Adoptium Summit 2024

Ahoy, fellow voyagers! Join us aboard the Jenkins ship as we embark on an exhilarating journey with Temurin.

Set sail with us as we navigate through the seas of JDK management: From the choppy waters of Docker images to the smooth sailing of Temurin binaries.

Discover how we've optimized performance, enhanced CVE response times, and explored uncharted territories like testing JDK21 on RISC-V.

But that’s not all! Learn about our efforts to improve Adoptium API integration and our vision for the future of JDK management in Jenkins.

Prepare to be inspired and energized as we chart our course towards smoother seas and brighter horizons.

Don’t miss this opportunity to join our crew and be part of the adventure!

From the outside the release process at Adoptium may look overwhelming; 5 different java versions (at the time of writing) each released on multiple platforms. This talk will explore what it takes from an infrastructure perspective to facilitate a smooth and stable release process. The talk will provide an overview of the builds and tests we run at Adoptium before announcing a successful release, as well as a comparison with other popular Java vendors.

We (Alibaba), as one of the largest Java users in the world, have been on a perpetual journey of upgrading Java versions in our production systems. In this talk, we will share our engaging experiences with EMT4J and the lessons we have learned from using EMT4J to migrate extremely distributed Java applications running on massive infrastructure. We will describe the technical challenges we faced when upgrading our applications in the cloud and the solutions with EMT4J we are using. While your workloads are different, the thought practices we went through could be helpful for you.

You'll learn about:

1. What’s the EMT4J, and how can you use it for your upgrade?
2. The scale of Alibaba Cloud’s internal Java ecosystem, how we manage the migrating efforts
3. The upgrading process/practices we used in our production system and the lessons we have learned.

A Vulnerability Disclosure Report (VDR) is to software what a nutrition label is to food. In this talk, we’ll review the Temurin VDR, what goes in it, how to interpret it, and how to determine what your next steps should be if the version you are using is vulnerable. We’ll discuss what Common Vulnerabilities and Exposures (CVEs) are and how they are reported. We’ll point out where we get our information from (e.g., the OpenJDK Vulnerability Group and NIST Database). We’ll also discuss the CycloneDX format we use for reporting and will walk through a sample VDR.

Software supply chain security is an industry-wide problem that impacts both open source and proprietary software. With attack vectors present at every stage of the software development process and thousands of dependencies, this is a technical debt that demands innovative solutions, scalable processes, and years of effort to address. The Eclipse Foundation and the Adoptium Project are leading the way with Eclipse Temurin and a common security infrastructure to make open source software more secure. The presentation will explain how and why the Adoptium Project and the Eclipse Foundation are combining forces to make Temurin the world’s most secure OpenJDK Distribution and why anyone running Java applications should care.

In today’s fast-paced technological landscape, maintaining efficiency, quality, and reliability in projects is critical for any project development. Embark on a journey of inspiration as we explore the fusion of AI with Adoptium AQAvit and Openj9. In this talk, we’ll delve into visionary AI concepts and initiatives within both projects, illuminating pathways for transformative change. From dynamic issue triage and seamless assignment to proactive issue creation, test prioritization, and foresighted issue prediction, we’ll unveil the boundless possibilities that AI integration offers. Moreover, we will explore the tangible benefits and pragmatic implications of infusing AI into AQAvit testing and Openj9 workflows, including accelerated testing and release cycles, heightened fault detection capabilities, and diminished manual workload. Through real-world case studies, attendees will gain insights into how AI can revolutionize testing and triaging, paving the way for more robust and reliable software development practices.

The Adoptium project utilises infrastructure from a variety of providers, and due to the publicly open nature of the project, ensuring the supply chain and build infrastructure machines are secure is a key objective.

This talk will discuss implementing tools (most notably Wazuh) to extend the default auditing available on systems) to more easily enable access audits, provide visibility of the volume of attacks, and allow a great degree of confidence in our implemented security policies. This 10-minute lightning talk will cover the importance of proving that implemented security measures are effective.

This is an opportunity to celebrate all the achievements done by the Adoptium community based on their annual plan and what is still waiting to be done with the community contribution.