The package rpms/java-1.8.0-openjdk.git has added or updated architecture specific content
in its
spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s):
https://src.fedoraproject.org/cgit/rpms/java-1.8.0-openjdk.git/commit/?id...
https://src.fedoraproject.org/cgit/rpms/java-1.8.0-openjdk.git/commit/?id...
https://src.fedoraproject.org/cgit/rpms/java-1.8.0-openjdk.git/commit/?id...
https://src.fedoraproject.org/cgit/rpms/java-1.8.0-openjdk.git/commit/?id...
https://src.fedoraproject.org/cgit/rpms/java-1.8.0-openjdk.git/commit/?id....
Change:
+%ifarch %{gdb_arches}
+%ifarch %{bootstrap_arches}
+%ifarch %{bootstrap_arches}
+%ifarch %{share_arches}
+%ifarch %{share_arches}
Thanks.
Full change:
============
commit 2aed6d3e5b2fb7531d56bf1c60e5c8cb421cdd9f
Merge: 3bcd2bd 870c9df
Author: Jiri <jvanek(a)redhat.com>
Date: Thu Apr 28 15:39:55 2022 +0200
Merge branch 'f35' into f34
commit 870c9df011084103e6d428088e7a6662d57dec32
Merge: 3c30c3c d2443b0
Author: Jiri <jvanek(a)redhat.com>
Date: Thu Apr 28 15:34:48 2022 +0200
Merge branch 'f36' into f35
commit d2443b0107fb7855cf52e3879cab1caa46ba23f8
Merge: 9b9a3bb 100440c
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Thu Apr 28 14:25:55 2022 +0200
Merge branch 'rawhide' into f36
commit 100440c51eb31742f057c7e2b66df2a1c8d7d3fa
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Wed Apr 20 20:38:06 2022 +0100
Update to shenandoah-jdk8u332-b09 (GA)
Update release notes for 8u332-b09.
Switch to GA mode for final release.
diff --git a/.gitignore b/.gitignore
index 42c84a9..a973960 100644
--- a/.gitignore
+++ b/.gitignore
@@ -254,3 +254,4 @@
/openjdk-shenandoah-jdk8u-aarch64-shenandoah-jdk8u322-b06-4curve.tar.xz
/openjdk-shenandoah-jdk8u-shenandoah-jdk8u332-b01-4curve.tar.xz
/openjdk-shenandoah-jdk8u-shenandoah-jdk8u332-b06-4curve.tar.xz
+/openjdk-shenandoah-jdk8u-shenandoah-jdk8u332-b09-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 6baf506..f9af271 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,22 @@ Live versions of these release notes can be found at:
*
https://bitly.com/openjdk8u332
*
https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u332.txt
+* Security fixes
+ - JDK-8269938: Enhance XML processing passes redux
+ - JDK-8270504, CVE-2022-21426: Better XPath expression handling
+ - JDK-8272255: Completely handle MIDI files
+ - JDK-8272261: Improve JFR recording file processing
+ - JDK-8272594: Better record of recordings
+ - JDK-8274221: More definite BER encodings
+ - JDK-8275151, CVE-2022-21443: Improved Object Identification
+ - JDK-8277227: Better identification of OIDs
+ - JDK-8277672, CVE-2022-21434: Better invocation handler handling
+ - JDK-8278008, CVE-2022-21476: Improve Santuario processing
+ - JDK-8278356: Improve file creation
+ - JDK-8278449: Improve keychain support
+ - JDK-8278805: Enhance BMP image loading
+ - JDK-8278972, CVE-2022-21496: Improve URL supports
+ - JDK-8281388: Change wrapping of EncryptedPrivateKeyInfo
* Other changes
- JDK-8033980: Xerces Update: datatype XMLGregorianCalendarImpl and DurationImpl
- JDK-8035437: Xerces Update: xml/serialize/DOMSerializerImpl
@@ -32,7 +48,6 @@ Live versions of these release notes can be found at:
- JDK-8247766: [aarch64] guarantee(val < (1U << nbits)) failed: Field too big
for insn
- JDK-8253147: The javax/swing/JPopupMenu/7154841/bug7154841.java fail on big screens
- JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
- - JDK-8260632: Build failures after JDK-8253353
- JDK-8266749: AArch64: Backtracing broken on PAC enabled systems
- JDK-8270290: NTLM authentication fails if HEAD request is used
- JDK-8273229: Update OS detection code to recognize Windows Server 2022
@@ -43,7 +58,13 @@ Live versions of these release notes can be found at:
- JDK-8277488: Add expiry exception for Digicert (geotrustglobalca) expiring in May
2022
- JDK-8279077: JFR crashes on Linux ppc due to missing crash protector in signal
handler
- JDK-8280060: The sun/rmi/server/Activation.java class use Thread.dumpStack()
+ - JDK-8282300: Throws NamingException instead of InvalidNameException after
JDK-8278972
+ - JDK-8282397: createTempFile method of java.io.File is failing when called with suffix
of spaces character
+ - JDK-8284548: Invalid XPath expression causes StringIndexOutOfBoundsException
+ - JDK-8284920: Incorrect Token type causes XPath expression to return empty result
+ - JDK-8284936: Fix Java 7 bootstrap breakage due to use of Arrays.stream
* Shenandoah
+ - JDK-8260632: Build failures after JDK-8253353
- JDK-8282458: Update .jcheck/conf file for sh-jdk8u move to git
New in release OpenJDK 8u322 (2022-01-18):
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index a81960a..5098c8b 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -329,7 +329,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project openjdk
%global shenandoah_repo shenandoah-jdk8u
-%global shenandoah_revision shenandoah-jdk8u332-b06
+%global shenandoah_revision shenandoah-jdk8u332-b09
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -349,7 +349,7 @@
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
# - N%%{?extraver}{?dist} for GA releases
-%global is_ga 0
+%global is_ga 1
%if %{is_ga}
%global milestone fcs
%global milestone_version %{nil}
@@ -2781,6 +2781,11 @@ cjc.mainProgram(args)
%endif
%changelog
+* Mon Apr 18 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.332.b09-1
+- Update to shenandoah-jdk8u332-b09 (GA)
+- Update release notes for 8u332-b09.
+- Switch to GA mode for final release.
+
* Mon Apr 18 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.332.b06-0.1.ea
- Update to shenandoah-jdk8u332-b06 (EA)
- Update release notes for shenandoah-8u332-b06.
diff --git a/sources b/sources
index 8c3d3bb..4662b4c 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (openjdk-shenandoah-jdk8u-shenandoah-jdk8u332-b06-4curve.tar.xz) =
663e0093bf7d5698c168e1609b88179ccd8cfb8b1e8ecc937cdaae287960dedea170bce16572f79046e45fafce38dca6848e7524da06a56d4aa0ad15af271775
+SHA512 (openjdk-shenandoah-jdk8u-shenandoah-jdk8u332-b09-4curve.tar.xz) =
23d906ecce6864e0bd3ae4c95ac597eb697c1e28356371aafd7aabab5c3a9a9d861c326125e7a45f15340a5a106c1915808fa93b3ff7cdc8b003647a44caf7fd
commit 019748fe88a640f21bc95a68a25c96082b5fe52b
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Tue Apr 19 00:39:55 2022 +0100
Update to shenandoah-jdk8u332-b06 (EA)
Update release notes for shenandoah-8u332-b06.
diff --git a/.gitignore b/.gitignore
index 1a13c4c..42c84a9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -253,3 +253,4 @@
/openjdk-shenandoah-jdk8u-aarch64-shenandoah-jdk8u322-b05-4curve.tar.xz
/openjdk-shenandoah-jdk8u-aarch64-shenandoah-jdk8u322-b06-4curve.tar.xz
/openjdk-shenandoah-jdk8u-shenandoah-jdk8u332-b01-4curve.tar.xz
+/openjdk-shenandoah-jdk8u-shenandoah-jdk8u332-b06-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 8c34c43..6baf506 100644
--- a/NEWS
+++ b/NEWS
@@ -13,11 +13,16 @@ Live versions of these release notes can be found at:
- JDK-8033980: Xerces Update: datatype XMLGregorianCalendarImpl and DurationImpl
- JDK-8035437: Xerces Update: xml/serialize/DOMSerializerImpl
- JDK-8035577: Xerces Update: impl/xpath/regex/RangeToken.java
+ - JDK-8037259: xerces update: xpointer update
+ - JDK-8041523: Xerces Update: Serializer improvements from Xalan
+ - JDK-8141508: java.lang.invoke.LambdaConversionException: Invalid receiver type
- JDK-8162572: Update License Header for all JAXP sources
- JDK-8167014: jdeps: Missing message: warn.skipped.entry
- JDK-8198411: [TEST_BUG] Two java2d tests are unstable in mach5
- JDK-8202822: Add .git to .hgignore
- JDK-8205540: test/hotspot/jtreg/vmTestbase/nsk/jdb/trace/trace001/trace001.java fails
with Debuggee did not exit after 15 <cont> commands
+ - JDK-8209178: Proxied HttpsURLConnection doesn't send BODY when retrying POST
request
+ - JDK-8210283: Support git as an SCM alternative in the build
- JDK-8218682: [TEST_BUG] DashOffset fails in mach5
- JDK-8225690: Multiple AttachListener threads can be created
- JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due to "exit code is
134"
@@ -27,10 +32,17 @@ Live versions of these release notes can be found at:
- JDK-8247766: [aarch64] guarantee(val < (1U << nbits)) failed: Field too big
for insn
- JDK-8253147: The javax/swing/JPopupMenu/7154841/bug7154841.java fail on big screens
- JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
+ - JDK-8260632: Build failures after JDK-8253353
- JDK-8266749: AArch64: Backtracing broken on PAC enabled systems
- JDK-8270290: NTLM authentication fails if HEAD request is used
+ - JDK-8273229: Update OS detection code to recognize Windows Server 2022
+ - JDK-8273341: Update Siphash to version 1.0
+ - JDK-8273575: memory leak in appendBootClassPath(), paths must be deallocated
+ - JDK-8274524: SSLSocket.close() hangs if it is called during the ssl handshake
- JDK-8277224: sun.security.pkcs.PKCS9Attributes.toString() throws NPE
+ - JDK-8277488: Add expiry exception for Digicert (geotrustglobalca) expiring in May
2022
- JDK-8279077: JFR crashes on Linux ppc due to missing crash protector in signal
handler
+ - JDK-8280060: The sun/rmi/server/Activation.java class use Thread.dumpStack()
* Shenandoah
- JDK-8282458: Update .jcheck/conf file for sh-jdk8u move to git
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index bcb79b4..a81960a 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -329,7 +329,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project openjdk
%global shenandoah_repo shenandoah-jdk8u
-%global shenandoah_revision shenandoah-jdk8u332-b01
+%global shenandoah_revision shenandoah-jdk8u332-b06
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -2781,9 +2781,13 @@ cjc.mainProgram(args)
%endif
%changelog
+* Mon Apr 18 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.332.b06-0.1.ea
+- Update to shenandoah-jdk8u332-b06 (EA)
+- Update release notes for shenandoah-8u332-b06.
+
* Mon Apr 18 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.332.b01-0.1.ea
- Update to shenandoah-jdk8u332-b01 (EA)
-- Update release notes for 8u332-b01.
+- Update release notes for shenandoah-8u332-b01.
- Switch to EA mode.
* Wed Mar 16 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-7
diff --git a/sources b/sources
index 71b554d..8c3d3bb 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (openjdk-shenandoah-jdk8u-shenandoah-jdk8u332-b01-4curve.tar.xz) =
55b8968e78631acdf14a594d83f6e357e00114dac9f6330a80116a909b402a9f879abb9f1cd8b576fb627a50b01db22be19a1e24ee4078e97c8ecc84428eb184
+SHA512 (openjdk-shenandoah-jdk8u-shenandoah-jdk8u332-b06-4curve.tar.xz) =
663e0093bf7d5698c168e1609b88179ccd8cfb8b1e8ecc937cdaae287960dedea170bce16572f79046e45fafce38dca6848e7524da06a56d4aa0ad15af271775
commit cb59f552f45f912f6949702632cd35daa82bfb7a
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Mon Apr 18 01:19:19 2022 +0100
Update to shenandoah-jdk8u332-b01 (EA)
Update release notes for 8u332-b01.
Switch to EA mode.
diff --git a/.gitignore b/.gitignore
index c3d10c5..1a13c4c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -252,3 +252,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b04-4curve.tar.xz
/openjdk-shenandoah-jdk8u-aarch64-shenandoah-jdk8u322-b05-4curve.tar.xz
/openjdk-shenandoah-jdk8u-aarch64-shenandoah-jdk8u322-b06-4curve.tar.xz
+/openjdk-shenandoah-jdk8u-shenandoah-jdk8u332-b01-4curve.tar.xz
diff --git a/NEWS b/NEWS
index e911b13..8c34c43 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,37 @@ Key:
JDK-X -
https://bugs.openjdk.java.net/browse/JDK-X
CVE-XXXX-YYYY:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
+New in release OpenJDK 8u332 (2022-04-19):
+===========================================
+Live versions of these release notes can be found at:
+ *
https://bitly.com/openjdk8u332
+ *
https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u332.txt
+
+* Other changes
+ - JDK-8033980: Xerces Update: datatype XMLGregorianCalendarImpl and DurationImpl
+ - JDK-8035437: Xerces Update: xml/serialize/DOMSerializerImpl
+ - JDK-8035577: Xerces Update: impl/xpath/regex/RangeToken.java
+ - JDK-8162572: Update License Header for all JAXP sources
+ - JDK-8167014: jdeps: Missing message: warn.skipped.entry
+ - JDK-8198411: [TEST_BUG] Two java2d tests are unstable in mach5
+ - JDK-8202822: Add .git to .hgignore
+ - JDK-8205540: test/hotspot/jtreg/vmTestbase/nsk/jdb/trace/trace001/trace001.java fails
with Debuggee did not exit after 15 <cont> commands
+ - JDK-8218682: [TEST_BUG] DashOffset fails in mach5
+ - JDK-8225690: Multiple AttachListener threads can be created
+ - JDK-8227738: jvmti/DataDumpRequest/datadumpreq001 failed due to "exit code is
134"
+ - JDK-8227815: Minimal VM: set_state is not a member of AttachListener
+ - JDK-8240633: Memory leaks in the implementations of FileChooserUI
+ - JDK-8241768: git needs .gitattributes
+ - JDK-8247766: [aarch64] guarantee(val < (1U << nbits)) failed: Field too big
for insn
+ - JDK-8253147: The javax/swing/JPopupMenu/7154841/bug7154841.java fail on big screens
+ - JDK-8253353: Crash in C2: guarantee(n != NULL) failed: No Node
+ - JDK-8266749: AArch64: Backtracing broken on PAC enabled systems
+ - JDK-8270290: NTLM authentication fails if HEAD request is used
+ - JDK-8277224: sun.security.pkcs.PKCS9Attributes.toString() throws NPE
+ - JDK-8279077: JFR crashes on Linux ppc due to missing crash protector in signal
handler
+* Shenandoah
+ - JDK-8282458: Update .jcheck/conf file for sh-jdk8u move to git
+
New in release OpenJDK 8u322 (2022-01-18):
===========================================
Live versions of these release notes can be found at:
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 9177d7d..bcb79b4 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -329,7 +329,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project openjdk
%global shenandoah_repo shenandoah-jdk8u
-%global shenandoah_revision aarch64-shenandoah-jdk8u322-b06
+%global shenandoah_revision shenandoah-jdk8u332-b01
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -344,12 +344,12 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 7
+%global rpmrelease 1
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
# - N%%{?extraver}{?dist} for GA releases
-%global is_ga 1
+%global is_ga 0
%if %{is_ga}
%global milestone fcs
%global milestone_version %{nil}
@@ -2781,6 +2781,11 @@ cjc.mainProgram(args)
%endif
%changelog
+* Mon Apr 18 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.332.b01-0.1.ea
+- Update to shenandoah-jdk8u332-b01 (EA)
+- Update release notes for 8u332-b01.
+- Switch to EA mode.
+
* Wed Mar 16 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-7
- Reinstate JIT builds on x86_32.
- Add JDK-8282231 to fix missing CALL effects on x86_32.
diff --git a/sources b/sources
index 35c822f..71b554d 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (openjdk-shenandoah-jdk8u-aarch64-shenandoah-jdk8u322-b06-4curve.tar.xz) =
0f2af8cacb1a4acdca7c1b2d5cc1e0d27f9abf8e05ccf7e8384074ac124132012b15e36abc31b498f746d6f5295530f535a9d9d85a3e45b387728b4ce726ccc7
+SHA512 (openjdk-shenandoah-jdk8u-shenandoah-jdk8u332-b01-4curve.tar.xz) =
55b8968e78631acdf14a594d83f6e357e00114dac9f6330a80116a909b402a9f879abb9f1cd8b576fb627a50b01db22be19a1e24ee4078e97c8ecc84428eb184
commit 9b9a3bb4af6552f3a6a88c45bd8ed22498195f99
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Wed Feb 16 19:50:19 2022 +0000
Reinstate JIT builds on x86_32.
Add JDK-8282231 to fix missing CALL effects on x86_32.
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index c4c077f..bab7b61 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -100,9 +100,9 @@
# Set of architectures for which we build fastdebug builds
%global fastdebug_arches x86_64 ppc64le aarch64
# Set of architectures with a Just-In-Time (JIT) compiler
-%global jit_arches %{aarch64} %{power64} sparcv9 sparc64 x86_64
+%global jit_arches %{aarch64} %{ix86} %{power64} sparcv9 sparc64 x86_64
# Set of architectures which use the Zero assembler port (!jit_arches)
-%global zero_arches %{arm} %{ix86} ppc s390 s390x
+%global zero_arches %{arm} ppc s390 s390x
# Set of architectures which run a full bootstrap cycle
%global bootstrap_arches %{jit_arches} %{zero_arches}
# Set of architectures which support SystemTap tapsets
@@ -344,7 +344,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 6
+%global rpmrelease 7
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1524,6 +1524,8 @@ Patch204: jdk8042159-allow_using_system_installed_lcms2-jdk.patch
Patch580: jdk8195607-pr3776-rh1760437-nss_sqlite_db_config.patch
# JDK-8257794: Zero: assert(istate->_stack_limit ==
istate->_thread->last_Java_sp() + 1) failed: wrong on Linux/x86_32
Patch581: jdk8257794-remove_broken_assert.patch
+# JDK-8282231: x86-32: runtime call to SharedRuntime::ldiv corrupts registers
+Patch582: jdk8282231-x86_32-missing_call_effects.patch
#############################################
#
@@ -1959,6 +1961,7 @@ sh %{SOURCE12}
%patch112
%patch580
%patch581
+%patch582
# RPM-only fixes
%patch539
@@ -2778,6 +2781,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Wed Mar 16 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-7
+- Reinstate JIT builds on x86_32.
+- Add JDK-8282231 to fix missing CALL effects on x86_32.
+
* Sat Feb 26 2022 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.322.b06-6
- Storing and restoring alterntives during update manually
- Fixing Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives
and select (as auto) system JDK/JRE
diff --git a/jdk8282231-x86_32-missing_call_effects.patch
b/jdk8282231-x86_32-missing_call_effects.patch
new file mode 100644
index 0000000..ab341b6
--- /dev/null
+++ b/jdk8282231-x86_32-missing_call_effects.patch
@@ -0,0 +1,35 @@
+diff --git openjdk.orig/hotspot/src/cpu/x86/vm/x86_32.ad
openjdk/hotspot/src/cpu/x86/vm/x86_32.ad
+index c8f4ee1613..cc0f4eef14 100644
+--- openjdk.orig/hotspot/src/cpu/x86/vm/x86_32.ad
++++ openjdk/hotspot/src/cpu/x86/vm/x86_32.ad
+@@ -1,5 +1,5 @@
+ //
+-// Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
++// Copyright (c) 1997, 2022, Oracle and/or its affiliates. All rights reserved.
+ // DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ //
+ // This code is free software; you can redistribute it and/or modify it
+@@ -7665,9 +7665,9 @@ instruct divI_eReg(eAXRegI rax, eDXRegI rdx, eCXRegI div, eFlagsReg
cr) %{
+ %}
+
+ // Divide Register Long
+-instruct divL_eReg( eADXRegL dst, eRegL src1, eRegL src2, eFlagsReg cr, eCXRegI cx,
eBXRegI bx ) %{
++instruct divL_eReg(eADXRegL dst, eRegL src1, eRegL src2) %{
+ match(Set dst (DivL src1 src2));
+- effect( KILL cr, KILL cx, KILL bx );
++ effect(CALL);
+ ins_cost(10000);
+ format %{ "PUSH $src1.hi\n\t"
+ "PUSH $src1.lo\n\t"
+@@ -7713,9 +7713,9 @@ instruct modI_eReg(eDXRegI rdx, eAXRegI rax, eCXRegI div, eFlagsReg
cr) %{
+ %}
+
+ // Remainder Register Long
+-instruct modL_eReg( eADXRegL dst, eRegL src1, eRegL src2, eFlagsReg cr, eCXRegI cx,
eBXRegI bx ) %{
++instruct modL_eReg(eADXRegL dst, eRegL src1, eRegL src2) %{
+ match(Set dst (ModL src1 src2));
+- effect( KILL cr, KILL cx, KILL bx );
++ effect(CALL);
+ ins_cost(10000);
+ format %{ "PUSH $src1.hi\n\t"
+ "PUSH $src1.lo\n\t"
commit 7e5331a512b10f543bdc371bf13db8cee6ec1f77
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Wed Feb 16 19:50:19 2022 +0000
Reinstate JIT builds on x86_32.
Add JDK-8282231 to fix missing CALL effects on x86_32.
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 5efbb8e..9177d7d 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -100,9 +100,9 @@
# Set of architectures for which we build fastdebug builds
%global fastdebug_arches x86_64 ppc64le aarch64
# Set of architectures with a Just-In-Time (JIT) compiler
-%global jit_arches %{aarch64} %{power64} sparcv9 sparc64 x86_64
+%global jit_arches %{aarch64} %{ix86} %{power64} sparcv9 sparc64 x86_64
# Set of architectures which use the Zero assembler port (!jit_arches)
-%global zero_arches %{arm} %{ix86} ppc s390 s390x
+%global zero_arches %{arm} ppc s390 s390x
# Set of architectures which run a full bootstrap cycle
%global bootstrap_arches %{jit_arches} %{zero_arches}
# Set of architectures which support SystemTap tapsets
@@ -344,7 +344,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 6
+%global rpmrelease 7
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1524,6 +1524,8 @@ Patch204: jdk8042159-allow_using_system_installed_lcms2-jdk.patch
Patch580: jdk8195607-pr3776-rh1760437-nss_sqlite_db_config.patch
# JDK-8257794: Zero: assert(istate->_stack_limit ==
istate->_thread->last_Java_sp() + 1) failed: wrong on Linux/x86_32
Patch581: jdk8257794-remove_broken_assert.patch
+# JDK-8282231: x86-32: runtime call to SharedRuntime::ldiv corrupts registers
+Patch582: jdk8282231-x86_32-missing_call_effects.patch
#############################################
#
@@ -1959,6 +1961,7 @@ sh %{SOURCE12}
%patch112
%patch580
%patch581
+%patch582
# RPM-only fixes
%patch539
@@ -2778,6 +2781,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Wed Mar 16 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-7
+- Reinstate JIT builds on x86_32.
+- Add JDK-8282231 to fix missing CALL effects on x86_32.
+
* Sat Feb 26 2022 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.322.b06-6
- Storing and restoring alterntives during update manually
- Fixing Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives
and select (as auto) system JDK/JRE
diff --git a/jdk8282231-x86_32-missing_call_effects.patch
b/jdk8282231-x86_32-missing_call_effects.patch
new file mode 100644
index 0000000..ab341b6
--- /dev/null
+++ b/jdk8282231-x86_32-missing_call_effects.patch
@@ -0,0 +1,35 @@
+diff --git openjdk.orig/hotspot/src/cpu/x86/vm/x86_32.ad
openjdk/hotspot/src/cpu/x86/vm/x86_32.ad
+index c8f4ee1613..cc0f4eef14 100644
+--- openjdk.orig/hotspot/src/cpu/x86/vm/x86_32.ad
++++ openjdk/hotspot/src/cpu/x86/vm/x86_32.ad
+@@ -1,5 +1,5 @@
+ //
+-// Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
++// Copyright (c) 1997, 2022, Oracle and/or its affiliates. All rights reserved.
+ // DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ //
+ // This code is free software; you can redistribute it and/or modify it
+@@ -7665,9 +7665,9 @@ instruct divI_eReg(eAXRegI rax, eDXRegI rdx, eCXRegI div, eFlagsReg
cr) %{
+ %}
+
+ // Divide Register Long
+-instruct divL_eReg( eADXRegL dst, eRegL src1, eRegL src2, eFlagsReg cr, eCXRegI cx,
eBXRegI bx ) %{
++instruct divL_eReg(eADXRegL dst, eRegL src1, eRegL src2) %{
+ match(Set dst (DivL src1 src2));
+- effect( KILL cr, KILL cx, KILL bx );
++ effect(CALL);
+ ins_cost(10000);
+ format %{ "PUSH $src1.hi\n\t"
+ "PUSH $src1.lo\n\t"
+@@ -7713,9 +7713,9 @@ instruct modI_eReg(eDXRegI rdx, eAXRegI rax, eCXRegI div, eFlagsReg
cr) %{
+ %}
+
+ // Remainder Register Long
+-instruct modL_eReg( eADXRegL dst, eRegL src1, eRegL src2, eFlagsReg cr, eCXRegI cx,
eBXRegI bx ) %{
++instruct modL_eReg(eADXRegL dst, eRegL src1, eRegL src2) %{
+ match(Set dst (ModL src1 src2));
+- effect( KILL cr, KILL cx, KILL bx );
++ effect(CALL);
+ ins_cost(10000);
+ format %{ "PUSH $src1.hi\n\t"
+ "PUSH $src1.lo\n\t"
commit 3c30c3c566312ccbaddb5671205f7e7d5bd43e9f
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Mon Feb 28 15:43:06 2022 +0100
Added forgotten rh2021263-fips_separate_policy_and_fips_init.patch
diff --git a/rh2021263-fips_separate_policy_and_fips_init.patch
b/rh2021263-fips_separate_policy_and_fips_init.patch
new file mode 100644
index 0000000..e237841
--- /dev/null
+++ b/rh2021263-fips_separate_policy_and_fips_init.patch
@@ -0,0 +1,98 @@
+commit aaf92165ad1cbb1c9818eb60178c91293e13b053
+Author: Andrew John Hughes <andrew(a)openjdk.org>
+Date: Mon Jan 24 15:13:14 2022 +0000
+
+ RH2021263: Improve Security initialisation, now FIPS support no longer relies on
crypto policy support
+
+diff --git openjdk.orig/jdk/src/share/classes/java/security/Security.java
openjdk/jdk/src/share/classes/java/security/Security.java
+index fa494b680f..b5aa5c749d 100644
+--- openjdk.orig/jdk/src/share/classes/java/security/Security.java
++++ openjdk/jdk/src/share/classes/java/security/Security.java
+@@ -57,10 +57,6 @@ public final class Security {
+ private static final Debug sdebug =
+ Debug.getInstance("properties");
+
+- /* System property file*/
+- private static final String SYSTEM_PROPERTIES =
+- "/etc/crypto-policies/back-ends/java.config";
+-
+ /* The java.security properties */
+ private static Properties props;
+
+@@ -202,13 +198,6 @@ public final class Security {
+ }
+ }
+
+- String disableSystemProps =
System.getProperty("java.security.disableSystemPropertiesFile");
+- if (disableSystemProps == null &&
+- "true".equalsIgnoreCase(props.getProperty
+- ("security.useSystemPropertiesFile"))) {
+- loadedProps = loadedProps && SystemConfigurator.configure(props);
+- }
+-
+ if (!loadedProps) {
+ initializeStatic();
+ if (sdebug != null) {
+@@ -217,6 +206,28 @@ public final class Security {
+ }
+ }
+
++ String disableSystemProps =
System.getProperty("java.security.disableSystemPropertiesFile");
++ if ((disableSystemProps == null ||
"false".equalsIgnoreCase(disableSystemProps)) &&
++
"true".equalsIgnoreCase(props.getProperty("security.useSystemPropertiesFile")))
{
++ if (!SystemConfigurator.configureSysProps(props)) {
++ if (sdebug != null) {
++ sdebug.println("WARNING: System properties could not be
loaded.");
++ }
++ }
++ }
++
++ // FIPS support depends on the contents of java.security so
++ // ensure it has loaded first
++ if (loadedProps) {
++ boolean fipsEnabled = SystemConfigurator.configureFIPS(props);
++ if (sdebug != null) {
++ if (fipsEnabled) {
++ sdebug.println("FIPS support enabled.");
++ } else {
++ sdebug.println("FIPS support disabled.");
++ }
++ }
++ }
+ }
+
+ /*
+diff --git openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java
openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
+index d1f677597d..7da65b1d2c 100644
+--- openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java
++++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
+@@ -76,7 +76,7 @@ final class SystemConfigurator {
+ * java.security.disableSystemPropertiesFile property is not set and
+ * security.useSystemPropertiesFile is true.
+ */
+- static boolean configure(Properties props) {
++ static boolean configureSysProps(Properties props) {
+ boolean loadedProps = false;
+
+ try (BufferedInputStream bis =
+@@ -96,11 +96,19 @@ final class SystemConfigurator {
+ e.printStackTrace();
+ }
+ }
++ return loadedProps;
++ }
++
++ /*
++ * Invoked at the end of java.security.Security initialisation
++ * if java.security properties have been loaded
++ */
++ static boolean configureFIPS(Properties props) {
++ boolean loadedProps = false;
+
+ try {
+ if (enableFips()) {
+ if (sdebug != null) { sdebug.println("FIPS mode detected"); }
+- loadedProps = false;
+ // Remove all security providers
+ Iterator<Entry<Object, Object>> i =
props.entrySet().iterator();
+ while (i.hasNext()) {
commit be56a680008ed7cdc7a7cbd5baf84506528f3f69
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Mon Feb 28 15:36:24 2022 +0100
Storing and restoring alterntives during update manually
Fixing:
Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives and
select (as auto) system JDK/JRE
The move of alternatives creation to posttrans to fix:
Bug 1200302 - dnf reinstall breaks alternatives
Had caused the alternatives to be removed, and then created again,
instead of being added, and then removing the old, and thus persisting
the selection in family
Thus this fix, is storing the family of manually selected master, and if
stored, then it is restoring the family of the master
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 9fcf73e..0f446f6 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -321,7 +321,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 5
+%global rpmrelease 6
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -423,6 +423,50 @@
# not-duplicated scriptlets for normal/debug packages
%global update_desktop_icons /usr/bin/gtk-update-icon-cache %{_datadir}/icons/hicolor
&>/dev/null || :
+%define save_alternatives() %{expand:
+ # warning! alternatives are localised!
+ # LANG=cs_CZ.UTF-8 alternatives --display java | head
+ # LANG=en_US.UTF-8 alternatives --display java | head
+ function nonLocalisedAlternativesDisplayOfMaster() {
+ LANG=en_US.UTF-8 alternatives --display "$MASTER"
+ }
+ function headOfAbove() {
+ nonLocalisedAlternativesDisplayOfMaster | head -n $1
+ }
+ MASTER="%{?1}"
+ LOCAL_LINK="%{?2}"
+ FAMILY="%{?3}"
+ rm -f %{_localstatedir}/lib/rpm-state/"$MASTER"_$FAMILY > /dev/null
+ if nonLocalisedAlternativesDisplayOfMaster > /dev/null ; then
+ if headOfAbove 1 | grep -q manual ; then
+ if headOfAbove 2 | tail -n 1 | grep -q %{compatiblename} ; then
+ headOfAbove 2 >
%{_localstatedir}/lib/rpm-state/"$MASTER"_"$FAMILY"
+ fi
+ fi
+ fi
+}
+
+%define save_and_remove_alternatives() %{expand:
+ if [ "x$debug" == "xtrue" ] ; then
+ set -x
+ fi
+ upgrade1_uninstal0=%{?3}
+ if [ "0$upgrade1_uninstal0" -gt 0 ] ; then # removal of this condition will
cause persistence between uninstall
+ %{save_alternatives %{?1} %{?2} %{?4}}
+ fi
+ alternatives --remove "%{?1}" "%{?2}"
+}
+
+%define set_if_needed_alternatives() %{expand:
+ MASTER="%{?1}"
+ FAMILY="%{?2}"
+
ALTERNATIVES_FILE="%{_localstatedir}/lib/rpm-state/$MASTER"_"$FAMILY"
+ if [ -e "$ALTERNATIVES_FILE" ] ; then
+ rm "$ALTERNATIVES_FILE"
+ alternatives --set $MASTER $FAMILY
+ fi
+}
+
%define post_script() %{expand:
update-desktop-database %{_datadir}/applications &> /dev/null || :
@@ -431,14 +475,18 @@ exit 0
}
%define alternatives_java_install() %{expand:
+if [ "x$debug" == "xtrue" ] ; then
+ set -x
+fi
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
fi
ext=.gz
+key=java
alternatives \\
- --install %{_bindir}/java java %{jrebindir -- %{?1}}/java $PRIORITY --family %{family}
\\
+ --install %{_bindir}/java $key %{jrebindir -- %{?1}}/java $PRIORITY --family %{family}
\\
--slave %{_jvmdir}/jre jre %{_jvmdir}/%{jredir -- %{?1}} \\
--slave %{_bindir}/%{alt_java_name} %{alt_java_name} %{jrebindir --
%{?1}}/%{alt_java_name} \\
--slave %{_bindir}/jjs jjs %{jrebindir -- %{?1}}/jjs \\
@@ -476,11 +524,17 @@ alternatives \\
--slave %{_mandir}/man1/unpack200.1$ext unpack200.1$ext \\
%{_mandir}/man1/unpack200-%{uniquesuffix -- %{?1}}.1$ext
+%{set_if_needed_alternatives $key %{family}}
+
for X in %{origin} %{javaver} ; do
- alternatives --install %{_jvmdir}/jre-"$X" jre_"$X"
%{_jvmdir}/%{jredir -- %{?1}} $PRIORITY --family %{family}
+ key=jre_"$X"
+ alternatives --install %{_jvmdir}/jre-"$X" $key %{_jvmdir}/%{jredir -- %{?1}}
$PRIORITY --family %{family}
+ %{set_if_needed_alternatives $key %{family}}
done
-alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} jre_%{javaver}_%{origin}
%{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family %{family}
+key=jre_%{javaver}_%{origin}
+alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} $key %{_jvmdir}/%{jrelnk --
%{?1}} $PRIORITY --family %{family}
+%{set_if_needed_alternatives $key %{family}}
}
%define post_headless() %{expand:
@@ -513,10 +567,14 @@ exit 0
%define postun_headless() %{expand:
- alternatives --remove java %{jrebindir -- %{?1}}/java
- alternatives --remove jre_%{origin} %{_jvmdir}/%{jredir -- %{?1}}
- alternatives --remove jre_%{javaver} %{_jvmdir}/%{jredir -- %{?1}}
- alternatives --remove jre_%{javaver}_%{origin} %{_jvmdir}/%{jrelnk -- %{?1}}
+ if [ "x$debug" == "xtrue" ] ; then
+ set -x
+ fi
+ post_state=$1 # from postun,
https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_sy...
+ %{save_and_remove_alternatives java %{jrebindir -- %{?1}}/java $post_state
%{family}}
+ %{save_and_remove_alternatives jre_%{origin} %{_jvmdir}/%{jredir -- %{?1}} $post_state
%{family}}
+ %{save_and_remove_alternatives jre_%{javaver} %{_jvmdir}/%{jredir -- %{?1}}
$post_state %{family}}
+ %{save_and_remove_alternatives jre_%{javaver}_%{origin} %{_jvmdir}/%{jrelnk -- %{?1}}
$post_state %{family}}
}
%define posttrans_script() %{expand:
@@ -525,14 +583,18 @@ exit 0
%define alternatives_javac_install() %{expand:
+if [ "x$debug" == "xtrue" ] ; then
+ set -x
+fi
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
fi
ext=.gz
+key=javac
alternatives \\
- --install %{_bindir}/javac javac %{sdkbindir -- %{?1}}/javac $PRIORITY --family
%{family} \\
+ --install %{_bindir}/javac $key %{sdkbindir -- %{?1}}/javac $PRIORITY --family
%{family} \\
--slave %{_jvmdir}/java java_sdk %{_jvmdir}/%{sdkdir -- %{?1}} \\
--slave %{_bindir}/appletviewer appletviewer %{sdkbindir -- %{?1}}/appletviewer \\
--slave %{_bindir}/clhsdb clhsdb %{sdkbindir -- %{?1}}/clhsdb \\
@@ -626,12 +688,17 @@ alternatives \\
--slave %{_mandir}/man1/xjc.1$ext xjc.1$ext \\
%{_mandir}/man1/xjc-%{uniquesuffix -- %{?1}}.1$ext
+%{set_if_needed_alternatives $key %{family}}
+
for X in %{origin} %{javaver} ; do
- alternatives \\
- --install %{_jvmdir}/java-"$X" java_sdk_"$X" %{_jvmdir}/%{sdkdir
-- %{?1}} $PRIORITY --family %{family}
+ key=java_sdk_"$X"
+ alternatives --install %{_jvmdir}/java-"$X" $key %{_jvmdir}/%{sdkdir --
%{?1}} $PRIORITY --family %{family}
+ %{set_if_needed_alternatives $key %{family}}
done
-update-alternatives --install %{_jvmdir}/java-%{javaver}-%{origin}
java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family %{family}
+key=java_sdk_%{javaver}_%{origin}
+alternatives --install %{_jvmdir}/java-%{javaver}-%{origin} $key %{_jvmdir}/%{sdkdir --
%{?1}} $PRIORITY --family %{family}
+%{set_if_needed_alternatives $key %{family}}
}
%define post_devel() %{expand:
@@ -642,10 +709,14 @@ exit 0
}
%define postun_devel() %{expand:
- alternatives --remove javac %{sdkbindir -- %{?1}}/javac
- alternatives --remove java_sdk_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}}
- alternatives --remove java_sdk_%{javaver} %{_jvmdir}/%{sdkdir -- %{?1}}
- alternatives --remove java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}}
+ if [ "x$debug" == "xtrue" ] ; then
+ set -x
+ fi
+ post_state=$1 # from postun,
https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_sy...
+ %{save_and_remove_alternatives javac %{sdkbindir -- %{?1}}/javac $post_state
%{family}}
+ %{save_and_remove_alternatives java_sdk_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}}
$post_state %{family}}
+ %{save_and_remove_alternatives java_sdk_%{javaver} %{_jvmdir}/%{sdkdir -- %{?1}}
$post_state %{family}}
+ %{save_and_remove_alternatives java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir --
%{?1}} $post_state %{family}}
update-desktop-database %{_datadir}/applications &> /dev/null || :
@@ -662,36 +733,49 @@ exit 0
}
%define alternatives_javadoc_install() %{expand:
+if [ "x$debug" == "xtrue" ] ; then
+ set -x
+fi
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
fi
-alternatives \\
- --install %{_javadocdir}/java javadocdir %{_javadocdir}/%{uniquejavadocdir --
%{?1}}/api \\
- $PRIORITY --family %{family_noarch}
+key=javadocdir
+alternatives --install %{_javadocdir}/java $key %{_javadocdir}/%{uniquejavadocdir --
%{?1}}/api $PRIORITY --family %{family_noarch}
+%{set_if_needed_alternatives $key %{family_noarch}}
exit 0
}
%define postun_javadoc() %{expand:
- alternatives --remove javadocdir %{_javadocdir}/%{uniquejavadocdir -- %{?1}}/api
+if [ "x$debug" == "xtrue" ] ; then
+ set -x
+fi
+ post_state=$1 # from postun,
https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_sy...
+ %{save_and_remove_alternatives javadocdir %{_javadocdir}/%{uniquejavadocdir --
%{?1}}/api $post_state %{family_noarch}}
exit 0
}
%define alternatives_javadoczip_install() %{expand:
+if [ "x$debug" == "xtrue" ] ; then
+ set -x
+fi
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
fi
-
-alternatives \\
- --install %{_javadocdir}/java-zip javadoczip %{_javadocdir}/%{uniquejavadocdir --
%{?1}}.zip \\
- $PRIORITY --family %{family_noarch}
+key=javadoczip
+alternatives --install %{_javadocdir}/java-zip $key %{_javadocdir}/%{uniquejavadocdir --
%{?1}}.zip $PRIORITY --family %{family_noarch}
+%{set_if_needed_alternatives $key %{family_noarch}}
exit 0
}
%define postun_javadoc_zip() %{expand:
- alternatives --remove javadoczip %{_javadocdir}/%{uniquejavadocdir -- %{?1}}.zip
+ if [ "x$debug" == "xtrue" ] ; then
+ set -x
+ fi
+ post_state=$1 # from postun,
https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_sy...
+ %{save_and_remove_alternatives javadoczip %{_javadocdir}/%{uniquejavadocdir --
%{?1}}.zip $post_state %{family_noarch}}
exit 0
}
@@ -2648,6 +2732,17 @@ cjc.mainProgram(args)
%endif
%changelog
+* Sat Feb 26 2022 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.322.b06-6
+- Storing and restoring alterntives during update manually
+- Fixing Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives
and select (as auto) system JDK/JRE
+-- The move of alternatives creation to posttrans to fix:
+-- Bug 1200302 - dnf reinstall breaks alternatives
+-- Had caused the alternatives to be removed, and then created again,
+-- instead of being added, and then removing the old, and thus persisting
+-- the selection in family
+-- Thus this fix, is storing the family of manually selected master, and if
+-- stored, then it is restoring the family of the master
+
* Sat Feb 26 2022 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.322.b06-5
- Family extracted to globals
commit 3555655600b083f16de84e02615b66545053a70c
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Mon Feb 28 15:35:39 2022 +0100
family extracted to globals
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 5da992c..9fcf73e 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -321,7 +321,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 4
+%global rpmrelease 5
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -403,6 +403,9 @@
%global alternatives_requires %{_sbindir}/alternatives
%endif
+%global family %{name}.%{_arch}
+%global family_noarch %{name}
+
%if %{with_systemtap}
# Where to install systemtap tapset (links)
# We would like these to be in a package specific sub-dir,
@@ -435,7 +438,7 @@ fi
ext=.gz
alternatives \\
- --install %{_bindir}/java java %{jrebindir -- %{?1}}/java $PRIORITY --family
%{name}.%{_arch} \\
+ --install %{_bindir}/java java %{jrebindir -- %{?1}}/java $PRIORITY --family %{family}
\\
--slave %{_jvmdir}/jre jre %{_jvmdir}/%{jredir -- %{?1}} \\
--slave %{_bindir}/%{alt_java_name} %{alt_java_name} %{jrebindir --
%{?1}}/%{alt_java_name} \\
--slave %{_bindir}/jjs jjs %{jrebindir -- %{?1}}/jjs \\
@@ -474,10 +477,10 @@ alternatives \\
%{_mandir}/man1/unpack200-%{uniquesuffix -- %{?1}}.1$ext
for X in %{origin} %{javaver} ; do
- alternatives --install %{_jvmdir}/jre-"$X" jre_"$X"
%{_jvmdir}/%{jredir -- %{?1}} $PRIORITY --family %{name}.%{_arch}
+ alternatives --install %{_jvmdir}/jre-"$X" jre_"$X"
%{_jvmdir}/%{jredir -- %{?1}} $PRIORITY --family %{family}
done
-alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} jre_%{javaver}_%{origin}
%{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family %{name}.%{_arch}
+alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} jre_%{javaver}_%{origin}
%{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family %{family}
}
%define post_headless() %{expand:
@@ -529,7 +532,7 @@ fi
ext=.gz
alternatives \\
- --install %{_bindir}/javac javac %{sdkbindir -- %{?1}}/javac $PRIORITY --family
%{name}.%{_arch} \\
+ --install %{_bindir}/javac javac %{sdkbindir -- %{?1}}/javac $PRIORITY --family
%{family} \\
--slave %{_jvmdir}/java java_sdk %{_jvmdir}/%{sdkdir -- %{?1}} \\
--slave %{_bindir}/appletviewer appletviewer %{sdkbindir -- %{?1}}/appletviewer \\
--slave %{_bindir}/clhsdb clhsdb %{sdkbindir -- %{?1}}/clhsdb \\
@@ -625,10 +628,10 @@ alternatives \\
for X in %{origin} %{javaver} ; do
alternatives \\
- --install %{_jvmdir}/java-"$X" java_sdk_"$X" %{_jvmdir}/%{sdkdir
-- %{?1}} $PRIORITY --family %{name}.%{_arch}
+ --install %{_jvmdir}/java-"$X" java_sdk_"$X" %{_jvmdir}/%{sdkdir
-- %{?1}} $PRIORITY --family %{family}
done
-update-alternatives --install %{_jvmdir}/java-%{javaver}-%{origin}
java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family
%{name}.%{_arch}
+update-alternatives --install %{_jvmdir}/java-%{javaver}-%{origin}
java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family %{family}
}
%define post_devel() %{expand:
@@ -666,7 +669,7 @@ fi
alternatives \\
--install %{_javadocdir}/java javadocdir %{_javadocdir}/%{uniquejavadocdir --
%{?1}}/api \\
- $PRIORITY --family %{name}
+ $PRIORITY --family %{family_noarch}
exit 0
}
@@ -683,7 +686,7 @@ fi
alternatives \\
--install %{_javadocdir}/java-zip javadoczip %{_javadocdir}/%{uniquejavadocdir --
%{?1}}.zip \\
- $PRIORITY --family %{name}
+ $PRIORITY --family %{family_noarch}
exit 0
}
@@ -2645,6 +2648,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Sat Feb 26 2022 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.322.b06-5
+- Family extracted to globals
+
* Sat Feb 26 2022 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.322.b06-4
- javadoc-zip got its own provides next to plain javadoc ones
commit f6fde10644b216dfd32de618708e91306406c2c5
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Mon Feb 28 15:35:07 2022 +0100
Providing proper provides for javadoc-zip subpk
Before this patch, the java-17-openjdk-javadoc-zip was not existing, and
instead of that, javadoc was provided by both
Factm, that both subpkgs should provide javadoc, should be kept
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 52a09d4..5da992c 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -321,7 +321,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 3
+%global rpmrelease 4
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1190,10 +1190,10 @@ Requires(post): %{alternatives_requires}
Requires(postun): %{alternatives_requires}
# Standard JPackage javadoc provides
-Provides: java-%{javaver}-javadoc%{?1} = %{epoch}:%{version}-%{release}
-Provides: java-%{javaver}-%{origin}-javadoc%{?1} = %{epoch}:%{version}-%{release}
+Provides: java-%{javaver}-javadoc%{?1}%{?2} = %{epoch}:%{version}-%{release}
+Provides: java-%{javaver}-%{origin}-javadoc%{?1}%{?2} = %{epoch}:%{version}-%{release}
%if %is_system_jdk
-Provides: java-javadoc%{?1} = %{epoch}:%{version}-%{release}
+Provides: java-javadoc%{?1}%{?2} = %{epoch}:%{version}-%{release}
%endif
}
@@ -1682,7 +1682,8 @@ Requires: javapackages-filesystem
Obsoletes: javadoc-slowdebug < 1:1.8.0.222.b10-1
BuildArch: noarch
-%{java_javadoc_rpo %{nil}}
+%{java_javadoc_rpo -- %{nil} -zip}
+%{java_javadoc_rpo -- %{nil} %{nil}}
%description javadoc
The %{origin_nice} %{majorver} API documentation.
@@ -1695,7 +1696,7 @@ Requires: javapackages-filesystem
Obsoletes: javadoc-zip-slowdebug < 1:1.8.0.222.b10-1
BuildArch: noarch
-%{java_javadoc_rpo %{nil}}
+%{java_javadoc_rpo -- %{nil} %{nil}}
%description javadoc-zip
The %{origin_nice} %{majorver} API documentation compressed in a single archive.
@@ -2644,6 +2645,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Sat Feb 26 2022 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.322.b06-4
+- javadoc-zip got its own provides next to plain javadoc ones
+
* Tue Feb 22 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-3
- Separate crypto policy initialisation from FIPS initialisation, now they are no longer
interdependent
commit 5429d12f51b10505f3b1f9133c17687a4ca485f1
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Mon Feb 28 15:34:23 2022 +0100
Separate crypto policy initialisation from FIPS
initialisation, now they are no longer interdependent
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 416b52b..52a09d4 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -321,7 +321,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 2
+%global rpmrelease 3
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1330,6 +1330,7 @@ Patch1011: rh1991003-enable_fips_keys_import.patch
# RH2021263: Resolve outstanding FIPS issues
Patch1014: rh2021263-fips_ensure_security_initialised.patch
Patch1015: rh2021263-fips_missing_native_returns.patch
+Patch1016: rh2021263-fips_separate_policy_and_fips_init.patch
#############################################
#
@@ -1862,6 +1863,7 @@ sh %{SOURCE12}
%patch1011
%patch1014
%patch1015
+%patch1016
# RHEL-only patches
%if ! 0%{?fedora} && 0%{?rhel} <= 7
@@ -2642,6 +2644,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Tue Feb 22 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-3
+- Separate crypto policy initialisation from FIPS initialisation, now they are no longer
interdependent
+
* Mon Jan 24 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-2
- Fix FIPS issues in native code and with initialisation of java.security.Security
commit 92f7c940c557cc8e65671d3c99071fde209ddd8c
Author: Jiri <jvanek(a)redhat.com>
Date: Sun Feb 27 11:47:05 2022 +0100
Storing and restoring alterntives during update manually
Fixing:
Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives and
select (as auto) system JDK/JRE
The move of alternatives creation to posttrans to fix:
Bug 1200302 - dnf reinstall breaks alternatives
Had caused the alternatives to be removed, and then created again,
instead of being added, and then removing the old, and thus persisting
the selection in family
Thus this fix, is storing the family of manually selected master, and if
stored, then it is restoring the family of the master
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index ef8d491..c4c077f 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -344,7 +344,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 5
+%global rpmrelease 6
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -446,6 +446,50 @@
# not-duplicated scriptlets for normal/debug packages
%global update_desktop_icons /usr/bin/gtk-update-icon-cache %{_datadir}/icons/hicolor
&>/dev/null || :
+%define save_alternatives() %{expand:
+ # warning! alternatives are localised!
+ # LANG=cs_CZ.UTF-8 alternatives --display java | head
+ # LANG=en_US.UTF-8 alternatives --display java | head
+ function nonLocalisedAlternativesDisplayOfMaster() {
+ LANG=en_US.UTF-8 alternatives --display "$MASTER"
+ }
+ function headOfAbove() {
+ nonLocalisedAlternativesDisplayOfMaster | head -n $1
+ }
+ MASTER="%{?1}"
+ LOCAL_LINK="%{?2}"
+ FAMILY="%{?3}"
+ rm -f %{_localstatedir}/lib/rpm-state/"$MASTER"_$FAMILY > /dev/null
+ if nonLocalisedAlternativesDisplayOfMaster > /dev/null ; then
+ if headOfAbove 1 | grep -q manual ; then
+ if headOfAbove 2 | tail -n 1 | grep -q %{compatiblename} ; then
+ headOfAbove 2 >
%{_localstatedir}/lib/rpm-state/"$MASTER"_"$FAMILY"
+ fi
+ fi
+ fi
+}
+
+%define save_and_remove_alternatives() %{expand:
+ if [ "x$debug" == "xtrue" ] ; then
+ set -x
+ fi
+ upgrade1_uninstal0=%{?3}
+ if [ "0$upgrade1_uninstal0" -gt 0 ] ; then # removal of this condition will
cause persistence between uninstall
+ %{save_alternatives %{?1} %{?2} %{?4}}
+ fi
+ alternatives --remove "%{?1}" "%{?2}"
+}
+
+%define set_if_needed_alternatives() %{expand:
+ MASTER="%{?1}"
+ FAMILY="%{?2}"
+
ALTERNATIVES_FILE="%{_localstatedir}/lib/rpm-state/$MASTER"_"$FAMILY"
+ if [ -e "$ALTERNATIVES_FILE" ] ; then
+ rm "$ALTERNATIVES_FILE"
+ alternatives --set $MASTER $FAMILY
+ fi
+}
+
%define post_script() %{expand:
update-desktop-database %{_datadir}/applications &> /dev/null || :
@@ -454,14 +498,18 @@ exit 0
}
%define alternatives_java_install() %{expand:
+if [ "x$debug" == "xtrue" ] ; then
+ set -x
+fi
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
fi
ext=.gz
+key=java
alternatives \\
- --install %{_bindir}/java java %{jrebindir -- %{?1}}/java $PRIORITY --family %{family}
\\
+ --install %{_bindir}/java $key %{jrebindir -- %{?1}}/java $PRIORITY --family %{family}
\\
--slave %{_jvmdir}/jre jre %{_jvmdir}/%{jredir -- %{?1}} \\
--slave %{_bindir}/%{alt_java_name} %{alt_java_name} %{jrebindir --
%{?1}}/%{alt_java_name} \\
--slave %{_bindir}/jjs jjs %{jrebindir -- %{?1}}/jjs \\
@@ -499,11 +547,17 @@ alternatives \\
--slave %{_mandir}/man1/unpack200.1$ext unpack200.1$ext \\
%{_mandir}/man1/unpack200-%{uniquesuffix -- %{?1}}.1$ext
+%{set_if_needed_alternatives $key %{family}}
+
for X in %{origin} %{javaver} ; do
- alternatives --install %{_jvmdir}/jre-"$X" jre_"$X"
%{_jvmdir}/%{jredir -- %{?1}} $PRIORITY --family %{family}
+ key=jre_"$X"
+ alternatives --install %{_jvmdir}/jre-"$X" $key %{_jvmdir}/%{jredir -- %{?1}}
$PRIORITY --family %{family}
+ %{set_if_needed_alternatives $key %{family}}
done
-alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} jre_%{javaver}_%{origin}
%{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family %{family}
+key=jre_%{javaver}_%{origin}
+alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} $key %{_jvmdir}/%{jrelnk --
%{?1}} $PRIORITY --family %{family}
+%{set_if_needed_alternatives $key %{family}}
}
%define post_headless() %{expand:
@@ -536,10 +590,14 @@ exit 0
%define postun_headless() %{expand:
- alternatives --remove java %{jrebindir -- %{?1}}/java
- alternatives --remove jre_%{origin} %{_jvmdir}/%{jredir -- %{?1}}
- alternatives --remove jre_%{javaver} %{_jvmdir}/%{jredir -- %{?1}}
- alternatives --remove jre_%{javaver}_%{origin} %{_jvmdir}/%{jrelnk -- %{?1}}
+ if [ "x$debug" == "xtrue" ] ; then
+ set -x
+ fi
+ post_state=$1 # from postun,
https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_sy...
+ %{save_and_remove_alternatives java %{jrebindir -- %{?1}}/java $post_state
%{family}}
+ %{save_and_remove_alternatives jre_%{origin} %{_jvmdir}/%{jredir -- %{?1}} $post_state
%{family}}
+ %{save_and_remove_alternatives jre_%{javaver} %{_jvmdir}/%{jredir -- %{?1}}
$post_state %{family}}
+ %{save_and_remove_alternatives jre_%{javaver}_%{origin} %{_jvmdir}/%{jrelnk -- %{?1}}
$post_state %{family}}
}
%define posttrans_script() %{expand:
@@ -548,14 +606,18 @@ exit 0
%define alternatives_javac_install() %{expand:
+if [ "x$debug" == "xtrue" ] ; then
+ set -x
+fi
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
fi
ext=.gz
+key=javac
alternatives \\
- --install %{_bindir}/javac javac %{sdkbindir -- %{?1}}/javac $PRIORITY --family
%{family} \\
+ --install %{_bindir}/javac $key %{sdkbindir -- %{?1}}/javac $PRIORITY --family
%{family} \\
--slave %{_jvmdir}/java java_sdk %{_jvmdir}/%{sdkdir -- %{?1}} \\
--slave %{_bindir}/appletviewer appletviewer %{sdkbindir -- %{?1}}/appletviewer \\
--slave %{_bindir}/clhsdb clhsdb %{sdkbindir -- %{?1}}/clhsdb \\
@@ -649,12 +711,17 @@ alternatives \\
--slave %{_mandir}/man1/xjc.1$ext xjc.1$ext \\
%{_mandir}/man1/xjc-%{uniquesuffix -- %{?1}}.1$ext
+%{set_if_needed_alternatives $key %{family}}
+
for X in %{origin} %{javaver} ; do
- alternatives \\
- --install %{_jvmdir}/java-"$X" java_sdk_"$X" %{_jvmdir}/%{sdkdir
-- %{?1}} $PRIORITY --family %{family}
+ key=java_sdk_"$X"
+ alternatives --install %{_jvmdir}/java-"$X" $key %{_jvmdir}/%{sdkdir --
%{?1}} $PRIORITY --family %{family}
+ %{set_if_needed_alternatives $key %{family}}
done
-update-alternatives --install %{_jvmdir}/java-%{javaver}-%{origin}
java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family %{family}
+key=java_sdk_%{javaver}_%{origin}
+alternatives --install %{_jvmdir}/java-%{javaver}-%{origin} $key %{_jvmdir}/%{sdkdir --
%{?1}} $PRIORITY --family %{family}
+%{set_if_needed_alternatives $key %{family}}
}
%define post_devel() %{expand:
@@ -665,10 +732,14 @@ exit 0
}
%define postun_devel() %{expand:
- alternatives --remove javac %{sdkbindir -- %{?1}}/javac
- alternatives --remove java_sdk_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}}
- alternatives --remove java_sdk_%{javaver} %{_jvmdir}/%{sdkdir -- %{?1}}
- alternatives --remove java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}}
+ if [ "x$debug" == "xtrue" ] ; then
+ set -x
+ fi
+ post_state=$1 # from postun,
https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_sy...
+ %{save_and_remove_alternatives javac %{sdkbindir -- %{?1}}/javac $post_state
%{family}}
+ %{save_and_remove_alternatives java_sdk_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}}
$post_state %{family}}
+ %{save_and_remove_alternatives java_sdk_%{javaver} %{_jvmdir}/%{sdkdir -- %{?1}}
$post_state %{family}}
+ %{save_and_remove_alternatives java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir --
%{?1}} $post_state %{family}}
update-desktop-database %{_datadir}/applications &> /dev/null || :
@@ -685,36 +756,49 @@ exit 0
}
%define alternatives_javadoc_install() %{expand:
+if [ "x$debug" == "xtrue" ] ; then
+ set -x
+fi
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
fi
-alternatives \\
- --install %{_javadocdir}/java javadocdir %{_javadocdir}/%{uniquejavadocdir --
%{?1}}/api \\
- $PRIORITY --family %{family_noarch}
+key=javadocdir
+alternatives --install %{_javadocdir}/java $key %{_javadocdir}/%{uniquejavadocdir --
%{?1}}/api $PRIORITY --family %{family_noarch}
+%{set_if_needed_alternatives $key %{family_noarch}}
exit 0
}
%define postun_javadoc() %{expand:
- alternatives --remove javadocdir %{_javadocdir}/%{uniquejavadocdir -- %{?1}}/api
+if [ "x$debug" == "xtrue" ] ; then
+ set -x
+fi
+ post_state=$1 # from postun,
https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_sy...
+ %{save_and_remove_alternatives javadocdir %{_javadocdir}/%{uniquejavadocdir --
%{?1}}/api $post_state %{family_noarch}}
exit 0
}
%define alternatives_javadoczip_install() %{expand:
+if [ "x$debug" == "xtrue" ] ; then
+ set -x
+fi
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
fi
-
-alternatives \\
- --install %{_javadocdir}/java-zip javadoczip %{_javadocdir}/%{uniquejavadocdir --
%{?1}}.zip \\
- $PRIORITY --family %{family_noarch}
+key=javadoczip
+alternatives --install %{_javadocdir}/java-zip $key %{_javadocdir}/%{uniquejavadocdir --
%{?1}}.zip $PRIORITY --family %{family_noarch}
+%{set_if_needed_alternatives $key %{family_noarch}}
exit 0
}
%define postun_javadoc_zip() %{expand:
- alternatives --remove javadoczip %{_javadocdir}/%{uniquejavadocdir -- %{?1}}.zip
+ if [ "x$debug" == "xtrue" ] ; then
+ set -x
+ fi
+ post_state=$1 # from postun,
https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_sy...
+ %{save_and_remove_alternatives javadoczip %{_javadocdir}/%{uniquejavadocdir --
%{?1}}.zip $post_state %{family_noarch}}
exit 0
}
@@ -2694,6 +2778,17 @@ cjc.mainProgram(args)
%endif
%changelog
+* Sat Feb 26 2022 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.322.b06-6
+- Storing and restoring alterntives during update manually
+- Fixing Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives
and select (as auto) system JDK/JRE
+-- The move of alternatives creation to posttrans to fix:
+-- Bug 1200302 - dnf reinstall breaks alternatives
+-- Had caused the alternatives to be removed, and then created again,
+-- instead of being added, and then removing the old, and thus persisting
+-- the selection in family
+-- Thus this fix, is storing the family of manually selected master, and if
+-- stored, then it is restoring the family of the master
+
* Sat Feb 26 2022 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.322.b06-5
- Family extracted to globals
commit 917b9b412102145fecb2e50aa9c19418ca1788c4
Author: Jiri <jvanek(a)redhat.com>
Date: Sat Feb 26 20:50:05 2022 +0100
family extracted to globals
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index e9a7a5f..ef8d491 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -344,7 +344,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 4
+%global rpmrelease 5
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -426,6 +426,9 @@
%global alternatives_requires %{_sbindir}/alternatives
%endif
+%global family %{name}.%{_arch}
+%global family_noarch %{name}
+
%if %{with_systemtap}
# Where to install systemtap tapset (links)
# We would like these to be in a package specific sub-dir,
@@ -458,7 +461,7 @@ fi
ext=.gz
alternatives \\
- --install %{_bindir}/java java %{jrebindir -- %{?1}}/java $PRIORITY --family
%{name}.%{_arch} \\
+ --install %{_bindir}/java java %{jrebindir -- %{?1}}/java $PRIORITY --family %{family}
\\
--slave %{_jvmdir}/jre jre %{_jvmdir}/%{jredir -- %{?1}} \\
--slave %{_bindir}/%{alt_java_name} %{alt_java_name} %{jrebindir --
%{?1}}/%{alt_java_name} \\
--slave %{_bindir}/jjs jjs %{jrebindir -- %{?1}}/jjs \\
@@ -497,10 +500,10 @@ alternatives \\
%{_mandir}/man1/unpack200-%{uniquesuffix -- %{?1}}.1$ext
for X in %{origin} %{javaver} ; do
- alternatives --install %{_jvmdir}/jre-"$X" jre_"$X"
%{_jvmdir}/%{jredir -- %{?1}} $PRIORITY --family %{name}.%{_arch}
+ alternatives --install %{_jvmdir}/jre-"$X" jre_"$X"
%{_jvmdir}/%{jredir -- %{?1}} $PRIORITY --family %{family}
done
-alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} jre_%{javaver}_%{origin}
%{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family %{name}.%{_arch}
+alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} jre_%{javaver}_%{origin}
%{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family %{family}
}
%define post_headless() %{expand:
@@ -552,7 +555,7 @@ fi
ext=.gz
alternatives \\
- --install %{_bindir}/javac javac %{sdkbindir -- %{?1}}/javac $PRIORITY --family
%{name}.%{_arch} \\
+ --install %{_bindir}/javac javac %{sdkbindir -- %{?1}}/javac $PRIORITY --family
%{family} \\
--slave %{_jvmdir}/java java_sdk %{_jvmdir}/%{sdkdir -- %{?1}} \\
--slave %{_bindir}/appletviewer appletviewer %{sdkbindir -- %{?1}}/appletviewer \\
--slave %{_bindir}/clhsdb clhsdb %{sdkbindir -- %{?1}}/clhsdb \\
@@ -648,10 +651,10 @@ alternatives \\
for X in %{origin} %{javaver} ; do
alternatives \\
- --install %{_jvmdir}/java-"$X" java_sdk_"$X" %{_jvmdir}/%{sdkdir
-- %{?1}} $PRIORITY --family %{name}.%{_arch}
+ --install %{_jvmdir}/java-"$X" java_sdk_"$X" %{_jvmdir}/%{sdkdir
-- %{?1}} $PRIORITY --family %{family}
done
-update-alternatives --install %{_jvmdir}/java-%{javaver}-%{origin}
java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family
%{name}.%{_arch}
+update-alternatives --install %{_jvmdir}/java-%{javaver}-%{origin}
java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family %{family}
}
%define post_devel() %{expand:
@@ -689,7 +692,7 @@ fi
alternatives \\
--install %{_javadocdir}/java javadocdir %{_javadocdir}/%{uniquejavadocdir --
%{?1}}/api \\
- $PRIORITY --family %{name}
+ $PRIORITY --family %{family_noarch}
exit 0
}
@@ -706,7 +709,7 @@ fi
alternatives \\
--install %{_javadocdir}/java-zip javadoczip %{_javadocdir}/%{uniquejavadocdir --
%{?1}}.zip \\
- $PRIORITY --family %{name}
+ $PRIORITY --family %{family_noarch}
exit 0
}
@@ -2691,6 +2694,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Sat Feb 26 2022 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.322.b06-5
+- Family extracted to globals
+
* Sat Feb 26 2022 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.322.b06-4
- javadoc-zip got its own provides next to plain javadoc ones
commit 967ddd7db2f60920f109a601a71eedabd2086426
Author: Jiri <jvanek(a)redhat.com>
Date: Sun Feb 27 12:01:51 2022 +0100
Providing proper provides for javadoc-zip subpk
Before this patch, the java-17-openjdk-javadoc-zip was not existing, and
instead of that, javadoc was provided by both
Factm, that both subpkgs should provide javadoc, should be kept
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 8b0abfa..e9a7a5f 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -344,7 +344,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 3
+%global rpmrelease 4
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1217,10 +1217,10 @@ Requires(post): %{alternatives_requires}
Requires(postun): %{alternatives_requires}
# Standard JPackage javadoc provides
-Provides: java-%{javaver}-javadoc%{?1} = %{epoch}:%{version}-%{release}
-Provides: java-%{javaver}-%{origin}-javadoc%{?1} = %{epoch}:%{version}-%{release}
+Provides: java-%{javaver}-javadoc%{?1}%{?2} = %{epoch}:%{version}-%{release}
+Provides: java-%{javaver}-%{origin}-javadoc%{?1}%{?2} = %{epoch}:%{version}-%{release}
%if %is_system_jdk
-Provides: java-javadoc%{?1} = %{epoch}:%{version}-%{release}
+Provides: java-javadoc%{?1}%{?2} = %{epoch}:%{version}-%{release}
%endif
}
@@ -1705,7 +1705,8 @@ Requires: javapackages-filesystem
Obsoletes: javadoc-slowdebug < 1:1.8.0.222.b10-1
BuildArch: noarch
-%{java_javadoc_rpo %{nil}}
+%{java_javadoc_rpo -- %{nil} -zip}
+%{java_javadoc_rpo -- %{nil} %{nil}}
%description javadoc
The %{origin_nice} %{majorver} API documentation.
@@ -1718,7 +1719,7 @@ Requires: javapackages-filesystem
Obsoletes: javadoc-zip-slowdebug < 1:1.8.0.222.b10-1
BuildArch: noarch
-%{java_javadoc_rpo %{nil}}
+%{java_javadoc_rpo -- %{nil} %{nil}}
%description javadoc-zip
The %{origin_nice} %{majorver} API documentation compressed in a single archive.
@@ -2690,6 +2691,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Sat Feb 26 2022 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.322.b06-4
+- javadoc-zip got its own provides next to plain javadoc ones
+
* Tue Feb 22 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-3
- Separate crypto policy initialisation from FIPS initialisation, now they are no longer
interdependent
commit 355e52d362a612cced85770416edd7c6d8e2c80a
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Wed Feb 23 17:22:05 2022 +0000
Separate crypto policy initialisation from FIPS initialisation, now they are no longer
interdependent
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 8ab490b..8b0abfa 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -344,7 +344,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 2
+%global rpmrelease 3
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1357,6 +1357,7 @@ Patch1011: rh1991003-enable_fips_keys_import.patch
# RH2021263: Resolve outstanding FIPS issues
Patch1014: rh2021263-fips_ensure_security_initialised.patch
Patch1015: rh2021263-fips_missing_native_returns.patch
+Patch1016: rh2021263-fips_separate_policy_and_fips_init.patch
#############################################
#
@@ -1886,6 +1887,7 @@ sh %{SOURCE12}
%patch1011
%patch1014
%patch1015
+%patch1016
# RHEL-only patches
%if ! 0%{?fedora} && 0%{?rhel} <= 7
@@ -2688,6 +2690,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Tue Feb 22 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-3
+- Separate crypto policy initialisation from FIPS initialisation, now they are no longer
interdependent
+
* Wed Feb 16 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-2
- Fix FIPS issues in native code and with initialisation of java.security.Security
diff --git a/rh2021263-fips_separate_policy_and_fips_init.patch
b/rh2021263-fips_separate_policy_and_fips_init.patch
new file mode 100644
index 0000000..e237841
--- /dev/null
+++ b/rh2021263-fips_separate_policy_and_fips_init.patch
@@ -0,0 +1,98 @@
+commit aaf92165ad1cbb1c9818eb60178c91293e13b053
+Author: Andrew John Hughes <andrew(a)openjdk.org>
+Date: Mon Jan 24 15:13:14 2022 +0000
+
+ RH2021263: Improve Security initialisation, now FIPS support no longer relies on
crypto policy support
+
+diff --git openjdk.orig/jdk/src/share/classes/java/security/Security.java
openjdk/jdk/src/share/classes/java/security/Security.java
+index fa494b680f..b5aa5c749d 100644
+--- openjdk.orig/jdk/src/share/classes/java/security/Security.java
++++ openjdk/jdk/src/share/classes/java/security/Security.java
+@@ -57,10 +57,6 @@ public final class Security {
+ private static final Debug sdebug =
+ Debug.getInstance("properties");
+
+- /* System property file*/
+- private static final String SYSTEM_PROPERTIES =
+- "/etc/crypto-policies/back-ends/java.config";
+-
+ /* The java.security properties */
+ private static Properties props;
+
+@@ -202,13 +198,6 @@ public final class Security {
+ }
+ }
+
+- String disableSystemProps =
System.getProperty("java.security.disableSystemPropertiesFile");
+- if (disableSystemProps == null &&
+- "true".equalsIgnoreCase(props.getProperty
+- ("security.useSystemPropertiesFile"))) {
+- loadedProps = loadedProps && SystemConfigurator.configure(props);
+- }
+-
+ if (!loadedProps) {
+ initializeStatic();
+ if (sdebug != null) {
+@@ -217,6 +206,28 @@ public final class Security {
+ }
+ }
+
++ String disableSystemProps =
System.getProperty("java.security.disableSystemPropertiesFile");
++ if ((disableSystemProps == null ||
"false".equalsIgnoreCase(disableSystemProps)) &&
++
"true".equalsIgnoreCase(props.getProperty("security.useSystemPropertiesFile")))
{
++ if (!SystemConfigurator.configureSysProps(props)) {
++ if (sdebug != null) {
++ sdebug.println("WARNING: System properties could not be
loaded.");
++ }
++ }
++ }
++
++ // FIPS support depends on the contents of java.security so
++ // ensure it has loaded first
++ if (loadedProps) {
++ boolean fipsEnabled = SystemConfigurator.configureFIPS(props);
++ if (sdebug != null) {
++ if (fipsEnabled) {
++ sdebug.println("FIPS support enabled.");
++ } else {
++ sdebug.println("FIPS support disabled.");
++ }
++ }
++ }
+ }
+
+ /*
+diff --git openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java
openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
+index d1f677597d..7da65b1d2c 100644
+--- openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java
++++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
+@@ -76,7 +76,7 @@ final class SystemConfigurator {
+ * java.security.disableSystemPropertiesFile property is not set and
+ * security.useSystemPropertiesFile is true.
+ */
+- static boolean configure(Properties props) {
++ static boolean configureSysProps(Properties props) {
+ boolean loadedProps = false;
+
+ try (BufferedInputStream bis =
+@@ -96,11 +96,19 @@ final class SystemConfigurator {
+ e.printStackTrace();
+ }
+ }
++ return loadedProps;
++ }
++
++ /*
++ * Invoked at the end of java.security.Security initialisation
++ * if java.security properties have been loaded
++ */
++ static boolean configureFIPS(Properties props) {
++ boolean loadedProps = false;
+
+ try {
+ if (enableFips()) {
+ if (sdebug != null) { sdebug.println("FIPS mode detected"); }
+- loadedProps = false;
+ // Remove all security providers
+ Iterator<Entry<Object, Object>> i =
props.entrySet().iterator();
+ while (i.hasNext()) {
commit 0e882feab657bc9990c6dab6f9eebe406640c1b4
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Wed Feb 16 02:36:10 2022 +0000
Fix FIPS issues in native code and with initialisation of java.security.Security
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index b9bb5c6..8ab490b 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -344,7 +344,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 1
+%global rpmrelease 2
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -2688,6 +2688,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Wed Feb 16 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-2
+- Fix FIPS issues in native code and with initialisation of java.security.Security
+
* Wed Feb 16 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-1
- Update to aarch64-shenandoah-jdk8u322-b06 (EA)
- Update release notes for 8u322-b06.
commit edb63206cdde09841e8be821f7393b649aaf07eb
Author: Jiri <jvanek(a)redhat.com>
Date: Sun Feb 27 11:47:05 2022 +0100
Storing and restoring alterntives during update manually
Fixing:
Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives and
select (as auto) system JDK/JRE
The move of alternatives creation to posttrans to fix:
Bug 1200302 - dnf reinstall breaks alternatives
Had caused the alternatives to be removed, and then created again,
instead of being added, and then removing the old, and thus persisting
the selection in family
Thus this fix, is storing the family of manually selected master, and if
stored, then it is restoring the family of the master
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 587eee8..5efbb8e 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -344,7 +344,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 5
+%global rpmrelease 6
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -446,6 +446,50 @@
# not-duplicated scriptlets for normal/debug packages
%global update_desktop_icons /usr/bin/gtk-update-icon-cache %{_datadir}/icons/hicolor
&>/dev/null || :
+%define save_alternatives() %{expand:
+ # warning! alternatives are localised!
+ # LANG=cs_CZ.UTF-8 alternatives --display java | head
+ # LANG=en_US.UTF-8 alternatives --display java | head
+ function nonLocalisedAlternativesDisplayOfMaster() {
+ LANG=en_US.UTF-8 alternatives --display "$MASTER"
+ }
+ function headOfAbove() {
+ nonLocalisedAlternativesDisplayOfMaster | head -n $1
+ }
+ MASTER="%{?1}"
+ LOCAL_LINK="%{?2}"
+ FAMILY="%{?3}"
+ rm -f %{_localstatedir}/lib/rpm-state/"$MASTER"_$FAMILY > /dev/null
+ if nonLocalisedAlternativesDisplayOfMaster > /dev/null ; then
+ if headOfAbove 1 | grep -q manual ; then
+ if headOfAbove 2 | tail -n 1 | grep -q %{compatiblename} ; then
+ headOfAbove 2 >
%{_localstatedir}/lib/rpm-state/"$MASTER"_"$FAMILY"
+ fi
+ fi
+ fi
+}
+
+%define save_and_remove_alternatives() %{expand:
+ if [ "x$debug" == "xtrue" ] ; then
+ set -x
+ fi
+ upgrade1_uninstal0=%{?3}
+ if [ "0$upgrade1_uninstal0" -gt 0 ] ; then # removal of this condition will
cause persistence between uninstall
+ %{save_alternatives %{?1} %{?2} %{?4}}
+ fi
+ alternatives --remove "%{?1}" "%{?2}"
+}
+
+%define set_if_needed_alternatives() %{expand:
+ MASTER="%{?1}"
+ FAMILY="%{?2}"
+
ALTERNATIVES_FILE="%{_localstatedir}/lib/rpm-state/$MASTER"_"$FAMILY"
+ if [ -e "$ALTERNATIVES_FILE" ] ; then
+ rm "$ALTERNATIVES_FILE"
+ alternatives --set $MASTER $FAMILY
+ fi
+}
+
%define post_script() %{expand:
update-desktop-database %{_datadir}/applications &> /dev/null || :
@@ -454,14 +498,18 @@ exit 0
}
%define alternatives_java_install() %{expand:
+if [ "x$debug" == "xtrue" ] ; then
+ set -x
+fi
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
fi
ext=.gz
+key=java
alternatives \\
- --install %{_bindir}/java java %{jrebindir -- %{?1}}/java $PRIORITY --family %{family}
\\
+ --install %{_bindir}/java $key %{jrebindir -- %{?1}}/java $PRIORITY --family %{family}
\\
--slave %{_jvmdir}/jre jre %{_jvmdir}/%{jredir -- %{?1}} \\
--slave %{_bindir}/%{alt_java_name} %{alt_java_name} %{jrebindir --
%{?1}}/%{alt_java_name} \\
--slave %{_bindir}/jjs jjs %{jrebindir -- %{?1}}/jjs \\
@@ -499,11 +547,17 @@ alternatives \\
--slave %{_mandir}/man1/unpack200.1$ext unpack200.1$ext \\
%{_mandir}/man1/unpack200-%{uniquesuffix -- %{?1}}.1$ext
+%{set_if_needed_alternatives $key %{family}}
+
for X in %{origin} %{javaver} ; do
- alternatives --install %{_jvmdir}/jre-"$X" jre_"$X"
%{_jvmdir}/%{jredir -- %{?1}} $PRIORITY --family %{family}
+ key=jre_"$X"
+ alternatives --install %{_jvmdir}/jre-"$X" $key %{_jvmdir}/%{jredir -- %{?1}}
$PRIORITY --family %{family}
+ %{set_if_needed_alternatives $key %{family}}
done
-alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} jre_%{javaver}_%{origin}
%{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family %{family}
+key=jre_%{javaver}_%{origin}
+alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} $key %{_jvmdir}/%{jrelnk --
%{?1}} $PRIORITY --family %{family}
+%{set_if_needed_alternatives $key %{family}}
}
%define post_headless() %{expand:
@@ -536,10 +590,14 @@ exit 0
%define postun_headless() %{expand:
- alternatives --remove java %{jrebindir -- %{?1}}/java
- alternatives --remove jre_%{origin} %{_jvmdir}/%{jredir -- %{?1}}
- alternatives --remove jre_%{javaver} %{_jvmdir}/%{jredir -- %{?1}}
- alternatives --remove jre_%{javaver}_%{origin} %{_jvmdir}/%{jrelnk -- %{?1}}
+ if [ "x$debug" == "xtrue" ] ; then
+ set -x
+ fi
+ post_state=$1 # from postun,
https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_sy...
+ %{save_and_remove_alternatives java %{jrebindir -- %{?1}}/java $post_state
%{family}}
+ %{save_and_remove_alternatives jre_%{origin} %{_jvmdir}/%{jredir -- %{?1}} $post_state
%{family}}
+ %{save_and_remove_alternatives jre_%{javaver} %{_jvmdir}/%{jredir -- %{?1}}
$post_state %{family}}
+ %{save_and_remove_alternatives jre_%{javaver}_%{origin} %{_jvmdir}/%{jrelnk -- %{?1}}
$post_state %{family}}
}
%define posttrans_script() %{expand:
@@ -548,14 +606,18 @@ exit 0
%define alternatives_javac_install() %{expand:
+if [ "x$debug" == "xtrue" ] ; then
+ set -x
+fi
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
fi
ext=.gz
+key=javac
alternatives \\
- --install %{_bindir}/javac javac %{sdkbindir -- %{?1}}/javac $PRIORITY --family
%{family} \\
+ --install %{_bindir}/javac $key %{sdkbindir -- %{?1}}/javac $PRIORITY --family
%{family} \\
--slave %{_jvmdir}/java java_sdk %{_jvmdir}/%{sdkdir -- %{?1}} \\
--slave %{_bindir}/appletviewer appletviewer %{sdkbindir -- %{?1}}/appletviewer \\
--slave %{_bindir}/clhsdb clhsdb %{sdkbindir -- %{?1}}/clhsdb \\
@@ -649,12 +711,17 @@ alternatives \\
--slave %{_mandir}/man1/xjc.1$ext xjc.1$ext \\
%{_mandir}/man1/xjc-%{uniquesuffix -- %{?1}}.1$ext
+%{set_if_needed_alternatives $key %{family}}
+
for X in %{origin} %{javaver} ; do
- alternatives \\
- --install %{_jvmdir}/java-"$X" java_sdk_"$X" %{_jvmdir}/%{sdkdir
-- %{?1}} $PRIORITY --family %{family}
+ key=java_sdk_"$X"
+ alternatives --install %{_jvmdir}/java-"$X" $key %{_jvmdir}/%{sdkdir --
%{?1}} $PRIORITY --family %{family}
+ %{set_if_needed_alternatives $key %{family}}
done
-update-alternatives --install %{_jvmdir}/java-%{javaver}-%{origin}
java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family %{family}
+key=java_sdk_%{javaver}_%{origin}
+alternatives --install %{_jvmdir}/java-%{javaver}-%{origin} $key %{_jvmdir}/%{sdkdir --
%{?1}} $PRIORITY --family %{family}
+%{set_if_needed_alternatives $key %{family}}
}
%define post_devel() %{expand:
@@ -665,10 +732,14 @@ exit 0
}
%define postun_devel() %{expand:
- alternatives --remove javac %{sdkbindir -- %{?1}}/javac
- alternatives --remove java_sdk_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}}
- alternatives --remove java_sdk_%{javaver} %{_jvmdir}/%{sdkdir -- %{?1}}
- alternatives --remove java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}}
+ if [ "x$debug" == "xtrue" ] ; then
+ set -x
+ fi
+ post_state=$1 # from postun,
https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_sy...
+ %{save_and_remove_alternatives javac %{sdkbindir -- %{?1}}/javac $post_state
%{family}}
+ %{save_and_remove_alternatives java_sdk_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}}
$post_state %{family}}
+ %{save_and_remove_alternatives java_sdk_%{javaver} %{_jvmdir}/%{sdkdir -- %{?1}}
$post_state %{family}}
+ %{save_and_remove_alternatives java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir --
%{?1}} $post_state %{family}}
update-desktop-database %{_datadir}/applications &> /dev/null || :
@@ -685,36 +756,49 @@ exit 0
}
%define alternatives_javadoc_install() %{expand:
+if [ "x$debug" == "xtrue" ] ; then
+ set -x
+fi
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
fi
-alternatives \\
- --install %{_javadocdir}/java javadocdir %{_javadocdir}/%{uniquejavadocdir --
%{?1}}/api \\
- $PRIORITY --family %{family_noarch}
+key=javadocdir
+alternatives --install %{_javadocdir}/java $key %{_javadocdir}/%{uniquejavadocdir --
%{?1}}/api $PRIORITY --family %{family_noarch}
+%{set_if_needed_alternatives $key %{family_noarch}}
exit 0
}
%define postun_javadoc() %{expand:
- alternatives --remove javadocdir %{_javadocdir}/%{uniquejavadocdir -- %{?1}}/api
+if [ "x$debug" == "xtrue" ] ; then
+ set -x
+fi
+ post_state=$1 # from postun,
https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_sy...
+ %{save_and_remove_alternatives javadocdir %{_javadocdir}/%{uniquejavadocdir --
%{?1}}/api $post_state %{family_noarch}}
exit 0
}
%define alternatives_javadoczip_install() %{expand:
+if [ "x$debug" == "xtrue" ] ; then
+ set -x
+fi
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
fi
-
-alternatives \\
- --install %{_javadocdir}/java-zip javadoczip %{_javadocdir}/%{uniquejavadocdir --
%{?1}}.zip \\
- $PRIORITY --family %{family_noarch}
+key=javadoczip
+alternatives --install %{_javadocdir}/java-zip $key %{_javadocdir}/%{uniquejavadocdir --
%{?1}}.zip $PRIORITY --family %{family_noarch}
+%{set_if_needed_alternatives $key %{family_noarch}}
exit 0
}
%define postun_javadoc_zip() %{expand:
- alternatives --remove javadoczip %{_javadocdir}/%{uniquejavadocdir -- %{?1}}.zip
+ if [ "x$debug" == "xtrue" ] ; then
+ set -x
+ fi
+ post_state=$1 # from postun,
https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_sy...
+ %{save_and_remove_alternatives javadoczip %{_javadocdir}/%{uniquejavadocdir --
%{?1}}.zip $post_state %{family_noarch}}
exit 0
}
@@ -2694,6 +2778,17 @@ cjc.mainProgram(args)
%endif
%changelog
+* Sat Feb 26 2022 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.322.b06-6
+- Storing and restoring alterntives during update manually
+- Fixing Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives
and select (as auto) system JDK/JRE
+-- The move of alternatives creation to posttrans to fix:
+-- Bug 1200302 - dnf reinstall breaks alternatives
+-- Had caused the alternatives to be removed, and then created again,
+-- instead of being added, and then removing the old, and thus persisting
+-- the selection in family
+-- Thus this fix, is storing the family of manually selected master, and if
+-- stored, then it is restoring the family of the master
+
* Sat Feb 26 2022 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.322.b06-5
- Family extracted to globals
commit 0da973f5a714bef5d665c3cc22869dad44a3a3bc
Author: Jiri <jvanek(a)redhat.com>
Date: Sat Feb 26 20:50:05 2022 +0100
family extracted to globals
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 8bb6504..587eee8 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -344,7 +344,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 4
+%global rpmrelease 5
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -426,6 +426,9 @@
%global alternatives_requires %{_sbindir}/alternatives
%endif
+%global family %{name}.%{_arch}
+%global family_noarch %{name}
+
%if %{with_systemtap}
# Where to install systemtap tapset (links)
# We would like these to be in a package specific sub-dir,
@@ -458,7 +461,7 @@ fi
ext=.gz
alternatives \\
- --install %{_bindir}/java java %{jrebindir -- %{?1}}/java $PRIORITY --family
%{name}.%{_arch} \\
+ --install %{_bindir}/java java %{jrebindir -- %{?1}}/java $PRIORITY --family %{family}
\\
--slave %{_jvmdir}/jre jre %{_jvmdir}/%{jredir -- %{?1}} \\
--slave %{_bindir}/%{alt_java_name} %{alt_java_name} %{jrebindir --
%{?1}}/%{alt_java_name} \\
--slave %{_bindir}/jjs jjs %{jrebindir -- %{?1}}/jjs \\
@@ -497,10 +500,10 @@ alternatives \\
%{_mandir}/man1/unpack200-%{uniquesuffix -- %{?1}}.1$ext
for X in %{origin} %{javaver} ; do
- alternatives --install %{_jvmdir}/jre-"$X" jre_"$X"
%{_jvmdir}/%{jredir -- %{?1}} $PRIORITY --family %{name}.%{_arch}
+ alternatives --install %{_jvmdir}/jre-"$X" jre_"$X"
%{_jvmdir}/%{jredir -- %{?1}} $PRIORITY --family %{family}
done
-alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} jre_%{javaver}_%{origin}
%{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family %{name}.%{_arch}
+alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} jre_%{javaver}_%{origin}
%{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family %{family}
}
%define post_headless() %{expand:
@@ -552,7 +555,7 @@ fi
ext=.gz
alternatives \\
- --install %{_bindir}/javac javac %{sdkbindir -- %{?1}}/javac $PRIORITY --family
%{name}.%{_arch} \\
+ --install %{_bindir}/javac javac %{sdkbindir -- %{?1}}/javac $PRIORITY --family
%{family} \\
--slave %{_jvmdir}/java java_sdk %{_jvmdir}/%{sdkdir -- %{?1}} \\
--slave %{_bindir}/appletviewer appletviewer %{sdkbindir -- %{?1}}/appletviewer \\
--slave %{_bindir}/clhsdb clhsdb %{sdkbindir -- %{?1}}/clhsdb \\
@@ -648,10 +651,10 @@ alternatives \\
for X in %{origin} %{javaver} ; do
alternatives \\
- --install %{_jvmdir}/java-"$X" java_sdk_"$X" %{_jvmdir}/%{sdkdir
-- %{?1}} $PRIORITY --family %{name}.%{_arch}
+ --install %{_jvmdir}/java-"$X" java_sdk_"$X" %{_jvmdir}/%{sdkdir
-- %{?1}} $PRIORITY --family %{family}
done
-update-alternatives --install %{_jvmdir}/java-%{javaver}-%{origin}
java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family
%{name}.%{_arch}
+update-alternatives --install %{_jvmdir}/java-%{javaver}-%{origin}
java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family %{family}
}
%define post_devel() %{expand:
@@ -689,7 +692,7 @@ fi
alternatives \\
--install %{_javadocdir}/java javadocdir %{_javadocdir}/%{uniquejavadocdir --
%{?1}}/api \\
- $PRIORITY --family %{name}
+ $PRIORITY --family %{family_noarch}
exit 0
}
@@ -706,7 +709,7 @@ fi
alternatives \\
--install %{_javadocdir}/java-zip javadoczip %{_javadocdir}/%{uniquejavadocdir --
%{?1}}.zip \\
- $PRIORITY --family %{name}
+ $PRIORITY --family %{family_noarch}
exit 0
}
@@ -2691,6 +2694,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Sat Feb 26 2022 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.322.b06-5
+- Family extracted to globals
+
* Sat Feb 26 2022 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.322.b06-4
- javadoc-zip got its own provides next to plain javadoc ones
commit e88c69368c88f3a4a595433f1b9a21d1963c2054
Author: Jiri <jvanek(a)redhat.com>
Date: Sun Feb 27 12:01:51 2022 +0100
Providing proper provides for javadoc-zip subpk
Before this patch, the java-17-openjdk-javadoc-zip was not existing, and
instead of that, javadoc was provided by both
Factm, that both subpkgs should provide javadoc, should be kept
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 9885a10..8bb6504 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -344,7 +344,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 3
+%global rpmrelease 4
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1217,10 +1217,10 @@ Requires(post): %{alternatives_requires}
Requires(postun): %{alternatives_requires}
# Standard JPackage javadoc provides
-Provides: java-%{javaver}-javadoc%{?1} = %{epoch}:%{version}-%{release}
-Provides: java-%{javaver}-%{origin}-javadoc%{?1} = %{epoch}:%{version}-%{release}
+Provides: java-%{javaver}-javadoc%{?1}%{?2} = %{epoch}:%{version}-%{release}
+Provides: java-%{javaver}-%{origin}-javadoc%{?1}%{?2} = %{epoch}:%{version}-%{release}
%if %is_system_jdk
-Provides: java-javadoc%{?1} = %{epoch}:%{version}-%{release}
+Provides: java-javadoc%{?1}%{?2} = %{epoch}:%{version}-%{release}
%endif
}
@@ -1705,7 +1705,8 @@ Requires: javapackages-filesystem
Obsoletes: javadoc-slowdebug < 1:1.8.0.222.b10-1
BuildArch: noarch
-%{java_javadoc_rpo %{nil}}
+%{java_javadoc_rpo -- %{nil} -zip}
+%{java_javadoc_rpo -- %{nil} %{nil}}
%description javadoc
The %{origin_nice} %{majorver} API documentation.
@@ -1718,7 +1719,7 @@ Requires: javapackages-filesystem
Obsoletes: javadoc-zip-slowdebug < 1:1.8.0.222.b10-1
BuildArch: noarch
-%{java_javadoc_rpo %{nil}}
+%{java_javadoc_rpo -- %{nil} %{nil}}
%description javadoc-zip
The %{origin_nice} %{majorver} API documentation compressed in a single archive.
@@ -2690,6 +2691,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Sat Feb 26 2022 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.322.b06-4
+- javadoc-zip got its own provides next to plain javadoc ones
+
* Tue Feb 22 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-3
- Separate crypto policy initialisation from FIPS initialisation, now they are no longer
interdependent
commit f2e995182a63de4467a5361b3516fd4e42bb74ef
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Wed Feb 23 17:22:05 2022 +0000
Separate crypto policy initialisation from FIPS initialisation, now they are no longer
interdependent
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 7e6f114..9885a10 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -344,7 +344,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 2
+%global rpmrelease 3
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1357,6 +1357,7 @@ Patch1011: rh1991003-enable_fips_keys_import.patch
# RH2021263: Resolve outstanding FIPS issues
Patch1014: rh2021263-fips_ensure_security_initialised.patch
Patch1015: rh2021263-fips_missing_native_returns.patch
+Patch1016: rh2021263-fips_separate_policy_and_fips_init.patch
#############################################
#
@@ -1886,6 +1887,7 @@ sh %{SOURCE12}
%patch1011
%patch1014
%patch1015
+%patch1016
# RHEL-only patches
%if ! 0%{?fedora} && 0%{?rhel} <= 7
@@ -2688,6 +2690,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Tue Feb 22 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-3
+- Separate crypto policy initialisation from FIPS initialisation, now they are no longer
interdependent
+
* Wed Feb 16 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-2
- Fix FIPS issues in native code and with initialisation of java.security.Security
diff --git a/rh2021263-fips_separate_policy_and_fips_init.patch
b/rh2021263-fips_separate_policy_and_fips_init.patch
new file mode 100644
index 0000000..e237841
--- /dev/null
+++ b/rh2021263-fips_separate_policy_and_fips_init.patch
@@ -0,0 +1,98 @@
+commit aaf92165ad1cbb1c9818eb60178c91293e13b053
+Author: Andrew John Hughes <andrew(a)openjdk.org>
+Date: Mon Jan 24 15:13:14 2022 +0000
+
+ RH2021263: Improve Security initialisation, now FIPS support no longer relies on
crypto policy support
+
+diff --git openjdk.orig/jdk/src/share/classes/java/security/Security.java
openjdk/jdk/src/share/classes/java/security/Security.java
+index fa494b680f..b5aa5c749d 100644
+--- openjdk.orig/jdk/src/share/classes/java/security/Security.java
++++ openjdk/jdk/src/share/classes/java/security/Security.java
+@@ -57,10 +57,6 @@ public final class Security {
+ private static final Debug sdebug =
+ Debug.getInstance("properties");
+
+- /* System property file*/
+- private static final String SYSTEM_PROPERTIES =
+- "/etc/crypto-policies/back-ends/java.config";
+-
+ /* The java.security properties */
+ private static Properties props;
+
+@@ -202,13 +198,6 @@ public final class Security {
+ }
+ }
+
+- String disableSystemProps =
System.getProperty("java.security.disableSystemPropertiesFile");
+- if (disableSystemProps == null &&
+- "true".equalsIgnoreCase(props.getProperty
+- ("security.useSystemPropertiesFile"))) {
+- loadedProps = loadedProps && SystemConfigurator.configure(props);
+- }
+-
+ if (!loadedProps) {
+ initializeStatic();
+ if (sdebug != null) {
+@@ -217,6 +206,28 @@ public final class Security {
+ }
+ }
+
++ String disableSystemProps =
System.getProperty("java.security.disableSystemPropertiesFile");
++ if ((disableSystemProps == null ||
"false".equalsIgnoreCase(disableSystemProps)) &&
++
"true".equalsIgnoreCase(props.getProperty("security.useSystemPropertiesFile")))
{
++ if (!SystemConfigurator.configureSysProps(props)) {
++ if (sdebug != null) {
++ sdebug.println("WARNING: System properties could not be
loaded.");
++ }
++ }
++ }
++
++ // FIPS support depends on the contents of java.security so
++ // ensure it has loaded first
++ if (loadedProps) {
++ boolean fipsEnabled = SystemConfigurator.configureFIPS(props);
++ if (sdebug != null) {
++ if (fipsEnabled) {
++ sdebug.println("FIPS support enabled.");
++ } else {
++ sdebug.println("FIPS support disabled.");
++ }
++ }
++ }
+ }
+
+ /*
+diff --git openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java
openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
+index d1f677597d..7da65b1d2c 100644
+--- openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java
++++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
+@@ -76,7 +76,7 @@ final class SystemConfigurator {
+ * java.security.disableSystemPropertiesFile property is not set and
+ * security.useSystemPropertiesFile is true.
+ */
+- static boolean configure(Properties props) {
++ static boolean configureSysProps(Properties props) {
+ boolean loadedProps = false;
+
+ try (BufferedInputStream bis =
+@@ -96,11 +96,19 @@ final class SystemConfigurator {
+ e.printStackTrace();
+ }
+ }
++ return loadedProps;
++ }
++
++ /*
++ * Invoked at the end of java.security.Security initialisation
++ * if java.security properties have been loaded
++ */
++ static boolean configureFIPS(Properties props) {
++ boolean loadedProps = false;
+
+ try {
+ if (enableFips()) {
+ if (sdebug != null) { sdebug.println("FIPS mode detected"); }
+- loadedProps = false;
+ // Remove all security providers
+ Iterator<Entry<Object, Object>> i =
props.entrySet().iterator();
+ while (i.hasNext()) {
commit aa4a54e45a31ba0961e19c53b427976df48cd61f
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Tue Feb 8 15:48:38 2022 +0000
Update to aarch64-shenandoah-jdk8u322-b06 (EA)
Update release notes for 8u322-b06.
Switch to GA mode for final release.
Require tzdata 2021e as of JDK-8275766.
Update tarball generation script to use git following shenandoah-jdk8u's move to
github
Re-enable gdb backtrace check.
Fix FIPS issues in native code and with initialisation of java.security.Security
diff --git a/.gitignore b/.gitignore
index f1536da..c3d10c5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -250,3 +250,5 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b02-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b03-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b04-4curve.tar.xz
+/openjdk-shenandoah-jdk8u-aarch64-shenandoah-jdk8u322-b05-4curve.tar.xz
+/openjdk-shenandoah-jdk8u-aarch64-shenandoah-jdk8u322-b06-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 9773926..e911b13 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,33 @@ Live versions of these release notes can be found at:
*
https://bitly.com/openjdk8u322
*
https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u322.txt
+* Security fixes
+ - JDK-8264934, CVE-2022-21248: Enhance cross VM serialization
+ - JDK-8268488: More valuable DerValues
+ - JDK-8268494: Better inlining of inlined interfaces
+ - JDK-8268512: More content for ContentInfo
+ - JDK-8268795: Enhance digests of Jar files
+ - JDK-8268801: Improve PKCS attribute handling
+ - JDK-8268813, CVE-2022-21283: Better String matching
+ - JDK-8269151: Better construction of EncryptedPrivateKeyInfo
+ - JDK-8269944: Better HTTP transport redux
+ - JDK-8270392, CVE-2022-21293: Improve String constructions
+ - JDK-8270416, CVE-2022-21294: Enhance construction of Identity maps
+ - JDK-8270492, CVE-2022-21282: Better resolution of URIs
+ - JDK-8270498, CVE-2022-21296: Improve SAX Parser configuration management
+ - JDK-8270646, CVE-2022-21299: Improved scanning of XML entities
+ - JDK-8271962: Better TrueType font loading
+ - JDK-8271968: Better canonical naming
+ - JDK-8271987: Manifest improved manifest entries
+ - JDK-8272014, CVE-2022-21305: Better array indexing
+ - JDK-8272026, CVE-2022-21340: Verify Jar Verification
+ - JDK-8272236, CVE-2022-21341: Improve serial forms for transport
+ - JDK-8272272: Enhance jcmd communication
+ - JDK-8272462: Enhance image handling
+ - JDK-8273290: Enhance sound handling
+ - JDK-8273748, CVE-2022-21349: Improve Solaris font rendering
+ - JDK-8273756, CVE-2022-21360: Enhance BMP image support
+ - JDK-8273838, CVE-2022-21365: Enhanced BMP processing
* Other changes
- JDK-6801613: Cross-platform pageDialog and printDialog top margin entry broken
- JDK-8011541: [TEST_BUG] closed/javax/swing/plaf/metal/MetalUtils/bug6190373.java
fails NPE since 7u25b03
@@ -56,13 +83,18 @@ Live versions of these release notes can be found at:
- JDK-8261397: Try Catch Method Failing to Work When Dividing An Integer By 0
- JDK-8262731: [macOS] Exception from "Printable.print" is swallowed during
"PrinterJob.print"
- JDK-8272342: [TEST_BUG] java/awt/print/PrinterJob/PageDialogMarginTest.java catches
all exceptions
+ - JDK-8273308: PatternMatchTest.java fails on CI
- JDK-8273342: Null pointer dereference in classFileParser.cpp:2817
- JDK-8273826: Correct Manifest file name and NPE checks
+ - JDK-8273968: JCK javax_xml tests fail in CI
- JDK-8274407: (tz) Update Timezone Data to 2021c
- JDK-8274467: TestZoneInfo310.java fails with tzdata2021b
- JDK-8274468: TimeZoneTest.java fails with tzdata2021b
- JDK-8274595: DisableRMIOverHTTPTest failed: connection refused
- JDK-8274779: HttpURLConnection: HttpClient and HttpsClient incorrectly check request
method when set to POST
+ - JDK-8275766: (tz) Update Timezone Data to 2021e
+ - JDK-8275849: TestZoneInfo310.java fails with tzdata2021e
+ - JDK-8276536: Update TimeZoneNames files to follow the changes made by JDK-8275766
Notes on individual issues:
===========================
diff --git a/generate_source_tarball.sh b/generate_source_tarball.sh
index c6f0756..61aad1f 100755
--- a/generate_source_tarball.sh
+++ b/generate_source_tarball.sh
@@ -7,9 +7,9 @@
# If you want to use a local copy of patch PR3822, set the path to it in the PR3822
variable
#
# In any case you have to set PROJECT_NAME REPO_NAME and VERSION. eg:
-# PROJECT_NAME=jdk8u OR aarch64-port
-# REPO_NAME=jdk8u60 OR jdk8u60
-# VERSION=jdk8u60-b27 OR aarch64-jdk8u65-b17 OR for head, keyword 'tip' should
do the job there
+# PROJECT_NAME=openjdk
+# REPO_NAME=shenandoah-jdk8u
+# VERSION=HEAD
#
# They are used to create correct name and are used in construction of sources url
(unless REPO_ROOT is set)
@@ -40,7 +40,7 @@ fi
set -e
-OPENJDK_URL_DEFAULT=http://hg.openjdk.java.net
+OPENJDK_URL_DEFAULT=https://github.com
COMPRESSION_DEFAULT=xz
# jdk is last for its size
REPOS_DEFAULT="hotspot corba jaxws jaxp langtools nashorn jdk"
@@ -99,7 +99,7 @@ if [ "x$FILE_NAME_ROOT" = "x" ] ; then
echo "No file name root specified; default to ${FILE_NAME_ROOT}"
fi
if [ "x$REPO_ROOT" = "x" ] ; then
- REPO_ROOT="${OPENJDK_URL}/${PROJECT_NAME}/${REPO_NAME}"
+ REPO_ROOT="${OPENJDK_URL}/${PROJECT_NAME}/${REPO_NAME}.git"
echo "No repository root specified; default to ${REPO_ROOT}"
fi;
if [ "x$REPOS" = "x" ] ; then
@@ -123,15 +123,9 @@ mkdir "${FILE_NAME_ROOT}"
pushd "${FILE_NAME_ROOT}"
echo "Cloning ${VERSION} root repository from ${REPO_ROOT}"
-hg clone ${REPO_ROOT} openjdk -r ${VERSION}
+git clone -b ${VERSION} ${REPO_ROOT} openjdk
pushd openjdk
-for subrepo in ${REPOS}
-do
- echo "Cloning ${VERSION} ${subrepo} repository from ${REPO_ROOT}"
- hg clone ${REPO_ROOT}/${subrepo} -r ${VERSION}
-done
-
# UnderlineTaglet.java has a BSD license with a field-of-use restriction, making it
non-Free
if [ -d langtools ] ; then
echo "Removing langtools test case with non-Free license"
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 970234f..b9bb5c6 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -115,15 +115,10 @@
%global share_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64}
# Set of architectures which support JFR
%global jfr_arches %{jit_arches}
-# Set of architectures where we verify backtraces with gdb (ideally all)
-# Temporarily disable check on x86, x86_64, ppc64le and s390x as gdb crashes
-# ../../gdb/objfiles.h:510: internal-error: sect_index_data not initialized
-# A problem internal to GDB has been detected,
-# further debugging may prove unreliable.
-# See
https://bugzilla.redhat.com/show_bug.cgi?id=2041970
-%global gdb_arches sparcv9 sparc64 %{aarch64} %{arm} ppc s390
# Set of architectures for which alt-java has SSB mitigation
%global ssbd_arches x86_64
+# Set of architectures where we verify backtraces with gdb
+%global gdb_arches %{jit_arches} %{zero_arches}
# By default, we build a debug build during main build on JIT architectures
%if %{with slowdebug}
@@ -332,9 +327,9 @@
%endif
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
-%global shenandoah_project aarch64-port
-%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u322-b04
+%global shenandoah_project openjdk
+%global shenandoah_repo shenandoah-jdk8u
+%global shenandoah_revision aarch64-shenandoah-jdk8u322-b06
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -349,12 +344,12 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 2
+%global rpmrelease 1
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
# - N%%{?extraver}{?dist} for GA releases
-%global is_ga 0
+%global is_ga 1
%if %{is_ga}
%global milestone fcs
%global milestone_version %{nil}
@@ -1146,8 +1141,8 @@ Requires: ca-certificates
# Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros
Requires: javapackages-filesystem
# Require zoneinfo data provided by tzdata-java subpackage.
-# 2021c required as of JDK-8274407 in January 2022 CPU
-Requires: tzdata-java >= 2021c
+# 2021e required as of JDK-8275766 in January 2022 CPU
+Requires: tzdata-java >= 2021e
# for support of kernel stream control
# libsctp.so.1 is being `dlopen`ed on demand
Requires: lksctp-tools%{?_isa}
@@ -1359,6 +1354,9 @@ Patch1007: rh1929465-improve_system_FIPS_detection-jdk.patch
Patch1008: rh1996182-login_to_nss_software_token.patch
# RH1991003: Allow plain key import unless com.redhat.fips.plainKeySupport is set to
false
Patch1011: rh1991003-enable_fips_keys_import.patch
+# RH2021263: Resolve outstanding FIPS issues
+Patch1014: rh2021263-fips_ensure_security_initialised.patch
+Patch1015: rh2021263-fips_missing_native_returns.patch
#############################################
#
@@ -1519,8 +1517,8 @@ BuildRequires: java-%{buildjdkver}-openjdk-devel >=
1.7.0.151-2.6.11.3
%ifarch %{zero_arches}
BuildRequires: libffi-devel
%endif
-# 2021c required as of JDK-8274407 in January 2022 CPU
-BuildRequires: tzdata-java >= 2021c
+# 2021e required as of JDK-8275766 in January 2022 CPU
+BuildRequires: tzdata-java >= 2021e
# Earlier versions have a bug in tree vectorization on PPC
BuildRequires: gcc >= 4.8.3-8
@@ -1886,6 +1884,8 @@ sh %{SOURCE12}
%patch1007
%patch1008
%patch1011
+%patch1014
+%patch1015
# RHEL-only patches
%if ! 0%{?fedora} && 0%{?rhel} <= 7
@@ -2688,6 +2688,17 @@ cjc.mainProgram(args)
%endif
%changelog
+* Wed Feb 16 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-1
+- Update to aarch64-shenandoah-jdk8u322-b06 (EA)
+- Update release notes for 8u322-b06.
+- Switch to GA mode for final release.
+- Require tzdata 2021e as of JDK-8275766.
+- Update tarball generation script to use git following shenandoah-jdk8u's move to
github
+- Fix FIPS issues in native code and with initialisation of java.security.Security
+
+* Mon Feb 07 2022 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:1.8.0.322.b06-1
+- Re-enable gdb backtrace check.
+
* Thu Jan 20 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b04-0.2.ea
- Temporarily move x86 to use Zero in order to get a working build
- Introduce architecture restriction logic for the gdb test. (RH2041970)
diff --git a/rh2021263-fips_ensure_security_initialised.patch
b/rh2021263-fips_ensure_security_initialised.patch
new file mode 100644
index 0000000..5aa9ec7
--- /dev/null
+++ b/rh2021263-fips_ensure_security_initialised.patch
@@ -0,0 +1,28 @@
+commit 06c2decab204fcce5aca2d285953fcac1820b1ae
+Author: Andrew John Hughes <andrew(a)openjdk.org>
+Date: Mon Jan 24 01:23:28 2022 +0000
+
+ RH2021263: Make sure java.security.Security is initialised when retrieving
JavaSecuritySystemConfiguratorAccess instance
+
+diff --git openjdk.orig/jdk/src/share/classes/sun/misc/SharedSecrets.java
openjdk/jdk/src/share/classes/sun/misc/SharedSecrets.java
+index 40ca609e02..0dafe6f59c 100644
+--- openjdk.orig/jdk/src/share/classes/sun/misc/SharedSecrets.java
++++ openjdk/jdk/src/share/classes/sun/misc/SharedSecrets.java
+@@ -31,6 +31,7 @@ import java.io.Console;
+ import java.io.FileDescriptor;
+ import java.io.ObjectInputStream;
+ import java.security.ProtectionDomain;
++import java.security.Security;
+ import java.security.Signature;
+
+ import java.security.AccessController;
+@@ -255,6 +256,9 @@ public class SharedSecrets {
+ }
+
+ public static JavaSecuritySystemConfiguratorAccess
getJavaSecuritySystemConfiguratorAccess() {
++ if (javaSecuritySystemConfiguratorAccess == null) {
++ unsafe.ensureClassInitialized(Security.class);
++ }
+ return javaSecuritySystemConfiguratorAccess;
+ }
+ }
diff --git a/rh2021263-fips_missing_native_returns.patch
b/rh2021263-fips_missing_native_returns.patch
new file mode 100644
index 0000000..90cc44e
--- /dev/null
+++ b/rh2021263-fips_missing_native_returns.patch
@@ -0,0 +1,24 @@
+commit 7f58a05104138ebdfd3b7b968ed67ea4c8573073
+Author: Fridrich Strba <fstrba(a)suse.com>
+Date: Mon Jan 24 01:10:57 2022 +0000
+
+ RH2021263: Return in C code after having generated Java exception
+
+diff --git openjdk.orig/jdk/src/solaris/native/java/security/systemconf.c
openjdk/jdk/src/solaris/native/java/security/systemconf.c
+index 6f4656bfcb..34d0ff0ce9 100644
+--- openjdk.orig/jdk/src/solaris/native/java/security/systemconf.c
++++ openjdk/jdk/src/solaris/native/java/security/systemconf.c
+@@ -131,11 +131,13 @@ JNIEXPORT jboolean JNICALL
Java_java_security_SystemConfigurator_getSystemFIPSEn
+ dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH);
+ if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) {
+ throwIOException(env, "Cannot open " FIPS_ENABLED_PATH);
++ return JNI_FALSE;
+ }
+ fips_enabled = fgetc(fe);
+ fclose(fe);
+ if (fips_enabled == EOF) {
+ throwIOException(env, "Cannot read " FIPS_ENABLED_PATH);
++ return JNI_FALSE;
+ }
+ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \
+ " read character is '%c'", fips_enabled);
diff --git a/sources b/sources
index eb1f71f..35c822f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b04-4curve.tar.xz) =
ebc3cceb40f7ca567fd9fe751ba9762ad50ac474f63da5e2123cf268683db10132ffb09b6f6a99b3379c021b4fcc3b04a82bc81c2e63c8d4da0fdcf58d995322
+SHA512 (openjdk-shenandoah-jdk8u-aarch64-shenandoah-jdk8u322-b06-4curve.tar.xz) =
0f2af8cacb1a4acdca7c1b2d5cc1e0d27f9abf8e05ccf7e8384074ac124132012b15e36abc31b498f746d6f5295530f535a9d9d85a3e45b387728b4ce726ccc7
commit 6d412ee58b7019db098546df7e7b53f1f331ec93
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Wed Feb 16 02:36:10 2022 +0000
Fix FIPS issues in native code and with initialisation of java.security.Security
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index c39eaaa..7e6f114 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -344,7 +344,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 1
+%global rpmrelease 2
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1354,6 +1354,9 @@ Patch1007: rh1929465-improve_system_FIPS_detection-jdk.patch
Patch1008: rh1996182-login_to_nss_software_token.patch
# RH1991003: Allow plain key import unless com.redhat.fips.plainKeySupport is set to
false
Patch1011: rh1991003-enable_fips_keys_import.patch
+# RH2021263: Resolve outstanding FIPS issues
+Patch1014: rh2021263-fips_ensure_security_initialised.patch
+Patch1015: rh2021263-fips_missing_native_returns.patch
#############################################
#
@@ -1881,6 +1884,8 @@ sh %{SOURCE12}
%patch1007
%patch1008
%patch1011
+%patch1014
+%patch1015
# RHEL-only patches
%if ! 0%{?fedora} && 0%{?rhel} <= 7
@@ -2683,6 +2688,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Wed Feb 16 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-2
+- Fix FIPS issues in native code and with initialisation of java.security.Security
+
* Wed Feb 16 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-1
- Update to aarch64-shenandoah-jdk8u322-b06 (EA)
- Update release notes for 8u322-b06.
diff --git a/rh2021263-fips_ensure_security_initialised.patch
b/rh2021263-fips_ensure_security_initialised.patch
new file mode 100644
index 0000000..5aa9ec7
--- /dev/null
+++ b/rh2021263-fips_ensure_security_initialised.patch
@@ -0,0 +1,28 @@
+commit 06c2decab204fcce5aca2d285953fcac1820b1ae
+Author: Andrew John Hughes <andrew(a)openjdk.org>
+Date: Mon Jan 24 01:23:28 2022 +0000
+
+ RH2021263: Make sure java.security.Security is initialised when retrieving
JavaSecuritySystemConfiguratorAccess instance
+
+diff --git openjdk.orig/jdk/src/share/classes/sun/misc/SharedSecrets.java
openjdk/jdk/src/share/classes/sun/misc/SharedSecrets.java
+index 40ca609e02..0dafe6f59c 100644
+--- openjdk.orig/jdk/src/share/classes/sun/misc/SharedSecrets.java
++++ openjdk/jdk/src/share/classes/sun/misc/SharedSecrets.java
+@@ -31,6 +31,7 @@ import java.io.Console;
+ import java.io.FileDescriptor;
+ import java.io.ObjectInputStream;
+ import java.security.ProtectionDomain;
++import java.security.Security;
+ import java.security.Signature;
+
+ import java.security.AccessController;
+@@ -255,6 +256,9 @@ public class SharedSecrets {
+ }
+
+ public static JavaSecuritySystemConfiguratorAccess
getJavaSecuritySystemConfiguratorAccess() {
++ if (javaSecuritySystemConfiguratorAccess == null) {
++ unsafe.ensureClassInitialized(Security.class);
++ }
+ return javaSecuritySystemConfiguratorAccess;
+ }
+ }
diff --git a/rh2021263-fips_missing_native_returns.patch
b/rh2021263-fips_missing_native_returns.patch
new file mode 100644
index 0000000..90cc44e
--- /dev/null
+++ b/rh2021263-fips_missing_native_returns.patch
@@ -0,0 +1,24 @@
+commit 7f58a05104138ebdfd3b7b968ed67ea4c8573073
+Author: Fridrich Strba <fstrba(a)suse.com>
+Date: Mon Jan 24 01:10:57 2022 +0000
+
+ RH2021263: Return in C code after having generated Java exception
+
+diff --git openjdk.orig/jdk/src/solaris/native/java/security/systemconf.c
openjdk/jdk/src/solaris/native/java/security/systemconf.c
+index 6f4656bfcb..34d0ff0ce9 100644
+--- openjdk.orig/jdk/src/solaris/native/java/security/systemconf.c
++++ openjdk/jdk/src/solaris/native/java/security/systemconf.c
+@@ -131,11 +131,13 @@ JNIEXPORT jboolean JNICALL
Java_java_security_SystemConfigurator_getSystemFIPSEn
+ dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH);
+ if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) {
+ throwIOException(env, "Cannot open " FIPS_ENABLED_PATH);
++ return JNI_FALSE;
+ }
+ fips_enabled = fgetc(fe);
+ fclose(fe);
+ if (fips_enabled == EOF) {
+ throwIOException(env, "Cannot read " FIPS_ENABLED_PATH);
++ return JNI_FALSE;
+ }
+ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \
+ " read character is '%c'", fips_enabled);
commit 050fecd883ec846a10507fa7b121b722f6ba0114
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Wed Feb 16 00:05:22 2022 +0000
Update to aarch64-shenandoah-jdk8u322-b06 (EA)
Update release notes for 8u322-b06.
Switch to GA mode for final release.
diff --git a/.gitignore b/.gitignore
index a986941..c3d10c5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -251,3 +251,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b03-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b04-4curve.tar.xz
/openjdk-shenandoah-jdk8u-aarch64-shenandoah-jdk8u322-b05-4curve.tar.xz
+/openjdk-shenandoah-jdk8u-aarch64-shenandoah-jdk8u322-b06-4curve.tar.xz
diff --git a/NEWS b/NEWS
index b8a1f92..e911b13 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,33 @@ Live versions of these release notes can be found at:
*
https://bitly.com/openjdk8u322
*
https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u322.txt
+* Security fixes
+ - JDK-8264934, CVE-2022-21248: Enhance cross VM serialization
+ - JDK-8268488: More valuable DerValues
+ - JDK-8268494: Better inlining of inlined interfaces
+ - JDK-8268512: More content for ContentInfo
+ - JDK-8268795: Enhance digests of Jar files
+ - JDK-8268801: Improve PKCS attribute handling
+ - JDK-8268813, CVE-2022-21283: Better String matching
+ - JDK-8269151: Better construction of EncryptedPrivateKeyInfo
+ - JDK-8269944: Better HTTP transport redux
+ - JDK-8270392, CVE-2022-21293: Improve String constructions
+ - JDK-8270416, CVE-2022-21294: Enhance construction of Identity maps
+ - JDK-8270492, CVE-2022-21282: Better resolution of URIs
+ - JDK-8270498, CVE-2022-21296: Improve SAX Parser configuration management
+ - JDK-8270646, CVE-2022-21299: Improved scanning of XML entities
+ - JDK-8271962: Better TrueType font loading
+ - JDK-8271968: Better canonical naming
+ - JDK-8271987: Manifest improved manifest entries
+ - JDK-8272014, CVE-2022-21305: Better array indexing
+ - JDK-8272026, CVE-2022-21340: Verify Jar Verification
+ - JDK-8272236, CVE-2022-21341: Improve serial forms for transport
+ - JDK-8272272: Enhance jcmd communication
+ - JDK-8272462: Enhance image handling
+ - JDK-8273290: Enhance sound handling
+ - JDK-8273748, CVE-2022-21349: Improve Solaris font rendering
+ - JDK-8273756, CVE-2022-21360: Enhance BMP image support
+ - JDK-8273838, CVE-2022-21365: Enhanced BMP processing
* Other changes
- JDK-6801613: Cross-platform pageDialog and printDialog top margin entry broken
- JDK-8011541: [TEST_BUG] closed/javax/swing/plaf/metal/MetalUtils/bug6190373.java
fails NPE since 7u25b03
@@ -56,8 +83,10 @@ Live versions of these release notes can be found at:
- JDK-8261397: Try Catch Method Failing to Work When Dividing An Integer By 0
- JDK-8262731: [macOS] Exception from "Printable.print" is swallowed during
"PrinterJob.print"
- JDK-8272342: [TEST_BUG] java/awt/print/PrinterJob/PageDialogMarginTest.java catches
all exceptions
+ - JDK-8273308: PatternMatchTest.java fails on CI
- JDK-8273342: Null pointer dereference in classFileParser.cpp:2817
- JDK-8273826: Correct Manifest file name and NPE checks
+ - JDK-8273968: JCK javax_xml tests fail in CI
- JDK-8274407: (tz) Update Timezone Data to 2021c
- JDK-8274467: TestZoneInfo310.java fails with tzdata2021b
- JDK-8274468: TimeZoneTest.java fails with tzdata2021b
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index f65ab51..c39eaaa 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -329,7 +329,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project openjdk
%global shenandoah_repo shenandoah-jdk8u
-%global shenandoah_revision aarch64-shenandoah-jdk8u322-b05
+%global shenandoah_revision aarch64-shenandoah-jdk8u322-b06
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -349,7 +349,7 @@
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
# - N%%{?extraver}{?dist} for GA releases
-%global is_ga 0
+%global is_ga 1
%if %{is_ga}
%global milestone fcs
%global milestone_version %{nil}
@@ -2683,6 +2683,11 @@ cjc.mainProgram(args)
%endif
%changelog
+* Wed Feb 16 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-1
+- Update to aarch64-shenandoah-jdk8u322-b06 (EA)
+- Update release notes for 8u322-b06.
+- Switch to GA mode for final release.
+
* Tue Feb 15 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b05-0.1.ea
- Update to aarch64-shenandoah-jdk8u322-b05 (EA)
- Update release notes for 8u322-b05.
diff --git a/sources b/sources
index 12cd6db..35c822f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (openjdk-shenandoah-jdk8u-aarch64-shenandoah-jdk8u322-b05-4curve.tar.xz) =
5026d6bd2e6d052fa88fb27d7d9fca2f50c5cc66ca3a9e52f8d3903ec4c738c0c815c20dfd5dfd44ab0ec48d264a36c67f35c302c1eee06a1b2277d842035221
+SHA512 (openjdk-shenandoah-jdk8u-aarch64-shenandoah-jdk8u322-b06-4curve.tar.xz) =
0f2af8cacb1a4acdca7c1b2d5cc1e0d27f9abf8e05ccf7e8384074ac124132012b15e36abc31b498f746d6f5295530f535a9d9d85a3e45b387728b4ce726ccc7
commit c867f608e3471506aea129a45d31aa10d815b389
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Tue Feb 15 16:45:42 2022 +0000
Update to aarch64-shenandoah-jdk8u322-b05 (EA)
Update release notes for 8u322-b05.
Require tzdata 2021e as of JDK-8275766.
Update tarball generation script to use git following shenandoah-jdk8u's move to
github
diff --git a/.gitignore b/.gitignore
index f1536da..a986941 100644
--- a/.gitignore
+++ b/.gitignore
@@ -250,3 +250,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b02-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b03-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b04-4curve.tar.xz
+/openjdk-shenandoah-jdk8u-aarch64-shenandoah-jdk8u322-b05-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 9773926..b8a1f92 100644
--- a/NEWS
+++ b/NEWS
@@ -63,6 +63,9 @@ Live versions of these release notes can be found at:
- JDK-8274468: TimeZoneTest.java fails with tzdata2021b
- JDK-8274595: DisableRMIOverHTTPTest failed: connection refused
- JDK-8274779: HttpURLConnection: HttpClient and HttpsClient incorrectly check request
method when set to POST
+ - JDK-8275766: (tz) Update Timezone Data to 2021e
+ - JDK-8275849: TestZoneInfo310.java fails with tzdata2021e
+ - JDK-8276536: Update TimeZoneNames files to follow the changes made by JDK-8275766
Notes on individual issues:
===========================
diff --git a/generate_source_tarball.sh b/generate_source_tarball.sh
index c6f0756..61aad1f 100755
--- a/generate_source_tarball.sh
+++ b/generate_source_tarball.sh
@@ -7,9 +7,9 @@
# If you want to use a local copy of patch PR3822, set the path to it in the PR3822
variable
#
# In any case you have to set PROJECT_NAME REPO_NAME and VERSION. eg:
-# PROJECT_NAME=jdk8u OR aarch64-port
-# REPO_NAME=jdk8u60 OR jdk8u60
-# VERSION=jdk8u60-b27 OR aarch64-jdk8u65-b17 OR for head, keyword 'tip' should
do the job there
+# PROJECT_NAME=openjdk
+# REPO_NAME=shenandoah-jdk8u
+# VERSION=HEAD
#
# They are used to create correct name and are used in construction of sources url
(unless REPO_ROOT is set)
@@ -40,7 +40,7 @@ fi
set -e
-OPENJDK_URL_DEFAULT=http://hg.openjdk.java.net
+OPENJDK_URL_DEFAULT=https://github.com
COMPRESSION_DEFAULT=xz
# jdk is last for its size
REPOS_DEFAULT="hotspot corba jaxws jaxp langtools nashorn jdk"
@@ -99,7 +99,7 @@ if [ "x$FILE_NAME_ROOT" = "x" ] ; then
echo "No file name root specified; default to ${FILE_NAME_ROOT}"
fi
if [ "x$REPO_ROOT" = "x" ] ; then
- REPO_ROOT="${OPENJDK_URL}/${PROJECT_NAME}/${REPO_NAME}"
+ REPO_ROOT="${OPENJDK_URL}/${PROJECT_NAME}/${REPO_NAME}.git"
echo "No repository root specified; default to ${REPO_ROOT}"
fi;
if [ "x$REPOS" = "x" ] ; then
@@ -123,15 +123,9 @@ mkdir "${FILE_NAME_ROOT}"
pushd "${FILE_NAME_ROOT}"
echo "Cloning ${VERSION} root repository from ${REPO_ROOT}"
-hg clone ${REPO_ROOT} openjdk -r ${VERSION}
+git clone -b ${VERSION} ${REPO_ROOT} openjdk
pushd openjdk
-for subrepo in ${REPOS}
-do
- echo "Cloning ${VERSION} ${subrepo} repository from ${REPO_ROOT}"
- hg clone ${REPO_ROOT}/${subrepo} -r ${VERSION}
-done
-
# UnderlineTaglet.java has a BSD license with a field-of-use restriction, making it
non-Free
if [ -d langtools ] ; then
echo "Removing langtools test case with non-Free license"
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 9dc6a8a..f65ab51 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -327,9 +327,9 @@
%endif
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
-%global shenandoah_project aarch64-port
-%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u322-b04
+%global shenandoah_project openjdk
+%global shenandoah_repo shenandoah-jdk8u
+%global shenandoah_revision aarch64-shenandoah-jdk8u322-b05
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -344,7 +344,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 3
+%global rpmrelease 1
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1141,8 +1141,8 @@ Requires: ca-certificates
# Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros
Requires: javapackages-filesystem
# Require zoneinfo data provided by tzdata-java subpackage.
-# 2021c required as of JDK-8274407 in January 2022 CPU
-Requires: tzdata-java >= 2021c
+# 2021e required as of JDK-8275766 in January 2022 CPU
+Requires: tzdata-java >= 2021e
# for support of kernel stream control
# libsctp.so.1 is being `dlopen`ed on demand
Requires: lksctp-tools%{?_isa}
@@ -1514,8 +1514,8 @@ BuildRequires: java-%{buildjdkver}-openjdk-devel >=
1.7.0.151-2.6.11.3
%ifarch %{zero_arches}
BuildRequires: libffi-devel
%endif
-# 2021c required as of JDK-8274407 in January 2022 CPU
-BuildRequires: tzdata-java >= 2021c
+# 2021e required as of JDK-8275766 in January 2022 CPU
+BuildRequires: tzdata-java >= 2021e
# Earlier versions have a bug in tree vectorization on PPC
BuildRequires: gcc >= 4.8.3-8
@@ -2683,6 +2683,12 @@ cjc.mainProgram(args)
%endif
%changelog
+* Tue Feb 15 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b05-0.1.ea
+- Update to aarch64-shenandoah-jdk8u322-b05 (EA)
+- Update release notes for 8u322-b05.
+- Require tzdata 2021e as of JDK-8275766.
+- Update tarball generation script to use git following shenandoah-jdk8u's move to
github
+
* Mon Feb 07 2022 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:1.8.0.322.b04-0.3.ea
- Re-enable gdb backtrace check.
diff --git a/sources b/sources
index eb1f71f..12cd6db 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b04-4curve.tar.xz) =
ebc3cceb40f7ca567fd9fe751ba9762ad50ac474f63da5e2123cf268683db10132ffb09b6f6a99b3379c021b4fcc3b04a82bc81c2e63c8d4da0fdcf58d995322
+SHA512 (openjdk-shenandoah-jdk8u-aarch64-shenandoah-jdk8u322-b05-4curve.tar.xz) =
5026d6bd2e6d052fa88fb27d7d9fca2f50c5cc66ca3a9e52f8d3903ec4c738c0c815c20dfd5dfd44ab0ec48d264a36c67f35c302c1eee06a1b2277d842035221
commit d3b17054c227146584b900828461d6c414e1aad4
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Tue Feb 8 15:48:38 2022 +0000
Re-enable gdb backtrace check.
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 970234f..9dc6a8a 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -115,15 +115,10 @@
%global share_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64}
# Set of architectures which support JFR
%global jfr_arches %{jit_arches}
-# Set of architectures where we verify backtraces with gdb (ideally all)
-# Temporarily disable check on x86, x86_64, ppc64le and s390x as gdb crashes
-# ../../gdb/objfiles.h:510: internal-error: sect_index_data not initialized
-# A problem internal to GDB has been detected,
-# further debugging may prove unreliable.
-# See
https://bugzilla.redhat.com/show_bug.cgi?id=2041970
-%global gdb_arches sparcv9 sparc64 %{aarch64} %{arm} ppc s390
# Set of architectures for which alt-java has SSB mitigation
%global ssbd_arches x86_64
+# Set of architectures where we verify backtraces with gdb
+%global gdb_arches %{jit_arches} %{zero_arches}
# By default, we build a debug build during main build on JIT architectures
%if %{with slowdebug}
@@ -349,7 +344,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 2
+%global rpmrelease 3
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -2688,6 +2683,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Mon Feb 07 2022 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:1.8.0.322.b04-0.3.ea
+- Re-enable gdb backtrace check.
+
* Thu Jan 20 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b04-0.2.ea
- Temporarily move x86 to use Zero in order to get a working build
- Introduce architecture restriction logic for the gdb test. (RH2041970)
commit 2988ce90ffc176c047dcb63bb70e4c8ca1ec6d88
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Thu Jan 20 23:09:54 2022 +0000
Temporarily move x86 to use Zero in order to get a working build
Introduce architecture restriction logic for the gdb test.
Disable on x86, x86_64, ppc64le & s390x while these are broken in rawhide.
Replace GCC 11 patch to remove use of the register keyword with correct fix to ADLC
build (JDK-8281098)
Adjust JDK8199936/PR3533 -mstackrealign patch to instead pass
-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4
Refactor build functions so we can build just HotSpot without any attempt at
installation.
Explicitly list JIT architectures rather than relying on those with slowdebug builds
Disable the serviceability agent on Zero architectures even when the architecture
itself is supported
Add backport of JDK-8257794 to fix bogus assert on slowdebug x86-32 Zero builds
Resolves: rhbz#2045726
Related: rhbz#2051302
Related: rhbz#2041970
diff --git a/java-1.8.0-openjdk-gcc11.patch b/java-1.8.0-openjdk-gcc11.patch
deleted file mode 100644
index 2d0820d..0000000
--- a/java-1.8.0-openjdk-gcc11.patch
+++ /dev/null
@@ -1,74 +0,0 @@
-diff --git a/openjdk/hotspot/src/share/vm/adlc/adlparse.cpp
b/openjdk/hotspot/src/share/vm/adlc/adlparse.cpp
-index 31955ff7..6dcd90ac 100644
---- openjdk/hotspot/src/share/vm/adlc/adlparse.cpp
-+++ openjdk/hotspot/src/share/vm/adlc/adlparse.cpp
-@@ -4564,7 +4564,7 @@ char *ADLParser::get_paren_expr(const char *description, bool
include_location)
- // string(still inside the file buffer). Returns a pointer to the string or
- // NULL if some other token is found instead.
- char *ADLParser::get_ident_common(bool do_preproc) {
-- register char c;
-+ char c;
- char *start; // Pointer to start of token
- char *end; // Pointer to end of token
-
-@@ -4762,7 +4762,7 @@ char *ADLParser::get_unique_ident(FormDict& dict, const char*
nameDescription){
- // invokes a parse_err if the next token is not an integer.
- // This routine does not leave the integer null-terminated.
- int ADLParser::get_int(void) {
-- register char c;
-+ char c;
- char *start; // Pointer to start of token
- char *end; // Pointer to end of token
- int result; // Storage for integer result
-diff --git a/openjdk/hotspot/src/share/vm/adlc/arena.cpp
b/openjdk/hotspot/src/share/vm/adlc/arena.cpp
-index d7e4fc6e..406187ae 100644
---- openjdk/hotspot/src/share/vm/adlc/arena.cpp
-+++ openjdk/hotspot/src/share/vm/adlc/arena.cpp
-@@ -79,7 +79,7 @@ Arena::Arena( Arena *a )
- // Total of all Chunks in arena
- size_t Arena::used() const {
- size_t sum = _chunk->_len - (_max-_hwm); // Size leftover in this Chunk
-- register Chunk *k = _first;
-+ Chunk *k = _first;
- while( k != _chunk) { // Whilst have Chunks in a row
- sum += k->_len; // Total size of this Chunk
- k = k->_next; // Bump along to next Chunk
-@@ -93,7 +93,7 @@ void* Arena::grow( size_t x ) {
- // Get minimal required size. Either real big, or even bigger for giant objs
- size_t len = max(x, Chunk::size);
-
-- register Chunk *k = _chunk; // Get filled-up chunk address
-+ Chunk *k = _chunk; // Get filled-up chunk address
- _chunk = new (len) Chunk(len);
-
- if( k ) k->_next = _chunk; // Append new chunk to end of linked list
-diff --git a/openjdk/hotspot/src/share/vm/adlc/dict2.cpp
b/openjdk/hotspot/src/share/vm/adlc/dict2.cpp
-index f341a2b6..2dc60b25 100644
---- openjdk/hotspot/src/share/vm/adlc/dict2.cpp
-+++ openjdk/hotspot/src/share/vm/adlc/dict2.cpp
-@@ -283,9 +283,9 @@ void Dict::print(PrintKeyOrValue print_key, PrintKeyOrValue
print_value) {
- // limited to MAXID characters in length. Experimental evidence on 150K of
- // C text shows excellent spreading of values for any size hash table.
- int hashstr(const void *t) {
-- register char c, k = 0;
-- register int sum = 0;
-- register const char *s = (const char *)t;
-+ char c, k = 0;
-+ int sum = 0;
-+ const char *s = (const char *)t;
-
- while (((c = s[k]) != '\0') && (k < MAXID-1)) { // Get characters
till nul
- c = (char) ((c << 1) + 1); // Characters are always odd!
-diff --git a/openjdk/hotspot/src/share/vm/adlc/main.cpp
b/openjdk/hotspot/src/share/vm/adlc/main.cpp
-index 52044f12..40bcda74 100644
---- openjdk/hotspot/src/share/vm/adlc/main.cpp
-+++ openjdk/hotspot/src/share/vm/adlc/main.cpp
-@@ -58,7 +58,7 @@ int main(int argc, char *argv[])
-
- // Read command line arguments and file names
- for( int i = 1; i < argc; i++ ) { // For all arguments
-- register char *s = argv[i]; // Get option/filename
-+ char *s = argv[i]; // Get option/filename
-
- if( *s++ == '-' ) { // It's a flag? (not a filename)
- if( !*s ) { // Stand-alone `-' means stdin
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 43b33d4..970234f 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -24,6 +24,15 @@
%bcond_without release
# Remove build artifacts by default
%bcond_with artifacts
+# Build a fresh libjvm.so for use in a copy of the bootstrap JDK
+%bcond_without fresh_libjvm
+
+# Define whether to use the bootstrap JDK directly or with a fresh libjvm.so
+%if %{with fresh_libjvm}
+%global build_hotspot_first 1
+%else
+%global build_hotspot_first 0
+%endif
# The -g flag says to use strip -g instead of full strip on DSOs or EXEs.
# This fixes detailed NMT and other tools which need minimal debug info.
@@ -91,9 +100,9 @@
# Set of architectures for which we build fastdebug builds
%global fastdebug_arches x86_64 ppc64le aarch64
# Set of architectures with a Just-In-Time (JIT) compiler
-%global jit_arches %{debug_arches}
+%global jit_arches %{aarch64} %{power64} sparcv9 sparc64 x86_64
# Set of architectures which use the Zero assembler port (!jit_arches)
-%global zero_arches %{arm} ppc s390 s390x
+%global zero_arches %{arm} %{ix86} ppc s390 s390x
# Set of architectures which run a full bootstrap cycle
%global bootstrap_arches %{jit_arches} %{zero_arches}
# Set of architectures which support SystemTap tapsets
@@ -104,8 +113,15 @@
# See
https://bugzilla.redhat.com/show_bug.cgi?id=513605
# MetaspaceShared::generate_vtable_methods is not implemented for the PPC JIT
%global share_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64}
+# Set of architectures which support JFR
%global jfr_arches %{jit_arches}
-
+# Set of architectures where we verify backtraces with gdb (ideally all)
+# Temporarily disable check on x86, x86_64, ppc64le and s390x as gdb crashes
+# ../../gdb/objfiles.h:510: internal-error: sect_index_data not initialized
+# A problem internal to GDB has been detected,
+# further debugging may prove unreliable.
+# See
https://bugzilla.redhat.com/show_bug.cgi?id=2041970
+%global gdb_arches sparcv9 sparc64 %{aarch64} %{arm} ppc s390
# Set of architectures for which alt-java has SSB mitigation
%global ssbd_arches x86_64
@@ -143,7 +159,7 @@
%global fastdebug_build %{nil}
%endif
-# If you disable both builds, then the build fails
+# If you disable all builds, then the build fails
# Build and test slowdebug first as it provides the best diagnostics
%global build_loop %{slowdebug_build} %{fastdebug_build} %{normal_build}
@@ -156,6 +172,18 @@
%global bootstrap_targets images
%global release_targets images docs-zip
%global debug_targets images
+# Target to use to just build HotSpot
+%global hotspot_target hotspot
+
+# JDK to use for bootstrapping
+# Use OpenJDK 7 where available (on RHEL) to avoid
+# having to use the rhel-7.x-java-unsafe-candidate hack
+%if ! 0%{?fedora} && 0%{?rhel} <= 7
+%global buildjdkver 1.7.0
+%else
+%global buildjdkver 1.8.0
+%endif
+%global bootjdk /usr/lib/jvm/java-%{buildjdkver}-openjdk
# Disable LTO as this causes build failures at the moment.
# See RHBZ#1861401
@@ -321,7 +349,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 1
+%global rpmrelease 2
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -814,8 +842,10 @@ exit 0
%{_jvmdir}/%{jredir -- %{?1}}/lib/%{archinstall}/libnio.so
%{_jvmdir}/%{jredir -- %{?1}}/lib/%{archinstall}/libnpt.so
%ifarch %{sa_arches}
+%ifnarch %{zero_arches}
%{_jvmdir}/%{jredir -- %{?1}}/lib/%{archinstall}/libsaproc.so
%endif
+%endif
%{_jvmdir}/%{jredir -- %{?1}}/lib/%{archinstall}/libsctp.so
%{_jvmdir}/%{jredir -- %{?1}}/lib/%{archinstall}/libsunec.so
%{_jvmdir}/%{jredir -- %{?1}}/lib/%{archinstall}/libsystemconf.so
@@ -952,8 +982,10 @@ exit 0
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/jconsole.jar
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/orb.idl
%ifarch %{sa_arches}
+%ifnarch %{zero_arches}
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/sa-jdi.jar
%endif
+%endif
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/dt.jar
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/jexec
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/tools.jar
@@ -1215,7 +1247,7 @@ Provides: java-%{origin}-src%{?1} = %{epoch}:%{version}-%{release}
Name: java-%{javaver}-%{origin}
Version: %{javaver}.%{updatever}.%{buildver}
-Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}.1
+Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
# java-1.5.0-ibm from
jpackage.org set Epoch to 1 for unknown reasons
# and this change was brought into RHEL-4. java-1.5.0-ibm packages
# also included the epoch in their virtual provides. This created a
@@ -1358,8 +1390,8 @@ Patch600: rh1750419-redhat_alt_java.patch
# JDK-8218811: replace open by os::open in hotspot coding
# This fixes a GCC 10 build issue
Patch111: jdk8218811-perfMemory_linux.patch
-# Similar for GCC 11
-Patch112: %{name}-gcc11.patch
+# JDK-8281098, PR3836: Extra compiler flags not passed to adlc build
+Patch112: jdk8281098-pr3836-pass_compiler_flags_to_adlc.patch
#############################################
#
@@ -1404,6 +1436,8 @@ Patch203: jdk8042159-allow_using_system_installed_lcms2-root.patch
Patch204: jdk8042159-allow_using_system_installed_lcms2-jdk.patch
# JDK-8195607, PR3776, RH1760437: sun/security/pkcs11/Secmod/TestNssDbSqlite.java failed
with "NSS initialization failed" on NSS 3.34.1
Patch580: jdk8195607-pr3776-rh1760437-nss_sqlite_db_config.patch
+# JDK-8257794: Zero: assert(istate->_stack_limit ==
istate->_thread->last_Java_sp() + 1) failed: wrong on Linux/x86_32
+Patch581: jdk8257794-remove_broken_assert.patch
#############################################
#
@@ -1479,16 +1513,10 @@ BuildRequires: pkgconfig
BuildRequires: xorg-x11-proto-devel
BuildRequires: zip
BuildRequires: unzip
-# Use OpenJDK 7 where available (on RHEL) to avoid
-# having to use the rhel-7.x-java-unsafe-candidate hack
-%if ! 0%{?fedora} && 0%{?rhel} <= 7
# Require a boot JDK which doesn't fail due to RH1482244
-BuildRequires: java-1.7.0-openjdk-devel >= 1.7.0.151-2.6.11.3
-%else
-BuildRequires: java-1.8.0-openjdk-devel
-%endif
+BuildRequires: java-%{buildjdkver}-openjdk-devel >= 1.7.0.151-2.6.11.3
# Zero-assembler build requirement
-%ifnarch %{jit_arches}
+%ifarch %{zero_arches}
BuildRequires: libffi-devel
%endif
# 2021c required as of JDK-8274407 in January 2022 CPU
@@ -1843,6 +1871,7 @@ sh %{SOURCE12}
%patch111
%patch112
%patch580
+%patch581
# RPM-only fixes
%patch539
@@ -1953,10 +1982,9 @@ export EXTRA_CFLAGS EXTRA_ASFLAGS
function buildjdk() {
local outputdir=${1}
- local installdir=${2}
- local buildjdk=${3}
- local maketargets=${4}
- local debuglevel=${5}
+ local buildjdk=${2}
+ local maketargets="${3}"
+ local debuglevel=${4}
local top_srcdir_abs_path=$(pwd)/%{top_level_dir_name}
# Variable used in hs_err hook on build failures
@@ -1966,7 +1994,7 @@ function buildjdk() {
${buildjdk}/bin/java -version
echo "Building 8u%{updatever}-%{buildver}, milestone %{milestone}"
- mkdir -p ${outputdir} ${installdir}
+ mkdir -p ${outputdir}
pushd ${outputdir}
bash ${top_srcdir_abs_path}/configure \
@@ -1975,7 +2003,7 @@ function buildjdk() {
%else
--disable-jfr \
%endif
-%ifnarch %{jit_arches}
+%ifarch %{zero_arches}
--with-jvm-variants=zero \
%endif
--with-native-debug-symbols=internal \
@@ -2011,24 +2039,16 @@ function buildjdk() {
SCTP_WERROR= \
${maketargets} || ( pwd; find ${top_srcdir_abs_path} ${top_builddir_abs_path} -name
"hs_err_pid*.log" | xargs cat && false )
- # the build (erroneously) removes read permissions from some jars
- # this is a regression in OpenJDK 7 (our compiler):
- #
http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=1437
- find images/%{jdkimage} -iname '*.jar' -exec chmod ugo+r {} \;
- chmod ugo+r images/%{jdkimage}/lib/ct.sym
-
- # remove redundant *diz and *debuginfo files
- find images/%{jdkimage} -iname '*.diz' -exec rm -v {} \;
- find images/%{jdkimage} -iname '*.debuginfo' -exec rm -v {} \;
-
- # Build screws up permissions on binaries
- #
https://bugs.openjdk.java.net/browse/JDK-8173610
- find images/%{jdkimage} -iname '*.so' -exec chmod +x {} \;
- find images/%{jdkimage}/bin/ -exec chmod +x {} \;
+ popd
+}
- popd >& /dev/null
+function installjdk() {
+ local outputdir=${1}
+ local installdir=${2}
+ local imagepath=${installdir}/images/%{jdkimage}
echo "Installing build from ${outputdir} to ${installdir}..."
+ mkdir -p ${installdir}
echo "Installing images..."
mv ${outputdir}/images ${installdir}
if [ -d ${outputdir}/bundles ] ; then
@@ -2044,8 +2064,35 @@ function buildjdk() {
echo "Removing output directory...";
rm -rf ${outputdir}
%endif
+
+ if [ -d ${imagepath} ] ; then
+ # the build (erroneously) removes read permissions from some jars
+ # this is a regression in OpenJDK 7 (our compiler):
+ #
http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=1437
+ find ${imagepath} -iname '*.jar' -exec chmod ugo+r {} \;
+ chmod ugo+r ${imagepath}/lib/ct.sym
+
+ # remove redundant *diz and *debuginfo files
+ find ${imagepath} -iname '*.diz' -exec rm -v {} \;
+ find ${imagepath} -iname '*.debuginfo' -exec rm -v {} \;
+
+ # Build screws up permissions on binaries
+ #
https://bugs.openjdk.java.net/browse/JDK-8173610
+ find ${imagepath} -iname '*.so' -exec chmod +x {} \;
+ find ${imagepath}/bin/ -exec chmod +x {} \;
+ fi
}
+%if %{build_hotspot_first}
+ # Build a fresh libjvm.so first and use it to bootstrap
+ cp -LR --preserve=mode,timestamps %{bootjdk} newboot
+ systemjdk=$(pwd)/newboot
+ buildjdk build/newboot ${systemjdk} %{hotspot_target} "release"
"bundled"
+ mv build/newboot/hotspot/dist/jre/lib/%{archinstall}/server/libjvm.so
newboot/jre/lib/%{archinstall}/server
+%else
+ systemjdk=%{bootjdk}
+%endif
+
for suffix in %{build_loop} ; do
if [ "x$suffix" = "x" ] ; then
debugbuild=release
@@ -2054,7 +2101,6 @@ else
debugbuild=`echo $suffix | sed "s/-//g"`
fi
-systemjdk=/usr/lib/jvm/java-openjdk
builddir=%{buildoutputdir -- $suffix}
bootbuilddir=boot${builddir}
installdir=%{installoutputdir -- $suffix}
@@ -2072,11 +2118,14 @@ else
fi
if ${run_bootstrap} ; then
- buildjdk ${bootbuilddir} ${bootinstalldir} ${systemjdk}
"%{bootstrap_targets}" ${debugbuild}
- buildjdk ${builddir} ${installdir} $(pwd)/${bootinstalldir}/images/%{jdkimage}
"${maketargets}" ${debugbuild}
+ buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild}
+ installjdk ${bootbuilddir} ${bootinstalldir}
+ buildjdk ${builddir} $(pwd)/${bootinstalldir}/images/%{jdkimage}
"${maketargets}" ${debugbuild}
+ installjdk ${builddir} ${installdir}
%{!?with_artifacts:rm -rf ${bootinstalldir}}
else
- buildjdk ${builddir} ${installdir} ${systemjdk} "${maketargets}"
${debugbuild}
+ buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild}
+ installjdk ${builddir} ${installdir}
fi
# Install nss.cfg right away as we will be using the JRE above
@@ -2197,7 +2246,9 @@ end
run -version
EOF
+%ifarch %{gdb_arches}
grep 'JavaCallWrapper::JavaCallWrapper' gdb.out
+%endif
# Check src.zip has all sources. See RHBZ#1130490
jar -tf $JAVA_HOME/src.zip | grep 'sun.misc.Unsafe'
@@ -2637,6 +2688,20 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Jan 20 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b04-0.2.ea
+- Temporarily move x86 to use Zero in order to get a working build
+- Introduce architecture restriction logic for the gdb test. (RH2041970)
+- Disable on x86, x86_64, ppc64le & s390x while these are broken in rawhide.
+- Replace GCC 11 patch to remove use of the register keyword with correct fix to ADLC
build (JDK-8281098)
+- Adjust JDK8199936/PR3533 -mstackrealign patch to instead pass
-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4
+- Refactor build functions so we can build just HotSpot without any attempt at
installation.
+- Explicitly list JIT architectures rather than relying on those with slowdebug builds
+- Disable the serviceability agent on Zero architectures even when the architecture
itself is supported
+- Add backport of JDK-8257794 to fix bogus assert on slowdebug x86-32 Zero builds
+- Resolves: rhbz#2045726
+- Related: rhbz#2051302
+- Related: rhbz#2041970
+
* Thu Jan 20 2022 Fedora Release Engineering <releng(a)fedoraproject.org> -
1:1.8.0.322.b04-0.1.ea.1
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
diff --git
a/jdk8199936-pr3533-enable_mstackrealign_on_x86_linux_as_well_as_x86_mac_os_x.patch
b/jdk8199936-pr3533-enable_mstackrealign_on_x86_linux_as_well_as_x86_mac_os_x.patch
index ae48068..0af9d51 100644
--- a/jdk8199936-pr3533-enable_mstackrealign_on_x86_linux_as_well_as_x86_mac_os_x.patch
+++ b/jdk8199936-pr3533-enable_mstackrealign_on_x86_linux_as_well_as_x86_mac_os_x.patch
@@ -22,7 +22,7 @@ diff --git openjdk.orig///common/autoconf/flags.m4
openjdk///common/autoconf/fla
+ # On 32-bit MacOSX the OS requires C-entry points to be 16 byte aligned.
+ # While waiting for a better solution, the current workaround is to use
-mstackrealign
+ # This is also required on Linux systems which use libraries compiled with SSE
instructions
-+ REALIGN_CFLAG="-mstackrealign"
++ REALIGN_CFLAG="-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4"
+ FLAGS_COMPILER_CHECK_ARGUMENTS([$REALIGN_CFLAG -Werror], [],
+ AC_MSG_ERROR([The selected compiler $CXX does not support -mstackrealign! Try to
put another compiler in the path.])
+ )
diff --git a/jdk8257794-remove_broken_assert.patch
b/jdk8257794-remove_broken_assert.patch
new file mode 100644
index 0000000..bb88013
--- /dev/null
+++ b/jdk8257794-remove_broken_assert.patch
@@ -0,0 +1,13 @@
+diff --git openjdk.orig/hotspot/src/share/vm/interpreter/bytecodeInterpreter.cpp
openjdk/hotspot/src/share/vm/interpreter/bytecodeInterpreter.cpp
+--- openjdk.orig/hotspot/src/share/vm/interpreter/bytecodeInterpreter.cpp
++++ openjdk/hotspot/src/share/vm/interpreter/bytecodeInterpreter.cpp
+@@ -493,9 +493,6 @@
+ assert(labs(istate->_stack_base - istate->_stack_limit) ==
(istate->_method->max_stack() + extra_stack_entries
+
+ 1), "bad stack limit");
+ }
+-#ifndef SHARK
+- IA32_ONLY(assert(istate->_stack_limit == istate->_thread->last_Java_sp() +
1, "wrong"));
+-#endif // !SHARK
+ }
+ // Verify linkages.
+ interpreterState l = istate;
diff --git a/jdk8281098-pr3836-pass_compiler_flags_to_adlc.patch
b/jdk8281098-pr3836-pass_compiler_flags_to_adlc.patch
new file mode 100644
index 0000000..774a08e
--- /dev/null
+++ b/jdk8281098-pr3836-pass_compiler_flags_to_adlc.patch
@@ -0,0 +1,67 @@
+# HG changeset patch
+# User Andrew John Hughes <gnu_andrew(a)member.fsf.org>
+# Date 1620365804 -3600
+# Fri May 07 06:36:44 2021 +0100
+# Node ID 39b62f35eca823b4c9a98bc1dc0cb9acb87360f8
+# Parent 723b59ed1afe878c5cd35f080399c8ceec4f776b
+PR3836: Extra compiler flags not passed to adlc build
+
+diff --git openjdk.orig/hotspot/make/aix/makefiles/adlc.make
openjdk/hotspot/make/aix/makefiles/adlc.make
+--- openjdk.orig/hotspot/make/aix/makefiles/adlc.make
++++ openjdk/hotspot/make/aix/makefiles/adlc.make
+@@ -69,6 +69,11 @@
+ CFLAGS_WARN = -w
+ CFLAGS += $(CFLAGS_WARN)
+
++# Extra flags from gnumake's invocation or environment
++CFLAGS += $(EXTRA_CFLAGS)
++LFLAGS += $(EXTRA_CFLAGS) $(EXTRA_LDFLAGS)
++ASFLAGS += $(EXTRA_ASFLAGS)
++
+ OBJECTNAMES = \
+ adlparse.o \
+ archDesc.o \
+diff --git openjdk.orig/hotspot/make/bsd/makefiles/adlc.make
openjdk/hotspot/make/bsd/makefiles/adlc.make
+--- openjdk.orig/hotspot/make/bsd/makefiles/adlc.make
++++ openjdk/hotspot/make/bsd/makefiles/adlc.make
+@@ -71,6 +71,11 @@
+ endif
+ CFLAGS += $(CFLAGS_WARN)
+
++# Extra flags from gnumake's invocation or environment
++CFLAGS += $(EXTRA_CFLAGS)
++LFLAGS += $(EXTRA_CFLAGS) $(EXTRA_LDFLAGS)
++ASFLAGS += $(EXTRA_ASFLAGS)
++
+ OBJECTNAMES = \
+ adlparse.o \
+ archDesc.o \
+diff --git openjdk.orig/hotspot/make/linux/makefiles/adlc.make
openjdk/hotspot/make/linux/makefiles/adlc.make
+--- openjdk.orig/hotspot/make/linux/makefiles/adlc.make
++++ openjdk/hotspot/make/linux/makefiles/adlc.make
+@@ -69,6 +69,11 @@
+ CFLAGS_WARN = $(WARNINGS_ARE_ERRORS)
+ CFLAGS += $(CFLAGS_WARN)
+
++# Extra flags from gnumake's invocation or environment
++CFLAGS += $(EXTRA_CFLAGS)
++LFLAGS += $(EXTRA_CFLAGS) $(EXTRA_LDFLAGS)
++ASFLAGS += $(EXTRA_ASFLAGS)
++
+ OBJECTNAMES = \
+ adlparse.o \
+ archDesc.o \
+diff --git openjdk.orig/hotspot/make/solaris/makefiles/adlc.make
openjdk/hotspot/make/solaris/makefiles/adlc.make
+--- openjdk.orig/hotspot/make/solaris/makefiles/adlc.make
++++ openjdk/hotspot/make/solaris/makefiles/adlc.make
+@@ -85,6 +85,10 @@
+ endif
+ CFLAGS += $(CFLAGS_WARN)
+
++# Extra flags from gnumake's invocation or environment
++CFLAGS += $(EXTRA_CFLAGS)
++ASFLAGS += $(EXTRA_ASFLAGS)
++
+ ifeq ("${Platform_compiler}", "sparcWorks")
+ # Enable the following CFLAGS addition if you need to compare the
+ # built ELF objects.
commit 0c44bffbcb44fd08cbe5e315cf30235d94a22ff0
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Mon Jan 24 19:18:03 2022 +0000
Fix FIPS issues in native code and with initialisation of java.security.Security
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index df79314..416b52b 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -321,7 +321,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 1
+%global rpmrelease 2
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1327,6 +1327,9 @@ Patch1007: rh1929465-improve_system_FIPS_detection-jdk.patch
Patch1008: rh1996182-login_to_nss_software_token.patch
# RH1991003: Allow plain key import unless com.redhat.fips.plainKeySupport is set to
false
Patch1011: rh1991003-enable_fips_keys_import.patch
+# RH2021263: Resolve outstanding FIPS issues
+Patch1014: rh2021263-fips_ensure_security_initialised.patch
+Patch1015: rh2021263-fips_missing_native_returns.patch
#############################################
#
@@ -1857,6 +1860,8 @@ sh %{SOURCE12}
%patch1007
%patch1008
%patch1011
+%patch1014
+%patch1015
# RHEL-only patches
%if ! 0%{?fedora} && 0%{?rhel} <= 7
@@ -2637,6 +2642,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Mon Jan 24 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-2
+- Fix FIPS issues in native code and with initialisation of java.security.Security
+
* Mon Jan 24 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-1
- Update to aarch64-shenandoah-jdk8u322-b06 (GA)
- Update release notes for 8u322-b06.
diff --git a/rh2021263-fips_ensure_security_initialised.patch
b/rh2021263-fips_ensure_security_initialised.patch
new file mode 100644
index 0000000..5aa9ec7
--- /dev/null
+++ b/rh2021263-fips_ensure_security_initialised.patch
@@ -0,0 +1,28 @@
+commit 06c2decab204fcce5aca2d285953fcac1820b1ae
+Author: Andrew John Hughes <andrew(a)openjdk.org>
+Date: Mon Jan 24 01:23:28 2022 +0000
+
+ RH2021263: Make sure java.security.Security is initialised when retrieving
JavaSecuritySystemConfiguratorAccess instance
+
+diff --git openjdk.orig/jdk/src/share/classes/sun/misc/SharedSecrets.java
openjdk/jdk/src/share/classes/sun/misc/SharedSecrets.java
+index 40ca609e02..0dafe6f59c 100644
+--- openjdk.orig/jdk/src/share/classes/sun/misc/SharedSecrets.java
++++ openjdk/jdk/src/share/classes/sun/misc/SharedSecrets.java
+@@ -31,6 +31,7 @@ import java.io.Console;
+ import java.io.FileDescriptor;
+ import java.io.ObjectInputStream;
+ import java.security.ProtectionDomain;
++import java.security.Security;
+ import java.security.Signature;
+
+ import java.security.AccessController;
+@@ -255,6 +256,9 @@ public class SharedSecrets {
+ }
+
+ public static JavaSecuritySystemConfiguratorAccess
getJavaSecuritySystemConfiguratorAccess() {
++ if (javaSecuritySystemConfiguratorAccess == null) {
++ unsafe.ensureClassInitialized(Security.class);
++ }
+ return javaSecuritySystemConfiguratorAccess;
+ }
+ }
diff --git a/rh2021263-fips_missing_native_returns.patch
b/rh2021263-fips_missing_native_returns.patch
new file mode 100644
index 0000000..90cc44e
--- /dev/null
+++ b/rh2021263-fips_missing_native_returns.patch
@@ -0,0 +1,24 @@
+commit 7f58a05104138ebdfd3b7b968ed67ea4c8573073
+Author: Fridrich Strba <fstrba(a)suse.com>
+Date: Mon Jan 24 01:10:57 2022 +0000
+
+ RH2021263: Return in C code after having generated Java exception
+
+diff --git openjdk.orig/jdk/src/solaris/native/java/security/systemconf.c
openjdk/jdk/src/solaris/native/java/security/systemconf.c
+index 6f4656bfcb..34d0ff0ce9 100644
+--- openjdk.orig/jdk/src/solaris/native/java/security/systemconf.c
++++ openjdk/jdk/src/solaris/native/java/security/systemconf.c
+@@ -131,11 +131,13 @@ JNIEXPORT jboolean JNICALL
Java_java_security_SystemConfigurator_getSystemFIPSEn
+ dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH);
+ if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) {
+ throwIOException(env, "Cannot open " FIPS_ENABLED_PATH);
++ return JNI_FALSE;
+ }
+ fips_enabled = fgetc(fe);
+ fclose(fe);
+ if (fips_enabled == EOF) {
+ throwIOException(env, "Cannot read " FIPS_ENABLED_PATH);
++ return JNI_FALSE;
+ }
+ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \
+ " read character is '%c'", fips_enabled);
commit 1df9f60904f8e1ac182c80755a94cfca094e8844
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Mon Dec 6 00:42:17 2021 +0000
Update to aarch64-shenandoah-jdk8u322-b06
Update release notes for 8u322-b06.
Require tzdata 2021e as of JDK-8275766.
Update tarball generation script to use git following shenandoah-jdk8u's move to
github
Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
diff --git a/.gitignore b/.gitignore
index d5493bd..c3d10c5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -246,3 +246,9 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b05-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b05-shenandoah-merge-2021-10-07-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b07-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b01-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b02-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b03-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b04-4curve.tar.xz
+/openjdk-shenandoah-jdk8u-aarch64-shenandoah-jdk8u322-b05-4curve.tar.xz
+/openjdk-shenandoah-jdk8u-aarch64-shenandoah-jdk8u322-b06-4curve.tar.xz
diff --git a/NEWS b/NEWS
index ef9db68..e911b13 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,132 @@ Key:
JDK-X -
https://bugs.openjdk.java.net/browse/JDK-X
CVE-XXXX-YYYY:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
+New in release OpenJDK 8u322 (2022-01-18):
+===========================================
+Live versions of these release notes can be found at:
+ *
https://bitly.com/openjdk8u322
+ *
https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u322.txt
+
+* Security fixes
+ - JDK-8264934, CVE-2022-21248: Enhance cross VM serialization
+ - JDK-8268488: More valuable DerValues
+ - JDK-8268494: Better inlining of inlined interfaces
+ - JDK-8268512: More content for ContentInfo
+ - JDK-8268795: Enhance digests of Jar files
+ - JDK-8268801: Improve PKCS attribute handling
+ - JDK-8268813, CVE-2022-21283: Better String matching
+ - JDK-8269151: Better construction of EncryptedPrivateKeyInfo
+ - JDK-8269944: Better HTTP transport redux
+ - JDK-8270392, CVE-2022-21293: Improve String constructions
+ - JDK-8270416, CVE-2022-21294: Enhance construction of Identity maps
+ - JDK-8270492, CVE-2022-21282: Better resolution of URIs
+ - JDK-8270498, CVE-2022-21296: Improve SAX Parser configuration management
+ - JDK-8270646, CVE-2022-21299: Improved scanning of XML entities
+ - JDK-8271962: Better TrueType font loading
+ - JDK-8271968: Better canonical naming
+ - JDK-8271987: Manifest improved manifest entries
+ - JDK-8272014, CVE-2022-21305: Better array indexing
+ - JDK-8272026, CVE-2022-21340: Verify Jar Verification
+ - JDK-8272236, CVE-2022-21341: Improve serial forms for transport
+ - JDK-8272272: Enhance jcmd communication
+ - JDK-8272462: Enhance image handling
+ - JDK-8273290: Enhance sound handling
+ - JDK-8273748, CVE-2022-21349: Improve Solaris font rendering
+ - JDK-8273756, CVE-2022-21360: Enhance BMP image support
+ - JDK-8273838, CVE-2022-21365: Enhanced BMP processing
+* Other changes
+ - JDK-6801613: Cross-platform pageDialog and printDialog top margin entry broken
+ - JDK-8011541: [TEST_BUG] closed/javax/swing/plaf/metal/MetalUtils/bug6190373.java
fails NPE since 7u25b03
+ - JDK-8025430: [TEST_BUG] javax/swing/JEditorPane/5076514/bug5076514.java failed since
jdk8b108
+ - JDK-8041928: MouseEvent.getModifiersEx gives wrong result
+ - JDK-8042199: The build of J2DBench via makefile is broken after the JDK-8005402
+ - JDK-8044365: (dc) MulticastSendReceiveTests.java failing with ENOMEM when joining
group (OS X 10.9)
+ - JDK-8048021: Remove @version tag in jaxp repo
+ - JDK-8049348: compiler/intrinsics/bmi/verifycode tests on lzcnt and tzcnt use
incorrect assumption about REXB prefix usage
+ - JDK-8060027: Tests java/beans/XMLEncoder/Test4903007.java and
java/beans/XMLEncoder/java_awt_GridBagLayout.java
+ - JDK-8066588: javax/management/remote/mandatory/connection/RMIConnector_NPETest.java
fails to compile
+ - JDK-8066652: Default TimeZone is GMT not local if user.timezone is invalid on Mac OS
+ - JDK-8069034: gc/g1/TestEagerReclaimHumongousRegionsClearMarkBits.java nightly
failure
+ - JDK-8077590: windows_i586_6.2-product-c2-runThese8_Xcomp_vm failing after win
compiler upgrade
+ - JDK-8080287: The image of BufferedImage.TYPE_INT_ARGB and
BufferedImage.TYPE_INT_ARGB_PRE is blank
+ - JDK-8140329: [TEST_BUG] test FullScreenAfterSplash.java failed because image was not
generated
+ - JDK-8140472: java/net/ipv6tests/TcpTest.java failed intermittently with
java.net.BindException: Address already in use: NET_Bind
+ - JDK-8147051: StaxEntityResolverWrapper should create StaxXMLInputSource with a
resolver indicator
+ - JDK-8148915: Intermittent failures of bug6400879.java
+ - JDK-8176837: SunPKCS11 provider needs to check more details on PKCS11 Mechanism
+ - JDK-8177393: Result of RescaleOp for 4BYTE_ABGR images may be 25% black
+ - JDK-8177536: Avoid Apple Peer-to-Peer interfaces in networking tests
+ - JDK-8182036: Load from initializing arraycopy uses wrong memory state
+ - JDK-8183369: RFC unconformity of HttpURLConnection with proxy
+ - JDK-8183543: Aarch64: C2 compilation often fails with "failed
spill-split-recycle sanity check"
+ - JDK-8187450: JNI local refs exceeds capacity warning in NetworkInterface::getAll
+ - JDK-8187649: ArrayIndexOutOfBoundsException in java.util.JapaneseImperialCalendar
+ - JDK-8190482: InnocuousThread creation should not require the caller to possess
enableContextClassLoaderOverride
+ - JDK-8190793: Httpserver does not detect truncated request body
+ - JDK-8196572: Tests ColConvCCMTest.java and MTColConvTest.java fail
+ - JDK-8202788: Explicitly reclaim cached thread-local direct buffers at thread exit
+ - JDK-8210058: Algorithmic Italic font leans opposite angle in Printing
+ - JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs instead of aliased B&W
glyphs
+ - JDK-8225082: Remove IdenTrust certificate that is expiring in September 2021
+ - JDK-8225083: Remove Google certificate that is expiring in December 2021
+ - JDK-8226806: [macOS 10.14] Methods of Java Robot should be called from appropriate
thread
+ - JDK-8231254: (fs) Add test for macOS Catalina changes to protect system software
+ - JDK-8231438: [macOS] Dark mode for the desktop is not supported
+ - JDK-8232178: MacVolumesTest failed after upgrade to MacOS Catalina
+ - JDK-8232226: [macos 10.15] test/jdk/java/awt/color/EqualityTest/EqualityTest.java may
fail
+ - JDK-8235153: [TESTBUG] [macos 10.15]
java/awt/Graphics/DrawImageBG/SystemBgColorTest.java fails
+ - JDK-8236897: Fix the copyright header for pkcs11gcm2.h
+ - JDK-8237499: JFR: Include stack trace in the ThreadStart event
+ - JDK-8239886: Minimal VM build fails after JDK-8237499
+ - JDK-8261397: Try Catch Method Failing to Work When Dividing An Integer By 0
+ - JDK-8262731: [macOS] Exception from "Printable.print" is swallowed during
"PrinterJob.print"
+ - JDK-8272342: [TEST_BUG] java/awt/print/PrinterJob/PageDialogMarginTest.java catches
all exceptions
+ - JDK-8273308: PatternMatchTest.java fails on CI
+ - JDK-8273342: Null pointer dereference in classFileParser.cpp:2817
+ - JDK-8273826: Correct Manifest file name and NPE checks
+ - JDK-8273968: JCK javax_xml tests fail in CI
+ - JDK-8274407: (tz) Update Timezone Data to 2021c
+ - JDK-8274467: TestZoneInfo310.java fails with tzdata2021b
+ - JDK-8274468: TimeZoneTest.java fails with tzdata2021b
+ - JDK-8274595: DisableRMIOverHTTPTest failed: connection refused
+ - JDK-8274779: HttpURLConnection: HttpClient and HttpsClient incorrectly check request
method when set to POST
+ - JDK-8275766: (tz) Update Timezone Data to 2021e
+ - JDK-8275849: TestZoneInfo310.java fails with tzdata2021e
+ - JDK-8276536: Update TimeZoneNames files to follow the changes made by JDK-8275766
+
+Notes on individual issues:
+===========================
+
+security-libs/java.security:
+
+JDK-8271434: Removed IdenTrust Root Certificate
+===============================================
+The following root certificate from IdenTrust has been removed from
+the `cacerts` keystore:
+
+Alias Name: identrustdstx3 [jdk]
+Distinguished Name: CN=DST Root CA X3, O=Digital Signature Trust Co.
+
+JDK-8272535: Removed Google's GlobalSign Root Certificate
+=========================================================
+The following root certificate from Google has been removed from the
+`cacerts` keystore:
+
+Alias Name: globalsignr2ca [jdk]
+Distinguished Name: CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2
+
+core-libs/java.time:
+
+JDK-8274857: Update Timezone Data to 2021c
+===========================================
+IANA Time Zone Database, on which JDK's Date/Time libraries are based,
+has been updated to version 2021c
+(https://mm.icann.org/pipermail/tz-announce/2021-October/000067.html). Note
+that with this update, some of the time zone rules prior to the year
+1970 have been modified according to the changes which were introduced
+with 2021b. For more detail, refer to the announcement of 2021b
+(https://mm.icann.org/pipermail/tz-announce/2021-September/000066.html)
+
New in release OpenJDK 8u312 (2021-10-19):
===========================================
Live versions of these release notes can be found at:
diff --git a/generate_source_tarball.sh b/generate_source_tarball.sh
index c6f0756..61aad1f 100755
--- a/generate_source_tarball.sh
+++ b/generate_source_tarball.sh
@@ -7,9 +7,9 @@
# If you want to use a local copy of patch PR3822, set the path to it in the PR3822
variable
#
# In any case you have to set PROJECT_NAME REPO_NAME and VERSION. eg:
-# PROJECT_NAME=jdk8u OR aarch64-port
-# REPO_NAME=jdk8u60 OR jdk8u60
-# VERSION=jdk8u60-b27 OR aarch64-jdk8u65-b17 OR for head, keyword 'tip' should
do the job there
+# PROJECT_NAME=openjdk
+# REPO_NAME=shenandoah-jdk8u
+# VERSION=HEAD
#
# They are used to create correct name and are used in construction of sources url
(unless REPO_ROOT is set)
@@ -40,7 +40,7 @@ fi
set -e
-OPENJDK_URL_DEFAULT=http://hg.openjdk.java.net
+OPENJDK_URL_DEFAULT=https://github.com
COMPRESSION_DEFAULT=xz
# jdk is last for its size
REPOS_DEFAULT="hotspot corba jaxws jaxp langtools nashorn jdk"
@@ -99,7 +99,7 @@ if [ "x$FILE_NAME_ROOT" = "x" ] ; then
echo "No file name root specified; default to ${FILE_NAME_ROOT}"
fi
if [ "x$REPO_ROOT" = "x" ] ; then
- REPO_ROOT="${OPENJDK_URL}/${PROJECT_NAME}/${REPO_NAME}"
+ REPO_ROOT="${OPENJDK_URL}/${PROJECT_NAME}/${REPO_NAME}.git"
echo "No repository root specified; default to ${REPO_ROOT}"
fi;
if [ "x$REPOS" = "x" ] ; then
@@ -123,15 +123,9 @@ mkdir "${FILE_NAME_ROOT}"
pushd "${FILE_NAME_ROOT}"
echo "Cloning ${VERSION} root repository from ${REPO_ROOT}"
-hg clone ${REPO_ROOT} openjdk -r ${VERSION}
+git clone -b ${VERSION} ${REPO_ROOT} openjdk
pushd openjdk
-for subrepo in ${REPOS}
-do
- echo "Cloning ${VERSION} ${subrepo} repository from ${REPO_ROOT}"
- hg clone ${REPO_ROOT}/${subrepo} -r ${VERSION}
-done
-
# UnderlineTaglet.java has a BSD license with a field-of-use restriction, making it
non-Free
if [ -d langtools ] ; then
echo "Removing langtools test case with non-Free license"
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 7b01ed0..df79314 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -86,13 +86,18 @@
%global ppc64be ppc64 ppc64p7
# Set of architectures which support multiple ABIs
%global multilib_arches %{power64} sparc64 x86_64
-# Set of architectures for which we build debug builds
+# Set of architectures for which we build slowdebug builds
%global debug_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64}
+# Set of architectures for which we build fastdebug builds
+%global fastdebug_arches x86_64 ppc64le aarch64
# Set of architectures with a Just-In-Time (JIT) compiler
%global jit_arches %{debug_arches}
+# Set of architectures which use the Zero assembler port (!jit_arches)
+%global zero_arches %{arm} ppc s390 s390x
+# Set of architectures which run a full bootstrap cycle
+%global bootstrap_arches %{jit_arches} %{zero_arches}
# Set of architectures which support SystemTap tapsets
%global systemtap_arches %{jit_arches}
-%global fastdebug_arches x86_64 ppc64le aarch64
# Set of architectures which support the serviceability agent
%global sa_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64}
# Set of architectures which support class data sharing
@@ -137,12 +142,17 @@
%else
%global fastdebug_build %{nil}
%endif
-%global bootstrap_build 1
# If you disable both builds, then the build fails
# Build and test slowdebug first as it provides the best diagnostics
%global build_loop %{slowdebug_build} %{fastdebug_build} %{normal_build}
+%ifarch %{bootstrap_arches}
+%global bootstrap_build true
+%else
+%global bootstrap_build false
+%endif
+
%global bootstrap_targets images
%global release_targets images docs-zip
%global debug_targets images
@@ -294,9 +304,9 @@
%endif
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
-%global shenandoah_project aarch64-port
-%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u312-b07
+%global shenandoah_project openjdk
+%global shenandoah_repo shenandoah-jdk8u
+%global shenandoah_revision aarch64-shenandoah-jdk8u322-b06
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -311,7 +321,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 2
+%global rpmrelease 1
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1104,8 +1114,8 @@ Requires: ca-certificates
# Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros
Requires: javapackages-filesystem
# Require zoneinfo data provided by tzdata-java subpackage.
-# 2021a required as of JDK-8260356 in April CPU
-Requires: tzdata-java >= 2021a
+# 2021e required as of JDK-8275766 in January 2022 CPU
+Requires: tzdata-java >= 2021e
# for support of kernel stream control
# libsctp.so.1 is being `dlopen`ed on demand
Requires: lksctp-tools%{?_isa}
@@ -1481,8 +1491,8 @@ BuildRequires: java-1.8.0-openjdk-devel
%ifnarch %{jit_arches}
BuildRequires: libffi-devel
%endif
-# 2021a required as of JDK-8260356 in April CPU
-BuildRequires: tzdata-java >= 2021a
+# 2021e required as of JDK-8275766 in January 2022 CPU
+BuildRequires: tzdata-java >= 2021e
# Earlier versions have a bug in tree vectorization on PPC
BuildRequires: gcc >= 4.8.3-8
@@ -2051,19 +2061,23 @@ installdir=%{installoutputdir -- $suffix}
bootinstalldir=boot${installdir}
# Debug builds don't need same targets as release for
-# build speed-up
-maketargets="%{release_targets}"
+# build speed-up. We also avoid bootstrapping these
+# slower builds.
if echo $debugbuild | grep -q "debug" ; then
maketargets="%{debug_targets}"
+ run_bootstrap=false
+else
+ maketargets="%{release_targets}"
+ run_bootstrap=%{bootstrap_build}
fi
-%if %{bootstrap_build}
-buildjdk ${bootbuilddir} ${bootinstalldir} ${systemjdk} "%{bootstrap_targets}"
${debugbuild}
-buildjdk ${builddir} ${installdir} $(pwd)/${bootinstalldir}/images/%{jdkimage}
"${maketargets}" ${debugbuild}
-%{!?with_artifacts:rm -rf ${bootinstalldir}}
-%else
-buildjdk ${builddir} ${installdir} ${systemjdk} "${maketargets}" ${debugbuild}
-%endif
+if ${run_bootstrap} ; then
+ buildjdk ${bootbuilddir} ${bootinstalldir} ${systemjdk}
"%{bootstrap_targets}" ${debugbuild}
+ buildjdk ${builddir} ${installdir} $(pwd)/${bootinstalldir}/images/%{jdkimage}
"${maketargets}" ${debugbuild}
+ %{!?with_artifacts:rm -rf ${bootinstalldir}}
+else
+ buildjdk ${builddir} ${installdir} ${systemjdk} "${maketargets}"
${debugbuild}
+fi
# Install nss.cfg right away as we will be using the JRE above
export JAVA_HOME=$(pwd)/%{installoutputdir -- $suffix}/images/%{jdkimage}
@@ -2623,6 +2637,13 @@ cjc.mainProgram(args)
%endif
%changelog
+* Mon Jan 24 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b06-1
+- Update to aarch64-shenandoah-jdk8u322-b06 (GA)
+- Update release notes for 8u322-b06.
+- Require tzdata 2021e as of JDK-8275766.
+- Update tarball generation script to use git following shenandoah-jdk8u's move to
github
+- Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
+
* Wed Nov 03 2021 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:1.8.0.312.b07-2
- Use 'sql:' prefix in nss.fips.cfg as F35+ no longer ship the legacy
secmod.db file as part of nss
diff --git a/sources b/sources
index 32ce1e2..35c822f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b07-4curve.tar.xz) =
6da9aab9f456336d73cb41755b9e075c43b21ce54fa208d94295aaeef0dce9e4059740efe87458e131b633c3ab3d6f964a5d2407a76e79dd9b080a5416efd7e7
+SHA512 (openjdk-shenandoah-jdk8u-aarch64-shenandoah-jdk8u322-b06-4curve.tar.xz) =
0f2af8cacb1a4acdca7c1b2d5cc1e0d27f9abf8e05ccf7e8384074ac124132012b15e36abc31b498f746d6f5295530f535a9d9d85a3e45b387728b4ce726ccc7
commit 92c5ccf84cd523a631a4591a4caca18c28c7b722
Author: Fedora Release Engineering <releng(a)fedoraproject.org>
Date: Thu Jan 20 13:39:33 2022 +0000
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng(a)fedoraproject.org>
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 52325f3..43b33d4 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -1215,7 +1215,7 @@ Provides: java-%{origin}-src%{?1} = %{epoch}:%{version}-%{release}
Name: java-%{javaver}-%{origin}
Version: %{javaver}.%{updatever}.%{buildver}
-Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
+Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}.1
# java-1.5.0-ibm from
jpackage.org set Epoch to 1 for unknown reasons
# and this change was brought into RHEL-4. java-1.5.0-ibm packages
# also included the epoch in their virtual provides. This created a
@@ -2637,6 +2637,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Jan 20 2022 Fedora Release Engineering <releng(a)fedoraproject.org> -
1:1.8.0.322.b04-0.1.ea.1
+- Rebuilt for
https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
+
* Mon Jan 10 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b04-0.1.ea
- Update to aarch64-shenandoah-jdk8u322-b04 (EA)
- Update release notes for 8u322-b04.
commit e3e7a2f6b3250760d68043d5075cdb3d5806a596
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Mon Jan 10 16:26:55 2022 +0000
Update to aarch64-shenandoah-jdk8u322-b04 (EA)
Update release notes for 8u322-b04.
Require tzdata 2021c as of JDK-8274407.
diff --git a/.gitignore b/.gitignore
index bc46b5c..f1536da 100644
--- a/.gitignore
+++ b/.gitignore
@@ -249,3 +249,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b01-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b02-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b03-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b04-4curve.tar.xz
diff --git a/NEWS b/NEWS
index da4df72..9773926 100644
--- a/NEWS
+++ b/NEWS
@@ -58,6 +58,9 @@ Live versions of these release notes can be found at:
- JDK-8272342: [TEST_BUG] java/awt/print/PrinterJob/PageDialogMarginTest.java catches
all exceptions
- JDK-8273342: Null pointer dereference in classFileParser.cpp:2817
- JDK-8273826: Correct Manifest file name and NPE checks
+ - JDK-8274407: (tz) Update Timezone Data to 2021c
+ - JDK-8274467: TestZoneInfo310.java fails with tzdata2021b
+ - JDK-8274468: TimeZoneTest.java fails with tzdata2021b
- JDK-8274595: DisableRMIOverHTTPTest failed: connection refused
- JDK-8274779: HttpURLConnection: HttpClient and HttpsClient incorrectly check request
method when set to POST
@@ -82,6 +85,18 @@ The following root certificate from Google has been removed from the
Alias Name: globalsignr2ca [jdk]
Distinguished Name: CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2
+core-libs/java.time:
+
+JDK-8274857: Update Timezone Data to 2021c
+===========================================
+IANA Time Zone Database, on which JDK's Date/Time libraries are based,
+has been updated to version 2021c
+(https://mm.icann.org/pipermail/tz-announce/2021-October/000067.html). Note
+that with this update, some of the time zone rules prior to the year
+1970 have been modified according to the changes which were introduced
+with 2021b. For more detail, refer to the announcement of 2021b
+(https://mm.icann.org/pipermail/tz-announce/2021-September/000066.html)
+
New in release OpenJDK 8u312 (2021-10-19):
===========================================
Live versions of these release notes can be found at:
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index b17d121..52325f3 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -306,7 +306,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u322-b03
+%global shenandoah_revision aarch64-shenandoah-jdk8u322-b04
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -1114,8 +1114,8 @@ Requires: ca-certificates
# Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros
Requires: javapackages-filesystem
# Require zoneinfo data provided by tzdata-java subpackage.
-# 2021a required as of JDK-8260356 in April CPU
-Requires: tzdata-java >= 2021a
+# 2021c required as of JDK-8274407 in January 2022 CPU
+Requires: tzdata-java >= 2021c
# for support of kernel stream control
# libsctp.so.1 is being `dlopen`ed on demand
Requires: lksctp-tools%{?_isa}
@@ -1491,8 +1491,8 @@ BuildRequires: java-1.8.0-openjdk-devel
%ifnarch %{jit_arches}
BuildRequires: libffi-devel
%endif
-# 2021a required as of JDK-8260356 in April CPU
-BuildRequires: tzdata-java >= 2021a
+# 2021c required as of JDK-8274407 in January 2022 CPU
+BuildRequires: tzdata-java >= 2021c
# Earlier versions have a bug in tree vectorization on PPC
BuildRequires: gcc >= 4.8.3-8
@@ -2637,6 +2637,11 @@ cjc.mainProgram(args)
%endif
%changelog
+* Mon Jan 10 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b04-0.1.ea
+- Update to aarch64-shenandoah-jdk8u322-b04 (EA)
+- Update release notes for 8u322-b04.
+- Require tzdata 2021c as of JDK-8274407.
+
* Fri Jan 07 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b03-0.1.ea
- Update to aarch64-shenandoah-jdk8u322-b03 (EA)
- Update release notes for 8u322-b03.
diff --git a/sources b/sources
index f8bc0ea..eb1f71f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b03-4curve.tar.xz) =
5a511b7721f5d3178c494ebf2ee51dd93b44ca4843226b3e9fc49a6350a5563651e0fe06cef68f21b229f13031661830dfab52ec2ead46d31aaa02c5720d71b0
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b04-4curve.tar.xz) =
ebc3cceb40f7ca567fd9fe751ba9762ad50ac474f63da5e2123cf268683db10132ffb09b6f6a99b3379c021b4fcc3b04a82bc81c2e63c8d4da0fdcf58d995322
commit 172b64584ad633cd9f755d573a4cebbd3c74cc23
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Fri Jan 7 15:25:17 2022 +0000
Update to aarch64-shenandoah-jdk8u322-b03 (EA)
Update release notes for 8u322-b03.
diff --git a/.gitignore b/.gitignore
index 9cd6ee4..bc46b5c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -248,3 +248,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b07-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b01-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b02-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b03-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 433a4f6..da4df72 100644
--- a/NEWS
+++ b/NEWS
@@ -16,6 +16,7 @@ Live versions of these release notes can be found at:
- JDK-8041928: MouseEvent.getModifiersEx gives wrong result
- JDK-8042199: The build of J2DBench via makefile is broken after the JDK-8005402
- JDK-8044365: (dc) MulticastSendReceiveTests.java failing with ENOMEM when joining
group (OS X 10.9)
+ - JDK-8048021: Remove @version tag in jaxp repo
- JDK-8049348: compiler/intrinsics/bmi/verifycode tests on lzcnt and tzcnt use
incorrect assumption about REXB prefix usage
- JDK-8060027: Tests java/beans/XMLEncoder/Test4903007.java and
java/beans/XMLEncoder/java_awt_GridBagLayout.java
- JDK-8066588: javax/management/remote/mandatory/connection/RMIConnector_NPETest.java
fails to compile
@@ -49,6 +50,7 @@ Live versions of these release notes can be found at:
- JDK-8232178: MacVolumesTest failed after upgrade to MacOS Catalina
- JDK-8232226: [macos 10.15] test/jdk/java/awt/color/EqualityTest/EqualityTest.java may
fail
- JDK-8235153: [TESTBUG] [macos 10.15]
java/awt/Graphics/DrawImageBG/SystemBgColorTest.java fails
+ - JDK-8236897: Fix the copyright header for pkcs11gcm2.h
- JDK-8237499: JFR: Include stack trace in the ThreadStart event
- JDK-8239886: Minimal VM build fails after JDK-8237499
- JDK-8261397: Try Catch Method Failing to Work When Dividing An Integer By 0
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 682224d..b17d121 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -306,7 +306,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u322-b02
+%global shenandoah_revision aarch64-shenandoah-jdk8u322-b03
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -2637,6 +2637,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Fri Jan 07 2022 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b03-0.1.ea
+- Update to aarch64-shenandoah-jdk8u322-b03 (EA)
+- Update release notes for 8u322-b03.
+
* Fri Dec 17 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b02-0.1.ea
- Update to aarch64-shenandoah-jdk8u322-b02 (EA)
- Update release notes for 8u322-b02.
diff --git a/sources b/sources
index 1ea332b..f8bc0ea 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b02-4curve.tar.xz) =
ebf2c1495ad47345fdc9025fbb690e5fe31fdcb08f180020b061a91cd4f9d01f1617f56f1038c3acbdb1dd9e3ade2cdf7f7c3854cf229084ef5b1fc822ab5422
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b03-4curve.tar.xz) =
5a511b7721f5d3178c494ebf2ee51dd93b44ca4843226b3e9fc49a6350a5563651e0fe06cef68f21b229f13031661830dfab52ec2ead46d31aaa02c5720d71b0
commit a0ac8516d6ebc12bab3af9fec466a19e1c478869
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Fri Dec 17 03:06:13 2021 +0000
Update to aarch64-shenandoah-jdk8u322-b02 (EA)
Update release notes for 8u322-b02.
diff --git a/.gitignore b/.gitignore
index 891d2d8..9cd6ee4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -247,3 +247,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b05-shenandoah-merge-2021-10-07-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b07-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b01-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b02-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 2dac9d2..433a4f6 100644
--- a/NEWS
+++ b/NEWS
@@ -11,12 +11,22 @@ Live versions of these release notes can be found at:
* Other changes
- JDK-6801613: Cross-platform pageDialog and printDialog top margin entry broken
+ - JDK-8011541: [TEST_BUG] closed/javax/swing/plaf/metal/MetalUtils/bug6190373.java
fails NPE since 7u25b03
+ - JDK-8025430: [TEST_BUG] javax/swing/JEditorPane/5076514/bug5076514.java failed since
jdk8b108
+ - JDK-8041928: MouseEvent.getModifiersEx gives wrong result
+ - JDK-8042199: The build of J2DBench via makefile is broken after the JDK-8005402
+ - JDK-8044365: (dc) MulticastSendReceiveTests.java failing with ENOMEM when joining
group (OS X 10.9)
- JDK-8049348: compiler/intrinsics/bmi/verifycode tests on lzcnt and tzcnt use
incorrect assumption about REXB prefix usage
+ - JDK-8060027: Tests java/beans/XMLEncoder/Test4903007.java and
java/beans/XMLEncoder/java_awt_GridBagLayout.java
- JDK-8066588: javax/management/remote/mandatory/connection/RMIConnector_NPETest.java
fails to compile
+ - JDK-8066652: Default TimeZone is GMT not local if user.timezone is invalid on Mac OS
- JDK-8069034: gc/g1/TestEagerReclaimHumongousRegionsClearMarkBits.java nightly
failure
- JDK-8077590: windows_i586_6.2-product-c2-runThese8_Xcomp_vm failing after win
compiler upgrade
- JDK-8080287: The image of BufferedImage.TYPE_INT_ARGB and
BufferedImage.TYPE_INT_ARGB_PRE is blank
+ - JDK-8140329: [TEST_BUG] test FullScreenAfterSplash.java failed because image was not
generated
- JDK-8140472: java/net/ipv6tests/TcpTest.java failed intermittently with
java.net.BindException: Address already in use: NET_Bind
+ - JDK-8147051: StaxEntityResolverWrapper should create StaxXMLInputSource with a
resolver indicator
+ - JDK-8148915: Intermittent failures of bug6400879.java
- JDK-8176837: SunPKCS11 provider needs to check more details on PKCS11 Mechanism
- JDK-8177393: Result of RescaleOp for 4BYTE_ABGR images may be 25% black
- JDK-8177536: Avoid Apple Peer-to-Peer interfaces in networking tests
@@ -25,20 +35,29 @@ Live versions of these release notes can be found at:
- JDK-8183543: Aarch64: C2 compilation often fails with "failed
spill-split-recycle sanity check"
- JDK-8187450: JNI local refs exceeds capacity warning in NetworkInterface::getAll
- JDK-8187649: ArrayIndexOutOfBoundsException in java.util.JapaneseImperialCalendar
+ - JDK-8190482: InnocuousThread creation should not require the caller to possess
enableContextClassLoaderOverride
- JDK-8190793: Httpserver does not detect truncated request body
+ - JDK-8196572: Tests ColConvCCMTest.java and MTColConvTest.java fail
- JDK-8202788: Explicitly reclaim cached thread-local direct buffers at thread exit
- JDK-8210058: Algorithmic Italic font leans opposite angle in Printing
+ - JDK-8220150: macos10.14 Mojave returns anti-aliased glyphs instead of aliased B&W
glyphs
- JDK-8225082: Remove IdenTrust certificate that is expiring in September 2021
- JDK-8225083: Remove Google certificate that is expiring in December 2021
- JDK-8226806: [macOS 10.14] Methods of Java Robot should be called from appropriate
thread
+ - JDK-8231254: (fs) Add test for macOS Catalina changes to protect system software
- JDK-8231438: [macOS] Dark mode for the desktop is not supported
+ - JDK-8232178: MacVolumesTest failed after upgrade to MacOS Catalina
- JDK-8232226: [macos 10.15] test/jdk/java/awt/color/EqualityTest/EqualityTest.java may
fail
+ - JDK-8235153: [TESTBUG] [macos 10.15]
java/awt/Graphics/DrawImageBG/SystemBgColorTest.java fails
- JDK-8237499: JFR: Include stack trace in the ThreadStart event
- JDK-8239886: Minimal VM build fails after JDK-8237499
- JDK-8261397: Try Catch Method Failing to Work When Dividing An Integer By 0
- JDK-8262731: [macOS] Exception from "Printable.print" is swallowed during
"PrinterJob.print"
- JDK-8272342: [TEST_BUG] java/awt/print/PrinterJob/PageDialogMarginTest.java catches
all exceptions
- JDK-8273342: Null pointer dereference in classFileParser.cpp:2817
+ - JDK-8273826: Correct Manifest file name and NPE checks
+ - JDK-8274595: DisableRMIOverHTTPTest failed: connection refused
+ - JDK-8274779: HttpURLConnection: HttpClient and HttpsClient incorrectly check request
method when set to POST
Notes on individual issues:
===========================
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 41a4f39..682224d 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -306,7 +306,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u322-b01
+%global shenandoah_revision aarch64-shenandoah-jdk8u322-b02
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -2637,6 +2637,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Fri Dec 17 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b02-0.1.ea
+- Update to aarch64-shenandoah-jdk8u322-b02 (EA)
+- Update release notes for 8u322-b02.
+
* Tue Dec 14 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b01-0.1.ea
- Update to aarch64-shenandoah-jdk8u322-b01 (EA)
- Update release notes for 8u322-b01.
diff --git a/sources b/sources
index fc55bb8..1ea332b 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b01-4curve.tar.xz) =
0a514ce037f3681819f931312c3de38683d3d8a12fc8b038b11466a8ccb89d1828944816a47267f140707c4149ed959a921b03356f3587487988916c658d5197
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b02-4curve.tar.xz) =
ebf2c1495ad47345fdc9025fbb690e5fe31fdcb08f180020b061a91cd4f9d01f1617f56f1038c3acbdb1dd9e3ade2cdf7f7c3854cf229084ef5b1fc822ab5422
commit be50f32572d549f56dc2b1b39434ee6ebba211ac
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Tue Dec 14 02:19:05 2021 +0000
Update to aarch64-shenandoah-jdk8u322-b01 (EA)
Update release notes for 8u322-b01.
Switch to EA mode.
diff --git a/.gitignore b/.gitignore
index d5493bd..891d2d8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -246,3 +246,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b05-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b05-shenandoah-merge-2021-10-07-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b07-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b01-4curve.tar.xz
diff --git a/NEWS b/NEWS
index ef9db68..2dac9d2 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,64 @@ Key:
JDK-X -
https://bugs.openjdk.java.net/browse/JDK-X
CVE-XXXX-YYYY:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
+New in release OpenJDK 8u322 (2022-01-18):
+===========================================
+Live versions of these release notes can be found at:
+ *
https://bitly.com/openjdk8u322
+ *
https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u322.txt
+
+* Other changes
+ - JDK-6801613: Cross-platform pageDialog and printDialog top margin entry broken
+ - JDK-8049348: compiler/intrinsics/bmi/verifycode tests on lzcnt and tzcnt use
incorrect assumption about REXB prefix usage
+ - JDK-8066588: javax/management/remote/mandatory/connection/RMIConnector_NPETest.java
fails to compile
+ - JDK-8069034: gc/g1/TestEagerReclaimHumongousRegionsClearMarkBits.java nightly
failure
+ - JDK-8077590: windows_i586_6.2-product-c2-runThese8_Xcomp_vm failing after win
compiler upgrade
+ - JDK-8080287: The image of BufferedImage.TYPE_INT_ARGB and
BufferedImage.TYPE_INT_ARGB_PRE is blank
+ - JDK-8140472: java/net/ipv6tests/TcpTest.java failed intermittently with
java.net.BindException: Address already in use: NET_Bind
+ - JDK-8176837: SunPKCS11 provider needs to check more details on PKCS11 Mechanism
+ - JDK-8177393: Result of RescaleOp for 4BYTE_ABGR images may be 25% black
+ - JDK-8177536: Avoid Apple Peer-to-Peer interfaces in networking tests
+ - JDK-8182036: Load from initializing arraycopy uses wrong memory state
+ - JDK-8183369: RFC unconformity of HttpURLConnection with proxy
+ - JDK-8183543: Aarch64: C2 compilation often fails with "failed
spill-split-recycle sanity check"
+ - JDK-8187450: JNI local refs exceeds capacity warning in NetworkInterface::getAll
+ - JDK-8187649: ArrayIndexOutOfBoundsException in java.util.JapaneseImperialCalendar
+ - JDK-8190793: Httpserver does not detect truncated request body
+ - JDK-8202788: Explicitly reclaim cached thread-local direct buffers at thread exit
+ - JDK-8210058: Algorithmic Italic font leans opposite angle in Printing
+ - JDK-8225082: Remove IdenTrust certificate that is expiring in September 2021
+ - JDK-8225083: Remove Google certificate that is expiring in December 2021
+ - JDK-8226806: [macOS 10.14] Methods of Java Robot should be called from appropriate
thread
+ - JDK-8231438: [macOS] Dark mode for the desktop is not supported
+ - JDK-8232226: [macos 10.15] test/jdk/java/awt/color/EqualityTest/EqualityTest.java may
fail
+ - JDK-8237499: JFR: Include stack trace in the ThreadStart event
+ - JDK-8239886: Minimal VM build fails after JDK-8237499
+ - JDK-8261397: Try Catch Method Failing to Work When Dividing An Integer By 0
+ - JDK-8262731: [macOS] Exception from "Printable.print" is swallowed during
"PrinterJob.print"
+ - JDK-8272342: [TEST_BUG] java/awt/print/PrinterJob/PageDialogMarginTest.java catches
all exceptions
+ - JDK-8273342: Null pointer dereference in classFileParser.cpp:2817
+
+Notes on individual issues:
+===========================
+
+security-libs/java.security:
+
+JDK-8271434: Removed IdenTrust Root Certificate
+===============================================
+The following root certificate from IdenTrust has been removed from
+the `cacerts` keystore:
+
+Alias Name: identrustdstx3 [jdk]
+Distinguished Name: CN=DST Root CA X3, O=Digital Signature Trust Co.
+
+JDK-8272535: Removed Google's GlobalSign Root Certificate
+=========================================================
+The following root certificate from Google has been removed from the
+`cacerts` keystore:
+
+Alias Name: globalsignr2ca [jdk]
+Distinguished Name: CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2
+
New in release OpenJDK 8u312 (2021-10-19):
===========================================
Live versions of these release notes can be found at:
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 5275910..41a4f39 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -306,7 +306,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u312-b07
+%global shenandoah_revision aarch64-shenandoah-jdk8u322-b01
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -321,12 +321,12 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 3
+%global rpmrelease 1
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
# - N%%{?extraver}{?dist} for GA releases
-%global is_ga 1
+%global is_ga 0
%if %{is_ga}
%global milestone fcs
%global milestone_version %{nil}
@@ -2637,6 +2637,11 @@ cjc.mainProgram(args)
%endif
%changelog
+* Tue Dec 14 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.322.b01-0.1.ea
+- Update to aarch64-shenandoah-jdk8u322-b01 (EA)
+- Update release notes for 8u322-b01.
+- Switch to EA mode.
+
* Mon Dec 06 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b07-3
- Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
diff --git a/sources b/sources
index 32ce1e2..fc55bb8 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b07-4curve.tar.xz) =
6da9aab9f456336d73cb41755b9e075c43b21ce54fa208d94295aaeef0dce9e4059740efe87458e131b633c3ab3d6f964a5d2407a76e79dd9b080a5416efd7e7
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u322-b01-4curve.tar.xz) =
0a514ce037f3681819f931312c3de38683d3d8a12fc8b038b11466a8ccb89d1828944816a47267f140707c4149ed959a921b03356f3587487988916c658d5197
commit 0478a68d4063ca222c2a544192dfe376ede17488
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Mon Dec 6 00:42:17 2021 +0000
Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 6557c22..5275910 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -86,13 +86,18 @@
%global ppc64be ppc64 ppc64p7
# Set of architectures which support multiple ABIs
%global multilib_arches %{power64} sparc64 x86_64
-# Set of architectures for which we build debug builds
+# Set of architectures for which we build slowdebug builds
%global debug_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64}
+# Set of architectures for which we build fastdebug builds
+%global fastdebug_arches x86_64 ppc64le aarch64
# Set of architectures with a Just-In-Time (JIT) compiler
%global jit_arches %{debug_arches}
+# Set of architectures which use the Zero assembler port (!jit_arches)
+%global zero_arches %{arm} ppc s390 s390x
+# Set of architectures which run a full bootstrap cycle
+%global bootstrap_arches %{jit_arches} %{zero_arches}
# Set of architectures which support SystemTap tapsets
%global systemtap_arches %{jit_arches}
-%global fastdebug_arches x86_64 ppc64le aarch64
# Set of architectures which support the serviceability agent
%global sa_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64}
# Set of architectures which support class data sharing
@@ -137,12 +142,17 @@
%else
%global fastdebug_build %{nil}
%endif
-%global bootstrap_build 1
# If you disable both builds, then the build fails
# Build and test slowdebug first as it provides the best diagnostics
%global build_loop %{slowdebug_build} %{fastdebug_build} %{normal_build}
+%ifarch %{bootstrap_arches}
+%global bootstrap_build true
+%else
+%global bootstrap_build false
+%endif
+
%global bootstrap_targets images
%global release_targets images docs-zip
%global debug_targets images
@@ -311,7 +321,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 2
+%global rpmrelease 3
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -2051,19 +2061,23 @@ installdir=%{installoutputdir -- $suffix}
bootinstalldir=boot${installdir}
# Debug builds don't need same targets as release for
-# build speed-up
-maketargets="%{release_targets}"
+# build speed-up. We also avoid bootstrapping these
+# slower builds.
if echo $debugbuild | grep -q "debug" ; then
maketargets="%{debug_targets}"
+ run_bootstrap=false
+else
+ maketargets="%{release_targets}"
+ run_bootstrap=%{bootstrap_build}
fi
-%if %{bootstrap_build}
-buildjdk ${bootbuilddir} ${bootinstalldir} ${systemjdk} "%{bootstrap_targets}"
${debugbuild}
-buildjdk ${builddir} ${installdir} $(pwd)/${bootinstalldir}/images/%{jdkimage}
"${maketargets}" ${debugbuild}
-%{!?with_artifacts:rm -rf ${bootinstalldir}}
-%else
-buildjdk ${builddir} ${installdir} ${systemjdk} "${maketargets}" ${debugbuild}
-%endif
+if ${run_bootstrap} ; then
+ buildjdk ${bootbuilddir} ${bootinstalldir} ${systemjdk}
"%{bootstrap_targets}" ${debugbuild}
+ buildjdk ${builddir} ${installdir} $(pwd)/${bootinstalldir}/images/%{jdkimage}
"${maketargets}" ${debugbuild}
+ %{!?with_artifacts:rm -rf ${bootinstalldir}}
+else
+ buildjdk ${builddir} ${installdir} ${systemjdk} "${maketargets}"
${debugbuild}
+fi
# Install nss.cfg right away as we will be using the JRE above
export JAVA_HOME=$(pwd)/%{installoutputdir -- $suffix}/images/%{jdkimage}
@@ -2623,6 +2637,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Mon Dec 06 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b07-3
+- Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
+
* Wed Nov 03 2021 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:1.8.0.312.b07-2
- Use 'sql:' prefix in nss.fips.cfg as F35+ no longer ship the legacy
secmod.db file as part of nss
commit cd23abf967b3e97d6993cfacbadc584c3b9f9430
Author: Severin Gehwolf <sgehwolf(a)redhat.com>
Date: Wed Nov 3 11:43:58 2021 +0100
Use 'sql:' prefix in nss.fips.cfg
Fedora 35 and better no longer ship the legacy
secmod.db file as part of the nss package. Explicitly
tell OpenJDK to use sqlite-based sec mode.
Resolves: RHBZ#2019555
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 8fe4eb1..7b01ed0 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -311,7 +311,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 1
+%global rpmrelease 2
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1907,7 +1907,6 @@ sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE11} >
nss.cfg
# Setup nss.fips.cfg
sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE17} > nss.fips.cfg
-sed -i -e "s:@NSS_SECMOD@:/etc/pki/nssdb:g" nss.fips.cfg
%build
# How many CPU's do we have?
@@ -2624,6 +2623,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Wed Nov 03 2021 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:1.8.0.312.b07-2
+- Use 'sql:' prefix in nss.fips.cfg as F35+ no longer ship the legacy
+ secmod.db file as part of nss
+
* Fri Oct 15 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b07-1
- Update to aarch64-shenandoah-jdk8u312-b07 (GA)
- Update release notes for 8u312-b07.
diff --git a/nss.fips.cfg.in b/nss.fips.cfg.in
index ead27be..1aff153 100644
--- a/nss.fips.cfg.in
+++ b/nss.fips.cfg.in
@@ -1,6 +1,6 @@
name = NSS-FIPS
nssLibraryDirectory = @NSS_LIBDIR@
-nssSecmodDirectory = @NSS_SECMOD@
+nssSecmodDirectory = sql:/etc/pki/nssdb
nssDbMode = readOnly
nssModule = fips
commit b1a7d3ba426353f381b04c725272bf1bb197e02a
Author: Severin Gehwolf <sgehwolf(a)redhat.com>
Date: Wed Nov 3 11:43:58 2021 +0100
Use 'sql:' prefix in nss.fips.cfg
Fedora 35 and better no longer ship the legacy
secmod.db file as part of the nss package. Explicitly
tell OpenJDK to use sqlite-based sec mode.
Resolves: RHBZ#2019555
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index afad6cd..6557c22 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -311,7 +311,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 1
+%global rpmrelease 2
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1907,7 +1907,6 @@ sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE11} >
nss.cfg
# Setup nss.fips.cfg
sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE17} > nss.fips.cfg
-sed -i -e "s:@NSS_SECMOD@:/etc/pki/nssdb:g" nss.fips.cfg
%build
# How many CPU's do we have?
@@ -2624,6 +2623,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Wed Nov 03 2021 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:1.8.0.312.b07-2
+- Use 'sql:' prefix in nss.fips.cfg as F35+ no longer ship the legacy
+ secmod.db file as part of nss
+
* Fri Oct 15 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b07-1
- Update to aarch64-shenandoah-jdk8u312-b07 (GA)
- Update release notes for 8u312-b07.
diff --git a/nss.fips.cfg.in b/nss.fips.cfg.in
index ead27be..1aff153 100644
--- a/nss.fips.cfg.in
+++ b/nss.fips.cfg.in
@@ -1,6 +1,6 @@
name = NSS-FIPS
nssLibraryDirectory = @NSS_LIBDIR@
-nssSecmodDirectory = @NSS_SECMOD@
+nssSecmodDirectory = sql:/etc/pki/nssdb
nssDbMode = readOnly
nssModule = fips
commit 41a31ef1ede25c529e956333000ff90cedba475b
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Wed Sep 1 23:23:51 2021 +0100
Update to aarch64-shenandoah-jdk8u312-b07 (GA)
Update release notes for 8u312-b07.
Remove "-clean" suffix as no 8u312 builds are unclean.
Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library.
Port FIPS system detection support to OpenJDK 8u
Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled
in configure.
Remove unneeded Requires on NSS as it will now be dynamically linked and detected by
RPM.
Add FIPS patch to login to the NSS software token when in FIPS mode.
Add FIPS patch to allow plain key import.
Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
Reduce disk footprint by removing build artifacts by default.
diff --git a/.gitignore b/.gitignore
index 67c9eb6..d5493bd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -239,3 +239,10 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b07-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b08-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b08-4curve-clean.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b01-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b02-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b03-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b04-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b05-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b05-shenandoah-merge-2021-10-07-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b07-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 1cb973a..ef9db68 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,132 @@ Key:
JDK-X -
https://bugs.openjdk.java.net/browse/JDK-X
CVE-XXXX-YYYY:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
+New in release OpenJDK 8u312 (2021-10-19):
+===========================================
+Live versions of these release notes can be found at:
+ *
https://bitly.com/openjdk8u312
+ *
https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u312.txt
+
+* Security fixes
+ - JDK-8130183, CVE-2021-35588: InnerClasses: VM permits wrong Throw ClassFormatError if
InnerClasses attribute's inner_class_info_index is 0
+ - JDK-8161016: Strange behavior of URLConnection with proxy
+ - JDK-8163326, CVE-2021-35550: Update the default enabled cipher suites preference
+ - JDK-8254967, CVE-2021-35565: com.sun.net.HttpsServer spins on TLS session close
+ - JDK-8263314: Enhance XML Dsig modes
+ - JDK-8265167, CVE-2021-35556: Richer Text Editors
+ - JDK-8265574: Improve handling of sheets
+ - JDK-8265580, CVE-2021-35559: Enhanced style for RTF kit
+ - JDK-8265776: Improve Stream handling for SSL
+ - JDK-8266097, CVE-2021-35561: Better hashing support
+ - JDK-8266103: Better specified spec values
+ - JDK-8266109: More Resilient Classloading
+ - JDK-8266115: More Manifest Jar Loading
+ - JDK-8266137, CVE-2021-35564: Improve Keystore integrity
+ - JDK-8266689, CVE-2021-35567: More Constrained Delegation
+ - JDK-8267086: ArrayIndexOutOfBoundsException in
java.security.KeyFactory.generatePublic
+ - JDK-8267712: Better LDAP reference processing
+ - JDK-8267729, CVE-2021-35578: Improve TLS client handshaking
+ - JDK-8267735, CVE-2021-35586: Better BMP support
+ - JDK-8268193: Improve requests of certificates
+ - JDK-8268199: Correct certificate requests
+ - JDK-8268506: More Manifest Digests
+ - JDK-8269618, CVE-2021-35603: Better session identification
+ - JDK-8269624: Enhance method selection support
+ - JDK-8270398: Enhance canonicalization
+ - JDK-8270404: Better canonicalization
+* Other changes
+ - JDK-6847157: java.lang.NullPointerException: HDC for component at
sun.java2d.loops.Blit.Blit
+ - JDK-7146776: deadlock between URLStreamHandler.getHostAddress and
file.Handler.openconnection
+ - JDK-7188942: Remove support of pbuffers in OGL Java2d pipeline
+ - JDK-8004148: NPE in sun.awt.SunToolkit.getWindowDeactivationTime
+ - JDK-8022323: [JavaSecurityScanner] review package com.sun.management.* Native methods
should be private
+ - JDK-8027154: [TESTBUG] Test
java/awt/Mouse/GetMousePositionTest/GetMousePositionWithPopup.java fails
+ - JDK-8035001: TEST_BUG: the retry logic in RMID.start() should check that the
subprocess hasn't terminated
+ - JDK-8035424: (reflect) Performance problem in
sun.reflect.generics.parser.SignatureParser
+ - JDK-8042557: compiler/uncommontrap/TestSpecTrapClassUnloading.java fails with: GC
triggered before VM initialization completed
+ - JDK-8054118: java/net/ipv6tests/UdpTest.java failed intermittently
+ - JDK-8065215: Print warning summary at end of configure
+ - JDK-8072767: DefaultCellEditor for comboBox creates ActionEvent with wrong source
object
+ - JDK-8079891: Store configure log in $BUILD/configure.log
+ - JDK-8080082: configure fails if you create an empty directory and then run configure
from it
+ - JDK-8086003: Test fails on OSX with java.lang.RuntimeException 'Narrow klass
base: 0x0000000000000000, Narrow klass shift: 3' missing
+ - JDK-8131062: aarch64: add support for GHASH acceleration
+ - JDK-8134869: AARCH64: GHASH intrinsic is not optimal
+ - JDK-8134989: java/net/MulticastSocket/TestInterfaces.java failed due to unexpected IP
address
+ - JDK-8156584: Initialization race in sun.security.x509.AlgorithmId.get
+ - JDK-8157404: Unable to read certain PKCS12 keystores from SequenceInputStream
+ - JDK-8166673: The new implementation of Robot.waitForIdle() may hang
+ - JDK-8170467: (reflect) Optimize SignatureParser's use of StringBuilders
+ - JDK-8194246: JVM crashes when calling getStackTrace if stack contains a method that
is a member of a very large class
+ - JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
+ - JDK-8202837: PBES2 AlgorithmId encoding error in PKCS12 KeyStore
+ - JDK-8206189: sun/security/pkcs12/EmptyPassword.java fails with Sequence tag error
+ - JDK-8214418: half-closed SSLEngine status may cause application dead loop
+ - JDK-8214513: A PKCS12 keystore from Java 8 using custom PBE parameters cannot be read
in Java 11
+ - JDK-8220786: Create new switch to redirect error reporting output to stdout or
stderr
+ - JDK-8222751:
closed/test/jdk/sun/security/util/DerIndefLenConverter/IndefBerPkcs12.java fail
+ - JDK-8229243: SunPKCS11-Solaris provider tests failing on Solaris 11.4
+ - JDK-8231222: fix pkcs11 P11_DEBUG guarded native traces
+ - JDK-8237495: Java MIDI fails with a dereferenced memory error when asked to send a
raw 0xF7
+ - JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong handling of stoppedMixers
+ - JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in Windows Print
+ - JDK-8241248: NullPointerException in sun.security.ssl.HKDF.extract(HKDF.java:93)
+ - JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header files
+ - JDK-8247469: getSystemCpuLoad() returns -1 on linux when some offline cpus are
present and cpusets.effective_cpus is not available
+ - JDK-8248901: Signed immediate support in .../share/assembler.hpp is broken.
+ - JDK-8259338: Add expiry exception for identrustdstx3 alias to VerifyCACerts.java
test
+ - JDK-8262000:
jdk/jfr/event/gc/detailed/TestPromotionFailedEventWithParallelScavenge.java failed with
"OutOfMemoryError: Java heap space"
+ - JDK-8262829: Native crash in Win32PrintServiceLookup.getAllPrinterNames()
+ - JDK-8263311: Watch registry changes for remote printers update instead of polling
+ - JDK-8263382: java/util/logging/ParentLoggersTest.java failed with "checkLoggers:
getLoggerNames() returned unexpected loggers"
+ - JDK-8264752: SIGFPE crash with option FlightRecorderOptions:threadbuffersize=30M
+ - JDK-8265238: [8u] [macos] build failure in OpenJDK8u after JDK-8211301 in older
xcode
+ - JDK-8265836: OperatingSystemImpl.getCpuLoad() returns incorrect CPU load inside a
container
+ - JDK-8265978: make test should look for more locations when searching for exit code
+ - JDK-8266206: Build failure after JDK-8264752 with older GCCs
+ - JDK-8268103: JNI functions incorrectly return a double after JDK-8265836
+ - JDK-8268965: TCP Connection Reset when connecting simple socket to SSL server
+ - JDK-8269594: assert(_handle_mark_nesting > 1) failed: memory leak: allocating
handle outside HandleMark
+ - JDK-8269763: The JEditorPane is blank after JDK-8265167
+ - JDK-8269810: [8u] Update generated_configure.sh after JDK-8250876 backport
+ - JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports incorrect process cpu
usage in containers
+ - JDK-8269859: BacktraceBuilder._cprefs needs to be accessed as unsigned short
+ - JDK-8269882: stack-use-after-scope in NewObjectA
+ - JDK-8269953: config.log is not in build directory after 8u backport of JDK-8079891
+ - JDK-8270137: Kerberos Credential Retrieval from Cache not Working in Cross-Realm
Setup
+ - JDK-8271466: StackGap test fails on aarch64 due to "-m64"
+ - JDK-8272124: Cgroup v1 initialization causes NullPointerException when cgroup path
contains colon
+ - JDK-8272214: [8u] Build failure after backport of JDK-8248901
+ - JDK-8272714: [8u] Build failure after backport of JDK-8248901 with MSVC 2013
+* Shenandoah
+ - [backport] JDK-8269661: JNI_GetStringCritical does not lock char array
+ - Re-cast JNI critical strings patch to be Shenandoah-specific
+
+Notes on individual issues:
+===========================
+
+core-libs/java.net:
+
+JDK-8164200: Modified HttpURLConnection behavior when no suitable proxy is found
+================================================================================
+The behavior of HttpURLConnection when using a ProxySelector has been
+modified with this JDK release. HttpURLConnection used to fall back to
+a DIRECT connection attempt if the configured proxy(s) failed to make
+a connection. This release introduces a change whereby no DIRECT
+connection will be attempted in such a scenario. Instead, the
+HttpURLConnection.connect() method will fail and throw an IOException
+which occurred from the last proxy tested.
+
+security-libs/javax.net.ssl:
+
+JDK-8219551: Updated the Default Enabled Cipher Suites Preference
+=================================================================
+The preference of the default enabled cipher suites has been
+changed. The compatibility impact should be minimal. If needed,
+applications can customize the enabled cipher suites and the
+preference. For more details, refer to the SunJSSE provider
+documentation and the JSSE Reference Guide documentation.
+
New in release OpenJDK 8u302 (2021-07-20):
===========================================
Live versions of these release notes can be found at:
diff --git a/generate_source_tarball.sh b/generate_source_tarball.sh
index e9eed11..c6f0756 100755
--- a/generate_source_tarball.sh
+++ b/generate_source_tarball.sh
@@ -177,7 +177,7 @@ if [ "X$COMPRESSION" = "Xxz" ] ; then
else
SWITCH=czf
fi
-TARBALL_NAME=${FILE_NAME_ROOT}-4curve-clean.tar.${COMPRESSION}
+TARBALL_NAME=${FILE_NAME_ROOT}-4curve.tar.${COMPRESSION}
tar --exclude-vcs -$SWITCH ${TARBALL_NAME} openjdk
mv ${TARBALL_NAME} ..
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 68867b4..8fe4eb1 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -22,6 +22,8 @@
%bcond_without slowdebug
# Enable release builds by default on relevant arches.
%bcond_without release
+# Remove build artifacts by default
+%bcond_with artifacts
# The -g flag says to use strip -g instead of full strip on DSOs or EXEs.
# This fixes detailed NMT and other tools which need minimal debug info.
@@ -294,7 +296,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u302-b08
+%global shenandoah_revision aarch64-shenandoah-jdk8u312-b07
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -309,7 +311,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 2
+%global rpmrelease 1
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -343,6 +345,7 @@
%global jdkimage j2sdk-image
# output dir stub
%define buildoutputdir() %{expand:build/jdk8.build%{?1}}
+%define installoutputdir() %{expand:install/jdk8.install%{?1}}
# we can copy the javadoc to not arched dir, or make it not noarch
%define uniquejavadocdir() %{expand:%{fullversion}%{?1}}
# main id and dir of this jdk
@@ -352,7 +355,7 @@
# fix for
https://bugzilla.redhat.com/show_bug.cgi?id=1111349
#
https://bugzilla.redhat.com/show_bug.cgi?id=1590796#c14
#
https://bugzilla.redhat.com/show_bug.cgi?id=1655938
-%global _privatelibs
libattach[.]so.*|libawt_headless[.]so.*|libawt[.]so.*|libawt_xawt[.]so.*|libdt_socket[.]so.*|libfontmanager[.]so.*|libhprof[.]so.*|libinstrument[.]so.*|libj2gss[.]so.*|libj2pcsc[.]so.*|libj2pkcs11[.]so.*|libjaas_unix[.]so.*|libjava_crw_demo[.]so.*|libjavajpeg[.]so.*|libjdwp[.]so.*|libjli[.]so.*|libjsdt[.]so.*|libjsoundalsa[.]so.*|libjsound[.]so.*|liblcms[.]so.*|libmanagement[.]so.*|libmlib_image[.]so.*|libnet[.]so.*|libnio[.]so.*|libnpt[.]so.*|libsaproc[.]so.*|libsctp[.]so.*|libsplashscreen[.]so.*|libsunec[.]so.*|libunpack[.]so.*|libzip[.]so.*|lib[.]so\\(SUNWprivate_.*
+%global _privatelibs
libattach[.]so.*|libawt_headless[.]so.*|libawt[.]so.*|libawt_xawt[.]so.*|libdt_socket[.]so.*|libfontmanager[.]so.*|libhprof[.]so.*|libinstrument[.]so.*|libj2gss[.]so.*|libj2pcsc[.]so.*|libj2pkcs11[.]so.*|libjaas_unix[.]so.*|libjava_crw_demo[.]so.*|libjavajpeg[.]so.*|libjdwp[.]so.*|libjli[.]so.*|libjsdt[.]so.*|libjsoundalsa[.]so.*|libjsound[.]so.*|liblcms[.]so.*|libmanagement[.]so.*|libmlib_image[.]so.*|libnet[.]so.*|libnio[.]so.*|libnpt[.]so.*|libsaproc[.]so.*|libsctp[.]so.*|libsplashscreen[.]so.*|libsunec[.]so.*|libsystemconf[.]so.*|libunpack[.]so.*|libzip[.]so.*|lib[.]so\\(SUNWprivate_.*
%global _publiclibs
libjawt[.]so.*|libjava[.]so.*|libjvm[.]so.*|libverify[.]so.*|libjsig[.]so.*
%if %is_system_jdk
%global __provides_exclude ^(%{_privatelibs})$
@@ -805,6 +808,7 @@ exit 0
%endif
%{_jvmdir}/%{jredir -- %{?1}}/lib/%{archinstall}/libsctp.so
%{_jvmdir}/%{jredir -- %{?1}}/lib/%{archinstall}/libsunec.so
+%{_jvmdir}/%{jredir -- %{?1}}/lib/%{archinstall}/libsystemconf.so
%{_jvmdir}/%{jredir -- %{?1}}/lib/%{archinstall}/libunpack.so
%{_jvmdir}/%{jredir -- %{?1}}/lib/%{archinstall}/libverify.so
%{_jvmdir}/%{jredir -- %{?1}}/lib/%{archinstall}/libzip.so
@@ -1044,8 +1048,8 @@ exit 0
%define files_javadoc() %{expand:
%defattr(-,root,root,-)
%doc %{_javadocdir}/%{uniquejavadocdir -- %{?1}}
-#javadoc is in jdk8 noarch, so also licnese file must be treated like it
-%license %{buildoutputdir -- %{?1}}/images/%{jdkimage}/jre/LICENSE
+#javadoc is in jdk8 noarch, so also license file must be treated like it
+%license %{installoutputdir -- %{?1}}/images/%{jdkimage}/jre/LICENSE
%if %is_system_jdk
%if %{is_release_build -- %{?1}}
%ghost %{_javadocdir}/java
@@ -1056,8 +1060,8 @@ exit 0
%define files_javadoc_zip() %{expand:
%defattr(-,root,root,-)
%doc %{_javadocdir}/%{uniquejavadocdir -- %{?1}}.zip
-#javadoc is in jdk8 noarch, so also licnese file must be treated like it
-%license %{buildoutputdir -- %{?1}}/images/%{jdkimage}/jre/LICENSE
+#javadoc is in jdk8 noarch, so also license file must be treated like it
+%license %{installoutputdir -- %{?1}}/images/%{jdkimage}/jre/LICENSE
%if %is_system_jdk
%if %{is_release_build -- %{?1}}
%ghost %{_javadocdir}/java-zip
@@ -1112,8 +1116,6 @@ Requires: copy-jdk-configs >= 4.0
OrderWithRequires: copy-jdk-configs
# for printing support
Requires: cups-libs
-# for FIPS PKCS11 provider
-Requires: nss
# Post requires alternatives to install tool alternatives
Requires(post): %{alternatives_requires}
# Postun requires alternatives to uninstall tool alternatives
@@ -1238,7 +1240,7 @@ URL:
http://openjdk.java.net/
# FILE_NAME_ROOT=%%{shenandoah_project}-%%{shenandoah_repo}-${VERSION}
# REPO_ROOT=<path to checked-out repository> generate_source_tarball.sh
# where the source is obtained from
http://hg.openjdk.java.net/%%{project}/%%{repo}
-Source0:
%{shenandoah_project}-%{shenandoah_repo}-%{shenandoah_revision}-4curve-clean.tar.xz
+Source0: %{shenandoah_project}-%{shenandoah_repo}-%{shenandoah_revision}-4curve.tar.xz
# Custom README for -src subpackage
Source2: README.md
@@ -1308,6 +1310,13 @@ Patch1002: rh1760838-fips_default_keystore_type.patch
Patch1004: rh1860986-disable_tlsv1.3_in_fips_mode.patch
# RH1906862: Always initialise JavaSecuritySystemConfiguratorAccess
Patch1005: rh1906862-always_initialise_configurator_access.patch
+# RH1929465: Improve system FIPS detection
+Patch1006: rh1929465-improve_system_FIPS_detection-root.patch
+Patch1007: rh1929465-improve_system_FIPS_detection-jdk.patch
+# RH1996182: Login to the NSS software token in FIPS mode
+Patch1008: rh1996182-login_to_nss_software_token.patch
+# RH1991003: Allow plain key import unless com.redhat.fips.plainKeySupport is set to
false
+Patch1011: rh1991003-enable_fips_keys_import.patch
#############################################
#
@@ -1454,8 +1463,8 @@ BuildRequires: libXinerama-devel
BuildRequires: libXrender-devel
BuildRequires: libXt-devel
BuildRequires: libXtst-devel
-# Requirements for setting up the nss.cfg
-BuildRequires: nss-devel
+# Requirements for setting up the nss.cfg and FIPS support
+BuildRequires: nss-devel >= 3.53
BuildRequires: pkgconfig
BuildRequires: xorg-x11-proto-devel
BuildRequires: zip
@@ -1834,6 +1843,10 @@ sh %{SOURCE12}
%patch1003
%patch1004
%patch1005
+%patch1006
+%patch1007
+%patch1008
+%patch1011
# RHEL-only patches
%if ! 0%{?fedora} && 0%{?rhel} <= 7
@@ -1931,9 +1944,10 @@ export EXTRA_CFLAGS EXTRA_ASFLAGS
function buildjdk() {
local outputdir=${1}
- local buildjdk=${2}
- local maketargets=${3}
- local debuglevel=${4}
+ local installdir=${2}
+ local buildjdk=${3}
+ local maketargets=${4}
+ local debuglevel=${5}
local top_srcdir_abs_path=$(pwd)/%{top_level_dir_name}
# Variable used in hs_err hook on build failures
@@ -1943,7 +1957,7 @@ function buildjdk() {
${buildjdk}/bin/java -version
echo "Building 8u%{updatever}-%{buildver}, milestone %{milestone}"
- mkdir -p ${outputdir}
+ mkdir -p ${outputdir} ${installdir}
pushd ${outputdir}
bash ${top_srcdir_abs_path}/configure \
@@ -1965,6 +1979,7 @@ function buildjdk() {
--with-vendor-vm-bug-url="%{oj_vendor_bug_url}" \
--with-boot-jdk=${buildjdk} \
--with-debug-level=${debuglevel} \
+ --enable-sysconf-nss \
--enable-unlimited-crypto \
--with-zlib=system \
--with-libjpeg=system \
@@ -2003,6 +2018,23 @@ function buildjdk() {
find images/%{jdkimage}/bin/ -exec chmod +x {} \;
popd >& /dev/null
+
+ echo "Installing build from ${outputdir} to ${installdir}..."
+ echo "Installing images..."
+ mv ${outputdir}/images ${installdir}
+ if [ -d ${outputdir}/bundles ] ; then
+ echo "Installing bundles...";
+ mv ${outputdir}/bundles ${installdir} ;
+ fi
+ if [ -d ${outputdir}/docs ] ; then
+ echo "Installing docs...";
+ mv ${outputdir}/docs ${installdir} ;
+ fi
+
+%if !%{with artifacts}
+ echo "Removing output directory...";
+ rm -rf ${outputdir}
+%endif
}
for suffix in %{build_loop} ; do
@@ -2016,6 +2048,8 @@ fi
systemjdk=/usr/lib/jvm/java-openjdk
builddir=%{buildoutputdir -- $suffix}
bootbuilddir=boot${builddir}
+installdir=%{installoutputdir -- $suffix}
+bootinstalldir=boot${installdir}
# Debug builds don't need same targets as release for
# build speed-up
@@ -2025,15 +2059,15 @@ if echo $debugbuild | grep -q "debug" ; then
fi
%if %{bootstrap_build}
-buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild}
-buildjdk ${builddir} $(pwd)/${bootbuilddir}/images/%{jdkimage} "${maketargets}"
${debugbuild}
-rm -rf ${bootbuilddir}
+buildjdk ${bootbuilddir} ${bootinstalldir} ${systemjdk} "%{bootstrap_targets}"
${debugbuild}
+buildjdk ${builddir} ${installdir} $(pwd)/${bootinstalldir}/images/%{jdkimage}
"${maketargets}" ${debugbuild}
+%{!?with_artifacts:rm -rf ${bootinstalldir}}
%else
-buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild}
+buildjdk ${builddir} ${installdir} ${systemjdk} "${maketargets}" ${debugbuild}
%endif
# Install nss.cfg right away as we will be using the JRE above
-export JAVA_HOME=$(pwd)/%{buildoutputdir -- $suffix}/images/%{jdkimage}
+export JAVA_HOME=$(pwd)/%{installoutputdir -- $suffix}/images/%{jdkimage}
# Install nss.cfg right away as we will be using the JRE above
install -m 644 nss.cfg $JAVA_HOME/jre/lib/security/
@@ -2059,7 +2093,7 @@ done
# We test debug first as it will give better diagnostics on a crash
for suffix in %{build_loop} ; do
-export JAVA_HOME=$(pwd)/%{buildoutputdir -- $suffix}/images/%{jdkimage}
+export JAVA_HOME=$(pwd)/%{installoutputdir -- $suffix}/images/%{jdkimage}
# Check unlimited policy has been used
$JAVA_HOME/bin/javac -d . %{SOURCE13}
@@ -2174,7 +2208,7 @@ STRIP_KEEP_SYMTAB=libjvm*
for suffix in %{build_loop} ; do
# Install the jdk
-pushd %{buildoutputdir -- $suffix}/images/%{jdkimage}
+pushd %{installoutputdir -- $suffix}/images/%{jdkimage}
# Install jsa directories so we can owe them
mkdir -p $RPM_BUILD_ROOT%{_jvmdir}/%{jredir -- $suffix}/lib/%{archinstall}/server/
@@ -2241,9 +2275,9 @@ popd
if ! echo $suffix | grep -q "debug" ; then
# Install Javadoc documentation
install -d -m 755 $RPM_BUILD_ROOT%{_javadocdir}
- cp -a %{buildoutputdir -- $suffix}/docs
$RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}
+ cp -a %{installoutputdir -- $suffix}/docs
$RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}
built_doc_archive=`echo
"jdk-%{javaver}_%{updatever}%{milestone_version}$suffix-%{buildver}-docs.zip" |
sed s/slowdebug/debug/`
- cp -a %{buildoutputdir -- $suffix}/bundles/$built_doc_archive
$RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip
+ cp -a %{installoutputdir -- $suffix}/bundles/$built_doc_archive
$RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip
fi
# Install release notes
@@ -2590,6 +2624,21 @@ cjc.mainProgram(args)
%endif
%changelog
+* Fri Oct 15 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b07-1
+- Update to aarch64-shenandoah-jdk8u312-b07 (GA)
+- Update release notes for 8u312-b07.
+- Remove "-clean" suffix as no 8u312 builds are unclean.
+- Port FIPS system detection support to OpenJDK 8u
+- Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled
in configure.
+- Remove unneeded Requires on NSS as it will now be dynamically linked and detected by
RPM.
+- Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
+- Reduce disk footprint by removing build artifacts by default.
+
+* Thu Oct 07 2021 Martin Balao <mbalao(a)redhat.com> - 1:1.8.0.312.b07-1
+- Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library.
+- Add patch to login to the NSS software token when in FIPS mode.
+- Add patch to allow plain key import.
+
* Mon Aug 30 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.302.b08-2
- alternatives creation moved to posttrans
- Thus fixing the old reisntall issue:
@@ -2694,7 +2743,7 @@ cjc.mainProgram(args)
- removed patch1 rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch and patch3
rh1648644-java_access_bridge_privileged_security.patch
- removal of accessibility{,-slowdebug,-fastdebug} subpackages
- no longer creating symlinks of %%{_libdir}/java-atk-wrapper/libatk-wrapper.so.0
libatk-wrapper.so and %%{_libdir}/java-atk-wrapper/java-atk-wrapper.jar
java-atk-wrapper.jar
-- no longer creating %%{_jvmdir}/%{jredir -- $suffix}/lib/accessibility.properties with
content of "assistive_technologies=org.GNOME.Accessibility.AtkWrapper"
+- no longer creating %%{_jvmdir}/%%{jredir -- $suffix}/lib/accessibility.properties with
content of "assistive_technologies=org.GNOME.Accessibility.AtkWrapper"
- removal of accessibility{,-slowdebug,-fastdebug} subpackages files sections
* Mon Mar 22 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b06-0.0.ea
diff --git a/rh1929465-improve_system_FIPS_detection-jdk.patch
b/rh1929465-improve_system_FIPS_detection-jdk.patch
new file mode 100644
index 0000000..1461be8
--- /dev/null
+++ b/rh1929465-improve_system_FIPS_detection-jdk.patch
@@ -0,0 +1,344 @@
+diff --git openjdk.orig/jdk/make/lib/SecurityLibraries.gmk
openjdk/jdk/make/lib/SecurityLibraries.gmk
+--- openjdk.orig/jdk/make/lib/SecurityLibraries.gmk
++++ openjdk/jdk/make/lib/SecurityLibraries.gmk
+@@ -289,3 +289,34 @@
+
+ endif
+ endif
++
++################################################################################
++# Create the systemconf library
++
++LIBSYSTEMCONF_CFLAGS :=
++LIBSYSTEMCONF_CXXFLAGS :=
++
++ifeq ($(USE_SYSCONF_NSS), true)
++ LIBSYSTEMCONF_CFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS
++ LIBSYSTEMCONF_CXXFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS
++endif
++
++ifeq ($(OPENJDK_BUILD_OS), linux)
++ $(eval $(call SetupNativeCompilation,BUILD_LIBSYSTEMCONF, \
++ LIBRARY := systemconf, \
++ OUTPUT_DIR := $(INSTALL_LIBRARIES_HERE), \
++ SRC := $(JDK_TOPDIR)/src/$(OPENJDK_TARGET_OS_API_DIR)/native/java/security, \
++ LANG := C, \
++ OPTIMIZATION := LOW, \
++ CFLAGS := $(CFLAGS_JDKLIB) $(LIBSYSTEMCONF_CFLAGS), \
++ CXXFLAGS := $(CXXFLAGS_JDKLIB) $(LIBSYSTEMCONF_CXXFLAGS), \
++ MAPFILE := $(JDK_TOPDIR)/make/mapfiles/libsystemconf/mapfile-vers, \
++ LDFLAGS := $(LDFLAGS_JDKLIB) \
++ $(call SET_SHARED_LIBRARY_ORIGIN), \
++ LDFLAGS_SUFFIX := $(LIBDL) $(NSS_LIBS), \
++ OBJECT_DIR := $(JDK_OUTPUTDIR)/objs/libsystemconf, \
++ DEBUG_SYMBOLS := $(DEBUG_ALL_BINARIES)))
++
++ BUILD_LIBRARIES += $(BUILD_LIBSYSTEMCONF)
++endif
++
+diff --git openjdk.orig/jdk/make/mapfiles/libsystemconf/mapfile-vers
openjdk/jdk/make/mapfiles/libsystemconf/mapfile-vers
+new file mode 100644
+--- /dev/null
++++ openjdk/jdk/make/mapfiles/libsystemconf/mapfile-vers
+@@ -0,0 +1,35 @@
++#
++# Copyright (c) 2021, Red Hat, Inc.
++# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++#
++# This code is free software; you can redistribute it and/or modify it
++# under the terms of the GNU General Public License version 2 only, as
++# published by the Free Software Foundation. Oracle designates this
++# particular file as subject to the "Classpath" exception as provided
++# by Oracle in the LICENSE file that accompanied this code.
++#
++# This code is distributed in the hope that it will be useful, but WITHOUT
++# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++# version 2 for more details (a copy is included in the LICENSE file that
++# accompanied this code).
++#
++# You should have received a copy of the GNU General Public License version
++# 2 along with this work; if not, write to the Free Software Foundation,
++# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++#
++# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++# or visit
www.oracle.com if you need additional information or have any
++# questions.
++#
++
++# Define public interface.
++
++SUNWprivate_1.1 {
++ global:
++ DEF_JNI_OnLoad;
++ DEF_JNI_OnUnLoad;
++ Java_java_security_SystemConfigurator_getSystemFIPSEnabled;
++ local:
++ *;
++};
+diff --git openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java
openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
+--- openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java
++++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2019, 2020, Red Hat, Inc.
++ * Copyright (c) 2019, 2021, Red Hat, Inc.
+ *
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+@@ -30,14 +30,9 @@
+ import java.io.FileInputStream;
+ import java.io.IOException;
+
+-import java.nio.file.Files;
+-import java.nio.file.FileSystems;
+-import java.nio.file.Path;
+-
+ import java.util.Iterator;
+ import java.util.Map.Entry;
+ import java.util.Properties;
+-import java.util.regex.Pattern;
+
+ import sun.security.util.Debug;
+
+@@ -59,10 +54,21 @@
+ private static final String CRYPTO_POLICIES_JAVA_CONFIG =
+ CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config";
+
+- private static final String CRYPTO_POLICIES_CONFIG =
+- CRYPTO_POLICIES_BASE_DIR + "/config";
++ private static boolean systemFipsEnabled = false;
++
++ private static final String SYSTEMCONF_NATIVE_LIB = "systemconf";
++
++ private static native boolean getSystemFIPSEnabled()
++ throws IOException;
+
+- private static boolean systemFipsEnabled = false;
++ static {
++ AccessController.doPrivileged(new PrivilegedAction<Void>() {
++ public Void run() {
++ System.loadLibrary(SYSTEMCONF_NATIVE_LIB);
++ return null;
++ }
++ });
++ }
+
+ /*
+ * Invoked when java.security.Security class is initialized, if
+@@ -171,17 +177,34 @@
+ }
+
+ /*
+- * FIPS is enabled only if crypto-policies are set to "FIPS"
+- * and the com.redhat.fips property is true.
++ * OpenJDK FIPS mode will be enabled only if the com.redhat.fips
++ * system property is true (default) and the system is in FIPS mode.
++ *
++ * There are 2 possible ways in which OpenJDK detects that the system
++ * is in FIPS mode: 1) if the NSS SECMOD_GetSystemFIPSEnabled API is
++ * available at OpenJDK's built-time, it is called; 2) otherwise, the
++ * /proc/sys/crypto/fips_enabled file is read.
+ */
+- private static boolean enableFips() throws Exception {
++ private static boolean enableFips() throws IOException {
+ boolean shouldEnable =
Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
+ if (shouldEnable) {
+- Path configPath = FileSystems.getDefault().getPath(CRYPTO_POLICIES_CONFIG);
+- String cryptoPoliciesConfig = new String(Files.readAllBytes(configPath));
+- if (sdebug != null) { sdebug.println("Crypto config:\n" +
cryptoPoliciesConfig); }
+- Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
+- return pattern.matcher(cryptoPoliciesConfig).find();
++ if (sdebug != null) {
++ sdebug.println("Calling getSystemFIPSEnabled
(libsystemconf)...");
++ }
++ try {
++ shouldEnable = getSystemFIPSEnabled();
++ if (sdebug != null) {
++ sdebug.println("Call to getSystemFIPSEnabled (libsystemconf)
returned: "
++ + shouldEnable);
++ }
++ return shouldEnable;
++ } catch (IOException e) {
++ if (sdebug != null) {
++ sdebug.println("Call to getSystemFIPSEnabled (libsystemconf)
failed:");
++ sdebug.println(e.getMessage());
++ }
++ throw e;
++ }
+ } else {
+ return false;
+ }
+diff --git openjdk.orig/jdk/src/solaris/native/java/security/systemconf.c
openjdk/jdk/src/solaris/native/java/security/systemconf.c
+new file mode 100644
+--- /dev/null
++++ openjdk/jdk/src/solaris/native/java/security/systemconf.c
+@@ -0,0 +1,168 @@
++/*
++ * Copyright (c) 2021, Red Hat, Inc.
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation. Oracle designates this
++ * particular file as subject to the "Classpath" exception as provided
++ * by Oracle in the LICENSE file that accompanied this code.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit
www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++#include <dlfcn.h>
++#include <jni.h>
++#include <jni_util.h>
++#include <stdio.h>
++
++#ifdef SYSCONF_NSS
++#include <nss3/pk11pub.h>
++#endif //SYSCONF_NSS
++
++#include "java_security_SystemConfigurator.h"
++
++#define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled"
++#define MSG_MAX_SIZE 96
++
++static jmethodID debugPrintlnMethodID = NULL;
++static jobject debugObj = NULL;
++
++static void throwIOException(JNIEnv *env, const char *msg);
++static void dbgPrint(JNIEnv *env, const char* msg);
++
++/*
++ * Class: java_security_SystemConfigurator
++ * Method: JNI_OnLoad
++ */
++JNIEXPORT jint JNICALL DEF_JNI_OnLoad(JavaVM *vm, void *reserved)
++{
++ JNIEnv *env;
++ jclass sysConfCls, debugCls;
++ jfieldID sdebugFld;
++
++ if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) {
++ return JNI_EVERSION; /* JNI version not supported */
++ }
++
++ sysConfCls =
(*env)->FindClass(env,"java/security/SystemConfigurator");
++ if (sysConfCls == NULL) {
++ printf("libsystemconf: SystemConfigurator class not found\n");
++ return JNI_ERR;
++ }
++ sdebugFld = (*env)->GetStaticFieldID(env, sysConfCls,
++ "sdebug", "Lsun/security/util/Debug;");
++ if (sdebugFld == NULL) {
++ printf("libsystemconf: SystemConfigurator::sdebug field not
found\n");
++ return JNI_ERR;
++ }
++ debugObj = (*env)->GetStaticObjectField(env, sysConfCls, sdebugFld);
++ if (debugObj != NULL) {
++ debugCls = (*env)->FindClass(env,"sun/security/util/Debug");
++ if (debugCls == NULL) {
++ printf("libsystemconf: Debug class not found\n");
++ return JNI_ERR;
++ }
++ debugPrintlnMethodID = (*env)->GetMethodID(env, debugCls,
++ "println", "(Ljava/lang/String;)V");
++ if (debugPrintlnMethodID == NULL) {
++ printf("libsystemconf: Debug::println(String) method not
found\n");
++ return JNI_ERR;
++ }
++ debugObj = (*env)->NewGlobalRef(env, debugObj);
++ }
++
++ return (*env)->GetVersion(env);
++}
++
++/*
++ * Class: java_security_SystemConfigurator
++ * Method: JNI_OnUnload
++ */
++JNIEXPORT void JNICALL DEF_JNI_OnUnload(JavaVM *vm, void *reserved)
++{
++ JNIEnv *env;
++
++ if (debugObj != NULL) {
++ if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) {
++ return; /* Should not happen */
++ }
++ (*env)->DeleteGlobalRef(env, debugObj);
++ }
++}
++
++JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEnabled
++ (JNIEnv *env, jclass cls)
++{
++ int fips_enabled;
++ char msg[MSG_MAX_SIZE];
++ int msg_bytes;
++
++#ifdef SYSCONF_NSS
++
++ dbgPrint(env, "getSystemFIPSEnabled: calling
SECMOD_GetSystemFIPSEnabled");
++ fips_enabled = SECMOD_GetSystemFIPSEnabled();
++ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \
++ " SECMOD_GetSystemFIPSEnabled returned 0x%x", fips_enabled);
++ if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) {
++ dbgPrint(env, msg);
++ } else {
++ dbgPrint(env, "getSystemFIPSEnabled: cannot render" \
++ " SECMOD_GetSystemFIPSEnabled return value");
++ }
++ return (fips_enabled == 1 ? JNI_TRUE : JNI_FALSE);
++
++#else // SYSCONF_NSS
++
++ FILE *fe;
++
++ dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH);
++ if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) {
++ throwIOException(env, "Cannot open " FIPS_ENABLED_PATH);
++ }
++ fips_enabled = fgetc(fe);
++ fclose(fe);
++ if (fips_enabled == EOF) {
++ throwIOException(env, "Cannot read " FIPS_ENABLED_PATH);
++ }
++ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \
++ " read character is '%c'", fips_enabled);
++ if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) {
++ dbgPrint(env, msg);
++ } else {
++ dbgPrint(env, "getSystemFIPSEnabled: cannot render" \
++ " read character");
++ }
++ return (fips_enabled == '1' ? JNI_TRUE : JNI_FALSE);
++
++#endif // SYSCONF_NSS
++}
++
++static void throwIOException(JNIEnv *env, const char *msg)
++{
++ jclass cls = (*env)->FindClass(env, "java/io/IOException");
++ if (cls != 0)
++ (*env)->ThrowNew(env, cls, msg);
++}
++
++static void dbgPrint(JNIEnv *env, const char* msg)
++{
++ jstring jMsg;
++ if (debugObj != NULL) {
++ jMsg = (*env)->NewStringUTF(env, msg);
++ CHECK_NULL(jMsg);
++ (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg);
++ }
++}
diff --git a/rh1929465-improve_system_FIPS_detection-root.patch
b/rh1929465-improve_system_FIPS_detection-root.patch
new file mode 100644
index 0000000..64d8ac0
--- /dev/null
+++ b/rh1929465-improve_system_FIPS_detection-root.patch
@@ -0,0 +1,152 @@
+diff --git openjdk.orig/common/autoconf/configure.ac
openjdk/common/autoconf/configure.ac
+--- openjdk.orig/common/autoconf/configure.ac
++++ openjdk/common/autoconf/configure.ac
+@@ -212,6 +212,7 @@
+ LIB_SETUP_ALSA
+ LIB_SETUP_FONTCONFIG
+ LIB_SETUP_MISC_LIBS
++LIB_SETUP_SYSCONF_LIBS
+ LIB_SETUP_STATIC_LINK_LIBSTDCPP
+ LIB_SETUP_ON_WINDOWS
+
+diff --git openjdk.orig/common/autoconf/libraries.m4
openjdk/common/autoconf/libraries.m4
+--- openjdk.orig/common/autoconf/libraries.m4
++++ openjdk/common/autoconf/libraries.m4
+@@ -1067,3 +1067,63 @@
+ BASIC_DEPRECATED_ARG_WITH([dxsdk-include])
+ fi
+ ])
++
++################################################################################
++# Setup system configuration libraries
++################################################################################
++AC_DEFUN_ONCE([LIB_SETUP_SYSCONF_LIBS],
++[
++ ###############################################################################
++ #
++ # Check for the NSS library
++ #
++
++ AC_MSG_CHECKING([whether to use the system NSS library with the System Configurator
(libsysconf)])
++
++ # default is not available
++ DEFAULT_SYSCONF_NSS=no
++
++ AC_ARG_ENABLE([sysconf-nss], [AS_HELP_STRING([--enable-sysconf-nss],
++ [build the System Configurator (libsysconf) using the system NSS library if
available @<:@disabled@:>@])],
++ [
++ case "${enableval}" in
++ yes)
++ sysconf_nss=yes
++ ;;
++ *)
++ sysconf_nss=no
++ ;;
++ esac
++ ],
++ [
++ sysconf_nss=${DEFAULT_SYSCONF_NSS}
++ ])
++ AC_MSG_RESULT([$sysconf_nss])
++
++ USE_SYSCONF_NSS=false
++ if test "x${sysconf_nss}" = "xyes"; then
++ PKG_CHECK_MODULES(NSS, nss >= 3.53, [NSS_FOUND=yes], [NSS_FOUND=no])
++ if test "x${NSS_FOUND}" = "xyes"; then
++ AC_MSG_CHECKING([for system FIPS support in NSS])
++ saved_libs="${LIBS}"
++ saved_cflags="${CFLAGS}"
++ CFLAGS="${CFLAGS} ${NSS_CFLAGS}"
++ LIBS="${LIBS} ${NSS_LIBS}"
++ AC_LANG_PUSH([C])
++ AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <nss3/pk11pub.h>]],
++ [[SECMOD_GetSystemFIPSEnabled()]])],
++ [AC_MSG_RESULT([yes])],
++ [AC_MSG_RESULT([no])
++ AC_MSG_ERROR([System NSS FIPS detection unavailable])])
++ AC_LANG_POP([C])
++ CFLAGS="${saved_cflags}"
++ LIBS="${saved_libs}"
++ USE_SYSCONF_NSS=true
++ else
++ dnl NSS 3.53 is the one that introduces the SECMOD_GetSystemFIPSEnabled API
++ dnl in nss3/pk11pub.h.
++ AC_MSG_ERROR([--enable-sysconf-nss specified, but NSS 3.53 or above not
found.])
++ fi
++ fi
++ AC_SUBST(USE_SYSCONF_NSS)
++])
+diff --git openjdk.orig/common/autoconf/spec.gmk.in openjdk/common/autoconf/spec.gmk.in
+--- openjdk.orig/common/autoconf/spec.gmk.in
++++ openjdk/common/autoconf/spec.gmk.in
+@@ -312,6 +312,10 @@
+ ALSA_LIBS:=@ALSA_LIBS@
+ ALSA_CFLAGS:=@ALSA_CFLAGS@
+
++USE_SYSCONF_NSS:=@USE_SYSCONF_NSS@
++NSS_LIBS:=@NSS_LIBS@
++NSS_CFLAGS:=@NSS_CFLAGS@
++
+ PACKAGE_PATH=@PACKAGE_PATH@
+
+ # Source file for cacerts
+diff --git openjdk.orig/common/bin/compare_exceptions.sh.incl
openjdk/common/bin/compare_exceptions.sh.incl
+--- openjdk.orig/common/bin/compare_exceptions.sh.incl
++++ openjdk/common/bin/compare_exceptions.sh.incl
+@@ -280,6 +280,7 @@
+ ./jre/lib/i386/libsplashscreen.so
+ ./jre/lib/i386/libsunec.so
+ ./jre/lib/i386/libsunwjdga.so
++./jre/lib/i386/libsystemconf.so
+ ./jre/lib/i386/libt2k.so
+ ./jre/lib/i386/libunpack.so
+ ./jre/lib/i386/libverify.so
+@@ -433,6 +434,7 @@
+ ./jre/lib/amd64/libsplashscreen.so
+ ./jre/lib/amd64/libsunec.so
+ ./jre/lib/amd64/libsunwjdga.so
++//jre/lib/amd64/libsystemconf.so
+ ./jre/lib/amd64/libt2k.so
+ ./jre/lib/amd64/libunpack.so
+ ./jre/lib/amd64/libverify.so
+@@ -587,6 +589,7 @@
+ ./jre/lib/sparc/libsplashscreen.so
+ ./jre/lib/sparc/libsunec.so
+ ./jre/lib/sparc/libsunwjdga.so
++./jre/lib/sparc/libsystemconf.so
+ ./jre/lib/sparc/libt2k.so
+ ./jre/lib/sparc/libunpack.so
+ ./jre/lib/sparc/libverify.so
+@@ -741,6 +744,7 @@
+ ./jre/lib/sparcv9/libsplashscreen.so
+ ./jre/lib/sparcv9/libsunec.so
+ ./jre/lib/sparcv9/libsunwjdga.so
++./jre/lib/sparcv9/libsystemconf.so
+ ./jre/lib/sparcv9/libt2k.so
+ ./jre/lib/sparcv9/libunpack.so
+ ./jre/lib/sparcv9/libverify.so
+diff --git openjdk.orig/common/nb_native/nbproject/configurations.xml
openjdk/common/nb_native/nbproject/configurations.xml
+--- openjdk.orig/common/nb_native/nbproject/configurations.xml
++++ openjdk/common/nb_native/nbproject/configurations.xml
+@@ -53,6 +53,9 @@
+ <in>jvmtiEnterTrace.cpp</in>
+ </df>
+ </df>
++ <df name="libsystemconf">
++ <in>systemconf.c</in>
++ </df>
+ </df>
+ </df>
+ <df name="jdk">
+@@ -12772,6 +12775,11 @@
+ tool="0"
+ flavor2="0">
+ </item>
++ <item path="../../jdk/src/solaris/native/java/security/systemconf.c"
++ ex="false"
++ tool="0"
++ flavor2="0">
++ </item>
+ <item path="../../jdk/src/share/native/java/util/TimeZone.c"
+ ex="false"
+ tool="0"
diff --git a/rh1991003-enable_fips_keys_import.patch
b/rh1991003-enable_fips_keys_import.patch
new file mode 100644
index 0000000..028769d
--- /dev/null
+++ b/rh1991003-enable_fips_keys_import.patch
@@ -0,0 +1,583 @@
+diff --git openjdk.orig/jdk/src/share/classes/java/security/Security.java
openjdk/jdk/src/share/classes/java/security/Security.java
+--- openjdk.orig/jdk/src/share/classes/java/security/Security.java
++++ openjdk/jdk/src/share/classes/java/security/Security.java
+@@ -78,6 +78,10 @@
+ public boolean isSystemFipsEnabled() {
+ return SystemConfigurator.isSystemFipsEnabled();
+ }
++ @Override
++ public boolean isPlainKeySupportEnabled() {
++ return SystemConfigurator.isPlainKeySupportEnabled();
++ }
+ });
+
+ // doPrivileged here because there are multiple
+diff --git openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java
openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
+--- openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java
++++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
+@@ -55,6 +55,7 @@
+ CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config";
+
+ private static boolean systemFipsEnabled = false;
++ private static boolean plainKeySupportEnabled = false;
+
+ private static final String SYSTEMCONF_NATIVE_LIB = "systemconf";
+
+@@ -149,6 +150,16 @@
+ }
+ loadedProps = true;
+ systemFipsEnabled = true;
++ String plainKeySupport =
System.getProperty("com.redhat.fips.plainKeySupport",
++ "true");
++ plainKeySupportEnabled = !"false".equals(plainKeySupport);
++ if (sdebug != null) {
++ if (plainKeySupportEnabled) {
++ sdebug.println("FIPS support enabled with plain key
support");
++ } else {
++ sdebug.println("FIPS support enabled without plain key
support");
++ }
++ }
+ }
+ } catch (Exception e) {
+ if (sdebug != null) {
+@@ -176,6 +187,19 @@
+ return systemFipsEnabled;
+ }
+
++ /**
++ * Returns {@code true} if system FIPS alignment is enabled
++ * and plain key support is allowed. Plain key support is
++ * enabled by default but can be disabled with
++ * {@code -Dcom.redhat.fips.plainKeySupport=false}.
++ *
++ * @return a boolean indicating whether plain key support
++ * should be enabled.
++ */
++ static boolean isPlainKeySupportEnabled() {
++ return plainKeySupportEnabled;
++ }
++
+ /*
+ * OpenJDK FIPS mode will be enabled only if the com.redhat.fips
+ * system property is true (default) and the system is in FIPS mode.
+diff --git
openjdk.orig/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
openjdk/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
+---
openjdk.orig/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
++++ openjdk/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
+@@ -27,4 +27,5 @@
+
+ public interface JavaSecuritySystemConfiguratorAccess {
+ boolean isSystemFipsEnabled();
++ boolean isPlainKeySupportEnabled();
+ }
+diff --git openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
openjdk/jdk/src/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
+new file mode 100644
+--- /dev/null
++++ openjdk/jdk/src/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
+@@ -0,0 +1,290 @@
++/*
++ * Copyright (c) 2021, Red Hat, Inc.
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation. Oracle designates this
++ * particular file as subject to the "Classpath" exception as provided
++ * by Oracle in the LICENSE file that accompanied this code.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit
www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++package sun.security.pkcs11;
++
++import java.math.BigInteger;
++import java.security.KeyFactory;
++import java.security.Provider;
++import java.security.Security;
++import java.util.HashMap;
++import java.util.Map;
++import java.util.concurrent.locks.ReentrantLock;
++
++import javax.crypto.Cipher;
++import javax.crypto.spec.DHPrivateKeySpec;
++import javax.crypto.spec.IvParameterSpec;
++
++import sun.security.jca.JCAUtil;
++import sun.security.pkcs11.TemplateManager;
++import sun.security.pkcs11.wrapper.CK_ATTRIBUTE;
++import sun.security.pkcs11.wrapper.CK_MECHANISM;
++import static sun.security.pkcs11.wrapper.PKCS11Constants.*;
++import sun.security.pkcs11.wrapper.PKCS11Exception;
++import sun.security.rsa.RSAUtil.KeyType;
++import sun.security.util.Debug;
++import sun.security.util.ECUtil;
++
++final class FIPSKeyImporter {
++
++ private static final Debug debug =
++ Debug.getInstance("sunpkcs11");
++
++ private static P11Key importerKey = null;
++ private static final ReentrantLock importerKeyLock = new ReentrantLock();
++ private static CK_MECHANISM importerKeyMechanism = null;
++ private static Cipher importerCipher = null;
++
++ private static Provider sunECProvider = null;
++ private static final ReentrantLock sunECProviderLock = new ReentrantLock();
++
++ private static KeyFactory DHKF = null;
++ private static final ReentrantLock DHKFLock = new ReentrantLock();
++
++ static Long importKey(SunPKCS11 sunPKCS11, long hSession, CK_ATTRIBUTE[]
attributes)
++ throws PKCS11Exception {
++ long keyID = -1;
++ Token token = sunPKCS11.getToken();
++ if (debug != null) {
++ debug.println("Private or Secret key will be imported in" +
++ " system FIPS mode.");
++ }
++ if (importerKey == null) {
++ importerKeyLock.lock();
++ try {
++ if (importerKey == null) {
++ if (importerKeyMechanism == null) {
++ // Importer Key creation has not been tried yet. Try it.
++ createImporterKey(token);
++ }
++ if (importerKey == null || importerCipher == null) {
++ if (debug != null) {
++ debug.println("Importer Key could not be" +
++ " generated.");
++ }
++ throw new PKCS11Exception(CKR_GENERAL_ERROR);
++ }
++ if (debug != null) {
++ debug.println("Importer Key successfully" +
++ " generated.");
++ }
++ }
++ } finally {
++ importerKeyLock.unlock();
++ }
++ }
++ long importerKeyID = importerKey.getKeyID();
++ try {
++ byte[] keyBytes = null;
++ byte[] encKeyBytes = null;
++ long keyClass = 0L;
++ long keyType = 0L;
++ Map<Long, CK_ATTRIBUTE> attrsMap = new HashMap<>();
++ for (CK_ATTRIBUTE attr : attributes) {
++ if (attr.type == CKA_CLASS) {
++ keyClass = attr.getLong();
++ } else if (attr.type == CKA_KEY_TYPE) {
++ keyType = attr.getLong();
++ }
++ attrsMap.put(attr.type, attr);
++ }
++ BigInteger v = null;
++ if (keyClass == CKO_PRIVATE_KEY) {
++ if (keyType == CKK_RSA) {
++ if (debug != null) {
++ debug.println("Importing an RSA private key...");
++ }
++ keyBytes = sun.security.rsa.RSAPrivateCrtKeyImpl.newKey(
++ KeyType.RSA,
++ null,
++ ((v = attrsMap.get(CKA_MODULUS).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_PUBLIC_EXPONENT).getBigInteger()) !=
null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_PRIVATE_EXPONENT).getBigInteger()) !=
null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_PRIME_1).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_PRIME_2).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_EXPONENT_1).getBigInteger()) !=
null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_EXPONENT_2).getBigInteger()) !=
null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_COEFFICIENT).getBigInteger()) !=
null)
++ ? v : BigInteger.ZERO
++ ).getEncoded();
++ } else if (keyType == CKK_DSA) {
++ if (debug != null) {
++ debug.println("Importing a DSA private key...");
++ }
++ keyBytes = new sun.security.provider.DSAPrivateKey(
++ ((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_PRIME).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_SUBPRIME).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_BASE).getBigInteger()) != null)
++ ? v : BigInteger.ZERO
++ ).getEncoded();
++ if (token.config.getNssNetscapeDbWorkaround() &&
++ attrsMap.get(CKA_NETSCAPE_DB) == null) {
++ attrsMap.put(CKA_NETSCAPE_DB,
++ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO));
++ }
++ } else if (keyType == CKK_EC) {
++ if (debug != null) {
++ debug.println("Importing an EC private key...");
++ }
++ if (sunECProvider == null) {
++ sunECProviderLock.lock();
++ try {
++ if (sunECProvider == null) {
++ sunECProvider =
Security.getProvider("SunEC");
++ }
++ } finally {
++ sunECProviderLock.unlock();
++ }
++ }
++ keyBytes = P11ECUtil.generateECPrivateKey(
++ ((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ECUtil.getECParameterSpec(sunECProvider,
++ attrsMap.get(CKA_EC_PARAMS).getByteArray()))
++ .getEncoded();
++ if (token.config.getNssNetscapeDbWorkaround() &&
++ attrsMap.get(CKA_NETSCAPE_DB) == null) {
++ attrsMap.put(CKA_NETSCAPE_DB,
++ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO));
++ }
++ } else if (keyType == CKK_DH) {
++ if (debug != null) {
++ debug.println("Importing a Diffie-Hellman private
key...");
++ }
++ if (DHKF == null) {
++ DHKFLock.lock();
++ try {
++ if (DHKF == null) {
++ DHKF = KeyFactory.getInstance(
++ "DH", P11Util.getSunJceProvider());
++ }
++ } finally {
++ DHKFLock.unlock();
++ }
++ }
++ DHPrivateKeySpec spec = new DHPrivateKeySpec
++ (((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_PRIME).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_BASE).getBigInteger()) != null)
++ ? v : BigInteger.ZERO);
++ keyBytes = DHKF.generatePrivate(spec).getEncoded();
++ if (token.config.getNssNetscapeDbWorkaround() &&
++ attrsMap.get(CKA_NETSCAPE_DB) == null) {
++ attrsMap.put(CKA_NETSCAPE_DB,
++ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO));
++ }
++ } else {
++ if (debug != null) {
++ debug.println("Unrecognized private key type.");
++ }
++ throw new PKCS11Exception(CKR_GENERAL_ERROR);
++ }
++ } else if (keyClass == CKO_SECRET_KEY) {
++ if (debug != null) {
++ debug.println("Importing a secret key...");
++ }
++ keyBytes = attrsMap.get(CKA_VALUE).getByteArray();
++ }
++ if (keyBytes == null || keyBytes.length == 0) {
++ if (debug != null) {
++ debug.println("Private or secret key plain bytes could" +
++ " not be obtained. Import failed.");
++ }
++ throw new PKCS11Exception(CKR_GENERAL_ERROR);
++ }
++ importerCipher.init(Cipher.ENCRYPT_MODE, importerKey,
++ new IvParameterSpec((byte[])importerKeyMechanism.pParameter),
++ null);
++ attributes = new CK_ATTRIBUTE[attrsMap.size()];
++ attrsMap.values().toArray(attributes);
++ encKeyBytes = importerCipher.doFinal(keyBytes);
++ attributes = token.getAttributes(TemplateManager.O_IMPORT,
++ keyClass, keyType, attributes);
++ keyID = token.p11.C_UnwrapKey(hSession,
++ importerKeyMechanism, importerKeyID, encKeyBytes, attributes);
++ if (debug != null) {
++ debug.println("Imported key ID: " + keyID);
++ }
++ } catch (Throwable t) {
++ throw new PKCS11Exception(CKR_GENERAL_ERROR);
++ } finally {
++ importerKey.releaseKeyID();
++ }
++ return Long.valueOf(keyID);
++ }
++
++ private static void createImporterKey(Token token) {
++ if (debug != null) {
++ debug.println("Generating Importer Key...");
++ }
++ byte[] iv = new byte[16];
++ JCAUtil.getSecureRandom().nextBytes(iv);
++ importerKeyMechanism = new CK_MECHANISM(CKM_AES_CBC_PAD, iv);
++ try {
++ CK_ATTRIBUTE[] attributes = token.getAttributes(TemplateManager.O_GENERATE,
++ CKO_SECRET_KEY, CKK_AES, new CK_ATTRIBUTE[] {
++ new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
++ new CK_ATTRIBUTE(CKA_VALUE_LEN, 256 >> 3)});
++ Session s = null;
++ try {
++ s = token.getObjSession();
++ long keyID = token.p11.C_GenerateKey(
++ s.id(), new CK_MECHANISM(CKM_AES_KEY_GEN),
++ attributes);
++ if (debug != null) {
++ debug.println("Importer Key ID: " + keyID);
++ }
++ importerKey = (P11Key)P11Key.secretKey(s, keyID, "AES",
++ 256 >> 3, null);
++ } catch (PKCS11Exception e) {
++ // best effort
++ } finally {
++ token.releaseSession(s);
++ }
++ if (importerKey != null) {
++ importerCipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
++ }
++ } catch (Throwable t) {
++ // best effort
++ importerKey = null;
++ importerCipher = null;
++ // importerKeyMechanism value is kept initialized to indicate that
++ // Importer Key creation has been tried and failed.
++ }
++ }
++}
+diff --git openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
openjdk/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
+--- openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
++++ openjdk/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
+@@ -26,6 +26,9 @@
+ package sun.security.pkcs11;
+
+ import java.io.*;
++import java.lang.invoke.MethodHandle;
++import java.lang.invoke.MethodHandles;
++import java.lang.invoke.MethodType;
+ import java.util.*;
+
+ import java.security.*;
+@@ -63,6 +66,26 @@
+ private static final boolean systemFipsEnabled = SharedSecrets
+ .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled();
+
++ private static final boolean plainKeySupportEnabled = SharedSecrets
++ .getJavaSecuritySystemConfiguratorAccess().isPlainKeySupportEnabled();
++
++ private static final MethodHandle fipsImportKey;
++ static {
++ MethodHandle fipsImportKeyTmp = null;
++ if (plainKeySupportEnabled) {
++ try {
++ fipsImportKeyTmp = MethodHandles.lookup().findStatic(
++ FIPSKeyImporter.class, "importKey",
++ MethodType.methodType(Long.class, SunPKCS11.class,
++ long.class, CK_ATTRIBUTE[].class));
++ } catch (Throwable t) {
++ throw new SecurityException("FIPS key importer initialization"
+
++ " failed", t);
++ }
++ }
++ fipsImportKey = fipsImportKeyTmp;
++ }
++
+ private static final long serialVersionUID = -1354835039035306505L;
+
+ static final Debug debug = Debug.getInstance("sunpkcs11");
+@@ -314,10 +337,15 @@
+ // request multithreaded access first
+ initArgs.flags = CKF_OS_LOCKING_OK;
+ PKCS11 tmpPKCS11;
++ MethodHandle fipsKeyImporter = null;
++ if (plainKeySupportEnabled) {
++ fipsKeyImporter = MethodHandles.insertArguments(
++ fipsImportKey, 0, this);
++ }
+ try {
+ tmpPKCS11 = PKCS11.getInstance(
+ library, functionList, initArgs,
+- config.getOmitInitialize());
++ config.getOmitInitialize(), fipsKeyImporter);
+ } catch (PKCS11Exception e) {
+ if (debug != null) {
+ debug.println("Multi-threaded initialization failed: " +
e);
+@@ -333,7 +361,7 @@
+ initArgs.flags = 0;
+ }
+ tmpPKCS11 = PKCS11.getInstance(library,
+- functionList, initArgs, config.getOmitInitialize());
++ functionList, initArgs, config.getOmitInitialize(),
fipsKeyImporter);
+ }
+ p11 = tmpPKCS11;
+
+diff --git openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
openjdk/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
+--- openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
++++ openjdk/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
+@@ -49,6 +49,7 @@
+
+ import java.io.File;
+ import java.io.IOException;
++import java.lang.invoke.MethodHandle;
+ import java.util.*;
+
+ import java.security.AccessController;
+@@ -147,16 +148,28 @@
+
+ public static synchronized PKCS11 getInstance(String pkcs11ModulePath,
+ String functionList, CK_C_INITIALIZE_ARGS pInitArgs,
+- boolean omitInitialize) throws IOException, PKCS11Exception {
++ boolean omitInitialize, MethodHandle fipsKeyImporter)
++ throws IOException, PKCS11Exception {
+ // we may only call C_Initialize once per native .so/.dll
+ // so keep a cache using the (non-canonicalized!) path
+ PKCS11 pkcs11 = moduleMap.get(pkcs11ModulePath);
+ if (pkcs11 == null) {
++ boolean nssFipsMode = fipsKeyImporter != null;
+ if ((pInitArgs != null)
+ && ((pInitArgs.flags & CKF_OS_LOCKING_OK) != 0)) {
+- pkcs11 = new PKCS11(pkcs11ModulePath, functionList);
++ if (nssFipsMode) {
++ pkcs11 = new FIPSPKCS11(pkcs11ModulePath, functionList,
++ fipsKeyImporter);
++ } else {
++ pkcs11 = new PKCS11(pkcs11ModulePath, functionList);
++ }
+ } else {
+- pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList);
++ if (nssFipsMode) {
++ pkcs11 = new SynchronizedFIPSPKCS11(pkcs11ModulePath,
++ functionList, fipsKeyImporter);
++ } else {
++ pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList);
++ }
+ }
+ if (omitInitialize == false) {
+ try {
+@@ -1905,4 +1918,69 @@
+ super.C_GenerateRandom(hSession, randomData);
+ }
+ }
++
++// PKCS11 subclass that allows using plain private or secret keys in
++// FIPS-configured NSS Software Tokens. Only used when System FIPS
++// is enabled.
++static class FIPSPKCS11 extends PKCS11 {
++ private MethodHandle fipsKeyImporter;
++ FIPSPKCS11(String pkcs11ModulePath, String functionListName,
++ MethodHandle fipsKeyImporter) throws IOException {
++ super(pkcs11ModulePath, functionListName);
++ this.fipsKeyImporter = fipsKeyImporter;
++ }
++
++ public synchronized long C_CreateObject(long hSession,
++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception {
++ // Creating sensitive key objects from plain key material in a
++ // FIPS-configured NSS Software Token is not allowed. We apply
++ // a key-unwrapping scheme to achieve so.
++ if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) {
++ try {
++ return ((Long)fipsKeyImporter.invoke(hSession, pTemplate))
++ .longValue();
++ } catch (Throwable t) {
++ throw new PKCS11Exception(CKR_GENERAL_ERROR);
++ }
++ }
++ return super.C_CreateObject(hSession, pTemplate);
++ }
+ }
++
++// FIPSPKCS11 synchronized counterpart.
++static class SynchronizedFIPSPKCS11 extends SynchronizedPKCS11 {
++ private MethodHandle fipsKeyImporter;
++ SynchronizedFIPSPKCS11(String pkcs11ModulePath, String functionListName,
++ MethodHandle fipsKeyImporter) throws IOException {
++ super(pkcs11ModulePath, functionListName);
++ this.fipsKeyImporter = fipsKeyImporter;
++ }
++
++ public synchronized long C_CreateObject(long hSession,
++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception {
++ // See FIPSPKCS11::C_CreateObject.
++ if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) {
++ try {
++ return ((Long)fipsKeyImporter.invoke(hSession, pTemplate))
++ .longValue();
++ } catch (Throwable t) {
++ throw new PKCS11Exception(CKR_GENERAL_ERROR);
++ }
++ }
++ return super.C_CreateObject(hSession, pTemplate);
++ }
++}
++
++private static class FIPSPKCS11Helper {
++ static boolean isSensitiveObject(CK_ATTRIBUTE[] pTemplate) {
++ for (CK_ATTRIBUTE attr : pTemplate) {
++ if (attr.type == CKA_CLASS &&
++ (attr.getLong() == CKO_PRIVATE_KEY ||
++ attr.getLong() == CKO_SECRET_KEY)) {
++ return true;
++ }
++ }
++ return false;
++ }
++}
++}
+diff --git openjdk.orig/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
openjdk/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
+--- openjdk.orig/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
++++ openjdk/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
+@@ -33,8 +33,13 @@
+
+ import javax.net.ssl.*;
+
++import sun.misc.SharedSecrets;
++
+ abstract class KeyManagerFactoryImpl extends KeyManagerFactorySpi {
+
++ private static final boolean plainKeySupportEnabled = SharedSecrets
++ .getJavaSecuritySystemConfiguratorAccess().isPlainKeySupportEnabled();
++
+ X509ExtendedKeyManager keyManager;
+ boolean isInitialized;
+
+@@ -62,7 +67,8 @@
+ KeyStoreException, NoSuchAlgorithmException,
+ UnrecoverableKeyException {
+ if ((ks != null) && SunJSSE.isFIPS()) {
+- if (ks.getProvider() != SunJSSE.cryptoProvider) {
++ if (ks.getProvider() != SunJSSE.cryptoProvider &&
++ !plainKeySupportEnabled) {
+ throw new KeyStoreException("FIPS mode: KeyStore must be
"
+ + "from provider " +
SunJSSE.cryptoProvider.getName());
+ }
+@@ -91,8 +97,8 @@
+ keyManager = new X509KeyManagerImpl(
+ Collections.<Builder>emptyList());
+ } else {
+- if (SunJSSE.isFIPS() &&
+- (ks.getProvider() != SunJSSE.cryptoProvider)) {
++ if (SunJSSE.isFIPS() && (ks.getProvider() !=
SunJSSE.cryptoProvider)
++ && !plainKeySupportEnabled) {
+ throw new KeyStoreException(
+ "FIPS mode: KeyStore must be " +
+ "from provider " + SunJSSE.cryptoProvider.getName());
diff --git a/rh1996182-login_to_nss_software_token.patch
b/rh1996182-login_to_nss_software_token.patch
new file mode 100644
index 0000000..341e092
--- /dev/null
+++ b/rh1996182-login_to_nss_software_token.patch
@@ -0,0 +1,55 @@
+# HG changeset patch
+# User mbalao
+# Date 1630103180 -3600
+# Fri Aug 27 23:26:20 2021 +0100
+# Node ID b3bd3119fab9bc5adfd7073377aca12bb1af80b3
+# Parent c90394a76ee02a689f95199559d5724824b4b25e
+RH1996182: Login to the NSS Software Token in FIPS Mode
+
+diff --git openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
openjdk/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
+--- openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
++++ openjdk/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
+@@ -42,6 +42,8 @@
+ import javax.security.auth.callback.PasswordCallback;
+ import javax.security.auth.callback.TextOutputCallback;
+
++import sun.misc.SharedSecrets;
++
+ import sun.security.util.Debug;
+ import sun.security.util.ResourcesMgr;
+
+@@ -58,6 +60,9 @@
+ */
+ public final class SunPKCS11 extends AuthProvider {
+
++ private static final boolean systemFipsEnabled = SharedSecrets
++ .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled();
++
+ private static final long serialVersionUID = -1354835039035306505L;
+
+ static final Debug debug = Debug.getInstance("sunpkcs11");
+@@ -368,6 +373,24 @@
+ if (nssModule != null) {
+ nssModule.setProvider(this);
+ }
++ if (systemFipsEnabled) {
++ // The NSS Software Token in FIPS 140-2 mode requires a user
++ // login for most operations. See sftk_fipsCheck. The NSS DB
++ // (/etc/pki/nssdb) PIN is empty.
++ Session session = null;
++ try {
++ session = token.getOpSession();
++ p11.C_Login(session.id(), CKU_USER, new char[] {});
++ } catch (PKCS11Exception p11e) {
++ if (debug != null) {
++ debug.println("Error during token login: " +
++ p11e.getMessage());
++ }
++ throw p11e;
++ } finally {
++ token.releaseSession(session);
++ }
++ }
+ } catch (Exception e) {
+ if (config.getHandleStartupErrors() == Config.ERR_IGNORE_ALL) {
+ throw new UnsupportedOperationException
diff --git a/sources b/sources
index 3236329..32ce1e2 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512
(aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b08-4curve-clean.tar.xz) =
04ecdcde841038c0042b44fb3c5303a08616864566fb918ab261fc381fae8804a21f875b1645538e864a1c6db5985f16dfc13b91eb1caeeab54d6d07828c7657
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b07-4curve.tar.xz) =
6da9aab9f456336d73cb41755b9e075c43b21ce54fa208d94295aaeef0dce9e4059740efe87458e131b633c3ab3d6f964a5d2407a76e79dd9b080a5416efd7e7
commit 06afebf8011b6c20c3771e6f98f8f76ea2c0c36c
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Wed Oct 20 01:46:06 2021 +0100
Update to aarch64-shenandoah-jdk8u312-b07 (GA)
Update release notes for 8u312-b07.
Switch to GA mode for final release.
diff --git a/.gitignore b/.gitignore
index f34cedd..d5493bd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -244,3 +244,5 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b03-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b04-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b05-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b05-shenandoah-merge-2021-10-07-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b07-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 05c1b39..ef9db68 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,33 @@ Live versions of these release notes can be found at:
*
https://bitly.com/openjdk8u312
*
https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u312.txt
+* Security fixes
+ - JDK-8130183, CVE-2021-35588: InnerClasses: VM permits wrong Throw ClassFormatError if
InnerClasses attribute's inner_class_info_index is 0
+ - JDK-8161016: Strange behavior of URLConnection with proxy
+ - JDK-8163326, CVE-2021-35550: Update the default enabled cipher suites preference
+ - JDK-8254967, CVE-2021-35565: com.sun.net.HttpsServer spins on TLS session close
+ - JDK-8263314: Enhance XML Dsig modes
+ - JDK-8265167, CVE-2021-35556: Richer Text Editors
+ - JDK-8265574: Improve handling of sheets
+ - JDK-8265580, CVE-2021-35559: Enhanced style for RTF kit
+ - JDK-8265776: Improve Stream handling for SSL
+ - JDK-8266097, CVE-2021-35561: Better hashing support
+ - JDK-8266103: Better specified spec values
+ - JDK-8266109: More Resilient Classloading
+ - JDK-8266115: More Manifest Jar Loading
+ - JDK-8266137, CVE-2021-35564: Improve Keystore integrity
+ - JDK-8266689, CVE-2021-35567: More Constrained Delegation
+ - JDK-8267086: ArrayIndexOutOfBoundsException in
java.security.KeyFactory.generatePublic
+ - JDK-8267712: Better LDAP reference processing
+ - JDK-8267729, CVE-2021-35578: Improve TLS client handshaking
+ - JDK-8267735, CVE-2021-35586: Better BMP support
+ - JDK-8268193: Improve requests of certificates
+ - JDK-8268199: Correct certificate requests
+ - JDK-8268506: More Manifest Digests
+ - JDK-8269618, CVE-2021-35603: Better session identification
+ - JDK-8269624: Enhance method selection support
+ - JDK-8270398: Enhance canonicalization
+ - JDK-8270404: Better canonicalization
* Other changes
- JDK-6847157: java.lang.NullPointerException: HDC for component at
sun.java2d.loops.Blit.Blit
- JDK-7146776: deadlock between URLStreamHandler.getHostAddress and
file.Handler.openconnection
@@ -29,10 +56,9 @@ Live versions of these release notes can be found at:
- JDK-8134869: AARCH64: GHASH intrinsic is not optimal
- JDK-8134989: java/net/MulticastSocket/TestInterfaces.java failed due to unexpected IP
address
- JDK-8156584: Initialization race in sun.security.x509.AlgorithmId.get
- - JDK-8161016: Strange behavior of URLConnection with proxy
+ - JDK-8157404: Unable to read certain PKCS12 keystores from SequenceInputStream
- JDK-8166673: The new implementation of Robot.waitForIdle() may hang
- JDK-8170467: (reflect) Optimize SignatureParser's use of StringBuilders
- - JDK-8176837: SunPKCS11 provider needs to check more details on PKCS11 Mechanism
- JDK-8194246: JVM crashes when calling getStackTrace if stack contains a method that
is a member of a very large class
- JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
- JDK-8202837: PBES2 AlgorithmId encoding error in PKCS12 KeyStore
@@ -40,6 +66,7 @@ Live versions of these release notes can be found at:
- JDK-8214418: half-closed SSLEngine status may cause application dead loop
- JDK-8214513: A PKCS12 keystore from Java 8 using custom PBE parameters cannot be read
in Java 11
- JDK-8220786: Create new switch to redirect error reporting output to stdout or
stderr
+ - JDK-8222751:
closed/test/jdk/sun/security/util/DerIndefLenConverter/IndefBerPkcs12.java fail
- JDK-8229243: SunPKCS11-Solaris provider tests failing on Solaris 11.4
- JDK-8231222: fix pkcs11 P11_DEBUG guarded native traces
- JDK-8237495: Java MIDI fails with a dereferenced memory error when asked to send a
raw 0xF7
@@ -49,7 +76,6 @@ Live versions of these release notes can be found at:
- JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header files
- JDK-8247469: getSystemCpuLoad() returns -1 on linux when some offline cpus are
present and cpusets.effective_cpus is not available
- JDK-8248901: Signed immediate support in .../share/assembler.hpp is broken.
- - JDK-8254967: com.sun.net.HttpsServer spins on TLS session close
- JDK-8259338: Add expiry exception for identrustdstx3 alias to VerifyCACerts.java
test
- JDK-8262000:
jdk/jfr/event/gc/detailed/TestPromotionFailedEventWithParallelScavenge.java failed with
"OutOfMemoryError: Java heap space"
- JDK-8262829: Native crash in Win32PrintServiceLookup.getAllPrinterNames()
@@ -61,7 +87,9 @@ Live versions of these release notes can be found at:
- JDK-8265978: make test should look for more locations when searching for exit code
- JDK-8266206: Build failure after JDK-8264752 with older GCCs
- JDK-8268103: JNI functions incorrectly return a double after JDK-8265836
+ - JDK-8268965: TCP Connection Reset when connecting simple socket to SSL server
- JDK-8269594: assert(_handle_mark_nesting > 1) failed: memory leak: allocating
handle outside HandleMark
+ - JDK-8269763: The JEditorPane is blank after JDK-8265167
- JDK-8269810: [8u] Update generated_configure.sh after JDK-8250876 backport
- JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports incorrect process cpu
usage in containers
- JDK-8269859: BacktraceBuilder._cprefs needs to be accessed as unsigned short
@@ -72,6 +100,34 @@ Live versions of these release notes can be found at:
- JDK-8272124: Cgroup v1 initialization causes NullPointerException when cgroup path
contains colon
- JDK-8272214: [8u] Build failure after backport of JDK-8248901
- JDK-8272714: [8u] Build failure after backport of JDK-8248901 with MSVC 2013
+* Shenandoah
+ - [backport] JDK-8269661: JNI_GetStringCritical does not lock char array
+ - Re-cast JNI critical strings patch to be Shenandoah-specific
+
+Notes on individual issues:
+===========================
+
+core-libs/java.net:
+
+JDK-8164200: Modified HttpURLConnection behavior when no suitable proxy is found
+================================================================================
+The behavior of HttpURLConnection when using a ProxySelector has been
+modified with this JDK release. HttpURLConnection used to fall back to
+a DIRECT connection attempt if the configured proxy(s) failed to make
+a connection. This release introduces a change whereby no DIRECT
+connection will be attempted in such a scenario. Instead, the
+HttpURLConnection.connect() method will fail and throw an IOException
+which occurred from the last proxy tested.
+
+security-libs/javax.net.ssl:
+
+JDK-8219551: Updated the Default Enabled Cipher Suites Preference
+=================================================================
+The preference of the default enabled cipher suites has been
+changed. The compatibility impact should be minimal. If needed,
+applications can customize the enabled cipher suites and the
+preference. For more details, refer to the SunJSSE provider
+documentation and the JSSE Reference Guide documentation.
New in release OpenJDK 8u302 (2021-07-20):
===========================================
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 16c2d89..afad6cd 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -296,7 +296,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u312-b05
+%global shenandoah_revision aarch64-shenandoah-jdk8u312-b07
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -311,12 +311,12 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 2
+%global rpmrelease 1
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
# - N%%{?extraver}{?dist} for GA releases
-%global is_ga 0
+%global is_ga 1
%if %{is_ga}
%global milestone fcs
%global milestone_version %{nil}
@@ -2624,6 +2624,11 @@ cjc.mainProgram(args)
%endif
%changelog
+* Fri Oct 15 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b07-1
+- Update to aarch64-shenandoah-jdk8u312-b07 (GA)
+- Update release notes for 8u312-b07.
+- Switch to GA mode for final release.
+
* Thu Oct 07 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b05-0.2.ea
- Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
diff --git a/sources b/sources
index 7c2359c..32ce1e2 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b05-4curve.tar.xz) =
41aa7cfe6946f9b88e8ae66716e8db204a401f5ded43037c54c071b7a895e08df389d6a7ae5961da00c309a6802c88197cd59ed8e5e52a466c997a680f7f425f
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b07-4curve.tar.xz) =
6da9aab9f456336d73cb41755b9e075c43b21ce54fa208d94295aaeef0dce9e4059740efe87458e131b633c3ab3d6f964a5d2407a76e79dd9b080a5416efd7e7
commit 38ede77603423977c87a2c9298a9993fa00d9545
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Sun Oct 10 22:01:08 2021 +0100
Add FIPS patch to allow plain key import.
Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 35a55bd..16c2d89 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -311,7 +311,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 1
+%global rpmrelease 2
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1315,6 +1315,8 @@ Patch1006: rh1929465-improve_system_FIPS_detection-root.patch
Patch1007: rh1929465-improve_system_FIPS_detection-jdk.patch
# RH1996182: Login to the NSS software token in FIPS mode
Patch1008: rh1996182-login_to_nss_software_token.patch
+# RH1991003: Allow plain key import unless com.redhat.fips.plainKeySupport is set to
false
+Patch1011: rh1991003-enable_fips_keys_import.patch
#############################################
#
@@ -1844,6 +1846,7 @@ sh %{SOURCE12}
%patch1006
%patch1007
%patch1008
+%patch1011
# RHEL-only patches
%if ! 0%{?fedora} && 0%{?rhel} <= 7
@@ -2621,6 +2624,12 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Oct 07 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b05-0.2.ea
+- Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
+
+* Thu Oct 07 2021 Martin Balao <mbalao(a)redhat.com> - 1:1.8.0.312.b05-0.2.ea
+- Add patch to allow plain key import.
+
* Thu Sep 30 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b05-0.1.ea
- Update to aarch64-shenandoah-jdk8u312-b05 (EA)
- Update release notes for 8u312-b05.
diff --git a/rh1991003-enable_fips_keys_import.patch
b/rh1991003-enable_fips_keys_import.patch
new file mode 100644
index 0000000..028769d
--- /dev/null
+++ b/rh1991003-enable_fips_keys_import.patch
@@ -0,0 +1,583 @@
+diff --git openjdk.orig/jdk/src/share/classes/java/security/Security.java
openjdk/jdk/src/share/classes/java/security/Security.java
+--- openjdk.orig/jdk/src/share/classes/java/security/Security.java
++++ openjdk/jdk/src/share/classes/java/security/Security.java
+@@ -78,6 +78,10 @@
+ public boolean isSystemFipsEnabled() {
+ return SystemConfigurator.isSystemFipsEnabled();
+ }
++ @Override
++ public boolean isPlainKeySupportEnabled() {
++ return SystemConfigurator.isPlainKeySupportEnabled();
++ }
+ });
+
+ // doPrivileged here because there are multiple
+diff --git openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java
openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
+--- openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java
++++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
+@@ -55,6 +55,7 @@
+ CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config";
+
+ private static boolean systemFipsEnabled = false;
++ private static boolean plainKeySupportEnabled = false;
+
+ private static final String SYSTEMCONF_NATIVE_LIB = "systemconf";
+
+@@ -149,6 +150,16 @@
+ }
+ loadedProps = true;
+ systemFipsEnabled = true;
++ String plainKeySupport =
System.getProperty("com.redhat.fips.plainKeySupport",
++ "true");
++ plainKeySupportEnabled = !"false".equals(plainKeySupport);
++ if (sdebug != null) {
++ if (plainKeySupportEnabled) {
++ sdebug.println("FIPS support enabled with plain key
support");
++ } else {
++ sdebug.println("FIPS support enabled without plain key
support");
++ }
++ }
+ }
+ } catch (Exception e) {
+ if (sdebug != null) {
+@@ -176,6 +187,19 @@
+ return systemFipsEnabled;
+ }
+
++ /**
++ * Returns {@code true} if system FIPS alignment is enabled
++ * and plain key support is allowed. Plain key support is
++ * enabled by default but can be disabled with
++ * {@code -Dcom.redhat.fips.plainKeySupport=false}.
++ *
++ * @return a boolean indicating whether plain key support
++ * should be enabled.
++ */
++ static boolean isPlainKeySupportEnabled() {
++ return plainKeySupportEnabled;
++ }
++
+ /*
+ * OpenJDK FIPS mode will be enabled only if the com.redhat.fips
+ * system property is true (default) and the system is in FIPS mode.
+diff --git
openjdk.orig/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
openjdk/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
+---
openjdk.orig/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
++++ openjdk/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
+@@ -27,4 +27,5 @@
+
+ public interface JavaSecuritySystemConfiguratorAccess {
+ boolean isSystemFipsEnabled();
++ boolean isPlainKeySupportEnabled();
+ }
+diff --git openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
openjdk/jdk/src/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
+new file mode 100644
+--- /dev/null
++++ openjdk/jdk/src/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
+@@ -0,0 +1,290 @@
++/*
++ * Copyright (c) 2021, Red Hat, Inc.
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation. Oracle designates this
++ * particular file as subject to the "Classpath" exception as provided
++ * by Oracle in the LICENSE file that accompanied this code.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit
www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++package sun.security.pkcs11;
++
++import java.math.BigInteger;
++import java.security.KeyFactory;
++import java.security.Provider;
++import java.security.Security;
++import java.util.HashMap;
++import java.util.Map;
++import java.util.concurrent.locks.ReentrantLock;
++
++import javax.crypto.Cipher;
++import javax.crypto.spec.DHPrivateKeySpec;
++import javax.crypto.spec.IvParameterSpec;
++
++import sun.security.jca.JCAUtil;
++import sun.security.pkcs11.TemplateManager;
++import sun.security.pkcs11.wrapper.CK_ATTRIBUTE;
++import sun.security.pkcs11.wrapper.CK_MECHANISM;
++import static sun.security.pkcs11.wrapper.PKCS11Constants.*;
++import sun.security.pkcs11.wrapper.PKCS11Exception;
++import sun.security.rsa.RSAUtil.KeyType;
++import sun.security.util.Debug;
++import sun.security.util.ECUtil;
++
++final class FIPSKeyImporter {
++
++ private static final Debug debug =
++ Debug.getInstance("sunpkcs11");
++
++ private static P11Key importerKey = null;
++ private static final ReentrantLock importerKeyLock = new ReentrantLock();
++ private static CK_MECHANISM importerKeyMechanism = null;
++ private static Cipher importerCipher = null;
++
++ private static Provider sunECProvider = null;
++ private static final ReentrantLock sunECProviderLock = new ReentrantLock();
++
++ private static KeyFactory DHKF = null;
++ private static final ReentrantLock DHKFLock = new ReentrantLock();
++
++ static Long importKey(SunPKCS11 sunPKCS11, long hSession, CK_ATTRIBUTE[]
attributes)
++ throws PKCS11Exception {
++ long keyID = -1;
++ Token token = sunPKCS11.getToken();
++ if (debug != null) {
++ debug.println("Private or Secret key will be imported in" +
++ " system FIPS mode.");
++ }
++ if (importerKey == null) {
++ importerKeyLock.lock();
++ try {
++ if (importerKey == null) {
++ if (importerKeyMechanism == null) {
++ // Importer Key creation has not been tried yet. Try it.
++ createImporterKey(token);
++ }
++ if (importerKey == null || importerCipher == null) {
++ if (debug != null) {
++ debug.println("Importer Key could not be" +
++ " generated.");
++ }
++ throw new PKCS11Exception(CKR_GENERAL_ERROR);
++ }
++ if (debug != null) {
++ debug.println("Importer Key successfully" +
++ " generated.");
++ }
++ }
++ } finally {
++ importerKeyLock.unlock();
++ }
++ }
++ long importerKeyID = importerKey.getKeyID();
++ try {
++ byte[] keyBytes = null;
++ byte[] encKeyBytes = null;
++ long keyClass = 0L;
++ long keyType = 0L;
++ Map<Long, CK_ATTRIBUTE> attrsMap = new HashMap<>();
++ for (CK_ATTRIBUTE attr : attributes) {
++ if (attr.type == CKA_CLASS) {
++ keyClass = attr.getLong();
++ } else if (attr.type == CKA_KEY_TYPE) {
++ keyType = attr.getLong();
++ }
++ attrsMap.put(attr.type, attr);
++ }
++ BigInteger v = null;
++ if (keyClass == CKO_PRIVATE_KEY) {
++ if (keyType == CKK_RSA) {
++ if (debug != null) {
++ debug.println("Importing an RSA private key...");
++ }
++ keyBytes = sun.security.rsa.RSAPrivateCrtKeyImpl.newKey(
++ KeyType.RSA,
++ null,
++ ((v = attrsMap.get(CKA_MODULUS).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_PUBLIC_EXPONENT).getBigInteger()) !=
null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_PRIVATE_EXPONENT).getBigInteger()) !=
null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_PRIME_1).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_PRIME_2).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_EXPONENT_1).getBigInteger()) !=
null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_EXPONENT_2).getBigInteger()) !=
null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_COEFFICIENT).getBigInteger()) !=
null)
++ ? v : BigInteger.ZERO
++ ).getEncoded();
++ } else if (keyType == CKK_DSA) {
++ if (debug != null) {
++ debug.println("Importing a DSA private key...");
++ }
++ keyBytes = new sun.security.provider.DSAPrivateKey(
++ ((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_PRIME).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_SUBPRIME).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_BASE).getBigInteger()) != null)
++ ? v : BigInteger.ZERO
++ ).getEncoded();
++ if (token.config.getNssNetscapeDbWorkaround() &&
++ attrsMap.get(CKA_NETSCAPE_DB) == null) {
++ attrsMap.put(CKA_NETSCAPE_DB,
++ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO));
++ }
++ } else if (keyType == CKK_EC) {
++ if (debug != null) {
++ debug.println("Importing an EC private key...");
++ }
++ if (sunECProvider == null) {
++ sunECProviderLock.lock();
++ try {
++ if (sunECProvider == null) {
++ sunECProvider =
Security.getProvider("SunEC");
++ }
++ } finally {
++ sunECProviderLock.unlock();
++ }
++ }
++ keyBytes = P11ECUtil.generateECPrivateKey(
++ ((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ECUtil.getECParameterSpec(sunECProvider,
++ attrsMap.get(CKA_EC_PARAMS).getByteArray()))
++ .getEncoded();
++ if (token.config.getNssNetscapeDbWorkaround() &&
++ attrsMap.get(CKA_NETSCAPE_DB) == null) {
++ attrsMap.put(CKA_NETSCAPE_DB,
++ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO));
++ }
++ } else if (keyType == CKK_DH) {
++ if (debug != null) {
++ debug.println("Importing a Diffie-Hellman private
key...");
++ }
++ if (DHKF == null) {
++ DHKFLock.lock();
++ try {
++ if (DHKF == null) {
++ DHKF = KeyFactory.getInstance(
++ "DH", P11Util.getSunJceProvider());
++ }
++ } finally {
++ DHKFLock.unlock();
++ }
++ }
++ DHPrivateKeySpec spec = new DHPrivateKeySpec
++ (((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_PRIME).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_BASE).getBigInteger()) != null)
++ ? v : BigInteger.ZERO);
++ keyBytes = DHKF.generatePrivate(spec).getEncoded();
++ if (token.config.getNssNetscapeDbWorkaround() &&
++ attrsMap.get(CKA_NETSCAPE_DB) == null) {
++ attrsMap.put(CKA_NETSCAPE_DB,
++ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO));
++ }
++ } else {
++ if (debug != null) {
++ debug.println("Unrecognized private key type.");
++ }
++ throw new PKCS11Exception(CKR_GENERAL_ERROR);
++ }
++ } else if (keyClass == CKO_SECRET_KEY) {
++ if (debug != null) {
++ debug.println("Importing a secret key...");
++ }
++ keyBytes = attrsMap.get(CKA_VALUE).getByteArray();
++ }
++ if (keyBytes == null || keyBytes.length == 0) {
++ if (debug != null) {
++ debug.println("Private or secret key plain bytes could" +
++ " not be obtained. Import failed.");
++ }
++ throw new PKCS11Exception(CKR_GENERAL_ERROR);
++ }
++ importerCipher.init(Cipher.ENCRYPT_MODE, importerKey,
++ new IvParameterSpec((byte[])importerKeyMechanism.pParameter),
++ null);
++ attributes = new CK_ATTRIBUTE[attrsMap.size()];
++ attrsMap.values().toArray(attributes);
++ encKeyBytes = importerCipher.doFinal(keyBytes);
++ attributes = token.getAttributes(TemplateManager.O_IMPORT,
++ keyClass, keyType, attributes);
++ keyID = token.p11.C_UnwrapKey(hSession,
++ importerKeyMechanism, importerKeyID, encKeyBytes, attributes);
++ if (debug != null) {
++ debug.println("Imported key ID: " + keyID);
++ }
++ } catch (Throwable t) {
++ throw new PKCS11Exception(CKR_GENERAL_ERROR);
++ } finally {
++ importerKey.releaseKeyID();
++ }
++ return Long.valueOf(keyID);
++ }
++
++ private static void createImporterKey(Token token) {
++ if (debug != null) {
++ debug.println("Generating Importer Key...");
++ }
++ byte[] iv = new byte[16];
++ JCAUtil.getSecureRandom().nextBytes(iv);
++ importerKeyMechanism = new CK_MECHANISM(CKM_AES_CBC_PAD, iv);
++ try {
++ CK_ATTRIBUTE[] attributes = token.getAttributes(TemplateManager.O_GENERATE,
++ CKO_SECRET_KEY, CKK_AES, new CK_ATTRIBUTE[] {
++ new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
++ new CK_ATTRIBUTE(CKA_VALUE_LEN, 256 >> 3)});
++ Session s = null;
++ try {
++ s = token.getObjSession();
++ long keyID = token.p11.C_GenerateKey(
++ s.id(), new CK_MECHANISM(CKM_AES_KEY_GEN),
++ attributes);
++ if (debug != null) {
++ debug.println("Importer Key ID: " + keyID);
++ }
++ importerKey = (P11Key)P11Key.secretKey(s, keyID, "AES",
++ 256 >> 3, null);
++ } catch (PKCS11Exception e) {
++ // best effort
++ } finally {
++ token.releaseSession(s);
++ }
++ if (importerKey != null) {
++ importerCipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
++ }
++ } catch (Throwable t) {
++ // best effort
++ importerKey = null;
++ importerCipher = null;
++ // importerKeyMechanism value is kept initialized to indicate that
++ // Importer Key creation has been tried and failed.
++ }
++ }
++}
+diff --git openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
openjdk/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
+--- openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
++++ openjdk/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
+@@ -26,6 +26,9 @@
+ package sun.security.pkcs11;
+
+ import java.io.*;
++import java.lang.invoke.MethodHandle;
++import java.lang.invoke.MethodHandles;
++import java.lang.invoke.MethodType;
+ import java.util.*;
+
+ import java.security.*;
+@@ -63,6 +66,26 @@
+ private static final boolean systemFipsEnabled = SharedSecrets
+ .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled();
+
++ private static final boolean plainKeySupportEnabled = SharedSecrets
++ .getJavaSecuritySystemConfiguratorAccess().isPlainKeySupportEnabled();
++
++ private static final MethodHandle fipsImportKey;
++ static {
++ MethodHandle fipsImportKeyTmp = null;
++ if (plainKeySupportEnabled) {
++ try {
++ fipsImportKeyTmp = MethodHandles.lookup().findStatic(
++ FIPSKeyImporter.class, "importKey",
++ MethodType.methodType(Long.class, SunPKCS11.class,
++ long.class, CK_ATTRIBUTE[].class));
++ } catch (Throwable t) {
++ throw new SecurityException("FIPS key importer initialization"
+
++ " failed", t);
++ }
++ }
++ fipsImportKey = fipsImportKeyTmp;
++ }
++
+ private static final long serialVersionUID = -1354835039035306505L;
+
+ static final Debug debug = Debug.getInstance("sunpkcs11");
+@@ -314,10 +337,15 @@
+ // request multithreaded access first
+ initArgs.flags = CKF_OS_LOCKING_OK;
+ PKCS11 tmpPKCS11;
++ MethodHandle fipsKeyImporter = null;
++ if (plainKeySupportEnabled) {
++ fipsKeyImporter = MethodHandles.insertArguments(
++ fipsImportKey, 0, this);
++ }
+ try {
+ tmpPKCS11 = PKCS11.getInstance(
+ library, functionList, initArgs,
+- config.getOmitInitialize());
++ config.getOmitInitialize(), fipsKeyImporter);
+ } catch (PKCS11Exception e) {
+ if (debug != null) {
+ debug.println("Multi-threaded initialization failed: " +
e);
+@@ -333,7 +361,7 @@
+ initArgs.flags = 0;
+ }
+ tmpPKCS11 = PKCS11.getInstance(library,
+- functionList, initArgs, config.getOmitInitialize());
++ functionList, initArgs, config.getOmitInitialize(),
fipsKeyImporter);
+ }
+ p11 = tmpPKCS11;
+
+diff --git openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
openjdk/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
+--- openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
++++ openjdk/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
+@@ -49,6 +49,7 @@
+
+ import java.io.File;
+ import java.io.IOException;
++import java.lang.invoke.MethodHandle;
+ import java.util.*;
+
+ import java.security.AccessController;
+@@ -147,16 +148,28 @@
+
+ public static synchronized PKCS11 getInstance(String pkcs11ModulePath,
+ String functionList, CK_C_INITIALIZE_ARGS pInitArgs,
+- boolean omitInitialize) throws IOException, PKCS11Exception {
++ boolean omitInitialize, MethodHandle fipsKeyImporter)
++ throws IOException, PKCS11Exception {
+ // we may only call C_Initialize once per native .so/.dll
+ // so keep a cache using the (non-canonicalized!) path
+ PKCS11 pkcs11 = moduleMap.get(pkcs11ModulePath);
+ if (pkcs11 == null) {
++ boolean nssFipsMode = fipsKeyImporter != null;
+ if ((pInitArgs != null)
+ && ((pInitArgs.flags & CKF_OS_LOCKING_OK) != 0)) {
+- pkcs11 = new PKCS11(pkcs11ModulePath, functionList);
++ if (nssFipsMode) {
++ pkcs11 = new FIPSPKCS11(pkcs11ModulePath, functionList,
++ fipsKeyImporter);
++ } else {
++ pkcs11 = new PKCS11(pkcs11ModulePath, functionList);
++ }
+ } else {
+- pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList);
++ if (nssFipsMode) {
++ pkcs11 = new SynchronizedFIPSPKCS11(pkcs11ModulePath,
++ functionList, fipsKeyImporter);
++ } else {
++ pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList);
++ }
+ }
+ if (omitInitialize == false) {
+ try {
+@@ -1905,4 +1918,69 @@
+ super.C_GenerateRandom(hSession, randomData);
+ }
+ }
++
++// PKCS11 subclass that allows using plain private or secret keys in
++// FIPS-configured NSS Software Tokens. Only used when System FIPS
++// is enabled.
++static class FIPSPKCS11 extends PKCS11 {
++ private MethodHandle fipsKeyImporter;
++ FIPSPKCS11(String pkcs11ModulePath, String functionListName,
++ MethodHandle fipsKeyImporter) throws IOException {
++ super(pkcs11ModulePath, functionListName);
++ this.fipsKeyImporter = fipsKeyImporter;
++ }
++
++ public synchronized long C_CreateObject(long hSession,
++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception {
++ // Creating sensitive key objects from plain key material in a
++ // FIPS-configured NSS Software Token is not allowed. We apply
++ // a key-unwrapping scheme to achieve so.
++ if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) {
++ try {
++ return ((Long)fipsKeyImporter.invoke(hSession, pTemplate))
++ .longValue();
++ } catch (Throwable t) {
++ throw new PKCS11Exception(CKR_GENERAL_ERROR);
++ }
++ }
++ return super.C_CreateObject(hSession, pTemplate);
++ }
+ }
++
++// FIPSPKCS11 synchronized counterpart.
++static class SynchronizedFIPSPKCS11 extends SynchronizedPKCS11 {
++ private MethodHandle fipsKeyImporter;
++ SynchronizedFIPSPKCS11(String pkcs11ModulePath, String functionListName,
++ MethodHandle fipsKeyImporter) throws IOException {
++ super(pkcs11ModulePath, functionListName);
++ this.fipsKeyImporter = fipsKeyImporter;
++ }
++
++ public synchronized long C_CreateObject(long hSession,
++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception {
++ // See FIPSPKCS11::C_CreateObject.
++ if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) {
++ try {
++ return ((Long)fipsKeyImporter.invoke(hSession, pTemplate))
++ .longValue();
++ } catch (Throwable t) {
++ throw new PKCS11Exception(CKR_GENERAL_ERROR);
++ }
++ }
++ return super.C_CreateObject(hSession, pTemplate);
++ }
++}
++
++private static class FIPSPKCS11Helper {
++ static boolean isSensitiveObject(CK_ATTRIBUTE[] pTemplate) {
++ for (CK_ATTRIBUTE attr : pTemplate) {
++ if (attr.type == CKA_CLASS &&
++ (attr.getLong() == CKO_PRIVATE_KEY ||
++ attr.getLong() == CKO_SECRET_KEY)) {
++ return true;
++ }
++ }
++ return false;
++ }
++}
++}
+diff --git openjdk.orig/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
openjdk/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
+--- openjdk.orig/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
++++ openjdk/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
+@@ -33,8 +33,13 @@
+
+ import javax.net.ssl.*;
+
++import sun.misc.SharedSecrets;
++
+ abstract class KeyManagerFactoryImpl extends KeyManagerFactorySpi {
+
++ private static final boolean plainKeySupportEnabled = SharedSecrets
++ .getJavaSecuritySystemConfiguratorAccess().isPlainKeySupportEnabled();
++
+ X509ExtendedKeyManager keyManager;
+ boolean isInitialized;
+
+@@ -62,7 +67,8 @@
+ KeyStoreException, NoSuchAlgorithmException,
+ UnrecoverableKeyException {
+ if ((ks != null) && SunJSSE.isFIPS()) {
+- if (ks.getProvider() != SunJSSE.cryptoProvider) {
++ if (ks.getProvider() != SunJSSE.cryptoProvider &&
++ !plainKeySupportEnabled) {
+ throw new KeyStoreException("FIPS mode: KeyStore must be
"
+ + "from provider " +
SunJSSE.cryptoProvider.getName());
+ }
+@@ -91,8 +97,8 @@
+ keyManager = new X509KeyManagerImpl(
+ Collections.<Builder>emptyList());
+ } else {
+- if (SunJSSE.isFIPS() &&
+- (ks.getProvider() != SunJSSE.cryptoProvider)) {
++ if (SunJSSE.isFIPS() && (ks.getProvider() !=
SunJSSE.cryptoProvider)
++ && !plainKeySupportEnabled) {
+ throw new KeyStoreException(
+ "FIPS mode: KeyStore must be " +
+ "from provider " + SunJSSE.cryptoProvider.getName());
commit afeb38682d63bf513aca64685b0b6938a86918ef
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Sat Oct 9 23:21:05 2021 +0100
Update to aarch64-shenandoah-jdk8u312-b05 (EA)
Update release notes for 8u312-b05.
diff --git a/.gitignore b/.gitignore
index 402cdf4..f34cedd 100644
--- a/.gitignore
+++ b/.gitignore
@@ -243,3 +243,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b02-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b03-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b04-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b05-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 832ad01..05c1b39 100644
--- a/NEWS
+++ b/NEWS
@@ -12,7 +12,9 @@ Live versions of these release notes can be found at:
* Other changes
- JDK-6847157: java.lang.NullPointerException: HDC for component at
sun.java2d.loops.Blit.Blit
- JDK-7146776: deadlock between URLStreamHandler.getHostAddress and
file.Handler.openconnection
+ - JDK-7188942: Remove support of pbuffers in OGL Java2d pipeline
- JDK-8004148: NPE in sun.awt.SunToolkit.getWindowDeactivationTime
+ - JDK-8022323: [JavaSecurityScanner] review package com.sun.management.* Native methods
should be private
- JDK-8027154: [TESTBUG] Test
java/awt/Mouse/GetMousePositionTest/GetMousePositionWithPopup.java fails
- JDK-8035001: TEST_BUG: the retry logic in RMID.start() should check that the
subprocess hasn't terminated
- JDK-8035424: (reflect) Performance problem in
sun.reflect.generics.parser.SignatureParser
@@ -23,6 +25,8 @@ Live versions of these release notes can be found at:
- JDK-8079891: Store configure log in $BUILD/configure.log
- JDK-8080082: configure fails if you create an empty directory and then run configure
from it
- JDK-8086003: Test fails on OSX with java.lang.RuntimeException 'Narrow klass
base: 0x0000000000000000, Narrow klass shift: 3' missing
+ - JDK-8131062: aarch64: add support for GHASH acceleration
+ - JDK-8134869: AARCH64: GHASH intrinsic is not optimal
- JDK-8134989: java/net/MulticastSocket/TestInterfaces.java failed due to unexpected IP
address
- JDK-8156584: Initialization race in sun.security.x509.AlgorithmId.get
- JDK-8161016: Strange behavior of URLConnection with proxy
@@ -59,12 +63,15 @@ Live versions of these release notes can be found at:
- JDK-8268103: JNI functions incorrectly return a double after JDK-8265836
- JDK-8269594: assert(_handle_mark_nesting > 1) failed: memory leak: allocating
handle outside HandleMark
- JDK-8269810: [8u] Update generated_configure.sh after JDK-8250876 backport
+ - JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports incorrect process cpu
usage in containers
- JDK-8269859: BacktraceBuilder._cprefs needs to be accessed as unsigned short
- JDK-8269882: stack-use-after-scope in NewObjectA
- JDK-8269953: config.log is not in build directory after 8u backport of JDK-8079891
- JDK-8270137: Kerberos Credential Retrieval from Cache not Working in Cross-Realm
Setup
- JDK-8271466: StackGap test fails on aarch64 due to "-m64"
+ - JDK-8272124: Cgroup v1 initialization causes NullPointerException when cgroup path
contains colon
- JDK-8272214: [8u] Build failure after backport of JDK-8248901
+ - JDK-8272714: [8u] Build failure after backport of JDK-8248901 with MSVC 2013
New in release OpenJDK 8u302 (2021-07-20):
===========================================
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 149ca75..35a55bd 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -296,7 +296,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u312-b04
+%global shenandoah_revision aarch64-shenandoah-jdk8u312-b05
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -311,7 +311,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 2
+%global rpmrelease 1
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -2621,6 +2621,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Sep 30 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b05-0.1.ea
+- Update to aarch64-shenandoah-jdk8u312-b05 (EA)
+- Update release notes for 8u312-b05.
+
* Mon Sep 27 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b04-0.2.ea
- Reduce disk footprint by removing build artifacts by default.
diff --git a/sources b/sources
index 36c8460..7c2359c 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b04-4curve.tar.xz) =
7553ff5b007150a3361be355e210ae8394926b61aeb1921c67e839710d8a57a639060725b589b7c62ef7b67936239452b438b68e08b38be4c74a3f636f7e9823
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b05-4curve.tar.xz) =
41aa7cfe6946f9b88e8ae66716e8db204a401f5ded43037c54c071b7a895e08df389d6a7ae5961da00c309a6802c88197cd59ed8e5e52a466c997a680f7f425f
commit 92642a8a9641a89fdbf0dd620f25258bb1d32f03
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Fri Oct 1 16:29:42 2021 +0100
Reduce disk footprint by removing build artifacts by default.
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 22a6971..149ca75 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -22,6 +22,8 @@
%bcond_without slowdebug
# Enable release builds by default on relevant arches.
%bcond_without release
+# Remove build artifacts by default
+%bcond_with artifacts
# The -g flag says to use strip -g instead of full strip on DSOs or EXEs.
# This fixes detailed NMT and other tools which need minimal debug info.
@@ -309,7 +311,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 1
+%global rpmrelease 2
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -343,6 +345,7 @@
%global jdkimage j2sdk-image
# output dir stub
%define buildoutputdir() %{expand:build/jdk8.build%{?1}}
+%define installoutputdir() %{expand:install/jdk8.install%{?1}}
# we can copy the javadoc to not arched dir, or make it not noarch
%define uniquejavadocdir() %{expand:%{fullversion}%{?1}}
# main id and dir of this jdk
@@ -1045,8 +1048,8 @@ exit 0
%define files_javadoc() %{expand:
%defattr(-,root,root,-)
%doc %{_javadocdir}/%{uniquejavadocdir -- %{?1}}
-#javadoc is in jdk8 noarch, so also licnese file must be treated like it
-%license %{buildoutputdir -- %{?1}}/images/%{jdkimage}/jre/LICENSE
+#javadoc is in jdk8 noarch, so also license file must be treated like it
+%license %{installoutputdir -- %{?1}}/images/%{jdkimage}/jre/LICENSE
%if %is_system_jdk
%if %{is_release_build -- %{?1}}
%ghost %{_javadocdir}/java
@@ -1057,8 +1060,8 @@ exit 0
%define files_javadoc_zip() %{expand:
%defattr(-,root,root,-)
%doc %{_javadocdir}/%{uniquejavadocdir -- %{?1}}.zip
-#javadoc is in jdk8 noarch, so also licnese file must be treated like it
-%license %{buildoutputdir -- %{?1}}/images/%{jdkimage}/jre/LICENSE
+#javadoc is in jdk8 noarch, so also license file must be treated like it
+%license %{installoutputdir -- %{?1}}/images/%{jdkimage}/jre/LICENSE
%if %is_system_jdk
%if %{is_release_build -- %{?1}}
%ghost %{_javadocdir}/java-zip
@@ -1938,9 +1941,10 @@ export EXTRA_CFLAGS EXTRA_ASFLAGS
function buildjdk() {
local outputdir=${1}
- local buildjdk=${2}
- local maketargets=${3}
- local debuglevel=${4}
+ local installdir=${2}
+ local buildjdk=${3}
+ local maketargets=${4}
+ local debuglevel=${5}
local top_srcdir_abs_path=$(pwd)/%{top_level_dir_name}
# Variable used in hs_err hook on build failures
@@ -1950,7 +1954,7 @@ function buildjdk() {
${buildjdk}/bin/java -version
echo "Building 8u%{updatever}-%{buildver}, milestone %{milestone}"
- mkdir -p ${outputdir}
+ mkdir -p ${outputdir} ${installdir}
pushd ${outputdir}
bash ${top_srcdir_abs_path}/configure \
@@ -2011,6 +2015,23 @@ function buildjdk() {
find images/%{jdkimage}/bin/ -exec chmod +x {} \;
popd >& /dev/null
+
+ echo "Installing build from ${outputdir} to ${installdir}..."
+ echo "Installing images..."
+ mv ${outputdir}/images ${installdir}
+ if [ -d ${outputdir}/bundles ] ; then
+ echo "Installing bundles...";
+ mv ${outputdir}/bundles ${installdir} ;
+ fi
+ if [ -d ${outputdir}/docs ] ; then
+ echo "Installing docs...";
+ mv ${outputdir}/docs ${installdir} ;
+ fi
+
+%if !%{with artifacts}
+ echo "Removing output directory...";
+ rm -rf ${outputdir}
+%endif
}
for suffix in %{build_loop} ; do
@@ -2024,6 +2045,8 @@ fi
systemjdk=/usr/lib/jvm/java-openjdk
builddir=%{buildoutputdir -- $suffix}
bootbuilddir=boot${builddir}
+installdir=%{installoutputdir -- $suffix}
+bootinstalldir=boot${installdir}
# Debug builds don't need same targets as release for
# build speed-up
@@ -2033,15 +2056,15 @@ if echo $debugbuild | grep -q "debug" ; then
fi
%if %{bootstrap_build}
-buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild}
-buildjdk ${builddir} $(pwd)/${bootbuilddir}/images/%{jdkimage} "${maketargets}"
${debugbuild}
-rm -rf ${bootbuilddir}
+buildjdk ${bootbuilddir} ${bootinstalldir} ${systemjdk} "%{bootstrap_targets}"
${debugbuild}
+buildjdk ${builddir} ${installdir} $(pwd)/${bootinstalldir}/images/%{jdkimage}
"${maketargets}" ${debugbuild}
+%{!?with_artifacts:rm -rf ${bootinstalldir}}
%else
-buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild}
+buildjdk ${builddir} ${installdir} ${systemjdk} "${maketargets}" ${debugbuild}
%endif
# Install nss.cfg right away as we will be using the JRE above
-export JAVA_HOME=$(pwd)/%{buildoutputdir -- $suffix}/images/%{jdkimage}
+export JAVA_HOME=$(pwd)/%{installoutputdir -- $suffix}/images/%{jdkimage}
# Install nss.cfg right away as we will be using the JRE above
install -m 644 nss.cfg $JAVA_HOME/jre/lib/security/
@@ -2067,7 +2090,7 @@ done
# We test debug first as it will give better diagnostics on a crash
for suffix in %{build_loop} ; do
-export JAVA_HOME=$(pwd)/%{buildoutputdir -- $suffix}/images/%{jdkimage}
+export JAVA_HOME=$(pwd)/%{installoutputdir -- $suffix}/images/%{jdkimage}
# Check unlimited policy has been used
$JAVA_HOME/bin/javac -d . %{SOURCE13}
@@ -2182,7 +2205,7 @@ STRIP_KEEP_SYMTAB=libjvm*
for suffix in %{build_loop} ; do
# Install the jdk
-pushd %{buildoutputdir -- $suffix}/images/%{jdkimage}
+pushd %{installoutputdir -- $suffix}/images/%{jdkimage}
# Install jsa directories so we can owe them
mkdir -p $RPM_BUILD_ROOT%{_jvmdir}/%{jredir -- $suffix}/lib/%{archinstall}/server/
@@ -2249,9 +2272,9 @@ popd
if ! echo $suffix | grep -q "debug" ; then
# Install Javadoc documentation
install -d -m 755 $RPM_BUILD_ROOT%{_javadocdir}
- cp -a %{buildoutputdir -- $suffix}/docs
$RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}
+ cp -a %{installoutputdir -- $suffix}/docs
$RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}
built_doc_archive=`echo
"jdk-%{javaver}_%{updatever}%{milestone_version}$suffix-%{buildver}-docs.zip" |
sed s/slowdebug/debug/`
- cp -a %{buildoutputdir -- $suffix}/bundles/$built_doc_archive
$RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip
+ cp -a %{installoutputdir -- $suffix}/bundles/$built_doc_archive
$RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip
fi
# Install release notes
@@ -2598,6 +2621,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Mon Sep 27 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b04-0.2.ea
+- Reduce disk footprint by removing build artifacts by default.
+
* Sun Sep 26 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b04-0.1.ea
- Update to aarch64-shenandoah-jdk8u312-b04 (EA)
- Update release notes for 8u312-b04.
commit 5e8cea34ec67303a43c0d0bd3a57e05a93705b0a
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Sun Sep 26 20:02:53 2021 +0100
Update to aarch64-shenandoah-jdk8u312-b04 (EA)
Update release notes for 8u312-b04.
diff --git a/.gitignore b/.gitignore
index 5ddd4a9..402cdf4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -242,3 +242,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b01-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b02-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b03-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b04-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 9052cf4..832ad01 100644
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,7 @@ Live versions of these release notes can be found at:
*
https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u312.txt
* Other changes
+ - JDK-6847157: java.lang.NullPointerException: HDC for component at
sun.java2d.loops.Blit.Blit
- JDK-7146776: deadlock between URLStreamHandler.getHostAddress and
file.Handler.openconnection
- JDK-8004148: NPE in sun.awt.SunToolkit.getWindowDeactivationTime
- JDK-8027154: [TESTBUG] Test
java/awt/Mouse/GetMousePositionTest/GetMousePositionWithPopup.java fails
@@ -24,8 +25,11 @@ Live versions of these release notes can be found at:
- JDK-8086003: Test fails on OSX with java.lang.RuntimeException 'Narrow klass
base: 0x0000000000000000, Narrow klass shift: 3' missing
- JDK-8134989: java/net/MulticastSocket/TestInterfaces.java failed due to unexpected IP
address
- JDK-8156584: Initialization race in sun.security.x509.AlgorithmId.get
+ - JDK-8161016: Strange behavior of URLConnection with proxy
- JDK-8166673: The new implementation of Robot.waitForIdle() may hang
- JDK-8170467: (reflect) Optimize SignatureParser's use of StringBuilders
+ - JDK-8176837: SunPKCS11 provider needs to check more details on PKCS11 Mechanism
+ - JDK-8194246: JVM crashes when calling getStackTrace if stack contains a method that
is a member of a very large class
- JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
- JDK-8202837: PBES2 AlgorithmId encoding error in PKCS12 KeyStore
- JDK-8206189: sun/security/pkcs12/EmptyPassword.java fails with Sequence tag error
@@ -38,6 +42,7 @@ Live versions of these release notes can be found at:
- JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong handling of stoppedMixers
- JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in Windows Print
- JDK-8241248: NullPointerException in sun.security.ssl.HKDF.extract(HKDF.java:93)
+ - JDK-8244154: Update SunPKCS11 provider with PKCS11 v3.0 header files
- JDK-8247469: getSystemCpuLoad() returns -1 on linux when some offline cpus are
present and cpusets.effective_cpus is not available
- JDK-8248901: Signed immediate support in .../share/assembler.hpp is broken.
- JDK-8254967: com.sun.net.HttpsServer spins on TLS session close
@@ -45,12 +50,17 @@ Live versions of these release notes can be found at:
- JDK-8262000:
jdk/jfr/event/gc/detailed/TestPromotionFailedEventWithParallelScavenge.java failed with
"OutOfMemoryError: Java heap space"
- JDK-8262829: Native crash in Win32PrintServiceLookup.getAllPrinterNames()
- JDK-8263311: Watch registry changes for remote printers update instead of polling
+ - JDK-8263382: java/util/logging/ParentLoggersTest.java failed with "checkLoggers:
getLoggerNames() returned unexpected loggers"
- JDK-8264752: SIGFPE crash with option FlightRecorderOptions:threadbuffersize=30M
- JDK-8265238: [8u] [macos] build failure in OpenJDK8u after JDK-8211301 in older
xcode
- JDK-8265836: OperatingSystemImpl.getCpuLoad() returns incorrect CPU load inside a
container
- JDK-8265978: make test should look for more locations when searching for exit code
- JDK-8266206: Build failure after JDK-8264752 with older GCCs
+ - JDK-8268103: JNI functions incorrectly return a double after JDK-8265836
+ - JDK-8269594: assert(_handle_mark_nesting > 1) failed: memory leak: allocating
handle outside HandleMark
- JDK-8269810: [8u] Update generated_configure.sh after JDK-8250876 backport
+ - JDK-8269859: BacktraceBuilder._cprefs needs to be accessed as unsigned short
+ - JDK-8269882: stack-use-after-scope in NewObjectA
- JDK-8269953: config.log is not in build directory after 8u backport of JDK-8079891
- JDK-8270137: Kerberos Credential Retrieval from Cache not Working in Cross-Realm
Setup
- JDK-8271466: StackGap test fails on aarch64 due to "-m64"
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index dfda03b..22a6971 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -294,7 +294,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u312-b03
+%global shenandoah_revision aarch64-shenandoah-jdk8u312-b04
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -309,7 +309,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 2
+%global rpmrelease 1
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -2598,7 +2598,11 @@ cjc.mainProgram(args)
%endif
%changelog
-* Fri Sep 10 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b03-0.2.ea
+* Sun Sep 26 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b04-0.1.ea
+- Update to aarch64-shenandoah-jdk8u312-b04 (EA)
+- Update release notes for 8u312-b04.
+
+* Tue Sep 14 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b03-0.2.ea
- Add patch to login to the NSS software token when in FIPS mode.
* Mon Sep 13 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b03-0.1.ea
@@ -2727,7 +2731,7 @@ cjc.mainProgram(args)
- removed patch1 rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch and patch3
rh1648644-java_access_bridge_privileged_security.patch
- removal of accessibility{,-slowdebug,-fastdebug} subpackages
- no longer creating symlinks of %%{_libdir}/java-atk-wrapper/libatk-wrapper.so.0
libatk-wrapper.so and %%{_libdir}/java-atk-wrapper/java-atk-wrapper.jar
java-atk-wrapper.jar
-- no longer creating %%{_jvmdir}/%{jredir -- $suffix}/lib/accessibility.properties with
content of "assistive_technologies=org.GNOME.Accessibility.AtkWrapper"
+- no longer creating %%{_jvmdir}/%%{jredir -- $suffix}/lib/accessibility.properties with
content of "assistive_technologies=org.GNOME.Accessibility.AtkWrapper"
- removal of accessibility{,-slowdebug,-fastdebug} subpackages files sections
* Mon Mar 22 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b06-0.0.ea
diff --git a/sources b/sources
index fc6c611..36c8460 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b03-4curve.tar.xz) =
e6a9dd82d3c76920b03124f9cf261f68f520bea9368427b850adfb36385cd717cfe6a5f684b6f1653d4d79c9863e45e4b62907567446e8a5c68587a3a8bdef10
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b04-4curve.tar.xz) =
7553ff5b007150a3361be355e210ae8394926b61aeb1921c67e839710d8a57a639060725b589b7c62ef7b67936239452b438b68e08b38be4c74a3f636f7e9823
commit aa2c8f31b92b74e2eca59bdcf1acb5b92792764b
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Tue Sep 14 02:59:18 2021 +0100
Add patch to login to the NSS software token when in FIPS mode.
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 3d857b9..dfda03b 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -309,7 +309,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 1
+%global rpmrelease 2
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1310,6 +1310,8 @@ Patch1005: rh1906862-always_initialise_configurator_access.patch
# RH1929465: Improve system FIPS detection
Patch1006: rh1929465-improve_system_FIPS_detection-root.patch
Patch1007: rh1929465-improve_system_FIPS_detection-jdk.patch
+# RH1996182: Login to the NSS software token in FIPS mode
+Patch1008: rh1996182-login_to_nss_software_token.patch
#############################################
#
@@ -1838,6 +1840,7 @@ sh %{SOURCE12}
%patch1005
%patch1006
%patch1007
+%patch1008
# RHEL-only patches
%if ! 0%{?fedora} && 0%{?rhel} <= 7
@@ -2595,6 +2598,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Fri Sep 10 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b03-0.2.ea
+- Add patch to login to the NSS software token when in FIPS mode.
+
* Mon Sep 13 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b03-0.1.ea
- Update to aarch64-shenandoah-jdk8u312-b03 (EA)
- Update release notes for 8u312-b03.
diff --git a/rh1996182-login_to_nss_software_token.patch
b/rh1996182-login_to_nss_software_token.patch
new file mode 100644
index 0000000..341e092
--- /dev/null
+++ b/rh1996182-login_to_nss_software_token.patch
@@ -0,0 +1,55 @@
+# HG changeset patch
+# User mbalao
+# Date 1630103180 -3600
+# Fri Aug 27 23:26:20 2021 +0100
+# Node ID b3bd3119fab9bc5adfd7073377aca12bb1af80b3
+# Parent c90394a76ee02a689f95199559d5724824b4b25e
+RH1996182: Login to the NSS Software Token in FIPS Mode
+
+diff --git openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
openjdk/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
+--- openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
++++ openjdk/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
+@@ -42,6 +42,8 @@
+ import javax.security.auth.callback.PasswordCallback;
+ import javax.security.auth.callback.TextOutputCallback;
+
++import sun.misc.SharedSecrets;
++
+ import sun.security.util.Debug;
+ import sun.security.util.ResourcesMgr;
+
+@@ -58,6 +60,9 @@
+ */
+ public final class SunPKCS11 extends AuthProvider {
+
++ private static final boolean systemFipsEnabled = SharedSecrets
++ .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled();
++
+ private static final long serialVersionUID = -1354835039035306505L;
+
+ static final Debug debug = Debug.getInstance("sunpkcs11");
+@@ -368,6 +373,24 @@
+ if (nssModule != null) {
+ nssModule.setProvider(this);
+ }
++ if (systemFipsEnabled) {
++ // The NSS Software Token in FIPS 140-2 mode requires a user
++ // login for most operations. See sftk_fipsCheck. The NSS DB
++ // (/etc/pki/nssdb) PIN is empty.
++ Session session = null;
++ try {
++ session = token.getOpSession();
++ p11.C_Login(session.id(), CKU_USER, new char[] {});
++ } catch (PKCS11Exception p11e) {
++ if (debug != null) {
++ debug.println("Error during token login: " +
++ p11e.getMessage());
++ }
++ throw p11e;
++ } finally {
++ token.releaseSession(session);
++ }
++ }
+ } catch (Exception e) {
+ if (config.getHandleStartupErrors() == Config.ERR_IGNORE_ALL) {
+ throw new UnsupportedOperationException
commit 0cb1fbdb0bdab3fca4fd43433c0d0c677ceab770
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Mon Sep 13 12:28:45 2021 +0100
Update to aarch64-shenandoah-jdk8u312-b03 (EA)
Update release notes for 8u312-b03.
diff --git a/.gitignore b/.gitignore
index 5d0524d..5ddd4a9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -241,3 +241,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b08-4curve-clean.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b01-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b02-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b03-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 3cf6136..9052cf4 100644
--- a/NEWS
+++ b/NEWS
@@ -34,21 +34,27 @@ Live versions of these release notes can be found at:
- JDK-8220786: Create new switch to redirect error reporting output to stdout or
stderr
- JDK-8229243: SunPKCS11-Solaris provider tests failing on Solaris 11.4
- JDK-8231222: fix pkcs11 P11_DEBUG guarded native traces
+ - JDK-8237495: Java MIDI fails with a dereferenced memory error when asked to send a
raw 0xF7
- JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong handling of stoppedMixers
- JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in Windows Print
- JDK-8241248: NullPointerException in sun.security.ssl.HKDF.extract(HKDF.java:93)
- JDK-8247469: getSystemCpuLoad() returns -1 on linux when some offline cpus are
present and cpusets.effective_cpus is not available
- JDK-8248901: Signed immediate support in .../share/assembler.hpp is broken.
+ - JDK-8254967: com.sun.net.HttpsServer spins on TLS session close
- JDK-8259338: Add expiry exception for identrustdstx3 alias to VerifyCACerts.java
test
- JDK-8262000:
jdk/jfr/event/gc/detailed/TestPromotionFailedEventWithParallelScavenge.java failed with
"OutOfMemoryError: Java heap space"
- JDK-8262829: Native crash in Win32PrintServiceLookup.getAllPrinterNames()
- JDK-8263311: Watch registry changes for remote printers update instead of polling
+ - JDK-8264752: SIGFPE crash with option FlightRecorderOptions:threadbuffersize=30M
- JDK-8265238: [8u] [macos] build failure in OpenJDK8u after JDK-8211301 in older
xcode
- JDK-8265836: OperatingSystemImpl.getCpuLoad() returns incorrect CPU load inside a
container
- JDK-8265978: make test should look for more locations when searching for exit code
+ - JDK-8266206: Build failure after JDK-8264752 with older GCCs
- JDK-8269810: [8u] Update generated_configure.sh after JDK-8250876 backport
- JDK-8269953: config.log is not in build directory after 8u backport of JDK-8079891
+ - JDK-8270137: Kerberos Credential Retrieval from Cache not Working in Cross-Realm
Setup
- JDK-8271466: StackGap test fails on aarch64 due to "-m64"
+ - JDK-8272214: [8u] Build failure after backport of JDK-8248901
New in release OpenJDK 8u302 (2021-07-20):
===========================================
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index c545df3..3d857b9 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -294,7 +294,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u312-b02
+%global shenandoah_revision aarch64-shenandoah-jdk8u312-b03
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -2595,6 +2595,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Mon Sep 13 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b03-0.1.ea
+- Update to aarch64-shenandoah-jdk8u312-b03 (EA)
+- Update release notes for 8u312-b03.
+
* Fri Sep 10 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b02-0.1.ea
- Update to aarch64-shenandoah-jdk8u312-b02 (EA)
- Update release notes for 8u312-b02.
diff --git a/sources b/sources
index c2c873f..fc6c611 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b02-4curve.tar.xz) =
fcff36d3c837de6770eb32ac1ff514278ec92feb6311aa0b8150d9da4b917494899993b498ffd3ac55c7ddbd22860105af0ffcb30b3c43ec702847650098c349
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b03-4curve.tar.xz) =
e6a9dd82d3c76920b03124f9cf261f68f520bea9368427b850adfb36385cd717cfe6a5f684b6f1653d4d79c9863e45e4b62907567446e8a5c68587a3a8bdef10
commit 12c54a64a11f9620ab5d31b3773f15156f442dba
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Fri Sep 10 05:30:49 2021 +0100
Update to aarch64-shenandoah-jdk8u312-b02 (EA)
Update release notes for 8u312-b02.
diff --git a/.gitignore b/.gitignore
index 4252ee4..5d0524d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -240,3 +240,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b08-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b08-4curve-clean.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b01-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b02-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 947e72a..3cf6136 100644
--- a/NEWS
+++ b/NEWS
@@ -37,12 +37,14 @@ Live versions of these release notes can be found at:
- JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong handling of stoppedMixers
- JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in Windows Print
- JDK-8241248: NullPointerException in sun.security.ssl.HKDF.extract(HKDF.java:93)
+ - JDK-8247469: getSystemCpuLoad() returns -1 on linux when some offline cpus are
present and cpusets.effective_cpus is not available
- JDK-8248901: Signed immediate support in .../share/assembler.hpp is broken.
- JDK-8259338: Add expiry exception for identrustdstx3 alias to VerifyCACerts.java
test
- JDK-8262000:
jdk/jfr/event/gc/detailed/TestPromotionFailedEventWithParallelScavenge.java failed with
"OutOfMemoryError: Java heap space"
- JDK-8262829: Native crash in Win32PrintServiceLookup.getAllPrinterNames()
- JDK-8263311: Watch registry changes for remote printers update instead of polling
- JDK-8265238: [8u] [macos] build failure in OpenJDK8u after JDK-8211301 in older
xcode
+ - JDK-8265836: OperatingSystemImpl.getCpuLoad() returns incorrect CPU load inside a
container
- JDK-8265978: make test should look for more locations when searching for exit code
- JDK-8269810: [8u] Update generated_configure.sh after JDK-8250876 backport
- JDK-8269953: config.log is not in build directory after 8u backport of JDK-8079891
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 294ed12..c545df3 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -294,7 +294,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u312-b01
+%global shenandoah_revision aarch64-shenandoah-jdk8u312-b02
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -309,7 +309,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 3
+%global rpmrelease 1
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -2595,6 +2595,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Fri Sep 10 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b02-0.1.ea
+- Update to aarch64-shenandoah-jdk8u312-b02 (EA)
+- Update release notes for 8u312-b02.
+
* Wed Sep 01 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b01-0.3.ea
- Port FIPS system detection support to OpenJDK 8u
- Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled
in configure.
diff --git a/sources b/sources
index 743cecf..c2c873f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b01-4curve.tar.xz) =
ddce8d47e12e4de078004d981d4c89538738a7cb201b7e7f820f51a39aac2c00040e3ba9c6ee92ec10d10e5607f420a4c3e4d059e05a8d9930e3f71e0917c84f
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b02-4curve.tar.xz) =
fcff36d3c837de6770eb32ac1ff514278ec92feb6311aa0b8150d9da4b917494899993b498ffd3ac55c7ddbd22860105af0ffcb30b3c43ec702847650098c349
commit d57e76505362030867d295ab1f4c36a2664de233
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Sat Sep 4 02:14:31 2021 +0100
Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library.
Port FIPS system detection support to OpenJDK 8u
Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled
in configure.
Remove unneeded Requires on NSS as it will now be dynamically linked and detected by
RPM.
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index a31c545..294ed12 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -309,7 +309,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 2
+%global rpmrelease 3
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -352,7 +352,7 @@
# fix for
https://bugzilla.redhat.com/show_bug.cgi?id=1111349
#
https://bugzilla.redhat.com/show_bug.cgi?id=1590796#c14
#
https://bugzilla.redhat.com/show_bug.cgi?id=1655938
-%global _privatelibs
libattach[.]so.*|libawt_headless[.]so.*|libawt[.]so.*|libawt_xawt[.]so.*|libdt_socket[.]so.*|libfontmanager[.]so.*|libhprof[.]so.*|libinstrument[.]so.*|libj2gss[.]so.*|libj2pcsc[.]so.*|libj2pkcs11[.]so.*|libjaas_unix[.]so.*|libjava_crw_demo[.]so.*|libjavajpeg[.]so.*|libjdwp[.]so.*|libjli[.]so.*|libjsdt[.]so.*|libjsoundalsa[.]so.*|libjsound[.]so.*|liblcms[.]so.*|libmanagement[.]so.*|libmlib_image[.]so.*|libnet[.]so.*|libnio[.]so.*|libnpt[.]so.*|libsaproc[.]so.*|libsctp[.]so.*|libsplashscreen[.]so.*|libsunec[.]so.*|libunpack[.]so.*|libzip[.]so.*|lib[.]so\\(SUNWprivate_.*
+%global _privatelibs
libattach[.]so.*|libawt_headless[.]so.*|libawt[.]so.*|libawt_xawt[.]so.*|libdt_socket[.]so.*|libfontmanager[.]so.*|libhprof[.]so.*|libinstrument[.]so.*|libj2gss[.]so.*|libj2pcsc[.]so.*|libj2pkcs11[.]so.*|libjaas_unix[.]so.*|libjava_crw_demo[.]so.*|libjavajpeg[.]so.*|libjdwp[.]so.*|libjli[.]so.*|libjsdt[.]so.*|libjsoundalsa[.]so.*|libjsound[.]so.*|liblcms[.]so.*|libmanagement[.]so.*|libmlib_image[.]so.*|libnet[.]so.*|libnio[.]so.*|libnpt[.]so.*|libsaproc[.]so.*|libsctp[.]so.*|libsplashscreen[.]so.*|libsunec[.]so.*|libsystemconf[.]so.*|libunpack[.]so.*|libzip[.]so.*|lib[.]so\\(SUNWprivate_.*
%global _publiclibs
libjawt[.]so.*|libjava[.]so.*|libjvm[.]so.*|libverify[.]so.*|libjsig[.]so.*
%if %is_system_jdk
%global __provides_exclude ^(%{_privatelibs})$
@@ -805,6 +805,7 @@ exit 0
%endif
%{_jvmdir}/%{jredir -- %{?1}}/lib/%{archinstall}/libsctp.so
%{_jvmdir}/%{jredir -- %{?1}}/lib/%{archinstall}/libsunec.so
+%{_jvmdir}/%{jredir -- %{?1}}/lib/%{archinstall}/libsystemconf.so
%{_jvmdir}/%{jredir -- %{?1}}/lib/%{archinstall}/libunpack.so
%{_jvmdir}/%{jredir -- %{?1}}/lib/%{archinstall}/libverify.so
%{_jvmdir}/%{jredir -- %{?1}}/lib/%{archinstall}/libzip.so
@@ -1112,8 +1113,6 @@ Requires: copy-jdk-configs >= 4.0
OrderWithRequires: copy-jdk-configs
# for printing support
Requires: cups-libs
-# for FIPS PKCS11 provider
-Requires: nss
# Post requires alternatives to install tool alternatives
Requires(post): %{alternatives_requires}
# Postun requires alternatives to uninstall tool alternatives
@@ -1308,6 +1307,9 @@ Patch1002: rh1760838-fips_default_keystore_type.patch
Patch1004: rh1860986-disable_tlsv1.3_in_fips_mode.patch
# RH1906862: Always initialise JavaSecuritySystemConfiguratorAccess
Patch1005: rh1906862-always_initialise_configurator_access.patch
+# RH1929465: Improve system FIPS detection
+Patch1006: rh1929465-improve_system_FIPS_detection-root.patch
+Patch1007: rh1929465-improve_system_FIPS_detection-jdk.patch
#############################################
#
@@ -1454,8 +1456,8 @@ BuildRequires: libXinerama-devel
BuildRequires: libXrender-devel
BuildRequires: libXt-devel
BuildRequires: libXtst-devel
-# Requirements for setting up the nss.cfg
-BuildRequires: nss-devel
+# Requirements for setting up the nss.cfg and FIPS support
+BuildRequires: nss-devel >= 3.53
BuildRequires: pkgconfig
BuildRequires: xorg-x11-proto-devel
BuildRequires: zip
@@ -1834,6 +1836,8 @@ sh %{SOURCE12}
%patch1003
%patch1004
%patch1005
+%patch1006
+%patch1007
# RHEL-only patches
%if ! 0%{?fedora} && 0%{?rhel} <= 7
@@ -1965,6 +1969,7 @@ function buildjdk() {
--with-vendor-vm-bug-url="%{oj_vendor_bug_url}" \
--with-boot-jdk=${buildjdk} \
--with-debug-level=${debuglevel} \
+ --enable-sysconf-nss \
--enable-unlimited-crypto \
--with-zlib=system \
--with-libjpeg=system \
@@ -2590,7 +2595,15 @@ cjc.mainProgram(args)
%endif
%changelog
-* Wed Sep 01 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b01-0.1.ea
+* Wed Sep 01 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b01-0.3.ea
+- Port FIPS system detection support to OpenJDK 8u
+- Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled
in configure.
+- Remove unneeded Requires on NSS as it will now be dynamically linked and detected by
RPM.
+
+* Wed Sep 01 2021 Martin Balao <mbalao(a)redhat.com> - 1:1.8.0.312.b01-0.3.ea
+- Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library.
+
+* Wed Sep 01 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b01-0.2.ea
- Update to aarch64-shenandoah-jdk8u312-b01 (EA)
- Update release notes for 8u312-b01.
- Switch to EA mode.
diff --git a/rh1929465-improve_system_FIPS_detection-jdk.patch
b/rh1929465-improve_system_FIPS_detection-jdk.patch
new file mode 100644
index 0000000..1461be8
--- /dev/null
+++ b/rh1929465-improve_system_FIPS_detection-jdk.patch
@@ -0,0 +1,344 @@
+diff --git openjdk.orig/jdk/make/lib/SecurityLibraries.gmk
openjdk/jdk/make/lib/SecurityLibraries.gmk
+--- openjdk.orig/jdk/make/lib/SecurityLibraries.gmk
++++ openjdk/jdk/make/lib/SecurityLibraries.gmk
+@@ -289,3 +289,34 @@
+
+ endif
+ endif
++
++################################################################################
++# Create the systemconf library
++
++LIBSYSTEMCONF_CFLAGS :=
++LIBSYSTEMCONF_CXXFLAGS :=
++
++ifeq ($(USE_SYSCONF_NSS), true)
++ LIBSYSTEMCONF_CFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS
++ LIBSYSTEMCONF_CXXFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS
++endif
++
++ifeq ($(OPENJDK_BUILD_OS), linux)
++ $(eval $(call SetupNativeCompilation,BUILD_LIBSYSTEMCONF, \
++ LIBRARY := systemconf, \
++ OUTPUT_DIR := $(INSTALL_LIBRARIES_HERE), \
++ SRC := $(JDK_TOPDIR)/src/$(OPENJDK_TARGET_OS_API_DIR)/native/java/security, \
++ LANG := C, \
++ OPTIMIZATION := LOW, \
++ CFLAGS := $(CFLAGS_JDKLIB) $(LIBSYSTEMCONF_CFLAGS), \
++ CXXFLAGS := $(CXXFLAGS_JDKLIB) $(LIBSYSTEMCONF_CXXFLAGS), \
++ MAPFILE := $(JDK_TOPDIR)/make/mapfiles/libsystemconf/mapfile-vers, \
++ LDFLAGS := $(LDFLAGS_JDKLIB) \
++ $(call SET_SHARED_LIBRARY_ORIGIN), \
++ LDFLAGS_SUFFIX := $(LIBDL) $(NSS_LIBS), \
++ OBJECT_DIR := $(JDK_OUTPUTDIR)/objs/libsystemconf, \
++ DEBUG_SYMBOLS := $(DEBUG_ALL_BINARIES)))
++
++ BUILD_LIBRARIES += $(BUILD_LIBSYSTEMCONF)
++endif
++
+diff --git openjdk.orig/jdk/make/mapfiles/libsystemconf/mapfile-vers
openjdk/jdk/make/mapfiles/libsystemconf/mapfile-vers
+new file mode 100644
+--- /dev/null
++++ openjdk/jdk/make/mapfiles/libsystemconf/mapfile-vers
+@@ -0,0 +1,35 @@
++#
++# Copyright (c) 2021, Red Hat, Inc.
++# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++#
++# This code is free software; you can redistribute it and/or modify it
++# under the terms of the GNU General Public License version 2 only, as
++# published by the Free Software Foundation. Oracle designates this
++# particular file as subject to the "Classpath" exception as provided
++# by Oracle in the LICENSE file that accompanied this code.
++#
++# This code is distributed in the hope that it will be useful, but WITHOUT
++# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++# version 2 for more details (a copy is included in the LICENSE file that
++# accompanied this code).
++#
++# You should have received a copy of the GNU General Public License version
++# 2 along with this work; if not, write to the Free Software Foundation,
++# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++#
++# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++# or visit
www.oracle.com if you need additional information or have any
++# questions.
++#
++
++# Define public interface.
++
++SUNWprivate_1.1 {
++ global:
++ DEF_JNI_OnLoad;
++ DEF_JNI_OnUnLoad;
++ Java_java_security_SystemConfigurator_getSystemFIPSEnabled;
++ local:
++ *;
++};
+diff --git openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java
openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
+--- openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java
++++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2019, 2020, Red Hat, Inc.
++ * Copyright (c) 2019, 2021, Red Hat, Inc.
+ *
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+@@ -30,14 +30,9 @@
+ import java.io.FileInputStream;
+ import java.io.IOException;
+
+-import java.nio.file.Files;
+-import java.nio.file.FileSystems;
+-import java.nio.file.Path;
+-
+ import java.util.Iterator;
+ import java.util.Map.Entry;
+ import java.util.Properties;
+-import java.util.regex.Pattern;
+
+ import sun.security.util.Debug;
+
+@@ -59,10 +54,21 @@
+ private static final String CRYPTO_POLICIES_JAVA_CONFIG =
+ CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config";
+
+- private static final String CRYPTO_POLICIES_CONFIG =
+- CRYPTO_POLICIES_BASE_DIR + "/config";
++ private static boolean systemFipsEnabled = false;
++
++ private static final String SYSTEMCONF_NATIVE_LIB = "systemconf";
++
++ private static native boolean getSystemFIPSEnabled()
++ throws IOException;
+
+- private static boolean systemFipsEnabled = false;
++ static {
++ AccessController.doPrivileged(new PrivilegedAction<Void>() {
++ public Void run() {
++ System.loadLibrary(SYSTEMCONF_NATIVE_LIB);
++ return null;
++ }
++ });
++ }
+
+ /*
+ * Invoked when java.security.Security class is initialized, if
+@@ -171,17 +177,34 @@
+ }
+
+ /*
+- * FIPS is enabled only if crypto-policies are set to "FIPS"
+- * and the com.redhat.fips property is true.
++ * OpenJDK FIPS mode will be enabled only if the com.redhat.fips
++ * system property is true (default) and the system is in FIPS mode.
++ *
++ * There are 2 possible ways in which OpenJDK detects that the system
++ * is in FIPS mode: 1) if the NSS SECMOD_GetSystemFIPSEnabled API is
++ * available at OpenJDK's built-time, it is called; 2) otherwise, the
++ * /proc/sys/crypto/fips_enabled file is read.
+ */
+- private static boolean enableFips() throws Exception {
++ private static boolean enableFips() throws IOException {
+ boolean shouldEnable =
Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
+ if (shouldEnable) {
+- Path configPath = FileSystems.getDefault().getPath(CRYPTO_POLICIES_CONFIG);
+- String cryptoPoliciesConfig = new String(Files.readAllBytes(configPath));
+- if (sdebug != null) { sdebug.println("Crypto config:\n" +
cryptoPoliciesConfig); }
+- Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
+- return pattern.matcher(cryptoPoliciesConfig).find();
++ if (sdebug != null) {
++ sdebug.println("Calling getSystemFIPSEnabled
(libsystemconf)...");
++ }
++ try {
++ shouldEnable = getSystemFIPSEnabled();
++ if (sdebug != null) {
++ sdebug.println("Call to getSystemFIPSEnabled (libsystemconf)
returned: "
++ + shouldEnable);
++ }
++ return shouldEnable;
++ } catch (IOException e) {
++ if (sdebug != null) {
++ sdebug.println("Call to getSystemFIPSEnabled (libsystemconf)
failed:");
++ sdebug.println(e.getMessage());
++ }
++ throw e;
++ }
+ } else {
+ return false;
+ }
+diff --git openjdk.orig/jdk/src/solaris/native/java/security/systemconf.c
openjdk/jdk/src/solaris/native/java/security/systemconf.c
+new file mode 100644
+--- /dev/null
++++ openjdk/jdk/src/solaris/native/java/security/systemconf.c
+@@ -0,0 +1,168 @@
++/*
++ * Copyright (c) 2021, Red Hat, Inc.
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation. Oracle designates this
++ * particular file as subject to the "Classpath" exception as provided
++ * by Oracle in the LICENSE file that accompanied this code.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit
www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++#include <dlfcn.h>
++#include <jni.h>
++#include <jni_util.h>
++#include <stdio.h>
++
++#ifdef SYSCONF_NSS
++#include <nss3/pk11pub.h>
++#endif //SYSCONF_NSS
++
++#include "java_security_SystemConfigurator.h"
++
++#define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled"
++#define MSG_MAX_SIZE 96
++
++static jmethodID debugPrintlnMethodID = NULL;
++static jobject debugObj = NULL;
++
++static void throwIOException(JNIEnv *env, const char *msg);
++static void dbgPrint(JNIEnv *env, const char* msg);
++
++/*
++ * Class: java_security_SystemConfigurator
++ * Method: JNI_OnLoad
++ */
++JNIEXPORT jint JNICALL DEF_JNI_OnLoad(JavaVM *vm, void *reserved)
++{
++ JNIEnv *env;
++ jclass sysConfCls, debugCls;
++ jfieldID sdebugFld;
++
++ if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) {
++ return JNI_EVERSION; /* JNI version not supported */
++ }
++
++ sysConfCls =
(*env)->FindClass(env,"java/security/SystemConfigurator");
++ if (sysConfCls == NULL) {
++ printf("libsystemconf: SystemConfigurator class not found\n");
++ return JNI_ERR;
++ }
++ sdebugFld = (*env)->GetStaticFieldID(env, sysConfCls,
++ "sdebug", "Lsun/security/util/Debug;");
++ if (sdebugFld == NULL) {
++ printf("libsystemconf: SystemConfigurator::sdebug field not
found\n");
++ return JNI_ERR;
++ }
++ debugObj = (*env)->GetStaticObjectField(env, sysConfCls, sdebugFld);
++ if (debugObj != NULL) {
++ debugCls = (*env)->FindClass(env,"sun/security/util/Debug");
++ if (debugCls == NULL) {
++ printf("libsystemconf: Debug class not found\n");
++ return JNI_ERR;
++ }
++ debugPrintlnMethodID = (*env)->GetMethodID(env, debugCls,
++ "println", "(Ljava/lang/String;)V");
++ if (debugPrintlnMethodID == NULL) {
++ printf("libsystemconf: Debug::println(String) method not
found\n");
++ return JNI_ERR;
++ }
++ debugObj = (*env)->NewGlobalRef(env, debugObj);
++ }
++
++ return (*env)->GetVersion(env);
++}
++
++/*
++ * Class: java_security_SystemConfigurator
++ * Method: JNI_OnUnload
++ */
++JNIEXPORT void JNICALL DEF_JNI_OnUnload(JavaVM *vm, void *reserved)
++{
++ JNIEnv *env;
++
++ if (debugObj != NULL) {
++ if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) {
++ return; /* Should not happen */
++ }
++ (*env)->DeleteGlobalRef(env, debugObj);
++ }
++}
++
++JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEnabled
++ (JNIEnv *env, jclass cls)
++{
++ int fips_enabled;
++ char msg[MSG_MAX_SIZE];
++ int msg_bytes;
++
++#ifdef SYSCONF_NSS
++
++ dbgPrint(env, "getSystemFIPSEnabled: calling
SECMOD_GetSystemFIPSEnabled");
++ fips_enabled = SECMOD_GetSystemFIPSEnabled();
++ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \
++ " SECMOD_GetSystemFIPSEnabled returned 0x%x", fips_enabled);
++ if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) {
++ dbgPrint(env, msg);
++ } else {
++ dbgPrint(env, "getSystemFIPSEnabled: cannot render" \
++ " SECMOD_GetSystemFIPSEnabled return value");
++ }
++ return (fips_enabled == 1 ? JNI_TRUE : JNI_FALSE);
++
++#else // SYSCONF_NSS
++
++ FILE *fe;
++
++ dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH);
++ if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) {
++ throwIOException(env, "Cannot open " FIPS_ENABLED_PATH);
++ }
++ fips_enabled = fgetc(fe);
++ fclose(fe);
++ if (fips_enabled == EOF) {
++ throwIOException(env, "Cannot read " FIPS_ENABLED_PATH);
++ }
++ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \
++ " read character is '%c'", fips_enabled);
++ if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) {
++ dbgPrint(env, msg);
++ } else {
++ dbgPrint(env, "getSystemFIPSEnabled: cannot render" \
++ " read character");
++ }
++ return (fips_enabled == '1' ? JNI_TRUE : JNI_FALSE);
++
++#endif // SYSCONF_NSS
++}
++
++static void throwIOException(JNIEnv *env, const char *msg)
++{
++ jclass cls = (*env)->FindClass(env, "java/io/IOException");
++ if (cls != 0)
++ (*env)->ThrowNew(env, cls, msg);
++}
++
++static void dbgPrint(JNIEnv *env, const char* msg)
++{
++ jstring jMsg;
++ if (debugObj != NULL) {
++ jMsg = (*env)->NewStringUTF(env, msg);
++ CHECK_NULL(jMsg);
++ (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg);
++ }
++}
diff --git a/rh1929465-improve_system_FIPS_detection-root.patch
b/rh1929465-improve_system_FIPS_detection-root.patch
new file mode 100644
index 0000000..64d8ac0
--- /dev/null
+++ b/rh1929465-improve_system_FIPS_detection-root.patch
@@ -0,0 +1,152 @@
+diff --git openjdk.orig/common/autoconf/configure.ac
openjdk/common/autoconf/configure.ac
+--- openjdk.orig/common/autoconf/configure.ac
++++ openjdk/common/autoconf/configure.ac
+@@ -212,6 +212,7 @@
+ LIB_SETUP_ALSA
+ LIB_SETUP_FONTCONFIG
+ LIB_SETUP_MISC_LIBS
++LIB_SETUP_SYSCONF_LIBS
+ LIB_SETUP_STATIC_LINK_LIBSTDCPP
+ LIB_SETUP_ON_WINDOWS
+
+diff --git openjdk.orig/common/autoconf/libraries.m4
openjdk/common/autoconf/libraries.m4
+--- openjdk.orig/common/autoconf/libraries.m4
++++ openjdk/common/autoconf/libraries.m4
+@@ -1067,3 +1067,63 @@
+ BASIC_DEPRECATED_ARG_WITH([dxsdk-include])
+ fi
+ ])
++
++################################################################################
++# Setup system configuration libraries
++################################################################################
++AC_DEFUN_ONCE([LIB_SETUP_SYSCONF_LIBS],
++[
++ ###############################################################################
++ #
++ # Check for the NSS library
++ #
++
++ AC_MSG_CHECKING([whether to use the system NSS library with the System Configurator
(libsysconf)])
++
++ # default is not available
++ DEFAULT_SYSCONF_NSS=no
++
++ AC_ARG_ENABLE([sysconf-nss], [AS_HELP_STRING([--enable-sysconf-nss],
++ [build the System Configurator (libsysconf) using the system NSS library if
available @<:@disabled@:>@])],
++ [
++ case "${enableval}" in
++ yes)
++ sysconf_nss=yes
++ ;;
++ *)
++ sysconf_nss=no
++ ;;
++ esac
++ ],
++ [
++ sysconf_nss=${DEFAULT_SYSCONF_NSS}
++ ])
++ AC_MSG_RESULT([$sysconf_nss])
++
++ USE_SYSCONF_NSS=false
++ if test "x${sysconf_nss}" = "xyes"; then
++ PKG_CHECK_MODULES(NSS, nss >= 3.53, [NSS_FOUND=yes], [NSS_FOUND=no])
++ if test "x${NSS_FOUND}" = "xyes"; then
++ AC_MSG_CHECKING([for system FIPS support in NSS])
++ saved_libs="${LIBS}"
++ saved_cflags="${CFLAGS}"
++ CFLAGS="${CFLAGS} ${NSS_CFLAGS}"
++ LIBS="${LIBS} ${NSS_LIBS}"
++ AC_LANG_PUSH([C])
++ AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <nss3/pk11pub.h>]],
++ [[SECMOD_GetSystemFIPSEnabled()]])],
++ [AC_MSG_RESULT([yes])],
++ [AC_MSG_RESULT([no])
++ AC_MSG_ERROR([System NSS FIPS detection unavailable])])
++ AC_LANG_POP([C])
++ CFLAGS="${saved_cflags}"
++ LIBS="${saved_libs}"
++ USE_SYSCONF_NSS=true
++ else
++ dnl NSS 3.53 is the one that introduces the SECMOD_GetSystemFIPSEnabled API
++ dnl in nss3/pk11pub.h.
++ AC_MSG_ERROR([--enable-sysconf-nss specified, but NSS 3.53 or above not
found.])
++ fi
++ fi
++ AC_SUBST(USE_SYSCONF_NSS)
++])
+diff --git openjdk.orig/common/autoconf/spec.gmk.in openjdk/common/autoconf/spec.gmk.in
+--- openjdk.orig/common/autoconf/spec.gmk.in
++++ openjdk/common/autoconf/spec.gmk.in
+@@ -312,6 +312,10 @@
+ ALSA_LIBS:=@ALSA_LIBS@
+ ALSA_CFLAGS:=@ALSA_CFLAGS@
+
++USE_SYSCONF_NSS:=@USE_SYSCONF_NSS@
++NSS_LIBS:=@NSS_LIBS@
++NSS_CFLAGS:=@NSS_CFLAGS@
++
+ PACKAGE_PATH=@PACKAGE_PATH@
+
+ # Source file for cacerts
+diff --git openjdk.orig/common/bin/compare_exceptions.sh.incl
openjdk/common/bin/compare_exceptions.sh.incl
+--- openjdk.orig/common/bin/compare_exceptions.sh.incl
++++ openjdk/common/bin/compare_exceptions.sh.incl
+@@ -280,6 +280,7 @@
+ ./jre/lib/i386/libsplashscreen.so
+ ./jre/lib/i386/libsunec.so
+ ./jre/lib/i386/libsunwjdga.so
++./jre/lib/i386/libsystemconf.so
+ ./jre/lib/i386/libt2k.so
+ ./jre/lib/i386/libunpack.so
+ ./jre/lib/i386/libverify.so
+@@ -433,6 +434,7 @@
+ ./jre/lib/amd64/libsplashscreen.so
+ ./jre/lib/amd64/libsunec.so
+ ./jre/lib/amd64/libsunwjdga.so
++//jre/lib/amd64/libsystemconf.so
+ ./jre/lib/amd64/libt2k.so
+ ./jre/lib/amd64/libunpack.so
+ ./jre/lib/amd64/libverify.so
+@@ -587,6 +589,7 @@
+ ./jre/lib/sparc/libsplashscreen.so
+ ./jre/lib/sparc/libsunec.so
+ ./jre/lib/sparc/libsunwjdga.so
++./jre/lib/sparc/libsystemconf.so
+ ./jre/lib/sparc/libt2k.so
+ ./jre/lib/sparc/libunpack.so
+ ./jre/lib/sparc/libverify.so
+@@ -741,6 +744,7 @@
+ ./jre/lib/sparcv9/libsplashscreen.so
+ ./jre/lib/sparcv9/libsunec.so
+ ./jre/lib/sparcv9/libsunwjdga.so
++./jre/lib/sparcv9/libsystemconf.so
+ ./jre/lib/sparcv9/libt2k.so
+ ./jre/lib/sparcv9/libunpack.so
+ ./jre/lib/sparcv9/libverify.so
+diff --git openjdk.orig/common/nb_native/nbproject/configurations.xml
openjdk/common/nb_native/nbproject/configurations.xml
+--- openjdk.orig/common/nb_native/nbproject/configurations.xml
++++ openjdk/common/nb_native/nbproject/configurations.xml
+@@ -53,6 +53,9 @@
+ <in>jvmtiEnterTrace.cpp</in>
+ </df>
+ </df>
++ <df name="libsystemconf">
++ <in>systemconf.c</in>
++ </df>
+ </df>
+ </df>
+ <df name="jdk">
+@@ -12772,6 +12775,11 @@
+ tool="0"
+ flavor2="0">
+ </item>
++ <item path="../../jdk/src/solaris/native/java/security/systemconf.c"
++ ex="false"
++ tool="0"
++ flavor2="0">
++ </item>
+ <item path="../../jdk/src/share/native/java/util/TimeZone.c"
+ ex="false"
+ tool="0"
commit 8803d9fc833ed25000379a1da5383f2cf1c4435f
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Wed Sep 1 16:48:03 2021 +0200
alternatives creation moved to posttrans
Thus fixing the old reisntall issue:
https://bugzilla.redhat.com/show_bug.cgi?id=1200302
https://bugzilla.redhat.com/show_bug.cgi?id=1976053
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 53718f7..68867b4 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -63,7 +63,7 @@
# in alternatives those are slaves and master, very often triplicated by man pages
# in files all masters and slaves are ghosted
# the ghosts are here to allow installation via query like `dnf install /usr/bin/java`
-# you can list those files, with appropriate sections: cat *.spec | grep -e --install -e
--slave -e post_
+# you can list those files, with appropriate sections: cat *.spec | grep -e --install -e
--slave -e post_ -e alternatives
# TODO - fix those hardcoded lists via single list
# Those files must *NOT* be ghosted for *slowdebug* packages
# FIXME - if you are moving jshell or jlink or similar, always modify all three sections
@@ -309,7 +309,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 1
+%global rpmrelease 2
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -414,12 +414,7 @@ update-desktop-database %{_datadir}/applications &> /dev/null
|| :
exit 0
}
-
-%define post_headless() %{expand:
-%ifarch %{share_arches}
-%{jrebindir -- %{?1}}/java -Xshare:dump >/dev/null 2>/dev/null
-%endif
-
+%define alternatives_java_install() %{expand:
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
@@ -469,8 +464,13 @@ for X in %{origin} %{javaver} ; do
alternatives --install %{_jvmdir}/jre-"$X" jre_"$X"
%{_jvmdir}/%{jredir -- %{?1}} $PRIORITY --family %{name}.%{_arch}
done
-update-alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin}
jre_%{javaver}_%{origin} %{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family
%{name}.%{_arch}
+alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} jre_%{javaver}_%{origin}
%{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family %{name}.%{_arch}
+}
+%define post_headless() %{expand:
+%ifarch %{share_arches}
+%{jrebindir -- %{?1}}/java -Xshare:dump >/dev/null 2>/dev/null
+%endif
update-desktop-database %{_datadir}/applications &> /dev/null || :
/bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || :
@@ -507,8 +507,8 @@ exit 0
%{update_desktop_icons}
}
-%define post_devel() %{expand:
+%define alternatives_javac_install() %{expand:
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
@@ -616,7 +616,9 @@ for X in %{origin} %{javaver} ; do
done
update-alternatives --install %{_jvmdir}/java-%{javaver}-%{origin}
java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family
%{name}.%{_arch}
+}
+%define post_devel() %{expand:
update-desktop-database %{_datadir}/applications &> /dev/null || :
/bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || :
@@ -639,11 +641,11 @@ exit 0
}
%define posttrans_devel() %{expand:
+%{alternatives_javac_install -- %{?1}}
%{update_desktop_icons}
}
-%define post_javadoc() %{expand:
-
+%define alternatives_javadoc_install() %{expand:
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
@@ -660,8 +662,7 @@ exit 0
exit 0
}
-%define post_javadoc_zip() %{expand:
-
+%define alternatives_javadoczip_install() %{expand:
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
@@ -2419,6 +2420,9 @@ cjc.mainProgram(args)
%posttrans
%{posttrans_script %{nil}}
+%posttrans headless
+%{alternatives_java_install %{nil}}
+
%post devel
%{post_devel %{nil}}
@@ -2428,14 +2432,14 @@ cjc.mainProgram(args)
%posttrans devel
%{posttrans_devel %{nil}}
-%post javadoc
-%{post_javadoc %{nil}}
+%posttrans javadoc
+%{alternatives_javadoc_install %{nil}}
%postun javadoc
%{postun_javadoc %{nil}}
-%post javadoc-zip
-%{post_javadoc_zip %{nil}}
+%posttrans javadoc-zip
+%{alternatives_javadoczip_install %{nil}}
%postun javadoc-zip
%{postun_javadoc_zip %{nil}}
@@ -2448,6 +2452,9 @@ cjc.mainProgram(args)
%post headless-slowdebug
%{post_headless -- %{debug_suffix_unquoted}}
+%posttrans headless-slowdebug
+%{alternatives_java_install -- %{debug_suffix_unquoted}}
+
%postun slowdebug
%{postun_script -- %{debug_suffix_unquoted}}
@@ -2483,6 +2490,9 @@ cjc.mainProgram(args)
%posttrans fastdebug
%{posttrans_script -- %{fastdebug_suffix_unquoted}}
+%posttrans headless-fastdebug
+%{alternatives_java_install -- %{fastdebug_suffix_unquoted}}
+
%post devel-fastdebug
%{post_devel -- %{fastdebug_suffix_unquoted}}
@@ -2580,6 +2590,12 @@ cjc.mainProgram(args)
%endif
%changelog
+* Mon Aug 30 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.302.b08-2
+- alternatives creation moved to posttrans
+- Thus fixing the old reisntall issue:
+-
https://bugzilla.redhat.com/show_bug.cgi?id=1200302
+-
https://bugzilla.redhat.com/show_bug.cgi?id=1976053
+
* Sun Aug 08 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b08-1
- Remove non-Free test and demo files from source tarball.
commit 661c37e98f47d3009ad494331f36cd2006dffe18
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Sun Aug 8 05:21:18 2021 +0100
Remove non-Free test and demo files from source tarball.
diff --git a/.gitignore b/.gitignore
index a4aa037..67c9eb6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -238,3 +238,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b06-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b07-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b08-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b08-4curve-clean.tar.xz
diff --git a/generate_source_tarball.sh b/generate_source_tarball.sh
index 94b75e7..e9eed11 100755
--- a/generate_source_tarball.sh
+++ b/generate_source_tarball.sh
@@ -19,12 +19,25 @@
# level folder, name is created, based on parameter
#
+SCRIPT_DIR=$(dirname $0)
+JCONSOLE_JS_PATCH_DEFAULT=${SCRIPT_DIR}/jconsole-plugin.patch
+
if [ ! "x$PR3822" = "x" ] ; then
if [ ! -f "$PR3822" ] ; then
- echo "You have specified PR3822 as $PR3822 but it does not exists.
exiting"
+ echo "You have specified PR3822 as $PR3822 but it does not exist. Exiting"
exit 1
fi
fi
+
+if [ "x${JCONSOLE_JS_PATCH}" != "x" ] ; then
+ if [ ! -f "${JCONSOLE_JS_PATCH}" ] ; then
+ echo "You have specified the jconsole.js patch as ${JCONSOLE_JS_PATCH} but it does
not exist. Exiting.";
+ exit 2;
+ fi
+else
+ JCONSOLE_JS_PATCH=${JCONSOLE_JS_PATCH_DEFAULT}
+fi
+
set -e
OPENJDK_URL_DEFAULT=http://hg.openjdk.java.net
@@ -42,6 +55,7 @@ if [ "x$1" = "xhelp" ] ; then
echo "FILE_NAME_ROOT - name of the archive, minus extensions (optional; defaults
to PROJECT_NAME-REPO_NAME-VERSION)"
echo "REPO_ROOT - the location of the Mercurial repository to archive (optional;
defaults to OPENJDK_URL/PROJECT_NAME/REPO_NAME)"
echo "PR3822 - the path to the PR3822 patch to apply (optional; downloaded if
unavailable)"
+ echo "JCONSOLE_JS_PATCH - the path to a patch to fix non-availiability of
jconsole.js (optional; defaults to ${JCONSOLE_JS_PATCH_DEFAULT})"
echo "REPOS - specify the repositories to use (optional; defaults to
${REPOS_DEFAULT})"
exit 1;
fi
@@ -88,6 +102,22 @@ if [ "x$REPO_ROOT" = "x" ] ; then
REPO_ROOT="${OPENJDK_URL}/${PROJECT_NAME}/${REPO_NAME}"
echo "No repository root specified; default to ${REPO_ROOT}"
fi;
+if [ "x$REPOS" = "x" ] ; then
+ REPOS=${REPOS_DEFAULT}
+ echo "No repositories specified; defaulting to ${REPOS}"
+fi;
+
+echo -e "Settings:"
+echo -e "\tVERSION: ${VERSION}"
+echo -e "\tPROJECT_NAME: ${PROJECT_NAME}"
+echo -e "\tREPO_NAME: ${REPO_NAME}"
+echo -e "\tOPENJDK_URL: ${OPENJDK_URL}"
+echo -e "\tCOMPRESSION: ${COMPRESSION}"
+echo -e "\tFILE_NAME_ROOT: ${FILE_NAME_ROOT}"
+echo -e "\tREPO_ROOT: ${REPO_ROOT}"
+echo -e "\tPR3822: ${PR3822}"
+echo -e "\tJCONSOLE_JS_PATCH: ${JCONSOLE_JS_PATCH}"
+echo -e "\tREPOS: ${REPOS}"
mkdir "${FILE_NAME_ROOT}"
pushd "${FILE_NAME_ROOT}"
@@ -96,22 +126,22 @@ echo "Cloning ${VERSION} root repository from
${REPO_ROOT}"
hg clone ${REPO_ROOT} openjdk -r ${VERSION}
pushd openjdk
-
-if [ "x$REPOS" = "x" ] ; then
- repos=${REPOS_DEFAULT}
- echo "No repositories specified; defaulting to ${repos}"
-else
- repos=$REPOS
- echo "Repositories: ${repos}"
-fi;
-
-for subrepo in $repos
+for subrepo in ${REPOS}
do
echo "Cloning ${VERSION} ${subrepo} repository from ${REPO_ROOT}"
hg clone ${REPO_ROOT}/${subrepo} -r ${VERSION}
done
-if [ -d jdk ]; then
+# UnderlineTaglet.java has a BSD license with a field-of-use restriction, making it
non-Free
+if [ -d langtools ] ; then
+ echo "Removing langtools test case with non-Free license"
+ rm -vf langtools/test/tools/javadoc/api/basic/TagletPathTest.java
+ rm -vf langtools/test/tools/javadoc/api/basic/taglets/UnderlineTaglet.java
+fi
+if [ -d jdk ]; then
+# jconsole.js has a BSD license with a field-of-use restriction, making it non-Free
+echo "Removing jconsole-plugin file with non-Free license"
+rm -vf jdk/src/share/demo/scripting/jconsole-plugin/src/resources/jconsole.js
echo "Removing EC source code we don't build"
rm -vf jdk/src/share/native/sun/security/ec/impl/ec2.h
rm -vf jdk/src/share/native/sun/security/ec/impl/ec2_163.c
@@ -123,7 +153,6 @@ rm -vf jdk/src/share/native/sun/security/ec/impl/ecp_192.c
rm -vf jdk/src/share/native/sun/security/ec/impl/ecp_224.c
echo "Syncing EC list with NSS"
-
if [ "x$PR3822" = "x" ] ; then
# get pr3822.patch (from
http://icedtea.classpath.org/hg/icedtea8) from most correct tag
# Do not push it or publish it (see
http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=3822)
@@ -135,6 +164,10 @@ else
patch -Np1 < $PR3822
fi;
fi
+
+echo "Patching out use of jconsole.js"
+patch -Np1 < ${JCONSOLE_JS_PATCH}
+
find . -name '*.orig' -exec rm -vf '{}' ';'
popd
@@ -144,7 +177,7 @@ if [ "X$COMPRESSION" = "Xxz" ] ; then
else
SWITCH=czf
fi
-TARBALL_NAME=${FILE_NAME_ROOT}-4curve.tar.${COMPRESSION}
+TARBALL_NAME=${FILE_NAME_ROOT}-4curve-clean.tar.${COMPRESSION}
tar --exclude-vcs -$SWITCH ${TARBALL_NAME} openjdk
mv ${TARBALL_NAME} ..
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index b5067ff..53718f7 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -309,7 +309,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 0
+%global rpmrelease 1
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1202,7 +1202,7 @@ Provides: java-%{origin}-src%{?1} = %{epoch}:%{version}-%{release}
Name: java-%{javaver}-%{origin}
Version: %{javaver}.%{updatever}.%{buildver}
-Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}.1
+Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
# java-1.5.0-ibm from
jpackage.org set Epoch to 1 for unknown reasons
# and this change was brought into RHEL-4. java-1.5.0-ibm packages
# also included the epoch in their virtual provides. This created a
@@ -1237,7 +1237,7 @@ URL:
http://openjdk.java.net/
# FILE_NAME_ROOT=%%{shenandoah_project}-%%{shenandoah_repo}-${VERSION}
# REPO_ROOT=<path to checked-out repository> generate_source_tarball.sh
# where the source is obtained from
http://hg.openjdk.java.net/%%{project}/%%{repo}
-Source0: %{shenandoah_project}-%{shenandoah_repo}-%{shenandoah_revision}-4curve.tar.xz
+Source0:
%{shenandoah_project}-%{shenandoah_repo}-%{shenandoah_revision}-4curve-clean.tar.xz
# Custom README for -src subpackage
Source2: README.md
@@ -2580,6 +2580,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Sun Aug 08 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b08-1
+- Remove non-Free test and demo files from source tarball.
+
* Thu Jul 22 2021 Fedora Release Engineering <releng(a)fedoraproject.org> -
1:1.8.0.302.b08-0.1
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
diff --git a/jconsole-plugin.patch b/jconsole-plugin.patch
new file mode 100644
index 0000000..b015a78
--- /dev/null
+++ b/jconsole-plugin.patch
@@ -0,0 +1,31 @@
+diff --git openjdk.orig/jdk/src/share/demo/scripting/jconsole-plugin/README.txt
openjdk/jdk/src/share/demo/scripting/jconsole-plugin/README.txt
+--- openjdk.orig/jdk/src/share/demo/scripting/jconsole-plugin/README.txt
++++ openjdk/jdk/src/share/demo/scripting/jconsole-plugin/README.txt
+@@ -18,11 +18,9 @@
+ engine javax.script.ScriptEngine
+ plugin com.sun.tools.jconsole.JConsolePlugin
+
+-If you use JavaScript, there are many useful global functions defined in
+-./src/resources/jconsole.js. This is built into the script plugin jar file.
+-In addition, you can add other global functions and global variables by
+-defining those in ~/jconsole.js (or jconsole.<ext> where <ext> is the file
+-extension for your scripting language of choice under your home directory).
++You can add global functions and global variables by defining those in
++~/jconsole.js (or jconsole.<ext> where <ext> is the file extension for
++your scripting language of choice under your home directory).
+
+ How do I compile script console plugin?
+
+diff --git openjdk.orig/jdk/src/share/demo/scripting/jconsole-plugin/build.xml
openjdk/jdk/src/share/demo/scripting/jconsole-plugin/build.xml
+--- openjdk.orig/jdk/src/share/demo/scripting/jconsole-plugin/build.xml
++++ openjdk/jdk/src/share/demo/scripting/jconsole-plugin/build.xml
+@@ -73,9 +73,6 @@
+ <copy todir="${classes.dir}/META-INF/services">
+ <fileset dir="${src.dir}/META-INF/services"/>
+ </copy>
+- <copy todir="${resources.dir}">
+- <fileset dir="${src.dir}/resources"/>
+- </copy>
+ </target>
+
+ <target name="all" depends="compile" description="buile
deployment bundle">
diff --git a/sources b/sources
index 0357887..3236329 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b08-4curve.tar.xz) =
938b3308357c5be40fd474e861f5a612e758520988588b633791ada742fdaef522ecc05f4b2a0c40799a01e1b5d33960c1b76deb2089e36b6d92b0788a74bf74
+SHA512
(aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b08-4curve-clean.tar.xz) =
04ecdcde841038c0042b44fb3c5303a08616864566fb918ab261fc381fae8804a21f875b1645538e864a1c6db5985f16dfc13b91eb1caeeab54d6d07828c7657
commit 37a363e30cf6934369ea54430e41bd92cd21d940
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Wed Sep 1 23:23:51 2021 +0100
Update to aarch64-shenandoah-jdk8u312-b01 (EA)
Update release notes for 8u312-b01.
Switch to EA mode.
Remove "-clean" suffix as no 8u312 builds are unclean.
diff --git a/.gitignore b/.gitignore
index 67c9eb6..4252ee4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -239,3 +239,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b07-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b08-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b08-4curve-clean.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b01-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 1cb973a..947e72a 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,51 @@ Key:
JDK-X -
https://bugs.openjdk.java.net/browse/JDK-X
CVE-XXXX-YYYY:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
+New in release OpenJDK 8u312 (2021-10-19):
+===========================================
+Live versions of these release notes can be found at:
+ *
https://bitly.com/openjdk8u312
+ *
https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u312.txt
+
+* Other changes
+ - JDK-7146776: deadlock between URLStreamHandler.getHostAddress and
file.Handler.openconnection
+ - JDK-8004148: NPE in sun.awt.SunToolkit.getWindowDeactivationTime
+ - JDK-8027154: [TESTBUG] Test
java/awt/Mouse/GetMousePositionTest/GetMousePositionWithPopup.java fails
+ - JDK-8035001: TEST_BUG: the retry logic in RMID.start() should check that the
subprocess hasn't terminated
+ - JDK-8035424: (reflect) Performance problem in
sun.reflect.generics.parser.SignatureParser
+ - JDK-8042557: compiler/uncommontrap/TestSpecTrapClassUnloading.java fails with: GC
triggered before VM initialization completed
+ - JDK-8054118: java/net/ipv6tests/UdpTest.java failed intermittently
+ - JDK-8065215: Print warning summary at end of configure
+ - JDK-8072767: DefaultCellEditor for comboBox creates ActionEvent with wrong source
object
+ - JDK-8079891: Store configure log in $BUILD/configure.log
+ - JDK-8080082: configure fails if you create an empty directory and then run configure
from it
+ - JDK-8086003: Test fails on OSX with java.lang.RuntimeException 'Narrow klass
base: 0x0000000000000000, Narrow klass shift: 3' missing
+ - JDK-8134989: java/net/MulticastSocket/TestInterfaces.java failed due to unexpected IP
address
+ - JDK-8156584: Initialization race in sun.security.x509.AlgorithmId.get
+ - JDK-8166673: The new implementation of Robot.waitForIdle() may hang
+ - JDK-8170467: (reflect) Optimize SignatureParser's use of StringBuilders
+ - JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
+ - JDK-8202837: PBES2 AlgorithmId encoding error in PKCS12 KeyStore
+ - JDK-8206189: sun/security/pkcs12/EmptyPassword.java fails with Sequence tag error
+ - JDK-8214418: half-closed SSLEngine status may cause application dead loop
+ - JDK-8214513: A PKCS12 keystore from Java 8 using custom PBE parameters cannot be read
in Java 11
+ - JDK-8220786: Create new switch to redirect error reporting output to stdout or
stderr
+ - JDK-8229243: SunPKCS11-Solaris provider tests failing on Solaris 11.4
+ - JDK-8231222: fix pkcs11 P11_DEBUG guarded native traces
+ - JDK-8238567: SoftMainMixer.processAudioBuffers(): Wrong handling of stoppedMixers
+ - JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in Windows Print
+ - JDK-8241248: NullPointerException in sun.security.ssl.HKDF.extract(HKDF.java:93)
+ - JDK-8248901: Signed immediate support in .../share/assembler.hpp is broken.
+ - JDK-8259338: Add expiry exception for identrustdstx3 alias to VerifyCACerts.java
test
+ - JDK-8262000:
jdk/jfr/event/gc/detailed/TestPromotionFailedEventWithParallelScavenge.java failed with
"OutOfMemoryError: Java heap space"
+ - JDK-8262829: Native crash in Win32PrintServiceLookup.getAllPrinterNames()
+ - JDK-8263311: Watch registry changes for remote printers update instead of polling
+ - JDK-8265238: [8u] [macos] build failure in OpenJDK8u after JDK-8211301 in older
xcode
+ - JDK-8265978: make test should look for more locations when searching for exit code
+ - JDK-8269810: [8u] Update generated_configure.sh after JDK-8250876 backport
+ - JDK-8269953: config.log is not in build directory after 8u backport of JDK-8079891
+ - JDK-8271466: StackGap test fails on aarch64 due to "-m64"
+
New in release OpenJDK 8u302 (2021-07-20):
===========================================
Live versions of these release notes can be found at:
diff --git a/generate_source_tarball.sh b/generate_source_tarball.sh
index e9eed11..c6f0756 100755
--- a/generate_source_tarball.sh
+++ b/generate_source_tarball.sh
@@ -177,7 +177,7 @@ if [ "X$COMPRESSION" = "Xxz" ] ; then
else
SWITCH=czf
fi
-TARBALL_NAME=${FILE_NAME_ROOT}-4curve-clean.tar.${COMPRESSION}
+TARBALL_NAME=${FILE_NAME_ROOT}-4curve.tar.${COMPRESSION}
tar --exclude-vcs -$SWITCH ${TARBALL_NAME} openjdk
mv ${TARBALL_NAME} ..
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 68867b4..a31c545 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -294,7 +294,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u302-b08
+%global shenandoah_revision aarch64-shenandoah-jdk8u312-b01
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -314,7 +314,7 @@
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
# - N%%{?extraver}{?dist} for GA releases
-%global is_ga 1
+%global is_ga 0
%if %{is_ga}
%global milestone fcs
%global milestone_version %{nil}
@@ -1238,7 +1238,7 @@ URL:
http://openjdk.java.net/
# FILE_NAME_ROOT=%%{shenandoah_project}-%%{shenandoah_repo}-${VERSION}
# REPO_ROOT=<path to checked-out repository> generate_source_tarball.sh
# where the source is obtained from
http://hg.openjdk.java.net/%%{project}/%%{repo}
-Source0:
%{shenandoah_project}-%{shenandoah_repo}-%{shenandoah_revision}-4curve-clean.tar.xz
+Source0: %{shenandoah_project}-%{shenandoah_repo}-%{shenandoah_revision}-4curve.tar.xz
# Custom README for -src subpackage
Source2: README.md
@@ -2590,6 +2590,12 @@ cjc.mainProgram(args)
%endif
%changelog
+* Wed Sep 01 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.312.b01-0.1.ea
+- Update to aarch64-shenandoah-jdk8u312-b01 (EA)
+- Update release notes for 8u312-b01.
+- Switch to EA mode.
+- Remove "-clean" suffix as no 8u312 builds are unclean.
+
* Mon Aug 30 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.302.b08-2
- alternatives creation moved to posttrans
- Thus fixing the old reisntall issue:
diff --git a/sources b/sources
index 3236329..743cecf 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512
(aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b08-4curve-clean.tar.xz) =
04ecdcde841038c0042b44fb3c5303a08616864566fb918ab261fc381fae8804a21f875b1645538e864a1c6db5985f16dfc13b91eb1caeeab54d6d07828c7657
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u312-b01-4curve.tar.xz) =
ddce8d47e12e4de078004d981d4c89538738a7cb201b7e7f820f51a39aac2c00040e3ba9c6ee92ec10d10e5607f420a4c3e4d059e05a8d9930e3f71e0917c84f
commit ae9982ef76614e5357e5d4409d330f9e738b3277
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Wed Sep 1 16:48:03 2021 +0200
alternatives creation moved to posttrans
Thus fixing the old reisntall issue:
https://bugzilla.redhat.com/show_bug.cgi?id=1200302
https://bugzilla.redhat.com/show_bug.cgi?id=1976053
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 53718f7..68867b4 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -63,7 +63,7 @@
# in alternatives those are slaves and master, very often triplicated by man pages
# in files all masters and slaves are ghosted
# the ghosts are here to allow installation via query like `dnf install /usr/bin/java`
-# you can list those files, with appropriate sections: cat *.spec | grep -e --install -e
--slave -e post_
+# you can list those files, with appropriate sections: cat *.spec | grep -e --install -e
--slave -e post_ -e alternatives
# TODO - fix those hardcoded lists via single list
# Those files must *NOT* be ghosted for *slowdebug* packages
# FIXME - if you are moving jshell or jlink or similar, always modify all three sections
@@ -309,7 +309,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 1
+%global rpmrelease 2
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -414,12 +414,7 @@ update-desktop-database %{_datadir}/applications &> /dev/null
|| :
exit 0
}
-
-%define post_headless() %{expand:
-%ifarch %{share_arches}
-%{jrebindir -- %{?1}}/java -Xshare:dump >/dev/null 2>/dev/null
-%endif
-
+%define alternatives_java_install() %{expand:
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
@@ -469,8 +464,13 @@ for X in %{origin} %{javaver} ; do
alternatives --install %{_jvmdir}/jre-"$X" jre_"$X"
%{_jvmdir}/%{jredir -- %{?1}} $PRIORITY --family %{name}.%{_arch}
done
-update-alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin}
jre_%{javaver}_%{origin} %{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family
%{name}.%{_arch}
+alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} jre_%{javaver}_%{origin}
%{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family %{name}.%{_arch}
+}
+%define post_headless() %{expand:
+%ifarch %{share_arches}
+%{jrebindir -- %{?1}}/java -Xshare:dump >/dev/null 2>/dev/null
+%endif
update-desktop-database %{_datadir}/applications &> /dev/null || :
/bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || :
@@ -507,8 +507,8 @@ exit 0
%{update_desktop_icons}
}
-%define post_devel() %{expand:
+%define alternatives_javac_install() %{expand:
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
@@ -616,7 +616,9 @@ for X in %{origin} %{javaver} ; do
done
update-alternatives --install %{_jvmdir}/java-%{javaver}-%{origin}
java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family
%{name}.%{_arch}
+}
+%define post_devel() %{expand:
update-desktop-database %{_datadir}/applications &> /dev/null || :
/bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || :
@@ -639,11 +641,11 @@ exit 0
}
%define posttrans_devel() %{expand:
+%{alternatives_javac_install -- %{?1}}
%{update_desktop_icons}
}
-%define post_javadoc() %{expand:
-
+%define alternatives_javadoc_install() %{expand:
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
@@ -660,8 +662,7 @@ exit 0
exit 0
}
-%define post_javadoc_zip() %{expand:
-
+%define alternatives_javadoczip_install() %{expand:
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
@@ -2419,6 +2420,9 @@ cjc.mainProgram(args)
%posttrans
%{posttrans_script %{nil}}
+%posttrans headless
+%{alternatives_java_install %{nil}}
+
%post devel
%{post_devel %{nil}}
@@ -2428,14 +2432,14 @@ cjc.mainProgram(args)
%posttrans devel
%{posttrans_devel %{nil}}
-%post javadoc
-%{post_javadoc %{nil}}
+%posttrans javadoc
+%{alternatives_javadoc_install %{nil}}
%postun javadoc
%{postun_javadoc %{nil}}
-%post javadoc-zip
-%{post_javadoc_zip %{nil}}
+%posttrans javadoc-zip
+%{alternatives_javadoczip_install %{nil}}
%postun javadoc-zip
%{postun_javadoc_zip %{nil}}
@@ -2448,6 +2452,9 @@ cjc.mainProgram(args)
%post headless-slowdebug
%{post_headless -- %{debug_suffix_unquoted}}
+%posttrans headless-slowdebug
+%{alternatives_java_install -- %{debug_suffix_unquoted}}
+
%postun slowdebug
%{postun_script -- %{debug_suffix_unquoted}}
@@ -2483,6 +2490,9 @@ cjc.mainProgram(args)
%posttrans fastdebug
%{posttrans_script -- %{fastdebug_suffix_unquoted}}
+%posttrans headless-fastdebug
+%{alternatives_java_install -- %{fastdebug_suffix_unquoted}}
+
%post devel-fastdebug
%{post_devel -- %{fastdebug_suffix_unquoted}}
@@ -2580,6 +2590,12 @@ cjc.mainProgram(args)
%endif
%changelog
+* Mon Aug 30 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.302.b08-2
+- alternatives creation moved to posttrans
+- Thus fixing the old reisntall issue:
+-
https://bugzilla.redhat.com/show_bug.cgi?id=1200302
+-
https://bugzilla.redhat.com/show_bug.cgi?id=1976053
+
* Sun Aug 08 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b08-1
- Remove non-Free test and demo files from source tarball.
commit 1b05b0ca2a1c58fa9eeee68440d19506bb238846
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Sun Aug 8 05:21:18 2021 +0100
Remove non-Free test and demo files from source tarball.
diff --git a/.gitignore b/.gitignore
index a4aa037..67c9eb6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -238,3 +238,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b06-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b07-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b08-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b08-4curve-clean.tar.xz
diff --git a/generate_source_tarball.sh b/generate_source_tarball.sh
index 94b75e7..e9eed11 100755
--- a/generate_source_tarball.sh
+++ b/generate_source_tarball.sh
@@ -19,12 +19,25 @@
# level folder, name is created, based on parameter
#
+SCRIPT_DIR=$(dirname $0)
+JCONSOLE_JS_PATCH_DEFAULT=${SCRIPT_DIR}/jconsole-plugin.patch
+
if [ ! "x$PR3822" = "x" ] ; then
if [ ! -f "$PR3822" ] ; then
- echo "You have specified PR3822 as $PR3822 but it does not exists.
exiting"
+ echo "You have specified PR3822 as $PR3822 but it does not exist. Exiting"
exit 1
fi
fi
+
+if [ "x${JCONSOLE_JS_PATCH}" != "x" ] ; then
+ if [ ! -f "${JCONSOLE_JS_PATCH}" ] ; then
+ echo "You have specified the jconsole.js patch as ${JCONSOLE_JS_PATCH} but it does
not exist. Exiting.";
+ exit 2;
+ fi
+else
+ JCONSOLE_JS_PATCH=${JCONSOLE_JS_PATCH_DEFAULT}
+fi
+
set -e
OPENJDK_URL_DEFAULT=http://hg.openjdk.java.net
@@ -42,6 +55,7 @@ if [ "x$1" = "xhelp" ] ; then
echo "FILE_NAME_ROOT - name of the archive, minus extensions (optional; defaults
to PROJECT_NAME-REPO_NAME-VERSION)"
echo "REPO_ROOT - the location of the Mercurial repository to archive (optional;
defaults to OPENJDK_URL/PROJECT_NAME/REPO_NAME)"
echo "PR3822 - the path to the PR3822 patch to apply (optional; downloaded if
unavailable)"
+ echo "JCONSOLE_JS_PATCH - the path to a patch to fix non-availiability of
jconsole.js (optional; defaults to ${JCONSOLE_JS_PATCH_DEFAULT})"
echo "REPOS - specify the repositories to use (optional; defaults to
${REPOS_DEFAULT})"
exit 1;
fi
@@ -88,6 +102,22 @@ if [ "x$REPO_ROOT" = "x" ] ; then
REPO_ROOT="${OPENJDK_URL}/${PROJECT_NAME}/${REPO_NAME}"
echo "No repository root specified; default to ${REPO_ROOT}"
fi;
+if [ "x$REPOS" = "x" ] ; then
+ REPOS=${REPOS_DEFAULT}
+ echo "No repositories specified; defaulting to ${REPOS}"
+fi;
+
+echo -e "Settings:"
+echo -e "\tVERSION: ${VERSION}"
+echo -e "\tPROJECT_NAME: ${PROJECT_NAME}"
+echo -e "\tREPO_NAME: ${REPO_NAME}"
+echo -e "\tOPENJDK_URL: ${OPENJDK_URL}"
+echo -e "\tCOMPRESSION: ${COMPRESSION}"
+echo -e "\tFILE_NAME_ROOT: ${FILE_NAME_ROOT}"
+echo -e "\tREPO_ROOT: ${REPO_ROOT}"
+echo -e "\tPR3822: ${PR3822}"
+echo -e "\tJCONSOLE_JS_PATCH: ${JCONSOLE_JS_PATCH}"
+echo -e "\tREPOS: ${REPOS}"
mkdir "${FILE_NAME_ROOT}"
pushd "${FILE_NAME_ROOT}"
@@ -96,22 +126,22 @@ echo "Cloning ${VERSION} root repository from
${REPO_ROOT}"
hg clone ${REPO_ROOT} openjdk -r ${VERSION}
pushd openjdk
-
-if [ "x$REPOS" = "x" ] ; then
- repos=${REPOS_DEFAULT}
- echo "No repositories specified; defaulting to ${repos}"
-else
- repos=$REPOS
- echo "Repositories: ${repos}"
-fi;
-
-for subrepo in $repos
+for subrepo in ${REPOS}
do
echo "Cloning ${VERSION} ${subrepo} repository from ${REPO_ROOT}"
hg clone ${REPO_ROOT}/${subrepo} -r ${VERSION}
done
-if [ -d jdk ]; then
+# UnderlineTaglet.java has a BSD license with a field-of-use restriction, making it
non-Free
+if [ -d langtools ] ; then
+ echo "Removing langtools test case with non-Free license"
+ rm -vf langtools/test/tools/javadoc/api/basic/TagletPathTest.java
+ rm -vf langtools/test/tools/javadoc/api/basic/taglets/UnderlineTaglet.java
+fi
+if [ -d jdk ]; then
+# jconsole.js has a BSD license with a field-of-use restriction, making it non-Free
+echo "Removing jconsole-plugin file with non-Free license"
+rm -vf jdk/src/share/demo/scripting/jconsole-plugin/src/resources/jconsole.js
echo "Removing EC source code we don't build"
rm -vf jdk/src/share/native/sun/security/ec/impl/ec2.h
rm -vf jdk/src/share/native/sun/security/ec/impl/ec2_163.c
@@ -123,7 +153,6 @@ rm -vf jdk/src/share/native/sun/security/ec/impl/ecp_192.c
rm -vf jdk/src/share/native/sun/security/ec/impl/ecp_224.c
echo "Syncing EC list with NSS"
-
if [ "x$PR3822" = "x" ] ; then
# get pr3822.patch (from
http://icedtea.classpath.org/hg/icedtea8) from most correct tag
# Do not push it or publish it (see
http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=3822)
@@ -135,6 +164,10 @@ else
patch -Np1 < $PR3822
fi;
fi
+
+echo "Patching out use of jconsole.js"
+patch -Np1 < ${JCONSOLE_JS_PATCH}
+
find . -name '*.orig' -exec rm -vf '{}' ';'
popd
@@ -144,7 +177,7 @@ if [ "X$COMPRESSION" = "Xxz" ] ; then
else
SWITCH=czf
fi
-TARBALL_NAME=${FILE_NAME_ROOT}-4curve.tar.${COMPRESSION}
+TARBALL_NAME=${FILE_NAME_ROOT}-4curve-clean.tar.${COMPRESSION}
tar --exclude-vcs -$SWITCH ${TARBALL_NAME} openjdk
mv ${TARBALL_NAME} ..
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index b5067ff..53718f7 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -309,7 +309,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 0
+%global rpmrelease 1
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1202,7 +1202,7 @@ Provides: java-%{origin}-src%{?1} = %{epoch}:%{version}-%{release}
Name: java-%{javaver}-%{origin}
Version: %{javaver}.%{updatever}.%{buildver}
-Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}.1
+Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
# java-1.5.0-ibm from
jpackage.org set Epoch to 1 for unknown reasons
# and this change was brought into RHEL-4. java-1.5.0-ibm packages
# also included the epoch in their virtual provides. This created a
@@ -1237,7 +1237,7 @@ URL:
http://openjdk.java.net/
# FILE_NAME_ROOT=%%{shenandoah_project}-%%{shenandoah_repo}-${VERSION}
# REPO_ROOT=<path to checked-out repository> generate_source_tarball.sh
# where the source is obtained from
http://hg.openjdk.java.net/%%{project}/%%{repo}
-Source0: %{shenandoah_project}-%{shenandoah_repo}-%{shenandoah_revision}-4curve.tar.xz
+Source0:
%{shenandoah_project}-%{shenandoah_repo}-%{shenandoah_revision}-4curve-clean.tar.xz
# Custom README for -src subpackage
Source2: README.md
@@ -2580,6 +2580,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Sun Aug 08 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b08-1
+- Remove non-Free test and demo files from source tarball.
+
* Thu Jul 22 2021 Fedora Release Engineering <releng(a)fedoraproject.org> -
1:1.8.0.302.b08-0.1
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
diff --git a/jconsole-plugin.patch b/jconsole-plugin.patch
new file mode 100644
index 0000000..b015a78
--- /dev/null
+++ b/jconsole-plugin.patch
@@ -0,0 +1,31 @@
+diff --git openjdk.orig/jdk/src/share/demo/scripting/jconsole-plugin/README.txt
openjdk/jdk/src/share/demo/scripting/jconsole-plugin/README.txt
+--- openjdk.orig/jdk/src/share/demo/scripting/jconsole-plugin/README.txt
++++ openjdk/jdk/src/share/demo/scripting/jconsole-plugin/README.txt
+@@ -18,11 +18,9 @@
+ engine javax.script.ScriptEngine
+ plugin com.sun.tools.jconsole.JConsolePlugin
+
+-If you use JavaScript, there are many useful global functions defined in
+-./src/resources/jconsole.js. This is built into the script plugin jar file.
+-In addition, you can add other global functions and global variables by
+-defining those in ~/jconsole.js (or jconsole.<ext> where <ext> is the file
+-extension for your scripting language of choice under your home directory).
++You can add global functions and global variables by defining those in
++~/jconsole.js (or jconsole.<ext> where <ext> is the file extension for
++your scripting language of choice under your home directory).
+
+ How do I compile script console plugin?
+
+diff --git openjdk.orig/jdk/src/share/demo/scripting/jconsole-plugin/build.xml
openjdk/jdk/src/share/demo/scripting/jconsole-plugin/build.xml
+--- openjdk.orig/jdk/src/share/demo/scripting/jconsole-plugin/build.xml
++++ openjdk/jdk/src/share/demo/scripting/jconsole-plugin/build.xml
+@@ -73,9 +73,6 @@
+ <copy todir="${classes.dir}/META-INF/services">
+ <fileset dir="${src.dir}/META-INF/services"/>
+ </copy>
+- <copy todir="${resources.dir}">
+- <fileset dir="${src.dir}/resources"/>
+- </copy>
+ </target>
+
+ <target name="all" depends="compile" description="buile
deployment bundle">
diff --git a/sources b/sources
index 0357887..3236329 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b08-4curve.tar.xz) =
938b3308357c5be40fd474e861f5a612e758520988588b633791ada742fdaef522ecc05f4b2a0c40799a01e1b5d33960c1b76deb2089e36b6d92b0788a74bf74
+SHA512
(aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b08-4curve-clean.tar.xz) =
04ecdcde841038c0042b44fb3c5303a08616864566fb918ab261fc381fae8804a21f875b1645538e864a1c6db5985f16dfc13b91eb1caeeab54d6d07828c7657
commit dc1cbfccd17474ddb687e2c0166e3d607048c2d0
Author: Fedora Release Engineering <releng(a)fedoraproject.org>
Date: Thu Jul 22 08:56:33 2021 +0000
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng(a)fedoraproject.org>
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 6b3d66a..b5067ff 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -1202,7 +1202,7 @@ Provides: java-%{origin}-src%{?1} = %{epoch}:%{version}-%{release}
Name: java-%{javaver}-%{origin}
Version: %{javaver}.%{updatever}.%{buildver}
-Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
+Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}.1
# java-1.5.0-ibm from
jpackage.org set Epoch to 1 for unknown reasons
# and this change was brought into RHEL-4. java-1.5.0-ibm packages
# also included the epoch in their virtual provides. This created a
@@ -2580,6 +2580,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Jul 22 2021 Fedora Release Engineering <releng(a)fedoraproject.org> -
1:1.8.0.302.b08-0.1
+- Rebuilt for
https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
* Fri Jul 16 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b08-0
- Update to aarch64-shenandoah-jdk8u302-b08 (EA)
- Update release notes for 8u302-b08.
commit 3c6c1a2a272320b06c338486ede63b378a403ef4
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Wed Jul 21 01:28:21 2021 +0100
Update to aarch64-shenandoah-jdk8u302-b08 (EA)
Update release notes for 8u302-b08.
Switch to GA mode for final release.
diff --git a/.gitignore b/.gitignore
index d479a9c..a4aa037 100644
--- a/.gitignore
+++ b/.gitignore
@@ -237,3 +237,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b05-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b06-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b07-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b08-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 0c08ae6..1cb973a 100644
--- a/NEWS
+++ b/NEWS
@@ -10,6 +10,20 @@ Live versions of these release notes can be found at:
*
https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u302.txt
* Security fixes
+ - JDK-8256157: Improve bytecode assembly
+ - JDK-8256491: Better HTTP transport
+ - JDK-8258432, CVE-2021-2341: Improve file transfers
+ - JDK-8260453: Improve Font Bounding
+ - JDK-8260960: Signs of jarsigner signing
+ - JDK-8260967, CVE-2021-2369: Better jar file validation
+ - JDK-8262380: Enhance XML processing passes
+ - JDK-8262403: Enhanced data transfer
+ - JDK-8262410: Enhanced rules for zones
+ - JDK-8262477: Enhance String Conclusions
+ - JDK-8262967: Improve Zip file support
+ - JDK-8264066, CVE-2021-2388: Enhance compiler validation
+ - JDK-8264079: Improve abstractions
+ - JDK-8264460: Improve NTLM support
* Other changes
- JDK-6878250: (so) IllegalBlockingModeException thrown when reading from a closed
SocketChannel's InputStream
- JDK-6990210: [TEST_BUG]
EventDispatchThread/HandleExceptionOnEDT/HandleExceptionOnEDT.java fails on gnome
@@ -144,6 +158,7 @@ Live versions of these release notes can be found at:
- JDK-8268444: keytool -v -list print is incorrect after backport JDK-8141457
- JDK-8269388: Default build of OpenJDK 8 fails on newer GCCs with warnings as errors
on format-overflow
- JDK-8269468: JDK-8269388 breaks the build on older GCCs
+ - JDK-8270533: AArch64: size_fits_all_mem_uses should return false if its output is a
CAS
* Shenandoah
- [backport] JDK-8259580: Shenandoah: uninitialized label in VerifyThreadGCState
- [backport] JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 4e3f4ae..6b3d66a 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -294,7 +294,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u302-b07
+%global shenandoah_revision aarch64-shenandoah-jdk8u302-b08
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -314,7 +314,7 @@
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
# - N%%{?extraver}{?dist} for GA releases
-%global is_ga 0
+%global is_ga 1
%if %{is_ga}
%global milestone fcs
%global milestone_version %{nil}
@@ -2580,6 +2580,11 @@ cjc.mainProgram(args)
%endif
%changelog
+* Fri Jul 16 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b08-0
+- Update to aarch64-shenandoah-jdk8u302-b08 (EA)
+- Update release notes for 8u302-b08.
+- Switch to GA mode for final release.
+
* Thu Jul 08 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b07-0.0.ea
- Update to aarch64-shenandoah-jdk8u302-b07 (EA)
- Update release notes for 8u302-b07.
diff --git a/sources b/sources
index 0760ba5..0357887 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b07-4curve.tar.xz) =
a228681a8b5fa437b9b0e2da5ce4ef1fa27b7cfcc639a375f499339479e10f68e422b69eda4a7db661769c8ef1290586c200c2d0197ec72cb56d99b4765f2c08
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b08-4curve.tar.xz) =
938b3308357c5be40fd474e861f5a612e758520988588b633791ada742fdaef522ecc05f4b2a0c40799a01e1b5d33960c1b76deb2089e36b6d92b0788a74bf74
commit bc8a2c217a304e6ac5cdf6fb1eec21b72dad4f78
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Thu Jul 8 02:37:19 2021 +0100
Update to aarch64-shenandoah-jdk8u302-b07 (EA)
Update release notes for 8u302-b07.
diff --git a/.gitignore b/.gitignore
index cce8a4d..d479a9c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -236,3 +236,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b04-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b05-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b06-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b07-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 541c395..0c08ae6 100644
--- a/NEWS
+++ b/NEWS
@@ -142,6 +142,8 @@ Live versions of these release notes can be found at:
- JDK-8267545: [8u] Enable Xcode 12 builds on macOS
- JDK-8267689: [aarch64] Crash due to bad shift in indirect addressing mode
- JDK-8268444: keytool -v -list print is incorrect after backport JDK-8141457
+ - JDK-8269388: Default build of OpenJDK 8 fails on newer GCCs with warnings as errors
on format-overflow
+ - JDK-8269468: JDK-8269388 breaks the build on older GCCs
* Shenandoah
- [backport] JDK-8259580: Shenandoah: uninitialized label in VerifyThreadGCState
- [backport] JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
@@ -173,7 +175,7 @@ Distinguished Name: OU=VeriSign Trust Network, OU="(c) 1998
VeriSign, Inc. - For
Alias Name: verisignclass3ca [jdk]
Distinguished Name: OU=Class 3 Public Primary Certification Authority, O="VeriSign,
Inc.", C=US
-Alias Name: verisignclass3g2caÂ[jdk]
+Alias Name: verisignclass3g2ca [jdk]
Distinguished Name: OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For
authorized use only", OU=Class 3 Public Primary Certification Authority - G2,
O="VeriSign, Inc.", C=US
Alias Name: verisigntsaca [jdk]
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 93ed221..4e3f4ae 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -294,7 +294,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u302-b06
+%global shenandoah_revision aarch64-shenandoah-jdk8u302-b07
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -2580,6 +2580,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Jul 08 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b07-0.0.ea
+- Update to aarch64-shenandoah-jdk8u302-b07 (EA)
+- Update release notes for 8u302-b07.
+
* Tue Jul 06 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b06-0.0.ea
- Update to aarch64-shenandoah-jdk8u302-b06 (EA)
- Update release notes for 8u302-b06.
diff --git a/sources b/sources
index 84c12ad..0760ba5 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b06-4curve.tar.xz) =
d6dfc358151a11c1ce81aabae82aba2b57f020be21100eb4b29fc4cc16bd13865450a36642cef8755fddbfde5a355c9001fbb6338ccab370b2ab9f38125ecdc8
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b07-4curve.tar.xz) =
a228681a8b5fa437b9b0e2da5ce4ef1fa27b7cfcc639a375f499339479e10f68e422b69eda4a7db661769c8ef1290586c200c2d0197ec72cb56d99b4765f2c08
commit 35d7fdc77fc07278dc058a3977e50eb5ce318246
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Tue Jul 6 17:31:13 2021 +0100
Update to aarch64-shenandoah-jdk8u302-b06 (EA)
Update release notes for 8u302-b06.
diff --git a/.gitignore b/.gitignore
index c99d462..cce8a4d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -235,3 +235,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b03-shenandoah-merge-2021-06-23-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b04-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b05-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b06-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 734417e..541c395 100644
--- a/NEWS
+++ b/NEWS
@@ -139,7 +139,9 @@ Live versions of these release notes can be found at:
- JDK-8266929: Unable to use algorithms from 3p providers
- JDK-8267235: [macos_aarch64] InterpreterRuntime::throw_pending_exception messing up
LR results in crash
- JDK-8267426: MonitorVmStartTerminate test timed out on Embedded VM
+ - JDK-8267545: [8u] Enable Xcode 12 builds on macOS
- JDK-8267689: [aarch64] Crash due to bad shift in indirect addressing mode
+ - JDK-8268444: keytool -v -list print is incorrect after backport JDK-8141457
* Shenandoah
- [backport] JDK-8259580: Shenandoah: uninitialized label in VerifyThreadGCState
- [backport] JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
@@ -204,6 +206,10 @@ U+000007F that were previously encoded using UTF-8 may need to
either
be modified to perform the UTF-8 conversion, or set the Java security
property `jdk.tls.alpnCharset` to "UTF-8" revert the behavior.
+See the updated guide at
+https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/alpn.html
+for more information.
+
JDK-8244460: Support for certificate_authorities Extension
==========================================================
The "certificate_authorities" extension is an optional extension
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 93ed25b..93ed221 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -294,7 +294,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u302-b05
+%global shenandoah_revision aarch64-shenandoah-jdk8u302-b06
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -309,7 +309,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 1
+%global rpmrelease 0
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -2580,6 +2580,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Tue Jul 06 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b06-0.0.ea
+- Update to aarch64-shenandoah-jdk8u302-b06 (EA)
+- Update release notes for 8u302-b06.
+
* Mon Jul 05 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b05-0.1.ea
- Use the "reverse" build loop (debug first) as the main and only build loop to
get more diagnostics.
diff --git a/sources b/sources
index 33af4d9..84c12ad 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b05-4curve.tar.xz) =
4034420e63d98b2268ee6c762a2c79528271d42e7c423a1fd27147e5e8479b2af94345bccae6a09789397627ff5c34ae77e010a30ae042c62df3d7e79a24fe8c
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b06-4curve.tar.xz) =
d6dfc358151a11c1ce81aabae82aba2b57f020be21100eb4b29fc4cc16bd13865450a36642cef8755fddbfde5a355c9001fbb6338ccab370b2ab9f38125ecdc8
commit 6d4aec5be31a2ee84462910806f8a3daffa8e188
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Mon Jul 5 23:09:44 2021 +0100
Use the "reverse" build loop (debug first) as the main and only build loop
to get more diagnostics.
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index d14175c..93ed25b 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -138,10 +138,8 @@
%global bootstrap_build 1
# If you disable both builds, then the build fails
-# Note that the debug build requires the normal build for docs
-%global build_loop %{normal_build} %{fastdebug_build} %{slowdebug_build}
-# Test slowdebug first as it provides the best diagnostics
-%global rev_build_loop %{slowdebug_build} %{fastdebug_build} %{normal_build}
+# Build and test slowdebug first as it provides the best diagnostics
+%global build_loop %{slowdebug_build} %{fastdebug_build} %{normal_build}
%global bootstrap_targets images
%global release_targets images docs-zip
@@ -311,7 +309,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 0
+%global rpmrelease 1
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -2058,7 +2056,7 @@ done
%check
# We test debug first as it will give better diagnostics on a crash
-for suffix in %{rev_build_loop} ; do
+for suffix in %{build_loop} ; do
export JAVA_HOME=$(pwd)/%{buildoutputdir -- $suffix}/images/%{jdkimage}
@@ -2582,6 +2580,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Mon Jul 05 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b05-0.1.ea
+- Use the "reverse" build loop (debug first) as the main and only build loop to
get more diagnostics.
+
* Fri Jul 02 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b05-0.0.ea
- Update to aarch64-shenandoah-jdk8u302-b05 (EA)
- Update release notes for 8u302-b05.
commit 148101f0bc5a9edf7b8a05cc5c855ceabc643c13
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Fri Jul 2 17:28:26 2021 +0100
Update to aarch64-shenandoah-jdk8u302-b05 (EA)
Update release notes for 8u302-b05.
diff --git a/.gitignore b/.gitignore
index f3bf720..c99d462 100644
--- a/.gitignore
+++ b/.gitignore
@@ -234,3 +234,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b03-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b03-shenandoah-merge-2021-06-23-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b04-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b05-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 5bcec36..734417e 100644
--- a/NEWS
+++ b/NEWS
@@ -12,25 +12,37 @@ Live versions of these release notes can be found at:
* Security fixes
* Other changes
- JDK-6878250: (so) IllegalBlockingModeException thrown when reading from a closed
SocketChannel's InputStream
+ - JDK-6990210: [TEST_BUG]
EventDispatchThread/HandleExceptionOnEDT/HandleExceptionOnEDT.java fails on gnome
- JDK-7059970: Test case: javax/imageio/plugins/png/ITXtTest.java is not closing a
file
+ - JDK-7106851: Test should not use System.exit
- JDK-8019470: Changes needed to compile JDK 8 on MacOS with clang compiler
+ - JDK-8028618: [TEST BUG] javax/swing/JScrollBar/bug4202954/bug4202954.java fails
- JDK-8030123: java/beans/Introspector/Test8027648.java fails
- JDK-8032050: Clean up for
java/rmi/activation/Activatable/shutdownGracefully/ShutdownGracefully.java
- JDK-8033289: clang: clean up unused function warning
- JDK-8034856: gcc warnings compiling src/solaris/native/sun/security/pkcs11
- JDK-8034857: gcc warnings compiling src/solaris/native/sun/management
+ - JDK-8035000: clean up ActivationLibrary.DestroyThread
- JDK-8035054: JarFacade.c should not include ctype.h
+ - JDK-8035287: gcc warnings compiling various libraries files
- JDK-8036095: RMI tests using testlibrary.RMID and testlibrary.JavaVM do not pass
through vmoptions
+ - JDK-8037825: Fix warnings and enable "warnings as errors" in serviceability
native libraries
- JDK-8042891: Format issues embedded in macros for two g1 source files
- JDK-8043264: hsdis library not picked up correctly on expected paths
+ - JDK-8043646: libosxapp.dylib fails to build on Mac OS 10.9 with clang
+ - JDK-8047939: [TESTBUG] Rewrite test/runtime/8001071/Test8001071.sh
- JDK-8055754: filemap.cpp does not compile with clang
- JDK-8064909: FragmentMetaspace.java got OutOfMemoryError
- JDK-8066508: JTReg tests timeout on slow devices when run using JPRT
- JDK-8066807: langtools/test/Makefile should use -agentvm not -samevm
- JDK-8071374: -XX:+PrintAssembly -XX:+PrintSignatureHandlers crash fastdebug VM with
assert(limit == __null || limit <= nm->code_end()) in RelocIterator::initialize
- JDK-8073446: TimeZone getOffset API does not return a dst offset between years
2038-2137
+ - JDK-8074835: Resolve disabled warnings for libj2gss
+ - JDK-8074836: Resolve disabled warnings for libosxkrb5
- JDK-8075071: [TEST_BUG] TimSortStackSize2.java: OOME: Java heap space: MaxHeap
shrinked by MaxRAMFraction
- JDK-8077364: "if( !this )" construct prevents build on Xcode 6.3
+ - JDK-8078855: [TEST_BUG] javax/swing/JComboBox/8032878/bug8032878.java fails in
WindowsClassicLookAndFeel
+ - JDK-8081764: [TEST_BUG] Test javax/swing/plaf/aqua/CustomComboBoxFocusTest.java fails
on Windows, Solaris Sparcv9 and Linux but passes on MacOSX
- JDK-8129511: PlatformMidi.c:83 uses malloc without malloc header
- JDK-8130308: Too low memory usage in
TestPromotionFromSurvivorToTenuredAfterMinorGC.java
- JDK-8130430: [TEST_BUG] remove unnecessary internal calls from
javax/swing/JRadioButton/8075609/bug8075609.java
@@ -44,6 +56,7 @@ Live versions of these release notes can be found at:
- JDK-8159898: Negative array size in java/beans/Introspector/Test8027905.java
- JDK-8166046: [TESTBUG] compiler/stringopts/TestStringObjectInitialization.java fails
with OOME
- JDK-8166724: gc/g1/TestHumongousShrinkHeap.java fails with OOME
+ - JDK-8172188: JDI tests fail due to "permission denied" when creating temp
file
- JDK-8177809: File.lastModified() is losing milliseconds (always ends in 000)
- JDK-8178403: DirectAudio in JavaSound may hang and leak
- JDK-8180478: tools/launcher/MultipleJRE.sh fails on Windows because of
extra-''
@@ -51,8 +64,10 @@ Live versions of these release notes can be found at:
- JDK-8190332: PngReader throws NegativeArraySizeException/OOM error when IHDR width is
very large
- JDK-8190679: java/util/Arrays/TimSortStackSize2.java fails with "Initial heap
size set to a larger value than the maximum heap size"
- JDK-8191955: AArch64: incorrect prefetch distance causes an internal error
+ - JDK-8196092: javax/swing/JComboBox/8032878/bug8032878.java fails
- JDK-8199265: java/util/Arrays/TimSortStackSize2.java fails with OOM
- JDK-8200550: Xcode 9.3 produce warning -Wexpansion-to-defined
+ - JDK-8202299: Java Keystore fails to load PKCS12/PFX certificates created in
WindowsServer2016
- JDK-8203196: C1 emits incorrect code due to integer overflow in _tableswitch keys
- JDK-8205014: com/sun/jndi/ldap/DeadSSLLdapTimeoutTest.java failed with "Read
timed out"
- JDK-8206243: java -XshowSettings fails if memory.limit_in_bytes overflows LONG.max
@@ -69,14 +84,19 @@ Live versions of these release notes can be found at:
- JDK-8231841: AArch64: debug.cpp help() is missing an AArch64 line for pns
- JDK-8231949: [PPC64, s390]: Make async profiling more reliable
- JDK-8234011: (zipfs) Memory leak in ZipFileSystem.releaseDeflater()
+ - JDK-8239053: [8u] clean up undefined-var-template warnings
+ - JDK-8239400: [8u] clean up undefined-var-template warnings
- JDK-8241649: Optimize Character.toString
- JDK-8241829: Cleanup the code for PrinterJob on windows
- JDK-8242565: Policy initialization issues when the denyAfter constraint is enabled
- JDK-8243559: Remove root certificates with 1024-bit keys
- JDK-8247350: [aarch64] assert(false) failed: wrong size of mach node
+ - JDK-8249142: java/awt/FontClass/CreateFont/DeleteFont.sh is unstable
- JDK-8249278: Revert JDK-8226253 which breaks the spec of AccessibleState.SHOWING for
JList
+ - JDK-8250876: Fix issues with cross-compile on macos
- JDK-8252883: AccessDeniedException caused by delayed file deletion on Windows
- JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
+ - JDK-8254631: Better support ALPN byte wire values in SunJSSE
- JDK-8255086: Update the root locale display names
- JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
- JDK-8256818: SSLSocket that is never bound or connected leaks socket resources
@@ -110,10 +130,16 @@ Live versions of these release notes can be found at:
- JDK-8264562: assert(verify_field_bit(1)) failed: Attempting to write an uninitialized
event field: type
- JDK-8264640: CMS ParScanClosure misses a barrier
- JDK-8264816: Weak handles leak causes GC to take longer
+ - JDK-8265462: Handle multiple slots in the NSS Internal Module from SunPKCS11's
Secmod
- JDK-8265666: Enable AIX build platform to make external debug symbols
- JDK-8265832: runtime/StackGap/testme.sh fails to compile in 8u
- JDK-8265988: Fix sun/text/IntHashtable/Bug4170614 for JDK 8u
- JDK-8266191: Missing aarch64 parts of JDK-8181872 (C1: possible overflow when
strength reducing integer multiply by constant)
+ - JDK-8266723: JFR periodic events are causing extra allocations
+ - JDK-8266929: Unable to use algorithms from 3p providers
+ - JDK-8267235: [macos_aarch64] InterpreterRuntime::throw_pending_exception messing up
LR results in crash
+ - JDK-8267426: MonitorVmStartTerminate test timed out on Embedded VM
+ - JDK-8267689: [aarch64] Crash due to bad shift in indirect addressing mode
* Shenandoah
- [backport] JDK-8259580: Shenandoah: uninitialized label in VerifyThreadGCState
- [backport] JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
@@ -161,6 +187,23 @@ Distinguished Name: CN=Sonera Class2 CA, O=Sonera, C=FI
security-libs/javax.net.ssl:
+JDK-8257548: Improve Encoding of TLS Application-Layer Protocol Negotiation (ALPN)
Values
+=========================================================================================
+Certain TLS ALPN values couldn't be properly read or written by the
+SunJSSE provider. This is due to the choice of Strings as the API
+interface and the undocumented internal use of the UTF-8 Character Set
+which converts characters larger than U+00007F (7-bit ASCII) into
+multi-byte arrays that may not be expected by a peer.
+
+ALPN values are now represented using the network byte representation
+expected by the peer, which should require no modification for
+standard 7-bit ASCII-based character Strings. However, SunJSSE now
+encodes/decodes String characters as 8-bit ISO_8859_1/LATIN-1
+characters. This means applications that used characters above
+U+000007F that were previously encoded using UTF-8 may need to either
+be modified to perform the UTF-8 conversion, or set the Java security
+property `jdk.tls.alpnCharset` to "UTF-8" revert the behavior.
+
JDK-8244460: Support for certificate_authorities Extension
==========================================================
The "certificate_authorities" extension is an optional extension
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index c710d66..d14175c 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -296,7 +296,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u302-b04
+%global shenandoah_revision aarch64-shenandoah-jdk8u302-b05
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -2582,6 +2582,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Fri Jul 02 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b05-0.0.ea
+- Update to aarch64-shenandoah-jdk8u302-b05 (EA)
+- Update release notes for 8u302-b05.
+
* Wed Jun 30 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b04-0.0.ea
- Update to aarch64-shenandoah-jdk8u302-b04 (EA)
- Update release notes for 8u302-b04.
diff --git a/sources b/sources
index 07a777b..33af4d9 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b04-4curve.tar.xz) =
4b49ae51eb4366e7b812ea9cd852af2ed0aa6b7b5a720598ecd3a7734968fa135e3d68b2ec9439b169e6197205b715763adf247831455163d63955d418a14c83
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b05-4curve.tar.xz) =
4034420e63d98b2268ee6c762a2c79528271d42e7c423a1fd27147e5e8479b2af94345bccae6a09789397627ff5c34ae77e010a30ae042c62df3d7e79a24fe8c
commit cf02803a5d818c01958016936b768dbb9aca777b
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Thu Jul 1 05:31:56 2021 +0100
Update to aarch64-shenandoah-jdk8u302-b04 (EA)
Update release notes for 8u302-b04.
diff --git a/.gitignore b/.gitignore
index 6957bb8..f3bf720 100644
--- a/.gitignore
+++ b/.gitignore
@@ -233,3 +233,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b02-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b03-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b03-shenandoah-merge-2021-06-23-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b04-4curve.tar.xz
diff --git a/NEWS b/NEWS
index d4bc4d7..5bcec36 100644
--- a/NEWS
+++ b/NEWS
@@ -15,12 +15,14 @@ Live versions of these release notes can be found at:
- JDK-7059970: Test case: javax/imageio/plugins/png/ITXtTest.java is not closing a
file
- JDK-8019470: Changes needed to compile JDK 8 on MacOS with clang compiler
- JDK-8030123: java/beans/Introspector/Test8027648.java fails
+ - JDK-8032050: Clean up for
java/rmi/activation/Activatable/shutdownGracefully/ShutdownGracefully.java
- JDK-8033289: clang: clean up unused function warning
- JDK-8034856: gcc warnings compiling src/solaris/native/sun/security/pkcs11
- JDK-8034857: gcc warnings compiling src/solaris/native/sun/management
- JDK-8035054: JarFacade.c should not include ctype.h
- JDK-8036095: RMI tests using testlibrary.RMID and testlibrary.JavaVM do not pass
through vmoptions
- JDK-8042891: Format issues embedded in macros for two g1 source files
+ - JDK-8043264: hsdis library not picked up correctly on expected paths
- JDK-8055754: filemap.cpp does not compile with clang
- JDK-8064909: FragmentMetaspace.java got OutOfMemoryError
- JDK-8066508: JTReg tests timeout on slow devices when run using JPRT
@@ -31,6 +33,7 @@ Live versions of these release notes can be found at:
- JDK-8077364: "if( !this )" construct prevents build on Xcode 6.3
- JDK-8129511: PlatformMidi.c:83 uses malloc without malloc header
- JDK-8130308: Too low memory usage in
TestPromotionFromSurvivorToTenuredAfterMinorGC.java
+ - JDK-8130430: [TEST_BUG] remove unnecessary internal calls from
javax/swing/JRadioButton/8075609/bug8075609.java
- JDK-8132148: G1 hs_err region dump legend out of sync with region values
- JDK-8132709: [TESTBUG] gc/g1/TestHumongousShrinkHeap.java might fail on embedded
- JDK-8134672: [TEST_BUG] Some tests should check isDisplayChangeSupported
@@ -52,12 +55,15 @@ Live versions of these release notes can be found at:
- JDK-8200550: Xcode 9.3 produce warning -Wexpansion-to-defined
- JDK-8203196: C1 emits incorrect code due to integer overflow in _tableswitch keys
- JDK-8205014: com/sun/jndi/ldap/DeadSSLLdapTimeoutTest.java failed with "Read
timed out"
+ - JDK-8206243: java -XshowSettings fails if memory.limit_in_bytes overflows LONG.max
+ - JDK-8206925: Support the certificate_authorities extension
- JDK-8209996: [PPC64] Fix JFR profiling
- JDK-8214345: infinite recursion while checking super class
- JDK-8217230: assert(t == t_no_spec) failure in
NodeHash::check_no_speculative_types()
- JDK-8217348: assert(thread->is_Java_thread()) failed: just checking
- JDK-8225081: Remove Telia Company CA certificate expiring in April 2021
- JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
+ - JDK-8228757: Fail fast if the handshake type is unknown
- JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
- JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails intermittently with NPE
- JDK-8231841: AArch64: debug.cpp help() is missing an AArch64 line for pns
@@ -65,13 +71,16 @@ Live versions of these release notes can be found at:
- JDK-8234011: (zipfs) Memory leak in ZipFileSystem.releaseDeflater()
- JDK-8241649: Optimize Character.toString
- JDK-8241829: Cleanup the code for PrinterJob on windows
+ - JDK-8242565: Policy initialization issues when the denyAfter constraint is enabled
- JDK-8243559: Remove root certificates with 1024-bit keys
- JDK-8247350: [aarch64] assert(false) failed: wrong size of mach node
- JDK-8249278: Revert JDK-8226253 which breaks the spec of AccessibleState.SHOWING for
JList
- JDK-8252883: AccessDeniedException caused by delayed file deletion on Windows
+ - JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
- JDK-8255086: Update the root locale display names
- JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
- JDK-8256818: SSLSocket that is never bound or connected leaks socket resources
+ - JDK-8257039: [8u] GenericTaskQueue destructor is incorrect
- JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java reports leaks
- JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java as automatic
test
- JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java again reports leaks
after JDK-8257884
@@ -90,6 +99,7 @@ Live versions of these release notes can be found at:
- JDK-8261355: No data buffering in SunPKCS11 Cipher encryption when the underlying
mechanism has no padding
- JDK-8261867: Backport relevant test changes & additions from JDK-8130125
- JDK-8262110: DST starts from incorrect time in 2038
+ - JDK-8262446: DragAndDrop hangs on Windows
- JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt stack
- JDK-8262730: Enable jdk8u MacOS external debug symbols
- JDK-8262864: No debug symbols in image for Windows
--with-native-debug-symbols=external
@@ -100,6 +110,7 @@ Live versions of these release notes can be found at:
- JDK-8264562: assert(verify_field_bit(1)) failed: Attempting to write an uninitialized
event field: type
- JDK-8264640: CMS ParScanClosure misses a barrier
- JDK-8264816: Weak handles leak causes GC to take longer
+ - JDK-8265666: Enable AIX build platform to make external debug symbols
- JDK-8265832: runtime/StackGap/testme.sh fails to compile in 8u
- JDK-8265988: Fix sun/text/IntHashtable/Bug4170614 for JDK 8u
- JDK-8266191: Missing aarch64 parts of JDK-8181872 (C1: possible overflow when
strength reducing integer multiply by constant)
@@ -148,6 +159,31 @@ The following root certificate have been removed from the cacerts
truststore:
Alias Name: soneraclass2ca
Distinguished Name: CN=Sonera Class2 CA, O=Sonera, C=FI
+security-libs/javax.net.ssl:
+
+JDK-8244460: Support for certificate_authorities Extension
+==========================================================
+The "certificate_authorities" extension is an optional extension
+introduced in TLS 1.3. It is used to indicate the certificate
+authorities (CAs) that an endpoint supports and should be used by the
+receiving endpoint to guide certificate selection.
+
+With this JDK release, the "certificate_authorities" extension is
+supported for TLS 1.3 in both the client and the server sides. This
+extension is always present for client certificate selection, while it
+is optional for server certificate selection.
+
+Applications can enable this extension for server certificate
+selection by setting the `jdk.tls.client.enableCAExtension` system
+property to `true`. The default value of the property is `false`.
+
+Note that if the client trusts more CAs than the size limit of the
+extension (less than 2^16 bytes), the extension is not enabled. Also,
+some server implementations do not allow handshake messages to exceed
+2^14 bytes. Consequently, there may be interoperability issues when
+`jdk.tls.client.enableCAExtension` is set to `true` and the client
+trusts more CAs than the server implementation limit.
+
New in release OpenJDK 8u292 (2021-04-20):
===========================================
Live versions of these release notes can be found at:
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index e891b3f..c710d66 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -296,7 +296,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision
aarch64-shenandoah-jdk8u302-b03-shenandoah-merge-2021-06-23
+%global shenandoah_revision aarch64-shenandoah-jdk8u302-b04
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -311,7 +311,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 2
+%global rpmrelease 0
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -2582,6 +2582,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Wed Jun 30 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b04-0.0.ea
+- Update to aarch64-shenandoah-jdk8u302-b04 (EA)
+- Update release notes for 8u302-b04.
+
* Fri Jun 25 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b03-0.2.ea
- Update to aarch64-shenandoah-jdk8u302-b03-shenandoah-merge-2021-06-23 (EA)
- Update release notes for 8u302-b03-shenandoah-merge-2021-06-23.
diff --git a/sources b/sources
index 971a667..07a777b 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512
(aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b03-shenandoah-merge-2021-06-23-4curve.tar.xz)
=
41f2c7e2549ad569491d406b16f18a0f9840e804696238ef6ad3e2c49ed0b88f50afda152b6880758b0b34ae14e1b6fc548a9770fe32f8131ec96187d69afcb3
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b04-4curve.tar.xz) =
4b49ae51eb4366e7b812ea9cd852af2ed0aa6b7b5a720598ecd3a7734968fa135e3d68b2ec9439b169e6197205b715763adf247831455163d63955d418a14c83
commit 585f29fea66b0f7a5625e9c890bfd8a4e86ffb50
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Sat Jun 26 23:51:48 2021 +0100
Update to aarch64-shenandoah-jdk8u302-b03-shenandoah-merge-2021-06-23 (EA)
Update release notes for 8u302-b03-shenandoah-merge-2021-06-23.
diff --git a/.gitignore b/.gitignore
index 248a89d..6957bb8 100644
--- a/.gitignore
+++ b/.gitignore
@@ -232,3 +232,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b01-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b02-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b03-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b03-shenandoah-merge-2021-06-23-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 2f78280..d4bc4d7 100644
--- a/NEWS
+++ b/NEWS
@@ -103,6 +103,17 @@ Live versions of these release notes can be found at:
- JDK-8265832: runtime/StackGap/testme.sh fails to compile in 8u
- JDK-8265988: Fix sun/text/IntHashtable/Bug4170614 for JDK 8u
- JDK-8266191: Missing aarch64 parts of JDK-8181872 (C1: possible overflow when
strength reducing integer multiply by constant)
+* Shenandoah
+ - [backport] JDK-8259580: Shenandoah: uninitialized label in VerifyThreadGCState
+ - [backport] JDK-8259954: gc/shenandoah/mxbeans tests fail with -Xcomp
+ - [backport] JDK-8261251: Shenandoah: Use object size for full GC humongous
+ - [backport] JDK-8261413: Shenandoah: Disable class-unloading in I-U mode
+ - [backport] JDK-8265239: Shenandoah: Shenandoah heap region count could be off by 1
+ - [backport] JDK-8266802: Shenandoah: Round up region size to page size
unconditionally
+ - [backport] JDK-8267561: Shenandoah: Reference processing not properly setup for
outside of cycle degenerated GC
+ - [backport] JDK-8268127: Shenandoah: Heap size may be too small for region to align to
large page size
+ - [backport] JDK-8268699: Shenandoah: Add test for JDK-8268127
+ - Shenandoah: Process weak roots during class unloading cycle
Notes on individual issues:
===========================
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index a68ee78..e891b3f 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -296,7 +296,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u302-b03
+%global shenandoah_revision
aarch64-shenandoah-jdk8u302-b03-shenandoah-merge-2021-06-23
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -311,7 +311,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 1
+%global rpmrelease 2
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -2582,6 +2582,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Fri Jun 25 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b03-0.2.ea
+- Update to aarch64-shenandoah-jdk8u302-b03-shenandoah-merge-2021-06-23 (EA)
+- Update release notes for 8u302-b03-shenandoah-merge-2021-06-23.
+
* Mon Jun 07 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b03-0.1.ea
- Backport FIPS mode patch (RH1655466) to java-1.8.0-openjdk, simplifying provider
removal.
- nss.fips.cfg needs to be moved to %%{etcjavadir} and symlinked into the JDK, like
nss.cfg
diff --git a/sources b/sources
index 7507617..971a667 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b03-4curve.tar.xz) =
2da04211fadddf96a7acf18cc5e9a790f403eb31f3b9f960db93d1c2afd5a0d193b7ae70589e4382434816d5849b34be17ae0772cda2e4d7b4338b55cd6cd1f9
+SHA512
(aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b03-shenandoah-merge-2021-06-23-4curve.tar.xz)
=
41f2c7e2549ad569491d406b16f18a0f9840e804696238ef6ad3e2c49ed0b88f50afda152b6880758b0b34ae14e1b6fc548a9770fe32f8131ec96187d69afcb3
commit 0e6069cde381d80f94998a05af512f714da95707
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Tue Jun 8 04:50:48 2021 +0100
Support the FIPS mode crypto policy.
Backport FIPS mode patch to java-1.8.0-openjdk, simplifying provider removal.
nss.fips.cfg needs to be moved to %%{etcjavadir} and symlinked into the JDK, like
nss.cfg
SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the
name in the config file.
Change nss.fips.cfg config name to "NSS-FIPS" to avoid confusion with
nss.cfg.
Disable FIPS mode support unless com.redhat.fips is set to "true".
Add JDK-8195607/PR3776 to support NSS SQLite databases.
Use appropriate keystore types when in FIPS mode (RH1760838)
Enable alignment with FIPS crypto policy by default (-Dcom.redhat.fips=false to
disable).
Disable TLSv1.3 when using the NSS-FIPS provider (RH1860986)
Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always
occurs (RH1906862)
Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 8097ba5..a68ee78 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -311,7 +311,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 0
+%global rpmrelease 1
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -756,7 +756,9 @@ exit 0
%{_mandir}/man1/unpack200-%{uniquesuffix -- %{?1}}.1*
%{_mandir}/man1/policytool-%{uniquesuffix -- %{?1}}.1*
%{_jvmdir}/%{jredir -- %{?1}}/lib/security/nss.cfg
+%{_jvmdir}/%{jredir -- %{?1}}/lib/security/nss.fips.cfg
%config(noreplace) %{etcjavadir -- %{?1}}/lib/security/nss.cfg
+%config(noreplace) %{etcjavadir -- %{?1}}/lib/security/nss.fips.cfg
%ifarch %{share_arches}
%attr(444, root, root) %ghost %{_jvmdir}/%{jredir --
%{?1}}/lib/%{archinstall}/server/classes.jsa
%attr(444, root, root) %ghost %{_jvmdir}/%{jredir --
%{?1}}/lib/%{archinstall}/client/classes.jsa
@@ -1111,6 +1113,8 @@ Requires: copy-jdk-configs >= 4.0
OrderWithRequires: copy-jdk-configs
# for printing support
Requires: cups-libs
+# for FIPS PKCS11 provider
+Requires: nss
# Post requires alternatives to install tool alternatives
Requires(post): %{alternatives_requires}
# Postun requires alternatives to uninstall tool alternatives
@@ -1267,14 +1271,18 @@ Source14: TestECDSA.java
# Verify system crypto (policy) can be disabled via a property
Source15: TestSecurityProperties.java
+# Ensure vendor settings are correct
+Source16: CheckVendor.java
+
+# nss fips configuration file
+Source17: nss.fips.cfg.in
+
Source20: repackReproduciblePolycies.sh
# New versions of config files with aarch64 support. This is not upstream yet.
Source100: config.guess
Source101: config.sub
-# Ensure vendor settings are correct
-Source16: CheckVendor.java
############################################
#
@@ -1290,6 +1298,18 @@ Patch534:
rh1648246-always_instruct_vm_to_assume_multiple_processors_are_availab
# RH1582504: Use RSA as default for keytool, as DSA is disabled in all crypto policies
except LEGACY
Patch1003: rh1582504-rsa_default_for_keytool.patch
+# FIPS support patches
+# RH1648249: Add PKCS11 provider to java.security
+Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
+# RH1655466: Support RHEL FIPS mode using SunPKCS11 provider
+Patch1001: rh1655466-global_crypto_and_fips.patch
+# RH1760838: No ciphersuites available for SSLSocket in FIPS mode
+Patch1002: rh1760838-fips_default_keystore_type.patch
+# RH1860986: Disable TLSv1.3 with the NSS-FIPS provider until PKCS#11 v3.0 support is
available
+Patch1004: rh1860986-disable_tlsv1.3_in_fips_mode.patch
+# RH1906862: Always initialise JavaSecuritySystemConfiguratorAccess
+Patch1005: rh1906862-always_initialise_configurator_access.patch
+
#############################################
#
# Upstreamable patches
@@ -1364,6 +1384,8 @@ Patch202: jdk8035341-allow_using_system_installed_libpng.patch
# 8042159: Allow using a system-installed lcms2
Patch203: jdk8042159-allow_using_system_installed_lcms2-root.patch
Patch204: jdk8042159-allow_using_system_installed_lcms2-jdk.patch
+# JDK-8195607, PR3776, RH1760437: sun/security/pkcs11/Secmod/TestNssDbSqlite.java failed
with "NSS initialization failed" on NSS 3.34.1
+Patch580: jdk8195607-pr3776-rh1760437-nss_sqlite_db_config.patch
#############################################
#
@@ -1402,7 +1424,6 @@ Patch201: jdk8043805-allow_using_system_installed_libjpeg.patch
# This section includes patches to code other
# that from OpenJDK.
#############################################
-Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
#############################################
#
@@ -1803,12 +1824,17 @@ sh %{SOURCE12}
%patch574
%patch111
%patch112
+%patch580
# RPM-only fixes
%patch539
%patch600
%patch1000
+%patch1001
+%patch1002
%patch1003
+%patch1004
+%patch1005
# RHEL-only patches
%if ! 0%{?fedora} && 0%{?rhel} <= 7
@@ -1867,6 +1893,9 @@ done
# Setup nss.cfg
sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE11} > nss.cfg
+# Setup nss.fips.cfg
+sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE17} > nss.fips.cfg
+sed -i -e "s:@NSS_SECMOD@:/etc/pki/nssdb:g" nss.fips.cfg
%build
# How many CPU's do we have?
@@ -2010,6 +2039,9 @@ export JAVA_HOME=$(pwd)/%{buildoutputdir --
$suffix}/images/%{jdkimage}
# Install nss.cfg right away as we will be using the JRE above
install -m 644 nss.cfg $JAVA_HOME/jre/lib/security/
+# Install nss.fips.cfg: NSS configuration for global FIPS mode (crypto-policies)
+install -m 644 nss.fips.cfg $JAVA_HOME/jre/lib/security/
+
# Use system-wide tzdata
rm $JAVA_HOME/jre/lib/tzdb.dat
ln -s %{_datadir}/javazi-1.8/tzdb.dat $JAVA_HOME/jre/lib/tzdb.dat
@@ -2309,7 +2341,7 @@ touch -t 201401010000 $RPM_BUILD_ROOT/%{_jvmdir}/%{jredir --
$suffix}/lib/securi
# moving config files to /etc
mkdir -p $RPM_BUILD_ROOT/%{etcjavadir -- $suffix}/lib/security/policy/unlimited/
mkdir -p $RPM_BUILD_ROOT/%{etcjavadir -- $suffix}/lib/security/policy/limited/
-for file in lib/security/cacerts lib/security/policy/unlimited/US_export_policy.jar
lib/security/policy/unlimited/local_policy.jar
lib/security/policy/limited/US_export_policy.jar
lib/security/policy/limited/local_policy.jar lib/security/java.policy
lib/security/java.security lib/security/blacklisted.certs lib/logging.properties
lib/calendars.properties lib/security/nss.cfg lib/net.properties ; do
+for file in lib/security/cacerts lib/security/policy/unlimited/US_export_policy.jar
lib/security/policy/unlimited/local_policy.jar
lib/security/policy/limited/US_export_policy.jar
lib/security/policy/limited/local_policy.jar lib/security/java.policy
lib/security/java.security lib/security/blacklisted.certs lib/logging.properties
lib/calendars.properties lib/security/nss.cfg lib/security/nss.fips.cfg lib/net.properties
; do
mv $RPM_BUILD_ROOT/%{_jvmdir}/%{jredir -- $suffix}/$file
$RPM_BUILD_ROOT/%{etcjavadir -- $suffix}/$file
ln -sf %{etcjavadir -- $suffix}/$file
$RPM_BUILD_ROOT/%{_jvmdir}/%{jredir -- $suffix}/$file
done
@@ -2550,6 +2582,22 @@ cjc.mainProgram(args)
%endif
%changelog
+* Mon Jun 07 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b03-0.1.ea
+- Backport FIPS mode patch (RH1655466) to java-1.8.0-openjdk, simplifying provider
removal.
+- nss.fips.cfg needs to be moved to %%{etcjavadir} and symlinked into the JDK, like
nss.cfg
+- SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the
name in the config file.
+- Change nss.fips.cfg config name to "NSS-FIPS" to avoid confusion with
nss.cfg.
+- Disable FIPS mode support unless com.redhat.fips is set to "true".
+- Add JDK-8195607/PR3776 to support NSS SQLite databases.
+- Enable alignment with FIPS crypto policy by default (-Dcom.redhat.fips=false to
disable).
+- Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always
occurs (RH1906862)
+- Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode
+
+* Mon Jun 07 2021 Martin Balao <mbalao(a)redhat.com> - 1:1.8.0.302.b03-0.1.ea
+- Support the FIPS mode crypto policy on RHEL 8 (RH1655466)
+- Use appropriate keystore types when in FIPS mode (RH1760838)
+- Disable TLSv1.3 when using the NSS-FIPS provider (RH1860986)
+
* Wed Jun 02 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b03-0.0.ea
- Update to aarch64-shenandoah-jdk8u302-b03 (EA)
- Update release notes for 8u302-b03.
@@ -2571,7 +2619,7 @@ cjc.mainProgram(args)
main package now have to obsolete java-1.8.0-openjdk-accessibility-{release, slowdebug,
fastdebug} < 1:1.8.0.292.b06
otherwise update fails
-* Fri Apr 29 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.292.b10-1
+* Thu Apr 29 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.292.b10-1
- adapted to newst cjc to fix issue with rpm 4.17
* Tue Apr 13 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b10-0
diff --git a/jdk8195607-pr3776-rh1760437-nss_sqlite_db_config.patch
b/jdk8195607-pr3776-rh1760437-nss_sqlite_db_config.patch
new file mode 100644
index 0000000..ddab642
--- /dev/null
+++ b/jdk8195607-pr3776-rh1760437-nss_sqlite_db_config.patch
@@ -0,0 +1,125 @@
+# HG changeset patch
+# User mbalao
+# Date 1529971845 -28800
+# Tue Jun 26 08:10:45 2018 +0800
+# Node ID e9c20b7250cd98d16a67f2a30b34284c2caa01dc
+# Parent 9f1aa2e38d90dd60522237d7414af6bdcf03c4ff
+8195607, PR3776: sun/security/pkcs11/Secmod/TestNssDbSqlite.java failed with "NSS
initialization failed" on NSS 3.34.1
+Reviewed-by: valeriep, weijun
+
+diff --git openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/Secmod.java
openjdk/jdk/src/share/classes/sun/security/pkcs11/Secmod.java
+--- openjdk.orig/jdk/src/share/classes/sun/security/pkcs11/Secmod.java
++++ openjdk/jdk/src/share/classes/sun/security/pkcs11/Secmod.java
+@@ -197,7 +197,7 @@
+
+ if (configDir != null) {
+ String configDirPath = null;
+- String sqlPrefix = "sql:/";
++ String sqlPrefix = "sql:";
+ if (!configDir.startsWith(sqlPrefix)) {
+ configDirPath = configDir;
+ } else {
+diff --git openjdk.orig/jdk/src/share/native/sun/security/pkcs11/j2secmod.c
openjdk/jdk/src/share/native/sun/security/pkcs11/j2secmod.c
+--- openjdk.orig/jdk/src/share/native/sun/security/pkcs11/j2secmod.c
++++ openjdk/jdk/src/share/native/sun/security/pkcs11/j2secmod.c
+@@ -69,9 +69,14 @@
+ int res = 0;
+ FPTR_Initialize initialize =
+ (FPTR_Initialize)findFunction(env, jHandle, "NSS_Initialize");
++ #ifdef SECMOD_DEBUG
++ FPTR_GetError getError =
++ (FPTR_GetError)findFunction(env, jHandle, "PORT_GetError");
++ #endif // SECMOD_DEBUG
+ unsigned int flags = 0x00;
+ const char *configDir = NULL;
+ const char *functionName = NULL;
++ const char *configFile = NULL;
+
+ /* If we cannot initialize, exit now */
+ if (initialize == NULL) {
+@@ -97,13 +102,18 @@
+ flags = 0x20; // NSS_INIT_OPTIMIZESPACE flag
+ }
+
++ configFile = "secmod.db";
++ if (configDir != NULL && strncmp("sql:", configDir, 4U) == 0) {
++ configFile = "pkcs11.txt";
++ }
++
+ /*
+ * If the NSS_Init function is requested then call NSS_Initialize to
+ * open the Cert, Key and Security Module databases, read only.
+ */
+ if (strcmp("NSS_Init", functionName) == 0) {
+ flags = flags | 0x01; // NSS_INIT_READONLY flag
+- res = initialize(configDir, "", "", "secmod.db",
flags);
++ res = initialize(configDir, "", "", configFile, flags);
+
+ /*
+ * If the NSS_InitReadWrite function is requested then call
+@@ -111,7 +121,7 @@
+ * read/write.
+ */
+ } else if (strcmp("NSS_InitReadWrite", functionName) == 0) {
+- res = initialize(configDir, "", "", "secmod.db",
flags);
++ res = initialize(configDir, "", "", configFile, flags);
+
+ /*
+ * If the NSS_NoDB_Init function is requested then call
+@@ -137,6 +147,13 @@
+ (*env)->ReleaseStringUTFChars(env, jConfigDir, configDir);
+ }
+ dprintf1("-res: %d\n", res);
++ #ifdef SECMOD_DEBUG
++ if (res == -1) {
++ if (getError != NULL) {
++ dprintf1("-NSS error: %d\n", getError());
++ }
++ }
++ #endif // SECMOD_DEBUG
+
+ return (res == 0) ? JNI_TRUE : JNI_FALSE;
+ }
+diff --git openjdk.orig/jdk/src/solaris/native/sun/security/pkcs11/j2secmod_md.h
openjdk/jdk/src/solaris/native/sun/security/pkcs11/j2secmod_md.h
+--- openjdk.orig/jdk/src/solaris/native/sun/security/pkcs11/j2secmod_md.h
++++ openjdk/jdk/src/solaris/native/sun/security/pkcs11/j2secmod_md.h
+@@ -34,6 +34,10 @@
+ const char *certPrefix, const char *keyPrefix,
+ const char *secmodName, unsigned int flags);
+
++#ifdef SECMOD_DEBUG
++typedef int (*FPTR_GetError)(void);
++#endif //SECMOD_DEBUG
++
+ // in secmod.h
+ //extern SECMODModule *SECMOD_LoadModule(char *moduleSpec,SECMODModule *parent,
+ // PRBool recurse);
+diff --git openjdk.orig/jdk/test/sun/security/pkcs11/Secmod/pkcs11.txt
openjdk/jdk/test/sun/security/pkcs11/Secmod/pkcs11.txt
+new file mode 100644
+--- /dev/null
++++ openjdk/jdk/test/sun/security/pkcs11/Secmod/pkcs11.txt
+@@ -0,0 +1,4 @@
++library=
++name=NSS Internal PKCS #11 Module
++parameters=configdir='sql:./tmpdb' certPrefix='' keyPrefix=''
secmod='' flags= updatedir='' updateCertPrefix=''
updateKeyPrefix='' updateid='' updateTokenDescription=''
++NSS=Flags=internal,critical trustOrder=75 cipherOrder=100
slotParams=(1={slotFlags=[RSA,DSA,DH,RC2,RC4,DES,RANDOM,SHA1,MD5,MD2,SSL,TLS,AES,Camellia,SEED,SHA256,SHA512]
askpw=any timeout=30})
+diff --git openjdk.orig/jdk/test/sun/security/pkcs11/SecmodTest.java
openjdk/jdk/test/sun/security/pkcs11/SecmodTest.java
+--- openjdk.orig/jdk/test/sun/security/pkcs11/SecmodTest.java
++++ openjdk/jdk/test/sun/security/pkcs11/SecmodTest.java
+@@ -55,7 +55,7 @@
+
+ DBDIR = System.getProperty("test.classes", ".") + SEP +
"tmpdb";
+ if (useSqlite) {
+- System.setProperty("pkcs11test.nss.db", "sql:/" +
DBDIR);
++ System.setProperty("pkcs11test.nss.db", "sql:" +
DBDIR);
+ } else {
+ System.setProperty("pkcs11test.nss.db", DBDIR);
+ }
+@@ -67,6 +67,7 @@
+ if (useSqlite) {
+ copyFile("key4.db", BASE, DBDIR);
+ copyFile("cert9.db", BASE, DBDIR);
++ copyFile("pkcs11.txt", BASE, DBDIR);
+ } else {
+ copyFile("secmod.db", BASE, DBDIR);
+ copyFile("key3.db", BASE, DBDIR);
diff --git a/nss.fips.cfg.in b/nss.fips.cfg.in
new file mode 100644
index 0000000..ead27be
--- /dev/null
+++ b/nss.fips.cfg.in
@@ -0,0 +1,6 @@
+name = NSS-FIPS
+nssLibraryDirectory = @NSS_LIBDIR@
+nssSecmodDirectory = @NSS_SECMOD@
+nssDbMode = readOnly
+nssModule = fips
+
diff --git a/rh1655466-global_crypto_and_fips.patch
b/rh1655466-global_crypto_and_fips.patch
new file mode 100644
index 0000000..58d77b3
--- /dev/null
+++ b/rh1655466-global_crypto_and_fips.patch
@@ -0,0 +1,208 @@
+diff --git a/src/share/classes/javopenjdk.orig/jdk/security/Security.java
openjdk/jdk/src/share/classes/java/security/Security.java
+--- openjdk.orig/jdk/src/share/classes/java/security/Security.java
++++ openjdk/jdk/src/share/classes/java/security/Security.java
+@@ -191,27 +191,7 @@
+ if (disableSystemProps == null &&
+ "true".equalsIgnoreCase(props.getProperty
+ ("security.useSystemPropertiesFile"))) {
+-
+- // now load the system file, if it exists, so its values
+- // will win if they conflict with the earlier values
+- try (BufferedInputStream bis =
+- new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
+- props.load(bis);
+- loadedProps = true;
+-
+- if (sdebug != null) {
+- sdebug.println("reading system security properties file "
+
+- SYSTEM_PROPERTIES);
+- sdebug.println(props.toString());
+- }
+- } catch (IOException e) {
+- if (sdebug != null) {
+- sdebug.println
+- ("unable to load security properties from " +
+- SYSTEM_PROPERTIES);
+- e.printStackTrace();
+- }
+- }
++ loadedProps = loadedProps && SystemConfigurator.configure(props);
+ }
+
+ if (!loadedProps) {
+diff --git a/src/share/classes/javopenjdk.orig/jdk/security/SystemConfigurator.java
openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
+new file mode 100644
+--- /dev/null
++++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
+@@ -0,0 +1,153 @@
++/*
++ * Copyright (c) 2019, Red Hat, Inc.
++ *
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit
www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++package java.security;
++
++import java.io.BufferedInputStream;
++import java.io.FileInputStream;
++import java.io.IOException;
++
++import java.nio.file.Files;
++import java.nio.file.FileSystems;
++import java.nio.file.Path;
++
++import java.util.Iterator;
++import java.util.Map.Entry;
++import java.util.Properties;
++import java.util.function.Consumer;
++import java.util.regex.Matcher;
++import java.util.regex.Pattern;
++
++import sun.security.util.Debug;
++
++/**
++ * Internal class to align OpenJDK with global crypto-policies.
++ * Called from java.security.Security class initialization,
++ * during startup.
++ *
++ */
++
++class SystemConfigurator {
++
++ private static final Debug sdebug =
++ Debug.getInstance("properties");
++
++ private static final String CRYPTO_POLICIES_BASE_DIR =
++ "/etc/crypto-policies";
++
++ private static final String CRYPTO_POLICIES_JAVA_CONFIG =
++ CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config";
++
++ private static final String CRYPTO_POLICIES_CONFIG =
++ CRYPTO_POLICIES_BASE_DIR + "/config";
++
++ private static final class SecurityProviderInfo {
++ int number;
++ String key;
++ String value;
++ SecurityProviderInfo(int number, String key, String value) {
++ this.number = number;
++ this.key = key;
++ this.value = value;
++ }
++ }
++
++ /*
++ * Invoked when java.security.Security class is initialized, if
++ * java.security.disableSystemPropertiesFile property is not set and
++ * security.useSystemPropertiesFile is true.
++ */
++ static boolean configure(Properties props) {
++ boolean loadedProps = false;
++
++ try (BufferedInputStream bis =
++ new BufferedInputStream(
++ new FileInputStream(CRYPTO_POLICIES_JAVA_CONFIG))) {
++ props.load(bis);
++ loadedProps = true;
++ if (sdebug != null) {
++ sdebug.println("reading system security properties file " +
++ CRYPTO_POLICIES_JAVA_CONFIG);
++ sdebug.println(props.toString());
++ }
++ } catch (IOException e) {
++ if (sdebug != null) {
++ sdebug.println("unable to load security properties from " +
++ CRYPTO_POLICIES_JAVA_CONFIG);
++ e.printStackTrace();
++ }
++ }
++
++ try {
++ if (enableFips()) {
++ if (sdebug != null) { sdebug.println("FIPS mode detected"); }
++ loadedProps = false;
++ // Remove all security providers
++ Iterator<Entry<Object, Object>> i =
props.entrySet().iterator();
++ while (i.hasNext()) {
++ Entry<Object, Object> e = i.next();
++ if (((String) e.getKey()).startsWith("security.provider"))
{
++ if (sdebug != null) { sdebug.println("Removing provider:
" + e); }
++ i.remove();
++ }
++ }
++ // Add FIPS security providers
++ String fipsProviderValue = null;
++ for (int n = 1;
++ (fipsProviderValue = (String) props.get("fips.provider."
+ n)) != null; n++) {
++ String fipsProviderKey = "security.provider." + n;
++ if (sdebug != null) {
++ sdebug.println("Adding provider " + n + ": "
+
++ fipsProviderKey + "=" + fipsProviderValue);
++ }
++ props.put(fipsProviderKey, fipsProviderValue);
++ }
++ loadedProps = true;
++ }
++ } catch (Exception e) {
++ if (sdebug != null) {
++ sdebug.println("unable to load FIPS configuration");
++ e.printStackTrace();
++ }
++ }
++ return loadedProps;
++ }
++
++ /*
++ * FIPS is enabled only if crypto-policies are set to "FIPS"
++ * and the com.redhat.fips property is true.
++ */
++ private static boolean enableFips() throws Exception {
++ boolean fipsEnabled = Boolean.valueOf(System.getProperty("com.redhat.fips",
"true"));
++ if (fipsEnabled) {
++ Path configPath = FileSystems.getDefault().getPath(CRYPTO_POLICIES_CONFIG);
++ String cryptoPoliciesConfig = new String(Files.readAllBytes(configPath));
++ if (sdebug != null) { sdebug.println("Crypto config:\n" +
cryptoPoliciesConfig); }
++ Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
++ return pattern.matcher(cryptoPoliciesConfig).find();
++ } else {
++ return false;
++ }
++ }
++}
+diff --git openjdk.orig/jdk/src/share/lib/security/java.security-linux
openjdk/jdk/src/share/lib/security/java.security-linux
+--- openjdk.orig/jdk/src/share/lib/security/java.security-linux
++++ openjdk/jdk/src/share/lib/security/java.security-linux
+@@ -77,6 +77,14 @@
+ #security.provider.10=sun.security.pkcs11.SunPKCS11 ${java.home}/lib/security/nss.cfg
+
+ #
++# Security providers used when global crypto-policies are set to FIPS.
++#
++fips.provider.1=sun.security.pkcs11.SunPKCS11 ${java.home}/lib/security/nss.fips.cfg
++fips.provider.2=sun.security.provider.Sun
++fips.provider.3=sun.security.ec.SunEC
++fips.provider.4=com.sun.net.ssl.internal.ssl.Provider SunPKCS11-NSS-FIPS
++
++#
+ # Sun Provider SecureRandom seed source.
+ #
+ # Select the primary source of seed data for the "SHA1PRNG" and
diff --git a/rh1760838-fips_default_keystore_type.patch
b/rh1760838-fips_default_keystore_type.patch
new file mode 100644
index 0000000..bedc8ea
--- /dev/null
+++ b/rh1760838-fips_default_keystore_type.patch
@@ -0,0 +1,52 @@
+diff -r 6efbd7b35a10 src/share/classes/java/security/SystemConfigurator.java
+--- openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java Thu Jan 23
18:22:31 2020 -0300
++++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java Mon Mar 02
19:20:17 2020 -0300
+@@ -123,6 +123,33 @@
+ }
+ props.put(fipsProviderKey, fipsProviderValue);
+ }
++ // Add other security properties
++ String keystoreTypeValue = (String)
props.get("fips.keystore.type");
++ if (keystoreTypeValue != null) {
++ String nonFipsKeystoreType =
props.getProperty("keystore.type");
++ props.put("keystore.type", keystoreTypeValue);
++ if (keystoreTypeValue.equals("PKCS11")) {
++ // If keystore.type is PKCS11, javax.net.ssl.keyStore
++ // must be "NONE". See JDK-8238264.
++ System.setProperty("javax.net.ssl.keyStore",
"NONE");
++ }
++ if (System.getProperty("javax.net.ssl.trustStoreType") ==
null) {
++ // If no trustStoreType has been set, use the
++ // previous keystore.type under FIPS mode. In
++ // a default configuration, the Trust Store will
++ // be 'cacerts' (JKS type).
++ System.setProperty("javax.net.ssl.trustStoreType",
++ nonFipsKeystoreType);
++ }
++ if (sdebug != null) {
++ sdebug.println("FIPS mode default keystore.type = " +
++ keystoreTypeValue);
++ sdebug.println("FIPS mode javax.net.ssl.keyStore = "
+
++ System.getProperty("javax.net.ssl.keyStore",
""));
++ sdebug.println("FIPS mode javax.net.ssl.trustStoreType =
" +
++
System.getProperty("javax.net.ssl.trustStoreType", ""));
++ }
++ }
+ loadedProps = true;
+ }
+ } catch (Exception e) {
+diff -r 6efbd7b35a10 src/share/lib/security/java.security-linux
+--- openjdk.orig/jdk/src/share/lib/security/java.security-linux Thu Jan 23 18:22:31 2020
-0300
++++ openjdk/jdk/src/share/lib/security/java.security-linux Mon Mar 02 19:20:17 2020
-0300
+@@ -179,6 +179,11 @@
+ keystore.type=jks
+
+ #
++# Default keystore type used when global crypto-policies are set to FIPS.
++#
++fips.keystore.type=PKCS11
++
++#
+ # Controls compatibility mode for the JKS keystore type.
+ #
+ # When set to 'true', the JKS keystore type supports loading
diff --git a/rh1860986-disable_tlsv1.3_in_fips_mode.patch
b/rh1860986-disable_tlsv1.3_in_fips_mode.patch
new file mode 100644
index 0000000..91e3705
--- /dev/null
+++ b/rh1860986-disable_tlsv1.3_in_fips_mode.patch
@@ -0,0 +1,327 @@
+diff -r bbc65dfa59d1 src/share/classes/java/security/SystemConfigurator.java
+--- openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java Thu Jan 23
18:22:31 2020 -0300
++++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java Sat Aug 01
23:16:51 2020 -0300
+@@ -1,11 +1,13 @@
+ /*
+- * Copyright (c) 2019, Red Hat, Inc.
++ * Copyright (c) 2019, 2020, Red Hat, Inc.
+ *
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+- * published by the Free Software Foundation.
++ * published by the Free Software Foundation. Oracle designates this
++ * particular file as subject to the "Classpath" exception as provided
++ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+@@ -34,10 +36,10 @@
+ import java.util.Iterator;
+ import java.util.Map.Entry;
+ import java.util.Properties;
+-import java.util.function.Consumer;
+-import java.util.regex.Matcher;
+ import java.util.regex.Pattern;
+
++import sun.misc.SharedSecrets;
++import sun.misc.JavaSecuritySystemConfiguratorAccess;
+ import sun.security.util.Debug;
+
+ /**
+@@ -47,7 +49,7 @@
+ *
+ */
+
+-class SystemConfigurator {
++final class SystemConfigurator {
+
+ private static final Debug sdebug =
+ Debug.getInstance("properties");
+@@ -61,15 +63,16 @@
+ private static final String CRYPTO_POLICIES_CONFIG =
+ CRYPTO_POLICIES_BASE_DIR + "/config";
+
+- private static final class SecurityProviderInfo {
+- int number;
+- String key;
+- String value;
+- SecurityProviderInfo(int number, String key, String value) {
+- this.number = number;
+- this.key = key;
+- this.value = value;
+- }
++ private static boolean systemFipsEnabled = false;
++
++ static {
++ SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
++ new JavaSecuritySystemConfiguratorAccess() {
++ @Override
++ public boolean isSystemFipsEnabled() {
++ return SystemConfigurator.isSystemFipsEnabled();
++ }
++ });
+ }
+
+ /*
+@@ -128,9 +131,9 @@
+ String nonFipsKeystoreType =
props.getProperty("keystore.type");
+ props.put("keystore.type", keystoreTypeValue);
+ if (keystoreTypeValue.equals("PKCS11")) {
+- // If keystore.type is PKCS11, javax.net.ssl.keyStore
+- // must be "NONE". See JDK-8238264.
+- System.setProperty("javax.net.ssl.keyStore",
"NONE");
++ // If keystore.type is PKCS11, javax.net.ssl.keyStore
++ // must be "NONE". See JDK-8238264.
++ System.setProperty("javax.net.ssl.keyStore",
"NONE");
+ }
+ if (System.getProperty("javax.net.ssl.trustStoreType") ==
null) {
+ // If no trustStoreType has been set, use the
+@@ -144,12 +147,13 @@
+ sdebug.println("FIPS mode default keystore.type = " +
+ keystoreTypeValue);
+ sdebug.println("FIPS mode javax.net.ssl.keyStore = "
+
+- System.getProperty("javax.net.ssl.keyStore",
""));
++ System.getProperty("javax.net.ssl.keyStore",
""));
+ sdebug.println("FIPS mode javax.net.ssl.trustStoreType =
" +
+
System.getProperty("javax.net.ssl.trustStoreType", ""));
+ }
+ }
+ loadedProps = true;
++ systemFipsEnabled = true;
+ }
+ } catch (Exception e) {
+ if (sdebug != null) {
+@@ -165,20 +165,37 @@
+ return loadedProps;
+ }
+
++ /**
++ * Returns whether or not global system FIPS alignment is enabled.
++ *
++ * Value is always 'false' before java.security.Security class is
++ * initialized.
++ *
++ * Call from out of this package through SharedSecrets:
++ * SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
++ * .isSystemFipsEnabled();
++ *
++ * @return a boolean value indicating whether or not global
++ * system FIPS alignment is enabled.
++ */
++ static boolean isSystemFipsEnabled() {
++ return systemFipsEnabled;
++ }
++
+ /*
+ * FIPS is enabled only if crypto-policies are set to "FIPS"
+ * and the com.redhat.fips property is true.
+ */
+ private static boolean enableFips() throws Exception {
+- boolean fipsEnabled = Boolean.valueOf(System.getProperty("com.redhat.fips",
"true"));
+- if (fipsEnabled) {
+- Path configPath = FileSystems.getDefault().getPath(CRYPTO_POLICIES_CONFIG);
+- String cryptoPoliciesConfig = new String(Files.readAllBytes(configPath));
+- if (sdebug != null) { sdebug.println("Crypto config:\n" +
cryptoPoliciesConfig); }
+- Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
+- return pattern.matcher(cryptoPoliciesConfig).find();
+- } else {
+- return false;
+- }
++ boolean shouldEnable =
Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
++ if (shouldEnable) {
++ Path configPath = FileSystems.getDefault().getPath(CRYPTO_POLICIES_CONFIG);
++ String cryptoPoliciesConfig = new String(Files.readAllBytes(configPath));
++ if (sdebug != null) { sdebug.println("Crypto config:\n" +
cryptoPoliciesConfig); }
++ Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
++ return pattern.matcher(cryptoPoliciesConfig).find();
++ } else {
++ return false;
++ }
+ }
+ }
+diff --git
openjdk.orig/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
openjdk/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
+new file mode 100644
+--- /dev/null
++++ openjdk/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
+@@ -0,0 +1,30 @@
++/*
++ * Copyright (c) 2020, Red Hat, Inc.
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation. Oracle designates this
++ * particular file as subject to the "Classpath" exception as provided
++ * by Oracle in the LICENSE file that accompanied this code.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit
www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++package sun.misc;
++
++public interface JavaSecuritySystemConfiguratorAccess {
++ boolean isSystemFipsEnabled();
++}
+diff --git openjdk.orig/jdk/src/share/classes/sun/misc/SharedSecrets.java
openjdk/jdk/src/share/classes/sun/misc/SharedSecrets.java
+--- openjdk.orig/jdk/src/share/classes/sun/misc/SharedSecrets.java
++++ openjdk/jdk/src/share/classes/sun/misc/SharedSecrets.java
+@@ -63,6 +63,7 @@
+ private static JavaObjectInputStreamReadString javaObjectInputStreamReadString;
+ private static JavaObjectInputStreamAccess javaObjectInputStreamAccess;
+ private static JavaSecuritySignatureAccess javaSecuritySignatureAccess;
++ private static JavaSecuritySystemConfiguratorAccess
javaSecuritySystemConfiguratorAccess;
+
+ public static JavaUtilJarAccess javaUtilJarAccess() {
+ if (javaUtilJarAccess == null) {
+@@ -248,4 +249,12 @@
+ }
+ return javaxCryptoSealedObjectAccess;
+ }
++
++ public static void
setJavaSecuritySystemConfiguratorAccess(JavaSecuritySystemConfiguratorAccess jssca) {
++ javaSecuritySystemConfiguratorAccess = jssca;
++ }
++
++ public static JavaSecuritySystemConfiguratorAccess
getJavaSecuritySystemConfiguratorAccess() {
++ return javaSecuritySystemConfiguratorAccess;
++ }
+ }
+diff --git openjdk.orig/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
openjdk/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
+--- openjdk.orig/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
++++ openjdk/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
+@@ -31,6 +31,7 @@
+ import java.security.cert.*;
+ import java.util.*;
+ import javax.net.ssl.*;
++import sun.misc.SharedSecrets;
+ import sun.security.action.GetPropertyAction;
+ import sun.security.provider.certpath.AlgorithmChecker;
+ import sun.security.validator.Validator;
+@@ -539,20 +540,38 @@
+
+ static {
+ if (SunJSSE.isFIPS()) {
+- supportedProtocols = Arrays.asList(
+- ProtocolVersion.TLS13,
+- ProtocolVersion.TLS12,
+- ProtocolVersion.TLS11,
+- ProtocolVersion.TLS10
+- );
++ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
++ .isSystemFipsEnabled()) {
++ // RH1860986: TLSv1.3 key derivation not supported with
++ // the Security Providers available in system FIPS mode.
++ supportedProtocols = Arrays.asList(
++ ProtocolVersion.TLS12,
++ ProtocolVersion.TLS11,
++ ProtocolVersion.TLS10
++ );
+
+- serverDefaultProtocols = getAvailableProtocols(
+- new ProtocolVersion[] {
+- ProtocolVersion.TLS13,
+- ProtocolVersion.TLS12,
+- ProtocolVersion.TLS11,
+- ProtocolVersion.TLS10
+- });
++ serverDefaultProtocols = getAvailableProtocols(
++ new ProtocolVersion[] {
++ ProtocolVersion.TLS12,
++ ProtocolVersion.TLS11,
++ ProtocolVersion.TLS10
++ });
++ } else {
++ supportedProtocols = Arrays.asList(
++ ProtocolVersion.TLS13,
++ ProtocolVersion.TLS12,
++ ProtocolVersion.TLS11,
++ ProtocolVersion.TLS10
++ );
++
++ serverDefaultProtocols = getAvailableProtocols(
++ new ProtocolVersion[] {
++ ProtocolVersion.TLS13,
++ ProtocolVersion.TLS12,
++ ProtocolVersion.TLS11,
++ ProtocolVersion.TLS10
++ });
++ }
+ } else {
+ supportedProtocols = Arrays.asList(
+ ProtocolVersion.TLS13,
+@@ -612,6 +631,16 @@
+
+ static ProtocolVersion[] getSupportedProtocols() {
+ if (SunJSSE.isFIPS()) {
++ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
++ .isSystemFipsEnabled()) {
++ // RH1860986: TLSv1.3 key derivation not supported with
++ // the Security Providers available in system FIPS mode.
++ return new ProtocolVersion[] {
++ ProtocolVersion.TLS12,
++ ProtocolVersion.TLS11,
++ ProtocolVersion.TLS10
++ };
++ }
+ return new ProtocolVersion[] {
+ ProtocolVersion.TLS13,
+ ProtocolVersion.TLS12,
+@@ -939,6 +968,16 @@
+
+ static ProtocolVersion[] getProtocols() {
+ if (SunJSSE.isFIPS()) {
++ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
++ .isSystemFipsEnabled()) {
++ // RH1860986: TLSv1.3 key derivation not supported with
++ // the Security Providers available in system FIPS mode.
++ return new ProtocolVersion[] {
++ ProtocolVersion.TLS12,
++ ProtocolVersion.TLS11,
++ ProtocolVersion.TLS10
++ };
++ }
+ return new ProtocolVersion[]{
+ ProtocolVersion.TLS12,
+ ProtocolVersion.TLS11,
+diff --git openjdk.orig/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
openjdk/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
+--- openjdk.orig/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
++++ openjdk/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
+@@ -30,6 +30,8 @@
+
+ import java.security.*;
+
++import sun.misc.SharedSecrets;
++
+ /**
+ * The JSSE provider.
+ *
+@@ -215,8 +217,13 @@
+ "sun.security.ssl.SSLContextImpl$TLS11Context");
+ put("SSLContext.TLSv1.2",
+ "sun.security.ssl.SSLContextImpl$TLS12Context");
+- put("SSLContext.TLSv1.3",
+- "sun.security.ssl.SSLContextImpl$TLS13Context");
++ if (!SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
++ .isSystemFipsEnabled()) {
++ // RH1860986: TLSv1.3 key derivation not supported with
++ // the Security Providers available in system FIPS mode.
++ put("SSLContext.TLSv1.3",
++ "sun.security.ssl.SSLContextImpl$TLS13Context");
++ }
+ put("SSLContext.TLS",
+ "sun.security.ssl.SSLContextImpl$TLSContext");
+ if (isfips == false) {
diff --git a/rh1906862-always_initialise_configurator_access.patch
b/rh1906862-always_initialise_configurator_access.patch
new file mode 100644
index 0000000..82116ad
--- /dev/null
+++ b/rh1906862-always_initialise_configurator_access.patch
@@ -0,0 +1,65 @@
+# HG changeset patch
+# User andrew
+# Date 1608219816 0
+# Thu Dec 17 15:43:36 2020 +0000
+# Node ID db5d1b28bfce04352b3a48960bf836f6eb20804b
+# Parent a2cfa397150e99b813354226d536eb8509b5850b
+RH1906862: Always initialise JavaSecuritySystemConfiguratorAccess
+
+diff --git openjdk.orig/jdk/src/share/classes/java/security/Security.java
openjdk/jdk/src/share/classes/java/security/Security.java
+--- openjdk.orig/jdk/src/share/classes/java/security/Security.java
++++ openjdk/jdk/src/share/classes/java/security/Security.java
+@@ -30,6 +30,8 @@
+ import java.util.concurrent.ConcurrentHashMap;
+ import java.io.*;
+ import java.net.URL;
++import sun.misc.SharedSecrets;
++import sun.misc.JavaSecuritySystemConfiguratorAccess;
+ import sun.security.util.Debug;
+ import sun.security.util.PropertyExpander;
+
+@@ -69,6 +71,15 @@
+ }
+
+ static {
++ // Initialise here as used by code with system properties disabled
++ SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
++ new JavaSecuritySystemConfiguratorAccess() {
++ @Override
++ public boolean isSystemFipsEnabled() {
++ return SystemConfigurator.isSystemFipsEnabled();
++ }
++ });
++
+ // doPrivileged here because there are multiple
+ // things in initialize that might require privs.
+ // (the FileInputStream call and the File.exists call,
+diff --git openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java
openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
+--- openjdk.orig/jdk/src/share/classes/java/security/SystemConfigurator.java
++++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
+@@ -39,8 +39,6 @@
+ import java.util.Properties;
+ import java.util.regex.Pattern;
+
+-import sun.misc.SharedSecrets;
+-import sun.misc.JavaSecuritySystemConfiguratorAccess;
+ import sun.security.util.Debug;
+
+ /**
+@@ -66,16 +64,6 @@
+
+ private static boolean systemFipsEnabled = false;
+
+- static {
+- SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
+- new JavaSecuritySystemConfiguratorAccess() {
+- @Override
+- public boolean isSystemFipsEnabled() {
+- return SystemConfigurator.isSystemFipsEnabled();
+- }
+- });
+- }
+-
+ /*
+ * Invoked when java.security.Security class is initialized, if
+ * java.security.disableSystemPropertiesFile property is not set and
commit 9bb503395a4ebac7476bfe86633dc6ea16f8b19f
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Mon Jun 7 13:35:52 2021 +0100
Update to aarch64-shenandoah-jdk8u302-b03 (EA)
Update release notes for 8u302-b03.
diff --git a/.gitignore b/.gitignore
index fa44d8a..248a89d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -231,3 +231,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b10-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b01-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b02-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b03-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 95a3b38..2f78280 100644
--- a/NEWS
+++ b/NEWS
@@ -13,6 +13,7 @@ Live versions of these release notes can be found at:
* Other changes
- JDK-6878250: (so) IllegalBlockingModeException thrown when reading from a closed
SocketChannel's InputStream
- JDK-7059970: Test case: javax/imageio/plugins/png/ITXtTest.java is not closing a
file
+ - JDK-8019470: Changes needed to compile JDK 8 on MacOS with clang compiler
- JDK-8030123: java/beans/Introspector/Test8027648.java fails
- JDK-8033289: clang: clean up unused function warning
- JDK-8034856: gcc warnings compiling src/solaris/native/sun/security/pkcs11
@@ -35,6 +36,7 @@ Live versions of these release notes can be found at:
- JDK-8134672: [TEST_BUG] Some tests should check isDisplayChangeSupported
- JDK-8134883: C1 hard crash in range check elimination in Nashorn test262parallel
- JDK-8136592: [TEST_BUG] Fix 2 platform-specific closed regtests for jigsaw
+ - JDK-8138820: JDK Hotspot build fails with Xcode 7.0.1
- JDK-8151786: [TESTBUG] java/beans/XMLEncoder/Test4625418.java timed out
intermittently
- JDK-8159898: Negative array size in java/beans/Introspector/Test8027905.java
- JDK-8166046: [TESTBUG] compiler/stringopts/TestStringObjectInitialization.java fails
with OOME
@@ -62,11 +64,17 @@ Live versions of these release notes can be found at:
- JDK-8231949: [PPC64, s390]: Make async profiling more reliable
- JDK-8234011: (zipfs) Memory leak in ZipFileSystem.releaseDeflater()
- JDK-8241649: Optimize Character.toString
+ - JDK-8241829: Cleanup the code for PrinterJob on windows
- JDK-8243559: Remove root certificates with 1024-bit keys
- JDK-8247350: [aarch64] assert(false) failed: wrong size of mach node
- JDK-8249278: Revert JDK-8226253 which breaks the spec of AccessibleState.SHOWING for
JList
+ - JDK-8252883: AccessDeniedException caused by delayed file deletion on Windows
- JDK-8255086: Update the root locale display names
- JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
+ - JDK-8256818: SSLSocket that is never bound or connected leaks socket resources
+ - JDK-8257670: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java reports leaks
+ - JDK-8257884: Re-enable sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java as automatic
test
+ - JDK-8257997: sun/security/ssl/SSLSocketImpl/SSLSocketLeak.java again reports leaks
after JDK-8257884
- JDK-8257999: Parallel GC crash in gc/parallel/TestDynShrinkHeap.java: new region is
not in covered_region
- JDK-8258419: RSA cipher buffer cleanup
- JDK-8258669: fastdebug jvm crashes when do event based tracing for monitor inflation
@@ -90,6 +98,7 @@ Live versions of these release notes can be found at:
- JDK-8263600: change rmidRunning to a simple lookup
- JDK-8264509: jdk8u MacOS zipped debug symbols won't build
- JDK-8264562: assert(verify_field_bit(1)) failed: Attempting to write an uninitialized
event field: type
+ - JDK-8264640: CMS ParScanClosure misses a barrier
- JDK-8264816: Weak handles leak causes GC to take longer
- JDK-8265832: runtime/StackGap/testme.sh fails to compile in 8u
- JDK-8265988: Fix sun/text/IntHashtable/Bug4170614 for JDK 8u
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 315ab69..8097ba5 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -296,7 +296,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u302-b02
+%global shenandoah_revision aarch64-shenandoah-jdk8u302-b03
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -2550,6 +2550,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Wed Jun 02 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b03-0.0.ea
+- Update to aarch64-shenandoah-jdk8u302-b03 (EA)
+- Update release notes for 8u302-b03.
+
* Tue May 25 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b02-0.0.ea
- Update to aarch64-shenandoah-jdk8u302-b02 (EA)
- Update release notes for 8u302-b02.
diff --git a/sources b/sources
index ff68f68..7507617 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b02-4curve.tar.xz) =
1c3328c79551d76f0c3730d50e66d2abd251bb8614f947446d76d3543a39b41f8c32e4391b62aa2f4330da2df36686b6825e54d9079ce84b9625da7fa65f21fd
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b03-4curve.tar.xz) =
2da04211fadddf96a7acf18cc5e9a790f403eb31f3b9f960db93d1c2afd5a0d193b7ae70589e4382434816d5849b34be17ae0772cda2e4d7b4338b55cd6cd1f9
commit 6d48cf0847e9f45a424d69763643a7f5bf30d6c6
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Fri Jun 4 06:51:37 2021 +0100
Update to aarch64-shenandoah-jdk8u302-b02 (EA)
Update release notes for 8u302-b02.
diff --git a/.gitignore b/.gitignore
index a29eb85..fa44d8a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -230,3 +230,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b09-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b10-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b01-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b02-4curve.tar.xz
diff --git a/NEWS b/NEWS
index b78d9ce..95a3b38 100644
--- a/NEWS
+++ b/NEWS
@@ -15,6 +15,9 @@ Live versions of these release notes can be found at:
- JDK-7059970: Test case: javax/imageio/plugins/png/ITXtTest.java is not closing a
file
- JDK-8030123: java/beans/Introspector/Test8027648.java fails
- JDK-8033289: clang: clean up unused function warning
+ - JDK-8034856: gcc warnings compiling src/solaris/native/sun/security/pkcs11
+ - JDK-8034857: gcc warnings compiling src/solaris/native/sun/management
+ - JDK-8035054: JarFacade.c should not include ctype.h
- JDK-8036095: RMI tests using testlibrary.RMID and testlibrary.JavaVM do not pass
through vmoptions
- JDK-8042891: Format issues embedded in macros for two g1 source files
- JDK-8055754: filemap.cpp does not compile with clang
@@ -25,6 +28,7 @@ Live versions of these release notes can be found at:
- JDK-8073446: TimeZone getOffset API does not return a dst offset between years
2038-2137
- JDK-8075071: [TEST_BUG] TimSortStackSize2.java: OOME: Java heap space: MaxHeap
shrinked by MaxRAMFraction
- JDK-8077364: "if( !this )" construct prevents build on Xcode 6.3
+ - JDK-8129511: PlatformMidi.c:83 uses malloc without malloc header
- JDK-8130308: Too low memory usage in
TestPromotionFromSurvivorToTenuredAfterMinorGC.java
- JDK-8132148: G1 hs_err region dump legend out of sync with region values
- JDK-8132709: [TESTBUG] gc/g1/TestHumongousShrinkHeap.java might fail on embedded
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 1aac854..315ab69 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -296,7 +296,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u302-b01
+%global shenandoah_revision aarch64-shenandoah-jdk8u302-b02
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -2550,6 +2550,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Tue May 25 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b02-0.0.ea
+- Update to aarch64-shenandoah-jdk8u302-b02 (EA)
+- Update release notes for 8u302-b02.
+
* Sat May 22 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b01-0.0.ea
- Update to aarch64-shenandoah-jdk8u302-b01 (EA)
- Update release notes for 8u302-b01.
diff --git a/sources b/sources
index 6774c52..ff68f68 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b01-4curve.tar.xz) =
7a73f7ffcbe368edfd17b1c13509939bc57e7e14e18fa010d1c4341846c5306820111b789e529e37b5c31fb8fb67dfb3daeb12d6814e62cdff57503884dfbc1d
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b02-4curve.tar.xz) =
1c3328c79551d76f0c3730d50e66d2abd251bb8614f947446d76d3543a39b41f8c32e4391b62aa2f4330da2df36686b6825e54d9079ce84b9625da7fa65f21fd
commit 4c961126942d7b2d53fcaef5f7127e47cc61a213
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Wed Jun 2 06:03:04 2021 +0100
Update to aarch64-shenandoah-jdk8u302-b01 (EA)
Update release notes for 8u302-b01.
Switch to EA mode.
diff --git a/.gitignore b/.gitignore
index c959a85..a29eb85 100644
--- a/.gitignore
+++ b/.gitignore
@@ -229,3 +229,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b08-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b09-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b10-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b01-4curve.tar.xz
diff --git a/NEWS b/NEWS
index e5dea8d..b78d9ce 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,127 @@ Key:
JDK-X -
https://bugs.openjdk.java.net/browse/JDK-X
CVE-XXXX-YYYY:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
+New in release OpenJDK 8u302 (2021-07-20):
+===========================================
+Live versions of these release notes can be found at:
+ *
https://bitly.com/openjdk8u302
+ *
https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u302.txt
+
+* Security fixes
+* Other changes
+ - JDK-6878250: (so) IllegalBlockingModeException thrown when reading from a closed
SocketChannel's InputStream
+ - JDK-7059970: Test case: javax/imageio/plugins/png/ITXtTest.java is not closing a
file
+ - JDK-8030123: java/beans/Introspector/Test8027648.java fails
+ - JDK-8033289: clang: clean up unused function warning
+ - JDK-8036095: RMI tests using testlibrary.RMID and testlibrary.JavaVM do not pass
through vmoptions
+ - JDK-8042891: Format issues embedded in macros for two g1 source files
+ - JDK-8055754: filemap.cpp does not compile with clang
+ - JDK-8064909: FragmentMetaspace.java got OutOfMemoryError
+ - JDK-8066508: JTReg tests timeout on slow devices when run using JPRT
+ - JDK-8066807: langtools/test/Makefile should use -agentvm not -samevm
+ - JDK-8071374: -XX:+PrintAssembly -XX:+PrintSignatureHandlers crash fastdebug VM with
assert(limit == __null || limit <= nm->code_end()) in RelocIterator::initialize
+ - JDK-8073446: TimeZone getOffset API does not return a dst offset between years
2038-2137
+ - JDK-8075071: [TEST_BUG] TimSortStackSize2.java: OOME: Java heap space: MaxHeap
shrinked by MaxRAMFraction
+ - JDK-8077364: "if( !this )" construct prevents build on Xcode 6.3
+ - JDK-8130308: Too low memory usage in
TestPromotionFromSurvivorToTenuredAfterMinorGC.java
+ - JDK-8132148: G1 hs_err region dump legend out of sync with region values
+ - JDK-8132709: [TESTBUG] gc/g1/TestHumongousShrinkHeap.java might fail on embedded
+ - JDK-8134672: [TEST_BUG] Some tests should check isDisplayChangeSupported
+ - JDK-8134883: C1 hard crash in range check elimination in Nashorn test262parallel
+ - JDK-8136592: [TEST_BUG] Fix 2 platform-specific closed regtests for jigsaw
+ - JDK-8151786: [TESTBUG] java/beans/XMLEncoder/Test4625418.java timed out
intermittently
+ - JDK-8159898: Negative array size in java/beans/Introspector/Test8027905.java
+ - JDK-8166046: [TESTBUG] compiler/stringopts/TestStringObjectInitialization.java fails
with OOME
+ - JDK-8166724: gc/g1/TestHumongousShrinkHeap.java fails with OOME
+ - JDK-8177809: File.lastModified() is losing milliseconds (always ends in 000)
+ - JDK-8178403: DirectAudio in JavaSound may hang and leak
+ - JDK-8180478: tools/launcher/MultipleJRE.sh fails on Windows because of
extra-''
+ - JDK-8183910: gc/arguments/TestAggressiveHeap.java fails intermittently
+ - JDK-8190332: PngReader throws NegativeArraySizeException/OOM error when IHDR width is
very large
+ - JDK-8190679: java/util/Arrays/TimSortStackSize2.java fails with "Initial heap
size set to a larger value than the maximum heap size"
+ - JDK-8191955: AArch64: incorrect prefetch distance causes an internal error
+ - JDK-8199265: java/util/Arrays/TimSortStackSize2.java fails with OOM
+ - JDK-8200550: Xcode 9.3 produce warning -Wexpansion-to-defined
+ - JDK-8203196: C1 emits incorrect code due to integer overflow in _tableswitch keys
+ - JDK-8205014: com/sun/jndi/ldap/DeadSSLLdapTimeoutTest.java failed with "Read
timed out"
+ - JDK-8209996: [PPC64] Fix JFR profiling
+ - JDK-8214345: infinite recursion while checking super class
+ - JDK-8217230: assert(t == t_no_spec) failure in
NodeHash::check_no_speculative_types()
+ - JDK-8217348: assert(thread->is_Java_thread()) failed: just checking
+ - JDK-8225081: Remove Telia Company CA certificate expiring in April 2021
+ - JDK-8225116: Test OwnedWindowsLeak.java intermittently fails
+ - JDK-8230428: Cleanup dead CastIP node code in formssel.cpp
+ - JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails intermittently with NPE
+ - JDK-8231841: AArch64: debug.cpp help() is missing an AArch64 line for pns
+ - JDK-8231949: [PPC64, s390]: Make async profiling more reliable
+ - JDK-8234011: (zipfs) Memory leak in ZipFileSystem.releaseDeflater()
+ - JDK-8241649: Optimize Character.toString
+ - JDK-8243559: Remove root certificates with 1024-bit keys
+ - JDK-8247350: [aarch64] assert(false) failed: wrong size of mach node
+ - JDK-8249278: Revert JDK-8226253 which breaks the spec of AccessibleState.SHOWING for
JList
+ - JDK-8255086: Update the root locale display names
+ - JDK-8255734: VM should ignore SIGXFSZ on ppc64, s390 too
+ - JDK-8257999: Parallel GC crash in gc/parallel/TestDynShrinkHeap.java: new region is
not in covered_region
+ - JDK-8258419: RSA cipher buffer cleanup
+ - JDK-8258669: fastdebug jvm crashes when do event based tracing for monitor inflation
+ - JDK-8258753: StartTlsResponse.close() hangs due to synchronization issues
+ - JDK-8259271: gc/parallel/TestDynShrinkHeap.java still fails
"assert(covered_region.contains(new_memregion)) failed: new region is not in
covered_region"
+ - JDK-8259619: C1: 3-arg StubAssembler::call_RT stack-use condition is incorrect
+ - JDK-8259886: Improve SSL session cache performance and scalability
+ - JDK-8260029: aarch64: fix typo in verify_oop_array
+ - JDK-8260236: better init AnnotationCollector _contended_group
+ - JDK-8260255: C1: LoopInvariantCodeMotion constructor can leave some fields
uninitialized
+ - JDK-8260484: CheckExamples.java / NoJavaLangTest.java fail with jtreg 4.2
+ - JDK-8260704: ParallelGC: oldgen expansion needs release-store for _end
+ - JDK-8261355: No data buffering in SunPKCS11 Cipher encryption when the underlying
mechanism has no padding
+ - JDK-8261867: Backport relevant test changes & additions from JDK-8130125
+ - JDK-8262110: DST starts from incorrect time in 2038
+ - JDK-8262726: AArch64: C1 StubAssembler::call_RT can corrupt stack
+ - JDK-8262730: Enable jdk8u MacOS external debug symbols
+ - JDK-8262864: No debug symbols in image for Windows
--with-native-debug-symbols=external
+ - JDK-8263061: copy wrong unpack200 debuginfo to bin directory after 8252395
+ - JDK-8263504: Some OutputMachOpcodes fields are uninitialized
+ - JDK-8263600: change rmidRunning to a simple lookup
+ - JDK-8264509: jdk8u MacOS zipped debug symbols won't build
+ - JDK-8264562: assert(verify_field_bit(1)) failed: Attempting to write an uninitialized
event field: type
+ - JDK-8264816: Weak handles leak causes GC to take longer
+ - JDK-8265832: runtime/StackGap/testme.sh fails to compile in 8u
+ - JDK-8265988: Fix sun/text/IntHashtable/Bug4170614 for JDK 8u
+ - JDK-8266191: Missing aarch64 parts of JDK-8181872 (C1: possible overflow when
strength reducing integer multiply by constant)
+
+Notes on individual issues:
+===========================
+
+security-libs/java.security:
+
+JDK-8256902: Removed Root Certificates with 1024-bit Keys
+=========================================================
+The following root certificates with weak 1024-bit RSA public keys
+have been removed from the `cacerts` keystore:
+
+Alias Name: thawtepremiumserverca [jdk]
+Distinguished Name: EMAILADDRESS=premium-server(a)thawte.com, CN=Thawte Premium Server CA,
OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town, ST=Western Cape,
C=ZA
+
+Alias Name: verisignclass2g2ca [jdk]
+Distinguished Name: OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For
authorized use only", OU=Class 2 Public Primary Certification Authority - G2,
O="VeriSign, Inc.", C=US
+
+Alias Name: verisignclass3ca [jdk]
+Distinguished Name: OU=Class 3 Public Primary Certification Authority, O="VeriSign,
Inc.", C=US
+
+Alias Name: verisignclass3g2caÂ[jdk]
+Distinguished Name: OU=VeriSign Trust Network, OU="(c) 1998 VeriSign, Inc. - For
authorized use only", OU=Class 3 Public Primary Certification Authority - G2,
O="VeriSign, Inc.", C=US
+
+Alias Name: verisigntsaca [jdk]
+Distinguished Name: CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte,
L=Durbanville, ST=Western Cape, C=ZA
+
+JDK-8261361: Removed Telia Company's Sonera Class2 CA certificate
+=================================================================
+
+The following root certificate have been removed from the cacerts truststore:
+
+Alias Name: soneraclass2ca
+Distinguished Name: CN=Sonera Class2 CA, O=Sonera, C=FI
+
New in release OpenJDK 8u292 (2021-04-20):
===========================================
Live versions of these release notes can be found at:
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 5e15372..1aac854 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -296,7 +296,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u292-b10
+%global shenandoah_revision aarch64-shenandoah-jdk8u302-b01
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -311,12 +311,12 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 3
+%global rpmrelease 0
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
# - N%%{?extraver}{?dist} for GA releases
-%global is_ga 1
+%global is_ga 0
%if %{is_ga}
%global milestone fcs
%global milestone_version %{nil}
@@ -2550,6 +2550,11 @@ cjc.mainProgram(args)
%endif
%changelog
+* Sat May 22 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.302.b01-0.0.ea
+- Update to aarch64-shenandoah-jdk8u302-b01 (EA)
+- Update release notes for 8u302-b01.
+- Switch to EA mode.
+
* Mon May 10 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.292.b10-3
- removed cjc backward comaptiblity, to fix when both rpm 4.16 and 4.17 are in
transaction
diff --git a/sources b/sources
index dc8efbe..6774c52 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b10-4curve.tar.xz) =
3cde5e7eb2c6e72ad20fc3370d0a2d04d122152243196a4edc617495b428ddc16f7f902b7259999936a44232424032848447c87f3d7e296d0d2a902b61e72173
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u302-b01-4curve.tar.xz) =
7a73f7ffcbe368edfd17b1c13509939bc57e7e14e18fa010d1c4341846c5306820111b789e529e37b5c31fb8fb67dfb3daeb12d6814e62cdff57503884dfbc1d
commit f2efa3b9304d84d0547770a7581c52b81ba60cbb
Author: Jiri <jvanek(a)redhat.com>
Date: Mon May 10 20:34:52 2021 +0200
removed cjc backward comaptiblity, to fix when both rpm 4.16 and 4.17 are in
transaction
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 416f16e..5e15372 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -311,7 +311,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 2
+%global rpmrelease 3
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1107,7 +1107,7 @@ Requires: lksctp-tools%{?_isa}
# tool to copy jdk's configs - should be Recommends only, but then only dnf/yum
enforce it,
# not rpm transaction and so no configs are persisted when pure rpm -u is run. It may be
# considered as regression
-Requires: copy-jdk-configs >= 3.9
+Requires: copy-jdk-configs >= 4.0
OrderWithRequires: copy-jdk-configs
# for printing support
Requires: cups-libs
@@ -2369,10 +2369,10 @@ else
return
end
end
--- run content of included file with fake args
+arg = nil ; -- it is better to null the arg up, no meter if they exists or not, and use
cjc as module in unified way, instead of relaying on "main" method during
require "copy_jdk_configs.lua"
cjc = require "copy_jdk_configs.lua"
-arg = {"--currentjvm", "%{uniquesuffix %{nil}}",
"--jvmdir", "%{_jvmdir %{nil}}", "--origname",
"%{name}", "--origjavaver", "%{javaver}",
"--arch", "%{_arch}", "--temp",
"%{rpm_state_dir}/%{name}.%{_arch}"}
-cjc.mainProgram(arg)
+args = {"--currentjvm", "%{uniquesuffix %{nil}}",
"--jvmdir", "%{_jvmdir %{nil}}", "--origname",
"%{name}", "--origjavaver", "%{javaver}",
"--arch", "%{_arch}", "--temp",
"%{rpm_state_dir}/%{name}.%{_arch}"}
+cjc.mainProgram(args)
%post
%{post_script %{nil}}
@@ -2550,6 +2550,9 @@ cjc.mainProgram(arg)
%endif
%changelog
+* Mon May 10 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.292.b10-3
+- removed cjc backward comaptiblity, to fix when both rpm 4.16 and 4.17 are in
transaction
+
* Mon May 03 2021 Sérgio Basto <sergio(a)serjux.com> - 1:1.8.0.292.b10-2
- Fix upgrade path after removal of accessibility subpackage. As main accessibility was
requiring main package,
main package now have to obsolete java-1.8.0-openjdk-accessibility-{release, slowdebug,
fastdebug} < 1:1.8.0.292.b06
commit 808d7a0c2c021dbe2bf9273d444bccf8eb132bc9
Author: Sérgio M. Basto <sergio(a)serjux.com>
Date: Tue May 4 11:22:44 2021 +0100
Fix upgrade path after removal of accessibility subpackage. As main accessibility was
requiring main package,
main package now have to obsolete java-1.8.0-openjdk-accessibility-{release,
slowdebug, fastdebug} < 1:1.8.0.292.b06
otherwise update fails
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 38d4d99..416f16e 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -311,7 +311,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 1
+%global rpmrelease 2
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1465,6 +1465,15 @@ BuildRequires: systemtap-sdt-devel
# when it is built in debug-only this package is just placeholder
%{java_rpo %{nil}}
+# Fix upgrade path after removal of accessibility subpackage
+# on commit 0c79c1451ef42c540682fb75329a92bb110609e7
+# As main accessibility was requiring main package, main package now have to
+# obsolete java-1.8.0-openjdk-accessibility-{release, slowdebug, fastdebug} <
1:1.8.0.292.b06
+# otherwise update fails
+Obsoletes: java-1.8.0-openjdk-accessibility < 1:1.8.0.292.b06
+Obsoletes: java-1.8.0-openjdk-accessibility-slowdebug < 1:1.8.0.292.b06
+Obsoletes: java-1.8.0-openjdk-accessibility-fastdebug < 1:1.8.0.292.b06
+
%description
The %{origin_nice} %{majorver} runtime environment.
@@ -2541,6 +2550,11 @@ cjc.mainProgram(arg)
%endif
%changelog
+* Mon May 03 2021 Sérgio Basto <sergio(a)serjux.com> - 1:1.8.0.292.b10-2
+- Fix upgrade path after removal of accessibility subpackage. As main accessibility was
requiring main package,
+ main package now have to obsolete java-1.8.0-openjdk-accessibility-{release, slowdebug,
fastdebug} < 1:1.8.0.292.b06
+ otherwise update fails
+
* Fri Apr 29 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.292.b10-1
- adapted to newst cjc to fix issue with rpm 4.17
commit 7c44d4d12d148d87c4e471ffb06a93f99d08b0b3
Author: Jiri <jvanek(a)redhat.com>
Date: Thu Apr 29 17:35:13 2021 +0200
Adapted to rpm 4.17 and cjc 4.0
As rpm 4.17 dropped arg from varaibale table, cjc now have to be sued as
module. cjc 4.0 was converted to module
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index b8bf093..38d4d99 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -311,7 +311,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 0
+%global rpmrelease 1
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1107,7 +1107,7 @@ Requires: lksctp-tools%{?_isa}
# tool to copy jdk's configs - should be Recommends only, but then only dnf/yum
enforce it,
# not rpm transaction and so no configs are persisted when pure rpm -u is run. It may be
# considered as regression
-Requires: copy-jdk-configs >= 3.3
+Requires: copy-jdk-configs >= 3.9
OrderWithRequires: copy-jdk-configs
# for printing support
Requires: cups-libs
@@ -2326,7 +2326,13 @@ done
-- whether copy-jdk-configs is installed or not. If so, then configs are copied
-- (copy_jdk_configs from %%{_libexecdir} used) or not copied at all
local posix = require "posix"
-local debug = false
+
+if (os.getenv("debug") == "true") then
+ debug = true;
+ print("cjc: in spec debug is on")
+else
+ debug = false;
+end
SOURCE1 = "%{rpm_state_dir}/copy_jdk_configs.lua"
SOURCE2 = "%{_libexecdir}/copy_jdk_configs.lua"
@@ -2355,8 +2361,9 @@ else
end
end
-- run content of included file with fake args
+cjc = require "copy_jdk_configs.lua"
arg = {"--currentjvm", "%{uniquesuffix %{nil}}",
"--jvmdir", "%{_jvmdir %{nil}}", "--origname",
"%{name}", "--origjavaver", "%{javaver}",
"--arch", "%{_arch}", "--temp",
"%{rpm_state_dir}/%{name}.%{_arch}"}
-require "copy_jdk_configs.lua"
+cjc.mainProgram(arg)
%post
%{post_script %{nil}}
@@ -2534,6 +2541,9 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Fri Apr 29 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.292.b10-1
+- adapted to newst cjc to fix issue with rpm 4.17
+
* Tue Apr 13 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b10-0
- Update to aarch64-shenandoah-jdk8u292-b10 (GA)
- Update release notes for 8u292-b10.
commit 2e183d309d75fc1876656bc6d8af8aa45095a48c
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Thu Apr 22 01:15:41 2021 +0100
Update to aarch64-shenandoah-jdk8u292-b10 (GA)
Update release notes for 8u292-b10.
diff --git a/.gitignore b/.gitignore
index 0855951..c959a85 100644
--- a/.gitignore
+++ b/.gitignore
@@ -228,3 +228,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b07-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b08-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b09-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b10-4curve.tar.xz
diff --git a/NEWS b/NEWS
index fa9e29f..e5dea8d 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,13 @@ Live versions of these release notes can be found at:
*
https://bitly.com/openjdk8u292
*
https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u292.txt
+* Security fixes
+ - JDK-8227467: Better class method invocations
+ - JDK-8244473: Contextualize registration for JNDI
+ - JDK-8244543: Enhanced handling of abstract classes
+ - JDK-8249906, CVE-2021-2163: Enhance opening JARs
+ - JDK-8250568, CVE-2021-2161: Less ambiguous processing
+ - JDK-8253799: Make lists of normal filenames
* Other changes
- JDK-6345095: regression test EmptyClipRenderingTest fails
- JDK-6896810: TEST_BUG: java/lang/ref/SoftReference/Pin.java fails with OOME during
System.out.println
@@ -92,6 +99,7 @@ Live versions of these release notes can be found at:
- JDK-8256682: JDK-8202343 is incomplete
- JDK-8257746: Regression introduced with JDK-8250984 - memory might be null in some
machines
- JDK-8258241: [8u] Missing doPrivileged() hunks from JDK-8226575
+ - JDK-8258247: Couple of issues in fix for JDK-8249906
- JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder.rotateDisk()
- JDK-8258430: 8u backport of JDK-8063107 missing
test/javax/swing/JRadioButton/8041561/bug8041561.java changes
- JDK-8258833: Cancel multi-part cipher operations in SunPKCS11 after failures
@@ -99,10 +107,12 @@ Live versions of these release notes can be found at:
- JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
- JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert will
- JDK-8259384: CUP version wrong in THIRD_PARTY_README after JDK-8233548
+ - JDK-8259428: AlgorithmId.getEncodedParams() should return copy
- JDK-8259568: PPC64 builds broken after JDK-8221408 8u backport
- JDK-8260349: Cannot programmatically retrieve Metaspace max set via
JAVA_TOOL_OPTIONS
- JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
- JDK-8260930: AARCH64: Invalid value passed to critical JNI function
+ - JDK-8261183: Follow on to Make lists of normal filenames
- JDK-8261231: Windows IME was disabled after DnD operation
- JDK-8261766: [8u] hotspot needs to recognise cl.exe 19.16 to build with VS2017
- JDK-8262073: assert(allocates2(pc)) failed: not in CodeBuffer memory
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 36e87cb..b8bf093 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -296,7 +296,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u292-b09
+%global shenandoah_revision aarch64-shenandoah-jdk8u292-b10
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -316,7 +316,7 @@
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
# - N%%{?extraver}{?dist} for GA releases
-%global is_ga 0
+%global is_ga 1
%if %{is_ga}
%global milestone fcs
%global milestone_version %{nil}
@@ -2534,6 +2534,10 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Tue Apr 13 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b10-0
+- Update to aarch64-shenandoah-jdk8u292-b10 (GA)
+- Update release notes for 8u292-b10.
+
* Tue Mar 30 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b09-0.0.ea
- Update to aarch64-shenandoah-jdk8u292-b09 (EA)
- Update release notes for 8u292-b09.
diff --git a/sources b/sources
index 62b0bbb..dc8efbe 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b09-4curve.tar.xz) =
a3c69aba94c5e7ddd391296462bc6fb54c49e76d28d8df230144ccdb5dd584666cc895aeb42a2094d3073d11b64b3b3756b5e499484e7a3510283294df27a8e2
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b10-4curve.tar.xz) =
3cde5e7eb2c6e72ad20fc3370d0a2d04d122152243196a4edc617495b428ddc16f7f902b7259999936a44232424032848447c87f3d7e296d0d2a902b61e72173
commit 2d9c5160dda5d9d785eced1bb70927549b6bf7e7
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Fri Apr 9 04:20:07 2021 +0100
Update to aarch64-shenandoah-jdk8u292-b09 (EA)
Update release notes for 8u292-b09.
diff --git a/.gitignore b/.gitignore
index 662ab2f..0855951 100644
--- a/.gitignore
+++ b/.gitignore
@@ -227,3 +227,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b06-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b07-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b08-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b09-4curve.tar.xz
diff --git a/NEWS b/NEWS
index cc24bef..fa9e29f 100644
--- a/NEWS
+++ b/NEWS
@@ -13,7 +13,7 @@ Live versions of these release notes can be found at:
- JDK-6345095: regression test EmptyClipRenderingTest fails
- JDK-6896810: TEST_BUG: java/lang/ref/SoftReference/Pin.java fails with OOME during
System.out.println
- JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/PDialogTest.java needs update by
removing a infinite loop
- - JDK-7107012: sun.jvm.hostspot.code.CompressedReadStream readDouble() conversion to
long mishandled
+ - JDK-7107012: sun.jvm.hotspot.code.CompressedReadStream readDouble() conversion to
long mishandled
- JDK-7112454: TEST_BUG:
java/awt/Choice/PopdownGeneratesMouseEvents/PopdownGeneratesMouseEvents.html failed
- JDK-7131835: [TEST_BUG] Test does not consider that the rounded edges of the window
in Mac OS 10.7
- JDK-7185221: [macosx] Regtest should not throw exception if a suitable display mode
found
@@ -108,6 +108,7 @@ Live versions of these release notes can be found at:
- JDK-8262073: assert(allocates2(pc)) failed: not in CodeBuffer memory
- JDK-8262075: sun/security/krb5/auto/UseCacheAndStoreKey.java timed out
intermittently
- JDK-8263008: AARCH64: Add debug info for libsaproc.so
+ - JDK-8264171: Missing aarch64 parts of JDK-8236179 (C1 register allocation failure
with T_ADDRESS)
* Shenandoah
- Normalise whitespace in AArch64 sources prior to merge of upstreamed version in
8u292-b01.
- Revert differences against upstream 8u
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index b464e49..36e87cb 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -296,7 +296,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u292-b08
+%global shenandoah_revision aarch64-shenandoah-jdk8u292-b09
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -2534,6 +2534,10 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Tue Mar 30 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b09-0.0.ea
+- Update to aarch64-shenandoah-jdk8u292-b09 (EA)
+- Update release notes for 8u292-b09.
+
* Sat Mar 27 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b08-0.0.ea
- Update to aarch64-shenandoah-jdk8u292-b08 (EA)
- Update release notes for 8u292-b08.
diff --git a/sources b/sources
index c1b4274..62b0bbb 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b08-4curve.tar.xz) =
03df325f6d34de3483609d1aa6de4f1998c6cf8b0502c7d1ee328dae89b5c7a03c3278dde3843e7b7de68291509eea0cda162a620e69fd053a85d3e01170c6ee
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b09-4curve.tar.xz) =
a3c69aba94c5e7ddd391296462bc6fb54c49e76d28d8df230144ccdb5dd584666cc895aeb42a2094d3073d11b64b3b3756b5e499484e7a3510283294df27a8e2
commit 34aae23aafe52e81301ea486aa819c3164dba39b
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Thu Apr 8 07:18:29 2021 +0100
Fix bad date in Changelog.
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 6edd97c..b464e49 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -2543,7 +2543,7 @@ require "copy_jdk_configs.lua"
- Update to aarch64-shenandoah-jdk8u292-b07 (EA)
- Update release notes for 8u292-b07.
-* Mon Mar 24 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.292.b06-0.1.ea
+* Wed Mar 24 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.292.b06-0.1.ea
- removal of atk accessibility bridge bindings:
- removed libatk-wrapper[.]so.* from global _privatelibs
- removed files_accessibility and java_accessibility_rpo macros
commit 5df61f34ef80f723e545bb531f7a4b00a3a6ccb0
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Thu Apr 8 07:13:15 2021 +0100
Update to aarch64-shenandoah-jdk8u292-b08 (EA)
Update release notes for 8u292-b08.
Require tzdata 2021a due to JDK-8260356
diff --git a/.gitignore b/.gitignore
index 0a52cb3..662ab2f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -226,3 +226,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b05-shenandoah-merge-2021-03-11-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b06-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b07-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b08-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 6a07c87..cc24bef 100644
--- a/NEWS
+++ b/NEWS
@@ -40,6 +40,7 @@ Live versions of these release notes can be found at:
- JDK-8171410: aarch64: long multiplyExact shifts by 31 instead of 63
- JDK-8172404: Tools should warn if weak algorithms are used before restricting them
- JDK-8185934: keytool shows "Signature algorithm: SHA1withECDSA, -1-bit
key"
+ - JDK-8191915: JCK tests produce incorrect results with C2
- JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java fails in headless mode
- JDK-8202343: Disable TLS 1.0 and 1.1
- JDK-8209333: Socket reset issue for TLS 1.3 socket close
@@ -85,6 +86,7 @@ Live versions of these release notes can be found at:
- JDK-8255880: UI of Swing components is not redrawn after their internal state
changed
- JDK-8255908: ExceptionInInitializerError due to UncheckedIOException while
initializing cgroupv1 subsystem
- JDK-8255937: Better cleanup for test/jdk/javax/imageio/stream/StreamFlush.java
+ - JDK-8256421: Add 2 HARICA roots to cacerts truststore
- JDK-8256642: [TEST_BUG] jdk/test/javax/sound/midi/MidiSystem/DefaultProperties.java
failed
- JDK-8258079: Eliminate ParNew's use of klass_or_null()
- JDK-8256682: JDK-8202343 is incomplete
@@ -99,6 +101,7 @@ Live versions of these release notes can be found at:
- JDK-8259384: CUP version wrong in THIRD_PARTY_README after JDK-8233548
- JDK-8259568: PPC64 builds broken after JDK-8221408 8u backport
- JDK-8260349: Cannot programmatically retrieve Metaspace max set via
JAVA_TOOL_OPTIONS
+ - JDK-8260356: (tz) Upgrade time-zone data to tzdata2021a
- JDK-8260930: AARCH64: Invalid value passed to critical JNI function
- JDK-8261231: Windows IME was disabled after DnD operation
- JDK-8261766: [8u] hotspot needs to recognise cl.exe 19.16 to build with VS2017
@@ -146,6 +149,17 @@ Notes on individual issues:
security-libs/java.security:
+JDK-8260597: Added 2 HARICA Root CA Certificates
+================================================
+
+The following root certificates have been added to the cacerts truststore:
+
+Alias Name: haricarootca2015
+Distinguished Name: CN=Hellenic Academic and Research Institutions RootCA 2015,
O=Hellenic Academic and Research Institutions Cert. Authority, L=Athens, C=GR
+
+Alias Name: haricaeccrootca2015
+Distinguished Name: CN=Hellenic Academic and Research Institutions ECC RootCA 2015,
O=Hellenic Academic and Research Institutions Cert. Authority, L=Athens, C=GR
+
JDK-8236730: Weak Named Curves in TLS, CertPath, and Signed JAR Disabled by Default
===================================================================================
Weak named curves are disabled by default by adding them to the
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 4d80d62..6edd97c 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -296,7 +296,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u292-b07
+%global shenandoah_revision aarch64-shenandoah-jdk8u292-b08
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -1099,8 +1099,8 @@ Requires: ca-certificates
# Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros
Requires: javapackages-filesystem
# Require zoneinfo data provided by tzdata-java subpackage.
-# 2020f required as of JDK-8259048 in April CPU
-Requires: tzdata-java >= 2020f
+# 2021a required as of JDK-8260356 in April CPU
+Requires: tzdata-java >= 2021a
# for support of kernel stream control
# libsctp.so.1 is being `dlopen`ed on demand
Requires: lksctp-tools%{?_isa}
@@ -1452,8 +1452,8 @@ BuildRequires: java-1.8.0-openjdk-devel
%ifnarch %{jit_arches}
BuildRequires: libffi-devel
%endif
-# 2020f required as of JDK-8259048 in April CPU
-BuildRequires: tzdata-java >= 2020f
+# 2021a required as of JDK-8260356 in April CPU
+BuildRequires: tzdata-java >= 2021a
# Earlier versions have a bug in tree vectorization on PPC
BuildRequires: gcc >= 4.8.3-8
@@ -2534,6 +2534,11 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Sat Mar 27 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b08-0.0.ea
+- Update to aarch64-shenandoah-jdk8u292-b08 (EA)
+- Update release notes for 8u292-b08.
+- Require tzdata 2021a due to JDK-8260356
+
* Thu Mar 25 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b07-0.0.ea
- Update to aarch64-shenandoah-jdk8u292-b07 (EA)
- Update release notes for 8u292-b07.
diff --git a/sources b/sources
index 8d2689b..c1b4274 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b07-4curve.tar.xz) =
d12cba379f610b426ce95b67763e60e6eaf6821f08c69516dac49932c72f116f0e5934ca946877f1caa97efa6259097e5669fed0af9b2bc3bc575c88ef158f44
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b08-4curve.tar.xz) =
03df325f6d34de3483609d1aa6de4f1998c6cf8b0502c7d1ee328dae89b5c7a03c3278dde3843e7b7de68291509eea0cda162a620e69fd053a85d3e01170c6ee
commit b11200180bdbe8b2d780158fd80d7ac4eba50340
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Tue Mar 30 04:17:23 2021 +0100
Update to aarch64-shenandoah-jdk8u292-b07 (EA)
Update release notes for 8u292-b07.
diff --git a/.gitignore b/.gitignore
index cd6ab2b..0a52cb3 100644
--- a/.gitignore
+++ b/.gitignore
@@ -225,3 +225,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b05-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b05-shenandoah-merge-2021-03-11-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b06-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b07-4curve.tar.xz
diff --git a/NEWS b/NEWS
index f9484d0..6a07c87 100644
--- a/NEWS
+++ b/NEWS
@@ -104,6 +104,7 @@ Live versions of these release notes can be found at:
- JDK-8261766: [8u] hotspot needs to recognise cl.exe 19.16 to build with VS2017
- JDK-8262073: assert(allocates2(pc)) failed: not in CodeBuffer memory
- JDK-8262075: sun/security/krb5/auto/UseCacheAndStoreKey.java timed out
intermittently
+ - JDK-8263008: AARCH64: Add debug info for libsaproc.so
* Shenandoah
- Normalise whitespace in AArch64 sources prior to merge of upstreamed version in
8u292-b01.
- Revert differences against upstream 8u
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index cdec57f..4d80d62 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -296,7 +296,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u292-b06
+%global shenandoah_revision aarch64-shenandoah-jdk8u292-b07
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -311,7 +311,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 1
+%global rpmrelease 0
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -2534,6 +2534,10 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Thu Mar 25 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b07-0.0.ea
+- Update to aarch64-shenandoah-jdk8u292-b07 (EA)
+- Update release notes for 8u292-b07.
+
* Mon Mar 24 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.292.b06-0.1.ea
- removal of atk accessibility bridge bindings:
- removed libatk-wrapper[.]so.* from global _privatelibs
diff --git a/sources b/sources
index c1c7289..8d2689b 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b06-4curve.tar.xz) =
f69272380ff719727e4213e17503a76505eb8103b73d582ba5ec862fb002e8becd106aa426d86326401c394362b11eb7b5891fc260f9d06662bce406c5c1a803
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b07-4curve.tar.xz) =
d12cba379f610b426ce95b67763e60e6eaf6821f08c69516dac49932c72f116f0e5934ca946877f1caa97efa6259097e5669fed0af9b2bc3bc575c88ef158f44
commit 0c79c1451ef42c540682fb75329a92bb110609e7
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Wed Mar 24 11:18:46 2021 +0100
removal of atk accessibility bridge bindings:
- removed libatk-wrapper[.]so.* from global _privatelibs
- removed files_accessibility and java_accessibility_rpo macros
- removed patch1 rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch and patch3
rh1648644-java_access_bridge_privileged_security.patch
- removal of accessibility{,-slowdebug,-fastdebug} subpackages
- no longer creating symlinks of %%{_libdir}/java-atk-wrapper/libatk-wrapper.so.0
libatk-wrapper.so and %%{_libdir}/java-atk-wrapper/java-atk-wrapper.jar
java-atk-wrapper.jar
- no longer creating %%{_jvmdir}/%{jredir -- $suffix}/lib/accessibility.properties
with content of "assistive_technologies=org.GNOME.Accessibility.AtkWrapper"
- removal of accessibility{,-slowdebug,-fastdebug} subpackages files sections
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index c3c803c..cdec57f 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -311,7 +311,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 0
+%global rpmrelease 1
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -354,7 +354,7 @@
# fix for
https://bugzilla.redhat.com/show_bug.cgi?id=1111349
#
https://bugzilla.redhat.com/show_bug.cgi?id=1590796#c14
#
https://bugzilla.redhat.com/show_bug.cgi?id=1655938
-%global _privatelibs
libatk-wrapper[.]so.*|libattach[.]so.*|libawt_headless[.]so.*|libawt[.]so.*|libawt_xawt[.]so.*|libdt_socket[.]so.*|libfontmanager[.]so.*|libhprof[.]so.*|libinstrument[.]so.*|libj2gss[.]so.*|libj2pcsc[.]so.*|libj2pkcs11[.]so.*|libjaas_unix[.]so.*|libjava_crw_demo[.]so.*|libjavajpeg[.]so.*|libjdwp[.]so.*|libjli[.]so.*|libjsdt[.]so.*|libjsoundalsa[.]so.*|libjsound[.]so.*|liblcms[.]so.*|libmanagement[.]so.*|libmlib_image[.]so.*|libnet[.]so.*|libnio[.]so.*|libnpt[.]so.*|libsaproc[.]so.*|libsctp[.]so.*|libsplashscreen[.]so.*|libsunec[.]so.*|libunpack[.]so.*|libzip[.]so.*|lib[.]so\\(SUNWprivate_.*
+%global _privatelibs
libattach[.]so.*|libawt_headless[.]so.*|libawt[.]so.*|libawt_xawt[.]so.*|libdt_socket[.]so.*|libfontmanager[.]so.*|libhprof[.]so.*|libinstrument[.]so.*|libj2gss[.]so.*|libj2pcsc[.]so.*|libj2pkcs11[.]so.*|libjaas_unix[.]so.*|libjava_crw_demo[.]so.*|libjavajpeg[.]so.*|libjdwp[.]so.*|libjli[.]so.*|libjsdt[.]so.*|libjsoundalsa[.]so.*|libjsound[.]so.*|liblcms[.]so.*|libmanagement[.]so.*|libmlib_image[.]so.*|libnet[.]so.*|libnio[.]so.*|libnpt[.]so.*|libsaproc[.]so.*|libsctp[.]so.*|libsplashscreen[.]so.*|libsunec[.]so.*|libunpack[.]so.*|libzip[.]so.*|lib[.]so\\(SUNWprivate_.*
%global _publiclibs
libjawt[.]so.*|libjava[.]so.*|libjvm[.]so.*|libverify[.]so.*|libjsig[.]so.*
%if %is_system_jdk
%global __provides_exclude ^(%{_privatelibs})$
@@ -1064,12 +1064,6 @@ exit 0
%endif
}
-%define files_accessibility() %{expand:
-%{_jvmdir}/%{jredir -- %{?1}}/lib/%{archinstall}/libatk-wrapper.so
-%{_jvmdir}/%{jredir -- %{?1}}/lib/ext/java-atk-wrapper.jar
-%{_jvmdir}/%{jredir -- %{?1}}/lib/accessibility.properties
-}
-
# not-duplicated requires/provides/obsoletes for normal/debug packages
%define java_rpo() %{expand:
Requires: fontconfig%{?_isa}
@@ -1200,17 +1194,6 @@ Provides: java-%{origin}-src%{?1} = %{epoch}:%{version}-%{release}
%endif
}
-%define java_accessibility_rpo() %{expand:
-Requires: java-atk-wrapper%{?_isa}
-Requires: %{name}%{?1}%{?_isa} = %{epoch}:%{version}-%{release}
-OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release}
-
-Provides: java-accessibility%{?1} = %{epoch}:%{version}-%{release}
-Provides: java-%{origin}-accessibility%{?1} = %{epoch}:%{version}-%{release}
-Provides: java-%{javaver}-accessibility%{?1} = %{epoch}:%{version}-%{release}
-Provides: java-%{javaver}-%{origin}-accessibility%{?1} = %{epoch}:%{version}-%{release}
-
-}
# Prevent brp-java-repack-jars from being run
%global __jar_repack 0
@@ -1302,11 +1285,6 @@ Source16: CheckVendor.java
# either in their current form or at all.
############################################
-# Accessibility patches
-# Ignore AWTError when assistive technologies are loaded
-Patch1: rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
-# Restrict access to java-atk-wrapper classes
-Patch3: rh1648644-java_access_bridge_privileged_security.patch
# Turn on AssumeMP by default on RHEL systems
Patch534: rh1648246-always_instruct_vm_to_assume_multiple_processors_are_available.patch
# RH1582504: Use RSA as default for keytool, as DSA is disabled in all crypto policies
except LEGACY
@@ -1671,44 +1649,6 @@ BuildArch: noarch
The %{origin_nice} %{majorver} API documentation compressed in a single archive.
%endif
-%if %{include_normal_build}
-%package accessibility
-Summary: %{origin_nice} %{majorver} accessibility connector
-
-%{java_accessibility_rpo %{nil}}
-
-%description accessibility
-Enables accessibility support in %{origin_nice} %{majorver} by using java-atk-wrapper.
This allows
-compatible at-spi2 based accessibility programs to work for AWT and Swing-based
-programs.
-
-Please note, the java-atk-wrapper is still in beta, and %{origin_nice} %{majorver} itself
is still
-being tuned to be working with accessibility features. There are known issues
-with accessibility on, so please do not install this package unless you really
-need to.
-%endif
-
-%if %{include_debug_build}
-%package accessibility-slowdebug
-Summary: %{origin_nice} %{majorver} accessibility connector %{for_debug}
-
-%{java_accessibility_rpo -- %{debug_suffix_unquoted}}
-
-%description accessibility-slowdebug
-See normal java-%{version}-openjdk-accessibility description.
-%endif
-
-%if %{include_fastdebug_build}
-%package accessibility-fastdebug
-Summary: %{origin_nice} %{majorver} accessibility connector %{for_fastdebug}
-
-%{java_accessibility_rpo -- %{fastdebug_suffix_unquoted}}
-
-%description accessibility-fastdebug
-See normal java-%{version}-openjdk-accessibility description.
-%endif
-
-
%if %{with_openjfx_binding}
%package openjfx
Summary: OpenJDK x OpenJFX connector. This package adds symliks finishing Java FX
integration to %{name}
@@ -1832,8 +1772,6 @@ sh %{SOURCE12}
%patch400
%patch401
-%patch1
-%patch3
%patch5
# s390 build fixes
@@ -2317,21 +2255,6 @@ find $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/demo \
| sed 's|^|%dir |' \
> %{name}-demo.files"$suffix"
-# Create links which leads to separately installed java-atk-bridge and allow
configuration
-# links points to java-atk-wrapper - an dependence
- pushd $RPM_BUILD_ROOT/%{_jvmdir}/%{jredir -- $suffix}/lib/%{archinstall}
- ln -s %{_libdir}/java-atk-wrapper/libatk-wrapper.so.0 libatk-wrapper.so
- popd
- pushd $RPM_BUILD_ROOT/%{_jvmdir}/%{jredir -- $suffix}/lib/ext
- ln -s %{_libdir}/java-atk-wrapper/java-atk-wrapper.jar java-atk-wrapper.jar
- popd
- pushd $RPM_BUILD_ROOT/%{_jvmdir}/%{jredir -- $suffix}/lib/
- echo "#Config file to enable java-atk-wrapper" >
accessibility.properties
- echo "" >> accessibility.properties
- echo "assistive_technologies=org.GNOME.Accessibility.AtkWrapper" >>
accessibility.properties
- echo "" >> accessibility.properties
- popd
-
# intentionally after all else, fx links with redirections on its own
%if %{with_openjfx_binding}
FXSDK_FILES=%{name}-openjfx-devel.files"$suffix"
@@ -2534,7 +2457,6 @@ require "copy_jdk_configs.lua"
# placeholder
%endif
-
%if %{include_normal_build}
%files headless
# important note, see
https://bugzilla.redhat.com/show_bug.cgi?id=1038092 for whole
issue
@@ -2558,9 +2480,6 @@ require "copy_jdk_configs.lua"
%files javadoc-zip
%{files_javadoc_zip %{nil}}
-%files accessibility
-%{files_accessibility %{nil}}
-
%if %{with_openjfx_binding}
%files openjfx -f %{name}-openjfx.files
@@ -2584,9 +2503,6 @@ require "copy_jdk_configs.lua"
%files src-slowdebug
%{files_src -- %{debug_suffix_unquoted}}
-%files accessibility-slowdebug
-%{files_accessibility -- %{debug_suffix_unquoted}}
-
%if %{with_openjfx_binding}
%files openjfx-slowdebug -f %{name}-openjfx.files-slowdebug
@@ -2604,16 +2520,12 @@ require "copy_jdk_configs.lua"
%files devel-fastdebug
%{files_devel -- %{fastdebug_suffix_unquoted}}
-
%files demo-fastdebug -f %{name}-demo.files-fastdebug
%{files_demo -- %{fastdebug_suffix_unquoted}}
%files src-fastdebug
%{files_src -- %{fastdebug_suffix_unquoted}}
-%files accessibility-fastdebug
-%{files_accessibility -- %{fastdebug_suffix_unquoted}}
-
%if %{with_openjfx_binding}
%files openjfx-fastdebug -f %{name}-openjfx.files-fastdebug
@@ -2622,6 +2534,16 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Mon Mar 24 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:1.8.0.292.b06-0.1.ea
+- removal of atk accessibility bridge bindings:
+- removed libatk-wrapper[.]so.* from global _privatelibs
+- removed files_accessibility and java_accessibility_rpo macros
+- removed patch1 rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch and patch3
rh1648644-java_access_bridge_privileged_security.patch
+- removal of accessibility{,-slowdebug,-fastdebug} subpackages
+- no longer creating symlinks of %%{_libdir}/java-atk-wrapper/libatk-wrapper.so.0
libatk-wrapper.so and %%{_libdir}/java-atk-wrapper/java-atk-wrapper.jar
java-atk-wrapper.jar
+- no longer creating %%{_jvmdir}/%{jredir -- $suffix}/lib/accessibility.properties with
content of "assistive_technologies=org.GNOME.Accessibility.AtkWrapper"
+- removal of accessibility{,-slowdebug,-fastdebug} subpackages files sections
+
* Mon Mar 22 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b06-0.0.ea
- Update to aarch64-shenandoah-jdk8u292-b06 (EA)
- Update release notes for 8u292-b06.
diff --git a/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
b/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
deleted file mode 100644
index bddd702..0000000
--- a/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff -uNr openjdk-orig/jdk/src/share/classes/java/awt/Toolkit.java
jdk8/jdk/src/share/classes/java/awt/Toolkit.java
---- openjdk-orig/jdk/src/share/classes/java/awt/Toolkit.java 2009-01-23
11:59:47.000000000 -0500
-+++ jdk8/jdk/src/share/classes/java/awt/Toolkit.java 2009-01-23 12:05:20.000000000 -0500
-@@ -883,7 +883,11 @@
- return null;
- }
- });
-- loadAssistiveTechnologies();
-+ try {
-+ loadAssistiveTechnologies();
-+ } catch ( AWTError error) {
-+ // ignore silently
-+ }
- }
- return toolkit;
- }
diff --git a/rh1648644-java_access_bridge_privileged_security.patch
b/rh1648644-java_access_bridge_privileged_security.patch
deleted file mode 100644
index 28060ed..0000000
--- a/rh1648644-java_access_bridge_privileged_security.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-diff --git openjdk.orig/jdk/src/share/lib/security/java.security-linux
openjdk/jdk/src/share/lib/security/java.security-linux
---- openjdk.orig/jdk/src/share/lib/security/java.security-linux
-+++ openjdk/jdk/src/share/lib/security/java.security-linux
-@@ -226,7 +226,9 @@
- com.sun.activation.registries.,\
- jdk.jfr.events.,\
- jdk.jfr.internal.,\
-- jdk.management.jfr.internal.
-+ jdk.management.jfr.internal.,\
-+ org.GNOME.Accessibility.,\
-+ org.GNOME.Bonobo.
-
- #
- # List of comma-separated packages that start with or equal this string
-@@ -279,7 +281,9 @@
- com.sun.activation.registries.,\
- jdk.jfr.events.,\
- jdk.jfr.internal.,\
-- jdk.management.jfr.internal.
-+ jdk.management.jfr.internal.,\
-+ org.GNOME.Accessibility.,\
-+ org.GNOME.Bonobo.
-
- #
- # Determines whether this properties file can be appended to
commit 4efcbc5b8772b8cf79002ef115cec77f28d2da8a
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Mon Mar 22 03:49:43 2021 +0000
Update to aarch64-shenandoah-jdk8u292-b06 (EA)
Update release notes for 8u292-b06.
Require tzdata 2020f due to JDK-8259048
diff --git a/.gitignore b/.gitignore
index 6baa99c..cd6ab2b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -224,3 +224,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b04-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b05-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b05-shenandoah-merge-2021-03-11-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b06-4curve.tar.xz
diff --git a/NEWS b/NEWS
index e3183b6..f9484d0 100644
--- a/NEWS
+++ b/NEWS
@@ -94,6 +94,7 @@ Live versions of these release notes can be found at:
- JDK-8258430: 8u backport of JDK-8063107 missing
test/javax/swing/JRadioButton/8041561/bug8041561.java changes
- JDK-8258833: Cancel multi-part cipher operations in SunPKCS11 after failures
- JDK-8258933: G1 needs klass_or_null_acquire
+ - JDK-8259048: (tz) Upgrade time-zone data to tzdata2020f
- JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert will
- JDK-8259384: CUP version wrong in THIRD_PARTY_README after JDK-8233548
- JDK-8259568: PPC64 builds broken after JDK-8221408 8u backport
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index b468e71..c3c803c 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -296,7 +296,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision
aarch64-shenandoah-jdk8u292-b05-shenandoah-merge-2021-03-11
+%global shenandoah_revision aarch64-shenandoah-jdk8u292-b06
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -311,7 +311,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 2
+%global rpmrelease 0
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -1105,8 +1105,8 @@ Requires: ca-certificates
# Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros
Requires: javapackages-filesystem
# Require zoneinfo data provided by tzdata-java subpackage.
-# 2020b required as of JDK-8254177 in October CPU
-Requires: tzdata-java >= 2020b
+# 2020f required as of JDK-8259048 in April CPU
+Requires: tzdata-java >= 2020f
# for support of kernel stream control
# libsctp.so.1 is being `dlopen`ed on demand
Requires: lksctp-tools%{?_isa}
@@ -1474,8 +1474,8 @@ BuildRequires: java-1.8.0-openjdk-devel
%ifnarch %{jit_arches}
BuildRequires: libffi-devel
%endif
-# 2020b required as of JDK-8254177 in October CPU
-BuildRequires: tzdata-java >= 2020b
+# 2020f required as of JDK-8259048 in April CPU
+BuildRequires: tzdata-java >= 2020f
# Earlier versions have a bug in tree vectorization on PPC
BuildRequires: gcc >= 4.8.3-8
@@ -2622,6 +2622,11 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Mon Mar 22 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b06-0.0.ea
+- Update to aarch64-shenandoah-jdk8u292-b06 (EA)
+- Update release notes for 8u292-b06.
+- Require tzdata 2020f due to JDK-8259048
+
* Thu Mar 18 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b05-0.2.ea
- Update to aarch64-shenandoah-jdk8u292-b05-shenandoah-merge-2021-03-11 (EA)
- Update release notes for 8u292-b05-shenandoah-merge-2021-03-11.
diff --git a/sources b/sources
index 9c386e5..c1c7289 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512
(aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b05-shenandoah-merge-2021-03-11-4curve.tar.xz)
=
fc31d0933b5bf73b91b0e54e7683310b15debcbfe10e41f632a65b9fa4bc5345241107d4b4b99a18bd3e41b0843fbfa06348e267cb19a7e0739b8a2b291b2953
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b06-4curve.tar.xz) =
f69272380ff719727e4213e17503a76505eb8103b73d582ba5ec862fb002e8becd106aa426d86326401c394362b11eb7b5891fc260f9d06662bce406c5c1a803
commit a63448df0f164c612af39e9fbc2e5a174e441cd1
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Fri Mar 19 02:46:15 2021 +0000
Update to aarch64-shenandoah-jdk8u292-b05-shenandoah-merge-2021-03-11 (EA)
Update release notes for 8u292-b05-shenandoah-merge-2021-03-11.
Extend s390 patch to fix issue caused by JDK-8252660 backport and lack of JDK-8188813
in 8u.
Revise JDK-8252660 s390 failure to make _soft_max_size a jlong so pointer types are
accurate.
diff --git a/.gitignore b/.gitignore
index 956b2b5..6baa99c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -223,3 +223,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b03-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b04-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b05-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b05-shenandoah-merge-2021-03-11-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 835e478..e3183b6 100644
--- a/NEWS
+++ b/NEWS
@@ -103,8 +103,41 @@ Live versions of these release notes can be found at:
- JDK-8261766: [8u] hotspot needs to recognise cl.exe 19.16 to build with VS2017
- JDK-8262073: assert(allocates2(pc)) failed: not in CodeBuffer memory
- JDK-8262075: sun/security/krb5/auto/UseCacheAndStoreKey.java timed out
intermittently
+* Shenandoah
- Normalise whitespace in AArch64 sources prior to merge of upstreamed version in
8u292-b01.
- Revert differences against upstream 8u
+ - [backport] 8202976: Add C1 lea patching support for x86
+ - [backport] 8221507: Implement JFR Events for Shenandoah
+ - [backport] 8224573: Fix windows build after JDK-8221507
+ - [backport] 8228369: Shenandoah: Refactor LRB C1 stubs
+ - [backport] 8229474: Shenandoah: Cleanup CM::update_roots()
+ - [backport] 8229709: x86_32 build and test failures after JDK-8228369 (Shenandoah:
Refactor LRB C1 stubs)
+ - [backport] 8231087: Shenandoah: Self-fixing load reference barriers for C1/C2
+ - [backport] 8232747: Shenandoah: Concurrent GC should deactivate SATB before
processing weak roots
+ - [backport] 8232992: Shenandoah: Implement self-fixing interpreter LRB
+ - [backport] 8233021: Shenandoah: SBSC2::is_shenandoah_lrb_call should match all LRB
shapes
+ - [backport] 8233165: Shenandoah:SBSA::gen_load_reference_barrier_stub() should use
pointer register for address on aarch64
+ - [backport] 8233574: Shenandoah: build is broken without jfr
+ - [backport] 8237837: Shenandoah: assert(mem == __null) failed: only one safepoint
+ - [backport] 8238153: CTW: C2 (Shenandoah) compilation fails with "Unknown node in
get_load_addr: CreateEx"
+ - [backport] 8238851: Shenandoah: C1: Resolve into registers of correct type
+ - [backport] 8240315: Shenandoah: Rename ShLBN::get_barrier_strength()
+ - [backport] 8240751: Shenandoah: fold ShenandoahTracer definition
+ - [backport] 8241765: Shenandoah: AARCH64 need to save/restore call clobbered registers
before calling keepalive barrier
+ - [backport] 8244510: Shenandoah: invert SHC2Support::is_in_cset condition
+ - [backport] 8244663: Shenandoah: C2 assertion fails in Matcher::collect_null_checks
+ - [backport] 8244721: CTW: C2 (Shenandoah) compilation fails with "unexpected
infinite loop graph shape"
+ - [backport] 8251451: Shenandoah: Remark ObjectSynchronizer roots with I-U
+ - [backport] 8252660: Shenandoah: support manageable SoftMaxHeapSize option
+ - [backport] 8253224: Shenandoah: ShenandoahStrDedupQueue destructor calls virtual
num_queues()
+ - [backport] 8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint should not access
VMThread state from other threads
+ - [backport] 8255457: Shenandoah: cleanup ShenandoahMarkTask
+ - [backport] 8255760: Shenandoah: match constants style in ShenandoahMarkTask fallback
+ - [backport] 8256806: Shenandoah: optimize shenandoah/jni/TestPinnedGarbage.java test
+ - [backport] 8257641: Shenandoah: Query is_at_shenandoah_safepoint() from control
thread should return false
+ - Fix register allocation for thread register is 32bit LRB
+ - Fix Shenandoah bindings in ADLC formssel
+ - Shenandoah: Backed out weak roots cleaning during full gc
Notes on individual issues:
===========================
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 491bcba..b468e71 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -296,7 +296,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u292-b05
+%global shenandoah_revision
aarch64-shenandoah-jdk8u292-b05-shenandoah-merge-2021-03-11
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -311,7 +311,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 1
+%global rpmrelease 2
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -2622,6 +2622,12 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Thu Mar 18 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b05-0.2.ea
+- Update to aarch64-shenandoah-jdk8u292-b05-shenandoah-merge-2021-03-11 (EA)
+- Update release notes for 8u292-b05-shenandoah-merge-2021-03-11.
+- Extend s390 patch to fix issue caused by JDK-8252660 backport and lack of JDK-8188813
in 8u.
+- Revise JDK-8252660 s390 failure to make _soft_max_size a jlong so pointer types are
accurate.
+
* Thu Mar 18 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b05-0.1.ea
- Re-organise S/390 patches for upstream submission, separating 8u upstream from
Shenandoah fixes.
- Add new formatting case found in memprofiler.cpp on debug builds to PR3593 patch.
diff --git a/s390-8214206_fix.patch b/s390-8214206_fix.patch
index fd5b7c5..1b78a9b 100644
--- a/s390-8214206_fix.patch
+++ b/s390-8214206_fix.patch
@@ -20,3 +20,27 @@ diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenan
// Defensively saturate for product bits:
if (mag < 0) {
+diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahHeap.cpp
openjdk/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahHeap.cpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahHeap.cpp
++++ openjdk/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahHeap.cpp
+@@ -659,7 +659,7 @@
+ }
+
+ size_t ShenandoahHeap::soft_max_capacity() const {
+- size_t v = OrderAccess::load_acquire((volatile size_t*)&_soft_max_size);
++ size_t v = OrderAccess::load_acquire((volatile jlong*)&_soft_max_size);
+ assert(min_capacity() <= v && v <= max_capacity(),
+ err_msg("Should be in bounds: " SIZE_FORMAT " <= "
SIZE_FORMAT " <= " SIZE_FORMAT,
+ min_capacity(), v, max_capacity()));
+diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahHeap.hpp
openjdk/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahHeap.hpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahHeap.hpp
++++ openjdk/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahHeap.hpp
+@@ -155,7 +155,7 @@
+ private:
+ size_t _initial_size;
+ size_t _minimum_size;
+- volatile size_t _soft_max_size;
++ volatile jlong _soft_max_size;
+ shenandoah_padding(0);
+ volatile jlong _used;
+ volatile size_t _committed;
diff --git a/sources b/sources
index b0c0d1b..9c386e5 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b05-4curve.tar.xz) =
6267e958e05c36d010578ea1b773b5575f11c085c4c1036a96f984c44df17d70cb46a5d6db75fb509a900f6918da7bfbbe5e24530691f393069471c7f2b51993
+SHA512
(aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b05-shenandoah-merge-2021-03-11-4curve.tar.xz)
=
fc31d0933b5bf73b91b0e54e7683310b15debcbfe10e41f632a65b9fa4bc5345241107d4b4b99a18bd3e41b0843fbfa06348e267cb19a7e0739b8a2b291b2953
commit c98058256bd97721ffdfb0dbf8a9fe8e7a9f5d47
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Thu Mar 18 18:55:49 2021 +0000
Re-organise S/390 patches for upstream submission, separating 8u upstream from
Shenandoah fixes.
Add new formatting case found in memprofiler.cpp on debug builds to PR3593 patch.
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index aeec4dd..491bcba 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -311,7 +311,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 0
+%global rpmrelease 1
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -2622,6 +2622,10 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Thu Mar 18 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b05-0.1.ea
+- Re-organise S/390 patches for upstream submission, separating 8u upstream from
Shenandoah fixes.
+- Add new formatting case found in memprofiler.cpp on debug builds to PR3593 patch.
+
* Mon Mar 08 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b05-0.0.ea
- Update to aarch64-shenandoah-jdk8u292-b05 (EA)
- Update release notes for 8u292-b05.
diff --git a/jdk8203030-zero_s390_31_bit_size_t_type_conflicts_in_shared_code.patch
b/jdk8203030-zero_s390_31_bit_size_t_type_conflicts_in_shared_code.patch
index 53bceec..4098bdc 100644
--- a/jdk8203030-zero_s390_31_bit_size_t_type_conflicts_in_shared_code.patch
+++ b/jdk8203030-zero_s390_31_bit_size_t_type_conflicts_in_shared_code.patch
@@ -1,7 +1,7 @@
-diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/compactibleFreeListSpace.cpp
openjdk/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/compactibleFreeListSpace.cpp
----
openjdk.orig/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/compactibleFreeListSpace.cpp
-+++
openjdk/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/compactibleFreeListSpace.cpp
-@@ -2659,7 +2659,7 @@
+diff -r 4689eaf1a5c9
src/share/vm/gc_implementation/concurrentMarkSweep/compactibleFreeListSpace.cpp
+---
openjdk.orig/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/compactibleFreeListSpace.cpp Mon
Aug 31 07:09:56 2020 +0100
++++
openjdk/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/compactibleFreeListSpace.cpp Tue
Sep 08 22:20:44 2020 -0400
+@@ -2689,7 +2689,7 @@
if (ResizeOldPLAB && CMSOldPLABResizeQuicker) {
size_t multiple =
_num_blocks[word_sz]/(CMSOldPLABToleranceFactor*CMSOldPLABNumRefills*n_blks);
n_blks += CMSOldPLABReactivityFactor*multiple*n_blks;
@@ -10,10 +10,10 @@ diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/concurrentMarkSwe
}
assert(n_blks > 0, "Error");
_cfls->par_get_chunk_of_blocks(word_sz, n_blks, fl);
-diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp
openjdk/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp
----
openjdk.orig/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp
-+++
openjdk/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp
-@@ -957,7 +957,7 @@
+diff -r 4689eaf1a5c9
src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp
+---
openjdk.orig/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp Mon
Aug 31 07:09:56 2020 +0100
++++
openjdk/hotspot/src/share/vm/gc_implementation/concurrentMarkSweep/concurrentMarkSweepGeneration.cpp Tue
Sep 08 22:20:44 2020 -0400
+@@ -961,7 +961,7 @@
if (free_percentage < desired_free_percentage) {
size_t desired_capacity = (size_t)(used() / ((double) 1 -
desired_free_percentage));
assert(desired_capacity >= capacity(), "invalid expansion size");
@@ -22,7 +22,7 @@ diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/concurrentMarkSwe
if (PrintGCDetails && Verbose) {
size_t desired_capacity = (size_t)(used() / ((double) 1 -
desired_free_percentage));
gclog_or_tty->print_cr("\nFrom compute_new_size: ");
-@@ -6577,7 +6577,7 @@
+@@ -6591,7 +6591,7 @@
HeapWord* curAddr = _markBitMap.startWord();
while (curAddr < _markBitMap.endWord()) {
size_t remaining = pointer_delta(_markBitMap.endWord(), curAddr);
@@ -31,7 +31,7 @@ diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/concurrentMarkSwe
_markBitMap.clear_large_range(chunk);
if (ConcurrentMarkSweepThread::should_yield() &&
!foregroundGCIsActive() &&
-@@ -6875,7 +6875,7 @@
+@@ -6889,7 +6889,7 @@
return;
}
// Double capacity if possible
@@ -40,30 +40,34 @@ diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/concurrentMarkSwe
// Do not give up existing stack until we have managed to
// get the double capacity that we desired.
ReservedSpace rs(ReservedSpace::allocation_align_size_up(
-diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/concurrentMark.cpp
openjdk/hotspot/src/share/vm/gc_implementation/g1/concurrentMark.cpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/concurrentMark.cpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/g1/concurrentMark.cpp
-@@ -3902,7 +3902,7 @@
+diff -r 4689eaf1a5c9 src/share/vm/gc_implementation/g1/concurrentMark.cpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/concurrentMark.cpp Mon Aug 31
07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/gc_implementation/g1/concurrentMark.cpp Tue Sep 08
22:20:44 2020 -0400
+@@ -3916,7 +3916,7 @@
// of things to do) or totally (at the very end).
size_t target_size;
if (partially) {
- target_size = MIN2((size_t)_task_queue->max_elems()/3, GCDrainStackTargetSize);
-+ target_size = MIN2((size_t)(_task_queue->max_elems()/3), (size_t)
GCDrainStackTargetSize);
++ target_size = MIN2((size_t)_task_queue->max_elems()/3,
(size_t)GCDrainStackTargetSize);
} else {
target_size = 0;
}
-@@ -4706,7 +4706,7 @@
- // The > 0 check is to deal with the prev and next live bytes which
- // could be 0.
- if (*hum_bytes > 0) {
-- bytes = MIN2(HeapRegion::GrainBytes, *hum_bytes);
-+ bytes = MIN2(HeapRegion::GrainBytes, (size_t)*hum_bytes);
- *hum_bytes -= bytes;
+diff -r 4689eaf1a5c9 src/share/vm/gc_implementation/g1/g1BiasedArray.hpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1BiasedArray.hpp Mon Aug 31
07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1BiasedArray.hpp Tue Sep 08
22:20:44 2020 -0400
+@@ -78,7 +78,8 @@
+ size_t num_target_elems = pointer_delta(end, bottom, mapping_granularity_in_bytes);
+ idx_t bias = (uintptr_t)bottom / mapping_granularity_in_bytes;
+ address base = create_new_base_array(num_target_elems, target_elem_size_in_bytes);
+- initialize_base(base, num_target_elems, bias, target_elem_size_in_bytes,
log2_intptr(mapping_granularity_in_bytes));
++ initialize_base(base, num_target_elems, bias, target_elem_size_in_bytes,
++ log2_intptr((uintptr_t)mapping_granularity_in_bytes));
}
- return bytes;
-diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1CollectedHeap.cpp
openjdk/hotspot/src/share/vm/gc_implementation/g1/g1CollectedHeap.cpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1CollectedHeap.cpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1CollectedHeap.cpp
+
+ size_t bias() const { return _bias; }
+diff -r 4689eaf1a5c9 src/share/vm/gc_implementation/g1/g1CollectedHeap.cpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1CollectedHeap.cpp Mon Aug 31
07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1CollectedHeap.cpp Tue Sep 08
22:20:44 2020 -0400
@@ -1729,7 +1729,7 @@
verify_region_sets_optional();
@@ -73,21 +77,33 @@ diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1CollectedHea
ergo_verbose1(ErgoHeapSizing,
"attempt heap expansion",
ergo_format_reason("allocation request failed")
-diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1PageBasedVirtualSpace.cpp
openjdk/hotspot/src/share/vm/gc_implementation/g1/g1PageBasedVirtualSpace.cpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1PageBasedVirtualSpace.cpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1PageBasedVirtualSpace.cpp
-@@ -117,7 +117,7 @@
- return reserved_size() - committed_size();
+diff -r 4689eaf1a5c9
src/share/vm/gc_implementation/g1/g1ConcurrentMarkObjArrayProcessor.cpp
+---
openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1ConcurrentMarkObjArrayProcessor.cpp Mon
Aug 31 07:09:56 2020 +0100
++++
openjdk/hotspot/src/share/vm/gc_implementation/g1/g1ConcurrentMarkObjArrayProcessor.cpp Tue
Sep 08 22:20:44 2020 -0400
+@@ -41,7 +41,7 @@
}
--size_t G1PageBasedVirtualSpace::addr_to_page_index(char* addr) const {
-+uintptr_t G1PageBasedVirtualSpace::addr_to_page_index(char* addr) const {
- return (addr - _low_boundary) / _page_size;
- }
+ size_t G1CMObjArrayProcessor::process_array_slice(objArrayOop obj, HeapWord* start_from,
size_t remaining) {
+- size_t words_to_scan = MIN2(remaining, ObjArrayMarkingStride);
++ size_t words_to_scan = MIN2(remaining, (size_t)ObjArrayMarkingStride);
+
+ if (remaining > ObjArrayMarkingStride) {
+ push_array_slice(start_from + ObjArrayMarkingStride);
+diff -r 4689eaf1a5c9 src/share/vm/gc_implementation/g1/g1PageBasedVirtualSpace.hpp
+---
openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1PageBasedVirtualSpace.hpp Mon Aug
31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1PageBasedVirtualSpace.hpp Tue Sep
08 22:20:44 2020 -0400
+@@ -89,7 +89,7 @@
+ void pretouch_internal(size_t start_page, size_t end_page);
+
+ // Returns the index of the page which contains the given address.
+- uintptr_t addr_to_page_index(char* addr) const;
++ size_t addr_to_page_index(char* addr) const;
+ // Returns the address of the given page index.
+ char* page_start(size_t index) const;
-diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupQueue.cpp
openjdk/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupQueue.cpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupQueue.cpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupQueue.cpp
+diff -r 4689eaf1a5c9 src/share/vm/gc_implementation/g1/g1StringDedupQueue.cpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupQueue.cpp Mon Aug
31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupQueue.cpp Tue Sep 08
22:20:44 2020 -0400
@@ -38,7 +38,7 @@
_cancel(false),
_empty(true),
@@ -97,9 +113,9 @@ diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupQ
_queues = NEW_C_HEAP_ARRAY(G1StringDedupWorkerQueue, _nqueues, mtGC);
for (size_t i = 0; i < _nqueues; i++) {
new (_queues + i)
G1StringDedupWorkerQueue(G1StringDedupWorkerQueue::default_segment_size(),
_max_cache_size, _max_size);
-diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupTable.cpp
openjdk/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupTable.cpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupTable.cpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupTable.cpp
+diff -r 4689eaf1a5c9 src/share/vm/gc_implementation/g1/g1StringDedupTable.cpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupTable.cpp Mon Aug
31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupTable.cpp Tue Sep 08
22:20:44 2020 -0400
@@ -120,7 +120,7 @@
};
@@ -109,10 +125,10 @@ diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupT
_max_list_length(0),
_cached(PaddedArray<G1StringDedupEntryList,
mtGC>::create_unfreeable((uint)_nlists)),
_overflowed(PaddedArray<G1StringDedupEntryList,
mtGC>::create_unfreeable((uint)_nlists)) {
-diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/heapRegion.cpp
openjdk/hotspot/src/share/vm/gc_implementation/g1/heapRegion.cpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/heapRegion.cpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/g1/heapRegion.cpp
-@@ -109,7 +109,7 @@
+diff -r 4689eaf1a5c9 src/share/vm/gc_implementation/g1/heapRegion.cpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/heapRegion.cpp Mon Aug 31
07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/gc_implementation/g1/heapRegion.cpp Tue Sep 08 22:20:44
2020 -0400
+@@ -110,7 +110,7 @@
if (FLAG_IS_DEFAULT(G1HeapRegionSize)) {
size_t average_heap_size = (initial_heap_size + max_heap_size) / 2;
region_size = MAX2(average_heap_size / HeapRegionBounds::target_number(),
@@ -121,9 +137,9 @@ diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/heapRegion.cpp
}
int region_size_log = log2_long((jlong) region_size);
-diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/parNew/parNewGeneration.cpp
openjdk/hotspot/src/share/vm/gc_implementation/parNew/parNewGeneration.cpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/parNew/parNewGeneration.cpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/parNew/parNewGeneration.cpp
+diff -r 4689eaf1a5c9 src/share/vm/gc_implementation/parNew/parNewGeneration.cpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/parNew/parNewGeneration.cpp Mon
Aug 31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/gc_implementation/parNew/parNewGeneration.cpp Tue Sep 08
22:20:44 2020 -0400
@@ -194,7 +194,7 @@
const size_t num_overflow_elems = of_stack->size();
const size_t space_available = queue->max_elems() - queue->size();
@@ -133,29 +149,27 @@ diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/parNew/parNewGene
num_overflow_elems);
// Transfer the most recent num_take_elems from the overflow
// stack to our work queue.
-diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/parallelScavenge/psParallelCompact.cpp
openjdk/hotspot/src/share/vm/gc_implementation/parallelScavenge/psParallelCompact.cpp
----
openjdk.orig/hotspot/src/share/vm/gc_implementation/parallelScavenge/psParallelCompact.cpp
-+++
openjdk/hotspot/src/share/vm/gc_implementation/parallelScavenge/psParallelCompact.cpp
-@@ -910,8 +910,8 @@
+diff -r 4689eaf1a5c9
src/share/vm/gc_implementation/parallelScavenge/psParallelCompact.cpp
+---
openjdk.orig/hotspot/src/share/vm/gc_implementation/parallelScavenge/psParallelCompact.cpp Mon
Aug 31 07:09:56 2020 +0100
++++
openjdk/hotspot/src/share/vm/gc_implementation/parallelScavenge/psParallelCompact.cpp Tue
Sep 08 22:20:44 2020 -0400
+@@ -912,7 +912,7 @@
+
void PSParallelCompact::initialize_dead_wood_limiter()
{
- const size_t max = 100;
-- _dwl_mean = double(MIN2(ParallelOldDeadWoodLimiterMean, max)) / 100.0;
-- _dwl_std_dev = double(MIN2(ParallelOldDeadWoodLimiterStdDev, max)) / 100.0;
-+ _dwl_mean = double(MIN2((size_t)ParallelOldDeadWoodLimiterMean, max)) / 100.0;
-+ _dwl_std_dev = double(MIN2((size_t)ParallelOldDeadWoodLimiterStdDev, max)) / 100.0;
+- const size_t max = 100;
++ const uintx max = 100;
+ _dwl_mean = double(MIN2(ParallelOldDeadWoodLimiterMean, max)) / 100.0;
+ _dwl_std_dev = double(MIN2(ParallelOldDeadWoodLimiterStdDev, max)) / 100.0;
_dwl_first_term = 1.0 / (sqrt(2.0 * M_PI) * _dwl_std_dev);
- DEBUG_ONLY(_dwl_initialized = true;)
- _dwl_adjustment = normal_distribution(1.0);
-diff --git openjdk.orig/hotspot/src/share/vm/memory/collectorPolicy.cpp
openjdk/hotspot/src/share/vm/memory/collectorPolicy.cpp
---- openjdk.orig/hotspot/src/share/vm/memory/collectorPolicy.cpp
-+++ openjdk/hotspot/src/share/vm/memory/collectorPolicy.cpp
+diff -r 4689eaf1a5c9 src/share/vm/memory/collectorPolicy.cpp
+--- openjdk.orig/hotspot/src/share/vm/memory/collectorPolicy.cpp Mon Aug 31 07:09:56 2020
+0100
++++ openjdk/hotspot/src/share/vm/memory/collectorPolicy.cpp Tue Sep 08 22:20:44 2020
-0400
@@ -385,7 +385,7 @@
uintx calculated_size = NewSize + OldSize;
double shrink_factor = (double) MaxHeapSize / calculated_size;
uintx smaller_new_size = align_size_down((uintx)(NewSize * shrink_factor),
_gen_alignment);
- FLAG_SET_ERGO(uintx, NewSize, MAX2(young_gen_size_lower_bound(),
smaller_new_size));
-+ FLAG_SET_ERGO(uintx, NewSize, MAX2(young_gen_size_lower_bound(),
(size_t)smaller_new_size));
++ FLAG_SET_ERGO(uintx, NewSize, MAX2((uintx)young_gen_size_lower_bound(),
smaller_new_size));
_initial_gen0_size = NewSize;
// OldSize is already aligned because above we aligned MaxHeapSize to
@@ -168,7 +182,7 @@ diff --git
openjdk.orig/hotspot/src/share/vm/memory/collectorPolicy.cpp openjdk/
}
assert(max_new_size > 0, "All paths should set max_new_size");
-@@ -455,24 +455,23 @@
+@@ -455,23 +455,25 @@
// lower limit.
_min_gen0_size = NewSize;
desired_new_size = NewSize;
@@ -190,15 +204,16 @@ diff --git
openjdk.orig/hotspot/src/share/vm/memory/collectorPolicy.cpp openjdk/
// NewRatio is overly large, the resulting sizes can be too
// small.
- _min_gen0_size = MAX2(scale_by_NewRatio_aligned(_min_heap_byte_size), NewSize);
-+ _min_gen0_size = MAX2(scale_by_NewRatio_aligned(_min_heap_byte_size),
(size_t)NewSize);
++ _min_gen0_size = MAX2(scale_by_NewRatio_aligned(_min_heap_byte_size),
++ (size_t)NewSize);
desired_new_size =
- MAX2(scale_by_NewRatio_aligned(_initial_heap_byte_size), NewSize);
-- }
-+ MAX2(scale_by_NewRatio_aligned(_initial_heap_byte_size), (size_t)NewSize); }
++ MAX2(scale_by_NewRatio_aligned(_initial_heap_byte_size),
++ (size_t)NewSize);
+ }
assert(_min_gen0_size > 0, "Sanity check");
- _initial_gen0_size = desired_new_size;
-@@ -573,7 +572,7 @@
+@@ -573,7 +575,7 @@
} else {
// It's been explicitly set on the command line. Use the
// OldSize and then determine the consequences.
@@ -207,9 +222,9 @@ diff --git
openjdk.orig/hotspot/src/share/vm/memory/collectorPolicy.cpp openjdk/
_initial_gen1_size = OldSize;
// If the user has explicitly set an OldSize that is inconsistent
-diff --git openjdk.orig/hotspot/src/share/vm/memory/metaspace.cpp
openjdk/hotspot/src/share/vm/memory/metaspace.cpp
---- openjdk.orig/hotspot/src/share/vm/memory/metaspace.cpp
-+++ openjdk/hotspot/src/share/vm/memory/metaspace.cpp
+diff -r 4689eaf1a5c9 src/share/vm/memory/metaspace.cpp
+--- openjdk.orig/hotspot/src/share/vm/memory/metaspace.cpp Mon Aug 31 07:09:56 2020
+0100
++++ openjdk/hotspot/src/share/vm/memory/metaspace.cpp Tue Sep 08 22:20:44 2020 -0400
@@ -1482,7 +1482,7 @@
void MetaspaceGC::post_initialize() {
@@ -237,38 +252,18 @@ diff --git openjdk.orig/hotspot/src/share/vm/memory/metaspace.cpp
openjdk/hotspo
if (PrintGCDetails && Verbose) {
gclog_or_tty->print_cr(" "
" maximum_free_percentage: %6.2f"
-@@ -3361,7 +3361,7 @@
+@@ -3320,7 +3320,7 @@
+ // Make the first class chunk bigger than a medium chunk so it's not put
// on the medium chunk list. The next chunk will be small and progress
// from there. This size calculated by -version.
- _first_class_chunk_word_size = MIN2((size_t)MediumChunk*6,
-- (CompressedClassSpaceSize/BytesPerWord)*2);
-+
(size_t)(CompressedClassSpaceSize/BytesPerWord)*2);
+- _first_class_chunk_word_size = MIN2((size_t)MediumChunk*6,
++ _first_class_chunk_word_size = MIN2((uintx)MediumChunk*6,
+ (CompressedClassSpaceSize/BytesPerWord)*2);
_first_class_chunk_word_size = align_word_size_up(_first_class_chunk_word_size);
// Arbitrarily set the initial virtual space to a multiple
- // of the boot class loader size.
-diff --git openjdk.orig/hotspot/src/share/vm/memory/threadLocalAllocBuffer.cpp
openjdk/hotspot/src/share/vm/memory/threadLocalAllocBuffer.cpp
---- openjdk.orig/hotspot/src/share/vm/memory/threadLocalAllocBuffer.cpp
-+++ openjdk/hotspot/src/share/vm/memory/threadLocalAllocBuffer.cpp
-@@ -250,13 +250,13 @@
- size_t init_sz = 0;
-
- if (TLABSize > 0) {
-- init_sz = TLABSize / HeapWordSize;
-+ init_sz = (size_t)(TLABSize / HeapWordSize);
- } else if (global_stats() != NULL) {
- // Initial size is a function of the average number of allocating threads.
- unsigned nof_threads = global_stats()->allocating_threads_avg();
-
-- init_sz = (Universe::heap()->tlab_capacity(myThread()) / HeapWordSize) /
-- (nof_threads * target_refills());
-+ init_sz = (size_t)((Universe::heap()->tlab_capacity(myThread()) / HeapWordSize)
/
-+ (nof_threads * target_refills()));
- init_sz = align_object_size(init_sz);
- }
- init_sz = MIN2(MAX2(init_sz, min_size()), max_size());
-diff --git openjdk.orig/hotspot/src/share/vm/oops/objArrayKlass.inline.hpp
openjdk/hotspot/src/share/vm/oops/objArrayKlass.inline.hpp
---- openjdk.orig/hotspot/src/share/vm/oops/objArrayKlass.inline.hpp
-+++ openjdk/hotspot/src/share/vm/oops/objArrayKlass.inline.hpp
+diff -r 4689eaf1a5c9 src/share/vm/oops/objArrayKlass.inline.hpp
+--- openjdk.orig/hotspot/src/share/vm/oops/objArrayKlass.inline.hpp Mon Aug 31 07:09:56
2020 +0100
++++ openjdk/hotspot/src/share/vm/oops/objArrayKlass.inline.hpp Tue Sep 08 22:20:44 2020
-0400
@@ -48,7 +48,7 @@
const size_t beg_index = size_t(index);
assert(beg_index < len || len == 0, "index too large");
@@ -287,10 +282,10 @@ diff --git
openjdk.orig/hotspot/src/share/vm/oops/objArrayKlass.inline.hpp openj
const size_t end_index = beg_index + stride;
T* const base = (T*)a->base();
T* const beg = base + beg_index;
-diff --git openjdk.orig/hotspot/src/share/vm/runtime/arguments.cpp
openjdk/hotspot/src/share/vm/runtime/arguments.cpp
---- openjdk.orig/hotspot/src/share/vm/runtime/arguments.cpp
-+++ openjdk/hotspot/src/share/vm/runtime/arguments.cpp
-@@ -1289,7 +1289,7 @@
+diff -r 4689eaf1a5c9 src/share/vm/runtime/arguments.cpp
+--- openjdk.orig/hotspot/src/share/vm/runtime/arguments.cpp Mon Aug 31 07:09:56 2020
+0100
++++ openjdk/hotspot/src/share/vm/runtime/arguments.cpp Tue Sep 08 22:20:44 2020 -0400
+@@ -1301,7 +1301,7 @@
// NewSize was set on the command line and it is larger than
// preferred_max_new_size.
if (!FLAG_IS_DEFAULT(NewSize)) { // NewSize explicitly set at command-line
@@ -299,7 +294,7 @@ diff --git openjdk.orig/hotspot/src/share/vm/runtime/arguments.cpp
openjdk/hotsp
} else {
FLAG_SET_ERGO(uintx, MaxNewSize, preferred_max_new_size);
}
-@@ -1314,8 +1314,8 @@
+@@ -1326,8 +1326,8 @@
// Unless explicitly requested otherwise, make young gen
// at least min_new, and at most preferred_max_new_size.
if (FLAG_IS_DEFAULT(NewSize)) {
@@ -310,7 +305,7 @@ diff --git openjdk.orig/hotspot/src/share/vm/runtime/arguments.cpp
openjdk/hotsp
if (PrintGCDetails && Verbose) {
// Too early to use gclog_or_tty
tty->print_cr("CMS ergo set NewSize: " SIZE_FORMAT, NewSize);
-@@ -1325,7 +1325,7 @@
+@@ -1337,7 +1337,7 @@
// so it's NewRatio x of NewSize.
if (FLAG_IS_DEFAULT(OldSize)) {
if (max_heap > NewSize) {
@@ -319,25 +314,15 @@ diff --git openjdk.orig/hotspot/src/share/vm/runtime/arguments.cpp
openjdk/hotsp
if (PrintGCDetails && Verbose) {
// Too early to use gclog_or_tty
tty->print_cr("CMS ergo set OldSize: " SIZE_FORMAT, OldSize);
-diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1ConcurrentMarkObjArrayProcessor.cpp
openjdk/hotspot/src/share/vm/gc_implementation/g1/g1ConcurrentMarkObjArrayProcessor.cpp
----
openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1ConcurrentMarkObjArrayProcessor.cpp
-+++
openjdk/hotspot/src/share/vm/gc_implementation/g1/g1ConcurrentMarkObjArrayProcessor.cpp
-@@ -41,7 +41,7 @@
+diff -r 4689eaf1a5c9 src/share/vm/runtime/os.cpp
+--- openjdk.orig/hotspot/src/share/vm/runtime/os.cpp Mon Aug 31 07:09:56 2020 +0100
++++ openjdk/hotspot/src/share/vm/runtime/os.cpp Tue Sep 08 22:20:44 2020 -0400
+@@ -1272,7 +1272,7 @@
}
- size_t G1CMObjArrayProcessor::process_array_slice(objArrayOop obj, HeapWord* start_from,
size_t remaining) {
-- size_t words_to_scan = MIN2(remaining, ObjArrayMarkingStride);
-+ size_t words_to_scan = MIN2(remaining, (size_t) ObjArrayMarkingStride);
-
- if (remaining > ObjArrayMarkingStride) {
- push_array_slice(start_from + ObjArrayMarkingStride);
-diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahUtils.cpp
openjdk/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahUtils.cpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahUtils.cpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahUtils.cpp
-@@ -150,5 +150,5 @@
- return value;
- }
-
-- return (size_t)1 << (log2_intptr(value) + 1);
-+ return (size_t)1 << (log2_intptr((uintptr_t) value) + 1);
- }
+ void os::set_memory_serialize_page(address page) {
+- int count = log2_intptr(sizeof(class JavaThread)) - log2_int(64);
++ int count = log2_intptr((uintptr_t)sizeof(class JavaThread)) - log2_int(64);
+ _mem_serialize_page = (volatile int32_t *)page;
+ // We initialize the serialization page shift count here
+ // We assume a cache line size of 64 bytes
diff --git
a/pr3593-s390_use_z_format_specifier_for_size_t_arguments_as_size_t_not_equals_to_int.patch
b/pr3593-s390_use_z_format_specifier_for_size_t_arguments_as_size_t_not_equals_to_int.patch
index e1e7214..a980895 100644
---
a/pr3593-s390_use_z_format_specifier_for_size_t_arguments_as_size_t_not_equals_to_int.patch
+++
b/pr3593-s390_use_z_format_specifier_for_size_t_arguments_as_size_t_not_equals_to_int.patch
@@ -141,3 +141,26 @@ diff --git
openjdk.orig/hotspot/src/share/vm/utilities/globalDefinitions.hpp ope
#define INTX_FORMAT "%" PRIdPTR
#define UINTX_FORMAT "%" PRIuPTR
+diff --git openjdk.orig/hotspot/src/share/vm/runtime/memprofiler.cpp
openjdk/hotspot/src/share/vm/runtime/memprofiler.cpp
+--- openjdk.orig/hotspot/src/share/vm/runtime/memprofiler.cpp
++++ openjdk/hotspot/src/share/vm/runtime/memprofiler.cpp
+@@ -117,16 +117,16 @@
+ }
+
+ // Print trace line in log
+- fprintf(_log_fp, "%6.1f,%5d,%5d," UINTX_FORMAT_W(6) ","
UINTX_FORMAT_W(6) ",",
++ fprintf(_log_fp, "%6.1f,%5d,%5d," SIZE_FORMAT_W(6) ","
SIZE_FORMAT_W(6) ",",
+ os::elapsedTime(),
+ Threads::number_of_threads(),
+ SystemDictionary::number_of_classes(),
+ Universe::heap()->used() / K,
+ Universe::heap()->capacity() / K);
+
+- fprintf(_log_fp, UINTX_FORMAT_W(6) ",", CodeCache::capacity() / K);
++ fprintf(_log_fp, SIZE_FORMAT_W(6) ",", CodeCache::capacity() / K);
+
+- fprintf(_log_fp, UINTX_FORMAT_W(6) "," UINTX_FORMAT_W(6) ","
UINTX_FORMAT_W(6) "\n",
++ fprintf(_log_fp, SIZE_FORMAT_W(6) "," SIZE_FORMAT_W(6) ","
SIZE_FORMAT_W(6) "\n",
+ handles_memory_usage / K,
+ resource_memory_usage / K,
+ OopMapCache::memory_usage() / K);
diff --git a/s390-8214206_fix.patch b/s390-8214206_fix.patch
index 42902cf..fd5b7c5 100644
--- a/s390-8214206_fix.patch
+++ b/s390-8214206_fix.patch
@@ -1,16 +1,13 @@
-diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1BiasedArray.hpp
openjdk/hotspot/src/share/vm/gc_implementation/g1/g1BiasedArray.hpp
---- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1BiasedArray.hpp
-+++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1BiasedArray.hpp
-@@ -78,7 +78,8 @@
- size_t num_target_elems = pointer_delta(end, bottom, mapping_granularity_in_bytes);
- idx_t bias = (uintptr_t)bottom / mapping_granularity_in_bytes;
- address base = create_new_base_array(num_target_elems, target_elem_size_in_bytes);
-- initialize_base(base, num_target_elems, bias, target_elem_size_in_bytes,
log2_intptr(mapping_granularity_in_bytes));
-+ initialize_base(base, num_target_elems, bias, target_elem_size_in_bytes,
-+ log2_long(mapping_granularity_in_bytes));
+diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahUtils.cpp
openjdk/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahUtils.cpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahUtils.cpp
++++ openjdk/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahUtils.cpp
+@@ -150,5 +150,5 @@
+ return value;
}
- size_t bias() const { return _bias; }
+- return (size_t)1 << (log2_intptr(value) + 1);
++ return (size_t)1 << (log2_intptr((uintptr_t) value) + 1);
+ }
diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahNumberSeq.cpp
openjdk/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahNumberSeq.cpp
---
openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahNumberSeq.cpp
+++ openjdk/hotspot/src/share/vm/gc_implementation/shenandoah/shenandoahNumberSeq.cpp
@@ -19,19 +16,7 @@ diff --git
openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenan
Atomic::add(val, &_sum);
- int mag = log2_intptr(val) + 1;
-+ int mag = log2_long(val) + 1;
++ int mag = log2_intptr((uintptr_t)val) + 1;
// Defensively saturate for product bits:
if (mag < 0) {
-diff --git openjdk.orig/hotspot/src/share/vm/runtime/os.cpp
openjdk/hotspot/src/share/vm/runtime/os.cpp
---- openjdk.orig/hotspot/src/share/vm/runtime/os.cpp
-+++ openjdk/hotspot/src/share/vm/runtime/os.cpp
-@@ -1284,7 +1284,7 @@
- }
-
- void os::set_memory_serialize_page(address page) {
-- int count = log2_intptr(sizeof(class JavaThread)) - log2_int(64);
-+ int count = log2_long(sizeof(class JavaThread)) - log2_int(64);
- _mem_serialize_page = (volatile int32_t *)page;
- // We initialize the serialization page shift count here
- // We assume a cache line size of 64 bytes
commit 13bfe740ca068594961a45c85db435f8a471688f
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Tue Mar 9 17:18:55 2021 +0000
Update to aarch64-shenandoah-jdk8u292-b05 (EA)
Update release notes for 8u292-b05.
diff --git a/.gitignore b/.gitignore
index 543be9e..956b2b5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -222,3 +222,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b02-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b03-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b04-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b05-4curve.tar.xz
diff --git a/NEWS b/NEWS
index a34e64e..835e478 100644
--- a/NEWS
+++ b/NEWS
@@ -10,17 +10,26 @@ Live versions of these release notes can be found at:
*
https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u292.txt
* Other changes
+ - JDK-6345095: regression test EmptyClipRenderingTest fails
+ - JDK-6896810: TEST_BUG: java/lang/ref/SoftReference/Pin.java fails with OOME during
System.out.println
- JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/PDialogTest.java needs update by
removing a infinite loop
+ - JDK-7107012: sun.jvm.hostspot.code.CompressedReadStream readDouble() conversion to
long mishandled
+ - JDK-7112454: TEST_BUG:
java/awt/Choice/PopdownGeneratesMouseEvents/PopdownGeneratesMouseEvents.html failed
+ - JDK-7131835: [TEST_BUG] Test does not consider that the rounded edges of the window
in Mac OS 10.7
+ - JDK-7185221: [macosx] Regtest should not throw exception if a suitable display mode
found
- JDK-8031126: java/lang/management/ThreadMXBean/ThreadUserTime.java fails
intermittently
- JDK-8035166: Remove dependency on EC classes from pkcs11 provider
- JDK-8035186: j2se_jdk/jdk/test/java/lang/invoke/lambda/LogGeneratedClassesTest.java -
assertion error
- JDK-8038723: Openup some PrinterJob tests
+ - JDK-8041464: [TEST_BUG] CustomClassLoaderTransferTest does not support OS X
- JDK-8041561: Inconsistent opacity behaviour between JCheckBox and JRadioButton
- JDK-8061777: (zipfs) IllegalArgumentException in ZipCoder.toString when using
Shitft_JIS
+ - JDK-8078024: javac, several incorporation steps are silently failing when an error
should be reported
- JDK-8078450: Implement consistent process for quarantine of tests
- JDK-8078614: WindowsClassicLookAndFeel MetalComboBoxUI.getbaseLine fails with
IllegalArgumentException
- JDK-8080953: [TEST_BUG]Test java/awt/FontClass/DebugFonts.java fails due to wrongly
typed bugid
- JDK-8081547: Prepare client libs regression tests for running in a concurrent,
headless jtreg environment
+ - JDK-8129626: G1: set_in_progress() and clear_started() needs a barrier on non-TSO
platforms
- JDK-8141457: keytool default cert fingerprint algorithm should be SHA-256
- JDK-8145051: Wrong parameter name in synthetic lambda method leads to verifier error
- JDK-8150204: (fs) Enhance java/nio/file/Files/probeContentType/Basic.java debugging
output
@@ -34,6 +43,7 @@ Live versions of these release notes can be found at:
- JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java fails in headless mode
- JDK-8202343: Disable TLS 1.0 and 1.1
- JDK-8209333: Socket reset issue for TLS 1.3 socket close
+ - JDK-8211301: [macos] support full window content options
- JDK-8211339: NPE during SSL handshake caused by HostnameChecker
- JDK-8216987: ciMethodData::load_data() unpacks MDOs with non-atomic copy
- JDK-8217338: [Containers] Improve systemd slice memory limit support
@@ -56,9 +66,11 @@ Live versions of these release notes can be found at:
- JDK-8236500: Windows ucrt.dll should be looked up in versioned WINSDK subdirectory
- JDK-8238579: HttpsURLConnection drops the timeout and hangs forever in read
- JDK-8239091: Reversed arguments in call to strstr in freetype "debug"
code.
+ - JDK-8240353: AArch64: missing support for -XX:+ExtendedDTraceProbes in C1
- JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use fiber-friendly
java.util.concurrent.locks in JSSE"
- JDK-8242141: New System Properties to configure the TLS signature schemes
- JDK-8244621: [macos10.15] Garbled FX printing plus CoreText warnings on Catalina when
building with Xcode 11
+ - JDK-8248336: AArch64: C2: offset overflow in BoxLockNode::emit
- JDK-8249183: JVM crash in "AwtFrame::WmSize" method
- JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is not highlighted in
GTKLookAndFeel
- JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
@@ -76,6 +88,7 @@ Live versions of these release notes can be found at:
- JDK-8256642: [TEST_BUG] jdk/test/javax/sound/midi/MidiSystem/DefaultProperties.java
failed
- JDK-8258079: Eliminate ParNew's use of klass_or_null()
- JDK-8256682: JDK-8202343 is incomplete
+ - JDK-8257746: Regression introduced with JDK-8250984 - memory might be null in some
machines
- JDK-8258241: [8u] Missing doPrivileged() hunks from JDK-8226575
- JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder.rotateDisk()
- JDK-8258430: 8u backport of JDK-8063107 missing
test/javax/swing/JRadioButton/8041561/bug8041561.java changes
@@ -86,7 +99,9 @@ Live versions of these release notes can be found at:
- JDK-8259568: PPC64 builds broken after JDK-8221408 8u backport
- JDK-8260349: Cannot programmatically retrieve Metaspace max set via
JAVA_TOOL_OPTIONS
- JDK-8260930: AARCH64: Invalid value passed to critical JNI function
+ - JDK-8261231: Windows IME was disabled after DnD operation
- JDK-8261766: [8u] hotspot needs to recognise cl.exe 19.16 to build with VS2017
+ - JDK-8262073: assert(allocates2(pc)) failed: not in CodeBuffer memory
- JDK-8262075: sun/security/krb5/auto/UseCacheAndStoreKey.java timed out
intermittently
- Normalise whitespace in AArch64 sources prior to merge of upstreamed version in
8u292-b01.
- Revert differences against upstream 8u
@@ -171,6 +186,53 @@ used for the TLS connections.
The names are described in the "Signature Schemes" section of the
*Java Security Standard Algorithm Names Specification*.
+tools/javac:
+
+JDK-8177368: Several incorporation steps are silently failing when an error should be
reported
+==============================================================================================
+Reporting previously silent errors found during incorporation, JLS
+8§18.3, was supposed to be a clean-up with performance only
+implications. But consider the test case:
+
+import java.util.Arrays;
+import java.util.List;
+
+class Klass {
+ public static <A> List<List<A>> foo(List<? extends A>... lists)
{
+ return foo(Arrays.asList(lists));
+ }
+
+ public static <B> List<List<B>> foo(List<? extends List<?
extends B>> lists) {
+ return null;
+ }
+}
+
+This code was not accepted before the patch for [1], but after this
+patch the compiler is accepting it. Accepting this code is the right
+behavior as not reporting incorporation errors was a bug in the
+compiler. While determining the applicability of method: <B>
+List<List<B>> foo(List<? extends List<? extends B>> lists) for
which
+we have the constraints: b <: Object t <: List<? extends B> t<:Object
+List<? extends A> <: t first, inference variable b is selected for
+instantiation: b = CAP1 of ? extends A so this implies that: t <:
+List<? extends CAP1 of ? extends A> t<: Object List<? extends A> <: t
+
+Now all the bounds are checked for consistency. While checking if
+List<? extends A> is a subtype of List<? extends CAP1 of ? extends A>
+a bound error is reported. Before the compiler was just swallowing
+it. As now the error is reported while inference variable b is being
+instantiated, the bound set is rolled back to it's initial state, 'b'
+is instantiated to Object, and with this instantiation the constraint
+set is solvable, the method is applicable, it's the only applicable
+one and the code is accepted as correct. The compiler behavior in this
+case is defined at JLS 8 §18.4
+
+This fix has source compatibility impact, right now code that wasn't
+being accepted is now being accepted by the javac compiler. Currently
+there are no reports of any other kind of incompatibility.
+
+[1]
https://bugs.openjdk.java.net/browse/JDK-8078024
+
New in release OpenJDK 8u282 (2021-01-19):
===========================================
Live versions of these release notes can be found at:
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 0249414..aeec4dd 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -296,7 +296,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u292-b04
+%global shenandoah_revision aarch64-shenandoah-jdk8u292-b05
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -2622,6 +2622,10 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Mon Mar 08 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b05-0.0.ea
+- Update to aarch64-shenandoah-jdk8u292-b05 (EA)
+- Update release notes for 8u292-b05.
+
* Fri Mar 05 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b04-0.0.ea
- Update to aarch64-shenandoah-jdk8u292-b04 (EA)
- Update release notes for 8u292-b04.
diff --git a/sources b/sources
index fb2e5a7..b0c0d1b 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b04-4curve.tar.xz) =
db7a66478b34da1edc52488ee1ec3d8ce4bd3795df58ad9b34bdb8bc0cb863b6b29aa14c696fb5f48ac474def3b840bc2b279ffe16fffded838e2aec54f1fe1e
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b05-4curve.tar.xz) =
6267e958e05c36d010578ea1b773b5575f11c085c4c1036a96f984c44df17d70cb46a5d6db75fb509a900f6918da7bfbbe5e24530691f393069471c7f2b51993
commit 1b76c65723c98decdad20cc4dd1aab7cb40de68e
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Fri Mar 5 06:01:54 2021 +0000
Update to aarch64-shenandoah-jdk8u292-b04 (EA)
Update release notes for 8u292-b04.
diff --git a/.gitignore b/.gitignore
index 1e967ba..543be9e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -221,3 +221,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b01-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b02-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b03-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b04-4curve.tar.xz
diff --git a/NEWS b/NEWS
index edf401b..a34e64e 100644
--- a/NEWS
+++ b/NEWS
@@ -16,6 +16,7 @@ Live versions of these release notes can be found at:
- JDK-8035186: j2se_jdk/jdk/test/java/lang/invoke/lambda/LogGeneratedClassesTest.java -
assertion error
- JDK-8038723: Openup some PrinterJob tests
- JDK-8041561: Inconsistent opacity behaviour between JCheckBox and JRadioButton
+ - JDK-8061777: (zipfs) IllegalArgumentException in ZipCoder.toString when using
Shitft_JIS
- JDK-8078450: Implement consistent process for quarantine of tests
- JDK-8078614: WindowsClassicLookAndFeel MetalComboBoxUI.getbaseLine fails with
IllegalArgumentException
- JDK-8080953: [TEST_BUG]Test java/awt/FontClass/DebugFonts.java fails due to wrongly
typed bugid
@@ -23,9 +24,11 @@ Live versions of these release notes can be found at:
- JDK-8141457: keytool default cert fingerprint algorithm should be SHA-256
- JDK-8145051: Wrong parameter name in synthetic lambda method leads to verifier error
- JDK-8150204: (fs) Enhance java/nio/file/Files/probeContentType/Basic.java debugging
output
+ - JDK-8158525: Update a few java/net tests to use the loopback address instead of the
host address
- JDK-8160217: JavaSound should clean up resources better
- JDK-8167281: IIOMetadataNode bugs in getElementsByTagName and NodeList.item methods
- JDK-8168996: C2 crash at postaloc.cpp:140 : assert(false) failed: unexpected yanked
node
+ - JDK-8171410: aarch64: long multiplyExact shifts by 31 instead of 63
- JDK-8172404: Tools should warn if weak algorithms are used before restricting them
- JDK-8185934: keytool shows "Signature algorithm: SHA1withECDSA, -1-bit
key"
- JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java fails in headless mode
@@ -37,6 +40,7 @@ Live versions of these release notes can be found at:
- JDK-8219991: New fix of the deadlock in sun.security.ssl.SSLSocketImpl
- JDK-8221408: Windows 32bit build build errors/warnings in hotspot
- JDK-8223186: HotSpot compile warnings from GCC 9
+ - JDK-8225435: Upgrade IANA Language Subtag Registry to the latest for JDK14
- JDK-8225805: Java Access Bridge does not close the logger
- JDK-8226899: Problemlist compiler/rtm tests
- JDK-8227642: [TESTBUG] Make docker tests podman compatible
@@ -46,7 +50,10 @@ Live versions of these release notes can be found at:
- JDK-8233228: Disable weak named curves by default in TLS, CertPath, and Signed JAR
- JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests support TLSv1.3
- JDK-8234728: Some security tests should support TLSv1.3
+ - JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
+ - JDK-8235311: Tag mismatch may alert bad_record_mac
- JDK-8235874: The ordering of Cipher Suites is not maintained provided through
jdk.tls.client.cipherSuites and jdk.tls.server.cipherSuites system property.
+ - JDK-8236500: Windows ucrt.dll should be looked up in versioned WINSDK subdirectory
- JDK-8238579: HttpsURLConnection drops the timeout and hangs forever in read
- JDK-8239091: Reversed arguments in call to strstr in freetype "debug"
code.
- JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use fiber-friendly
java.util.concurrent.locks in JSSE"
@@ -77,7 +84,10 @@ Live versions of these release notes can be found at:
- JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert will
- JDK-8259384: CUP version wrong in THIRD_PARTY_README after JDK-8233548
- JDK-8259568: PPC64 builds broken after JDK-8221408 8u backport
+ - JDK-8260349: Cannot programmatically retrieve Metaspace max set via
JAVA_TOOL_OPTIONS
- JDK-8260930: AARCH64: Invalid value passed to critical JNI function
+ - JDK-8261766: [8u] hotspot needs to recognise cl.exe 19.16 to build with VS2017
+ - JDK-8262075: sun/security/krb5/auto/UseCacheAndStoreKey.java timed out
intermittently
- Normalise whitespace in AArch64 sources prior to merge of upstreamed version in
8u292-b01.
- Revert differences against upstream 8u
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 58c87bd..0249414 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -296,7 +296,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u292-b03
+%global shenandoah_revision aarch64-shenandoah-jdk8u292-b04
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -2622,6 +2622,10 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Fri Mar 05 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b04-0.0.ea
+- Update to aarch64-shenandoah-jdk8u292-b04 (EA)
+- Update release notes for 8u292-b04.
+
* Thu Mar 04 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b03-0.0.ea
- Update to aarch64-shenandoah-jdk8u292-b03 (EA)
- Update release notes for 8u292-b03.
diff --git a/sources b/sources
index b463d0a..fb2e5a7 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b03-4curve.tar.xz) =
9dabe45a32d25fd4332006e2b5b17a6bf43693cee3cb82a371c91857d647f86c5c50453b4a95a1c65121ca21fb4a74f9779925a07707f2b3d2e06b946b84b9ea
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b04-4curve.tar.xz) =
db7a66478b34da1edc52488ee1ec3d8ce4bd3795df58ad9b34bdb8bc0cb863b6b29aa14c696fb5f48ac474def3b840bc2b279ffe16fffded838e2aec54f1fe1e
commit 36a26ce298d7cf8ee36ea8d4c2ec3bc0dc9e446a
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Thu Mar 4 18:37:48 2021 +0000
Update to aarch64-shenandoah-jdk8u292-b03 (EA)
Update release notes for 8u292-b03.
diff --git a/.gitignore b/.gitignore
index b701844..1e967ba 100644
--- a/.gitignore
+++ b/.gitignore
@@ -220,3 +220,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u282-b08-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b01-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b02-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b03-4curve.tar.xz
diff --git a/NEWS b/NEWS
index 2645cdb..edf401b 100644
--- a/NEWS
+++ b/NEWS
@@ -21,16 +21,20 @@ Live versions of these release notes can be found at:
- JDK-8080953: [TEST_BUG]Test java/awt/FontClass/DebugFonts.java fails due to wrongly
typed bugid
- JDK-8081547: Prepare client libs regression tests for running in a concurrent,
headless jtreg environment
- JDK-8141457: keytool default cert fingerprint algorithm should be SHA-256
+ - JDK-8145051: Wrong parameter name in synthetic lambda method leads to verifier error
- JDK-8150204: (fs) Enhance java/nio/file/Files/probeContentType/Basic.java debugging
output
- JDK-8160217: JavaSound should clean up resources better
- JDK-8167281: IIOMetadataNode bugs in getElementsByTagName and NodeList.item methods
- JDK-8168996: C2 crash at postaloc.cpp:140 : assert(false) failed: unexpected yanked
node
+ - JDK-8172404: Tools should warn if weak algorithms are used before restricting them
- JDK-8185934: keytool shows "Signature algorithm: SHA1withECDSA, -1-bit
key"
- JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java fails in headless mode
- JDK-8202343: Disable TLS 1.0 and 1.1
+ - JDK-8209333: Socket reset issue for TLS 1.3 socket close
- JDK-8211339: NPE during SSL handshake caused by HostnameChecker
- JDK-8216987: ciMethodData::load_data() unpacks MDOs with non-atomic copy
- JDK-8217338: [Containers] Improve systemd slice memory limit support
+ - JDK-8219991: New fix of the deadlock in sun.security.ssl.SSLSocketImpl
- JDK-8221408: Windows 32bit build build errors/warnings in hotspot
- JDK-8223186: HotSpot compile warnings from GCC 9
- JDK-8225805: Java Access Bridge does not close the logger
@@ -44,6 +48,8 @@ Live versions of these release notes can be found at:
- JDK-8234728: Some security tests should support TLSv1.3
- JDK-8235874: The ordering of Cipher Suites is not maintained provided through
jdk.tls.client.cipherSuites and jdk.tls.server.cipherSuites system property.
- JDK-8238579: HttpsURLConnection drops the timeout and hangs forever in read
+ - JDK-8239091: Reversed arguments in call to strstr in freetype "debug"
code.
+ - JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use fiber-friendly
java.util.concurrent.locks in JSSE"
- JDK-8242141: New System Properties to configure the TLS signature schemes
- JDK-8244621: [macos10.15] Garbled FX printing plus CoreText warnings on Catalina when
building with Xcode 11
- JDK-8249183: JVM crash in "AwtFrame::WmSize" method
@@ -57,10 +63,12 @@ Live versions of these release notes can be found at:
- JDK-8253476: TestUseContainerSupport.java fails on some Linux kernels w/o swap limit
capabilities
- JDK-8253932: SSL debug log prints incorrect caller info
- JDK-8254854: [cgroups v1] Metric limits not properly detected on some join controller
combinations
+ - JDK-8255880: UI of Swing components is not redrawn after their internal state
changed
- JDK-8255908: ExceptionInInitializerError due to UncheckedIOException while
initializing cgroupv1 subsystem
- JDK-8255937: Better cleanup for test/jdk/javax/imageio/stream/StreamFlush.java
- JDK-8256642: [TEST_BUG] jdk/test/javax/sound/midi/MidiSystem/DefaultProperties.java
failed
- JDK-8258079: Eliminate ParNew's use of klass_or_null()
+ - JDK-8256682: JDK-8202343 is incomplete
- JDK-8258241: [8u] Missing doPrivileged() hunks from JDK-8226575
- JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder.rotateDisk()
- JDK-8258430: 8u backport of JDK-8063107 missing
test/javax/swing/JRadioButton/8041561/bug8041561.java changes
@@ -69,6 +77,7 @@ Live versions of these release notes can be found at:
- JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert will
- JDK-8259384: CUP version wrong in THIRD_PARTY_README after JDK-8233548
- JDK-8259568: PPC64 builds broken after JDK-8221408 8u backport
+ - JDK-8260930: AARCH64: Invalid value passed to critical JNI function
- Normalise whitespace in AArch64 sources prior to merge of upstreamed version in
8u292-b01.
- Revert differences against upstream 8u
@@ -116,6 +125,15 @@ jdk.disabled.namedCurves` either from specific or from all
curves, remove the specific named curve(s) from the
`jdk.disabled.namedCurves` property.
+JDK-8244286: Tools Warn If Weak Algorithms Are Used
+===================================================
+The `keytool` and `jarsigner` tools have been updated to warn users
+when weak cryptographic algorithms are used in keys, certificates, and
+signed JARs before they are disabled. The weak algorithms are set in
+the `jdk.security.legacyAlgorithms` security property in the
+`java.security` configuration file. In this release, the tools issue
+warnings for the SHA-1 hash algorithm and 1024-bit RSA/DSA keys.
+
security-libs/javax.net.ssl:
JDK-8256490: Disable TLS 1.0 and 1.1
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index d60b160..58c87bd 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -296,7 +296,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u292-b02
+%global shenandoah_revision aarch64-shenandoah-jdk8u292-b03
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -2622,6 +2622,10 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Thu Mar 04 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b03-0.0.ea
+- Update to aarch64-shenandoah-jdk8u292-b03 (EA)
+- Update release notes for 8u292-b03.
+
* Tue Mar 02 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b02-0.0.ea
- Update to aarch64-shenandoah-jdk8u292-b02 (EA)
- Update release notes for 8u292-b02.
diff --git a/sources b/sources
index 14dc49a..b463d0a 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b02-4curve.tar.xz) =
8b08ade80d5ee2fc9c175242b0f3ecddb342791bfab56779ca2f8b30de48c4f5e116dd23a8c5ad495c38a84d96738e7ba2011b6a96752cf71105d19a53cfe821
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b03-4curve.tar.xz) =
9dabe45a32d25fd4332006e2b5b17a6bf43693cee3cb82a371c91857d647f86c5c50453b4a95a1c65121ca21fb4a74f9779925a07707f2b3d2e06b946b84b9ea
commit af1441c7511f2cf209e73b9de33aa391e5098486
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Wed Mar 3 02:14:53 2021 +0000
Update to aarch64-shenandoah-jdk8u292-b02 (EA)
Update release notes for 8u292-b02.
diff --git a/.gitignore b/.gitignore
index 20468b5..b701844 100644
--- a/.gitignore
+++ b/.gitignore
@@ -219,3 +219,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u282-b07-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u282-b08-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b01-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b02-4curve.tar.xz
diff --git a/NEWS b/NEWS
index bc656ee..2645cdb 100644
--- a/NEWS
+++ b/NEWS
@@ -17,6 +17,7 @@ Live versions of these release notes can be found at:
- JDK-8038723: Openup some PrinterJob tests
- JDK-8041561: Inconsistent opacity behaviour between JCheckBox and JRadioButton
- JDK-8078450: Implement consistent process for quarantine of tests
+ - JDK-8078614: WindowsClassicLookAndFeel MetalComboBoxUI.getbaseLine fails with
IllegalArgumentException
- JDK-8080953: [TEST_BUG]Test java/awt/FontClass/DebugFonts.java fails due to wrongly
typed bugid
- JDK-8081547: Prepare client libs regression tests for running in a concurrent,
headless jtreg environment
- JDK-8141457: keytool default cert fingerprint algorithm should be SHA-256
@@ -25,6 +26,7 @@ Live versions of these release notes can be found at:
- JDK-8167281: IIOMetadataNode bugs in getElementsByTagName and NodeList.item methods
- JDK-8168996: C2 crash at postaloc.cpp:140 : assert(false) failed: unexpected yanked
node
- JDK-8185934: keytool shows "Signature algorithm: SHA1withECDSA, -1-bit
key"
+ - JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java fails in headless mode
- JDK-8202343: Disable TLS 1.0 and 1.1
- JDK-8211339: NPE during SSL handshake caused by HostnameChecker
- JDK-8216987: ciMethodData::load_data() unpacks MDOs with non-atomic copy
@@ -45,7 +47,9 @@ Live versions of these release notes can be found at:
- JDK-8242141: New System Properties to configure the TLS signature schemes
- JDK-8244621: [macos10.15] Garbled FX printing plus CoreText warnings on Catalina when
building with Xcode 11
- JDK-8249183: JVM crash in "AwtFrame::WmSize" method
+ - JDK-8249251: [dark_mode ubuntu 20.04] The selected menu is not highlighted in
GTKLookAndFeel
- JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
+ - JDK-8250582: Revert Principal Name type to NT-UNKNOWN when requesting TGS Kerberos
tickets
- JDK-8250984: Memory Docker tests fail on some Linux kernels w/o cgroupv1 swap limit
capabilities
- JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
- JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/DisposeFrameOnDragTest.java fails
on Windows
@@ -60,11 +64,13 @@ Live versions of these release notes can be found at:
- JDK-8258241: [8u] Missing doPrivileged() hunks from JDK-8226575
- JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder.rotateDisk()
- JDK-8258430: 8u backport of JDK-8063107 missing
test/javax/swing/JRadioButton/8041561/bug8041561.java changes
+ - JDK-8258833: Cancel multi-part cipher operations in SunPKCS11 after failures
- JDK-8258933: G1 needs klass_or_null_acquire
- JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert will
- JDK-8259384: CUP version wrong in THIRD_PARTY_README after JDK-8233548
- JDK-8259568: PPC64 builds broken after JDK-8221408 8u backport
- Normalise whitespace in AArch64 sources prior to merge of upstreamed version in
8u292-b01.
+ - Revert differences against upstream 8u
Notes on individual issues:
===========================
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 99525d3..d60b160 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -296,7 +296,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u292-b01
+%global shenandoah_revision aarch64-shenandoah-jdk8u292-b02
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -2622,6 +2622,10 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Tue Mar 02 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b02-0.0.ea
+- Update to aarch64-shenandoah-jdk8u292-b02 (EA)
+- Update release notes for 8u292-b02.
+
* Fri Feb 19 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b01-0.0.ea
- Update to aarch64-shenandoah-jdk8u292-b01 (EA)
- Update release notes for 8u292-b01.
diff --git a/sources b/sources
index 49a40a0..14dc49a 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b01-4curve.tar.xz) =
35e527c387f55af66132cdae8c8ea198700d731ce2a69136cf7e02a8f837a6f2d9c96303c84468305cc7762d65c3f95ef8264218a82652a00063179d2557a648
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b02-4curve.tar.xz) =
8b08ade80d5ee2fc9c175242b0f3ecddb342791bfab56779ca2f8b30de48c4f5e116dd23a8c5ad495c38a84d96738e7ba2011b6a96752cf71105d19a53cfe821
commit 572aa88c5790feba3ff49c2a7b716dd592c275a1
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Sat Feb 20 03:23:35 2021 +0000
Update to aarch64-shenandoah-jdk8u292-b01 (EA)
Update release notes for 8u292-b01.
Switch to EA mode.
Update tarball generation script to use PR3822 which handles JDK-8233228 &
JDK-8035166 changes
diff --git a/.gitignore b/.gitignore
index a9304d6..20468b5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -218,3 +218,4 @@
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u282-b06-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u282-b07-4curve.tar.xz
/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u282-b08-4curve.tar.xz
+/aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b01-4curve.tar.xz
diff --git a/NEWS b/NEWS
index ee1e724..bc656ee 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,140 @@ Key:
JDK-X -
https://bugs.openjdk.java.net/browse/JDK-X
CVE-XXXX-YYYY:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
+New in release OpenJDK 8u292 (2021-04-20):
+===========================================
+Live versions of these release notes can be found at:
+ *
https://bitly.com/openjdk8u292
+ *
https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u292.txt
+
+* Other changes
+ - JDK-6949753: [TEST BUG]: java/awt/print/PageFormat/PDialogTest.java needs update by
removing a infinite loop
+ - JDK-8031126: java/lang/management/ThreadMXBean/ThreadUserTime.java fails
intermittently
+ - JDK-8035166: Remove dependency on EC classes from pkcs11 provider
+ - JDK-8035186: j2se_jdk/jdk/test/java/lang/invoke/lambda/LogGeneratedClassesTest.java -
assertion error
+ - JDK-8038723: Openup some PrinterJob tests
+ - JDK-8041561: Inconsistent opacity behaviour between JCheckBox and JRadioButton
+ - JDK-8078450: Implement consistent process for quarantine of tests
+ - JDK-8080953: [TEST_BUG]Test java/awt/FontClass/DebugFonts.java fails due to wrongly
typed bugid
+ - JDK-8081547: Prepare client libs regression tests for running in a concurrent,
headless jtreg environment
+ - JDK-8141457: keytool default cert fingerprint algorithm should be SHA-256
+ - JDK-8150204: (fs) Enhance java/nio/file/Files/probeContentType/Basic.java debugging
output
+ - JDK-8160217: JavaSound should clean up resources better
+ - JDK-8167281: IIOMetadataNode bugs in getElementsByTagName and NodeList.item methods
+ - JDK-8168996: C2 crash at postaloc.cpp:140 : assert(false) failed: unexpected yanked
node
+ - JDK-8185934: keytool shows "Signature algorithm: SHA1withECDSA, -1-bit
key"
+ - JDK-8202343: Disable TLS 1.0 and 1.1
+ - JDK-8211339: NPE during SSL handshake caused by HostnameChecker
+ - JDK-8216987: ciMethodData::load_data() unpacks MDOs with non-atomic copy
+ - JDK-8217338: [Containers] Improve systemd slice memory limit support
+ - JDK-8221408: Windows 32bit build build errors/warnings in hotspot
+ - JDK-8223186: HotSpot compile warnings from GCC 9
+ - JDK-8225805: Java Access Bridge does not close the logger
+ - JDK-8226899: Problemlist compiler/rtm tests
+ - JDK-8227642: [TESTBUG] Make docker tests podman compatible
+ - JDK-8228434: jdk/net/Sockets/Test.java fails after JDK-8227642
+ - JDK-8229284: jdk/internal/platform/cgroup/TestCgroupMetrics.java fails for -
memory:getMemoryUsage
+ - JDK-8230388: Problemlist additional compiler/rtm tests
+ - JDK-8233228: Disable weak named curves by default in TLS, CertPath, and Signed JAR
+ - JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests support TLSv1.3
+ - JDK-8234728: Some security tests should support TLSv1.3
+ - JDK-8235874: The ordering of Cipher Suites is not maintained provided through
jdk.tls.client.cipherSuites and jdk.tls.server.cipherSuites system property.
+ - JDK-8238579: HttpsURLConnection drops the timeout and hangs forever in read
+ - JDK-8242141: New System Properties to configure the TLS signature schemes
+ - JDK-8244621: [macos10.15] Garbled FX printing plus CoreText warnings on Catalina when
building with Xcode 11
+ - JDK-8249183: JVM crash in "AwtFrame::WmSize" method
+ - JDK-8249588: libwindowsaccessbridge issues on 64bit Windows
+ - JDK-8250984: Memory Docker tests fail on some Linux kernels w/o cgroupv1 swap limit
capabilities
+ - JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
+ - JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/DisposeFrameOnDragTest.java fails
on Windows
+ - JDK-8253368: TLS connection always receives close_notify exception
+ - JDK-8253476: TestUseContainerSupport.java fails on some Linux kernels w/o swap limit
capabilities
+ - JDK-8253932: SSL debug log prints incorrect caller info
+ - JDK-8254854: [cgroups v1] Metric limits not properly detected on some join controller
combinations
+ - JDK-8255908: ExceptionInInitializerError due to UncheckedIOException while
initializing cgroupv1 subsystem
+ - JDK-8255937: Better cleanup for test/jdk/javax/imageio/stream/StreamFlush.java
+ - JDK-8256642: [TEST_BUG] jdk/test/javax/sound/midi/MidiSystem/DefaultProperties.java
failed
+ - JDK-8258079: Eliminate ParNew's use of klass_or_null()
+ - JDK-8258241: [8u] Missing doPrivileged() hunks from JDK-8226575
+ - JDK-8258396: SIGILL in jdk.jfr.internal.PlatformRecorder.rotateDisk()
+ - JDK-8258430: 8u backport of JDK-8063107 missing
test/javax/swing/JRadioButton/8041561/bug8041561.java changes
+ - JDK-8258933: G1 needs klass_or_null_acquire
+ - JDK-8259312: VerifyCACerts.java fails as soneraclass2ca cert will
+ - JDK-8259384: CUP version wrong in THIRD_PARTY_README after JDK-8233548
+ - JDK-8259568: PPC64 builds broken after JDK-8221408 8u backport
+ - Normalise whitespace in AArch64 sources prior to merge of upstreamed version in
8u292-b01.
+
+Notes on individual issues:
+===========================
+
+security-libs/java.security:
+
+JDK-8236730: Weak Named Curves in TLS, CertPath, and Signed JAR Disabled by Default
+===================================================================================
+Weak named curves are disabled by default by adding them to the
+following `disabledAlgorithms` security properties:
+
+* jdk.tls.disabledAlgorithms
+* jdk.certpath.disabledAlgorithms
+* jdk.jar.disabledAlgorithms
+
+Red Hat has always disabled many of the curves provided by upstream,
+so the only addition in this release is:
+
+* secp256k1
+
+The curves that remain enabled are:
+
+* secp256r1
+* secp384r1
+* secp521r1
+* X25519
+* X448
+
+When large numbers of weak named curves need to be disabled, adding
+individual named curves to each `disabledAlgorithms` property would be
+overwhelming. To relieve this, a new security property,
+`jdk.disabled.namedCurves`, is implemented that can list the named
+curves common to all of the `disabledAlgorithms` properties. To use
+the new property in the `disabledAlgorithms` properties, precede the
+full property name with the keyword `include`. Users can still add
+individual named curves to `disabledAlgorithms` properties separate
+from this new property. No other properties can be included in the
+`disabledAlgorithms` properties.
+
+To restore the named curves, remove the `include
+jdk.disabled.namedCurves` either from specific or from all
+`disabledAlgorithms` security properties. To restore one or more
+curves, remove the specific named curve(s) from the
+`jdk.disabled.namedCurves` property.
+
+security-libs/javax.net.ssl:
+
+JDK-8256490: Disable TLS 1.0 and 1.1
+====================================
+TLS 1.0 and 1.1 are versions of the TLS protocol that are no longer
+considered secure and have been superseded by more secure and modern
+versions (TLS 1.2 and 1.3).
+
+These versions have now been disabled by default. If you encounter
+issues, you can, at your own risk, re-enable the versions by removing
+"TLSv1" and/or "TLSv1.1" from the `jdk.tls.disabledAlgorithms`
+security property in the `java.security` configuration file.
+
+JDK-8242147: New System Properties to Configure the TLS Signature Schemes
+=========================================================================
+Two new system properties have been added to customize the TLS
+signature schemes in JDK. `jdk.tls.client.SignatureSchemes` has been
+added for the TLS client side, and `jdk.tls.server.SignatureSchemes`
+has been added for the server side.
+
+Each system property contains a comma-separated list of supported
+signature scheme names specifying the signature schemes that could be
+used for the TLS connections.
+
+The names are described in the "Signature Schemes" section of the
+*Java Security Standard Algorithm Names Specification*.
+
New in release OpenJDK 8u282 (2021-01-19):
===========================================
Live versions of these release notes can be found at:
diff --git a/generate_source_tarball.sh b/generate_source_tarball.sh
index 5f3c6f0..94b75e7 100755
--- a/generate_source_tarball.sh
+++ b/generate_source_tarball.sh
@@ -4,7 +4,7 @@
# Example:
# When used from local repo set REPO_ROOT pointing to file:// with your repo
# If your local repo follows upstream forests conventions, it may be enough to set
OPENJDK_URL
-# If you want to use a local copy of patch PR3799, set the path to it in the PR3799
variable
+# If you want to use a local copy of patch PR3822, set the path to it in the PR3822
variable
#
# In any case you have to set PROJECT_NAME REPO_NAME and VERSION. eg:
# PROJECT_NAME=jdk8u OR aarch64-port
@@ -19,9 +19,9 @@
# level folder, name is created, based on parameter
#
-if [ ! "x$PR3799" = "x" ] ; then
- if [ ! -f "$PR3799" ] ; then
- echo "You have specified PR3799 as $PR3799 but it does not exists.
exiting"
+if [ ! "x$PR3822" = "x" ] ; then
+ if [ ! -f "$PR3822" ] ; then
+ echo "You have specified PR3822 as $PR3822 but it does not exists.
exiting"
exit 1
fi
fi
@@ -41,7 +41,7 @@ if [ "x$1" = "xhelp" ] ; then
echo "COMPRESSION - the compression type to use (optional; defaults to
${COMPRESSION_DEFAULT})"
echo "FILE_NAME_ROOT - name of the archive, minus extensions (optional; defaults
to PROJECT_NAME-REPO_NAME-VERSION)"
echo "REPO_ROOT - the location of the Mercurial repository to archive (optional;
defaults to OPENJDK_URL/PROJECT_NAME/REPO_NAME)"
- echo "PR3799 - the path to the PR3799 patch to apply (optional; downloaded if
unavailable)"
+ echo "PR3822 - the path to the PR3822 patch to apply (optional; downloaded if
unavailable)"
echo "REPOS - specify the repositories to use (optional; defaults to
${REPOS_DEFAULT})"
exit 1;
fi
@@ -124,15 +124,15 @@ rm -vf jdk/src/share/native/sun/security/ec/impl/ecp_224.c
echo "Syncing EC list with NSS"
-if [ "x$PR3799" = "x" ] ; then
-# get pr3799.patch (from
http://icedtea.classpath.org/hg/icedtea8) from most correct tag
-# Do not push it or publish it (see
http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=3799)
- wget -O pr3799.patch
http://icedtea.classpath.org/hg/icedtea8/raw-file/tip/patches/pr3799-4cur...
- patch -Np1 < pr3799.patch
- rm pr3799.patch
+if [ "x$PR3822" = "x" ] ; then
+# get pr3822.patch (from
http://icedtea.classpath.org/hg/icedtea8) from most correct tag
+# Do not push it or publish it (see
http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=3822)
+ wget -O pr3822.patch
http://icedtea.classpath.org/hg/icedtea8/raw-file/tip/patches/pr3822-4cur...
+ patch -Np1 < pr3822.patch
+ rm pr3822.patch
else
- echo "Applying ${PR3799}"
- patch -Np1 < $PR3799
+ echo "Applying ${PR3822}"
+ patch -Np1 < $PR3822
fi;
fi
find . -name '*.orig' -exec rm -vf '{}' ';'
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index fc5df6f..99525d3 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -296,7 +296,7 @@
# note, following three variables are sedded from update_sources if used correctly.
Hardcode them rather there.
%global shenandoah_project aarch64-port
%global shenandoah_repo jdk8u-shenandoah
-%global shenandoah_revision aarch64-shenandoah-jdk8u282-b08
+%global shenandoah_revision aarch64-shenandoah-jdk8u292-b01
# Define old aarch64/jdk8u tree variables for compatibility
%global project %{shenandoah_project}
%global repo %{shenandoah_repo}
@@ -311,12 +311,12 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 5
+%global rpmrelease 0
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
# - N%%{?extraver}{?dist} for GA releases
-%global is_ga 1
+%global is_ga 0
%if %{is_ga}
%global milestone fcs
%global milestone_version %{nil}
@@ -2622,6 +2622,13 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Fri Feb 19 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.292.b01-0.0.ea
+- Update to aarch64-shenandoah-jdk8u292-b01 (EA)
+- Update release notes for 8u292-b01.
+- Switch to EA mode.
+- Update tarball generation script to use PR3822 which handles
+ JDK-8233228 & JDK-8035166 changes
+
* Thu Feb 18 2021 Stephan Bergmann <sbergman(a)redhat.com> - 1:1.8.0.282.b08-5
- Hardcode /usr/sbin/alternatives for Flatpak builds
diff --git a/sources b/sources
index a2b2f6a..49a40a0 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u282-b08-4curve.tar.xz) =
166549a3cebab7a27811b9a486930d4cdce688af9a8e0ab6d6718550694cff42718cc6a9cee7703e409d82a967eacc6b009e9389ca85cfa0748d93bda3517c66
+SHA512 (aarch64-port-jdk8u-shenandoah-aarch64-shenandoah-jdk8u292-b01-4curve.tar.xz) =
35e527c387f55af66132cdae8c8ea198700d731ce2a69136cf7e02a8f837a6f2d9c96303c84468305cc7762d65c3f95ef8264218a82652a00063179d2557a648
commit 4916ef5be4fb433ded6d9e2c74a10929c8fff9c1
Author: Andrew Hughes <gnu.andrew(a)redhat.com>
Date: Thu Feb 18 19:01:12 2021 +0000
Hardcode /usr/sbin/alternatives for Flatpak builds
/usr/sbin/alternatives is not under the Flatpak build's %{_prefix},
which is set to /app.
(See <
https://pagure.io/packaging-committee/issue/848> "Clarify the
use of path macros with respect to build dependencies").
Found when trying to do a LibreOffice Flatpak build from RHEL RPM
specs, which includes java-1.8.0-openjdk among its components.
diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec
index 6b4227f..fc5df6f 100644
--- a/java-1.8.0-openjdk.spec
+++ b/java-1.8.0-openjdk.spec
@@ -311,7 +311,7 @@
%global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u})
# eg jdk8u60-b27 -> b27
%global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease 4
+%global rpmrelease 5
# Define milestone (EA for pre-releases, GA ("fcs") for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -384,6 +384,14 @@
%global rpm_state_dir %{_localstatedir}/lib/rpm-state/
+# For flatpack builds hard-code /usr/sbin/alternatives,
+# otherwise use %%{_sbindir} relative path.
+%if 0%{?flatpak}
+%global alternatives_requires /usr/sbin/alternatives
+%else
+%global alternatives_requires %{_sbindir}/alternatives
+%endif
+
%if %{with_systemtap}
# Where to install systemtap tapset (links)
# We would like these to be in a package specific sub-dir,
@@ -1110,9 +1118,9 @@ OrderWithRequires: copy-jdk-configs
# for printing support
Requires: cups-libs
# Post requires alternatives to install tool alternatives
-Requires(post): %{_sbindir}/alternatives
+Requires(post): %{alternatives_requires}
# Postun requires alternatives to uninstall tool alternatives
-Requires(postun): %{_sbindir}/alternatives
+Requires(postun): %{alternatives_requires}
# for optional support of kernel stream control, card reader and printing bindings
%if 0%{?fedora} || 0%{?rhel} >= 8
Suggests: lksctp-tools%{?_isa}, pcsc-lite-devel%{?_isa}
@@ -1136,9 +1144,9 @@ Provides: java-headless%{?1} = %{epoch}:%{version}-%{release}
Requires: %{name}%{?1}%{?_isa} = %{epoch}:%{version}-%{release}
OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release}
# Post requires alternatives to install tool alternatives
-Requires(post): %{_sbindir}/alternatives
+Requires(post): %{alternatives_requires}
# Postun requires alternatives to uninstall tool alternatives
-Requires(postun): %{_sbindir}/alternatives
+Requires(postun): %{alternatives_requires}
# Standard JPackage devel provides
Provides: java-sdk-%{javaver}-%{origin}%{?1} = %{epoch}:%{version}-%{release}
@@ -1168,9 +1176,9 @@ Provides: java-%{origin}-demo%{?1} = %{epoch}:%{version}-%{release}
%define java_javadoc_rpo() %{expand:
OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release}
# Post requires alternatives to install javadoc alternative
-Requires(post): %{_sbindir}/alternatives
+Requires(post): %{alternatives_requires}
# Postun requires alternatives to uninstall javadoc alternative
-Requires(postun): %{_sbindir}/alternatives
+Requires(postun): %{alternatives_requires}
# Standard JPackage javadoc provides
Provides: java-%{javaver}-javadoc%{?1} = %{epoch}:%{version}-%{release}
@@ -2614,6 +2622,9 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Thu Feb 18 2021 Stephan Bergmann <sbergman(a)redhat.com> - 1:1.8.0.282.b08-5
+- Hardcode /usr/sbin/alternatives for Flatpak builds
+
* Sat Jan 30 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:1.8.0.282.b08-4
- Cleanup package descriptions and version number placement.