Monday, 3 September 2018

Time to look beyond Oracle's JDK

From Java 11 its time to think beyond Oracle's JDK. Time to appreciate the depth of the ecosystem built on OpenJDK. Here is a list of some key OpenJDK builds.

This is a quick follow up to my recent zero-cost Java post

OpenJDK builds

In practical terms, there is only one set of source code for the JDK. The source code is hosted in Mercurial at OpenJDK.

Anyone can take that source code, produce a build and publish it on a URL. But there is a distinct certification process that should be used to ensure the build is valid.

Certification is run by the Java Community Process, which provides a Technology Compatibility Kit (TCK, sometimes referred to as the JCK). If an organization produces an OpenJDK build that passes the TCK then that build can be described as "Java SE compatible".

Note that the build cannot be referred to as "Java SE" without the vendor getting a commercial license from Oracle. For example, builds from AdoptOpenJDK that pass the TCK are not "Java SE", but "Java SE compatible" or "compatible with the Java SE specification". Note also that certification is currently on a trust-basis - the results are not submitted to the JCP/Oracle for checking and cannot be made public. See Volker's excellent comment for more details.

To summarise, the OpenJDK + Vendor process turns one sourcebase into many different builds.

In the process of turning the OpenJDK sourcebase into a build, the vendor may, or may not, add some additional branding or utilities, provided these do not prevent certification. For example, a vendor cannot add a new public method to an API, or a new language feature.

Oracle JDK

From Java 11 this is a branded commercial build with paid-for support. It can be downloaded and used without cost only for development use. It cannot be used in production without paying Oracle (so it is a bit of a trap for the unwary). Oracle intends to provide full paid support until 2026 or later (details). Note that unlike in the past, the Oracle JDK is not "better" than the OpenJDK build (provided both are at the same security patch level). See here for more details of the small differences between Oracle JDK and the OpenJDk build by Oracle.

OpenJDK builds by Oracle

These are $free pure unbranded builds of OpenJDK under the GPL license with Classpath Extension (safe for use in companies). These builds are only available for the first 6 months of a release. For Java 11, the expectation is there will be Java 11.0.0, then two security patches 11.0.1 and 11.0.2. To continue using the OpenJDK build by Oracle with security patches, you would have to move to Java 12 within one month of it being released. (Note that the provision of security patches is not the same as support. Support involves paying someone to triage and act upon your bug reports.)

AdoptOpenJDK builds

These are $free pure unbranded builds of OpenJDK under the GPL license with Classpath Extension. Unlike the OpenJDK builds by Oracle, these builds will continue for a much longer period for major releases like Java 11. The Java 11 builds will continue for 4 years, one year after the next major release (details). AdoptOpenJDK is a community group. They will provide builds provided that other groups create and publish security patches in a source repository at OpenJDK. Both IBM and Red Hat have indicated that they intend to provide those security patches.

AdoptOpenJDK OpenJ9 builds

In addition to the standard OpenJDK builds, AdoptOpenJDK will also be providing builds with OpenJ9 instead of HotSpot. OpenJ9 was originally IBM's JVM, but OpenJ9 is now Open Source at Eclipse.

Red Hat OpenJDK builds

Red Hat provides builds of OpenJDK via Red Hat Enterprise Linux (RHEL) which is a commercial product with paid-for support (details). They are very good at providing security patches back to OpenJDK, and Red Hat has run the security updates project of Java 6 and 7. The Red Hat build is integrated better into the operating system, so it is not a pure OpenJDK build (although you wouldn't notice the difference).

Other Linux OpenJDK builds

Different Linux distros have different ways to access OpenJDK. Here are some links for common distros: Debian, Fedora, Arch, Ubuntu.

Azul Zulu

Zulu is a branded build of OpenJDK with commercial paid-for support. In addition, Azul provides some Zulu builds for $free as "Zulu Community", however there are no specific commitments as to the availability of those $free builds. Azul has an extensive plan for supporting Zulu commercially, including plans to support Java 9, 13 and 15, unlike any other vendor (details).

Amazon Corretto

In preview from 2018-11-14, this is a zero-cost build of OpenJDK with long-term support that passes the TCK. It is under the standard GPL+CE license of all OpenJDK builds. Amazon will be adding their own patches and running Corretto on AWS, so it will be very widely used. Java 8 support will be until at least June 2023.


IBM provides and supports a JDK for Java 8 and earlier. They also provide commercial paid-for support for the AdoptOpenJDK builds with OpenJ9.


SAP provides a JDK for Java 10 and later under the GPL+CE license. They also have a commercial closed-source JVM. Information on support lifetimes can be found here.


Liberica from Bellsoft is a $free TCK verified OpenJDK distribution for x86, ARM32 and ARM64. I haven't found any information on support lifetimes.

ojdkbuild project

A community project sponsored by Red Hat that produces OpenJDK builds. They are the basis of Red Hat's Windows builds. The project has no customer support but does intend to provide builds so long as Red Hat supports a Java version. No information is provided about the TCK.


There are undoubtedly other builds of OpenJDK, both commercial and $free. Please contact me if you'd like me to consider adding another section.


There are many different builds of OpenJDK, the original upstream source repository. Each build offers its own unique take - $free or commercial, branded or unbranded.

Choice is great. But if you just want the "standard", currently my best advice is to use the OpenJDK builds by Oracle, AdoptOpenJDK builds or the one in your Operating System (Linux).


  1. > Other Linux OpenJDK builds

    How many of them actually run the TCK? I assume Fedora is the same as RHEL. But Debian?

    Red Hat obviously has some patches but "you wouldn't notice the difference"(tm). Are they documented somewhere? What about the other Linux builds, do they build just from the OpenJDK sources or do they have some patches as well?

    1. You can get the source rpm and pull them apart. Engineering tries to upstream all patches first, so having rhel specific patches is the exception rather the rule (at least from my perspective in the product security team).

    2. > You can get the source rpm and pull them apart.

      So undocumented then?

      > so having rhel specific patches is the exception rather the rule

      This directly contradicts the statements made by Andrew Haley in the comment linked in the article

  2. Thanks for sharing this information. You're doing an important thing for all of us here.

  3. Hi Stephen,
    thanks for compiling this useful overview. However, it contains a tiny but crucial inaccuracy: you can NEVER call you OpenJDK build “Java SE” unless you buy a commercial license from Oracle which allows you to do so (“Java” and “Java SE” are a trademark registered by Oracle). All you can do if you fully pass a “certification” run with the TCK is to call your binary “Java (TM) SE XX compatible” or say that it passed the “Java (TM) SE XX TCK.
    Notice moreover that the TCK can be run in several “modes” of which the “certification” mode is by far the most extensive and expensive one. Unfortunately, neither are the users of the TCK for the OpenJDK (i.e. OCTLA signers allowed to share their certification results with the public nor are they required to submit theses results to Oracle for checking. So claiming compatibility with a Java SE specification is currently a matter of trust.

  4. A correction for your information. TCK stands for Technology Compatibility Kit rather than Testing Compatibility Kit.

  5. In addition to RHEL, Red Hat also has OpenJDK builds for Windows:

  6. What about IntellIJ? They provide a very good range of OpenJDK builds for most popular patforms.

  7. Thanks for the information. One naive question: Is there a way to get the tar/zip for Oracle OpenJDK? The site seem to point to a download of Oracle JDK and not Oracle OpenJDK.

    1. Thanks Stephen! Hope I am not missing anything here ..I downloaded JDK 8 from the above link and looked at License file and it redirected to which points to Oracle BCL. Is that correct?

    2. This article is about Java 11. For Java 8 there was no "OpenJDK build by Oracle".

  8. Excellent Article. Thanks for sharing.

  9. So, really, it all comes down to:
    * How often security patches are pushed back into the OpenJDK source (by anyone)
    * How often companies rebuild and release THEIR OpenJDK build

    By the sounds of it, best bet is:
    * Oracle OpenJDK if you think you CAN update through major versions easily
    * AdoptOpenJDK if you think you can't

  10. I just want to tell that in order to avoid thinking about Oracle licencing issues, I switched to Zulu several days ago and deleted all Java. So far, Zulu works great without a glitch with may JavaEE apps (Hibernate+Maven+Sprint+Primefaces) and eclipse.

  11. I think a very good reason for getting the Oracle JDK is that it actually invests back into an organization heavily contributing to the development effort. Especially now that the subscription fees are sane…

  12. I just want to add:
    -, used by docker for their windows container builds

    -, only openjdk8, used by jetbrains for theirs intellij based ide, openjdk with font smoothing patch

  13. Why is there no JDK 11 download on AdoptOpenJDK?
    Will it only be available after Oracle OpenJDK 11 ( ends its live cycle after 6 month? Or is it just not maintained at the time?

    1. It will take a few days to run the TCK and get it uploaded. Their aim is later this week, but bear in mind it is a volunteer-led project!

    2. Was it same with RedHatOpenJDK too?

  14. Liberica from Bellsoft is a $free TCK verified OpenJDK distributrion for x86, ARM32 and ARM64.

  15. One need only contemplate that as of 1-Oct-2018 and a simple search of "Java Download" continues to push Java 8 to the masses. Oracle could have resolved their own house with a more open and unified rollout, and avoided the vast majority of confusion...if they had wanted to. Politics.

  16. Just an observation : We did a quick look at the AdoptOpenJDK (both OpenJ9 and regular) for Java 8 and it looked like OpenJ9 did not support the AES extensions in the microprocessor. I don't think Java 9 did either.

  17. About Azul's Zulu, I have the impression that the link you provided is for the commercial product, while is for the community product, the one I supposed is the free one. What link should we use if we want it $free and open source?

    1. With Oracle, the commercial JDK is a different download with a different license. Whereas with Azul, there is only one download and one JDK, but you can choose to pay for support. ie. the support is an optional choice you can make separate to downloading and using the JDK. Note that now redirects to the main Azul website.

    2. Thank you for the clarification

  18. So, every OpenJDK builder forks OpenJDK source code to add their own improvements.
    And , I guess, these new repositories (forks) are open source, according to GPL + CPE license.
    So, every builder could apply patches from another builder to its own repository, right ?
    And , must every builder contribute to main OpenJDK repository , backporting patches/improvements ?

    1. There is no requirement for builders to contribute back to the main OpenJDK repository.

    2. OK, thanks. So, from January 2019, if you want an patched Oracle JDK 8 build , you need a paid license. But Oracle must publish the source code of these patches, because Oracle JDK's source is derivated from OpenJDK 8. So, RedHat ( or someone ) could apply these patches to OpenJDK 8 source , available for every vendor/builder. Is this a real scenario ? What is going to be the behaviour of Oracle with OpenJDK 8 from next January 2019 ?

    3. No, Oracle is the prime author and copyright holder they are not limited by the GPL. They have their own rights under a different license, so they do not have to publish their patches. For Red Hat and others to maintain the JDK, they will need to work on their own set of patches, independent of Oracle.

  19. Hi Stephen,
    Thanks for the info. I'm not getting this specific part under **OpenJDK builds by Oracle**: *To continue using the OpenJDK build by Oracle with security patches, you would have to move to Java 12 within one month of it being released*. Am I obliged to do this by license terms or you mean just to receive patches? Thanks.

    1. The license does not force you to move - it is just that most companies don't want to run unpatched software in production.

  20. Question,
    Will the Java 8 build on Open JDK be receiving the same security patches as the Oracle builds? We need to use Java Webstart for now.

    1. There is an expectation that there will be some divergence between Oracle JDK and OpenJDK once Oracle ceases to be the lead of the project, but there is also the expectation that the security patches will be kept close between the two.

  21. How does project IcedTea fall into this?


Please be aware that by commenting you provide consent to associate your selected profile with your comment. Long comments or those with excessive links may be deleted by Blogger (not me!). All spam will be deleted.