The package rpms/java-latest-openjdk.git has added or updated architecture specific
content in its
spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s):
https://src.fedoraproject.org/cgit/rpms/java-latest-openjdk.git/commit/?i...
https://src.fedoraproject.org/cgit/rpms/java-latest-openjdk.git/commit/?i....
Change:
+%ifarch %{share_arches}
-%ifarch %{aot_arches}
Thanks.
Full change:
============
commit fa176cf64b894623f38d13f136c3a1cdea66102e
Merge: 5582d86 d62b3d6
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Wed Dec 22 14:35:30 2021 +0100
Merge branch 'rawhide' into f34
diff --cc java-latest-openjdk.spec
index c7eebd1,40612a4..9d98ad9
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@@ -2275,7 -2463,34 +2463,34 @@@ cjc.mainProgram(args
%endif
%changelog
+ * Thu Dec 09 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.1.0.12-12.rolling
+ - Storing and restoring alterntives during update manually
+ - Fixing Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives
and select (as auto) system JDK/JRE
+ -- The move of alternatives creation to posttrans to fix:
+ -- Bug 1200302 - dnf reinstall breaks alternatives
+ -- Had caused the alternatives to be removed, and then created again,
+ -- instead of being added, and then removing the old, and thus persisting
+ -- the selection in family
+ -- Thus this fix, is storing the family of manually selected master, and if
+ -- stored, then it is restoring the family of the master
+
+ * Thu Dec 09 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.1.0.12-12.rolling
+ - Family extracted to globals
+
+ * Thu Dec 09 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.1.0.12-11.rolling
+ - javadoc-zip got its own provides next to plain javadoc ones
+
+ * Thu Dec 09 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.1.0.12-10.rolling
+ - replaced tabs by sets of spaces to make rpmlint happy
+
+ * Mov Nov 29 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-9.rolling
+ - Handle Fedora in distro conditionals that currently only pertain to RHEL.
+
+ * Fri Nov 05 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-8.rolling
+ - Patch syslookup.c so it actually has some code to be compiled into libsyslookup
+ - Related: rhbz#2013846
+
-* Wed Nov 03 2021 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:17.0.1.0.12-7.rolling
+* Wed Nov 03 2021 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:17.0.1.0.12-2.rolling
- Use 'sql:' prefix in nss.fips.cfg as F35+ no longer ship the legacy
secmod.db file as part of nss
commit d62b3d65d1f937a0279abf58ab45a37bd2ad76e8
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Mon Dec 13 18:17:21 2021 +0100
Storing and restoring alterntives during update manually
Fixing:
Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives and
select (as auto) system JDK/JRE
The move of alternatives creation to posttrans to fix:
Bug 1200302 - dnf reinstall breaks alternatives
Had caused the alternatives to be removed, and then created again,
instead of being added, and then removing the old, and thus persisting
the selection in family
Thus this fix, is storing the family of manually selected master, and if
stored, then it is restoring the family of the master
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 24ab008..40612a4 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 12
-%global rpmrelease 12
+%global rpmrelease 13
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -428,6 +428,50 @@
# not-duplicated scriptlets for normal/debug packages
%global update_desktop_icons /usr/bin/gtk-update-icon-cache %{_datadir}/icons/hicolor
&>/dev/null || :
+%define save_alternatives() %{expand:
+ # warning! alternatives are localised!
+ # LANG=cs_CZ.UTF-8 alternatives --display java | head
+ # LANG=en_US.UTF-8 alternatives --display java | head
+ function nonLocalisedAlternativesDisplayOfMaster() {
+ LANG=en_US.UTF-8 alternatives --display "$MASTER"
+ }
+ function headOfAbove() {
+ nonLocalisedAlternativesDisplayOfMaster | head -n $1
+ }
+ MASTER="%{?1}"
+ LOCAL_LINK="%{?2}"
+ FAMILY="%{?3}"
+ rm -f %{_localstatedir}/lib/rpm-state/"$MASTER"_$FAMILY > /dev/null
+ if nonLocalisedAlternativesDisplayOfMaster > /dev/null ; then
+ if headOfAbove 1 | grep -q manual ; then
+ if headOfAbove 2 | tail -n 1 | grep -q %{compatiblename} ; then
+ headOfAbove 2 >
%{_localstatedir}/lib/rpm-state/"$MASTER"_"$FAMILY"
+ fi
+ fi
+ fi
+}
+
+%define save_and_remove_alternatives() %{expand:
+ if [ "x$debug" == "xtrue" ] ; then
+ set -x
+ fi
+ upgrade1_uninstal0=%{?3}
+ if [ "0$upgrade1_uninstal0" -gt 0 ] ; then # removal of this condition will
cause persistence between uninstall
+ %{save_alternatives %{?1} %{?2} %{?4}}
+ fi
+ alternatives --remove "%{?1}" "%{?2}"
+}
+
+%define set_if_needed_alternatives() %{expand:
+ MASTER="%{?1}"
+ FAMILY="%{?2}"
+
ALTERNATIVES_FILE="%{_localstatedir}/lib/rpm-state/$MASTER"_"$FAMILY"
+ if [ -e "$ALTERNATIVES_FILE" ] ; then
+ rm "$ALTERNATIVES_FILE"
+ alternatives --set $MASTER $FAMILY
+ fi
+}
+
%define post_script() %{expand:
update-desktop-database %{_datadir}/applications &> /dev/null || :
@@ -436,14 +480,18 @@ exit 0
}
%define alternatives_java_install() %{expand:
+if [ "x$debug" == "xtrue" ] ; then
+ set -x
+fi
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
fi
ext=.gz
+key=java
alternatives \\
- --install %{_bindir}/java java %{jrebindir -- %{?1}}/java $PRIORITY --family %{family}
\\
+ --install %{_bindir}/java $key %{jrebindir -- %{?1}}/java $PRIORITY --family %{family}
\\
--slave %{_jvmdir}/jre jre %{_jvmdir}/%{sdkdir -- %{?1}} \\
--slave %{_bindir}/%{alt_java_name} %{alt_java_name} %{jrebindir --
%{?1}}/%{alt_java_name} \\
--slave %{_bindir}/keytool keytool %{jrebindir -- %{?1}}/keytool \\
@@ -457,11 +505,17 @@ alternatives \\
--slave %{_mandir}/man1/rmiregistry.1$ext rmiregistry.1$ext \\
%{_mandir}/man1/rmiregistry-%{uniquesuffix -- %{?1}}.1$ext
+%{set_if_needed_alternatives $key %{family}}
+
for X in %{origin} %{javaver} ; do
- alternatives --install %{_jvmdir}/jre-"$X" jre_"$X"
%{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family %{family}
+ key=jre_"$X"
+ alternatives --install %{_jvmdir}/jre-"$X" $key %{_jvmdir}/%{sdkdir -- %{?1}}
$PRIORITY --family %{family}
+ %{set_if_needed_alternatives $key %{family}}
done
-alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} jre_%{javaver}_%{origin}
%{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family %{family}
+key=jre_%{javaver}_%{origin}
+alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} $key %{_jvmdir}/%{jrelnk --
%{?1}} $PRIORITY --family %{family}
+%{set_if_needed_alternatives $key %{family}}
}
%define post_headless() %{expand:
@@ -494,10 +548,14 @@ exit 0
%define postun_headless() %{expand:
- alternatives --remove java %{jrebindir -- %{?1}}/java
- alternatives --remove jre_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}}
- alternatives --remove jre_%{javaver} %{_jvmdir}/%{sdkdir -- %{?1}}
- alternatives --remove jre_%{javaver}_%{origin} %{_jvmdir}/%{jrelnk -- %{?1}}
+ if [ "x$debug" == "xtrue" ] ; then
+ set -x
+ fi
+ post_state=$1 # from postun,
https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_sy...
+ %{save_and_remove_alternatives java %{jrebindir -- %{?1}}/java $post_state
%{family}}
+ %{save_and_remove_alternatives jre_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} $post_state
%{family}}
+ %{save_and_remove_alternatives jre_%{javaver} %{_jvmdir}/%{sdkdir -- %{?1}}
$post_state %{family}}
+ %{save_and_remove_alternatives jre_%{javaver}_%{origin} %{_jvmdir}/%{jrelnk -- %{?1}}
$post_state %{family}}
}
%define posttrans_script() %{expand:
@@ -506,14 +564,18 @@ exit 0
%define alternatives_javac_install() %{expand:
+if [ "x$debug" == "xtrue" ] ; then
+ set -x
+fi
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
fi
ext=.gz
+key=javac
alternatives \\
- --install %{_bindir}/javac javac %{sdkbindir -- %{?1}}/javac $PRIORITY --family
%{family} \\
+ --install %{_bindir}/javac $key %{sdkbindir -- %{?1}}/javac $PRIORITY --family
%{family} \\
--slave %{_jvmdir}/java java_sdk %{_jvmdir}/%{sdkdir -- %{?1}} \\
--slave %{_bindir}/jlink jlink %{sdkbindir -- %{?1}}/jlink \\
--slave %{_bindir}/jmod jmod %{sdkbindir -- %{?1}}/jmod \\
@@ -576,14 +638,19 @@ alternatives \\
--slave %{_mandir}/man1/jstatd.1$ext jstatd.1$ext \\
%{_mandir}/man1/jstatd-%{uniquesuffix -- %{?1}}.1$ext \\
--slave %{_mandir}/man1/serialver.1$ext serialver.1$ext \\
- %{_mandir}/man1/serialver-%{uniquesuffix -- %{?1}}.1$ext \\
+ %{_mandir}/man1/serialver-%{uniquesuffix -- %{?1}}.1$ext
+
+%{set_if_needed_alternatives $key %{family}}
for X in %{origin} %{javaver} ; do
- alternatives \\
- --install %{_jvmdir}/java-"$X" java_sdk_"$X" %{_jvmdir}/%{sdkdir
-- %{?1}} $PRIORITY --family %{family}
+ key=java_sdk_"$X"
+ alternatives --install %{_jvmdir}/java-"$X" $key %{_jvmdir}/%{sdkdir --
%{?1}} $PRIORITY --family %{family}
+ %{set_if_needed_alternatives $key %{family}}
done
-update-alternatives --install %{_jvmdir}/java-%{javaver}-%{origin}
java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family %{family}
+key=java_sdk_%{javaver}_%{origin}
+alternatives --install %{_jvmdir}/java-%{javaver}-%{origin} $key %{_jvmdir}/%{sdkdir --
%{?1}} $PRIORITY --family %{family}
+%{set_if_needed_alternatives $key %{family}}
}
%define post_devel() %{expand:
@@ -594,10 +661,14 @@ exit 0
}
%define postun_devel() %{expand:
- alternatives --remove javac %{sdkbindir -- %{?1}}/javac
- alternatives --remove java_sdk_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}}
- alternatives --remove java_sdk_%{javaver} %{_jvmdir}/%{sdkdir -- %{?1}}
- alternatives --remove java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}}
+ if [ "x$debug" == "xtrue" ] ; then
+ set -x
+ fi
+ post_state=$1 # from postun,
https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_sy...
+ %{save_and_remove_alternatives javac %{sdkbindir -- %{?1}}/javac $post_state
%{family}}
+ %{save_and_remove_alternatives java_sdk_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}}
$post_state %{family}}
+ %{save_and_remove_alternatives java_sdk_%{javaver} %{_jvmdir}/%{sdkdir -- %{?1}}
$post_state %{family}}
+ %{save_and_remove_alternatives java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir --
%{?1}} $post_state %{family}}
update-desktop-database %{_datadir}/applications &> /dev/null || :
@@ -614,36 +685,49 @@ exit 0
}
%define alternatives_javadoc_install() %{expand:
+if [ "x$debug" == "xtrue" ] ; then
+ set -x
+fi
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
fi
-alternatives \\
- --install %{_javadocdir}/java javadocdir %{_javadocdir}/%{uniquejavadocdir --
%{?1}}/api \\
- $PRIORITY --family %{family_noarch}
+key=javadocdir
+alternatives --install %{_javadocdir}/java $key %{_javadocdir}/%{uniquejavadocdir --
%{?1}}/api $PRIORITY --family %{family_noarch}
+%{set_if_needed_alternatives $key %{family_noarch}}
exit 0
}
%define postun_javadoc() %{expand:
- alternatives --remove javadocdir %{_javadocdir}/%{uniquejavadocdir -- %{?1}}/api
+if [ "x$debug" == "xtrue" ] ; then
+ set -x
+fi
+ post_state=$1 # from postun,
https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_sy...
+ %{save_and_remove_alternatives javadocdir %{_javadocdir}/%{uniquejavadocdir --
%{?1}}/api $post_state %{family_noarch}}
exit 0
}
%define alternatives_javadoczip_install() %{expand:
+if [ "x$debug" == "xtrue" ] ; then
+ set -x
+fi
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
fi
-
-alternatives \\
- --install %{_javadocdir}/java-zip javadoczip %{_javadocdir}/%{uniquejavadocdir --
%{?1}}.zip \\
- $PRIORITY --family %{family_noarch}
+key=javadoczip
+alternatives --install %{_javadocdir}/java-zip $key %{_javadocdir}/%{uniquejavadocdir --
%{?1}}.zip $PRIORITY --family %{family_noarch}
+%{set_if_needed_alternatives $key %{family_noarch}}
exit 0
}
%define postun_javadoc_zip() %{expand:
- alternatives --remove javadoczip %{_javadocdir}/%{uniquejavadocdir -- %{?1}}.zip
+ if [ "x$debug" == "xtrue" ] ; then
+ set -x
+ fi
+ post_state=$1 # from postun,
https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_sy...
+ %{save_and_remove_alternatives javadoczip %{_javadocdir}/%{uniquejavadocdir --
%{?1}}.zip $post_state %{family_noarch}}
exit 0
}
@@ -2379,6 +2463,17 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Dec 09 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.1.0.12-12.rolling
+- Storing and restoring alterntives during update manually
+- Fixing Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives
and select (as auto) system JDK/JRE
+-- The move of alternatives creation to posttrans to fix:
+-- Bug 1200302 - dnf reinstall breaks alternatives
+-- Had caused the alternatives to be removed, and then created again,
+-- instead of being added, and then removing the old, and thus persisting
+-- the selection in family
+-- Thus this fix, is storing the family of manually selected master, and if
+-- stored, then it is restoring the family of the master
+
* Thu Dec 09 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.1.0.12-12.rolling
- Family extracted to globals
commit b0564c69d6d591cedf374f2456336cbdb9e90be8
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Thu Dec 2 13:15:46 2021 +0100
family extracted to globals
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index a8c34fd..24ab008 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 12
-%global rpmrelease 11
+%global rpmrelease 12
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -408,6 +408,9 @@
%global alternatives_requires %{_sbindir}/alternatives
%endif
+%global family %{name}.%{_arch}
+%global family_noarch %{name}
+
%if %{with_systemtap}
# Where to install systemtap tapset (links)
# We would like these to be in a package specific sub-dir,
@@ -440,7 +443,7 @@ fi
ext=.gz
alternatives \\
- --install %{_bindir}/java java %{jrebindir -- %{?1}}/java $PRIORITY --family
%{name}.%{_arch} \\
+ --install %{_bindir}/java java %{jrebindir -- %{?1}}/java $PRIORITY --family %{family}
\\
--slave %{_jvmdir}/jre jre %{_jvmdir}/%{sdkdir -- %{?1}} \\
--slave %{_bindir}/%{alt_java_name} %{alt_java_name} %{jrebindir --
%{?1}}/%{alt_java_name} \\
--slave %{_bindir}/keytool keytool %{jrebindir -- %{?1}}/keytool \\
@@ -455,10 +458,10 @@ alternatives \\
%{_mandir}/man1/rmiregistry-%{uniquesuffix -- %{?1}}.1$ext
for X in %{origin} %{javaver} ; do
- alternatives --install %{_jvmdir}/jre-"$X" jre_"$X"
%{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family %{name}.%{_arch}
+ alternatives --install %{_jvmdir}/jre-"$X" jre_"$X"
%{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family %{family}
done
-alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} jre_%{javaver}_%{origin}
%{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family %{name}.%{_arch}
+alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} jre_%{javaver}_%{origin}
%{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family %{family}
}
%define post_headless() %{expand:
@@ -510,7 +513,7 @@ fi
ext=.gz
alternatives \\
- --install %{_bindir}/javac javac %{sdkbindir -- %{?1}}/javac $PRIORITY --family
%{name}.%{_arch} \\
+ --install %{_bindir}/javac javac %{sdkbindir -- %{?1}}/javac $PRIORITY --family
%{family} \\
--slave %{_jvmdir}/java java_sdk %{_jvmdir}/%{sdkdir -- %{?1}} \\
--slave %{_bindir}/jlink jlink %{sdkbindir -- %{?1}}/jlink \\
--slave %{_bindir}/jmod jmod %{sdkbindir -- %{?1}}/jmod \\
@@ -577,10 +580,10 @@ alternatives \\
for X in %{origin} %{javaver} ; do
alternatives \\
- --install %{_jvmdir}/java-"$X" java_sdk_"$X" %{_jvmdir}/%{sdkdir
-- %{?1}} $PRIORITY --family %{name}.%{_arch}
+ --install %{_jvmdir}/java-"$X" java_sdk_"$X" %{_jvmdir}/%{sdkdir
-- %{?1}} $PRIORITY --family %{family}
done
-update-alternatives --install %{_jvmdir}/java-%{javaver}-%{origin}
java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family
%{name}.%{_arch}
+update-alternatives --install %{_jvmdir}/java-%{javaver}-%{origin}
java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family %{family}
}
%define post_devel() %{expand:
@@ -618,7 +621,7 @@ fi
alternatives \\
--install %{_javadocdir}/java javadocdir %{_javadocdir}/%{uniquejavadocdir --
%{?1}}/api \\
- $PRIORITY --family %{name}
+ $PRIORITY --family %{family_noarch}
exit 0
}
@@ -635,7 +638,7 @@ fi
alternatives \\
--install %{_javadocdir}/java-zip javadoczip %{_javadocdir}/%{uniquejavadocdir --
%{?1}}.zip \\
- $PRIORITY --family %{name}
+ $PRIORITY --family %{family_noarch}
exit 0
}
@@ -2376,6 +2379,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Dec 09 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.1.0.12-12.rolling
+- Family extracted to globals
+
* Thu Dec 09 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.1.0.12-11.rolling
- javadoc-zip got its own provides next to plain javadoc ones
commit 31a223aed497105147bd5496b8fe6db178a8e5c7
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Tue Dec 7 14:08:08 2021 +0100
Providing proper provides for javadoc-zip subpk
Before this patch, the java-17-openjdk-javadoc-zip was not existing, and
instead of that, javadoc was provided by both
Factm, that both subpkgs should provide javadoc, should be kept
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index e640ac7..a8c34fd 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 12
-%global rpmrelease 10
+%global rpmrelease 11
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -1058,10 +1058,10 @@ Requires(post): %{alternatives_requires}
Requires(postun): %{alternatives_requires}
# Standard JPackage javadoc provides
-Provides: java-%{javaver}-javadoc%{?1} = %{epoch}:%{version}-%{release}
-Provides: java-%{javaver}-%{origin}-javadoc%{?1} = %{epoch}:%{version}-%{release}
+Provides: java-%{javaver}-javadoc%{?1}%{?2} = %{epoch}:%{version}-%{release}
+Provides: java-%{javaver}-%{origin}-javadoc%{?1}%{?2} = %{epoch}:%{version}-%{release}
%if %is_system_jdk
-Provides: java-javadoc%{?1} = %{epoch}:%{version}-%{release}
+Provides: java-javadoc%{?1}%{?2} = %{epoch}:%{version}-%{release}
%endif
}
@@ -1537,7 +1537,7 @@ Group: Documentation
Requires: javapackages-filesystem
Obsoletes: javadoc-slowdebug < 1:13.0.0.33-1.rolling
-%{java_javadoc_rpo %{nil}}
+%{java_javadoc_rpo -- %{nil} %{nil}}
%description javadoc
The %{origin_nice} %{featurever} API documentation.
@@ -1552,7 +1552,8 @@ Group: Documentation
Requires: javapackages-filesystem
Obsoletes: javadoc-zip-slowdebug < 1:13.0.0.33-1.rolling
-%{java_javadoc_rpo %{nil}}
+%{java_javadoc_rpo -- %{nil} -zip}
+%{java_javadoc_rpo -- %{nil} %{nil}}
%description javadoc-zip
The %{origin_nice} %{featurever} API documentation compressed in a single archive.
@@ -2375,6 +2376,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Dec 09 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.1.0.12-11.rolling
+- javadoc-zip got its own provides next to plain javadoc ones
+
* Thu Dec 09 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.1.0.12-10.rolling
- replaced tabs by sets of spaces to make rpmlint happy
commit 461ed378a5801b0dc35b3c950b7ec2f508d354eb
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Tue Dec 7 14:30:53 2021 +0100
Removing tabs in whitespaced specfile for rpmlint
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 84b2e98..e640ac7 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 12
-%global rpmrelease 9
+%global rpmrelease 10
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -1715,14 +1715,14 @@ function buildjdk() {
# to configure
VERSION_FILE=${top_dir_abs_src_path}/make/conf/version-numbers.conf
if [ -f ${VERSION_FILE} ] ; then
- EA_DESIGNATOR=$(grep '^DEFAULT_PROMOTED_VERSION_PRE' ${VERSION_FILE} | cut -d
'=' -f 2)
+ EA_DESIGNATOR=$(grep '^DEFAULT_PROMOTED_VERSION_PRE' ${VERSION_FILE} | cut
-d '=' -f 2)
else
- echo "Could not find OpenJDK version file.";
- exit 16
+ echo "Could not find OpenJDK version file.";
+ exit 16
fi
if [ "x${EA_DESIGNATOR}" != "x%{expected_ea_designator}" ] ;
then
- echo "Spec file is configured for a %{build_type} build, but upstream version-pre
setting is ${EA_DESIGNATOR}";
- exit 17
+ echo "Spec file is configured for a %{build_type} build, but upstream
version-pre setting is ${EA_DESIGNATOR}";
+ exit 17
fi
echo "Using output directory: ${outputdir}";
@@ -2375,6 +2375,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Dec 09 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.1.0.12-10.rolling
+- replaced tabs by sets of spaces to make rpmlint happy
+
* Mov Nov 29 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-9.rolling
- Handle Fedora in distro conditionals that currently only pertain to RHEL.
commit 241e828cfe2ef51c61e5d0e544f613f3ee7bc960
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Fri Nov 5 22:46:45 2021 +0000
Handle Fedora in distro conditionals that currently only pertain to RHEL.
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index d1a8d83..84b2e98 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 12
-%global rpmrelease 8
+%global rpmrelease 9
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -937,7 +937,8 @@ Requires: libXcomposite%{?_isa}
Requires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release}
OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release}
# for java-X-openjdk package's desktop binding
-%if 0%{?rhel} >= 8
+# Where recommendations are available, recommend Gtk+ for the Swing look and feel
+%if 0%{?rhel} >= 8 || 0%{?fedora} > 0
Recommends: gtk3%{?_isa}
%endif
@@ -978,8 +979,11 @@ Requires: cups-libs
Requires(post): %{alternatives_requires}
# Postun requires alternatives to uninstall tool alternatives
Requires(postun): %{alternatives_requires}
-# for optional support of kernel stream control, card reader and printing bindings
+# Where suggestions are available, recommend the sctp and pcsc libraries
+# for optional support of kernel stream control and card reader
+%if 0%{?rhel} >= 8 || 0%{?fedora} > 0
Suggests: lksctp-tools%{?_isa}, pcsc-lite-libs%{?_isa}
+%endif
# Standard JPackage base provides
Provides: jre-%{javaver}-%{origin}-headless%{?1} = %{epoch}:%{version}-%{release}
@@ -1094,7 +1098,8 @@ Release: %{?eaprefix}%{rpmrelease}%{?extraver}.rolling%{?dist}
Epoch: 1
Summary: %{origin_nice} %{featurever} Runtime Environment
-%if 0%{?rhel} <= 8
+# Groups are only used up to RHEL 8 and on Fedora versions prior to F30
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 &&
0%{?fedora} < 30)
Group: Development/Languages
%endif
@@ -1257,7 +1262,7 @@ The %{origin_nice} %{featurever} runtime environment.
%if %{include_debug_build}
%package slowdebug
Summary: %{origin_nice} %{featurever} Runtime Environment %{debug_on}
-%if 0%{?rhel} <= 8
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 &&
0%{?fedora} < 30)
Group: Development/Languages
%endif
@@ -1270,7 +1275,7 @@ The %{origin_nice} %{featurever} runtime environment.
%if %{include_fastdebug_build}
%package fastdebug
Summary: %{origin_nice} %{featurever} Runtime Environment %{fastdebug_on}
-%if 0%{?rhel} <= 8
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 &&
0%{?fedora} < 30)
Group: Development/Languages
%endif
@@ -1283,7 +1288,7 @@ The %{origin_nice} %{featurever} runtime environment.
%if %{include_normal_build}
%package headless
Summary: %{origin_nice} %{featurever} Headless Runtime Environment
-%if 0%{?rhel} <= 8
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 &&
0%{?fedora} < 30)
Group: Development/Languages
%endif
@@ -1296,7 +1301,9 @@ The %{origin_nice} %{featurever} runtime environment without audio
and video sup
%if %{include_debug_build}
%package headless-slowdebug
Summary: %{origin_nice} %{featurever} Runtime Environment %{debug_on}
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 &&
0%{?fedora} < 30)
Group: Development/Languages
+%endif
%{java_headless_rpo -- %{debug_suffix_unquoted}}
@@ -1308,7 +1315,9 @@ The %{origin_nice} %{featurever} runtime environment without audio
and video sup
%if %{include_fastdebug_build}
%package headless-fastdebug
Summary: %{origin_nice} %{featurever} Runtime Environment %{fastdebug_on}
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 &&
0%{?fedora} < 30)
Group: Development/Languages
+%endif
%{java_headless_rpo -- %{fastdebug_suffix_unquoted}}
@@ -1320,7 +1329,7 @@ The %{origin_nice} %{featurever} runtime environment without audio
and video sup
%if %{include_normal_build}
%package devel
Summary: %{origin_nice} %{featurever} Development Environment
-%if 0%{?rhel} <= 8
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 &&
0%{?fedora} < 30)
Group: Development/Languages
%endif
@@ -1333,7 +1342,7 @@ The %{origin_nice} %{featurever} development tools.
%if %{include_debug_build}
%package devel-slowdebug
Summary: %{origin_nice} %{featurever} Development Environment %{debug_on}
-%if 0%{?rhel} <= 8
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 &&
0%{?fedora} < 30)
Group: Development/Languages
%endif
@@ -1347,7 +1356,9 @@ The %{origin_nice} %{featurever} development tools.
%if %{include_fastdebug_build}
%package devel-fastdebug
Summary: %{origin_nice} %{featurever} Development Environment %{fastdebug_on}
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 &&
0%{?fedora} < 30)
Group: Development/Tools
+%endif
%{java_devel_rpo -- %{fastdebug_suffix_unquoted}}
@@ -1396,7 +1407,7 @@ The %{origin_nice} %{featurever} libraries for static linking.
%if %{include_normal_build}
%package jmods
Summary: JMods for %{origin_nice} %{featurever}
-%if 0%{?rhel} <= 8
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 &&
0%{?fedora} < 30)
Group: Development/Languages
%endif
@@ -1409,7 +1420,7 @@ The JMods for %{origin_nice} %{featurever}.
%if %{include_debug_build}
%package jmods-slowdebug
Summary: JMods for %{origin_nice} %{featurever} %{debug_on}
-%if 0%{?rhel} <= 8
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 &&
0%{?fedora} < 30)
Group: Development/Languages
%endif
@@ -1423,7 +1434,9 @@ The JMods for %{origin_nice} %{featurever}.
%if %{include_fastdebug_build}
%package jmods-fastdebug
Summary: JMods for %{origin_nice} %{featurever} %{fastdebug_on}
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 &&
0%{?fedora} < 30)
Group: Development/Tools
+%endif
%{java_jmods_rpo -- %{fastdebug_suffix_unquoted}}
@@ -1435,7 +1448,7 @@ The JMods for %{origin_nice} %{featurever}.
%if %{include_normal_build}
%package demo
Summary: %{origin_nice} %{featurever} Demos
-%if 0%{?rhel} <= 8
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 &&
0%{?fedora} < 30)
Group: Development/Languages
%endif
@@ -1448,7 +1461,7 @@ The %{origin_nice} %{featurever} demos.
%if %{include_debug_build}
%package demo-slowdebug
Summary: %{origin_nice} %{featurever} Demos %{debug_on}
-%if 0%{?rhel} <= 8
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 &&
0%{?fedora} < 30)
Group: Development/Languages
%endif
@@ -1462,7 +1475,9 @@ The %{origin_nice} %{featurever} demos.
%if %{include_fastdebug_build}
%package demo-fastdebug
Summary: %{origin_nice} %{featurever} Demos %{fastdebug_on}
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 &&
0%{?fedora} < 30)
Group: Development/Languages
+%endif
%{java_demo_rpo -- %{fastdebug_suffix_unquoted}}
@@ -1474,7 +1489,7 @@ The %{origin_nice} %{featurever} demos.
%if %{include_normal_build}
%package src
Summary: %{origin_nice} %{featurever} Source Bundle
-%if 0%{?rhel} <= 8
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 &&
0%{?fedora} < 30)
Group: Development/Languages
%endif
@@ -1488,7 +1503,7 @@ class library source code for use by IDE indexers and debuggers.
%if %{include_debug_build}
%package src-slowdebug
Summary: %{origin_nice} %{featurever} Source Bundle %{for_debug}
-%if 0%{?rhel} <= 8
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 &&
0%{?fedora} < 30)
Group: Development/Languages
%endif
@@ -1502,7 +1517,9 @@ The %{compatiblename}-src-slowdebug sub-package contains the
complete %{origin_n
%if %{include_fastdebug_build}
%package src-fastdebug
Summary: %{origin_nice} %{featurever} Source Bundle %{for_fastdebug}
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 &&
0%{?fedora} < 30)
Group: Development/Languages
+%endif
%{java_src_rpo -- %{fastdebug_suffix_unquoted}}
@@ -1514,7 +1531,7 @@ The %{compatiblename}-src-fastdebug sub-package contains the
complete %{origin_n
%if %{include_normal_build}
%package javadoc
Summary: %{origin_nice} %{featurever} API documentation
-%if 0%{?rhel} <= 8
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 &&
0%{?fedora} < 30)
Group: Documentation
%endif
Requires: javapackages-filesystem
@@ -1529,7 +1546,7 @@ The %{origin_nice} %{featurever} API documentation.
%if %{include_normal_build}
%package javadoc-zip
Summary: %{origin_nice} %{featurever} API documentation compressed in a single archive
-%if 0%{?rhel} <= 8
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 &&
0%{?fedora} < 30)
Group: Documentation
%endif
Requires: javapackages-filesystem
@@ -2358,7 +2375,10 @@ cjc.mainProgram(args)
%endif
%changelog
-* Fri Nov 05 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.0.0.35-8
+* Mov Nov 29 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-9.rolling
+- Handle Fedora in distro conditionals that currently only pertain to RHEL.
+
+* Fri Nov 05 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-8.rolling
- Patch syslookup.c so it actually has some code to be compiled into libsyslookup
- Related: rhbz#2013846
commit 683790912048789d6450728e22aee0e52f46164f
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Mon Nov 8 14:48:30 2021 +0100
Patch syslookup.c so it actually has some code to be compiled into libsyslookup
Related: rhbz#2013846
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 8b7e164..d1a8d83 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 12
-%global rpmrelease 7
+%global rpmrelease 8
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -1198,6 +1198,8 @@ Patch1013: rh1991003-enable_fips_keys_import.patch
# OpenJDK patches in need of upstreaming
#
#############################################
+# JDK-8276572: Fake libsyslookup.so library causes tooling issues
+Patch2000: jdk8276572-fake_libsyslookup_causes_tooling_issues.patch
BuildRequires: autoconf
@@ -1596,6 +1598,7 @@ popd # openjdk
%patch1011
%patch1012
%patch1013
+%patch2000
# Extract systemtap tapsets
%if %{with_systemtap}
@@ -1912,14 +1915,6 @@ do
# All these tests rely on RPM failing the build if the exit code of any set
# of piped commands is non-zero.
- # If this is the empty library, libsyslookup.so, of the foreign function and memory
- # API incubation module (JEP 412), skip the debuginfo check as this seems unreliable
- # on s390x. It's not very useful for other arches either, so skip
unconditionally.
- if [ "`basename $lib`" = "libsyslookup.so" ]; then
- echo "Skipping debuginfo check for empty library
'libsyslookup.so'"
- continue
- fi
-
# Test for .debug_* sections in the shared object. This is the main test
# Stripped objects will not contain these
eu-readelf -S "$lib" | grep "] .debug_"
@@ -2363,6 +2358,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Fri Nov 05 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.0.0.35-8
+- Patch syslookup.c so it actually has some code to be compiled into libsyslookup
+- Related: rhbz#2013846
+
* Wed Nov 03 2021 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:17.0.1.0.12-7.rolling
- Use 'sql:' prefix in nss.fips.cfg as F35+ no longer ship the legacy
secmod.db file as part of nss
diff --git a/jdk8276572-fake_libsyslookup_causes_tooling_issues.patch
b/jdk8276572-fake_libsyslookup_causes_tooling_issues.patch
new file mode 100644
index 0000000..dee144b
--- /dev/null
+++ b/jdk8276572-fake_libsyslookup_causes_tooling_issues.patch
@@ -0,0 +1,21 @@
+commit a4724332098cd8bff44ee27e9190fd28fa5c1865
+Author: Andrew John Hughes <andrew(a)openjdk.org>
+Date: Fri Nov 5 21:05:42 2021 +0000
+
+ 8276572: Fake libsyslookup.so library causes tooling issues
+
+ Reviewed-by: shade, mcimadamore
+
+diff --git openjdk.orig/src/jdk.incubator.foreign/share/native/libsyslookup/syslookup.c
openjdk/src/jdk.incubator.foreign/share/native/libsyslookup/syslookup.c
+index fdf99866786..b1f543bfdb7 100644
+--- openjdk.orig/src/jdk.incubator.foreign/share/native/libsyslookup/syslookup.c
++++ openjdk/src/jdk.incubator.foreign/share/native/libsyslookup/syslookup.c
+@@ -26,3 +26,8 @@
+ // Note: the include below is not strictly required, as dependencies will be pulled
using linker flags.
+ // Adding at least one #include removes unwanted warnings on some platforms.
+ #include <stdlib.h>
++
++// Simple dummy function so this library appears as a normal library to tooling.
++char* syslookup() {
++ return "syslookup";
++}
commit 62ce7fecfc4b06e41910d5c3a10f4624cb9b3265
Author: Severin Gehwolf <sgehwolf(a)redhat.com>
Date: Wed Nov 3 11:50:39 2021 +0100
Use 'sql:' prefix in nss.fips.cfg
Fedora 35 and better no longer ship the legacy
secmod.db file as part of the nss package. Explicitly
tell OpenJDK to use sqlite-based sec mode.
Resolves: RHBZ#2019555
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 18124b1..8b7e164 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 12
-%global rpmrelease 6
+%global rpmrelease 7
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -1648,7 +1648,6 @@ sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE11} >
nss.cfg
# Setup nss.fips.cfg
sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE17} > nss.fips.cfg
-sed -i -e "s:@NSS_SECMOD@:/etc/pki/nssdb:g" nss.fips.cfg
%build
# How many CPU's do we have?
@@ -2364,6 +2363,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Wed Nov 03 2021 Severin Gehwolf <sgehwolf(a)redhat.com> - 1:17.0.1.0.12-7.rolling
+- Use 'sql:' prefix in nss.fips.cfg as F35+ no longer ship the legacy
+ secmod.db file as part of nss
+
* Wed Nov 03 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-6.rolling
- Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
diff --git a/nss.fips.cfg.in b/nss.fips.cfg.in
index ead27be..1aff153 100644
--- a/nss.fips.cfg.in
+++ b/nss.fips.cfg.in
@@ -1,6 +1,6 @@
name = NSS-FIPS
nssLibraryDirectory = @NSS_LIBDIR@
-nssSecmodDirectory = @NSS_SECMOD@
+nssSecmodDirectory = sql:/etc/pki/nssdb
nssDbMode = readOnly
nssModule = fips
commit 5deee57a1225ec5d182c6ad3f96ef292f140491a
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Wed Nov 3 21:39:17 2021 +0000
Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 88dbef9..18124b1 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -177,9 +177,9 @@
%endif
%ifarch %{bootstrap_arches}
-%global bootstrap_build 1
+%global bootstrap_build true
%else
-%global bootstrap_build 1
+%global bootstrap_build false
%endif
%if %{include_staticlibs}
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 12
-%global rpmrelease 5
+%global rpmrelease 6
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -1821,18 +1821,22 @@ for suffix in %{build_loop} ; do
# Use system libraries
link_opt="system"
# Debug builds don't need same targets as release for
- # build speed-up
- maketargets="%{release_targets}"
+ # build speed-up. We also avoid bootstrapping these
+ # slower builds.
if echo $debugbuild | grep -q "debug" ; then
- maketargets="%{debug_targets}"
+ maketargets="%{debug_targets}"
+ run_bootstrap=false
+ else
+ maketargets="%{release_targets}"
+ run_bootstrap=%{bootstrap_build}
+ fi
+ if ${run_bootstrap} ; then
+ buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}"
${debugbuild} ${link_opt}
+ buildjdk ${builddir} $(pwd)/${bootbuilddir}/images/%{jdkimage}
"${maketargets}" ${debugbuild} ${link_opt}
+ rm -rf ${bootbuilddir}
+ else
+ buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild}
${link_opt}
fi
-%if %{bootstrap_build}
- buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}"
${debugbuild} ${link_opt}
- buildjdk ${builddir} $(pwd)/${bootbuilddir}/images/%{jdkimage}
"${maketargets}" ${debugbuild} ${link_opt}
- rm -rf ${bootbuilddir}
-%else
- buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild}
${link_opt}
-%endif
# Restore original source tree we modified by removing full in-tree sources
rm -rf %{top_level_dir_name}
mv %{top_level_dir_name_backup} %{top_level_dir_name}
@@ -2360,6 +2364,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Wed Nov 03 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-6.rolling
+- Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
+
* Thu Oct 28 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-5.rolling
- Sync desktop files with upstream IcedTea release 3.15.0 using new script
commit 68acf88023a2280ae989e950f6fdef4ff5a8c8fa
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Mon Nov 1 13:46:13 2021 +0000
Sync desktop files with upstream IcedTea release 3.15.0 using new script
diff --git a/icedtea_sync.sh b/icedtea_sync.sh
index 022d199..e5c54f3 100755
--- a/icedtea_sync.sh
+++ b/icedtea_sync.sh
@@ -23,6 +23,7 @@
ICEDTEA_URL=https://icedtea.classpath.org/download/source
ICEDTEA_SIGNING_KEY=CFDA0F9B35964222
ICEDTEA_HG_URL=https://icedtea.classpath.org/hg/icedtea11
+
set -e
RPM_DIR=${PWD}
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 73323fe..88dbef9 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 12
-%global rpmrelease 4
+%global rpmrelease 5
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -1609,7 +1609,7 @@ cp -r tapset tapset%{fastdebug_suffix}
for suffix in %{build_loop} ; do
for file in "tapset"$suffix/*.in; do
- OUTPUT_FILE=`echo $file | sed -e
"s:\.stp\.in$:%{version}-%{release}.%{_arch}.stp:g"`
+ OUTPUT_FILE=`echo $file | sed -e
"s:\.stp\.in$:-%{version}-%{release}.%{_arch}.stp:g"`
sed -e "s:@ABS_SERVER_LIBJVM_SO@:%{_jvmdir}/%{sdkdir --
$suffix}/lib/server/libjvm.so:g" $file > $file.1
sed -e "s:@JAVA_SPEC_VER@:%{javaver}:g" $file.1 > $file.2
# TODO find out which architectures other than i686 have a client vm
@@ -1627,16 +1627,18 @@ done
%endif
# Prepare desktop files
+# The _X_ syntax indicates variables that are replaced by make upstream
+# The @X@ syntax indicates variables that are replaced by configure upstream
for suffix in %{build_loop} ; do
for file in %{SOURCE9}; do
FILE=`basename $file | sed -e s:\.in$::g`
EXT="${FILE##*.}"
NAME="${FILE%.*}"
OUTPUT_FILE=$NAME$suffix.$EXT
- sed -e "s:@JAVA_HOME@:%{sdkbindir -- $suffix}:g" $file >
$OUTPUT_FILE
- sed -i -e "s:@JRE_HOME@:%{jrebindir -- $suffix}:g" $OUTPUT_FILE
- sed -i -e "s:@ARCH@:%{version}-%{release}.%{_arch}$suffix:g" $OUTPUT_FILE
- sed -i -e "s:@JAVA_MAJOR_VERSION@:%{featurever}:g" $OUTPUT_FILE
+ sed -e "s:_SDKBINDIR_:%{sdkbindir -- $suffix}:g" $file >
$OUTPUT_FILE
+ sed -i -e "s:@target_cpu@:%{_arch}:g" $OUTPUT_FILE
+ sed -i -e "s:@OPENJDK_VER@:%{version}-%{release}.%{_arch}$suffix:g"
$OUTPUT_FILE
+ sed -i -e "s:@JAVA_VER@:%{javaver}:g" $OUTPUT_FILE
sed -i -e "s:@JAVA_VENDOR@:%{origin}:g" $OUTPUT_FILE
done
done
@@ -2358,6 +2360,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Oct 28 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-5.rolling
+- Sync desktop files with upstream IcedTea release 3.15.0 using new script
+
* Tue Oct 26 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-4.rolling
- Restructure the build so a minimal initial build is then used for the final build (with
docs)
- This reduces pressure on the system JDK and ensures the JDK being built can do a full
build
diff --git a/jconsole.desktop.in b/jconsole.desktop.in
index a8917c1..8a3b04d 100644
--- a/jconsole.desktop.in
+++ b/jconsole.desktop.in
@@ -1,8 +1,8 @@
[Desktop Entry]
-Name=OpenJDK @JAVA_MAJOR_VERSION@ Monitoring & Management Console @ARCH@
-Comment=Monitor and manage OpenJDK @JAVA_MAJOR_VERSION@ applications for @ARCH@
-Exec=@JAVA_HOME@/jconsole
-Icon=java-@JAVA_MAJOR_VERSION@-@JAVA_VENDOR@
+Name=OpenJDK @JAVA_VER@ for @target_cpu@ Monitoring & Management Console
(@OPENJDK_VER@)
+Comment=Monitor and manage OpenJDK applications
+Exec=_SDKBINDIR_/jconsole
+Icon=java-@JAVA_VER@-@JAVA_VENDOR@
Terminal=false
Type=Application
StartupWMClass=sun-tools-jconsole-JConsole
commit 28b9940ebac8e6131324b03889c057700822c7c8
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Tue Oct 26 16:35:41 2021 +0100
Restructure the build so a minimal initial build is then used for the final build
(with docs)
This reduces pressure on the system JDK and ensures the JDK being built can do a full
build
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index e90a707..73323fe 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -192,12 +192,12 @@
%global static_libs_target %{nil}
%endif
+# RPM JDK builds keep the debug symbols internal, to be later stripped by RPM
+%global debug_symbols internal
+
# unlike portables,the rpms have to use static_libs_target very dynamically
-%if %{bootstrap_build}
-%global release_targets bootcycle-images docs-zip
-%else
+%global bootstrap_targets images
%global release_targets images docs-zip
-%endif
# No docs nor bootcycle for debug builds
%global debug_targets images
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 12
-%global rpmrelease 3
+%global rpmrelease 4
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -1676,62 +1676,46 @@ EXTRA_CFLAGS="$EXTRA_CFLAGS -fno-strict-aliasing"
%endif
export EXTRA_CFLAGS
-for suffix in %{build_loop} ; do
-if [ "x$suffix" = "x" ] ; then
- debugbuild=release
- debug_symbols=internal
-else
- # change --something to something
- debugbuild=`echo $suffix | sed "s/-//g"`
- debug_symbols=internal
-fi
-
-for loop in %{main_suffix} %{staticlibs_loop} ; do
-
-if test "x${loop}" = "x%{main_suffix}" ; then
- # Copy the source tree so we can remove all in-tree libraries
- cp -a %{top_level_dir_name} %{top_level_dir_name_backup}
- # Remove all libraries that are linked
- sh %{SOURCE12} %{top_level_dir_name} full
- # Variable used by configure and hs_err hook on build failures
- link_opt="system"
- # Debug builds don't need same targets as release for
- # build speed-up
- maketargets="%{release_targets}"
- if echo $debugbuild | grep -q "debug" ; then
- maketargets="%{debug_targets}"
+function buildjdk() {
+ local outputdir=${1}
+ local buildjdk=${2}
+ local maketargets="${3}"
+ local debuglevel=${4}
+ local link_opt=${5}
+
+ local top_dir_abs_src_path=$(pwd)/%{top_level_dir_name}
+ local top_dir_abs_build_path=$(pwd)/${outputdir}
+
+ # The OpenJDK version file includes the current
+ # upstream version information. For some reason,
+ # configure does not automatically use the
+ # default pre-version supplied there (despite
+ # what the file claims), so we pass it manually
+ # to configure
+ VERSION_FILE=${top_dir_abs_src_path}/make/conf/version-numbers.conf
+ if [ -f ${VERSION_FILE} ] ; then
+ EA_DESIGNATOR=$(grep '^DEFAULT_PROMOTED_VERSION_PRE' ${VERSION_FILE} | cut -d
'=' -f 2)
+ else
+ echo "Could not find OpenJDK version file.";
+ exit 16
+ fi
+ if [ "x${EA_DESIGNATOR}" != "x%{expected_ea_designator}" ] ;
then
+ echo "Spec file is configured for a %{build_type} build, but upstream version-pre
setting is ${EA_DESIGNATOR}";
+ exit 17
fi
-else
- # Variable used by configure and hs_err hook on build failures
- link_opt="bundled"
- # Static library cycle only builds the static libraries
- maketargets="%{static_libs_target}"
-fi
-top_dir_abs_src_path=$(pwd)/%{top_level_dir_name}
-top_dir_abs_build_path=$(pwd)/%{buildoutputdir -- ${suffix}${loop}}
-# The OpenJDK version file includes the current
-# upstream version information. For some reason,
-# configure does not automatically use the
-# default pre-version supplied there (despite
-# what the file claims), so we pass it manually
-# to configure
-VERSION_FILE=${top_dir_abs_src_path}/make/conf/version-numbers.conf
-if [ -f ${VERSION_FILE} ] ; then
- EA_DESIGNATOR=$(grep '^DEFAULT_PROMOTED_VERSION_PRE' ${VERSION_FILE} | cut -d
'=' -f 2)
-else
- echo "Could not find OpenJDK version file.";
- exit 16
-fi
-if [ "x${EA_DESIGNATOR}" != "x%{expected_ea_designator}" ] ; then
- echo "Spec file is configured for a %{build_type} build, but upstream
version-pre setting is ${EA_DESIGNATOR}";
- exit 17
-fi
+ echo "Using output directory: ${outputdir}";
+ echo "Checking build JDK ${buildjdk} is operational..."
+ ${buildjdk}/bin/java -version
+ echo "Using make targets: ${maketargets}"
+ echo "Using debuglevel: ${debuglevel}"
+ echo "Using link_opt: ${link_opt}"
+ echo "Building %{newjavaver}-%{buildver}, pre=${EA_DESIGNATOR},
opt=%{lts_designator}"
-mkdir -p ${top_dir_abs_build_path}
-pushd ${top_dir_abs_build_path}
+ mkdir -p ${outputdir}
+ pushd ${outputdir}
-bash ${top_dir_abs_src_path}/configure \
+ bash ${top_dir_abs_src_path}/configure \
%ifnarch %{jit_arches}
--with-jvm-variants=zero \
%endif
@@ -1746,9 +1730,9 @@ bash ${top_dir_abs_src_path}/configure \
--with-vendor-url="https://www.redhat.com/" \
--with-vendor-bug-url="%{bugs}" \
--with-vendor-vm-bug-url="%{bugs}" \
- --with-boot-jdk=/usr/lib/jvm/java-%{buildjdkver}-openjdk \
- --with-debug-level=$debugbuild \
- --with-native-debug-symbols=$debug_symbols \
+ --with-boot-jdk=${buildjdk} \
+ --with-debug-level=${debuglevel} \
+ --with-native-debug-symbols="%{debug_symbols}" \
--enable-sysconf-nss \
--enable-unlimited-crypto \
--with-zlib=system \
@@ -1769,53 +1753,101 @@ bash ${top_dir_abs_src_path}/configure \
%endif
--disable-warnings-as-errors
-make \
- LOG=trace \
- WARNINGS_ARE_ERRORS="-Wno-error" \
- CFLAGS_WARNINGS_ARE_ERRORS="-Wno-error" \
- $maketargets || ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name
"hs_err_pid*.log" | xargs cat && false )
+ cat spec.gmk
-popd
+ make \
+ LOG=trace \
+ WARNINGS_ARE_ERRORS="-Wno-error" \
+ CFLAGS_WARNINGS_ARE_ERRORS="-Wno-error" \
+ $maketargets || ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name
"hs_err_pid*.log" | xargs cat && false )
-# Restore original source tree if we modified it by removing full in-tree sources
-if [ -d %{top_level_dir_name_backup} ] ; then
- rm -rf %{top_level_dir_name}
- mv %{top_level_dir_name_backup} %{top_level_dir_name}
-fi
+ popd
+}
-done # end of main / staticlibs loop
+function installjdk() {
+ local imagepath=${1}
-top_dir_abs_main_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{main_suffix}}
+ # the build (erroneously) removes read permissions from some jars
+ # this is a regression in OpenJDK 7 (our compiler):
+ #
http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=1437
+ find ${imagepath} -iname '*.jar' -exec chmod ugo+r {} \;
-# the build (erroneously) removes read permissions from some jars
-# this is a regression in OpenJDK 7 (our compiler):
-#
http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=1437
-find ${top_dir_abs_main_build_path}/images/%{jdkimage} -iname '*.jar' -exec chmod
ugo+r {} \;
+ # Build screws up permissions on binaries
+ #
https://bugs.openjdk.java.net/browse/JDK-8173610
+ find ${imagepath} -iname '*.so' -exec chmod +x {} \;
+ find ${imagepath}/bin/ -exec chmod +x {} \;
-# Build screws up permissions on binaries
-#
https://bugs.openjdk.java.net/browse/JDK-8173610
-find ${top_dir_abs_main_build_path}/images/%{jdkimage} -iname '*.so' -exec chmod
+x {} \;
-find ${top_dir_abs_main_build_path}/images/%{jdkimage}/bin/ -exec chmod +x {} \;
+ # Install nss.cfg right away as we will be using the JRE above
+ install -m 644 nss.cfg ${imagepath}/conf/security/
-# Install nss.cfg right away as we will be using the JRE above
-export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage}
+ # Install nss.fips.cfg: NSS configuration for global FIPS mode (crypto-policies)
+ install -m 644 nss.fips.cfg ${imagepath}/conf/security/
-# Install nss.cfg right away as we will be using the JRE above
-install -m 644 nss.cfg $JAVA_HOME/conf/security/
+ # Use system-wide tzdata
+ rm ${imagepath}/lib/tzdb.dat
+ ln -s %{_datadir}/javazi-1.8/tzdb.dat ${imagepath}/lib/tzdb.dat
-# Install nss.fips.cfg: NSS configuration for global FIPS mode (crypto-policies)
-install -m 644 nss.fips.cfg $JAVA_HOME/conf/security/
+ # Create fake alt-java as a placeholder for future alt-java
+ pushd ${imagepath}
+ # add alt-java man page
+ echo "Hardened java binary recommended for launching untrusted code from the Web
e.g. javaws" > man/man1/%{alt_java_name}.1
+ cat man/man1/java.1 >> man/man1/%{alt_java_name}.1
+ popd
+}
-# Use system-wide tzdata
-rm $JAVA_HOME/lib/tzdb.dat
-ln -s %{_datadir}/javazi-1.8/tzdb.dat $JAVA_HOME/lib/tzdb.dat
+for suffix in %{build_loop} ; do
-# Create fake alt-java as a placeholder for future alt-java
-pushd ${JAVA_HOME}
-# add alt-java man page
-echo "Hardened java binary recommended for launching untrusted code from the Web
e.g. javaws" > man/man1/%{alt_java_name}.1
-cat man/man1/java.1 >> man/man1/%{alt_java_name}.1
-popd
+ if [ "x$suffix" = "x" ] ; then
+ debugbuild=release
+ else
+ # change --something to something
+ debugbuild=`echo $suffix | sed "s/-//g"`
+ fi
+
+ systemjdk=/usr/lib/jvm/java-%{buildjdkver}-openjdk
+
+ for loop in %{main_suffix} %{staticlibs_loop} ; do
+
+ builddir=%{buildoutputdir -- ${suffix}${loop}}
+ bootbuilddir=boot${builddir}
+
+ if test "x${loop}" = "x%{main_suffix}" ; then
+ # Copy the source tree so we can remove all in-tree libraries
+ cp -a %{top_level_dir_name} %{top_level_dir_name_backup}
+ # Remove all libraries that are linked
+ sh %{SOURCE12} %{top_level_dir_name} full
+ # Use system libraries
+ link_opt="system"
+ # Debug builds don't need same targets as release for
+ # build speed-up
+ maketargets="%{release_targets}"
+ if echo $debugbuild | grep -q "debug" ; then
+ maketargets="%{debug_targets}"
+ fi
+%if %{bootstrap_build}
+ buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}"
${debugbuild} ${link_opt}
+ buildjdk ${builddir} $(pwd)/${bootbuilddir}/images/%{jdkimage}
"${maketargets}" ${debugbuild} ${link_opt}
+ rm -rf ${bootbuilddir}
+%else
+ buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild}
${link_opt}
+%endif
+ # Restore original source tree we modified by removing full in-tree sources
+ rm -rf %{top_level_dir_name}
+ mv %{top_level_dir_name_backup} %{top_level_dir_name}
+ else
+ # Use bundled libraries for building statically
+ link_opt="bundled"
+ # Static library cycle only builds the static libraries
+ maketargets="%{static_libs_target}"
+ # Always just do the one build for the static libraries
+ buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild}
${link_opt}
+ fi
+
+ done # end of main / staticlibs loop
+
+ # Final setup on the main image
+ top_dir_abs_main_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{main_suffix}}
+ installjdk ${top_dir_abs_main_build_path}/images/%{jdkimage}
# build cycles
done # end of release / debug cycle loop
@@ -2326,6 +2358,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Tue Oct 26 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-4.rolling
+- Restructure the build so a minimal initial build is then used for the final build (with
docs)
+- This reduces pressure on the system JDK and ensures the JDK being built can do a full
build
+
* Tue Oct 26 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.1.0.12-3.rolling
- Minor cosmetic improvements to make spec more comparable between variants
commit 18b2f765654a6cd3c378b8d44bc44af96973c252
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Tue Oct 26 02:11:32 2021 +0100
Minor cosmetic improvements to make spec more comparable between variants
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index d058ba0..e90a707 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -12,10 +12,7 @@
#
# Only produce a release build on x86_64:
# $ fedpkg mockbuild --without slowdebug --without fastdebug
-#
-# Only produce a debug build on x86_64:
-# $ fedpkg local --without release
-#
+
# Enable fastdebug builds by default on relevant arches.
%bcond_without fastdebug
# Enable slowdebug builds by default on relevant arches.
@@ -59,11 +56,11 @@
%global staticlibs_suffix "%{staticlibs_suffix_unquoted}"
%global debug_warning This package is unoptimised with full debugging. Install only as
needed and remove ASAP.
-%global debug_on with full debugging on
-%global fastdebug_on with minimal debugging on
%global fastdebug_warning This package is optimised with full debugging. Install only as
needed and remove ASAP.
-%global for_fastdebug_on for packages with minimal debugging on
-%global for_debug for packages with debugging on
+%global debug_on unoptimised with full debugging on
+%global fastdebug_on optimised with full debugging on
+%global for_fastdebug for packages with debugging on and optimisation
+%global for_debug for packages with debugging on and no optimisation
%if %{with release}
%global include_normal_build 1
@@ -171,7 +168,7 @@
# If you disable both builds, then the build fails
# Build and test slowdebug first as it provides the best diagnostics
-%global build_loop %{slowdebug_build} %{fastdebug_build} %{normal_build}
+%global build_loop %{slowdebug_build} %{fastdebug_build} %{normal_build}
%if %{include_staticlibs}
%global staticlibs_loop %{staticlibs_suffix}
@@ -185,22 +182,25 @@
%global bootstrap_build 1
%endif
-%if %{bootstrap_build}
-%global release_targets bootcycle-images docs-zip
-%else
-%global release_targets images docs-zip
-%endif
-# No docs nor bootcycle for debug builds
-%global debug_targets images
-
%if %{include_staticlibs}
# Extra target for producing the static-libraries. Separate from
# other targets since this target is configured to use in-tree
# AWT dependencies: lcms, libjpeg, libpng, libharfbuzz, giflib
# and possibly others
%global static_libs_target static-libs-image
+%else
+%global static_libs_target %{nil}
%endif
+# unlike portables,the rpms have to use static_libs_target very dynamically
+%if %{bootstrap_build}
+%global release_targets bootcycle-images docs-zip
+%else
+%global release_targets images docs-zip
+%endif
+# No docs nor bootcycle for debug builds
+%global debug_targets images
+
# Filter out flags from the optflags macro that cause problems with the OpenJDK build
# We filter out -O flags so that the optimization of HotSpot is not lowered from O3 to
O2
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 12
-%global rpmrelease 2
+%global rpmrelease 3
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -311,7 +311,7 @@
# for techpreview, using 1, so slowdebugs can have 0
%global priority %( printf '%08d' 1 )
%endif
-%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
+%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
%global javaver %{featurever}
# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version
used in filenames
@@ -573,7 +573,7 @@ alternatives \\
--slave %{_mandir}/man1/jstatd.1$ext jstatd.1$ext \\
%{_mandir}/man1/jstatd-%{uniquesuffix -- %{?1}}.1$ext \\
--slave %{_mandir}/man1/serialver.1$ext serialver.1$ext \\
- %{_mandir}/man1/serialver-%{uniquesuffix -- %{?1}}.1$ext
+ %{_mandir}/man1/serialver-%{uniquesuffix -- %{?1}}.1$ext \\
for X in %{origin} %{javaver} ; do
alternatives \\
@@ -754,7 +754,7 @@ exit 0
%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/nss.cfg
%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/nss.fips.cfg
%config(noreplace) %{etcjavadir -- %{?1}}/conf/management/jmxremote.access
-# these are config templates, thus not config-noreplace
+# This is a config template, thus not config-noreplace
%config %{etcjavadir -- %{?1}}/conf/management/jmxremote.password.template
%config %{etcjavadir -- %{?1}}/conf/sdp/sdp.conf.template
%config(noreplace) %{etcjavadir -- %{?1}}/conf/management/management.properties
@@ -777,6 +777,10 @@ exit 0
%ghost %{_jvmdir}/jre-%{javaver}-%{origin}
%endif
%endif
+#
https://bugzilla.redhat.com/show_bug.cgi?id=1820172
+#
https://docs.fedoraproject.org/en-US/packaging-guidelines/Directory_Repla...
+%ghost %{_jvmdir}/%{sdkdir -- %{?1}}/conf.rpmmoved
+%ghost %{_jvmdir}/%{sdkdir -- %{?1}}/lib/security.rpmmoved
}
%define files_devel() %{expand:
@@ -933,7 +937,9 @@ Requires: libXcomposite%{?_isa}
Requires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release}
OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release}
# for java-X-openjdk package's desktop binding
+%if 0%{?rhel} >= 8
Recommends: gtk3%{?_isa}
+%endif
Provides: java-%{javaver}-%{origin}%{?1} = %{epoch}:%{version}-%{release}
@@ -1003,9 +1009,9 @@ Provides: java-sdk-%{javaver}%{?1} = %{epoch}:%{version}-%{release}
Provides: java-%{javaver}-devel%{?1} = %{epoch}:%{version}-%{release}
Provides: java-%{javaver}-%{origin}-devel%{?1} = %{epoch}:%{version}-%{release}
%if %is_system_jdk
+Provides: java-devel-%{origin}%{?1} = %{epoch}:%{version}-%{release}
Provides: java-sdk-%{origin}%{?1} = %{epoch}:%{version}-%{release}
Provides: java-devel%{?1} = %{epoch}:%{version}-%{release}
-Provides: java-%{origin}-devel%{?1} = %{epoch}:%{version}-%{release}
Provides: java-sdk%{?1} = %{epoch}:%{version}-%{release}
%endif
}
@@ -1088,6 +1094,9 @@ Release: %{?eaprefix}%{rpmrelease}%{?extraver}.rolling%{?dist}
Epoch: 1
Summary: %{origin_nice} %{featurever} Runtime Environment
+%if 0%{?rhel} <= 8
+Group: Development/Languages
+%endif
# HotSpot code is licensed under GPLv2
# JDK library code is licensed under GPLv2 with the Classpath exception
@@ -1149,7 +1158,7 @@ Source17: nss.fips.cfg.in
# NSS via SunPKCS11 Provider (disabled comment
# due to memory leak).
Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
-# enable build of speculative store bypass hardened alt-java
+# RH1750419: enable build of speculative store bypass hardened alt-java (CVE-2018-3639)
Patch600: rh1750419-redhat_alt_java.patch
# Ignore AWTError when assistive technologies are loaded
@@ -1246,6 +1255,9 @@ The %{origin_nice} %{featurever} runtime environment.
%if %{include_debug_build}
%package slowdebug
Summary: %{origin_nice} %{featurever} Runtime Environment %{debug_on}
+%if 0%{?rhel} <= 8
+Group: Development/Languages
+%endif
%{java_rpo -- %{debug_suffix_unquoted}}
%description slowdebug
@@ -1256,7 +1268,9 @@ The %{origin_nice} %{featurever} runtime environment.
%if %{include_fastdebug_build}
%package fastdebug
Summary: %{origin_nice} %{featurever} Runtime Environment %{fastdebug_on}
+%if 0%{?rhel} <= 8
Group: Development/Languages
+%endif
%{java_rpo -- %{fastdebug_suffix_unquoted}}
%description fastdebug
@@ -1267,6 +1281,9 @@ The %{origin_nice} %{featurever} runtime environment.
%if %{include_normal_build}
%package headless
Summary: %{origin_nice} %{featurever} Headless Runtime Environment
+%if 0%{?rhel} <= 8
+Group: Development/Languages
+%endif
%{java_headless_rpo %{nil}}
@@ -1277,6 +1294,7 @@ The %{origin_nice} %{featurever} runtime environment without audio
and video sup
%if %{include_debug_build}
%package headless-slowdebug
Summary: %{origin_nice} %{featurever} Runtime Environment %{debug_on}
+Group: Development/Languages
%{java_headless_rpo -- %{debug_suffix_unquoted}}
@@ -1300,6 +1318,9 @@ The %{origin_nice} %{featurever} runtime environment without audio
and video sup
%if %{include_normal_build}
%package devel
Summary: %{origin_nice} %{featurever} Development Environment
+%if 0%{?rhel} <= 8
+Group: Development/Languages
+%endif
%{java_devel_rpo %{nil}}
@@ -1310,6 +1331,9 @@ The %{origin_nice} %{featurever} development tools.
%if %{include_debug_build}
%package devel-slowdebug
Summary: %{origin_nice} %{featurever} Development Environment %{debug_on}
+%if 0%{?rhel} <= 8
+Group: Development/Languages
+%endif
%{java_devel_rpo -- %{debug_suffix_unquoted}}
@@ -1370,6 +1394,9 @@ The %{origin_nice} %{featurever} libraries for static linking.
%if %{include_normal_build}
%package jmods
Summary: JMods for %{origin_nice} %{featurever}
+%if 0%{?rhel} <= 8
+Group: Development/Languages
+%endif
%{java_jmods_rpo %{nil}}
@@ -1380,6 +1407,9 @@ The JMods for %{origin_nice} %{featurever}.
%if %{include_debug_build}
%package jmods-slowdebug
Summary: JMods for %{origin_nice} %{featurever} %{debug_on}
+%if 0%{?rhel} <= 8
+Group: Development/Languages
+%endif
%{java_jmods_rpo -- %{debug_suffix_unquoted}}
@@ -1400,10 +1430,12 @@ The JMods for %{origin_nice} %{featurever}.
%{fastdebug_warning}
%endif
-
%if %{include_normal_build}
%package demo
Summary: %{origin_nice} %{featurever} Demos
+%if 0%{?rhel} <= 8
+Group: Development/Languages
+%endif
%{java_demo_rpo %{nil}}
@@ -1414,6 +1446,9 @@ The %{origin_nice} %{featurever} demos.
%if %{include_debug_build}
%package demo-slowdebug
Summary: %{origin_nice} %{featurever} Demos %{debug_on}
+%if 0%{?rhel} <= 8
+Group: Development/Languages
+%endif
%{java_demo_rpo -- %{debug_suffix_unquoted}}
@@ -1437,6 +1472,9 @@ The %{origin_nice} %{featurever} demos.
%if %{include_normal_build}
%package src
Summary: %{origin_nice} %{featurever} Source Bundle
+%if 0%{?rhel} <= 8
+Group: Development/Languages
+%endif
%{java_src_rpo %{nil}}
@@ -1448,6 +1486,9 @@ class library source code for use by IDE indexers and debuggers.
%if %{include_debug_build}
%package src-slowdebug
Summary: %{origin_nice} %{featurever} Source Bundle %{for_debug}
+%if 0%{?rhel} <= 8
+Group: Development/Languages
+%endif
%{java_src_rpo -- %{debug_suffix_unquoted}}
@@ -1468,10 +1509,12 @@ The %{compatiblename}-src-fastdebug sub-package contains the
complete %{origin_n
class library source code for use by IDE indexers and debuggers, %{for_fastdebug}.
%endif
-
%if %{include_normal_build}
%package javadoc
Summary: %{origin_nice} %{featurever} API documentation
+%if 0%{?rhel} <= 8
+Group: Documentation
+%endif
Requires: javapackages-filesystem
Obsoletes: javadoc-slowdebug < 1:13.0.0.33-1.rolling
@@ -1484,6 +1527,9 @@ The %{origin_nice} %{featurever} API documentation.
%if %{include_normal_build}
%package javadoc-zip
Summary: %{origin_nice} %{featurever} API documentation compressed in a single archive
+%if 0%{?rhel} <= 8
+Group: Documentation
+%endif
Requires: javapackages-filesystem
Obsoletes: javadoc-zip-slowdebug < 1:13.0.0.33-1.rolling
@@ -1561,7 +1607,6 @@ cp -r tapset tapset%{debug_suffix}
cp -r tapset tapset%{fastdebug_suffix}
%endif
-
for suffix in %{build_loop} ; do
for file in "tapset"$suffix/*.in; do
OUTPUT_FILE=`echo $file | sed -e
"s:\.stp\.in$:%{version}-%{release}.%{_arch}.stp:g"`
@@ -1634,9 +1679,11 @@ export EXTRA_CFLAGS
for suffix in %{build_loop} ; do
if [ "x$suffix" = "x" ] ; then
debugbuild=release
+ debug_symbols=internal
else
# change --something to something
debugbuild=`echo $suffix | sed "s/-//g"`
+ debug_symbols=internal
fi
for loop in %{main_suffix} %{staticlibs_loop} ; do
@@ -1701,7 +1748,7 @@ bash ${top_dir_abs_src_path}/configure \
--with-vendor-vm-bug-url="%{bugs}" \
--with-boot-jdk=/usr/lib/jvm/java-%{buildjdkver}-openjdk \
--with-debug-level=$debugbuild \
- --with-native-debug-symbols=internal \
+ --with-native-debug-symbols=$debug_symbols \
--enable-sysconf-nss \
--enable-unlimited-crypto \
--with-zlib=system \
@@ -1728,7 +1775,7 @@ make \
CFLAGS_WARNINGS_ARE_ERRORS="-Wno-error" \
$maketargets || ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name
"hs_err_pid*.log" | xargs cat && false )
-popd >& /dev/null
+popd
# Restore original source tree if we modified it by removing full in-tree sources
if [ -d %{top_level_dir_name_backup} ] ; then
@@ -1819,8 +1866,9 @@ readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep
w_remainder.c
readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep e_remainder.c
%endif
+so_suffix="so"
# Check debug symbols are present and can identify code
-find "$JAVA_HOME" -iname '*.so' -print0 | while read -d $'\0'
lib
+find "$JAVA_HOME" -iname "*.$so_suffix" -print0 | while read -d
$'\0' lib
do
if [ -f "$lib" ] ; then
echo "Testing $lib for debug symbols"
@@ -1888,15 +1936,16 @@ quit
end
run -version
EOF
-
+%if 0%{?fedora} > 0
# This fails on s390x for some reason. Disable for now. See:
#
https://koji.fedoraproject.org/koji/taskinfo?taskID=41499227
%ifnarch s390x
grep 'JavaCallWrapper::JavaCallWrapper' gdb.out
%endif
+%endif
# Check src.zip has all sources. See RHBZ#1130490
-jar -tf $JAVA_HOME/lib/src.zip | grep 'sun.misc.Unsafe'
+$JAVA_HOME/bin/jar -tf $JAVA_HOME/lib/src.zip | grep 'sun.misc.Unsafe'
# Check class files include useful debugging information
$JAVA_HOME/bin/javap -l java.lang.Object | grep "Compiled from"
@@ -2277,6 +2326,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Tue Oct 26 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.1.0.12-3.rolling
+- Minor cosmetic improvements to make spec more comparable between variants
+
* Thu Oct 21 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-2.rolling
- Update tapsets from IcedTea 6.x repository with fix for JDK-8015774 changes
(_heap->_heaps) and @JAVA_SPEC_VER@
- Update icedtea_sync.sh with a VCS mode that retrieves sources from a Mercurial
repository
commit e70d9ec500ac0eabc9fb017dd9b2367afbca2d75
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Thu Oct 21 16:14:35 2021 +0100
Update tapsets from IcedTea 6.x repository with fix for JDK-8015774 changes
(_heap->_heaps) and @JAVA_SPEC_VER@
Update icedtea_sync.sh with a VCS mode that retrieves sources from a Mercurial
repository
diff --git a/.gitignore b/.gitignore
index c09271c..1cf80ea 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,3 +19,4 @@
/openjdk-jdk17-jdk-17+33.tar.xz
/openjdk-jdk17-jdk-17+35.tar.xz
/openjdk-jdk17u-jdk-17.0.1+12.tar.xz
+/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz
diff --git a/icedtea_sync.sh b/icedtea_sync.sh
index c3fd5e6..022d199 100755
--- a/icedtea_sync.sh
+++ b/icedtea_sync.sh
@@ -16,12 +16,30 @@
# You should have received a copy of the GNU Affero General Public License
# along with this program. If not, see <
http://www.gnu.org/licenses/>.
+ICEDTEA_USE_VCS=true
+
ICEDTEA_VERSION=3.15.0
ICEDTEA_URL=https://icedtea.classpath.org/download/source
ICEDTEA_SIGNING_KEY=CFDA0F9B35964222
+ICEDTEA_HG_URL=https://icedtea.classpath.org/hg/icedtea11
set -e
+RPM_DIR=${PWD}
+if [ ! -f ${RPM_DIR}/jconsole.desktop.in ] ; then
+ echo "Not in RPM source tree.";
+ exit 1;
+fi
+
+if test "x${TMPDIR}" = "x"; then
+ TMPDIR=/tmp;
+fi
+WORKDIR=${TMPDIR}/it.sync
+
+echo "Using working directory ${WORKDIR}"
+mkdir ${WORKDIR}
+pushd ${WORKDIR}
+
if test "x${WGET}" = "x"; then
WGET=$(which wget);
if test "x${WGET}" = "x"; then
@@ -30,68 +48,144 @@ if test "x${WGET}" = "x"; then
fi
fi
-if test "x${CHECKSUM}" = "x"; then
- CHECKSUM=$(which sha256sum)
- if test "x${CHECKSUM}" = "x"; then
- echo "sha256sum not found";
- exit 2;
- fi
-fi
-
-if test "x${PGP}" = "x"; then
- PGP=$(which gpg)
- if test "x${PGP}" = "x"; then
- echo "gpg not found";
- exit 3;
- fi
-fi
-
if test "x${TAR}" = "x"; then
TAR=$(which tar)
if test "x${TAR}" = "x"; then
echo "tar not found";
- exit 4;
+ exit 2;
fi
fi
echo "Dependencies:";
echo -e "\tWGET: ${WGET}";
-echo -e "\tCHECKSUM: ${CHECKSUM}";
-echo -e "\tPGP: ${PGP}\n";
echo -e "\tTAR: ${TAR}\n";
-echo "Checking for IcedTea signing key ${ICEDTEA_SIGNING_KEY}...";
-if ! gpg --list-keys ${ICEDTEA_SIGNING_KEY}; then
- echo "IcedTea signing key ${ICEDTEA_SIGNING_KEY} not installed.";
- exit 5;
-fi
+if test "x${ICEDTEA_USE_VCS}" = "xtrue"; then
+ echo "Mode: Using VCS";
-echo "Downloading IcedTea release tarball...";
-${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz
-echo "Downloading IcedTea tarball signature...";
-${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz.sig
-echo "Downloading IcedTea tarball checksums...";
-${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.sha256
+ if test "x${GREP}" = "x"; then
+ GREP=$(which grep);
+ if test "x${GREP}" = "x"; then
+ echo "grep not found";
+ exit 3;
+ fi
+ fi
-echo "Verifying checksums...";
-${CHECKSUM} --check --ignore-missing icedtea-${ICEDTEA_VERSION}.sha256
+ if test "x${CUT}" = "x"; then
+ CUT=$(which cut);
+ if test "x${CUT}" = "x"; then
+ echo "cut not found";
+ exit 4;
+ fi
+ fi
-echo "Checking signature...";
-${PGP} --verify icedtea-${ICEDTEA_VERSION}.tar.xz.sig
+ if test "x${TR}" = "x"; then
+ TR=$(which tr);
+ if test "x${TR}" = "x"; then
+ echo "tr not found";
+ exit 5;
+ fi
+ fi
-echo "Extracting files...";
-${TAR} xJf icedtea-${ICEDTEA_VERSION}.tar.xz \
+ if test "x${HG}" = "x"; then
+ HG=$(which hg);
+ if test "x${HG}" = "x"; then
+ echo "hg not found";
+ exit 6;
+ fi
+ fi
+
+ echo "Dependencies:";
+ echo -e "\tGREP: ${GREP}";
+ echo -e "\tCUT: ${CUT}";
+ echo -e "\tTR: ${TR}";
+ echo -e "\tHG: ${HG}";
+
+ echo "Checking out repository from VCS...";
+ ${HG} clone ${ICEDTEA_HG_URL} icedtea
+
+ echo "Obtaining version from configure.ac...";
+ ROOT_VER=$(${GREP} '^AC_INIT' icedtea/configure.ac|${CUT} -d ',' -f
2|${TR} -d '[][:space:]')
+ echo "Root version from configure: ${ROOT_VER}";
+
+ VCS_REV=$(${HG} log -R icedtea --template '{node|short}' -r tip)
+ echo "VCS revision: ${VCS_REV}";
+
+ ICEDTEA_VERSION="${ROOT_VER}-${VCS_REV}"
+ echo "Creating icedtea-${ICEDTEA_VERSION}";
+ mkdir icedtea-${ICEDTEA_VERSION}
+ echo "Copying required files from checkout to icedtea-${ICEDTEA_VERSION}";
+ # Commented out for now as IcedTea 6's jconsole.desktop.in is outdated
+ #cp -a icedtea/jconsole.desktop.in ../icedtea-${ICEDTEA_VERSION}
+ cp -a ${RPM_DIR}/jconsole.desktop.in icedtea-${ICEDTEA_VERSION}
+ cp -a icedtea/tapset icedtea-${ICEDTEA_VERSION}
+
+ rm -rf icedtea
+else
+ echo "Mode: Using tarball";
+
+ if test "x${ICEDTEA_VERSION}" = "x"; then
+ echo "No IcedTea version specified for tarball download.";
+ exit 3;
+ fi
+
+ if test "x${CHECKSUM}" = "x"; then
+ CHECKSUM=$(which sha256sum)
+ if test "x${CHECKSUM}" = "x"; then
+ echo "sha256sum not found";
+ exit 4;
+ fi
+ fi
+
+ if test "x${PGP}" = "x"; then
+ PGP=$(which gpg)
+ if test "x${PGP}" = "x"; then
+ echo "gpg not found";
+ exit 5;
+ fi
+ fi
+
+ echo "Dependencies:";
+ echo -e "\tCHECKSUM: ${CHECKSUM}";
+ echo -e "\tPGP: ${PGP}\n";
+
+ echo "Checking for IcedTea signing key ${ICEDTEA_SIGNING_KEY}...";
+ if ! gpg --list-keys ${ICEDTEA_SIGNING_KEY}; then
+ echo "IcedTea signing key ${ICEDTEA_SIGNING_KEY} not installed.";
+ exit 6;
+ fi
+
+ echo "Downloading IcedTea release tarball...";
+ ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz
+ echo "Downloading IcedTea tarball signature...";
+ ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz.sig
+ echo "Downloading IcedTea tarball checksums...";
+ ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.sha256
+
+ echo "Verifying checksums...";
+ ${CHECKSUM} --check --ignore-missing icedtea-${ICEDTEA_VERSION}.sha256
+
+ echo "Checking signature...";
+ ${PGP} --verify icedtea-${ICEDTEA_VERSION}.tar.xz.sig
+
+ echo "Extracting files...";
+ ${TAR} xJf icedtea-${ICEDTEA_VERSION}.tar.xz \
icedtea-${ICEDTEA_VERSION}/tapset \
icedtea-${ICEDTEA_VERSION}/jconsole.desktop.in
+ rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz
+ rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz.sig
+ rm -vf icedtea-${ICEDTEA_VERSION}.sha256
+fi
+
echo "Replacing desktop files...";
-mv -v icedtea-${ICEDTEA_VERSION}/jconsole.desktop.in .
+mv -v icedtea-${ICEDTEA_VERSION}/jconsole.desktop.in ${RPM_DIR}
echo "Creating new tapset tarball...";
mv -v icedtea-${ICEDTEA_VERSION} openjdk
-${TAR} cJf tapsets-icedtea-${ICEDTEA_VERSION}.tar.xz openjdk
+${TAR} cJf ${RPM_DIR}/tapsets-icedtea-${ICEDTEA_VERSION}.tar.xz openjdk
rm -rvf openjdk
-rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz
-rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz.sig
-rm -vf icedtea-${ICEDTEA_VERSION}.sha256
+
+popd
+rm -rf ${WORKDIR}
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 131d75c..d058ba0 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -290,7 +290,7 @@
%global lts_designator_zip ""
# Define IcedTea version used for SystemTap tapsets and desktop file
-%global icedteaver 3.15.0
+%global icedteaver 6.0.0pre00-c848b93a8598
# Standard JPackage naming and versioning defines
%global origin openjdk
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 12
-%global rpmrelease 1
+%global rpmrelease 2
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -1112,7 +1112,7 @@ URL:
http://openjdk.java.net/
Source0:
openjdk-jdk%{featurever}u-jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}.tar.xz
# Use 'icedtea_sync.sh' to update the following
-# They are based on code contained in the IcedTea project (3.x).
+# They are based on code contained in the IcedTea project (6.x).
# Systemtap tapsets. Zipped up to keep it small.
Source8: tapsets-icedtea-%{icedteaver}.tar.xz
@@ -1566,11 +1566,12 @@ for suffix in %{build_loop} ; do
for file in "tapset"$suffix/*.in; do
OUTPUT_FILE=`echo $file | sed -e
"s:\.stp\.in$:%{version}-%{release}.%{_arch}.stp:g"`
sed -e "s:@ABS_SERVER_LIBJVM_SO@:%{_jvmdir}/%{sdkdir --
$suffix}/lib/server/libjvm.so:g" $file > $file.1
+ sed -e "s:@JAVA_SPEC_VER@:%{javaver}:g" $file.1 > $file.2
# TODO find out which architectures other than i686 have a client vm
%ifarch %{ix86}
- sed -e "s:@ABS_CLIENT_LIBJVM_SO@:%{_jvmdir}/%{sdkdir --
$suffix}/lib/client/libjvm.so:g" $file.1 > $OUTPUT_FILE
+ sed -e "s:@ABS_CLIENT_LIBJVM_SO@:%{_jvmdir}/%{sdkdir --
$suffix}/lib/client/libjvm.so:g" $file.2 > $OUTPUT_FILE
%else
- sed -e "/@ABS_CLIENT_LIBJVM_SO@/d" $file.1 > $OUTPUT_FILE
+ sed -e "/@ABS_CLIENT_LIBJVM_SO@/d" $file.2 > $OUTPUT_FILE
%endif
sed -i -e "s:@ABS_JAVA_HOME_DIR@:%{_jvmdir}/%{sdkdir -- $suffix}:g"
$OUTPUT_FILE
sed -i -e "s:@INSTALL_ARCH_DIR@:%{archinstall}:g" $OUTPUT_FILE
@@ -2276,6 +2277,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Oct 21 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-2.rolling
+- Update tapsets from IcedTea 6.x repository with fix for JDK-8015774 changes
(_heap->_heaps) and @JAVA_SPEC_VER@
+- Update icedtea_sync.sh with a VCS mode that retrieves sources from a Mercurial
repository
+
* Wed Oct 20 2021 Petra Alice Mikova <pmikova(a)redhat.com> -
1:17.0.1.0.12-1.rolling
- October CPU update to jdk 17.0.1+12
- dropped commented-out source line
diff --git a/sources b/sources
index 558762f..1824428 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
+SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) =
97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
SHA512 (openjdk-jdk17u-jdk-17.0.1+12.tar.xz) =
d9503de1001e42657ddb2600e1141d4169e333f0592ce3ad3c4ce14f817ca73a6bf6fb867e15930150c7b55e8fd4c4cd73d43984979e721df481a9ac7919580c
commit fb48b1ebd8e4b3e8d669ce7e650c0d2db97596d4
Author: Petra Mikova <pmikova(a)redhat.com>
Date: Wed Oct 20 19:32:18 2021 +0200
October CPU 2021 update
diff --git a/.gitignore b/.gitignore
index c591b54..c09271c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -18,3 +18,4 @@
/openjdk-jdk17-jdk-17+26.tar.xz
/openjdk-jdk17-jdk-17+33.tar.xz
/openjdk-jdk17-jdk-17+35.tar.xz
+/openjdk-jdk17u-jdk-17.0.1+12.tar.xz
diff --git a/NEWS b/NEWS
index cf7bae0..9d37ff9 100644
--- a/NEWS
+++ b/NEWS
@@ -3,6 +3,97 @@ Key:
JDK-X -
https://bugs.openjdk.java.net/browse/JDK-X
CVE-XXXX-YYYY:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
+New in release OpenJDK 17.0.1 (2021-10-19):
+===========================================
+Live versions of these release notes can be found at:
+ *
https://builds.shipilev.net/backports-monitor/release-notes-17.0.1.txt
+
+* Security fixes
+ - JDK-8263314: Enhance XML Dsig modes
+ - JDK-8265167, CVE-2021-35556: Richer Text Editors
+ - JDK-8265574: Improve handling of sheets
+ - JDK-8265580, CVE-2021-35559: Enhanced style for RTF kit
+ - JDK-8265776: Improve Stream handling for SSL
+ - JDK-8266097, CVE-2021-35561: Better hashing support
+ - JDK-8266103: Better specified spec values
+ - JDK-8266109: More Resilient Classloading
+ - JDK-8266115: More Manifest Jar Loading
+ - JDK-8266137, CVE-2021-35564: Improve Keystore integrity
+ - JDK-8266689, CVE-2021-35567: More Constrained Delegation
+ - JDK-8267086: ArrayIndexOutOfBoundsException in
java.security.KeyFactory.generatePublic
+ - JDK-8267712: Better LDAP reference processing
+ - JDK-8267729, CVE-2021-35578: Improve TLS client handshaking
+ - JDK-8267735, CVE-2021-35586: Better BMP support
+ - JDK-8268193: Improve requests of certificates
+ - JDK-8268199: Correct certificate requests
+ - JDK-8268205: Enhance DTLS client handshake
+ - JDK-8268500: Better specified ParameterSpecs
+ - JDK-8268506: More Manifest Digests
+ - JDK-8269618, CVE-2021-35603: Better session identification
+ - JDK-8269624: Enhance method selection support
+ - JDK-8270398: Enhance canonicalization
+ - JDK-8270404: Better canonicalization
+* Other changes
+ - JDK-8225082: Remove IdenTrust certificate that is expiring in September 2021
+ - JDK-8243543: jtreg test
security/infra/java/security/cert/CertPathValidator/certification/BuypassCA.java fails
+ - JDK-8248899:
security/infra/java/security/cert/CertPathValidator/certification/QuoVadisCA.java fails,
Certificate has been revoked
+ - JDK-8261088: Repeatable annotations without @Target cannot have containers that
target module declarations
+ - JDK-8262731: [macOS] Exception from "Printable.print" is swallowed during
"PrinterJob.print"
+ - JDK-8263531: Remove unused buffer int
+ - JDK-8266182: Automate manual steps listed in the test
jdk/sun/security/pkcs12/ParamsTest.java
+ - JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type
+ - JDK-8267666: Add option to jcmd GC.heap_dump to use existing file
+ - JDK-8268019: C2: assert(no_dead_loop) failed: dead loop detected
+ - JDK-8268261: C2: assert(n != __null) failed: Bad immediate dominator info.
+ - JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm performance
+ - JDK-8268963: [IR Framework] Some default regexes matching on PrintOptoAssembly in
IRNode.java do not work on all platforms
+ - JDK-8269297: Bump version numbers for JDK 17.0.1
+ - JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should be more resilient
+ - JDK-8269574: C2: Avoid redundant uncommon traps in GraphKit::builtin_throw() for
JVMTI exception events
+ - JDK-8269763: The JEditorPane is blank after JDK-8265167
+ - JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports incorrect process cpu
usage in containers
+ - JDK-8269882: stack-use-after-scope in NewObjectA
+ - JDK-8269897: Shenandoah: Resolve UNKNOWN access strength, where possible
+ - JDK-8269934: RunThese24H.java failed with EXCEPTION_ACCESS_VIOLATION in
java_lang_Thread::get_thread_status
+ - JDK-8269993: [Test]: java/net/httpclient/DigestEchoClientSSL.java contains redundant
@run tags
+ - JDK-8270094: Shenandoah: Provide human-readable labels for test configurations
+ - JDK-8270096: Shenandoah: Optimize gc/shenandoah/TestRefprocSanity.java for
interpreter mode
+ - JDK-8270098: ZGC: ZBarrierSetC2::clone_at_expansion fails with "Guard against
surprises" assert
+ - JDK-8270137: Kerberos Credential Retrieval from Cache not Working in Cross-Realm
Setup
+ - JDK-8270280:
security/infra/java/security/cert/CertPathValidator/certification/LetsEncryptCA.java OCSP
response error
+ - JDK-8270344: Session resumption errors
+ - JDK-8271203: C2: assert(iff->Opcode() == Op_If || iff->Opcode() ==
Op_CountedLoopEnd || iff->Opcode() == Op_RangeCheck) failed: Check this code when new
subtype is added
+ - JDK-8271276: C2: Wrong JVM state used for receiver null check
+ - JDK-8271335: Updating RE Configs for BUILD REQUEST 17.0.1+4
+ - JDK-8271589: fatal error with variable shift count integer rotate operation.
+ - JDK-8271723: Unproblemlist runtime/InvocationTests/invokevirtualTests.java
+ - JDK-8271730: Client authentication using RSASSA-PSS fails after correct certificate
requests
+ - JDK-8271925: ZGC: Arraycopy stub passes invalid oop to load barrier
+ - JDK-8272124: Cgroup v1 initialization causes NullPointerException when cgroup path
contains colon
+ - JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash when clone null
CallProjections.fallthrough_ioproj
+ - JDK-8272326: java/util/Random/RandomTestMoments.java had two Gaussian fails
+ - JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz after JDK-8255790
+ - JDK-8272472: StackGuardPages test doesn't build with glibc 2.34
+ - JDK-8272581: sun/security/pkcs11/Provider/MultipleLogins.sh fails after JDK-8266182
+ - JDK-8272602: [macos] not all KEY_PRESSED events sent when control modifier is used
+ - JDK-8272700: [macos] Build failure with Xcode 13.0 after JDK-8264848
+ - JDK-8272708: [Test]: Cleanup:
test/jdk/security/infra/java/security/cert/CertPathValidator/certification/BuypassCA.java
no longer needs ocspEnabled
+ - JDK-8272806: [macOS] "Apple AWT Internal Exception" when input method is
changed
+ - JDK-8273358: macOS Monterey does not have the font Times needed by Serif
+
+Notes on individual issues:
+===========================
+
+security-libs/java.security:
+
+JDK-8271434: Removed IdenTrust Root Certificate
+===============================================
+The following root certificate from IdenTrust has been removed from
+the `cacerts` keystore:
+
+Alias Name: identrustdstx3 [jdk]
+Distinguished Name: CN=DST Root CA X3, O=Digital Signature Trust Co.
+
New in release OpenJDK 17.0.0 (2021-09-14):
===========================================
The full list of changes in the interim releases from 11u to 17u can be found at:
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 59ed275..131d75c 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -274,7 +274,7 @@
# New Version-String scheme-style defines
%global featurever 17
%global interimver 0
-%global updatever 0
+%global updatever 1
%global patchver 0
# If you bump featurever, you must also bump vendor_version_string
# Used via new version scheme. JDK 17 was
@@ -297,8 +297,8 @@
%global origin_nice OpenJDK
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver 35
-%global rpmrelease 5
+%global buildver 12
+%global rpmrelease 1
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -1109,8 +1109,7 @@ URL:
http://openjdk.java.net/
# to regenerate source0 (jdk) run update_package.sh
# update_package.sh contains hard-coded repos, revisions, tags, and projects to
regenerate the source archives
-Source0:
openjdk-jdk%{featurever}-jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}.tar.xz
-#Source0: openjdk-jdk%{featurever}-jdk-%{filever}+%{buildver}.tar.xz
+Source0:
openjdk-jdk%{featurever}u-jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}.tar.xz
# Use 'icedtea_sync.sh' to update the following
# They are based on code contained in the IcedTea project (3.x).
@@ -2277,6 +2276,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Wed Oct 20 2021 Petra Alice Mikova <pmikova(a)redhat.com> -
1:17.0.1.0.12-1.rolling
+- October CPU update to jdk 17.0.1+12
+- dropped commented-out source line
+
* Sun Oct 10 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.0.0.35-5.rolling
- Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
diff --git a/sources b/sources
index f4030b5..558762f 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (openjdk-jdk17-jdk-17+35.tar.xz) =
51f533812219e732f74fd77a19df0e82ecf11a3341d958cf9cb0438350805118a4852ddbbeccce374f96c7b12c80c410435cdcd9e3f576497a7deb6f72e17c69
+SHA512 (openjdk-jdk17u-jdk-17.0.1+12.tar.xz) =
d9503de1001e42657ddb2600e1141d4169e333f0592ce3ad3c4ce14f817ca73a6bf6fb867e15930150c7b55e8fd4c4cd73d43984979e721df481a9ac7919580c
commit 2891e38fa239f7fe4404264ae0a58670db64f7bb
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Sun Oct 10 23:10:57 2021 +0100
Add FIPS patch to allow plain key import.
Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 3bf0eec..59ed275 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 35
-%global rpmrelease 4
+%global rpmrelease 5
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -1182,6 +1182,8 @@ Patch1009: rh1995150-disable_non-fips_crypto.patch
# RH1996182: Login to the NSS software token in FIPS mode
Patch1010: rh1996182-login_to_nss_software_token.patch
Patch1012: rh1996182-extend_security_policy.patch
+# RH1991003: Allow plain key import unless com.redhat.fips.plainKeySupport is set to
false
+Patch1013: rh1991003-enable_fips_keys_import.patch
#############################################
#
@@ -1548,6 +1550,7 @@ popd # openjdk
%patch1010
%patch1011
%patch1012
+%patch1013
# Extract systemtap tapsets
%if %{with_systemtap}
@@ -2274,6 +2277,12 @@ cjc.mainProgram(args)
%endif
%changelog
+* Sun Oct 10 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.0.0.35-5.rolling
+- Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
+
+* Sun Oct 10 2021 Martin Balao <mbalao(a)redhat.com> - 1:17.0.0.0.35-5.rolling
+- Add patch to allow plain key import.
+
* Thu Sep 30 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.0.0.35-4.rolling
- Fix unused function compiler warning found in systemconf.c
- Extend the default security policy to accomodate PKCS11 accessing jdk.internal.access.
diff --git a/rh1991003-enable_fips_keys_import.patch
b/rh1991003-enable_fips_keys_import.patch
new file mode 100644
index 0000000..79d2743
--- /dev/null
+++ b/rh1991003-enable_fips_keys_import.patch
@@ -0,0 +1,579 @@
+commit abcd0954643eddbf826d96291d44a143038ab750
+Author: Martin Balao <mbalao(a)redhat.com>
+Date: Sun Oct 10 18:14:01 2021 +0100
+
+ RH1991003: Enable the import of plain keys into the NSS software token.
+
+ This can be individually disabled using -Dcom.redhat.fips.plainKeySupport=false
+
+diff --git openjdk.orig/src/java.base/share/classes/java/security/Security.java
openjdk/src/java.base/share/classes/java/security/Security.java
+index ce32c939253..dc7020ce668 100644
+--- openjdk.orig/src/java.base/share/classes/java/security/Security.java
++++ openjdk/src/java.base/share/classes/java/security/Security.java
+@@ -82,6 +82,10 @@ public final class Security {
+ public boolean isSystemFipsEnabled() {
+ return SystemConfigurator.isSystemFipsEnabled();
+ }
++ @Override
++ public boolean isPlainKeySupportEnabled() {
++ return SystemConfigurator.isPlainKeySupportEnabled();
++ }
+ });
+
+ // doPrivileged here because there are multiple
+diff --git openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java
openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
+index 6aa1419dfd0..ecab722848e 100644
+--- openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java
++++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
+@@ -55,6 +55,7 @@ final class SystemConfigurator {
+ CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config";
+
+ private static boolean systemFipsEnabled = false;
++ private static boolean plainKeySupportEnabled = false;
+
+ private static final String SYSTEMCONF_NATIVE_LIB = "systemconf";
+
+@@ -150,6 +151,16 @@ final class SystemConfigurator {
+ }
+ loadedProps = true;
+ systemFipsEnabled = true;
++ String plainKeySupport =
System.getProperty("com.redhat.fips.plainKeySupport",
++ "true");
++ plainKeySupportEnabled = !"false".equals(plainKeySupport);
++ if (sdebug != null) {
++ if (plainKeySupportEnabled) {
++ sdebug.println("FIPS support enabled with plain key
support");
++ } else {
++ sdebug.println("FIPS support enabled without plain key
support");
++ }
++ }
+ }
+ } catch (Exception e) {
+ if (sdebug != null) {
+@@ -177,6 +188,19 @@ final class SystemConfigurator {
+ return systemFipsEnabled;
+ }
+
++ /**
++ * Returns {@code true} if system FIPS alignment is enabled
++ * and plain key support is allowed. Plain key support is
++ * enabled by default but can be disabled with
++ * {@code -Dcom.redhat.fips.plainKeySupport=false}.
++ *
++ * @return a boolean indicating whether plain key support
++ * should be enabled.
++ */
++ static boolean isPlainKeySupportEnabled() {
++ return plainKeySupportEnabled;
++ }
++
+ /*
+ * OpenJDK FIPS mode will be enabled only if the com.redhat.fips
+ * system property is true (default) and the system is in FIPS mode.
+diff --git
openjdk.orig/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java
openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java
+index a31e93ec02e..3f3caac64dc 100644
+---
openjdk.orig/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java
++++
openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java
+@@ -27,4 +27,5 @@ package jdk.internal.access;
+
+ public interface JavaSecuritySystemConfiguratorAccess {
+ boolean isSystemFipsEnabled();
++ boolean isPlainKeySupportEnabled();
+ }
+diff --git
openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
+new file mode 100644
+index 00000000000..bee3a1e1537
+--- /dev/null
++++
openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
+@@ -0,0 +1,291 @@
++/*
++ * Copyright (c) 2021, Red Hat, Inc.
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation. Oracle designates this
++ * particular file as subject to the "Classpath" exception as provided
++ * by Oracle in the LICENSE file that accompanied this code.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit
www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++package sun.security.pkcs11;
++
++import java.math.BigInteger;
++import java.security.KeyFactory;
++import java.security.Provider;
++import java.security.Security;
++import java.util.HashMap;
++import java.util.Map;
++import java.util.concurrent.locks.ReentrantLock;
++
++import javax.crypto.Cipher;
++import javax.crypto.spec.DHPrivateKeySpec;
++import javax.crypto.spec.IvParameterSpec;
++
++import sun.security.jca.JCAUtil;
++import sun.security.pkcs11.TemplateManager;
++import sun.security.pkcs11.wrapper.CK_ATTRIBUTE;
++import sun.security.pkcs11.wrapper.CK_MECHANISM;
++import static sun.security.pkcs11.wrapper.PKCS11Constants.*;
++import static sun.security.pkcs11.wrapper.PKCS11Exception.*;
++import sun.security.pkcs11.wrapper.PKCS11Exception;
++import sun.security.rsa.RSAUtil.KeyType;
++import sun.security.util.Debug;
++import sun.security.util.ECUtil;
++
++final class FIPSKeyImporter {
++
++ private static final Debug debug =
++ Debug.getInstance("sunpkcs11");
++
++ private static P11Key importerKey = null;
++ private static final ReentrantLock importerKeyLock = new ReentrantLock();
++ private static CK_MECHANISM importerKeyMechanism = null;
++ private static Cipher importerCipher = null;
++
++ private static Provider sunECProvider = null;
++ private static final ReentrantLock sunECProviderLock = new ReentrantLock();
++
++ private static KeyFactory DHKF = null;
++ private static final ReentrantLock DHKFLock = new ReentrantLock();
++
++ static Long importKey(SunPKCS11 sunPKCS11, long hSession, CK_ATTRIBUTE[]
attributes)
++ throws PKCS11Exception {
++ long keyID = -1;
++ Token token = sunPKCS11.getToken();
++ if (debug != null) {
++ debug.println("Private or Secret key will be imported in" +
++ " system FIPS mode.");
++ }
++ if (importerKey == null) {
++ importerKeyLock.lock();
++ try {
++ if (importerKey == null) {
++ if (importerKeyMechanism == null) {
++ // Importer Key creation has not been tried yet. Try it.
++ createImporterKey(token);
++ }
++ if (importerKey == null || importerCipher == null) {
++ if (debug != null) {
++ debug.println("Importer Key could not be" +
++ " generated.");
++ }
++ throw new PKCS11Exception(CKR_GENERAL_ERROR);
++ }
++ if (debug != null) {
++ debug.println("Importer Key successfully" +
++ " generated.");
++ }
++ }
++ } finally {
++ importerKeyLock.unlock();
++ }
++ }
++ long importerKeyID = importerKey.getKeyID();
++ try {
++ byte[] keyBytes = null;
++ byte[] encKeyBytes = null;
++ long keyClass = 0L;
++ long keyType = 0L;
++ Map<Long, CK_ATTRIBUTE> attrsMap = new HashMap<>();
++ for (CK_ATTRIBUTE attr : attributes) {
++ if (attr.type == CKA_CLASS) {
++ keyClass = attr.getLong();
++ } else if (attr.type == CKA_KEY_TYPE) {
++ keyType = attr.getLong();
++ }
++ attrsMap.put(attr.type, attr);
++ }
++ BigInteger v = null;
++ if (keyClass == CKO_PRIVATE_KEY) {
++ if (keyType == CKK_RSA) {
++ if (debug != null) {
++ debug.println("Importing an RSA private key...");
++ }
++ keyBytes = sun.security.rsa.RSAPrivateCrtKeyImpl.newKey(
++ KeyType.RSA,
++ null,
++ ((v = attrsMap.get(CKA_MODULUS).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_PUBLIC_EXPONENT).getBigInteger()) !=
null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_PRIVATE_EXPONENT).getBigInteger()) !=
null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_PRIME_1).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_PRIME_2).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_EXPONENT_1).getBigInteger()) !=
null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_EXPONENT_2).getBigInteger()) !=
null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_COEFFICIENT).getBigInteger()) !=
null)
++ ? v : BigInteger.ZERO
++ ).getEncoded();
++ } else if (keyType == CKK_DSA) {
++ if (debug != null) {
++ debug.println("Importing a DSA private key...");
++ }
++ keyBytes = new sun.security.provider.DSAPrivateKey(
++ ((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_PRIME).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_SUBPRIME).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_BASE).getBigInteger()) != null)
++ ? v : BigInteger.ZERO
++ ).getEncoded();
++ if (token.config.getNssNetscapeDbWorkaround() &&
++ attrsMap.get(CKA_NETSCAPE_DB) == null) {
++ attrsMap.put(CKA_NETSCAPE_DB,
++ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO));
++ }
++ } else if (keyType == CKK_EC) {
++ if (debug != null) {
++ debug.println("Importing an EC private key...");
++ }
++ if (sunECProvider == null) {
++ sunECProviderLock.lock();
++ try {
++ if (sunECProvider == null) {
++ sunECProvider =
Security.getProvider("SunEC");
++ }
++ } finally {
++ sunECProviderLock.unlock();
++ }
++ }
++ keyBytes = ECUtil.generateECPrivateKey(
++ ((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ECUtil.getECParameterSpec(sunECProvider,
++ attrsMap.get(CKA_EC_PARAMS).getByteArray()))
++ .getEncoded();
++ if (token.config.getNssNetscapeDbWorkaround() &&
++ attrsMap.get(CKA_NETSCAPE_DB) == null) {
++ attrsMap.put(CKA_NETSCAPE_DB,
++ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO));
++ }
++ } else if (keyType == CKK_DH) {
++ if (debug != null) {
++ debug.println("Importing a Diffie-Hellman private
key...");
++ }
++ if (DHKF == null) {
++ DHKFLock.lock();
++ try {
++ if (DHKF == null) {
++ DHKF = KeyFactory.getInstance(
++ "DH", P11Util.getSunJceProvider());
++ }
++ } finally {
++ DHKFLock.unlock();
++ }
++ }
++ DHPrivateKeySpec spec = new DHPrivateKeySpec
++ (((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_PRIME).getBigInteger()) != null)
++ ? v : BigInteger.ZERO,
++ ((v = attrsMap.get(CKA_BASE).getBigInteger()) != null)
++ ? v : BigInteger.ZERO);
++ keyBytes = DHKF.generatePrivate(spec).getEncoded();
++ if (token.config.getNssNetscapeDbWorkaround() &&
++ attrsMap.get(CKA_NETSCAPE_DB) == null) {
++ attrsMap.put(CKA_NETSCAPE_DB,
++ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO));
++ }
++ } else {
++ if (debug != null) {
++ debug.println("Unrecognized private key type.");
++ }
++ throw new PKCS11Exception(CKR_GENERAL_ERROR);
++ }
++ } else if (keyClass == CKO_SECRET_KEY) {
++ if (debug != null) {
++ debug.println("Importing a secret key...");
++ }
++ keyBytes = attrsMap.get(CKA_VALUE).getByteArray();
++ }
++ if (keyBytes == null || keyBytes.length == 0) {
++ if (debug != null) {
++ debug.println("Private or secret key plain bytes could" +
++ " not be obtained. Import failed.");
++ }
++ throw new PKCS11Exception(CKR_GENERAL_ERROR);
++ }
++ importerCipher.init(Cipher.ENCRYPT_MODE, importerKey,
++ new IvParameterSpec((byte[])importerKeyMechanism.pParameter),
++ null);
++ attributes = new CK_ATTRIBUTE[attrsMap.size()];
++ attrsMap.values().toArray(attributes);
++ encKeyBytes = importerCipher.doFinal(keyBytes);
++ attributes = token.getAttributes(TemplateManager.O_IMPORT,
++ keyClass, keyType, attributes);
++ keyID = token.p11.C_UnwrapKey(hSession,
++ importerKeyMechanism, importerKeyID, encKeyBytes, attributes);
++ if (debug != null) {
++ debug.println("Imported key ID: " + keyID);
++ }
++ } catch (Throwable t) {
++ throw new PKCS11Exception(CKR_GENERAL_ERROR);
++ } finally {
++ importerKey.releaseKeyID();
++ }
++ return Long.valueOf(keyID);
++ }
++
++ private static void createImporterKey(Token token) {
++ if (debug != null) {
++ debug.println("Generating Importer Key...");
++ }
++ byte[] iv = new byte[16];
++ JCAUtil.getSecureRandom().nextBytes(iv);
++ importerKeyMechanism = new CK_MECHANISM(CKM_AES_CBC_PAD, iv);
++ try {
++ CK_ATTRIBUTE[] attributes = token.getAttributes(TemplateManager.O_GENERATE,
++ CKO_SECRET_KEY, CKK_AES, new CK_ATTRIBUTE[] {
++ new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
++ new CK_ATTRIBUTE(CKA_VALUE_LEN, 256 >> 3)});
++ Session s = null;
++ try {
++ s = token.getObjSession();
++ long keyID = token.p11.C_GenerateKey(
++ s.id(), new CK_MECHANISM(CKM_AES_KEY_GEN),
++ attributes);
++ if (debug != null) {
++ debug.println("Importer Key ID: " + keyID);
++ }
++ importerKey = (P11Key)P11Key.secretKey(s, keyID, "AES",
++ 256 >> 3, null);
++ } catch (PKCS11Exception e) {
++ // best effort
++ } finally {
++ token.releaseSession(s);
++ }
++ if (importerKey != null) {
++ importerCipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
++ }
++ } catch (Throwable t) {
++ // best effort
++ importerKey = null;
++ importerCipher = null;
++ // importerKeyMechanism value is kept initialized to indicate that
++ // Importer Key creation has been tried and failed.
++ }
++ }
++}
+diff --git
openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
+index 5d3963ea893..42c72b393fd 100644
+---
openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
++++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
+@@ -26,6 +26,9 @@
+ package sun.security.pkcs11;
+
+ import java.io.*;
++import java.lang.invoke.MethodHandle;
++import java.lang.invoke.MethodHandles;
++import java.lang.invoke.MethodType;
+ import java.util.*;
+
+ import java.security.*;
+@@ -66,6 +69,26 @@ public final class SunPKCS11 extends AuthProvider {
+ private static final boolean systemFipsEnabled = SharedSecrets
+ .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled();
+
++ private static final boolean plainKeySupportEnabled = SharedSecrets
++ .getJavaSecuritySystemConfiguratorAccess().isPlainKeySupportEnabled();
++
++ private static final MethodHandle fipsImportKey;
++ static {
++ MethodHandle fipsImportKeyTmp = null;
++ if (plainKeySupportEnabled) {
++ try {
++ fipsImportKeyTmp = MethodHandles.lookup().findStatic(
++ FIPSKeyImporter.class, "importKey",
++ MethodType.methodType(Long.class, SunPKCS11.class,
++ long.class, CK_ATTRIBUTE[].class));
++ } catch (Throwable t) {
++ throw new SecurityException("FIPS key importer initialization"
+
++ " failed", t);
++ }
++ }
++ fipsImportKey = fipsImportKeyTmp;
++ }
++
+ private static final long serialVersionUID = -1354835039035306505L;
+
+ static final Debug debug = Debug.getInstance("sunpkcs11");
+@@ -324,10 +347,15 @@ public final class SunPKCS11 extends AuthProvider {
+ // request multithreaded access first
+ initArgs.flags = CKF_OS_LOCKING_OK;
+ PKCS11 tmpPKCS11;
++ MethodHandle fipsKeyImporter = null;
++ if (plainKeySupportEnabled) {
++ fipsKeyImporter = MethodHandles.insertArguments(
++ fipsImportKey, 0, this);
++ }
+ try {
+ tmpPKCS11 = PKCS11.getInstance(
+ library, functionList, initArgs,
+- config.getOmitInitialize());
++ config.getOmitInitialize(), fipsKeyImporter);
+ } catch (PKCS11Exception e) {
+ if (debug != null) {
+ debug.println("Multi-threaded initialization failed: " +
e);
+@@ -343,7 +371,7 @@ public final class SunPKCS11 extends AuthProvider {
+ initArgs.flags = 0;
+ }
+ tmpPKCS11 = PKCS11.getInstance(library,
+- functionList, initArgs, config.getOmitInitialize());
++ functionList, initArgs, config.getOmitInitialize(),
fipsKeyImporter);
+ }
+ p11 = tmpPKCS11;
+
+diff --git
openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
+index 5c0aacd1a67..4d80145cb91 100644
+---
openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
++++
openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
+@@ -49,6 +49,7 @@ package sun.security.pkcs11.wrapper;
+
+ import java.io.File;
+ import java.io.IOException;
++import java.lang.invoke.MethodHandle;
+ import java.util.*;
+
+ import java.security.AccessController;
+@@ -152,16 +153,28 @@ public class PKCS11 {
+
+ public static synchronized PKCS11 getInstance(String pkcs11ModulePath,
+ String functionList, CK_C_INITIALIZE_ARGS pInitArgs,
+- boolean omitInitialize) throws IOException, PKCS11Exception {
++ boolean omitInitialize, MethodHandle fipsKeyImporter)
++ throws IOException, PKCS11Exception {
+ // we may only call C_Initialize once per native .so/.dll
+ // so keep a cache using the (non-canonicalized!) path
+ PKCS11 pkcs11 = moduleMap.get(pkcs11ModulePath);
+ if (pkcs11 == null) {
++ boolean nssFipsMode = fipsKeyImporter != null;
+ if ((pInitArgs != null)
+ && ((pInitArgs.flags & CKF_OS_LOCKING_OK) != 0)) {
+- pkcs11 = new PKCS11(pkcs11ModulePath, functionList);
++ if (nssFipsMode) {
++ pkcs11 = new FIPSPKCS11(pkcs11ModulePath, functionList,
++ fipsKeyImporter);
++ } else {
++ pkcs11 = new PKCS11(pkcs11ModulePath, functionList);
++ }
+ } else {
+- pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList);
++ if (nssFipsMode) {
++ pkcs11 = new SynchronizedFIPSPKCS11(pkcs11ModulePath,
++ functionList, fipsKeyImporter);
++ } else {
++ pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList);
++ }
+ }
+ if (omitInitialize == false) {
+ try {
+@@ -1911,4 +1924,69 @@ static class SynchronizedPKCS11 extends PKCS11 {
+ super.C_GenerateRandom(hSession, randomData);
+ }
+ }
++
++// PKCS11 subclass that allows using plain private or secret keys in
++// FIPS-configured NSS Software Tokens. Only used when System FIPS
++// is enabled.
++static class FIPSPKCS11 extends PKCS11 {
++ private MethodHandle fipsKeyImporter;
++ FIPSPKCS11(String pkcs11ModulePath, String functionListName,
++ MethodHandle fipsKeyImporter) throws IOException {
++ super(pkcs11ModulePath, functionListName);
++ this.fipsKeyImporter = fipsKeyImporter;
++ }
++
++ public synchronized long C_CreateObject(long hSession,
++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception {
++ // Creating sensitive key objects from plain key material in a
++ // FIPS-configured NSS Software Token is not allowed. We apply
++ // a key-unwrapping scheme to achieve so.
++ if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) {
++ try {
++ return ((Long)fipsKeyImporter.invoke(hSession, pTemplate))
++ .longValue();
++ } catch (Throwable t) {
++ throw new PKCS11Exception(CKR_GENERAL_ERROR);
++ }
++ }
++ return super.C_CreateObject(hSession, pTemplate);
++ }
++}
++
++// FIPSPKCS11 synchronized counterpart.
++static class SynchronizedFIPSPKCS11 extends SynchronizedPKCS11 {
++ private MethodHandle fipsKeyImporter;
++ SynchronizedFIPSPKCS11(String pkcs11ModulePath, String functionListName,
++ MethodHandle fipsKeyImporter) throws IOException {
++ super(pkcs11ModulePath, functionListName);
++ this.fipsKeyImporter = fipsKeyImporter;
++ }
++
++ public synchronized long C_CreateObject(long hSession,
++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception {
++ // See FIPSPKCS11::C_CreateObject.
++ if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) {
++ try {
++ return ((Long)fipsKeyImporter.invoke(hSession, pTemplate))
++ .longValue();
++ } catch (Throwable t) {
++ throw new PKCS11Exception(CKR_GENERAL_ERROR);
++ }
++ }
++ return super.C_CreateObject(hSession, pTemplate);
++ }
++}
++
++private static class FIPSPKCS11Helper {
++ static boolean isSensitiveObject(CK_ATTRIBUTE[] pTemplate) {
++ for (CK_ATTRIBUTE attr : pTemplate) {
++ if (attr.type == CKA_CLASS &&
++ (attr.getLong() == CKO_PRIVATE_KEY ||
++ attr.getLong() == CKO_SECRET_KEY)) {
++ return true;
++ }
++ }
++ return false;
++ }
++}
+ }
+diff --git
openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java
openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java
+index e2d6d371bec..dc5e7eefdd3 100644
+---
openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java
++++
openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java
+@@ -219,6 +219,14 @@ public class PKCS11Exception extends Exception {
+ return "0x" + Functions.toFullHexString((int)errorCode);
+ }
+
++ /**
++ * Constructor taking the error code (the CKR_* constants in PKCS#11) with
++ * no extra info for the error message.
++ */
++ public PKCS11Exception(long errorCode) {
++ this(errorCode, null);
++ }
++
+ /**
+ * Constructor taking the error code (the CKR_* constants in PKCS#11) and
+ * extra info for error message.
commit f2132d86ba9dc7234379c8368b303bcbfcbde780
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Thu Sep 30 20:39:20 2021 +0100
Add patch to login to the NSS software token when in FIPS mode.
Fix unused function compiler warning found in systemconf.c
Extend the default security policy to accomodate PKCS11 accessing
jdk.internal.access.
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 7c3db6f..3bf0eec 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 35
-%global rpmrelease 3
+%global rpmrelease 4
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -1176,8 +1176,12 @@ Patch1004: rh1860986-disable_tlsv1.3_in_fips_mode.patch
Patch1007: rh1915071-always_initialise_configurator_access.patch
# RH1929465: Improve system FIPS detection
Patch1008: rh1929465-improve_system_FIPS_detection.patch
+Patch1011: rh1929465-dont_define_unused_throwioexception.patch
# RH1995150: Disable non-FIPS crypto in SUN and SunEC security providers
Patch1009: rh1995150-disable_non-fips_crypto.patch
+# RH1996182: Login to the NSS software token in FIPS mode
+Patch1010: rh1996182-login_to_nss_software_token.patch
+Patch1012: rh1996182-extend_security_policy.patch
#############################################
#
@@ -1541,6 +1545,9 @@ popd # openjdk
%patch1007
%patch1008
%patch1009
+%patch1010
+%patch1011
+%patch1012
# Extract systemtap tapsets
%if %{with_systemtap}
@@ -2267,6 +2274,13 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Sep 30 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.0.0.35-4.rolling
+- Fix unused function compiler warning found in systemconf.c
+- Extend the default security policy to accomodate PKCS11 accessing jdk.internal.access.
+
+* Thu Sep 30 2021 Martin Balao <mbalao(a)redhat.com> - 1:17.0.0.0.35-4.rolling
+- Add patch to login to the NSS software token when in FIPS mode.
+
* Mon Sep 27 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.0.0.35-3.rolling
- Update release notes to document the major changes between OpenJDK 11 & 17.
diff --git a/rh1929465-dont_define_unused_throwioexception.patch
b/rh1929465-dont_define_unused_throwioexception.patch
new file mode 100644
index 0000000..eba090f
--- /dev/null
+++ b/rh1929465-dont_define_unused_throwioexception.patch
@@ -0,0 +1,69 @@
+commit 90e344e7d4987af610fa0054c92d18fe1c2edd41
+Author: Andrew Hughes <gnu.andrew(a)redhat.com>
+Date: Sat Aug 28 01:15:28 2021 +0100
+
+ RH1929465: Don't define unused throwIOException function when using NSS
detection
+
+diff --git openjdk.orig/src/java.base/linux/native/libsystemconf/systemconf.c
openjdk/src/java.base/linux/native/libsystemconf/systemconf.c
+index 6f4656bfcb6..38919d6bb0f 100644
+--- openjdk.orig/src/java.base/linux/native/libsystemconf/systemconf.c
++++ openjdk/src/java.base/linux/native/libsystemconf/systemconf.c
+@@ -34,14 +34,34 @@
+
+ #include "java_security_SystemConfigurator.h"
+
+-#define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled"
+ #define MSG_MAX_SIZE 96
+
+ static jmethodID debugPrintlnMethodID = NULL;
+ static jobject debugObj = NULL;
+
+-static void throwIOException(JNIEnv *env, const char *msg);
+-static void dbgPrint(JNIEnv *env, const char* msg);
++// Only used when NSS is unavailable and FIPS_ENABLED_PATH is read
++#ifndef SYSCONF_NSS
++
++#define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled"
++
++static void throwIOException(JNIEnv *env, const char *msg)
++{
++ jclass cls = (*env)->FindClass(env, "java/io/IOException");
++ if (cls != 0)
++ (*env)->ThrowNew(env, cls, msg);
++}
++
++#endif
++
++static void dbgPrint(JNIEnv *env, const char* msg)
++{
++ jstring jMsg;
++ if (debugObj != NULL) {
++ jMsg = (*env)->NewStringUTF(env, msg);
++ CHECK_NULL(jMsg);
++ (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg);
++ }
++}
+
+ /*
+ * Class: java_security_SystemConfigurator
+@@ -149,20 +169,3 @@ JNIEXPORT jboolean JNICALL
Java_java_security_SystemConfigurator_getSystemFIPSEn
+
+ #endif // SYSCONF_NSS
+ }
+-
+-static void throwIOException(JNIEnv *env, const char *msg)
+-{
+- jclass cls = (*env)->FindClass(env, "java/io/IOException");
+- if (cls != 0)
+- (*env)->ThrowNew(env, cls, msg);
+-}
+-
+-static void dbgPrint(JNIEnv *env, const char* msg)
+-{
+- jstring jMsg;
+- if (debugObj != NULL) {
+- jMsg = (*env)->NewStringUTF(env, msg);
+- CHECK_NULL(jMsg);
+- (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg);
+- }
+-}
diff --git a/rh1996182-extend_security_policy.patch
b/rh1996182-extend_security_policy.patch
new file mode 100644
index 0000000..7622622
--- /dev/null
+++ b/rh1996182-extend_security_policy.patch
@@ -0,0 +1,18 @@
+commit bfd7c5dae9c15266799cb885b8c60199217b65b9
+Author: Andrew Hughes <gnu.andrew(a)redhat.com>
+Date: Mon Aug 30 16:14:14 2021 +0100
+
+ RH1996182: Extend default security policy to allow SunPKCS11 access to
jdk.internal.access
+
+diff --git openjdk.orig/src/java.base/share/lib/security/default.policy
openjdk/src/java.base/share/lib/security/default.policy
+index 8356e56367b..23925f048be 100644
+--- openjdk.orig/src/java.base/share/lib/security/default.policy
++++ openjdk/src/java.base/share/lib/security/default.policy
+@@ -128,6 +128,7 @@ grant codeBase "jrt:/jdk.crypto.ec" {
+ grant codeBase "jrt:/jdk.crypto.cryptoki" {
+ permission java.lang.RuntimePermission
+ "accessClassInPackage.com.sun.crypto.provider";
++ permission java.lang.RuntimePermission
"accessClassInPackage.jdk.internal.access";
+ permission java.lang.RuntimePermission
"accessClassInPackage.jdk.internal.misc";
+ permission java.lang.RuntimePermission
+ "accessClassInPackage.sun.security.*";
diff --git a/rh1996182-login_to_nss_software_token.patch
b/rh1996182-login_to_nss_software_token.patch
new file mode 100644
index 0000000..475c521
--- /dev/null
+++ b/rh1996182-login_to_nss_software_token.patch
@@ -0,0 +1,65 @@
+commit 93c9f6330bf2b4405c789bf893a5256c3f4a4923
+Author: Martin Balao <mbalao(a)redhat.com>
+Date: Sat Aug 28 00:35:44 2021 +0100
+
+ RH1996182: Login to the NSS Software Token in FIPS Mode
+
+diff --git openjdk.orig/src/java.base/share/classes/module-info.java
openjdk/src/java.base/share/classes/module-info.java
+index 39e69362458..aeb5fc2eb46 100644
+--- openjdk.orig/src/java.base/share/classes/module-info.java
++++ openjdk/src/java.base/share/classes/module-info.java
+@@ -151,6 +151,7 @@ module java.base {
+ java.management,
+ java.naming,
+ java.rmi,
++ jdk.crypto.cryptoki,
+ jdk.crypto.ec,
+ jdk.jartool,
+ jdk.jlink,
+diff --git
openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
+index 112b639aa96..5d3963ea893 100644
+---
openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
++++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
+@@ -42,6 +42,7 @@ import javax.security.auth.callback.PasswordCallback;
+
+ import com.sun.crypto.provider.ChaCha20Poly1305Parameters;
+
++import jdk.internal.access.SharedSecrets;
+ import jdk.internal.misc.InnocuousThread;
+ import sun.security.util.Debug;
+ import sun.security.util.ResourcesMgr;
+@@ -62,6 +63,9 @@ import static sun.security.pkcs11.wrapper.PKCS11Exception.*;
+ */
+ public final class SunPKCS11 extends AuthProvider {
+
++ private static final boolean systemFipsEnabled = SharedSecrets
++ .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled();
++
+ private static final long serialVersionUID = -1354835039035306505L;
+
+ static final Debug debug = Debug.getInstance("sunpkcs11");
+@@ -379,6 +383,24 @@ public final class SunPKCS11 extends AuthProvider {
+ if (nssModule != null) {
+ nssModule.setProvider(this);
+ }
++ if (systemFipsEnabled) {
++ // The NSS Software Token in FIPS 140-2 mode requires a user
++ // login for most operations. See sftk_fipsCheck. The NSS DB
++ // (/etc/pki/nssdb) PIN is empty.
++ Session session = null;
++ try {
++ session = token.getOpSession();
++ p11.C_Login(session.id(), CKU_USER, new char[] {});
++ } catch (PKCS11Exception p11e) {
++ if (debug != null) {
++ debug.println("Error during token login: " +
++ p11e.getMessage());
++ }
++ throw p11e;
++ } finally {
++ token.releaseSession(session);
++ }
++ }
+ } catch (Exception e) {
+ if (config.getHandleStartupErrors() == Config.ERR_IGNORE_ALL) {
+ throw new UnsupportedOperationException
commit 37b7b79aff0c745de0dc625bf4a14fffaab32fc7
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Mon Sep 27 02:42:03 2021 +0100
Update release notes to document the major changes between OpenJDK 11 & 17.
diff --git a/NEWS b/NEWS
index c88d968..cf7bae0 100644
--- a/NEWS
+++ b/NEWS
@@ -3,152 +3,526 @@ Key:
JDK-X -
https://bugs.openjdk.java.net/browse/JDK-X
CVE-XXXX-YYYY:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
-New in release OpenJDK 15.0.2 (2021-01-19):
+New in release OpenJDK 17.0.0 (2021-09-14):
===========================================
-Live versions of these release notes can be found at:
- *
https://builds.shipilev.net/backports-monitor/release-notes-15.0.2.txt
-
-* Security fixes
- - JDK-8247619: Improve Direct Buffering of Characters
-* Other changes
- - JDK-8197981: Missing return statement in __sync_val_compare_and_swap_8
- - JDK-8239105: Add exception for expiring Digicert root certificates to VerifyCACerts
test
- - JDK-8247741: Test test/hotspot/jtreg/runtime/7162488/TestUnrecognizedVmOption.java
fails when -XX:+IgnoreUnrecognizedVMOptions is set
- - JDK-8248411: [aarch64] Insufficient error handling when CodeBuffer is exhausted
- - JDK-8248596: [TESTBUG] compiler/loopopts/PartialPeelingUnswitch.java times out with
Graal enabled
- - JDK-8248667: Need support for building native libraries located in the test/lib
directory
- - JDK-8249176: Update GlobalSignR6CA test certificates
- - JDK-8249192: MonitorInfo stores raw oops across safepoints
- - JDK-8249217: Unexpected StackOverflowError in "process reaper" thread still
happens
- - JDK-8249781: AArch64: AOT compiled code crashes if C2 allocates r27
- - JDK-8250257: Bump release strings for JDK 15.0.2
- - JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
- - JDK-8251859: sun/security/validator/PKIXValAndRevCheckTests.java fails
- - JDK-8253191: C2: Masked byte comparisons with large masks produce wrong result on
x86
- - JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
- - JDK-8253566: clazz.isAssignableFrom will return false for interface implementors
- - JDK-8253756: C2 CompilerThread0 crash in Node::add_req(Node*)
- - JDK-8253791: Issue with useAppleColor check in CSystemColors.m
- - JDK-8253960: Memory leak in Java_java_lang_ClassLoader_defineClass0()
- - JDK-8254081: java/security/cert/PolicyNode/GetPolicyQualifiers.java fails due to an
expired certificate
- - JDK-8254166: Zero: return-type warning in zeroInterpreter_zero.cpp
- - JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
- - JDK-8254319: Shenandoah: Interpreter native-LRB needs to activate during
HAS_FORWARDED
- - JDK-8254320: Shenandoah: C2 native LRB should activate for non-cset objects
- - JDK-8254790: SIGSEGV in string_indexof_char and stringL_indexof_char intrinsics
- - JDK-8254854: [cgroups v1] Metric limits not properly detected on some join controller
combinations
- - JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
- - JDK-8255065: Zero: accessor_entry misses the IRIW case
- - JDK-8255067: Restore Copyright line in file modified by 8253191
- - JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
- - JDK-8255599: Change jdk 15.0.2 milestone to fcs for build b04
- - JDK-8255603: Memory/Performance regression after JDK-8210985
- - JDK-8256051: nmethod_entry_barrier stub miscalculates xmm spill size on x86_32
- - JDK-8256427: Test com/sun/jndi/dns/ConfigTests/PortUnreachable.java does not work on
AIX
- - JDK-8256618: Zero: Linux x86_32 build still fails
- - JDK-8257181: s390x builds are very noisy with gc-sections messages
- - JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint() from control thread
should return false
- - JDK-8257701: Shenandoah: objArrayKlass metadata is not marked with chunked arrays
-
-Notes on individual issues:
+The full list of changes in the interim releases from 11u to 17u can be found at:
+ *
https://builds.shipilev.net/backports-monitor/release-notes-12.txt
+ *
https://builds.shipilev.net/backports-monitor/release-notes-13.txt
+ *
https://builds.shipilev.net/backports-monitor/release-notes-14.txt
+ *
https://builds.shipilev.net/backports-monitor/release-notes-15.txt
+ *
https://builds.shipilev.net/backports-monitor/release-notes-16.txt
+ *
https://builds.shipilev.net/backports-monitor/release-notes-17.txt
+
+Major changes are listed below. Some changes may have been backported
+to earlier releases following their first appearance in OpenJDK 12
+through to 17.
+
+NEW FEATURES
+============
+
+Language Features
+=================
+
+Switch Expressions
+==================
+https://openjdk.java.net/jeps/325
+https://openjdk.java.net/jeps/354
+https://openjdk.java.net/jeps/361
+
+Extend the `switch` statement so that it can be used as either a
+statement or an expression, and that both forms can use either a
+"traditional" or "simplified" scoping and control flow behavior.
Both
+forms can use either traditional `case ... :` labels (with fall
+through) or new `case ... ->` labels (with no fall through), with a
+further new statement for yielding a value from a `switch`
+expression. These changes will simplify everyday coding, and also
+prepare the way for the use of pattern matching in `switch`.
+
+This was a preview feature (
http://openjdk.java.net/jeps/12) in
+OpenJDK 12 & 13 and became final in OpenJDK 14.
+
+Text Blocks
+===========
+https://openjdk.java.net/jeps/355
+https://openjdk.java.net/jeps/368
+https://openjdk.java.net/jeps/378
+
+Add text blocks to the Java language. A text block is a multi-line
+string literal that avoids the need for most escape sequences,
+automatically formats the string in a predictable way, and gives the
+developer control over format when desired.
+
+This was a preview feature (
http://openjdk.java.net/jeps/12) in
+OpenJDK 13 & 14 and became final in OpenJDK 15.
+
+Pattern Matching for instanceof
+===============================
+https://openjdk.java.net/jeps/305
+https://openjdk.java.net/jeps/375
+https://openjdk.java.net/jeps/394
+http://cr.openjdk.java.net/~briangoetz/amber/pattern-match.html
+
+Enhance the Java programming language with pattern matching for the
+`instanceof` operator. Pattern matching allows common logic in a
+program, namely the conditional extraction of components from objects,
+to be expressed more concisely and safely.
+
+This was a preview feature (
http://openjdk.java.net/jeps/12) in
+OpenJDK 14 & 15 and became final in OpenJDK 16.
+
+Records
+=======
+https://openjdk.java.net/jeps/359
+https://openjdk.java.net/jeps/384
+https://openjdk.java.net/jeps/395
+
+Enhance the Java programming language with records. Records provide a
+compact syntax for declaring classes which are transparent holders for
+shallowly immutable data.
+
+This was a preview feature (
http://openjdk.java.net/jeps/12) in
+OpenJDK 14 & 15 and became final in OpenJDK 16.
+
+Sealed Classes
+==============
+https://openjdk.java.net/jeps/360
+https://openjdk.java.net/jeps/397
+https://openjdk.java.net/jeps/409
+https://cr.openjdk.java.net/~briangoetz/amber/datum.html
+
+Enhance the Java programming language with sealed classes and
+interfaces. Sealed classes and interfaces restrict which other classes
+or interfaces may extend or implement them.
+
+This was a preview feature (
http://openjdk.java.net/jeps/12) in
+OpenJDK 15 & 16 and became final in OpenJDK 17.
+
+Restore Always-Strict Floating-Point Semantics
+==============================================
+https://openjdk.java.net/jeps/306
+
+Make floating-point operations consistently strict, rather than have
+both strict floating-point semantics (`strictfp`) and subtly different
+default floating-point semantics. This will restore the original
+floating-point semantics to the language and VM, matching the
+semantics before the introduction of strict and default floating-point
+modes in Java SE 1.2.
+
+Pattern Matching for switch
===========================
+https://openjdk.java.net/jeps/406
-core-libs/java.time:
+Enhance the Java programming language with pattern matching for
+`switch` expressions and statements, along with extensions to the
+language of patterns. Extending pattern matching to `switch` allows an
+expression to be tested against a number of patterns, each with a
+specific action, so that complex data-oriented queries can be
+expressed concisely and safely.
-JDK-8254177: US/Pacific-New Zone name removed as part of tzdata2020b
-====================================================================
-Following JDK's update to tzdata2020b, the long-obsolete files
-pacificnew and systemv have been removed. As a result, the
-"US/Pacific-New" zone name declared in the pacificnew data file is no
-longer available for use.
+This is a preview feature (
http://openjdk.java.net/jeps/12) in OpenJDK
+17.
-Information regarding the update can be viewed at
-https://mm.icann.org/pipermail/tz-announce/2020-October/000059.html
+Library Features
+================
-New in release OpenJDK 15.0.1 (2020-10-20):
-===========================================
-Live versions of these release notes can be found at:
- *
https://builds.shipilev.net/backports-monitor/release-notes-15.0.1.txt
-
-* Security fixes
- - JDK-8233624: Enhance JNI linkage
- - JDK-8236196: Improve string pooling
- - JDK-8236862, CVE-2020-14779: Enhance support of Proxy class
- - JDK-8237990, CVE-2020-14781: Enhanced LDAP contexts
- - JDK-8237995, CVE-2020-14782: Enhance certificate processing
- - JDK-8240124: Better VM Interning
- - JDK-8241114, CVE-2020-14792: Better range handling
- - JDK-8242680, CVE-2020-14796: Improved URI Support
- - JDK-8242685, CVE-2020-14797: Better Path Validation
- - JDK-8242695, CVE-2020-14798: Enhanced buffer support
- - JDK-8243302: Advanced class supports
- - JDK-8244136, CVE-2020-14803: Improved Buffer supports
- - JDK-8244479: Further constrain certificates
- - JDK-8244955: Additional Fix for JDK-8240124
- - JDK-8245407: Enhance zoning of times
- - JDK-8245412: Better class definitions
- - JDK-8245417: Improve certificate chain handling
- - JDK-8248574: Improve jpeg processing
- - JDK-8249927: Specify limits of jdk.serialProxyInterfaceLimit
- - JDK-8253019: Enhanced JPEG decoding
-* Other changes
- - JDK-8232114: JVM crashed at imjpapi.dll in native code
- - JDK-8243470: [macos] bring back O2 opt level for unsafe.cpp
- - JDK-8247251: Assert '(_pcs_length == 0 || last_pc()->pc_offset() <
pc_offset) failed: must specify a new, larger pc offset' failure
- - JDK-8248495: [macos] zerovm is broken due to libffi headers location
- - JDK-8248745: Add jarsigner and keytool tests for restricted algorithms
- - JDK-8249165: Remove unneeded nops introduced by 8234160 changes
- - JDK-8249183: JVM crash in "AwtFrame::WmSize" method
- - JDK-8249266: Bump release strings for JDK 15.0.1
- - JDK-8249266: Change jdk 15.0.1 milestone to fcs for build b02
- - JDK-8250612: jvmciCompilerToVM.cpp declares jio_printf with "void" return
type, should be "int"
- - JDK-8250665: Wrong translation for the month name of May in ar_JO,LB,SY
- - JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
- - JDK-8250876: Fix issues with cross-compile on macos
- - JDK-8250928: JFR: Improve hash algorithm for stack traces
- - JDK-8251359: Shenandoah: filter null oops before calling enqueue/SATB barrier
- - JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt >= 0)
failed"
- - JDK-8251859: sun/security/validator/PKIXValAndRevCheckTests.java fails
- - JDK-8251910: Shenandoah: Handshake threads between weak-roots and reset phases
- - JDK-8252120: compiler/oracle/TestCompileCommand.java misspells "occured"
- - JDK-8252292: 8240795 may cause anti-dependence to be missed
- - JDK-8252359: HotSpot Not Identifying it is Running in a Container
- - JDK-8252367: Undo JDK-8245000: Windows GDI functions don't support large pages
- - JDK-8252368: Undo JDK-8245002: Windows GDI functions don't support NUMA
interleaving
- - JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/DisposeFrameOnDragTest.java fails
on Windows
- - JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize option
- - JDK-8252754: Hash code calculation of JfrStackTrace is inconsistent
- - JDK-8253222: Shenandoah: unused AlwaysTrueClosure after JDK-8246591
- - JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor calls virtual
num_queues()
- - JDK-8253226: Shenandoah: remove unimplemented ShenandoahStrDedupQueue::verify
- - JDK-8253284: Zero OrderAccess barrier mappings are incorrect
- - JDK-8253714: [cgroups v2] Soft memory limit incorrectly using memory.high
- - JDK-8253727: [cgroups v2] Memory and swap limits reported incorrectly
- - JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint should not access
VMThread state from other threads
- - JDK-8254144: Non-x86 Zero builds fail with return-type warning in os_linux_zero.cpp
- - JDK-8254560: Shenandoah: Concurrent Strong Roots logging is incorrect
-
-Notes on individual issues:
+JVM Constants API
+=================
+https://openjdk.java.net/jeps/334
+
+Introduce an API to model nominal descriptions of key class-file and
+run-time artifacts, in particular constants that are loadable from the
+constant pool.
+
+Reimplement the Legacy Socket API
+=================================
+https://openjdk.java.net/jeps/353
+
+Replace the underlying implementation used by the `java.net.Socket`
+and `java.net.ServerSocket` APIs with a simpler and more modern
+implementation that is easy to maintain and debug. The new
+implementation will be easy to adapt to work with user-mode threads,
+a.k.a. fibers, currently being explored in Project Loom
+(https://openjdk.java.net/projects/loom).
+
+JFR Event Streaming
+===================
+https://openjdk.java.net/jeps/349
+
+Expose JDK Flight Recorder data for continuous monitoring.
+
+Non-Volatile Mapped Byte Buffers
+================================
+https://openjdk.java.net/jeps/352
+
+Add new JDK-specific file mapping modes so that the `FileChannel` API
+can be used to create `MappedByteBuffer` instances that refer to
+non-volatile memory.
+
+Helpful NullPointerExceptions
+=============================
+https://openjdk.java.net/jeps/358
+
+Improve the usability of `NullPointerException`s generated by the JVM
+by describing precisely which variable was `null`.
+
+Foreign-Memory Access API
+=========================
+https://openjdk.java.net/jeps/370
+https://openjdk.java.net/jeps/383
+https://openjdk.java.net/jeps/393
+
+Introduce an API to allow Java programs to safely and efficiently
+access foreign memory outside of the Java heap.
+
+This was a incubation feature (
https://openjdk.java.net/jeps/11) in
+OpenJDK 14, 15 & 16, now superseded by the Foreign Function & Memory
+API in OpenJDK 17 (see below).
+
+Edwards-Curve Digital Signature Algorithm (EdDSA)
+=================================================
+https://openjdk.java.net/jeps/339
+
+Implement cryptographic signatures using the Edwards-Curve Digital
+Signature Algorithm (EdDSA) as described by RFC 8032
+(https://tools.ietf.org/html/rfc8032).
+
+Hidden Classes
+==============
+https://openjdk.java.net/jeps/371
+
+Introduce hidden classes, which are classes that cannot be used
+directly by the bytecode of other classes. Hidden classes are intended
+for use by frameworks that generate classes at run time and use them
+indirectly, via reflection. A hidden class may be defined as a member
+of an access control nest (
https://openjdk.java.net/jeps/181), and may
+be unloaded independently of other classes.
+
+Reimplement the Legacy DatagramSocket API
+=========================================
+https://openjdk.java.net/jeps/373
+
+Replace the underlying implementations of the
+`java.net.DatagramSocket` and `java.net.MulticastSocket` APIs with
+simpler and more modern implementations that are easy to maintain and
+debug. The new implementations will be easy to adapt to work with
+virtual threads, currently being explored in Project Loom
+(https://openjdk.java.net/projects/loom). This is a follow-on to JEP
+353 (see above), which already reimplemented the legacy Socket API.
+
+Vector API
+==========
+https://openjdk.java.net/jeps/338
+https://openjdk.java.net/jeps/414
+
+Provide an initial iteration of an incubator module,
+`jdk.incubator.vector`, to express vector computations that reliably
+compile at runtime to optimal vector hardware instructions on
+supported CPU architectures and thus achieve superior performance to
+equivalent scalar computations.
+
+This is an incubation feature (
https://openjdk.java.net/jeps/11)
+introduced in OpenJDK 16.
+
+Unix-Domain Socket Channels
+===========================
+https://openjdk.java.net/jeps/380
+
+Add Unix-domain (`AF_UNIX`) socket support to the socket channel and
+server-socket channel APIs in the `java.nio.channels` package. Extend
+the inherited channel mechanism to support Unix-domain socket channels
+and server socket channels.
+
+Foreign Linker API (Incubator)
+==============================
+https://openjdk.java.net/jeps/389
+
+Introduce an API that offers statically-typed, pure-Java access to
+native code. This API, together with the Foreign-Memory API (see
+above), will considerably simplify the otherwise error-prone process
+of binding to a native library.
+
+This was an incubation feature (
https://openjdk.java.net/jeps/11)
+introduced in OpenJDK 16, now superseded by the Foreign Function &
+Memory API in OpenJDK 17 (see below).
+
+Strongly Encapsulate JDK Internals by Default
+=============================================
+https://openjdk.java.net/jeps/396
+https://openjdk.java.net/jeps/403
+
+Strongly encapsulate all internal elements of the JDK by default,
+except for critical internal APIs such as `sun.misc.Unsafe`. It will
+no longer be possible to relax the strong encapsulation of internal
+elements via a single command-line option, as was possible in OpenJDK
+9 through 16.
+
+Enhanced Pseudo-Random Number Generators
+========================================
+https://openjdk.java.net/jeps/356
+
+Provide new interface types and implementations for pseudo-random
+number generators (PRNGs), including jumpable PRNGs and an additional
+class of splittable PRNG algorithms (LXM).
+
+Foreign Function & Memory API
+=============================
+https://openjdk.java.net/jeps/412
+
+Introduce an API by which Java programs can interoperate with code and
+data outside of the Java runtime. By efficiently invoking foreign
+functions (i.e., code outside the JVM), and by safely accessing
+foreign memory (i.e., memory not managed by the JVM), the API enables
+Java programs to call native libraries and process native data without
+the brittleness and danger of JNI.
+
+This API is an incubation feature (
https://openjdk.java.net/jeps/11)
+introduced in OpenJDK 17, and is an evolution of the Foreign Memory
+Access API (OpenJDK 14 through 16) and Foreign Linker API (OpenJDK
+16) (see above).
+
+Context-Specific Deserialization Filters
+========================================
+https://openjdk.java.net/jeps/415
+
+Allow applications to configure context-specific and
+dynamically-selected deserialization filters via a JVM-wide filter
+factory that is invoked to select a filter for each individual
+deserialization operation.
+
+Tools
+=====
+
+Packaging Tool
+==============
+https://openjdk.java.net/jeps/343
+https://openjdk.java.net/jeps/392
+
+Provide the `jpackage` tool, for packaging self-contained Java
+applications.
+
+JVM Features
+============
+
+Shenandoah: A Low-Pause-Time Garbage Collector
+==============================================
+https://openjdk.java.net/jeps/189
+https://openjdk.java.net/jeps/379
+
+Add a new garbage collection (GC) algorithm named Shenandoah which
+reduces GC pause times by doing evacuation work concurrently with the
+running Java threads. Pause times with Shenandoah are independent of
+heap size, meaning you will have the same consistent pause times
+whether your heap is 200 MB or 200 GB.
+
+Shenandoah has been provided in Red Hat builds of OpenJDK 8 since
+8u131 in April 2017 and in all 11u builds.
+
+Upstream, it was introduced in OpenJDK 12 as an experimental feature
+and became a production feature in OpenJDK 15. It was backported to
+OpenJDK 11 with the 11.0.9 release in October 2020.
+
+Abortable Mixed Collections for G1
+==================================
+https://openjdk.java.net/jeps/344
+
+Make G1 mixed collections abortable if they might exceed the pause
+target.
+
+Promptly Return Unused Committed Memory from G1
+===============================================
+https://openjdk.java.net/jeps/346
+
+Enhance the G1 garbage collector to automatically return Java heap
+memory to the operating system when idle.
+
+Dynamic CDS Archives
+====================
+https://openjdk.java.net/jeps/310
+https://openjdk.java.net/jeps/350
+
+Extend application class-data sharing to allow the dynamic archiving
+of classes at the end of Java application execution. The archived
+classes will include all loaded application classes and library
+classes that are not present in the default, base-layer CDS archive.
+
+ZGC: Uncommit Unused Memory (Experimental)
+==========================================
+https://openjdk.java.net/jeps/351
+
+Enhance ZGC to return unused heap memory to the operating system.
+
+NUMA-Aware Memory Allocation for G1
+===================================
+https://openjdk.java.net/jeps/345
+
+Improve G1 performance on large machines by implementing NUMA-aware
+memory allocation.
+
+ZGC on macOS (Experimental)
===========================
+https://openjdk.java.net/jeps/364
+
+Port the ZGC garbage collector to macOS.
+
+ZGC on Windows (Experimental)
+=============================
+https://openjdk.java.net/jeps/365
+
+Port the ZGC garbage collector to Windows.
+
+ZGC: A Scalable Low-Latency Garbage Collector (Production)
+==========================================================
+https://openjdk.java.net/jeps/377
+
+Change the Z Garbage Collector from an experimental feature into a
+product feature.
+
+ZGC: Concurrent Thread-Stack Processing
+=======================================
+https://openjdk.java.net/jeps/376
+
+Move ZGC thread-stack processing from safepoints to a concurrent
+phase.
-security-libs/java.security:
+Elastic Metaspace
+=================
+https://openjdk.java.net/jeps/387
-JDK-8250756: Added Entrust Root Certification Authority - G4 certificate
-========================================================================
-The Entrust root certificate has been added to the cacerts truststore:
+Return unused HotSpot class-metadata (i.e., metaspace) memory to the
+operating system more promptly, reduce metaspace footprint, and
+simplify the metaspace code in order to reduce maintenance costs.
-Alias Name: entrustrootcag4
-Distinguished Name: CN=Entrust Root Certification Authority - G4, OU="(c) 2015
Entrust, Inc. - for authorized use only", OU=See
www.entrust.net/legal-terms,
O="Entrust, Inc.", C=US
+Ports
+=====
-JDK-8250860: Added 3 SSL Corporation Root CA Certificates
+Alpine Linux Port
+=================
+https://openjdk.java.net/jeps/386
+
+Port the JDK to Alpine Linux, and to other Linux distributions that
+use musl as their primary C library, on both the x64 and AArch64
+architectures,
+
+Windows/AArch64 Port
+====================
+https://openjdk.java.net/jeps/388
+
+Port the JDK to Windows/AArch64.
+
+New macOS Rendering Pipeline
+============================
+https://openjdk.java.net/jeps/382
+
+Implement a Java 2D internal rendering pipeline for macOS using the
+Apple Metal API as alternative to the existing pipeline, which uses
+the deprecated Apple OpenGL API.
+
+macOS/AArch64 Port
+==================
+https://openjdk.java.net/jeps/391
+
+Port the JDK to macOS/AArch64.
+
+DEPRECATIONS
+============
+
+Deprecate the ParallelScavenge + SerialOld GC Combination
=========================================================
-The following root certificates have been added to the cacerts truststore for the SSL
Corporation:
+https://openjdk.java.net/jeps/366
+
+Deprecate the combination of the Parallel Scavenge and Serial Old
+garbage collection algorithms.
+
+Deprecate and Disable Biased Locking
+====================================
+https://openjdk.java.net/jeps/374
+
+Disable biased locking by default, and deprecate all related
+command-line options.
+
+Warnings for Value-Based Classes
+================================
+https://openjdk.java.net/jeps/390
+
+Designate the primitive wrapper classes as value-based and deprecate
+their constructors for removal, prompting new deprecation
+warnings. Provide warnings about improper attempts to synchronize on
+instances of any value-based classes in the Java Platform.
+
+Deprecate the Applet API for Removal
+====================================
+https://openjdk.java.net/jeps/398
+
+Deprecate the Applet API for removal. It is essentially irrelevant
+since all web-browser vendors have either removed support for Java
+browser plug-ins or announced plans to do so.
+
+Deprecate the Security Manager for Removal
+==========================================
+https://openjdk.java.net/jeps/411
+
+Deprecate the Security Manager for removal in a future release. The
+Security Manager dates from Java 1.0. It has not been the primary
+means of securing client-side Java code for many years, and it has
+rarely been used to secure server-side code. To move Java forward, we
+intend to deprecate the Security Manager for removal in concert with
+the legacy Applet API (see above). .
+
+REMOVALS
+========
+
+Remove the Concurrent Mark Sweep (CMS) Garbage Collector
+========================================================
+https://openjdk.java.net/jeps/363
+
+Remove the Concurrent Mark Sweep (CMS) garbage collector.
+
+Remove the Pack200 Tools and API
+================================
+https://openjdk.java.net/jeps/336
+https://openjdk.java.net/jeps/367
+
+Remove the `pack200` and `unpack200` tools, and the `Pack200` API in
+the `java.util.jar` package. These tools and API were deprecated for
+removal in OpenJDK 11 with the express intent to remove them in a
+future release.
+
+Remove the Nashorn JavaScript Engine
+====================================
+https://openjdk.java.net/jeps/372
+
+Remove the Nashorn JavaScript script engine and APIs, and the `jjs`
+tool. The engine, the APIs, and the tool were deprecated for removal
+in OpenJDK 11 with the express intent to remove them in a future
+release.
+
+Remove the Solaris and SPARC Ports
+==================================
+https://openjdk.java.net/jeps/362
+https://openjdk.java.net/jeps/381
+
+Remove the source code and build support for the Solaris/SPARC,
+Solaris/x64, and Linux/SPARC ports. These ports were deprecated for
+removal in OpenJDK 14 (JEP 362) and removed in OpenJDK 15 (JEP 381).
+
+Remove RMI Activation
+=====================
+https://openjdk.java.net/jeps/385
+https://openjdk.java.net/jeps/407
+https://docs.oracle.com/en/java/javase/14/docs/specs/rmi/activation.html
-Alias Name: sslrootrsaca
-Distinguished Name:
CN=SSL.com Root Certification Authority RSA, O=SSL Corporation,
L=Houston, ST=Texas, C=US
+Remove the Remote Method Invocation (RMI) Activation mechanism, while
+preserving the rest of RMI. RMI Activation is an obsolete part of RMI
+that has been optional since OpenJDK 8 and was deprecated in OpenJDK
+15.
-Alias Name: sslrootevrsaca
-Distinguished Name:
CN=SSL.com EV Root Certification Authority RSA R2, O=SSL Corporation,
L=Houston, ST=Texas, C=US
+Remove the Experimental AOT and JIT Compiler
+============================================
+https://openjdk.java.net/jeps/410
-Alias Name: sslrooteccca
-Distinguished Name:
CN=SSL.com Root Certification Authority ECC, O=SSL Corporation,
L=Houston, ST=Texas, C=US
+Remove the experimental Java-based ahead-of-time (AOT) and
+just-in-time (JIT) compiler. This compiler has seen little use since
+its introduction and the effort required to maintain it is
+significant. Retain the experimental Java-level JVM compiler
+interface (JVMCI) so that developers can continue to use
+externally-built versions of the compiler for JIT compilation.
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 296402c..7c3db6f 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 35
-%global rpmrelease 2
+%global rpmrelease 3
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -2267,6 +2267,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Mon Sep 27 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.0.0.35-3.rolling
+- Update release notes to document the major changes between OpenJDK 11 & 17.
+
* Thu Sep 16 2021 Martin Balao <mbalao(a)redhat.com> - 1:17.0.0.0.35-2.rolling
- Add patch to disable non-FIPS crypto in the SUN and SunEC security providers.
commit 53cd241c34d2444ac5aeeea70964a82fc3464316
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Thu Sep 16 02:11:23 2021 +0100
Add patch to disable non-FIPS crypto in the SUN and SunEC security providers.
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 2510088..296402c 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 35
-%global rpmrelease 1
+%global rpmrelease 2
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -1176,6 +1176,8 @@ Patch1004: rh1860986-disable_tlsv1.3_in_fips_mode.patch
Patch1007: rh1915071-always_initialise_configurator_access.patch
# RH1929465: Improve system FIPS detection
Patch1008: rh1929465-improve_system_FIPS_detection.patch
+# RH1995150: Disable non-FIPS crypto in SUN and SunEC security providers
+Patch1009: rh1995150-disable_non-fips_crypto.patch
#############################################
#
@@ -1538,6 +1540,7 @@ popd # openjdk
%patch1004
%patch1007
%patch1008
+%patch1009
# Extract systemtap tapsets
%if %{with_systemtap}
@@ -2264,6 +2267,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Sep 16 2021 Martin Balao <mbalao(a)redhat.com> - 1:17.0.0.0.35-2.rolling
+- Add patch to disable non-FIPS crypto in the SUN and SunEC security providers.
+
* Tue Sep 14 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.0.0.35-1.rolling
- Update to jdk-17+35, also known as jdk-17-ga.
- Switch to GA mode.
diff --git a/rh1995150-disable_non-fips_crypto.patch
b/rh1995150-disable_non-fips_crypto.patch
new file mode 100644
index 0000000..b3d0ae7
--- /dev/null
+++ b/rh1995150-disable_non-fips_crypto.patch
@@ -0,0 +1,596 @@
+diff --git openjdk/src/java.base/share/classes/module-info.java
openjdk/src/java.base/share/classes/module-info.java
+index 9d4a794de1a..39e69362458 100644
+--- openjdk/src/java.base/share/classes/module-info.java
++++ openjdk/src/java.base/share/classes/module-info.java
+@@ -151,6 +151,7 @@ module java.base {
+ java.management,
+ java.naming,
+ java.rmi,
++ jdk.crypto.ec,
+ jdk.jartool,
+ jdk.jlink,
+
jdk.net,
+diff --git openjdk/src/java.base/share/classes/sun/security/provider/SunEntries.java
openjdk/src/java.base/share/classes/sun/security/provider/SunEntries.java
+index 912cad59714..c5e13c98bd9 100644
+--- openjdk/src/java.base/share/classes/sun/security/provider/SunEntries.java
++++ openjdk/src/java.base/share/classes/sun/security/provider/SunEntries.java
+@@ -30,6 +30,7 @@ import java.net.*;
+ import java.util.*;
+ import java.security.*;
+
++import jdk.internal.access.SharedSecrets;
+ import jdk.internal.util.StaticProperty;
+ import sun.security.action.GetPropertyAction;
+ import sun.security.util.SecurityProviderConstants;
+@@ -83,6 +84,10 @@ import static sun.security.util.SecurityProviderConstants.getAliases;
+
+ public final class SunEntries {
+
++ private static final boolean systemFipsEnabled =
++ SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
++ .isSystemFipsEnabled();
++
+ // the default algo used by SecureRandom class for new SecureRandom() calls
+ public static final String DEF_SECURE_RANDOM_ALGO;
+
+@@ -94,147 +99,149 @@ public final class SunEntries {
+ // common attribute map
+ HashMap<String, String> attrs = new HashMap<>(3);
+
+- /*
+- * SecureRandom engines
+- */
+- attrs.put("ThreadSafe", "true");
+- if (NativePRNG.isAvailable()) {
+- add(p, "SecureRandom", "NativePRNG",
+- "sun.security.provider.NativePRNG", attrs);
+- }
+- if (NativePRNG.Blocking.isAvailable()) {
+- add(p, "SecureRandom", "NativePRNGBlocking",
+- "sun.security.provider.NativePRNG$Blocking", attrs);
+- }
+- if (NativePRNG.NonBlocking.isAvailable()) {
+- add(p, "SecureRandom", "NativePRNGNonBlocking",
+- "sun.security.provider.NativePRNG$NonBlocking", attrs);
++ if (!systemFipsEnabled) {
++ /*
++ * SecureRandom engines
++ */
++ attrs.put("ThreadSafe", "true");
++ if (NativePRNG.isAvailable()) {
++ add(p, "SecureRandom", "NativePRNG",
++ "sun.security.provider.NativePRNG", attrs);
++ }
++ if (NativePRNG.Blocking.isAvailable()) {
++ add(p, "SecureRandom", "NativePRNGBlocking",
++ "sun.security.provider.NativePRNG$Blocking", attrs);
++ }
++ if (NativePRNG.NonBlocking.isAvailable()) {
++ add(p, "SecureRandom", "NativePRNGNonBlocking",
++ "sun.security.provider.NativePRNG$NonBlocking",
attrs);
++ }
++ attrs.put("ImplementedIn", "Software");
++ add(p, "SecureRandom", "DRBG",
"sun.security.provider.DRBG", attrs);
++ add(p, "SecureRandom", "SHA1PRNG",
++ "sun.security.provider.SecureRandom", attrs);
++
++ /*
++ * Signature engines
++ */
++ attrs.clear();
++ String dsaKeyClasses = "java.security.interfaces.DSAPublicKey" +
++ "|java.security.interfaces.DSAPrivateKey";
++ attrs.put("SupportedKeyClasses", dsaKeyClasses);
++ attrs.put("ImplementedIn", "Software");
++
++ attrs.put("KeySize", "1024"); // for NONE and SHA1 DSA
signatures
++
++ addWithAlias(p, "Signature", "SHA1withDSA",
++ "sun.security.provider.DSA$SHA1withDSA", attrs);
++ addWithAlias(p, "Signature", "NONEwithDSA",
++ "sun.security.provider.DSA$RawDSA", attrs);
++
++ // for DSA signatures with 224/256-bit digests
++ attrs.put("KeySize", "2048");
++
++ addWithAlias(p, "Signature", "SHA224withDSA",
++ "sun.security.provider.DSA$SHA224withDSA", attrs);
++ addWithAlias(p, "Signature", "SHA256withDSA",
++ "sun.security.provider.DSA$SHA256withDSA", attrs);
++
++ addWithAlias(p, "Signature", "SHA3-224withDSA",
++ "sun.security.provider.DSA$SHA3_224withDSA", attrs);
++ addWithAlias(p, "Signature", "SHA3-256withDSA",
++ "sun.security.provider.DSA$SHA3_256withDSA", attrs);
++
++ attrs.put("KeySize", "3072"); // for DSA sig using
384/512-bit digests
++
++ addWithAlias(p, "Signature", "SHA384withDSA",
++ "sun.security.provider.DSA$SHA384withDSA", attrs);
++ addWithAlias(p, "Signature", "SHA512withDSA",
++ "sun.security.provider.DSA$SHA512withDSA", attrs);
++ addWithAlias(p, "Signature", "SHA3-384withDSA",
++ "sun.security.provider.DSA$SHA3_384withDSA", attrs);
++ addWithAlias(p, "Signature", "SHA3-512withDSA",
++ "sun.security.provider.DSA$SHA3_512withDSA", attrs);
++
++ attrs.remove("KeySize");
++
++ add(p, "Signature", "SHA1withDSAinP1363Format",
++ "sun.security.provider.DSA$SHA1withDSAinP1363Format");
++ add(p, "Signature", "NONEwithDSAinP1363Format",
++ "sun.security.provider.DSA$RawDSAinP1363Format");
++ add(p, "Signature", "SHA224withDSAinP1363Format",
++ "sun.security.provider.DSA$SHA224withDSAinP1363Format");
++ add(p, "Signature", "SHA256withDSAinP1363Format",
++ "sun.security.provider.DSA$SHA256withDSAinP1363Format");
++ add(p, "Signature", "SHA384withDSAinP1363Format",
++ "sun.security.provider.DSA$SHA384withDSAinP1363Format");
++ add(p, "Signature", "SHA512withDSAinP1363Format",
++ "sun.security.provider.DSA$SHA512withDSAinP1363Format");
++ add(p, "Signature", "SHA3-224withDSAinP1363Format",
++
"sun.security.provider.DSA$SHA3_224withDSAinP1363Format");
++ add(p, "Signature", "SHA3-256withDSAinP1363Format",
++
"sun.security.provider.DSA$SHA3_256withDSAinP1363Format");
++ add(p, "Signature", "SHA3-384withDSAinP1363Format",
++
"sun.security.provider.DSA$SHA3_384withDSAinP1363Format");
++ add(p, "Signature", "SHA3-512withDSAinP1363Format",
++
"sun.security.provider.DSA$SHA3_512withDSAinP1363Format");
++ /*
++ * Key Pair Generator engines
++ */
++ attrs.clear();
++ attrs.put("ImplementedIn", "Software");
++ attrs.put("KeySize", "2048"); // for DSA KPG and APG
only
++
++ String dsaKPGImplClass =
"sun.security.provider.DSAKeyPairGenerator$";
++ dsaKPGImplClass += (useLegacyDSA? "Legacy" :
"Current");
++ addWithAlias(p, "KeyPairGenerator", "DSA",
dsaKPGImplClass, attrs);
++
++ /*
++ * Algorithm Parameter Generator engines
++ */
++ addWithAlias(p, "AlgorithmParameterGenerator", "DSA",
++ "sun.security.provider.DSAParameterGenerator", attrs);
++ attrs.remove("KeySize");
++
++ /*
++ * Algorithm Parameter engines
++ */
++ addWithAlias(p, "AlgorithmParameters", "DSA",
++ "sun.security.provider.DSAParameters", attrs);
++
++ /*
++ * Key factories
++ */
++ addWithAlias(p, "KeyFactory", "DSA",
++ "sun.security.provider.DSAKeyFactory", attrs);
++
++ /*
++ * Digest engines
++ */
++ add(p, "MessageDigest", "MD2",
"sun.security.provider.MD2", attrs);
++ add(p, "MessageDigest", "MD5",
"sun.security.provider.MD5", attrs);
++ addWithAlias(p, "MessageDigest", "SHA-1",
"sun.security.provider.SHA",
++ attrs);
++
++ addWithAlias(p, "MessageDigest", "SHA-224",
++ "sun.security.provider.SHA2$SHA224", attrs);
++ addWithAlias(p, "MessageDigest", "SHA-256",
++ "sun.security.provider.SHA2$SHA256", attrs);
++ addWithAlias(p, "MessageDigest", "SHA-384",
++ "sun.security.provider.SHA5$SHA384", attrs);
++ addWithAlias(p, "MessageDigest", "SHA-512",
++ "sun.security.provider.SHA5$SHA512", attrs);
++ addWithAlias(p, "MessageDigest", "SHA-512/224",
++ "sun.security.provider.SHA5$SHA512_224", attrs);
++ addWithAlias(p, "MessageDigest", "SHA-512/256",
++ "sun.security.provider.SHA5$SHA512_256", attrs);
++ addWithAlias(p, "MessageDigest", "SHA3-224",
++ "sun.security.provider.SHA3$SHA224", attrs);
++ addWithAlias(p, "MessageDigest", "SHA3-256",
++ "sun.security.provider.SHA3$SHA256", attrs);
++ addWithAlias(p, "MessageDigest", "SHA3-384",
++ "sun.security.provider.SHA3$SHA384", attrs);
++ addWithAlias(p, "MessageDigest", "SHA3-512",
++ "sun.security.provider.SHA3$SHA512", attrs);
+ }
+- attrs.put("ImplementedIn", "Software");
+- add(p, "SecureRandom", "DRBG",
"sun.security.provider.DRBG", attrs);
+- add(p, "SecureRandom", "SHA1PRNG",
+- "sun.security.provider.SecureRandom", attrs);
+-
+- /*
+- * Signature engines
+- */
+- attrs.clear();
+- String dsaKeyClasses = "java.security.interfaces.DSAPublicKey" +
+- "|java.security.interfaces.DSAPrivateKey";
+- attrs.put("SupportedKeyClasses", dsaKeyClasses);
+- attrs.put("ImplementedIn", "Software");
+-
+- attrs.put("KeySize", "1024"); // for NONE and SHA1 DSA
signatures
+-
+- addWithAlias(p, "Signature", "SHA1withDSA",
+- "sun.security.provider.DSA$SHA1withDSA", attrs);
+- addWithAlias(p, "Signature", "NONEwithDSA",
+- "sun.security.provider.DSA$RawDSA", attrs);
+-
+- // for DSA signatures with 224/256-bit digests
+- attrs.put("KeySize", "2048");
+-
+- addWithAlias(p, "Signature", "SHA224withDSA",
+- "sun.security.provider.DSA$SHA224withDSA", attrs);
+- addWithAlias(p, "Signature", "SHA256withDSA",
+- "sun.security.provider.DSA$SHA256withDSA", attrs);
+-
+- addWithAlias(p, "Signature", "SHA3-224withDSA",
+- "sun.security.provider.DSA$SHA3_224withDSA", attrs);
+- addWithAlias(p, "Signature", "SHA3-256withDSA",
+- "sun.security.provider.DSA$SHA3_256withDSA", attrs);
+-
+- attrs.put("KeySize", "3072"); // for DSA sig using
384/512-bit digests
+-
+- addWithAlias(p, "Signature", "SHA384withDSA",
+- "sun.security.provider.DSA$SHA384withDSA", attrs);
+- addWithAlias(p, "Signature", "SHA512withDSA",
+- "sun.security.provider.DSA$SHA512withDSA", attrs);
+- addWithAlias(p, "Signature", "SHA3-384withDSA",
+- "sun.security.provider.DSA$SHA3_384withDSA", attrs);
+- addWithAlias(p, "Signature", "SHA3-512withDSA",
+- "sun.security.provider.DSA$SHA3_512withDSA", attrs);
+-
+- attrs.remove("KeySize");
+-
+- add(p, "Signature", "SHA1withDSAinP1363Format",
+- "sun.security.provider.DSA$SHA1withDSAinP1363Format");
+- add(p, "Signature", "NONEwithDSAinP1363Format",
+- "sun.security.provider.DSA$RawDSAinP1363Format");
+- add(p, "Signature", "SHA224withDSAinP1363Format",
+- "sun.security.provider.DSA$SHA224withDSAinP1363Format");
+- add(p, "Signature", "SHA256withDSAinP1363Format",
+- "sun.security.provider.DSA$SHA256withDSAinP1363Format");
+- add(p, "Signature", "SHA384withDSAinP1363Format",
+- "sun.security.provider.DSA$SHA384withDSAinP1363Format");
+- add(p, "Signature", "SHA512withDSAinP1363Format",
+- "sun.security.provider.DSA$SHA512withDSAinP1363Format");
+- add(p, "Signature", "SHA3-224withDSAinP1363Format",
+- "sun.security.provider.DSA$SHA3_224withDSAinP1363Format");
+- add(p, "Signature", "SHA3-256withDSAinP1363Format",
+- "sun.security.provider.DSA$SHA3_256withDSAinP1363Format");
+- add(p, "Signature", "SHA3-384withDSAinP1363Format",
+- "sun.security.provider.DSA$SHA3_384withDSAinP1363Format");
+- add(p, "Signature", "SHA3-512withDSAinP1363Format",
+- "sun.security.provider.DSA$SHA3_512withDSAinP1363Format");
+- /*
+- * Key Pair Generator engines
+- */
+- attrs.clear();
+- attrs.put("ImplementedIn", "Software");
+- attrs.put("KeySize", "2048"); // for DSA KPG and APG only
+-
+- String dsaKPGImplClass =
"sun.security.provider.DSAKeyPairGenerator$";
+- dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current");
+- addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass,
attrs);
+-
+- /*
+- * Algorithm Parameter Generator engines
+- */
+- addWithAlias(p, "AlgorithmParameterGenerator", "DSA",
+- "sun.security.provider.DSAParameterGenerator", attrs);
+- attrs.remove("KeySize");
+-
+- /*
+- * Algorithm Parameter engines
+- */
+- addWithAlias(p, "AlgorithmParameters", "DSA",
+- "sun.security.provider.DSAParameters", attrs);
+-
+- /*
+- * Key factories
+- */
+- addWithAlias(p, "KeyFactory", "DSA",
+- "sun.security.provider.DSAKeyFactory", attrs);
+-
+- /*
+- * Digest engines
+- */
+- add(p, "MessageDigest", "MD2",
"sun.security.provider.MD2", attrs);
+- add(p, "MessageDigest", "MD5",
"sun.security.provider.MD5", attrs);
+- addWithAlias(p, "MessageDigest", "SHA-1",
"sun.security.provider.SHA",
+- attrs);
+-
+- addWithAlias(p, "MessageDigest", "SHA-224",
+- "sun.security.provider.SHA2$SHA224", attrs);
+- addWithAlias(p, "MessageDigest", "SHA-256",
+- "sun.security.provider.SHA2$SHA256", attrs);
+- addWithAlias(p, "MessageDigest", "SHA-384",
+- "sun.security.provider.SHA5$SHA384", attrs);
+- addWithAlias(p, "MessageDigest", "SHA-512",
+- "sun.security.provider.SHA5$SHA512", attrs);
+- addWithAlias(p, "MessageDigest", "SHA-512/224",
+- "sun.security.provider.SHA5$SHA512_224", attrs);
+- addWithAlias(p, "MessageDigest", "SHA-512/256",
+- "sun.security.provider.SHA5$SHA512_256", attrs);
+- addWithAlias(p, "MessageDigest", "SHA3-224",
+- "sun.security.provider.SHA3$SHA224", attrs);
+- addWithAlias(p, "MessageDigest", "SHA3-256",
+- "sun.security.provider.SHA3$SHA256", attrs);
+- addWithAlias(p, "MessageDigest", "SHA3-384",
+- "sun.security.provider.SHA3$SHA384", attrs);
+- addWithAlias(p, "MessageDigest", "SHA3-512",
+- "sun.security.provider.SHA3$SHA512", attrs);
+
+ /*
+ * Certificates
+diff --git openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
+index 8c9e4f9dbe6..9eeb3013e0d 100644
+--- openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
++++ openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
+@@ -38,6 +38,7 @@ import java.util.HashMap;
+ import java.util.Iterator;
+ import java.util.List;
+
++import jdk.internal.access.SharedSecrets;
+ import sun.security.ec.ed.EdDSAAlgorithmParameters;
+ import sun.security.ec.ed.EdDSAKeyFactory;
+ import sun.security.ec.ed.EdDSAKeyPairGenerator;
+@@ -56,6 +57,10 @@ public final class SunEC extends Provider {
+
+ private static final long serialVersionUID = -2279741672933606418L;
+
++ private static final boolean systemFipsEnabled =
++ SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
++ .isSystemFipsEnabled();
++
+ private static class ProviderServiceA extends ProviderService {
+ ProviderServiceA(Provider p, String type, String algo, String cn,
+ HashMap<String, String> attrs) {
+@@ -249,85 +254,86 @@ public final class SunEC extends Provider {
+
+ putXDHEntries();
+ putEdDSAEntries();
+-
+- /*
+- * Signature engines
+- */
+- putService(new ProviderService(this, "Signature",
+- "NONEwithECDSA", "sun.security.ec.ECDSASignature$Raw",
+- null, ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "SHA1withECDSA", "sun.security.ec.ECDSASignature$SHA1",
+- ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "SHA224withECDSA",
"sun.security.ec.ECDSASignature$SHA224",
+- ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "SHA256withECDSA",
"sun.security.ec.ECDSASignature$SHA256",
+- ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "SHA384withECDSA",
"sun.security.ec.ECDSASignature$SHA384",
+- ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "SHA512withECDSA",
"sun.security.ec.ECDSASignature$SHA512",
+- ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "SHA3-224withECDSA",
"sun.security.ec.ECDSASignature$SHA3_224",
+- ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "SHA3-256withECDSA",
"sun.security.ec.ECDSASignature$SHA3_256",
+- ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "SHA3-384withECDSA",
"sun.security.ec.ECDSASignature$SHA3_384",
+- ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "SHA3-512withECDSA",
"sun.security.ec.ECDSASignature$SHA3_512",
+- ATTRS));
+-
+- putService(new ProviderService(this, "Signature",
+- "NONEwithECDSAinP1363Format",
+- "sun.security.ec.ECDSASignature$RawinP1363Format"));
+- putService(new ProviderService(this, "Signature",
+- "SHA1withECDSAinP1363Format",
+- "sun.security.ec.ECDSASignature$SHA1inP1363Format"));
+- putService(new ProviderService(this, "Signature",
+- "SHA224withECDSAinP1363Format",
+- "sun.security.ec.ECDSASignature$SHA224inP1363Format"));
+- putService(new ProviderService(this, "Signature",
+- "SHA256withECDSAinP1363Format",
+- "sun.security.ec.ECDSASignature$SHA256inP1363Format"));
+- putService(new ProviderService(this, "Signature",
+- "SHA384withECDSAinP1363Format",
+- "sun.security.ec.ECDSASignature$SHA384inP1363Format"));
+- putService(new ProviderService(this, "Signature",
+- "SHA512withECDSAinP1363Format",
+- "sun.security.ec.ECDSASignature$SHA512inP1363Format"));
+-
+- putService(new ProviderService(this, "Signature",
+- "SHA3-224withECDSAinP1363Format",
+- "sun.security.ec.ECDSASignature$SHA3_224inP1363Format"));
+- putService(new ProviderService(this, "Signature",
+- "SHA3-256withECDSAinP1363Format",
+- "sun.security.ec.ECDSASignature$SHA3_256inP1363Format"));
+- putService(new ProviderService(this, "Signature",
+- "SHA3-384withECDSAinP1363Format",
+- "sun.security.ec.ECDSASignature$SHA3_384inP1363Format"));
+- putService(new ProviderService(this, "Signature",
+- "SHA3-512withECDSAinP1363Format",
+- "sun.security.ec.ECDSASignature$SHA3_512inP1363Format"));
+-
+- /*
+- * Key Pair Generator engine
+- */
+- putService(new ProviderService(this, "KeyPairGenerator",
+- "EC", "sun.security.ec.ECKeyPairGenerator",
+- List.of("EllipticCurve"), ATTRS));
+-
+- /*
+- * Key Agreement engine
+- */
+- putService(new ProviderService(this, "KeyAgreement",
+- "ECDH", "sun.security.ec.ECDHKeyAgreement", null,
ATTRS));
++ if (!systemFipsEnabled) {
++ /*
++ * Signature engines
++ */
++ putService(new ProviderService(this, "Signature",
++ "NONEwithECDSA",
"sun.security.ec.ECDSASignature$Raw",
++ null, ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "SHA1withECDSA",
"sun.security.ec.ECDSASignature$SHA1",
++ ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "SHA224withECDSA",
"sun.security.ec.ECDSASignature$SHA224",
++ ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "SHA256withECDSA",
"sun.security.ec.ECDSASignature$SHA256",
++ ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "SHA384withECDSA",
"sun.security.ec.ECDSASignature$SHA384",
++ ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "SHA512withECDSA",
"sun.security.ec.ECDSASignature$SHA512",
++ ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "SHA3-224withECDSA",
"sun.security.ec.ECDSASignature$SHA3_224",
++ ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "SHA3-256withECDSA",
"sun.security.ec.ECDSASignature$SHA3_256",
++ ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "SHA3-384withECDSA",
"sun.security.ec.ECDSASignature$SHA3_384",
++ ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "SHA3-512withECDSA",
"sun.security.ec.ECDSASignature$SHA3_512",
++ ATTRS));
++
++ putService(new ProviderService(this, "Signature",
++ "NONEwithECDSAinP1363Format",
++ "sun.security.ec.ECDSASignature$RawinP1363Format"));
++ putService(new ProviderService(this, "Signature",
++ "SHA1withECDSAinP1363Format",
++ "sun.security.ec.ECDSASignature$SHA1inP1363Format"));
++ putService(new ProviderService(this, "Signature",
++ "SHA224withECDSAinP1363Format",
++ "sun.security.ec.ECDSASignature$SHA224inP1363Format"));
++ putService(new ProviderService(this, "Signature",
++ "SHA256withECDSAinP1363Format",
++ "sun.security.ec.ECDSASignature$SHA256inP1363Format"));
++ putService(new ProviderService(this, "Signature",
++ "SHA384withECDSAinP1363Format",
++ "sun.security.ec.ECDSASignature$SHA384inP1363Format"));
++ putService(new ProviderService(this, "Signature",
++ "SHA512withECDSAinP1363Format",
++ "sun.security.ec.ECDSASignature$SHA512inP1363Format"));
++
++ putService(new ProviderService(this, "Signature",
++ "SHA3-224withECDSAinP1363Format",
++ "sun.security.ec.ECDSASignature$SHA3_224inP1363Format"));
++ putService(new ProviderService(this, "Signature",
++ "SHA3-256withECDSAinP1363Format",
++ "sun.security.ec.ECDSASignature$SHA3_256inP1363Format"));
++ putService(new ProviderService(this, "Signature",
++ "SHA3-384withECDSAinP1363Format",
++ "sun.security.ec.ECDSASignature$SHA3_384inP1363Format"));
++ putService(new ProviderService(this, "Signature",
++ "SHA3-512withECDSAinP1363Format",
++ "sun.security.ec.ECDSASignature$SHA3_512inP1363Format"));
++
++ /*
++ * Key Pair Generator engine
++ */
++ putService(new ProviderService(this, "KeyPairGenerator",
++ "EC", "sun.security.ec.ECKeyPairGenerator",
++ List.of("EllipticCurve"), ATTRS));
++
++ /*
++ * Key Agreement engine
++ */
++ putService(new ProviderService(this, "KeyAgreement",
++ "ECDH", "sun.security.ec.ECDHKeyAgreement", null,
ATTRS));
++ }
+ }
+
+ private void putXDHEntries() {
+@@ -344,23 +350,25 @@ public final class SunEC extends Provider {
+ "X448", "sun.security.ec.XDHKeyFactory.X448",
+ ATTRS));
+
+- putService(new ProviderService(this, "KeyPairGenerator",
+- "XDH", "sun.security.ec.XDHKeyPairGenerator", null,
ATTRS));
+- putService(new ProviderServiceA(this, "KeyPairGenerator",
+- "X25519", "sun.security.ec.XDHKeyPairGenerator.X25519",
+- ATTRS));
+- putService(new ProviderServiceA(this, "KeyPairGenerator",
+- "X448", "sun.security.ec.XDHKeyPairGenerator.X448",
+- ATTRS));
+-
+- putService(new ProviderService(this, "KeyAgreement",
+- "XDH", "sun.security.ec.XDHKeyAgreement", null,
ATTRS));
+- putService(new ProviderServiceA(this, "KeyAgreement",
+- "X25519", "sun.security.ec.XDHKeyAgreement.X25519",
+- ATTRS));
+- putService(new ProviderServiceA(this, "KeyAgreement",
+- "X448", "sun.security.ec.XDHKeyAgreement.X448",
+- ATTRS));
++ if (!systemFipsEnabled) {
++ putService(new ProviderService(this, "KeyPairGenerator",
++ "XDH", "sun.security.ec.XDHKeyPairGenerator", null,
ATTRS));
++ putService(new ProviderServiceA(this, "KeyPairGenerator",
++ "X25519",
"sun.security.ec.XDHKeyPairGenerator.X25519",
++ ATTRS));
++ putService(new ProviderServiceA(this, "KeyPairGenerator",
++ "X448", "sun.security.ec.XDHKeyPairGenerator.X448",
++ ATTRS));
++
++ putService(new ProviderService(this, "KeyAgreement",
++ "XDH", "sun.security.ec.XDHKeyAgreement", null,
ATTRS));
++ putService(new ProviderServiceA(this, "KeyAgreement",
++ "X25519", "sun.security.ec.XDHKeyAgreement.X25519",
++ ATTRS));
++ putService(new ProviderServiceA(this, "KeyAgreement",
++ "X448", "sun.security.ec.XDHKeyAgreement.X448",
++ ATTRS));
++ }
+ }
+
+ private void putEdDSAEntries() {
+@@ -375,21 +383,23 @@ public final class SunEC extends Provider {
+ putService(new ProviderServiceA(this, "KeyFactory",
+ "Ed448", "sun.security.ec.ed.EdDSAKeyFactory.Ed448",
ATTRS));
+
+- putService(new ProviderService(this, "KeyPairGenerator",
+- "EdDSA", "sun.security.ec.ed.EdDSAKeyPairGenerator",
null, ATTRS));
+- putService(new ProviderServiceA(this, "KeyPairGenerator",
+- "Ed25519",
"sun.security.ec.ed.EdDSAKeyPairGenerator.Ed25519",
+- ATTRS));
+- putService(new ProviderServiceA(this, "KeyPairGenerator",
+- "Ed448",
"sun.security.ec.ed.EdDSAKeyPairGenerator.Ed448",
+- ATTRS));
+-
+- putService(new ProviderService(this, "Signature",
+- "EdDSA", "sun.security.ec.ed.EdDSASignature", null,
ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "Ed25519", "sun.security.ec.ed.EdDSASignature.Ed25519",
ATTRS));
+- putService(new ProviderServiceA(this, "Signature",
+- "Ed448", "sun.security.ec.ed.EdDSASignature.Ed448",
ATTRS));
++ if (!systemFipsEnabled) {
++ putService(new ProviderService(this, "KeyPairGenerator",
++ "EdDSA", "sun.security.ec.ed.EdDSAKeyPairGenerator",
null, ATTRS));
++ putService(new ProviderServiceA(this, "KeyPairGenerator",
++ "Ed25519",
"sun.security.ec.ed.EdDSAKeyPairGenerator.Ed25519",
++ ATTRS));
++ putService(new ProviderServiceA(this, "KeyPairGenerator",
++ "Ed448",
"sun.security.ec.ed.EdDSAKeyPairGenerator.Ed448",
++ ATTRS));
++
++ putService(new ProviderService(this, "Signature",
++ "EdDSA", "sun.security.ec.ed.EdDSASignature", null,
ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "Ed25519",
"sun.security.ec.ed.EdDSASignature.Ed25519", ATTRS));
++ putService(new ProviderServiceA(this, "Signature",
++ "Ed448", "sun.security.ec.ed.EdDSASignature.Ed448",
ATTRS));
++ }
+
+ }
+ }
commit 37b0e84cf488afbbac67d711e894cd5b9dd186fb
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Tue Sep 14 23:57:39 2021 +0100
Update to jdk-17+35, also known as jdk-17-ga.
Switch to GA mode.
diff --git a/.gitignore b/.gitignore
index 77dfe61..c591b54 100644
--- a/.gitignore
+++ b/.gitignore
@@ -17,3 +17,4 @@
/openjdk-jdk16u-jdk-16.0.1+9.tar.xz
/openjdk-jdk17-jdk-17+26.tar.xz
/openjdk-jdk17-jdk-17+33.tar.xz
+/openjdk-jdk17-jdk-17+35.tar.xz
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 69363f1..2510088 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -276,7 +276,7 @@
%global interimver 0
%global updatever 0
%global patchver 0
-# If you bump featurever, you must bump also vendor_version_string
+# If you bump featurever, you must also bump vendor_version_string
# Used via new version scheme. JDK 17 was
# GA'ed in September 2021 => 21.9
%global vendor_version_string 21.9
@@ -297,8 +297,8 @@
%global origin_nice OpenJDK
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver 33
-%global rpmrelease 3
+%global buildver 35
+%global rpmrelease 1
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -321,7 +321,7 @@
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
# - N%%{?extraver}{?dist} for GA releases
-%global is_ga 0
+%global is_ga 1
%if %{is_ga}
%global build_type GA
%global expected_ea_designator ""
@@ -2264,6 +2264,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Tue Sep 14 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.0.0.35-1.rolling
+- Update to jdk-17+35, also known as jdk-17-ga.
+- Switch to GA mode.
+
* Wed Sep 08 2021 Andrew Hughes <gnu.andrew(a)redhat.com> -
1:17.0.0.0.33-0.3.ea.rolling
- Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled
in configure.
- Remove unneeded Requires on NSS as it will now be dynamically linked and detected by
RPM.
diff --git a/sources b/sources
index 312b5ef..f4030b5 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (openjdk-jdk17-jdk-17+33.tar.xz) =
fa7e852a774d74dbd945a168f8e8f673601fbdf6ff3ce91a4c38a911b1ba66524fa30a8d4cdd60c7bb2c7f7d6d8ab353502c647a5e888a94c18958c7a8348b9c
+SHA512 (openjdk-jdk17-jdk-17+35.tar.xz) =
51f533812219e732f74fd77a19df0e82ecf11a3341d958cf9cb0438350805118a4852ddbbeccce374f96c7b12c80c410435cdcd9e3f576497a7deb6f72e17c69
commit 619b0b263e9a709bfc7c97c9c1aed944b9d4b379
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Wed Sep 8 04:41:40 2021 +0100
Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library.
Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled
in configure.
Remove unneeded Requires on NSS as it will now be dynamically linked and detected by
RPM.
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 7e79587..69363f1 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 33
-%global rpmrelease 2
+%global rpmrelease 3
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -370,7 +370,7 @@
# fix for
https://bugzilla.redhat.com/show_bug.cgi?id=1111349
#
https://bugzilla.redhat.com/show_bug.cgi?id=1590796#c14
#
https://bugzilla.redhat.com/show_bug.cgi?id=1655938
-%global _privatelibs
libsplashscreen[.]so.*|libawt_xawt[.]so.*|libjli[.]so.*|libattach[.]so.*|libawt[.]so.*|libextnet[.]so.*|libawt_headless[.]so.*|libdt_socket[.]so.*|libfontmanager[.]so.*|libinstrument[.]so.*|libj2gss[.]so.*|libj2pcsc[.]so.*|libj2pkcs11[.]so.*|libjaas[.]so.*|libjavajpeg[.]so.*|libjdwp[.]so.*|libjimage[.]so.*|libjsound[.]so.*|liblcms[.]so.*|libmanagement[.]so.*|libmanagement_agent[.]so.*|libmanagement_ext[.]so.*|libmlib_image[.]so.*|libnet[.]so.*|libnio[.]so.*|libprefs[.]so.*|librmi[.]so.*|libsaproc[.]so.*|libsctp[.]so.*|libzip[.]so.*
+%global _privatelibs
libsplashscreen[.]so.*|libawt_xawt[.]so.*|libjli[.]so.*|libattach[.]so.*|libawt[.]so.*|libextnet[.]so.*|libawt_headless[.]so.*|libdt_socket[.]so.*|libfontmanager[.]so.*|libinstrument[.]so.*|libj2gss[.]so.*|libj2pcsc[.]so.*|libj2pkcs11[.]so.*|libjaas[.]so.*|libjavajpeg[.]so.*|libjdwp[.]so.*|libjimage[.]so.*|libjsound[.]so.*|liblcms[.]so.*|libmanagement[.]so.*|libmanagement_agent[.]so.*|libmanagement_ext[.]so.*|libmlib_image[.]so.*|libnet[.]so.*|libnio[.]so.*|libprefs[.]so.*|librmi[.]so.*|libsaproc[.]so.*|libsctp[.]so.*|libsystemconf[.]so.*|libzip[.]so.*
%global _publiclibs
libjawt[.]so.*|libjava[.]so.*|libjvm[.]so.*|libverify[.]so.*|libjsig[.]so.*
%if %is_system_jdk
%global __provides_exclude ^(%{_privatelibs})$
@@ -709,6 +709,7 @@ exit 0
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsaproc.so
%endif
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsctp.so
+%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsystemconf.so
%ifarch %{svml_arches}
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsvml.so
%endif
@@ -967,8 +968,6 @@ OrderWithRequires: copy-jdk-configs
%endif
# for printing support
Requires: cups-libs
-# for FIPS PKCS11 provider
-Requires: nss
# Post requires alternatives to install tool alternatives
Requires(post): %{alternatives_requires}
# Postun requires alternatives to uninstall tool alternatives
@@ -1175,6 +1174,8 @@ Patch1002: rh1818909-fips_default_keystore_type.patch
Patch1004: rh1860986-disable_tlsv1.3_in_fips_mode.patch
# RH1915071: Always initialise JavaSecuritySystemConfiguratorAccess
Patch1007: rh1915071-always_initialise_configurator_access.patch
+# RH1929465: Improve system FIPS detection
+Patch1008: rh1929465-improve_system_FIPS_detection.patch
#############################################
#
@@ -1208,8 +1209,8 @@ BuildRequires: libXrandr-devel
BuildRequires: libXrender-devel
BuildRequires: libXt-devel
BuildRequires: libXtst-devel
-# Requirements for setting up the nss.cfg
-BuildRequires: nss-devel
+# Requirements for setting up the nss.cfg and FIPS support
+BuildRequires: nss-devel >= 3.53
BuildRequires: pkgconfig
BuildRequires: xorg-x11-proto-devel
BuildRequires: zip
@@ -1536,6 +1537,7 @@ popd # openjdk
%patch1002
%patch1004
%patch1007
+%patch1008
# Extract systemtap tapsets
%if %{with_systemtap}
@@ -1687,6 +1689,7 @@ bash ${top_dir_abs_src_path}/configure \
--with-boot-jdk=/usr/lib/jvm/java-%{buildjdkver}-openjdk \
--with-debug-level=$debugbuild \
--with-native-debug-symbols=internal \
+ --enable-sysconf-nss \
--enable-unlimited-crypto \
--with-zlib=system \
--with-libjpeg=${link_opt} \
@@ -2261,6 +2264,13 @@ cjc.mainProgram(args)
%endif
%changelog
+* Wed Sep 08 2021 Andrew Hughes <gnu.andrew(a)redhat.com> -
1:17.0.0.0.33-0.3.ea.rolling
+- Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled
in configure.
+- Remove unneeded Requires on NSS as it will now be dynamically linked and detected by
RPM.
+
+* Wed Sep 08 2021 Martin Balao <mbalao(a)redhat.com> - 1:17.0.0.0.33-0.3.ea.rolling
+- Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library.
+
* Mon Sep 06 2021 Andrew Hughes <gnu.andrew(a)redhat.com> -
1:17.0.0.0.33-0.2.ea.rolling
- Update RH1655466 FIPS patch with changes in OpenJDK 8 version.
- SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the
name in the config file.
diff --git a/rh1929465-improve_system_FIPS_detection.patch
b/rh1929465-improve_system_FIPS_detection.patch
new file mode 100644
index 0000000..4dfd1d4
--- /dev/null
+++ b/rh1929465-improve_system_FIPS_detection.patch
@@ -0,0 +1,428 @@
+diff --git openjdk/make/autoconf/lib-sysconf.m4 openjdk/make/autoconf/lib-sysconf.m4
+new file mode 100644
+index 00000000000..b2b1c1787da
+--- /dev/null
++++ openjdk/make/autoconf/lib-sysconf.m4
+@@ -0,0 +1,84 @@
++#
++# Copyright (c) 2021, Red Hat, Inc.
++# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++#
++# This code is free software; you can redistribute it and/or modify it
++# under the terms of the GNU General Public License version 2 only, as
++# published by the Free Software Foundation. Oracle designates this
++# particular file as subject to the "Classpath" exception as provided
++# by Oracle in the LICENSE file that accompanied this code.
++#
++# This code is distributed in the hope that it will be useful, but WITHOUT
++# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++# version 2 for more details (a copy is included in the LICENSE file that
++# accompanied this code).
++#
++# You should have received a copy of the GNU General Public License version
++# 2 along with this work; if not, write to the Free Software Foundation,
++# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++#
++# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++# or visit
www.oracle.com if you need additional information or have any
++# questions.
++#
++
++################################################################################
++# Setup system configuration libraries
++################################################################################
++AC_DEFUN_ONCE([LIB_SETUP_SYSCONF_LIBS],
++[
++ ###############################################################################
++ #
++ # Check for the NSS library
++ #
++
++ AC_MSG_CHECKING([whether to use the system NSS library with the System Configurator
(libsysconf)])
++
++ # default is not available
++ DEFAULT_SYSCONF_NSS=no
++
++ AC_ARG_ENABLE([sysconf-nss], [AS_HELP_STRING([--enable-sysconf-nss],
++ [build the System Configurator (libsysconf) using the system NSS library if
available @<:@disabled@:>@])],
++ [
++ case "${enableval}" in
++ yes)
++ sysconf_nss=yes
++ ;;
++ *)
++ sysconf_nss=no
++ ;;
++ esac
++ ],
++ [
++ sysconf_nss=${DEFAULT_SYSCONF_NSS}
++ ])
++ AC_MSG_RESULT([$sysconf_nss])
++
++ USE_SYSCONF_NSS=false
++ if test "x${sysconf_nss}" = "xyes"; then
++ PKG_CHECK_MODULES(NSS, nss >= 3.53, [NSS_FOUND=yes], [NSS_FOUND=no])
++ if test "x${NSS_FOUND}" = "xyes"; then
++ AC_MSG_CHECKING([for system FIPS support in NSS])
++ saved_libs="${LIBS}"
++ saved_cflags="${CFLAGS}"
++ CFLAGS="${CFLAGS} ${NSS_CFLAGS}"
++ LIBS="${LIBS} ${NSS_LIBS}"
++ AC_LANG_PUSH([C])
++ AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <nss3/pk11pub.h>]],
++ [[SECMOD_GetSystemFIPSEnabled()]])],
++ [AC_MSG_RESULT([yes])],
++ [AC_MSG_RESULT([no])
++ AC_MSG_ERROR([System NSS FIPS detection unavailable])])
++ AC_LANG_POP([C])
++ CFLAGS="${saved_cflags}"
++ LIBS="${saved_libs}"
++ USE_SYSCONF_NSS=true
++ else
++ dnl NSS 3.53 is the one that introduces the SECMOD_GetSystemFIPSEnabled API
++ dnl in nss3/pk11pub.h.
++ AC_MSG_ERROR([--enable-sysconf-nss specified, but NSS 3.53 or above not
found.])
++ fi
++ fi
++ AC_SUBST(USE_SYSCONF_NSS)
++])
+diff --git openjdk/make/autoconf/libraries.m4 openjdk/make/autoconf/libraries.m4
+index a65d91ee974..a8f054c1397 100644
+--- openjdk/make/autoconf/libraries.m4
++++ openjdk/make/autoconf/libraries.m4
+@@ -33,6 +33,7 @@ m4_include([lib-std.m4])
+ m4_include([lib-x11.m4])
+ m4_include([lib-fontconfig.m4])
+ m4_include([lib-tests.m4])
++m4_include([lib-sysconf.m4])
+
+ ################################################################################
+ # Determine which libraries are needed for this configuration
+@@ -104,6 +105,7 @@ AC_DEFUN_ONCE([LIB_SETUP_LIBRARIES],
+ LIB_SETUP_BUNDLED_LIBS
+ LIB_SETUP_MISC_LIBS
+ LIB_TESTS_SETUP_GTEST
++ LIB_SETUP_SYSCONF_LIBS
+
+ BASIC_JDKLIB_LIBS=""
+ if test "x$TOOLCHAIN_TYPE" != xmicrosoft; then
+diff --git openjdk/make/autoconf/spec.gmk.in openjdk/make/autoconf/spec.gmk.in
+index 29445c8c24f..9b1b512a34a 100644
+--- openjdk/make/autoconf/spec.gmk.in
++++ openjdk/make/autoconf/spec.gmk.in
+@@ -834,6 +834,10 @@ INSTALL_SYSCONFDIR=@sysconfdir@
+ # Libraries
+ #
+
++USE_SYSCONF_NSS:=@USE_SYSCONF_NSS@
++NSS_LIBS:=@NSS_LIBS@
++NSS_CFLAGS:=@NSS_CFLAGS@
++
+ USE_EXTERNAL_LCMS:=@USE_EXTERNAL_LCMS@
+ LCMS_CFLAGS:=@LCMS_CFLAGS@
+ LCMS_LIBS:=@LCMS_LIBS@
+diff --git openjdk/make/modules/java.base/Lib.gmk openjdk/make/modules/java.base/Lib.gmk
+index 5658ff342e5..cb7a56852f7 100644
+--- openjdk/make/modules/java.base/Lib.gmk
++++ openjdk/make/modules/java.base/Lib.gmk
+@@ -167,6 +167,31 @@ ifeq ($(call isTargetOsType, unix), true)
+ endif
+ endif
+
++################################################################################
++# Create the systemconf library
++
++LIBSYSTEMCONF_CFLAGS :=
++LIBSYSTEMCONF_CXXFLAGS :=
++
++ifeq ($(USE_SYSCONF_NSS), true)
++ LIBSYSTEMCONF_CFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS
++ LIBSYSTEMCONF_CXXFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS
++endif
++
++ifeq ($(OPENJDK_BUILD_OS), linux)
++ $(eval $(call SetupJdkLibrary, BUILD_LIBSYSTEMCONF, \
++ NAME := systemconf, \
++ OPTIMIZATION := LOW, \
++ CFLAGS := $(CFLAGS_JDKLIB) $(LIBSYSTEMCONF_CFLAGS), \
++ CXXFLAGS := $(CXXFLAGS_JDKLIB) $(LIBSYSTEMCONF_CXXFLAGS), \
++ LDFLAGS := $(LDFLAGS_JDKLIB) \
++ $(call SET_SHARED_LIBRARY_ORIGIN), \
++ LIBS_unix := $(LIBDL) $(NSS_LIBS), \
++ ))
++
++ TARGETS += $(BUILD_LIBSYSTEMCONF)
++endif
++
+ ################################################################################
+ # Create the symbols file for static builds.
+
+diff --git openjdk/src/java.base/linux/native/libsystemconf/systemconf.c
openjdk/src/java.base/linux/native/libsystemconf/systemconf.c
+new file mode 100644
+index 00000000000..6f4656bfcb6
+--- /dev/null
++++ openjdk/src/java.base/linux/native/libsystemconf/systemconf.c
+@@ -0,0 +1,168 @@
++/*
++ * Copyright (c) 2021, Red Hat, Inc.
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation. Oracle designates this
++ * particular file as subject to the "Classpath" exception as provided
++ * by Oracle in the LICENSE file that accompanied this code.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit
www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++#include <dlfcn.h>
++#include <jni.h>
++#include <jni_util.h>
++#include <stdio.h>
++
++#ifdef SYSCONF_NSS
++#include <nss3/pk11pub.h>
++#endif //SYSCONF_NSS
++
++#include "java_security_SystemConfigurator.h"
++
++#define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled"
++#define MSG_MAX_SIZE 96
++
++static jmethodID debugPrintlnMethodID = NULL;
++static jobject debugObj = NULL;
++
++static void throwIOException(JNIEnv *env, const char *msg);
++static void dbgPrint(JNIEnv *env, const char* msg);
++
++/*
++ * Class: java_security_SystemConfigurator
++ * Method: JNI_OnLoad
++ */
++JNIEXPORT jint JNICALL DEF_JNI_OnLoad(JavaVM *vm, void *reserved)
++{
++ JNIEnv *env;
++ jclass sysConfCls, debugCls;
++ jfieldID sdebugFld;
++
++ if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) {
++ return JNI_EVERSION; /* JNI version not supported */
++ }
++
++ sysConfCls =
(*env)->FindClass(env,"java/security/SystemConfigurator");
++ if (sysConfCls == NULL) {
++ printf("libsystemconf: SystemConfigurator class not found\n");
++ return JNI_ERR;
++ }
++ sdebugFld = (*env)->GetStaticFieldID(env, sysConfCls,
++ "sdebug", "Lsun/security/util/Debug;");
++ if (sdebugFld == NULL) {
++ printf("libsystemconf: SystemConfigurator::sdebug field not
found\n");
++ return JNI_ERR;
++ }
++ debugObj = (*env)->GetStaticObjectField(env, sysConfCls, sdebugFld);
++ if (debugObj != NULL) {
++ debugCls = (*env)->FindClass(env,"sun/security/util/Debug");
++ if (debugCls == NULL) {
++ printf("libsystemconf: Debug class not found\n");
++ return JNI_ERR;
++ }
++ debugPrintlnMethodID = (*env)->GetMethodID(env, debugCls,
++ "println", "(Ljava/lang/String;)V");
++ if (debugPrintlnMethodID == NULL) {
++ printf("libsystemconf: Debug::println(String) method not
found\n");
++ return JNI_ERR;
++ }
++ debugObj = (*env)->NewGlobalRef(env, debugObj);
++ }
++
++ return (*env)->GetVersion(env);
++}
++
++/*
++ * Class: java_security_SystemConfigurator
++ * Method: JNI_OnUnload
++ */
++JNIEXPORT void JNICALL DEF_JNI_OnUnload(JavaVM *vm, void *reserved)
++{
++ JNIEnv *env;
++
++ if (debugObj != NULL) {
++ if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) {
++ return; /* Should not happen */
++ }
++ (*env)->DeleteGlobalRef(env, debugObj);
++ }
++}
++
++JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEnabled
++ (JNIEnv *env, jclass cls)
++{
++ int fips_enabled;
++ char msg[MSG_MAX_SIZE];
++ int msg_bytes;
++
++#ifdef SYSCONF_NSS
++
++ dbgPrint(env, "getSystemFIPSEnabled: calling
SECMOD_GetSystemFIPSEnabled");
++ fips_enabled = SECMOD_GetSystemFIPSEnabled();
++ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \
++ " SECMOD_GetSystemFIPSEnabled returned 0x%x", fips_enabled);
++ if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) {
++ dbgPrint(env, msg);
++ } else {
++ dbgPrint(env, "getSystemFIPSEnabled: cannot render" \
++ " SECMOD_GetSystemFIPSEnabled return value");
++ }
++ return (fips_enabled == 1 ? JNI_TRUE : JNI_FALSE);
++
++#else // SYSCONF_NSS
++
++ FILE *fe;
++
++ dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH);
++ if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) {
++ throwIOException(env, "Cannot open " FIPS_ENABLED_PATH);
++ }
++ fips_enabled = fgetc(fe);
++ fclose(fe);
++ if (fips_enabled == EOF) {
++ throwIOException(env, "Cannot read " FIPS_ENABLED_PATH);
++ }
++ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \
++ " read character is '%c'", fips_enabled);
++ if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) {
++ dbgPrint(env, msg);
++ } else {
++ dbgPrint(env, "getSystemFIPSEnabled: cannot render" \
++ " read character");
++ }
++ return (fips_enabled == '1' ? JNI_TRUE : JNI_FALSE);
++
++#endif // SYSCONF_NSS
++}
++
++static void throwIOException(JNIEnv *env, const char *msg)
++{
++ jclass cls = (*env)->FindClass(env, "java/io/IOException");
++ if (cls != 0)
++ (*env)->ThrowNew(env, cls, msg);
++}
++
++static void dbgPrint(JNIEnv *env, const char* msg)
++{
++ jstring jMsg;
++ if (debugObj != NULL) {
++ jMsg = (*env)->NewStringUTF(env, msg);
++ CHECK_NULL(jMsg);
++ (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg);
++ }
++}
+diff --git openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
+index 10b54aa4ce4..6aa1419dfd0 100644
+--- openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
++++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 2019, 2020, Red Hat, Inc.
++ * Copyright (c) 2019, 2021, Red Hat, Inc.
+ *
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+@@ -30,13 +30,9 @@ import java.io.BufferedInputStream;
+ import java.io.FileInputStream;
+ import java.io.IOException;
+
+-import java.nio.file.Files;
+-import java.nio.file.Path;
+-
+ import java.util.Iterator;
+ import java.util.Map.Entry;
+ import java.util.Properties;
+-import java.util.regex.Pattern;
+
+ import sun.security.util.Debug;
+
+@@ -58,11 +54,23 @@ final class SystemConfigurator {
+ private static final String CRYPTO_POLICIES_JAVA_CONFIG =
+ CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config";
+
+- private static final String CRYPTO_POLICIES_CONFIG =
+- CRYPTO_POLICIES_BASE_DIR + "/config";
+-
+ private static boolean systemFipsEnabled = false;
+
++ private static final String SYSTEMCONF_NATIVE_LIB = "systemconf";
++
++ private static native boolean getSystemFIPSEnabled()
++ throws IOException;
++
++ static {
++ @SuppressWarnings("removal")
++ var dummy = AccessController.doPrivileged(new PrivilegedAction<Void>() {
++ public Void run() {
++ System.loadLibrary(SYSTEMCONF_NATIVE_LIB);
++ return null;
++ }
++ });
++ }
++
+ /*
+ * Invoked when java.security.Security class is initialized, if
+ * java.security.disableSystemPropertiesFile property is not set and
+@@ -170,16 +178,34 @@ final class SystemConfigurator {
+ }
+
+ /*
+- * FIPS is enabled only if crypto-policies are set to "FIPS"
+- * and the com.redhat.fips property is true.
++ * OpenJDK FIPS mode will be enabled only if the com.redhat.fips
++ * system property is true (default) and the system is in FIPS mode.
++ *
++ * There are 2 possible ways in which OpenJDK detects that the system
++ * is in FIPS mode: 1) if the NSS SECMOD_GetSystemFIPSEnabled API is
++ * available at OpenJDK's built-time, it is called; 2) otherwise, the
++ * /proc/sys/crypto/fips_enabled file is read.
+ */
+ private static boolean enableFips() throws Exception {
+ boolean shouldEnable =
Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
+ if (shouldEnable) {
+- String cryptoPoliciesConfig = new
String(Files.readAllBytes(Path.of(CRYPTO_POLICIES_CONFIG)));
+- if (sdebug != null) { sdebug.println("Crypto config:\n" +
cryptoPoliciesConfig); }
+- Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
+- return pattern.matcher(cryptoPoliciesConfig).find();
++ if (sdebug != null) {
++ sdebug.println("Calling getSystemFIPSEnabled
(libsystemconf)...");
++ }
++ try {
++ shouldEnable = getSystemFIPSEnabled();
++ if (sdebug != null) {
++ sdebug.println("Call to getSystemFIPSEnabled (libsystemconf)
returned: "
++ + shouldEnable);
++ }
++ return shouldEnable;
++ } catch (IOException e) {
++ if (sdebug != null) {
++ sdebug.println("Call to getSystemFIPSEnabled (libsystemconf)
failed:");
++ sdebug.println(e.getMessage());
++ }
++ throw e;
++ }
+ } else {
+ return false;
+ }
commit e426a3c6f9da06476697ca938827d14ee5d2c891
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Mon Sep 6 01:15:24 2021 +0100
Support the FIPS mode crypto policy (RH1655466)
Update RH1655466 FIPS patch with changes in OpenJDK 8 version.
SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the
name in the config file.
Change nss.fips.cfg config name to "NSS-FIPS" to avoid confusion with
nss.cfg.
No need to substitute path to nss.fips.cfg as java.security file supports a java.home
variable.
Disable FIPS mode support unless com.redhat.fips is set to "true".
Use appropriate keystore types when in FIPS mode (RH1818909)
Enable alignment with FIPS crypto policy by default (-Dcom.redhat.fips=false to
disable).
Disable TLSv1.3 when the FIPS crypto policy and the NSS-FIPS provider are in use
(RH1860986)
Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode
Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always
occurs (RH1915071)
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index acbf07b..7e79587 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 33
-%global rpmrelease 1
+%global rpmrelease 2
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -751,6 +751,7 @@ exit 0
%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/java.security
%config(noreplace) %{etcjavadir -- %{?1}}/conf/logging.properties
%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/nss.cfg
+%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/nss.fips.cfg
%config(noreplace) %{etcjavadir -- %{?1}}/conf/management/jmxremote.access
# these are config templates, thus not config-noreplace
%config %{etcjavadir -- %{?1}}/conf/management/jmxremote.password.template
@@ -966,6 +967,8 @@ OrderWithRequires: copy-jdk-configs
%endif
# for printing support
Requires: cups-libs
+# for FIPS PKCS11 provider
+Requires: nss
# Post requires alternatives to install tool alternatives
Requires(post): %{alternatives_requires}
# Postun requires alternatives to uninstall tool alternatives
@@ -1136,6 +1139,9 @@ Source14: TestECDSA.java
# Verify system crypto (policy) can be disabled via a property
Source15: TestSecurityProperties.java
+# nss fips configuration file
+Source17: nss.fips.cfg.in
+
############################################
#
# RPM/distribution specific patches
@@ -1160,6 +1166,16 @@ Patch5: pr3695-toggle_system_crypto_policy.patch
# Depend on pcs-lite-libs instead of pcs-lite-devel as this is only in optional repo
Patch6:
rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
+# FIPS support patches
+# RH1655466: Support RHEL FIPS mode using SunPKCS11 provider
+Patch1001: rh1655466-global_crypto_and_fips.patch
+# RH1818909: No ciphersuites availale for SSLSocket in FIPS mode
+Patch1002: rh1818909-fips_default_keystore_type.patch
+# RH1860986: Disable TLSv1.3 with the NSS-FIPS provider until PKCS#11 v3.0 support is
available
+Patch1004: rh1860986-disable_tlsv1.3_in_fips_mode.patch
+# RH1915071: Always initialise JavaSecuritySystemConfiguratorAccess
+Patch1007: rh1915071-always_initialise_configurator_access.patch
+
#############################################
#
# OpenJDK patches in need of upstreaming
@@ -1516,6 +1532,10 @@ popd # openjdk
%patch1000
%patch600
+%patch1001
+%patch1002
+%patch1004
+%patch1007
# Extract systemtap tapsets
%if %{with_systemtap}
@@ -1564,6 +1584,9 @@ done
# Setup nss.cfg
sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE11} > nss.cfg
+# Setup nss.fips.cfg
+sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE17} > nss.fips.cfg
+sed -i -e "s:@NSS_SECMOD@:/etc/pki/nssdb:g" nss.fips.cfg
%build
# How many CPU's do we have?
@@ -1717,6 +1740,9 @@ export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage}
# Install nss.cfg right away as we will be using the JRE above
install -m 644 nss.cfg $JAVA_HOME/conf/security/
+# Install nss.fips.cfg: NSS configuration for global FIPS mode (crypto-policies)
+install -m 644 nss.fips.cfg $JAVA_HOME/conf/security/
+
# Use system-wide tzdata
rm $JAVA_HOME/lib/tzdb.dat
ln -s %{_datadir}/javazi-1.8/tzdb.dat $JAVA_HOME/lib/tzdb.dat
@@ -2235,6 +2261,21 @@ cjc.mainProgram(args)
%endif
%changelog
+* Mon Sep 06 2021 Andrew Hughes <gnu.andrew(a)redhat.com> -
1:17.0.0.0.33-0.2.ea.rolling
+- Update RH1655466 FIPS patch with changes in OpenJDK 8 version.
+- SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the
name in the config file.
+- Change nss.fips.cfg config name to "NSS-FIPS" to avoid confusion with
nss.cfg.
+- No need to substitute path to nss.fips.cfg as java.security file supports a java.home
variable.
+- Disable FIPS mode support unless com.redhat.fips is set to "true".
+- Enable alignment with FIPS crypto policy by default (-Dcom.redhat.fips=false to
disable).
+- Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode
+- Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always
occurs (RH1915071)
+
+* Mon Sep 06 2021 Martin Balao <mbalao(a)redhat.com> - 1:17.0.0.0.33-0.2.ea.rolling
+- Support the FIPS mode crypto policy (RH1655466)
+- Use appropriate keystore types when in FIPS mode (RH1818909)
+- Disable TLSv1.3 when the FIPS crypto policy and the NSS-FIPS provider are in use
(RH1860986)
+
* Mon Aug 30 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.0.0.33-0.1.ea.rolling
- alternatives creation moved to posttrans
- Thus fixing the old reisntall issue:
diff --git a/nss.fips.cfg.in b/nss.fips.cfg.in
new file mode 100644
index 0000000..ead27be
--- /dev/null
+++ b/nss.fips.cfg.in
@@ -0,0 +1,6 @@
+name = NSS-FIPS
+nssLibraryDirectory = @NSS_LIBDIR@
+nssSecmodDirectory = @NSS_SECMOD@
+nssDbMode = readOnly
+nssModule = fips
+
diff --git a/rh1655466-global_crypto_and_fips.patch
b/rh1655466-global_crypto_and_fips.patch
new file mode 100644
index 0000000..80cd91c
--- /dev/null
+++ b/rh1655466-global_crypto_and_fips.patch
@@ -0,0 +1,205 @@
+diff --git a/src/java.base/share/classes/javopenjdk.orig///security/Security.java
openjdk///src/java.base/share/classes/java/security/Security.java
+--- openjdk.orig/src/java.base/share/classes/java/security/Security.java
++++ openjdk/src/java.base/share/classes/java/security/Security.java
+@@ -196,26 +196,8 @@
+ if (disableSystemProps == null &&
+ "true".equalsIgnoreCase(props.getProperty
+ ("security.useSystemPropertiesFile"))) {
+-
+- // now load the system file, if it exists, so its values
+- // will win if they conflict with the earlier values
+- try (BufferedInputStream bis =
+- new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
+- props.load(bis);
++ if (SystemConfigurator.configure(props)) {
+ loadedProps = true;
+-
+- if (sdebug != null) {
+- sdebug.println("reading system security properties file "
+
+- SYSTEM_PROPERTIES);
+- sdebug.println(props.toString());
+- }
+- } catch (IOException e) {
+- if (sdebug != null) {
+- sdebug.println
+- ("unable to load security properties from " +
+- SYSTEM_PROPERTIES);
+- e.printStackTrace();
+- }
+ }
+ }
+
+diff --git
a/src/java.base/share/classes/javopenjdk.orig///security/SystemConfigurator.java
openjdk///src/java.base/share/classes/java/security/SystemConfigurator.java
+new file mode 100644
+--- /dev/null
++++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
+@@ -0,0 +1,151 @@
++/*
++ * Copyright (c) 2019, Red Hat, Inc.
++ *
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit
www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++package java.security;
++
++import java.io.BufferedInputStream;
++import java.io.FileInputStream;
++import java.io.IOException;
++
++import java.nio.file.Files;
++import java.nio.file.Path;
++
++import java.util.Iterator;
++import java.util.Map.Entry;
++import java.util.Properties;
++import java.util.function.Consumer;
++import java.util.regex.Matcher;
++import java.util.regex.Pattern;
++
++import sun.security.util.Debug;
++
++/**
++ * Internal class to align OpenJDK with global crypto-policies.
++ * Called from java.security.Security class initialization,
++ * during startup.
++ *
++ */
++
++class SystemConfigurator {
++
++ private static final Debug sdebug =
++ Debug.getInstance("properties");
++
++ private static final String CRYPTO_POLICIES_BASE_DIR =
++ "/etc/crypto-policies";
++
++ private static final String CRYPTO_POLICIES_JAVA_CONFIG =
++ CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config";
++
++ private static final String CRYPTO_POLICIES_CONFIG =
++ CRYPTO_POLICIES_BASE_DIR + "/config";
++
++ private static final class SecurityProviderInfo {
++ int number;
++ String key;
++ String value;
++ SecurityProviderInfo(int number, String key, String value) {
++ this.number = number;
++ this.key = key;
++ this.value = value;
++ }
++ }
++
++ /*
++ * Invoked when java.security.Security class is initialized, if
++ * java.security.disableSystemPropertiesFile property is not set and
++ * security.useSystemPropertiesFile is true.
++ */
++ static boolean configure(Properties props) {
++ boolean loadedProps = false;
++
++ try (BufferedInputStream bis =
++ new BufferedInputStream(
++ new FileInputStream(CRYPTO_POLICIES_JAVA_CONFIG))) {
++ props.load(bis);
++ loadedProps = true;
++ if (sdebug != null) {
++ sdebug.println("reading system security properties file " +
++ CRYPTO_POLICIES_JAVA_CONFIG);
++ sdebug.println(props.toString());
++ }
++ } catch (IOException e) {
++ if (sdebug != null) {
++ sdebug.println("unable to load security properties from " +
++ CRYPTO_POLICIES_JAVA_CONFIG);
++ e.printStackTrace();
++ }
++ }
++
++ try {
++ if (enableFips()) {
++ if (sdebug != null) { sdebug.println("FIPS mode detected"); }
++ loadedProps = false;
++ // Remove all security providers
++ Iterator<Entry<Object, Object>> i =
props.entrySet().iterator();
++ while (i.hasNext()) {
++ Entry<Object, Object> e = i.next();
++ if (((String) e.getKey()).startsWith("security.provider"))
{
++ if (sdebug != null) { sdebug.println("Removing provider:
" + e); }
++ i.remove();
++ }
++ }
++ // Add FIPS security providers
++ String fipsProviderValue = null;
++ for (int n = 1;
++ (fipsProviderValue = (String) props.get("fips.provider."
+ n)) != null; n++) {
++ String fipsProviderKey = "security.provider." + n;
++ if (sdebug != null) {
++ sdebug.println("Adding provider " + n + ": "
+
++ fipsProviderKey + "=" + fipsProviderValue);
++ }
++ props.put(fipsProviderKey, fipsProviderValue);
++ }
++ loadedProps = true;
++ }
++ } catch (Exception e) {
++ if (sdebug != null) {
++ sdebug.println("unable to load FIPS configuration");
++ e.printStackTrace();
++ }
++ }
++ return loadedProps;
++ }
++
++ /*
++ * FIPS is enabled only if crypto-policies are set to "FIPS"
++ * and the com.redhat.fips property is true.
++ */
++ private static boolean enableFips() throws Exception {
++ boolean fipsEnabled =
Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
++ if (fipsEnabled) {
++ String cryptoPoliciesConfig = new
String(Files.readAllBytes(Path.of(CRYPTO_POLICIES_CONFIG)));
++ if (sdebug != null) { sdebug.println("Crypto config:\n" +
cryptoPoliciesConfig); }
++ Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
++ return pattern.matcher(cryptoPoliciesConfig).find();
++ } else {
++ return false;
++ }
++ }
++}
+diff --git openjdk.orig///src/java.base/share/conf/security/java.security
openjdk///src/java.base/share/conf/security/java.security
+--- openjdk.orig/src/java.base/share/conf/security/java.security
++++ openjdk/src/java.base/share/conf/security/java.security
+@@ -87,6 +87,14 @@
+ #security.provider.tbd=SunPKCS11 ${java.home}/lib/security/nss.cfg
+
+ #
++# Security providers used when global crypto-policies are set to FIPS.
++#
++fips.provider.1=SunPKCS11 ${java.home}/conf/security/nss.fips.cfg
++fips.provider.2=SUN
++fips.provider.3=SunEC
++fips.provider.4=SunJSSE
++
++#
+ # A list of preferred providers for specific algorithms. These providers will
+ # be searched for matching algorithms before the list of registered providers.
+ # Entries containing errors (parsing, etc) will be ignored. Use the
diff --git a/rh1818909-fips_default_keystore_type.patch
b/rh1818909-fips_default_keystore_type.patch
new file mode 100644
index 0000000..ff34f3e
--- /dev/null
+++ b/rh1818909-fips_default_keystore_type.patch
@@ -0,0 +1,52 @@
+diff -r 6efbd7b35a10 src/share/classes/java/security/SystemConfigurator.java
+--- openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java Thu
Jan 23 18:22:31 2020 -0300
++++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java Mon Mar 02
19:20:17 2020 -0300
+@@ -123,6 +123,33 @@
+ }
+ props.put(fipsProviderKey, fipsProviderValue);
+ }
++ // Add other security properties
++ String keystoreTypeValue = (String)
props.get("fips.keystore.type");
++ if (keystoreTypeValue != null) {
++ String nonFipsKeystoreType =
props.getProperty("keystore.type");
++ props.put("keystore.type", keystoreTypeValue);
++ if (keystoreTypeValue.equals("PKCS11")) {
++ // If keystore.type is PKCS11, javax.net.ssl.keyStore
++ // must be "NONE". See JDK-8238264.
++ System.setProperty("javax.net.ssl.keyStore",
"NONE");
++ }
++ if (System.getProperty("javax.net.ssl.trustStoreType") ==
null) {
++ // If no trustStoreType has been set, use the
++ // previous keystore.type under FIPS mode. In
++ // a default configuration, the Trust Store will
++ // be 'cacerts' (JKS type).
++ System.setProperty("javax.net.ssl.trustStoreType",
++ nonFipsKeystoreType);
++ }
++ if (sdebug != null) {
++ sdebug.println("FIPS mode default keystore.type = " +
++ keystoreTypeValue);
++ sdebug.println("FIPS mode javax.net.ssl.keyStore = "
+
++ System.getProperty("javax.net.ssl.keyStore",
""));
++ sdebug.println("FIPS mode javax.net.ssl.trustStoreType =
" +
++
System.getProperty("javax.net.ssl.trustStoreType", ""));
++ }
++ }
+ loadedProps = true;
+ }
+ } catch (Exception e) {
+diff -r 6efbd7b35a10 src/share/lib/security/java.security-linux
+--- openjdk.orig/src/java.base/share/conf/security/java.security Thu Jan 23 18:22:31 2020
-0300
++++ openjdk/src/java.base/share/conf/security/java.security Mon Mar 02 19:20:17 2020
-0300
+@@ -299,6 +299,11 @@
+ keystore.type=pkcs12
+
+ #
++# Default keystore type used when global crypto-policies are set to FIPS.
++#
++fips.keystore.type=PKCS11
++
++#
+ # Controls compatibility mode for JKS and PKCS12 keystore types.
+ #
+ # When set to 'true', both JKS and PKCS12 keystore types support loading
diff --git a/rh1860986-disable_tlsv1.3_in_fips_mode.patch
b/rh1860986-disable_tlsv1.3_in_fips_mode.patch
new file mode 100644
index 0000000..8dcd9a8
--- /dev/null
+++ b/rh1860986-disable_tlsv1.3_in_fips_mode.patch
@@ -0,0 +1,318 @@
+diff --git openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
+index f9baf8c9742..60fa75cab45 100644
+--- openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
++++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
+@@ -1,11 +1,13 @@
+ /*
+- * Copyright (c) 2019, Red Hat, Inc.
++ * Copyright (c) 2019, 2020, Red Hat, Inc.
+ *
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+- * published by the Free Software Foundation.
++ * published by the Free Software Foundation. Oracle designates this
++ * particular file as subject to the "Classpath" exception as provided
++ * by Oracle in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+@@ -34,10 +36,10 @@ import java.nio.file.Path;
+ import java.util.Iterator;
+ import java.util.Map.Entry;
+ import java.util.Properties;
+-import java.util.function.Consumer;
+-import java.util.regex.Matcher;
+ import java.util.regex.Pattern;
+
++import jdk.internal.access.JavaSecuritySystemConfiguratorAccess;
++import jdk.internal.access.SharedSecrets;
+ import sun.security.util.Debug;
+
+ /**
+@@ -47,7 +49,7 @@ import sun.security.util.Debug;
+ *
+ */
+
+-class SystemConfigurator {
++final class SystemConfigurator {
+
+ private static final Debug sdebug =
+ Debug.getInstance("properties");
+@@ -61,15 +63,16 @@ class SystemConfigurator {
+ private static final String CRYPTO_POLICIES_CONFIG =
+ CRYPTO_POLICIES_BASE_DIR + "/config";
+
+- private static final class SecurityProviderInfo {
+- int number;
+- String key;
+- String value;
+- SecurityProviderInfo(int number, String key, String value) {
+- this.number = number;
+- this.key = key;
+- this.value = value;
+- }
++ private static boolean systemFipsEnabled = false;
++
++ static {
++ SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
++ new JavaSecuritySystemConfiguratorAccess() {
++ @Override
++ public boolean isSystemFipsEnabled() {
++ return SystemConfigurator.isSystemFipsEnabled();
++ }
++ });
+ }
+
+ /*
+@@ -128,9 +131,9 @@ class SystemConfigurator {
+ String nonFipsKeystoreType =
props.getProperty("keystore.type");
+ props.put("keystore.type", keystoreTypeValue);
+ if (keystoreTypeValue.equals("PKCS11")) {
+- // If keystore.type is PKCS11, javax.net.ssl.keyStore
+- // must be "NONE". See JDK-8238264.
+- System.setProperty("javax.net.ssl.keyStore",
"NONE");
++ // If keystore.type is PKCS11, javax.net.ssl.keyStore
++ // must be "NONE". See JDK-8238264.
++ System.setProperty("javax.net.ssl.keyStore",
"NONE");
+ }
+ if (System.getProperty("javax.net.ssl.trustStoreType") ==
null) {
+ // If no trustStoreType has been set, use the
+@@ -144,12 +147,13 @@ class SystemConfigurator {
+ sdebug.println("FIPS mode default keystore.type = " +
+ keystoreTypeValue);
+ sdebug.println("FIPS mode javax.net.ssl.keyStore = "
+
+- System.getProperty("javax.net.ssl.keyStore",
""));
++ System.getProperty("javax.net.ssl.keyStore",
""));
+ sdebug.println("FIPS mode javax.net.ssl.trustStoreType =
" +
+
System.getProperty("javax.net.ssl.trustStoreType", ""));
+ }
+ }
+ loadedProps = true;
++ systemFipsEnabled = true;
+ }
+ } catch (Exception e) {
+ if (sdebug != null) {
+@@ -160,13 +164,30 @@ class SystemConfigurator {
+ return loadedProps;
+ }
+
++ /**
++ * Returns whether or not global system FIPS alignment is enabled.
++ *
++ * Value is always 'false' before java.security.Security class is
++ * initialized.
++ *
++ * Call from out of this package through SharedSecrets:
++ * SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
++ * .isSystemFipsEnabled();
++ *
++ * @return a boolean value indicating whether or not global
++ * system FIPS alignment is enabled.
++ */
++ static boolean isSystemFipsEnabled() {
++ return systemFipsEnabled;
++ }
++
+ /*
+ * FIPS is enabled only if crypto-policies are set to "FIPS"
+ * and the com.redhat.fips property is true.
+ */
+ private static boolean enableFips() throws Exception {
+- boolean fipsEnabled =
Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
+- if (fipsEnabled) {
++ boolean shouldEnable =
Boolean.valueOf(System.getProperty("com.redhat.fips", "true"));
++ if (shouldEnable) {
+ String cryptoPoliciesConfig = new
String(Files.readAllBytes(Path.of(CRYPTO_POLICIES_CONFIG)));
+ if (sdebug != null) { sdebug.println("Crypto config:\n" +
cryptoPoliciesConfig); }
+ Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE);
+diff --git
openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java
openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java
+new file mode 100644
+index 00000000000..a31e93ec02e
+--- /dev/null
++++
openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java
+@@ -0,0 +1,30 @@
++/*
++ * Copyright (c) 2020, Red Hat, Inc.
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation. Oracle designates this
++ * particular file as subject to the "Classpath" exception as provided
++ * by Oracle in the LICENSE file that accompanied this code.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit
www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++package jdk.internal.access;
++
++public interface JavaSecuritySystemConfiguratorAccess {
++ boolean isSystemFipsEnabled();
++}
+diff --git openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
+index f6d3638c3dd..5a2c9eb0c46 100644
+--- openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
++++ openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
+@@ -81,6 +81,7 @@ public class SharedSecrets {
+ private static JavaSecuritySpecAccess javaSecuritySpecAccess;
+ private static JavaxCryptoSealedObjectAccess javaxCryptoSealedObjectAccess;
+ private static JavaxCryptoSpecAccess javaxCryptoSpecAccess;
++ private static JavaSecuritySystemConfiguratorAccess
javaSecuritySystemConfiguratorAccess;
+
+ public static void setJavaUtilCollectionAccess(JavaUtilCollectionAccess juca) {
+ javaUtilCollectionAccess = juca;
+@@ -442,4 +443,12 @@ public class SharedSecrets {
+ MethodHandles.lookup().ensureInitialized(c);
+ } catch (IllegalAccessException e) {}
+ }
++
++ public static void
setJavaSecuritySystemConfiguratorAccess(JavaSecuritySystemConfiguratorAccess jssca) {
++ javaSecuritySystemConfiguratorAccess = jssca;
++ }
++
++ public static JavaSecuritySystemConfiguratorAccess
getJavaSecuritySystemConfiguratorAccess() {
++ return javaSecuritySystemConfiguratorAccess;
++ }
+ }
+diff --git openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java
openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java
+index 6ffdfeda18d..775b185fb06 100644
+--- openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java
++++ openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java
+@@ -32,6 +32,7 @@ import java.security.cert.*;
+ import java.util.*;
+ import java.util.concurrent.locks.ReentrantLock;
+ import javax.net.ssl.*;
++import jdk.internal.access.SharedSecrets;
+ import sun.security.action.GetPropertyAction;
+ import sun.security.provider.certpath.AlgorithmChecker;
+ import sun.security.validator.Validator;
+@@ -536,22 +537,40 @@ public abstract class SSLContextImpl extends SSLContextSpi {
+ private static final List<CipherSuite> serverDefaultCipherSuites;
+
+ static {
+- supportedProtocols = Arrays.asList(
+- ProtocolVersion.TLS13,
+- ProtocolVersion.TLS12,
+- ProtocolVersion.TLS11,
+- ProtocolVersion.TLS10,
+- ProtocolVersion.SSL30,
+- ProtocolVersion.SSL20Hello
+- );
+-
+- serverDefaultProtocols = getAvailableProtocols(
+- new ProtocolVersion[] {
+- ProtocolVersion.TLS13,
+- ProtocolVersion.TLS12,
+- ProtocolVersion.TLS11,
+- ProtocolVersion.TLS10
+- });
++ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
++ .isSystemFipsEnabled()) {
++ // RH1860986: TLSv1.3 key derivation not supported with
++ // the Security Providers available in system FIPS mode.
++ supportedProtocols = Arrays.asList(
++ ProtocolVersion.TLS12,
++ ProtocolVersion.TLS11,
++ ProtocolVersion.TLS10
++ );
++
++ serverDefaultProtocols = getAvailableProtocols(
++ new ProtocolVersion[] {
++ ProtocolVersion.TLS12,
++ ProtocolVersion.TLS11,
++ ProtocolVersion.TLS10
++ });
++ } else {
++ supportedProtocols = Arrays.asList(
++ ProtocolVersion.TLS13,
++ ProtocolVersion.TLS12,
++ ProtocolVersion.TLS11,
++ ProtocolVersion.TLS10,
++ ProtocolVersion.SSL30,
++ ProtocolVersion.SSL20Hello
++ );
++
++ serverDefaultProtocols = getAvailableProtocols(
++ new ProtocolVersion[] {
++ ProtocolVersion.TLS13,
++ ProtocolVersion.TLS12,
++ ProtocolVersion.TLS11,
++ ProtocolVersion.TLS10
++ });
++ }
+
+ supportedCipherSuites = getApplicableSupportedCipherSuites(
+ supportedProtocols);
+@@ -842,12 +861,23 @@ public abstract class SSLContextImpl extends SSLContextSpi {
+ ProtocolVersion[] candidates;
+ if (refactored.isEmpty()) {
+ // Client and server use the same default protocols.
+- candidates = new ProtocolVersion[] {
+- ProtocolVersion.TLS13,
+- ProtocolVersion.TLS12,
+- ProtocolVersion.TLS11,
+- ProtocolVersion.TLS10
+- };
++ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
++ .isSystemFipsEnabled()) {
++ // RH1860986: TLSv1.3 key derivation not supported with
++ // the Security Providers available in system FIPS mode.
++ candidates = new ProtocolVersion[] {
++ ProtocolVersion.TLS12,
++ ProtocolVersion.TLS11,
++ ProtocolVersion.TLS10
++ };
++ } else {
++ candidates = new ProtocolVersion[] {
++ ProtocolVersion.TLS13,
++ ProtocolVersion.TLS12,
++ ProtocolVersion.TLS11,
++ ProtocolVersion.TLS10
++ };
++ }
+ } else {
+ // Use the customized TLS protocols.
+ candidates =
+diff --git openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java
openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java
+index 894e26dfad8..8b16378b96b 100644
+--- openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java
++++ openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java
+@@ -27,6 +27,8 @@ package sun.security.ssl;
+
+ import java.security.*;
+ import java.util.*;
++
++import jdk.internal.access.SharedSecrets;
+ import static sun.security.util.SecurityConstants.PROVIDER_VER;
+
+ /**
+@@ -102,8 +104,13 @@ public class SunJSSE extends java.security.Provider {
+ "sun.security.ssl.SSLContextImpl$TLS11Context", null, null);
+ ps("SSLContext", "TLSv1.2",
+ "sun.security.ssl.SSLContextImpl$TLS12Context", null, null);
+- ps("SSLContext", "TLSv1.3",
+- "sun.security.ssl.SSLContextImpl$TLS13Context", null, null);
++ if (!SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
++ .isSystemFipsEnabled()) {
++ // RH1860986: TLSv1.3 key derivation not supported with
++ // the Security Providers available in system FIPS mode.
++ ps("SSLContext", "TLSv1.3",
++ "sun.security.ssl.SSLContextImpl$TLS13Context", null, null);
++ }
+ ps("SSLContext", "TLS",
+ "sun.security.ssl.SSLContextImpl$TLSContext",
+ List.of("SSL"), null);
diff --git a/rh1915071-always_initialise_configurator_access.patch
b/rh1915071-always_initialise_configurator_access.patch
new file mode 100644
index 0000000..513fbbf
--- /dev/null
+++ b/rh1915071-always_initialise_configurator_access.patch
@@ -0,0 +1,70 @@
+diff --git openjdk/src/java.base/share/classes/java/security/Security.java
openjdk/src/java.base/share/classes/java/security/Security.java
+index f1633afb627..ce32c939253 100644
+--- openjdk/src/java.base/share/classes/java/security/Security.java
++++ openjdk/src/java.base/share/classes/java/security/Security.java
+@@ -32,6 +32,7 @@ import java.net.URL;
+
+ import jdk.internal.event.EventHelper;
+ import jdk.internal.event.SecurityPropertyModificationEvent;
++import jdk.internal.access.JavaSecuritySystemConfiguratorAccess;
+ import jdk.internal.access.SharedSecrets;
+ import jdk.internal.util.StaticProperty;
+ import sun.security.util.Debug;
+@@ -74,6 +75,15 @@ public final class Security {
+ }
+
+ static {
++ // Initialise here as used by code with system properties disabled
++ SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
++ new JavaSecuritySystemConfiguratorAccess() {
++ @Override
++ public boolean isSystemFipsEnabled() {
++ return SystemConfigurator.isSystemFipsEnabled();
++ }
++ });
++
+ // doPrivileged here because there are multiple
+ // things in initialize that might require privs.
+ // (the FileInputStream call and the File.exists call,
+@@ -194,9 +204,8 @@ public final class Security {
+ }
+
+ String disableSystemProps =
System.getProperty("java.security.disableSystemPropertiesFile");
+- if (disableSystemProps == null &&
+- "true".equalsIgnoreCase(props.getProperty
+- ("security.useSystemPropertiesFile"))) {
++ if ((disableSystemProps == null ||
"false".equalsIgnoreCase(disableSystemProps)) &&
++
"true".equalsIgnoreCase(props.getProperty("security.useSystemPropertiesFile")))
{
+ if (SystemConfigurator.configure(props)) {
+ loadedProps = true;
+ }
+diff --git openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
+index 60fa75cab45..10b54aa4ce4 100644
+--- openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
++++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java
+@@ -38,8 +38,6 @@ import java.util.Map.Entry;
+ import java.util.Properties;
+ import java.util.regex.Pattern;
+
+-import jdk.internal.access.JavaSecuritySystemConfiguratorAccess;
+-import jdk.internal.access.SharedSecrets;
+ import sun.security.util.Debug;
+
+ /**
+@@ -65,16 +63,6 @@ final class SystemConfigurator {
+
+ private static boolean systemFipsEnabled = false;
+
+- static {
+- SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
+- new JavaSecuritySystemConfiguratorAccess() {
+- @Override
+- public boolean isSystemFipsEnabled() {
+- return SystemConfigurator.isSystemFipsEnabled();
+- }
+- });
+- }
+-
+ /*
+ * Invoked when java.security.Security class is initialized, if
+ * java.security.disableSystemPropertiesFile property is not set and
commit e16ee29c24b7c3fd46e4b2dec01a57bb13b99c18
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Tue Aug 31 18:26:42 2021 +0200
alternatives creation moved to posttrans
- Thus fixing the old reisntall issue:
-
https://bugzilla.redhat.com/show_bug.cgi?id=1200302
-
https://bugzilla.redhat.com/show_bug.cgi?id=1976053
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 24c213e..acbf07b 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -81,7 +81,7 @@
# in alternatives those are slaves and master, very often triplicated by man pages
# in files all masters and slaves are ghosted
# the ghosts are here to allow installation via query like `dnf install /usr/bin/java`
-# you can list those files, with appropriate sections: cat *.spec | grep -e --install -e
--slave -e post_
+# you can list those files, with appropriate sections: cat *.spec | grep -e --install -e
--slave -e post_ -e alternatives
# TODO - fix those hardcoded lists via single list
# Those files must *NOT* be ghosted for *slowdebug* packages
# FIXME - if you are moving jshell or jlink or similar, always modify all three sections
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 33
-%global rpmrelease 0
+%global rpmrelease 1
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -432,12 +432,7 @@ update-desktop-database %{_datadir}/applications &> /dev/null
|| :
exit 0
}
-
-%define post_headless() %{expand:
-%ifarch %{share_arches}
-%{jrebindir -- %{?1}}/java -Xshare:dump >/dev/null 2>/dev/null
-%endif
-
+%define alternatives_java_install() %{expand:
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
@@ -463,8 +458,13 @@ for X in %{origin} %{javaver} ; do
alternatives --install %{_jvmdir}/jre-"$X" jre_"$X"
%{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family %{name}.%{_arch}
done
-update-alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin}
jre_%{javaver}_%{origin} %{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family
%{name}.%{_arch}
+alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} jre_%{javaver}_%{origin}
%{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family %{name}.%{_arch}
+}
+%define post_headless() %{expand:
+%ifarch %{share_arches}
+%{jrebindir -- %{?1}}/java -Xshare:dump >/dev/null 2>/dev/null
+%endif
update-desktop-database %{_datadir}/applications &> /dev/null || :
/bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || :
@@ -501,8 +501,8 @@ exit 0
%{update_desktop_icons}
}
-%define post_devel() %{expand:
+%define alternatives_javac_install() %{expand:
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
@@ -581,7 +581,9 @@ for X in %{origin} %{javaver} ; do
done
update-alternatives --install %{_jvmdir}/java-%{javaver}-%{origin}
java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family
%{name}.%{_arch}
+}
+%define post_devel() %{expand:
update-desktop-database %{_datadir}/applications &> /dev/null || :
/bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || :
@@ -604,11 +606,11 @@ exit 0
}
%define posttrans_devel() %{expand:
+%{alternatives_javac_install -- %{?1}}
%{update_desktop_icons}
}
-%define post_javadoc() %{expand:
-
+%define alternatives_javadoc_install() %{expand:
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
@@ -625,8 +627,7 @@ exit 0
exit 0
}
-%define post_javadoc_zip() %{expand:
-
+%define alternatives_javadoczip_install() %{expand:
PRIORITY=%{priority}
if [ "%{?1}" == %{debug_suffix} ]; then
let PRIORITY=PRIORITY-1
@@ -2055,6 +2056,9 @@ cjc.mainProgram(args)
%posttrans
%{posttrans_script %{nil}}
+%posttrans headless
+%{alternatives_java_install %{nil}}
+
%post devel
%{post_devel %{nil}}
@@ -2064,14 +2068,14 @@ cjc.mainProgram(args)
%posttrans devel
%{posttrans_devel %{nil}}
-%post javadoc
-%{post_javadoc %{nil}}
+%posttrans javadoc
+%{alternatives_javadoc_install %{nil}}
%postun javadoc
%{postun_javadoc %{nil}}
-%post javadoc-zip
-%{post_javadoc_zip %{nil}}
+%posttrans javadoc-zip
+%{alternatives_javadoczip_install %{nil}}
%postun javadoc-zip
%{postun_javadoc_zip %{nil}}
@@ -2084,6 +2088,9 @@ cjc.mainProgram(args)
%post headless-slowdebug
%{post_headless -- %{debug_suffix_unquoted}}
+%posttrans headless-slowdebug
+%{alternatives_java_install -- %{debug_suffix_unquoted}}
+
%postun slowdebug
%{postun_script -- %{debug_suffix_unquoted}}
@@ -2119,6 +2126,9 @@ cjc.mainProgram(args)
%posttrans fastdebug
%{posttrans_script -- %{fastdebug_suffix_unquoted}}
+%posttrans headless-fastdebug
+%{alternatives_java_install -- %{fastdebug_suffix_unquoted}}
+
%post devel-fastdebug
%{post_devel -- %{fastdebug_suffix_unquoted}}
@@ -2225,6 +2235,12 @@ cjc.mainProgram(args)
%endif
%changelog
+* Mon Aug 30 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.0.0.33-0.1.ea.rolling
+- alternatives creation moved to posttrans
+- Thus fixing the old reisntall issue:
+-
https://bugzilla.redhat.com/show_bug.cgi?id=1200302
+-
https://bugzilla.redhat.com/show_bug.cgi?id=1976053
+
* Fri Jul 30 2021 Andrew Hughes <gnu.andrew(a)redhat.com> -
1:17.0.0.0.33-0.0.ea.rolling
- Update to jdk-17+33, including JDWP fix and July 2021 CPU
- Resolves: rhbz#1972529
commit e79cabf8e2c6f28d04b379b1ccb2924ab446f269
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Fri Jul 30 06:23:55 2021 +0100
Update to jdk-17+33, including JDWP fix and July 2021 CPU
Resolves: rhbz#1972529
diff --git a/.gitignore b/.gitignore
index 620751c..77dfe61 100644
--- a/.gitignore
+++ b/.gitignore
@@ -16,3 +16,4 @@
/openjdk-jdk16-jdk-16+36.tar.xz
/openjdk-jdk16u-jdk-16.0.1+9.tar.xz
/openjdk-jdk17-jdk-17+26.tar.xz
+/openjdk-jdk17-jdk-17+33.tar.xz
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index ad8b8ce..24c213e 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -297,8 +297,8 @@
%global origin_nice OpenJDK
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver 26
-%global rpmrelease 4
+%global buildver 33
+%global rpmrelease 0
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -1072,7 +1072,7 @@ Version: %{newjavaver}.%{buildver}
# This package needs `.rolling` as part of Release so as to not conflict on install with
# java-X-openjdk. I.e. when latest rolling release is also an LTS release packaged as
# java-X-openjdk. See:
https://bugzilla.redhat.com/show_bug.cgi?id=1647298
-Release: %{?eaprefix}%{rpmrelease}%{?extraver}.rolling%{?dist}.1
+Release: %{?eaprefix}%{rpmrelease}%{?extraver}.rolling%{?dist}
# java-1.5.0-ibm from
jpackage.org set Epoch to 1 for unknown reasons
# and this change was brought into RHEL-4. java-1.5.0-ibm packages
# also included the epoch in their virtual provides. This created a
@@ -2225,6 +2225,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Fri Jul 30 2021 Andrew Hughes <gnu.andrew(a)redhat.com> -
1:17.0.0.0.33-0.0.ea.rolling
+- Update to jdk-17+33, including JDWP fix and July 2021 CPU
+- Resolves: rhbz#1972529
+
* Thu Jul 22 2021 Fedora Release Engineering <releng(a)fedoraproject.org> -
1:17.0.0.0.26-0.4.ea.rolling.1
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
diff --git a/sources b/sources
index 4bb4cd6..312b5ef 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (openjdk-jdk17-jdk-17+26.tar.xz) =
a400889ba4f141ecf29e46e42f2b2a07ba6df0760502467e7925a31e88ec6fa07deec99f919a42fd673b30df5c86f2adf5e0dcb00687404f0715527b79f2fec7
+SHA512 (openjdk-jdk17-jdk-17+33.tar.xz) =
fa7e852a774d74dbd945a168f8e8f673601fbdf6ff3ce91a4c38a911b1ba66524fa30a8d4cdd60c7bb2c7f7d6d8ab353502c647a5e888a94c18958c7a8348b9c
commit e3ed81b032a983554dbc79ae0a2cc6d2234eeba3
Author: Fedora Release Engineering <releng(a)fedoraproject.org>
Date: Thu Jul 22 08:57:38 2021 +0000
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
Signed-off-by: Fedora Release Engineering <releng(a)fedoraproject.org>
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 995d4f2..ad8b8ce 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -1072,7 +1072,7 @@ Version: %{newjavaver}.%{buildver}
# This package needs `.rolling` as part of Release so as to not conflict on install with
# java-X-openjdk. I.e. when latest rolling release is also an LTS release packaged as
# java-X-openjdk. See:
https://bugzilla.redhat.com/show_bug.cgi?id=1647298
-Release: %{?eaprefix}%{rpmrelease}%{?extraver}.rolling%{?dist}
+Release: %{?eaprefix}%{rpmrelease}%{?extraver}.rolling%{?dist}.1
# java-1.5.0-ibm from
jpackage.org set Epoch to 1 for unknown reasons
# and this change was brought into RHEL-4. java-1.5.0-ibm packages
# also included the epoch in their virtual provides. This created a
@@ -2225,6 +2225,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Jul 22 2021 Fedora Release Engineering <releng(a)fedoraproject.org> -
1:17.0.0.0.26-0.4.ea.rolling.1
+- Rebuilt for
https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
+
* Fri Jul 02 2021 Andrew Hughes <gnu.andrew(a)redhat.com> -
1:17.0.0.0.26-0.4.ea.rolling
- Use the "reverse" build loop (debug first) as the main and only build loop to
get more diagnostics.
- Remove restriction on disabling product build, as debug packages no longer have javadoc
packages.
commit 7bc094fb91eca03e6f58d80dd26b1b9a02241465
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Wed Jul 7 07:02:16 2021 +0100
Use the "reverse" build loop (debug first) as the main and only build loop
to get more diagnostics.
Remove restriction on disabling product build, as debug packages no longer have
javadoc packages.
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 9963a19..995d4f2 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -170,10 +170,8 @@
%endif
# If you disable both builds, then the build fails
-# Note that the debug build requires the normal build for docs
-%global build_loop %{normal_build} %{fastdebug_build} %{slowdebug_build}
-# Test slowdebug first as it provides the best diagnostics
-%global rev_build_loop %{slowdebug_build} %{fastdebug_build} %{normal_build}
+# Build and test slowdebug first as it provides the best diagnostics
+%global build_loop %{slowdebug_build} %{fastdebug_build} %{normal_build}
%if %{include_staticlibs}
%global staticlibs_loop %{staticlibs_suffix}
@@ -300,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 26
-%global rpmrelease 3
+%global rpmrelease 4
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -1493,10 +1491,6 @@ if [ %{include_debug_build} -eq 0 -a %{include_normal_build} -eq 0
-a %{includ
echo "You have disabled all builds (normal,fastdebug,slowdebug). That is a no
go."
exit 14
fi
-if [ %{include_normal_build} -eq 0 ] ; then
- echo "You have disabled the normal build, but this is required to provide docs for
the debug build."
- exit 15
-fi
%setup -q -c -n %{uniquesuffix ""} -T -a 0
#
https://bugzilla.redhat.com/show_bug.cgi?id=1189084
prioritylength=`expr length %{priority}`
@@ -1739,7 +1733,7 @@ done # end of release / debug cycle loop
%check
# We test debug first as it will give better diagnostics on a crash
-for suffix in %{rev_build_loop} ; do
+for suffix in %{build_loop} ; do
top_dir_abs_main_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{main_suffix}}
%if %{include_staticlibs}
@@ -2231,6 +2225,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Fri Jul 02 2021 Andrew Hughes <gnu.andrew(a)redhat.com> -
1:17.0.0.0.26-0.4.ea.rolling
+- Use the "reverse" build loop (debug first) as the main and only build loop to
get more diagnostics.
+- Remove restriction on disabling product build, as debug packages no longer have javadoc
packages.
+
* Mon Jun 28 2021 Petra Alice Mikova <pmikova(a)redhat.com> -
1:17.0.0.0.26-0.3.ea.rolling
- fix patch rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch which
made the SunPKCS provider show up again
- Resolves: rhbz#1971120
commit e22fd4035f47404ff37d96367ec1f8e957ac3f3e
Author: Petra Mikova <pmikova(a)redhat.com>
Date: Thu Jun 17 10:22:07 2021 +0200
Fix patch rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
It makes the SunPKCS provider show up again
Resolves: rhbz#1971120
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index b36e635..9963a19 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -300,7 +300,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 26
-%global rpmrelease 2
+%global rpmrelease 3
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -2231,6 +2231,10 @@ cjc.mainProgram(args)
%endif
%changelog
+* Mon Jun 28 2021 Petra Alice Mikova <pmikova(a)redhat.com> -
1:17.0.0.0.26-0.3.ea.rolling
+- fix patch rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch which
made the SunPKCS provider show up again
+- Resolves: rhbz#1971120
+
* Thu Jun 24 2021 Severin Gehwolf <sgehwolf(a)redhat.com> -
1:17.0.0.0.26-0.2.ea.rolling
- Re-enable TestSecurityProperties after inclusion of PR3695
diff --git a/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
b/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
index ef4c828..7be1fae 100644
--- a/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
+++ b/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
@@ -1,11 +1,11 @@
-diff -r e3f940bd3c8f src/java.base/share/conf/security/java.security
---- openjdk/src/java.base/share/conf/security/java.security Thu Jun 11 21:54:51 2020
+0530
-+++ openjdk/src/java.base/share/conf/security/java.security Mon Aug 24 10:14:31 2020
+0200
-@@ -77,7 +77,7 @@
- #ifdef macosx
+diff --git openjdk/src/java.base/share/conf/security/java.security
openjdk/src/java.base/share/conf/security/java.security
+index 534bdae5a16..2df2b59cbf6 100644
+--- openjdk/src/java.base/share/conf/security/java.security
++++ openjdk/src/java.base/share/conf/security/java.security
+@@ -78,6 +78,7 @@ security.provider.tbd=SunMSCAPI
security.provider.tbd=Apple
#endif
--security.provider.tbd=SunPKCS11
+ security.provider.tbd=SunPKCS11
+#security.provider.tbd=SunPKCS11 ${java.home}/lib/security/nss.cfg
#
commit 2849b03224c321761dc90c228b764239fbad6f5e
Author: Severin Gehwolf <sgehwolf(a)redhat.com>
Date: Mon Jun 21 14:20:29 2021 +0200
Add PR3695 to allow the system crypto policy to be turned off.
- Adds patch from java-11-openjdk so as to be able to properly
toggle the system crypto policy
- Fixes test TestSecurityProperties.java which was failing
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 9e89d2a..b36e635 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -300,7 +300,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 26
-%global rpmrelease 1
+%global rpmrelease 2
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -1156,6 +1156,8 @@ Patch2: rh1648644-java_access_bridge_privileged_security.patch
Patch3:
rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
# Follow system wide crypto policy RHBZ#1249083
Patch4: pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch
+# PR3695: Allow use of system crypto policy to be disabled by the user
+Patch5: pr3695-toggle_system_crypto_policy.patch
# Depend on pcs-lite-libs instead of pcs-lite-devel as this is only in optional repo
Patch6:
rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
@@ -1513,6 +1515,7 @@ pushd %{top_level_dir_name}
%patch2 -p1
%patch3 -p1
%patch4 -p1
+%patch5 -p1
%patch6 -p1
popd # openjdk
@@ -1760,7 +1763,7 @@ $JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed
"s|\.java||")
# Check system crypto (policy) can be disabled
$JAVA_HOME/bin/javac -d . %{SOURCE15}
-$JAVA_HOME/bin/java -Djava.security.disableSystemPropertiesFile=true $(echo $(basename
%{SOURCE15})|sed "s|\.java||") || echo "crypto policy are now not honored
i jdk15"
+$JAVA_HOME/bin/java -Djava.security.disableSystemPropertiesFile=true $(echo $(basename
%{SOURCE15})|sed "s|\.java||")
# Check java launcher has no SSB mitigation
if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi
@@ -2228,6 +2231,12 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Jun 24 2021 Severin Gehwolf <sgehwolf(a)redhat.com> -
1:17.0.0.0.26-0.2.ea.rolling
+- Re-enable TestSecurityProperties after inclusion of PR3695
+
+* Thu Jun 24 2021 Andrew Hughes <gnu.andrew(a)redhat.com> -
1:17.0.0.0.26-0.2.ea.rolling
+- Add PR3695 to allow the system crypto policy to be turned off
+
* Thu Jun 24 2021 Severin Gehwolf <sgehwolf(a)redhat.com> -
1:17.0.0.0.26-0.1.ea.rolling
- Update buildjdkver to 17 so as to build with itself
diff --git a/pr3695-toggle_system_crypto_policy.patch
b/pr3695-toggle_system_crypto_policy.patch
new file mode 100644
index 0000000..3799237
--- /dev/null
+++ b/pr3695-toggle_system_crypto_policy.patch
@@ -0,0 +1,78 @@
+# HG changeset patch
+# User andrew
+# Date 1545198926 0
+# Wed Dec 19 05:55:26 2018 +0000
+# Node ID f2cbd688824c128db7fa848c8732fb0ab3507776
+# Parent 81f07f6d1f8b7b51b136d3974c61bc8bb513770c
+PR3695: Allow use of system crypto policy to be disabled by the user
+Summary: Read user overrides first so security.useSystemPropertiesFile can be disabled
and add -Djava.security.disableSystemPropertiesFile
+
+diff --git a/src/java.base/share/classes/java/security/Security.java
b/src/java.base/share/classes/java/security/Security.java
+--- a/src/java.base/share/classes/java/security/Security.java
++++ b/src/java.base/share/classes/java/security/Security.java
+@@ -125,31 +125,6 @@
+ }
+
+ if ("true".equalsIgnoreCase(props.getProperty
+- ("security.useSystemPropertiesFile"))) {
+-
+- // now load the system file, if it exists, so its values
+- // will win if they conflict with the earlier values
+- try (BufferedInputStream bis =
+- new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
+- props.load(bis);
+- loadedProps = true;
+-
+- if (sdebug != null) {
+- sdebug.println("reading system security properties file "
+
+- SYSTEM_PROPERTIES);
+- sdebug.println(props.toString());
+- }
+- } catch (IOException e) {
+- if (sdebug != null) {
+- sdebug.println
+- ("unable to load security properties from " +
+- SYSTEM_PROPERTIES);
+- e.printStackTrace();
+- }
+- }
+- }
+-
+- if ("true".equalsIgnoreCase(props.getProperty
+ ("security.overridePropertiesFile"))) {
+
+ String extraPropFile = System.getProperty
+@@ -215,6 +190,33 @@
+ }
+ }
+
++ String disableSystemProps =
System.getProperty("java.security.disableSystemPropertiesFile");
++ if (disableSystemProps == null &&
++ "true".equalsIgnoreCase(props.getProperty
++ ("security.useSystemPropertiesFile"))) {
++
++ // now load the system file, if it exists, so its values
++ // will win if they conflict with the earlier values
++ try (BufferedInputStream bis =
++ new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
++ props.load(bis);
++ loadedProps = true;
++
++ if (sdebug != null) {
++ sdebug.println("reading system security properties file "
+
++ SYSTEM_PROPERTIES);
++ sdebug.println(props.toString());
++ }
++ } catch (IOException e) {
++ if (sdebug != null) {
++ sdebug.println
++ ("unable to load security properties from " +
++ SYSTEM_PROPERTIES);
++ e.printStackTrace();
++ }
++ }
++ }
++
+ if (!loadedProps) {
+ initializeStatic();
+ if (sdebug != null) {
commit 4a0847cae5ead20d079753db9e798444679b68aa
Author: Severin Gehwolf <sgehwolf(a)redhat.com>
Date: Thu Jun 24 14:39:12 2021 +0200
Update buildjdkver to 17
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 5c84136..9e89d2a 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -285,7 +285,7 @@
# buildjdkver is usually same as %%{featurever},
# but in time of bootstrap of next jdk, it is featurever-1,
# and this it is better to change it here, on single place
-%global buildjdkver 16
+%global buildjdkver 17
# We don't add any LTS designator for STS packages (this package).
# Neither for Fedora nor EPEL which would have %%{rhel} macro defined.
%global lts_designator ""
@@ -300,7 +300,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 26
-%global rpmrelease 0
+%global rpmrelease 1
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -2228,6 +2228,9 @@ cjc.mainProgram(args)
%endif
%changelog
+* Thu Jun 24 2021 Severin Gehwolf <sgehwolf(a)redhat.com> -
1:17.0.0.0.26-0.1.ea.rolling
+- Update buildjdkver to 17 so as to build with itself
+
* Fri Jun 11 2021 Petra Alice Mikova <pmikova(a)redhat.com> -
1:17.0.0.0.26-0.0.ea.rolling
- update sources to jdk 17.0.0+26
- set is_ga to 0, as this is early access build
commit 825f19b8f0c4d7d432a5eecf4b81e2b75d806a65
Author: Petra Mikova <pmikova(a)redhat.com>
Date: Mon Jun 21 14:11:16 2021 +0200
Fix bogus date in changelog to get rid of the warning
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index f4f5280..5c84136 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -2243,7 +2243,7 @@ cjc.mainProgram(args)
* Fri May 07 2021 Jiri Vanek <jvanek(a)redhat.com> -1:16.0.1.0.9-3.rolling
- removed cjc backward comaptiblity, to fix when both rpm 4.16 and 4.17 are in
transaction
-* Fri Apr 29 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:16.0.1.0.9-2.rolling
+* Thu Apr 29 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:16.0.1.0.9-2.rolling
- adapted to newst cjc to fix issue with rpm 4.17
- Disable copy-jdk-configs for Flatpak builds
commit 404b8548a4029ea671ef30e7cd8a52b684bb9192
Author: Petra Mikova <pmikova(a)redhat.com>
Date: Fri Jun 11 11:56:54 2021 +0200
Update to JDK 17
Change path to version-number.conf
Bump sources to 17.0.0+26
Change vendor_version_string
Set is_ga to 0, as this is early access build
removed rmid binary from files and from slaves
removed JAVAC_FLAGS=-g from make command, as it breaks the build since JDK-8258407
add lib/libsyslookup.so to files
renamed lib/security/blacklisted.certs to lib/security/blocked.certs
add lib/libsvml.so for intel
skip debuginfo check for libsyslookup.so on s390x
diff --git a/.gitignore b/.gitignore
index ee2518e..620751c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -15,3 +15,4 @@
/jdk-updates-jdk15u-jdk-15.0.2+7.tar.xz
/openjdk-jdk16-jdk-16+36.tar.xz
/openjdk-jdk16u-jdk-16.0.1+9.tar.xz
+/openjdk-jdk17-jdk-17+26.tar.xz
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 34222c4..f4f5280 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -125,6 +125,8 @@
%global zgc_arches x86_64
# Set of architectures for which alt-java has SSB mitigation
%global ssbd_arches x86_64
+# Set of architectures for which java has short vector math library (libsvml.so)
+%global svml_arches x86_64
# By default, we build a debug build during main build on JIT architectures
%if %{with slowdebug}
@@ -272,14 +274,14 @@
%endif
# New Version-String scheme-style defines
-%global featurever 16
+%global featurever 17
%global interimver 0
-%global updatever 1
+%global updatever 0
%global patchver 0
# If you bump featurever, you must bump also vendor_version_string
-# Used via new version scheme. JDK 16 was
-# GA'ed in March 2020 => 21.3
-%global vendor_version_string 21.3
+# Used via new version scheme. JDK 17 was
+# GA'ed in September 2021 => 21.9
+%global vendor_version_string 21.9
# buildjdkver is usually same as %%{featurever},
# but in time of bootstrap of next jdk, it is featurever-1,
# and this it is better to change it here, on single place
@@ -297,8 +299,8 @@
%global origin_nice OpenJDK
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver 9
-%global rpmrelease 3
+%global buildver 26
+%global rpmrelease 0
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -321,7 +323,7 @@
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
# - N%%{?extraver}{?dist} for GA releases
-%global is_ga 1
+%global is_ga 0
%if %{is_ga}
%global build_type GA
%global expected_ea_designator ""
@@ -449,7 +451,6 @@ alternatives \\
--slave %{_jvmdir}/jre jre %{_jvmdir}/%{sdkdir -- %{?1}} \\
--slave %{_bindir}/%{alt_java_name} %{alt_java_name} %{jrebindir --
%{?1}}/%{alt_java_name} \\
--slave %{_bindir}/keytool keytool %{jrebindir -- %{?1}}/keytool \\
- --slave %{_bindir}/rmid rmid %{jrebindir -- %{?1}}/rmid \\
--slave %{_bindir}/rmiregistry rmiregistry %{jrebindir -- %{?1}}/rmiregistry \\
--slave %{_mandir}/man1/java.1$ext java.1$ext \\
%{_mandir}/man1/java-%{uniquesuffix -- %{?1}}.1$ext \\
@@ -457,8 +458,6 @@ alternatives \\
%{_mandir}/man1/%{alt_java_name}-%{uniquesuffix -- %{?1}}.1$ext \\
--slave %{_mandir}/man1/keytool.1$ext keytool.1$ext \\
%{_mandir}/man1/keytool-%{uniquesuffix -- %{?1}}.1$ext \\
- --slave %{_mandir}/man1/rmid.1$ext rmid.1$ext \\
- %{_mandir}/man1/rmid-%{uniquesuffix -- %{?1}}.1$ext \\
--slave %{_mandir}/man1/rmiregistry.1$ext rmiregistry.1$ext \\
%{_mandir}/man1/rmiregistry-%{uniquesuffix -- %{?1}}.1$ext
@@ -515,9 +514,6 @@ ext=.gz
alternatives \\
--install %{_bindir}/javac javac %{sdkbindir -- %{?1}}/javac $PRIORITY --family
%{name}.%{_arch} \\
--slave %{_jvmdir}/java java_sdk %{_jvmdir}/%{sdkdir -- %{?1}} \\
-%ifarch %{aot_arches}
- --slave %{_bindir}/jaotc jaotc %{sdkbindir -- %{?1}}/jaotc \\
-%endif
--slave %{_bindir}/jlink jlink %{sdkbindir -- %{?1}}/jlink \\
--slave %{_bindir}/jmod jmod %{sdkbindir -- %{?1}}/jmod \\
%ifarch %{sa_arches}
@@ -669,7 +665,6 @@ exit 0
%{_jvmdir}/%{sdkdir -- %{?1}}/bin/java
%{_jvmdir}/%{sdkdir -- %{?1}}/bin/%{alt_java_name}
%{_jvmdir}/%{sdkdir -- %{?1}}/bin/keytool
-%{_jvmdir}/%{sdkdir -- %{?1}}/bin/rmid
%{_jvmdir}/%{sdkdir -- %{?1}}/bin/rmiregistry
%dir %{_jvmdir}/%{sdkdir -- %{?1}}/lib
%ifarch %{jit_arches}
@@ -715,6 +710,10 @@ exit 0
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsaproc.so
%endif
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsctp.so
+%ifarch %{svml_arches}
+%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsvml.so
+%endif
+%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsyslookup.so
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libverify.so
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libzip.so
%dir %{_jvmdir}/%{sdkdir -- %{?1}}/lib/jfr
@@ -723,7 +722,6 @@ exit 0
%{_mandir}/man1/java-%{uniquesuffix -- %{?1}}.1*
%{_mandir}/man1/%{alt_java_name}-%{uniquesuffix -- %{?1}}.1*
%{_mandir}/man1/keytool-%{uniquesuffix -- %{?1}}.1*
-%{_mandir}/man1/rmid-%{uniquesuffix -- %{?1}}.1*
%{_mandir}/man1/rmiregistry-%{uniquesuffix -- %{?1}}.1*
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/server/
%ifarch %{share_arches}
@@ -742,7 +740,7 @@ exit 0
%dir %{etcjavadir -- %{?1}}/conf/security/policy/limited
%dir %{etcjavadir -- %{?1}}/conf/security/policy/unlimited
%config(noreplace) %{etcjavadir -- %{?1}}/lib/security/default.policy
-%config(noreplace) %{etcjavadir -- %{?1}}/lib/security/blacklisted.certs
+%config(noreplace) %{etcjavadir -- %{?1}}/lib/security/blocked.certs
%config(noreplace) %{etcjavadir -- %{?1}}/lib/security/public_suffix_list.dat
%config(noreplace) %{etcjavadir --
%{?1}}/conf/security/policy/limited/exempt_local.policy
%config(noreplace) %{etcjavadir --
%{?1}}/conf/security/policy/limited/default_local.policy
@@ -811,9 +809,6 @@ exit 0
%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jstat
%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jstatd
%{_jvmdir}/%{sdkdir -- %{?1}}/bin/serialver
-%ifarch %{aot_arches}
-%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jaotc
-%endif
%{_jvmdir}/%{sdkdir -- %{?1}}/include
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/ct.sym
%if %{with_systemtap}
@@ -843,9 +838,6 @@ exit 0
%{_mandir}/man1/jmod-%{uniquesuffix -- %{?1}}.1.gz
%{_mandir}/man1/jshell-%{uniquesuffix -- %{?1}}.1.gz
%{_mandir}/man1/jfr-%{uniquesuffix -- %{?1}}.1.gz
-%ifarch %{aot_arches}
-%{_mandir}/man1/jaotc-%{uniquesuffix -- %{?1}}.1.gz
-%endif
%if %{with_systemtap}
%dir %{tapsetroot}
@@ -858,7 +850,6 @@ exit 0
%ghost %{_bindir}/javac
%ghost %{_jvmdir}/java
%ghost %{_jvmdir}/%{alt_java_name}
-%ghost %{_bindir}/jaotc
%ghost %{_bindir}/jlink
%ghost %{_bindir}/jmod
%ghost %{_bindir}/jhsdb
@@ -1117,7 +1108,7 @@ URL:
http://openjdk.java.net/
# to regenerate source0 (jdk) run update_package.sh
# update_package.sh contains hard-coded repos, revisions, tags, and projects to
regenerate the source archives
-Source0:
openjdk-jdk%{featurever}u-jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}.tar.xz
+Source0:
openjdk-jdk%{featurever}-jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}.tar.xz
#Source0: openjdk-jdk%{featurever}-jdk-%{filever}+%{buildver}.tar.xz
# Use 'icedtea_sync.sh' to update the following
@@ -1642,7 +1633,7 @@ top_dir_abs_build_path=$(pwd)/%{buildoutputdir -- ${suffix}${loop}}
# default pre-version supplied there (despite
# what the file claims), so we pass it manually
# to configure
-VERSION_FILE=${top_dir_abs_src_path}/make/autoconf/version-numbers
+VERSION_FILE=${top_dir_abs_src_path}/make/conf/version-numbers.conf
if [ -f ${VERSION_FILE} ] ; then
EA_DESIGNATOR=$(grep '^DEFAULT_PROMOTED_VERSION_PRE' ${VERSION_FILE} | cut -d
'=' -f 2)
else
@@ -1695,7 +1686,6 @@ bash ${top_dir_abs_src_path}/configure \
--disable-warnings-as-errors
make \
- JAVAC_FLAGS=-g \
LOG=trace \
WARNINGS_ARE_ERRORS="-Wno-error" \
CFLAGS_WARNINGS_ARE_ERRORS="-Wno-error" \
@@ -1797,6 +1787,14 @@ do
# All these tests rely on RPM failing the build if the exit code of any set
# of piped commands is non-zero.
+ # If this is the empty library, libsyslookup.so, of the foreign function and memory
+ # API incubation module (JEP 412), skip the debuginfo check as this seems unreliable
+ # on s390x. It's not very useful for other arches either, so skip
unconditionally.
+ if [ "`basename $lib`" = "libsyslookup.so" ]; then
+ echo "Skipping debuginfo check for empty library
'libsyslookup.so'"
+ continue
+ fi
+
# Test for .debug_* sections in the shared object. This is the main test
# Stripped objects will not contain these
eu-readelf -S "$lib" | grep "] .debug_"
@@ -2230,6 +2228,18 @@ cjc.mainProgram(args)
%endif
%changelog
+* Fri Jun 11 2021 Petra Alice Mikova <pmikova(a)redhat.com> -
1:17.0.0.0.26-0.0.ea.rolling
+- update sources to jdk 17.0.0+26
+- set is_ga to 0, as this is early access build
+- change vendor_version_string
+- change path to the version-numbers.conf
+- removed rmid binary from files and from slaves
+- removed JAVAC_FLAGS=-g from make command, as it breaks the build since JDK-8258407
+- add lib/libsyslookup.so to files
+- renamed lib/security/blacklisted.certs to lib/security/blocked.certs
+- add lib/libsvml.so for intel
+- skip debuginfo check for libsyslookup.so on s390x
+
* Fri May 07 2021 Jiri Vanek <jvanek(a)redhat.com> -1:16.0.1.0.9-3.rolling
- removed cjc backward comaptiblity, to fix when both rpm 4.16 and 4.17 are in
transaction
diff --git a/sources b/sources
index 0349b1c..4bb4cd6 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (openjdk-jdk16u-jdk-16.0.1+9.tar.xz) =
ff06d5c97377cac4d5e8921766c61d4d96dc0c968913263b5371f0d3d0e98bb6a5ccf5b1cbb3ddaff3380bf4499ff6501e73f96e0e922b2294d1f7c1ec3eee23
+SHA512 (openjdk-jdk17-jdk-17+26.tar.xz) =
a400889ba4f141ecf29e46e42f2b2a07ba6df0760502467e7925a31e88ec6fa07deec99f919a42fd673b30df5c86f2adf5e0dcb00687404f0715527b79f2fec7
commit a1a350dc3aad42f8a6c05a8de50bf696b02ab4ae
Author: Jiri Vanek <jvanek(a)redhat.com>
Date: Fri May 7 15:04:52 2021 +0200
removed cjc backward comaptiblity, to fix when both rpm 4.16 and 4.17 are in
transaction
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 4f60d1d..34222c4 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 9
-%global rpmrelease 2
+%global rpmrelease 3
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -971,7 +971,7 @@ Requires: lksctp-tools%{?_isa}
# tool to copy jdk's configs - should be Recommends only, but then only dnf/yum
enforce it,
# not rpm transaction and so no configs are persisted when pure rpm -u is run. It may be
# considered as regression
-Requires: copy-jdk-configs >= 3.9
+Requires: copy-jdk-configs >= 4.0
OrderWithRequires: copy-jdk-configs
%endif
# for printing support
@@ -2040,10 +2040,10 @@ else
return
end
end
--- run content of included file with fake args
+arg = nil ; -- it is better to null the arg up, no meter if they exists or not, and use
cjc as module in unified way, instead of relaying on "main" method during
require "copy_jdk_configs.lua"
cjc = require "copy_jdk_configs.lua"
-arg = {"--currentjvm", "%{uniquesuffix %{nil}}",
"--jvmdir", "%{_jvmdir %{nil}}", "--origname",
"%{name}", "--origjavaver", "%{javaver}",
"--arch", "%{_arch}", "--temp",
"%{rpm_state_dir}/%{name}.%{_arch}"}
-cjc.mainProgram(arg)
+args = {"--currentjvm", "%{uniquesuffix %{nil}}",
"--jvmdir", "%{_jvmdir %{nil}}", "--origname",
"%{name}", "--origjavaver", "%{javaver}",
"--arch", "%{_arch}", "--temp",
"%{rpm_state_dir}/%{name}.%{_arch}"}
+cjc.mainProgram(args)
%post
%{post_script %{nil}}
@@ -2230,6 +2230,9 @@ cjc.mainProgram(arg)
%endif
%changelog
+* Fri May 07 2021 Jiri Vanek <jvanek(a)redhat.com> -1:16.0.1.0.9-3.rolling
+- removed cjc backward comaptiblity, to fix when both rpm 4.16 and 4.17 are in
transaction
+
* Fri Apr 29 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:16.0.1.0.9-2.rolling
- adapted to newst cjc to fix issue with rpm 4.17
- Disable copy-jdk-configs for Flatpak builds
commit 51bd7e14daf340745688a262abe640cdff94a5ea
Author: Jiri <jvanek(a)redhat.com>
Date: Fri Apr 30 08:22:12 2021 +0200
Disable copy-jdk-configs for Flatpak builds
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index c7f48c6..4f60d1d 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -967,11 +967,13 @@ Requires: tzdata-java >= 2015d
# for support of kernel stream control
# libsctp.so.1 is being `dlopen`ed on demand
Requires: lksctp-tools%{?_isa}
+%if ! 0%{?flatpak}
# tool to copy jdk's configs - should be Recommends only, but then only dnf/yum
enforce it,
# not rpm transaction and so no configs are persisted when pure rpm -u is run. It may be
# considered as regression
Requires: copy-jdk-configs >= 3.9
OrderWithRequires: copy-jdk-configs
+%endif
# for printing support
Requires: cups-libs
# Post requires alternatives to install tool alternatives
@@ -2230,6 +2232,7 @@ cjc.mainProgram(arg)
%changelog
* Fri Apr 29 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:16.0.1.0.9-2.rolling
- adapted to newst cjc to fix issue with rpm 4.17
+- Disable copy-jdk-configs for Flatpak builds
* Sun Apr 25 2021 Petra Alice Mikova <pmikova(a)redhat.com> - 1:16.0.1.0.9-1.rolling
- update to 16.0.1+9 april cpu tag
commit 3d30d08e0a176bbd97d4e624e763696a941134a6
Author: Jiri <jvanek(a)redhat.com>
Date: Thu Apr 29 17:46:13 2021 +0200
Adapted to rpm 4.17 and cjc 4.0
As rpm 4.17 dropped arg from varaibale table, cjc now have to be sued as
module. cjc 4.0 was converted to module
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index ed3ef5f..c7f48c6 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -298,7 +298,7 @@
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 9
-%global rpmrelease 1
+%global rpmrelease 2
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -970,7 +970,7 @@ Requires: lksctp-tools%{?_isa}
# tool to copy jdk's configs - should be Recommends only, but then only dnf/yum
enforce it,
# not rpm transaction and so no configs are persisted when pure rpm -u is run. It may be
# considered as regression
-Requires: copy-jdk-configs >= 3.3
+Requires: copy-jdk-configs >= 3.9
OrderWithRequires: copy-jdk-configs
# for printing support
Requires: cups-libs
@@ -2004,7 +2004,13 @@ done
-- whether copy-jdk-configs is installed or not. If so, then configs are copied
-- (copy_jdk_configs from %%{_libexecdir} used) or not copied at all
local posix = require "posix"
-local debug = false
+
+if (os.getenv("debug") == "true") then
+ debug = true;
+ print("cjc: in spec debug is on")
+else
+ debug = false;
+end
SOURCE1 = "%{rpm_state_dir}/copy_jdk_configs.lua"
SOURCE2 = "%{_libexecdir}/copy_jdk_configs.lua"
@@ -2033,8 +2039,9 @@ else
end
end
-- run content of included file with fake args
+cjc = require "copy_jdk_configs.lua"
arg = {"--currentjvm", "%{uniquesuffix %{nil}}",
"--jvmdir", "%{_jvmdir %{nil}}", "--origname",
"%{name}", "--origjavaver", "%{javaver}",
"--arch", "%{_arch}", "--temp",
"%{rpm_state_dir}/%{name}.%{_arch}"}
-require "copy_jdk_configs.lua"
+cjc.mainProgram(arg)
%post
%{post_script %{nil}}
@@ -2221,6 +2228,9 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Fri Apr 29 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:16.0.1.0.9-2.rolling
+- adapted to newst cjc to fix issue with rpm 4.17
+
* Sun Apr 25 2021 Petra Alice Mikova <pmikova(a)redhat.com> - 1:16.0.1.0.9-1.rolling
- update to 16.0.1+9 april cpu tag
- dropped jdk8259949-allow_cf-protection_on_x86.patch
commit cd1b221136f7ca566b98ce2919d3772558fe7f95
Author: Petra Mikova <pmikova(a)redhat.com>
Date: Mon Apr 26 12:04:21 2021 +0200
Add forgotten changelog
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 38e06a6..ed3ef5f 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -2221,6 +2221,10 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Sun Apr 25 2021 Petra Alice Mikova <pmikova(a)redhat.com> - 1:16.0.1.0.9-1.rolling
+- update to 16.0.1+9 april cpu tag
+- dropped jdk8259949-allow_cf-protection_on_x86.patch
+
* Thu Mar 11 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:16.0.0.0.36-2.rolling
- Perform static library build on a separate source tree with bundled image libraries
- Make static library build optional
commit ed8c45a36f56905023e117541fb6a3d5f98c3c5c
Author: Petra Mikova <pmikova(a)redhat.com>
Date: Wed Apr 21 16:38:36 2021 +0200
April CPU update
Generated new sources and removed obsoleted patch
diff --git a/.gitignore b/.gitignore
index dc0dce0..ee2518e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -14,3 +14,4 @@
/tapsets-icedtea-3.15.0.tar.xz
/jdk-updates-jdk15u-jdk-15.0.2+7.tar.xz
/openjdk-jdk16-jdk-16+36.tar.xz
+/openjdk-jdk16u-jdk-16.0.1+9.tar.xz
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index d4101a3..38e06a6 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -274,7 +274,7 @@
# New Version-String scheme-style defines
%global featurever 16
%global interimver 0
-%global updatever 0
+%global updatever 1
%global patchver 0
# If you bump featurever, you must bump also vendor_version_string
# Used via new version scheme. JDK 16 was
@@ -297,8 +297,8 @@
%global origin_nice OpenJDK
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver 36
-%global rpmrelease 2
+%global buildver 9
+%global rpmrelease 1
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -1115,8 +1115,8 @@ URL:
http://openjdk.java.net/
# to regenerate source0 (jdk) run update_package.sh
# update_package.sh contains hard-coded repos, revisions, tags, and projects to
regenerate the source archives
-#Source0:
openjdk-jdk%{featurever}u-jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}.tar.xz
-Source0: openjdk-jdk%{featurever}-jdk-%{filever}+%{buildver}.tar.xz
+Source0:
openjdk-jdk%{featurever}u-jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}.tar.xz
+#Source0: openjdk-jdk%{featurever}-jdk-%{filever}+%{buildver}.tar.xz
# Use 'icedtea_sync.sh' to update the following
# They are based on code contained in the IcedTea project (3.x).
@@ -1165,8 +1165,6 @@ Patch3:
rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk1
Patch4: pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch
# Depend on pcs-lite-libs instead of pcs-lite-devel as this is only in optional repo
Patch6:
rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
-# JDK-8259949: Use i686 instead of i586 on x86 when -fcf-protection is passed to the
compiler, as CMOV is needed
-Patch8: jdk8259949-allow_cf-protection_on_x86.patch
#############################################
#
@@ -1523,7 +1521,6 @@ pushd %{top_level_dir_name}
%patch3 -p1
%patch4 -p1
%patch6 -p1
-%patch8 -p1
popd # openjdk
%patch1000
diff --git a/jdk8259949-allow_cf-protection_on_x86.patch
b/jdk8259949-allow_cf-protection_on_x86.patch
deleted file mode 100644
index 283fecf..0000000
--- a/jdk8259949-allow_cf-protection_on_x86.patch
+++ /dev/null
@@ -1,27 +0,0 @@
-diff --git openjdk.orig/make/autoconf/flags-cflags.m4
openjdk/make/autoconf/flags-cflags.m4
---- openjdk.orig/make/autoconf/flags-cflags.m4
-+++ openjdk/make/autoconf/flags-cflags.m4
-@@ -715,9 +715,21 @@
- # CFLAGS PER CPU
- if test "x$TOOLCHAIN_TYPE" = xgcc || test "x$TOOLCHAIN_TYPE" =
xclang; then
- # COMMON to gcc and clang
-+ AC_MSG_CHECKING([if $1 is x86])
- if test "x$FLAGS_CPU" = xx86; then
-- # Force compatibility with i586 on 32 bit intel platforms.
-- $1_CFLAGS_CPU="-march=i586"
-+ AC_MSG_RESULT([yes])
-+ AC_MSG_CHECKING([if control flow protection is enabled by additional compiler
flags])
-+ if echo "${EXTRA_CFLAGS}${EXTRA_CXXFLAGS}${EXTRA_ASFLAGS}" | ${GREP} -q
'fcf-protection' ; then
-+ # cf-protection requires CMOV and thus i686
-+ $1_CFLAGS_CPU="-march=i686"
-+ AC_MSG_RESULT([yes, forcing ${$1_CFLAGS_CPU}])
-+ else
-+ # Force compatibility with i586 on 32 bit intel platforms.
-+ $1_CFLAGS_CPU="-march=i586"
-+ AC_MSG_RESULT([no, forcing ${$1_CFLAGS_CPU}])
-+ fi
-+ else
-+ AC_MSG_RESULT([no])
- fi
- fi
-
diff --git a/sources b/sources
index c91ba79..0349b1c 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (openjdk-jdk16-jdk-16+36.tar.xz) =
8fc618b960eb6d982d408dd5607dea61f230895b2e2b233793308048ae004868595f501e56a1ab79c3d6aa5b638e06f58383c34d0a09fb321f48678a3a89f5f4
+SHA512 (openjdk-jdk16u-jdk-16.0.1+9.tar.xz) =
ff06d5c97377cac4d5e8921766c61d4d96dc0c968913263b5371f0d3d0e98bb6a5ccf5b1cbb3ddaff3380bf4499ff6501e73f96e0e922b2294d1f7c1ec3eee23
commit 7ba3ca3fe3c0a8f530d0cd64a4d0357d9ecee1ea
Author: Severin Gehwolf <sgehwolf(a)redhat.com>
Date: Thu Mar 11 14:30:42 2021 +0100
Perform static library build on a separate source tree with bundled image libraries
Make static library build optional
Ported from java-11-openjdk. Work of Andrew Hughes.
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 9a16a47..d4101a3 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -22,9 +22,16 @@
%bcond_without slowdebug
# Enable release builds by default on relevant arches.
%bcond_without release
+# Enable static library builds by default.
+%bcond_without staticlibs
# Workaround for stripping of debug symbols from static libraries
+%if %{with staticlibs}
%define __brp_strip_static_archive %{nil}
+%global include_staticlibs 1
+%else
+%global include_staticlibs 0
+%endif
# The -g flag says to use strip -g instead of full strip on DSOs or EXEs.
# This fixes detailed NMT and other tools which need minimal debug info.
@@ -42,10 +49,14 @@
# (initiated in
https://bugzilla.redhat.com/show_bug.cgi?id=1482192)
%global debug_suffix_unquoted -slowdebug
%global fastdebug_suffix_unquoted -fastdebug
+%global main_suffix_unquoted -main
+%global staticlibs_suffix_unquoted -staticlibs
# quoted one for shell operations
%global debug_suffix "%{debug_suffix_unquoted}"
%global fastdebug_suffix "%{fastdebug_suffix_unquoted}"
%global normal_suffix ""
+%global main_suffix "%{main_suffix_unquoted}"
+%global staticlibs_suffix "%{staticlibs_suffix_unquoted}"
%global debug_warning This package is unoptimised with full debugging. Install only as
needed and remove ASAP.
%global debug_on with full debugging on
@@ -162,6 +173,12 @@
# Test slowdebug first as it provides the best diagnostics
%global rev_build_loop %{slowdebug_build} %{fastdebug_build} %{normal_build}
+%if %{include_staticlibs}
+%global staticlibs_loop %{staticlibs_suffix}
+%else
+%global staticlibs_loop %{nil}
+%endif
+
%ifarch %{bootstrap_arches}
%global bootstrap_build 1
%else
@@ -169,12 +186,20 @@
%endif
%if %{bootstrap_build}
-%global release_targets bootcycle-images static-libs-image docs-zip
+%global release_targets bootcycle-images docs-zip
%else
-%global release_targets images docs-zip static-libs-image
+%global release_targets images docs-zip
%endif
# No docs nor bootcycle for debug builds
-%global debug_targets images static-libs-image
+%global debug_targets images
+
+%if %{include_staticlibs}
+# Extra target for producing the static-libraries. Separate from
+# other targets since this target is configured to use in-tree
+# AWT dependencies: lcms, libjpeg, libpng, libharfbuzz, giflib
+# and possibly others
+%global static_libs_target static-libs-image
+%endif
# Filter out flags from the optflags macro that cause problems with the OpenJDK build
@@ -271,8 +296,9 @@
%global origin openjdk
%global origin_nice OpenJDK
%global top_level_dir_name %{origin}
+%global top_level_dir_name_backup %{top_level_dir_name}-backup
%global buildver 36
-%global rpmrelease 1
+%global rpmrelease 2
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -334,7 +360,7 @@
%global jdkimage jdk
%global static_libs_image static-libs
# output dir stub
-%define buildoutputdir() %{expand:openjdk/build%{?1}}
+%define buildoutputdir() %{expand:build/jdk%{featurever}.build%{?1}}
# we can copy the javadoc to not arched dir, or make it not noarch
%define uniquejavadocdir() %{expand:%{fullversion}.%{_arch}%{?1}}
# main id and dir of this jdk
@@ -1288,6 +1314,8 @@ The %{origin_nice} %{featurever} development tools .
%{fastdebug_warning}
%endif
+%if %{include_staticlibs}
+
%if %{include_normal_build}
%package static-libs
Summary: %{origin_nice} %{featurever} libraries for static linking
@@ -1320,6 +1348,9 @@ The %{origin_nice} %{featurever} libraries for static linking.
%{fastdebug_warning}
%endif
+# staticlibs
+%endif
+
%if %{include_normal_build}
%package jmods
Summary: JMods for %{origin_nice} %{featurever}
@@ -1482,9 +1513,10 @@ if [ $prioritylength -ne 8 ] ; then
fi
# OpenJDK patches
+# Remove libraries that are linked by both static and dynamic builds
+sh %{SOURCE12} %{top_level_dir_name}
-# Remove libraries that are linked
-sh %{SOURCE12}
+# Patch the JDK
pushd %{top_level_dir_name}
%patch1 -p1
%patch2 -p1
@@ -1581,16 +1613,37 @@ else
debugbuild=`echo $suffix | sed "s/-//g"`
fi
-# Variable used in hs_err hook on build failures
-top_dir_abs_path=$(pwd)/%{top_level_dir_name}
+for loop in %{main_suffix} %{staticlibs_loop} ; do
+
+if test "x${loop}" = "x%{main_suffix}" ; then
+ # Copy the source tree so we can remove all in-tree libraries
+ cp -a %{top_level_dir_name} %{top_level_dir_name_backup}
+ # Remove all libraries that are linked
+ sh %{SOURCE12} %{top_level_dir_name} full
+ # Variable used by configure and hs_err hook on build failures
+ link_opt="system"
+ # Debug builds don't need same targets as release for
+ # build speed-up
+ maketargets="%{release_targets}"
+ if echo $debugbuild | grep -q "debug" ; then
+ maketargets="%{debug_targets}"
+ fi
+else
+ # Variable used by configure and hs_err hook on build failures
+ link_opt="bundled"
+ # Static library cycle only builds the static libraries
+ maketargets="%{static_libs_target}"
+fi
+top_dir_abs_src_path=$(pwd)/%{top_level_dir_name}
+top_dir_abs_build_path=$(pwd)/%{buildoutputdir -- ${suffix}${loop}}
# The OpenJDK version file includes the current
# upstream version information. For some reason,
# configure does not automatically use the
# default pre-version supplied there (despite
# what the file claims), so we pass it manually
# to configure
-VERSION_FILE=${top_dir_abs_path}/make/autoconf/version-numbers
+VERSION_FILE=${top_dir_abs_src_path}/make/autoconf/version-numbers
if [ -f ${VERSION_FILE} ] ; then
EA_DESIGNATOR=$(grep '^DEFAULT_PROMOTED_VERSION_PRE' ${VERSION_FILE} | cut -d
'=' -f 2)
else
@@ -1602,10 +1655,10 @@ if [ "x${EA_DESIGNATOR}" !=
"x%{expected_ea_designator}" ] ; then
exit 17
fi
-mkdir -p %{buildoutputdir -- $suffix}
-pushd %{buildoutputdir -- $suffix}
+mkdir -p ${top_dir_abs_build_path}
+pushd ${top_dir_abs_build_path}
-bash ../configure \
+bash ${top_dir_abs_src_path}/configure \
%ifnarch %{jit_arches}
--with-jvm-variants=zero \
%endif
@@ -1625,11 +1678,11 @@ bash ../configure \
--with-native-debug-symbols=internal \
--enable-unlimited-crypto \
--with-zlib=system \
- --with-libjpeg=system \
- --with-giflib=system \
- --with-libpng=system \
- --with-lcms=system \
- --with-harfbuzz=system \
+ --with-libjpeg=${link_opt} \
+ --with-giflib=${link_opt} \
+ --with-libpng=${link_opt} \
+ --with-lcms=${link_opt} \
+ --with-harfbuzz=${link_opt} \
--with-stdc++lib=dynamic \
--with-extra-cxxflags="$EXTRA_CPP_FLAGS" \
--with-extra-cflags="$EXTRA_CFLAGS" \
@@ -1642,33 +1695,37 @@ bash ../configure \
%endif
--disable-warnings-as-errors
-# Debug builds don't need same targets as release for
-# build speed-up
-maketargets="%{release_targets}"
-if echo $debugbuild | grep -q "debug" ; then
- maketargets="%{debug_targets}"
-fi
make \
JAVAC_FLAGS=-g \
LOG=trace \
WARNINGS_ARE_ERRORS="-Wno-error" \
CFLAGS_WARNINGS_ARE_ERRORS="-Wno-error" \
- $maketargets || ( pwd; find $top_dir_abs_path -name "hs_err_pid*.log" |
xargs cat && false )
+ $maketargets || ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name
"hs_err_pid*.log" | xargs cat && false )
+
+popd >& /dev/null
+
+# Restore original source tree if we modified it by removing full in-tree sources
+if [ -d %{top_level_dir_name_backup} ] ; then
+ rm -rf %{top_level_dir_name}
+ mv %{top_level_dir_name_backup} %{top_level_dir_name}
+fi
+
+done # end of main / staticlibs loop
+
+top_dir_abs_main_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{main_suffix}}
# the build (erroneously) removes read permissions from some jars
# this is a regression in OpenJDK 7 (our compiler):
#
http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=1437
-find images/%{jdkimage} -iname '*.jar' -exec chmod ugo+r {} \;
+find ${top_dir_abs_main_build_path}/images/%{jdkimage} -iname '*.jar' -exec chmod
ugo+r {} \;
# Build screws up permissions on binaries
#
https://bugs.openjdk.java.net/browse/JDK-8173610
-find images/%{jdkimage} -iname '*.so' -exec chmod +x {} \;
-find images/%{jdkimage}/bin/ -exec chmod +x {} \;
-
-popd >& /dev/null
+find ${top_dir_abs_main_build_path}/images/%{jdkimage} -iname '*.so' -exec chmod
+x {} \;
+find ${top_dir_abs_main_build_path}/images/%{jdkimage}/bin/ -exec chmod +x {} \;
# Install nss.cfg right away as we will be using the JRE above
-export JAVA_HOME=$(pwd)/%{buildoutputdir -- $suffix}/images/%{jdkimage}
+export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage}
# Install nss.cfg right away as we will be using the JRE above
install -m 644 nss.cfg $JAVA_HOME/conf/security/
@@ -1685,14 +1742,19 @@ cat man/man1/java.1 >> man/man1/%{alt_java_name}.1
popd
# build cycles
-done
+done # end of release / debug cycle loop
%check
# We test debug first as it will give better diagnostics on a crash
for suffix in %{rev_build_loop} ; do
-export JAVA_HOME=$(pwd)/%{buildoutputdir -- $suffix}/images/%{jdkimage}
+top_dir_abs_main_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{main_suffix}}
+%if %{include_staticlibs}
+top_dir_abs_staticlibs_build_path=$(pwd)/%{buildoutputdir --
${suffix}%{staticlibs_loop}}
+%endif
+
+export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage}
#check Shenandoah is enabled
%if %{use_shenandoah_hotspot}
@@ -1721,10 +1783,12 @@ nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation
if ! nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation ; then true ; else false;
fi
%endif
+%if %{include_staticlibs}
# Check debug symbols in static libraries (smoke test)
-export STATIC_LIBS_HOME=$(pwd)/%{buildoutputdir -- $suffix}/images/%{static_libs_image}
+export STATIC_LIBS_HOME=${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image}
readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep w_remainder.c
readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep e_remainder.c
+%endif
# Check debug symbols are present and can identify code
find "$JAVA_HOME" -iname '*.so' -print0 | while read -d $'\0'
lib
@@ -1815,12 +1879,17 @@ STRIP_KEEP_SYMTAB=libjvm*
for suffix in %{build_loop} ; do
+top_dir_abs_main_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{main_suffix}}
+%if %{include_staticlibs}
+top_dir_abs_staticlibs_build_path=$(pwd)/%{buildoutputdir --
${suffix}%{staticlibs_loop}}
+%endif
+jdk_image=${top_dir_abs_main_build_path}/images/%{jdkimage}
+
# Install the jdk
mkdir -p $RPM_BUILD_ROOT%{_jvmdir}
-cp -a %{buildoutputdir -- $suffix}/images/%{jdkimage} \
- $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}
+cp -a ${jdk_image} $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}
-pushd %{buildoutputdir $suffix}/images/%{jdkimage}
+pushd ${jdk_image}
%if %{with_systemtap}
# Install systemtap support files
@@ -1864,17 +1933,19 @@ pushd %{buildoutputdir $suffix}/images/%{jdkimage}
popd
# Install static libs artefacts
+%if %{include_staticlibs}
mkdir -p $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir --
$suffix}/lib/static/linux-%{archinstall}/glibc
-cp -a %{buildoutputdir -- $suffix}/images/%{static_libs_image}/lib/*.a \
+cp -a ${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image}/lib/*.a \
$RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/lib/static/linux-%{archinstall}/glibc
+%endif
if ! echo $suffix | grep -q "debug" ; then
# Install Javadoc documentation
install -d -m 755 $RPM_BUILD_ROOT%{_javadocdir}
- cp -a %{buildoutputdir -- $suffix}/images/docs
$RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}
+ cp -a ${top_dir_abs_main_build_path}/images/docs
$RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}
built_doc_archive=jdk-%{filever}%{ea_designator_zip}+%{buildver}%{lts_designator_zip}-docs.zip
- cp -a %{buildoutputdir -- $suffix}/bundles/${built_doc_archive} \
- $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip || ls -l
%{buildoutputdir -- $suffix}/bundles/
+ cp -a ${top_dir_abs_main_build_path}/bundles/${built_doc_archive} \
+ $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip || ls -l
${top_dir_abs_main_build_path}/bundles/
fi
# Install release notes
@@ -2077,8 +2148,10 @@ require "copy_jdk_configs.lua"
%files devel
%{files_devel %{nil}}
+%if %{include_staticlibs}
%files static-libs
%{files_static_libs %{nil}}
+%endif
%files jmods
%{files_jmods %{nil}}
@@ -2109,8 +2182,10 @@ require "copy_jdk_configs.lua"
%files devel-slowdebug
%{files_devel -- %{debug_suffix_unquoted}}
+%if %{include_staticlibs}
%files static-libs-slowdebug
%{files_static_libs -- %{debug_suffix_unquoted}}
+%endif
%files jmods-slowdebug
%{files_jmods -- %{debug_suffix_unquoted}}
@@ -2132,8 +2207,10 @@ require "copy_jdk_configs.lua"
%files devel-fastdebug
%{files_devel -- %{fastdebug_suffix_unquoted}}
+%if %{include_staticlibs}
%files static-libs-fastdebug
%{files_static_libs -- %{fastdebug_suffix_unquoted}}
+%endif
%files jmods-fastdebug
%{files_jmods -- %{fastdebug_suffix_unquoted}}
@@ -2147,6 +2224,11 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Thu Mar 11 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:16.0.0.0.36-2.rolling
+- Perform static library build on a separate source tree with bundled image libraries
+- Make static library build optional
+- Based on initial work by Severin Gehwolf
+
* Tue Mar 09 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:16.0.0.0.36-1.rolling
- fixed suggests of wrong pcsc-lite-devel%{?_isa} to correct pcsc-lite-libs%{?_isa}
- bumped buildjdkver to build by itself - 16
diff --git a/remove-intree-libraries.sh b/remove-intree-libraries.sh
index 635da8a..e999c7e 100644
--- a/remove-intree-libraries.sh
+++ b/remove-intree-libraries.sh
@@ -1,24 +1,52 @@
#!/bin/sh
+# Arguments: <JDK TREE> <MINIMAL|FULL>
+TREE=${1}
+TYPE=${2}
+
ZIP_SRC=src/java.base/share/native/libzip/zlib/
JPEG_SRC=src/java.desktop/share/native/libjavajpeg/
GIF_SRC=src/java.desktop/share/native/libsplashscreen/giflib/
PNG_SRC=src/java.desktop/share/native/libsplashscreen/libpng/
LCMS_SRC=src/java.desktop/share/native/liblcms/
-cd openjdk
+if test "x${TREE}" = "x"; then
+ echo "$0 <JDK_TREE> (MINIMAL|FULL)";
+ exit 1;
+fi
+
+if test "x${TYPE}" = "x"; then
+ TYPE=minimal;
+fi
+
+if test "x${TYPE}" != "xminimal" -a "x${TYPE}" !=
"xfull"; then
+ echo "Type must be minimal or full";
+ exit 2;
+fi
+
+echo "Removing in-tree libraries from ${TREE}"
+echo "Cleansing operation: ${TYPE}";
+
+cd ${TREE}
echo "Removing built-in libs (they will be linked)"
+# On full runs, allow for zlib having already been deleted by minimal
echo "Removing zlib"
-if [ ! -d ${ZIP_SRC} ]; then
+if [ "x${TYPE}" = "xminimal" -a ! -d ${ZIP_SRC} ]; then
echo "${ZIP_SRC} does not exist. Refusing to proceed."
exit 1
fi
rm -rvf ${ZIP_SRC}
+# Minimal is limited to just zlib so finish here
+if test "x${TYPE}" = "xminimal"; then
+ echo "Finished.";
+ exit 0;
+fi
+
echo "Removing libjpeg"
-if [ ! -f ${JPEG_SRC}/jdhuff.c ]; then # some file that sound definitely exist
+if [ ! -f ${JPEG_SRC}/jdhuff.c ]; then # some file that should definitely exist
echo "${JPEG_SRC} does not contain jpeg sources. Refusing to proceed."
exit 1
fi
commit 551c2470a9698701fe90d6f271892a188aed6ec8
Author: Jiri <jvanek(a)redhat.com>
Date: Tue Mar 9 14:06:19 2021 +0100
bumped buildjdkver to build by itself - 16
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index c01f3b6..9a16a47 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -258,7 +258,7 @@
# buildjdkver is usually same as %%{featurever},
# but in time of bootstrap of next jdk, it is featurever-1,
# and this it is better to change it here, on single place
-%global buildjdkver 15
+%global buildjdkver 16
# We don't add any LTS designator for STS packages (this package).
# Neither for Fedora nor EPEL which would have %%{rhel} macro defined.
%global lts_designator ""
@@ -2149,6 +2149,7 @@ require "copy_jdk_configs.lua"
%changelog
* Tue Mar 09 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:16.0.0.0.36-1.rolling
- fixed suggests of wrong pcsc-lite-devel%{?_isa} to correct pcsc-lite-libs%{?_isa}
+- bumped buildjdkver to build by itself - 16
* Fri Feb 19 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:16.0.0.0.36-0.rolling
- Update to jdk-16.0.0.0+36
commit fbb116c65138c255ec2c771a71f3daf24e8e6360
Author: Jiri <jvanek(a)redhat.com>
Date: Tue Mar 9 10:09:20 2021 +0100
fixed suggests of wrong pcsc-lite-devel%{?_isa} to correct pcsc-lite-libs%{?_isa}
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 36f858e..c01f3b6 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -272,7 +272,7 @@
%global origin_nice OpenJDK
%global top_level_dir_name %{origin}
%global buildver 36
-%global rpmrelease 0
+%global rpmrelease 1
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -953,7 +953,7 @@ Requires(post): %{alternatives_requires}
# Postun requires alternatives to uninstall tool alternatives
Requires(postun): %{alternatives_requires}
# for optional support of kernel stream control, card reader and printing bindings
-Suggests: lksctp-tools%{?_isa}, pcsc-lite-devel%{?_isa}
+Suggests: lksctp-tools%{?_isa}, pcsc-lite-libs%{?_isa}
# Standard JPackage base provides
Provides: jre-%{javaver}-%{origin}-headless%{?1} = %{epoch}:%{version}-%{release}
@@ -2147,7 +2147,10 @@ require "copy_jdk_configs.lua"
%endif
%changelog
-* Fri Feb 19 2021 Andrew Hughes <gnu.andrew(a)redhat.com> -
1:16.0.0.0.36-0.0.ea.rolling
+* Tue Mar 09 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:16.0.0.0.36-1.rolling
+- fixed suggests of wrong pcsc-lite-devel%{?_isa} to correct pcsc-lite-libs%{?_isa}
+
+* Fri Feb 19 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:16.0.0.0.36-0.rolling
- Update to jdk-16.0.0.0+36
- Update tarball generation script to use git following OpenJDK's move to github
- Update tarball generation script to use PR3823 which handles JDK-8235710 changes
commit c5efa6bf325647c5f5011e31462fb72a3d42e797
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Fri Feb 12 08:48:58 2021 +0000
Update to jdk-16.0.0.0+36
Update tarball generation script to use git following OpenJDK's move to github
Update tarball generation script to use PR3823 which handles JDK-8235710 changes
Use upstream default for version-pre rather than setting it to "ea" or
""
Drop libsunec.so which is no longer generated, thanks to JDK-8235710
Drop unnecessary compiler flags, dating back to work on GCC 6 & 10
Adapt RH1750419 alt-java patch to still apply after some variable re-naming in the
makefiles
Update filever to remove any trailing zeros, as in the OpenJDK build, and use for
source filename
Use system harfbuzz now this is supported.
Pass SOURCE_DATE_EPOCH to build for reproducible builds
diff --git a/.gitignore b/.gitignore
index 9203ad8..dc0dce0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -13,3 +13,4 @@
/jdk-updates-jdk15u-jdk-15.0.1+9.tar.xz
/tapsets-icedtea-3.15.0.tar.xz
/jdk-updates-jdk15u-jdk-15.0.2+7.tar.xz
+/openjdk-jdk16-jdk-16+36.tar.xz
diff --git a/generate_source_tarball.sh b/generate_source_tarball.sh
index 6f9564c..1a019ff 100755
--- a/generate_source_tarball.sh
+++ b/generate_source_tarball.sh
@@ -7,9 +7,9 @@
# If you want to use a local copy of patch PR3788, set the path to it in the PR3788
variable
#
# In any case you have to set PROJECT_NAME REPO_NAME and VERSION. eg:
-# PROJECT_NAME=jdk
-# REPO_NAME=jdk
-# VERSION=tip
+# PROJECT_NAME=openjdk
+# REPO_NAME=jdk16
+# VERSION=HEAD
# or to eg prepare systemtap:
# icedtea7's jstack and other tapsets
# VERSION=6327cf1cea9e
@@ -26,16 +26,16 @@
# level folder, name is created, based on parameter
#
-if [ ! "x$PR3803" = "x" ] ; then
- if [ ! -f "$PR3803" ] ; then
- echo "You have specified PR3803 as $PR3803 but it does not exist. Exiting"
+if [ ! "x$PR3823" = "x" ] ; then
+ if [ ! -f "$PR3823" ] ; then
+ echo "You have specified PR3823 as $PR3823 but it does not exist. Exiting"
exit 1
fi
fi
set -e
-OPENJDK_URL_DEFAULT=http://hg.openjdk.java.net
+OPENJDK_URL_DEFAULT=https://github.com
COMPRESSION_DEFAULT=xz
if [ "x$1" = "xhelp" ] ; then
@@ -47,7 +47,7 @@ if [ "x$1" = "xhelp" ] ; then
echo "COMPRESSION - the compression type to use (optional; defaults to
${COMPRESSION_DEFAULT})"
echo "FILE_NAME_ROOT - name of the archive, minus extensions (optional; defaults
to PROJECT_NAME-REPO_NAME-VERSION)"
echo "TO_COMPRESS - what part of clone to pack (default is openjdk)"
- echo "PR3788 - the path to the PR3788 patch to apply (optional; downloaded if
unavailable)"
+ echo "PR3823 - the path to the PR3823 patch to apply (optional; downloaded if
unavailable)"
exit 1;
fi
@@ -90,7 +90,7 @@ if [ "x$FILE_NAME_ROOT" = "x" ] ; then
echo "No file name root specified; default to ${FILE_NAME_ROOT}"
fi
if [ "x$REPO_ROOT" = "x" ] ; then
- REPO_ROOT="${OPENJDK_URL}/${PROJECT_NAME}/${REPO_NAME}"
+ REPO_ROOT="${OPENJDK_URL}/${PROJECT_NAME}/${REPO_NAME}.git"
echo "No repository root specified; default to ${REPO_ROOT}"
fi;
@@ -107,7 +107,7 @@ else
mkdir "${FILE_NAME_ROOT}"
pushd "${FILE_NAME_ROOT}"
echo "Cloning ${VERSION} root repository from ${REPO_ROOT}"
- hg clone ${REPO_ROOT} openjdk -r ${VERSION}
+ git clone -b ${VERSION} ${REPO_ROOT} openjdk
popd
fi
pushd "${FILE_NAME_ROOT}"
@@ -125,18 +125,18 @@ pushd "${FILE_NAME_ROOT}"
rm -vf ${CRYPTO_PATH}/ecp_224.c
echo "Syncing EC list with NSS"
- if [ "x$PR3803" = "x" ] ; then
+ if [ "x$PR3823" = "x" ] ; then
# originally for 8:
- # get PR3803.patch (from
http://icedtea.classpath.org/hg/icedtea15) from
most correct tag
- # Do not push it or publish it (see
https://icedtea.classpath.org/bugzilla/show_bug.cgi?id=3803)
- echo "PR3803 not found. Downloading..."
- wget
https://icedtea.classpath.org/hg/icedtea15/raw-file/d68ffcc9a497/patches/...
- echo "Applying ${PWD}/pr3803.patch"
- patch -Np1 < pr3803.patch
- rm pr3803.patch
+ # get PR3823.patch (from
http://icedtea.classpath.org/hg/icedtea16) from
most correct tag
+ # Do not push it or publish it (see
https://icedtea.classpath.org/bugzilla/show_bug.cgi?id=3823)
+ echo "PR3823 not found. Downloading..."
+ wget
https://icedtea.classpath.org/hg/icedtea16/raw-file/tip/patches/pr3823.patch
+ echo "Applying ${PWD}/pr3823.patch"
+ patch -Np1 < pr3823.patch
+ rm pr3823.patch
else
- echo "Applying ${PR3803}"
- patch -Np1 < $PR3803
+ echo "Applying ${PR3823}"
+ patch -Np1 < $PR3823
fi;
find . -name '*.orig' -exec rm -vf '{}' ';'
popd
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 406f9ed..36f858e 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -247,18 +247,18 @@
%endif
# New Version-String scheme-style defines
-%global featurever 15
+%global featurever 16
%global interimver 0
-%global updatever 2
+%global updatever 0
%global patchver 0
# If you bump featurever, you must bump also vendor_version_string
-# Used via new version scheme. JDK 15 was
-# GA'ed in September 2020 => 20.9
-%global vendor_version_string 20.9
+# Used via new version scheme. JDK 16 was
+# GA'ed in March 2020 => 21.3
+%global vendor_version_string 21.3
# buildjdkver is usually same as %%{featurever},
# but in time of bootstrap of next jdk, it is featurever-1,
# and this it is better to change it here, on single place
-%global buildjdkver %{featurever}
+%global buildjdkver 15
# We don't add any LTS designator for STS packages (this package).
# Neither for Fedora nor EPEL which would have %%{rhel} macro defined.
%global lts_designator ""
@@ -271,8 +271,8 @@
%global origin openjdk
%global origin_nice OpenJDK
%global top_level_dir_name %{origin}
-%global buildver 7
-%global rpmrelease 1
+%global buildver 36
+%global rpmrelease 0
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -286,30 +286,27 @@
%global priority %( printf '%08d' 1 )
%endif
%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
-
-# Omit trailing 0 in filenames when the patch version is 0
-%if 0%{?patchver} > 0
-%global filever %{newjavaver}
-%else
-%global filever %{featurever}.%{interimver}.%{updatever}
-%endif
-
%global javaver %{featurever}
+# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version
used in filenames
+%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done;
echo ${svn})
+
# Define milestone (EA for pre-releases, GA for releases)
# Release will be (where N is usually a number starting at 1):
# - 0.N%%{?extraver}%%{?dist} for EA releases,
# - N%%{?extraver}{?dist} for GA releases
%global is_ga 1
%if %{is_ga}
-%global ea_designator ""
+%global build_type GA
+%global expected_ea_designator ""
%global ea_designator_zip ""
%global extraver %{nil}
%global eaprefix %{nil}
%else
-%global ea_designator ea
-%global ea_designator_zip -%{ea_designator}
-%global extraver .%{ea_designator}
+%global build_type EA
+%global expected_ea_designator ea
+%global ea_designator_zip -%{expected_ea_designator}
+%global extraver .%{expected_ea_designator}
%global eaprefix 0.
%endif
@@ -347,7 +344,7 @@
# fix for
https://bugzilla.redhat.com/show_bug.cgi?id=1111349
#
https://bugzilla.redhat.com/show_bug.cgi?id=1590796#c14
#
https://bugzilla.redhat.com/show_bug.cgi?id=1655938
-%global _privatelibs
libsplashscreen[.]so.*|libawt_xawt[.]so.*|libjli[.]so.*|libattach[.]so.*|libawt[.]so.*|libextnet[.]so.*|libawt_headless[.]so.*|libdt_socket[.]so.*|libfontmanager[.]so.*|libinstrument[.]so.*|libj2gss[.]so.*|libj2pcsc[.]so.*|libj2pkcs11[.]so.*|libjaas[.]so.*|libjavajpeg[.]so.*|libjdwp[.]so.*|libjimage[.]so.*|libjsound[.]so.*|liblcms[.]so.*|libmanagement[.]so.*|libmanagement_agent[.]so.*|libmanagement_ext[.]so.*|libmlib_image[.]so.*|libnet[.]so.*|libnio[.]so.*|libprefs[.]so.*|librmi[.]so.*|libsaproc[.]so.*|libsctp[.]so.*|libsunec[.]so.*|libzip[.]so.*
+%global _privatelibs
libsplashscreen[.]so.*|libawt_xawt[.]so.*|libjli[.]so.*|libattach[.]so.*|libawt[.]so.*|libextnet[.]so.*|libawt_headless[.]so.*|libdt_socket[.]so.*|libfontmanager[.]so.*|libinstrument[.]so.*|libj2gss[.]so.*|libj2pcsc[.]so.*|libj2pkcs11[.]so.*|libjaas[.]so.*|libjavajpeg[.]so.*|libjdwp[.]so.*|libjimage[.]so.*|libjsound[.]so.*|liblcms[.]so.*|libmanagement[.]so.*|libmanagement_agent[.]so.*|libmanagement_ext[.]so.*|libmlib_image[.]so.*|libnet[.]so.*|libnio[.]so.*|libprefs[.]so.*|librmi[.]so.*|libsaproc[.]so.*|libsctp[.]so.*|libzip[.]so.*
%global _publiclibs
libjawt[.]so.*|libjava[.]so.*|libjvm[.]so.*|libverify[.]so.*|libjsig[.]so.*
%if %is_system_jdk
%global __provides_exclude ^(%{_privatelibs})$
@@ -692,7 +689,6 @@ exit 0
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsaproc.so
%endif
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsctp.so
-%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsunec.so
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libverify.so
%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libzip.so
%dir %{_jvmdir}/%{sdkdir -- %{?1}}/lib/jfr
@@ -1093,7 +1089,8 @@ URL:
http://openjdk.java.net/
# to regenerate source0 (jdk) run update_package.sh
# update_package.sh contains hard-coded repos, revisions, tags, and projects to
regenerate the source archives
-Source0:
jdk-updates-jdk%{featurever}u-jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}.tar.xz
+#Source0:
openjdk-jdk%{featurever}u-jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}.tar.xz
+Source0: openjdk-jdk%{featurever}-jdk-%{filever}+%{buildver}.tar.xz
# Use 'icedtea_sync.sh' to update the following
# They are based on code contained in the IcedTea project (3.x).
@@ -1165,6 +1162,7 @@ BuildRequires: freetype-devel
BuildRequires: giflib-devel
BuildRequires: gcc-c++
BuildRequires: gdb
+BuildRequires: harfbuzz-devel
BuildRequires: lcms2-devel
BuildRequires: libjpeg-devel
BuildRequires: libpng-devel
@@ -1566,8 +1564,8 @@ export CFLAGS="$CFLAGS -mieee"
# We use ourcppflags because the OpenJDK build seems to
# pass EXTRA_CFLAGS to the HotSpot C++ compiler...
# Explicitly set the C++ standard as the default has changed on GCC >= 6
-EXTRA_CFLAGS="%ourcppflags -std=gnu++98 -Wno-error -fno-delete-null-pointer-checks
-fno-lifetime-dse -fcommon"
-EXTRA_CPP_FLAGS="%ourcppflags -std=gnu++98 -fno-delete-null-pointer-checks
-fno-lifetime-dse -fcommon"
+EXTRA_CFLAGS="%ourcppflags"
+EXTRA_CPP_FLAGS="%ourcppflags"
%ifarch %{power64} ppc
# fix rpmlint warnings
@@ -1586,6 +1584,24 @@ fi
# Variable used in hs_err hook on build failures
top_dir_abs_path=$(pwd)/%{top_level_dir_name}
+# The OpenJDK version file includes the current
+# upstream version information. For some reason,
+# configure does not automatically use the
+# default pre-version supplied there (despite
+# what the file claims), so we pass it manually
+# to configure
+VERSION_FILE=${top_dir_abs_path}/make/autoconf/version-numbers
+if [ -f ${VERSION_FILE} ] ; then
+ EA_DESIGNATOR=$(grep '^DEFAULT_PROMOTED_VERSION_PRE' ${VERSION_FILE} | cut -d
'=' -f 2)
+else
+ echo "Could not find OpenJDK version file.";
+ exit 16
+fi
+if [ "x${EA_DESIGNATOR}" != "x%{expected_ea_designator}" ] ; then
+ echo "Spec file is configured for a %{build_type} build, but upstream
version-pre setting is ${EA_DESIGNATOR}";
+ exit 17
+fi
+
mkdir -p %{buildoutputdir -- $suffix}
pushd %{buildoutputdir -- $suffix}
@@ -1597,7 +1613,7 @@ bash ../configure \
--with-jobs=1 \
%endif
--with-version-build=%{buildver} \
- --with-version-pre="%{ea_designator}" \
+ --with-version-pre="${EA_DESIGNATOR}" \
--with-version-opt=%{lts_designator} \
--with-vendor-version-string="%{vendor_version_string}" \
--with-vendor-name="Red Hat, Inc." \
@@ -1613,11 +1629,13 @@ bash ../configure \
--with-giflib=system \
--with-libpng=system \
--with-lcms=system \
+ --with-harfbuzz=system \
--with-stdc++lib=dynamic \
--with-extra-cxxflags="$EXTRA_CPP_FLAGS" \
--with-extra-cflags="$EXTRA_CFLAGS" \
--with-extra-ldflags="%{ourldflags}" \
--with-num-cores="$NUM_PROC" \
+ --with-source-date="${SOURCE_DATE_EPOCH}" \
--disable-javac-server \
%ifarch %{zgc_arches}
--with-jvm-features=zgc \
@@ -2129,6 +2147,18 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Fri Feb 19 2021 Andrew Hughes <gnu.andrew(a)redhat.com> -
1:16.0.0.0.36-0.0.ea.rolling
+- Update to jdk-16.0.0.0+36
+- Update tarball generation script to use git following OpenJDK's move to github
+- Update tarball generation script to use PR3823 which handles JDK-8235710 changes
+- Use upstream default for version-pre rather than setting it to "ea" or
""
+- Drop libsunec.so which is no longer generated, thanks to JDK-8235710
+- Drop unnecessary compiler flags, dating back to work on GCC 6 & 10
+- Adapt RH1750419 alt-java patch to still apply after some variable re-naming in the
makefiles
+- Update filever to remove any trailing zeros, as in the OpenJDK build, and use for
source filename
+- Use system harfbuzz now this is supported.
+- Pass SOURCE_DATE_EPOCH to build for reproducible builds
+
* Fri Feb 19 2021 Stephan Bergmann <sbergman(a)redhat.com> - 1:15.0.2.0.7-1.rolling
- Hardcode /usr/sbin/alternatives for Flatpak builds
diff --git a/rh1750419-redhat_alt_java.patch b/rh1750419-redhat_alt_java.patch
index 70f45d4..88f5e5a 100644
--- a/rh1750419-redhat_alt_java.patch
+++ b/rh1750419-redhat_alt_java.patch
@@ -1,25 +1,27 @@
-diff -r 1356affa5e44 make/modules/java.base/Launcher.gmk
---- openjdk/make/modules/java.base/Launcher.gmk
+diff --git openjdk.orig/make/modules/java.base/Launcher.gmk
openjdk/make/modules/java.base/Launcher.gmk
+index 700ddefda49..2882de68eb2 100644
+--- openjdk.orig/make/modules/java.base/Launcher.gmk
+++ openjdk/make/modules/java.base/Launcher.gmk
-@@ -37,6 +37,14 @@
+@@ -41,6 +41,14 @@ $(eval $(call SetupBuildLauncher, java, \
+ OPTIMIZATION := HIGH, \
+ ))
- $(eval $(call SetupBuildLauncher, java, \
- CFLAGS := -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES, \
-+ EXTRA_RC_FLAGS := $(JAVA_RC_FLAGS), \
++#Wno-error=cpp is present to allow commented warning in ifdef part of main.c
++$(eval $(call SetupBuildLauncher, alt-java, \
++ CFLAGS := -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES -DREDHAT_ALT_JAVA
-Wno-error=cpp, \
++ EXTRA_RCFLAGS := $(JAVA_RCFLAGS), \
+ VERSION_INFO_RESOURCE := $(JAVA_VERSION_INFO_RESOURCE), \
+ OPTIMIZATION := HIGH, \
+))
+
-+#Wno-error=cpp is present to allow commented warning in ifdef part of main.c
-+$(eval $(call SetupBuildLauncher, alt-java, \
-+ CFLAGS := -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES -DREDHAT_ALT_JAVA
-Wno-error=cpp, \
- EXTRA_RC_FLAGS := $(JAVA_RC_FLAGS), \
- VERSION_INFO_RESOURCE := $(JAVA_VERSION_INFO_RESOURCE), \
- OPTIMIZATION := HIGH, \
-
-diff -r 25e94aa812b2 src/share/bin/alt_main.h
---- /dev/null Thu Jan 01 00:00:00 1970 +0000
-+++ openjdk/src/java.base/share/native/launcher/alt_main.h Tue Jun 02 17:15:28 2020
+0100
+ ifeq ($(call isTargetOs, windows), true)
+ $(eval $(call SetupBuildLauncher, javaw, \
+ CFLAGS := -DJAVAW -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES, \
+diff --git openjdk.orig/src/java.base/share/native/launcher/alt_main.h
openjdk/src/java.base/share/native/launcher/alt_main.h
+new file mode 100644
+index 00000000000..697df2898ac
+--- /dev/null
++++ openjdk/src/java.base/share/native/launcher/alt_main.h
@@ -0,0 +1,73 @@
+/*
+ * Copyright (c) 2019, Red Hat, Inc. All rights reserved.
@@ -94,9 +96,10 @@ diff -r 25e94aa812b2 src/share/bin/alt_main.h
+}
+
+#endif // REDHAT_ALT_JAVA
-diff -r 25e94aa812b2 src/share/bin/main.c
---- openjdk/src/java.base/share/native/launcher/main.c Wed Feb 05 12:20:36 2020 -0300
-+++ openjdk/src/java.base/share/native/launcher/main.c Tue Jun 02 17:15:28 2020 +0100
+diff --git openjdk.orig/src/java.base/share/native/launcher/main.c
openjdk/src/java.base/share/native/launcher/main.c
+index b734fe2ba78..79dc8307650 100644
+--- openjdk.orig/src/java.base/share/native/launcher/main.c
++++ openjdk/src/java.base/share/native/launcher/main.c
@@ -34,6 +34,14 @@
#include "jli_util.h"
#include "jni.h"
diff --git a/sources b/sources
index f34e8af..c91ba79 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
SHA512 (tapsets-icedtea-3.15.0.tar.xz) =
c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (jdk-updates-jdk15u-jdk-15.0.2+7.tar.xz) =
d82e932671464d5c3643bda95c66bccb8cff7f22fdfb242e8b17f41b8b07cdf843ce5e85388edff8ab81ccad09f17575451440039adada2cd49d479ea600bf18
+SHA512 (openjdk-jdk16-jdk-16+36.tar.xz) =
8fc618b960eb6d982d408dd5607dea61f230895b2e2b233793308048ae004868595f501e56a1ab79c3d6aa5b638e06f58383c34d0a09fb321f48678a3a89f5f4
commit 7f939719de8d87927a918efb6cb7f2f76f9ed075
Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org>
Date: Fri Feb 19 03:26:43 2021 +0000
Hardcode /usr/sbin/alternatives for Flatpak builds
/usr/sbin/alternatives is not under the Flatpak build's %{_prefix},
which is set to /app.
(See <
https://pagure.io/packaging-committee/issue/848> "Clarify the
use of path macros with respect to build dependencies").
Found when trying to do a LibreOffice Flatpak build from RHEL RPM
specs, which includes java-1.8.0-openjdk among its components.
diff --git a/java-latest-openjdk.spec b/java-latest-openjdk.spec
index 1f6c372..406f9ed 100644
--- a/java-latest-openjdk.spec
+++ b/java-latest-openjdk.spec
@@ -272,7 +272,7 @@
%global origin_nice OpenJDK
%global top_level_dir_name %{origin}
%global buildver 7
-%global rpmrelease 0
+%global rpmrelease 1
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we
moved to 11, we had to add another digit
%if %is_system_jdk
# Using 10 digits may overflow the int used for priority, so we combine the patch and
build versions
@@ -377,6 +377,14 @@
%global rpm_state_dir %{_localstatedir}/lib/rpm-state/
+# For flatpack builds hard-code /usr/sbin/alternatives,
+# otherwise use %%{_sbindir} relative path.
+%if 0%{?flatpak}
+%global alternatives_requires /usr/sbin/alternatives
+%else
+%global alternatives_requires %{_sbindir}/alternatives
+%endif
+
%if %{with_systemtap}
# Where to install systemtap tapset (links)
# We would like these to be in a package specific sub-dir,
@@ -945,9 +953,9 @@ OrderWithRequires: copy-jdk-configs
# for printing support
Requires: cups-libs
# Post requires alternatives to install tool alternatives
-Requires(post): %{_sbindir}/alternatives
+Requires(post): %{alternatives_requires}
# Postun requires alternatives to uninstall tool alternatives
-Requires(postun): %{_sbindir}/alternatives
+Requires(postun): %{alternatives_requires}
# for optional support of kernel stream control, card reader and printing bindings
Suggests: lksctp-tools%{?_isa}, pcsc-lite-devel%{?_isa}
@@ -969,9 +977,9 @@ Provides: java-headless%{?1} = %{epoch}:%{version}-%{release}
Requires: %{name}%{?1}%{?_isa} = %{epoch}:%{version}-%{release}
OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release}
# Post requires alternatives to install tool alternatives
-Requires(post): %{_sbindir}/alternatives
+Requires(post): %{alternatives_requires}
# Postun requires alternatives to uninstall tool alternatives
-Requires(postun): %{_sbindir}/alternatives
+Requires(postun): %{alternatives_requires}
# Standard JPackage devel provides
Provides: java-sdk-%{javaver}-%{origin}%{?1} = %{epoch}:%{version}-%{release}
@@ -1019,9 +1027,9 @@ Provides: java-%{origin}-demo%{?1} = %{epoch}:%{version}-%{release}
%define java_javadoc_rpo() %{expand:
OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release}
# Post requires alternatives to install javadoc alternative
-Requires(post): %{_sbindir}/alternatives
+Requires(post): %{alternatives_requires}
# Postun requires alternatives to uninstall javadoc alternative
-Requires(postun): %{_sbindir}/alternatives
+Requires(postun): %{alternatives_requires}
# Standard JPackage javadoc provides
Provides: java-%{javaver}-javadoc%{?1} = %{epoch}:%{version}-%{release}
@@ -1051,7 +1059,7 @@ Version: %{newjavaver}.%{buildver}
# This package needs `.rolling` as part of Release so as to not conflict on install with
# java-X-openjdk. I.e. when latest rolling release is also an LTS release packaged as
# java-X-openjdk. See:
https://bugzilla.redhat.com/show_bug.cgi?id=1647298
-Release: %{?eaprefix}%{rpmrelease}%{?extraver}.rolling%{?dist}.1
+Release: %{?eaprefix}%{rpmrelease}%{?extraver}.rolling%{?dist}
# java-1.5.0-ibm from
jpackage.org set Epoch to 1 for unknown reasons
# and this change was brought into RHEL-4. java-1.5.0-ibm packages
# also included the epoch in their virtual provides. This created a
@@ -2121,6 +2129,9 @@ require "copy_jdk_configs.lua"
%endif
%changelog
+* Fri Feb 19 2021 Stephan Bergmann <sbergman(a)redhat.com> - 1:15.0.2.0.7-1.rolling
+- Hardcode /usr/sbin/alternatives for Flatpak builds
+
* Tue Jan 26 2021 Fedora Release Engineering <releng(a)fedoraproject.org> -
1:15.0.2.0.7-0.rolling.1
- Rebuilt for
https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild