Merge branch 'c8' into a8-portable

.gitignore

@@ -1,2 +1,2 @@
-SOURCES/openjdk-shenandoah-jdk8u-shenandoah-jdk8u402-b06.tar.xz
+SOURCES/shenandoah8u412-b08.tar.xz
 SOURCES/tapsets-icedtea-3.15.0.tar.xz

.java-1.8.0-openjdk.metadata

@@ -1,2 +1,2 @@
-0ca0a2433bfd7aa62a21fc37c8079f540e672a9c SOURCES/openjdk-shenandoah-jdk8u-shenandoah-jdk8u402-b06.tar.xz
+9cb6b4c557e9a433fe4c16b3996f998335cec8a5 SOURCES/shenandoah8u412-b08.tar.xz
 7ae2cba67467825b2c2a5fec7aea041865023002 SOURCES/tapsets-icedtea-3.15.0.tar.xz

SOURCES/java-1.8.0-openjdk-portable.specfile

@@ -268,8 +268,8 @@
 # Define version of OpenJDK 8 used
 %global project openjdk
 %global repo shenandoah-jdk8u
-%global openjdk_revision jdk8u402-b06
+%global openjdk_revision 8u412-b08
-%global shenandoah_revision shenandoah-%{openjdk_revision}
+%global shenandoah_revision shenandoah%{openjdk_revision}
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      3.15.0
 # Define current Git revision for the FIPS support patches
@@ -314,7 +314,7 @@
 %global updatever       %(VERSION=%{whole_update}; echo ${VERSION##*u})
 # eg jdk8u60-b27 -> b27
 %global buildver        %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease      1
+%global rpmrelease      2
 # Define milestone (EA for pre-releases, GA ("fcs") for releases)
 # Release will be (where N is usually a number starting at 1):
 # - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -428,14 +428,14 @@ License:  ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv
 URL:      http://openjdk.java.net/
 
 # Shenandoah HotSpot
-# aarch64-port/jdk8u-shenandoah contains an integration forest of
+# openjdk/shenandoah-jdk8u contains an integration forest of
-# OpenJDK 8u, the aarch64 port and Shenandoah
+# OpenJDK 8u and the Shenandoah garbage collector
 # To regenerate, use:
 # VERSION=%%{shenandoah_revision}
-# FILE_NAME_ROOT=%%{project}-%%{repo}-${VERSION}
+# FILE_NAME_ROOT=${VERSION}
 # REPO_ROOT=<path to checked-out repository> generate_source_tarball.sh
 # where the source is obtained from http://github.com/%%{project}/%%{repo}
-Source0: %{project}-%{repo}-%{shenandoah_revision}.tar.xz
+Source0: %{shenandoah_revision}.tar.xz
 
 # Custom README for -src subpackage
 Source2:  README.md
@@ -446,12 +446,11 @@ Source7: NEWS
 # Use 'icedtea_sync.sh' to update the following
 # They are based on code contained in the IcedTea project (3.x).
 # Systemtap tapsets. Zipped up to keep it small.
-Source8: tapsets-icedtea-%%{icedteaver}.tar.xz
+Source8: tapsets-icedtea-%{icedteaver}.tar.xz
 
 # Desktop files. Adapted from IcedTea
-# Disabled in portables
+Source9: jconsole.desktop.in
-#Source9: jconsole.desktop.in
+Source10: policytool.desktop.in
-#Source10: policytool.desktop.in
 
 # nss configuration file
 Source11: nss.cfg.in
@@ -679,8 +678,8 @@ BuildRequires: java-%{buildjdkver}-openjdk-devel >= 1.7.0.151-2.6.11.3
 %ifarch %{zero_arches}
 BuildRequires: libffi-devel
 %endif
-# 2023c required as of JDK-8305113
+# 2024a required as of JDK-8325150
-BuildRequires: tzdata-java >= 2023c
+BuildRequires: tzdata-java >= 2024a
 # Earlier versions have a bug in tree vectorization on PPC
 BuildRequires: gcc >= 4.8.3-8
 
@@ -800,6 +799,9 @@ fi
 echo "Update version: %{updatever}"
 echo "Build number: %{buildver}"
 echo "Milestone: %{milestone}"
+%ifnarch %{ix86}
+export XZ_OPT="-T0"
+%endif
 %setup -q -c -n %{uniquesuffix ""} -T -a 0
 # https://bugzilla.redhat.com/show_bug.cgi?id=1189084
 prioritylength=`expr length %{priority}`
@@ -822,6 +824,20 @@ cp %{SOURCE101} %{top_level_dir_name}/common/autoconf/build-aux/
 
 # OpenJDK patches
 
+# This syntax is deprecated:
+#    %patchN [...]
+# and should be replaced with:
+#    %patch -PN [...]
+# For example:
+#    %patch1001 -p1
+# becomes:
+#    %patch -P1001 -p1
+# The replacement format suggested by recent (circa Fedora 38) RPM
+# deprecation messages:
+#    %patch N [...]
+# is not backward-compatible with prior (circa RHEL-8) versions of
+# rpmbuild.
+
 %if %{system_libs}
 # Remove libraries that are linked
 sh %{SOURCE12}
@@ -830,60 +846,60 @@ sh %{SOURCE12}
 # Do not enable them with system_libs, they do not work properly with bundled option
 # System library fixes
 %if %{system_libs}
-%patch201
+%patch -P201
-%patch202
+%patch -P202
-%patch203
+%patch -P203
-%patch204
+%patch -P204
 %endif
 
-%patch1
+%patch -P1
-%patch5
+%patch -P5
 
 # s390 build fixes
-%patch102
+%patch -P102
-%patch103
+%patch -P103
-%patch107
+%patch -P107
 
 # AArch64 fixes
 
 # x86 fixes
-%patch105
+%patch -P105
 
 # Upstreamable fixes
-%patch502
+%patch -P502
-%patch512
+%patch -P512
-%patch523
+%patch -P523
-%patch528
+%patch -P528
-%patch571
+%patch -P571
-%patch574
+%patch -P574
-%patch112
+%patch -P112
-%patch581
+%patch -P581
-%patch541
+%patch -P541
-%patch12
+%patch -P12
 
 pushd %{top_level_dir_name}
 # Add crypto policy and FIPS support
-%patch1001 -p1
+%patch -P1001 -p1
 # nss.cfg PKCS11 support; must come last as it also alters java.security
-%patch1000 -p1
+%patch -P1000 -p1
 # system cacerts support
-%patch539 -p1
+%patch -P539 -p1
 popd
 
 # RPM-only fixes
-%patch600
+%patch -P600
-%patch1003
+%patch -P1003
 
 # RHEL-only patches
 %if ! 0%{?fedora} && 0%{?rhel} <= 7
-%patch534
+%patch -P534
 %endif
 
 # Shenandoah patches
 
 # Extract systemtap tapsets
 %if %{with_systemtap}
-tar --strip-components=1 -x -I xz -f %{SOURCE8}
+tar --strip-components=1 -x -I 'xz -T0' -f %{SOURCE8}
 %if %{include_debug_build}
 cp -r tapset tapset%{debug_suffix}
 %endif
@@ -922,6 +938,9 @@ export NUM_PROC=${NUM_PROC:-1}
 # Honor %%_smp_ncpus_max
 [ ${NUM_PROC} -gt %{?_smp_ncpus_max} ] && export NUM_PROC=%{?_smp_ncpus_max}
 %endif
+%ifnarch %{ix86}
+export XZ_OPT="-T0"
+%endif
 
 %ifarch s390x sparc64 alpha %{power64} %{aarch64}
 export ARCH_DATA_MODEL=64
@@ -1100,12 +1119,20 @@ function genchecksum() {
 }
 
 function packagejdk() {
+    # Reusing OPENJDK_UPSTREAM_TAG_EPOCH for the modification times of all
+    # files in the portable tarballs eliminates one source of variability
+    # across RPM rebuilds.
+    VERSION_FILE="$(pwd)"/"%{top_level_dir_name}"/common/autoconf/version-numbers
+    OPENJDK_UPSTREAM_TAG_EPOCH="$(stat --format=%Y "${VERSION_FILE}")"
+
     local imagesdir=$(pwd)/${1}/images
     local docdir=$(pwd)/${1}/docs
     local bundledir=$(pwd)/${1}/bundles
     local packagesdir=$(pwd)/${2}
     local srcdir=$(pwd)/%{top_level_dir_name}
     local tapsetdir=$(pwd)/tapset
+    local tar_time="$(date --utc --iso-8601=seconds --date=@"${OPENJDK_UPSTREAM_TAG_EPOCH}")"
+    local tar_opts="--mtime=${tar_time} --sort=name -cJf"
 
     echo "Packaging build from ${imagesdir} to ${packagesdir}..."
     mkdir -p ${packagesdir}
@@ -1139,7 +1166,7 @@ function packagejdk() {
     # Release images have external debug symbols
     if [ "x$suffix" = "x" ] ; then
         # Keep the unstripped version for consumption by RHEL RPMs
-        tar -cJf ${unstrippedarchive} ${jdkname}
+        tar ${tar_opts} ${unstrippedarchive} ${jdkname}
         genchecksum ${unstrippedarchive}
 
         # Strip the files
@@ -1152,15 +1179,15 @@ function packagejdk() {
             fi
         done
 
-        tar -cJf ${debugjdkarchive} $(find ${jdkname} -name \*.debuginfo)
+        tar ${tar_opts} ${debugjdkarchive} $(find ${jdkname} -name \*.debuginfo)
         genchecksum ${debugjdkarchive}
-        tar -cJf ${debugjrearchive} $(find ${jrename} -name \*.debuginfo)
+        tar ${tar_opts} ${debugjrearchive} $(find ${jdkname} -name \*.debuginfo)
         genchecksum ${debugjrearchive}
 
         mkdir ${docname}
         mv ${docdir} ${docname}
         mv ${bundledir}/${built_doc_archive} ${docname}
-	tar -cJf ${docarchive} ${docname}
+        tar ${tar_opts} ${docarchive} ${docname}
         genchecksum ${docarchive}
 
         mkdir ${miscname}
@@ -1170,14 +1197,14 @@ function packagejdk() {
 %if %{with_systemtap}
         cp -a ${tapsetdir}* ${miscname}
 %endif
-	tar -cJf ${miscarchive} ${miscname}
+        tar ${tar_opts} ${miscarchive} ${miscname}
         genchecksum ${miscarchive}
     fi
 
-    tar -cJf ${jdkarchive} --exclude='**.debuginfo' ${jdkname}
+    tar ${tar_opts} ${jdkarchive} --exclude='**.debuginfo' ${jdkname}
     genchecksum ${jdkarchive}
 
-    tar -cJf ${jrearchive}  --exclude='**.debuginfo' ${jrename}
+    tar ${tar_opts} ${jrearchive}  --exclude='**.debuginfo' ${jrename}
     genchecksum ${jrearchive}
 
     # Revert directory renaming so testing will run
@@ -1497,6 +1524,94 @@ done
 %{_jvmdir}/%{miscportablearchive}.sha256sum
 
 %changelog
+* Wed Apr 10 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b08-2
+- Add CVEs to release notes
+
+* Mon Apr 08 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b08-1
+- Update to shenandoah-jdk8u412-b08 (GA)
+- Update release notes for shenandoah-8u412-b08.
+- Complete release note for Certainly roots
+- Switch to GA mode.
+- ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
+
+* Fri Apr 05 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b07-0.1.ea
+- Update to shenandoah-jdk8u412-b07 (EA)
+- Update release notes for shenandoah-8u412-b07.
+- Require tzdata 2024a due to upstream inclusion of JDK-8322725
+
+* Fri Mar 29 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b01-0.2.ea
+- Move to upstream tag style (shenandoah8ux-by) in preparation for eventually moving back to official sources
+- generate_source_tarball.sh: Rename JCONSOLE_JS_PATCH{,_DEFAULT} to JCONSOLE_PATCH{,_DEFAULT} for brevity
+- generate_source_tarball.sh: Adapt OPENJDK_LATEST logic to work with 8u Shenandoah fork
+- generate_source_tarball.sh: Adapt version logic to work with 8u
+- generate_source_tarball.sh: Add quoting for SCRIPT_DIR and JCONSOLE_PATCH (SC2086)
+- generate_source_tarball.sh: Update examples in header for clarity
+- generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
+- generate_source_tarball.sh: Only add --depth=1 on non-local repositories
+- icedtea_sync.sh: Reinstate from rhel-8.8.0 branch
+- Move maintenance scripts to a scripts subdirectory
+- icedtea_sync.sh: Update with a VCS mode that retrieves sources from a Mercurial repository
+- jconsole.desktop.in: Restored by running icedtea_sync.sh
+- policytool.desktop.in: Likewise.
+- Restore IcedTea sources correctly in spec file
+- discover_trees.sh: Set compile-command and indentation instructions for Emacs
+- discover_trees.sh: shellcheck: Do not use -o (SC2166)
+- discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
+- discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
+- generate_source_tarball.sh: Add authorship
+- icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
+- icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
+- icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
+- openjdk_news.sh: Set compile-command and indentation instructions for Emacs
+- openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
+- openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
+- openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
+- Remove pointless empty file generate_singlerepo_source_tarball.sh
+- Remove pointless empty file update_main_sources.sh
+- generate_source_tarball.sh: Handle an existing checkout
+- generate_source_tarball.sh: Sync indentation with java-21-openjdk version
+- generate_source_tarball.sh: Support using a subdirectory via TO_COMPRESS
+
+* Fri Mar 29 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:1.8.0.412.b01-0.2.ea
+- generate_source_tarball.sh: Add WITH_TEMP environment variable
+- generate_source_tarball.sh: Multithread xz on all available cores
+- generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
+- generate_source_tarball.sh: Update comment about tarball naming
+- generate_source_tarball.sh: Reformat comment header
+- generate_source_tarball.sh: Reformat and update help output
+- generate_source_tarball.sh: Do a shallow clone, for speed
+- generate_source_tarball.sh: Eliminate some removal prompting
+- generate_source_tarball.sh: Make tarball reproducible
+- generate_source_tarball.sh: Prefix temporary directory with temp-
+- generate_source_tarball.sh: Remove temporary directory exit conditions
+- generate_source_tarball.sh: Set compile-command in Emacs
+- generate_source_tarball.sh: Remove REPO_NAME from FILE_NAME_ROOT
+- generate_source_tarball.sh: Move PROJECT_NAME and REPO_NAME checks
+- generate_source_tarball.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
+- generate_source_tarball.sh: shellcheck: Double-quote variable references (SC2086)
+- generate_source_tarball.sh: shellcheck: Do not use -a (SC2166)
+- generate_source_tarball.sh: shellcheck: Do not use $ on arithmetic variables (SC2004)
+- Use backward-compatible patch syntax
+- generate_source_tarball.sh: Ignore -ga tags with OPENJDK_LATEST
+- generate_source_tarball.sh: Remove trailing period in echo
+- generate_source_tarball.sh: Use long-style argument to grep
+- generate_source_tarball.sh: Add license
+- generate_source_tarball.sh: Add indentation instructions for Emacs
+
+* Fri Mar 22 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b01-0.1.ea
+- Introduce tar_opts to avoid repetition of lengthy tar creation options
+- Normalise whitespace
+- Turn off xz multi-threading on i686 as it fails with an out of memory error
+
+* Fri Mar 22 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:1.8.0.412.b01-0.1.ea
+- Invoke xz in multi-threaded mode
+- Make portable tarball modification times reproducible
+
+* Thu Mar 21 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b01-0.1.ea
+- Update to shenandoah-jdk8u412-b01 (EA)
+- Update release notes for shenandoah-8u412-b01.
+- Switch to EA mode.
+
 * Thu Jan 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.402.b06-0.1.ea
 - Update to shenandoah-jdk8u402-b06 (GA)
 - Update release notes for shenandoah-8u402-b06.

SOURCES/rh1648644-java_access_bridge_privileged_security.patch

@@ -1,25 +0,0 @@
-diff --git openjdk.orig/jdk/src/share/lib/security/java.security-linux openjdk/jdk/src/share/lib/security/java.security-linux
---- openjdk.orig/jdk/src/share/lib/security/java.security-linux
-+++ openjdk/jdk/src/share/lib/security/java.security-linux
-@@ -226,7 +226,9 @@
-                com.sun.activation.registries.,\
-                jdk.jfr.events.,\
-                jdk.jfr.internal.,\
--               jdk.management.jfr.internal.
-+               jdk.management.jfr.internal.,\
-+               org.GNOME.Accessibility.,\
-+               org.GNOME.Bonobo.
- 
- #
- # List of comma-separated packages that start with or equal this string
-@@ -279,7 +281,9 @@
-                    com.sun.activation.registries.,\
-                    jdk.jfr.events.,\
-                    jdk.jfr.internal.,\
--                   jdk.management.jfr.internal.
-+                   jdk.management.jfr.internal.,\
-+                   org.GNOME.Accessibility.,\
-+                   org.GNOME.Bonobo.
- 
- #
- # Determines whether this properties file can be appended to