Use SPDX identifier in POMs

[TheMrMilchmann]

This replaces the custom name with an SPDX identifier to enable tooling to automatically detect the correct license. Using an SPDX identifier is recommended by the official Maven documentation.

See https://spdx.org/licenses/Apache-2.0.html

[TheMrMilchmann]

Just checked the Ci failure. It's unrelated to this change and instead seems to be a spurious issue while downloading the JDK.

[bdemers]

@TheMrMilchmann I'll re-run the job, looks like that might have been a GH Actions infra issue?

[lhazlewood]

Just tried to run it myself as well - the setup JDK task is failing. Seems to be due to:

jjwt/.github/workflows/ci.yml

Line 23 in 2ad964a

uses: oracle-actions/setup-java@v1

That project is here: https://github.com/oracle-actions/setup-java
and their latest release version is 1.4.0: https://github.com/oracle-actions/setup-java/releases/tag/v1.4.0

But we're referencing setup-java@v1. If v1 is just an alias for 'latest 1.x release`, then 1.4.0's URI properties file doesn't list anything for JDK 17: https://github.com/oracle-actions/setup-java/blob/v1.4.0/jdk.java.net-uri.properties

I wonder: @TheMrMilchmann can you update the ci.yml line to pin the concrete version to @v1.1.0? That is the last version that references JDK 17: https://github.com/oracle-actions/setup-java/blob/v1.1.0/jdk.java.net-uri.properties

What I don't understand is that it was working until recently, so maybe Oracle stopped hosting the file? Not sure.

[lhazlewood]

There does indeed seem to be a version mismatch. From the failed build:

openjdk 21.0.6 2025-01-21 LTS
  OpenJDK Runtime Environment Temurin-21.0.6+7 (build 21.0.6+7-LTS)
  OpenJDK 64-Bit Server VM Temurin-21.0.6+7 (build 21.0.6+7-LTS, mixed mode, sharing)
Warning: Checksum not available for: https://download.oracle.com/java/17/latest/jdk-17_linux-x64_bin.tar.gz

Definitely trying something with JDK 21 instead of 17.

I looked in the old version 1.1.0 jdk.java.net-uri.properties file and downloaded the referenced file for JDK 17 to my local system just now:

curl -O https://download.java.net/java/GA/jdk17.0.2/dfd4a8d0985749f896bed50d7138ee7f/8/GPL/openjdk-17.0.2_linux-aarch64_bin.tar.gz
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  177M  100  177M    0     0  35.1M      0  0:00:05  0:00:05 --:--:-- 35.5M

and then verified the file:

file openjdk-17.0.2_linux-aarch64_bin.tar.gz
openjdk-17.0.2_linux-aarch64_bin.tar.gz: gzip compressed data, last modified: Tue Dec  7 21:48:55 2021, from Unix, original size modulo 2^32 323481600

So it seems that the file is still there, and I'm assuming that changing the ci.yml file and updating it to this could (probably?) fix it:

uses: oracle-actions/[email protected]

[TheMrMilchmann]

This appears to be intentional oracle-actions/setup-java#94 (comment).

I'm currently travelling but can pin the version on Thursday.