Add java25 checks and unit test min to java17

.github/workflows/ci.yaml

@@ -20,7 +20,7 @@ jobs:
     strategy:
       matrix:
         # sigstore-java still supports Java 11, however, we test it with conformance-tests only
-        java-version: [17, 21]
+        java-version: [17, 21, 25]
       fail-fast: false
 
     concurrency:

build-logic/basics/src/main/kotlin/ToolchainProperties.kt

@@ -1,4 +1,5 @@
 import buildparameters.BuildParametersExtension
+import org.gradle.api.InvalidUserDataException
 import org.gradle.api.JavaVersion
 
 class ToolchainProperties(
@@ -17,9 +18,16 @@ val BuildParametersExtension.buildJdkVersion: Int
     get() = buildJdk?.version ?: JavaVersion.current().majorVersion.toInt()
 
 val BuildParametersExtension.testJdk: ToolchainProperties?
-    get() = jdkTestVersion.orNull?.takeIf { it != 0 }
-        ?.let { ToolchainProperties(it, jdkTestVendor.orNull, jdkTestImplementation.orNull) }
-        ?: buildJdk
+    get() {
+        val requestedVersion = jdkTestVersion.orNull?.takeIf { it != 0 }
+        val finalVersion = requestedVersion ?: buildJdkVersion
+        if (finalVersion < 17) {
+            throw InvalidUserDataException("Unit tests require at least Java 17. Resolved: $finalVersion")
+        }
+        return requestedVersion?.let { ToolchainProperties(it, jdkTestVendor.orNull, jdkTestImplementation.orNull) }
+            ?: buildJdk
+    }
 
 val BuildParametersExtension.testJdkVersion: Int
-    get() = jdkTestVersion.orNull ?: buildJdkVersion
+    get() = testJdk?.version ?: buildJdkVersion
+

build-logic/jvm/src/main/kotlin/build-logic.java.gradle.kts

@@ -25,7 +25,7 @@ tasks.configureEach<JavaExec> {
 
 spotless {
     java {
-        googleJavaFormat("1.24.0")
+        googleJavaFormat("1.35.0")
         licenseHeaderFile("$rootDir/config/licenseHeader")
         // Note if submodule needs to add more exclusions, it should list ALL of them since
         // Spotless does not have "addTargetExclude" method
@@ -36,14 +36,17 @@ spotless {
 tasks.withType<JavaCompile>().configureEach {
     inputs.property("java.version", System.getProperty("java.version"))
     inputs.property("java.vm.version", System.getProperty("java.vm.version"))
-    options.apply {
-        encoding = "UTF-8"
-        compilerArgs.add("-Xlint:deprecation")
-        if (buildParameters.failOnJavacWarning) {
-            compilerArgs.add("-Werror")
-        }
+    options.encoding = "UTF-8"
+    options.compilerArgs.add("-Xlint:deprecation")
+    if (buildParameters.failOnJavacWarning) {
+        options.compilerArgs.add("-Werror")
+    }
+    options.release.set(buildParameters.targetJavaVersion)
+}
 
-        release.set(buildParameters.targetJavaVersion)
+plugins.withId("java") {
+    tasks.named<JavaCompile>("compileTestJava") {
+        options.release.set(17)
     }
 }
 

build-logic/jvm/src/main/kotlin/build-logic.kotlin.gradle.kts

@@ -24,10 +24,17 @@ autostyle {
     }
 }
 
-tasks.withType<KotlinJvmCompile>().configureEach {
+tasks.named<KotlinJvmCompile>("compileKotlin") {
     compilerOptions {
         val targetJdkRelease = buildParameters.targetJavaVersion.toString()
         freeCompilerArgs.add("-Xjdk-release=$targetJdkRelease")
-        jvmTarget = JvmTarget.fromTarget(targetJdkRelease)
+        jvmTarget.set(JvmTarget.fromTarget(targetJdkRelease))
+    }
+}
+
+tasks.named<KotlinJvmCompile>("compileTestKotlin") {
+    compilerOptions {
+        freeCompilerArgs.add("-Xjdk-release=17")
+        jvmTarget.set(JvmTarget.JVM_17)
     }
 }

build-logic/jvm/src/main/kotlin/build-logic.testing.gradle.kts

@@ -22,4 +22,7 @@ tasks.withType<Test>().configureEach {
     if (project.hasProperty("skipStaging")) {
         systemProperty("sigstore-java.test.skipStaging", project.findProperty("skipStaging")!!)
     }
+    if (buildParameters.testJdkVersion >= 23) {
+        jvmArgs("--sun-misc-unsafe-memory-access=deny")
+    }
 }

fuzzing/oss_fuzz_build.sh

@@ -3,7 +3,8 @@
 # TODO: this should be a gradle plugin
 
 # build the fuzzing classes and extract dependencies into $OUT
-./gradlew :fuzzing:copyToFuzzOut -x test -PfuzzOut="$OUT"
+# Exclude spotlessCheck because GJF 1.35.0+ requires JDK 21+ to run, which would crash the build in CIFuzz (currently running on JDK 17).
+./gradlew :fuzzing:copyToFuzzOut -x test -x spotlessCheck -PfuzzOut="$OUT"
 ALL_JARS=""
 for jarfile in $(find $OUT -name *.jar)
 do

sigstore-java/build.gradle.kts

@@ -50,7 +50,7 @@ dependencies {
     testImplementation("org.mockito:mockito-core")
     testImplementation("org.mockito:mockito-junit-jupiter")
 
-    testImplementation("no.nav.security:mock-oauth2-server:0.5.10")
+    testImplementation("no.nav.security:mock-oauth2-server:5.0.2")
     testImplementation("com.squareup.okhttp3:mockwebserver:5.4.0")
     testImplementation("net.sourceforge.htmlunit:htmlunit:2.70.0")
 
@@ -91,12 +91,12 @@ spotless {
         )
     }
     format("conscrypt", com.diffplug.gradle.spotless.JavaExtension::class.java) {
-        googleJavaFormat("1.24.0")
+        googleJavaFormat("1.35.0")
         licenseHeaderFile("$rootDir/config/conscryptLicenseHeader")
         target("src/*/java/dev/sigstore/encryption/certificates/transparency/*.java")
     }
     format("webPki", com.diffplug.gradle.spotless.JavaExtension::class.java) {
-        googleJavaFormat("1.24.0")
+        googleJavaFormat("1.35.0")
         licenseHeaderFile("$rootDir/config/webPKILicenseHeader")
         target("src/*/java/dev/sigstore/json/canonicalizer/*.java")
     }

sigstore-java/src/test/resources/dev/sigstore/oidc/server/config-bad-nonce.json

@@ -11,8 +11,8 @@
       "tokenExpiry": 120,
       "requestMappings": [
         {
-          "requestParam": "scope",
-          "match": "openid email",
+          "requestParam": "client_id",
+          "match": "sigstore",
           "claims": {
             "audience": "sigstore",
             "email": "test.person@test.com",

sigstore-java/src/test/resources/dev/sigstore/oidc/server/config.json

@@ -11,8 +11,8 @@
       "tokenExpiry": 120,
       "requestMappings": [
         {
-          "requestParam": "scope",
-          "match": "openid email",
+          "requestParam": "client_id",
+          "match": "sigstore",
           "claims": {
             "audience": "sigstore",
             "email": "test.person@test.com",

sigstore-testkit/build.gradle.kts

@@ -1,3 +1,6 @@
+import org.jetbrains.kotlin.gradle.dsl.JvmTarget
+import org.jetbrains.kotlin.gradle.tasks.KotlinJvmCompile
+
 plugins {
     id("build-logic.kotlin")
     id("build-logic.repositories")
@@ -18,3 +21,14 @@ dependencies {
     api("org.assertj:assertj-core:3.27.7")
     api(gradleTestKit())
 }
+
+tasks.named<JavaCompile>("compileJava") {
+    options.release.set(17)
+}
+
+tasks.named<KotlinJvmCompile>("compileKotlin") {
+    compilerOptions {
+        freeCompilerArgs.set(listOf("-Xjdk-release=17"))
+        jvmTarget.set(JvmTarget.JVM_17)
+    }
+}