Evaluate Debian 11 (Bullseye)
Description
Environment
is related to
Activity
Ian Young August 23, 2021 at 9:58 AM
Per the https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/2760343901/2021-08-20 meeting, I have updated https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/1177321655/Java+Distributions to say that we partially support Java 11 under Debian 11. I also added more detail to the Debian rationale section to indicate LTS dates for the various releases of Debian.
That’s probably all we want for now, so I’ll close this and open a new issue if and when we see what happens to Debian’s support for Java 17.
Ian Young August 18, 2021 at 3:40 PMEdited
I think we’re done on the evaluation, but we can discuss on Friday https://shibboleth.atlassian.net/wiki/spaces/DEV/pages/2760343901/2021-08-20.
New ticket https://shibboleth.atlassian.net/browse/JOIDC-54 covers the AWT issue.
Henri Mikkonen August 18, 2021 at 3:00 PM
The AWT dependency must indeed be stripped out. I’ll find a way for it.
Philip Smart August 18, 2021 at 2:49 PMEdited
ImageJ might be a usable alternative to find the width and height of the logo/image. I agree with trying to strip out the AWT dependency.
Ian Young August 18, 2021 at 2:12 PMEdited
I ran into one issue attempting to test the java-idp-oidc package. It fails if you only insteall the “headless” version of the JDK, as one of the native libraries used by the javax.imageio package isn’t included in the “headless” version.
The error looks like this:
[INFO] Running TestSuite
[ERROR] Tests run: 539, Failures: 3, Errors: 0, Skipped: 0, Time elapsed: 25.301 s <<< FAILURE! - in TestSuite
[ERROR] net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeOutboundAuthenticationResponseMessageContextTest.emptyLogo Time elapsed: 0.024 s <<< FAILURE!
java.lang.UnsatisfiedLinkError: Can't load library: /usr/lib/jvm/java-11-openjdk-amd64/lib/libawt_xawt.so
at net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeOutboundAuthenticationResponseMessageContextTest.emptyLogo(InitializeOutboundAuthenticationResponseMessageContextTest.java:100)
[ERROR] net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeOutboundAuthenticationResponseMessageContextTest.nonExistentLogo Time elapsed: 0.001 s <<< FAILURE!
java.lang.NoClassDefFoundError: Could not initialize class javax.imageio.ImageIO
at net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeOutboundAuthenticationResponseMessageContextTest.nonExistentLogo(InitializeOutboundAuthenticationResponseMessageContextTest.java:90)
[ERROR] net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeOutboundAuthenticationResponseMessageContextTest.successLogo Time elapsed: 0.002 s <<< FAILURE!
java.lang.NoClassDefFoundError: Could not initialize class javax.imageio.ImageIO
at net.shibboleth.idp.plugin.oidc.op.profile.impl.InitializeOutboundAuthenticationResponseMessageContextTest.successLogo(InitializeOutboundAuthenticationResponseMessageContextTest.java:110)
[INFO]
[INFO] Results:
[INFO]
[ERROR] Failures:
[ERROR] InitializeOutboundAuthenticationResponseMessageContextTest.emptyLogo:100 ? UnsatisfiedLink
[ERROR] InitializeOutboundAuthenticationResponseMessageContextTest.nonExistentLogo:90 ? NoClassDefFound
[ERROR] InitializeOutboundAuthenticationResponseMessageContextTest.successLogo:110 ? NoClassDefFound
[INFO]
[ERROR] Tests run: 539, Failures: 3, Errors: 0, Skipped: 0
Installing the -jdk package as well as the -jdk-headless version fixes this.
However, I’m not sure I am aligned with the idea that we need to be using the java.desktop module in our (server) applications. I realise there may be some convenient functionality here (reading an image file!) but if it means we’re dragging in AWT it seems questionable.
@Henri Mikkonen @Scott Cantor @Philip Smart thoughts?
Debian 11 (Bullseye) will be out this year; it has already passed its "hard freeze" point.
We should evaluate this release with a view to supporting it for IdP deployments at the same level as we support Debian 10. This means verifying that our current unit and integration tests all run in that environment, and being prepared to spin up an environment if deployers encounter issues.
We should also determine whether this release will support Java 17 or just Java 11. It seems likely to be out before Java 17, so I guess that's unlikely at least in the first instance.