Merge branch 'c8' into a8-portable

.gitignore

@@ -1,2 +1,2 @@
-SOURCES/shenandoah8u412-b08.tar.xz
+SOURCES/shenandoah8u422-b05.tar.xz
 SOURCES/tapsets-icedtea-3.15.0.tar.xz

.java-1.8.0-openjdk.metadata

@@ -1,2 +1,2 @@
-9cb6b4c557e9a433fe4c16b3996f998335cec8a5 SOURCES/shenandoah8u412-b08.tar.xz
+e2828a59a56b737f58f33dc21f654e92bdfc085e SOURCES/shenandoah8u422-b05.tar.xz
 7ae2cba67467825b2c2a5fec7aea041865023002 SOURCES/tapsets-icedtea-3.15.0.tar.xz

SOURCES/NEWS

@@ -3,6 +3,608 @@ Key:
 JDK-X  - https://bugs.openjdk.java.net/browse/JDK-X
 CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
 
+New in release OpenJDK 8u422 (2024-07-16):
+===========================================
+Live versions of these release notes can be found at:
+  * https://bit.ly/openjdk8u422
+
+* CVEs
+  - CVE-2024-21131
+  - CVE-2024-21138
+  - CVE-2024-21140
+  - CVE-2024-21144
+  - CVE-2024-21145
+  - CVE-2024-21147
+* Security fixes
+  - JDK-8314794: Improve UTF8 String supports
+  - JDK-8319859: Better symbol storage
+  - JDK-8320097: Improve Image transformations
+  - JDK-8320548: Improved loop handling
+  - JDK-8322106: Enhance Pack 200 loading
+  - JDK-8323231: Improve array management
+  - JDK-8323390: Enhance mask blit functionality
+  - JDK-8324559: Improve 2D image handling
+  - JDK-8325600: Better symbol storage
+* Other changes
+  - JDK-8025439: [TEST BUG] [macosx] PrintServiceLookup.lookupPrintServices doesn't work properly since jdk8b105
+  - JDK-8069389: CompilerOracle prefix wildcarding is broken for long strings
+  - JDK-8159454: [TEST_BUG] javax/swing/ToolTipManager/7123767/bug7123767.java: number of checked graphics configurations should be limited
+  - JDK-8159690: [TESTBUG] Mark headful tests with @key headful.
+  - JDK-8198321: javax/swing/JEditorPane/5076514/bug5076514.java fails
+  - JDK-8203691: [TESTBUG] Test /runtime/containers/cgroup/PlainRead.java fails
+  - JDK-8205407: [windows, vs<2017] C4800 after 8203197
+  - JDK-8235834: IBM-943 charset encoder needs updating
+  - JDK-8239965: XMLEncoder/Test4625418.java fails due to "Error: Cp943 - can't read properly"
+  - JDK-8240756: [macos] SwingSet2:TableDemo:Printed Japanese characters were garbled
+  - JDK-8256152: tests fail because of ambiguous method resolution
+  - JDK-8258855: Two tests sun/security/krb5/auto/ReplayCacheTestProc.java and ReplayCacheTestProcWithMD5.java failed on OL8.3
+  - JDK-8262017: C2: assert(n != __null) failed: Bad immediate dominator info.
+  - JDK-8268916: Tests for AffirmTrust roots
+  - JDK-8278067: Make HttpURLConnection default keep alive timeout configurable
+  - JDK-8291226: Create Test Cases to cover scenarios for JDK-8278067
+  - JDK-8291637: HttpClient default keep alive timeout not followed if server sends invalid value
+  - JDK-8291638: Keep-Alive timeout of 0 should close connection immediately
+  - JDK-8293562: KeepAliveCache Blocks Threads while Closing Connections
+  - JDK-8303466: C2: failed: malformed control flow. Limit type made precise with MaxL/MinL
+  - JDK-8304074: [JMX] Add an approximation of total bytes allocated on the Java heap by the JVM
+  - JDK-8313081: MonitoringSupport_lock should be unconditionally initialized after 8304074
+  - JDK-8315020: The macro definition for LoongArch64 zero build is not accurate.
+  - JDK-8316138: Add GlobalSign 2 TLS root certificates
+  - JDK-8318410: jdk/java/lang/instrument/BootClassPath/BootClassPathTest.sh fails on Japanese Windows
+  - JDK-8320005: Allow loading of shared objects with .a extension on AIX
+  - JDK-8324185: [8u] Accept Xcode 12+ builds on macOS
+  - JDK-8325096: Test java/security/cert/CertPathBuilder/akiExt/AKISerialNumber.java is failing
+  - JDK-8325927: [8u] Backport of JDK-8170552 missed part of the test
+  - JDK-8326686: Bump update version of OpenJDK: 8u422
+  - JDK-8327440: Fix "bad source file" error during beaninfo generation
+  - JDK-8328809: [8u] Problem list some CA tests
+  - JDK-8328825: Google CAInterop test failures
+  - JDK-8329544: [8u] sun/security/krb5/auto/ReplayCacheTestProc.java cannot find the testlibrary
+  - JDK-8331791: [8u] AIX build break from JDK-8320005 backport
+  - JDK-8331980: [8u] Problem list CAInterop.java#certignarootca test
+  - JDK-8335552: [8u] JDK-8303466 backport to 8u requires 3 ::Identity signature fixes
+
+Notes on individual issues:
+===========================
+
+core-libs/java.net:
+
+JDK-8278067: Make HttpURLConnection Default Keep Alive Timeout Configurable
+===========================================================================
+Two system properties have been added which control the keep alive
+behavior of HttpURLConnection in the case where the server does not
+specify a keep alive time. These are:
+
+* `http.keepAlive.time.server`
+* `http.keepAlive.time.proxy`
+
+which control the number of seconds before an idle connection to a
+server or proxy will be closed, respectively. If the server or proxy
+specifies a keep alive time in a "Keep-Alive" response header, this
+will take precedence over the values of these properties.
+
+security-libs/java.security:
+
+JDK-8316138: Add GlobalSign 2 TLS root certificates
+===================================================
+The following root certificates have been added to the cacerts
+truststore:
+
+Name: GlobalSign
+Alias Name: globalsignr46
+Distinguished Name: CN=GlobalSign Root R46, O=GlobalSign nv-sa, C=BE
+
+Name: GlobalSign
+Alias Name: globalsigne46
+Distinguished Name: CN=GlobalSign Root E46, O=GlobalSign nv-sa, C=BE
+
+New in release OpenJDK 8u412 (2024-04-16):
+===========================================
+Live versions of these release notes can be found at:
+  * https://bit.ly/openjdk8u412
+
+* CVEs
+  - CVE-2024-21011
+  - CVE-2024-21085
+  - CVE-2024-21068
+  - CVE-2024-21094
+* Security fixes
+  - JDK-8317507, JDK-8325348: C2 compilation fails with "Exceeded _node_regs array"
+  - JDK-8318340: Improve RSA key implementations
+  - JDK-8319851: Improve exception logging
+  - JDK-8322114: Improve Pack 200 handling
+  - JDK-8322122: Enhance generation of addresses
+* Other changes
+  - JDK-8011180: Delete obsolete scripts
+  - JDK-8016451: Scary messages emitted by build.tools.generatenimbus.PainterGenerator during build
+  - JDK-8021961: setAlwaysOnTop doesn't behave correctly in Linux/Solaris under certain scenarios
+  - JDK-8023735: [TESTBUG][macosx] runtime/XCheckJniJsig/XCheckJSig.java fails on MacOS X
+  - JDK-8074860: Structured Exception Catcher missing around CreateJavaVM on Windows
+  - JDK-8079441: Intermittent failures on Windows with "Unexpected exit from test [exit code: 1080890248]" (0x406d1388)
+  - JDK-8155590: Dubious collection management in sun.net.www.http.KeepAliveCache
+  - JDK-8168518: rcache interop with krb5-1.15
+  - JDK-8183503: Update hotspot tests to allow for unique test classes directory
+  - JDK-8186095: upgrade to jtreg 4.2 b08
+  - JDK-8186199: [windows] JNI_DestroyJavaVM not covered by SEH
+  - JDK-8192931: Regression test java/awt/font/TextLayout/CombiningPerf.java fails
+  - JDK-8208655: use JTreg skipped status in hotspot tests
+  - JDK-8208701: Fix for JDK-8208655 causes test failures in CI tier1
+  - JDK-8208706: compiler/tiered/ConstantGettersTransitionsTest.java fails to compile
+  - JDK-8213410: UseCompressedOops requirement check fails fails on 32-bit system
+  - JDK-8222323: ChildAlwaysOnTopTest.java fails with "RuntimeException: Failed to unset alwaysOnTop"
+  - JDK-8224768: Test ActalisCA.java fails
+  - JDK-8251155: HostIdentifier fails to canonicalize hostnames starting with digits
+  - JDK-8251551: Use .md filename extension for README
+  - JDK-8268678: LetsEncryptCA.java test fails as Let’s Encrypt Authority X3 is retired
+  - JDK-8270280: security/infra/java/security/cert/CertPathValidator/certification/LetsEncryptCA.java  OCSP response error
+  - JDK-8270517: Add Zero support for LoongArch
+  - JDK-8272708: [Test]: Cleanup: test/jdk/security/infra/java/security/cert/CertPathValidator/certification/BuypassCA.java no longer needs ocspEnabled
+  - JDK-8276139: TestJpsHostName.java not reliable, better to expand HostIdentifierCreate.java test
+  - JDK-8288132: Update test artifacts in QuoVadis CA interop tests
+  - JDK-8297955: LDAP CertStore should use LdapName and not String for DNs
+  - JDK-8301310: The SendRawSysexMessage test may cause a JVM crash
+  - JDK-8308592: Framework for CA interoperability testing
+  - JDK-8312126: NullPointerException in CertStore.getCRLs after 8297955
+  - JDK-8315042: NPE in PKCS7.parseOldSignedData
+  - JDK-8315757: [8u] Add cacerts JTREG tests to GHA tier1 test set
+  - JDK-8320713: Bump update version of OpenJDK: 8u412
+  - JDK-8321060: [8u] hotspot needs to recognise VS2022
+  - JDK-8321408: Add Certainly roots R1 and E1
+  - JDK-8322725: (tz) Update Timezone Data to 2023d
+  - JDK-8322750: Test "api/java_awt/interactive/SystemTrayTests.html" failed because A blue ball icon is added outside of the system tray
+  - JDK-8323202: [8u] Remove get_source.sh and hgforest.sh
+  - JDK-8323640: [TESTBUG]testMemoryFailCount in jdk/internal/platform/docker/TestDockerMemoryMetrics.java always fail because OOM killed
+  - JDK-8324184: Windows VS2010 build failed with "error C2275: 'int64_t'"
+  - JDK-8324530: Build error with gcc 10
+  - JDK-8325150: (tz) Update Timezone Data to 2024a
+
+Notes on individual issues:
+===========================
+
+security-libs/org.ietf.jgss:krb5:
+
+JDK-8168518: rcache interop with krb5-1.15
+==========================================
+The hash algorithm used in the Kerberos 5 replay cache file (rcache)
+has been changed from MD5 to SHA256. This is the same algorithm used
+by MIT krb5-1.15 and is interoperable with earlier releases of MIT
+krb5.
+
+The MD5 algorithm can still be used by setting the new
+jdk.krb5.rcache.useMD5 property to 'true':
+
+java -Djdk.krb5.rcache.useMD5=true ...
+
+This is useful where either the system has a coarse clock and has to
+depend on hash values in replay attack detection, or interoperability
+with the rcache files in older versions of OpenJDK is required.
+
+client-libs/java.awt:
+
+JDK-8322750: AWT SystemTray API Is Not Supported on Most Linux Desktops
+=======================================================================
+The java.awt.SystemTray API is used to interact with the system's
+desktop taskbar to provide notifications and may include an icon
+representing an application. The GNOME desktop's support for taskbar
+icons has not worked properly for several years, due to a platform
+bug. This bug, in turn, affects the JDK's SystemTray support on GNOME
+desktops.
+
+Therefore, in accordance with the SystemTray API specification,
+java.awt.SystemTray.isSupported() will now return false on systems
+that exhibit this bug, which is assumed to be those running a version
+of GNOME Shell below 45.
+
+The impact of this change is likely to be minimal, as users of the
+SystemTray API should already be able to handle isSupported()
+returning false and the system tray on such platforms has already been
+unsupported for a number of years for all applications.
+
+security-libs/java.security:
+
+JDK-8321408: Added Certainly R1 and E1 Root Certificates
+========================================================
+The following root certificate has been added to the cacerts
+truststore:
+
+Name: Certainly
+Alias Name: certainlyrootr1
+Distinguished Name: CN=Certainly Root R1, O=Certainly, C=US
+
+Name: Certainly
+Alias Name: certainlyroote1
+Distinguished Name: CN=Certainly Root E1, O=Certainly, C=US
+
+New in release OpenJDK 8u402 (2024-01-16):
+===========================================
+Live versions of these release notes can be found at:
+  * https://bit.ly/openjdk8u402
+
+* CVEs
+  - CVE-2024-20918
+  - CVE-2024-20919
+  - CVE-2024-20921
+  - CVE-2024-20926
+  - CVE-2024-20945
+  - CVE-2024-20952
+* Security fixes
+  - JDK-8308204: Enhanced certificate processing
+  - JDK-8314284: Enhance Nashorn performance
+  - JDK-8314295: Enhance verification of verifier
+  - JDK-8314307: Improve loop handling
+  - JDK-8314468: Improve Compiler loops
+  - JDK-8316976: Improve signature handling
+  - JDK-8317547: Enhance TLS connection support
+* Other changes
+  - JDK-6528710: sRGB-ColorSpace to sRGB-ColorSpace Conversion
+  - JDK-8029995: accept yes/no for boolean krb5.conf settings
+  - JDK-8159156: [TESTBUG] ReserveMemory test is not useful on Aix.
+  - JDK-8176509: Use pandoc for converting build readme to html
+  - JDK-8206179: com/sun/management/OperatingSystemMXBean/GetCommittedVirtualMemorySize.java fails with Committed virtual memory size illegal value
+  - JDK-8207404: MulticastSocket tests failing on AIX
+  - JDK-8212677: X11 default visual support for IM status window on VNC
+  - JDK-8239365: ProcessBuilder test modifications for AIX execution
+  - JDK-8271838: AmazonCA.java interop test fails
+  - JDK-8285398: Cache the results of constraint checks
+  - JDK-8285696: AlgorithmConstraints:permits not throwing IllegalArgumentException when 'alg'  is null
+  - JDK-8302017: Allocate BadPaddingException only if it will be thrown
+  - JDK-8305329: [8u] Unify test libraries into single test library - step 1
+  - JDK-8307837: [8u] Check step in GHA should also print errors
+  - JDK-8309088: security/infra/java/security/cert/CertPathValidator/certification/AmazonCA.java fails
+  - JDK-8311813: C1: Uninitialized PhiResolver::_loop field
+  - JDK-8312489: Increase jdk.jar.maxSignatureFileSize default which is too low for JARs such as WhiteSource/Mend unified agent jar
+  - JDK-8312535: MidiSystem.getSoundbank() throws unexpected SecurityException
+  - JDK-8315280: Bump update version of OpenJDK: 8u402
+  - JDK-8315506: C99 compatibility issue in LinuxNativeDispatcher
+  - JDK-8317291: Missing null check for nmethod::is_native_method()
+  - JDK-8317373: Add Telia Root CA v2
+  - JDK-8317374: Add Let's Encrypt ISRG Root X2
+  - JDK-8318759: Add four DigiCert root certificates
+  - JDK-8319187: Add three eMudhra emSign roots
+  - JDK-8319405: [s390] [jdk8] Increase javac default stack size for s390x zero
+  - JDK-8320597: RSA signature verification fails on signed data that does not encode params correctly
+
+Notes on individual issues:
+===========================
+
+security-libs/org.ietf.jgss:krb5:
+
+JDK-8029995: accept yes/no for boolean krb5.conf settings
+=========================================================
+The krb5.conf configuration file now also accepts "yes" and "no", as
+alternatives to the existing "true" and "false" support, when using
+settings that take boolean values.
+
+security-libs/java.security:
+
+JDK-8312489: Increase jdk.jar.maxSignatureFileSize default which is too low for JARs such as WhiteSource/Mend unified agent jar
+===============================================================================================================================
+A maximum signature file size property, jdk.jar.maxSignatureFileSize,
+was introduced in the 8u382 release of OpenJDK by JDK-8300596, with a
+default of 8MB. This default proved to be too small for some JAR
+files. This release, 8u402, increases it to 16MB.
+
+JDK-8317374: Added ISRG Root X2 CA Certificate from Let's Encrypt
+=================================================================
+The following root certificate has been added to the cacerts
+truststore:
+
+Name: Let's Encrypt
+Alias Name: letsencryptisrgx2
+Distinguished Name: CN=ISRG Root X2, O=Internet Security Research Group, C=US
+
+JDK-8318759: Added Four Root Certificates from DigiCert, Inc.
+=============================================================
+The following root certificates have been added to the cacerts
+truststore:
+
+Name: DigiCert, Inc.
+Alias Name: digicertcseccrootg5
+Distinguished Name: CN=DigiCert CS ECC P384 Root G5, O="DigiCert, Inc.", C=US
+
+Name: DigiCert, Inc.
+Alias Name: digicertcsrsarootg5
+Distinguished Name: CN=DigiCert CS RSA4096 Root G5, O="DigiCert, Inc.", C=US
+
+Name: DigiCert, Inc.
+Alias Name: digicerttlseccrootg5
+Distinguished Name: CN=DigiCert TLS ECC P384 Root G5, O="DigiCert, Inc.", C=US
+
+Name: DigiCert, Inc.
+Alias Name: digicerttlsrsarootg5
+Distinguished Name: CN=DigiCert TLS RSA4096 Root G5, O="DigiCert, Inc.", C=US
+
+JDK-8319187: Added Three Root Certificates from eMudhra Technologies Limited
+============================================================================
+The following root certificates have been added to the cacerts
+truststore:
+
+Name: eMudhra Technologies Limited
+Alias Name: emsignrootcag1
+Distinguished Name: CN=emSign Root CA - G1, O=eMudhra Technologies Limited, OU=emSign PKI, C=IN
+
+Name: eMudhra Technologies Limited
+Alias Name: emsigneccrootcag3
+Distinguished Name: CN=emSign ECC Root CA - G3, O=eMudhra Technologies Limited, OU=emSign PKI, C=IN
+
+Name: eMudhra Technologies Limited
+Alias Name: emsignrootcag2
+Distinguished Name: CN=emSign Root CA - G2, O=eMudhra Technologies Limited, OU=emSign PKI, C=IN
+
+JDK-8317373: Added Telia Root CA v2 Certificate
+===============================================
+The following root certificate has been added to the cacerts
+truststore:
+
+Name: Telia Root CA v2
+Alias Name: teliarootcav2
+Distinguished Name: CN=Telia Root CA v2, O=Telia Finland Oyj, C=FI ```
+
+New in release OpenJDK 8u392 (2023-10-17):
+===========================================
+Live versions of these release notes can be found at:
+  * https://bit.ly/openjdk8u392
+
+* CVEs
+  - CVE-2023-22067
+  - CVE-2023-22081
+* Security fixes
+  - JDK-8286503, JDK-8312367: Enhance security classes
+  - JDK-8297856: Improve handling of Bidi characters
+  - JDK-8303384: Improved communication in CORBA
+  - JDK-8305815, JDK-8307278: Update Libpng to 1.6.39
+  - JDK-8309966: Enhanced TLS connections
+* Other changes
+  - JDK-6722928: Provide a default native GSS-API library on Windows
+  - JDK-8040887: [TESTBUG] Remove test/runtime/6925573/SortMethodsTest.java
+  - JDK-8042726: [TESTBUG] TEST.groups file was not updated after runtime/6925573/SortMethodsTest.java removal
+  - JDK-8139348: Deprecate 3DES and RC4 in Kerberos
+  - JDK-8173072: zipfs fails to handle incorrect info-zip "extended timestamp extra field"
+  - JDK-8200468: Port the native GSS-API bridge to Windows
+  - JDK-8202952: C2: Unexpected dead nodes after matching
+  - JDK-8205399: Set node color on pinned HashMap.TreeNode deletion
+  - JDK-8209115: adjust libsplashscreen linux ppc64le builds for easier libpng update
+  - JDK-8214046: [macosx] Undecorated Frame does not Iconify when set to
+  - JDK-8219804: java/net/MulticastSocket/Promiscuous.java fails intermittently due to NumberFormatException
+  - JDK-8225687: Newly added sspi.cpp in JDK-6722928 still contains some small errors
+  - JDK-8232225: Rework the fix for JDK-8071483
+  - JDK-8242330: Arrays should be cloned in several JAAS Callback classes
+  - JDK-8253269: The CheckCommonColors test should provide more info on failure
+  - JDK-8283441: C2: segmentation fault in ciMethodBlocks::make_block_at(int)
+  - JDK-8284910: Buffer clean in PasswordCallback
+  - JDK-8287073: NPE from CgroupV2Subsystem.getInstance()
+  - JDK-8287663: Add a regression test for JDK-8287073
+  - JDK-8295685: Update Libpng to 1.6.38
+  - JDK-8295894: Remove SECOM certificate that is expiring in September 2023
+  - JDK-8308788: [8u] Remove duplicate HaricaCA.java test
+  - JDK-8309122: Bump update version of OpenJDK: 8u392
+  - JDK-8309143: [8u] fix archiving inconsistencies in GHA
+  - JDK-8310026: [8u] make java_lang_String::hash_code consistent across platforms
+  - JDK-8314960: Add Certigna Root CA - 2
+  - JDK-8315135: Memory leak in the native implementation of Pack200.Unpacker.unpack()
+  - JDK-8317040: Exclude cleaner test failing on older releases
+
+Notes on individual issues:
+===========================
+
+other-libs/corba:idl:
+
+JDK-8303384: Improved communication in CORBA
+============================================
+The JDK's CORBA implementation now provides the option to limit
+serialisation in stub objects to those with the "IOR:" prefix.  For
+ORB constrained stub classes:
+
+* _DynArrayStub
+* _DynEnumStub
+* _DynFixedStub
+* _DynSequenceStub
+* _DynStructStub
+* _DynUnionStub
+* _DynValueStub
+* _DynAnyStub
+* _DynAnyFactoryStub
+
+this is enabled by default and may be disabled by setting the system
+property org.omg.DynamicAny.disableIORCheck to 'true'.
+
+For remote service stub classes:
+
+* _NamingContextStub
+* _BindingIteratorStub
+* _NamingContextExtStub
+* _ServantActivatorStub
+* _ServantLocatorStub
+* _ServerManagerStub
+* _ActivatorStub
+* _RepositoryStub
+* _InitialNameServiceStub
+* _LocatorStub
+* _ServerStub
+
+it is disabled by default and may be enabled by setting the system
+property org.omg.CORBA.IDL.Stubs.enableIORCheck to 'true'.
+
+security-libs/org.ietf.jgss:
+
+JDK-6722928: Added a Default Native GSS-API Library on Windows
+==============================================================
+
+A native GSS-API library named `sspi_bridge.dll` has been added to the
+JDK on the Windows platform.  As with native GSS-API library provision
+on other operating systems, it will only be loaded when the
+`sun.security.jgss.native` system property is set to "true". A user
+can still load a third-party native GSS-API library instead by setting
+the `sun.security.jgss.lib` system property to the appropriate path.
+
+The library is client-side only and uses the default credentials.
+Native GSS support automatically uses cached credentials from the
+underlying operating system, so the
+`javax.security.auth.useSubjectCredsOnly` system property should be
+set to false.
+
+The `com.sun.security.auth.module.Krb5LoginModule` does not call
+native JGSS and so its use in your JAAS config should be avoided.
+
+security-libs/org.ietf.jgss:krb5:
+
+JDK-8139348: Deprecate 3DES and RC4 in Kerberos
+===============================================
+The `des3-hmac-sha1` and `rc4-hmac` Kerberos encryption types (etypes)
+are now deprecated and disabled by default.  To re-enable them, you
+can either enable all weak crypto (which also includes `des-cbc-crc`
+and `des-cbc-md5`) by setting `allow_weak_crypto = true` in the
+`krb5.conf` configuration file or explicitly list all the preferred
+encryption types using the `default_tkt_enctypes`,
+`default_tgs_enctypes`, or `permitted_enctypes` settings.
+
+security-libs/java.security:
+
+JDK-8295894: Removed SECOM Trust System's RootCA1 Root Certificate
+==================================================================
+The following root certificate from SECOM Trust System has been
+removed from the `cacerts` keystore:
+
+Alias Name: secomscrootca1 [jdk]
+Distinguished Name: OU=Security Communication RootCA1, O=SECOM Trust.net, C=JP
+
+JDK-8314960: Added Certigna Root CA Certificate
+===============================================
+The following root certificate has been added to the cacerts
+truststore:
+
+Name: Certigna (Dhimyotis)
+Alias Name: certignarootca
+Distinguished Name: CN=Certigna Root CA, OU=0002 48146308100036, O=Dhimyotis, C=FR
+
+security-libs/javax.security:
+
+JDK-8242330: Arrays should be cloned in several JAAS Callback classes
+=====================================================================
+In the JAAS classes, ChoiceCallback and ConfirmationCallback, arrays
+were not cloned when passed into a constructor or returned. This
+allowed an external program to get access to the internal fields of
+these classes. The classes have been updated to return cloned arrays.
+
+New in release OpenJDK 8u382 (2023-07-18):
+===========================================
+Live versions of these release notes can be found at:
+  * https://bit.ly/openjdk8u382
+
+* CVEs
+  - CVE-2023-22045
+  - CVE-2023-22049
+* Security fixes
+  - JDK-8298676: Enhanced Look and Feel
+  - JDK-8300596: Enhance Jar Signature validation
+  - JDK-8304468: Better array usages
+  - JDK-8305312: Enhanced path handling
+* Other changes
+  - JDK-8072678: Wrong exception messages in java.awt.color.ICC_ColorSpace
+  - JDK-8151460: Metaspace counters can have inconsistent values
+  - JDK-8152432: Implement setting jtreg @requires properties vm.flavor, vm.bits, vm.compMode
+  - JDK-8185736: missing default exception handler in calls to rethrow_Stub
+  - JDK-8186801: Add regression test to test mapping based charsets (generated at build time)
+  - JDK-8215105: java/awt/Robot/HiDPIScreenCapture/ScreenCaptureTest.java: Wrong Pixel Color
+  - JDK-8241311: Move some charset mapping tests from closed to open
+  - JDK-8263059: security/infra/java/security/cert/CertPathValidator/certification/ComodoCA.java fails due to revoked cert
+  - JDK-8268558: [TESTBUG] Case 2 in TestP11KeyFactoryGetRSAKeySpec is skipped
+  - JDK-8271199: Mutual TLS handshake fails signing client certificate with custom sensitive PKCS11 key
+  - JDK-8276841: Add support for Visual Studio 2022
+  - JDK-8277881: Missing SessionID in TLS1.3 resumption in compatibility mode
+  - JDK-8278851: Correct signer logic for jars signed with multiple digest algorithms
+  - JDK-8282345: handle latest VS2022 in abstract_vm_version
+  - JDK-8282600: SSLSocketImpl should not use user_canceled workaround when not necessary
+  - JDK-8285515: (dc) DatagramChannel.disconnect fails with "Invalid argument" on macOS 12.4
+  - JDK-8289301: P11Cipher should not throw out of bounds exception during padding
+  - JDK-8293232: Fix race condition in pkcs11 SessionManager
+  - JDK-8293815: P11PSSSignature.engineUpdate should not print debug messages during normal operation
+  - JDK-8295530: Update Zlib Data Compression Library to Version 1.2.13
+  - JDK-8298108: Add a regression test for JDK-8297684
+  - JDK-8298271: java/security/SignedJar/spi-calendar-provider/TestSPISigned.java failing on Windows
+  - JDK-8301119: Support for GB18030-2022
+  - JDK-8301400: Allow additional characters for GB18030-2022 support
+  - JDK-8302791: Add specific ClassLoader object to Proxy IllegalArgumentException message
+  - JDK-8303028: Update system property for Java SE specification maintenance version
+  - JDK-8303462: Bump update version of OpenJDK: 8u382
+  - JDK-8304760: Add 2 Microsoft TLS roots
+  - JDK-8305165: [8u] ServiceThread::nmethods_do is not called to keep nmethods from being zombied while in the queue
+  - JDK-8305681: Allow additional characters for GB18030-2022 (Level 2) support
+  - JDK-8305975: Add TWCA Global Root CA
+  - JDK-8307134: Add GTS root CAs
+  - JDK-8307310: Backport the tests for JDK-8058969 and JDK-8039271 to the OpenJDK8
+  - JDK-8307531: [aarch64] JDK8 single-step debugging is extremely slow
+  - JDK-8310947: gb18030-2000 not selectable with LANG=zh_CN.GB18030 after JDK-8301119
+
+Notes on individual issues:
+===========================
+
+core-libs/java.lang:
+
+JDK-8305681: Allow additional characters for GB18030-2022 (Level 2) support
+===========================================================================
+In order to support "Implementation Level 2" of the GB18030-2022
+standard, the JDK must be able to use characters from the CJK Unified
+Ideographs Extension E block of Unicode 8.0.  The addition of these
+characters forms Maintenance Release 5 of the Java SE 8 specification,
+which is implemented in this release of OpenJDK via the addition of a
+new UnicodeBlock instance,
+Character.CJK_UNIFIED_IDEOGRAPHS_EXTENSION_E.
+
+core-libs/java.util.jar:
+
+8300596: Enhance Jar Signature validation
+=========================================
+A System property "jdk.jar.maxSignatureFileSize" is introduced to
+configure the maximum number of bytes allowed for the
+signature-related files in a JAR file during verification. The default
+value is 8000000 bytes (8 MB).
+
+security-libs/java.security:
+
+JDK-8307134: Added 4 GTS Root CA Certificates
+=============================================
+The following root certificates have been added to the cacerts
+truststore:
+
+Name: Google Trust Services LLC
+Alias Name: gtsrootcar1
+Distinguished Name: CN=GTS Root R1, O=Google Trust Services LLC, C=US
+
+Name: Google Trust Services LLC
+Alias Name: gtsrootcar2
+Distinguished Name: CN=GTS Root R2, O=Google Trust Services LLC, C=US
+
+Name: Google Trust Services LLC
+Alias Name: gtsrootcar3
+Distinguished Name: CN=GTS Root R3, O=Google Trust Services LLC, C=US
+
+Name: Google Trust Services LLC
+Alias Name: gtsrootcar4
+Distinguished Name: CN=GTS Root R4, O=Google Trust Services LLC, C=US
+
+JDK-8304760: Added Microsoft Corporation's 2 TLS Root CA Certificates
+=====================================================================
+The following root certificates has been added to the cacerts
+truststore:
+
+Name: Microsoft Corporation
+Alias Name: microsoftecc2017
+Distinguished Name: CN=Microsoft ECC Root Certificate Authority 2017, O=Microsoft Corporation, C=US
+
+Name: Microsoft Corporation
+Alias Name: microsoftrsa2017
+Distinguished Name: CN=Microsoft RSA Root Certificate Authority 2017, O=Microsoft Corporation, C=US
+
+JDK-8305975: Added TWCA Root CA Certificate
+===========================================
+The following root certificate has been added to the cacerts
+truststore:
+
+Name: TWCA
+Alias Name: twcaglobalrootca
+Distinguished Name: CN=TWCA Global Root CA, OU=Root CA, O=TAIWAN-CA, C=TW
+
 New in release OpenJDK 8u372 (2023-04-18):
 ===========================================
 Live versions of these release notes can be found at:
@@ -694,7 +1296,7 @@ device paths such as `NUL:` are *not* used.
 New in release OpenJDK 8u332 (2022-04-22):
 ===========================================
 Live versions of these release notes can be found at:
-  * https://bit.ly/openjdk8u332
+  * https://bitly.com/openjdk8u332
   * https://builds.shipilev.net/backports-monitor/release-notes-openjdk8u332.txt
 
 * Security fixes

SOURCES/java-1.8.0-openjdk-portable.specfile

@@ -108,6 +108,8 @@
 %global ssbd_arches x86_64
 # Set of architectures where we verify backtraces with gdb
 %global gdb_arches %{jit_arches} %{zero_arches}
+# Architecture on which we run Java only tests
+%global jdk_test_arch x86_64
 
 # By default, we build a debug build during main build on JIT architectures
 %if %{with slowdebug}
@@ -268,7 +270,7 @@
 # Define version of OpenJDK 8 used
 %global project openjdk
 %global repo shenandoah-jdk8u
-%global openjdk_revision 8u412-b08
+%global openjdk_revision 8u422-b05
 %global shenandoah_revision shenandoah%{openjdk_revision}
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      3.15.0
@@ -314,7 +316,7 @@
 %global updatever       %(VERSION=%{whole_update}; echo ${VERSION##*u})
 # eg jdk8u60-b27 -> b27
 %global buildver        %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global rpmrelease      2
+%global rpmrelease      1
 # Define milestone (EA for pre-releases, GA ("fcs") for releases)
 # Release will be (where N is usually a number starting at 1):
 # - 0.N%%{?extraver}%%{?dist} for EA releases,
@@ -476,9 +478,6 @@ Source17: nss.fips.cfg.in
 # Ensure translations are available for new timezones
 Source18: TestTranslations.java
 
-# Disabled in portables
-#Source20: repackReproduciblePolycies.sh
-
 # New versions of config files with aarch64 support. This is not upstream yet.
 Source100: config.guess
 Source101: config.sub
@@ -669,17 +668,15 @@ BuildRequires: nss-devel
 #BuildRequires: crypto-policies
 BuildRequires: pkgconfig
 BuildRequires: xorg-x11-proto-devel
-BuildRequires: zip
 BuildRequires: tar
 BuildRequires: unzip
+BuildRequires: zip
 # Require a boot JDK which doesn't fail due to RH1482244
 BuildRequires: java-%{buildjdkver}-openjdk-devel >= 1.7.0.151-2.6.11.3
 # Zero-assembler build requirement
 %ifarch %{zero_arches}
 BuildRequires: libffi-devel
 %endif
-# 2024a required as of JDK-8325150
-BuildRequires: tzdata-java >= 2024a
 # Earlier versions have a bug in tree vectorization on PPC
 BuildRequires: gcc >= 4.8.3-8
 
@@ -694,17 +691,18 @@ BuildRequires: giflib-devel
 BuildRequires: lcms2-devel
 BuildRequires: libjpeg-devel
 BuildRequires: libpng-devel
+BuildRequires: zlib-devel
 %else
-# Version in jdk/src/share/native/java/util/zip/zlib/zlib.h
-Provides: bundled(zlib) = 1.2.13
 # Version in jdk/src/share/native/sun/awt/giflib/gif_lib.h
 Provides: bundled(giflib) = 5.2.1
 # Version in jdk/src/share/native/sun/java2d/cmm/lcms/lcms2.h
-Provides: bundled(lcms2) = 2.10.0
+Provides: bundled(lcms2) = 2.11.0
 # Version in jdk/src/share/native/sun/awt/image/jpeg/jpeglib.h
 Provides: bundled(libjpeg) = 6b
 # Version in jdk/src/share/native/sun/awt/libpng/png.h
 Provides: bundled(libpng) = 1.6.39
+# Version in jdk/src/share/native/java/util/zip/zlib/zlib.h
+Provides: bundled(zlib) = 1.2.13
 # We link statically against libstdc++ to increase portability
 BuildRequires: libstdc++-static
 %endif
@@ -866,7 +864,6 @@ sh %{SOURCE12}
 %patch -P105
 
 # Upstreamable fixes
-%patch -P502
 %patch -P512
 %patch -P523
 %patch -P528
@@ -876,6 +873,9 @@ sh %{SOURCE12}
 %patch -P581
 %patch -P541
 %patch -P12
+pushd %{top_level_dir_name}
+%patch -P502 -p1
+popd
 
 pushd %{top_level_dir_name}
 # Add crypto policy and FIPS support
@@ -1148,6 +1148,13 @@ function packagejdk() {
     jdkarchive=${packagesdir}/%{jdkportablearchive -- "$nameSuffix"}
     jrename=%{jreportablename -- "$nameSuffix"}
     jrearchive=${packagesdir}/%{jreportablearchive -- "$nameSuffix"}
+
+    # Rename directories for packaging
+    cp -r %{jdkimage} ${jdkname}
+    cp -r %{jreimage} ${jrename}
+
+    # Release images have external debug symbols
+    if [ "x$suffix" = "x" ] ; then
         debugjdkarchive=${packagesdir}/%{jdkportablearchive -- "${nameSuffix}.debuginfo"}
         debugjrearchive=${packagesdir}/%{jreportablearchive -- "${nameSuffix}.debuginfo"}
         unstrippedarchive=${packagesdir}/%{jdkportablearchive -- "${nameSuffix}.unstripped"}
@@ -1159,12 +1166,6 @@ function packagejdk() {
         miscname=%{miscportablename}
         miscarchive=${packagesdir}/%{miscportablearchive}
 
-    # Rename directories for packaging
-    cp -r %{jdkimage} ${jdkname}
-    cp -r %{jreimage} ${jrename}
-
-    # Release images have external debug symbols
-    if [ "x$suffix" = "x" ] ; then
         # Keep the unstripped version for consumption by RHEL RPMs
         tar ${tar_opts} ${unstrippedarchive} ${jdkname}
         genchecksum ${unstrippedarchive}
@@ -1289,27 +1290,54 @@ for suffix in %{build_loop} ; do
 
 export JAVA_HOME=$(pwd)/%{installoutputdir -- $suffix}/images/%{jdkimage}
 
-# Check unlimited policy has been used
+# Only test on one architecture (the fastest) for Java only tests
-$JAVA_HOME/bin/javac -d . %{SOURCE13}
+%ifarch %{jdk_test_arch}
-$JAVA_HOME/bin/java TestCryptoLevel
 
-# Check ECC is working
+  # Check unlimited policy has been used
-$JAVA_HOME/bin/javac -d . %{SOURCE14}
+  $JAVA_HOME/bin/javac -d . %{SOURCE13}
-$JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||")
+  $JAVA_HOME/bin/java TestCryptoLevel
 
-# Check system crypto (policy) is active and can be disabled
+  # Check ECC is working
-# Test takes a single argument - true or false - to state whether system
+  $JAVA_HOME/bin/javac -d . %{SOURCE14}
-# security properties are enabled or not.
+  $JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||")
-$JAVA_HOME/bin/javac -d . %{SOURCE15}
-export PROG=$(echo $(basename %{SOURCE15})|sed "s|\.java||")
-export SEC_DEBUG="-Djava.security.debug=properties"
-# Portable specific: set false whereas its true for upstream
-$JAVA_HOME/bin/java ${SEC_DEBUG} ${PROG} false
-$JAVA_HOME/bin/java ${SEC_DEBUG} -Djava.security.disableSystemPropertiesFile=true ${PROG} false
 
-# Check correct vendor values have been set
+  # Check system crypto (policy) is active and can be disabled
-$JAVA_HOME/bin/javac -d . %{SOURCE16}
+  # Test takes a single argument - true or false - to state whether system
-$JAVA_HOME/bin/java $(echo $(basename %{SOURCE16})|sed "s|\.java||") "%{oj_vendor}" %{oj_vendor_url} %{oj_vendor_bug_url}
+  # security properties are enabled or not.
+  # Portable specific: default is false
+  $JAVA_HOME/bin/javac -d . %{SOURCE15}
+  export PROG=$(echo $(basename %{SOURCE15})|sed "s|\.java||")
+  export SEC_DEBUG="-Djava.security.debug=properties"
+  $JAVA_HOME/bin/java ${SEC_DEBUG} ${PROG} false
+  $JAVA_HOME/bin/java ${SEC_DEBUG} -Djava.security.disableSystemPropertiesFile=true ${PROG} false
+
+  # Check correct vendor values have been set
+  $JAVA_HOME/bin/javac -d . %{SOURCE16}
+  $JAVA_HOME/bin/java $(echo $(basename %{SOURCE16})|sed "s|\.java||") "%{oj_vendor}" %{oj_vendor_url} %{oj_vendor_bug_url}
+
+  # Check translations are available for new timezones
+  $JAVA_HOME/bin/javac -d . %{SOURCE18}
+  $JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE
+
+  # Check src.zip has all sources. See RHBZ#1130490
+  unzip -l $JAVA_HOME/src.zip | grep 'sun.misc.Unsafe'
+
+  # Check class files include useful debugging information
+  $JAVA_HOME/bin/javap -l java.lang.Object | grep "Compiled from"
+  $JAVA_HOME/bin/javap -l java.lang.Object | grep LineNumberTable
+  $JAVA_HOME/bin/javap -l java.lang.Object | grep LocalVariableTable
+
+  # Check generated class files include useful debugging information
+  $JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep "Compiled from"
+  $JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep LineNumberTable
+  $JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep LocalVariableTable
+
+%else
+
+  # Just run a basic java -version test on other architectures
+  $JAVA_HOME/bin/java -version
+
+%endif
 
 # Check java launcher has no SSB mitigation
 if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi
@@ -1321,10 +1349,6 @@ nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation
 if ! nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation ; then true ; else false; fi
 %endif
 
-# Check translations are available for new timezones
-$JAVA_HOME/bin/javac -d . %{SOURCE18}
-$JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE
-
 # Release builds strip the debug symbols into external .debuginfo files
 if [ "x$suffix" = "x" ] ; then
   so_suffix="debuginfo"
@@ -1398,19 +1422,6 @@ EOF
 grep 'JavaCallWrapper::JavaCallWrapper' gdb.out
 %endif
 
-# Check src.zip has all sources. See RHBZ#1130490
-jar -tf $JAVA_HOME/src.zip | grep 'sun.misc.Unsafe'
-
-# Check class files include useful debugging information
-$JAVA_HOME/bin/javap -l java.lang.Object | grep "Compiled from"
-$JAVA_HOME/bin/javap -l java.lang.Object | grep LineNumberTable
-$JAVA_HOME/bin/javap -l java.lang.Object | grep LocalVariableTable
-
-# Check generated class files include useful debugging information
-$JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep "Compiled from"
-$JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep LineNumberTable
-$JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep LocalVariableTable
-
 # build cycles check
 done
 
@@ -1426,12 +1437,9 @@ for suffix in %{build_loop} ; do
         nameSuffix=`echo "$suffix"| sed s/-/./`
     fi
 
-    # These definitions should match those in installjdk
+    # These definitions should match those in packagejdk
     jdkarchive=${packagesdir}/%{jdkportablearchive -- "$nameSuffix"}
     jrearchive=${packagesdir}/%{jreportablearchive -- "$nameSuffix"}
-    debugjdkarchive=${packagesdir}/%{jdkportablearchive -- "${nameSuffix}.debuginfo"}
-    debugjrearchive=${packagesdir}/%{jreportablearchive -- "${nameSuffix}.debuginfo"}
-    unstrippedarchive=${packagesdir}/%{jdkportablearchive -- "${nameSuffix}.unstripped"}
 
     mkdir -p $RPM_BUILD_ROOT%{_jvmdir}
 
@@ -1441,32 +1449,33 @@ for suffix in %{build_loop} ; do
     mv ${jrearchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/
 
     if [ "x$suffix" = "x" ] ; then
+        # These definitions should match those in packagejdk
+        debugjdkarchive=${packagesdir}/%{jdkportablearchive -- "${nameSuffix}.debuginfo"}
+        debugjrearchive=${packagesdir}/%{jreportablearchive -- "${nameSuffix}.debuginfo"}
+        unstrippedarchive=${packagesdir}/%{jdkportablearchive -- "${nameSuffix}.unstripped"}
+        docarchive=${packagesdir}/%{docportablearchive}
+        miscarchive=${packagesdir}/%{miscportablearchive}
+
         mv ${debugjdkarchive} $RPM_BUILD_ROOT%{_jvmdir}/
         mv ${debugjdkarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/
         mv ${debugjrearchive} $RPM_BUILD_ROOT%{_jvmdir}/
         mv ${debugjrearchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/
         mv ${unstrippedarchive} $RPM_BUILD_ROOT%{_jvmdir}/
         mv ${unstrippedarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/
+        mv ${docarchive} $RPM_BUILD_ROOT%{_jvmdir}/
+        mv ${docarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/
+        mv ${miscarchive} $RPM_BUILD_ROOT%{_jvmdir}/
+        mv ${miscarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/
     fi
+
 done
 
-# These definitions should match those in installjdk
-# Install outside the loop as there are no debug variants
-docarchive=${packagesdir}/%{docportablearchive}
-miscarchive=${packagesdir}/%{miscportablearchive}
-
-mv ${docarchive} $RPM_BUILD_ROOT%{_jvmdir}/
-mv ${docarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/
-mv ${miscarchive} $RPM_BUILD_ROOT%{_jvmdir}/
-mv ${miscarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/
-
 # To show sha in the build log
 for file in `ls $RPM_BUILD_ROOT%{_jvmdir}/*.sha256sum` ; do
     ls -l $file ;
     cat $file ;
 done
 
-
 %if %{include_normal_build}
 
 %files
@@ -1475,23 +1484,36 @@ done
 %{_jvmdir}/%{jreportablearchive -- .debuginfo}
 %{_jvmdir}/%{jreportablearchive -- %%{nil}}.sha256sum
 %{_jvmdir}/%{jreportablearchive -- .debuginfo}.sha256sum
+
 %else
+
 %files
 # placeholder
+
 %endif
 
 %if %{include_normal_build}
+
 %files devel
 %{_jvmdir}/%{jdkportablearchive -- %%{nil}}
 %{_jvmdir}/%{jdkportablearchive -- .debuginfo}
 %{_jvmdir}/%{jdkportablearchive -- %%{nil}}.sha256sum
 %{_jvmdir}/%{jdkportablearchive -- .debuginfo}.sha256sum
-%endif
 
 %files unstripped
 %{_jvmdir}/%{jdkportablearchive -- .unstripped}
 %{_jvmdir}/%{jdkportablearchive -- .unstripped}.sha256sum
 
+%files docs
+%{_jvmdir}/%{docportablearchive}
+%{_jvmdir}/%{docportablearchive}.sha256sum
+
+%files misc
+%{_jvmdir}/%{miscportablearchive}
+%{_jvmdir}/%{miscportablearchive}.sha256sum
+
+%endif
+
 %if %{include_debug_build}
 
 %files slowdebug
@@ -1501,6 +1523,7 @@ done
 %files devel-slowdebug
 %{_jvmdir}/%{jdkportablearchive -- .slowdebug}
 %{_jvmdir}/%{jdkportablearchive -- .slowdebug}.sha256sum
+
 %endif
 
 %if %{include_fastdebug_build}
@@ -1515,15 +1538,29 @@ done
 
 %endif
 
-%files docs
-%{_jvmdir}/%{docportablearchive}
-%{_jvmdir}/%{docportablearchive}.sha256sum
-
-%files misc
-%{_jvmdir}/%{miscportablearchive}
-%{_jvmdir}/%{miscportablearchive}.sha256sum
-
 %changelog
+* Wed Jul 10 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.422.b05-1.1
+- Update to shenandoah-jdk8u422-b05 (GA)
+- Update release notes for shenandoah-8u422-b05.
+- Rebase PR2462 patch following patched hunk being removed by JDK-8322106
+- Switch to GA mode.
+- Limit Java only tests to one architecture using jdk_test_arch
+- Remove unused policy repacking script repackReproduciblePolycies.sh
+- Sync README.md with RHEL 8
+- Add missing build dependency on zlib-devel
+- Update LCMS version to match JDK-8245400
+- Move unstripped, misc and doc tarball handling into normal build / no suffix blocks
+- Drop unneeded tzdata-java build dependency following 11d4d3308dd3334acae563101c007be9db017b83
+- ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **
+- Resolves: OPENJDK-3183
+- Resolves: OPENJDK-3187
+- Resolves: OPENJDK-3193
+
+* Tue Jul 09 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.422.b01-0.1.ea
+- Update to shenandoah-jdk8u422-b01 (EA)
+- Update release notes for shenandoah-8u422-b01.
+- Switch to EA mode.
+
 * Wed Apr 10 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.412.b08-2
 - Add CVEs to release notes
 

SOURCES/java-1.8.0-openjdk-remove-intree-libraries.sh

@@ -1,131 +0,0 @@
-#!/bin/sh
-
-ZIP_SRC=openjdk/jdk/src/share/native/java/util/zip/zlib
-JPEG_SRC=openjdk/jdk/src/share/native/sun/awt/image/jpeg
-GIF_SRC=openjdk/jdk/src/share/native/sun/awt/giflib
-PNG_SRC=openjdk/jdk/src/share/native/sun/awt/libpng
-LCMS_SRC=openjdk/jdk/src/share/native/sun/java2d/cmm/lcms
-
-echo "Removing built-in libs (they will be linked)"
-
-echo "Removing zlib"
-if [ ! -d ${ZIP_SRC} ]; then
-	echo "${ZIP_SRC} does not exist. Refusing to proceed."
-	exit 1
-fi	
-rm -rvf ${ZIP_SRC}
-
-echo "Removing libjpeg"
-if [ ! -f ${JPEG_SRC}/jdhuff.c ]; then # some file that sound definitely exist
-	echo "${JPEG_SRC} does not contain jpeg sources. Refusing to proceed."
-	exit 1
-fi	
-
-rm -vf ${JPEG_SRC}/jcomapi.c
-rm -vf ${JPEG_SRC}/jdapimin.c
-rm -vf ${JPEG_SRC}/jdapistd.c
-rm -vf ${JPEG_SRC}/jdcoefct.c
-rm -vf ${JPEG_SRC}/jdcolor.c
-rm -vf ${JPEG_SRC}/jdct.h
-rm -vf ${JPEG_SRC}/jddctmgr.c
-rm -vf ${JPEG_SRC}/jdhuff.c
-rm -vf ${JPEG_SRC}/jdhuff.h
-rm -vf ${JPEG_SRC}/jdinput.c
-rm -vf ${JPEG_SRC}/jdmainct.c
-rm -vf ${JPEG_SRC}/jdmarker.c
-rm -vf ${JPEG_SRC}/jdmaster.c
-rm -vf ${JPEG_SRC}/jdmerge.c
-rm -vf ${JPEG_SRC}/jdphuff.c
-rm -vf ${JPEG_SRC}/jdpostct.c
-rm -vf ${JPEG_SRC}/jdsample.c
-rm -vf ${JPEG_SRC}/jerror.c
-rm -vf ${JPEG_SRC}/jerror.h
-rm -vf ${JPEG_SRC}/jidctflt.c
-rm -vf ${JPEG_SRC}/jidctfst.c
-rm -vf ${JPEG_SRC}/jidctint.c
-rm -vf ${JPEG_SRC}/jidctred.c
-rm -vf ${JPEG_SRC}/jinclude.h
-rm -vf ${JPEG_SRC}/jmemmgr.c
-rm -vf ${JPEG_SRC}/jmemsys.h
-rm -vf ${JPEG_SRC}/jmemnobs.c
-rm -vf ${JPEG_SRC}/jmorecfg.h
-rm -vf ${JPEG_SRC}/jpegint.h
-rm -vf ${JPEG_SRC}/jpeglib.h
-rm -vf ${JPEG_SRC}/jquant1.c
-rm -vf ${JPEG_SRC}/jquant2.c
-rm -vf ${JPEG_SRC}/jutils.c
-rm -vf ${JPEG_SRC}/jcapimin.c
-rm -vf ${JPEG_SRC}/jcapistd.c
-rm -vf ${JPEG_SRC}/jccoefct.c
-rm -vf ${JPEG_SRC}/jccolor.c
-rm -vf ${JPEG_SRC}/jcdctmgr.c
-rm -vf ${JPEG_SRC}/jchuff.c
-rm -vf ${JPEG_SRC}/jchuff.h
-rm -vf ${JPEG_SRC}/jcinit.c
-rm -vf ${JPEG_SRC}/jconfig.h
-rm -vf ${JPEG_SRC}/jcmainct.c
-rm -vf ${JPEG_SRC}/jcmarker.c
-rm -vf ${JPEG_SRC}/jcmaster.c
-rm -vf ${JPEG_SRC}/jcparam.c
-rm -vf ${JPEG_SRC}/jcphuff.c
-rm -vf ${JPEG_SRC}/jcprepct.c
-rm -vf ${JPEG_SRC}/jcsample.c
-rm -vf ${JPEG_SRC}/jctrans.c
-rm -vf ${JPEG_SRC}/jdtrans.c
-rm -vf ${JPEG_SRC}/jfdctflt.c
-rm -vf ${JPEG_SRC}/jfdctfst.c
-rm -vf ${JPEG_SRC}/jfdctint.c
-rm -vf ${JPEG_SRC}/jversion.h
-rm -vf ${JPEG_SRC}/README
-
-echo "Removing giflib"
-if [ ! -d ${GIF_SRC} ]; then
-	echo "${GIF_SRC} does not exist. Refusing to proceed."
-	exit 1
-fi	
-rm -rvf ${GIF_SRC}
-
-echo "Removing libpng"
-if [ ! -d ${PNG_SRC} ]; then
-	echo "${PNG_SRC} does not exist. Refusing to proceed."
-	exit 1
-fi	
-rm -rvf ${PNG_SRC}
-
-echo "Removing lcms"
-if [ ! -d ${LCMS_SRC} ]; then
-	echo "${LCMS_SRC} does not exist. Refusing to proceed."
-	exit 1
-fi
-# temporary change to move bundled LCMS
-if [ ! true ]; then
-rm -vf ${LCMS_SRC}/cmsalpha.c
-rm -vf ${LCMS_SRC}/cmscam02.c
-rm -vf ${LCMS_SRC}/cmscgats.c
-rm -vf ${LCMS_SRC}/cmscnvrt.c
-rm -vf ${LCMS_SRC}/cmserr.c
-rm -vf ${LCMS_SRC}/cmsgamma.c
-rm -vf ${LCMS_SRC}/cmsgmt.c
-rm -vf ${LCMS_SRC}/cmshalf.c
-rm -vf ${LCMS_SRC}/cmsintrp.c
-rm -vf ${LCMS_SRC}/cmsio0.c
-rm -vf ${LCMS_SRC}/cmsio1.c
-rm -vf ${LCMS_SRC}/cmslut.c
-rm -vf ${LCMS_SRC}/cmsmd5.c
-rm -vf ${LCMS_SRC}/cmsmtrx.c
-rm -vf ${LCMS_SRC}/cmsnamed.c
-rm -vf ${LCMS_SRC}/cmsopt.c
-rm -vf ${LCMS_SRC}/cmspack.c
-rm -vf ${LCMS_SRC}/cmspcs.c
-rm -vf ${LCMS_SRC}/cmsplugin.c
-rm -vf ${LCMS_SRC}/cmsps2.c
-rm -vf ${LCMS_SRC}/cmssamp.c
-rm -vf ${LCMS_SRC}/cmssm.c
-rm -vf ${LCMS_SRC}/cmstypes.c
-rm -vf ${LCMS_SRC}/cmsvirt.c
-rm -vf ${LCMS_SRC}/cmswtpnt.c
-rm -vf ${LCMS_SRC}/cmsxform.c
-rm -vf ${LCMS_SRC}/lcms2.h
-rm -vf ${LCMS_SRC}/lcms2_internal.h
-rm -vf ${LCMS_SRC}/lcms2_plugin.h
-fi

SOURCES/pr2462-resolve_disabled_warnings_for_libunpack_and_the_unpack200_binary.patch

@@ -7,10 +7,10 @@
 8074839: Resolve disabled warnings for libunpack and the unpack200 binary
 Reviewed-by: dholmes, ksrini
 
-diff --git openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h
+diff --git a/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h b/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h
 index bdaf95a2f6a..60c5b4f2a69 100644
---- openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h
+--- a/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h
-+++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h
++++ b/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h
 @@ -63,7 +63,7 @@ struct bytes {
      bytes res;
      res.ptr = ptr + beg;
@@ -20,10 +20,10 @@ index bdaf95a2f6a..60c5b4f2a69 100644
      return res;
    }
    // building C strings inside byte buffers:
-diff --git openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp
+diff --git a/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp b/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp
 index 5fbc7261fb3..4c002e779d8 100644
---- openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp
+--- a/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp
-+++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp
++++ b/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp
 @@ -292,7 +292,7 @@ Java_com_sun_java_util_jar_pack_NativeUnpack_getUnusedInput(JNIEnv *env, jobject
  
    if (uPtr->aborting()) {
@@ -50,10 +50,10 @@ index 5fbc7261fb3..4c002e779d8 100644
    const char* prop  = env->GetStringUTFChars(pProp, JNI_FALSE);
    CHECK_EXCEPTION_RETURN_VALUE(prop, false);
    const char* value = env->GetStringUTFChars(pValue, JNI_FALSE);
-diff --git openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp
+diff --git a/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp b/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp
 index 6fbc43a18ae..722c8baaff0 100644
---- openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp
+--- a/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp
-+++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp
++++ b/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp
 @@ -142,31 +142,28 @@ static const char* nbasename(const char* progname) {
    return progname;
  }
@@ -104,10 +104,10 @@ index 6fbc43a18ae..722c8baaff0 100644
    }
  }
  
-diff --git openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp
+diff --git a/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp b/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp
-index 56f391b1e87..f0a25f8cd20 100644
+index a585535c513..8df3fade499 100644
---- openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp
+--- a/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp
-+++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp
++++ b/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp
 @@ -225,9 +225,9 @@ struct entry {
    }
  
@@ -120,7 +120,7 @@ index 56f391b1e87..f0a25f8cd20 100644
  #endif
  };
  
-@@ -718,13 +718,13 @@ void unpacker::read_file_header() {
+@@ -719,13 +719,13 @@ void unpacker::read_file_header() {
    // Now we can size the whole archive.
    // Read everything else into a mega-buffer.
    rp = hdr.rp;
@@ -138,7 +138,7 @@ index 56f391b1e87..f0a25f8cd20 100644
        abort("EOF reading fixed input buffer");
        return;
      }
-@@ -738,7 +738,7 @@ void unpacker::read_file_header() {
+@@ -739,7 +739,7 @@ void unpacker::read_file_header() {
        return;
      }
      input.set(U_NEW(byte, add_size(header_size_0, archive_size, C_SLOP)),
@@ -147,7 +147,7 @@ index 56f391b1e87..f0a25f8cd20 100644
      CHECK;
      assert(input.limit()[0] == 0);
      // Move all the bytes we read initially into the real buffer.
-@@ -961,13 +961,13 @@ void cpool::init(unpacker* u_, int counts[CONSTANT_Limit]) {
+@@ -962,13 +962,13 @@ void cpool::init(unpacker* u_, int counts[CONSTANT_Limit]) {
    nentries = next_entry;
  
    // place a limit on future CP growth:
@@ -163,18 +163,7 @@ index 56f391b1e87..f0a25f8cd20 100644
  
    // Note that this CP does not include "empty" entries
    // for longs and doubles.  Those are introduced when
-@@ -985,8 +985,9 @@ void cpool::init(unpacker* u_, int counts[CONSTANT_Limit]) {
+@@ -3694,21 +3694,22 @@ void cpool::computeOutputIndexes() {
-   }
- 
-   // Initialize *all* our entries once
--  for (int i = 0 ; i < maxentries ; i++)
-+  for (uint i = 0 ; i < maxentries ; i++) {
-     entries[i].outputIndex = REQUESTED_NONE;
-+  }
- 
-   initGroupIndexes();
-   // Initialize hashTab to a generous power-of-two size.
-@@ -3681,21 +3682,22 @@ void cpool::computeOutputIndexes() {
  
  unpacker* debug_u;
  
@@ -201,7 +190,7 @@ index 56f391b1e87..f0a25f8cd20 100644
    case CONSTANT_Signature:
      if (value.b.ptr == null)
        return ref(0)->string();
-@@ -3715,26 +3717,28 @@ char* entry::string() {
+@@ -3728,26 +3729,28 @@ char* entry::string() {
      break;
    default:
      if (nrefs == 0) {
@@ -239,10 +228,10 @@ index 56f391b1e87..f0a25f8cd20 100644
  }
  
  void print_cp_entries(int beg, int end) {
-diff --git openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h
+diff --git a/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h b/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h
-index cec7a88b24e..ed5f3336a59 100644
+index 4ec595333c4..aad0c971ef2 100644
---- openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h
+--- a/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h
-+++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h
++++ b/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h
 @@ -209,7 +209,7 @@ struct unpacker {
    byte*     rp;          // read pointer (< rplimit <= input.limit())
    byte*     rplimit;     // how much of the input block has been read?
@@ -252,10 +241,10 @@ index cec7a88b24e..ed5f3336a59 100644
  
    // callback to read at least one byte, up to available input
    typedef jlong (*read_input_fn_t)(unpacker* self, void* buf, jlong minlen, jlong maxlen);
-diff --git openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp
+diff --git a/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp b/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp
-index e5197e1a3f1..40a10055ea5 100644
+index da39a589545..1281d8b25c8 100644
---- openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp
+--- a/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp
-+++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp
++++ b/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp
 @@ -81,7 +81,7 @@ void breakpoint() { }  // hook for debugger
  int assert_failed(const char* p) {
    char message[1<<12];
@@ -265,10 +254,10 @@ index e5197e1a3f1..40a10055ea5 100644
    breakpoint();
    unpack_abort(message);
    return 0;
-diff --git openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp
+diff --git a/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp b/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp
 index f58c94956c0..343da3e183b 100644
---- openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp
+--- a/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp
-+++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp
++++ b/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp
 @@ -84,7 +84,7 @@ void jar::init(unpacker* u_) {
  }
  
@@ -293,10 +282,10 @@ index f58c94956c0..343da3e183b 100644
  
    PRINTCR((2, "writing zip comment\n"));
    // Write the comment.
-diff --git openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h
+diff --git a/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h b/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h
 index 14ffc9d65bd..9877f6f68ca 100644
---- openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h
+--- a/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h
-+++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h
++++ b/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h
 @@ -68,8 +68,8 @@ struct jar {
    }