OWS not working with JDK23+?

[AlBundy33]

OWS does not start our application with JDK23 (tested with https://adoptium.net/de/temurin/releases/?version=23&os=windows&arch=x64&package=jdk)

Feel free to ask if you need more informations.

end of stage1-log looks like this

...
[ITW-CORE][2025-02-27 16:05:50.380 MEZ][INFO ][com.openwebstart.launcher.OwsJvmLauncher] using java runtime at 'Z:\Software\Java\OpenJDK23\jdk-23.0.2+7' for launching managed application
[ITW-CORE][2025-02-27 16:05:50.399 MEZ][INFO ][com.openwebstart.launcher.OwsJvmLauncher] About to launch process with command:
Z:\Software\Java\OpenJDK23\jdk-23.0.2+7\bin\java.exe "-Xbootclasspath/a:C:\Program Files\OpenWebStart\openwebstart.jar" -Dicedtea-web.bin.location=C:\Program Files\OpenWebStart\javaws -Xms64m -Xmx1024m -XX:MaxHeapFreeRatio=40 -Djnlp.secure.argument.14=true -Djnlp.file.encoding=UTF-8 -Djnlp.osgi.parentClassloader=current -Djnlp.java.util.Arrays.useLegacyMergeSort=true -Djnlp.osgi.bundles=org.eclipse.core.runtime@2:start,org.eclipse.equinox.event@3:start,org.eclipse.equinox.ds@3:start,org.apache.felix.scr@3:start -Djnlp.osgi.splashPath=platform:/base/plugins/my.super.application -Djnlp.donotModifyDefaultLocale=true -Djava.util.Arrays.useLegacyMergeSort=true -Djnlp.eclipse.security=osgi -Djnlp.org.eclipse.swt.internal.carbon.smallFonts= -Djnlp.packEnabled=true --add-reads=java.base=ALL-UNNAMED,java.desktop --add-reads=java.desktop=ALL-UNNAMED,java.naming --add-reads=java.naming=ALL-UNNAMED,java.desktop --add-exports=java.desktop/sun.awt=ALL-UNNAMED,java.desktop --add-exports=java.desktop/javax.jnlp=ALL-UNNAMED,java.desktop --add-exports=java.base/com.sun.net.ssl.internal.ssl=ALL-UNNAMED,java.desktop --add-exports=java.base/sun.net.www.protocol.jar=ALL-UNNAMED,java.desktop --add-exports=java.base/sun.security.action=ALL-UNNAMED,java.desktop --add-exports=java.base/sun.security.provider=ALL-UNNAMED,java.desktop --add-exports=java.base/sun.security.util=ALL-UNNAMED,java.desktop --add-exports=java.base/sun.security.validator=ALL-UNNAMED,java.desktop --add-exports=java.base/sun.security.x509=ALL-UNNAMED,java.desktop --add-exports=java.base/jdk.internal.util.jar=ALL-UNNAMED,java.desktop --add-exports=java.base/sun.net.www.protocol.http=ALL-UNNAMED,java.desktop --add-exports=java.desktop/sun.awt.X11=ALL-UNNAMED,java.desktop --add-exports=java.desktop/sun.applet=ALL-UNNAMED,java.desktop,jdk.jsobject --add-exports=java.naming/com.sun.jndi.toolkit.url=ALL-UNNAMED,java.desktop --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.math=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.desktop/java.beans=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/sun.nio.ch=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/sun.security.ssl=ALL-UNNAMED -Djava.security.manager=allow net.sourceforge.jnlp.runtime.Boot -Xnofork C:\Users\XXXX\Downloads\jnlp (10).jnlp
[ITW-CORE][2025-02-27 16:05:54.121 MEZ][INFO ][net.sourceforge.jnlp.util.logging.OutputController] Increase polling interval for shutdown phase
[ITW-CORE][2025-02-27 16:05:54.122 MEZ][INFO ][net.adoptopenjdk.icedteaweb.resources.cache.CacheImpl] No other instances of javaws are running

stage2-log looks like this

[XXXX][ITW-CORE][2025-02-27 16:05:51.035 MEZ][INFO ][net.sourceforge.jnlp.util.logging.filelogs.WriterBasedFileLog][Output controller consumer daemon#352b2754] writer-based impl.
[ITW-CORE][2025-02-27 16:05:50.688 MEZ][INFO ][net.sourceforge.jnlp.runtime.EnvironmentPrinter] OpenWebStartLauncher called with args: [-Xnofork, C:\Users\XXXX\Downloads\jnlp (10).jnlp].
[ITW-CORE][2025-02-27 16:05:50.688 MEZ][INFO ][net.sourceforge.jnlp.runtime.EnvironmentPrinter] OS: Windows 10
[ITW-CORE][2025-02-27 16:05:50.688 MEZ][INFO ][net.sourceforge.jnlp.runtime.EnvironmentPrinter] Java Runtime Eclipse Adoptium-23.0.2
[ITW-CORE][2025-02-27 16:05:50.986 MEZ][INFO ][net.sourceforge.jnlp.config.DeploymentConfiguration] Ico provider registered correctly.
[ITW-CORE][2025-02-27 16:05:51.012 MEZ][INFO ][net.sourceforge.jnlp.config.DeploymentConfiguration] Loading USER level properties from: file:/C:/Users/XXXX/.config/icedtea-web/deployment.properties
[ITW-CORE][2025-02-27 16:05:53.907 MEZ][INFO ][net.sourceforge.jnlp.util.logging.OutputController] Increase polling interval for shutdown phase

if I use a local client with the same java it starts as expected so I assume that this is an issue with OWS

[janakmulani]

Yes, we too tested with JDK 23 and found out that OWS does not work with Java 23. We are looking into this.

[kovadam69]

The cause with JDK23 is this:
[ITW-CORE][2025-11-12 14:33:00.844 CET][DEBUG][net.sourceforge.jnlp.runtime.Boot]
Exiting Boot.mainWithReturnCode() exceptionally
java.lang.NoClassDefFoundError: sun/net/www/protocol/jar/URLJarFileCallBack
at net.sourceforge.jnlp.runtime.JNLPRuntime.initialize(JNLPRuntime.java:304)
at net.sourceforge.jnlp.runtime.Boot.runMain(Boot.java:280)
at net.sourceforge.jnlp.runtime.Boot.mainWithReturnCode(Boot.java:153)
at net.sourceforge.jnlp.runtime.Boot.main(Boot.java:135)

There is also problem with JDK24, which removed securityManager completely from it, and accessing securityManager throws an UnsupportedOperationException. Since the command line is assembled like this:
/usr/lib/jvm/jdk-24.0.2/bin/java -Xbootclasspath/a:/opt/OpenWebStart/openwebstart.jar -Dicedtea-web.bin.location=/opt/OpenWebStart/javaws -Xms64m -Xmx2048m -Djnlp.versionEnabled=true -Djava.net.preferIPv4Stack=true --add-reads=java.base=ALL-UNNAMED,java.desktop --add-reads=java.desktop=ALL-UNNAMED,java.naming --add-reads=java.naming=ALL-UNNAMED,java.desktop --add-exports=java.desktop/sun.awt=ALL-UNNAMED,java.desktop --add-exports=java.desktop/javax.jnlp=ALL-UNNAMED,java.desktop --add-exports=java.base/com.sun.net.ssl.internal.ssl=ALL-UNNAMED,java.desktop --add-exports=java.base/sun.net.www.protocol.jar=ALL-UNNAMED,java.desktop --add-exports=java.base/sun.security.action=ALL-UNNAMED,java.desktop --add-exports=java.base/sun.security.provider=ALL-UNNAMED,java.desktop --add-exports=java.base/sun.security.util=ALL-UNNAMED,java.desktop --add-exports=java.base/sun.security.validator=ALL-UNNAMED,java.desktop --add-exports=java.base/sun.security.x509=ALL-UNNAMED,java.desktop --add-exports=java.base/jdk.internal.util.jar=ALL-UNNAMED,java.desktop --add-exports=java.base/sun.net.www.protocol.http=ALL-UNNAMED,java.desktop --add-exports=java.desktop/sun.awt.X11=ALL-UNNAMED,java.desktop --add-exports=java.desktop/sun.applet=ALL-UNNAMED,java.desktop,jdk.jsobject --add-exports=java.naming/com.sun.jndi.toolkit.url=ALL-UNNAMED,java.desktop -Djava.security.manager=allow net.sourceforge.jnlp.runtime.Boot -Xnofork /home/user/app.jnlp

The -Djava.security.manager=allow throws an exception even before starting anything:

Error occurred during initialization of VM
java.lang.Error: A command line option has attempted to allow or enable the Security Manager. Enabling a Security Manager is not supported.
at java.lang.System.initPhase3(java.base@24.0.2/System.java:1947)

If you remove the -Djava.security.manager=allow from command line, then it would start except it also misses the sun.net.www.protocol.jar.URLJarFileCallBack class from JDK24 also.

This "bug" makes impossible, that a JavaFX application can be started using OpenWebstart, which uses JavaFX version 24+, as it requires JDK23+.

[AlBundy33]

This is (of course) also an issue with java 25 which is the current LTS version

ava -version
openjdk version "25.0.1" 2025-10-21 LTS
OpenJDK Runtime Environment Temurin-25.0.1+8 (build 25.0.1+8-LTS)
OpenJDK 64-Bit Server VM Temurin-25.0.1+8 (build 25.0.1+8-LTS, mixed mode, sharing)

java -Djava.security.manager=allow -version
Error occurred during initialization of VM
java.lang.Error: A command line option has attempted to allow or enable the Security Manager. Enabling a Security Manager is not supported.
        at java.lang.System.initPhase3(java.base@25.0.1/System.java:1969)

seems to be set (only?) here:

OpenWebStart/openwebstart/src/main/java/com/openwebstart/launcher/OwsJvmLauncher.java

Line 174 in 4b63ebf

mergedVMArgs.add("-Djava.security.manager=allow");

[hansiang93]

this is pretty much critical given that jdk25 is released and is considered LTS

[AlBundy33]

Any news about this issue?

[janakmulani]

OWS/ITW stopped working with Java 23 because URLJarFileCallBack was removed and with Java 24 because the SecurityManager was removed. The vm arg -Djava.security.manager=allow was added for OWS stage2 JVM to make OWS run with Java 18 onwards. No plans yet as need to estimate effort and find resources.

[akuhtz]

See AdoptOpenJDK/IcedTea-Web#969

[janakmulani]

@akuhtz Thanks for the pointer. Will review soon.

[StijnArnauts]

@janakmulani, have you had a change to review the provided PR? This is a pretty import issue for us.

[janakmulani]

Yes, looking at it..

[sbrattla]

Following this one closely - eagerly waiting to upgrade to a more recent version of Java.

[siju-bcm]

I see the PR is open #651 - any idea when we can expect a release with this fix ?

[janakmulani]

PR #651: similar PR has been created. However, AdoptOpenJDK/IcedTea-Web#969 has some issues. Moreover, the changes related to the SecurityManager also have some issues. Will create a new branch of ITW and new PR after testing various scenarios. This will need time and effort, hence won't be part of the next release (due likely in June).

[imps-od]

Thanks for your valuable work on OpenWebStart.

We recently upgraded our flagship application and build process to fully use JDK 25 LTS (for compile, test, sonar scan and run). Today we realized that web-start is the only blocking issue for rolling out our updated application.

So I guess this is a +1 for up-voting the importance of this issue.