The JDKs: Which One to Use?

Recently (or not so much), Oracle announced that it will change the way Java evolves, adopting the "Release Train" to launch new versions. In addition, it has changed the way support for the versions will be offered, providing only support for LTS versions.

However, along with this news, how are JDK builds available? Will they be free or paid? Before answering this, it's important to understand what a "valid" JDK for distribution actually means. In practical terms, there is only one set of source code for the JDK. Anyone can pick up this source code, produce a build, and post it to a URL. However, there is a separate certification process that must be used to ensure that construction is valid. Certification is performed by the Java Community Process (JCP), which provides a Technology Compatibility Kit (TCK). If an organization produces an OpenJDK build that complies with the entirely TCK, this build may be described as "compatible with Java SE".

Note that the build cannot be called "Java SE" without the vendor obtaining a commercial license from Oracle. For example, AdoptOpenJDK builds that pass the TCK are not "Java SE," but "Java SE compatible" Also, note that certification is currently on a trust basis — results are not sent to JCP/Oracle for verification and cannot be made public. In short, the OpenJDK + Vendor process transforms a source base into several different builds.

Without further ado, check out the following JDKs that are ready to download:

Oracle JDK

This is the main distributor of Java. This is a commercial version of the brand with paid support. It can be downloaded and used free of charge for development use only. It cannot be used in production without paying Oracle (so it's a trap for the unsuspecting). Oracle intends to provide full, paid support until 2026 or later. Note that, unlike the past, Oracle JDK is not "better" than the OpenJDK build (as long as both are at the same level as the security patch).

OpenJDK Build by Oracle

These are free and unbranded versions of the OpenJDK under the GPL license with Classpath Exception (secure for business use). These builds are only available in the first six months of a release. For Java 11, the expectation is that there will be Java 11.0.0 and then two security patches, 11.0.1 and 11.0.2. To continue using the OpenJDK build by Oracle with security patches, you would have to switch to Java 12 within a month after the launch. Note that the provision of security patches is not the same as support. Support involves paying someone to do the sorting and acting on the error reports.

AdoptOpenJDK Build

These are free and unbranded OpenJDK builds under the GPL license with the Classpath Exception. Unlike Oracle's OpenJDK builds, these builds will continue for a much longer period for major versions such as Java 11. The versions of Java 11 will continue for four years, one year after the next major release. AdoptOpenJDK is a community group. They will provide builds as long as other groups create and publish security fixes to a source repository in OpenJDK. Both IBM and Red Hat have indicated that they intend to provide these security patches.

AdoptOpenJDK OpenJ9 Build

In addition to standard OpenJDK builds, AdoptOpenJDK will also provide builds with OpenJ9 instead of HotSpot. OpenJ9 was originally the IBM JVM, but OpenJ9 is now open source in Eclipse. This one, in fact, is something to be studied.

Red Hat OpenJDK Build

Red Hat provides OpenJDK builds through Red Hat Enterprise Linux (RHEL), which is a commercial product with paid support. They are very good at providing security fixes back to OpenJDK. In the past, Red Hat has run the Java 6 and 7 security update project. The Red Hat build is better integrated with the operating system, so it is not a pure OpenJDK build (no end-user JDK)

Azul Zulu

Zulu is a branded version of OpenJDK with paid commercial support. In addition, Azul provides some Zulu constructions for free as part of the "Zulu Community;" however, there are no specific commitments regarding the availability of these free constructions. Azul has an extensive plan to commercially support Zulu, including plans to support Java 9, 13, and 15, unlike any other vendor.

Amazon Corretto

Among all, it is the newest option. Corretto is a no-cost build of OpenJDK with long-term support passing through the TCK. It is under the standard GPL + CE license of all versions of OpenJDK. Amazon will add its own patches and run Corretto on AWS, so it will be heavily used (it has already been placed on some products). Support for Java 8 will be at least until June 2023.

In the process of transforming OpenJDK's source database into a building, the vendor may or may not add some branding or additional utilities as long as this does not prevent certification (TCK). For example, a provider can not add a new public method to an API or a new language resource.

Additionally, there are still other implementations of JDK, such as IBM and SAPMachine. However, these builds are not yet as used as the others, so I decided to leave their out of this short article.

Conclusion

Personally, I don't see it as a problem to have several distributions of JDK, since each one must be passed previously in the TCK. The item to be taken care of here is precisely the adoption of a proprietary JDK (Oracle) and a free build, avoiding further headaches in the future. If you only use the default features (for example, it does not depend heavily on security updates for your business), it is good to use OpenJDK Builds by Oracle (NOT OracleJDK), as it will ensure constant updating (within six months of release) and you can use JDK in production without major problems. If your business is cloud-based (with AWS), I think it's a good try on AWS Corretto.