JDK 21 security manager deprecation

[Zixian Cai]

The implementation is here

https://github.com/openjdk/jdk/blob/890adb6410dab4606a4f26a942aed02fb2f55387/src/java.base/share/classes/java/lang/System.java#L2266

Also see JavaDoc https://docs.oracle.com/en/java/javase/21/docs/api/java.base/java/lang/SecurityManager.html

Also see JEP https://openjdk.org/jeps/411

[Zixian Cai]

This is one potential workaround

spotbugs/spotbugs@4c0c1b9#diff-cdbcc250a7e828934344ecdd56a28104b5bc91af8ee0f7a3a17588f0d8e46387R59

But the JavaDoc says

In the JDK implementation, if the Java virtual machine is started with the system property java.security.manager not set or set to the special token "disallow" then the setSecurityManager method cannot be used to set a security manager. See the following section of the SecurityManager class specification for more details.

[Zixian Cai]

Since this is deprecated anyway, perhaps an easy thing to do, is to check property java.lang.SecurityManager and JDK version, and ask users to set this on the command line for newer JDKs (>= 18 I think)

[Steve Blackburn]

Yes. Done 76d1f8b.