OLP CLI error: java.base does not export sun.security.util to unnamed module under JDK 16

Question

Under the MacOS Big Sur (11.4), latest OLP (10.0.9), and latest Java (16.0.1), hitting an error in akka with an "olp catalog list". The same command works if switching to Java 8, but this is beside the point. Per the User Guide Java 16 should be okay:

The OLP CLI requires the Java Runtime Environment (JRE) version 1.8.0_91 or above.

Error:

$ java --version
openjdk 16.0.1 2021-04-20
OpenJDK Runtime Environment (build 16.0.1+9-24)
OpenJDK 64-Bit Server VM (build 16.0.1+9-24, mixed mode, sharing)

$ olp version show
Version: 10.0.9(727ba090)

$ olp api token get
Token: <XXX>
Token Expires at: 2021-07-03T03:01:21.455Z

$ olp catalog list --profile default
Uncaught error from thread [olp-akka.actor.default-dispatcher-3]: class com.typesafe.sslconfig.ssl.DefaultHostnameVerifier (in unnamed module @0x71e7a66b) cannot access class sun.security.util.HostnameChecker (in module java.base) because module java.base does not export sun.security.util to unnamed module @0x71e7a66b, shutting down JVM since 'akka.jvm-exit-on-fatal-error' is enabled for ActorSystem[olp]
java.lang.IllegalAccessError: class com.typesafe.sslconfig.ssl.DefaultHostnameVerifier (in unnamed module @0x71e7a66b) cannot access class sun.security.util.HostnameChecker (in module java.base) because module java.base does not export sun.security.util to unnamed module @0x71e7a66b
        at com.typesafe.sslconfig.ssl.DefaultHostnameVerifier.hostnameChecker(DefaultHostnameVerifier.scala:38)
        at com.typesafe.sslconfig.ssl.DefaultHostnameVerifier.matchCertificates(DefaultHostnameVerifier.scala:77)
        at com.typesafe.sslconfig.ssl.DefaultHostnameVerifier.verify(DefaultHostnameVerifier.scala:51)
        at akka.stream.scaladsl.TLS$.$anonfun$apply$3(TLS.scala:116)
        at akka.stream.impl.io.TLSActor.handshakeFinished(TLSActor.scala:436)
        at akka.stream.impl.io.TLSActor.doUnwrap(TLSActor.scala:399)
        at akka.stream.impl.io.TLSActor.doInbound(TLSActor.scala:295)
        at akka.stream.impl.io.TLSActor.$anonfun$bidirectional$1(TLSActor.scala:230)
        at akka.stream.impl.Pump.pump(Transfer.scala:202)
        at akka.stream.impl.Pump.pump$(Transfer.scala:200)
        at akka.stream.impl.io.TLSActor.pump(TLSActor.scala:50)
        at akka.stream.impl.BatchingInputBuffer.enqueueInputElement(ActorProcessor.scala:96)
        at akka.stream.impl.BatchingInputBuffer$$anonfun$upstreamRunning$1.applyOrElse(ActorProcessor.scala:147)
        at scala.runtime.AbstractPartialFunction.apply(AbstractPartialFunction.scala:38)
        at akka.stream.impl.SubReceive.apply(Transfer.scala:18)
        at akka.stream.impl.FanIn$InputBunch$$anonfun$subreceive$1.applyOrElse(FanIn.scala:242)
        at scala.runtime.AbstractPartialFunction.apply(AbstractPartialFunction.scala:38)
        at akka.stream.impl.SubReceive.apply(Transfer.scala:18)
        at akka.stream.impl.SubReceive.apply(Transfer.scala:14)
        at scala.PartialFunction.applyOrElse(PartialFunction.scala:127)
        at scala.PartialFunction.applyOrElse$(PartialFunction.scala:126)
        at akka.stream.impl.SubReceive.applyOrElse(Transfer.scala:14)
        at scala.PartialFunction$OrElse.applyOrElse(PartialFunction.scala:175)
        at akka.actor.Actor.aroundReceive(Actor.scala:539)
        at akka.actor.Actor.aroundReceive$(Actor.scala:537)
        at akka.stream.impl.io.TLSActor.aroundReceive(TLSActor.scala:50)
        at akka.actor.ActorCell.receiveMessage(ActorCell.scala:614)
        at akka.actor.ActorCell.invoke(ActorCell.scala:583)
        at akka.dispatch.Mailbox.processMailbox(Mailbox.scala:268)
        at akka.dispatch.Mailbox.run(Mailbox.scala:229)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630)
        at java.base/java.lang.Thread.run(Thread.java:831)

Answer 1

HERE Workspace lib/sdks/CLI supports only Java 8 . Please see, in the configure environment. https://developer.here.com/documentation/java-scala-dev/dev_guide/topics/configure-your-environment.html

Answer 2

OLP seems not to be compatible with the effects of Project Jigsaw, which encapsulated the internals of Java since Java 9

Answer 3

Update

The issue has been fixed. The new versions of the CLI starting from 10.0.36 work correctly with JDK 16.

Download it from here: https://platform.here.com/sdk/cli

Root Cause

Some tools and libraries use reflection to access the parts of the JDK that are meant for internal use only. This is called illegal reflective access and by default is not permitted in JDK 16 and later.

The code compiled with earlier Java releases that directly access internal APIs of the JDK does not work by default.

The java launcher option --illegal-access controls relaxed strong encapsulation. The default value of this option is --illegal-access=deny, which disables illegal access operations.

So, the problem why the catalog-related commands fail in the CLI using SDK 16 is that the sun.security.* internal API is not available since JDK 16.

Here is the table with internal API which is not working in the JDK 16: https://wiki.openjdk.java.net/display/JDK8/Java+Dependency+Analysis+Tool

Strongly Encapsulate JDK Internals by Default: https://openjdk.java.net/jeps/396

The OLP documentation states that when using Java above 8, errors like this may occur: https://developer.here.com/documentation/java-scala-dev/dev_guide/topics/configure-your-environment.html

Workaround

As a workaround you can add the environment variable,

 export _JAVA_OPTIONS="--add-opens=java.base/sun.security.util=ALL-UNNAMED"

or

 export _JAVA_OPTIONS="--illegal-access=permit" (this parameter is deprecated)

and then all commands should work properly.