# Temurin 25 as JDK and Runtime of All werk Repositories

**Status:**
- proposed: 2026-10-11
- accepted: 2026-10-11
- rejected: -
- superseded: -
- revised: 2026-10-11, see "Revision of 2026-10-11"

**Decision [accepted]:** All werk repositories build with Temurin 25, and each service runs on a runtime jlinked from it;
Werkator's build environment provides Temurin 25, so no build downloads a JDK.

## Context and Problem Statement

Each werk repository chose its JDK and its runtime on its own (state on 2026-10-11):

| Repository | JDK | Vendor | Download | Gradle | Kotlin | Runtime on the host |
|---|---|---|---|---|---|---|
| werkator | 21 | Temurin | Foojay 0.8.0 | 8.14.5 | 2.2.0 | jlinked, mih09 |
| werkregie | 21 | Temurin | Foojay 1.0.0 | 9.8.1 | 2.4.21 | jlinked |
| werkrevisor, statistics | 21 | Temurin | Foojay 0.8.0 | 8.14.5 | 2.2.0 | jar on mih09 |
| werkcrappit | 21 | any | - | 9.8.0 | - | none, a Gradle plugin |
| werkbaum, backend | 21 | any | - | 9.1.0 | 2.2.20 | full Temurin JDK 21 in the home, mih00 |
| werkprobe | any, bytecode 17 | any | - | 9.6.0 | - | Java 17 of the managed webspaces |

`mi` wants one choice for all of them.

### Technical Background

- jlink compiles nothing; it copies the vendor's binaries, so the vendor's build platform sets the glibc floor of a runtime
  (Werkator ADR 0006, Werkator PR#62).
- Measured over all shared libraries: Temurin 21 needs `GLIBC_2.15`, Temurin 25 `GLIBC_2.17`,
  a distribution's OpenJDK the glibc of its distribution, e.g. `GLIBC_2.38` for Ubuntu 24.04's OpenJDK 21.
- mih09 and mih00 run Debian 12 with glibc 2.36.
- Werkator's build environment has Debian's OpenJDK 21; a repository that pins Temurin downloads it with Foojay in each build.

## Considered Options

* Temurin 25 everywhere
* Temurin 21 everywhere
* Any JDK for compiling, Temurin only where a runtime is jlinked

### Temurin 25 Everywhere

Java 25 is the current LTS release.
A test build on 2026-10-11, of a copy of each `main` with the toolchain set to 25, showed:

- werkregie, werkcrappit and werkprobe build unchanged; the jlinked runtimes report Temurin 25.0.4.
- werkator, werkbaum and the statistics service of werkrevisor need Kotlin 2.4.21:
  Kotlin 2.2.0 and 2.2.20 have no JVM 25 target.
  With Kotlin 2.4.21 they build, and werkator's runtime bundle reports Temurin 25.0.4.
- PIT 1.30, JaCoCo 0.8.13 and 0.8.15, Spring Boot 4.0, Trixnity, sqlite-jdbc and H2 work with 25.
- Only tests that need a git checkout or werkdock's sandbox failed, and they fail with JDK 21 as well.

#### Advantages

- One JDK and one runtime for all repositories, with the longest support of an LTS release.
- A runtime jlinked from Temurin 25 starts on every Hostsharing host with glibc 2.17 or newer.

#### Disadvantages

- Three repositories must raise Kotlin to 2.4.21 first.
- Gradle 8.14 does not run on JDK 25; werkator and werkrevisor need Gradle 9 and Foojay 1.0.0, as werkregie.
- werkprobe stays on Java 17 bytecode: the managed webspaces bring their own Java 17.

### Temurin 21 Everywhere

#### Advantages

- No Kotlin and no Gradle upgrade.

#### Disadvantages

- A move to 25 is still due later, with the same work.

### Any JDK for Compiling, Temurin Only Where a Runtime Is jlinked

The state of 2026-10-11.

#### Advantages

- No change.

#### Disadvantages

- What the CI tests is not what runs on the hosts.
- Two Foojay versions and downloads in each build stay.

## Decision Outcome

Temurin 25 everywhere, decided by `mi` on 2026-10-11:

- Each repository builds with the toolchain `JavaLanguageVersion.of(25)` and the vendor `JvmVendorSpec.ADOPTIUM`.
  werkprobe keeps `options.release = 17` for the webspaces.
- Werkator's build environment provides Temurin 25; Foojay stays only as a fallback.
- Each service runs on a runtime jlinked from Temurin 25, werkbaum included; the full JDK in its home goes.

The rollout, in this order:

1. werkator: its build environment gets Temurin 25 beside OpenJDK 21, so no build breaks.
2. One PR per repository switches it to 25, with Kotlin 2.4.21 and Gradle 9 where needed.
3. OpenJDK 21 leaves the build environment.

## Consequences

- A new repository builds with Temurin 25 from the start.
- The module list of each jlinked runtime is checked again with jdeps when its dependencies change.
- The next LTS release gets a decision of its own.

## Revision of 2026-10-11

The build environment does not get Temurin 25; Foojay provides it, decided by `mi` on 2026-10-11 (werkregie PR#22).

- The reason above, "so that no build downloads a JDK", is wrong.
  The builds on mih09 share one Gradle home, and Foojay downloads a JDK into it only once;
  Temurin 21 lies there since 2026-09-17.
- Werkator PR#62 had already rejected a Temurin baked into the rootfs:
  each Java update would mean a new archive of about 425 MB, uploaded by hand.

What changes:

- Each repository pins Temurin 25 with `JvmVendorSpec.ADOPTIUM` and loads it with Foojay 1.0.0.
- Werkator's build environment stays as it is; its OpenJDK 21 runs Gradle.
- The rollout is one PR per repository, with Kotlin 2.4.21 and Gradle 9 where needed;
  steps 1 and 3 above are dropped.