.gitignore

@@ -1,2 +1,2 @@
-SOURCES/shenandoah8u432-b06.tar.xz
+SOURCES/openjdk-shenandoah-jdk8u-shenandoah-jdk8u362-b08-4curve.tar.xz
 SOURCES/tapsets-icedtea-3.15.0.tar.xz

.java-1.8.0-openjdk.metadata

@@ -1,2 +1,2 @@
-af2d3b85c48ecc8c22188ac687e6160658ef6aca SOURCES/shenandoah8u432-b06.tar.xz
+71e5a111b66d7a8e4234d35117e0fd663d39f9ce SOURCES/openjdk-shenandoah-jdk8u-shenandoah-jdk8u362-b08-4curve.tar.xz
 7ae2cba67467825b2c2a5fec7aea041865023002 SOURCES/tapsets-icedtea-3.15.0.tar.xz

SOURCES/README.md

@@ -1,34 +1,8 @@
-OpenJDK 8 is a Long-Term Support (LTS) release of the Java platform.
+Package of LTS OpenJDK 8
+OpenJDK have release cadence of 6 months. but 3/4 of them are Short Term Supported for 6 months only. This package is designed to harbore them. Currently it is build on openJDK 10. LTSs (next is 11) will go as separate packages. 
 
-For a list of major changes in OpenJDK 8 (java-1.8.0-openjdk), see the
+JDK8 is last LTS release of Java platform. It is bringing many cool improvements - http://openjdk.java.net/projects/jdk/8/ and is landing to your RHEL. Where it will be maintained for several years. You will always be allowed to install Used LTSs in build root, and alongside via alternatives. 
-upstream release page: https://openjdk.org/projects/jdk8/features
 
-# Rebuilding the OpenJDK package
+See announcement: http://mail.openjdk.java.net/pipermail/discuss/2017-September/004281.html
+See java SIG plans: https://jvanek.fedorapeople.org/devconf/2018/changesInjavaReleaseProcess.pdf
 
-The OpenJDK packages are now created from a single build which is then
-packaged for different major versions of Red Hat Enterprise Linux
-(RHEL). This allows the OpenJDK team to focus their efforts on the
-development and testing of this single build, rather than having
-multiple builds which only differ by the platform they were built on.
-
-This does make rebuilding the package slightly more complicated than a
-normal package. Modifications should be made to the
-`java-1.8.0-openjdk-portable.specfile` file, which can be found with
-this README file in the source RPM or installed in the documentation
-tree by the `java-1.8.0-openjdk-headless` RPM.
-
-Once the modified `java-1.8.0-openjdk-portable` RPMs are built, they
-should be installed and will produce a number of tarballs in the
-`/usr/lib/jvm` directory. The `java-1.8.0-openjdk` RPMs can then be
-built, which will use these tarballs to create the usual RPMs found in
-RHEL. The `java-1.8.0-openjdk-portable` RPMs can be uninstalled once
-the desired final RPMs are produced.
-
-Note that the `java-1.8.0-openjdk.spec` file has a hard requirement on
-the exact version of java-1.8.0-openjdk-portable to use, so this will
-need to be modified if the version or rpmrelease values are changed in
-`java-1.8.0-openjdk-portable.specfile`.
-
-To reduce the number of RPMs involved, the `fastdebug` and `slowdebug`
-builds may be disabled using `--without fastdebug` and `--without
-slowdebug`.

SOURCES/jdk8186464-rh1433262-zip64_failure.patch

@@ -1,286 +0,0 @@
-# HG changeset patch
-# User sherman
-# Date 1505950914 25200
-#      Wed Sep 20 16:41:54 2017 -0700
-# Node ID 723486922bfe4c17e3f5c067ce5e97229842fbcd
-# Parent  c8ac05bbe47771b3dafa2e7fc9a95d86d68d7c07
-8186464: ZipFile cannot read some InfoZip ZIP64 zip files
-Reviewed-by: martin
-
-diff --git openjdk.orig/jdk/src/share/demo/nio/zipfs/src/com/sun/nio/zipfs/ZipFileSystem.java openjdk/jdk/src/share/demo/nio/zipfs/src/com/sun/nio/zipfs/ZipFileSystem.java
-index 26e2a5bf9e9..2630c118817 100644
---- openjdk.orig/jdk/src/share/demo/nio/zipfs/src/com/sun/nio/zipfs/ZipFileSystem.java
-+++ openjdk/jdk/src/share/demo/nio/zipfs/src/com/sun/nio/zipfs/ZipFileSystem.java
-@@ -92,6 +92,7 @@ public class ZipFileSystem extends FileSystem {
-     private final boolean createNew;     // create a new zip if not exists
-     private static final boolean isWindows =
-         System.getProperty("os.name").startsWith("Windows");
-+    private final boolean forceEnd64;
- 
-     // a threshold, in bytes, to decide whether to create a temp file
-     // for outputstream of a zip entry
-@@ -112,12 +113,13 @@ public class ZipFileSystem extends FileSystem {
-         if (this.defaultDir.charAt(0) != '/')
-             throw new IllegalArgumentException("default dir should be absolute");
- 
-+        this.forceEnd64 = "true".equals(env.get("forceZIP64End"));
-         this.provider = provider;
-         this.zfpath = zfpath;
-         if (Files.notExists(zfpath)) {
-             if (createNew) {
-                 try (OutputStream os = Files.newOutputStream(zfpath, CREATE_NEW, WRITE)) {
--                    new END().write(os, 0);
-+                    new END().write(os, 0, forceEnd64);
-                 }
-             } else {
-                 throw new FileSystemNotFoundException(zfpath.toString());
-@@ -1014,28 +1016,36 @@ public class ZipFileSystem extends FileSystem {
-                     end.cenoff = ENDOFF(buf);
-                     end.comlen = ENDCOM(buf);
-                     end.endpos = pos + i;
--                    if (end.cenlen == ZIP64_MINVAL ||
--                        end.cenoff == ZIP64_MINVAL ||
--                        end.centot == ZIP64_MINVAL32)
--                    {
--                        // need to find the zip64 end;
--                        byte[] loc64 = new byte[ZIP64_LOCHDR];
--                        if (readFullyAt(loc64, 0, loc64.length, end.endpos - ZIP64_LOCHDR)
--                            != loc64.length) {
--                            return end;
--                        }
--                        long end64pos = ZIP64_LOCOFF(loc64);
--                        byte[] end64buf = new byte[ZIP64_ENDHDR];
--                        if (readFullyAt(end64buf, 0, end64buf.length, end64pos)
--                            != end64buf.length) {
--                            return end;
--                        }
--                        // end64 found, re-calcualte everything.
--                        end.cenlen = ZIP64_ENDSIZ(end64buf);
--                        end.cenoff = ZIP64_ENDOFF(end64buf);
--                        end.centot = (int)ZIP64_ENDTOT(end64buf); // assume total < 2g
--                        end.endpos = end64pos;
-+                    // try if there is zip64 end;
-+                    byte[] loc64 = new byte[ZIP64_LOCHDR];
-+                    if (end.endpos < ZIP64_LOCHDR ||
-+                        readFullyAt(loc64, 0, loc64.length, end.endpos - ZIP64_LOCHDR)
-+                        != loc64.length ||
-+                        !locator64SigAt(loc64, 0)) {
-+                        return end;
-+                    }
-+                    long end64pos = ZIP64_LOCOFF(loc64);
-+                    byte[] end64buf = new byte[ZIP64_ENDHDR];
-+                    if (readFullyAt(end64buf, 0, end64buf.length, end64pos)
-+                        != end64buf.length ||
-+                        !end64SigAt(end64buf, 0)) {
-+                        return end;
-+                    }
-+                    // end64 found,
-+                    long cenlen64 = ZIP64_ENDSIZ(end64buf);
-+                    long cenoff64 = ZIP64_ENDOFF(end64buf);
-+                    long centot64 = ZIP64_ENDTOT(end64buf);
-+                    // double-check
-+                    if (cenlen64 != end.cenlen && end.cenlen != ZIP64_MINVAL ||
-+                        cenoff64 != end.cenoff && end.cenoff != ZIP64_MINVAL ||
-+                        centot64 != end.centot && end.centot != ZIP64_MINVAL32) {
-+                        return end;
-                     }
-+                    // to use the end64 values
-+                    end.cenlen = cenlen64;
-+                    end.cenoff = cenoff64;
-+                    end.centot = (int)centot64; // assume total < 2g
-+                    end.endpos = end64pos;
-                     return end;
-                 }
-             }
-@@ -1201,7 +1211,7 @@ public class ZipFileSystem extends FileSystem {
- 
-     // sync the zip file system, if there is any udpate
-     private void sync() throws IOException {
--        //System.out.printf("->sync(%s) starting....!%n", toString());
-+        // System.out.printf("->sync(%s) starting....!%n", toString());
-         // check ex-closer
-         if (!exChClosers.isEmpty()) {
-             for (ExChannelCloser ecc : exChClosers) {
-@@ -1292,7 +1302,7 @@ public class ZipFileSystem extends FileSystem {
-             }
-             end.centot = elist.size();
-             end.cenlen = written - end.cenoff;
--            end.write(os, written);
-+            end.write(os, written, forceEnd64);
-         }
-         if (!streams.isEmpty()) {
-             //
-@@ -1849,8 +1859,8 @@ public class ZipFileSystem extends FileSystem {
-         long endpos;
-         int disktot;
- 
--        void write(OutputStream os, long offset) throws IOException {
--            boolean hasZip64 = false;
-+        void write(OutputStream os, long offset, boolean forceEnd64) throws IOException {
-+            boolean hasZip64 = forceEnd64; // false;
-             long xlen = cenlen;
-             long xoff = cenoff;
-             if (xlen >= ZIP64_MINVAL) {
-@@ -1875,8 +1885,8 @@ public class ZipFileSystem extends FileSystem {
-                 writeShort(os, 45);               // version needed to extract
-                 writeInt(os, 0);                  // number of this disk
-                 writeInt(os, 0);                  // central directory start disk
--                writeLong(os, centot);            // number of directory entires on disk
--                writeLong(os, centot);            // number of directory entires
-+                writeLong(os, centot);            // number of directory entries on disk
-+                writeLong(os, centot);            // number of directory entries
-                 writeLong(os, cenlen);            // length of central directory
-                 writeLong(os, cenoff);            // offset of central directory
- 
-diff --git openjdk.orig/jdk/src/share/native/java/util/zip/zip_util.c openjdk/jdk/src/share/native/java/util/zip/zip_util.c
-index 5fd6fea049d..858e5814e92 100644
---- openjdk.orig/jdk/src/share/native/java/util/zip/zip_util.c
-+++ openjdk/jdk/src/share/native/java/util/zip/zip_util.c
-@@ -385,6 +385,9 @@ findEND64(jzfile *zip, void *end64buf, jlong endpos)
- {
-     char loc64[ZIP64_LOCHDR];
-     jlong end64pos;
-+    if (endpos < ZIP64_LOCHDR) {
-+	return -1;
-+    }
-     if (readFullyAt(zip->zfd, loc64, ZIP64_LOCHDR, endpos - ZIP64_LOCHDR) == -1) {
-         return -1;    // end64 locator not found
-     }
-@@ -567,6 +570,7 @@ readCEN(jzfile *zip, jint knownTotal)
- {
-     /* Following are unsigned 32-bit */
-     jlong endpos, end64pos, cenpos, cenlen, cenoff;
-+    jlong cenlen64, cenoff64, centot64;
-     /* Following are unsigned 16-bit */
-     jint total, tablelen, i, j;
-     unsigned char *cenbuf = NULL;
-@@ -594,13 +598,20 @@ readCEN(jzfile *zip, jint knownTotal)
-     cenlen = ENDSIZ(endbuf);
-     cenoff = ENDOFF(endbuf);
-     total  = ENDTOT(endbuf);
--    if (cenlen == ZIP64_MAGICVAL || cenoff == ZIP64_MAGICVAL ||
--        total == ZIP64_MAGICCOUNT) {
--        unsigned char end64buf[ZIP64_ENDHDR];
--        if ((end64pos = findEND64(zip, end64buf, endpos)) != -1) {
--            cenlen = ZIP64_ENDSIZ(end64buf);
--            cenoff = ZIP64_ENDOFF(end64buf);
--            total = (jint)ZIP64_ENDTOT(end64buf);
-+    unsigned char end64buf[ZIP64_ENDHDR];
-+    if ((end64pos = findEND64(zip, end64buf, endpos)) != -1) {
-+	// end64 candidate found,
-+	cenlen64 = ZIP64_ENDSIZ(end64buf);
-+	cenoff64 = ZIP64_ENDOFF(end64buf);
-+	centot64 = ZIP64_ENDTOT(end64buf);
-+	// double-check
-+	if ((cenlen64 == cenlen || cenlen == ZIP64_MAGICVAL) &&
-+	    (cenoff64 == cenoff || cenoff == ZIP64_MAGICVAL) &&
-+	    (centot64 == total || total == ZIP64_MAGICCOUNT)) {
-+	    // to use the end64 values
-+            cenlen = cenlen64;
-+            cenoff = cenoff64;
-+            total = (jint)centot64;
-             endpos = end64pos;
-             endhdrlen = ZIP64_ENDHDR;
-         }
-diff --git openjdk.orig/jdk/test/java/util/zip/ZipFile/ReadZip.java openjdk/jdk/test/java/util/zip/ZipFile/ReadZip.java
-index ffe8a8ed712..9b380003893 100644
---- openjdk.orig/jdk/test/java/util/zip/ZipFile/ReadZip.java
-+++ openjdk/jdk/test/java/util/zip/ZipFile/ReadZip.java
-@@ -22,7 +22,7 @@
-  */
- 
- /* @test
-- * @bug 4241361 4842702 4985614 6646605 5032358 6923692 6233323 8144977 8184993
-+ * @bug 4241361 4842702 4985614 6646605 5032358 6923692 6233323 8144977 8184993 8186464
-  * @summary Make sure we can read a zip file.
-    @key randomness
-  * @run main/othervm ReadZip
-@@ -31,12 +31,24 @@
-  */
- 
- import java.io.*;
-+import java.net.URI;
- import java.nio.file.Files;
-+import java.nio.file.FileSystem;
-+import java.nio.file.FileSystems;
-+import java.nio.file.Path;
- import java.nio.file.Paths;
- import java.nio.file.StandardCopyOption;
- import java.nio.file.StandardOpenOption;
-+import java.util.Collections;
-+import java.util.HashMap;
-+import java.util.List;
-+import java.util.Map;
- import java.util.zip.*;
- 
-+import sun.misc.IOUtils;
-+
-+import static java.nio.charset.StandardCharsets.US_ASCII;
-+
- public class ReadZip {
-     private static void unreached (Object o)
-         throws Exception
-@@ -144,8 +156,6 @@ public class ReadZip {
-             newZip.delete();
-         }
- 
--
--
-         // Throw a FNF exception when read a non-existing zip file
-         try { unreached (new ZipFile(
-                              new File(System.getProperty("test.src", "."),
-@@ -153,5 +163,54 @@ public class ReadZip {
-                                       + String.valueOf(new java.util.Random().nextInt())
-                                       + ".zip")));
-         } catch (FileNotFoundException fnfe) {}
-+
-+        // read a zip file with ZIP64 end
-+        Path path = Paths.get(System.getProperty("test.dir", ""), "end64.zip");
-+        try {
-+            URI uri = URI.create("jar:" + path.toUri());
-+            Map<String, Object> env = new HashMap<>();
-+	    env.put("create", "true");
-+	    env.put("forceZIP64End", "true");
-+            try (FileSystem fs = FileSystems.newFileSystem(uri, env)) {
-+                Files.write(fs.getPath("hello"), "hello".getBytes());
-+            }
-+            try (ZipFile zf = new ZipFile(path.toFile())) {
-+                if (!"hello".equals(new String(IOUtils.readAllBytes(zf.getInputStream(new ZipEntry("hello"))),
-+                                               US_ASCII)))
-+                    throw new RuntimeException("zipfile: read entry failed");
-+            } catch (IOException x) {
-+                throw new RuntimeException("zipfile: zip64 end failed");
-+            }
-+            try (FileSystem fs = FileSystems.newFileSystem(uri, Collections.emptyMap())) {
-+                if (!"hello".equals(new String(Files.readAllBytes(fs.getPath("hello")))))
-+                    throw new RuntimeException("zipfs: read entry failed");
-+            } catch (IOException x) {
-+                throw new RuntimeException("zipfile: zip64 end failed");
-+            }
-+        } finally {
-+            Files.deleteIfExists(path);
-+        }
-+
-+        // read a zip file created via "echo hello | zip dst.zip -", which uses
-+        // ZIP64 end record
-+        if (Files.notExists(Paths.get("/usr/bin/zip")))
-+            return;
-+        try {
-+            Process zip = new ProcessBuilder("zip", path.toString().toString(), "-").start();
-+            OutputStream os = zip.getOutputStream();
-+            os.write("hello".getBytes(US_ASCII));
-+            os.close();
-+            zip.waitFor();
-+            if (zip.exitValue() == 0 && Files.exists(path)) {
-+                try (ZipFile zf = new ZipFile(path.toFile())) {
-+                    if (!"hello".equals(new String(IOUtils.readAllBytes(zf.getInputStream(new ZipEntry("-"))))))
-+                        throw new RuntimeException("zipfile: read entry failed");
-+                } catch (IOException x) {
-+                    throw new RuntimeException("zipfile: zip64 end failed");
-+                }
-+            }
-+        } finally {
-+            Files.deleteIfExists(path);
-+        }
-     }
- }

SOURCES/jdk8199936-pr3533-enable_mstackrealign_on_x86_linux_as_well_as_x86_mac_os_x.patch

@@ -7,11 +7,10 @@
 PR3533: HotSpot generates code with unaligned stack, crashes on SSE operations
 Summary: Enable -mstackrealign on x86 Linux as well as x86 Mac OS X
 
-diff --git a/common/autoconf/flags.m4 b/common/autoconf/flags.m4
+diff --git openjdk.orig///common/autoconf/flags.m4 openjdk///common/autoconf/flags.m4
-index 113bf367e2..bed030e8d1 100644
+--- openjdk.orig///common/autoconf/flags.m4
---- a/common/autoconf/flags.m4
++++ openjdk///common/autoconf/flags.m4
-+++ b/common/autoconf/flags.m4
+@@ -402,6 +402,21 @@
-@@ -451,6 +451,21 @@ AC_DEFUN_ONCE([FLAGS_SETUP_COMPILER_FLAGS_FOR_JDK],
      AC_SUBST($2CXXSTD_CXXFLAG)
    fi
  
@@ -33,32 +32,23 @@ index 113bf367e2..bed030e8d1 100644
    if test "x$CFLAGS" != "x${ADDED_CFLAGS}"; then
      AC_MSG_WARN([Ignoring CFLAGS($CFLAGS) found in environment. Use --with-extra-cflags])
    fi
-diff --git a/common/autoconf/hotspot-spec.gmk.in b/common/autoconf/hotspot-spec.gmk.in
+diff --git openjdk.orig///common/autoconf/hotspot-spec.gmk.in openjdk///common/autoconf/hotspot-spec.gmk.in
-index 3f86751d2b..f8a271383f 100644
+--- openjdk.orig///common/autoconf/hotspot-spec.gmk.in
---- a/common/autoconf/hotspot-spec.gmk.in
++++ openjdk///common/autoconf/hotspot-spec.gmk.in
-+++ b/common/autoconf/hotspot-spec.gmk.in
+@@ -112,7 +112,8 @@
-@@ -114,13 +114,14 @@ RC:=@HOTSPOT_RC@
+ RC:=@HOTSPOT_RC@
- # Retain EXTRA_{CFLAGS,CXXFLAGS,LDFLAGS,ASFLAGS} for the target flags to
+ 
- # maintain compatibility with the existing Makefiles
+ EXTRA_CFLAGS=@LEGACY_EXTRA_CFLAGS@ $(NO_DELETE_NULL_POINTER_CHECKS_CFLAG) \
- EXTRA_CFLAGS=@LEGACY_TARGET_CFLAGS@ $(NO_DELETE_NULL_POINTER_CHECKS_CFLAG) \
 -				   $(NO_LIFETIME_DSE_CFLAG) $(CXXSTD_CXXFLAG)
 +				   $(NO_LIFETIME_DSE_CFLAG) $(CXXSTD_CXXFLAG) \
 +				   $(REALIGN_CFLAG)
- EXTRA_CXXFLAGS=@LEGACY_TARGET_CXXFLAGS@
+ EXTRA_CXXFLAGS=@LEGACY_EXTRA_CXXFLAGS@
- EXTRA_LDFLAGS=@LEGACY_TARGET_LDFLAGS@
+ EXTRA_LDFLAGS=@LEGACY_EXTRA_LDFLAGS@
- EXTRA_ASFLAGS=@LEGACY_TARGET_ASFLAGS@
+ EXTRA_ASFLAGS=@LEGACY_EXTRA_ASFLAGS@
- # Define an equivalent set for the host flags (i.e. without sysroot options)
+diff --git openjdk.orig///common/autoconf/spec.gmk.in openjdk///common/autoconf/spec.gmk.in
- HOST_CFLAGS=@LEGACY_HOST_CFLAGS@ $(NO_DELETE_NULL_POINTER_CHECKS_CFLAG) \
+--- openjdk.orig///common/autoconf/spec.gmk.in
--				 $(NO_LIFETIME_DSE_CFLAG) $(CXXSTD_CXXFLAG)
++++ openjdk///common/autoconf/spec.gmk.in
-+                                 $(NO_LIFETIME_DSE_CFLAG) $(CXXSTD_CXXFLAG)
+@@ -366,6 +366,7 @@
- HOST_CXXFLAGS=@LEGACY_HOST_CXXFLAGS@
- HOST_LDFLAGS=@LEGACY_HOST_LDFLAGS@
- HOST_ASFLAGS=@LEGACY_HOST_ASFLAGS@
-diff --git a/common/autoconf/spec.gmk.in b/common/autoconf/spec.gmk.in
-index 9573bb2cbd..fe7efc130c 100644
---- a/common/autoconf/spec.gmk.in
-+++ b/common/autoconf/spec.gmk.in
-@@ -366,6 +366,7 @@ CXXFLAGS_JDKEXE:=@CXXFLAGS_JDKEXE@
  
  NO_DELETE_NULL_POINTER_CHECKS_CFLAG=@NO_DELETE_NULL_POINTER_CHECKS_CFLAG@
  NO_LIFETIME_DSE_CFLAG=@NO_LIFETIME_DSE_CFLAG@

SOURCES/jdk8275535-rh2053256-ldap_auth.patch

@@ -0,0 +1,26 @@
+diff --git openjdk.orig/jdk/src/share/classes/com/sun/jndi/ldap/LdapCtxFactory.java openjdk/jdk/src/share/classes/com/sun/jndi/ldap/LdapCtxFactory.java
+index cf4becb7db..4ab2ac0a31 100644
+--- openjdk.orig/jdk/src/share/classes/com/sun/jndi/ldap/LdapCtxFactory.java
++++ openjdk/jdk/src/share/classes/com/sun/jndi/ldap/LdapCtxFactory.java
+@@ -189,6 +189,10 @@ final public class LdapCtxFactory implements ObjectFactory, InitialContextFactor
+                     ctx = getLdapCtxFromUrl(
+                             r.getDomainName(), url, new LdapURL(u), env);
+                     return ctx;
++                } catch (AuthenticationException e) {
++                    // do not retry on a different endpoint to avoid blocking
++                    // the user if authentication credentials are wrong.
++                    throw e;
+                 } catch (NamingException e) {
+                     // try the next element
+                     lastException = e;
+@@ -241,6 +245,10 @@ final public class LdapCtxFactory implements ObjectFactory, InitialContextFactor
+         for (String u : urls) {
+             try {
+                 return getUsingURL(u, env);
++            } catch (AuthenticationException e) {
++                // do not retry on a different URL to avoid blocking
++                // the user if authentication credentials are wrong.
++                throw e;
+             } catch (NamingException e) {
+                 ex = e;
+             }

SOURCES/jdk8281098-pr3836-pass_compiler_flags_to_adlc.patch

@@ -0,0 +1,67 @@
+# HG changeset patch
+# User Andrew John Hughes <gnu_andrew@member.fsf.org>
+# Date 1620365804 -3600
+#      Fri May 07 06:36:44 2021 +0100
+# Node ID 39b62f35eca823b4c9a98bc1dc0cb9acb87360f8
+# Parent  723b59ed1afe878c5cd35f080399c8ceec4f776b
+PR3836: Extra compiler flags not passed to adlc build
+
+diff --git openjdk.orig/hotspot/make/aix/makefiles/adlc.make openjdk/hotspot/make/aix/makefiles/adlc.make
+--- openjdk.orig/hotspot/make/aix/makefiles/adlc.make
++++ openjdk/hotspot/make/aix/makefiles/adlc.make
+@@ -69,6 +69,11 @@
+ CFLAGS_WARN = -w
+ CFLAGS += $(CFLAGS_WARN)
+ 
++# Extra flags from gnumake's invocation or environment
++CFLAGS += $(EXTRA_CFLAGS)
++LFLAGS += $(EXTRA_CFLAGS) $(EXTRA_LDFLAGS)
++ASFLAGS += $(EXTRA_ASFLAGS)
++
+ OBJECTNAMES = \
+ 	adlparse.o \
+ 	archDesc.o \
+diff --git openjdk.orig/hotspot/make/bsd/makefiles/adlc.make openjdk/hotspot/make/bsd/makefiles/adlc.make
+--- openjdk.orig/hotspot/make/bsd/makefiles/adlc.make
++++ openjdk/hotspot/make/bsd/makefiles/adlc.make
+@@ -71,6 +71,11 @@
+ endif
+ CFLAGS += $(CFLAGS_WARN)
+ 
++# Extra flags from gnumake's invocation or environment
++CFLAGS += $(EXTRA_CFLAGS)
++LFLAGS += $(EXTRA_CFLAGS) $(EXTRA_LDFLAGS)
++ASFLAGS += $(EXTRA_ASFLAGS)
++
+ OBJECTNAMES = \
+ 	adlparse.o \
+ 	archDesc.o \
+diff --git openjdk.orig/hotspot/make/linux/makefiles/adlc.make openjdk/hotspot/make/linux/makefiles/adlc.make
+--- openjdk.orig/hotspot/make/linux/makefiles/adlc.make
++++ openjdk/hotspot/make/linux/makefiles/adlc.make
+@@ -69,6 +69,11 @@
+ CFLAGS_WARN = $(WARNINGS_ARE_ERRORS)
+ CFLAGS += $(CFLAGS_WARN)
+ 
++# Extra flags from gnumake's invocation or environment
++CFLAGS += $(EXTRA_CFLAGS)
++LFLAGS += $(EXTRA_CFLAGS) $(EXTRA_LDFLAGS)
++ASFLAGS += $(EXTRA_ASFLAGS)
++
+ OBJECTNAMES = \
+ 	adlparse.o \
+ 	archDesc.o \
+diff --git openjdk.orig/hotspot/make/solaris/makefiles/adlc.make openjdk/hotspot/make/solaris/makefiles/adlc.make
+--- openjdk.orig/hotspot/make/solaris/makefiles/adlc.make
++++ openjdk/hotspot/make/solaris/makefiles/adlc.make
+@@ -85,6 +85,10 @@
+ endif
+ CFLAGS += $(CFLAGS_WARN)
+ 
++# Extra flags from gnumake's invocation or environment
++CFLAGS += $(EXTRA_CFLAGS)
++ASFLAGS += $(EXTRA_ASFLAGS)
++
+ ifeq ("${Platform_compiler}", "sparcWorks")
+ # Enable the following CFLAGS addition if you need to compare the
+ # built ELF objects.

SOURCES/pr2462-resolve_disabled_warnings_for_libunpack_and_the_unpack200_binary.patch

@@ -7,11 +7,10 @@
 8074839: Resolve disabled warnings for libunpack and the unpack200 binary
 Reviewed-by: dholmes, ksrini
 
-diff --git a/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h b/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h
+diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h
-index bdaf95a2f6a..60c5b4f2a69 100644
+--- openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h
---- a/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h
++++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h
-+++ b/jdk/src/share/native/com/sun/java/util/jar/pack/bytes.h
+@@ -63,7 +63,7 @@
-@@ -63,7 +63,7 @@ struct bytes {
      bytes res;
      res.ptr = ptr + beg;
      res.len = end - beg;
@@ -20,11 +19,10 @@ index bdaf95a2f6a..60c5b4f2a69 100644
      return res;
    }
    // building C strings inside byte buffers:
-diff --git a/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp b/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp
+diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp
-index 5fbc7261fb3..4c002e779d8 100644
+--- openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp
---- a/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp
++++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp
-+++ b/jdk/src/share/native/com/sun/java/util/jar/pack/jni.cpp
+@@ -292,7 +292,7 @@
-@@ -292,7 +292,7 @@ Java_com_sun_java_util_jar_pack_NativeUnpack_getUnusedInput(JNIEnv *env, jobject
  
    if (uPtr->aborting()) {
      THROW_IOE(uPtr->get_abort_message());
@@ -33,16 +31,16 @@ index 5fbc7261fb3..4c002e779d8 100644
    }
  
    // We have fetched all the files.
-@@ -312,7 +312,7 @@ Java_com_sun_java_util_jar_pack_NativeUnpack_finish(JNIEnv *env, jobject pObj) {
+@@ -310,7 +310,7 @@
-   // There's no need to create a new unpacker here if we don't already have one
+ JNIEXPORT jlong JNICALL
-   // just to immediatly free it afterwards.
+ Java_com_sun_java_util_jar_pack_NativeUnpack_finish(JNIEnv *env, jobject pObj) {
-   unpacker* uPtr = get_unpacker(env, pObj, /* noCreate= */ true);
+   unpacker* uPtr = get_unpacker(env, pObj, false);
 -  CHECK_EXCEPTION_RETURN_VALUE(uPtr, NULL);
 +  CHECK_EXCEPTION_RETURN_VALUE(uPtr, 0);
    size_t consumed = uPtr->input_consumed();
-   // free_unpacker() will set the unpacker field on 'pObj' to null
    free_unpacker(env, pObj, uPtr);
-@@ -323,6 +323,7 @@ JNIEXPORT jboolean JNICALL
+   return consumed;
+@@ -320,6 +320,7 @@
  Java_com_sun_java_util_jar_pack_NativeUnpack_setOption(JNIEnv *env, jobject pObj,
                                         jstring pProp, jstring pValue) {
    unpacker*   uPtr  = get_unpacker(env, pObj);
@@ -50,11 +48,10 @@ index 5fbc7261fb3..4c002e779d8 100644
    const char* prop  = env->GetStringUTFChars(pProp, JNI_FALSE);
    CHECK_EXCEPTION_RETURN_VALUE(prop, false);
    const char* value = env->GetStringUTFChars(pValue, JNI_FALSE);
-diff --git a/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp b/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp
+diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp
-index 6fbc43a18ae..722c8baaff0 100644
+--- openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp
---- a/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp
++++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp
-+++ b/jdk/src/share/native/com/sun/java/util/jar/pack/main.cpp
+@@ -142,31 +142,28 @@
-@@ -142,31 +142,28 @@ static const char* nbasename(const char* progname) {
    return progname;
  }
  
@@ -104,11 +101,10 @@ index 6fbc43a18ae..722c8baaff0 100644
    }
  }
  
-diff --git a/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp b/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp
+diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp
-index a585535c513..8df3fade499 100644
+--- openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp
---- a/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp
++++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp
-+++ b/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.cpp
+@@ -222,9 +222,9 @@
-@@ -225,9 +225,9 @@ struct entry {
    }
  
  #ifdef PRODUCT
@@ -120,7 +116,7 @@ index a585535c513..8df3fade499 100644
  #endif
  };
  
-@@ -719,13 +719,13 @@ void unpacker::read_file_header() {
+@@ -715,13 +715,13 @@
    // Now we can size the whole archive.
    // Read everything else into a mega-buffer.
    rp = hdr.rp;
@@ -138,7 +134,7 @@ index a585535c513..8df3fade499 100644
        abort("EOF reading fixed input buffer");
        return;
      }
-@@ -739,7 +739,7 @@ void unpacker::read_file_header() {
+@@ -735,7 +735,7 @@
        return;
      }
      input.set(U_NEW(byte, add_size(header_size_0, archive_size, C_SLOP)),
@@ -147,7 +143,7 @@ index a585535c513..8df3fade499 100644
      CHECK;
      assert(input.limit()[0] == 0);
      // Move all the bytes we read initially into the real buffer.
-@@ -962,13 +962,13 @@ void cpool::init(unpacker* u_, int counts[CONSTANT_Limit]) {
+@@ -958,13 +958,13 @@
    nentries = next_entry;
  
    // place a limit on future CP growth:
@@ -163,7 +159,18 @@ index a585535c513..8df3fade499 100644
  
    // Note that this CP does not include "empty" entries
    // for longs and doubles.  Those are introduced when
-@@ -3694,21 +3694,22 @@ void cpool::computeOutputIndexes() {
+@@ -982,8 +982,9 @@
+   }
+ 
+   // Initialize *all* our entries once
+-  for (int i = 0 ; i < maxentries ; i++)
++  for (uint i = 0 ; i < maxentries ; i++) {
+     entries[i].outputIndex = REQUESTED_NONE;
++  }
+ 
+   initGroupIndexes();
+   // Initialize hashTab to a generous power-of-two size.
+@@ -3677,21 +3678,22 @@
  
  unpacker* debug_u;
  
@@ -190,7 +197,7 @@ index a585535c513..8df3fade499 100644
    case CONSTANT_Signature:
      if (value.b.ptr == null)
        return ref(0)->string();
-@@ -3728,26 +3729,28 @@ char* entry::string() {
+@@ -3711,26 +3713,28 @@
      break;
    default:
      if (nrefs == 0) {
@@ -228,11 +235,10 @@ index a585535c513..8df3fade499 100644
  }
  
  void print_cp_entries(int beg, int end) {
-diff --git a/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h b/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h
+diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h
-index 4ec595333c4..aad0c971ef2 100644
+--- openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h
---- a/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h
++++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h
-+++ b/jdk/src/share/native/com/sun/java/util/jar/pack/unpack.h
+@@ -209,7 +209,7 @@
-@@ -209,7 +209,7 @@ struct unpacker {
    byte*     rp;          // read pointer (< rplimit <= input.limit())
    byte*     rplimit;     // how much of the input block has been read?
    julong    bytes_read;
@@ -241,11 +247,10 @@ index 4ec595333c4..aad0c971ef2 100644
  
    // callback to read at least one byte, up to available input
    typedef jlong (*read_input_fn_t)(unpacker* self, void* buf, jlong minlen, jlong maxlen);
-diff --git a/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp b/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp
+diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp
-index da39a589545..1281d8b25c8 100644
+--- openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp
---- a/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp
++++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp
-+++ b/jdk/src/share/native/com/sun/java/util/jar/pack/utils.cpp
+@@ -81,7 +81,7 @@
-@@ -81,7 +81,7 @@ void breakpoint() { }  // hook for debugger
  int assert_failed(const char* p) {
    char message[1<<12];
    sprintf(message, "@assert failed: %s\n", p);
@@ -254,11 +259,10 @@ index da39a589545..1281d8b25c8 100644
    breakpoint();
    unpack_abort(message);
    return 0;
-diff --git a/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp b/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp
+diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp
-index f58c94956c0..343da3e183b 100644
+--- openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp
---- a/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp
++++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp
-+++ b/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp
+@@ -84,7 +84,7 @@
-@@ -84,7 +84,7 @@ void jar::init(unpacker* u_) {
  }
  
  // Write data to the ZIP output stream.
@@ -267,7 +271,7 @@ index f58c94956c0..343da3e183b 100644
    while (len > 0) {
      int rc = (int)fwrite(buff, 1, len, jarfp);
      if (rc <= 0) {
-@@ -323,12 +323,12 @@ void jar::write_central_directory() {
+@@ -323,12 +323,12 @@
      // Total number of disks (int)
      header64[36] = (ushort)SWAP_BYTES(1);
      header64[37] = 0;
@@ -282,11 +286,10 @@ index f58c94956c0..343da3e183b 100644
  
    PRINTCR((2, "writing zip comment\n"));
    // Write the comment.
-diff --git a/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h b/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h
+diff --git openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h
-index 14ffc9d65bd..9877f6f68ca 100644
+--- openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h
---- a/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h
++++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h
-+++ b/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h
+@@ -68,8 +68,8 @@
-@@ -68,8 +68,8 @@ struct jar {
    }
  
    // Private Methods

SOURCES/pr2888-rh2055274-support_system_cacerts.patch

@@ -1,5 +1,5 @@
 diff --git a/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java b/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java
-index e7b4763db53..0005e56f528 100644
+index e7b4763db53..e8ec8467e6a 100644
 --- a/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java
 +++ b/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java
 @@ -31,6 +31,7 @@ import java.security.*;
@@ -19,17 +19,16 @@ index e7b4763db53..0005e56f528 100644
       */
      private static final class TrustStoreDescriptor {
          private static final String fileSep = File.separator;
-@@ -76,7 +77,8 @@ final class TrustStoreManager {
+@@ -76,7 +77,7 @@ final class TrustStoreManager {
                  GetPropertyAction.privilegedGetProperty("java.home") +
                  fileSep + "lib" + fileSep + "security";
          private static final String defaultStore =
 -                defaultStorePath + fileSep + "cacerts";
-+                AccessController.doPrivileged((PrivilegedAction<String>) () ->
++            KeyStoreUtil.getCacertsKeyStoreFile().getPath();
-+                        KeyStoreUtil.getCacertsKeyStorePath());
          private static final String jsseDefaultStore =
                  defaultStorePath + fileSep + "jssecacerts";
  
-@@ -139,6 +141,10 @@ final class TrustStoreManager {
+@@ -139,6 +140,10 @@ final class TrustStoreManager {
                      String storePropPassword = System.getProperty(
                              "javax.net.ssl.trustStorePassword", "");
  
@@ -40,56 +39,117 @@ index e7b4763db53..0005e56f528 100644
                      String temporaryName = "";
                      File temporaryFile = null;
                      long temporaryTime = 0L;
-@@ -160,7 +166,7 @@ final class TrustStoreManager {
+@@ -146,21 +151,22 @@ final class TrustStoreManager {
+                         String[] fileNames =
+                                 new String[] {storePropName, defaultStore};
+                         for (String fileName : fileNames) {
+-                            File f = new File(fileName);
+-                            if (f.isFile() && f.canRead()) {
+-                                temporaryName = fileName;;
+-                                temporaryFile = f;
+-                                temporaryTime = f.lastModified();
+-
+-                                break;
+-                            }
+-
+-                            // Not break, the file is inaccessible.
+-                            if (SSLLogger.isOn &&
++                            if (fileName != null && !"".equals(fileName)) {
++                                File f = new File(fileName);
++                                if (f.isFile() && f.canRead()) {
++                                    temporaryName = fileName;;
++                                    temporaryFile = f;
++                                    temporaryTime = f.lastModified();
++
++                                    break;
++                                }
++                                // Not break, the file is inaccessible.
++                                if (SSLLogger.isOn &&
                                      SSLLogger.isOn("trustmanager")) {
-                                 SSLLogger.fine(
+-                                SSLLogger.fine(
-                                         "Inaccessible trust store: " +
+-                                        "Inaccessible trust store: " +
 -                                        storePropName);
++                                    SSLLogger.fine(
++                                            "Inaccessible trust store: " +
 +                                            fileName);
++                                }
                              }
                          }
                      } else {
 diff --git a/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java b/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java
-index fcc77786da1..3a4388964cc 100644
+index fcc77786da1..f554f83a8b4 100644
 --- a/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java
 +++ b/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java
-@@ -41,6 +41,8 @@ import java.text.Collator;
+@@ -33,7 +33,10 @@ import java.io.InputStreamReader;
- import java.util.Locale;
- import java.util.ResourceBundle;
  
-+import sun.security.util.SecurityProperties;
+ import java.net.URL;
-+
+ 
- /**
++import java.security.AccessController;
-  * <p> This class provides several utilities to <code>KeyStore</code>.
+ import java.security.KeyStore;
-  *
++import java.security.PrivilegedAction;
-@@ -54,6 +56,8 @@ public class KeyStoreUtil {
++import java.security.Security;
+ 
+ import java.security.cert.X509Certificate;
+ import java.text.Collator;
+@@ -54,6 +57,33 @@ public class KeyStoreUtil {
  
      private static final String JKS = "jks";
  
-+    private static final String SYSTEM_CA_CERTS_PROP = "security.systemCACerts";
++    private static final String PROP_NAME = "security.systemCACerts";
++
++    /**
++     * Returns the value of the security property propName, which can be overridden
++     * by a system property of the same name
++     *
++     * @param  propName the name of the system or security property
++     * @return the value of the system or security property
++     */
++    @SuppressWarnings("removal")
++    public static String privilegedGetOverridable(String propName) {
++        if (System.getSecurityManager() == null) {
++            return getOverridableProperty(propName);
++        } else {
++            return AccessController.doPrivileged((PrivilegedAction<String>) () -> getOverridableProperty(propName));
++        }
++    }
++
++    private static String getOverridableProperty(String propName) {
++        String val = System.getProperty(propName);
++        if (val == null) {
++            return Security.getProperty(propName);
++        } else {
++            return val;
++        }
++    }
 +
      /**
       * Returns true if the certificate is self-signed, false otherwise.
       */
-@@ -96,16 +100,30 @@ public class KeyStoreUtil {
+@@ -96,20 +126,38 @@ public class KeyStoreUtil {
          }
      }
  
 +    /**
 +     * Returns the path to the cacerts DB
 +     */
-+    public static String getCacertsKeyStorePath()
++    public static File getCacertsKeyStoreFile()
 +    {
-+        // Check system DB first, preferring system property over security one
-+        String systemDB = SecurityProperties
-+                .privilegedGetOverridable(SYSTEM_CA_CERTS_PROP);
-+        if (systemDB != null && !"".equals(systemDB) &&
-+                (new File(systemDB)).isFile()) {
-+            return systemDB;
-+        }
 +        String sep = File.separator;
-+        return System.getProperty("java.home") + sep
++        File file = null;
-+                + "lib" + sep + "security" + sep + "cacerts";
++        /* Check system cacerts DB first, preferring system property over security property */
++        String systemDB = privilegedGetOverridable(PROP_NAME);
++        if (systemDB != null && !"".equals(systemDB)) {
++            file = new File(systemDB);
++        }
++        if (file == null || !file.exists()) {
++            file = new File(System.getProperty("java.home") + sep
++                            + "lib" + sep + "security" + sep
++                            + "cacerts");
++        }
++        if (file.exists()) {
++            return file;
++        }
++        return null;
 +    }
 +
      /**
@@ -102,21 +162,27 @@ index fcc77786da1..3a4388964cc 100644
 -        File file = new File(System.getProperty("java.home") + sep
 -                             + "lib" + sep + "security" + sep
 -                             + "cacerts");
-+        File file = new File(getCacertsKeyStorePath());
+-        if (!file.exists()) {
-         if (!file.exists()) {
+-            return null;
-             return null;
+-        }
-         }
+         KeyStore caks = null;
++        File file = getCacertsKeyStoreFile();
++        if (file == null) { return null; }
+         try (FileInputStream fis = new FileInputStream(file)) {
+             caks = KeyStore.getInstance(JKS);
+             caks.load(fis, null);
 diff --git a/jdk/src/share/lib/security/java.security-aix b/jdk/src/share/lib/security/java.security-aix
-index 681a24b905d..ecb8bc43a6c 100644
+index bfe0c593adb..093bc09bf95 100644
 --- a/jdk/src/share/lib/security/java.security-aix
 +++ b/jdk/src/share/lib/security/java.security-aix
-@@ -294,6 +294,12 @@ security.overridePropertiesFile=true
+@@ -294,6 +294,13 @@ security.overridePropertiesFile=true
  #
  security.useSystemPropertiesFile=false
  
 +#
 +# Specifies the system certificate store
-+# This property may be disabled using an empty value
++# This property may be disabled using
++# -Djava.security.disableSystemCACerts=true
 +#
 +security.systemCACerts=${java.home}/lib/security/cacerts
 +
@@ -124,16 +190,17 @@ index 681a24b905d..ecb8bc43a6c 100644
  # Determines the default key and trust manager factory algorithms for
  # the javax.net.ssl package.
 diff --git a/jdk/src/share/lib/security/java.security-linux b/jdk/src/share/lib/security/java.security-linux
-index 789c19a8cba..2546fdec9b2 100644
+index 9d1c8fe8a8e..16c9281cc1f 100644
 --- a/jdk/src/share/lib/security/java.security-linux
 +++ b/jdk/src/share/lib/security/java.security-linux
-@@ -307,6 +307,12 @@ security.overridePropertiesFile=true
+@@ -307,6 +307,13 @@ security.overridePropertiesFile=true
  #
  security.useSystemPropertiesFile=false
  
 +#
 +# Specifies the system certificate store
-+# This property may be disabled using an empty value
++# This property may be disabled using
++# -Djava.security.disableSystemCACerts=true
 +#
 +security.systemCACerts=${java.home}/lib/security/cacerts
 +
@@ -141,16 +208,17 @@ index 789c19a8cba..2546fdec9b2 100644
  # Determines the default key and trust manager factory algorithms for
  # the javax.net.ssl package.
 diff --git a/jdk/src/share/lib/security/java.security-macosx b/jdk/src/share/lib/security/java.security-macosx
-index d4da666af3b..1a20027c02b 100644
+index 19047c61097..43e034cdeaf 100644
 --- a/jdk/src/share/lib/security/java.security-macosx
 +++ b/jdk/src/share/lib/security/java.security-macosx
-@@ -297,6 +297,12 @@ security.overridePropertiesFile=true
+@@ -297,6 +297,13 @@ security.overridePropertiesFile=true
  #
  security.useSystemPropertiesFile=false
  
 +#
 +# Specifies the system certificate store
-+# This property may be disabled using an empty value
++# This property may be disabled using
++# -Djava.security.disableSystemCACerts=true
 +#
 +security.systemCACerts=${java.home}/lib/security/cacerts
 +
@@ -158,16 +226,17 @@ index d4da666af3b..1a20027c02b 100644
  # Determines the default key and trust manager factory algorithms for
  # the javax.net.ssl package.
 diff --git a/jdk/src/share/lib/security/java.security-solaris b/jdk/src/share/lib/security/java.security-solaris
-index 300132384a1..6299e0a3c7b 100644
+index 7eda556ae13..325937e97fb 100644
 --- a/jdk/src/share/lib/security/java.security-solaris
 +++ b/jdk/src/share/lib/security/java.security-solaris
-@@ -295,6 +295,12 @@ security.overridePropertiesFile=true
+@@ -295,6 +295,13 @@ security.overridePropertiesFile=true
  #
  security.useSystemPropertiesFile=false
  
 +#
 +# Specifies the system certificate store
-+# This property may be disabled using an empty value
++# This property may be disabled using
++# -Djava.security.disableSystemCACerts=true
 +#
 +security.systemCACerts=${java.home}/lib/security/cacerts
 +
@@ -175,16 +244,17 @@ index 300132384a1..6299e0a3c7b 100644
  # Determines the default key and trust manager factory algorithms for
  # the javax.net.ssl package.
 diff --git a/jdk/src/share/lib/security/java.security-windows b/jdk/src/share/lib/security/java.security-windows
-index 64db5a5cd1e..823994f3466 100644
+index dfa1a669aa9..92ef777e065 100644
 --- a/jdk/src/share/lib/security/java.security-windows
 +++ b/jdk/src/share/lib/security/java.security-windows
-@@ -297,6 +297,12 @@ security.overridePropertiesFile=true
+@@ -297,6 +297,13 @@ security.overridePropertiesFile=true
  #
  security.useSystemPropertiesFile=false
  
 +#
 +# Specifies the system certificate store
-+# This property may be disabled using an empty value
++# This property may be disabled using
++# -Djava.security.disableSystemCACerts=true
 +#
 +security.systemCACerts=${java.home}/lib/security/cacerts
 +

SOURCES/repackReproduciblePolycies.sh

@@ -17,7 +17,7 @@ fi
 d=`mktemp -d`
 NW=$d/$f
   pushd $d
-    unzip $ORIG
+    jar  xf   $ORIG
     cat $M
 #    sed -i "s/Created-By.*/Created-By: 1.7.0/g"  $M
     sed -i "s/Created-By.*/Created-By: $2/g"  $M

SOURCES/rh1648644-java_access_bridge_privileged_security.patch

@@ -0,0 +1,25 @@
+diff --git openjdk.orig/jdk/src/share/lib/security/java.security-linux openjdk/jdk/src/share/lib/security/java.security-linux
+--- openjdk.orig/jdk/src/share/lib/security/java.security-linux
++++ openjdk/jdk/src/share/lib/security/java.security-linux
+@@ -226,7 +226,9 @@
+                com.sun.activation.registries.,\
+                jdk.jfr.events.,\
+                jdk.jfr.internal.,\
+-               jdk.management.jfr.internal.
++               jdk.management.jfr.internal.,\
++               org.GNOME.Accessibility.,\
++               org.GNOME.Bonobo.
+ 
+ #
+ # List of comma-separated packages that start with or equal this string
+@@ -279,7 +281,9 @@
+                    com.sun.activation.registries.,\
+                    jdk.jfr.events.,\
+                    jdk.jfr.internal.,\
+-                   jdk.management.jfr.internal.
++                   jdk.management.jfr.internal.,\
++                   org.GNOME.Accessibility.,\
++                   org.GNOME.Bonobo.
+ 
+ #
+ # Determines whether this properties file can be appended to

SOURCES/rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch

@@ -1,13 +0,0 @@
---- openjdk/jdk/src/solaris/classes/sun/security/smartcardio/PlatformPCSC.java	2013-03-01 10:48:12.038189968 +0100
-+++ openjdk/jdk/src/solaris/classes/sun/security/smartcardio/PlatformPCSC.java	2013-03-01 10:48:11.913188505 +0100
-@@ -48,8 +48,8 @@
- 
-     private final static String PROP_NAME = "sun.security.smartcardio.library";
- 
--    private final static String LIB1 = "/usr/$LIBISA/libpcsclite.so";
--    private final static String LIB2 = "/usr/local/$LIBISA/libpcsclite.so";
-+    private final static String LIB1 = "/usr/$LIBISA/libpcsclite.so.1";
-+    private final static String LIB2 = "/usr/local/$LIBISA/libpcsclite.so.1";
-     private final static String PCSC_FRAMEWORK = "/System/Library/Frameworks/PCSC.framework/Versions/Current/PCSC";
- 
-     PlatformPCSC() {