add java-xy-temurin virtual provides to RPMS (and consider rename)

[judovana]

For years, the java rpms were used to be named java-version-vendor. Temurin rpms currentl do not honour it.

For srtart, adding virtual provides of java-xy-temurin(-devel, javadoc...) would be nice. On long run, a rename (with backward compatible virtual provides, may b worthy

[fitzsim]

Why wait to rename? Virtual provides could be added for backward-compatibility with the non-JPackage naming.

[fitzsim]

See http://www.jpackage.org for the history of the efforts that arrived at these naming conventions.

[jerboaa]

One of the issues of installing to an "unknown" location to the distros point of view is that SELinux labelling doesn't happen automatically. In turn, running a Java app as a systemd service then fails (when SELinux is enforcing) due to the wrong labels.

/usr/lib/jvm/java-XX-<vendor> are "known" locations from SELinux labelling perspective.

[fitzsim]

I would be nice if the RPM files also followed the same naming conventions as other JDKs' RPMs. Does that need its own bug report?

[jerboaa]

I would be nice if the RPM files also followed the same naming conventions as other JDKs' RPMs. Does that need its own bug report?

Yes, please.

[fitzsim]

I would be nice if the RPM files also followed the same naming conventions as other JDKs' RPMs. Does that need its own bug report?

Yes, please.

Done: https://github.com/adoptium/installer/issues/1128

[judovana]

Hello!

Just note - to enable smooth kill of jdks in Fedora, I had obsoleted all java-xyz-openjdk-* : https://src.fedoraproject.org/rpms/adoptium-temurin-java-repository/blob/rawhide/f/adoptium-temurin-java-repository.spec#_54

If Temurin rpms will ever provide java-xyz-openjdk, those obsolete versions must be written more properly - with correct versions of last JDK ever shipped in fedora so it do not cross with future temurins with artificial java-xyz-penjdk provides. Also those "provide: java-xyz-penjdk" must keep very exact version, so this may work.
eg https://src.fedoraproject.org/rpms/java-17-openjdk/blob/f40/f/java-17-openjdk.spec#_1017

Provides: java-%{javaver}-%{origin}%{?1} = %{epoch}:%{version}-%{release}
	
# Standard JPackage base provides
Provides: jre-%{javaver}%{?1} = %{epoch}:%{version}-%{release}
Provides: jre-%{javaver}-%{origin}%{?1} = %{epoch}:%{version}-%{release}
Provides: java-%{javaver}%{?1} = %{epoch}:%{version}-%{release}
%if %is_system_jdk
Provides: java-%{origin}%{?1} = %{epoch}:%{version}-%{release}
Provides: jre-%{origin}%{?1} = %{epoch}:%{version}-%{release}
Provides: java%{?1} = %{epoch}:%{version}-%{release}
Provides: jre%{?1} = %{epoch}:%{version}-%{release}

where origin is in this case openjdk

[judovana]

Hmm. It seems that https://github.com/adoptium/installer/blob/master/linux/jdk/redhat/src/main/packaging/temurin/21/temurin-21-jdk.spec#L109 already provides java-xyz-openjdk as %global java_provides openjdk is on #L14

In that case the version must be added to those provides.

[steelhead31]

@jerboaa having a look at this, we build rpms in two fashions for different distros ( rhel & suse ) . Do you have any thoughts on whether we want to change both of these styles of RPM, or would we rather just change those distros managed under rhel?

[jerboaa]

@jerboaa having a look at this, we build rpms in two fashions for different distros ( rhel & suse ) . Do you have any thoughts on whether we want to change both of these styles of RPM, or would we rather just change those distros managed under rhel?

@steelhead31 This is a SELinux related issue, so I'd think it would be a RHEL/Fedora only problem. Not sure what SUSE uses (is it apparmour?).

[jerboaa]

But if it makes life simpler, we can argue the change would still make sense for SUSE as well. Since the plan is for later JDKs first, this shouldn't be a compatibility issue.

[steelhead31]

I think so, just wanted to confirm my thoughts. I'll limit the scope of these changes to just the rhel builds. I'm also looking at #1128 whilst doing this, again, we'll likely need to consider if we want to keep the package filenames consistent across rhel/suse/alpine/debian.

[steelhead31]

Proposing install paths to look like this.. thoughts? ( Having to use 23 for development.. ) but will be looking to make the proper changes for jdk24 onwards

Install Paths:

/usr/lib/jvm/java-23-temurin-jdk
/usr/lib/jvm/java-23-temurin-jre

RPM Names:

java-23-temurin-jdk-23.0.0.0.0.37-999.x86_64.rpm
java-23-temurin-jre-23.0.0.0.0.37-999.x86_64.rpm

And provides look like this :

rpm -q --provides java-23-temurin
/usr/lib/jvm/temurin-23-jdk
java
java-23
java-23-devel
java-23-headless
java-23-openjdk
java-23-openjdk-devel
java-23-openjdk-headless
java-23-temurin = 23.0.0.0.0.37-999
java-23-temurin(x86-64) = 23.0.0.0.0.37-999
java-devel
java-devel-openjdk
java-headless
java-openjdk
java-openjdk-devel
java-openjdk-headless
java-sdk
java-sdk-23
java-sdk-23-openjdk
java-sdk-openjdk

Im still investigating how to add a symlink to the old name, but thought I'd add the progress made so far.

[steelhead31]

Symlink added ( again example is for jdk23 )

lrwxrwxrwx. 1 root root  15 Mar  5 10:39 temurin-23-jdk -> java-23-temurin
drwxr-xr-x. 9 root root 121 Mar  5 10:39 java-23-temurin

Provides is as the old install location..

rpm -q --provides java-23-temurin
java
java-23
java-23-devel
java-23-headless
java-23-openjdk
java-23-openjdk-devel
java-23-openjdk-headless
java-23-temurin = 23.0.0.0.0.37-999
java-23-temurin(x86-64) = 23.0.0.0.0.37-999
java-devel
java-devel-openjdk
java-headless
java-openjdk
java-openjdk-devel
java-openjdk-headless
java-sdk
java-sdk-23
java-sdk-23-openjdk
java-sdk-openjdk

[steelhead31]

@jerboaa and @judovana would you mind taking a look at the above 2 comments for examples, made with JDK23, for testing purposes, but I'd really be looking to make this change for JDK24 for the upcoming release.

Also thoughts on whether we should rename, the Alpine, Debian and SUSE packages would also be welcome!

[jerboaa]

@steelhead31 I think since the previous package name was temurin-23-jdk then the rpm -q --provides output on the new package needs to have temurin-23-jdk in there (with proper versions). More details here: https://docs.fedoraproject.org/en-US/packaging-guidelines/#renaming-or-replacing-existing-packages

[steelhead31]

Thanks @jerboaa for JDK24, we wont be obsoleting anything, but I'll bear the above in mind for when/if we retrofit this changes into previous versions :)

[steelhead31]

My test data just uses JDK23, as we have github releases for me to build packages from.

[judovana]

When speaking of provides, I would remain: https://github.com/adoptium/installer/issues/1126. The terrible regex I'm providing as example is not needed right away, but provides on libjvm.so() should be there, as such are generated by programs which links directly against it, from which libreoffice is just biggest.

[jerboaa]

Thanks @jerboaa for JDK24, we wont be obsoleting anything, but I'll bear the above in mind for when/if we retrofit this changes into previous versions :)

It depends whether or not the existing installation instructions should continue to work: https://adoptium.net/installation/linux/

There, it's mentioned that one should install using yum install temurin-<version>-jdk which won't work unless you add a virtual provides for it. In the JDK 24 case it would be Provides: temurin-24-jdk = %{version}.

[steelhead31]

Thanks, both.. @judovana I'll take a seperate look at the provides for libre office , alongside planning for changes relevant #1128 .. I think #1126 might be possible in time for the upcoming JDK24 release though, and again, we can implement it for JDK24, and look to backport later ( when there's a little more time.. )

[steelhead31]

Im also planning to update the installation guide alongside this change, specifically for JDK24 onwards, I'm also going to include a static list of provides for these so's..

libjawt.so
libjava.so
libjvm.so
libjverify.so 
libjsig.so

which I think are the key libs in jdk24 ( identical to those in jdk21 ), so that this can be a starting point going forwards.

@judovana do you think this would be a sufficient place to start, to just add provides for the public libs ( again, this is just for JDK24 at this time )

[fitzsim]

Also thoughts on whether we should rename, the Alpine, Debian and SUSE packages would also be welcome!

@steelhead31 Can you look up the JDK package maintainers for each of those distributions and send them each an email asking this?

[judovana]

Yup. I think the listing is great start. The approach we had in fedora is pretty battletested (https://github.com/adoptium/installer/issues/1126#issuecomment-2656406208) feel free to copy it. Whether to keep the manual list, or two regexes (with same list) is nearly identical... TYVM for doing that!

[steelhead31]

Having done investigation, I've elected to change the naming standards for the package for both of the RPM style installer packages, but leave Debian & Alpine unchanged. Each distribution has different naming standards anyway, so this has the least potential for causing disruption.

[jerboaa]

Reproducer for the SELinux issue is (for example on RHEL 8):

$ sudo yum install https://packages.adoptium.net/artifactory/rpm/rhel/8/x86_64/Packages/temurin-23-jre-23.0.2.0.0.7-1.x86_64.rpm
$ sudo -s
# cat /etc/systemd/system/temurin-23-jre-demo.service 
[Unit]
Description=Demo service using Temurin 23 (JRE)
[Service]
ExecStart=/usr/lib/jvm/temurin-23-jre/bin/java -version
[Install]
WantedBy=multi-user.target
# systemctl daemon-reload && systemctl start temurin-23-jre-demo.service && sleep 1 && systemctl status temurin-23-jre-demo.service
● temurin-23-jre-demo.service - Demo service using Temurin 23 (JRE)
   Loaded: loaded (/etc/systemd/system/temurin-23-jre-demo.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Wed 2025-03-12 15:18:49 CET; 1s ago
  Process: 7274 ExecStart=/usr/lib/jvm/temurin-23-jre/bin/java -version (code=exited, status=1/FAILURE)
 Main PID: 7274 (code=exited, status=1/FAILURE)

Mar 12 15:18:49 rhel8-clone systemd[1]: Started Demo service using Temurin 23 (JRE).
Mar 12 15:18:49 rhel8-clone java[7274]: Error occurred during initialization of VM
Mar 12 15:18:49 rhel8-clone java[7274]: Failed to mark memory page as executable - check if grsecurity/PaX is enabled
Mar 12 15:18:49 rhel8-clone systemd[1]: temurin-23-jre-demo.service: Main process exited, code=exited, status=1/FAILURE
Mar 12 15:18:49 rhel8-clone systemd[1]: temurin-23-jre-demo.service: Failed with result 'exit-code'.

Note the Error occurred during initialization of VM issue and java -version not working.

[jerboaa]

I've re-created services for test builds of java-24-temurin-jdk and java-24-temurin-jre from #1141 and tested it, which looks good to me and the issue seems solved:

# cat /etc/systemd/system/temurin-24-jre-demo.service 
[Unit]
Description=Demo service using Temurin 24 (JRE)
[Service]
ExecStart=/usr/lib/jvm/java-24-temurin-jre/bin/java -version
[Install]
WantedBy=multi-user.target
# for i in $(seq 23 24); do echo "------------------------------------------ Testing JDK $i ------------------------------------"; systemctl daemon-reload && systemctl start temurin-$i-jre-demo.service && sleep 1 && systemctl status temurin-$i-jre-demo.service; echo "----------------------------------------------------------------------------------"; done
------------------------------------------ Testing JDK 23 ------------------------------------
● temurin-23-jre-demo.service - Demo service using Temurin 23 (JRE)
   Loaded: loaded (/etc/systemd/system/temurin-23-jre-demo.service; disabled; vendor preset: disabled)
   Active: failed (Result: exit-code) since Wed 2025-03-12 15:22:46 CET; 1s ago
  Process: 7385 ExecStart=/usr/lib/jvm/temurin-23-jre/bin/java -version (code=exited, status=1/FAILURE)
 Main PID: 7385 (code=exited, status=1/FAILURE)

Mar 12 15:22:46 rhel8-clone systemd[1]: Started Demo service using Temurin 23 (JRE).
Mar 12 15:22:46 rhel8-clone java[7385]: Error occurred during initialization of VM
Mar 12 15:22:46 rhel8-clone java[7385]: Failed to mark memory page as executable - check if grsecurity/PaX is enabled
Mar 12 15:22:46 rhel8-clone systemd[1]: temurin-23-jre-demo.service: Main process exited, code=exited, status=1/FAILURE
Mar 12 15:22:46 rhel8-clone systemd[1]: temurin-23-jre-demo.service: Failed with result 'exit-code'.
----------------------------------------------------------------------------------
------------------------------------------ Testing JDK 24 ------------------------------------
● temurin-24-jre-demo.service - Demo service using Temurin 24 (JRE)
   Loaded: loaded (/etc/systemd/system/temurin-24-jre-demo.service; disabled; vendor preset: disabled)
   Active: inactive (dead)

Mar 12 15:09:53 rhel8-clone systemd[1]: Started Demo service using Temurin 24 (JRE).
Mar 12 15:09:53 rhel8-clone java[7008]: openjdk version "24-beta" 2025-03-18
Mar 12 15:09:53 rhel8-clone java[7008]: OpenJDK Runtime Environment Temurin-24+9-202408011942 (build 24-beta+9-ea)
Mar 12 15:09:53 rhel8-clone java[7008]: OpenJDK 64-Bit Server VM Temurin-24+9-202408011942 (build 24-beta+9-ea, mixed mode, sharing)
Mar 12 15:09:53 rhel8-clone systemd[1]: temurin-24-jre-demo.service: Succeeded.
Mar 12 15:22:47 rhel8-clone systemd[1]: Started Demo service using Temurin 24 (JRE).
Mar 12 15:22:47 rhel8-clone java[7436]: openjdk version "24-beta" 2025-03-18
Mar 12 15:22:47 rhel8-clone java[7436]: OpenJDK Runtime Environment Temurin-24+9-202408011942 (build 24-beta+9-ea)
Mar 12 15:22:47 rhel8-clone java[7436]: OpenJDK 64-Bit Server VM Temurin-24+9-202408011942 (build 24-beta+9-ea, mixed mode, sharing)
Mar 12 15:22:47 rhel8-clone systemd[1]: temurin-24-jre-demo.service: Succeeded.
----------------------------------------------------------------------------------
# date
Wed Mar 12 15:22:58 CET 2025

Note the expected -version output in the services journal and a successful run:

Mar 12 15:22:47 rhel8-clone systemd[1]: Started Demo service using Temurin 24 (JRE).
Mar 12 15:22:47 rhel8-clone java[7436]: openjdk version "24-beta" 2025-03-18
Mar 12 15:22:47 rhel8-clone java[7436]: OpenJDK Runtime Environment Temurin-24+9-202408011942 (build 24-beta+9-ea)
Mar 12 15:22:47 rhel8-clone java[7436]: OpenJDK 64-Bit Server VM Temurin-24+9-202408011942 (build 24-beta+9-ea, mixed mode, sharing)
Mar 12 15:22:47 rhel8-clone systemd[1]: temurin-24-jre-demo.service: Succeeded.

[jerboaa]

Similar for the JDK 24 RPM (java-24-temurin-jdk):

# cat /etc/systemd/system/temurin-24-jdk-demo.service 
[Unit]
Description=Demo service using Temurin 24 (JDK)
[Service]
ExecStart=/usr/lib/jvm/java-24-temurin-jdk/bin/java -version
[Install]
WantedBy=multi-user.target
# systemctl daemon-reload && systemctl start temurin-24-jdk-demo.service && sleep 1 && systemctl status temurin-24-jdk-demo.service
● temurin-24-jdk-demo.service - Demo service using Temurin 24 (JDK)
   Loaded: loaded (/etc/systemd/system/temurin-24-jdk-demo.service; disabled; vendor preset: disabled)
   Active: inactive (dead)

Mar 12 15:28:40 rhel8-clone systemd[1]: Started Demo service using Temurin 24 (JDK).
Mar 12 15:28:40 rhel8-clone java[7559]: openjdk version "24-beta" 2025-03-18
Mar 12 15:28:40 rhel8-clone java[7559]: OpenJDK Runtime Environment Temurin-24+9-202408011942 (build 24-beta+9-ea)
Mar 12 15:28:40 rhel8-clone java[7559]: OpenJDK 64-Bit Server VM Temurin-24+9-202408011942 (build 24-beta+9-ea, mixed mode, sharing)
Mar 12 15:28:40 rhel8-clone systemd[1]: temurin-24-jdk-demo.service: Succeeded.
# date
Wed Mar 12 15:28:46 CET 2025