[jira] [Commented] (CASSANDRA-21171) JDK25 support

["Jeremiah Jordan (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/CASSANDRA-21171?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18091357#comment-18091357 ] 

Jeremiah Jordan commented on CASSANDRA-21171:
---------------------------------------------

Patches adding *JDK 25* as a supported build and runtime target (alongside 11/17/21) are available on the branches below. Each is named {{{}CASSANDRA-21171-support-jdk25-trunk{}}}. The cassandra branch is *rebased on current trunk* (25 commits).
 * cassandra: [https://github.com/JeremiahDJordan/cassandra/tree/CASSANDRA-21171-support-jdk25-trunk]
 * cassandra-ccm: [https://github.com/JeremiahDJordan/cassandra-ccm/tree/CASSANDRA-21171-support-jdk25-trunk]
 * cassandra-dtest: [https://github.com/JeremiahDJordan/cassandra-dtest/tree/CASSANDRA-21171-support-jdk25-trunk]
 * cassandra-builds: [https://github.com/JeremiahDJordan/cassandra-builds/tree/CASSANDRA-21171-support-jdk25-trunk]
 * cassandra-accord: [https://github.com/JeremiahDJordan/cassandra-accord/tree/CASSANDRA-21171-support-jdk25-trunk]

h2. cassandra
 * {*}Add JDK 25 as a supported build/runtime target{*}: {{{}java.supported=25{}}}; new {{{}jvm25-server.options{}}}/{{{}jvm25-clients.options{}}} (drop {{-XX:{+}ZGenerational{+}-}} and {{-Djdk.reflect.useDirectMethodHandle=false}} removed in JDK 22/23, add {{{}-sun-misc-unsafe-memory-access=allow-{}}}, drop {{{}-Djava.security.manager=allow{}}}, add {{-enable-native-access=ALL-UNNAMED}} so JEP 472 restricted-method warnings don't pollute stderr); {{-proc:full}} on JDK 21/25 so class-path annotation processing still runs on JDK 23.
 * {*}Fix AES-GCM TLS on JDK 25 (BufferPool){*}: JDK 25 rewrote {{GaloisCounterMode.overlapDetection}} (again CASSANDRA-18180) to walk a direct buffer's {{attachment()}} chain and cast each link to {{{}java.nio.Buffer{}}}. Cassandra's {{BufferPool}} stashed a {{Chunk}} (not a {{{}Buffer{}}}) in the attachment, so {*}every encrypted (AES-GCM) connection threw {{ClassCastException}} on JDK 25{*}. Fixed by attaching a per-chunk zero-capacity {{java.nio.Buffer}} _marker_ (null attachment, terminates the GCM walk at the chunk boundary) and recovering the owning {{Chunk}} from a weak-keyed identity side-map; gated on {{Runtime.version().feature() >= 25}} so JDK <= 24 is unchanged. Burn-tested ({{{}LongBufferPoolTest{}}}, {{{}DriverBurnTest{}}}) on JDK 25, no OOMs or issues seen.
 * {*}Strong-reference leak detector ({{{}Ref{}}}) on JDK 16+{*}: {{Ref.getFieldValue}} falls back to {{Unsafe.objectFieldOffset}} for module-protected fields, which throws {{UnsupportedOperationException}} for *record* components (enforced on JDK 25). The uncaught exception aborted the entire leak-detection pass at the first JDK record reached (e.g. {{{}SecureClassLoader$CodeSourceKey{}}}). Now caught and the unreadable field skipped (throttled log), so the scan completes; covered by a new regression test ({{{}RefFieldWalkTest{}}}). (jamm itself needs no change — its size path already handles records.)
 * {*}SecurityManager removal (JEP 411, finalized JDK 24){*}: sandbox UDFs without a SecurityManager (and harden the UDF byte-code verifier to deny {{java.lang.ClassLoader}} wholesale); trap {{System.exit}} in tests via Byteman; resolve JMX authz subjects via {{{}Subject.current(){}}}/{{{}callAs{}}}; overwrite {{static final}} fields via Unsafe instead of reflection.
 * {*}Common ForkJoinPool behaviour on JDK 25{*}: JDK 25's common {{ForkJoinPool}} does not start a compensating worker when a task blocks under low parallelism (procs <= 2 in the dtest JVMs), starving queued tasks. Tests that ran a blocking action on the common pool and waited for its effect ({{{}DisableBinaryTest{}}} and several dtests — repair/decommission/vector) now run that action on a dedicated executor, restoring determinism without weakening the test.
 * *Build jamm from a submodule patched for JDK 25* ({{{}.gitmodules{}}} + build): the bundled jamm is built from a JDK-25-compatible submodule an upstream patch will be sent once this is approved (or if the dev@ thread about Jamm resolves, will fix it after we bring it in).
 * {*}Test/instrumentation deps{*}: upgrade ASM, ByteBuddy, Mockito, JaCoCo and the test agents for JDK 25 class files; bundle the Amazon Corretto Crypto Provider for all supported platforms.
 * {*}Simulator{*}: support JDK 25 in the bytecode transformer; allow pinning the simulation seed for reproducible runs.
 * {*}Misc JDK 25 correctness{*}: encryption tests aware of protocols/ciphers disabled on JDK 25; keep {{{}FileTest{}}}'s empty-path case stable across the JDK 25 {{new File("")}} change.
 * {*}Modernize incidental TLS in tests{*}: JDK 25 disables TLSv1/TLSv1.1 and the {{TLS_RSA_WITH_AES_128_CBC_SHA}} cipher by default ({{{}jdk.tls.disabledAlgorithms{}}}). Tests that pinned these only incidentally — config/cache-key equality, SSL-context construction, internode framing — now use {{TLSv1.2}} and {{TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256}} (enabled on JDK 11/17/21/25). Tests that specifically assert the legacy protocols/ciphers are rejected (or gate them behind {{{}isProtocolEnabledByDefault(){}}}/{{{}isCipherEnabledByDefault(){}}}) are left unchanged.
 * {*}JMX over TLS on JDK 25{*}: {{JMXSslConfigDistributedTest.testSystemSettings}} connects with the JDK's stock {{{}SslRMIClientSocketFactory{}}}, which on JDK 25 performs TLS endpoint-identity verification; the default test keystore (CN=Apache Cassandra) has no SubjectAltName. Point that one test at the existing {{cassandra_ssl_test_endpoint_verify.keystore}} (CN=127.0.0.1 with an IPAddress SAN), already trusted by the shared test truststore.
 * {*}Accord{*}: build Accord with Gradle 9 on JDK 17+ (required to read JDK 25 bytecode, class file v69); Gradle 8 retained when building on JDK 11. The Accord submodule is bumped to a commit carrying the Gradle 9 build fix (see cassandra-accord).
 * {*}Build/CI images + tooling{*}: add JDK 25 to the packaging and CI docker images; add an optional {{cassandra_ccm_dir}} to the in-tree docker test runner so a local ccm working copy can be exercised.
 * *Point the Accord submodule at the JDK 25 fork* ({{{}.gitmodules{}}}). Temporary CI wiring so {{git submodule update --init}} can fetch the Accord commit; revert to {{apache/cassandra-accord}} once the Accord change is merged upstream.

h2. cassandra-accord
 * *Reference the accord-core source sets directly* so accord-maelstrom builds under Gradle 9 ({{{}evaluationDependsOn(':accord-core'){}}} + {{{}rootProject.project(':accord-core').sourceSets.test.output{}}}). The cassandra submodule is pinned to this commit.

h2. cassandra-ccm
 * {*}Add JDK 25 support{*}: supported-JDK lists (7.0+ -> 11/17/21/25, 6.0 -> 11/17/21, 5.0 -> 11/17); {{assert_jdk_valid_for_cassandra_version()}} accepts 25; make {{generatetokens}} parsing robust under JDK 25 — the Jamm {{UseEmptySlotsInSupers}} warning prints to stdout there, so token lines are now selected by their bracketed shape rather than by position.
 * {*}Keep num_tokens consistent with a node's configured initial tokens{*}: a single configured token now yields {{num_tokens=1}} even when config (e.g. the vnode dtest default of 16) sets a higher value, so the node no longer refuses to start on an initial_token/num_tokens mismatch.

h2. cassandra-dtest
 * JDK 25 added to the trunk upgrade matrix and version support.
 * {*}Jolokia JMX attach under load on JDK 25{*}: the agent attach could time out under a loaded single-VM run; addressed with {{-XX:+StartAttachListener}} so the attach listener is up front ({{{}test_18766_sr{}}}).
 * *Pin ccm to the JDK 25 ccm branch for CI* ({{{}requirements.txt{}}}). Temporary CI wiring so CI installs the matching ccm; revert to {{apache/cassandra-ccm@cassandra-test}} once the ccm changes are merged and the {{cassandra-test}} tag is re-pointed.

h2. cassandra-builds
 * *Add JDK 21 and JDK 25 to the testing docker images* (ubuntu2004_j11 and the java-driver testing image), installed from verified multi-arch GA tarballs (official amd64+arm64 {{.sha256}} checksums); JDK 21 had also been missing from one image.

h2. Validation
 * *Rebased on current trunk; builds clean on JDK 25* (and re-checked on JDK 11). {{{}checkstyle{}}}/{{{}checkstyle-test{}}} pass.
 * *Pre-commit CI* is running here: [https://pre-ci.cassandra.apache.org/job/cassandra-21171/]

> JDK25 support
> -------------
>
>                 Key: CASSANDRA-21171
>                 URL: https://issues.apache.org/jira/browse/CASSANDRA-21171
>             Project: Apache Cassandra
>          Issue Type: Task
>          Components: Build
>            Reporter: Simon(Semen) Karalyus
>            Assignee: Jeremiah Jordan
>            Priority: Normal
>         Attachments: Add_JDK25_support.patch
>
>
> This patch builds on the work in https://issues.apache.org/jira/browse/CASSANDRA-18831 that added JDK21 to the list of supported Java versions, and extends that work to enable building and running Cassandra under JDK25.
>  



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@cassandra.apache.org
For additional commands, e-mail: commits-help@cassandra.apache.org