Security Manager deprecation in JDK 17

[Kevin Rushforth]

I don't see how the pending Marlin review is related to anything we 
might do in the future regarding the security manager. In JavaFX 17 we 
already added @SuppressWarnings annotations everywhere they were needed 
using the bug ID referenced below (JDK-8264139).

Since the security manager is still supported in JDK 17 (and in JDK 19, 
for that matter), we still need to be able to run with the security 
manager enabled. So there is nothing related to the SM to fix, at least 
not for JavaFX 20.

The question that I think Nir is asking is: what do we do in the future 
given that the security manager is deprecated for removal, and will at 
some point go away. That's a good question. It's not one that needs to 
be answered immediately, but we should start to discuss it soon. It's 
almost certain that the JDK will provide one more step between where we 
are now (SM is deprecated, but still functional) and complete removal 
(at which time we would not even be able to run on that JDK without 
changes), that step being degraded functionality where the APIs are 
still there, but they do nothing. That would allow an application or 
library like JavaFX to continue running on newer JDKs without a SM and 
still run on older JDKs that support it, albeit in a deprecated fashion. 
That gives us a little more time to figure this out and plan for a 
transition.

The next time we bump the minimum JDK is probably the latest point at 
which we should remove SM support from JavaFX, but we may very well want 
to do it sooner. For example, I could easily imagine JavaFX 22 being be 
a good point at which to remove SM support from JavaFX, even though we 
are unlikely to bump the minimum JDK for JavaFX 22.

Part of the discussion will be: what, if anything, do we need in the way 
of a replacement for what the SM does?

-- Kevin


On 7/30/2022 12:09 AM, Laurent Bourgès wrote:
> Hi,
>
> I will fix the MarlinFX code myself, as I am proposing an openjfx 
> patch, that has already @SuppressWarning lines from jdk17.
> See https://github.com/openjdk/jfx/pull/674
>
> Kevin will review it soon, so I propose you to ignore changes on your 
> side to avoid conflicts in 
> modules/javafx.graphics/src/main/java/com/sun/marlin/**
>
> Thanks,
> Laurent
>
> Le sam. 30 juil. 2022, 08:18, Nir Lisker <nlisker at gmail.com> a écrit :
>
>     Now that we are using JDK 17, the SecurityManager is deprecated
>     for removal. JDK-8264139 [1] already suppressed the warnings, but
>     we should probably start looking at replacements as there are ~200
>     affected files. What is the plan going forward?
>
>     [1] https://bugs.openjdk.org/browse/JDK-8264139
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mail.openjdk.org/pipermail/openjfx-dev/attachments/20220730/c5237ec9/attachment.htm>