Security
Eliya ships with hardened defaults that are active on every JVM invocation, a clear disclosure process, and a quarterly CPU commitment aligned with upstream OpenJDK.
Reporting a vulnerability
Email security@asymm.systems. Responsible disclosure policy: acknowledgement within 72 hours, remediation target within 30 days for high-severity issues. Public advisories are published after fixes ship.
Do not file security issues as GitHub Issues on the public repo. Upstream OpenJDK vulnerabilities should be reported to the OpenJDK Vulnerability Group; Eliya-specific issues (patches, packaging, configuration) come to us.
Hardening, always on
Eliya modifies
conf/security/java.security in the overlay so hardening is active from the first JVM
invocation — no flags required. This is separate from
-XX:+UseEliyaDefaults (which controls GC and performance, not security).
| Category | Default | Rationale |
|---|---|---|
| TLS protocols | SSLv3, TLS 1.0, TLS 1.1 disabled | Known-broken. Modern enterprise policy baseline. |
| Minimum key sizes | RSA 2048, DSA 2048, DH 2048, EC 224 | NIST guidance post-2024. |
| Weak cipher suites | RC4, DES, 3DES, MD5 blocked | No legitimate production use case. |
| Ephemeral DH | 2048-bit enforced | Forward secrecy at modern strength. |
If a specific deployment genuinely needs vanilla defaults (legacy interoperability), use
-Djava.security.properties==<path-to-vanilla-java.security> (double equals
overrides rather than appends). Not recommended for general use.
Patch commitment
- Quarterly CPU: Eliya publishes within two weeks of each upstream OpenJDK CPU (third Tuesday of January, April, July, October).
- CVE-triggered rebuild: If upstream releases an out-of-cycle patch for a critical CVE, Eliya targets one week to ship.
- No SLA: Eliya does not today offer commercial support SLAs. The target windows above are commitments, not contractual guarantees. Enterprise support is a Phase 2 consideration.
See the lifecycle page for the forward CPU calendar.
Advisories
Each Eliya release documents the upstream CVEs it addresses plus any Eliya-specific patches. Canonical advisory list: PATCHES.md on GitHub.
TCK compliance
Eliya is built from upstream OpenJDK source and preserves the Technology Compatibility Kit compliance of upstream builds. Asymm Systems has not independently submitted Eliya to Oracle's TCK programme — an independent TCK run is planned for JDK 25.0.3.
This is the honest framing. Eliya is not dishonestly claiming certifications it hasn't earned.
Eliya
Dial