Java: Ensure we are not using non-free parts of Java

[John-Holt-Tessella]

See http://www.theregister.co.uk/2016/12/16/oracle_targets_java_users_non_compliance/

Kevin has emailed Tom letting him know.

[kjwoodsISIS]

From: Griffin, Tom (STFC,RAL,ISIS)
Sent: 19 December 2016 11:33
To: Woods, Kevin (Tessella,RAL,ISIS)
Subject: RE: Java is not free ...

... We are rolling out some asset software that should allow us to manage and report on this across PCs and servers. I’ve also passed a note to some of the development teams and will raise it the next STFC IT Committee. ...

[kjwoodsISIS]

Commercial features of Java SE are described here: http://www.oracle.com/technetwork/java/javase/terms/products/index.html
See especially Table 1-1.
See also Oracle Binary Code License Agreement for the JAVA SE Platform Products

[kjwoodsISIS]

The following features of Java SE:

• Java Flight Recorder
• Java Mission Control
• Java Advanced Management Console
• MSI Enterprise JRE Installer
• JRockit Flight Recorder
• JRockit Mission Control Console observability
• JRockit Mission Control Memory Leak Detector observability
• JRE Usage Tracking
• JRockit Real Time, Deterministic GC

all attract a license fee.

We should check to see which (if any) we use. By checking, I mean positively confirm and document whether we use each of the features listed above.

[DominicOram]

I was bored and did some quick research:

• Flight Recorder and Mission control require the -XX:+UnlockCommercialFeatures compiler flag to be set at the very least. We do not use this flag.
• JRockit is a separate JVM that we do not use so we cannot use any of the JRockit features.

[Tom-Willemsen]

• The Java Usage Tracker is disabled by default. To enable it, a special file has to be created in the JRE directory. Everyone would need to check that they do NOT have any of the following files in any JRE that is installed:
  <JRE directory>/conf/management/usagetracker.properties
<JRE directory>/lib/management/usagetracker.properties

[kjwoodsISIS]

According to the Java command line options page:

-XX:+UnlockCommercialFeatures
Use this flag to actively unlock the use of commercial features. Commercial features are the 
products Oracle Java SE Advanced or Oracle Java SE Suite, as defined at the Java SE Products 
web page.

If this flag is not specified, then the default is to run the Java Virtual Machine without the 
commercial features being available. After they are enabled, it is not possible to disable 
their use at runtime.

In this and other Oracle documentation (see next comment), it is made very clear that you cannot run commercial features of Java without specifying the -XX:+UnlockCommercialFeatures option on the command line.

The key word in the above quote is "actively". You have to actively choose to use the commercial features of Java. Provided we never use this flag (and we don't), we cannot run commercial features of Java.

[kjwoodsISIS]

The following documents are all related to the recent news that Oracle is seeking to enforce payment of fees for use of commercial features of Java:

• Oracle_denies_chasing_Java_SE_fees.pdf - press report on Oracle (responding to original Register article)
• JavaChampionsresponsetoTheRegisterArticleonJavaSEusage.pdf - view of independent expert user group
• Java Components_2017_02_21.pdf - commercial features of Java
• Java SE Offerings (Java Platform Group, Product Management blog).pdf - technical blog re-stating need to use -XX:+UnlockCommercialFeatures option
• Java SE Overview - General FAQs 2017_02_21.pdf - general FAQs, including a statement that Java SE 8 is free
• Java_Command_Line_Options_2017_02_21.pdf - full list of Java command line options (including -XX:+UnlockCommercialFeatures)
• Java™ Mission Control Release Notes_2017_02_21.pdf - makes it clear you need -XX:+UnlockCommercialFeatures option
• Running Java Flight Recorder_2017_02_21.pdf - makes it clear you need -XX:+UnlockCommercialFeatures option

Copies of these documents are on the ICP Discussions Sharepoint site.

[ChrisM-S]

Yes, escaped with a hair’s breadth on the installer I use on the clone build. It looks like there is a more functional MSI installer we should not use (unless we want to pay) but the basic one does do what is necessary for an installer in MDT.

[kjwoodsISIS]

The MSI installer is one of the commercial features of Java. We should NOT use it.

[ChrisM-S]

Just for the record, we use the MSI installer which is extracted by the standard Jave “.exe” installer into %TEMP% and which is how the JRE is installed onto our machines every time. There are some “commercial options” on the “official Enterprise installer" which you can only obtain by downloading it from the place specified. It is unclear to me what the difference between the two MSI installers is (and I’m not planning to try the extracted installer with the commercial options to see - as that might constitute commercial use!). The best explanation of the situation is given by the note at the bottom of

https://www.java.com/en/download/help/msi_install.xml

which shows that oracle know the mechanism we use is used, and is officially unsupported. If the mechanism becomes un-working as opposed to just “unsupported” we will probably have to pay the licence for the installer (as will our facilities IT who need to manage installations by SCCM). Java is a commercial product owned by Oracle so ultimately we are beholden to what they wish to do. I suspect although somewhat disingenuous on Oracle's part, the status quo will be maintained.

[kjwoodsISIS]

The scripts used to invoke Java in order to run the IBEX client are generated by the IBEX build server.
The -XX:+UnlockCommercialFeatures command line option is, at the time of writing (22nd February 2017), not included in the configuration of the build script.
See:

1. build.bat and
2. pom.xml

We also use ActiveMQ on the IBEX server. ActiveMQ is a Java application (from the Apache Software Foundation). ActiveMQ is invoked via one of two batch files:

1. activemq.bat
2. activemq-admin.bat

The -XX:+UnlockCommercialFeatures command line option is, at the time of writing (22nd February 2017), not a feature of either batch file. Given that the Apache SF is dedicated to the provision of open-source software, it seems highly unlikely that they will ever use the -XX:+UnlockCommercialFeatures command line option.

[kjwoodsISIS]

The installer noted by Chris in the previous-but-one comment is the standard installer for the Java SE run-time environment. This installer is free to use.

I don't think we can say that the MSI Enterprise JRE Installer is the "official" installer. It is merely an installer with extra features (whatever they might be) for the convenience of enterprise users and which Oracle want you to pay for. Provided we continue to use the standard installer for the Java SE run-time environment, we will not incur a license fee.

Although it is buried rather deep in various technical documents, Oracle do make it clear that you cannot accidentally use commercial features of Java. You have to make a conscious, explicit decision to do so (either by using the -XX:+UnlockCommercialFeatures command line option, or by downloading and using the MSI Enterprise JRE Installer).

[Tom-Willemsen]

Are the above points documented somewhere, other than on this ticket (which is likely to get buried among the mass of other tickets)?

If there's nowhere more suitable, perhaps a page on the wiki?

[Tom-Willemsen]

After discussion with @John-Holt-Tessella please add the information here:
https://github.com/ISISComputingGroup/ibex_developers_manual/wiki/Java-paid-features

We will link to it from the various places in the wiki where java is installed

[kjwoodsISIS]

Done.
Page now renamed to https://github.com/ISISComputingGroup/ibex_developers_manual/wiki/Understanding-Java-Licensing