You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@netbeans.apache.org by "mbien (via GitHub)" <gi...@apache.org> on 2024/10/31 02:50:50 UTC
[PR] Remove SecurityManager layer [netbeans]
mbien opened a new pull request, #7928:
URL: https://github.com/apache/netbeans/pull/7928
JDK 24 on the horizon we will have to find a solution for the upcoming removal of the deprecated `SecurityManager` mechanism.
[JEP 486](https://openjdk.org/jeps/486) is a candidate for JDK 24, PR is here https://github.com/openjdk/jdk/pull/21498 (still open)
This PR is an alternative to https://github.com/apache/netbeans/pull/3386 and proposes to remove the SM layer entirely, trying to avoid additional complexity of a tracking agent.
To simulate this, I am running NB 23 with `-DTopSecurityManager.disable=true -Djava.lang.Runtime.level=FINE` for several weeks now without issues, this PR goes one step further and removes the SM layer for a test build - which I tested too, but only about 10 days so far.
What is SM used for? Why could we likely simply remove it?
System exit blocking:
- trusted dependencies should not exit JVMs! (OpenJDK essentially came to the same conclusion if you read the JEP)
- there are many other ways to take down JVMs, the basic question is: is the dependency trusted or not, there is no way to simply run untrusted code today
- JVM exit is trackable with `-J-Djava.lang.Runtime.level=FINE` (will log full stack trace) and also via JFR's `jdk.Shutdown` event
- if something exits it can be found in the log and the issue resolved
- there is no ambiguity between JVM hard crashes and faulty dependencies
- problematic plugins can be removed from the portal until fixed (we have to do this anyway if something causes issues)
- tested several scenarios I could come up with
- e.g form designer preview windows with `EXIT_ON_CLOSE`
- or debugger eval window running `System.exit(0)`) but nothing did actually exit NB
- the "waiting for process to finish" window does also still work before exit
swing clipboard swap:
- NB swapped swing's clipboard impl by hooking into JDK's AppContext which was originally used for webstart sandboxing
- this did grab `sun.awt.AppContext` and write [`TransferHandler#SandboxClipboardKey`](https://github.com/openjdk/jdk/blob/688e92e7f5febddd2935cb7f500dd3f10fbd9401/src/java.desktop/share/classes/javax/swing/TransferHandler.java#L1788-L1792) using reflection, which was only read by Swing if a SM blocked access to the system clipboard (!)
- with webstart and SM removed, the clipboard swap trick will likely quit working too at some point (why would they keep this impl detail?)
- we might be able to remove an add-opens here
- TODO: more data needed - i tested this for over a month now and clipboard works perfectly fine so far - but I am no clipboard power user and only tested on linux
File IO tracking:
- tracking r/w methods gives wrong picture of the environment
- big part of IO is out of process (e.g the mvn/gradle process which might be even second level background daemons)
- IO heavy tasks are well known (e.g code scanning) even without method level tracking
- NVMe/SSDs are pretty good at concurrent IO today
- scheduling is questionable on non-mechanical drives
- most of this was written when hardware was more limited and RAM / caches were small
- running NB without IO task scheduling works perfectly fine for me - I can't tell a difference
Tracking calls to Unsafe:
- Unsafe is deprecated for removal, this problem will fix itself
- switches exist, e.g: `--sun-misc-unsafe-memory-access=deny`
- platform apps might be able to use JMS encapsulation to further limit reflective access
-> I don't think we actually need the SM layer anymore. This gives us an opportunity to remove a layer without further complicating things with an agent requirement for everything (launcher, tests, archetypes etc).
The agent rewrites bytecode by hand(!) to avoid having to bundle ASM, this could be likely solved by shading ASM till JDK 23 and using the multi-release mechanism + classfile API for 24+ (now final) but this is all extra maintenance cost which we should try to avoid if possible.
Bytecode rewriting can cause followup issues e,g jumping out of methods during debugging sessions without seeing the reason for it in the source.
I do think the agent impl is actually [pretty cool](https://github.com/apache/netbeans/pull/3386#issuecomment-1001446015) but I don't think everything what can be added, should be added if it is avoidable. (also please note that back then NB was still stuck on JDK 8)
this is just a draft - don't panic. This likely will need to be discussed on the mailing list anyway.
But feel free to give the dev build it a try. (the windows launcher might still break things since it has to be build separately unfortunately)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "mbien (via GitHub)" <gi...@apache.org>.
mbien commented on PR #7928:
URL: https://github.com/apache/netbeans/pull/7928#issuecomment-2552419685
temporarily merged https://github.com/apache/netbeans/pull/8037 into this PR so that we can test everything on JDK 24-ea (chicken-egg problem).
All tests green: https://github.com/apache/netbeans/actions/runs/12401186185
The only exception are the `platform/masterfs` tests which rely on the SM for read/write counting, those are kept on JDK 17 for now. Those tests already are very JDK version sensitive, remember having to patch them at least once https://github.com/apache/netbeans/commit/f2f8d5a91cfd5e68872a453dfa716a652577056d. Would be good to find other ways to tests this in future. Potentially via JFR IO events or other means.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "mbien (via GitHub)" <gi...@apache.org>.
mbien commented on code in PR #7928:
URL: https://github.com/apache/netbeans/pull/7928#discussion_r1901461585
##########
platform/o.n.bootstrap/nbproject/project.properties:
##########
@@ -16,7 +16,7 @@
# under the License.
javac.compilerargs=-Xlint:all -Xlint:-serial -Xlint:-processing
-javac.source=1.8
+javac.release=11
Review Comment:
note to self: this bumps bootstrap to 11 to have access to the `StackWalker` API.
this should be fine since `Main` is compiled separately, so the warning dialogs will still show up when launched on older JDKs:
<details>
https://github.com/apache/netbeans/blob/33cdacf4e3d5591b41e3d2971f7bfab800ddf464/platform/o.n.bootstrap/build.xml#L32-L40
</details>
verified with launch attempt on JDK 8:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "neilcsmith-net (via GitHub)" <gi...@apache.org>.
neilcsmith-net commented on PR #7928:
URL: https://github.com/apache/netbeans/pull/7928#issuecomment-2593649858
Now the launcher is updated to remove the hardcoded `-J-Djava.security.manager=allow`, setting `-J-DTopSecurityManager.disable=true` in the conf seems to work to run on JDK 24ea. If that can be verified to be OK everywhere needed, I'd be tempted to push the actual removal to NB26, and ship NB25 with the security manager disabled by default in the conf. This would give an escape hatch for NB25 in case of reported issues, and more time to resolve them.
@lahodaj thoughts on this? Seems similar to the javavscode PR you linked above?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "mbien (via GitHub)" <gi...@apache.org>.
mbien merged PR #7928:
URL: https://github.com/apache/netbeans/pull/7928
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "mbien (via GitHub)" <gi...@apache.org>.
mbien commented on code in PR #7928:
URL: https://github.com/apache/netbeans/pull/7928#discussion_r1953713548
##########
platform/o.n.bootstrap/src/org/netbeans/TopSecurityManager.java:
##########
@@ -19,163 +19,13 @@
package org.netbeans;
-import java.awt.AWTPermission;
-import java.io.FileDescriptor;
-import java.lang.reflect.Field;
-import java.lang.reflect.Method;
-import java.net.InetAddress;
-import java.net.URL;
-import java.net.UnknownHostException;
-import java.security.AccessControlContext;
-import java.security.AccessController;
-import java.security.AllPermission;
-import java.security.CodeSource;
-import java.security.Permission;
-import java.security.PrivilegedActionException;
-import java.security.PrivilegedExceptionAction;
-import java.util.ArrayList;
-import java.util.HashSet;
-import java.util.Iterator;
-import java.util.List;
-import java.util.Set;
-import java.util.logging.Level;
-import java.util.logging.Logger;
-import java.util.logging.LoggingPermission;
-import org.openide.util.Lookup;
-import org.openide.util.WeakSet;
-
/** NetBeans security manager implementation.
* @author Ales Novak, Jesse Glick
Review Comment:
renamed the class to `NbExit` since the only remaining purpose seems to be to not block shutdown hooks which might call exit() too.
I reimplemented the logic with `AtomicBoolean` to remove a race condition + removed author information as requested.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "mbien (via GitHub)" <gi...@apache.org>.
mbien commented on code in PR #7928:
URL: https://github.com/apache/netbeans/pull/7928#discussion_r1901461585
##########
platform/o.n.bootstrap/nbproject/project.properties:
##########
@@ -16,7 +16,7 @@
# under the License.
javac.compilerargs=-Xlint:all -Xlint:-serial -Xlint:-processing
-javac.source=1.8
+javac.release=11
Review Comment:
note to self: this bumps bootstrap to 11 to have access to the `StackWalker` API.
this should be fine since `Main` is compiled separately, so the warning dialogs etc will still show up when launched on older JDKs:
https://github.com/apache/netbeans/blob/33cdacf4e3d5591b41e3d2971f7bfab800ddf464/platform/o.n.bootstrap/build.xml#L32-L40
verified with launch attempt on JDK 8:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "mbien (via GitHub)" <gi...@apache.org>.
mbien commented on code in PR #7928:
URL: https://github.com/apache/netbeans/pull/7928#discussion_r1919387466
##########
platform/o.n.bootstrap/src/org/netbeans/TopSecurityManager.java:
##########
@@ -19,163 +19,13 @@
package org.netbeans;
-import java.awt.AWTPermission;
-import java.io.FileDescriptor;
-import java.lang.reflect.Field;
-import java.lang.reflect.Method;
-import java.net.InetAddress;
-import java.net.URL;
-import java.net.UnknownHostException;
-import java.security.AccessControlContext;
-import java.security.AccessController;
-import java.security.AllPermission;
-import java.security.CodeSource;
-import java.security.Permission;
-import java.security.PrivilegedActionException;
-import java.security.PrivilegedExceptionAction;
-import java.util.ArrayList;
-import java.util.HashSet;
-import java.util.Iterator;
-import java.util.List;
-import java.util.Set;
-import java.util.logging.Level;
-import java.util.logging.Logger;
-import java.util.logging.LoggingPermission;
-import org.openide.util.Lookup;
-import org.openide.util.WeakSet;
-
/** NetBeans security manager implementation.
* @author Ales Novak, Jesse Glick
Review Comment:
it would be rude to remove author information! :) This class has only one method left, we probably should move it somewhere else in another pass - I kept it minimal for now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "jglick (via GitHub)" <gi...@apache.org>.
jglick commented on code in PR #7928:
URL: https://github.com/apache/netbeans/pull/7928#discussion_r1919379172
##########
platform/o.n.bootstrap/src/org/netbeans/TopSecurityManager.java:
##########
@@ -19,163 +19,13 @@
package org.netbeans;
-import java.awt.AWTPermission;
-import java.io.FileDescriptor;
-import java.lang.reflect.Field;
-import java.lang.reflect.Method;
-import java.net.InetAddress;
-import java.net.URL;
-import java.net.UnknownHostException;
-import java.security.AccessControlContext;
-import java.security.AccessController;
-import java.security.AllPermission;
-import java.security.CodeSource;
-import java.security.Permission;
-import java.security.PrivilegedActionException;
-import java.security.PrivilegedExceptionAction;
-import java.util.ArrayList;
-import java.util.HashSet;
-import java.util.Iterator;
-import java.util.List;
-import java.util.Set;
-import java.util.logging.Level;
-import java.util.logging.Logger;
-import java.util.logging.LoggingPermission;
-import org.openide.util.Lookup;
-import org.openide.util.WeakSet;
-
/** NetBeans security manager implementation.
* @author Ales Novak, Jesse Glick
Review Comment:
I think my name can be removed now that it has been gutted. :grin:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "neilcsmith-net (via GitHub)" <gi...@apache.org>.
neilcsmith-net commented on PR #7928:
URL: https://github.com/apache/netbeans/pull/7928#issuecomment-2449506982
Thanks @mbien Following the Slack conversation on this I've also been running NetBeans a lot with `TopSecurityManager.disable=true` and am mostly in favour of taking this way forward and removing a layer of complexity. Maybe call me a +0.8.
> I know about 4 ways to trigger System.exit/Runtime.exit/Runtime.halt in current NetBeans ... (I don't want to put too much details here, as they can be sensitive.)
Sensitive in what way? There are numerous ways that code running in the IDE VM, or even in an external process, can cause the IDE to exit (not to mention any other havoc). I still agree with Alan Bateman's comment on the enhancement request for adding an API to intercept exit - https://bugs.openjdk.org/browse/JDK-8199704 - "There has been several APIs prototyped around this and the conclusion each time is that it probably isn't the right thing to do. If ant or some other task runner is running a task that is hostile to running embedded/in-process then it should be launched into their own process/VM."
IMO the benefits of intercepting System::exit are slight in comparison to the complexity introduced, were this the only reason for an agent ...
> with webstart and SM removed, the clipboard swap trick will likely quit working too at some point
The agent approach doesn't use the clipboard swap trick to implement this AFAIK. https://github.com/apache/netbeans/pull/3386/commits/8114562db52a62b359505097e813fc3f053beec6
The clipboard aspect of this is actually the aspect that concerns me the most. At the same time, given all the clipboard issues on Windows, removing all hacks might at least prove it's not our fault! :smile:
> for the clipboard, there's "Paste from History" (Ctrl-Shift-D), which I believe depends on the ability to listen on the clipboard, and the standard Swing clipboard is not firing events,
With a disabled SM the paste from history is _partly_ broken. It's possibly worth considering what the point of this feature is. If it's external and in-editor text, then that might be achievable without clipboard listening. There are of course now some events fired by the clipboard, but I assume not covering everything we want.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "mbien (via GitHub)" <gi...@apache.org>.
mbien commented on PR #7928:
URL: https://github.com/apache/netbeans/pull/7928#issuecomment-2450760981
> I know about 4 ways to trigger System.exit/Runtime.exit/Runtime.halt in current NetBeans: a NetBeans module, an annotation processor/javac Plugin running for an open project, a Jackpot rule and profiler query language. (I don't want to put too much details here, as they can be sensitive.)
JFR will write events for both, halt and exit. the java.lang.Runtime logger unfortunately only logs exit. I [asked](https://mail.openjdk.org/pipermail/jdk-dev/2024-October/thread.html#9469) on the JDK list a few weeks ago, there was also a proposal to [log on halt too](https://www.mail-archive.com/core-libs-dev@openjdk.org/msg19309.html) - but it was decided to not implement it there specifically due to the risk of the callback into application code (logger) which could fail for whatever reason.
While debugging, `-Xlog:safepoint+stats=info` could be also used to figure out the exit cause - however this isn't ideal for runtime. (JFR and the `java.lang.Runtime` is intended for runtime though, see [note in javadoc](https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/lang/Runtime.html#exit(int)))
IMO: an annotation processor calling halt, would be as broken as a annotation processor trying figure out your system password. Malicious or not - dependencies like that are filtered out by the java ecosystem, library supply chain reviews etc. You should not blindly use libraries you don't know - only protecting against exit/halt gives only a false sense of safety - a disappearing JVM is the smallest problem if you truly don't trust the code you execute.
>for the clipboard, there's "Paste from History" (Ctrl-Shift-D), which I believe depends on the ability to listen on the clipboard, and the standard Swing clipboard is not firing events, so the history may be missing some entries. (Although I suspect there's a check and event on Window activated, so this mostly affects stuff copied inside the IDE.)
I feared the same. However, it seems to work fine with one slight change in behavior: Copy from the editor will only appear in the list after focus loss or after the next copy event (paste works correctly though), everywhere else it appears right away. So there seems to be a special case for copy from editor specifically - this might be also connected to the bug, see comment https://github.com/apache/netbeans/discussions/7051#discussioncomment-11115211
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "lahodaj (via GitHub)" <gi...@apache.org>.
lahodaj commented on PR #7928:
URL: https://github.com/apache/netbeans/pull/7928#issuecomment-2449252836
Not too much against SM removal.
A few assorted comments, just to list what I know of. None of these necessarily means we need to replace SM, but it is something we are loosing.
- I know about 4 ways to trigger `System.exit/Runtime.exit/Runtime.halt` in current NetBeans: a NetBeans module, an annotation processor/javac Plugin running for an open project, a Jackpot rule and profiler query language. (I don't want to put too much details here, as they can be sensitive.)
- for the clipboard, there's "Paste from History" (Ctrl-Shift-D), which I believe depends on the ability to listen on the clipboard, and the standard Swing clipboard is not firing events, so the history may be missing some entries. (Although I suspect there's a check and event on Window activated, so this mostly affects stuff copied inside the IDE.)
- for I/O tracking, besides the runtime, there are quite a few tests that track I/O to verify the code is not touching "too many files".
-
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "neilcsmith-net (via GitHub)" <gi...@apache.org>.
neilcsmith-net commented on PR #7928:
URL: https://github.com/apache/netbeans/pull/7928#issuecomment-2449522563
> But feel free to give the dev build it a try. (the windows launcher might still break things since it has to be build separately unfortunately)
You can of course replace the launcher in the workflow dev build with the launcher built from this PR at https://github.com/apache/netbeans/actions/runs/11605258427
I wonder if we can find a way to do this automatically for dev builds that change the launcher code??? :thinking:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "emaphis (via GitHub)" <gi...@apache.org>.
emaphis commented on PR #7928:
URL: https://github.com/apache/netbeans/pull/7928#issuecomment-2593889213
Well, I'm running a NetBeans development build on Windows 10 using OpenJDK 24 right now and it seems to be running fine so far.
From the `netbeans_default_options=...` in the netbeans.conf file
I deleted the JVM options:
# -J--add-opens=java.base/java.security=ALL-UNNAMED
# -J-Djava.security.manager=allow
And I added the JVM option:
# -J-DTopSecurityManager.disable=true
I tried this configuration in OpenJDK 23 and 24.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "mbien (via GitHub)" <gi...@apache.org>.
mbien commented on PR #7928:
URL: https://github.com/apache/netbeans/pull/7928#issuecomment-2675814278
thanks for the reviews. Lets merge it so that CI can start testing on JDK 24 before someone breaks something ;)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "mbien (via GitHub)" <gi...@apache.org>.
mbien commented on PR #7928:
URL: https://github.com/apache/netbeans/pull/7928#issuecomment-2655338184
lets see if tests still work on JDK 24
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "mbien (via GitHub)" <gi...@apache.org>.
mbien commented on PR #7928:
URL: https://github.com/apache/netbeans/pull/7928#issuecomment-2675838349
forgot to mention: `right click -> run` does now also work for modules using JDK 24.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "BradWalker (via GitHub)" <gi...@apache.org>.
BradWalker commented on PR #7928:
URL: https://github.com/apache/netbeans/pull/7928#issuecomment-2588818008
Hey @mbien , should we also delete `platform/o.n.bootstrap/src/allow.java` ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "mbien (via GitHub)" <gi...@apache.org>.
mbien commented on code in PR #7928:
URL: https://github.com/apache/netbeans/pull/7928#discussion_r1901461585
##########
platform/o.n.bootstrap/nbproject/project.properties:
##########
@@ -16,7 +16,7 @@
# under the License.
javac.compilerargs=-Xlint:all -Xlint:-serial -Xlint:-processing
-javac.source=1.8
+javac.release=11
Review Comment:
note to self: this bumps bootstrap to 11 to have access to the `StackWalker` API.
this should be fine since `Main` is compiled separately, so the warning dialogs will still show up when launched on older JDKs:
https://github.com/apache/netbeans/blob/33cdacf4e3d5591b41e3d2971f7bfab800ddf464/platform/o.n.bootstrap/build.xml#L32-L40
verified with launch attempt on JDK 8:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "mbien (via GitHub)" <gi...@apache.org>.
mbien commented on PR #7928:
URL: https://github.com/apache/netbeans/pull/7928#issuecomment-2508660548
- extracted (some) CI changes into https://github.com/apache/netbeans/pull/7974
- extracted launcher flag removal into https://github.com/apache/netbeans/pull/8009
- rebased again
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "mbien (via GitHub)" <gi...@apache.org>.
mbien commented on PR #7928:
URL: https://github.com/apache/netbeans/pull/7928#issuecomment-2589813897
> Hey @mbien , should we also delete `platform/o.n.bootstrap/src/allow.java` ?
@BradWalker this PR already removes that file, or do you mean something else? I can find only one allow.java
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "mbien (via GitHub)" <gi...@apache.org>.
mbien commented on PR #7928:
URL: https://github.com/apache/netbeans/pull/7928#issuecomment-2593961819
please note that we have two discussion threads on the dev list. The [first](https://lists.apache.org/thread/zztyynsfgonbbxj6kwvgbft5oxfw2k6w) is about the SM removal roadmap itself, the [second](https://lists.apache.org/thread/9d7m8op21qmvkf16boykxhsmxv9xzs64) about the concrete implementation of the removal. We have also two proposals for that.
Lets not discuss `DTopSecurityManager.disable=` flags here since they don't exist anymore in this PR.
removing the milestone
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists
Re: [PR] Remove SecurityManager layer [netbeans]
Posted by "mbien (via GitHub)" <gi...@apache.org>.
mbien commented on PR #7928:
URL: https://github.com/apache/netbeans/pull/7928#issuecomment-2481434448
update:
- JDK merged the SM removal PR, it is integrated in 24-ea build 24
- rebased this PR to latest master
- enabled builds/tests on JDK 24-ea, however, zulu JDK is still at build 22 atm - needs to be restarted
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@netbeans.apache.org
For additional commands, e-mail: notifications-help@netbeans.apache.org
For further information about the NetBeans mailing lists, visit:
https://cwiki.apache.org/confluence/display/NETBEANS/Mailing+lists