Don't use unsafe on jdk23+

.github/workflows/build-common.yml

@@ -247,6 +247,7 @@ jobs:
           - 17
           - 21
           - 25 # renovate: datasource=java-version
+          - 25-deny-unsafe
         vm:
           - hotspot
           - openj9
@@ -260,6 +261,8 @@ jobs:
           - true
         exclude:
           - vm: ${{ inputs.skip-openj9-tests && 'openj9' || '' }}
+          - test-java-version: 25-deny-unsafe
+            vm: openj9
       fail-fast: false
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -273,7 +276,7 @@ jobs:
         with:
           # using zulu because new releases get published quickly
           distribution: ${{ matrix.vm == 'hotspot' && 'zulu' || 'adopt-openj9'}}
-          java-version: ${{ matrix.test-java-version }}
+          java-version: ${{ matrix.test-java-version != '25-deny-unsafe' && matrix.test-java-version || '25' }}
 
       - name: Set up JDK for running Gradle
         uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
@@ -329,6 +332,7 @@ jobs:
           -PtestJavaVersion=${{ matrix.test-java-version }}
           -PtestJavaVM=${{ matrix.vm }}
           -PtestIndy=${{ matrix.test-indy }}
+          -PdenyUnsafe=${{ matrix.test-java-version == '25-deny-unsafe' && 'true' || 'false' }}
           -Porg.gradle.java.installations.paths=${{ steps.setup-test-java.outputs.path }}
           -Porg.gradle.java.installations.auto-download=false
           ${{ inputs.no-build-cache && ' --no-build-cache' || '' }}

conventions/src/main/kotlin/io.opentelemetry.instrumentation.javaagent-testing.gradle.kts

@@ -6,6 +6,9 @@ plugins {
   id("io.opentelemetry.instrumentation.javaagent-shadowing")
 }
 
+val denyUnsafe = gradle.startParameter.projectProperties["denyUnsafe"] == "true"
+extra["denyUnsafe"] = denyUnsafe
+
 dependencies {
   /*
     Dependencies added to this configuration will be found by the muzzle gradle plugin during code
@@ -72,30 +75,40 @@ class JavaagentTestArgumentsProvider(
   @PathSensitive(PathSensitivity.RELATIVE)
   val shadowJar: File,
 ) : CommandLineArgumentProvider {
-  override fun asArguments(): Iterable<String> = listOf(
-    "-Dotel.javaagent.debug=true",
-    "-javaagent:${agentShadowJar.absolutePath}",
-    // make the path to the javaagent available to tests
-    "-Dotel.javaagent.testing.javaagent-jar-path=${agentShadowJar.absolutePath}",
-    "-Dotel.javaagent.experimental.initializer.jar=${shadowJar.absolutePath}",
-    "-Dotel.javaagent.testing.additional-library-ignores.enabled=false",
-    "-Dotel.javaagent.testing.fail-on-context-leak=${findProperty("failOnContextLeak") != false}",
-    // prevent sporadic gradle deadlocks, see SafeLogger for more details
-    "-Dotel.javaagent.testing.transform-safe-logging.enabled=true",
-    // Reduce noise in assertion messages since we don't need to verify this in most tests. We check
-    // in smoke tests instead.
-    "-Dotel.javaagent.add-thread-details=false",
-    "-Dotel.javaagent.experimental.indy=${findProperty("testIndy") == "true"}",
-    // suppress repeated logging of "No metric data to export - skipping export."
-    // since PeriodicMetricReader is configured with a short interval
-    "-Dio.opentelemetry.javaagent.slf4j.simpleLogger.log.io.opentelemetry.sdk.metrics.export.PeriodicMetricReader=INFO",
-    // suppress a couple of verbose ClassNotFoundException stack traces logged at debug level
-    "-Dio.opentelemetry.javaagent.slf4j.simpleLogger.log.io.grpc.internal.ServerImplBuilder=INFO",
-    "-Dio.opentelemetry.javaagent.slf4j.simpleLogger.log.io.grpc.internal.ManagedChannelImplBuilder=INFO",
-    "-Dio.opentelemetry.javaagent.slf4j.simpleLogger.log.io.perfmark.PerfMark=INFO",
-    "-Dio.opentelemetry.javaagent.slf4j.simpleLogger.log.io.grpc.Context=INFO",
-    "-Dotel.java.experimental.span-attributes.copy-from-baggage.include=test-baggage-key-1,test-baggage-key-2"
-  )
+  override fun asArguments(): Iterable<String> {
+    val list = mutableListOf(
+      "-Dotel.javaagent.debug=true",
+      "-javaagent:${agentShadowJar.absolutePath}",
+      // make the path to the javaagent available to tests
+      "-Dotel.javaagent.testing.javaagent-jar-path=${agentShadowJar.absolutePath}",
+      "-Dotel.javaagent.experimental.initializer.jar=${shadowJar.absolutePath}",
+      "-Dotel.javaagent.testing.additional-library-ignores.enabled=false",
+      "-Dotel.javaagent.testing.fail-on-context-leak=${findProperty("failOnContextLeak") != false}",
+      // prevent sporadic gradle deadlocks, see SafeLogger for more details
+      "-Dotel.javaagent.testing.transform-safe-logging.enabled=true",
+      // Reduce noise in assertion messages since we don't need to verify this in most tests. We check
+      // in smoke tests instead.
+      "-Dotel.javaagent.add-thread-details=false",
+      "-Dotel.javaagent.experimental.indy=${findProperty("testIndy") == "true"}",
+      // suppress repeated logging of "No metric data to export - skipping export."
+      // since PeriodicMetricReader is configured with a short interval
+      "-Dio.opentelemetry.javaagent.slf4j.simpleLogger.log.io.opentelemetry.sdk.metrics.export.PeriodicMetricReader=INFO",
+      // suppress a couple of verbose ClassNotFoundException stack traces logged at debug level
+      "-Dio.opentelemetry.javaagent.slf4j.simpleLogger.log.io.grpc.internal.ServerImplBuilder=INFO",
+      "-Dio.opentelemetry.javaagent.slf4j.simpleLogger.log.io.grpc.internal.ManagedChannelImplBuilder=INFO",
+      "-Dio.opentelemetry.javaagent.slf4j.simpleLogger.log.io.perfmark.PerfMark=INFO",
+      "-Dio.opentelemetry.javaagent.slf4j.simpleLogger.log.io.grpc.Context=INFO",
+      "-Dotel.java.experimental.span-attributes.copy-from-baggage.include=test-baggage-key-1,test-baggage-key-2"
+    )
+    if (denyUnsafe) {
+      list += listOf(
+        "-Dsun.misc.unsafe.memory.access=deny",
+        "-Dotel.instrumentation.deny-unsafe.enabled=true",
+        "-Dio.netty.noUnsafe=true"
+      )
+    }
+    return list
+  }
 }
 
 // need to run this after evaluate because testSets plugin adds new test tasks

instrumentation/akka/akka-actor-2.3/javaagent/build.gradle.kts

@@ -41,3 +41,9 @@ if (findProperty("testLatestDeps") as Boolean) {
     }
   }
 }
+
+if (findProperty("denyUnsafe") as Boolean) {
+  tasks.withType<Test>().configureEach {
+    enabled = false
+  }
+}

instrumentation/akka/akka-actor-fork-join-2.5/javaagent/build.gradle.kts

@@ -32,3 +32,9 @@ dependencies {
 
   testImplementation(project(":instrumentation:executors:testing"))
 }
+
+if (findProperty("denyUnsafe") as Boolean) {
+  tasks.withType<Test>().configureEach {
+    enabled = false
+  }
+}

instrumentation/akka/akka-http-10.0/javaagent/build.gradle.kts

@@ -71,6 +71,12 @@ tasks {
   check {
     dependsOn(testing.suites)
   }
+
+  if (findProperty("denyUnsafe") as Boolean) {
+    withType<Test>().configureEach {
+      enabled = false
+    }
+  }
 }
 
 if (findProperty("testLatestDeps") as Boolean) {

instrumentation/armeria/armeria-1.3/javaagent/build.gradle.kts

@@ -29,4 +29,10 @@ tasks {
     systemProperty("testLatestDeps", findProperty("testLatestDeps") as Boolean)
     systemProperty("collectMetadata", findProperty("collectMetadata")?.toString() ?: "false")
   }
+
+  if (findProperty("denyUnsafe") as Boolean) {
+    withType<Test>().configureEach {
+      enabled = false
+    }
+  }
 }

instrumentation/armeria/armeria-grpc-1.14/javaagent/build.gradle.kts

@@ -62,3 +62,9 @@ afterEvaluate {
 tasks.test {
   systemProperty("collectMetadata", findProperty("collectMetadata")?.toString() ?: "false")
 }
+
+if (findProperty("denyUnsafe") as Boolean) {
+  tasks.withType<Test>().configureEach {
+    enabled = false
+  }
+}

instrumentation/aws-sdk/aws-sdk-1.11/javaagent/build.gradle.kts

@@ -167,6 +167,13 @@ tasks {
   check {
     dependsOn(testStableSemconv)
   }
+
+  if (findProperty("denyUnsafe") as Boolean) {
+    // org.elasticmq:elasticmq-rest-sqs_2.13 uses unsafe. Future versions are likely to fix this.
+    withType<Test>().configureEach {
+      enabled = false
+    }
+  }
 }
 
 if (!(findProperty("testLatestDeps") as Boolean)) {

instrumentation/aws-sdk/aws-sdk-2.2/javaagent/build.gradle.kts

@@ -237,4 +237,12 @@ tasks {
       duplicatesStrategy = DuplicatesStrategy.INCLUDE
     }
   }
+
+  if (findProperty("denyUnsafe") as Boolean) {
+    // Aws2SqsTracingTest uses org.elasticmq:elasticmq-rest-sqs_2.13 that uses unsafe. Future
+    // versions are likely to fix this.
+    withType<Test>().configureEach {
+      enabled = false
+    }
+  }
 }

instrumentation/camel-2.20/javaagent/build.gradle.kts

@@ -104,6 +104,12 @@ tasks {
   check {
     dependsOn(testStableSemconv, testExperimental)
   }
+
+  if (findProperty("denyUnsafe") as Boolean) {
+    withType<Test>().configureEach {
+      enabled = false
+    }
+  }
 }
 
 configurations.testRuntimeClasspath {

instrumentation/cassandra/cassandra-3.0/javaagent/build.gradle.kts

@@ -57,4 +57,10 @@ tasks {
   check {
     dependsOn(testStableSemconv)
   }
+
+  if (findProperty("denyUnsafe") as Boolean) {
+    withType<Test>().configureEach {
+      enabled = false
+    }
+  }
 }

instrumentation/couchbase/couchbase-2.0/javaagent/build.gradle.kts

@@ -57,4 +57,10 @@ tasks {
   check {
     dependsOn(testStableSemconv)
   }
+
+  if (findProperty("denyUnsafe") as Boolean) {
+    withType<Test>().configureEach {
+      enabled = false
+    }
+  }
 }

instrumentation/couchbase/couchbase-2.6/javaagent/build.gradle.kts

@@ -66,4 +66,10 @@ tasks {
   check {
     dependsOn(testStableSemconv, testExperimental)
   }
+
+  if (findProperty("denyUnsafe") as Boolean) {
+    withType<Test>().configureEach {
+      enabled = false
+    }
+  }
 }

instrumentation/couchbase/couchbase-3.1.6/javaagent/build.gradle.kts

@@ -48,4 +48,10 @@ tasks {
     usesService(gradle.sharedServices.registrations["testcontainersBuildService"].service)
     systemProperty("collectMetadata", findProperty("collectMetadata")?.toString() ?: "false")
   }
+
+  if (findProperty("denyUnsafe") as Boolean) {
+    withType<Test>().configureEach {
+      enabled = false
+    }
+  }
 }

instrumentation/couchbase/couchbase-3.1/javaagent/build.gradle.kts

@@ -49,4 +49,10 @@ tasks {
     usesService(gradle.sharedServices.registrations["testcontainersBuildService"].service)
     systemProperty("collectMetadata", findProperty("collectMetadata")?.toString() ?: "false")
   }
+
+  if (findProperty("denyUnsafe") as Boolean) {
+    withType<Test>().configureEach {
+      enabled = false
+    }
+  }
 }

instrumentation/couchbase/couchbase-3.2/javaagent/build.gradle.kts

@@ -50,4 +50,10 @@ tasks {
     usesService(gradle.sharedServices.registrations["testcontainersBuildService"].service)
     systemProperty("collectMetadata", findProperty("collectMetadata")?.toString() ?: "false")
   }
+
+  if (findProperty("denyUnsafe") as Boolean) {
+    withType<Test>().configureEach {
+      enabled = false
+    }
+  }
 }

instrumentation/couchbase/couchbase-3.4/javaagent/build.gradle.kts

@@ -48,4 +48,10 @@ tasks {
     usesService(gradle.sharedServices.registrations["testcontainersBuildService"].service)
     systemProperty("collectMetadata", findProperty("collectMetadata")?.toString() ?: "false")
   }
+
+  if (findProperty("denyUnsafe") as Boolean) {
+    withType<Test>().configureEach {
+      enabled = false
+    }
+  }
 }

instrumentation/dropwizard/dropwizard-testing/build.gradle.kts

@@ -31,3 +31,9 @@ configurations.testRuntimeClasspath {
 tasks.withType<Test>().configureEach {
   jvmArgs("-Dotel.instrumentation.common.experimental.controller-telemetry.enabled=true")
 }
+
+if (findProperty("denyUnsafe") as Boolean) {
+  tasks.withType<Test>().configureEach {
+    enabled = false
+  }
+}

instrumentation/elasticsearch/elasticsearch-transport-5.3/javaagent/build.gradle.kts

@@ -96,4 +96,10 @@ tasks {
   check {
     dependsOn(testStableSemconv, testExperimental)
   }
+
+  if (findProperty("denyUnsafe") as Boolean) {
+    withType<Test>().configureEach {
+      enabled = false
+    }
+  }
 }

instrumentation/elasticsearch/elasticsearch-transport-6.0/javaagent/build.gradle.kts

@@ -126,4 +126,10 @@ tasks {
   check {
     dependsOn(testing.suites, stableSemconvSuites, experimentalSuites)
   }
+
+  if (findProperty("denyUnsafe") as Boolean) {
+    withType<Test>().configureEach {
+      enabled = false
+    }
+  }
 }

instrumentation/finagle-http-23.11/javaagent/build.gradle.kts

@@ -48,4 +48,10 @@ tasks {
 
     systemProperty("metadataConfig", "otel.instrumentation.http.client.emit-experimental-telemetry=true,otel.instrumentation.http.server.emit-experimental-telemetry=true")
   }
+
+  if (findProperty("denyUnsafe") as Boolean) {
+    withType<Test>().configureEach {
+      enabled = false
+    }
+  }
 }

instrumentation/finatra-2.9/javaagent/build.gradle.kts

@@ -91,6 +91,12 @@ tasks {
     systemProperty("collectMetadata", findProperty("collectMetadata")?.toString() ?: "false")
     systemProperty("metadataConfig", "otel.instrumentation.common.experimental.controller-telemetry.enabled=true")
   }
+
+  if (findProperty("denyUnsafe") as Boolean) {
+    withType<Test>().configureEach {
+      enabled = false
+    }
+  }
 }
 
 if (findProperty("testLatestDeps") as Boolean) {

instrumentation/grails-3.0/javaagent/build.gradle.kts

@@ -81,4 +81,10 @@ tasks {
     systemProperty("collectMetadata", findProperty("collectMetadata")?.toString() ?: "false")
     systemProperty("metadataConfig", "otel.instrumentation.common.experimental.controller-telemetry.enabled=true")
   }
+
+  if (findProperty("denyUnsafe") as Boolean) {
+    withType<Test>().configureEach {
+      enabled = false
+    }
+  }
 }

instrumentation/grpc-1.6/javaagent/build.gradle.kts

@@ -90,4 +90,10 @@ if (!(findProperty("testLatestDeps") as Boolean)) {
       }
     }
   }
+
+  if (findProperty("denyUnsafe") as Boolean) {
+    tasks.withType<Test>().configureEach {
+      enabled = false
+    }
+  }
 }

instrumentation/hystrix-1.4/javaagent/build.gradle.kts

@@ -42,4 +42,10 @@ tasks {
   check {
     dependsOn(testExperimental)
   }
+
+  if (findProperty("denyUnsafe") as Boolean) {
+    withType<Test>().configureEach {
+      enabled = false
+    }
+  }
 }

instrumentation/jaxrs/jaxrs-3.0/jaxrs-3.0-resteasy-6.0/javaagent/build.gradle.kts

@@ -60,4 +60,10 @@ tasks {
   check {
     dependsOn(testExperimental)
   }
+
+  if (findProperty("denyUnsafe") as Boolean) {
+    withType<Test>().configureEach {
+      enabled = false
+    }
+  }
 }

instrumentation/log4j/log4j-appender-2.17/javaagent/build.gradle.kts

@@ -56,6 +56,12 @@ tasks {
   check {
     dependsOn(testAsync)
   }
+
+  if (findProperty("denyUnsafe") as Boolean) {
+    withType<Test>().configureEach {
+      enabled = false
+    }
+  }
 }
 
 tasks.withType<Test>().configureEach {