I want to update my jdk for some security reasons in Redhat system and updated to jdk7u79 successfully.
Redhat has published some java vulnerabilities in their site with the name Oracle java for RHEL Server.
Do I need to update my jdk as mentioned in the RHEL site? Is jdk from oracle site is different from Oracle java for RHEL Server.
Reference
Oracle java is based on openjdk with some proprietary bits added:
– Sometimes those bits are supposed to increase performance (jrockit traces…),
– Sometimes those bits will improve compatibility (because they've been inherited from SUN and app authors tested against them since SUN era). A lot of the "stability" attributed to Oracle/Sun java is just app authors learning to avoid the bugs of Oracle/Sun proprietary bits, and adding workarounds that trip on jvms without those bugs (see also : IE6)
Red Hat java is based on the openjdk only
– pure openjdk is better integrated with the system. The openjdk guys try hard to remove residual java-isms and use the same conventions as other system apps
— pure openjdk is more forward facing. Oracle knows that SUN almost killed Java with byzantine combinations of proprietary tech it couldn't afford to maintain. Anything Oracle needs long term will end up in openjdk. It is sufficient for the openjdk implementation to achieve parity with the proprietary bits for Oracle to kill them – no $$$ in maintaining proprietary tech when similar free tech is available.
– it is very common for Red Hat to backport the code written for the next openjdk version in current redhat java, when it solves a problem in this version (as long as the current API is conserved), while Oracle will tend to wait for this next openjdk version before proposing it.
To my knowledge Oracle has been thoroughly disgusted by the way SUN handled java 1.6 (it was called java 1.6 but development was not linear, desktop/server/windows/linux jvms were all different with bits added in one version that could not be used in another due to coding shortcuts and complex licensing agreements, each of them lagged the others one way or another). Oracle intends to maintain a classic linear development pipe: openjdk next → current openjdk → oracle java
Whichever version you use you need to apply the security updates published by its maintainer. It's useless to use Oracle java as update to Red Hat java or vice versa, it's slightly different code with slightly different security bugs. Both companies have capable engineers and share security fixes in the openjdk trunk. When the fixed builds are published depend on embargo agreements and security fix policies. Oracle will tend to batch fixes in infrequent pre-planned releases, unless there is a critical vulnerability. Red Hat will publish as soon as there is something security-related to fix, be it big or small. Red Hat build processes are more agile than those Oracle uses. The Linux build processes are 100% automated, while Oracle needs to worry about windows & co.
Lastly Oracle Java as published in RHEL is a repackaging of Oracle files to use native Linux packaging tech and use the same path (etc) conventions as the openjdk packages (making it easy to replace one with another), while Oracle Java as published by Oracle still follows the very strange naming and path conventions SUN Solaris/windows people thought appropriate on Linux. It should have no more and no less security vulnerabilities than Oracle Java as published by Oracle (for the same version), just be a lot more convenient to deploy. It is designed to be just another linux package set, that can be deployed on many linux servers using native package deployment systems. When you have hundreds of servers to manage it is a great help not to have to special-case the jvm.
Each year in february Red Hat and Oracle top java people meet publicly at fosdem and present their current priorities.If you're interested you can consult their past presentations in fosdem public archives.
Related
What is the difference between Azul OpenJDK, Zulu OpenJDK and OpenJDK?
Update 2021-09
For versions 8 through 16, Oracle required a fee if their own Oracle JDK product was used in production, but not for dev, test, and training usages.
For Java 17, the Oracle JDK product is available under a new
No-Fee Terms and Conditions license, discussed on the Oracle
company blog.
On my first reading, it appears this new license makes production use free-of-cost (along with dev, test, and training usages), except for products sold for a fee while bundling the Oracle JDK product. But I am not an attorney, so read the terms yourself and consult legal advice as needed.
Keep in mind that many other vendors continue to provide implementations of the Java specs, as shown in the flowchart below. Some of these vendors sell support plans, either optionally or as a requirement for use of their product. Never assume, always read the detailed requirements for any distribution you obtain.
Another 2021 update: Add Microsoft to the list of vendors seen below.
Java specification versus implementation
Java is defined by a set of specifications, JSRs, and JEPs, all published by Oracle.
Those specifications are implemented in the source code found at the OpenJDK project.
Several vendors provide builds of that source code. Some charge money for those builds and some do not.
Azul Systems is one such vendor, a company providing multiple implementations. Zulu Community is one, provided free of charge. Zulu Enterprise is another of their products, a commercial offering. Zing is yet another product of theirs, a JVM/JDK for special needs.
You asked:
Is there any practical difference between Azul OpenJDK, Zulu OpenJDK and OpenJDK?
Yes and no.
Firstly, OpenJDK provides only source code. So you cannot use OpenJDK to run Java apps. You must first build the OpenJDK source code yourself to get executables for your particular host platform, or you must rely on a vendor make a build for you. As seen in the flow chart below, there are several such vendors making builds of the OpenJDK source code.
As for products from Azul Systems, there is no such thing as Azul OpenJDK nor Zulu OpenJDK that I know of. Azul offers multiple products, as discussed above, but none of them by that name.
The Zulu name is used for 3 products, the Community and Enterprise editions above, plus Zulu Embedded for running on constrained hardware resources. As explained on their web site, all three of these are builds of the source code from OpenJDK.
So, no, basically no practical differences, as they all are builds of OpenJDK, and behave similar to most any other build of OpenJDK source code. Any desktop, server, or console application written to comply with the Java specifications will run on Zulu Community and Zulu Enterprise.
But, yes, there are some differences in that Azul adds some features such as having back-ported Flight Recorder and Mission Control to their Java 8 version of Zulu products. And Azul, like any such JDK provider, reserves the right to add a patch when urgently needed to fix a critical bug or security vulnerability without waiting for a release in the OpenJDK codebase.
And, yes, there are major differences with the Zing product by Azul as that is intended for special needs such as supporting very large amounts of memory. While I presume this product uses parts of OpenJDK, Zing performs quite differently to meet those special needs while still conforming with the Java specifications to be able to run any application written in Java.
Another practical difference is that you can obtain support services from Azul Systems for their builds. Several of the vendors provide support services for their builds. OpenJDK provides only source code, no support.
Lastly, I should mention that Azul Systems is one of the sponsors of AdoptOpenJDK, a project to provide (a) builds of OpenJDK, and (b) test suites for quality assurance.
If you have specific product questions, you should study the Azul.com web site, and contact the sales department at Azul Systems. I speak only for myself here, unaffiliated with that company. I have on occasion used their Zulu Community product, but not the others.
➥ Read Java is Still Free to understand the ecosystem of Oracle, OpenJDK, and the various vendors of Java implementations.
Here is a flow chart I made to help guide you in choosing a vendor for an implementation of Java 11.
Let's start with full disclosure, I work for Azul (which I think makes me qualified to answer the question).
OpenJDK is a "...place to collaborate on an open-source implementation of the Java Platform, Standard Edition, and related projects". Primarily, it hosts the source code repositories for the versions of Java since JDK 6. Sun open-sourced their implementation of JDK 7 in 2007, which was how OpenJDK originated. Subsequently, a project was created for JDK 6 (which oddly, is based on JDK 7). Each version since then has been developed through the OpenJDK.
Azul is a company that specialises in Java and JVM products.
Zulu is the name chosen for the binary distribution of the OpenJDK provided by Azul. This comes in three versions:
Zulu Community: The free distribution provided under the GPLv2 with classpath exception (CPE) license.
Zulu Enterprise: A commercially supported binary distribution with SLAs for how quickly updates will be made available after Oracle provide theirs, two versions of each update (CPU and PSU) and phone/e-mail bug reporting/resolution.
Zulu Embedded: Porting and support for specific chipsets and hardware configurations for embedded applications. Also, a commercial product, although free ARM 32 builds are available for Zulu Community.
To summarise, OpenJDK is the source code, Azul is the company and Zulu is the binary distribution built from OpenJDK.
Closed. This question is opinion-based. It is not currently accepting answers.
Want to improve this question? Update the question so it can be answered with facts and citations by editing this post.
Closed 2 years ago.
Improve this question
With changes in JDK licensing agreement from Oracle, companies are switching to OpenJDK.
My question is - which distribution of the OpenJDK would be a better choice? I am evaluating Oracle Open JDK and AdoptOpenJDK, and they both seems to be an idea choice.. However when it comes to support, Oracle OpenJDK is following a 6 month release cadence without any Long term support, however AdoptOpenJDK has LTS for Java version 8 and 11. So if I switch to Oracle OpenJDK, then I will have to follow the new release cadence to be up to data with security patches (I don't care much about the new features), however If I switch to AdoptOpenJDK, then I can go with one of their LTS version (11), and expect the new security patches will be applied to this version. My main concern is, I wanted to be up to date with Java security updates after switching to OpenJDK distribution.
References
https://www.reddit.com/r/java/comments/9hd97k/openjdk_vs_adoptopenjdk/
https://www.baeldung.com/oracle-jdk-vs-openjdk
tl;dr
If you want the most rapid release of critical security patches, pay for a support plan from a vendor such as Azul systems, BellSoft, Oracle, Pivotal, or Red Hat (IBM).
To better understand the current state of the world of Java releases, you really should study the document Java Is Still Free. Written by the Java Champions community of independent Java leaders and experts.
Details
With changes in JDK licensing agreement from Oracle, companies are switching to OpenJDK.
To be clear here, you may be referring to Oracle changing the terms to their Oracle JDK product to require a fee when used in production. That product is still free-of-cost for use in development, testing, and such.
My question is - which distribution of the OpenJDK would be a better choice?
Answering that depends on the criteria important to you. But you did not mention any criteria other than needing security updates rapidly (more on that below).
I am evaluating Oracle Open JDK and AdoptOpenJDK, and they both seems to be an idea choice..
Be clear on this: The OpenJDK project publishes source code only, not builds nor installers. Many vendors provide builds/installers based on the OpenJDK source code.
Oracle is one such vendor, providing three products:
Oracle JDK — their branded product requiring a fee for production use, with paid support available.
jdk.java.net — a build of OpenJDK without any fees and without any support.
GraalVM — a special product, a Java VM and JDK based on HotSpot/OpenJDK, implemented in Java, and supporting additional programming languages and execution modes, like ahead-of-time compilation of Java applications for fast startup and low memory footprint.
All three of these are based on OpenJDK source code. The first and last offer paid support programs.
Oracle has publicly declared their intent to keep Oracle JDK at feature-parity with OpenJDK. Oracle sponsors the OpenJDK project as part of that commitment. At the same time, Oracle reserves the right to rapidly release any critical security patch to their paying customers. They will eventually submit such patches to the OpenJDK project. But those submitted patches are likely to take more time to go through the OpenJDK process before being released.
AdoptOpenJDK is another vendor offering builds and installers of the OpenJDK source code base. So, again, any critical security patches may not reach the public free-of-charge as fast as a patch from another vendor to their paying customers.
Here is a flow chart I made to help guide you in your selection of a vendor for a Java implementation. You have a variety of choices, some with support options.
However when it comes to support, Oracle OpenJDK is following a 6 month release cadence without any Long term support, however AdoptOpenJDK has LTS for Java version 8 and 11.
I believe you are incorrect here. Oracle does maintain LTS updates to their Oracle JDK product for both Java 8 and Java 11, for some number of years to the public, and for additional years to their paying customers.
The Java community is much more cooperative in working together than you may understand. Every implementation of Java I know of is largely based on the OpenJDK project. The OpenJDK project is supported by Oracle, Apple, IBM, SAP, and possibly others. Amazon, Microsoft, and other companies contribute. The rapid release train and Long-Term Support (LTS) strategy has been embraced by the entire Java community.
Oracle has turned over stewardship of the LTS versions 8 and 11 to Red Hat, but Oracle continues to support them both. See the Oracle Java SE Support Roadmap for details.
So if I switch to Oracle OpenJDK, then I will have to follow the new release cadence to be up to data with security patches
Every Java implementation I know of is following along the same release cadence.
(I don't care much about the new features),
Then you should certainly stick to using only the LTS versions. Currently that would be Java 8 and Java 11.
If I switch to AdoptOpenJDK, then I can go with one of their LTS version (11), and expect the new security patches will be applied to this version.
You can expect security patches from any vendor providing a Java implementation. The question is how rapidly those patches will arrive to you.
My main concern is, I wanted to be up to date with Java security updates
Then I recommend you purchase a paid support plan from a reliable vendor. You have a choice of several. See the left side of the blue barrel in my diagram above.
If you think the chance of critical security vulnerability affecting you specifically is exceedingly low, or that you are likely to be able to mitigate such a vulnerability, then the cost of a support plan may not be worth it to you. In this case, you would wait for a newer free-of-cost release. You may be waiting longer than you would with a paid vendor.
after switching to OpenJDK distribution.
Every Java implementation I know of being distributed today is based on OpenJDK.
Here is another graphic listing possible motivations for choosing a particular vendor for your Java implementation.
Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.
This question does not appear to be about programming within the scope defined in the help center.
Closed 4 years ago.
Improve this question
So I am currently building all my applications in Oracle JDK 8. Will the Oracle Licensing policy update affect the use of JDK 8 or Is that only for JDK 11 LTS. Suppose If I want to migrate to JDK 11 in near future, Can I choose OpenJDK under GPL upto production? Is there any change in source code from Oracle JDK under BCL and OpenJDK under GPL? Can I use it interchangeably?
OpenJDK is a word that means many things.
It all starts with OpenJDK, the source repository. It is GPL licensed (and that's a can of worms by itself, lots has been written about it, and the full license can be found on the OpenJDK licenses page.
But that's sources. There's the notion of 'packaging' the sources. This is, itself, a product. Perhaps if you're old enough you remember that folks would sell, shrink-wrapped in a box, a bunch of CDs or DVDs with a linux distro, a manual, and the right to support for a certain period of time. That is a packaging of an open source product. The fact that I can buy a SuSE distro in a box in the store doesn't make linux a for-pay product. The OpenJDK (the source repo) is no different.
A packaging of the OpenJDK (source repo) would presumably include, though all of these are optional components:
Binaries for a few platforms, such as 'for windows', 'for ARM Linux', etc.
An installer to install this binary.
A channel to communicate updates to you, for example about security issues; this can be as simple as a mail newsletter and as complex as a continuously running tiny app that checks for updates and automatically installs them when an update shows up, to commitment to maintain an apt-get repo.
Support, via phone, mail, etc. This support can be for the VM itself ("My VM crashes if I give it more than 4GB of memory") to programming java to trying to optimize a deployment ("Which garbage collector is more efficient here?") – to merely having a no-guarantees whatsoever forum.
There are many packagings of the OpenJDK (the source repo). The ones most relevant to you:
Oracle OpenJDK, the product. This is free and open source (FOSS), ships with no support whatsoever (like most FOSS), does have installers and binaries for many platforms, is produced by oracle, and notably offers a support channel ONLY until the next major java version is released. Right now you can download Oracle OpenJDK11 and it'll be supported.. for a few weeks, because OpenJDK12 is around the corner. You may have heard of 'long term support' versions.. that doesn't apply to Oracle OpenJDK. In this product, 'long term support' just isn't a thing.
Oracle JDK. This is a commercial offering (though it does have sort of a preview/developer version, but you're not supposed to use that for much, best to ignore its existence), that notably offers support from oracle for it, AND it DOES adhere to the long-term-support thing. In a few weeks, when Oracle OracleJDK12 is released, OracleJDK11 is still supported. As in, if a security issue comes up, they'd patch it and release an update, and make sure all your auto-updaters and such pick it up, and they'll mail you about it, etc.
AdoptOpenJDK's JDKs. The adoptopenJDK project is an open source volunteer endeavour. These are free and they do commit to keeping JDKs updated, particularly the ones oracleJDK considers 'long term support' (so, 8 and 11), though notably they have NOT committed to writing patches. If there's an open source security or bugfix patch out there they'll apply it and release a new version, but if there's no such patch then there won't be an update.
Amazon's Corretto offerings. These are free; there's an 8 version and just this week an 11 has been released. Amazon's committed to keeping these up to date and specifically checked to run smoothly on amazon AWS instances.
(Some others are listed in Wikipedia article https://en.wikipedia.org/wiki/OpenJDK#OpenJDK_builds)
My advice is to use adoptopenjdk JDKs everywhere, except perhaps if you run java on AWS stuff you might want to pick up coretto instead. If your boss wants the safety cushion of support and SLAs, buy oracle's.
Use Oracle's OpenJDK packaging only for early access releases; if you want to test JDK12 on your dev machine, oracle openJDK is what you're looking for.
Legally speaking all of these offerings have their own licenses. AdoptOpenJDK, Coretto, and Oracle OpenJDK are all pretty much GPL+classpath exception and that's all, but, I'm not a lawyer.
Java 11 does not come with a JRE for download, unlike past Java versions. I got an error "no java run-time environment" when running some Java-based software. To fix the problem, I had to install Java 8 JRE.
How can I get my PC to run Java 11 JRE given that there is no more JRE 11 to download?
I am using Windows 10.
The Answer by Stephen C is correct, and important.
Oracle no longer intends for end-users to be installing a JRE or a JDK. Java Applets in a browser and Java Web Start app delivery are both being phased out, leaving the end-user with no need for a JRE. Java-based apps are expected to bundle their own Java implementation. The only folks consciously installing a JDK will be developers & server-side sysadmins.
Important:
Understand clearly the nature of the OpenJDK project, as explained in Wikipedia
Read this white paper by Oracle of 2018-03, Java Client Roadmap Update
Read the white paper Java Is Still Free, authored by key members of the Java community.
Learn about:
Java Platform Module System
jlink (JEP 282)
jpackage (JEP 343)
Desktop apps are now expected to bundle their own Java runtime. Those tools listed above can create a very small runtime custom-fit to your particular app.
Here is a flowchart diagram that may help you finding and deciding amongst the various vendors providing a Java 11 implementation.
And a table mapping possible motivations or considerations leading to suggested vendors of Java.
Compatibility concerns
In the Comments, an question was raised, concern over compatibility issues between releases by various vendors.
Firstly, know that the OpenJDK project includes a vast suite of tests known as the OpenJDK Community Technology Compatibility Kit (TCK). Vendors are free to self-declare whether their release has passed those tests. These claims are not verified, and rely on the honor system. On my diagram above, I have check-marked "TCK" on the couple vendors I know have self-declared: Oracle JDK by Oracle & Zulu by Azul Systems.
All the products listed in the blue barrel area of my chart above are built almost directly on the OpenJDK source code. So generally, you should see virtually identical compatibility.
There are two areas of concern you might consider: Technology differences, and schedule of updates/patches.
As for technology differences, vendors using the OpenJDK project can ship with either the HotSpot engine or the OpenJ9 engine. These will differ on performance (faster/slower startup versus overall speed, more/less memory), but their behavior in terms of complying with the Java specifications should be identical. They could differ, and certainly either might present a flaw (that likely would be soon fixed) that the other lacked. Personally, I would not be concerned by this, but I mention it for completeness.
Another technology difference is the different kind of JVM used by Zing by Azul Systems and GraalVM by Oracle. Either of these might differ in some way from each other or from the other products, because they intentionally have a different kind of JVM implementation, to offer special features. But given the thoroughness of the Java specs, they should not be incompatible. If they were, you can expect any compatibility problem to be rapidly resolved. If I needed the special features of either of these products, I would use them with full confidence.
Another possible concern is the speed with which a vendor might update their own releases with certain bug fixes or security patches. For example, Oracle has stated that they reserve the right to immediately ship any ready patches to their own customers, while submitting those to the OpenJDK project for consideration. Certainly, any of the vendors providing commercial support are likely to rush a fix or patch to their paying customers. Those releases built as a courtesy to the community provided free-of-cost may take longer to update, likely after the OpenJDK project has incorporated a fix/patch.
And each vendor is free to modify their code base at will, as long as they comply with the Java specs. For example, the Corretto team at Amazon has already made improvements to their own release, and then shared those changes upstream to the OpenJDK project. There may a gap in time before OpenJDK incorporated those changes, if they decide to do so. So it is possible that various releases might differ. But at this point, all of the vendors in the Java community seem to have sincere commitments to work together to prevent fragmentation. So, again, I have no real concern here, but mention this for completeness.
Right now, there seem to be no free + easy Oracle-supported Java 11 JRE (only) options. Your options are:
Download and use an OpenJDK Java 11 JDK from the OpenJDK site.
Download and use an Oracle Java 11 JDK from the Oracle site ... and be sure that you fully understand the restrictions on "commercial use" that now apply to the Oracle Java 11+ releases.
Try to roll your own Windows JRE for Windows from the OpenJDK sources; see Create jre from OpenJDK Windows. (I wouldn't recommend doing this. There are better alternatives.)
Look into using the new jlink tool to create a custom image (basically a cut-down JRE) for your application. This seems to be the option that Oracle want 3rd-party application developers to use.
Talk to Oracle sales about a Java support contract, and specifically ask about how to get a JRE build. (I don't know what the answer will be. If someone does try this, and they get a positive response, please comment!)
Use a 3rd-party Java JRE distribution.
The list of Java vendors changes over time, but as of now it includes AdoptOpenJDK, Amazon, Azul, BellSoft, IBM, jClarity, Red Hat and SAP. See also: Difference between OpenJDK and Adoptium/AdoptOpenJDK
Some of these vendors offer JRE distros. Check their download sites.
Since (nearly) all Java vendors base their products on the same standard OpenJDK codebase that is used for Oracle Java, there is no reason to be concerned about the stability of a 3rd party JRE. Some vendors offer (paid for) support.
(Or switch from Windows to Linux. I can install an OpenJDK Java 11 JRE-only package from the distro package manager on recent versions of Ubuntu, Fedora, ...)
For those people who think that Oracle Java 11 and OpenJDK Java 11 are the same, please read the following from the Oracle download site:
Important changes in Oracle JDK 11 License
With JDK 11 Oracle has updated the license terms on which we offer the Oracle JDK. The new Oracle Technology Network License Agreement for Oracle Java SE is substantially different from the licenses under which previous versions of the JDK were offered. Please review the new terms carefully before downloading and using this product.
Oracle also offers this software under the GPL License on jdk.java.net/11
Notice that Oracle are saying that the licenses for Oracle Java and OpenJDK Java are different. (Not withstanding that the two are built from essentially the same source code base.) Ignore this at your peril!
You can use the "adoptopenjdk" project website to download latest jre and JDK https://github.com/AdoptOpenJDK/openjdk-jdk11
find latest link here > https://adoptopenjdk.net/releases.html?variant=openjdk11&jvmVariant=hotspot
Edit:
Problem has been fixed
I have used their night builds to workaround the problem of missing JRE in JDK package
https://adoptopenjdk.net/nightly.html?variant=openjdk11
zulu still maintains the jre (11 - 16) and it is recommended by some vendors.
you can download it on their site: https://www.azul.com/downloads/zulu/
I'm trying to get a rather JDK-sensitive piece of Oracle software working with Websphere, and I need to find some particular versions of the IBM JDK to try. The problem is that IBM doesn't really make these readily available like Sun/Oracle does with theirs, and all the versions I've been able to get my hands on haven't worked for one reason or another.
Specifically, I need one of:
IBM Java 5 SR9 for Windows (ideal)
IBM Java 5 SR2 for Windows
IBM Java 5 SR10 for Windows
How could I get these directly from IBM? My company has a support contract for Websphere, and I hopefully could have one of our Websphere engineers download it if I can tell them where to go.
I don't know if this is still true(but this was certainly true in the past), but here is the story.
Due to Java License restrictions earlier, the JDK cannot be provided alone by vendors like IBM.
I am unable to pull this info from any IBM site at the moment but i am pretty certain about these license restrictions in the past.
Here is a post by another gentleman in this space:
From : http://www.ibm.com/developerworks/forums/thread.jspa?messageID=14514070
Unfortunately you can get hold of the JDK only as part of another IBM product (say, Websphere or any Rational product) that you purchased. Our licensing agreement with Sun/Oracle forbids us from providing direct downloads of the IBM JDK on any platforms that Oracle/Sun also support (namely Windows and Linux). If you look at the Java downloads section of the developerWorks website, you'll only find SDKs for AIX, z/OS and Linux on System p/z, since those are IBM owned platforms that Oracle doesn't support.
Since the JDK is shipped along with Websphere/Rational/Tivoli products, you can use it if you already have one of them deployed(though even then you may have SR8 FP1, unless you also install the very latest fix packs for those products).
(Unless you work for IBM) there is no way to download the IBM JDK separately. It's shipped with the IBM Rational Suite of Software IBM develops.
The IBM JDK comes also with IBM Java Profiler (which isn't free).
The Eclipse Platform that is found here https://www.ibm.com/developerworks/eclipse/downloads/helios/#download is similar to the Eclipse download found on the Eclipse Site. IBM makes it easier for those who can't afford WebSphere Application Developer or Rational Application Developer (which are both Eclipse flavour) to use Eclipse.
Currently, (July 12 2017) you can find the older bundles for java 6, 7 and 7.1 here https://www.ibm.com/developerworks/java/jdk/eclipse/index.html
The latest one can be downloaded from here https://developer.ibm.com/javasdk/downloads/eclipse/
Yes IBM JRE/JDK is typically shipped with products, not stand-alone.
How about you get the WebSphere version that is the target for your activity and install that? Won't that give you what you need? The Single server edition is comparatively small footprint.
Here's a page with some IBM JDKs made available on developerWorks that may be useful to you.
https://www.ibm.com/developerworks/java/jdk/
the SR9 fix pack for WAS V6.1.0.25 is available here - http://www-01.ibm.com/support/docview.wss?uid=swg24023276. Click on the FTP link to download the PAK file (and rename to zip).
Previously I've found that the Eclipse bundles from IBM also contain the IBM JVM. This might still be the case but the bundles are too big for me to check now.
See http://www.ibm.com/developerworks/eclipse/downloads/
I hate to answer with the obvious... but if you have a support contract with IBM, why not just call IBM support? If you haven't seen it already, IBM's main JDK page is at: https://www.ibm.com/developerworks/java/jdk/.
However, the Windows offerings are pretty pitiful. IBM hasn't released a new JDK for the Windows platform since early-2006. That JDK was of the Java 5 generation, but there's no indication on the download page (or in the installer's file name) of an SR version. I can't install it and check for you, because of the other Windows caveat of which I hope you're aware: The IBM JDK will not install on a Windows machine unless the installer detects an IBM BIOS.
Given that IBM sold their PC division to Lenovo, I'm not even sure that it is possible AT ALL to install their standalone JDK on a contemporary box. I would contact IBM support if you have a contract... they might be able to tell you differently.
Either way, the preceding answer points at another possibility. IBM frequently bundles its JDK/JRE, without the crazy restrictions found in the standalone version, inside of other downloads. For instance, I know that WebSphere Community Edition (i.e. IBM's version of Apache Geronimo) comes with one. Good luck finding the specific version you need... but if you do, and don't mind the possibility of violating some license legalese, then you can just ZIP up that directory and copy it to the target machine.
This whole topic is a damn shame. In terms of bechmarks and runtime performance, the IBM JDK/JRE has always been awesome. However, on the larger "ecosystem" level it's always sucked.