Oracle Java Licensing

[kkfin]

For commercial use of  Oracle Java you will 2019 need to get from Oracle a commercial license. I suppose this has also impact to the cost of running ColdFusion server or  ColdFusion Builder? Or is it Adobes headache?

[Dave Watts]

I'm pretty sure this only applies to Java 8. This is pretty standard - as new versions of Java are released, old versions are eventually removed from free release. By 2019, you should have a new enough version of CF that it runs on a current release of Java. CF 2018 uses Java 10. It's possible that Adobe will release a hotfix for CF 2016 to support Java 10. By 2019, I think CF 11 and earlier will also no longer be supported.

If you're using an older version of CF, it comes with a version of Java that is supported by that CF version. That version of Java isn't going anywhere but it won't be updated. If you've configured CF to use a separate install of Java so that you can keep that Java install updated, you won't be able to do that for Java 8 in 2019.

So, it's your headache, in the sense that you have to be using a new-enough version of CF.

Dave Watts, Fig Leaf Software

[Charlie Arehart]

Hey, Dave. I don't read things (about the pending change to Oracle licensing) the same way. You seem to be saying it would affect only those on Java 8. That's not how I read the docs from Oracle and various blog posts and articles. It would seem it will affect all released after 8 as well.

Instead, what is so is that folks could certainly stay ON the older releases. They just won't be updated (which is untenable for most, for security reasons).

So it does seem this is a question for Adobe to clarify for us. It may be that THEY will license Java (for use with CF), in which case we would be able to get updates and legitimately use that supported JVM because Adobe licensed it for us. Or they may tell us that we all need to get our OWN JVM, and there will be the free (and updated) Open JDK from Oracle. Perhaps they will state support of that and tell us to go get it, before installing CF (just as some other products require, like Tomcat itself).

I will note that among the various resources out there about the changing license and update pattern, this seemed a short but comprehensive one: Eliminating Java Update Confusion - Azul Systems, Inc.

But Adobe folks, can you help us out, with an answer here and (better still) a post at coldfusion.adobe.com?

[Dave Watts]

Oracle has always charged for old versions of Java. What I found indicated that they're continuing to do this with Java 8 and maybe will do so with 9. CF 2018 ships with Java 10, and that's still supported, and I've found no indication that it won't be supported in 2019. Here's what Oracle has to say:

Java Future Release Notices

I don't really know what happened with Java 9, I never saw a major version get replaced so quickly. Of course, I haven't really followed this stuff that closely recently, and I could be wrong about everything here.

Dave Watts, Fig Leaf Software

[Runrocket]

Dave,

To Charlie's point, Oracle has changed the game. The licensing road map for Oracle SDK/JRE bundled with Java SE has changed. To your point, Java 8 is old and, on the face of it, Oracle ending commercial support for something so old seems standard, in this case, it's not. See https://www.itassetmanagement.net/2018/05/01/oracle-to-charge-for-java-from-jan-2019/. This is one of many articles on the subject. Here's the risk to Adobe as I see it. Java 8, unlike 9 and 10, is designated for Long Term Support (LTS). This is why, I'm sure, Adobe has stuck to it in CF 11 and 2016. After January 2019, any update to either of these CF versions that includes a version of the "Oracle" Java 8 JDK/JRE sourced after that date are a problem for Adobe unless the Adobe/Oracle Binary Redistribution License Agreement (BRLA) covers it. If not, Adobe maybe putting its customers at risk should they be subject to an Oracle audit. Beyond patches, though, the "Oracle" 10.0.2 JDK/JRE is the last version that can be "commercially" downloaded from Oracle without a service agreement. The Adobe/Oracle BRLA will either have to cover this version, possibly increasing the licensing cost of CF or move to OpenJDK and mitigate the 6 month release cycle (or not).

So Charlie is right, these questions still stand until an Adobe representative officially responds.

Stephen Johnson

[Charlie Arehart]

Stephen, to your last point, first thanks for the acknowledgment. Second, though, did you catch that (as Dave noted before), CF2018 does in fact include Java 10? It just sounded like you too were focused a bit too much on how CF2016 and 11 come with/support Java 8 (at most, for now).

But as you say, we need to hear from Adobe on how things will go for those on CF2018 WITH that bundled Java 10, and then also for those on CF2016 or 11, if/when Adobe may support updating to 9, 10, or 11 (which is due to come out from Oracle in the fall and is to be the next LTS Java version). And then also how it will go for any who may want to go with the openjdk instead.

[Dave Watts]

I'm not trying to be argumentative, so I hope you read that spirit in my reply. But those sorts of articles have been published every time Oracle requires payment for older versions of Java. The only difference is Oracle's continued support for Java 8 client JREs, which will presumably receive security updates for free. Presumably, in the future, Oracle may designate that Java 10 be covered by Long-Term Support. But it's too soon to tell, because it's a brand new version. The only odd thing here is, what really happened to Java 9? There's never been a major version of Java that came and went so quickly.

As for Adobe and what versions of Java they're including, nothing here has really changed. Adobe has always included the latest version of Java available at the time they start developing the new version of ColdFusion. For CF 2016 this was Java 8. For ColdFusion 2018, this is Java 10. After the product release, they don't ever upgrade the version of Java included in the installer, as far as I can remember. So, if they continue in this pattern, there will never be an update for CF 11 or 2016 including Java 9 or 10. What they do, however, is include upgrades that will support these newer versions of Java, and then you can go get Java on your own. That leaves licensing issues up to you as well, and Adobe has no part in that.

Dave Watts, Fig Leaf Software

[Runrocket]

To David and Charlie,

To Charlie's point, what's needed here is an informed contribution from someone representing Adobe. To be honest, I'm not sure we will get that on this forum because, at root, these questions are not technical, but legal. As a customer of Adobe, I suspect that I will have to reach out to them directly, but it would be great to get some feedback here.

Let's assume that I work for a very large software company, I do, and that company has many, many CF Enterprise software licenses. History shows that that company is also a ripe target for Oracle audits given that company's Java/DB exposure.  That company also embeds Java into it's own products so it understands what kind of pickle Adobe is in and it's currently working through these licensing issues themselves.

Now, we know that Adobe bundles the "Oracle" JDK as part of CF. In the past, that has been a fine thing because the JDK "features" within Java SE were supported by Oracle and free to use. In terms of the Binary Redistribution License Agreement, there was nothing that said that Adobe had to pay additional licensing fees for the use of the SDK/JRE features. Furthermore, the JDK does get updated over the course of a CF release life cycle. For example, see here: ColdFusion (2016 release) Update 5 . So here is the challenge:

1) In the case of Update 5 referenced above, you can argue that I, as the updater, are responsible for having a separate license/service agreement with Oracle if I update the JDK past the January 2019 final JDK 8 "free" release. As the purchaser of a CF license, I expect the Oracle/Adobe BRLA to cover that, but it might not. I'm assuming, David, that you would contend that that's my responsibility. Maybe, but you see the problem here. From where I stand, Adobe has no clear path forward without putting me at risk.

2) More importantly, there is the risk to me using future versions of CF without greatly increased costs or security risk. Accepting that 2018 will go out with Java 10, 10.0.2 is the last one that Adobe can bundle without putting themselves or their customers at risk without clear verbiage in their Oracle/Adobe BRLE license agreement if they should go with using the "Oracle" JDK. If they go with OpenJDK, they will need to weigh the risk of a longer JDK release cycle potentially putting their customers at risk.

Thanks guys,

Steve

[SeanACorfield]

It looks like no one has addressed Dave's questions about Java 9 and his assumptions around Java 10...

There are actually two "big" changes around this:

1. Release pattern: shifted from one big (LTS) release every two years to a release every six months, with every third one being LTS.
2. Restricting use of the LTS releases so they require payment for commercial use, and elevating the OpenJDK to a first class citizen.

Since Java 8 was an LTS release (essentially), Java 9 and Java 10 are interim releases with no support at all beyond six months, and Java 11 is the next LTS release. Java 12 and 13 will be interim releases with no support at all beyond six months, and Java 14 will be the next LTS release after Java 11. That's why security patches will stop for Java 8 -- unless you pay Oracle for extended support -- because the next LTS release (11) is already available. LTS releases will have some overlap (I believe). Interim releases will have zero overlap.

In the past, OpenJDK has always been a bit of a second-class citizen so as part of now charging for commercial use of the OracleJDK, starting with Java 11, Oracle is bringing the OpenJDK up to the same level for free commercial use. Going forward, OpenJDK will stay current with OracleJDK, but will not continue to get patches beyond a fixed window -- whereas the paid version (OracleJDK) will get patches for the LTS period (and beyond if you pay for extended support).

What that means for CF2018 is that Java 10 is already unsupported, because Java 11 has been released. I would expect that Adobe will update CF2018 to Java 11 (but probably OpenJDK 11 at this point) and will figure out how to arrange for CF2020 to use Java 14, in order to stay with the LTS releases. Or perhaps they'll unbundle the JRE and hand off the responsibility of managing JRE/JDK installation and upgrades to their customers (which is how every other JVM-based language works), and then they'll have to figure out how (or whether) to even deal with compatibility with the interim releases (12, 13, 15, 16, ...)?

[Charlie Arehart]

Actually, Sean, I did address that matter (about what happened with Java 9 and 10 and why they lived so briefly, and what they meant for CFers) in a blog post that I linked to above back on Sep 28.

As for your observations about CF (since Java is bundled with it) versus other engines that do not bundle Java (but leave you to get it yourself), you made the same point on my recent blog on the licensing issue (and elsewhere). And as I asked there on my blog (and have not heard back), someone could read your comments as implying that this Oracle licensing issue is ONLY a problem for CF folks (since Adobe bundles it).

That's not the case. It's about USE of Java for commercial purposes, whether you download it or it's bundled.

Am I reading you right or wrong here? and do you disagree with my last point? If you agree, I hope you will offer that clarification here and on my blog, and elsewhere that you've been making the point. I just fear people could interpret your comments as saying this is a problem ONLY for folks on CF. It's also a problem for folks on Lucee, Clojure, Tomcat, and any other Java-based app, it seems, if used for commercial purposes. Or do you think I am wrong?

[SeanACorfield]

I elaborated on the Java 9 & 10 (& 12 & 13) issue because this thread did not explicitly contain that information so it was for the benefit of people who scan a thread without diving into each and every link posted therein

As for the other points, yes, you are reading me wrong: I'm not talking about "other engines" but about JVM languages in general. ColdFusion is alone in bundling the JVM -- for all those other languages, this isn't a question about what the originating company (or project team) should do but about what the developers using that language should do.

With ColdFusion alone, it is a question about what Adobe will do -- and, as this thread makes clear, there is an expectation that this is Adobe's problem to "solve".

With other JVM languages, the Oracle licensing issue has nothing to do with the language per se but is "just another technology decision" that companies need to make about their stack. A lot of those companies are already using Oracle's OpenJDK or some other company's JDK or are already paying Oracle for support. Corretto isn't "news" is that context, other than it's yet another company offering a JDK with a particular support model, to add to the mix.

I already replied to your blog with a similar clarification.

[Bardnet]

Sean, you write other langauges allow to choose the JVM you run it on top. The thing with ACF is the missing compatibility with recent releases. I have to update JAVA every once in a while. I don't care if the major or the minor release number increases.

The possibilities in my opinion are either Adobe provides JAVA 8 releases for the money I bought the license with. Adobe can also recommend a free updated release like AdoptOpenJDK or Corretto.

Other possibility is, Adobe updates CF to be compatible with recent JAVA versions.

I'm not a JAVA developer. I cannot say how much 10, 11, 12 etc. differ. Maybe Adobe needs to do a handful fixes only, and is safe for a couple releases.

I don't remember a CF update bringing a new JDK version, an updated installer, however, brought a newer JDK version.

I always keep my JDK install recent myself. That allows to secure my installation against JAVA security issues.

[Bardnet]

Hi,

today, JAVA 11 was finally released. The questions remain: what version of ColdFusion runs on which JAVA version? Which JDK is recommended? Oracle? OpenJDK from: JDK 11 GA Release ? Have you heard about AdoptOpenJDK?

Will Adobe care for compatibility with latest JDK every half year?

Best,

Bernhard

[Bardnet]

On the Slack channel this had been posted a few weeks back

[Anit_Kumar · Accepted solution]

Hi All,

The JDK licensing is still under discussion at Adobe. Will announce the decision, once taken.

Regards,

Anit Kumar

[Christian_Reemts]

Hi,

is there any update available?

Regards

Christian

[chkamran]

Hi Anit, any update on this yet?

I'll reiterate the problem:

The Oracle JDK has historically been available for free (under BCL) until the end of public updates is declared. After this point, a commercial license is required to continue receiving support and updates. Java 8 will reach the end of public updates in January 2019 (ref).

We're on CF 11. What actions should I take before January 2019? Thanks in advance.

[BKBK]

Anit_Kumar  wrote

The JDK licensing is still under discussion at Adobe.

Hi Anit_Kumar​ , could you please give us an update. We are testing ColdFusion 2018 and wish to go into production next January. As you can imagine, things are getting tight.

[Suresh Jayaraman]

The next update of  ACF  2018 and 2016 planned for  Jan/Feb  2019 will have support for Java 11 . The team is working on this as i write . 

Suresh 

[SeanACorfield]

Thank you, Suresh. At this point, can you state whether it will be OracleJDK 11 or OpenJDK 11?

[Suresh Jayaraman]

It would be Oracle JDK 11. By 2020 Adobe is expected to move to a vendor other than Oracle . Many popular JDK distributors are under review but the current focus is to get on to Oracle Java 11 at the earliest .

Suresh

[bradwood.com]

Hi Suresh,

This is good news, but it doesn't answer the following:

• What about CF11, which has core support until 4/30/2019 and extended support until 4/30/2021
• Will CF2016 users be in violation of Oracles licensing if they are using Java 8 on Jan 1st 2019 or will they just be unable to get any Java updates for security patches until "Jan/Feb"
• What Java provider will Adobe be supporting?

[Suresh Jayaraman]

Brad

ACF 2016 will also be migrated to Java 11 , testing is underway

Suresh

[bradwood.com]

Thanks for the replies Suresh, but you managed to only answer 1 of my 3 questions.  You have not address:

1. The state of Java support ColdFusion users will have (if any) on Jan 1st 2019 since the update is not scheduled until as late as Feb.
2. The fate of ColdFusion 11 and if CF11 users will be on unsupported versions of Java.

I'm pleased to hear Adobe worked something out with Oracle but I presume it wasn't cheap.

[BKBK]

Hi Suresh,

Like the ColdFusion Team, we are also testing ColdFusion 2018 with Java 11.  Could you share with us the Java settings you are using?

ColdFusion 2018 currently ships with Java 10.0.1. The default java.args settings in /bin/jvm.config are:

 java.args=-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5005 -server --add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED --add-opens=java.base/java.nio=ALL-UNNAMED --add-modules=java.xml.ws --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/sun.util.cldr=ALL-UNNAMED  --add-opens=java.base/sun.util.locale.provider=ALL-UNNAMED -Xms256m -Xmx1024m -XX:MaxMetaspaceSize=192m -XX:+UseParallelGC -Xbatch -Djdk.attach.allowAttachSelf=true -Dcoldfusion.home={application.home} -Djava.awt.headless=true -Duser.language=en -Dcoldfusion.rootDir={application.home} -Dcom.sun.xml.bind.v2.bytecode.ClassTailor.noOptimize=true -Djava.security.policy={application.home}/lib/coldfusion.policy -Djava.security.auth.policy={application.home}/lib/neo_jaas.policy  -Dcoldfusion.classPath={application.home}/lib/updates,{application.home}/lib,{application.home}/lib/axis2,{application.home}/gateway/lib/,{application.home}/wwwroot/WEB-INF/cfform/jars,{application.home}/wwwroot/WEB-INF/flex/jars,{application.home}/lib/oosdk/lib,{application.home}/lib/oosdk/classes -Dcoldfusion.libPath={application.home}/lib -Dorg.apache.coyote.USE_CUSTOM_STATUS_MSG_IN_HEADER=true -Dcoldfusion.jsafe.defaultalgo=FIPS186Random -Dorg.eclipse.jetty.util.log.class=org.eclipse.jetty.util.log.JavaUtilLog -Djava.util.logging.config.file={application.home}/lib/logging.properties -Djava.locale.providers=COMPAT,SPI -Dsun.font.layoutengine=icu 

Which may we change or leave out when using Java 11? What may we add?