TECHNOLOGY WHITE PAPER

Best Practices for Moving to OpenJDK Best Practices for Moving to OpenJDK

Since SE 7, the OpenJDK has been the reference implementation (RI) of the Java SE standard, as de ned by the relevant Java Speci cation Request (JSR). A project was also created for OpenJDK 6 to allow an open-source implementation of Java SE 6 to be built. is the project lead for OpenJDK 6.

OpenJDK is licensed under the GNU Public License (GPL) version 2 with exception (CPE). The CPE eliminates the viral nature of the GPL from affecting applications running on the OpenJDK.

Changes to JDK Binary Distribution and Updates In September 2017, Oracle announced a series of changes to the way the JDK would be developed, This whitepaper explains what Zulu is and how to migrate distributed and updated. These changes can be applications from the Oracle JDK to the Zulu builds of summarized as follows: OpenJDK. • The release of the JDK has changed to a time-based model with two releases every year, in March and September. • Oracle has started to produce a second binary distribution of the JDK, built using only the OpenJDK Introduction . This is released under the GPLv2 with How the (JDK) is delivered is classpath exception license, which is less restrictive changing, and these changes will impact many Java than the Oracle Binary Code License for Java SE users. From JDK 11 (to be released in September 2018) used for the Oracle JDK binary. it will no longer be possible to use the Oracle JDK in • From JDK 11, there are no functional differences production without a commercial support agreement. between the Oracle JDK binary and one built purely To provide an alternative Java runtime with economically from OpenJDK source. To achieve this, Oracle has priced support and continued access to bug xes and contributed some previously closed-source features to security patches, Azul Systems has created the Zulu the OpenJDK (e.g., Mission Control and Flight OpenJDK distribution. This whitepaper explains what Zulu Recorder). Oracle has also removed some features is and how to migrate applications from the Oracle JDK to from the Oracle JDK binary such as the Zulu builds of OpenJDK. We have also appended a and JavaFX. series of links from the Oracle and Azul Systems websites to help you understand your Java support • From JDK 11 the Oracle JDK will no longer be free for alternatives. use in production. It can be used for development and testing but requires a commercial support The OpenJDK agreement for use in production. In 2006 , the then custodian of Java, • OpenJDK binaries will only be updated for six months announced that it was open-sourcing its implementation until the next JDK is released. Long-term support from of the JDK. To do this, it created the OpenJDK project, Oracle will only be available for the Oracle JDK binary hosted at http://openjdk.java.net under the commercial support agreement. • Public updates for JDK 8 end in January 2019. After Initially, just the JVM source code was released, but this that, users will still be able to use JDK 8 in the same was followed early in 2007 by that of the core libraries. way they have previously, but there will be no more Some parts remained closed-source until April 2009 with freely available security patches or bug xes provided build 53 of OpenJDK 7, when a complete JDK could be by Oracle. built using only open-source code.

TABLE OF CONTENTS

Introduction 2 Encryption 3 Migrating Applications to use the Zulu JDK 5 The OpenJDK 2 Getting support, timely security updates 5 Changes to JDK Binary Distribution and 2 Class Libraries 4 and bug xes for Zulu Updates Other Features 4 The Zulu Commercial Compatibility Kit 5 The Zulu Build of OpenJDK 3 Developer Tools 4 Conclusions 5 Differences Between OpenJDK and the 3 Java Runtime Deployment Strategy 4 Additional Resources 5 Oracle JDK Migrating to Zulu Enterprise 5 2 (JVM) 3 Downloading and Installing Zulu 5 Best Practices for Moving to OpenJDK

The Zulu Build of OpenJDK The following sections outline the differences between The OpenJDK is merely source code; in order to use this the source code of the OpenJDK and what is included in as a Java runtime, it is necessary to build a binary the Oracle JDK (prior to JDK 11). Azul makes speci c distribution. Azul’s binary distribution of the OpenJDK is changes to minimize these differences, and these are called Zulu. also noted.

To create Zulu, the standard build procedure, available as part of the OpenJDK, is used. To ensure confor- The following are not included in the OpenJDK: mance with the Java SE speci cation, the full suite of SNMP: The Oracle JDK provides closed-source support. Technology Compatibility Kit (TCK) tests are run on the There is no equivalent in the Zulu JDK. This will be resulting Zulu binaries. removed from the Oracle JDK as of JDK 11. To ensure that the JDK is as stable and secure as Sound Drivers: The Oracle JDK provides this for possible, regular updates are provided for the OpenJDK, Windows only. There is no equivalent in the Zulu JDK. which contain bug xes and security patches. The following differ between OpenJDK and the Oracle Until JDK 9, these updates were provided for the current JDK: release and for the previous release during an overlap Color Matching: The Oracle JDK replaces this feature period that has lasted between 13 and 37 months since with a closed-source version. The Zulu JDK uses the the release of JDK 6. Both OpenJDK 6 and OpenJDK 7 version from OpenJDK, which is comparable but not have reached the end of availability of public updates. identical. Azul includes backported updates from JDK 8 in Zulu Fonts: Both the Oracle and Zulu JDKs provide the same versions of JDK 6 and JDK 7. This enables customers to set of commercially licensed fonts. For more details of ensure the stability and security of older Java versions fonts for Zulu see the later section on the Commercial still in production use. Compatibility Kit. Azul’s engineering team has many staff-years of experi- Font Rendering: The Oracle JDK uses a closed-source ence working on the JDK; many of them having worked font renderer (T2K). Zulu (and OpenJDK) use an for Sun Microsystems and Oracle. open-source renderer (FreeType), which is comparable but not identical. Differences Between OpenJDK and the Oracle JDK Java 2D Graphics Rasterizer: Prior to JDK 9, the As the OpenJDK is the reference implementation of the OpenJDK used the open-source Pisces renderer, which Java SE standard, Oracle (and others) uses this as the was replaced with a closed-source version, Ductus, in basis for their JDK binary distributions. However, the the Oracle JDK. In JDK 9, Pisces was replaced by the pre-JDK 11 Oracle JDK is a super-set of the OpenJDK, Marlin renderer, which gives performance comparable which includes a number of additional features. Some of to Ductus. The Zulu JDK has used Marlin since JDK 8. these are open source; some are closed source.

The diagram below shows the relationship between the Encryption Java SE standard (as de ned by the relevant Java The Oracle JDK and OpenJDK both support the same Speci cation Request (JSR) of the Java Community encryption and cryptography capabilities with identical Process (JCP)), the OpenJDK and the Oracle JDK. code.

Since January 2018, (and the release of JDK 8 update 161) all OpenJDK-based distributions (Zulu and Oracle) Oracle JDK switched to using an “unlimited” strength cryptographic policy. Prior to this release, the default was “strong” (128 bit), and it was necessary to use additional Open JDK packages to upgrade this to unlimited. For the Oracle JDK, there was the Java Cryptographic Extensions (JCE) package, and for Zulu, there was the Cryptographic Extension Kit (CEK). Java SE Zulu and OpenJDK have generally followed the same cryptographic changes roadmap that Oracle has, which can be found here: https://www.java.com/en/jre-jdk-cryptoroadmap.html

3 Best Practices for Moving to OpenJDK

Class Libraries There are several choices: JavaFX: This is included in the Oracle JDK but not the 1: Continue to use the existing runtime, such as JDK 8, Zulu JDK. There is a separate open-source project called without further updates for security patches or bug xes. OpenJFX. Azul can provide support for OpenJFX, but it is This is the option with the most signi cant level of risk, not part of the core Zulu product. Oracle has announced as systems will potentially be open to security aws or that, as of JDK 11, JavaFX will no longer be included in instability. For speci c use-cases, like PCI compliance, the Oracle JDK. The OpenJFX project can be found at this may also expose the application to compliance http://openjdk.java.net/projects/openjfx regulation issues.

Other Features 2: Migrate applications to the latest version of the JDK Browser plugin: This is included in the Oracle JDK but using free OpenJDK binaries and repeat this every six not the Zulu JDK. This was deprecated from the Oracle months, as new JDK versions are released. This choice JDK in JDK 9 and will be removed from JDK 11. still has considerable risks associated with it. Oracle has stated that new releases of the JDK may contain Java Web Start: This is included in the Oracle JDK but changes that break backward compatibility (something not the Zulu JDK. This was deprecated from the Oracle that, until now, has long been a key feature of the Java JDK in JDK 9 and will be removed from JDK 11. platform). The effort required to test and certify applica- tions and libraries on a new version of the JDK every six months should not be underestimated.

Developer Tools Mission Control: In JDK 9 and earlier, this was a commercial product that could be used freely in develop- 3: Continue to use the Oracle JDK binaries and pay for ment and testing but required a commercial contract commercial support from Oracle. This eliminates the with Oracle for use in production. Oracle decided to risks of the rst two options but comes with a signi cant open-source this tool, and from JDK 10 it is part of the cost. Oracle has announced a new, subscription-based OpenJDK. Builds of Zulu include this as of JDK 10. pricing scheme for JDK support. The pricing of this is Flight Recorder: Similar to Mission Control, in JDK 10 based on a processor count, which is neither purely the and earlier this tool was separately licensed. Oracle number of cores in a processor, nor the number of decided to open-source this tool and, from JDK 11 it will sockets in a server. Calculating the number of proces- be part of the OpenJDK. Builds of Zulu will include this sors can be complex, but for x86-based hardware, each as of JDK 11. pair of cores in a socket counts as a single processor. A typical server that has two sockets with hex-core VisualVM: This was included in the Oracle JDK until JDK processors will be priced as six processors. The cost of 8 but not the Zulu JDK. It was removed from JDK 9 but a Java SE subscription is $15 per processor, per month is still available as an open-source project from giving an annual cost for the example server of $1,050. https://visualvm.github.io. In an estate with 1,000 such servers, this will cost over Java DB: This is a binary distribution of the Apache a million dollars a year. Derby database with no changes to the source code included with the Oracle JDK. This was included with the 4: Use a JDK from an alternative supplier with lower Oracle JDK until JDK 8 but not Zulu. It was removed cost. This is where Azul can play a crucial role with the from JDK 9 but is still available as an open-source Zulu binary distribution of OpenJDK. Azul only counts project from https://db.apache.org/derby/ servers, so the example in option three above would cost one-tenth of the Oracle price for premium support Java Runtime Deployment Strategy or a twelfth of the Oracle cost for standard support. Users need to evaluate the options available to them Using Zulu is obviously a very cost-effective option. when deciding on a strategy for existing and future deployment of JVM-based applications. 4 Best Practices for Moving to OpenJDK

Migrating to Zulu Enterprise Conclusions This section describes how you can migrate your Zulu is a build of the OpenJDK source code that fully applications to use Zulu Enterprise. conforms to the Java SE speci cation. Any application that relies only on standard Java components and APIs Downloading and Installing Zulu can switch to using Zulu simply by changing the path of Zulu OpenJDK is released under the GPLv2 with CPE where the Java executable is located. license. With skilled engineers undertaking the technically Zulu Binaries are available for the Windows, and complex tasks of backporting and integrating updates MacOS X platforms and can be downloaded from: into older versions of the OpenJDK customers can https://www.azul.com/downloads/zulu continue to have the latest security and stability xes while using older versions of Java. A comprehensive installation guide is also available at this address. This covers the full range of formats The Zulu build of OpenJDK provides a cost-effective provided, prerequisites for installation as well as alternative to having to migrate applications to newer instructions for deployment to popular cloud providers versions of Java. like Azure and Web Services. The guide also includes details of post-installation tasks If you would like to speak to an existing Zulu Enterprise including how to switch the default Java runtime between user, please contact Azul Sales at [email protected] and we different installed versions. will respond within one business day.

Migrating Applications to use the Zulu JDK Additional Resources The list of differences between the OpenJDK and Oracle From Oracle: JDK in the earlier section should be used to identify if Java SE Support Roadmap: http://www.ora- there are any features used by an application that are cle.com/technetwork/java/eol-135779.html not supported in the OpenJDK. Where alternatives exist, such as JavaFX, an appropriate binary should be located Java SE Subscriptions FAQ: https://www.ora- and downloaded. cle.com/technetwork/java/javaseproducts/over- view/javasesubscriptionfaq-4891443.html It is highly recommended that a full set of regression Java SE Support Subscriptions Overview: tests for any application be run after the switch to the https://www.oracle.com/java/java-se-subscription.html Zulu JDK to ensure that there are no compatibility issues. From Azul Systems: Java SE Overview: https://www.azul.com/products/zu- Getting support, timely security updates and lu-enterprise/key-features-bene ts/ bug fixes for Zulu Zulu Enterprise Support Overview: https://ww- The list of differences between the OpenJDK and Oracle w.azul.com/products/zulu-and-zulu-enterprise/zu- JDK in the earlier section should be used to identify if lu-enterprise-java-support-options there are any features used by an application that are not supported in the OpenJDK. Where alternatives exist, Azul Product Support Lifecycle: https://ww- such as JavaFX, an appropriate binary should be located w.azul.com/products/azul_support_roadmap/ and downloaded. Key benefits of Zulu Enterprise: https://ww- w.azul.com/products/zulu-enterprise/key-features-be- The Zulu Commercial Compatibility Kit ne ts/ As mentioned in the section Differences Between OpenJDK and the Oracle JDK, speci c commercial fonts are provided in the Oracle JDK that are not part of the OpenJDK. The Zulu Commercial Compatibility Kit (CCK) Connect with an Azul Expert provides an additional range of Lucida fonts to give the Azul Systems, Inc. same resources as the Oracle JDK. 385 Moffett Park Drive, Suite 115 Sunnyvale, CA 94089 USA The Zulu CCK requires acceptance of the associated +1.650.230.6500 terms of use. The installer will also ensure that the www.azul.com version of the Zulu CCK matches the installed version of [email protected] Zulu, so it is essential to download the correct version. Further details and downloads can be found here: https://www.azul.com/products/zulu-and-zulu-enter- prise/cck-downloads 5 10-18v1