The package rpms/java-17-openjdk.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/java-17-openjdk.git/commit/?id=eacad....
Change: +%ifarch %{gdb_arches}
Thanks.
Full change: ============
commit 62652f81a66eb1e2d824c1b827cedb5abd1a764c Author: Andrew John Hughes gnu_andrew@member.fsf.org Date: Tue Jan 18 02:31:53 2022 +0000
Separate crypto policy initialisation from FIPS initialisation, now they are no longer interdependent
diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec index 34035d2..5c15daf 100644 --- a/java-17-openjdk.spec +++ b/java-17-openjdk.spec @@ -308,7 +308,7 @@ %global top_level_dir_name %{origin} %global top_level_dir_name_backup %{top_level_dir_name}-backup %global buildver 12 -%global rpmrelease 15 +%global rpmrelease 16 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit %if %is_system_jdk # Using 10 digits may overflow the int used for priority, so we combine the patch and build versions @@ -1179,7 +1179,7 @@ Provides: java-%{origin}-src%{?1} = %{epoch}:%{version}-%{release}
Name: java-17-%{origin} Version: %{newjavaver}.%{buildver} -Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}.1 +Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist} # java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons # and this change was brought into RHEL-4. java-1.5.0-ibm packages # also included the epoch in their virtual provides. This created a @@ -1294,6 +1294,7 @@ Patch1013: rh1991003-enable_fips_keys_import.patch # RH2021263: Resolve outstanding FIPS issues Patch1014: rh2021263-fips_ensure_security_initialised.patch Patch1015: rh2021263-fips_missing_native_returns.patch +Patch1016: rh2021263-fips_separate_policy_and_fips_init.patch
############################################# # @@ -1715,6 +1716,7 @@ popd # openjdk %patch1013 %patch1014 %patch1015 +%patch1016
%patch2000
@@ -2472,6 +2474,9 @@ cjc.mainProgram(args) %endif
%changelog +* Mon Jan 24 2022 Andrew Hughes gnu.andrew@redhat.com - 1:17.0.1.0.12-16.rolling +- Separate crypto policy initialisation from FIPS initialisation, now they are no longer interdependent + * Thu Jan 20 2022 Fedora Release Engineering releng@fedoraproject.org - 1:17.0.1.0.12-15.rolling.1 - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
diff --git a/rh2021263-fips_separate_policy_and_fips_init.patch b/rh2021263-fips_separate_policy_and_fips_init.patch new file mode 100644 index 0000000..b5351a8 --- /dev/null +++ b/rh2021263-fips_separate_policy_and_fips_init.patch @@ -0,0 +1,99 @@ +commit 0cd8cee94fe0f867b0b39890e00be620af1d9b07 +Author: Andrew Hughes gnu.andrew@redhat.com +Date: Tue Jan 18 02:09:27 2022 +0000 + + RH2021263: Improve Security initialisation, now FIPS support no longer relies on crypto policy support + +diff --git openjdk.orig/src/java.base/share/classes/java/security/Security.java openjdk/src/java.base/share/classes/java/security/Security.java +index 28ab1846173..f9726741afd 100644 +--- openjdk.orig/src/java.base/share/classes/java/security/Security.java ++++ openjdk/src/java.base/share/classes/java/security/Security.java +@@ -61,10 +61,6 @@ public final class Security { + private static final Debug sdebug = + Debug.getInstance("properties"); + +- /* System property file*/ +- private static final String SYSTEM_PROPERTIES = +- "/etc/crypto-policies/back-ends/java.config"; +- + /* The java.security properties */ + private static Properties props; + +@@ -206,22 +202,36 @@ public final class Security { + } + } + ++ if (!loadedProps) { ++ initializeStatic(); ++ if (sdebug != null) { ++ sdebug.println("unable to load security properties " + ++ "-- using defaults"); ++ } ++ } ++ + String disableSystemProps = System.getProperty("java.security.disableSystemPropertiesFile"); + if ((disableSystemProps == null || "false".equalsIgnoreCase(disableSystemProps)) && + "true".equalsIgnoreCase(props.getProperty("security.useSystemPropertiesFile"))) { +- if (SystemConfigurator.configure(props)) { +- loadedProps = true; ++ if (!SystemConfigurator.configureSysProps(props)) { ++ if (sdebug != null) { ++ sdebug.println("WARNING: System properties could not be loaded."); ++ } + } + } + +- if (!loadedProps) { +- initializeStatic(); ++ // FIPS support depends on the contents of java.security so ++ // ensure it has loaded first ++ if (loadedProps) { ++ boolean fipsEnabled = SystemConfigurator.configureFIPS(props); + if (sdebug != null) { +- sdebug.println("unable to load security properties " + +- "-- using defaults"); ++ if (fipsEnabled) { ++ sdebug.println("FIPS support enabled."); ++ } else { ++ sdebug.println("FIPS support disabled."); ++ } + } + } +- + } + + /* +diff --git openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java +index 874c6221ebe..b7ed41acf0f 100644 +--- openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java ++++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java +@@ -76,7 +76,7 @@ final class SystemConfigurator { + * java.security.disableSystemPropertiesFile property is not set and + * security.useSystemPropertiesFile is true. + */ +- static boolean configure(Properties props) { ++ static boolean configureSysProps(Properties props) { + boolean loadedProps = false; + + try (BufferedInputStream bis = +@@ -96,11 +96,19 @@ final class SystemConfigurator { + e.printStackTrace(); + } + } ++ return loadedProps; ++ } ++ ++ /* ++ * Invoked at the end of java.security.Security initialisation ++ * if java.security properties have been loaded ++ */ ++ static boolean configureFIPS(Properties props) { ++ boolean loadedProps = false; + + try { + if (enableFips()) { + if (sdebug != null) { sdebug.println("FIPS mode detected"); } +- loadedProps = false; + // Remove all security providers + Iterator<Entry<Object, Object>> i = props.entrySet().iterator(); + while (i.hasNext()) {
commit e3a510910e42a87b6b3d8af9e005123b69e48a4b Author: Fedora Release Engineering releng@fedoraproject.org Date: Thu Jan 20 13:40:37 2022 +0000
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
Signed-off-by: Fedora Release Engineering releng@fedoraproject.org
diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec index 9bac5c5..34035d2 100644 --- a/java-17-openjdk.spec +++ b/java-17-openjdk.spec @@ -1179,7 +1179,7 @@ Provides: java-%{origin}-src%{?1} = %{epoch}:%{version}-%{release}
Name: java-17-%{origin} Version: %{newjavaver}.%{buildver} -Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist} +Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}.1 # java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons # and this change was brought into RHEL-4. java-1.5.0-ibm packages # also included the epoch in their virtual provides. This created a @@ -2472,6 +2472,9 @@ cjc.mainProgram(args) %endif
%changelog +* Thu Jan 20 2022 Fedora Release Engineering releng@fedoraproject.org - 1:17.0.1.0.12-15.rolling.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Tue Jan 18 2022 Andrew Hughes gnu.andrew@redhat.com - 1:17.0.1.0.12-15.rolling - Sync gdb test with java-1.8.0-openjdk and improve architecture restrictions. - Disable on x86, x86_64, ppc64le & s390x while these are broken in rawhide.
commit eacad27bf1734cd2abb2b46acb385b0d86278d47 Author: Andrew John Hughes gnu_andrew@member.fsf.org Date: Tue Jan 18 15:51:01 2022 +0000
Sync gdb test with java-1.8.0-openjdk and improve architecture restrictions.
Disable on x86, x86_64, ppc64le & s390x while these are broken in rawhide.
diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec index bf6aec3..9bac5c5 100644 --- a/java-17-openjdk.spec +++ b/java-17-openjdk.spec @@ -99,17 +99,20 @@ %global ppc64be ppc64 ppc64p7 # Set of architectures which support multiple ABIs %global multilib_arches %{power64} sparc64 x86_64 -# Set of architectures for which we build debug builds +# Set of architectures for which we build slowdebug builds %global debug_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} s390x +# Set of architectures for which we build fastdebug builds +%global fastdebug_arches x86_64 ppc64le aarch64 # Set of architectures with a Just-In-Time (JIT) compiler %global jit_arches %{debug_arches} %{arm} +# Set of architectures which use the Zero assembler port (!jit_arches) +%global zero_arches ppc s390 # Set of architectures which run a full bootstrap cycle %global bootstrap_arches %{jit_arches} # Set of architectures which support SystemTap tapsets %global systemtap_arches %{jit_arches} # Set of architectures with a Ahead-Of-Time (AOT) compiler %global aot_arches x86_64 %{aarch64} -%global fastdebug_arches x86_64 ppc64le aarch64 # Set of architectures which support the serviceability agent %global sa_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} %{arm} # Set of architectures which support class data sharing @@ -124,6 +127,13 @@ %global ssbd_arches x86_64 # Set of architectures for which java has short vector math library (libsvml.so) %global svml_arches x86_64 +# Set of architectures where we verify backtraces with gdb (ideally all) +# Temporarily disable check on x86, x86_64, ppc64le and s390x as gdb crashes +# ../../gdb/objfiles.h:510: internal-error: sect_index_data not initialized +# A problem internal to GDB has been detected, +# further debugging may prove unreliable. +# See https://bugzilla.redhat.com/show_bug.cgi?id=2041970 +%global gdb_arches sparcv9 sparc64 %{aarch64} %{arm} %{zero_arches}
# By default, we build a debug build during main build on JIT architectures %if %{with slowdebug} @@ -298,7 +308,7 @@ %global top_level_dir_name %{origin} %global top_level_dir_name_backup %{top_level_dir_name}-backup %global buildver 12 -%global rpmrelease 14 +%global rpmrelease 15 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit %if %is_system_jdk # Using 10 digits may overflow the int used for priority, so we combine the patch and build versions @@ -2069,20 +2079,16 @@ gdb -q "$JAVA_HOME/bin/java" <<EOF | tee gdb.out handle SIGSEGV pass nostop noprint handle SIGILL pass nostop noprint set breakpoint pending on -break javaCalls.cpp:1 +break javaCalls.cpp:58 commands 1 backtrace quit end run -version EOF -%if 0%{?fedora} > 0 -# This fails on s390x for some reason. Disable for now. See: -# https://koji.fedoraproject.org/koji/taskinfo?taskID=41499227 -%ifnarch s390x +%ifarch %{gdb_arches} grep 'JavaCallWrapper::JavaCallWrapper' gdb.out %endif -%endif
# Check src.zip has all sources. See RHBZ#1130490 $JAVA_HOME/bin/jar -tf $JAVA_HOME/lib/src.zip | grep 'sun.misc.Unsafe' @@ -2466,6 +2472,10 @@ cjc.mainProgram(args) %endif
%changelog +* Tue Jan 18 2022 Andrew Hughes gnu.andrew@redhat.com - 1:17.0.1.0.12-15.rolling +- Sync gdb test with java-1.8.0-openjdk and improve architecture restrictions. +- Disable on x86, x86_64, ppc64le & s390x while these are broken in rawhide. + * Thu Jan 13 2022 Andrew Hughes gnu.andrew@redhat.com - 1:17.0.1.0.12-14.rolling - Fix FIPS issues in native code and with initialisation of java.security.Security
commit bda1029633609d6e69564aa3a4aada67e4f6fe75 Author: Andrew John Hughes gnu_andrew@member.fsf.org Date: Thu Jan 13 01:12:07 2022 +0000
Fix FIPS issues in native code and with initialisation of java.security.Security
diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec index 9b78b14..bf6aec3 100644 --- a/java-17-openjdk.spec +++ b/java-17-openjdk.spec @@ -298,7 +298,7 @@ %global top_level_dir_name %{origin} %global top_level_dir_name_backup %{top_level_dir_name}-backup %global buildver 12 -%global rpmrelease 13 +%global rpmrelease 14 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit %if %is_system_jdk # Using 10 digits may overflow the int used for priority, so we combine the patch and build versions @@ -1281,6 +1281,9 @@ Patch1010: rh1996182-login_to_nss_software_token.patch Patch1012: rh1996182-extend_security_policy.patch # RH1991003: Allow plain key import unless com.redhat.fips.plainKeySupport is set to false Patch1013: rh1991003-enable_fips_keys_import.patch +# RH2021263: Resolve outstanding FIPS issues +Patch1014: rh2021263-fips_ensure_security_initialised.patch +Patch1015: rh2021263-fips_missing_native_returns.patch
############################################# # @@ -1700,6 +1703,9 @@ popd # openjdk %patch1011 %patch1012 %patch1013 +%patch1014 +%patch1015 + %patch2000
# Extract systemtap tapsets @@ -2460,7 +2466,10 @@ cjc.mainProgram(args) %endif
%changelog -* Thu Dec 09 2021 Jiri Vanek jvanek@redhat.com - 1:17.0.1.0.12-12.rolling +* Thu Jan 13 2022 Andrew Hughes gnu.andrew@redhat.com - 1:17.0.1.0.12-14.rolling +- Fix FIPS issues in native code and with initialisation of java.security.Security + +* Thu Dec 09 2021 Jiri Vanek jvanek@redhat.com - 1:17.0.1.0.12-13.rolling - Storing and restoring alterntives during update manually - Fixing Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives and select (as auto) system JDK/JRE -- The move of alternatives creation to posttrans to fix: @@ -2480,7 +2489,7 @@ cjc.mainProgram(args) * Thu Dec 09 2021 Jiri Vanek jvanek@redhat.com - 1:17.0.1.0.12-10.rolling - replaced tabs by sets of spaces to make rpmlint happy
-* Mov Nov 29 2021 Andrew Hughes gnu.andrew@redhat.com - 1:17.0.1.0.12-9.rolling +* Mon Nov 29 2021 Andrew Hughes gnu.andrew@redhat.com - 1:17.0.1.0.12-9.rolling - Handle Fedora in distro conditionals that currently only pertain to RHEL.
* Thu Nov 18 2021 Jiri Vanek jvanek@redhat.com - 1:17.0.0.0.35-8 diff --git a/rh2021263-fips_ensure_security_initialised.patch b/rh2021263-fips_ensure_security_initialised.patch new file mode 100644 index 0000000..8dc0122 --- /dev/null +++ b/rh2021263-fips_ensure_security_initialised.patch @@ -0,0 +1,28 @@ +commit 4ac1a03b3ec73358988553fe9e200130847ea3b4 +Author: Andrew Hughes gnu.andrew@redhat.com +Date: Mon Jan 10 20:19:40 2022 +0000 + + RH2021263: Make sure java.security.Security is initialised when retrieving JavaSecuritySystemConfiguratorAccess instance + +diff --git openjdk.orig/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java +index 5a2c9eb0c46..a1ee182d913 100644 +--- openjdk.orig/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java ++++ openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java +@@ -39,6 +39,7 @@ import java.io.FilePermission; + import java.io.ObjectInputStream; + import java.io.RandomAccessFile; + import java.security.ProtectionDomain; ++import java.security.Security; + import java.security.Signature; + + /** A repository of "shared secrets", which are a mechanism for +@@ -449,6 +450,9 @@ public class SharedSecrets { + } + + public static JavaSecuritySystemConfiguratorAccess getJavaSecuritySystemConfiguratorAccess() { ++ if (javaSecuritySystemConfiguratorAccess == null) { ++ ensureClassInitialized(Security.class); ++ } + return javaSecuritySystemConfiguratorAccess; + } + } diff --git a/rh2021263-fips_missing_native_returns.patch b/rh2021263-fips_missing_native_returns.patch new file mode 100644 index 0000000..5a056ce --- /dev/null +++ b/rh2021263-fips_missing_native_returns.patch @@ -0,0 +1,24 @@ +commit 8f6e35dc9e9289aed290b36e260beeda76986bb5 +Author: Fridrich Strba fstrba@suse.com +Date: Mon Jan 10 19:32:01 2022 +0000 + + RH2021263: Return in C code after having generated Java exception + +diff --git openjdk.orig/src/java.base/linux/native/libsystemconf/systemconf.c openjdk/src/java.base/linux/native/libsystemconf/systemconf.c +index 38919d6bb0f..caf678a7dd6 100644 +--- openjdk.orig/src/java.base/linux/native/libsystemconf/systemconf.c ++++ openjdk/src/java.base/linux/native/libsystemconf/systemconf.c +@@ -151,11 +151,13 @@ JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEn + dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH); + if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) { + throwIOException(env, "Cannot open " FIPS_ENABLED_PATH); ++ return JNI_FALSE; + } + fips_enabled = fgetc(fe); + fclose(fe); + if (fips_enabled == EOF) { + throwIOException(env, "Cannot read " FIPS_ENABLED_PATH); ++ return JNI_FALSE; + } + msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \ + " read character is '%c'", fips_enabled);
commit 33cde0f7b63842fd24085d95036749005f6c7de0 Author: Jiri Vanek jvanek@redhat.com Date: Mon Jan 24 15:07:30 2022 +0100
Revert "- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild"
This reverts commit 7364be54874ce0dbad7306e6d96f361c1bf68288.
diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec index 69c0fee..9b78b14 100644 --- a/java-17-openjdk.spec +++ b/java-17-openjdk.spec @@ -1169,7 +1169,7 @@ Provides: java-%{origin}-src%{?1} = %{epoch}:%{version}-%{release}
Name: java-17-%{origin} Version: %{newjavaver}.%{buildver} -Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}.1 +Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist} # java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons # and this change was brought into RHEL-4. java-1.5.0-ibm packages # also included the epoch in their virtual provides. This created a @@ -2460,9 +2460,6 @@ cjc.mainProgram(args) %endif
%changelog -* Thu Jan 20 2022 Fedora Release Engineering releng@fedoraproject.org - 1:17.0.1.0.12-13.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - * Thu Dec 09 2021 Jiri Vanek jvanek@redhat.com - 1:17.0.1.0.12-12.rolling - Storing and restoring alterntives during update manually - Fixing Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives and select (as auto) system JDK/JRE
commit 7364be54874ce0dbad7306e6d96f361c1bf68288 Author: Fedora Release Engineering releng@fedoraproject.org Date: Thu Jan 20 13:40:02 2022 +0000
- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
Signed-off-by: Fedora Release Engineering releng@fedoraproject.org
diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec index 9b78b14..69c0fee 100644 --- a/java-17-openjdk.spec +++ b/java-17-openjdk.spec @@ -1169,7 +1169,7 @@ Provides: java-%{origin}-src%{?1} = %{epoch}:%{version}-%{release}
Name: java-17-%{origin} Version: %{newjavaver}.%{buildver} -Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist} +Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}.1 # java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons # and this change was brought into RHEL-4. java-1.5.0-ibm packages # also included the epoch in their virtual provides. This created a @@ -2460,6 +2460,9 @@ cjc.mainProgram(args) %endif
%changelog +* Thu Jan 20 2022 Fedora Release Engineering releng@fedoraproject.org - 1:17.0.1.0.12-13.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + * Thu Dec 09 2021 Jiri Vanek jvanek@redhat.com - 1:17.0.1.0.12-12.rolling - Storing and restoring alterntives during update manually - Fixing Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives and select (as auto) system JDK/JRE
arch-excludes@lists.fedoraproject.org