Java SE download links now require custom hash

With the release of 8u121 Oracle Java download urls have changed

Previously the urls all followed the same predictable format, based on version and build:


Newer downloads now require a randomized hash,  unique to each version but the same across all package formats (RPM, TGZ, etc.)


Many build scripts  are used to parameterizing just the version

For anyone downloading Oracle Java as part of automated builds, this could be a headache. A great many build scripts are used to parameterizing just the version, and needing to lookup a new url for each release will have a reduced maintenance/security impact on the open-source community. Of course Oracle is free to release it’s builds however it desires.

Personally, this is one of those rare moments where time spent automating something pays true dividends. Latestver has included Java tracking from day one, with support for download urls.

Latestver is of course how BinaryBabel’s JDK Docker Images are updated. So addressing this change Oracle’s releases was really a matter of updating Latestver to support the new hashes, and then sitting back and watching, well, nothing really… No broken builds, or out-of-date runtimes, and no time spent updating build scripts by hand. Once and a while the Gods of Automation do smile, and it’s wondrous to behold.

So for those wondering, what to do now?

Here’s some shameless self-promotion by way of a couple of Latestver tactics you might want to deploy.

Use the Latestver API to get package URLs

URL=$(curl -s
echo "JDK8 download URL = ${URL}"
# JDK8 download URL =

curl -LOH 'Cookie: oraclelicense=accept-securebackup-cookie' "${URL}"

Or, if you prefer, install the CLI toolkit

gem install latestver

latestver get java:jdk8 -p downloads.rpm
latestver get java:jdk8 -p command_samples.curl_download
# curl -LOH 'Cookie: oraclelicense=accept-securebackup-cookie' ''

Check out the Latestver website for more automated fun.