@
       "tokenExpiry": 120,
       "requestMappings": [
         {
-          "requestParam": "scope",
-          "match": "openid email",
+          "requestParam": "client_id",
+          "match": "sigstore",
           "claims": {
             "audience": "sigstore",
             "email": "test.person@test.com",