chore: use Java 21 for building sigstore-java

This change bumps JDK we use when building the project, and it is mainly
to avoid known bugs in the toolchain.

The resulting binaries should still be compatible with Java 11.

At the same time, the commit skips "./gradlew test" checks for Java 11,
and we still execute tests with Java 11 via conformance.yml.

It would allow us to bump testing libraries as some of them require Java 17.

Signed-off-by: Vladimir Sitnikov <[email protected]>

Author: vlsi

.github/workflows/ci.yaml

@@ -19,7 +19,8 @@ jobs:
   build:
     strategy:
       matrix:
-        java-version: [11, 17]
+        # sigstore-java still supports Java 11, however, we test it with conformance-tests only
+        java-version: [17, 21]
       fail-fast: false
 
     concurrency:
@@ -39,10 +40,10 @@ jobs:
     - name: Set up JDK ${{ matrix.java-version }}
       uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
       with:
-        # We need Java 17 for the build, so we install it always
+        # We need Java 21 for the build, so we install it always
         java-version: |
           ${{ matrix.java-version }}
-          17
+          21
         distribution: 'temurin'
     - name: Setup Go environment
       uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
@@ -62,9 +63,9 @@ jobs:
 
     - name: Ensure sigstore-java self signing still works
       if: ${{ !github.event.pull_request.head.repo.fork }}
-      run: ./gradlew sigstore-java:publishToMavenLocal -Prelease -PskipPgpSigning
+      run: ./gradlew -Porg.gradle.java.installations.auto-download=false sigstore-java:publishToMavenLocal -Prelease -PskipPgpSigning
 
     - name: Test sigstore-java/sandbox
       run: |
         cd sandbox
-        ./gradlew build
+        ./gradlew -Porg.gradle.java.installations.auto-download=false build

.github/workflows/conformance.yml

@@ -13,7 +13,7 @@ jobs:
     strategy:
       max-parallel: 1
       matrix:
-        java-version: [11, 17]
+        java-version: [11, 17, 21]
         sigstore-env: [production, staging]
       fail-fast: false
 
@@ -30,21 +30,21 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up JDK 17
+      - name: Set up JDK 21
         uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version: 21
           distribution: 'temurin'
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1
 
       - name: Build sigstore-java cli and server jar
-        run: ./gradlew :sigstore-cli:serverShadowJar
-      
+        run: ./gradlew -Porg.gradle.java.installations.auto-download=false :sigstore-cli:serverShadowJar
+
       - name: Start test server in background
         run: java -jar ${{ github.workspace }}/sigstore-cli/build/libs/sigstore-cli-server-all.jar &
-      
+
       - name: Wait for server to be ready
         run: curl --retry-connrefused --retry 10 --retry-delay 1 --fail http://localhost:8080/
 

.github/workflows/examples.yaml

@@ -72,14 +72,14 @@ jobs:
     - name: Setup Java
       uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
       with:
-        java-version: 17
+        java-version: 21
         distribution: 'temurin'
 
     - name: Setup Gradle
       uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1
 
     - name: install sigstore java development jars into mavenLocal
-      run: ./gradlew publishToMavenLocal -Prelease -PskipSigning
+      run: ./gradlew -Porg.gradle.java.installations.auto-download=false publishToMavenLocal -Prelease -PskipSigning
 
     - name: calculate development version
       id: dev_version

.github/workflows/release-sigstore-gradle-plugin-from-tag.yaml

@@ -47,18 +47,18 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up JDK 17
+      - name: Set up JDK 21
         uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version: 21
           distribution: 'temurin'
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1
 
       - name: Build, Sign and Release to Gradle Plugin Portal
         run: |
-          ./gradlew publishPlugins -Prelease -Pgradle.publish.key=$GRADLE_PUBLISH_KEY -Pgradle.publish.secret=$GRADLE_PUBLISH_SECRET
+          ./gradlew -Porg.gradle.java.installations.auto-download=false publishPlugins -Prelease -Pgradle.publish.key=$GRADLE_PUBLISH_KEY -Pgradle.publish.secret=$GRADLE_PUBLISH_SECRET
         env:
           ORG_GRADLE_PROJECT_signingKey: ${{ secrets.PGP_PRIVATE_KEY }}
           ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.PGP_PASSPHRASE }}

.github/workflows/release-sigstore-java-from-tag.yaml

@@ -48,18 +48,18 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up JDK 17
+      - name: Set up JDK 21
         uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version: 21
           distribution: 'temurin'
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1
 
       - name: Build, Sign and Release to Maven Central
         run: |
-          ./gradlew clean :sigstore-java:publishMavenJavaPublicationToSonatypeRepository :sigstore-maven-plugin:publishMavenJavaPublicationToSonatypeRepository -Prelease
+          ./gradlew -Porg.gradle.java.installations.auto-download=false clean :sigstore-java:publishMavenJavaPublicationToSonatypeRepository :sigstore-maven-plugin:publishMavenJavaPublicationToSonatypeRepository -Prelease
         env:
           ORG_GRADLE_PROJECT_signingKey: ${{ secrets.PGP_PRIVATE_KEY }}
           ORG_GRADLE_PROJECT_signingPassword: ${{ secrets.PGP_PASSPHRASE }}

.github/workflows/tuf-conformance.yml

@@ -12,7 +12,7 @@ jobs:
     strategy:
       max-parallel: 1
       matrix:
-        java-version: [11, 17]
+        java-version: [11, 17, 21]
       fail-fast: false
 
     concurrency:
@@ -28,17 +28,17 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up JDK 17
+      - name: Set up JDK 21
         uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 17
+          java-version: 21
           distribution: 'temurin'
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@ac638b010cf58a27ee6c972d7336334ccaf61c96 # v4.4.1
 
       - name: Build tuf cli
-        run: ./gradlew :tuf-cli:build
+        run: ./gradlew -Porg.gradle.java.installations.auto-download=false :tuf-cli:build
 
       - name: Unpack tuf distribution
         run: tar -xvf ${{ github.workspace }}/tuf-cli/build/distributions/tuf-cli-*.tar --strip-components 1

build-logic/build-parameters/build.gradle.kts

@@ -14,7 +14,7 @@ buildParameters {
     }
     val projectName = "sigstore-java"
     integer("jdkBuildVersion") {
-        defaultValue.set(17)
+        defaultValue.set(21)
         mandatory.set(true)
         description.set("JDK version to use for building $projectName. If the value is 0, then the current Java is used. (see https://docs.gradle.org/8.4/userguide/toolchains.html#sec:consuming)")
     }

settings.gradle.kts

@@ -1,5 +1,14 @@
+plugins {
+    id("org.gradle.toolchains.foojay-resolver-convention") version "1.0.0"
+}
+
 rootProject.name = "sigstore-java-root"
 
+if (JavaVersion.current() < JavaVersion.VERSION_21) {
+    throw UnsupportedOperationException("Please use Java 21+ for launching Gradle when building ${rootProject.name}, the current Java is ${JavaVersion.current().majorVersion}. " +
+            "If you want to execute tests with a different Java version, use -PjdkTestVersion=${JavaVersion.current().majorVersion}")
+}
+
 includeBuild("build-logic-commons")
 includeBuild("build-logic")