Skip to content

Backend: outbound service-account tokens and identity-store migration - #6110

Open
shai-almog wants to merge 6 commits into
masterfrom
backend-oauth-credentials-migration
Open

Backend: outbound service-account tokens and identity-store migration#6110
shai-almog wants to merge 6 commits into
masterfrom
backend-oauth-credentials-migration

Conversation

@shai-almog

@shai-almog shai-almog commented Oct 26, 2026

Copy link
Copy Markdown
Collaborator

Resolves #5997 and #6000.

#5997 Outbound service-account tokens

New package security.oauth2.client.credentials:

  • ClientCredentialsGrant: client_secret_basic, client_secret_post, private_key_jwt.
  • JwtBearerGrant (RFC 7523), signed RS256/ES256/ES384 with the key's kid; scope goes in the form unless asked into the assertion.
  • GoogleServiceAccountCredentials: reads the service-account JSON (Google's scope-in-assertion convention).
  • AccessTokenProvider:
    • caches until a minute before expiry (capped at half a token's life);
    • one shared refresh for concurrent callers, with virtual threads waiting via napUntil;
    • never returns an expired token;
    • backs off with a jittered cooldown instead of retrying inside a request;
    • errors carry endpoint, status and OAuth error code only.
  • AccessTokenProviders.fromConfig: builds a provider from cn1.security.oauth2.client.credentials.<name>.*.

#6000 Identity-store migration

  • ModularPbkdf2PasswordEncoder reads Django, passlib and Werkzeug PBKDF2 hashes, with a bounded round count. DelegatingPasswordEncoder.isSupported asks the delegate whether it can read the value.
  • IdentityMigration + MigrationReport:
    • imports users, federated links, passkeys and TOTP verbatim, and never overwrites;
    • has a dry run;
    • gives a hash it can't verify a random password and reports a reset;
    • refuses usernames that differ only in case, so nothing attaches to another account;
    • lists the state it never carries over.
  • AuthorizationServerKeys: jwk.key-ids keeps a key's original kid, and jwk.verification-keys adds verify-only keys (PEM or JWK Set). Private and use=enc keys are refused.
  • Developer guide: "Calling other services" and "Migrating an existing identity store", with a table of what is kept and what is invalidated.

Testing

  • JVM tests:
    • outbound grants;
    • single-flight with 16 threads;
    • backoff;
    • Error recovery;
    • encoder vectors from Python hashlib;
    • end-to-end migration with rehash on login;
    • case collision;
    • an imported passkey answering a challenge;
    • an old token verifying after key rotation.
  • Native parity through the authcheck demo (BackendSecurityTest).
  • Full backend suite green.
  • SpotBugs, PMD and Checkstyle pass on backend and backend-parparvm. Backend javadoc doclint and Vale pass.

🤖 Generated with Claude Code

shai-almog and others added 5 commits October 26, 2026 06:07
@shai-almog @claude
backend: outbound service-account access tokens (#5997)
e38bd48 
Client credentials (basic, post, private_key_jwt) and RFC 7523 JWT bearer
grants, Google service-account JSON, and AccessTokenProvider: expiry-aware
cache, one shared refresh, cooldown backoff, sanitized failures. JVM tests
and the same checks in the native authcheck.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@shai-almog @claude
backend: identity-store migration (#6000)
80aaf9d 
ModularPbkdf2PasswordEncoder reads Django, passlib and Werkzeug hashes;
IdentityMigration imports users, federated links, passkeys and TOTP verbatim
and returns a MigrationReport; AuthorizationServerKeys keeps a key's kid
(key-ids) and takes verify-only keys (verification-keys). Docs for both
RFEs, including what a migration keeps and what it invalidates.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@shai-almog @claude
backend: red-team fixes for outbound tokens and migration
ff480f0 
Case-only username collisions attach nothing; a hash the id's encoder cannot
parse needs a reset; an Error from a grant no longer wedges the provider;
jwt_bearer sends scope as a form parameter unless asked (Google asks); no
unsanitized cause; skew capped at half a token's life; use=enc keys refused.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@shai-almog @claude
backend: build the Error failure after clearing the refresh flag
b995a5c 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@shai-almog
Merge remote-tracking branch 'origin/master' into backend-oauth-crede…
6c1042a 
…ntials-migration

# Conflicts:
#	docs/developer-guide/Backend-Security.asciidoc
#	vm/backend/demo/authcheck/com/demo/AuthCheck.java
@shai-almog shai-almog linked an issue Oct 26, 2026 that may be closed by this pull request
RFE: Backend identity-store migration and interoperability tooling #6000
Open
4 tasks
@github-actions

github-actions Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Developer Guide build artifacts are available for download from this workflow run:

Developer Guide quality checks:

  • AsciiDoc linter: No issues found (report)
  • Vale: No alerts found (report)
  • Paragraph capitalization: No paragraph capitalization issues (report)
  • LanguageTool: No grammar matches (report)
  • Image references: No unused images detected (report)

@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown
Contributor

Cloudflare Preview

@shai-almog

shai-almog commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Compared 191 screenshots: 191 matched.

Native Android coverage

  • 📊 Line coverage: 18.90% (48250/255341 lines covered) [HTML preview] (artifact android-coverage-report, jacocoAndroidReport/html/index.html)
    • Other counters: instruction 17.64% (229182/1299035), branch 12.04% (16817/139675), complexity 9.67% (12910/133466), method 14.57% (9122/62628), class 25.16% (1774/7052)
    • Lowest covered classes
      • kotlin.collections.kotlin.collections.ArraysKt___ArraysKt – 0.00% (0/6367 lines covered)
      • kotlin.collections.unsigned.kotlin.collections.unsigned.UArraysKt___UArraysKt – 0.00% (0/2384 lines covered)
      • org.jacoco.agent.rt.internal_0e20598.asm.org.jacoco.agent.rt.internal_0e20598.asm.ClassReader – 0.00% (0/1524 lines covered)
      • org.jacoco.agent.rt.internal_0e20598.asm.org.jacoco.agent.rt.internal_0e20598.asm.MethodWriter – 0.00% (0/922 lines covered)
      • kotlin.sequences.kotlin.sequences.SequencesKt___SequencesKt – 0.00% (0/736 lines covered)
      • com.google.common.cache.com.google.common.cache.LocalCache$Segment – 0.00% (0/726 lines covered)
      • okio.okio.Buffer – 0.00% (0/687 lines covered)
      • kotlin.text.kotlin.text.StringsKt___StringsKt – 0.00% (0/625 lines covered)
      • com.codename1.androidcompat.rt.com.codename1.androidcompat.rt.TextXmlPullParser – 0.00% (0/623 lines covered)
      • com.codename1.androidcompat.androidx.constraintlayout.core.widgets.com.codename1.androidcompat.androidx.constraintlayout.core.widgets.Flow – 0.00% (0/576 lines covered)

✅ Native Android screenshot tests passed.

Native Android coverage

  • 📊 Line coverage: 18.90% (48250/255341 lines covered) [HTML preview] (artifact android-coverage-report, jacocoAndroidReport/html/index.html)
    • Other counters: instruction 17.64% (229182/1299035), branch 12.04% (16817/139675), complexity 9.67% (12910/133466), method 14.57% (9122/62628), class 25.16% (1774/7052)
    • Lowest covered classes
      • kotlin.collections.kotlin.collections.ArraysKt___ArraysKt – 0.00% (0/6367 lines covered)
      • kotlin.collections.unsigned.kotlin.collections.unsigned.UArraysKt___UArraysKt – 0.00% (0/2384 lines covered)
      • org.jacoco.agent.rt.internal_0e20598.asm.org.jacoco.agent.rt.internal_0e20598.asm.ClassReader – 0.00% (0/1524 lines covered)
      • org.jacoco.agent.rt.internal_0e20598.asm.org.jacoco.agent.rt.internal_0e20598.asm.MethodWriter – 0.00% (0/922 lines covered)
      • kotlin.sequences.kotlin.sequences.SequencesKt___SequencesKt – 0.00% (0/736 lines covered)
      • com.google.common.cache.com.google.common.cache.LocalCache$Segment – 0.00% (0/726 lines covered)
      • okio.okio.Buffer – 0.00% (0/687 lines covered)
      • kotlin.text.kotlin.text.StringsKt___StringsKt – 0.00% (0/625 lines covered)
      • com.codename1.androidcompat.rt.com.codename1.androidcompat.rt.TextXmlPullParser – 0.00% (0/623 lines covered)
      • com.codename1.androidcompat.androidx.constraintlayout.core.widgets.com.codename1.androidcompat.androidx.constraintlayout.core.widgets.Flow – 0.00% (0/576 lines covered)

Benchmark Results

Detailed Performance Metrics

Metric Duration
SIMD kernel backend scalar fallback (no native SIMD)
SIMD int-add (64K x300) java 363ms / native 298ms = 1.2x speedup
SIMD float-mul (64K x300) java 153ms / native 138ms = 1.1x speedup
SIMD kernel correctness PASS (native result == scalar reference)
Base64 payload size 8192 bytes
Base64 benchmark iterations 6000
Base64 SIMD byte path gated to scalar (CPU autovectorizes scalar; explicit SIMD not beneficial here)
Base64 CN1 encode 88.000 ms
Base64 CN1 decode 82.000 ms
Base64 native encode 407.000 ms
Base64 encode ratio (CN1/native) 0.216x (78.4% faster)
Base64 native decode 267.000 ms
Base64 decode ratio (CN1/native) 0.307x (69.3% faster)
Image encode benchmark status skipped (SIMD unsupported)

@shai-almog

shai-almog commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Compared 227 screenshots: 227 matched.
✅ JavaScript-port screenshot tests passed.

@shai-almog

shai-almog commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Compared 206 screenshots: 206 matched.
Native Windows port, REAL shipping pipeline: the hellocodenameone screenshot suite rendered by a binary CROSS-COMPILED on Linux (clang-cl + xwin, WebView2 linked) and RUN on a Windows x64 runner. Compared against the in-repo baseline in scripts/windows/screenshots.

Benchmark Results

Detailed Performance Metrics

Metric Duration
SIMD kernel backend SSE2 (x64) / NEON (arm64) native kernels
SIMD int-add (64K x300) java 62ms / native 4ms = 15.5x speedup
SIMD float-mul (64K x300) java 56ms / native 4ms = 14.0x speedup
SIMD kernel correctness PASS (native result == scalar reference)
Base64 native bridge unavailable (CN1 + SIMD + image benchmarks only)
Base64 payload size 8192 bytes
Base64 benchmark iterations 6000
Base64 SIMD byte path gated to scalar (CPU autovectorizes scalar; explicit SIMD not beneficial here)
Base64 CN1 encode 74.000 ms
Base64 CN1 decode 92.000 ms
Base64 SIMD encode 115.000 ms
Base64 encode ratio (SIMD/CN1) 1.554x (55.4% slower)
Base64 SIMD decode 101.000 ms
Base64 decode ratio (SIMD/CN1) 1.098x (9.8% slower)
Image encode benchmark iterations 100
Image createMask (SIMD off) 8.000 ms
Image createMask (SIMD on) 3.000 ms
Image createMask ratio (SIMD on/off) 0.375x (62.5% faster)
Image applyMask (SIMD off) 31.000 ms
Image applyMask (SIMD on) 25.000 ms
Image applyMask ratio (SIMD on/off) 0.806x (19.4% faster)
Image modifyAlpha (SIMD off) 39.000 ms
Image modifyAlpha (SIMD on) 24.000 ms
Image modifyAlpha ratio (SIMD on/off) 0.615x (38.5% faster)
Image modifyAlpha removeColor (SIMD off) 48.000 ms
Image modifyAlpha removeColor (SIMD on) 22.000 ms
Image modifyAlpha removeColor ratio (SIMD on/off) 0.458x (54.2% faster)

@github-actions

github-actions Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

✅ Continuous Quality Report

Test & Coverage

Static Analysis

  • SpotBugs [Report archive]
    • ✅ ByteCodeTranslator: 0 findings (no issues)
    • ✅ android: 0 findings (no issues)
    • ✅ android-compat: 0 findings (no issues)
    • ✅ android-res-compiler: 0 findings (no issues)
    • ✅ backend: 0 findings (no issues)
    • ✅ backend-test: 0 findings (no issues)
    • ✅ build-engine: 0 findings (no issues)
    • ✅ build-hint-catalog: 0 findings (no issues)
    • ✅ build-hint-tools: 0 findings (no issues)
    • ✅ codenameone-gradle-plugin: 0 findings (no issues)
    • ✅ codenameone-maven-plugin: 0 findings (no issues)
    • ✅ core-unittests: 0 findings (no issues)
    • ✅ desktop-compat-runtime: 0 findings (no issues)
    • ✅ fxml-compiler: 0 findings (no issues)
    • ✅ ios: 0 findings (no issues)
    • ✅ javac: 0 findings (no issues)
    • ✅ javafx-compat: 0 findings (no issues)
    • ✅ project-model: 0 findings (no issues)
    • ✅ swing-compat: 0 findings (no issues)
  • ✅ PMD: 0 findings (no issues) [Report archive]
  • ✅ Checkstyle: 0 findings (no issues) [Report archive]

Generated automatically by the PR CI workflow.

@shai-almog

shai-almog commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Compared 206 screenshots: 206 matched.
Native Windows port (x64 / Intel-AMD): full hellocodenameone screenshot suite rendered offscreen with Direct2D/DirectWrite, plus the real benchmarks (base64 native/CN1/SIMD, image createMask/applyMask/modifyAlpha/PNG/JPEG, SSE2 SIMD kernels). Compared against the in-repo baseline in scripts/windows/screenshots.

Benchmark Results

Detailed Performance Metrics

Metric Duration
SIMD kernel backend SSE2 (x64) / NEON (arm64) native kernels
SIMD int-add (64K x300) java 62ms / native 5ms = 12.4x speedup
SIMD float-mul (64K x300) java 58ms / native 5ms = 11.6x speedup
SIMD kernel correctness PASS (native result == scalar reference)
Base64 native bridge unavailable (CN1 + SIMD + image benchmarks only)
Base64 payload size 8192 bytes
Base64 benchmark iterations 6000
Base64 SIMD byte path gated to scalar (CPU autovectorizes scalar; explicit SIMD not beneficial here)
Base64 CN1 encode 73.000 ms
Base64 CN1 decode 90.000 ms
Base64 SIMD encode 104.000 ms
Base64 encode ratio (SIMD/CN1) 1.425x (42.5% slower)
Base64 SIMD decode 101.000 ms
Base64 decode ratio (SIMD/CN1) 1.122x (12.2% slower)
Image encode benchmark iterations 100
Image createMask (SIMD off) 10.000 ms
Image createMask (SIMD on) 2.000 ms
Image createMask ratio (SIMD on/off) 0.200x (80.0% faster)
Image applyMask (SIMD off) 34.000 ms
Image applyMask (SIMD on) 25.000 ms
Image applyMask ratio (SIMD on/off) 0.735x (26.5% faster)
Image modifyAlpha (SIMD off) 37.000 ms
Image modifyAlpha (SIMD on) 20.000 ms
Image modifyAlpha ratio (SIMD on/off) 0.541x (45.9% faster)
Image modifyAlpha removeColor (SIMD off) 30.000 ms
Image modifyAlpha removeColor (SIMD on) 20.000 ms
Image modifyAlpha removeColor ratio (SIMD on/off) 0.667x (33.3% faster)

ParparVM vs HotSpot (JDK 25): Windows x64

Runner CPU: AMD64 Family 25 Model 1 Stepping 1, AuthenticAMD (baseline windows-x64@amd64-family-25-model-1-authenticamd)

Ratios are ParparVM / JDK 25: below 1.00x ParparVM is faster (time) or smaller (RAM). Median of 5 interleaved, paired rounds; every run's output was verified. A ratio more than 20% (time) / 25% (RAM) above its baseline in vm/selfhost/perf-baseline/ is a regression and fails; one that far below is an improvement, reported but not failed (a row whose calibration runs were noisier carries a wider tolerance), and for RAM the change must also exceed 0.05x in absolute terms. Both run unpinned on all of the runner's CPUs, with their own default thread counts.

Benchmark Cores Time RAM Status
hello (WinHelloMain) 4 1.48x (base 1.22x, +21.4%) 0.57x (base 0.94x, -39.1%) ok
translator (self) 4 0.77x (base 0.83x, -7.6%) 0.53x (base 0.54x, -1.3%) ok
intArithmetic 4 1.10x (base 1.10x, -0.0%) 0.06x (base 0.06x, +2.6%) ok
longArithmetic 4 1.14x (base 1.08x, +5.1%) 0.06x (base 0.05x, +3.3%) ok
mathTranscendental 4 0.79x (base 0.79x, -0.2%) 0.06x (base 0.06x, +2.9%) ok
arraySequential 4 1.38x (base 1.36x, +0.9%) 0.39x (base 0.39x, +0.1%) ok
arrayRandom 4 1.02x (base 1.06x, -4.1%) 0.23x (base 0.23x, +0.5%) ok
objectAllocation 4 1.52x (base 1.56x, -2.8%) 0.32x (base 0.39x, -18.3%) ok
valueEscape 4 0.10x (base 0.10x, +0.3%) 0.05x (base 0.04x, +2.4%) ok
hashMapChurn 4 1.86x (base 1.80x, +3.7%) 0.09x (base 0.09x, -4.8%) ok
stringBuilding 4 1.23x (base 1.22x, +0.9%) 0.27x (base 0.32x, -17.0%) ok
recursion 4 1.41x (base 1.49x, -5.8%) 0.06x (base 0.06x, +1.5%) ok
quicksort 4 1.11x (base 1.13x, -2.3%) 0.12x (base 0.12x, +0.9%) ok

Result: no regression

@shai-almog

shai-almog commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Compared 206 screenshots: 206 matched.
Native Linux port (x64), GTK3/Cairo/Pango, ParparVM bytecode-to-C (no JVM): the hellocodenameone screenshot suite rendered by a native ELF built + run on the GitHub x64 runner. Baseline: scripts/linux/screenshots.

ParparVM vs HotSpot (JDK 25): Linux x64

Runner CPU: AMD EPYC 9V45 96-Core Processor (baseline linux-x64@amd-epyc-9v45-96-core-processor)

Ratios are ParparVM / JDK 25: below 1.00x ParparVM is faster (time) or smaller (RAM). Median of 5 interleaved, paired rounds; every run's output was verified. A ratio more than 20% (time) / 25% (RAM) above its baseline in vm/selfhost/perf-baseline/ is a regression and fails; one that far below is an improvement, reported but not failed (a row whose calibration runs were noisier carries a wider tolerance), and for RAM the change must also exceed 0.05x in absolute terms. Both run unpinned on all of the runner's CPUs, with their own default thread counts.

Benchmark Cores Time RAM Status
hello (LinuxHelloMain) 4 0.97x (base 0.92x, +5.4%) 0.72x (base 0.84x, -14.1%) ok
translator (self) 4 0.58x (base 0.64x, -8.8%) 0.56x (base 0.55x, +2.1%) ok
intArithmetic 4 1.00x (base 1.00x, +0.0%) 0.06x (base 0.06x, +0.4%) ok
longArithmetic 4 0.98x (base 0.99x, -1.2%) 0.06x (base 0.07x, -23.5%) ok
mathTranscendental 4 1.20x (base 1.20x, -0.3%) 0.06x (base 0.06x, +1.5%) ok
arraySequential 4 3.21x (base 2.91x, +10.6%) 0.38x (base 0.36x, +5.6%) ok
arrayRandom 4 1.04x (base 1.04x, +0.2%) 0.23x (base 0.23x, +0.4%) ok
objectAllocation 4 1.58x (base 1.61x, -1.7%) 0.26x (base 0.24x, +7.6%) ok
valueEscape 4 0.10x (base 0.12x, -15.6%) 0.04x (base 0.04x, +0.8%) ok
hashMapChurn 4 1.30x (base 1.31x, -0.5%) 0.09x (base 0.09x, -1.5%) ok
stringBuilding 4 1.57x (base 1.58x, -0.7%) 0.26x (base 0.22x, +20.2%) ok
recursion 4 1.35x (base 1.34x, +0.9%) 0.06x (base 0.08x, -25.2%) ok
quicksort 4 1.06x (base 1.06x, -0.5%) 0.11x (base 0.11x, +0.5%) ok

Result: no regression

@shai-almog

shai-almog commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Compared 206 screenshots: 206 matched.
Native Linux port (arm64), GTK3/Cairo/Pango, ParparVM bytecode-to-C (no JVM): the hellocodenameone screenshot suite rendered by a native ELF built + run on the GitHub arm64 runner. Baseline: scripts/linux/screenshots-arm.

ParparVM vs HotSpot (JDK 25): Linux arm64

Runner CPU: Neoverse-N2 (baseline linux-arm64@neoverse-n2)

Ratios are ParparVM / JDK 25: below 1.00x ParparVM is faster (time) or smaller (RAM). Median of 5 interleaved, paired rounds; every run's output was verified. A ratio more than 20% (time) / 25% (RAM) above its baseline in vm/selfhost/perf-baseline/ is a regression and fails; one that far below is an improvement, reported but not failed (a row whose calibration runs were noisier carries a wider tolerance), and for RAM the change must also exceed 0.05x in absolute terms. Both run unpinned on all of the runner's CPUs, with their own default thread counts.

Benchmark Cores Time RAM Status
hello (LinuxHelloMain) 4 0.95x (base 1.02x, -7.1%) 0.65x (base 0.93x, -30.5%) ok
translator (self) 4 0.76x (base 0.70x, +9.0%) 0.46x (base 0.43x, +6.0%) ok
intArithmetic 4 1.05x (base 1.04x, +0.0%) 0.03x (base 0.03x, +4.4%) ok
longArithmetic 4 0.79x (base 0.79x, -0.1%) 0.03x (base 0.03x, +4.9%) ok
mathTranscendental 4 1.09x (base 1.10x, -0.3%) 0.04x (base 0.03x, +9.4%) ok
arraySequential 4 0.39x (base 0.36x, +8.0%) 0.37x (base 0.37x, +0.3%) ok
arrayRandom 4 0.94x (base 0.94x, -0.0%) 0.20x (base 0.20x, +0.6%) ok
objectAllocation 4 1.97x (base 1.77x, +11.3%) 0.37x (base 0.37x, +0.8%) ok
valueEscape 4 0.51x (base 0.51x, -0.1%) 0.03x (base 0.03x, +4.5%) ok
hashMapChurn 4 0.83x (base 0.84x, -1.2%) 0.12x (base 0.12x, +2.0%) ok
stringBuilding 4 1.44x (base 1.57x, -7.9%) 0.26x (base 0.26x, +0.4%) ok
recursion 4 1.41x (base 1.43x, -1.5%) 0.04x (base 0.04x, +3.0%) ok
quicksort 4 1.01x (base 0.99x, +1.4%) 0.09x (base 0.09x, +1.0%) ok

Result: no regression

@shai-almog @claude
docs: LanguageTool fixes in the backend security chapter
f4322b3 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@github-actions

github-actions Bot commented Oct 26, 2026

Copy link
Copy Markdown
Contributor

✅ ByteCodeTranslator Quality Report

Test & Coverage

  • ✅ Tests: 881 total, 0 failed, 55 skipped

Benchmark Results

  • Execution Time: 6513 ms

  • Hotspots (Top 20 sampled methods):

    • 8.92% java.lang.Object.hashCode (84 samples)
    • 7.96% com.codename1.tools.translator.BytecodeMethod.equals (75 samples)
    • 7.75% com.codename1.tools.translator.IteratorEscape.ctorOnlyStoresParamsIntoThis (73 samples)
    • 5.94% java.lang.System.identityHashCode (56 samples)
    • 2.65% java.util.ArrayList.indexOf (25 samples)
    • 2.44% com.codename1.tools.translator.ByteCodeClass.fillVirtualMethodTable (23 samples)
    • 2.44% com.codename1.tools.translator.IteratorEscape.mangle (23 samples)
    • 2.34% com.codename1.tools.translator.JavascriptReachability.enqueueResolved (22 samples)
    • 1.49% com.codename1.tools.translator.classfile.analysis.Frame.execute (14 samples)
    • 1.49% com.codename1.tools.translator.bytecodes.Invoke.resolveDirectTarget (14 samples)
    • 1.49% com.codename1.tools.translator.BytecodeMethod.updateInlinableFieldDependencies (14 samples)
    • 1.49% java.lang.StringBuilder.append (14 samples)
    • 1.17% com.codename1.tools.translator.ReachabilityCull.markCalled (11 samples)
    • 1.17% com.codename1.tools.translator.Parser.cullMethods (11 samples)
    • 1.06% com.codename1.tools.translator.ReachabilityCull.run (10 samples)
    • 1.06% com.codename1.tools.translator.DeadFieldElimination.run (10 samples)
    • 1.06% java.lang.String.equals (10 samples)
    • 1.06% com.codename1.tools.translator.Parser.collectTypeTests (10 samples)
    • 0.96% com.codename1.tools.translator.bytecodes.Invoke.findMethodUp (9 samples)
    • 0.96% com.codename1.tools.translator.ByteCodeClass.hasDeclaredMethod (9 samples)

  • ⚠️ Coverage report not generated.

Static Analysis

  • ✅ SpotBugs: no findings (report was not generated by the build).
  • ⚠️ PMD report not generated.
  • ⚠️ Checkstyle report not generated.

Generated automatically by the PR CI workflow.

@shai-almog

shai-almog commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Compared 206 screenshots: 206 matched.
Native Windows port (arm64 / Apple Silicon - Arm): full hellocodenameone screenshot suite rendered offscreen with Direct2D/DirectWrite, plus the real benchmarks (base64 native/CN1/SIMD, image createMask/applyMask/modifyAlpha/PNG/JPEG, NEON SIMD kernels). Compared against the in-repo baseline in scripts/windows/screenshots.

Benchmark Results

Detailed Performance Metrics

Metric Duration
SIMD kernel backend SSE2 (x64) / NEON (arm64) native kernels
SIMD int-add (64K x300) java 50ms / native 3ms = 16.6x speedup
SIMD float-mul (64K x300) java 49ms / native 3ms = 16.3x speedup
SIMD kernel correctness PASS (native result == scalar reference)
Base64 native bridge unavailable (CN1 + SIMD + image benchmarks only)
Base64 payload size 8192 bytes
Base64 benchmark iterations 6000
Base64 SIMD byte path gated to scalar (CPU autovectorizes scalar; explicit SIMD not beneficial here)
Base64 CN1 encode 60.000 ms
Base64 CN1 decode 69.000 ms
Base64 SIMD encode 77.000 ms
Base64 encode ratio (SIMD/CN1) 1.283x (28.3% slower)
Base64 SIMD decode 69.000 ms
Base64 decode ratio (SIMD/CN1) 1.000x (0.0% slower)
Image encode benchmark iterations 100
Image createMask (SIMD off) 5.000 ms
Image createMask (SIMD on) 1.000 ms
Image createMask ratio (SIMD on/off) 0.200x (80.0% faster)
Image applyMask (SIMD off) 19.000 ms
Image applyMask (SIMD on) 22.000 ms
Image applyMask ratio (SIMD on/off) 1.158x (15.8% slower)
Image modifyAlpha (SIMD off) 19.000 ms
Image modifyAlpha (SIMD on) 15.000 ms
Image modifyAlpha ratio (SIMD on/off) 0.789x (21.1% faster)
Image modifyAlpha removeColor (SIMD off) 20.000 ms
Image modifyAlpha removeColor (SIMD on) 15.000 ms
Image modifyAlpha removeColor ratio (SIMD on/off) 0.750x (25.0% faster)

ParparVM vs HotSpot (JDK 25): Windows arm64

Runner CPU: ARMv8 (64-bit) Family 8 Model D49 Revision 0, MICROSOFT CORPORATION (baseline windows-arm64@armv8-64-bit-family-8-model-d49-microsoft-corporation)

Ratios are ParparVM / JDK 25: below 1.00x ParparVM is faster (time) or smaller (RAM). Median of 5 interleaved, paired rounds; every run's output was verified. A ratio more than 20% (time) / 25% (RAM) above its baseline in vm/selfhost/perf-baseline/ is a regression and fails; one that far below is an improvement, reported but not failed (a row whose calibration runs were noisier carries a wider tolerance), and for RAM the change must also exceed 0.05x in absolute terms. Both run unpinned on all of the runner's CPUs, with their own default thread counts.

Benchmark Cores Time RAM Status
hello (WinHelloMain) 4 1.00x (base 1.11x, -10.1%) 0.63x (base 0.75x, -15.9%) ok
translator (self) 4 0.84x (base 0.84x, +0.7%) 0.51x (base 0.51x, +0.5%) ok
intArithmetic 4 1.04x (base 1.04x, +0.0%) 0.06x (base 0.06x, +3.4%) ok
longArithmetic 4 0.79x (base 0.80x, -0.1%) 0.06x (base 0.06x, +3.7%) ok
mathTranscendental 4 0.72x (base 0.72x, -0.0%) 0.07x (base 0.06x, +1.8%) ok
arraySequential 4 0.39x (base 0.46x, -15.0%) 0.39x (base 0.39x, -0.0%) ok
arrayRandom 4 0.94x (base 0.94x, +0.5%) 0.23x (base 0.23x, +0.2%) ok
objectAllocation 4 1.80x (base 1.82x, -0.8%) 0.41x (base 0.43x, -5.3%) ok
valueEscape 4 0.76x (base 0.76x, +0.0%) 0.05x (base 0.05x, +3.9%) ok
hashMapChurn 4 1.00x (base 0.98x, +1.5%) 0.11x (base 0.12x, -7.7%) ok
stringBuilding 4 1.61x (base 1.43x, +12.6%) 0.27x (base 0.27x, -0.4%) ok
recursion 4 1.55x (base 1.46x, +6.2%) 0.07x (base 0.07x, +1.5%) ok
quicksort 4 1.00x (base 1.00x, +0.4%) 0.12x (base 0.12x, +0.7%) ok

Result: no regression

@shai-almog

shai-almog commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator Author

Compared 192 screenshots: 192 matched.
✅ Native Mac screenshot tests passed.

Benchmark Results

  • VM Translation Time: 0 seconds
  • Compilation Time: 682 seconds

Detailed Performance Metrics

Metric Duration
SIMD kernel backend SSE2 (x64) / NEON (arm64) native kernels
SIMD int-add (64K x300) java 82ms / native 5ms = 16.4x speedup
SIMD float-mul (64K x300) java 86ms / native 6ms = 14.3x speedup
SIMD kernel correctness PASS (native result == scalar reference)
Base64 native bridge unavailable (CN1 + SIMD + image benchmarks only)
Base64 payload size 8192 bytes
Base64 benchmark iterations 6000
Base64 SIMD byte path active (NEON-accelerated)
Base64 CN1 encode 53.000 ms
Base64 CN1 decode 55.000 ms
Image encode benchmark iterations 100
Image createMask (SIMD off) 13.000 ms
Image createMask (SIMD on) 10.000 ms
Image createMask ratio (SIMD on/off) 0.769x (23.1% faster)
Image applyMask (SIMD off) 87.000 ms
Image applyMask (SIMD on) 69.000 ms
Image applyMask ratio (SIMD on/off) 0.793x (20.7% faster)
Image modifyAlpha (SIMD off) 63.000 ms
Image modifyAlpha (SIMD on) 60.000 ms
Image modifyAlpha ratio (SIMD on/off) 0.952x (4.8% faster)
Image modifyAlpha removeColor (SIMD off) 63.000 ms
Image modifyAlpha removeColor (SIMD on) 85.000 ms
Image modifyAlpha removeColor ratio (SIMD on/off) 1.349x (34.9% slower)

ParparVM vs HotSpot (JDK 25): macOS arm64

Runner CPU: Apple M1 (Virtual) (baseline macos-arm64)

Ratios are ParparVM / JDK 25: below 1.00x ParparVM is faster (time) or smaller (RAM). Median of 5 interleaved, paired rounds; every run's output was verified. A ratio more than 20% (time) / 25% (RAM) above its baseline in vm/selfhost/perf-baseline/ is a regression and fails; one that far below is an improvement, reported but not failed (a row whose calibration runs were noisier carries a wider tolerance), and for RAM the change must also exceed 0.05x in absolute terms. Both run unpinned on all of the runner's CPUs, with their own default thread counts.

Benchmark Cores Time RAM Status
hello (HelloCodenameOne) 3 0.80x (base 0.96x, -16.1%) 0.89x (base 0.93x, -3.4%) ok
translator (self) 3 0.61x (base 0.62x, -2.0%) 0.63x (base 0.78x, -19.1%) ok
intArithmetic 3 1.05x (base 1.03x, +1.3%) 0.12x (base 0.12x, +1.9%) ok
longArithmetic 3 1.03x (base 1.03x, +0.3%) 0.12x (base 0.07x, +67.3%) ok
mathTranscendental 3 0.92x (base 1.01x, -8.4%) 0.12x (base 0.12x, -0.0%) ok
arraySequential 3 0.45x (base 0.42x, +6.1%) 0.53x (base 0.53x, +0.3%) ok
arrayRandom 3 0.98x (base 0.99x, -0.9%) 0.33x (base 0.32x, +0.6%) ok
objectAllocation 3 1.08x (base 1.11x, -2.2%) 0.58x (base 0.72x, -19.8%) ok
valueEscape 3 0.50x (base 0.51x, -2.3%) 0.09x (base 0.09x, +5.7%) ok
hashMapChurn 3 1.06x (base 1.18x, -9.5%) 0.08x (base 0.07x, +13.6%) ok
stringBuilding 3 0.87x (base 0.84x, +3.2%) 0.44x (base 0.46x, -5.3%) ok
recursion 3 1.23x (base 1.24x, -0.5%) 0.12x (base 0.12x, +0.8%) ok
quicksort 3 1.00x (base 1.01x, -1.3%) 0.11x (base 0.11x, -2.5%) ok

Result: no regression

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

RFE: Backend identity-store migration and interoperability tooling RFE: Backend service-account OAuth credential exchange and refresh

1 participant

@shai-almog