SOFTWARE Editor: Robert Blumen

SalesForce
ENGINEERING rober t@rober tblumen.com

Nicolai Parlog on Java 9

Modules
Nate Black

From the Editor

In Episode 316 of Software Engineering Radio, host Nate Black talks with guest
Nicolai Parlog (author of the forthcoming book The Java Module System) about
Java’s evolution, emphasizing the latest release, version 9. The largest chunk cov-
ers the most significant new feature: modules. Nate and Nicolai also review the
major changes from earlier versions of Java and speculate about Java’s future. The
excerpt here covers the why and how of the module system. To hear the full inter-
view, visit www.se-radio.net or access our archives via RSS at feeds.feedburner
.com/se-radio. — Robert Blumen

Nate Black: The big change in Java 9 can go the other way as well—to another method just for the fun of
is the introduction of modules. How packages and JARs [Java Archives]. it. Usually, it does something that I
do you explain modules to people [A JAR is a ZIP file that contains the need. Beyond name and dependency,
who know Java but are new to the class files that are the combined by- it also has something that I want
concept? tecode of the Java classes.] to use—let’s call it an API. These
The graph also looks different at three things exist on all these levels.
Nicolai Parlog: When I think about compile time and at runtime. But it But let’s stick to methods, classes,
code, I have a huge graph in my head. is an idea that many people have: and JARs.
I have a class. What does this class How does the code relate? How does For methods and classes, the
do? It usually calls other classes. one thing call another thing? JVM [Java virtual machine] shares
In my head this class is a bubble. Each thing in the graph has prop- our understanding. The JVM says,
Other classes are also bubbles, and erties, like a name. Methods have “Yeah, it’s a class, it has a class
then there are arrows between them a name; classes have a class name; name, and it has an API, which are
where they call each other. In com- JARs have a JAR name; packages the public methods. And it has de-
puter science you would call [this a have a package name. They have de- pendencies.” You can scan the by-
“graph”], the classes “nodes,” and pendencies. For example, methods tecode to find what other classes
the edges “arrows.” make other method calls. But they it uses. On the level of classes and
But [this is ] not only for classes. all use each other. methods, the JVM sees things like
You can go lower. You can say, “I And there is a third property. we do.
have the same thing for methods, be- Each of these bubbles has some- But on the JAR level, that’s not
cause methods call each other.” You thing that I need. I wouldn’t call the case anymore. You cannot say,

0740-7459/18/$33.00 © 2018 IEEE M AY / J U N E 2 0 1 8 | IEEE SOFTWARE 101

 produced the Java Platform Module
System, although almost nobody calls
SOFTWARE ENGINEERING RADIO it that because it’s a mouthful. Usu-
ally people just say “modules.”
Visit www.se-radio.net to listen to these and other insightful hour-long
podcasts. For programmers, what are modules’
benefits?
RECENT EPISODES
•• 318—Host Felienne interviews Veronika Cheplygina on image recognition. [In Java development], there’s some-
•• 317—Host Kishore Bhatia talks with Travis Kimmel on measuring engi- thing known as “JAR hell.” We have
neering productivity. gotten used to it, but it means that
•• 314—Scott Piper and host Kim Carter discuss cloud security. the JVM doesn’t understand depen-
dencies, particularly transitive de-
UPCOMING EPISODES pendencies, so [you] have to hunt
•• Nicole Hubbard reports on a large migration from virtual-machine scale them down manually. Of course, we
sets to Kubernetes. built great tools to solve that, but
•• Nate Tagart discusses serverless tooling and operations. still, it’s a shortcoming of the JVM.
•• Maria Colgan talks about cost-based database query optimization. Something could be missing at run-
time, for example, and you wouldn’t
find out until it’s too late.
You can also have version con-
flicts. It can happen that you have
“This JAR depends on that other same environment. Everything that two versions of the same library that
JAR, and I only want to launch the is public is fair game. Even if, as a you absolutely have to use because of
program if that other JAR is there.” library developer, I said, “This pack- transitive dependencies. One of your
JARs don’t have names. For exam- age is internal,” the JVM doesn’t immediate dependencies uses, let’s
ple, when you track down compli- care. It can call whatever it wants. say, Guava 19, and the other one
cated runtime errors, you sometimes That’s the situation we’re in. Java uses Guava 14, and there is no way
see a stack trace and wonder, 9 takes JARs and says, “Look, you they can both run on the same ver-
“Which JAR is this class in again?” now have an identity that the JVM sion [of Guava]. That’s the problem.
It was just loaded from a JAR. But understands.” The other issue is that we had no
you don’t know which one. encapsulation across JARs. As I said
It’s easy to see why JARs are so There are a few terms floating earlier, every public type is free to
useless: because a JAR is just a con- around. We have JPMS (Java Plat- be used by everyone. The JDK itself
tainer. It has no identity. This causes form Module System), Java modules, contains some security-relevant code,
all kinds of problems that we’ve got- and Project Jigsaw. Could you please but not everybody should be calling
ten used to. We use Maven or Gradle briefly explain? that. They put in the security man-
to provide the dependencies because ager, which you have to activate. If
we have no other way to find out at Java is developed in projects. When you do so, then the security manager
runtime whether everything is there. Mark Reinhold back in 2008 said he is on critical code paths and checks
But for public APIs, we don’t have a wanted to have modules, he created whether this access is allowed.
good solution. Project Jigsaw. Whenever JDK [Java The problem with that is that it’s
At runtime, the JVM collects all SE Development Kit] teams work on a manual process. You cannot au-
of the JARs and puts them into one something new, they create a project. tomatically put in all the places be-
big ball of mud. Whatever we had in Project Jigsaw had the goal to provide cause if [the security manager is] in
our mind about one JAR using an- a specification and an implementation a hot loop, you couldn’t make that
other JAR’s API, that’s all fiction. of a module system that was geared check every time. It has to be put
[At runtime, a Java program is] just toward the JDK but also usable by into the right places in order to not
a bunch of classes running in the user code. That is Project Jigsaw. It impact performance too much. Even

102 I E E E S O F T WA R E | W W W. C O M P U T E R . O R G / S O F T W A R E | @ I E E E S O F T WA R E
 SOFTWARE ENGINEERING

then, anecdotes seem to suggest that problems. But first, let’s talk at a split-package problem. The module
turning the security manager on high level about how modules work. system ensures that each package is
means 10 to 15 percent less perfor- only contained in one module. You
mance. You must put it in the right There’s a one-to-one relationship cannot have Guava and its fork on
places so as not to make that 15 per- between JARs and modules. What the module path as long as they con-
cent into 50 percent. But that means is this module’s name? What other tain the same packages. You get an
it’s a manual process. modules does it need? And what is error then as well.
When Java 8 was delayed due to its API? (The API part is not that im-
security problems, two of the five portant at the moment because we’ve What does it look like to use the
major security breaches that Java largely talked about dependencies.) module system? Does it change how
had were missing security manager The JDK itself got split up into people write code? Is it a change in
calls. The reason for that is that Java about 100 modules. Around 20 or tooling? What does it look like at the
does not understand that this code 30 of them are publicly supported implementation level to use modules?
is not supposed to be called by the and standardized platform modules.
user—that this code is only meant The module system can make A module is just a JAR with a mod-
to be called by other parts of the sure that all transitive dependencies ule descriptor. It’s a regular JAR.
JDK. Because the separation on the are present. It will not let you launch You can even compile and run it
level of libraries does not exist in otherwise. It understands the de- on Java 8. The additional file is called
the JDK, every call is indistinguish- pendency graph of JARs. If you are module-info.class. It’s compiled from
able to the JDK. You would have had missing a dependency, even though module-info.java, which contains
to put in manual checks to distin- it’s not a direct dependency, it tells the module declaration. The compiler
guish whether or not a call is com- you which one. That solves the first sees it and thinks “Aha, we’re doing
ing from code that’s allowed to make part of the problem. a module here.” Then it expects the
that call. This level of manual secu- I invented a new term: “launch module things to be in place. [It’s
rity was a problem. time.” Technically it’s during runtime, the] same at runtime. If you have a
Last but not least, Java is a but it’s at the beginning of runtime. JAR with that module descriptor,
monolith. [Before Java 9], you had Even if the first time some service and you put it onto the module path,
just one Java runtime: it’s all or runs is an hour into the program run, then the JVM ensures that you want
nothing. And it was rather big. In it won’t take an hour to realize that to have the other modules in place.
the meantime, memory got so much something is missing and then crash. The developer creates the mod-
larger, but with Docker images and In Java 9 there is a module path, ule descriptor. The file contains
other virtualization, the idea of a which is like the class path, but for module . . . ,your module name., which
smaller runtime containing only modules. For example, when you must be a regular Java identifier. It is
the stuff that I need has come back. have Guava 14 and 19 on the module recommended that the module name
Why would I want an 80-Mbyte path, then it will not launch. It will is the same as the package. Then
runtime, half of which is probably say, “You have the same thing twice.” [come] curly braces, and then come
[GUI and windowing libraries] that The module system does not un- two blocks: requires and exports. Requires
I never use because I am writing derstand versions and does not help is a list of the modules that your
back end? Why have that in the de- you with the version conflict thing. module needs.
fault runtime? Why not have a run- It enables you to find out at launch And then come the exports. You ex-
time that can be split apart? time that you have a problem, but it port the packages that contain your
Class path hell, no encapsula- does not provide a solution. API. You list only the packages that
tion, the security problem, and the Another problem occurs when you intend to support. The other
rigid Java runtime: those were the there is a fork in a package. One packages that are internal—the
big problems that the module system says, “I’m Guava,” and the other module system guards these parts.
could tackle. says, “I’m whatever the other fork By not exporting, you are making
is called,” so they’re not the same a statement that “this is not a sup-
I’d like to understand how modules modules. But they still contain the ported API.” And you are telling the
and Java 9 address some of those same packages. This is a so-called JVM, “Don’t let people use this.”

M AY / J U N E 2 0 1 8 | I E E E S O F T WA R E 103
 SOFTWARE ENGINEERING

ABOUT THE AUTHOR [With Java 9], if I start using your

old JAR, I have to add an export.
And then, at code review, somebody
NATE BLACK is a software engineer at Sleeperbot. Contact him at can say “Are you sure?” This means
[email protected]. that we’re going to think much more
about public APIs.

Is this a change in thinking that’s on a

par with generics and lambdas in terms
of its effect on how people write code?

I think no. In day-to-day program-

ming, it will show up much less.
And then you’re done. Then used, but the others, you didn’t con- But that doesn’t mean it has less
you’ve done all you needed to create sider them to be the API. of a long-term effect. Many of the
your module. When you are doing a big proj- problems that slow down proj-
ect with dozens of modules, and you ects and eventually cause them to
To summarize, there’s no change wrote one of them a couple of years fail are not that the classes got too
to the Java code that I’m writing. ago, before Java 9, other developers wordy, which lambda fixes. The
There’s an additional small file would use that package—they have long-term problems are often that
called module-info.java that con- no incentive not to. There was no step the development speed got so slow
tains a list of all my dependencies in the process to question whether or because everybody was doing ev-
and my exported API. I’m explicitly not to do that. The IDE asks, “Do erything that was allowed to be
saying what my supported API is. you want to auto-import that?” and done. You end up with a big ball
I’m, like, “Sure, I want to”—and it’s of mud of JAR references, with
Yes. [In a project] you may have the done. In my personal experience, no- no oversight over dependencies
problem that you create a JAR and body really looks at import clauses or APIs.
you have a small subproject with a during code reviews. There are so And the module system is a tool
dozen packages, where you created many of them that nobody really that helps you to keep in mind that
two or three of them to be publicly bothers going through them. you don’t want to do that.

IEEE Software (ISSN 0740-7459) is published bimonthly by the IEEE third-party products or services. Authors and their companies are per-
Computer Society. IEEE headquarters: Three Park Ave., 17th Floor, New mitted to post the accepted version of IEEE-copyrighted material on their
York, NY 10016-5997. IEEE Computer Society Publications Office: 10662 own webservers without permission, provided that the IEEE copyright no-
Los Vaqueros Cir., Los Alamitos, CA 90720; +1 714 821 8380; fax +1 714 tice and a full citation to the original work appear on the first screen of the
821 4010. IEEE Computer Society headquarters: 2001 L St., Ste. 700, Wash- posted copy. An accepted manuscript is a version which has been revised
ington, DC 20036. Subscribe to IEEE Software by visiting www.computer. by the author to incorporate review suggestions, but not the published
org/software. version with copyediting, proofreading, and formatting added by IEEE.
For more information, please go to: http://www.ieee.org/publications
Postmaster: Send undelivered copies and address changes to IEEE Soft- _standards/publications/rights/paperversionpolicy.html. Permission to
ware, Membership Processing Dept., IEEE Service Center, 445 Hoes Lane, reprint/republish this material for commercial, advertising, or promo-
Piscataway, NJ 08854-4141. Periodicals Postage Paid at New York, NY, and tional purposes or for creating new collective works for resale or redis-
at additional mailing offices. Canadian GST #125634188. Canada Post tribution must be obtained from IEEE by writing to the IEEE Intellec-
Publications Mail Agreement Number 40013885. Return undeliverable tual Property Rights Office, 445 Hoes Lane, Piscataway, NJ 08854-4141 or
Canadian addresses to PO Box 122, Niagara Falls, ON L2E 6S8, Canada. [email protected]. Copyright © 2018 IEEE. All rights reserved.
Printed in the USA.
Abstracting and Library Use: Abstracting is permitted with credit to the
Reuse Rights and Reprint Permissions: Educational or personal use of source. Libraries are permitted to photocopy for private use of patrons,
this material is permitted without fee, provided such use: 1) is not made provided the per-copy fee indicated in the code at the bottom of the first
for profit; 2) includes this notice and a full citation to the original work on page is paid through the Copyright Clearance Center, 222 Rosewood
the first page of the copy; and 3) does not imply IEEE endorsement of any Drive, Danvers, MA 01923.

104 I E E E S O F T WA R E | W W W. C O M P U T E R . O R G / S O F T W A R E | @ I E E E S O F T WA R E