Re: Timeframe for JEP-411 completely removing SecurityManager APIs

2022-05-02 Thread Peter Firmstone
Hi Arjan, Java 8 is supported until 2030, and 17 to 2029, we would be unable to continue testing against new Java releases. https://bugs.openjdk.java.net/browse/JDK-8272340 With this choice, there will be incompatible Java versions we must prevent our software from running on, until it becom

Re: Timeframe for JEP-411 completely removing SecurityManager APIs

2022-05-02 Thread arjan tijms
Hi, On Monday, May 2, 2022, Peter Firmstone wrote: I guess I'm just trying to say we need more time, the process of > extricating SM for security will take years, if we can leave SM as it is in > deprecated form for a number of years, that would be greatly appreciated. Just wondering, but woul

Re: Timeframe for JEP-411 completely removing SecurityManager APIs

2022-05-01 Thread Peter Firmstone
Our software was never designed to run without SM enabled.  We will need to instrument the Java API's with some access controls, this will be reliant on the removal of finalizers, or the option to disable them. In our case deserialization is decided by the permission granted to the authenticat

Re: Timeframe for JEP-411 completely removing SecurityManager APIs

2022-04-26 Thread Scott Stark
By "migration feature" I'm talking about being able to retain the type of library code where one has a conditional call to an AccessController::doPrivileged(...) method that is only done when System.getSecurityManager() is not null. Not having to remove this code in all dependent libraries for a g

Re: Timeframe for JEP-411 completely removing SecurityManager APIs

2022-04-26 Thread Sean Mullan
On 4/26/22 1:06 PM, Scott Stark wrote: By "migration feature" I'm talking about being able to retain the type of library code where one has a conditional call to an AccessController::doPrivileged(...) method that is only done when System.getSecurityManager() is not null. Not having to remove

Re: Timeframe for JEP-411 completely removing SecurityManager APIs

2022-04-26 Thread Sean Mullan
Hello Scott, On 4/25/22 2:25 PM, Scott Stark wrote: Hello, I'm Scott Stark of Red Hat, and a member of the Jakarta EE platform dev group (EEPD). I'm currently coordinating the Jakarta EE 10 release that is targeting June of this year (2022). The removal of the SecurityManager as described in

Timeframe for JEP-411 completely removing SecurityManager APIs

2022-04-25 Thread Scott Stark
Hello, I'm Scott Stark of Red Hat, and a member of the Jakarta EE platform dev group (EEPD). I'm currently coordinating the Jakarta EE 10 release that is targeting June of this year (2022). The removal of the SecurityManager as described in JEP-411 has been a topic for the EEPD on may calls this y