Oracle will no longer provide a free, commercial version of Oracle Java Runtime Environment (JRE) after January, 2019. The current Oracle JRE version 8.x will receive its last security update in January, 2019 and no commercial Oracle JRE 11.x will be available for free use. Additional information about the future support of this product can be found here.
Oracle suggests that applications which require Java should be developed and maintained with either a paid subscription to Oracle Java SE or with free OpenJDK and embed the Java run-time in the software rather than rely on Java installed separately on a client system. Oracle points to OpenJDK for systems that require an installed, free Java product to support application needs.
The future USGS posture will include removing the Oracle JRE from all systems that do not require Java and move towards a state where Java dependencies are removed from our environment. To that end, the USGS needs to capture all Java dependencies in the environment in order to plan for how to manage the Oracle JRE end of life.
Expectations are that vendors will be making changes in how they develop products and offer updates that will not depend on separate JRE installations. Future notifications will be sent over the next two months outlining a path forward based on gathered dependencies.
WHAT YOU NEED TO DO
Local IT should document any Java dependencies on the Java dependencies sheet.
Sites are encouraged to remove Oracle JRE x64 and x86 from test systems, for a variety of user types, in order to discover dependencies and assure they are documented in each environment. If no dependencies are found, sites are encouraged to remove Oracle JRE from their environment to support this future product EOL.
The USGS is working with DOI to provide an MECM application that will be based on the Amazon Web Services distribution of OpenJDK named Corretto. This product should be available for testing in March, 2019 and the expectation is that this product will be available for installation to replace Oracle Java Runtime Environment for the next quarter security update.
Sites should work to research and resolve Oracle JRE dependencies in their environments and reach out to the servicedesk@usgs.gov with any questions. Updated guidance and resolutions will be notated on the Java dependencies sheet.