Announcement: Graal Development Kit for Micronaut 4.6.0

Today, we are announcing the general availability of Graal Development Kit for Micronaut 4.6.0 containing Microsoft Azure integration, Supply Chain Security Verification and SLSA Compliance with Macaron, Micronaut® framework 4.6.0, and more.

Graal Development Kit for Micronaut (GDK) is an Oracle build of a curated set of open source Micronaut® framework modules focused on multicloud portability and developer productivity. The GDK simplifies cloud application development, is designed to compile ahead of time with GraalVM Native Image, and is fully supported by Oracle. The GDK also provides project creation utilities, VS Code and IntelliJ extensions for faster application development and deployment. The GDK enables you to easily build portable cloud native Java microservices that start instantly and use fewer resources to reduce your compute costs.

Let us look at some of the notable changes in this release.

Microsoft Azure Integration

The most exciting feature in this release is the integration with Microsoft Azure. GDK’s vision and main goal has been to enable seamless application portability across leading public cloud platforms. Prior to this release, the GDK had integrations with Oracle Cloud Infrastructure (OCI), Amazon Web Services (AWS), and Google Cloud Platform (GCP). Now with the addition of Microsoft Azure the GDK multicloud vision has come to fruition.

GDK modules provide platform-independent APIs and libraries for several cloud services across OCI, AWS, Azure, and GCP. GDK 4.6.0 modules have also been designed, integrated and tested with Azure services such as Database for MySQL, Key Vaults, Kubernetes Services, Monitor Logs, Monitor Metrics, Blob Storage, Event Hubs, and more.

Now you can easily build, deploy and operate Java applications on Azure with the GDK. Moreover, you can write Java applications once and run them on any supported public cloud – OCI, AWS, Azure, and GCP – without worrying about cloud vendor lock-in.

New Guides for Microsoft Azure

This release contains the following guides to help you learn how to create Java applications that use Azure services with the GDK:

See GDK Guides for a complete list of guides for all supported public clouds.

Supply Chain Security Verification and SLSA Compliance with Macaron

We are dedicated to enhancing supply chain security and ensuring that GDK users can trust and confidently use our artifacts. To achieve this, we have followed the guidelines from Supply-chain Levels for Software Artifacts (SLSA) initiative to secure our build service and utilized Witness to generate in-toto provenances for GDK artifacts. After a GDK artifact is built, its provenance is analyzed using Oracle Lab’s open-source tool, Macaron. Macaron examines various aspects of the build and verifies the data against a Datalog policy before the artifact is published. For example, Macaron checks that the source code comes from a trusted repository and that the artifact is built using a trusted CI service and an Oracle Linux image. Macaron then produces a Verification Summary Attestation (VSA) that excludes any sensitive information about the build service. If the artifact meets the required standards, the VSA is published alongside it, allowing consumers to verify that the artifact complies with the policy before use. Instead, if the policy check fails, Macaron will not issue a VSA.

You can download the VSA generated for an artifact and use jq to inspect its content:

curl -O https://maven.oracle.com/public/io/micronaut/micronaut-core/4.6.5-oracle-00001/vsa.intoto.jsonl
cat vsa.intoto.jsonl | jq -r '.payload' | base64 -d | jq

For example, run this command to check if the verification has succeeded:

cat vsa.intoto.jsonl | jq -r '.payload' | base64 -d | jq -r '.predicate.verificationResult'

The output of this command should show “PASSED”.

For more information, see the related tutorial for this feature: https://oracle.github.io/macaron/pages/tutorials/use_verification_summary_attestation.html

New Bill of Materials with Micronaut Framework 4.6.0

In this release, we have updated the Micronaut framework version from 4.5.0 to 4.6.0 applying patches to multiple Micronaut modules. See Micronaut Framework Releases for more information. We have a new bill of materials for GDK 4.6.0 consisting of specific versions of Micronaut framework 4.6.0 modules and their dependencies that are compatible and tested together. This reduces the risk of library incompatibility and version mismatches, and saves you from having to test and figure this out yourself.

Include the BOM in your build files using:

Gradle

dependencies {
    micronautBoms(platform("cloud.graal.gdk:gdk-bom:4.6.0.1"))
    ...
}

Maven

<dependency>
  <groupId>cloud.graal.gdk</groupId>
  <artifactId>gdk-bom</artifactId>
  <version>4.6.0.1</version>
  <type>pom</type>
  <scope>import</scope>
</dependency>

Updated Launcher and CLI

The GDK Launcher, and GDK CLI have been updated to include the above changes. You can use the GDK Launcher to generate application starter templates for your preferred public cloud from a web browser. If you prefer command-line tools instead, use the GDK CLI.

Hands-on Labs for Oracle Cloud Infrastructure

We have introduced a new option on the GDK Hands-on Labs page to let users run the following hands-on labs in their own OCI tenancies. Users still have the option to run these labs for free on shared infrastructure, as before.

Next Steps

 

Micronaut® is a registered trademark of Object Computing, Inc. Use is for referential purposes and does not imply any endorsement or affiliation with any third-party product.