Add java25 checks and unit test min to java17

.github/workflows/ci.yaml

@@ -20,7 +20,7 @@ jobs:
     strategy:
       matrix:
         # sigstore-java still supports Java 11, however, we test it with conformance-tests only
-        java-version: [17, 21]
+        java-version: [17, 21, 25]
       fail-fast: false
 
     concurrency:

build-logic/basics/src/main/kotlin/ToolchainProperties.kt

@@ -17,9 +17,16 @@ val BuildParametersExtension.buildJdkVersion: Int
     get() = buildJdk?.version ?: JavaVersion.current().majorVersion.toInt()
 
 val BuildParametersExtension.testJdk: ToolchainProperties?
-    get() = jdkTestVersion.orNull?.takeIf { it != 0 }
-        ?.let { ToolchainProperties(it, jdkTestVendor.orNull, jdkTestImplementation.orNull) }
-        ?: buildJdk
+    get() {
+        val requestedVersion = jdkTestVersion.orNull?.takeIf { it != 0 }
+        val finalVersion = requestedVersion ?: buildJdkVersion
+        if (finalVersion < 17) {
+            throw IllegalArgumentException("Unit tests require at least Java 17. Resolved: $finalVersion")
+        }
+        return requestedVersion?.let { ToolchainProperties(it, jdkTestVendor.orNull, jdkTestImplementation.orNull) }
+            ?: buildJdk
+    }
 
 val BuildParametersExtension.testJdkVersion: Int
-    get() = jdkTestVersion.orNull ?: buildJdkVersion
+    get() = testJdk?.version ?: buildJdkVersion
+

build-logic/jvm/src/main/kotlin/build-logic.java.gradle.kts

@@ -25,7 +25,7 @@ tasks.configureEach<JavaExec> {
 
 spotless {
     java {
-        googleJavaFormat("1.24.0")
+        googleJavaFormat("1.35.0")
         licenseHeaderFile("$rootDir/config/licenseHeader")
         // Note if submodule needs to add more exclusions, it should list ALL of them since
         // Spotless does not have "addTargetExclude" method
@@ -43,7 +43,11 @@ tasks.withType<JavaCompile>().configureEach {
             compilerArgs.add("-Werror")
         }
 
-        release.set(buildParameters.targetJavaVersion)
+        if (name.endsWith("TestJava")) {
+            release.set(17)
+        } else {
+            release.set(buildParameters.targetJavaVersion)
+        }
     }
 }
 

build-logic/jvm/src/main/kotlin/build-logic.kotlin.gradle.kts

@@ -26,7 +26,7 @@ autostyle {
 
 tasks.withType<KotlinJvmCompile>().configureEach {
     compilerOptions {
-        val targetJdkRelease = buildParameters.targetJavaVersion.toString()
+        val targetJdkRelease = if (name.endsWith("TestKotlin")) "17" else buildParameters.targetJavaVersion.toString()
         freeCompilerArgs.add("-Xjdk-release=$targetJdkRelease")
         jvmTarget = JvmTarget.fromTarget(targetJdkRelease)
     }

build-logic/jvm/src/main/kotlin/build-logic.testing.gradle.kts

@@ -22,4 +22,7 @@ tasks.withType<Test>().configureEach {
     if (project.hasProperty("skipStaging")) {
         systemProperty("sigstore-java.test.skipStaging", project.findProperty("skipStaging")!!)
     }
+    if (buildParameters.testJdkVersion >= 23) {
+        jvmArgs("--sun-misc-unsafe-memory-access=deny")
+    }
 }

fuzzing/oss_fuzz_build.sh

@@ -3,7 +3,8 @@
 # TODO: this should be a gradle plugin
 
 # build the fuzzing classes and extract dependencies into $OUT
-./gradlew :fuzzing:copyToFuzzOut -x test -PfuzzOut="$OUT"
+# Exclude spotlessCheck because GJF 1.35.0+ requires JDK 21+ to run, which would crash the build in CIFuzz (currently running on JDK 17).
+./gradlew :fuzzing:copyToFuzzOut -x test -x spotlessCheck -PfuzzOut="$OUT"
 ALL_JARS=""
 for jarfile in $(find $OUT -name *.jar)
 do

sigstore-java/build.gradle.kts

@@ -50,7 +50,7 @@ dependencies {
     testImplementation("org.mockito:mockito-core")
     testImplementation("org.mockito:mockito-junit-jupiter")
 
-    testImplementation("no.nav.security:mock-oauth2-server:0.5.10")
+    testImplementation("no.nav.security:mock-oauth2-server:5.0.2")
     testImplementation("com.squareup.okhttp3:mockwebserver:5.4.0")
     testImplementation("net.sourceforge.htmlunit:htmlunit:2.70.0")
 
@@ -91,12 +91,12 @@ spotless {
         )
     }
     format("conscrypt", com.diffplug.gradle.spotless.JavaExtension::class.java) {
-        googleJavaFormat("1.24.0")
+        googleJavaFormat("1.35.0")
         licenseHeaderFile("$rootDir/config/conscryptLicenseHeader")
         target("src/*/java/dev/sigstore/encryption/certificates/transparency/*.java")
     }
     format("webPki", com.diffplug.gradle.spotless.JavaExtension::class.java) {
-        googleJavaFormat("1.24.0")
+        googleJavaFormat("1.35.0")
         licenseHeaderFile("$rootDir/config/webPKILicenseHeader")
         target("src/*/java/dev/sigstore/json/canonicalizer/*.java")
     }

sigstore-java/src/test/resources/dev/sigstore/oidc/server/config-bad-nonce.json

@@ -11,8 +11,8 @@
       "tokenExpiry": 120,
       "requestMappings": [
         {
-          "requestParam": "scope",
-          "match": "openid email",
+          "requestParam": "client_id",
+          "match": "sigstore",
           "claims": {
             "audience": "sigstore",
             "email": "test.person@test.com",

sigstore-java/src/test/resources/dev/sigstore/oidc/server/config.json

@@ -11,8 +11,8 @@
       "tokenExpiry": 120,
       "requestMappings": [
         {
-          "requestParam": "scope",
-          "match": "openid email",
+          "requestParam": "client_id",
+          "match": "sigstore",
           "claims": {
             "audience": "sigstore",
             "email": "test.person@test.com",

sigstore-testkit/build.gradle.kts

@@ -1,3 +1,6 @@
+import org.jetbrains.kotlin.gradle.dsl.JvmTarget
+import org.jetbrains.kotlin.gradle.tasks.KotlinJvmCompile
+
 plugins {
     id("build-logic.kotlin")
     id("build-logic.repositories")
@@ -18,3 +21,14 @@ dependencies {
     api("org.assertj:assertj-core:3.27.7")
     api(gradleTestKit())
 }
+
+tasks.withType<JavaCompile>().configureEach {
+    options.release.set(17)
+}
+
+tasks.withType<KotlinJvmCompile>().configureEach {
+    compilerOptions {
+        freeCompilerArgs.add("-Xjdk-release=17")
+        jvmTarget = JvmTarget.JVM_17
+    }
+}