Officina: Java runs too, and the isolation headers come back off

Java compiles and runs in the page: ecj compiles the cell, a WebAssembly JVM
runs the class. 23 worked examples, from a first program to a sieve.

Two findings shaped it, both measured rather than assumed.

The isolation headers added with the C/C++ toolchain were not needed and are
removed. emception wants a SharedArrayBuffer for interactive stdin and does
without one when it cannot have it — clang, wasm-ld and the programs they
build all run on a page that is not cross-origin isolated. Keeping the headers
would have bought a stdin this notebook does not offer, and it would have cost
Java outright: CheerpJ runs its JVM in an iframe on its own origin that sends
no COEP header of its own, so `require-corp` blocks it and every call hangs
with no error at all. That was an hour of a JVM that answered nothing.

CheerpJ ships a JRE, not a JDK, so `com.sun.tools.javac.Main` is not there to
call. The compiler is ecj, served from this origin, pinned to the 3.26 line:
later releases need Java 17 to run, and on 17 they refuse to start with
"invalid location for system libraries" because a modular JDK has no rt.jar to
read. Java 8 has one, 3.26 runs on 8.

The loader is the first and only thing this site fetches from another origin.
CheerpJ's free licence permits its runtime to be served only from the vendor's
domain, so the choice was that or no Java. scripts/audit.mjs now carries the
exception, scoped to that origin and that one page, and prints it on every
run rather than passing in silence — and /officina credits CheerpJ, as the
licence asks.

Java's entry point is a class, so the file is named after whatever the cell
declares: `public class Foo` must live in Foo.java, and always writing
Main.java would reject good programs over a filename the reader never chose.
Output is collected by borrowing console.log for the length of a run, because
CheerpJ offers no stdout of its own, and ecj's diagnostics say "your code"
where they would otherwise print a scratch path.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: asifuddin01

astro.config.mjs

@@ -118,29 +118,6 @@ export default defineConfig({
   vite: {
     plugins: [
       tailwindcss(),
-      /**
-       * The C/C++ toolchain in /officina runs clang as WebAssembly across a
-       * worker, which needs SharedArrayBuffer, which browsers only hand to a
-       * cross-origin-isolated page. `require-corp` is safe to apply site-wide
-       * here for the same reason the audit exists: every subresource this
-       * site loads is already same-origin, so there is nothing left to block.
-       * The deployed Worker sets the same pair on its own responses.
-       *
-       * `vite.server.headers` is ignored under `astro dev`, so the isolation
-       * headers go on as middleware instead. Without them SharedArrayBuffer
-       * is undefined and the toolchain refuses to start — in dev only; the
-       * deployed Worker sets the same pair on its own responses.
-       */
-      {
-        name: 'officina-cross-origin-isolation',
-        configureServer(server) {
-          server.middlewares.use((_req, res, next) => {
-            res.setHeader('Cross-Origin-Opener-Policy', 'same-origin');
-            res.setHeader('Cross-Origin-Embedder-Policy', 'require-corp');
-            next();
-          });
-        },
-      },
     ],
     /**
      * The toolchain adapter imports its Python shim as `./subprocess_shim.py?raw`.

public/_headers

@@ -1,24 +1,20 @@
 # Cloudflare Pages headers.
 #
-# The last two on /* are cross-origin isolation, which is what lets /officina
-# hand clang a SharedArrayBuffer and compile C in the page.
-#
-# Site-wide rather than on /officina alone, for two reasons. The pages are
-# linked with a client-side router, so arriving at /officina from another page
-# loads no new document and would inherit that page's headers — the toolchain
-# would work on a reload and not on a click. And `require-corp` blocks
-# subresources from other origins, which this site has none of by rule: the
-# audit fails the build if one appears. The isolation costs nothing here
-# precisely because that rule is already kept.
+# Deliberately no Cross-Origin-Embedder-Policy. The C/C++ toolchain in
+# /officina wants a SharedArrayBuffer for interactive stdin and does without
+# one when it cannot have it — clang, wasm-ld and the programs they build all
+# run on a page that is not cross-origin isolated, which was worth measuring
+# rather than assuming. Isolation would buy a stdin this notebook does not
+# offer, and it would cost Java: CheerpJ runs its JVM in an iframe on its own
+# origin that sends no COEP header of its own, so `require-corp` blocks it and
+# every call hangs with no error at all.
 
 /*
   X-Content-Type-Options: nosniff
   Referrer-Policy: strict-origin-when-cross-origin
   X-Frame-Options: DENY
   Permissions-Policy: geolocation=(), microphone=(), camera=(), interest-cohort=()
   Strict-Transport-Security: max-age=31536000; includeSubDomains
-  Cross-Origin-Opener-Policy: same-origin
-  Cross-Origin-Embedder-Policy: require-corp
 
 # Astro fingerprints everything under /_astro/, so it can be cached forever.
 /_astro/*

public/java/ecj.jar

@@ -17,6 +17,26 @@ const SITE_ORIGIN = (
   await readFile('src/consts.ts', 'utf8')
 ).match(/SITE = '([^']*)'/)?.[1] ?? '';
 
+/**
+ * The one thing on this site that is loaded from somewhere else.
+ *
+ * /officina runs Java, and running Java in a browser means a JVM. CheerpJ is
+ * the only working one, and its Community Licence — the free tier, which is
+ * what an individual gets — permits use *only* from the vendor's own domain:
+ * self-hosting the runtime requires a commercial licence. So Java is either
+ * this exception or nothing, and it was chosen deliberately over nothing.
+ *
+ * Scoped to the page that needs it and to that vendor's origin, so the rule
+ * still holds everywhere else and this stays one visible, arguable decision
+ * rather than a hole. The page carries the attribution the licence asks for.
+ */
+const ALLOWED_EXTERNAL = [
+  { origin: 'https://cjrtnc.leaningtech.com/', page: '/officina' },
+];
+
+const isAllowed = (page, url) =>
+  ALLOWED_EXTERNAL.some((a) => page === a.page && url.startsWith(a.origin));
+
 let fail = 0;
 const problems = [];
 
@@ -71,6 +91,7 @@ for await (const file of walk('dist')) {
       // rel=canonical/alternate/sitemap point at our own site by design
       if (/rel="(?:canonical|alternate|sitemap)"/i.test(m[0])) continue;
       if (m[1].startsWith(SITE_ORIGIN)) continue;
+      if (isAllowed(page, m[1])) continue;
       problems.push(`${page}  external subresource: ${m[1]}`);
     }
   }
@@ -98,6 +119,9 @@ if (problems.length) {
   for (const p of problems) console.log('  ✗ ' + p);
   fail = 1;
 } else {
-  console.log('✓ headings, alt text, landmarks, lang and self-hosting all clean');
+  console.log(
+    '✓ headings, alt text, landmarks, lang and self-hosting all clean ' +
+    `(${ALLOWED_EXTERNAL.length} declared exception: the Java runtime on /officina)`
+  );
 }
 process.exit(fail);

scripts/audit.mjs

@@ -980,15 +980,16 @@ const recipes = defineCollection({
   loader: glob({ pattern: '**/*.mdx', base: './src/content/recipes' }),
   schema: z.object({
     /** Must match a language the workshop knows: python, c, cpp, asm. */
-    language: z.enum(['python', 'c', 'cpp', 'asm']),
+    language: z.enum(['python', 'c', 'cpp', 'java', 'asm']),
     label: z.string(),
     /** Sets the order of the language tabs. */
     order: z.number().int().min(1),
     /**
      * Whether this language executes in the browser, and on what.
      *
-     * Python runs on Pyodide, C and C++ on a clang/wasm-ld toolchain that is
-     * fetched only when a cell is actually run — the packs are tens of
+     * Python runs on Pyodide, C and C++ on a clang/wasm-ld toolchain, and
+     * Java on a JVM plus the Eclipse batch compiler. All three are fetched
+     * only when a cell is actually run — the C/C++ packs alone are tens of
      * megabytes, so nobody who does not compile ever pays for them. Assembly
      * is architecture-specific and has no assembler here, so it is written and
      * exported rather than run.
@@ -998,7 +999,7 @@ const recipes = defineCollection({
      * refinement below rejects that pairing at build time.
      */
     runnable: z.boolean().default(false),
-    runtime: z.enum(['pyodide', 'emception', 'none']).default('none'),
+    runtime: z.enum(['pyodide', 'emception', 'cheerpj', 'none']).default('none'),
     /** File extension for a downloaded cell. */
     extension: z.string(),
     /** How to run it outside the browser, shown where a Run button is not. */

src/content.config.ts

@@ -1,7 +1,7 @@
 ---
 language: asm
 label: Assembly
-order: 4
+order: 5
 runnable: false
 runtime: none
 extension: .s