build: enforce Java 1.8

[jeremylong]

For now, we need to enforce Java 1.8. See #162 (comment)

[dwalluck]

It's possible to switch the build to use, say, Java 11. Then, you can even use maven toolchains to build the core with Java 8, and the tests with Java 11, for example.

[jeremylong]

Understood. You can also just build with Java 8 until the time the project upgrades Java.

[ppkarwasz]

Understood. You can also just build with Java 8 until the time the project upgrades Java.

I don't see any reason not to increase the build requirement to JDK 9+:

• --release 8 works really well to generate Java 8 bytecode. I have never seen any problems with it.
• newer JDKs create a better Java 8 bytecode than JDK 8 itself.
• The Maven Compiler plugin will fail on JDK 8 if you set <release>8</release>, while the compiled classes will not be 100% Java 8 compatible if you don't set it on JDK 9+.
• An increasing number of third-party Maven plugins require JDK 11 or JDK 17. For example BND, Error Prone, Spotless, etc.
• Those plugins also require additional JVM arguments (--add-opens, --add-exports) to be passed to the Maven process. Those parameters can be easily added to .mvn/jvm.config, but this breaks the build on JDK 8.
• As @dwalluck mentioned, Surefire can always use JRE 8 through Maven Toolchains

I would propose to:

• use Java 8 as target version for as long as it makes sense (another 5 years probably). I don't see any code in packageurl-java that would benefit from newer Java versions.
• use JDK 17 to build the artifact. This is a restriction that only applies to people that want to build the library from source.
• add a profile (e.g. java8-tests) to use toolchains to run tests. This profile should probably be active on the CI.

What do you think?

[jeremylong]

superceded by #178.