Jakarta EE
Jakarta EE is the latest version of the "enterprise edition" API defining what it means for GeoServer to be a web application. The previous JavaEE standard has transition from Oracle to the Eclipse Foundation resulting in the new name. While this is a win for open-source and vendor neutral governance - it provides some work for GeoServer to make the transition.
This activity is REQUIRED IN THE TIMELINE DESCRIBED in order to keep GeoServer available on a fully supported platform (with improvements and security updates).
-
This page outlines a "roadmap" which is rare for GeoServer Team. We learned that publishing a roadmap - in any form - may provide the assumption that the work is paid for and can be expected in the future. This is very much not the case - this page outlines the SCOPE OF WORK REQUIRED; not an assurance that we will be able to fund and accomplish the work in the timeframe outlined.
-
The team has experience with both sponsorship and cost recovery model for previous maintenance activities. The amount of overhead for organizers has been similar to the funds raised.
-
External GeoServer sponsorship in 2023 was $1000 USD.
-
Blog post: GeoServer 2024 Roadmap Planning to request financial support and in-kind support to accomplish the goals outlined on this page.
-
Ideally organizations with an operational requirement to run on a supported and fully patched environment - can step forward with RFQ for some of the work items listed here.
Here are the major updates required:
| Phase I | Activity | Notes |
|---|---|---|
| GEOS-11275 | 1.1. Wicket 7 --> 9 | simplifies updating to Wicket 10 |
| 1.2 ImageN 1.0 | requires test-cases be written | |
| 1.3 JAI --> ImageN 1.0 |
| Phase II | Activity | Notes |
|---|---|---|
| 2.1 Java 17 minimum | required for spring-framework-6 update | |
| GEOS-11271 | 2.2 Spring Security 5.8 | Prepare for updating to spring-security 6 |
| GEOS-11272 | 2.3 OAuth Client Replacement | replaces oauth and keycloak plugins |
| 2.4 wiremock 3 update | required for Java 17 |
| Phase III | Activity | Notes |
|---|---|---|
| 3.1 Spring Framework 6 | December 2024 Spring-Framework 5.3 EOL | |
| 3.2 Wicket 10 | required for spring-framework-6 | |
| 3.3 Jakarta Enterprise Edition 10 | required for spring-framework-6 | |
| 3.4 Tomcat 10.1 | Jakarta EE application server | |
| 3.5 Jetty 12 | Jakarta EE application server | |
| 3.6 commons-file upload |
| Phase IV | Activity | Notes |
|---|---|---|
| 4.1 Optional: charts replacement | ||
| 4.1 Optional: Glassfish | Jakarta reference environment |
This page gathers notes on what work will be required to migrate to Jakarta EE. When we have an opportunity to make this transition this page will be used as reference material for one or more proposals.
Reference:
Java 8 has been used up until GeoServer 2.23. Java 11 is used for GeoServer 2.23 onward.
To complete this activity we need to update to Java 17 minimum for spring-framework-6 and Jakarta-EE compatibility.
Updating Java has generally been okay, however increased module restrictions will mean that we can no longer use the Java Advanced Imaging jars as provided (which make use of javax namespace as former Java plugins).
Reference: https://adoptium.net/support/
The enterprise edition interfaces are responsible for concepts such as Servlet and Web Archive (WAR).
Oracle (with some encouragement from "friends") donated JavaEE to the Eclipse Foundation. In addition to an active caretaker this has provided a name and package change.
The spring-framework 5.3 reaches end-of-life in December 2024. Upgrading to the next spring-framework requires upgrading to Jakarta EE (providing a deadline for this activity).
This activity should just be work, and not risky.
Our choice of EE is driven by spring-framework support below.
The spring framework is used for the internal wiring of GeoServer, bridging from Enterprise Edition concepts like Servlet to services provided by GeoServer.
- spring-framework
Spring-Framework 5.3 reaches end of life in December 2024 providing a deadline.
- spring-core 5 (Java 8 / J2EE) GeoServer 2.23 and earlier
- spring-core 6 (Java 17 / JakartaEE 10 / Servlet 6)
Reference:
Spring-security library is driven by choice of spring-core above.
-
Upgrade spring-security to 5.8
The upgrade to spring-security 5.8 is designed as a stepping stone before jumping to 6
-
spring-security 6 is compatible with spring-framework 6 above
Activity:
- GEOS-11271 Upgrade spring-security to 5.8
This plugin is no longer provided, with the functionality being folded into spring-security above. However the replacement is not drop-in compatible and is far more locked down with final classes.
The GeoServer Oauth modules will need to be rewritten to target the new API.
This step is risky, although these are community modules they are used in production by a large number of security sensitive organizations.
Activity:
- GEOS-11272 spring-security-oauth replacement, with spring-security 5.8
Spring security keycloak plugin is no longer provided, with OAuth being recommended replacement between GeoServer and Keycloak.
The associated GeoServer module will need to be removed, and integration testing with keycloak covered as part of the replacement of spring-security-oauth above.
Wicket is the user-interface framework used by GeoServer. Updating Wicket in the past has required a team effort. It is preferable to do smaller updates rather than jumping straight from Wicket 7 to Wicket 10.
- Wicket 9: This is the last version that is compatible with spring-framework 5
- Wicket 10: This is the version required for spring-framework 6
Reference: https://cwiki.apache.org/confluence/display/WICKET/Migration+to+Wicket+10.0
Activity:
- GEOS-11275 Wicket 9 Upgrade
Reference: https://issues.apache.org/jira/projects/FILEUPLOAD/issues/FILEUPLOAD-349
Used for tests, will require version 3.x, available since August 2023.
The charts module is based on Eastwood which is no longer supported (and thus not going to make the transition to JakartaEE).
ImageN is a migration of Java Advanced Imaging to vendor neutral governance at the Eclipse Foundation. It has not reached version 1.x and would need to be completed as part of this activity.
This is required for Java 17 compatibility (as Java Advanced Imaging can no longer be used).
Reference:
GeoServer supports and recommends Tomcat as a good choice for production use; providing examples in our documentation of how this application server can be configured to deploy GeoServer.
- Tomcat 8.5: (Servlet 3.1 / Java EE / March 2024 EOL) GeoServer 2.23 and earlier
- Tomcat 9.0: (Servlet 4 / Java EE 8 platform) GeoServer 2.23 and earlier
- Tomcat 10: (Servlet 5 / JakartaEE 9)
- Tomcat 10.1: (Servlet 6 / JakartaEE 10)
Reference:
- https://github.com/apache/tomcat-jakartaee-migration
- https://stackoverflow.com/questions/75475861/will-geoserver-run-over-tomcat-10-x
- https://tomcat.apache.org/whichversion.html
Jetty is another great application server with GeoServer uses for our binary download.
- Jetty 9.4: GeoServer 2.23 and earlier
- Jetty 12.0.x: (Servlet 6 / JakartaEE 10 / Java 17+)
Reference:
Glassfish is the reference implementation of J2EE / JavaEE / JakartaEE.
- Glassfish 5: J2EE8/JDK8: Up until GeoServer 2.22.x
- Glassfish 6: Jakarta 9.1 / JDK11