Java Requirements - Can JAVA be Used Without Installation

[dgurrola]

Forgive the title, I am not asking to know if Java needs to be installed. I am asking if I can use Java for OpenKM without actually installing Java. The only application that needs Java on this server is OpenKM. I would like to minimize the attack surface of this Windows server by not installing java and instead using it from an extracted copy. Java is fully intact, just not hooked into the OS.

Here are is an example of how I would do this:

• Create working JDK directory (C:\JDK in this case)

• Download latest version of JDK from Oracle (for example jdk-8u171-windows-x64.exe)

• With 7-Zip right click the jdk-XuXX-windows-x64.exe and select Open archive from the 7-zip context menu

• Browse into the .rsrc directory, then the 1033 directory, then the JAVA_CAB10 directory

• Right-click the packed file (for example: 111) and select Open inside from the context menu

• Right-click the tools.zip file, and select Open inside from the context menu

• Extract to C:\JDK

• Execute the following commands in cmd.exe:
  • C:
  • CD\
  • CD JDK
  • FOR /R %x IN (*.pack) DO C:\JDK\bin\unpack200.exe -r "%x" "%~dx%~px%~nx.jar" <--this will convert all .pack files into .jar files
  • Setup JAVA_HOME and PATH manually to point to the JDK dir and its BIN subdirectory.

From what I can tell by reviewing the startup.bat and catalina.bat files, I would also need to manually associate .JAR files with javaw.exe

Maybe this is too esoteric?

This is my first post here, and as someone who has been working with various DM Systems for a little over 20 years now, I have to say this is an impressive piece of work. I inherited this OpenKM system that went from pilot to production without properly following your documentation - the DB is HSQL and the repository is over 240 GB now and I am sincerely doubting any attention was paid to the documented suggestions for configuration parameters.

Your time and consideration are much appreciated!
Daniel S. Gurrola II

[jllort]

Yes is esoteric and I do not suggest it.
First, I suggest moving outside HSQL database. for production environments, we do not recommend it. In some cases, for example, wrong power off in the computer, the database might be corrupted ( happened to some users ) and is quite difficult or impossible to recover it. For I suggest you move to MySQL or similar database ( PostgreSQL etc... ). For doing it you should install a clean OpenKM. Export data from older Administration > Tools > Repository export and then import to the new OpenKM. I will try to wrote some documentation about migration between OpenKM versions to switch database.

About JDK installation, I ignore what will be the benefits will give to you. The JDK periodically tries to upgrade the JDK version, what is not a bad feature. Except for a small daemon what will be running automatically after installing JDK, there's nothing else what might affect your windows in performance. The amount of size in disk used will be the same, sincerally I do not know what kind of advantage do you want to get from this strange configuration. Probably is possible disable the daemon or automatic upgrade.

[dgurrola]

When Java is installed it is hooked into the OS so anything needing Java can find and use Java. Java exploits are common, even though I think most are introduced by a browser or email messages being read on the system where Java is installed. On a server, no matter how many times I implore my team not to treat the server as a desktop, they do. As an administrator, you have a PC download and read what you must there, let servers serve and desktops do the user thing. If Java is specifically available to whatever knows where to look, it only works for those applications that have been configured to know. I just do not like introducing "global" system wide availability of, Java for example, so one specific application to work.

It's not a big deal I just noticed that though Java is required the OpenKM Community Edition has a JDK in it's root which seems odd if I have Java already installed. I am assuming the local JDK is being used in some specific way and if so, why not use the installed Java? or does it use both and if so, why? Does this make sense?

I will be moving to a different database, but for now I find I have little choice but to move this as is before the server being used dies. I have to move 6.3.0 from server 2008 so server 2012. I have also noticed the documentation does not really cover the actual installation instructions using the .EXE installer for windows and there does not appear to be a .JAR setup for 6.3.0. I'll figure it out, I already did it once to prove I could, but the process was done on a windows 10 desktop. It's not working the same on server 2012. I have read installation and administration info on the OpenKM site and Wiki. Seriously read it, not skimmed it. I have also scoured the installation and configuration forums for hints and clues that would help me. Like I noticed a post where if you have Java 1.8 installed these two lines are not needed in the Tomcat config:
tomcat7 //US//Tomcat7 ++JvmOptions="-XX:PermSize=256m"
tomcat7 //US//Tomcat7 ++JvmOptions="-XX:MaxPermSize=512m"
but the documentation does not mention that. Just having a hard time figuring out what is current and what may still apply to 6.3.0. Once I get it moved I will update it and then move it to a different database type. The database move will be a chore and a half so I am going to have to do that last.

My plan is to install and copy everything over (copied source would be from the current OpenKM server with OpenKM stopped). The export would be too big (300 GB in the repository). I am assuming this is the equivalent of a .ZIP archive or portable (fully self contained and restorable elsewhere) backup. I also plan to move the repository to a very local file share served over an enterprise network tuned for file serving (it's faster than local disks at times since it's all flash disks).

I noticed something odd when I followed instructions for moving the repository. If you move the server and relocate the repository in one shot (remember we are talking 6.3.0 here) OpenKM won't start, but if I copy everything in the repository over EXCEPT for datastore and copy only the most recent contents of the datastore (using a for /f command that implements dir /m:m-d-y with an xcopy do) I don't need the FULL repo, just the .lobs .script and this minimal amount of data to get the moved OpenKM to start. Then I can move the repository, BUT you can only move the cache, index, and datastore directories, if you move it all, OpenKM startup.bat process creates a new local Repository and won't start.

If you have any suggestions, hints, concerns, or direction to share, I am all ears to anyone willing to share them, otherwise I will continue on my path (with Java installed properly based on your reply).

[jllort]

Too large my friend.
1- Only two consideration. When you move to another server should move entire tomcat and repository in the same locations. I'm talking about copy everything ( it take some time, but there's no other short way for it ). The repository folder is created automatically when is not present, that means you had the wrong configuration when you moved.
2- About switching repository, you should export repository and import again ( will take a lot of time too ).
3- About extra service parameters I have commented it in the documentation ( anyway executing in JDK 1.8 should now have any malicious effect, simply warning indicating are deprecated, not much else ).