Lift minimum JDK version to 21 and remove SecurityManager

.github/workflows/ci.yml

@@ -27,7 +27,7 @@ on:
 
 jobs:
   build:
-    name: build (${{ matrix.os }})
+    name: build (${{ matrix.os }}, jdk ${{ matrix.java }})
 
     permissions:
       contents: read
@@ -36,29 +36,46 @@ jobs:
       fail-fast: false
       matrix:
         os: [ ubuntu-24.04, windows-latest, macos-latest ]
+        java: [ '21' ]
+        # Include an additional matrix entry for main branch with Ubuntu 26.04, JDK 25, and Maven 3.10.0
+        include: ${{ github.ref == 'refs/heads/main' && fromJSON('[{"os":"ubuntu-26.04","java":"25","maven":"3.10.0"}]') || fromJSON('[]') }}
 
     runs-on: ${{ matrix.os }}
 
     steps:
       - name: Checkout
         uses: actions/checkout@v7
-      - name: Set up JDK 17
+      - name: Set up JDK ${{ matrix.java }}
         uses: actions/setup-java@v6
         with:
-          java-version: '17'
+          java-version: ${{ matrix.java }}
           distribution: 'temurin'
           cache: 'maven'
+      - name: Set up Maven ${{ matrix.maven }}
+        if: matrix.maven
+        env:
+          MAVEN_VERSION: ${{ matrix.maven }}
+        run: |
+          url="https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz"
+          curl -fsSL -o "${RUNNER_TEMP}/maven.tar.gz" "${url}"
+          echo "$(curl -fsSL "${url}.sha512")  ${RUNNER_TEMP}/maven.tar.gz" | sha512sum -c -
+          tar -xzf "${RUNNER_TEMP}/maven.tar.gz" -C "${RUNNER_TEMP}"
+          # fails the step if the layout is not what we expect, rather than silently keeping Maven 3
+          "${RUNNER_TEMP}/apache-maven-${MAVEN_VERSION}/bin/mvn" -v
+          echo "${RUNNER_TEMP}/apache-maven-${MAVEN_VERSION}/bin" >> "${GITHUB_PATH}"
       - name: Build
-        run: mvn -U -B -e clean install -Prat -DskipTests "-Dinvoker.skip=true"
+        run: |
+          mvn --version
+          mvn -U -B -e clean install -Prat -DskipTests "-Dinvoker.skip=true"
       - name: Save Maven Local Repository
         uses: actions/upload-artifact@v7
         with:
-          name: maven-local-repo-${{ matrix.os }}
+          name: maven-local-repo-${{ matrix.os }}-jdk${{ matrix.java }}
           path: ~/.m2/repository
           retention-days: 1
 
   test:
-    name: test (${{ matrix.os }})
+    name: test (${{ matrix.os }}, jdk ${{ matrix.java }})
     needs: build
 
     permissions:
@@ -68,34 +85,51 @@ jobs:
       fail-fast: false
       matrix:
         os: [ ubuntu-24.04, windows-latest, macos-latest ]
+        java: [ '21' ]
+        # Include an additional matrix entry for main branch with Ubuntu 26.04, JDK 25, and Maven 3.10.0
+        include: ${{ github.ref == 'refs/heads/main' && fromJSON('[{"os":"ubuntu-26.04","java":"25","maven":"3.10.0"}]') || fromJSON('[]') }}
 
     runs-on: ${{ matrix.os }}
 
     steps:
       - name: Checkout
         uses: actions/checkout@v7
-      - name: Set up JDK 17
+      - name: Set up JDK ${{ matrix.java }}
         uses: actions/setup-java@v6
         with:
-          java-version: '17'
+          java-version: ${{ matrix.java }}
           distribution: 'temurin'
           cache: 'maven'
       - name: Restore Maven Local Repository
         uses: actions/download-artifact@v8
         with:
-          name: maven-local-repo-${{ matrix.os }}
+          name: maven-local-repo-${{ matrix.os }}-jdk${{ matrix.java }}
           path: ~/.m2/repository
+      - name: Set up Maven ${{ matrix.maven }}
+        if: matrix.maven
+        env:
+          MAVEN_VERSION: ${{ matrix.maven }}
+        run: |
+          url="https://archive.apache.org/dist/maven/maven-3/${MAVEN_VERSION}/binaries/apache-maven-${MAVEN_VERSION}-bin.tar.gz"
+          curl -fsSL -o "${RUNNER_TEMP}/maven.tar.gz" "${url}"
+          echo "$(curl -fsSL "${url}.sha512")  ${RUNNER_TEMP}/maven.tar.gz" | sha512sum -c -
+          tar -xzf "${RUNNER_TEMP}/maven.tar.gz" -C "${RUNNER_TEMP}"
+          # fails the step if the layout is not what we expect, rather than silently keeping Maven 3
+          "${RUNNER_TEMP}/apache-maven-${MAVEN_VERSION}/bin/mvn" -v
+          echo "${RUNNER_TEMP}/apache-maven-${MAVEN_VERSION}/bin" >> "${GITHUB_PATH}"
       - name: Test
-        run: mvn -B -e install -Ptest
+        run: |
+          mvn --version
+          mvn -B -e install -Ptest
         timeout-minutes: 180
       - name: Upload Test Results
         if: always()
         uses: actions/upload-artifact@v7
         with:
-          name: test-results-${{ matrix.os }}
+          name: test-results-${{ matrix.os }}-jdk${{ matrix.java }}
           path: '**/target/surefire-reports/*.xml'
       - name: Upload Event File
-        if: always()
+        if: always() && matrix.java == '21'
         uses: actions/upload-artifact@v7
         with:
           name: event-file-${{ matrix.os }}

BUILDING.md

@@ -21,13 +21,13 @@
 
 ## Initial Setup
 
-1. Install J2SE 11 SDK (or later)
+1. Install J2SE 21 SDK (or later)
 
 2. Make sure that your JAVA_HOME environment variable is set to the newly installed 
    JDK location, and that your PATH includes `%JAVA_HOME%\bin` (windows) or 
    `$JAVA_HOME$/bin` (unix).
 
-3. Install Maven 3.8.0 (or later), which can be downloaded from 
+3. Install Maven 3.8.8 (or later), which can be downloaded from 
    http://maven.apache.org/download.html. Make sure that your PATH includes 
    the `$MVN_HOME/bin` directory. 
 

archetypes/assembly/src/main/resources/archetype-resources/pom.xml

@@ -174,7 +174,7 @@
                         <!-- minimal distribution -->
                         <!--<feature>minimal</feature>-->
                     </bootFeatures>
-                    <javase>17</javase>
+                    <javase>^javaVersion^</javase>
                 </configuration>
             </plugin>
         </plugins>

archetypes/blueprint/src/main/resources/archetype-resources/pom.xml

@@ -63,8 +63,9 @@
                 <artifactId>maven-compiler-plugin</artifactId>
                 <version>3.15.0</version>
                 <configuration>
-                    <source>1.8</source>
-                    <target>1.8</target>
+                    <release>21</release>
+                    <source>21</source>
+                    <target>21</target>
                     <maxmem>256M</maxmem>
                 </configuration>
             </plugin>

archetypes/bundle/pom.xml

@@ -57,8 +57,9 @@
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
                 <configuration>
-                    <source>1.8</source>
-                    <target>1.8</target>
+                    <release>${javaVersion}</release>
+                    <source>${javaVersion}</source>
+                    <target>${javaVersion}</target>
                     <maxmem>256M</maxmem>
                 </configuration>
             </plugin>

archetypes/bundle/src/main/resources/archetype-resources/pom.xml

@@ -82,8 +82,9 @@
                 <artifactId>maven-compiler-plugin</artifactId>
                 <version>3.15.0</version>
                 <configuration>
-                    <source>1.8</source>
-                    <target>1.8</target>
+                    <release>21</release>
+                    <source>21</source>
+                    <target>21</target>
                     <maxmem>256M</maxmem>
                 </configuration>
             </plugin>

archetypes/command/src/main/resources/archetype-resources/pom.xml

@@ -67,8 +67,9 @@
                 <inherited>true</inherited>
                 <version>3.15.0</version>
                 <configuration>
-                    <source>1.8</source>
-                    <target>1.8</target>
+                    <release>21</release>
+                    <source>21</source>
+                    <target>21</target>
                 </configuration>
             </plugin>
             <plugin>

assemblies/apache-karaf-light/pom.xml

@@ -178,7 +178,7 @@
                     </bootFeatures>
                     <libraries>
                     </libraries>
-                    <javase>17</javase>
+                    <javase>${javaVersion}</javase>
                     <generateConsistencyReport>${project.build.directory}</generateConsistencyReport>
                     <consistencyReportProjectName>Apache Karaf Light</consistencyReportProjectName>
                 </configuration>

assemblies/apache-karaf-minimal/pom.xml

@@ -145,7 +145,7 @@
                         !org.apache.karaf.command.acl.*,
                         *
                     </pidsToExtract>
-                    <javase>17</javase>
+                    <javase>${javaVersion}</javase>
                 </configuration>
             </plugin>
             <plugin>

assemblies/apache-karaf-mix/pom.xml

@@ -187,7 +187,7 @@
                     </bootFeatures>
                     <libraries>
                     </libraries>
-                    <javase>17</javase>
+                    <javase>${javaVersion}</javase>
                     <generateConsistencyReport>${project.build.directory}</generateConsistencyReport>
                     <consistencyReportProjectName>Apache Karaf Mix</consistencyReportProjectName>
                 </configuration>

assemblies/apache-karaf/pom.xml

@@ -178,7 +178,7 @@
                     </bootFeatures>
                     <libraries>
                     </libraries>
-                    <javase>17</javase>
+                    <javase>${javaVersion}</javase>
                     <generateConsistencyReport>${project.build.directory}</generateConsistencyReport>
                     <consistencyReportProjectName>Apache Karaf (full)</consistencyReportProjectName>
                 </configuration>

assemblies/features/base/src/main/filtered-resources/resources/bin/inc

@@ -190,7 +190,7 @@ locateJava() {
     fi
 
     if [ "x${JAVA_HOME}" = "x" ] && [ "${darwin}" = "true" ]; then
-        JAVA_HOME="`/usr/libexec/java_home -v 1.8`"
+        JAVA_HOME="`/usr/libexec/java_home -v 21+`"
     fi
     if [ "x${JAVA_HOME}" = "x" ] && [ -r /etc/gentoo-release ] ; then
         JAVA_HOME=`java-config --jre-home`
@@ -243,9 +243,9 @@ checkJvmVersion() {
 
     VERSION=`"${JAVA}" -version 2>&1 | ${AWK} -F '"' '/version/ {print $2}' | sed -e 's/_.*//g; s/^1\.//g; s/\..*//g; s/-.*//g;s/-.*//g; s/^[A-Za-z].*//'`
 
-    # java must be at least version 11
-    if [ "${VERSION}" -lt "11" ]; then
-        die "JVM must be version 11 or greater"
+    # java must be at least version 21
+    if [ "${VERSION}" -lt "21" ]; then
+        die "JVM must be version 21 or greater"
     fi
 }
 
@@ -282,12 +282,6 @@ setupVendorSepcifics() {
 setupDefaults() {
     DEFAULT_JAVA_OPTS="-XX:+UnlockDiagnosticVMOptions "
 
-    if [ "${VERSION}" -gt "11" ]; then
-      # TODO revisit EventAdminImpl to avoid use of Subject.getSubject(AccessController.getContext());
-      # -Djava.security.manager=allow is a workaround for SecurityController deprecation in JDK23+
-      DEFAULT_JAVA_OPTS="$DEFAULT_JAVA_OPTS -Djava.security.manager=allow "
-    fi
-
     setupVendorSepcifics
 
     DEFAULT_JAVA_OPTS="${DEFAULT_JAVA_OPTS} ${JAVA_VENDOR_OPTS}"

assemblies/features/base/src/main/filtered-resources/resources/bin/karaf

@@ -94,16 +94,14 @@ setupClassPath() {
             CLASSPATH="${CLASSPATH}:${file}"
         fi
     done
-    if [ "${VERSION}" -gt "8" ] ; then
-        for file in "${KARAF_HOME}"/lib/jdk9plus/*.jar
-        do
-            if [ -z "${CLASSPATH}" ]; then
-                CLASSPATH="${file}"
-            else
-                CLASSPATH="${CLASSPATH}:${file}"
-            fi
-        done
-    fi
+    for file in "${KARAF_HOME}"/lib/jdk9plus/*.jar
+    do
+        if [ -z "${CLASSPATH}" ]; then
+            CLASSPATH="${file}"
+        else
+            CLASSPATH="${CLASSPATH}:${file}"
+        fi
+    done
 }
 
 checkRootInstance() {
@@ -183,12 +181,8 @@ run() {
     if [ "x$CHECK_ROOT_INSTANCE_RUNNING" = "x" ]; then
         CHECK_ROOT_INSTANCE_RUNNING=true
     fi
-    JAVA_ENDORSED_DIRS="${JAVA_HOME}/jre/lib/endorsed:${JAVA_HOME}/lib/endorsed:${KARAF_HOME}/lib/endorsed"
-    JAVA_EXT_DIRS="${JAVA_HOME}/jre/lib/ext:${JAVA_HOME}/lib/ext:${KARAF_HOME}/lib/ext"
     if ${cygwin}; then
         JAVA_HOME=`cygpath --path --windows "${JAVA_HOME}"`
-        JAVA_ENDORSED_DIRS=`cygpath --path --windows "${JAVA_ENDORSED_DIRS}"`
-        JAVA_EXT_DIRS=`cygpath --path --windows "${JAVA_EXT_DIRS}"`
     fi
     convertPaths
     cd "${KARAF_BASE}" || exit 2

assemblies/features/base/src/main/filtered-resources/resources/bin/karaf.bat

@@ -234,12 +234,16 @@ for /f tokens^=2-5^ delims^=.-_+^" %%j in ('"%JAVA%" -fullversion 2^>^&1') do (
     if %%j==1 (set JAVA_VERSION=%%k) else (set JAVA_VERSION=%%j)
 )
 
-if %JAVA_VERSION% GTR 8 (
-   pushd "%KARAF_HOME%\lib\jdk9plus"
-       for %%G in (*.jar) do call:APPEND_TO_JDK9PLUS_CLASSPATH %%G
-   popd
+rem java must be at least version 21
+if %JAVA_VERSION% LSS 21 (
+    call :warn JVM must be version 21 or greater
+    goto END
 )
 
+pushd "%KARAF_HOME%\lib\jdk9plus"
+    for %%G in (*.jar) do call:APPEND_TO_JDK9PLUS_CLASSPATH %%G
+popd
+
 :CheckRootInstance
     set ROOT_INSTANCE_RUNNING=false
     if exist "%KARAF_HOME%\instances\instance.properties" (
@@ -267,10 +271,6 @@ if not exist "%JAVA_HOME%\bin\server\jvm.dll" (
 )
 set DEFAULT_JAVA_OPTS=-XX:+UnlockDiagnosticVMOptions
 
-if %JAVA_VERSION% GTR 11 (
-    set DEFAULT_JAVA_OPTS=%DEFAULT_JAVA_OPTS% -Djava.security.manager=allow
-)
-
 if "%JAVA_OPTS%" == "" set JAVA_OPTS=%DEFAULT_JAVA_OPTS%
 
 if "%EXTRA_JAVA_OPTS%" == "" goto :KARAF_EXTRA_JAVA_OPTS_END

assemblies/features/enterprise/pom.xml

@@ -214,7 +214,7 @@
                                 <descriptor>file:${project.build.directory}/feature/feature.xml</descriptor>
                             </descriptors>
                             <distribution>org.apache.karaf.features:framework</distribution>
-                            <javase>17</javase>
+                            <javase>${javaVersion}</javase>
                             <framework>
                                 <feature>framework</feature>
                             </framework>

assemblies/features/integration/pom.xml

@@ -105,7 +105,7 @@
                                 <descriptor>file:${project.build.directory}/feature/feature.xml</descriptor>
                             </descriptors>
                             <distribution>org.apache.karaf.features:framework</distribution>
-                            <javase>17</javase>
+                            <javase>${javaVersion}</javase>
                             <framework>
                                 <feature>framework</feature>
                             </framework>

assemblies/features/specs/pom.xml

@@ -96,7 +96,7 @@
                                 <descriptor>file:${project.build.directory}/feature/feature.xml</descriptor>
                             </descriptors>
                             <distribution>org.apache.karaf.features:framework</distribution>
-                            <javase>17</javase>
+                            <javase>${javaVersion}</javase>
                             <framework>
                                 <feature>framework</feature>
                             </framework>
@@ -149,4 +149,4 @@
         </profile>
     </profiles>
 
-</project>
+</project>

assemblies/features/spring/pom.xml

@@ -158,7 +158,7 @@
                                 <descriptor>file:${project.build.directory}/feature/feature.xml</descriptor>
                             </descriptors>
                             <distribution>org.apache.karaf.features:framework</distribution>
-                            <javase>17</javase>
+                            <javase>${javaVersion}</javase>
                             <framework>
                                 <feature>framework</feature>
                             </framework>

assemblies/features/standard/pom.xml

@@ -476,7 +476,7 @@
                                 <descriptor>file:${project.build.directory}/feature/feature.xml</descriptor>
                             </descriptors>
                             <distribution>org.apache.karaf.features:framework</distribution>
-                            <javase>17</javase>
+                            <javase>${javaVersion}</javase>
                             <framework>
                                 <feature>framework</feature>
                             </framework>
@@ -503,7 +503,7 @@
                             <artifacts>
                                 <artifact>
                                     <file>target/feature/feature.xml</file>
-									<classifier>features</classifier>
+                                    <classifier>features</classifier>
                                     <type>xml</type>
                                 </artifact>
                             </artifacts>