Please release another 12.0.2+10.x build for macOS containing the entitlement allowing unsigned binaries

[jasontedor]

In trying to prepare for Elasticsearch to run with AdoptOpenJDK on macOS Catalina, we are being hit by adoptium/temurin-build#1206 on 12.0.2+10.2. This is because we use JNA, and the JNA native library extracted at runtime is treated by macOS as an unsigned binary. It looks like there is a fix in adoptium/temurin-build#1207 but that fix was only released into 11.0.4+11.4. We adopt the newest JDK aggressively (i.e., our builds already depend on JDK 12 builds, moving to a JDK 11 build for this fix would be moving backwards), so we would like to raise the possibility of a JDK 12.0.2+10.x build for macOS that could contain this fix to add the entitlement to allow unsigned binaries.

cc @smlambert

[smlambert]

@gdams - as we discussed today, it would be great to close off jdk12 with this last release/update. Let me know if/how I can assist, thanks!

[karianna]

For both OpenJ9 and Hotspot build a 12.0.2+10.3

[karianna]

TSC approves

[smlambert]

Notes from @sxa555 regarding kicking off the build today (that can subsequently be used as a 'quick start' guide for others who may help kick off future builds:

FYI Ref #110 I've triggered https://ci.adoptopenjdk.net/job/build-scripts/job/openjdk12-pipeline/ jobs 296 (HotSpot) and 297 (OpenJ9 mac+AIX) - In terms of parameters I set the targetConfiguration JSON to the desired platforms, releaseType to Nightly , adoptBuildNumber to 3, scmReference to 11.0.2+10_adopt and for OpenJ9 it has the overridePublishName that is needed to add the OpenJ9 version into the release (This is also why you need separate pipelines kicked off for HotSpot and OpenJ9). Hopefully that's enough base education for you to understand it.

Once it's complete we would use refactor_openjdk_release_tool to publish it as a full release to github.

[smlambert]

Build pipelines & test completed:
https://ci.adoptopenjdk.net/job/build-scripts/job/openjdk12-pipeline/302/

• sanity.system: passes
• extended.system: 1 failure HCRWorkloadLateAttach - non-blocking
• sanity.openjdk: 2/1066 tests fail, non-blocking network tests

https://ci.adoptopenjdk.net/job/build-scripts/job/openjdk12-pipeline/301/

• sanity.system: passes
• extended.system: passes
• sanity.openjdk: 2/1204 tests fail, non-blocking known issue

[sxa]

The AIX one in pipeline 301 isn't too happy and seems to have resulted in the demise of build-osuosl-ppc64-aix-71-1 - @andrew-m-leonard is attempting to re-run some of those jobs on another machine, and will hopefully not kill it too

[smlambert]

Note: I am rerunning the jdk12 sanity.openjdk test target on AIX at the OpenJ9 server here).

[andrew-m-leonard]

Managed a run on hyc-runtimes:
https://hyc-runtimes-jenkins.swg-devops.com/view/Test_openjdk/job/Test-sanity.openjdk-JDK12-aix_ppc-64_cmprssptrs/42/#showFailuresLink

9 failures:

    native_sanity/simplenativelauncher/ProgramTest.java.ProgramTest
    native_sanity/simplenativelib/NativeLib.java.NativeLib
    native_sanity/simplenativelib2/NativeLib.java.NativeLib
    java/net/Socket/asyncClose/AsyncClose.java.AsyncClose
    java/lang/invoke/condy/CondyNestedResolutionTest.java.CondyNestedResolutionTest
    java/net/Inet4Address/PingThis.java.PingThis
    java/net/SocketPermission/SocketPermissionTest.java.SocketPermissionTest
    java/nio/channels/AsyncCloseAndInterrupt.java.AsyncCloseAndInterrupt
    java/nio/channels/DatagramChannel/BasicMulticastTests.java.BasicMulticastTests

[smlambert]

native_sanity are newly added tests (not blocking as its to be determined if they are applicable to this implementation)
network tests look to be setup specific (and been around awhile, not regression / not blocking, should consider excluding as we investigate the setup issue)
CondyNestedResolutionTest issue raised here: eclipse-openj9/openj9#7158 and has been around awhile, not a regression / not blocking

[sxa]

HCRWorkloadLateAttache failure is also not new and covered by adoptium/aqa-tests#1353 so should not block release

[sxa]

On the basis of the previous comments I am happy to approve this release and will do the promotion

[sxa]

Holiding off AIX in light of some other testing not being completed yet but am publishing the macos ones:

• https://github.com/AdoptOpenJDK/openjdk12-binaries/releases/tag/jdk-12.0.2%2B10.3_openj9-0.15.1
• https://github.com/AdoptOpenJDK/openjdk12-binaries/releases/tag/jdk-12.0.2%2B10.3

[sxa]

@pshipton has confirmed he's happy with condition of the AIX build now after looking at the problems, therefore I am approving that one for release too now

[smlambert]

Want to follow up, based on #110 (comment) a build was published, but I had heard from @sxa555 there may still be some concerns as to whether this build addresses the issue

@jasontedor - can you please confirm if your issue has been addressed ?

[jasontedor]

@smlambert Sadly, the issue is not addressed, and the build produced is a regression from the previous release in that it's not even notarized at all. Similarly, the JDK 13+33 build released last week is also not notarized. I've been communicating with @sxa555 via Slack.

[smlambert]

Ok, thanks for the update, glad you are in contact with @sxa555 to help shake this out.

[sxa]

As discussed with the TSC I do not have the knowledge to progress this myself without floundering around. It ideally needs @gdams to get involved as he introduced the notarization attempts bearing in mind what @jasontedor has seen in relation to the various releases we've done recently.

The suggestion that I've heard is that it was unexpected for 11.0.4+11.4 to have been notarized, but we need input from SMEs on this.

[sxa]

As per adoptium/adoptium-support#65 we won't be doing another JDK12 build now as it's out of support, but future builds in the supported line (8, 11, 14+) should be sorted. The current JDK11 nightly builds are already fixed. JDK8 requires a floating patch to be backported. The main issues associated with this work is adoptium/temurin-build#1130 and is where any updates will be communicated.