The package rpms/java-17-openjdk.git has added or updated architecture specific content in
its
spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s):
https://src.fedoraproject.org/cgit/rpms/java-17-openjdk.git/commit/?id=ea....
Change:
+%ifarch %{gdb_arches}
Thanks.
Full change:
============
commit 62652f81a66eb1e2d824c1b827cedb5abd1a764c
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Tue Jan 18 02:31:53 2022 +0000
Separate crypto policy initialisation from FIPS initialisation, now they are no longer
interdependent
diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec
index 34035d2..5c15daf 100644
--- a/java-17-openjdk.spec
+++ b/java-17-openjdk.spec
@@ -308,7 +308,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 12
-%global rpmrelease 15
+%global rpmrelease 16
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -1179,7 +1179,7 @@ Provides: java-%{origin}-src%{?1} = %{epoch}:%{version}-%{release}
Name: java-17-%{origin}
Version: %{newjavaver}.%{buildver}
-Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}.1
+Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
# java-1.5.0-ibm from
jpackage.org set Epoch to 1 for unknown reasons
# and this change was brought into RHEL-4. java-1.5.0-ibm packages
# also included the epoch in their virtual provides. This created a
@@ -1294,6 +1294,7 @@ Patch1013: rh1991003-enable_fips_keys_import.patch
# RH2021263: Resolve outstanding FIPS issues
Patch1014: rh2021263-fips_ensure_security_initialised.patch
Patch1015: rh2021263-fips_missing_native_returns.patch
+Patch1016: rh2021263-fips_separate_policy_and_fips_init.patch
#############################################
#
@@ -1715,6 +1716,7 @@ popd # openjdk
%patch1013
%patch1014
%patch1015
+%patch1016
%patch2000
@@ -2472,6 +2474,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Mon Jan 24 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-16.rolling
+- Separate crypto policy initialisation from FIPS initialisation, now they are no longer
interdependent
+
* Thu Jan 20 2022 Fedora Release Engineering <releng(a)fedoraproject.org> -
1:17.0.1.0.12-15.rolling.1
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
diff --git a/rh2021263-fips_separate_policy_and_fips_init.patch
b/rh2021263-fips_separate_policy_and_fips_init.patch
new file mode 100644
index 0000000..b5351a8
--- /dev/null
+++ b/rh2021263-fips_separate_policy_and_fips_init.patch
@@ -0,0 +1,99 @@
+commit 0cd8cee94fe0f867b0b39890e00be620af1d9b07
+Author: Andrew Hughes <gnu.andrew(a)redhat.com>
+Date: Tue Jan 18 02:09:27 2022 +0000
+
+ RH2021263: Improve Security initialisation, now FIPS support no longer relies on
crypto policy support
+
+diff --git openjdk.orig/src/java.base/share/classes/java/security/Security.java
openjdk/src/java.base/share/classes/java/security/Security.java
+index 28ab1846173..f9726741afd 100644
+--- openjdk.orig/src/java.base/share/classes/java/security/Security.java
++++ openjdk/src/java.base/share/classes/java/security/Security.java
+@@ -61,10 +61,6 @@ public final class Security {
+ private static final Debug sdebug =
+ Debug.getInstance("properties");
+
+- /* System property file*/
+- private static final String SYSTEM_PROPERTIES =
+- "/etc/crypto-policies/back-ends/java.config";
+-
+ /* The java.security properties */
+ private static Properties props;
+
+@@ -206,22 +202,36 @@ public final class Security {
+ }
+ }
+
++ if (!loadedProps) {
++ initializeStatic();
++ if (sdebug != null) {
++ sdebug.println("unable to load security properties " +
++ "-- using defaults");
++ }
++ }
++
+ String disableSystemProps =
System.getProperty("java.security.disableSystemPropertiesFile");
+ if ((disableSystemProps == null ||
"false".equalsIgnoreCase(disableSystemProps)) &&
+
"true".equalsIgnoreCase(props.getProperty("security.useSystemPropertiesFile")))
{
+- if (SystemConfigurator.configure(props)) {
+- loadedProps = true;
++ if (!SystemConfigurator.configureSysProps(props)) {
++ if (sdebug != null) {
++ sdebug.println("WARNING: System properties could not be
loaded.");
++ }
+ }
+ }
+
+- if (!loadedProps) {
+- initializeStatic();
++ // FIPS support depends on the contents of java.security so
++ // ensure it has loaded first
++ if (loadedProps) {
++ boolean fipsEnabled = SystemConfigurator.configureFIPS(props);
+ if (sdebug != null) {
+- sdebug.println("unable to load security properties " +
+- "-- using defaults");
++ if (fipsEnabled) {
++ sdebug.println("FIPS support enabled.");
++ } else {
++ sdebug.println("FIPS support disabled.");
++ }
+ }
+ }
+-
+ }
+
+ /*
+diff --git openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java
openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
+index 874c6221ebe..b7ed41acf0f 100644
+--- openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java
++++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
+@@ -76,7 +76,7 @@ final class SystemConfigurator {
+ * java.security.disableSystemPropertiesFile property is not set and
+ * security.useSystemPropertiesFile is true.
+ */
+- static boolean configure(Properties props) {
++ static boolean configureSysProps(Properties props) {
+ boolean loadedProps = false;
+
+ try (BufferedInputStream bis =
+@@ -96,11 +96,19 @@ final class SystemConfigurator {
+ e.printStackTrace();
+ }
+ }
++ return loadedProps;
++ }
++
++ /*
++ * Invoked at the end of java.security.Security initialisation
++ * if java.security properties have been loaded
++ */
++ static boolean configureFIPS(Properties props) {
++ boolean loadedProps = false;
+
+ try {
+ if (enableFips()) {
+ if (sdebug != null) { sdebug.println("FIPS mode detected"); }
+- loadedProps = false;
+ // Remove all security providers
+ Iterator<Entry<Object, Object>> i =
props.entrySet().iterator();
+ while (i.hasNext()) {
commit e3a510910e42a87b6b3d8af9e005123b69e48a4b
Author: Fedora Release Engineering <releng(a)fedoraproject.org>
Date: Thu Jan 20 13:40:37 2022 +0000
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng(a)fedoraproject.org>
diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec
index 9bac5c5..34035d2 100644
--- a/java-17-openjdk.spec
+++ b/java-17-openjdk.spec
@@ -1179,7 +1179,7 @@ Provides: java-%{origin}-src%{?1} = %{epoch}:%{version}-%{release}
Name: java-17-%{origin}
Version: %{newjavaver}.%{buildver}
-Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
+Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}.1
# java-1.5.0-ibm from
jpackage.org set Epoch to 1 for unknown reasons
# and this change was brought into RHEL-4. java-1.5.0-ibm packages
# also included the epoch in their virtual provides. This created a
@@ -2472,6 +2472,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Jan 20 2022 Fedora Release Engineering <releng(a)fedoraproject.org> -
1:17.0.1.0.12-15.rolling.1
+- Rebuilt for
https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
* Tue Jan 18 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-15.rolling
- Sync gdb test with java-1.8.0-openjdk and improve architecture restrictions.
- Disable on x86, x86_64, ppc64le & s390x while these are broken in rawhide.
commit eacad27bf1734cd2abb2b46acb385b0d86278d47
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Tue Jan 18 15:51:01 2022 +0000
Sync gdb test with java-1.8.0-openjdk and improve architecture restrictions.
Disable on x86, x86_64, ppc64le & s390x while these are broken in rawhide.
diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec
index bf6aec3..9bac5c5 100644
--- a/java-17-openjdk.spec
+++ b/java-17-openjdk.spec
@@ -99,17 +99,20 @@
%global ppc64be ppc64 ppc64p7
# Set of architectures which support multiple ABIs
%global multilib_arches %{power64} sparc64 x86_64
-# Set of architectures for which we build debug builds
+# Set of architectures for which we build slowdebug builds
%global debug_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} s390x
+# Set of architectures for which we build fastdebug builds
+%global fastdebug_arches x86_64 ppc64le aarch64
# Set of architectures with a Just-In-Time (JIT) compiler
%global jit_arches %{debug_arches} %{arm}
+# Set of architectures which use the Zero assembler port (!jit_arches)
+%global zero_arches ppc s390
# Set of architectures which run a full bootstrap cycle
%global bootstrap_arches %{jit_arches}
# Set of architectures which support SystemTap tapsets
%global systemtap_arches %{jit_arches}
# Set of architectures with a Ahead-Of-Time (AOT) compiler
%global aot_arches x86_64 %{aarch64}
-%global fastdebug_arches x86_64 ppc64le aarch64
# Set of architectures which support the serviceability agent
%global sa_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} %{arm}
# Set of architectures which support class data sharing
@@ -124,6 +127,13 @@
%global ssbd_arches x86_64
# Set of architectures for which java has short vector math library (libsvml.so)
%global svml_arches x86_64
+# Set of architectures where we verify backtraces with gdb (ideally all)
+# Temporarily disable check on x86, x86_64, ppc64le and s390x as gdb crashes
+# ../../gdb/objfiles.h:510: internal-error: sect_index_data not initialized
+# A problem internal to GDB has been detected,
+# further debugging may prove unreliable.
+# See
https://bugzilla.redhat.com/show_bug.cgi?id=2041970
+%global gdb_arches sparcv9 sparc64 %{aarch64} %{arm} %{zero_arches}
# By default, we build a debug build during main build on JIT architectures
%if %{with slowdebug}
@@ -298,7 +308,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 12
-%global rpmrelease 14
+%global rpmrelease 15
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -2069,20 +2079,16 @@ gdb -q "$JAVA_HOME/bin/java" <<EOF | tee gdb.out
handle SIGSEGV pass nostop noprint
handle SIGILL pass nostop noprint
set breakpoint pending on
-break javaCalls.cpp:1
+break javaCalls.cpp:58
commands 1
backtrace
quit
end
run -version
EOF
-%if 0%{?fedora} > 0
-# This fails on s390x for some reason. Disable for now. See:
-#
https://koji.fedoraproject.org/koji/taskinfo?taskID=41499227
-%ifnarch s390x
+%ifarch %{gdb_arches}
grep 'JavaCallWrapper::JavaCallWrapper' gdb.out
%endif
-%endif
# Check src.zip has all sources. See RHBZ#1130490
$JAVA_HOME/bin/jar -tf $JAVA_HOME/lib/src.zip | grep 'sun.misc.Unsafe'
@@ -2466,6 +2472,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Tue Jan 18 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-15.rolling
+- Sync gdb test with java-1.8.0-openjdk and improve architecture restrictions.
+- Disable on x86, x86_64, ppc64le & s390x while these are broken in rawhide.
+
* Thu Jan 13 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-14.rolling
- Fix FIPS issues in native code and with initialisation of java.security.Security
commit bda1029633609d6e69564aa3a4aada67e4f6fe75
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Thu Jan 13 01:12:07 2022 +0000
Fix FIPS issues in native code and with initialisation of java.security.Security
diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec
index 9b78b14..bf6aec3 100644
--- a/java-17-openjdk.spec
+++ b/java-17-openjdk.spec
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 12
-%global rpmrelease 13
+%global rpmrelease 14
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -1281,6 +1281,9 @@ Patch1010: rh1996182-login_to_nss_software_token.patch
Patch1012: rh1996182-extend_security_policy.patch
# RH1991003: Allow plain key import unless com.redhat.fips.plainKeySupport is set to
false
Patch1013: rh1991003-enable_fips_keys_import.patch
+# RH2021263: Resolve outstanding FIPS issues
+Patch1014: rh2021263-fips_ensure_security_initialised.patch
+Patch1015: rh2021263-fips_missing_native_returns.patch
#############################################
#
@@ -1700,6 +1703,9 @@ popd # openjdk
%patch1011
%patch1012
%patch1013
+%patch1014
+%patch1015
+
%patch2000
# Extract systemtap tapsets
@@ -2460,7 +2466,10 @@ cjc.mainProgram(args)
%endif
%changelog
-* Thu Dec 09 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.1.0.12-12.rolling
+* Thu Jan 13 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-14.rolling
+- Fix FIPS issues in native code and with initialisation of java.security.Security
+
+* Thu Dec 09 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.1.0.12-13.rolling
- Storing and restoring alterntives during update manually
- Fixing Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives
and select (as auto) system JDK/JRE
-- The move of alternatives creation to posttrans to fix:
@@ -2480,7 +2489,7 @@ cjc.mainProgram(args)
* Thu Dec 09 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.1.0.12-10.rolling
- replaced tabs by sets of spaces to make rpmlint happy
-* Mov Nov 29 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-9.rolling
+* Mon Nov 29 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-9.rolling
- Handle Fedora in distro conditionals that currently only pertain to RHEL.
* Thu Nov 18 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.0.0.35-8
diff --git a/rh2021263-fips_ensure_security_initialised.patch
b/rh2021263-fips_ensure_security_initialised.patch
new file mode 100644
index 0000000..8dc0122
--- /dev/null
+++ b/rh2021263-fips_ensure_security_initialised.patch
@@ -0,0 +1,28 @@
+commit 4ac1a03b3ec73358988553fe9e200130847ea3b4
+Author: Andrew Hughes <gnu.andrew(a)redhat.com>
+Date: Mon Jan 10 20:19:40 2022 +0000
+
+ RH2021263: Make sure java.security.Security is initialised when retrieving
JavaSecuritySystemConfiguratorAccess instance
+
+diff --git
openjdk.orig/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
+index 5a2c9eb0c46..a1ee182d913 100644
+--- openjdk.orig/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
++++ openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
+@@ -39,6 +39,7 @@ import java.io.FilePermission;
+ import java.io.ObjectInputStream;
+ import java.io.RandomAccessFile;
+ import java.security.ProtectionDomain;
++import java.security.Security;
+ import java.security.Signature;
+
+ /** A repository of "shared secrets", which are a mechanism for
+@@ -449,6 +450,9 @@ public class SharedSecrets {
+ }
+
+ public static JavaSecuritySystemConfiguratorAccess
getJavaSecuritySystemConfiguratorAccess() {
++ if (javaSecuritySystemConfiguratorAccess == null) {
++ ensureClassInitialized(Security.class);
++ }
+ return javaSecuritySystemConfiguratorAccess;
+ }
+ }
diff --git a/rh2021263-fips_missing_native_returns.patch
b/rh2021263-fips_missing_native_returns.patch
new file mode 100644
index 0000000..5a056ce
--- /dev/null
+++ b/rh2021263-fips_missing_native_returns.patch
@@ -0,0 +1,24 @@
+commit 8f6e35dc9e9289aed290b36e260beeda76986bb5
+Author: Fridrich Strba <fstrba(a)suse.com>
+Date: Mon Jan 10 19:32:01 2022 +0000
+
+ RH2021263: Return in C code after having generated Java exception
+
+diff --git openjdk.orig/src/java.base/linux/native/libsystemconf/systemconf.c
openjdk/src/java.base/linux/native/libsystemconf/systemconf.c
+index 38919d6bb0f..caf678a7dd6 100644
+--- openjdk.orig/src/java.base/linux/native/libsystemconf/systemconf.c
++++ openjdk/src/java.base/linux/native/libsystemconf/systemconf.c
+@@ -151,11 +151,13 @@ JNIEXPORT jboolean JNICALL
Java_java_security_SystemConfigurator_getSystemFIPSEn
+ dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH);
+ if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) {
+ throwIOException(env, "Cannot open " FIPS_ENABLED_PATH);
++ return JNI_FALSE;
+ }
+ fips_enabled = fgetc(fe);
+ fclose(fe);
+ if (fips_enabled == EOF) {
+ throwIOException(env, "Cannot read " FIPS_ENABLED_PATH);
++ return JNI_FALSE;
+ }
+ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \
+ " read character is '%c'", fips_enabled);
commit 33cde0f7b63842fd24085d95036749005f6c7de0
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Mon Jan 24 15:07:30 2022 +0100
Revert "- Rebuilt for
https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild"
This reverts commit 7364be54874ce0dbad7306e6d96f361c1bf68288.
diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec
index 69c0fee..9b78b14 100644
--- a/java-17-openjdk.spec
+++ b/java-17-openjdk.spec
@@ -1169,7 +1169,7 @@ Provides: java-%{origin}-src%{?1} = %{epoch}:%{version}-%{release}
Name: java-17-%{origin}
Version: %{newjavaver}.%{buildver}
-Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}.1
+Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
# java-1.5.0-ibm from
jpackage.org set Epoch to 1 for unknown reasons
# and this change was brought into RHEL-4. java-1.5.0-ibm packages
# also included the epoch in their virtual provides. This created a
@@ -2460,9 +2460,6 @@ cjc.mainProgram(args)
%endif
%changelog
-* Thu Jan 20 2022 Fedora Release Engineering <releng(a)fedoraproject.org> -
1:17.0.1.0.12-13.1
-- Rebuilt for
https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
-
* Thu Dec 09 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.1.0.12-12.rolling
- Storing and restoring alterntives during update manually
- Fixing Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives
and select (as auto) system JDK/JRE
commit 7364be54874ce0dbad7306e6d96f361c1bf68288
Author: Fedora Release Engineering <releng(a)fedoraproject.org>
Date: Thu Jan 20 13:40:02 2022 +0000
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng(a)fedoraproject.org>
diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec
index 9b78b14..69c0fee 100644
--- a/java-17-openjdk.spec
+++ b/java-17-openjdk.spec
@@ -1169,7 +1169,7 @@ Provides: java-%{origin}-src%{?1} = %{epoch}:%{version}-%{release}
Name: java-17-%{origin}
Version: %{newjavaver}.%{buildver}
-Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
+Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}.1
# java-1.5.0-ibm from
jpackage.org set Epoch to 1 for unknown reasons
# and this change was brought into RHEL-4. java-1.5.0-ibm packages
# also included the epoch in their virtual provides. This created a
@@ -2460,6 +2460,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Jan 20 2022 Fedora Release Engineering <releng(a)fedoraproject.org> -
1:17.0.1.0.12-13.1
+- Rebuilt for
https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
* Thu Dec 09 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.1.0.12-12.rolling
- Storing and restoring alterntives during update manually
- Fixing Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives
and select (as auto) system JDK/JRE