Find Commercial Java Support Before Something Happens

Azul migration experts researched reasons companies choose not to migrate from Oracle Java to an OpenJDK distribution. After careful investigation, they identified six Oracle OpenJDK migration myths and produced the facts to counter each one. 

Myth 5: I don’t need to pay for Java support. After all, I’ve never called Oracle. 

Reality: While Java support includes the ability to log help desk tickets and receive expert engineering assistance, it is also an insurance policy against business-impacting regressions and security breaches. Historically, one in three updates is unstable and cannot be deployed due to issues with non-security-related fixes. Access to Critical Patch Updates from your support provider ensures your Java apps and infrastructure are protected while you wait for an update to stabilize.   

What is support? Most of us think of FAQs, Chatbots, and a phone number. For Java, it’s much more. Java support has elements of a comprehensive insurance policy and a best-in-class service contract rolled into one. It includes the timely delivery of new versions of Java, as well as  OpenJDK updates (security fixes, bug fixes, and enhancements).

Paid commercial Java support versus free Java downloads

The software provided through a support subscription differs from builds that are available for free download in a few important ways. 

First, a support subscription includes Critical Patch Updates,  also known as stabilized security updates. These are builds whose only recent changes are security-related. They act as insurance against instability that can be caused by a full update, with upwards of 300 changes. A support subscription also includes out-of-cycle builds that address urgent fixes and are delivered in between quarterly updates on an emergency basis.

Finally, a support subscription includes backported security fixes to Java versions that have reached their “end of life” and are no longer supported by Oracle and other providers, but continue to be widely used in production. Examples include Java 6 and 7, which reached their “end of life” in December 2018 and July 2022, respectively. Common vulnerabilities and exposures continue to be found in these versions, making support a must. 

While full updates – also known as Patch Set Updates (PSUs) – are available for free and via a support subscription, there are some subtle but significant differences.  The source code of PSU available through a subscription has been scrutinized to ensure that any application that incorporates that JVM can maintain be licensed independently. In the absence of this scrutiny, applications could be required to be licensed under the same open-source license as OpenJDK, the General Public License (GPL) v2 license. This is known as copyleft contamination.

A JDK commercial support subscription provides license, updates, and support for all currently supported LTS versions of Java, plus the current release. The support deliverables include out-of-cycle patches for all supported releases. Azul support includes free community support for Azul Zulu Builds of OpenJDK. Updates for Azul Platform Core customers are released the same day as Oracle updates and include security-only and security-plus-enhancement updates for all supported Java versions. Extended production support is also available for JDK 6 and 7. 

Important elements of support include:  

• Timely releases and fixes: With each new version of Java, Oracle releases new releases and fixes to make the new version safe to use. Because Java is backward compatible in most instances, new fixes can be applied to most previous versions as well. 

• Stabilized security-only updates: With each quarterly release of Java, Oracle and every other JDK distribution releases a patch set update (PSU). It is the full set of new features, enhancements, and security updates for the new release. Oracle and Azul both release a stabilized security-only update, also called a critical patch update (CPU). The CPU is a subset of only the security-related updates for the new release. If the new release is not an LTS, applying just the CPU is more scalable and safer than applying the entire PSU, which can be time-consuming and resource-intensive. 

• IP protection: GNU Public License version 2 with Classpath Exception (GPLv2+CPE) is the primary license used for OpenJDK distributions or runtimes. It imposes strict requirements on how code can be reused. The copyleft nature of the license grants the right to freely distribute and modify the source code but mandates that the rights granted by the GPL must be preserved in any derivative works using the code. The OpenJDK license includes the Classpath Exception (CPE), and any application code on either the classpath or module path is not affected by the copyleft nature of the GPLv2. For commercial OpenJDK distributions, all files that need the CPE must have it. Otherwise, the implication for your applications can be dire. 

• Customer support: Customer support is the most visible differentiator for an OpenJDK distribution. Some companies choose to make self-help assets like FAQs and, blog posts, and videos available. Others, like Azul, offer email and phone support to provide excellent customer service. 

To learn much more about all these issues, read OpenJDK Migration for Dummies. Written by Azul Deputy CTO Simon Ritter, it explains how to migrate to OpenJDK with a proven methodology and navigate any of the rare but potentially nasty edge cases that can trip up unprepared teams.