Oracle/Java licensing changes

jasond...@gmail.com

unread,

May 7, 2019, 1:15:32 PM5/7/19

to go-cd

Given the relatively recent Oracle Java licensing changes you all are aware of, what is the plan for GOCD?

Will users/clients be expected now to pay for any installation of Java needed for an agent?

Here is a faq for those interested: https://www.oracle.com/technetwork/java/javase/overview/oracle-jdk-faqs.html

Sorry if i missed this in another thread, but didn't find anything definitive.

Thanks

jason

Aravind SV

unread,

May 8, 2019, 10:21:33 PM5/8/19

to go-cd

Hello Jason,

On Tue, May 7, 2019 at 1:15 PM <jasond...@gmail.com> wrote:

Given the relatively recent Oracle Java licensing changes you all are aware of, what is the plan for GOCD?

Will users/clients be expected now to pay for any installation of Java needed for an agent?

Here is a faq for those interested: https://www.oracle.com/technetwork/java/javase/overview/oracle-jdk-faqs.html

==== DISCLAIMER: I am not a lawyer. This does not constitute not legal advice. You should consult your legal counsel. ====

Yes, we were supposed to mention this as a part of the release notes of 19.3, but missed it. You're right: Because of all the changes around the JVM, we've had to make some changes in our support for different versions of Java. Other relevant FAQs are:

The main aspects of these decisions from Oracle which apply are:

1. There will be a new major release of Java every 6 months.

2. Security updates will be provided only a few times within that timeframe (twice, I believe).

3. A new (non-LTS) release of Java supersedes the previous version (and it becomes "unsupported" by Oracle).

4. Oracle JDK is released under a commercial license, whereas Open JDK is released under GPL+CPE (GPL + Classpath exception)

Given all of this, and the fact that GoCD bundles the JRE in certain cases (Windows and Mac OS), we wanted to make sure that we were compliant and weren't causing anyone any undue distress. Based on conversations with our legal counsel, we believe that it is safe to bundle OpenJDK with GoCD.

Given the 6-month release cycle and the lack of security updates, GoCD will support the last 3 versions of JRE. This will mean that users can use (approximately) an 18 month-old JVM. The rationale is that upgrading JVM versions on agents may be painful for sysadmins that don’t have automation in place, or there’s too much regulatory overhead. The compiler target will be adjusted every 6 months when a new Java release is out. The compiler target will be (LATEST_VERSION - 2). For example: if the current GA Java version is 15, the compiler target will be set to 13. The main reason is that it's not feasible to keep up with more than three releases of Java at the same time, ensuring tests have run on all of them. Also, those releases do not get security updates and it's unsafe to recommend them.

The impact for sysadmins: Java 13 is expected to be out in about 5-6 months from today, around the same time this policy kicks in. This will mean that in the GoCD release 6 months from now, GoCD will support Java 11, 12, 13 only. If this is not already obvious: Support for java 8, 9, 10 will be completely dropped in 6 months from now.

There are others who have thought about this more deeply (/cc Ketan). So, this post might be corrected (both technically and legally). Please don't use this as an official statement. My preference is for us to make a blog post about this and mention it on the mailing list, as the official stance.

==== DISCLAIMER: I am not a lawyer. This does not constitute not legal advice. You should consult your legal counsel. ====

Regards,

Aravind

Jason D

unread,

May 10, 2019, 9:41:50 AM5/10/19

to go-cd

Thanks for the additional info Aravind.

As far as the license changes go, if I'm reading this right, given the (now) GOCD support for OpenJDK (as well as the Java JRE & Oracle JDK), these are the options for users:
-- continue to use JRE bundled with GO -- which would require payment to Oracle
-- use the Oracle JDK - which would require payment to Oracle
-- use OpenJDK - which is free

Does this seem accurate?

Aravind SV

unread,

May 10, 2019, 11:29:09 AM5/10/19

to go-cd

Hello Jason,

Not entirely. There is a GoCD blog post coming which will explain this better than I did. However, to your points:

1. As far as I know, no GoCD release has been released with a bundled Oracle JRE/JDK which has the new commercial license, which was introduced as a part of Oracle's JRE 11.

2. Here are the versions of the bundled JRE for GoCD's Windows installers (based on a quick look by me):

18.10: OracleJDK's JRE 1.8.0_102 (License: Oracle BCL - which allows redistribution and commercial use)
18.11: OracleJDK's JRE 1.8.0_102 (License: Oracle BCL - which allows redistribution and commercial use)
18.12: OpenJDK's JRE 11.0.1 (License: GPL+CPE - which allows redistribution and commercial use)
19.1: OpenJDK's JRE 11.0.1 (License: GPL+CPE - which allows redistribution and commercial use)
19.2: OpenJDK's JRE 11.0.2 (License: GPL+CPE - which allows redistribution and commercial use)
19.3: OpenJDK's JRE 11.0.2 (License: GPL+CPE - which allows redistribution and commercial use)

3. Earlier: OracleJDK's JRE included commercial components which were not under Oracle BCL. So, even though you were using Oracle JDK and signed the BCL, if the Java program you were using happened to use some of the commercial components, you were suddenly operating in violation of the license and Oracle could come after you with their enforcement team. Now, Oracle's OpenJDK comes with a permissive GPL+CPE license, and doesn't contain any commercial components. Oracle's OracleJDK does have commercial components and is distributed under the Oracle Technology Network License Agreement for Oracle Java SE which needs/requires a license for any commercial use. We have never, knowingly, bundled this with GoCD or knowingly used any commercial components.

Going back to your points:

As far as the license changes go, if I'm reading this right, given the (now) GOCD support for OpenJDK (as well as the Java JRE & Oracle JDK), these are the options for users:
-- continue to use JRE bundled with GO -- which would require payment to Oracle

No. GoCD's bundled versions of JRE are either Oracle JRE with BCL or Oracle OpenJDK's JRE with GPL+CPE, neither of which require you to pay Oracle.

-- use the Oracle JDK - which would require payment to Oracle

Definitely. Especially from Java 11. I think you don't need to if you're using older versions of Java and not using commercial components (which GoCD should not).

-- use OpenJDK - which is free

Correct. Either bundled in the latest releases of GoCD or through your package managers.

Aravind SV

unread,

May 21, 2019, 2:56:49 PM5/21/19

to go-cd

Just an FYI that there is now a blog post about this: https://www.gocd.org/2019/05/21/official-stance-on-java/