Skip to content

chore: use Java 21 for building sigstore-java #1044

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore: use Java 21 for building sigstore-java #1044

wants to merge 1 commit into from
+34 −24

Conversation

vlsi
Copy link
Collaborator

@vlsi vlsi commented Aug 7, 2025

Summary

This change bumps JDK we use when building the project, and it is mainly to avoid known bugs in the toolchain.

The resulting binaries should still be compatible with Java 11.

At the same time, the commit skips "./gradlew test" checks for Java 11, and we still execute tests with Java 11 via conformance.yml.

It would allow us to bump testing libraries as some of them require Java 17.

Release Note

  • Require Java 21 when building sigstore-java. The resulting artifacts are still compatible with Java 11

Documentation

NONE

@vlsi vlsi added the chore label Aug 7, 2025
@vlsi vlsi force-pushed the build_jdk21 branch 2 times, most recently from dd0b4ac to 8710430 Compare August 7, 2025 06:34
@vlsi
chore: use Java 21 for building sigstore-java
3fab0dd 
This change bumps JDK we use when building the project, and it is mainly
to avoid known bugs in the toolchain.

The resulting binaries should still be compatible with Java 11.

At the same time, the commit skips "./gradlew test" checks for Java 11,
and we still execute tests with Java 11 via conformance.yml.

It would allow us to bump testing libraries as some of them require Java 17.

Signed-off-by: Vladimir Sitnikov <[email protected]>
@vlsi
Copy link
Collaborator Author

vlsi commented Aug 7, 2025 

> Task :sigstore-java:forbiddenApisMain
Forbidden method invocation: java.net.URL#<init>(java.lang.String) [Deprecated in Java 21]
  in dev.sigstore.tuf.SigstoreTufClient$Builder (SigstoreTufClient.java:77)
Forbidden method invocation: java.net.URL#<init>(java.lang.String) [Deprecated in Java 21]
  in dev.sigstore.tuf.SigstoreTufClient$Builder (SigstoreTufClient.java:92)
Forbidden method invocation: java.net.URL#<init>(java.lang.String) [Deprecated in Java 21]
  in dev.sigstore.tuf.SigstoreTufClient$Builder (SigstoreTufClient.java:132)
Forbidden method invocation: java.net.URL#<init>(java.lang.String) [Deprecated in Java 21]
  in dev.sigstore.tuf.SigstoreTufClient$Builder (SigstoreTufClient.java:133)
Forbidden method invocation: java.net.URL#<init>(java.lang.String) [Deprecated in Java 21]

Should we prefer using URI in sigstore-java public APIs like public Builder tufMirror(URL mirror, RootProvider trustedRoot) {?

new URI has a new checked exception URISyntaxException which we probably need to wrap with the existing MalformedURLException

@loosebazooka
Copy link
Member

Should we prefer using URI in sigstore-java public APIs

sure go for it.

@loosebazooka
Copy link
Member

I can adjust for and fix this problem with URI/URL.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
chore
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@vlsi @loosebazooka