From b671cef4f62e72be4e586e63860e68c319e80529 Mon Sep 17 00:00:00 2001 From: Andrew Hughes Date: Wed, 6 May 2026 07:56:25 +0100 Subject: [PATCH] Update to 8u502-b07 (GA). - Update release notes for 8u502-b07. - Bump lcms2 version to 2.19.1 following JDK-8321489, JDK-8348110, JDK-8375065 & JDK-8383354 - Bump zlib version to 1.3.2 following JDK-8378631 ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** Resolves: RHEL-188852 --- .gitignore | 7 ++++ NEWS | 85 +++++++++++++++++++++++++++++++++++++++++ java-1.8.0-openjdk.spec | 27 ++++++++----- sources | 2 +- 4 files changed, 110 insertions(+), 11 deletions(-) diff --git a/.gitignore b/.gitignore index d8afec7..d85ed76 100644 --- a/.gitignore +++ b/.gitignore @@ -471,3 +471,10 @@ /openjdk8u492-b07-ea.tar.xz /openjdk8u492-b08-ea.tar.xz /shenandoah8u492-b09.tar.xz +/openjdk8u492-b09.tar.xz +/openjdk8u502-b01-ea.tar.xz +/openjdk8u502-b03-ea.tar.xz +/openjdk8u502-b04-ea.tar.xz +/openjdk8u502-b05-ea.tar.xz +/openjdk8u502-b07.tar.xz +/shenandoah8u502-b07.tar.xz diff --git a/NEWS b/NEWS index b03f669..aea4751 100644 --- a/NEWS +++ b/NEWS @@ -3,6 +3,91 @@ Key: JDK-X - https://bugs.openjdk.java.net/browse/JDK-X CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY +New in release OpenJDK 8u502 (2026-07-21): +=========================================== +Live versions of these release notes can be found at: + * https://bit.ly/openjdk8u502 + +* Changes + - JDK-6815126: intermittent SimulResumerTest.java failure + - JDK-8162545: Mac build failure + - JDK-8199138: Add RISC-V support to Zero + - JDK-8209362: sun/security/ssl/SSLSocketImpl/ReuseAddr.java failed due to "BindException: Address already in use (Bind failed)" + - JDK-8246330: Add TLS Tests for Legacy ECDSA curves + - JDK-8249159: Downport test rework for SSLSocketTemplate from 8224650 + - JDK-8261235: C1 compilation fails with assert(res->vreg_number() == index) failed: conversion check + - JDK-8273135: java/awt/color/ICC_ColorSpace/MTTransformReplacedProfile.java crashes in liblcms.dylib with NULLSeek+0x7 + - JDK-8274736: Concurrent read/close of SSLSockets causes SSLSessions to be invalidated unnecessarily + - JDK-8280158: New test from JDK-8274736 failed with/without patch in JDK11u + - JDK-8298873: Update IllegalRecordVersion.java for changes to TLS implementation + - JDK-8301189: validate-source fails after JDK-8298873 + - JDK-8314730: GHA: Drop libfreetype6-dev transitional package in favor of libfreetype-dev + - JDK-8321489: Update LCMS to 2.16 + - JDK-8336451: [11u] GHA macos-13 and macos-15 builders are unable to resolve local hostname + - JDK-8348110: Update LCMS to 2.17 + - JDK-8351359: OperatingSystemMXBean: values from getCpuLoad and getProcessCpuLoad are stale after 24.8 days (Windows) + - JDK-8363966: GHA: Switch cross-compiling sysroots to Debian trixie + - JDK-8368041: Enhance TLS certificate handling + - JDK-8369996: Testcase java/net/Socket/B8312065.java fails on Mac, AIX and Solaris + - JDK-8372351: Add 2 WISeKey roots + - JDK-8374058: Enhance JPEG handling + - JDK-8374888: Implement internal test cache to help UserIterCount test performance + - JDK-8375065: Update LCMS to 2.18 + - JDK-8377158: Enhance XBM image support + - JDK-8377498: Improve HttpServer handling + - JDK-8377833: Enhance Jar file processing + - JDK-8378631: Update Zlib Data Compression Library to Version 1.3.2 + - JDK-8378687: Improve delegation of HttpURLConnection + - JDK-8379684: Bump update version of OpenJDK: 8u502 + - JDK-8380377: [8u] Problem list CAInterop.java#teliarootcav2 + - JDK-8380672: Improve certification checking + - JDK-8380689: distrust/Chunghwa.java test fails with a compilation error + - JDK-8380947: Add pull request template + - JDK-8381039: Enhance AWT ImagingLib + - JDK-8381049: Enhance Jar handling + - JDK-8381185: Improve Nashorn index handling + - JDK-8381195: Enhance Dataview Implementation + - JDK-8381519: Enhance Der Value Handling + - JDK-8381796: Enhance Certificate parsing + - JDK-8383175: (tz) Update Timezone Data to 2026b + - JDK-8383354: Update LCMS to 2.19.1 + - JDK-8383473: Follow on from tzdata2026b time change to include temporary hack BC time change + - JDK-8384158: GHA: Downgrade Windows GHA runners to windows-2022 temporarily + +security-libs/java.security: + +JDK-8372351: Add 2 WISeKey roots +================================ +The following root certificates have been added to the cacerts +truststore: + +Alias Name: wisekeyglobalrootgbca +Distinguished Name: CN=OISTE WISeKey Global Root GB CA, OU=OISTE Foundation Endorsed, O=WISeKey, C=CH +Serial Number: 76b1205274f0858746b3f8231af6c2c0 +Valid From: Mon Dec 01 15:00:32 GMT 2014 +Valid Until: Thu Dec 01 15:10:31 GMT 2039 + +Alias Name: wisekeyglobalrootgcca +Distinguished Name: CN=OISTE WISeKey Global Root GC CA, OU=OISTE Foundation Endorsed, O=WISeKey, C=CH +Serial Number: 212a560caeda0cab4045bf2ba22d3aea +Valid From: Tue May 09 09:48:34 GMT 2017 +Valid Until: Fri May 09 09:58:33 GMT 2042 + +JDK-8381796: Enhance Certificate parsing +======================================== +With this release of OpenJDK, a security and system property +`com.sun.security.crl.maxSize` is introduced which acts as a maximum +size limit on a Certificate Revocation List (CRL) downloaded over the +network. For URICertStore requests, the value is the maximum size in +bytes of the DER-encoded CRL. For LDAPCertStore queries, the +threshold is the sum of all CRLs downloaded from a single search. By +default, the maximum size is 20MiB (20971520 bytes) and CRLs larger +than this will be discarded. A value less than zero may be used to +turn off the size limit and non-numeric values will be ignored. A +non-empty value for the system property takes precedence over the +security property. Enabling 'certpath' debug logging will output the +current size limit and note any discarded CRLs. + New in release OpenJDK 8u492 (2026-04-21): =========================================== Live versions of these release notes can be found at: diff --git a/java-1.8.0-openjdk.spec b/java-1.8.0-openjdk.spec index 16cd356..dd1d396 100644 --- a/java-1.8.0-openjdk.spec +++ b/java-1.8.0-openjdk.spec @@ -314,7 +314,7 @@ # Define version of OpenJDK 8 used %global project openjdk %global repo shenandoah-jdk8u -%global openjdk_revision 8u492-b09 +%global openjdk_revision 8u502-b07 %global shenandoah_revision shenandoah%{openjdk_revision} # Define IcedTea version used for SystemTap tapsets and desktop files %global icedteaver 3.15.0 @@ -360,9 +360,9 @@ %global updatever %(VERSION=%{whole_update}; echo ${VERSION##*u}) # eg jdk8u60-b27 -> b27 %global buildver %(VERSION=%{version_tag}; echo ${VERSION##*-}) -%global rpmrelease 3 +%global rpmrelease 1 # Settings used by the portable build -%global portablerelease 2 +%global portablerelease 1 # Portable suffix differs between RHEL and CentOS %if 0%{?centos} == 0 %global portablerhel 8 @@ -1281,8 +1281,8 @@ Provides: jre%{?1} = %{epoch}:%{version}-%{release} Requires: ca-certificates # Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros Requires: javapackages-filesystem -# 2026a required as of JDK-8379035 -Requires: tzdata-java >= 2026a +# 2026b required as of JDK-8383175 +Requires: tzdata-java >= 2026b # for support of kernel stream control # libsctp.so.1 is being `dlopen`ed on demand Requires: lksctp-tools%{?_isa} @@ -1697,8 +1697,8 @@ BuildRequires: java-%{buildjdkver}-openjdk-devel >= 1.7.0.151-2.6.11.3 BuildRequires: libffi BuildRequires: libffi-devel %endif -# 2026a required as of JDK-8379035 -BuildRequires: tzdata-java >= 2026a +# 2026b required as of JDK-8383175 +BuildRequires: tzdata-java >= 2026b # Earlier versions have a bug in tree vectorization on PPC BuildRequires: gcc >= 4.8.3-8 @@ -1719,13 +1719,13 @@ Provides: bundled(freetype) = 2.14.2 # Version in jdk/src/share/native/sun/awt/giflib/gif_lib.h Provides: bundled(giflib) = 6.1.2 # Version in jdk/src/share/native/sun/java2d/cmm/lcms/lcms2.h -Provides: bundled(lcms2) = 2.15.0 +Provides: bundled(lcms2) = 2.19.1 # Version in jdk/src/share/native/sun/awt/image/jpeg/jpeglib.h Provides: bundled(libjpeg) = 6b # Version in jdk/src/share/native/sun/awt/libpng/png.h Provides: bundled(libpng) = 1.6.57 # Version in jdk/src/share/native/java/util/zip/zlib/zlib.h -Provides: bundled(zlib) = 1.3.1 +Provides: bundled(zlib) = 1.3.2 %ifnarch %{portable_build_arches} # We link statically against libstdc++ to increase portability BuildRequires: libstdc++-static @@ -2970,10 +2970,17 @@ cjc.mainProgram(args) %endif %changelog -* Wed Jul 15 2026 Andrew Hughes - 1:1.8.0.492.b09-3 +* Fri Jul 17 2026 Andrew Hughes - 1:1.8.0.502.b07-1 +- Update to 8u502-b07 (GA). +- Update release notes for 8u502-b07. +- Bump lcms2 version to 2.19.1 following JDK-8321489, JDK-8348110, JDK-8375065 & JDK-8383354 +- Bump zlib version to 1.3.2 following JDK-8378631 +- Require tzdata 2026b due to upstream inclusion of JDK-8383175 - Add attempted patch for JDK-8385876 to fix -Wnonnull build failure with s390x Zero on CentOS 9 - Sync the copy of the portable specfile with the latest update +- ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** - Resolves: RHEL-212095 +- Resolves: RHEL-188852 * Mon Apr 20 2026 Andrew Hughes - 1:1.8.0.492.b09-2 - Bump release for PQC build diff --git a/sources b/sources index cf9065b..0e97e7d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (tapsets-icedtea-3.15.0.tar.xz) = c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671 -SHA512 (shenandoah8u492-b09.tar.xz) = 86a6df5f8dfa8e6453eef41facaf6ddac9d4b5aa30174eac421dc953168817451bfdb5203ef36880dc8a921a7a5991566804b5f5964b68cff0ee4c8319f87e1f +SHA512 (shenandoah8u502-b07.tar.xz) = e6742755e5052c8420865d08cbdbb368ecf2568d1f76784258832c1481edd33e19f9099e0554a649283bf0e27c41c5faaab493735d87ff28ebad2dde4bdb5f17