The package rpms/java-latest-openjdk.git has added or updated architecture specific
content in its
spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s):
https://src.fedoraproject.org/cgit/rpms/java-latest-openjdk.git/commit/?i...
https://src.fedoraproject.org/cgit/rpms/java-latest-openjdk.git/commit/?i....
Change:
+%ifarch %{share_arches}
-%ifarch %{aot_arches}
Thanks.
Full change:
============
commit f6a55b568b3cdba18e31b5705c213d6da030a1dc
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Tue Aug 31 18:26:42 2021 +0200
alternatives creation moved to posttrans
- Thus fixing the old reisntall issue:
-
https://bugzilla.redhat.com/show_bug.cgi?id=1200302
-
https://bugzilla.redhat.com/show_bug.cgi?id=1976053
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 24c213e..acbf07b 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -81,7 +81,7 @@
# in alternatives those are slaves and master, very often triplicated by man pages
# in files all masters and slaves are ghosted
# the ghosts are here to allow installation via query like `dnf install /usr/bin/java`
-# you can list those files, with appropriate sections: cat *.spec | grep -e --install -e
--slave -e post_
+# you can list those files, with appropriate sections: cat *.spec | grep -e --install -e
--slave -e post_ -e alternatives
# TODO - fix those hardcoded lists via single list
# Those files must *NOT* be ghosted for *slowdebug* packages
# FIXME - if you are moving jshell or jlink or similar, always modify all three sections
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 33
-%global rpmrelease 0
+%global rpmrelease 1
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -432,12 +432,7 @@ update-desktop-database %{_datadir}/applications &> /dev/null
|| :
exit 0
}
-
-%define post_headless() %{expand:
-%ifarch %{share_arches}
-%{jrebindir -- %{?1}}/java -Xshare:dump >/dev/null 2>/dev/null
-%endif
-
+%define alternatives_java_install() %{expand:
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
@@ -463,8 +458,13 @@ for X in %{origin} %{javaver} ; do
alternatives --install %{_jvmdir}/jre-"$X" jre_"$X"
%{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family %{name}.%{_arch}
done
-update-alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin}
jre_%{javaver}_%{origin} %{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family
%{name}.%{_arch}
+alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} jre_%{javaver}_%{origin}
%{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family %{name}.%{_arch}
+}
+%define post_headless() %{expand:
+%ifarch %{share_arches}
+%{jrebindir -- %{?1}}/java -Xshare:dump >/dev/null 2>/dev/null
+%endif
update-desktop-database %{_datadir}/applications &> /dev/null || :
/bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || :
@@ -501,8 +501,8 @@ exit 0
%{update_desktop_icons}
}
-%define post_devel() %{expand:
+%define alternatives_javac_install() %{expand:
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
@@ -581,7 +581,9 @@ for X in %{origin} %{javaver} ; do
done
update-alternatives --install %{_jvmdir}/java-%{javaver}-%{origin}
java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family
%{name}.%{_arch}
+}
+%define post_devel() %{expand:
update-desktop-database %{_datadir}/applications &> /dev/null || :
/bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || :
@@ -604,11 +606,11 @@ exit 0
}
%define posttrans_devel() %{expand:
+%{alternatives_javac_install -- %{?1}}
%{update_desktop_icons}
}
-%define post_javadoc() %{expand:
-
+%define alternatives_javadoc_install() %{expand:
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
@@ -625,8 +627,7 @@ exit 0
exit 0
}
-%define post_javadoc_zip() %{expand:
-
+%define alternatives_javadoczip_install() %{expand:
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
@@ -2055,6 +2056,9 @@ cjc.mainProgram(args)
%posttrans
%{posttrans_script %{nil}}
+%posttrans headless
+%{alternatives_java_install %{nil}}
+
%post devel
%{post_devel %{nil}}
@@ -2064,14 +2068,14 @@ cjc.mainProgram(args)
%posttrans devel
%{posttrans_devel %{nil}}
-%post javadoc
-%{post_javadoc %{nil}}
+%posttrans javadoc
+%{alternatives_javadoc_install %{nil}}
%postun javadoc
%{postun_javadoc %{nil}}
-%post javadoc-zip
-%{post_javadoc_zip %{nil}}
+%posttrans javadoc-zip
+%{alternatives_javadoczip_install %{nil}}
%postun javadoc-zip
%{postun_javadoc_zip %{nil}}
@@ -2084,6 +2088,9 @@ cjc.mainProgram(args)
%post headless-slowdebug
%{post_headless -- %{debug_suffix_unquoted}}
+%posttrans headless-slowdebug
+%{alternatives_java_install -- %{debug_suffix_unquoted}}
+
%postun slowdebug
%{postun_script -- %{debug_suffix_unquoted}}
@@ -2119,6 +2126,9 @@ cjc.mainProgram(args)
%posttrans fastdebug
%{posttrans_script -- %{fastdebug_suffix_unquoted}}
+%posttrans headless-fastdebug
+%{alternatives_java_install -- %{fastdebug_suffix_unquoted}}
+
%post devel-fastdebug
%{post_devel -- %{fastdebug_suffix_unquoted}}
@@ -2225,6 +2235,12 @@ cjc.mainProgram(args)
%endif
%changelog
+* Mon Aug 30 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.0.0.33-0.1.ea.rolling
+- alternatives creation moved to posttrans
+- Thus fixing the old reisntall issue:
+-
https://bugzilla.redhat.com/show_bug.cgi?id=1200302
+-
https://bugzilla.redhat.com/show_bug.cgi?id=1976053
+
* Fri Jul 30 2021 Andrew Hughes <gnu.andrew(a)redhat.com> -
1:17.0.0.0.33-0.0.ea.rolling
- Update to jdk-17+33, including JDWP fix and July 2021 CPU
- Resolves: rhbz#1972529
commit ad1d006fca6212f323d87a100a0f994d333980dc
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Fri Jul 30 06:23:55 2021 +0100
Update to jdk-17+33, including JDWP fix and July 2021 CPU
Resolves: rhbz#1972529
diff --git a/.gitignore b/.gitignore
index 620751c..77dfe61 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,3 +16,4 @@
/openjdk-jdk16-jdk-16+36.tar.xz
/openjdk-jdk16u-jdk-16.0.1+9.tar.xz
/openjdk-jdk17-jdk-17+26.tar.xz
+/openjdk-jdk17-jdk-17+33.tar.xz
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index ad8b8ce..24c213e 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -297,8 +297,8 @@
%global origin_nice OpenJDK
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver 26
-%global rpmrelease 4
+%global buildver 33
+%global rpmrelease 0
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -1072,7 +1072,7 @@ Version: %{newjavaver}.%{buildver}
# This package needs `.rolling` as part of Release so as to not conflict on install with
# java-X-openjdk. I.e. when latest rolling release is also an LTS release packaged as
# java-X-openjdk. See:
https://bugzilla.redhat.com/show_bug.cgi?id=1647298
-Release: %{?eaprefix}%{rpmrelease}%{?extraver}.rolling%{?dist}.1
+Release: %{?eaprefix}%{rpmrelease}%{?extraver}.rolling%{?dist}
# java-1.5.0-ibm from
jpackage.org set Epoch to 1 for unknown reasons
# and this change was brought into RHEL-4. java-1.5.0-ibm packages
# also included the epoch in their virtual provides. This created a
@@ -2225,6 +2225,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Fri Jul 30 2021 Andrew Hughes <gnu.andrew(a)redhat.com> -
1:17.0.0.0.33-0.0.ea.rolling
+- Update to jdk-17+33, including JDWP fix and July 2021 CPU
+- Resolves: rhbz#1972529
+
* Thu Jul 22 2021 Fedora Release Engineering <releng(a)fedoraproject.org> -
1:17.0.0.0.26-0.4.ea.rolling.1
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
diff --git a/sources b/sources
index 4bb4cd6..312b5ef 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (openjdk-jdk17-jdk-17+26.tar.xz) =
a400889ba4f141ecf29e46e42f2b2a07ba6df0760502467e7925a31e88ec6fa07deec99f919a42fd673b30df5c86f2adf5e0dcb00687404f0715527b79f2fec7
+SHA512 (openjdk-jdk17-jdk-17+33.tar.xz) =
fa7e852a774d74dbd945a168f8e8f673601fbdf6ff3ce91a4c38a911b1ba66524fa30a8d4cdd60c7bb2c7f7d6d8ab353502c647a5e888a94c18958c7a8348b9c
commit 01513bdab795dba09b6f40f3e5d0c44236a93aae
Author: Fedora Release Engineering <releng(a)fedoraproject.org>
Date: Thu Jul 22 08:57:38 2021 +0000
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng(a)fedoraproject.org>
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 995d4f2..ad8b8ce 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -1072,7 +1072,7 @@ Version: %{newjavaver}.%{buildver}
# This package needs `.rolling` as part of Release so as to not conflict on install with
# java-X-openjdk. I.e. when latest rolling release is also an LTS release packaged as
# java-X-openjdk. See:
https://bugzilla.redhat.com/show_bug.cgi?id=1647298
-Release: %{?eaprefix}%{rpmrelease}%{?extraver}.rolling%{?dist}
+Release: %{?eaprefix}%{rpmrelease}%{?extraver}.rolling%{?dist}.1
# java-1.5.0-ibm from
jpackage.org set Epoch to 1 for unknown reasons
# and this change was brought into RHEL-4. java-1.5.0-ibm packages
# also included the epoch in their virtual provides. This created a
@@ -2225,6 +2225,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Jul 22 2021 Fedora Release Engineering <releng(a)fedoraproject.org> -
1:17.0.0.0.26-0.4.ea.rolling.1
+- Rebuilt for
https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
* Fri Jul 02 2021 Andrew Hughes <gnu.andrew(a)redhat.com> -
1:17.0.0.0.26-0.4.ea.rolling
- Use the "reverse" build loop (debug first) as the main and only build loop to
get more diagnostics.
- Remove restriction on disabling product build, as debug packages no longer have javadoc
packages.
commit f905d4f641bd90d2e6dff175e8751dfb2b4569e5
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Wed Jul 7 07:02:16 2021 +0100
Use the "reverse" build loop (debug first) as the main and only build loop
to get more diagnostics.
Remove restriction on disabling product build, as debug packages no longer have
javadoc packages.
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 9963a19..995d4f2 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -170,10 +170,8 @@
%endif
# If you disable both builds, then the build fails
-# Note that the debug build requires the normal build for docs
-%global build_loop %{normal_build} %{fastdebug_build} %{slowdebug_build}
-# Test slowdebug first as it provides the best diagnostics
-%global rev_build_loop %{slowdebug_build} %{fastdebug_build} %{normal_build}
+# Build and test slowdebug first as it provides the best diagnostics
+%global build_loop %{slowdebug_build} %{fastdebug_build} %{normal_build}
%if %{include_staticlibs}
%global staticlibs_loop %{staticlibs_suffix}
@@ -300,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 26
-%global rpmrelease 3
+%global rpmrelease 4
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -1493,10 +1491,6 @@ if [ %{include_debug_build} -eq 0 -a %{include_normal_build} -eq 0
-a %{includ
echo "You have disabled all builds (normal,fastdebug,slowdebug). That is a no
go."
exit 14
fi
-if [ %{include_normal_build} -eq 0 ] ; then
- echo "You have disabled the normal build, but this is required to provide docs for
the debug build."
- exit 15
-fi
%setup -q -c -n %{uniquesuffix ""} -T -a 0
#
https://bugzilla.redhat.com/show_bug.cgi?id=1189084
prioritylength=`expr length %{priority}`
@@ -1739,7 +1733,7 @@ done # end of release / debug cycle loop
%check
# We test debug first as it will give better diagnostics on a crash
-for suffix in %{rev_build_loop} ; do
+for suffix in %{build_loop} ; do
top_dir_abs_main_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{main_suffix}}
%if %{include_staticlibs}
@@ -2231,6 +2225,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Fri Jul 02 2021 Andrew Hughes <gnu.andrew(a)redhat.com> -
1:17.0.0.0.26-0.4.ea.rolling
+- Use the "reverse" build loop (debug first) as the main and only build loop to
get more diagnostics.
+- Remove restriction on disabling product build, as debug packages no longer have javadoc
packages.
+
* Mon Jun 28 2021 Petra Alice Mikova <pmikova(a)redhat.com> -
1:17.0.0.0.26-0.3.ea.rolling
- fix patch rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch which
made the SunPKCS provider show up again
- Resolves: rhbz#1971120
commit 8494397c4f2543e8bc9e2de96be66d04fe399e36
Author: Petra Mikova <pmikova(a)redhat.com>
Date: Thu Jun 17 10:22:07 2021 +0200
Fix patch rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
It makes the SunPKCS provider show up again
Resolves: rhbz#1971120
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index b36e635..9963a19 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -300,7 +300,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 26
-%global rpmrelease 2
+%global rpmrelease 3
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -2231,6 +2231,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Mon Jun 28 2021 Petra Alice Mikova <pmikova(a)redhat.com> -
1:17.0.0.0.26-0.3.ea.rolling
+- fix patch rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch which
made the SunPKCS provider show up again
+- Resolves: rhbz#1971120
+
* Thu Jun 24 2021 Severin Gehwolf <sgehwolf(a)redhat.com> -
1:17.0.0.0.26-0.2.ea.rolling
- Re-enable TestSecurityProperties after inclusion of PR3695
diff --git a/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
b/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
index ef4c828..7be1fae 100644
--- a/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
+++ b/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
@@ -1,11 +1,11 @@
-diff -r e3f940bd3c8f src/java.base/share/conf/security/java.security
---- openjdk/src/java.base/share/conf/security/java.security Thu Jun 11 21:54:51 2020
+0530
-+++ openjdk/src/java.base/share/conf/security/java.security Mon Aug 24 10:14:31 2020
+0200
-@@ -77,7 +77,7 @@
- #ifdef macosx
+diff --git openjdk/src/java.base/share/conf/security/java.security
openjdk/src/java.base/share/conf/security/java.security
+index 534bdae5a16..2df2b59cbf6 100644
+--- openjdk/src/java.base/share/conf/security/java.security
++++ openjdk/src/java.base/share/conf/security/java.security
+@@ -78,6 +78,7 @@ security.provider.tbd=SunMSCAPI
security.provider.tbd=Apple
#endif
--security.provider.tbd=SunPKCS11
+ security.provider.tbd=SunPKCS11
+#security.provider.tbd=SunPKCS11 ${java.home}/lib/security/nss.cfg
#
commit 2d94c2eee7b69adf64e33ac84fbf5627c0ac7d60
Author: Severin Gehwolf <sgehwolf(a)redhat.com>
Date: Mon Jun 21 14:20:29 2021 +0200
Add PR3695 to allow the system crypto policy to be turned off.
- Adds patch from java-11-openjdk so as to be able to properly
toggle the system crypto policy
- Fixes test TestSecurityProperties.java which was failing
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 9e89d2a..b36e635 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -300,7 +300,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 26
-%global rpmrelease 1
+%global rpmrelease 2
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -1156,6 +1156,8 @@ Patch2: rh1648644-java_access_bridge_privileged_security.patch
Patch3:
rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
# Follow system wide crypto policy RHBZ#1249083
Patch4: pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch
+# PR3695: Allow use of system crypto policy to be disabled by the user
+Patch5: pr3695-toggle_system_crypto_policy.patch
# Depend on pcs-lite-libs instead of pcs-lite-devel as this is only in optional repo
Patch6:
rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
@@ -1513,6 +1515,7 @@ pushd %{top_level_dir_name}
%patch2 -p1
%patch3 -p1
%patch4 -p1
+%patch5 -p1
%patch6 -p1
popd # openjdk
@@ -1760,7 +1763,7 @@ $JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed
"s|\.java||")
# Check system crypto (policy) can be disabled
$JAVA_HOME/bin/javac -d . %{SOURCE15}
-$JAVA_HOME/bin/java -Djava.security.disableSystemPropertiesFile=true $(echo $(basename
%{SOURCE15})|sed "s|\.java||") || echo "crypto policy are now not honored
i jdk15"
+$JAVA_HOME/bin/java -Djava.security.disableSystemPropertiesFile=true $(echo $(basename
%{SOURCE15})|sed "s|\.java||")
# Check java launcher has no SSB mitigation
if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi
@@ -2228,6 +2231,12 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Jun 24 2021 Severin Gehwolf <sgehwolf(a)redhat.com> -
1:17.0.0.0.26-0.2.ea.rolling
+- Re-enable TestSecurityProperties after inclusion of PR3695
+
+* Thu Jun 24 2021 Andrew Hughes <gnu.andrew(a)redhat.com> -
1:17.0.0.0.26-0.2.ea.rolling
+- Add PR3695 to allow the system crypto policy to be turned off
+
* Thu Jun 24 2021 Severin Gehwolf <sgehwolf(a)redhat.com> -
1:17.0.0.0.26-0.1.ea.rolling
- Update buildjdkver to 17 so as to build with itself
diff --git a/pr3695-toggle_system_crypto_policy.patch
b/pr3695-toggle_system_crypto_policy.patch
new file mode 100644
index 0000000..3799237
--- /dev/null
+++ b/pr3695-toggle_system_crypto_policy.patch
@@ -0,0 +1,78 @@
+# HG changeset patch
+# User andrew
+# Date 1545198926 0
+# Wed Dec 19 05:55:26 2018 +0000
+# Node ID f2cbd688824c128db7fa848c8732fb0ab3507776
+# Parent 81f07f6d1f8b7b51b136d3974c61bc8bb513770c
+PR3695: Allow use of system crypto policy to be disabled by the user
+Summary: Read user overrides first so security.useSystemPropertiesFile can be disabled
and add -Djava.security.disableSystemPropertiesFile
+
+diff --git a/src/java.base/share/classes/java/security/Security.java
b/src/java.base/share/classes/java/security/Security.java
+--- a/src/java.base/share/classes/java/security/Security.java
++++ b/src/java.base/share/classes/java/security/Security.java
+@@ -125,31 +125,6 @@
+ }
+
+ if ("true".equalsIgnoreCase(props.getProperty
+- ("security.useSystemPropertiesFile"))) {
+-
+- // now load the system file, if it exists, so its values
+- // will win if they conflict with the earlier values
+- try (BufferedInputStream bis =
+- new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
+- props.load(bis);
+- loadedProps = true;
+-
+- if (sdebug != null) {
+- sdebug.println("reading system security properties file "
+
+- SYSTEM_PROPERTIES);
+- sdebug.println(props.toString());
+- }
+- } catch (IOException e) {
+- if (sdebug != null) {
+- sdebug.println
+- ("unable to load security properties from " +
+- SYSTEM_PROPERTIES);
+- e.printStackTrace();
+- }
+- }
+- }
+-
+- if ("true".equalsIgnoreCase(props.getProperty
+ ("security.overridePropertiesFile"))) {
+
+ String extraPropFile = System.getProperty
+@@ -215,6 +190,33 @@
+ }
+ }
+
++ String disableSystemProps =
System.getProperty("java.security.disableSystemPropertiesFile");
++ if (disableSystemProps == null &&
++ "true".equalsIgnoreCase(props.getProperty
++ ("security.useSystemPropertiesFile"))) {
++
++ // now load the system file, if it exists, so its values
++ // will win if they conflict with the earlier values
++ try (BufferedInputStream bis =
++ new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
++ props.load(bis);
++ loadedProps = true;
++
++ if (sdebug != null) {
++ sdebug.println("reading system security properties file "
+
++ SYSTEM_PROPERTIES);
++ sdebug.println(props.toString());
++ }
++ } catch (IOException e) {
++ if (sdebug != null) {
++ sdebug.println
++ ("unable to load security properties from " +
++ SYSTEM_PROPERTIES);
++ e.printStackTrace();
++ }
++ }
++ }
++
+ if (!loadedProps) {
+ initializeStatic();
+ if (sdebug != null) {
commit 483738b04c7c4d59edbdb82f8f6df1ffdfab11ea
Author: Severin Gehwolf <sgehwolf(a)redhat.com>
Date: Thu Jun 24 14:39:12 2021 +0200
Update buildjdkver to 17
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 5c84136..9e89d2a 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -285,7 +285,7 @@
# buildjdkver is usually same as %%{featurever},
# but in time of bootstrap of next jdk, it is featurever-1,
# and this it is better to change it here, on single place
-%global buildjdkver 16
+%global buildjdkver 17
# We don't add any LTS designator for STS packages (this package).
# Neither for Fedora nor EPEL which would have %%{rhel} macro defined.
%global lts_designator ""
@@ -300,7 +300,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 26
-%global rpmrelease 0
+%global rpmrelease 1
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -2228,6 +2228,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Jun 24 2021 Severin Gehwolf <sgehwolf(a)redhat.com> -
1:17.0.0.0.26-0.1.ea.rolling
+- Update buildjdkver to 17 so as to build with itself
+
* Fri Jun 11 2021 Petra Alice Mikova <pmikova(a)redhat.com> -
1:17.0.0.0.26-0.0.ea.rolling
- update sources to jdk 17.0.0+26
- set is_ga to 0, as this is early access build
commit 50793efd8e987ba31a8c5897594b6b7660e234a0
Author: Petra Mikova <pmikova(a)redhat.com>
Date: Mon Jun 21 14:11:16 2021 +0200
Fix bogus date in changelog to get rid of the warning
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index f4f5280..5c84136 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -2243,7 +2243,7 @@ cjc.mainProgram(args)
* Fri May 07 2021 Jiri Vanek <jvanek(a)redhat.com> -1:16.0.1.0.9-3.rolling
- removed cjc backward comaptiblity, to fix when both rpm 4.16 and 4.17 are in
transaction
-* Fri Apr 29 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:16.0.1.0.9-2.rolling
+* Thu Apr 29 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:16.0.1.0.9-2.rolling
- adapted to newst cjc to fix issue with rpm 4.17
- Disable copy-jdk-configs for Flatpak builds
commit 796870d0a2eac1127d70a1ceb68746ee1be719e2
Author: Petra Mikova <pmikova(a)redhat.com>
Date: Fri Jun 11 11:56:54 2021 +0200
Update to JDK 17
Change path to version-number.conf
Bump sources to 17.0.0+26
Change vendor_version_string
Set is_ga to 0, as this is early access build
removed rmid binary from files and from slaves
removed JAVAC_FLAGS=-g from make command, as it breaks the build since JDK-8258407
add lib/libsyslookup.so to files
renamed lib/security/blacklisted.certs to lib/security/blocked.certs
add lib/libsvml.so for intel
skip debuginfo check for libsyslookup.so on s390x
diff --git a/.gitignore b/.gitignore
index ee2518e..620751c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,3 +15,4 @@
/jdk-updates-jdk15u-jdk-15.0.2+7.tar.xz
/openjdk-jdk16-jdk-16+36.tar.xz
/openjdk-jdk16u-jdk-16.0.1+9.tar.xz
+/openjdk-jdk17-jdk-17+26.tar.xz
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 4c02b82..f4f5280 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -125,6 +125,8 @@
%global zgc_arches x86_64
# Set of architectures for which alt-java has SSB mitigation
%global ssbd_arches x86_64
+# Set of architectures for which java has short vector math library (libsvml.so)
+%global svml_arches x86_64
# By default, we build a debug build during main build on JIT architectures
%if %{with slowdebug}
@@ -272,14 +274,14 @@
%endif
# New Version-String scheme-style defines
-%global featurever 16
+%global featurever 17
%global interimver 0
-%global updatever 1
+%global updatever 0
%global patchver 0
# If you bump featurever, you must bump also vendor_version_string
-# Used via new version scheme. JDK 16 was
-# GA'ed in March 2020 => 21.3
-%global vendor_version_string 21.3
+# Used via new version scheme. JDK 17 was
+# GA'ed in September 2021 => 21.9
+%global vendor_version_string 21.9
# buildjdkver is usually same as %%{featurever},
# but in time of bootstrap of next jdk, it is featurever-1,
# and this it is better to change it here, on single place
@@ -297,8 +299,8 @@
%global origin_nice OpenJDK
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver 9
-%global rpmrelease 3
+%global buildver 26
+%global rpmrelease 0
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -321,7 +323,7 @@
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
# - N%%{?extraver}{?dist} for GA releases
-%global is_ga 1
+%global is_ga 0
%if %{is_ga}
%global build_type GA
%global expected_ea_designator ""
@@ -449,7 +451,6 @@ alternatives \\
--slave %{_jvmdir}/jre jre %{_jvmdir}/%{sdkdir -- %{?1}} \\
--slave %{_bindir}/%{alt_java_name} %{alt_java_name} %{jrebindir --
%{?1}}/%{alt_java_name} \\
--slave %{_bindir}/keytool keytool %{jrebindir -- %{?1}}/keytool \\
- --slave %{_bindir}/rmid rmid %{jrebindir -- %{?1}}/rmid \\
--slave %{_bindir}/rmiregistry rmiregistry %{jrebindir -- %{?1}}/rmiregistry \\
--slave %{_mandir}/man1/java.1$ext java.1$ext \\
%{_mandir}/man1/java-%{uniquesuffix -- %{?1}}.1$ext \\
@@ -457,8 +458,6 @@ alternatives \\
%{_mandir}/man1/%{alt_java_name}-%{uniquesuffix -- %{?1}}.1$ext \\
--slave %{_mandir}/man1/keytool.1$ext keytool.1$ext \\
%{_mandir}/man1/keytool-%{uniquesuffix -- %{?1}}.1$ext \\
- --slave %{_mandir}/man1/rmid.1$ext rmid.1$ext \\
- %{_mandir}/man1/rmid-%{uniquesuffix -- %{?1}}.1$ext \\
--slave %{_mandir}/man1/rmiregistry.1$ext rmiregistry.1$ext \\
%{_mandir}/man1/rmiregistry-%{uniquesuffix -- %{?1}}.1$ext
@@ -515,9 +514,6 @@ ext=.gz
alternatives \\
--install %{_bindir}/javac javac %{sdkbindir -- %{?1}}/javac $PRIORITY --family
%{name}.%{_arch} \\
--slave %{_jvmdir}/java java_sdk %{_jvmdir}/%{sdkdir -- %{?1}} \\
-%ifarch %{aot_arches}
- --slave %{_bindir}/jaotc jaotc %{sdkbindir -- %{?1}}/jaotc \\
-%endif
--slave %{_bindir}/jlink jlink %{sdkbindir -- %{?1}}/jlink \\
--slave %{_bindir}/jmod jmod %{sdkbindir -- %{?1}}/jmod \\
%ifarch %{sa_arches}
@@ -669,7 +665,6 @@ exit 0
%{_jvmdir}/%{sdkdir -- %{?1}}/bin/java
%{_jvmdir}/%{sdkdir -- %{?1}}/bin/%{alt_java_name}
%{_jvmdir}/%{sdkdir -- %{?1}}/bin/keytool
-%{_jvmdir}/%{sdkdir -- %{?1}}/bin/rmid
%{_jvmdir}/%{sdkdir -- %{?1}}/bin/rmiregistry
%dir %{_jvmdir}/%{sdkdir -- %{?1}}/lib
%ifarch %{jit_arches}
@@ -715,6 +710,10 @@ exit 0
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsaproc.so
%endif
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsctp.so
+%ifarch %{svml_arches}
+%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsvml.so
+%endif
+%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsyslookup.so
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libverify.so
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libzip.so
%dir %{_jvmdir}/%{sdkdir -- %{?1}}/lib/jfr
@@ -723,7 +722,6 @@ exit 0
%{_mandir}/man1/java-%{uniquesuffix -- %{?1}}.1*
%{_mandir}/man1/%{alt_java_name}-%{uniquesuffix -- %{?1}}.1*
%{_mandir}/man1/keytool-%{uniquesuffix -- %{?1}}.1*
-%{_mandir}/man1/rmid-%{uniquesuffix -- %{?1}}.1*
%{_mandir}/man1/rmiregistry-%{uniquesuffix -- %{?1}}.1*
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/server/
%ifarch %{share_arches}
@@ -742,7 +740,7 @@ exit 0
%dir %{etcjavadir -- %{?1}}/conf/security/policy/limited
%dir %{etcjavadir -- %{?1}}/conf/security/policy/unlimited
%config(noreplace) %{etcjavadir -- %{?1}}/lib/security/default.policy
-%config(noreplace) %{etcjavadir -- %{?1}}/lib/security/blacklisted.certs
+%config(noreplace) %{etcjavadir -- %{?1}}/lib/security/blocked.certs
%config(noreplace) %{etcjavadir -- %{?1}}/lib/security/public_suffix_list.dat
%config(noreplace) %{etcjavadir --
%{?1}}/conf/security/policy/limited/exempt_local.policy
%config(noreplace) %{etcjavadir --
%{?1}}/conf/security/policy/limited/default_local.policy
@@ -811,9 +809,6 @@ exit 0
%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jstat
%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jstatd
%{_jvmdir}/%{sdkdir -- %{?1}}/bin/serialver
-%ifarch %{aot_arches}
-%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jaotc
-%endif
%{_jvmdir}/%{sdkdir -- %{?1}}/include
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/ct.sym
%if %{with_systemtap}
@@ -843,9 +838,6 @@ exit 0
%{_mandir}/man1/jmod-%{uniquesuffix -- %{?1}}.1.gz
%{_mandir}/man1/jshell-%{uniquesuffix -- %{?1}}.1.gz
%{_mandir}/man1/jfr-%{uniquesuffix -- %{?1}}.1.gz
-%ifarch %{aot_arches}
-%{_mandir}/man1/jaotc-%{uniquesuffix -- %{?1}}.1.gz
-%endif
%if %{with_systemtap}
%dir %{tapsetroot}
@@ -858,7 +850,6 @@ exit 0
%ghost %{_bindir}/javac
%ghost %{_jvmdir}/java
%ghost %{_jvmdir}/%{alt_java_name}
-%ghost %{_bindir}/jaotc
%ghost %{_bindir}/jlink
%ghost %{_bindir}/jmod
%ghost %{_bindir}/jhsdb
@@ -1117,7 +1108,7 @@ URL:
http://openjdk.java.net/
# to regenerate source0 (jdk) run update_package.sh
# update_package.sh contains hard-coded repos, revisions, tags, and projects to
regenerate the source archives
-Source0:
openjdk-jdk%{featurever}u-jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}.tar.xz
+Source0:
openjdk-jdk%{featurever}-jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}.tar.xz
#Source0: openjdk-jdk%{featurever}-jdk-%{filever}+%{buildver}.tar.xz
# Use 'icedtea_sync.sh' to update the following
@@ -1642,7 +1633,7 @@ top_dir_abs_build_path=$(pwd)/%{buildoutputdir -- ${suffix}${loop}}
# default pre-version supplied there (despite
# what the file claims), so we pass it manually
# to configure
-VERSION_FILE=${top_dir_abs_src_path}/make/autoconf/version-numbers
+VERSION_FILE=${top_dir_abs_src_path}/make/conf/version-numbers.conf
if [ -f ${VERSION_FILE} ] ; then
EA_DESIGNATOR=$(grep '^DEFAULT_PROMOTED_VERSION_PRE' ${VERSION_FILE} | cut -d
'=' -f 2)
else
@@ -1695,7 +1686,6 @@ bash ${top_dir_abs_src_path}/configure \
--disable-warnings-as-errors
make \
- JAVAC_FLAGS=-g \
LOG=trace \
WARNINGS_ARE_ERRORS="-Wno-error" \
CFLAGS_WARNINGS_ARE_ERRORS="-Wno-error" \
@@ -1797,6 +1787,14 @@ do
# All these tests rely on RPM failing the build if the exit code of any set
# of piped commands is non-zero.
+ # If this is the empty library, libsyslookup.so, of the foreign function and memory
+ # API incubation module (JEP 412), skip the debuginfo check as this seems unreliable
+ # on s390x. It's not very useful for other arches either, so skip
unconditionally.
+ if [ "`basename $lib`" = "libsyslookup.so" ]; then
+ echo "Skipping debuginfo check for empty library
'libsyslookup.so'"
+ continue
+ fi
+
# Test for .debug_* sections in the shared object. This is the main test
# Stripped objects will not contain these
eu-readelf -S "$lib" | grep "] .debug_"
@@ -2230,12 +2228,23 @@ cjc.mainProgram(args)
%endif
%changelog
-* Fri May 07 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:16.0.1.0.9-2.rolling
+* Fri Jun 11 2021 Petra Alice Mikova <pmikova(a)redhat.com> -
1:17.0.0.0.26-0.0.ea.rolling
+- update sources to jdk 17.0.0+26
+- set is_ga to 0, as this is early access build
+- change vendor_version_string
+- change path to the version-numbers.conf
+- removed rmid binary from files and from slaves
+- removed JAVAC_FLAGS=-g from make command, as it breaks the build since JDK-8258407
+- add lib/libsyslookup.so to files
+- renamed lib/security/blacklisted.certs to lib/security/blocked.certs
+- add lib/libsvml.so for intel
+- skip debuginfo check for libsyslookup.so on s390x
+
+* Fri May 07 2021 Jiri Vanek <jvanek(a)redhat.com> -1:16.0.1.0.9-3.rolling
- removed cjc backward comaptiblity, to fix when both rpm 4.16 and 4.17 are in
transaction
* Fri Apr 29 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:16.0.1.0.9-2.rolling
-- adapted to debug handling in newer cjc
-- The rest of the "rpm 4.17" patch must NOT be backported, as on rpm 4.16 and
down, it would casue double execution
+- adapted to newst cjc to fix issue with rpm 4.17
- Disable copy-jdk-configs for Flatpak builds
* Sun Apr 25 2021 Petra Alice Mikova <pmikova(a)redhat.com> - 1:16.0.1.0.9-1.rolling
diff --git a/sources b/sources
index 0349b1c..4bb4cd6 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (openjdk-jdk16u-jdk-16.0.1+9.tar.xz) =
ff06d5c97377cac4d5e8921766c61d4d96dc0c968913263b5371f0d3d0e98bb6a5ccf5b1cbb3ddaff3380bf4499ff6501e73f96e0e922b2294d1f7c1ec3eee23
+SHA512 (openjdk-jdk17-jdk-17+26.tar.xz) =
a400889ba4f141ecf29e46e42f2b2a07ba6df0760502467e7925a31e88ec6fa07deec99f919a42fd673b30df5c86f2adf5e0dcb00687404f0715527b79f2fec7
commit 010e57f9f60e764187162c5851ecf248dc1f4f6f
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Thu Sep 2 12:48:21 2021 +0200
Revert "Fix patch
rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch"
This reverts commit 167363c8ad14a7beb89c5bd8755126d62414e110.
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 499b56b..4c02b82 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 9
-%global rpmrelease 4
+%global rpmrelease 3
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -2230,10 +2230,6 @@ cjc.mainProgram(args)
%endif
%changelog
-* Thu Jun 17 2021 Petra Alice Mikova <pmikova(a)redhat.com> - 1:16.0.1.0.9-4.rolling
-- fix patch rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch which
made the SunPKCS provider show up again
-- Resolves: rhbz#1971120
-
* Fri May 07 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:16.0.1.0.9-2.rolling
- removed cjc backward comaptiblity, to fix when both rpm 4.16 and 4.17 are in
transaction
diff --git a/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
b/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
index 7be1fae..ef4c828 100644
--- a/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
+++ b/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
@@ -1,11 +1,11 @@
-diff --git openjdk/src/java.base/share/conf/security/java.security
openjdk/src/java.base/share/conf/security/java.security
-index 534bdae5a16..2df2b59cbf6 100644
---- openjdk/src/java.base/share/conf/security/java.security
-+++ openjdk/src/java.base/share/conf/security/java.security
-@@ -78,6 +78,7 @@ security.provider.tbd=SunMSCAPI
+diff -r e3f940bd3c8f src/java.base/share/conf/security/java.security
+--- openjdk/src/java.base/share/conf/security/java.security Thu Jun 11 21:54:51 2020
+0530
++++ openjdk/src/java.base/share/conf/security/java.security Mon Aug 24 10:14:31 2020
+0200
+@@ -77,7 +77,7 @@
+ #ifdef macosx
security.provider.tbd=Apple
#endif
- security.provider.tbd=SunPKCS11
+-security.provider.tbd=SunPKCS11
+#security.provider.tbd=SunPKCS11 ${java.home}/lib/security/nss.cfg
#
commit ccbe3cb9b0b52ff960d5559ae996b52b4cdff152
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Thu Sep 2 12:48:19 2021 +0200
Revert "Fix bogus date in changelog to get rid of the warning"
This reverts commit a761355093577c55958f53366cfe52340c85f53c.
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 8684e90..499b56b 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -2237,7 +2237,7 @@ cjc.mainProgram(args)
* Fri May 07 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:16.0.1.0.9-2.rolling
- removed cjc backward comaptiblity, to fix when both rpm 4.16 and 4.17 are in
transaction
-* Thu Apr 29 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:16.0.1.0.9-2.rolling
+* Fri Apr 29 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:16.0.1.0.9-2.rolling
- adapted to debug handling in newer cjc
- The rest of the "rpm 4.17" patch must NOT be backported, as on rpm 4.16 and
down, it would casue double execution
- Disable copy-jdk-configs for Flatpak builds
commit dfa89a1027fa69c6ad35fd3a32a76065903602fd
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Thu Sep 2 12:48:17 2021 +0200
Revert "Added fips pathces and adapted specfile"
This reverts commit 987310ef1d80e11a2555b75594dd55bfcd787c71.
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index ef90def..8684e90 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -754,9 +754,8 @@ exit 0
%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/java.security
%config(noreplace) %{etcjavadir -- %{?1}}/conf/logging.properties
%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/nss.cfg
-%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/nss.fips.cfg
%config(noreplace) %{etcjavadir -- %{?1}}/conf/management/jmxremote.access
-# this is conifg template, thus not config-noreplace
+# these are config templates, thus not config-noreplace
%config %{etcjavadir -- %{?1}}/conf/management/jmxremote.password.template
%config %{etcjavadir -- %{?1}}/conf/sdp/sdp.conf.template
%config(noreplace) %{etcjavadir -- %{?1}}/conf/management/management.properties
@@ -977,8 +976,6 @@ OrderWithRequires: copy-jdk-configs
%endif
# for printing support
Requires: cups-libs
-# for FIPS PKCS11 provider
-Requires: nss
# Post requires alternatives to install tool alternatives
Requires(post): %{alternatives_requires}
# Postun requires alternatives to uninstall tool alternatives
@@ -1146,11 +1143,8 @@ Source13: TestCryptoLevel.java
# Ensure ECDSA is working
Source14: TestECDSA.java
-# nss fips configuration file
-Source15: nss.fips.cfg.in
-
# Verify system crypto (policy) can be disabled via a property
-Source17: TestSecurityProperties.java
+Source15: TestSecurityProperties.java
############################################
#
@@ -1158,31 +1152,21 @@ Source17: TestSecurityProperties.java
#
############################################
+# NSS via SunPKCS11 Provider (disabled comment
+# due to memory leak).
+Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
+# enable build of speculative store bypass hardened alt-java
+Patch600: rh1750419-redhat_alt_java.patch
+
# Ignore AWTError when assistive technologies are loaded
Patch1: rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
# Restrict access to java-atk-wrapper classes
Patch2: rh1648644-java_access_bridge_privileged_security.patch
-# NSS via SunPKCS11 Provider (disabled due to memory leak).
-Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
-# enable build of speculative store bypass hardened alt-java
-Patch600: rh1750419-redhat_alt_java.patch
Patch3:
rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
# Follow system wide crypto policy RHBZ#1249083
Patch4: pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch
# Depend on pcs-lite-libs instead of pcs-lite-devel as this is only in optional repo
Patch6:
rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
-# RH1582504: Use RSA as default for keytool, as DSA is disabled in all crypto policies
except LEGACY
-Patch1003: rh1842572-rsa_default_for_keytool.patch
-
-# FIPS support patches
-# RH1655466: Support RHEL FIPS mode using SunPKCS11 provider
-Patch1001: rh1655466-global_crypto_and_fips.patch
-# RH1818909: No ciphersuites availale for SSLSocket in FIPS mode
-Patch1002: rh1818909-fips_default_keystore_type.patch
-# RH1860986: Disable TLSv1.3 with the NSS-FIPS provider until PKCS#11 v3.0 support is
available
-Patch1004: rh1860986-disable_tlsv1.3_in_fips_mode.patch
-# RH1915071: Always initialise JavaSecuritySystemConfiguratorAccess
-Patch1007: rh1915071-always_initialise_configurator_access.patch
#############################################
#
@@ -1543,11 +1527,6 @@ popd # openjdk
%patch1000
%patch600
-%patch1001
-%patch1002
-%patch1003
-%patch1004
-%patch1007
# Extract systemtap tapsets
%if %{with_systemtap}
@@ -1596,9 +1575,6 @@ done
# Setup nss.cfg
sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE11} > nss.cfg
-# Setup nss.fips.cfg
-sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE15} > nss.fips.cfg
-sed -i -e "s:@NSS_SECMOD@:/etc/pki/nssdb:g" nss.fips.cfg
%build
# How many CPU's do we have?
@@ -1753,9 +1729,6 @@ export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage}
# Install nss.cfg right away as we will be using the JRE above
install -m 644 nss.cfg $JAVA_HOME/conf/security/
-# Install nss.fips.cfg: NSS configuration for global FIPS mode (crypto-policies)
-install -m 644 nss.fips.cfg $JAVA_HOME/conf/security/
-
# Use system-wide tzdata
rm $JAVA_HOME/lib/tzdb.dat
ln -s %{_datadir}/javazi-1.8/tzdb.dat $JAVA_HOME/lib/tzdb.dat
@@ -1796,8 +1769,8 @@ $JAVA_HOME/bin/javac -d . %{SOURCE14}
$JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||")
# Check system crypto (policy) can be disabled
-$JAVA_HOME/bin/javac -d . %{SOURCE17}
-$JAVA_HOME/bin/java -Djava.security.disableSystemPropertiesFile=true $(echo $(basename
%{SOURCE17})|sed "s|\.java||") || echo "crypto policy are now not honored
i jdk15"
+$JAVA_HOME/bin/javac -d . %{SOURCE15}
+$JAVA_HOME/bin/java -Djava.security.disableSystemPropertiesFile=true $(echo $(basename
%{SOURCE15})|sed "s|\.java||") || echo "crypto policy are now not honored
i jdk15"
# Check java launcher has no SSB mitigation
if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi
@@ -2257,19 +2230,16 @@ cjc.mainProgram(args)
%endif
%changelog
-* Tue Jun 29 2021 Jiri Vanek <jvanek(a)redhat.com> -1:16.0.1.0.9-5.rolling
-- renamed source15 to source17 to match el8
-- added fips support
-
* Thu Jun 17 2021 Petra Alice Mikova <pmikova(a)redhat.com> - 1:16.0.1.0.9-4.rolling
- fix patch rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch which
made the SunPKCS provider show up again
- Resolves: rhbz#1971120
-* Fri May 07 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:16.0.1.0.9-3.rolling
+* Fri May 07 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:16.0.1.0.9-2.rolling
- removed cjc backward comaptiblity, to fix when both rpm 4.16 and 4.17 are in
transaction
* Thu Apr 29 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:16.0.1.0.9-2.rolling
-- adapted to newst cjc to fix issue with rpm 4.17
+- adapted to debug handling in newer cjc
+- The rest of the "rpm 4.17" patch must NOT be backported, as on rpm 4.16 and
down, it would casue double execution
- Disable copy-jdk-configs for Flatpak builds
* Sun Apr 25 2021 Petra Alice Mikova <pmikova(a)redhat.com> - 1:16.0.1.0.9-1.rolling
diff --git a/nss.fips.cfg.in b/nss.fips.cfg.in
deleted file mode 100644
index ead27be..0000000
--- a/nss.fips.cfg.in
+++ /dev/null
@@ -1,6 +0,0 @@
-name = NSS-FIPS
-nssLibraryDirectory = @NSS_LIBDIR@
-nssSecmodDirectory = @NSS_SECMOD@
-nssDbMode = readOnly
-nssModule = fips
-
diff --git a/rh1655466-global_crypto_and_fips.patch
b/rh1655466-global_crypto_and_fips.patch
deleted file mode 100644
index 8bf1ced..0000000
--- a/rh1655466-global_crypto_and_fips.patch
+++ /dev/null
@@ -1,205 +0,0 @@
-diff --git a/src/java.base/share/classes/javopenjdk.orig///security/Security.java
openjdk///src/java.base/share/classes/java/security/Security.java
---- openjdk.orig/src/java.base/share/classes/java/security/Security.java
-+++ openjdk/src/java.base/share/classes/java/security/Security.java
-@@ -196,26 +196,8 @@
- if (disableSystemProps == null &&
- "true".equalsIgnoreCase(props.getProperty
- ("security.useSystemPropertiesFile"))) {
--
-- // now load the system file, if it exists, so its values
-- // will win if they conflict with the earlier values
-- try (BufferedInputStream bis =
-- new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
-- props.load(bis);
-+ if (SystemConfigurator.configure(props)) {
- loadedProps = true;
--
-- if (sdebug != null) {
-- sdebug.println("reading system security properties file "
+
-- SYSTEM_PROPERTIES);
-- sdebug.println(props.toString());
-- }
-- } catch (IOException e) {
-- if (sdebug != null) {
-- sdebug.println
-- ("unable to load security properties from " +
-- SYSTEM_PROPERTIES);
-- e.printStackTrace();
-- }
- }
- }
-
-diff --git
a/src/java.base/share/classes/javopenjdk.orig///security/SystemConfigurator.java
openjdk///src/java.base/share/classes/java/security/SystemConfigurator.java
-new file mode 100644
---- /dev/null
-+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
-@@ -0,0 +1,151 @@
-+/*
-+ * Copyright (c) 2019, Red Hat, Inc.
-+ *
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit
www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+package java.security;
-+
-+import java.io.BufferedInputStream;
-+import java.io.FileInputStream;
-+import java.io.IOException;
-+
-+import java.nio.file.Files;
-+import java.nio.file.Path;
-+
-+import java.util.Iterator;
-+import java.util.Map.Entry;
-+import java.util.Properties;
-+import java.util.function.Consumer;
-+import java.util.regex.Matcher;
-+import java.util.regex.Pattern;
-+
-+import sun.security.util.Debug;
-+
-+/**
-+ * Internal class to align OpenJDK with global crypto-policies.
-+ * Called from java.security.Security class initialization,
-+ * during startup.
-+ *
-+ */
-+
-+class SystemConfigurator {
-+
-+ private static final Debug sdebug =
-+ Debug.getInstance("properties");
-+
-+ private static final String CRYPTO_POLICIES_BASE_DIR =
-+ "/etc/crypto-policies";
-+
-+ private static final String CRYPTO_POLICIES_JAVA_CONFIG =
-+ CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config";
-+
-+ private static final String CRYPTO_POLICIES_CONFIG =
-+ CRYPTO_POLICIES_BASE_DIR + "/config";
-+
-+ private static final class SecurityProviderInfo {
-+ int number;
-+ String key;
-+ String value;
-+ SecurityProviderInfo(int number, String key, String value) {
-+ this.number = number;
-+ this.key = key;
-+ this.value = value;
-+ }
-+ }
-+
-+ /*
-+ * Invoked when java.security.Security class is initialized, if
-+ * java.security.disableSystemPropertiesFile property is not set and
-+ * security.useSystemPropertiesFile is true.
-+ */
-+ static boolean configure(Properties props) {
-+ boolean loadedProps = false;
-+
-+ try (BufferedInputStream bis =
-+ new BufferedInputStream(
-+ new FileInputStream(CRYPTO_POLICIES_JAVA_CONFIG))) {
-+ props.load(bis);
-+ loadedProps = true;
-+ if (sdebug != null) {
-+ sdebug.println("reading system security properties file " +
-+ CRYPTO_POLICIES_JAVA_CONFIG);
-+ sdebug.println(props.toString());
-+ }
-+ } catch (IOException e) {
-+ if (sdebug != null) {
-+ sdebug.println("unable to load security properties from " +
-+ CRYPTO_POLICIES_JAVA_CONFIG);
-+ e.printStackTrace();
-+ }
-+ }
-+
-+ try {
-+ if (enableFips()) {
-+ if (sdebug != null) { sdebug.println("FIPS mode detected"); }
-+ loadedProps = false;
-+ // Remove all security providers
-+ Iterator<Entry<Object, Object>> i =
props.entrySet().iterator();
-+ while (i.hasNext()) {
-+ Entry<Object, Object> e = i.next();
-+ if (((String) e.getKey()).startsWith("security.provider"))
{
-+ if (sdebug != null) { sdebug.println("Removing provider:
" + e); }
-+ i.remove();
-+ }
-+ }
-+ // Add FIPS security providers
-+ String fipsProviderValue = null;
-+ for (int n = 1;
-+ (fipsProviderValue = (String) props.get("fips.provider."
+ n)) != null; n++) {
-+ String fipsProviderKey = "security.provider." + n;
-+ if (sdebug != null) {
-+ sdebug.println("Adding provider " + n + ": "
+
-+ fipsProviderKey + "=" + fipsProviderValue);
-+ }
-+ props.put(fipsProviderKey, fipsProviderValue);
-+ }
-+ loadedProps = true;
-+ }
-+ } catch (Exception e) {
-+ if (sdebug != null) {
-+ sdebug.println("unable to load FIPS configuration");
-+ e.printStackTrace();
-+ }
-+ }
-+ return loadedProps;
-+ }
-+
-+ /*
-+ * FIPS is enabled only if crypto-policies are set to "FIPS"
-+ * and the com.redhat.fips property is true.
-+ */
-+ private static boolean enableFips() throws Exception {
-+ boolean fipsEnabled =
Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
-+ if (fipsEnabled) {
-+ String cryptoPoliciesConfig = new
String(Files.readAllBytes(Path.of(CRYPTO_POLICIES_CONFIG)));
-+ if (sdebug != null) { sdebug.println("Crypto config:\n" +
cryptoPoliciesConfig); }
-+ Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
-+ return pattern.matcher(cryptoPoliciesConfig).find();
-+ } else {
-+ return false;
-+ }
-+ }
-+}
-diff --git openjdk.orig///src/java.base/share/conf/security/java.security
openjdk///src/java.base/share/conf/security/java.security
---- openjdk.orig/src/java.base/share/conf/security/java.security
-+++ openjdk/src/java.base/share/conf/security/java.security
-@@ -87,6 +87,14 @@
- #security.provider.tbd=SunPKCS11 ${java.home}/lib/security/nss.cfg
-
- #
-+# Security providers used when global crypto-policies are set to FIPS.
-+#
-+fips.provider.1=SunPKCS11 ${java.home}/conf/security/nss.fips.cfg
-+fips.provider.2=SUN
-+fips.provider.3=SunEC
-+fips.provider.4=com.sun.net.ssl.internal.ssl.Provider SunPKCS11-NSS-FIPS
-+
-+#
- # A list of preferred providers for specific algorithms. These providers will
- # be searched for matching algorithms before the list of registered providers.
- # Entries containing errors (parsing, etc) will be ignored. Use the
diff --git a/rh1818909-fips_default_keystore_type.patch
b/rh1818909-fips_default_keystore_type.patch
deleted file mode 100644
index ff34f3e..0000000
--- a/rh1818909-fips_default_keystore_type.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-diff -r 6efbd7b35a10 src/share/classes/java/security/SystemConfigurator.java
---- openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java Thu
Jan 23 18:22:31 2020 -0300
-+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java Mon Mar 02
19:20:17 2020 -0300
-@@ -123,6 +123,33 @@
- }
- props.put(fipsProviderKey, fipsProviderValue);
- }
-+ // Add other security properties
-+ String keystoreTypeValue = (String)
props.get("fips.keystore.type");
-+ if (keystoreTypeValue != null) {
-+ String nonFipsKeystoreType =
props.getProperty("keystore.type");
-+ props.put("keystore.type", keystoreTypeValue);
-+ if (keystoreTypeValue.equals("PKCS11")) {
-+ // If keystore.type is PKCS11, javax.net.ssl.keyStore
-+ // must be "NONE". See JDK-8238264.
-+ System.setProperty("javax.net.ssl.keyStore",
"NONE");
-+ }
-+ if (System.getProperty("javax.net.ssl.trustStoreType") ==
null) {
-+ // If no trustStoreType has been set, use the
-+ // previous keystore.type under FIPS mode. In
-+ // a default configuration, the Trust Store will
-+ // be 'cacerts' (JKS type).
-+ System.setProperty("javax.net.ssl.trustStoreType",
-+ nonFipsKeystoreType);
-+ }
-+ if (sdebug != null) {
-+ sdebug.println("FIPS mode default keystore.type = " +
-+ keystoreTypeValue);
-+ sdebug.println("FIPS mode javax.net.ssl.keyStore = "
+
-+ System.getProperty("javax.net.ssl.keyStore",
""));
-+ sdebug.println("FIPS mode javax.net.ssl.trustStoreType =
" +
-+
System.getProperty("javax.net.ssl.trustStoreType", ""));
-+ }
-+ }
- loadedProps = true;
- }
- } catch (Exception e) {
-diff -r 6efbd7b35a10 src/share/lib/security/java.security-linux
---- openjdk.orig/src/java.base/share/conf/security/java.security Thu Jan 23 18:22:31 2020
-0300
-+++ openjdk/src/java.base/share/conf/security/java.security Mon Mar 02 19:20:17 2020
-0300
-@@ -299,6 +299,11 @@
- keystore.type=pkcs12
-
- #
-+# Default keystore type used when global crypto-policies are set to FIPS.
-+#
-+fips.keystore.type=PKCS11
-+
-+#
- # Controls compatibility mode for JKS and PKCS12 keystore types.
- #
- # When set to 'true', both JKS and PKCS12 keystore types support loading
diff --git a/rh1842572-rsa_default_for_keytool.patch
b/rh1842572-rsa_default_for_keytool.patch
deleted file mode 100644
index 9f1dabc..0000000
--- a/rh1842572-rsa_default_for_keytool.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git openjdk.orig/src/java.base/share/classes/sun/security/tools/keytool/Main.java
openjdk/src/java.base/share/classes/sun/security/tools/keytool/Main.java
---- openjdk.orig/src/java.base/share/classes/sun/security/tools/keytool/Main.java
-+++ openjdk/src/java.base/share/classes/sun/security/tools/keytool/Main.java
-@@ -1135,7 +1135,7 @@
- }
- } else if (command == GENKEYPAIR) {
- if (keyAlgName == null) {
-- keyAlgName = "DSA";
-+ keyAlgName = "RSA";
- }
- doGenKeyPair(alias, dname, keyAlgName, keysize, groupName, sigAlgName);
- kssave = true;
diff --git a/rh1860986-disable_tlsv1.3_in_fips_mode.patch
b/rh1860986-disable_tlsv1.3_in_fips_mode.patch
deleted file mode 100644
index 0a76cad..0000000
--- a/rh1860986-disable_tlsv1.3_in_fips_mode.patch
+++ /dev/null
@@ -1,311 +0,0 @@
-diff -r bbc65dfa59d1 src/java.base/share/classes/java/security/SystemConfigurator.java
---- openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java Thu Jan 23
18:22:31 2020 -0300
-+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java Sat Aug 01
23:16:51 2020 -0300
-@@ -1,11 +1,13 @@
- /*
-- * Copyright (c) 2019, Red Hat, Inc.
-+ * Copyright (c) 2019, 2020, Red Hat, Inc.
- *
- * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
- *
- * This code is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License version 2 only, as
-- * published by the Free Software Foundation.
-+ * published by the Free Software Foundation. Oracle designates this
-+ * particular file as subject to the "Classpath" exception as provided
-+ * by Oracle in the LICENSE file that accompanied this code.
- *
- * This code is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-@@ -34,10 +36,10 @@
- import java.util.Iterator;
- import java.util.Map.Entry;
- import java.util.Properties;
--import java.util.function.Consumer;
--import java.util.regex.Matcher;
- import java.util.regex.Pattern;
-
-+import jdk.internal.misc.SharedSecrets;
-+import jdk.internal.misc.JavaSecuritySystemConfiguratorAccess;
- import sun.security.util.Debug;
-
- /**
-@@ -47,7 +49,7 @@
- *
- */
-
--class SystemConfigurator {
-+final class SystemConfigurator {
-
- private static final Debug sdebug =
- Debug.getInstance("properties");
-@@ -61,15 +63,16 @@
- private static final String CRYPTO_POLICIES_CONFIG =
- CRYPTO_POLICIES_BASE_DIR + "/config";
-
-- private static final class SecurityProviderInfo {
-- int number;
-- String key;
-- String value;
-- SecurityProviderInfo(int number, String key, String value) {
-- this.number = number;
-- this.key = key;
-- this.value = value;
-- }
-+ private static boolean systemFipsEnabled = false;
-+
-+ static {
-+ SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
-+ new JavaSecuritySystemConfiguratorAccess() {
-+ @Override
-+ public boolean isSystemFipsEnabled() {
-+ return SystemConfigurator.isSystemFipsEnabled();
-+ }
-+ });
- }
-
- /*
-@@ -128,9 +131,9 @@
- String nonFipsKeystoreType =
props.getProperty("keystore.type");
- props.put("keystore.type", keystoreTypeValue);
- if (keystoreTypeValue.equals("PKCS11")) {
-- // If keystore.type is PKCS11, javax.net.ssl.keyStore
-- // must be "NONE". See JDK-8238264.
-- System.setProperty("javax.net.ssl.keyStore",
"NONE");
-+ // If keystore.type is PKCS11, javax.net.ssl.keyStore
-+ // must be "NONE". See JDK-8238264.
-+ System.setProperty("javax.net.ssl.keyStore",
"NONE");
- }
- if (System.getProperty("javax.net.ssl.trustStoreType") ==
null) {
- // If no trustStoreType has been set, use the
-@@ -144,12 +147,13 @@
- sdebug.println("FIPS mode default keystore.type = " +
- keystoreTypeValue);
- sdebug.println("FIPS mode javax.net.ssl.keyStore = "
+
-- System.getProperty("javax.net.ssl.keyStore",
""));
-+ System.getProperty("javax.net.ssl.keyStore",
""));
- sdebug.println("FIPS mode javax.net.ssl.trustStoreType =
" +
-
System.getProperty("javax.net.ssl.trustStoreType", ""));
- }
- }
- loadedProps = true;
-+ systemFipsEnabled = true;
- }
- } catch (Exception e) {
- if (sdebug != null) {
-@@ -160,13 +164,30 @@
- return loadedProps;
- }
-
-+ /**
-+ * Returns whether or not global system FIPS alignment is enabled.
-+ *
-+ * Value is always 'false' before java.security.Security class is
-+ * initialized.
-+ *
-+ * Call from out of this package through SharedSecrets:
-+ * SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+ * .isSystemFipsEnabled();
-+ *
-+ * @return a boolean value indicating whether or not global
-+ * system FIPS alignment is enabled.
-+ */
-+ static boolean isSystemFipsEnabled() {
-+ return systemFipsEnabled;
-+ }
-+
- /*
- * FIPS is enabled only if crypto-policies are set to "FIPS"
- * and the com.redhat.fips property is true.
- */
- private static boolean enableFips() throws Exception {
-- boolean fipsEnabled =
Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
-- if (fipsEnabled) {
-+ boolean shouldEnable =
Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
-+ if (shouldEnable) {
- String cryptoPoliciesConfig = new
String(Files.readAllBytes(Path.of(CRYPTO_POLICIES_CONFIG)));
- if (sdebug != null) { sdebug.println("Crypto config:\n" +
cryptoPoliciesConfig); }
- Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
-diff -r bbc65dfa59d1
src/java.base/share/classes/jdk/internal/misc/JavaSecuritySystemConfiguratorAccess.java
---- /dev/null Thu Jan 01 00:00:00 1970 +0000
-+++
openjdk/src/java.base/share/classes/jdk/internal/misc/JavaSecuritySystemConfiguratorAccess.java Sat
Aug 01 23:16:51 2020 -0300
-@@ -0,0 +1,30 @@
-+/*
-+ * Copyright (c) 2020, Red Hat, Inc.
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation. Oracle designates this
-+ * particular file as subject to the "Classpath" exception as provided
-+ * by Oracle in the LICENSE file that accompanied this code.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit
www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+package jdk.internal.misc;
-+
-+public interface JavaSecuritySystemConfiguratorAccess {
-+ boolean isSystemFipsEnabled();
-+}
-diff -r bbc65dfa59d1 src/java.base/share/classes/jdk/internal/misc/SharedSecrets.java
---- openjdk/src/java.base/share/classes/jdk/internal/misc/SharedSecrets.java Thu Jan 23
18:22:31 2020 -0300
-+++ openjdk/src/java.base/share/classes/jdk/internal/misc/SharedSecrets.java Sat Aug 01
23:16:51 2020 -0300
-@@ -76,6 +76,7 @@
- private static JavaIORandomAccessFileAccess javaIORandomAccessFileAccess;
- private static JavaSecuritySignatureAccess javaSecuritySignatureAccess;
- private static JavaxCryptoSealedObjectAccess javaxCryptoSealedObjectAccess;
-+ private static JavaSecuritySystemConfiguratorAccess
javaSecuritySystemConfiguratorAccess;
-
- public static JavaUtilJarAccess javaUtilJarAccess() {
- if (javaUtilJarAccess == null) {
-@@ -361,4 +362,12 @@
- }
- return javaxCryptoSealedObjectAccess;
- }
-+
-+ public static void
setJavaSecuritySystemConfiguratorAccess(JavaSecuritySystemConfiguratorAccess jssca) {
-+ javaSecuritySystemConfiguratorAccess = jssca;
-+ }
-+
-+ public static JavaSecuritySystemConfiguratorAccess
getJavaSecuritySystemConfiguratorAccess() {
-+ return javaSecuritySystemConfiguratorAccess;
-+ }
- }
-diff -r bbc65dfa59d1 src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java
---- openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java Thu Jan 23
18:22:31 2020 -0300
-+++ openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java Sat Aug 01
23:16:51 2020 -0300
-@@ -31,6 +31,7 @@
- import java.security.cert.*;
- import java.util.*;
- import javax.net.ssl.*;
-+import jdk.internal.misc.SharedSecrets;
- import sun.security.action.GetPropertyAction;
- import sun.security.provider.certpath.AlgorithmChecker;
- import sun.security.validator.Validator;
-@@ -542,20 +543,38 @@
-
- static {
- if (SunJSSE.isFIPS()) {
-- supportedProtocols = Arrays.asList(
-- ProtocolVersion.TLS13,
-- ProtocolVersion.TLS12,
-- ProtocolVersion.TLS11,
-- ProtocolVersion.TLS10
-- );
-+ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+ .isSystemFipsEnabled()) {
-+ // RH1860986: TLSv1.3 key derivation not supported with
-+ // the Security Providers available in system FIPS mode.
-+ supportedProtocols = Arrays.asList(
-+ ProtocolVersion.TLS12,
-+ ProtocolVersion.TLS11,
-+ ProtocolVersion.TLS10
-+ );
-
-- serverDefaultProtocols = getAvailableProtocols(
-- new ProtocolVersion[] {
-- ProtocolVersion.TLS13,
-- ProtocolVersion.TLS12,
-- ProtocolVersion.TLS11,
-- ProtocolVersion.TLS10
-- });
-+ serverDefaultProtocols = getAvailableProtocols(
-+ new ProtocolVersion[] {
-+ ProtocolVersion.TLS12,
-+ ProtocolVersion.TLS11,
-+ ProtocolVersion.TLS10
-+ });
-+ } else {
-+ supportedProtocols = Arrays.asList(
-+ ProtocolVersion.TLS13,
-+ ProtocolVersion.TLS12,
-+ ProtocolVersion.TLS11,
-+ ProtocolVersion.TLS10
-+ );
-+
-+ serverDefaultProtocols = getAvailableProtocols(
-+ new ProtocolVersion[] {
-+ ProtocolVersion.TLS13,
-+ ProtocolVersion.TLS12,
-+ ProtocolVersion.TLS11,
-+ ProtocolVersion.TLS10
-+ });
-+ }
- } else {
- supportedProtocols = Arrays.asList(
- ProtocolVersion.TLS13,
-@@ -620,6 +639,16 @@
-
- static ProtocolVersion[] getSupportedProtocols() {
- if (SunJSSE.isFIPS()) {
-+ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+ .isSystemFipsEnabled()) {
-+ // RH1860986: TLSv1.3 key derivation not supported with
-+ // the Security Providers available in system FIPS mode.
-+ return new ProtocolVersion[] {
-+ ProtocolVersion.TLS12,
-+ ProtocolVersion.TLS11,
-+ ProtocolVersion.TLS10
-+ };
-+ }
- return new ProtocolVersion[] {
- ProtocolVersion.TLS13,
- ProtocolVersion.TLS12,
-@@ -949,6 +978,16 @@
-
- static ProtocolVersion[] getProtocols() {
- if (SunJSSE.isFIPS()) {
-+ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+ .isSystemFipsEnabled()) {
-+ // RH1860986: TLSv1.3 key derivation not supported with
-+ // the Security Providers available in system FIPS mode.
-+ return new ProtocolVersion[] {
-+ ProtocolVersion.TLS12,
-+ ProtocolVersion.TLS11,
-+ ProtocolVersion.TLS10
-+ };
-+ }
- return new ProtocolVersion[]{
- ProtocolVersion.TLS13,
- ProtocolVersion.TLS12,
-diff -r bbc65dfa59d1 src/java.base/share/classes/sun/security/ssl/SunJSSE.java
---- openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java Thu Jan 23 18:22:31
2020 -0300
-+++ openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java Sat Aug 01 23:16:51
2020 -0300
-@@ -27,6 +27,8 @@
-
- import java.security.*;
- import java.util.*;
-+
-+import jdk.internal.misc.SharedSecrets;
- import sun.security.rsa.SunRsaSignEntries;
- import static sun.security.util.SecurityConstants.PROVIDER_VER;
- import static sun.security.provider.SunEntries.createAliases;
-@@ -195,8 +197,13 @@
- "sun.security.ssl.SSLContextImpl$TLS11Context", null, null);
- ps("SSLContext", "TLSv1.2",
- "sun.security.ssl.SSLContextImpl$TLS12Context", null, null);
-- ps("SSLContext", "TLSv1.3",
-- "sun.security.ssl.SSLContextImpl$TLS13Context", null, null);
-+ if (!SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+ .isSystemFipsEnabled()) {
-+ // RH1860986: TLSv1.3 key derivation not supported with
-+ // the Security Providers available in system FIPS mode.
-+ ps("SSLContext", "TLSv1.3",
-+ "sun.security.ssl.SSLContextImpl$TLS13Context", null, null);
-+ }
- ps("SSLContext", "TLS",
- "sun.security.ssl.SSLContextImpl$TLSContext",
- (isfips? null : createAliases("SSL")), null);
diff --git a/rh1915071-always_initialise_configurator_access.patch
b/rh1915071-always_initialise_configurator_access.patch
deleted file mode 100644
index 21ced06..0000000
--- a/rh1915071-always_initialise_configurator_access.patch
+++ /dev/null
@@ -1,68 +0,0 @@
-diff --git openjdk.orig/src/java.base/share/classes/java/security/Security.java
openjdk/src/java.base/share/classes/java/security/Security.java
---- openjdk.orig/src/java.base/share/classes/java/security/Security.java
-+++ openjdk/src/java.base/share/classes/java/security/Security.java
-@@ -32,6 +32,7 @@
-
- import jdk.internal.event.EventHelper;
- import jdk.internal.event.SecurityPropertyModificationEvent;
-+import jdk.internal.misc.JavaSecuritySystemConfiguratorAccess;
- import jdk.internal.misc.SharedSecrets;
- import jdk.internal.util.StaticProperty;
- import sun.security.util.Debug;
-@@ -74,6 +75,15 @@
- }
-
- static {
-+ // Initialise here as used by code with system properties disabled
-+ SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
-+ new JavaSecuritySystemConfiguratorAccess() {
-+ @Override
-+ public boolean isSystemFipsEnabled() {
-+ return SystemConfigurator.isSystemFipsEnabled();
-+ }
-+ });
-+
- // doPrivileged here because there are multiple
- // things in initialize that might require privs.
- // (the FileInputStream call and the File.exists call,
-@@ -193,9 +203,8 @@
- }
-
- String disableSystemProps =
System.getProperty("java.security.disableSystemPropertiesFile");
-- if (disableSystemProps == null &&
-- "true".equalsIgnoreCase(props.getProperty
-- ("security.useSystemPropertiesFile"))) {
-+ if ((disableSystemProps == null ||
"false".equalsIgnoreCase(disableSystemProps)) &&
-+
"true".equalsIgnoreCase(props.getProperty("security.useSystemPropertiesFile")))
{
- if (SystemConfigurator.configure(props)) {
- loadedProps = true;
- }
-diff --git openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java
openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
---- openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java
-+++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
-@@ -38,8 +38,6 @@
- import java.util.Properties;
- import java.util.regex.Pattern;
-
--import jdk.internal.misc.SharedSecrets;
--import jdk.internal.misc.JavaSecuritySystemConfiguratorAccess;
- import sun.security.util.Debug;
-
- /**
-@@ -65,16 +63,6 @@
-
- private static boolean systemFipsEnabled = false;
-
-- static {
-- SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
-- new JavaSecuritySystemConfiguratorAccess() {
-- @Override
-- public boolean isSystemFipsEnabled() {
-- return SystemConfigurator.isSystemFipsEnabled();
-- }
-- });
-- }
--
- /*
- * Invoked when java.security.Security class is initialized, if
- * java.security.disableSystemPropertiesFile property is not set and
commit bed2ea1420833862f19966be08f376ec5123277a
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Thu Sep 2 12:48:12 2021 +0200
Revert "Adapted patches to jdk16"
This reverts commit c7fa66aed4f257de6fc607ffcd29dd5eec5bcc8f.
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 57e30d0..ef90def 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -1171,7 +1171,8 @@ Patch3:
rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk1
Patch4: pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch
# Depend on pcs-lite-libs instead of pcs-lite-devel as this is only in optional repo
Patch6:
rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
-Patch7: pr3695-toggle_system_crypto_policy.patch
+# RH1582504: Use RSA as default for keytool, as DSA is disabled in all crypto policies
except LEGACY
+Patch1003: rh1842572-rsa_default_for_keytool.patch
# FIPS support patches
# RH1655466: Support RHEL FIPS mode using SunPKCS11 provider
@@ -1538,13 +1539,13 @@ pushd %{top_level_dir_name}
%patch3 -p1
%patch4 -p1
%patch6 -p1
-%patch7 -p1
popd # openjdk
%patch1000
%patch600
%patch1001
%patch1002
+%patch1003
%patch1004
%patch1007
@@ -2258,12 +2259,7 @@ cjc.mainProgram(args)
%changelog
* Tue Jun 29 2021 Jiri Vanek <jvanek(a)redhat.com> -1:16.0.1.0.9-5.rolling
- renamed source15 to source17 to match el8
-- added fips support:
-- added pr3695-toggle_system_crypto_policy.patch ; missing prerequisity
-- removed rh1655466-global_crypto_and_fips.patch; jdk16 do not have default algorithm, it
throws exception
-- adapted rh1655466-global_crypto_and_fips.patch
-- adapted rh1860986-disable_tlsv1.3_in_fips_mode.patch (?)
-- adapted rh1915071-always_initialise_configurator_access.patch
+- added fips support
* Thu Jun 17 2021 Petra Alice Mikova <pmikova(a)redhat.com> - 1:16.0.1.0.9-4.rolling
- fix patch rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch which
made the SunPKCS provider show up again
diff --git a/pr3695-toggle_system_crypto_policy.patch
b/pr3695-toggle_system_crypto_policy.patch
deleted file mode 100644
index 3799237..0000000
--- a/pr3695-toggle_system_crypto_policy.patch
+++ /dev/null
@@ -1,78 +0,0 @@
-# HG changeset patch
-# User andrew
-# Date 1545198926 0
-# Wed Dec 19 05:55:26 2018 +0000
-# Node ID f2cbd688824c128db7fa848c8732fb0ab3507776
-# Parent 81f07f6d1f8b7b51b136d3974c61bc8bb513770c
-PR3695: Allow use of system crypto policy to be disabled by the user
-Summary: Read user overrides first so security.useSystemPropertiesFile can be disabled
and add -Djava.security.disableSystemPropertiesFile
-
-diff --git a/src/java.base/share/classes/java/security/Security.java
b/src/java.base/share/classes/java/security/Security.java
---- a/src/java.base/share/classes/java/security/Security.java
-+++ b/src/java.base/share/classes/java/security/Security.java
-@@ -125,31 +125,6 @@
- }
-
- if ("true".equalsIgnoreCase(props.getProperty
-- ("security.useSystemPropertiesFile"))) {
--
-- // now load the system file, if it exists, so its values
-- // will win if they conflict with the earlier values
-- try (BufferedInputStream bis =
-- new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
-- props.load(bis);
-- loadedProps = true;
--
-- if (sdebug != null) {
-- sdebug.println("reading system security properties file "
+
-- SYSTEM_PROPERTIES);
-- sdebug.println(props.toString());
-- }
-- } catch (IOException e) {
-- if (sdebug != null) {
-- sdebug.println
-- ("unable to load security properties from " +
-- SYSTEM_PROPERTIES);
-- e.printStackTrace();
-- }
-- }
-- }
--
-- if ("true".equalsIgnoreCase(props.getProperty
- ("security.overridePropertiesFile"))) {
-
- String extraPropFile = System.getProperty
-@@ -215,6 +190,33 @@
- }
- }
-
-+ String disableSystemProps =
System.getProperty("java.security.disableSystemPropertiesFile");
-+ if (disableSystemProps == null &&
-+ "true".equalsIgnoreCase(props.getProperty
-+ ("security.useSystemPropertiesFile"))) {
-+
-+ // now load the system file, if it exists, so its values
-+ // will win if they conflict with the earlier values
-+ try (BufferedInputStream bis =
-+ new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
-+ props.load(bis);
-+ loadedProps = true;
-+
-+ if (sdebug != null) {
-+ sdebug.println("reading system security properties file "
+
-+ SYSTEM_PROPERTIES);
-+ sdebug.println(props.toString());
-+ }
-+ } catch (IOException e) {
-+ if (sdebug != null) {
-+ sdebug.println
-+ ("unable to load security properties from " +
-+ SYSTEM_PROPERTIES);
-+ e.printStackTrace();
-+ }
-+ }
-+ }
-+
- if (!loadedProps) {
- initializeStatic();
- if (sdebug != null) {
diff --git a/rh1655466-global_crypto_and_fips.patch
b/rh1655466-global_crypto_and_fips.patch
index 684c4c4..8bf1ced 100644
--- a/rh1655466-global_crypto_and_fips.patch
+++ b/rh1655466-global_crypto_and_fips.patch
@@ -197,7 +197,7 @@ diff --git
openjdk.orig///src/java.base/share/conf/security/java.security openjd
+fips.provider.1=SunPKCS11 ${java.home}/conf/security/nss.fips.cfg
+fips.provider.2=SUN
+fips.provider.3=SunEC
-+fips.provider.4=SunJSSE SunPKCS11-NSS-FIPS
++fips.provider.4=com.sun.net.ssl.internal.ssl.Provider SunPKCS11-NSS-FIPS
+
+#
# A list of preferred providers for specific algorithms. These providers will
diff --git a/rh1842572-rsa_default_for_keytool.patch
b/rh1842572-rsa_default_for_keytool.patch
new file mode 100644
index 0000000..9f1dabc
--- /dev/null
+++ b/rh1842572-rsa_default_for_keytool.patch
@@ -0,0 +1,12 @@
+diff --git openjdk.orig/src/java.base/share/classes/sun/security/tools/keytool/Main.java
openjdk/src/java.base/share/classes/sun/security/tools/keytool/Main.java
+--- openjdk.orig/src/java.base/share/classes/sun/security/tools/keytool/Main.java
++++ openjdk/src/java.base/share/classes/sun/security/tools/keytool/Main.java
+@@ -1135,7 +1135,7 @@
+ }
+ } else if (command == GENKEYPAIR) {
+ if (keyAlgName == null) {
+- keyAlgName = "DSA";
++ keyAlgName = "RSA";
+ }
+ doGenKeyPair(alias, dname, keyAlgName, keysize, groupName, sigAlgName);
+ kssave = true;
diff --git a/rh1860986-disable_tlsv1.3_in_fips_mode.patch
b/rh1860986-disable_tlsv1.3_in_fips_mode.patch
index b1bf3d6..0a76cad 100644
--- a/rh1860986-disable_tlsv1.3_in_fips_mode.patch
+++ b/rh1860986-disable_tlsv1.3_in_fips_mode.patch
@@ -160,28 +160,20 @@ diff -r bbc65dfa59d1
src/java.base/share/classes/jdk/internal/misc/JavaSecurityS
+public interface JavaSecuritySystemConfiguratorAccess {
+ boolean isSystemFipsEnabled();
+}
-diff -r bbc65dfa59d1 src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
---- openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java Thu Jan 23
18:22:31 2020 -0300
-+++ openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java Sat Aug 01
23:16:51 2020 -0300
-@@ -38,6 +38,7 @@
- import java.io.RandomAccessFile;
- import java.security.ProtectionDomain;
- import java.security.Signature;
-+import jdk.internal.misc.JavaSecuritySystemConfiguratorAccess;
-
- /** A repository of "shared secrets", which are a mechanism for
- calling implementation-private methods in another package without
+diff -r bbc65dfa59d1 src/java.base/share/classes/jdk/internal/misc/SharedSecrets.java
+--- openjdk/src/java.base/share/classes/jdk/internal/misc/SharedSecrets.java Thu Jan 23
18:22:31 2020 -0300
++++ openjdk/src/java.base/share/classes/jdk/internal/misc/SharedSecrets.java Sat Aug 01
23:16:51 2020 -0300
@@ -76,6 +76,7 @@
- private static JavaSecurityAccess javaSecurityAccess;
+ private static JavaIORandomAccessFileAccess javaIORandomAccessFileAccess;
private static JavaSecuritySignatureAccess javaSecuritySignatureAccess;
private static JavaxCryptoSealedObjectAccess javaxCryptoSealedObjectAccess;
+ private static JavaSecuritySystemConfiguratorAccess
javaSecuritySystemConfiguratorAccess;
- public static void setJavaUtilCollectionAccess(JavaUtilCollectionAccess juca) {
- javaUtilCollectionAccess = juca;
+ public static JavaUtilJarAccess javaUtilJarAccess() {
+ if (javaUtilJarAccess == null) {
@@ -361,4 +362,12 @@
- MethodHandles.lookup().ensureInitialized(c);
- } catch (IllegalAccessException e) {}
+ }
+ return javaxCryptoSealedObjectAccess;
}
+
+ public static void
setJavaSecuritySystemConfiguratorAccess(JavaSecuritySystemConfiguratorAccess jssca) {
@@ -196,134 +188,99 @@ diff -r bbc65dfa59d1
src/java.base/share/classes/sun/security/ssl/SSLContextImpl
--- openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java Thu Jan 23
18:22:31 2020 -0300
+++ openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java Sat Aug 01
23:16:51 2020 -0300
@@ -31,6 +31,7 @@
+ import java.security.cert.*;
import java.util.*;
- import java.util.concurrent.locks.ReentrantLock;
import javax.net.ssl.*;
-+import jdk.internal.access.SharedSecrets;
++import jdk.internal.misc.SharedSecrets;
import sun.security.action.GetPropertyAction;
import sun.security.provider.certpath.AlgorithmChecker;
import sun.security.validator.Validator;
-@@ -536,22 +536,42 @@
- private static final List<CipherSuite> serverDefaultCipherSuites;
+@@ -542,20 +543,38 @@
static {
-- supportedProtocols = Arrays.asList(
-- ProtocolVersion.TLS13,
-- ProtocolVersion.TLS12,
-- ProtocolVersion.TLS11,
-- ProtocolVersion.TLS10,
-- ProtocolVersion.SSL30,
-- ProtocolVersion.SSL20Hello
-- );
--
-- serverDefaultProtocols = getAvailableProtocols(
-- new ProtocolVersion[] {
-- ProtocolVersion.TLS13,
-- ProtocolVersion.TLS12,
-- ProtocolVersion.TLS11,
-- ProtocolVersion.TLS10
-- });
-+ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+ .isSystemFipsEnabled()) {
-+ // RH1860986: TLSv1.3 key derivation not supported with
-+ // the Security Providers available in system FIPS mode.
-+ supportedProtocols = Arrays.asList(
-+ ProtocolVersion.TLS12,
-+ ProtocolVersion.TLS11,
-+ ProtocolVersion.TLS10,
-+ ProtocolVersion.SSL30,
-+ ProtocolVersion.SSL20Hello
-+ );
-+
-+ serverDefaultProtocols = getAvailableProtocols(
-+ new ProtocolVersion[] {
-+ ProtocolVersion.TLS12,
-+ ProtocolVersion.TLS11,
-+ ProtocolVersion.TLS10
-+ });
+ if (SunJSSE.isFIPS()) {
+- supportedProtocols = Arrays.asList(
+- ProtocolVersion.TLS13,
+- ProtocolVersion.TLS12,
+- ProtocolVersion.TLS11,
+- ProtocolVersion.TLS10
+- );
++ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
++ .isSystemFipsEnabled()) {
++ // RH1860986: TLSv1.3 key derivation not supported with
++ // the Security Providers available in system FIPS mode.
++ supportedProtocols = Arrays.asList(
++ ProtocolVersion.TLS12,
++ ProtocolVersion.TLS11,
++ ProtocolVersion.TLS10
++ );
+
+- serverDefaultProtocols = getAvailableProtocols(
+- new ProtocolVersion[] {
+- ProtocolVersion.TLS13,
+- ProtocolVersion.TLS12,
+- ProtocolVersion.TLS11,
+- ProtocolVersion.TLS10
+- });
++ serverDefaultProtocols = getAvailableProtocols(
++ new ProtocolVersion[] {
++ ProtocolVersion.TLS12,
++ ProtocolVersion.TLS11,
++ ProtocolVersion.TLS10
++ });
+ } else {
-+ supportedProtocols = Arrays.asList(
-+ ProtocolVersion.TLS13,
-+ ProtocolVersion.TLS12,
-+ ProtocolVersion.TLS11,
-+ ProtocolVersion.TLS10,
-+ ProtocolVersion.SSL30,
-+ ProtocolVersion.SSL20Hello
-+ );
++ supportedProtocols = Arrays.asList(
++ ProtocolVersion.TLS13,
++ ProtocolVersion.TLS12,
++ ProtocolVersion.TLS11,
++ ProtocolVersion.TLS10
++ );
+
-+ serverDefaultProtocols = getAvailableProtocols(
-+ new ProtocolVersion[] {
-+ ProtocolVersion.TLS13,
-+ ProtocolVersion.TLS12,
-+ ProtocolVersion.TLS11,
-+ ProtocolVersion.TLS10
-+ });
-+ }
-
- supportedCipherSuites = getApplicableSupportedCipherSuites(
- supportedProtocols);
-@@ -699,13 +719,26 @@
- private static final List<CipherSuite> clientDefaultCipherSuites;
++ serverDefaultProtocols = getAvailableProtocols(
++ new ProtocolVersion[] {
++ ProtocolVersion.TLS13,
++ ProtocolVersion.TLS12,
++ ProtocolVersion.TLS11,
++ ProtocolVersion.TLS10
++ });
++ }
+ } else {
+ supportedProtocols = Arrays.asList(
+ ProtocolVersion.TLS13,
+@@ -620,6 +639,16 @@
- static {
-- clientDefaultProtocols = getAvailableProtocols(
-- new ProtocolVersion[] {
-- ProtocolVersion.TLS13,
-- ProtocolVersion.TLS12,
-- ProtocolVersion.TLS11,
-- ProtocolVersion.TLS10
-- });
-+ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+ .isSystemFipsEnabled()) {
-+ // RH1860986: TLSv1.3 key derivation not supported with
-+ // the Security Providers available in system FIPS mode.
-+ clientDefaultProtocols = getAvailableProtocols(
-+ new ProtocolVersion[] {
-+ ProtocolVersion.TLS12,
-+ ProtocolVersion.TLS11,
-+ ProtocolVersion.TLS10
-+ });
-+ } else {
-+ clientDefaultProtocols = getAvailableProtocols(
-+ new ProtocolVersion[] {
-+ ProtocolVersion.TLS13,
-+ ProtocolVersion.TLS12,
-+ ProtocolVersion.TLS11,
-+ ProtocolVersion.TLS10
-+ });
-+ }
-+
+ static ProtocolVersion[] getSupportedProtocols() {
+ if (SunJSSE.isFIPS()) {
++ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
++ .isSystemFipsEnabled()) {
++ // RH1860986: TLSv1.3 key derivation not supported with
++ // the Security Providers available in system FIPS mode.
++ return new ProtocolVersion[] {
++ ProtocolVersion.TLS12,
++ ProtocolVersion.TLS11,
++ ProtocolVersion.TLS10
++ };
++ }
+ return new ProtocolVersion[] {
+ ProtocolVersion.TLS13,
+ ProtocolVersion.TLS12,
+@@ -949,6 +978,16 @@
- clientDefaultCipherSuites = getApplicableEnabledCipherSuites(
- clientDefaultProtocols, true);
-@@ -842,12 +875,21 @@
- ProtocolVersion[] candidates;
- if (refactored.isEmpty()) {
- // Client and server use the same default protocols.
-- candidates = new ProtocolVersion[] {
-- ProtocolVersion.TLS13,
-- ProtocolVersion.TLS12,
-- ProtocolVersion.TLS11,
-- ProtocolVersion.TLS10
-- };
-+ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+ .isSystemFipsEnabled()) {
-+ candidates = new ProtocolVersion[] {
-+ ProtocolVersion.TLS12,
-+ ProtocolVersion.TLS11,
-+ ProtocolVersion.TLS10
-+ };
-+ } else {
-+ candidates = new ProtocolVersion[] {
-+ ProtocolVersion.TLS13,
-+ ProtocolVersion.TLS12,
-+ ProtocolVersion.TLS11,
-+ ProtocolVersion.TLS10
-+ };
-+ }
- } else {
- // Use the customized TLS protocols.
- candidates =
+ static ProtocolVersion[] getProtocols() {
+ if (SunJSSE.isFIPS()) {
++ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
++ .isSystemFipsEnabled()) {
++ // RH1860986: TLSv1.3 key derivation not supported with
++ // the Security Providers available in system FIPS mode.
++ return new ProtocolVersion[] {
++ ProtocolVersion.TLS12,
++ ProtocolVersion.TLS11,
++ ProtocolVersion.TLS10
++ };
++ }
+ return new ProtocolVersion[]{
+ ProtocolVersion.TLS13,
+ ProtocolVersion.TLS12,
diff -r bbc65dfa59d1 src/java.base/share/classes/sun/security/ssl/SunJSSE.java
--- openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java Thu Jan 23 18:22:31
2020 -0300
+++ openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java Sat Aug 01 23:16:51
2020 -0300
@@ -332,10 +289,10 @@ diff -r bbc65dfa59d1
src/java.base/share/classes/sun/security/ssl/SunJSSE.java
import java.security.*;
import java.util.*;
+
-+import jdk.internal.access.SharedSecrets;
++import jdk.internal.misc.SharedSecrets;
+ import sun.security.rsa.SunRsaSignEntries;
import static sun.security.util.SecurityConstants.PROVIDER_VER;
-
- /**
+ import static sun.security.provider.SunEntries.createAliases;
@@ -195,8 +197,13 @@
"sun.security.ssl.SSLContextImpl$TLS11Context", null, null);
ps("SSLContext", "TLSv1.2",
@@ -351,4 +308,4 @@ diff -r bbc65dfa59d1
src/java.base/share/classes/sun/security/ssl/SunJSSE.java
+ }
ps("SSLContext", "TLS",
"sun.security.ssl.SSLContextImpl$TLSContext",
- List.of("SSL"), null);
+ (isfips? null : createAliases("SSL")), null);
diff --git a/rh1915071-always_initialise_configurator_access.patch
b/rh1915071-always_initialise_configurator_access.patch
index 36a0b92..21ced06 100644
--- a/rh1915071-always_initialise_configurator_access.patch
+++ b/rh1915071-always_initialise_configurator_access.patch
@@ -6,7 +6,7 @@ diff --git
openjdk.orig/src/java.base/share/classes/java/security/Security.java
import jdk.internal.event.EventHelper;
import jdk.internal.event.SecurityPropertyModificationEvent;
+import jdk.internal.misc.JavaSecuritySystemConfiguratorAccess;
- import jdk.internal.access.SharedSecrets;
+ import jdk.internal.misc.SharedSecrets;
import jdk.internal.util.StaticProperty;
import sun.security.util.Debug;
@@ -74,6 +75,15 @@
commit 66aaf933edcd104cb8bda56956eee5c36b214c8e
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Thu Sep 2 12:48:11 2021 +0200
Revert "bumped release"
This reverts commit 2080b401474a180c3136a40660db87214dea920e.
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index fade353..57e30d0 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 9
-%global rpmrelease 5
+%global rpmrelease 4
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
commit 685de6aecf84aaf30765314069d8383ec23a04bd
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Thu Sep 2 12:48:07 2021 +0200
Revert "bumped to security update of 16.0.2+7 (16.0.2-ga)"
This reverts commit 487aa1654344cbb6fc81e72b4e808f163feae54a.
diff --git a/.gitignore b/.gitignore
index fb1d122..ee2518e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,5 +15,3 @@
/jdk-updates-jdk15u-jdk-15.0.2+7.tar.xz
/openjdk-jdk16-jdk-16+36.tar.xz
/openjdk-jdk16u-jdk-16.0.1+9.tar.xz
-/openjdk-jdk16u-jdk-16.0.2-ga.tar.xz
-/openjdk-jdk16u-jdk-16.0.2+7.tar.xz
diff --git a/generate_source_tarball.sh b/generate_source_tarball.sh
index 569ed31..1a019ff 100755
--- a/generate_source_tarball.sh
+++ b/generate_source_tarball.sh
@@ -130,10 +130,8 @@ pushd "${FILE_NAME_ROOT}"
# get PR3823.patch (from
http://icedtea.classpath.org/hg/icedtea16) from
most correct tag
# Do not push it or publish it (see
https://icedtea.classpath.org/bugzilla/show_bug.cgi?id=3823)
echo "PR3823 not found. Downloading..."
- # wget
https://icedtea.classpath.org/hg/icedtea16/raw-file/tip/patches/pr3823.patch
- # now using backup server... not sure when it will die...
- wget
https://icedtea.wildebeest.org/hg/icedtea16/raw-file/tip/patches/pr3823.p...
- echo "Applying ${PWD}/pr3823.patch"
+ wget
https://icedtea.classpath.org/hg/icedtea16/raw-file/tip/patches/pr3823.patch
+ echo "Applying ${PWD}/pr3823.patch"
patch -Np1 < pr3823.patch
rm pr3823.patch
else
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index a745b2a..fade353 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -274,7 +274,7 @@
# New Version-String scheme-style defines
%global featurever 16
%global interimver 0
-%global updatever 2
+%global updatever 1
%global patchver 0
# If you bump featurever, you must bump also vendor_version_string
# Used via new version scheme. JDK 16 was
@@ -297,8 +297,8 @@
%global origin_nice OpenJDK
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver 7
-%global rpmrelease 1
+%global buildver 9
+%global rpmrelease 5
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -2256,10 +2256,7 @@ cjc.mainProgram(args)
%endif
%changelog
-* Fri Jul 23 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:16.0.2.0.7-1.rolling
-- bumped to security update of 16.0.2-ga
-
-* Tue Jun 29 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:16.0.1.0.9-5.rolling
+* Tue Jun 29 2021 Jiri Vanek <jvanek(a)redhat.com> -1:16.0.1.0.9-5.rolling
- renamed source15 to source17 to match el8
- added fips support:
- added pr3695-toggle_system_crypto_policy.patch ; missing prerequisity
diff --git a/sources b/sources
index f9a2042..0349b1c 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (openjdk-jdk16u-jdk-16.0.2+7.tar.xz) =
9f0db34edcb1ffcd7af159113133677c03edb75990a2f54e60f445942447c7615af799f3229527abe3306ff626fd1cee4afd1ba86a8c799d688802f0e4b6d0d3
+SHA512 (openjdk-jdk16u-jdk-16.0.1+9.tar.xz) =
ff06d5c97377cac4d5e8921766c61d4d96dc0c968913263b5371f0d3d0e98bb6a5ccf5b1cbb3ddaff3380bf4499ff6501e73f96e0e922b2294d1f7c1ec3eee23