Java Support Policy for Nevis

Oracle changed the release and support lifecycle of the Oracle JDK [1]. All Nevis components rely on AdnJDK, which is derived from the Oracle JDK. Due to changes in the licensing model for commercial users, it is no longer possible to provide newer versions of AdnJDK to our customers. The following sections outline the Java support plans for Nevis.

This policy was updated to reflect the continued support for Java 8.

Operating Systems OpenJDK Lifecycle and Java Support Policy for Nevis

Nevis officially supports RedHat Enterprise Linux, SuSE Enterprise Linux and, as part of the nevisAppliance, CentOS. RedHat Enterprise Linux, SuSE Enterprise Linux, and CentOS provide patched versions of OpenJDK. These OpenJDK versions are updated regularly and provide long-term support that significantly exceeds the official OpenJDK release cycles [2]. The OS defines which major versions of OpenJDK to support. For each component, Nevis tests and supports a major version of the OpenJDK provided by the OS.

This support policy is effective from the 1st of January 2019. The official Oracle "Commercial User End of Public Updates" date for Java 8 SE [1] is a hard deadline.

Starting with the nevisAppliance 2.201811, see the Release Notes for instructions on how to switch to OpenJDK.

All Nevis components use Java except for nevisProxy and NinNet. Both OpenJDK and Oracle JDK are created and maintained currently by Oracle. Oracle builds OracleJDK from the same source repository like OpenJDK. It then adds own commercial features and legacy tools (javapackager, javaws, jcontrol, jmc, jweblauncher, javafx, and desktop support).

All the java distributions need to pass java compatibility kit testing (JCK) and are in principle exchangeable. The risk should be minimal.

You will not be able to apply JDK/JRE related security fixes from January 2019. Whether this is an option depends on a risk analysis of your environment, such as the severity of the JDK/JRE security issue and the Internet exposure of your Nevis components. For exposed components, such as nevisLogrend or nevisAuth, we recommend upgrading as soon as possible. For Nevis components with lower exposure, such as nevisAdmin and nevisReports, waiting for the next maintenance cycle may be acceptable. nevisProxy is not based on Java technology and is not affected by these changes.

Nevis currently supports Java 8. There will be no support for Java 9 and 10.

We may provide official support for further LTS releases (such as Java 11 or Java 17). Nevis support for future Java versions is dependent on the availability of OpenJDK in the officially supported Linux Distributions [3]. We will communicate changes in Nevis Java support via the usual channels.

If the regular Java 8 security updates for the officially supported Linux Distributions cease at a future point in time, we will start supporting a newer Java LTS version.

[1] Oracle Java SE Support Roadmap: <http://www.oracle.com/technetwork/java/eol-135779.html/> [2] OpenJDK Lifecycle and Support Policy: <http://access.redhat.com/articles/1299013> [3][Linux Distribution Support Policy for Nevis]