fix(kafka): include EC support in managed JRE

.github/workflows/agents-release.yml

@@ -214,7 +214,7 @@ jobs:
         include:
           - jre-key: "21"
             java-version: "21"
-            modules: "java.base,java.sql,java.sql.rowset,java.naming,java.management,java.desktop,java.security.jgss,java.security.sasl,jdk.security.auth,jdk.security.jgss,jdk.charsets,jdk.unsupported,java.scripting,java.compiler"
+            modules: "java.base,java.sql,java.sql.rowset,java.naming,java.management,java.desktop,java.security.jgss,java.security.sasl,jdk.security.auth,jdk.security.jgss,jdk.charsets,jdk.unsupported,java.scripting,java.compiler,jdk.crypto.ec"
     steps:
       - uses: actions/setup-java@v4
         with:
@@ -236,6 +236,7 @@ jobs:
             ["macos-aarch64"]="mac/aarch64"
             ["macos-x64"]="mac/x64"
             ["linux-aarch64"]="linux/aarch64"
+            ["windows-aarch64"]="windows/aarch64"
             ["windows-x64"]="windows/x64"
           )
           for platform in "${!PLATFORMS[@]}"; do
@@ -453,7 +454,7 @@ jobs:
           {
             "jres": {
               "21": {
-                "version": "21.0.12+kerberos.1",
+                "version": "21.0.12+kerberos.ec.2",
                 "platforms": {
           ${JRE21_PLATFORMS}
                 }

agents/scripts/driver_release_packages_test.py

@@ -78,25 +78,35 @@ class DriverReleasePackagesTest(unittest.TestCase):
                     {"url": versioned_native.name, "size": versioned_native.stat().st_size},
                 )
 
-    def test_full_offline_bundle_includes_versioned_native_artifact(self) -> None:
+    def test_full_offline_bundle_includes_supported_windows_artifacts(self) -> None:
         with tempfile.TemporaryDirectory() as temp_dir:
             release_dir = Path(temp_dir)
             filename = "dbx-agent-kingbase-0.1.34-windows-x64.exe"
+            kafka_filename = "dbx-agent-kafka-0.1.0.jar"
             (release_dir / filename).write_bytes(b"MZtest-agent")
+            (release_dir / kafka_filename).write_bytes(b"test-kafka-agent")
             (release_dir / "dbx-jre-21-windows-x64.tar.gz").write_bytes(b"test-jre")
+            (release_dir / "dbx-jre-21-windows-aarch64.tar.gz").write_bytes(b"test-jre")
             (release_dir / "agent-registry.json").write_text('{"jres":{},"drivers":{}}', encoding="utf-8")
 
-            subprocess.run(
+            result = subprocess.run(
                 ["bash", str(Path(__file__).with_name("build_offline_zip.sh")), str(release_dir)],
                 check=True,
                 capture_output=True,
                 text=True,
             )
 
-            bundle = release_dir / "dbx-agents-offline-windows-x64.zip"
-            self.assertTrue(bundle.is_file())
-            with zipfile.ZipFile(bundle) as archive:
+            self.assertNotIn("SKIP windows-aarch64", result.stdout)
+            x64_bundle = release_dir / "dbx-agents-offline-windows-x64.zip"
+            arm64_bundle = release_dir / "dbx-agents-offline-windows-aarch64.zip"
+            self.assertTrue(x64_bundle.is_file())
+            self.assertTrue(arm64_bundle.is_file())
+            with zipfile.ZipFile(x64_bundle) as archive:
                 self.assertIn(f"drivers/{filename}", archive.namelist())
+                self.assertIn(f"drivers/{kafka_filename}", archive.namelist())
+            with zipfile.ZipFile(arm64_bundle) as archive:
+                self.assertIn("jre/dbx-jre-21-windows-aarch64.tar.gz", archive.namelist())
+                self.assertIn(f"drivers/{kafka_filename}", archive.namelist())
 
 
 if __name__ == "__main__":

agents/scripts/validate_agents.py

@@ -245,6 +245,14 @@ def validate_release_runtime_keys(root: Path) -> list[str]:
             r"jdk\.security\.jgss",
             "release workflow JRE must include jdk.security.jgss for Kafka GSSAPI SASL support",
         ),
+        (
+            r"jdk\.crypto\.ec",
+            "release workflow JRE must include jdk.crypto.ec for Kafka EC TLS support",
+        ),
+        (
+            r'\["windows-aarch64"\]\s*=\s*"windows/aarch64"',
+            "release workflow must build the managed JRE for windows-aarch64",
+        ),
         (
             r"legacy-placeholder\.jar",
             "native-only registry entries must publish a legacy jar placeholder for older DBX clients",

agents/scripts/validate_agents_test.py

@@ -319,7 +319,10 @@ class ValidateAgentsTest(unittest.TestCase):
                         include:
                           - jre-key: "21"
                             java-version: "21"
-                            modules: "java.base,jdk.security.auth,jdk.security.jgss"
+                            modules: "java.base,jdk.security.auth,jdk.security.jgss,jdk.crypto.ec"
+                    declare -A PLATFORMS=(
+                      ["windows-aarch64"]="windows/aarch64"
+                    )
                     detect_jre_key() {
                       case "$name" in
                         *) echo "21" ;;
@@ -376,6 +379,8 @@ class ValidateAgentsTest(unittest.TestCase):
                     "registry must publish Java 21 under JRE key 21",
                     "release workflow JRE must include jdk.security.auth for Kafka Kerberos LoginModule support",
                     "release workflow JRE must include jdk.security.jgss for Kafka GSSAPI SASL support",
+                    "release workflow JRE must include jdk.crypto.ec for Kafka EC TLS support",
+                    "release workflow must build the managed JRE for windows-aarch64",
                     "native-only registry entries must publish a legacy jar placeholder for older DBX clients",
                     "release workflow must not build Java 21 under JRE key 17",
                     "agents must not use JRE key 17",

crates/dbx-core/src/agent_service.rs

@@ -2067,6 +2067,19 @@ mod agent_registry_install_tests {
         AgentRegistry { jre: None, jres: std::collections::HashMap::new(), drivers }
     }
 
+    fn registry_with_jre_version(version: &str) -> AgentRegistry {
+        AgentRegistry {
+            jre: None,
+            jres: [(
+                DEFAULT_JRE_KEY.to_string(),
+                JreInfo { version: version.to_string(), platforms: std::collections::HashMap::new() },
+            )]
+            .into_iter()
+            .collect(),
+            drivers: std::collections::HashMap::new(),
+        }
+    }
+
     fn write_cached_driver_download(
         am: &AgentManager,
         db_type: &str,
@@ -2082,6 +2095,25 @@ mod agent_registry_install_tests {
         cache_path
     }
 
+    #[test]
+    fn managed_jre_content_revision_triggers_install() {
+        let manager = test_manager("jre-content-revision");
+        let java_path = manager.jre_java_path(DEFAULT_JRE_KEY);
+        std::fs::create_dir_all(java_path.parent().unwrap()).unwrap();
+        std::fs::write(&java_path, b"java").unwrap();
+
+        let mut state = crate::agent_manager::AgentState::default();
+        state.jre_versions.insert(DEFAULT_JRE_KEY.to_string(), "21.0.12+kerberos.1".to_string());
+        manager.save_state(&state).unwrap();
+
+        let registry = registry_with_jre_version("21.0.12+kerberos.ec.2");
+        assert!(jre_needs_install(&manager, &registry, DEFAULT_JRE_KEY));
+
+        state.jre_versions.insert(DEFAULT_JRE_KEY.to_string(), "21.0.12+kerberos.ec.2".to_string());
+        manager.save_state(&state).unwrap();
+        assert!(!jre_needs_install(&manager, &registry, DEFAULT_JRE_KEY));
+    }
+
     fn registry_with_jre(jre_key: &str, version: &str, url: &str, size: u64) -> AgentRegistry {
         AgentRegistry {
             jre: None,