.gitignore

@@ -1,2 +1,2 @@
-SOURCES/shenandoah8u502-b07.tar.xz
+SOURCES/shenandoah8u482-b08.tar.xz
 SOURCES/tapsets-icedtea-3.15.0.tar.xz

.java-1.8.0-openjdk.metadata

@@ -1,2 +1,2 @@
-d874ba8e6e76629915b4464267cc07156355b84b SOURCES/shenandoah8u502-b07.tar.xz
+13abceddc732a35f2dbe547d15bb19b8aa1ab677 SOURCES/shenandoah8u482-b08.tar.xz
 7ae2cba67467825b2c2a5fec7aea041865023002 SOURCES/tapsets-icedtea-3.15.0.tar.xz

SOURCES/NEWS

@@ -3,228 +3,11 @@ Key:
 JDK-X  - https://bugs.openjdk.java.net/browse/JDK-X
 CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
 
-New in release OpenJDK 8u502 (2026-07-21):
-===========================================
-Live versions of these release notes can be found at:
-  * https://bit.ly/openjdk8u502
-
-* Changes
-  - JDK-6815126: intermittent SimulResumerTest.java failure
-  - JDK-8162545: Mac build failure
-  - JDK-8199138: Add RISC-V support to Zero
-  - JDK-8209362: sun/security/ssl/SSLSocketImpl/ReuseAddr.java failed due to "BindException: Address already in use (Bind failed)"
-  - JDK-8246330: Add TLS Tests for Legacy ECDSA curves
-  - JDK-8249159: Downport test rework for SSLSocketTemplate from 8224650
-  - JDK-8261235: C1 compilation fails with assert(res->vreg_number() == index) failed: conversion check
-  - JDK-8273135: java/awt/color/ICC_ColorSpace/MTTransformReplacedProfile.java crashes in liblcms.dylib with NULLSeek+0x7
-  - JDK-8274736: Concurrent read/close of SSLSockets causes SSLSessions to be invalidated unnecessarily
-  - JDK-8280158: New test from JDK-8274736 failed with/without patch in JDK11u
-  - JDK-8298873: Update IllegalRecordVersion.java for changes to TLS implementation
-  - JDK-8301189: validate-source fails after JDK-8298873
-  - JDK-8314730: GHA: Drop libfreetype6-dev transitional package in favor of libfreetype-dev
-  - JDK-8321489: Update LCMS to 2.16
-  - JDK-8336451: [11u] GHA macos-13 and macos-15 builders are unable to resolve local hostname
-  - JDK-8348110: Update LCMS to 2.17
-  - JDK-8351359: OperatingSystemMXBean: values from getCpuLoad and getProcessCpuLoad are stale after 24.8 days (Windows)
-  - JDK-8363966: GHA: Switch cross-compiling sysroots to Debian trixie
-  - JDK-8368041: Enhance TLS certificate handling
-  - JDK-8369996: Testcase java/net/Socket/B8312065.java fails on Mac, AIX and Solaris
-  - JDK-8372351: Add 2 WISeKey roots
-  - JDK-8374058: Enhance JPEG handling
-  - JDK-8374888: Implement internal test cache to help UserIterCount test performance
-  - JDK-8375065: Update LCMS to 2.18
-  - JDK-8377158: Enhance XBM image support
-  - JDK-8377498: Improve HttpServer handling
-  - JDK-8377833: Enhance Jar file processing
-  - JDK-8378631: Update Zlib Data Compression Library to Version 1.3.2
-  - JDK-8378687: Improve delegation of HttpURLConnection
-  - JDK-8379684: Bump update version of OpenJDK: 8u502
-  - JDK-8380377: [8u] Problem list CAInterop.java#teliarootcav2
-  - JDK-8380672: Improve certification checking
-  - JDK-8380689: distrust/Chunghwa.java test fails with a compilation error
-  - JDK-8380947: Add pull request template
-  - JDK-8381039: Enhance AWT ImagingLib
-  - JDK-8381049: Enhance Jar handling
-  - JDK-8381185: Improve Nashorn index handling
-  - JDK-8381195: Enhance Dataview Implementation
-  - JDK-8381519: Enhance Der Value Handling
-  - JDK-8381796: Enhance Certificate parsing
-  - JDK-8383175: (tz) Update Timezone Data to 2026b
-  - JDK-8383354: Update LCMS to 2.19.1
-  - JDK-8383473: Follow on from tzdata2026b time change to include temporary hack BC time change
-  - JDK-8384158: GHA: Downgrade Windows GHA runners to windows-2022 temporarily
-
-security-libs/java.security:
-
-JDK-8372351: Add 2 WISeKey roots
-================================
-The following root certificates have been added to the cacerts
-truststore:
-
-Alias Name: wisekeyglobalrootgbca
-Distinguished Name: CN=OISTE WISeKey Global Root GB CA, OU=OISTE Foundation Endorsed, O=WISeKey, C=CH
-Serial Number: 76b1205274f0858746b3f8231af6c2c0
-Valid From: Mon Dec 01 15:00:32 GMT 2014
-Valid Until: Thu Dec 01 15:10:31 GMT 2039
-
-Alias Name: wisekeyglobalrootgcca
-Distinguished Name: CN=OISTE WISeKey Global Root GC CA, OU=OISTE Foundation Endorsed, O=WISeKey, C=CH
-Serial Number: 212a560caeda0cab4045bf2ba22d3aea
-Valid From: Tue May 09 09:48:34 GMT 2017
-Valid Until: Fri May 09 09:58:33 GMT 2042
-
-JDK-8381796: Enhance Certificate parsing
-========================================
-With this release of OpenJDK, a security and system property
-`com.sun.security.crl.maxSize` is introduced which acts as a maximum
-size limit on a Certificate Revocation List (CRL) downloaded over the
-network.  For URICertStore requests, the value is the maximum size in
-bytes of the DER-encoded CRL.  For LDAPCertStore queries, the
-threshold is the sum of all CRLs downloaded from a single search.  By
-default, the maximum size is 20MiB (20971520 bytes) and CRLs larger
-than this will be discarded.  A value less than zero may be used to
-turn off the size limit and non-numeric values will be ignored.  A
-non-empty value for the system property takes precedence over the
-security property.  Enabling 'certpath' debug logging will output the
-current size limit and note any discarded CRLs.
-
-New in release OpenJDK 8u492 (2026-04-21):
-===========================================
-Live versions of these release notes can be found at:
-  * https://bit.ly/openjdk8u492
-
-* CVEs
-  - CVE-2026-22007
-  - CVE-2026-22013
-  - CVE-2026-22016
-  - CVE-2026-22018
-  - CVE-2026-22021
-  - CVE-2026-23865
-  - CVE-2026-34268
-* Changes
-  - JDK-8056039: Hotspot does not compile with clang 3.4 on Linux
-  - JDK-8074840: Resolve disabled warnings for libjli and libjli_static
-  - JDK-8132786: java/security/cert/CertPathValidator/OCSP/AIACheck.java fails intermittently
-  - JDK-8153147: Mark java/net/BindException/Test.java as intermittently failing
-  - JDK-8157758: JDK9 does not compile on Linux with GCC 6.1 because left-shifting a negative number has undefined behavior
-  - JDK-8170464: Remove shell script from compiler/c2/cr7005594/Test7005594.java
-  - JDK-8174734: Safepoint sync time did not increase
-  - JDK-8186149: quarantine gc/survivorAlignment/TestPromotionFromSurvivorToTenuredAfterMinorGC.java
-  - JDK-8220658: Improve the readability of container information in the error log
-  - JDK-8223145: Replace wildcard address with loopback or local host in tests - part 1
-  - JDK-8225487: giflib legal file is missing attribution for openbsd-reallocarray.c.
-  - JDK-8237834: com/sun/jndi/ldap/LdapDnsProviderTest.java failing with LDAP response read timeout
-  - JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java failed due to timeout
-  - JDK-8264524: jdk/internal/platform/docker/TestDockerMemoryMetrics.java fails due to swapping not working
-  - JDK-8274893: Update java.desktop classes to use try-with-resources
-  - JDK-8277159: Fix java/nio/file/FileStore/Basic.java test by ignoring /run/user/* mount points
-  - JDK-8284758: [linux] improve print_container_info
-  - JDK-8285836: sun/net/www/http/KeepAliveCache/KeepAliveProperty.java failed with "RuntimeException: Failed in server"
-  - JDK-8287011: Improve container information
-  - JDK-8303482: Update LCMS to 2.15
-  - JDK-8312518: [macos13] setFullScreenWindow() shows black screen on macOS 13 & above
-  - JDK-8313770: jdk/internal/platform/docker/TestSystemMetrics.java fails on Ubuntu
-  - JDK-8328999: Update GIFlib to 5.2.2
-  - JDK-8339271: giflib attribution correction
-  - JDK-8343622: AesDkCrypto.stringToKey should not return null
-  - JDK-8345578: New test in JDK-8343622 fails with a promoted build
-  - JDK-8347911: Limit the length of inflated text chunks
-  - JDK-8348014: Enhance certificate processing
-  - JDK-8350813: Rendering of bulky sound bank from MIDI sequence can cause OutOfMemoryError
-  - JDK-8353657: [8u] Test tools/launcher/VersionCheck.java fails with debug build
-  - JDK-8360869: jcstress is able to crash jdk8 on aarch64 with jfr on
-  - JDK-8361748: Enforce limits on the size of an XBM image
-  - JDK-8364373: Transform Affine transformations
-  - JDK-8364465: Enhance behavior of some intrinsics
-  - JDK-8369226: GHA: Switch to MacOS 15
-  - JDK-8369282: Distrust TLS server certificates anchored by Chunghwa ePKI Root CA
-  - JDK-8369575: Enhance crypto algorithm support
-  - JDK-8370529: Enhance Path Factories Redux
-  - JDK-8370615: Improve Kerberos credentialing
-  - JDK-8370986: Enhance Zip file reading
-  - JDK-8370995: Enhance ZipFile usage
-  - JDK-8371830: Enhance certificate chain validation
-  - JDK-8371935: Enhance key generation
-  - JDK-8372660: [8u] ProblemList TestCPUAwareness until 8370492 is addressed
-  - JDK-8373250: Bump update version of OpenJDK: 8u492
-  - JDK-8373290: Update FreeType to 2.14.1
-  - JDK-8373476: (tz) Update Timezone Data to 2025c
-  - JDK-8373727: New XBM images parser regression: only the first line of the bitmap array is parsed
-  - JDK-8374899: [8u] Fully handle clang as the toolchain in flags.m4
-  - JDK-8374917: [8u] C++ flags get passed to C compiles in the HotSpot build
-  - JDK-8374948: [8u] saproc & jsig builds add duplicate linker flags on Darwin/MacOS
-  - JDK-8375063: Update Libpng to 1.6.54
-  - JDK-8375189: [8u] Problem list CAInterop.java#microsoftrsa2017
-  - JDK-8376225: [8u] GHA: Apply work-around for missing JNF for MacOSX builds
-  - JDK-8376272: [8u] Windows x86-32 fails to build after JDK-8359501
-  - JDK-8376338: Test7005594.sh fails when given a memory value with decimals
-  - JDK-8376352: [8u] Build failure on Windows 32-bit after JDK-8362308
-  - JDK-8377344: [8u] Compilation failure on Windows for Linux-specific platform metric tests
-  - JDK-8377526: Update Libpng to 1.6.55
-  - JDK-8379035: (tz) Update Timezone Data to 2026a
-  - JDK-8379158: Update FreeType to 2.14.2
-  - JDK-8379256: Update GIFlib to 6.1.1
-  - JDK-8380078: Update GIFlib to 6.1.2
-  - JDK-8380959: Update Libpng to 1.6.56
-  - JDK-8382047: Update Libpng to 1.6.57
-
-Notes on individual issues:
-===========================
-
-security-libs/javax.net.ssl:
-
-JDK-8369282: Distrust TLS server certificates anchored by Chunghwa ePKI Root CA
-===============================================================================
-In accordance with similar plans recently announced by Google and
-Mozilla, the JDK will not trust Transport Layer Security (TLS)
-certificates issued after the 17th of March 2026 which are anchored by
-Chungwa root certificates.
-
-Certificates issued on or before the 17th of March, 2026 will continue
-to be trusted until they expire.
-
-If a server's certificate chain is anchored by an affected
-certificate, attempts to negotiate a TLS session will fail with an
-Exception that indicates the trust anchor is not trusted. For example,
-
-"TLS server certificate issued after 2026-03-17 and anchored by a
-distrusted legacy Chungwa root CA: OU=ePKI Root Certification
-Authority, O="Chunghwa Telecom Co.", Ltd. C=TW"
-
-To check whether a certificate in a JDK keystore is affected by this
-change, you can the `keytool` utility:
-
-keytool -v -list -alias <your_server_alias> -keystore <your_keystore_filename>
-
-If any of the certificates in the chain are affected by this change,
-then you will need to update the certificate or contact the
-organisation responsible for managing the certificate.
-
-These restrictions apply to the following Chungwa root certificates
-included in the JDK:
-
-Alias name: chunghwaepkirootca
-OU=ePKI Root Certification Authority
-O="Chunghwa Telecom Co., Ltd."
-C=TW
-SHA256:A6:F4:DC:63:A2:4B:FD:CF:54:EF:2A:6A:08:2A:0A:72:DE:35:80:3E:2F:F5:FF:52:7A:E5:D8:72:06:DF:D5
-
-Users can, *at their own risk*, remove this restriction by modifying
-the `java.security` configuration file (or override it by using the
-`java.security.properties` system property) so "CHUNGWA_TLS" is no
-longer listed in the `jdk.security.caDistrustPolicies` security
-property.
-
 New in release OpenJDK 8u482 (2026-01-20):
 ===========================================
 Live versions of these release notes can be found at:
   * https://bit.ly/openjdk8u482
 
-* CVEs
-  - CVE-2026-21925
-  - CVE-2026-21932
-  - CVE-2026-21933
-  - CVE-2026-21945
 * Changes
   - JDK-8154043: Fields not reachable anymore by tab-key, because of new tabbing behaviour of radio button groups.
   - JDK-8182577: Exception when Tab key moves focus to a JCheckbox with a custom ButtonModel

SOURCES/TestTranslations.java

@@ -1,5 +1,5 @@
 /* TestTranslations -- Ensure translations are available for new timezones
-   Copyright (C) 2026 Red Hat, Inc.
+   Copyright (C) 2022 Red Hat, Inc.
 
 This program is free software: you can redistribute it and/or modify
 it under the terms of the GNU Affero General Public License as
@@ -60,34 +60,15 @@ public class TestTranslations {
 
 
     public static void main(String[] args) {
-        boolean debug = false;
-
         if (args.length < 1) {
             System.err.println("Test must be started with the name of the locale provider.");
             System.exit(1);
         }
 
-        if (args.length > 1) {
-            debug = Boolean.parseBoolean(args[1]);
-        }
-
-        System.err.printf("Debugging: %s\n", debug);
-
-        testZoneStrings(debug);
-
-        String localeProvider = args[0];
-        testZone(localeProvider, KYIV,
-                 new String[] { "Europe/Kiev", "Europe/Kyiv", "Europe/Uzhgorod", "Europe/Zaporozhye" });
-        testZone(localeProvider, CIUDAD_JUAREZ,
-                 new String[] { "America/Cambridge_Bay", "America/Ciudad_Juarez" });
-    }
-
-    private static void testZoneStrings(final boolean debug) {
         System.out.println("Checking sanity of full zone string set...");
         boolean invalid = Arrays.stream(Locale.getAvailableLocales())
-            .peek(l -> System.out.printf(debug ? "Locale: %s\n" : "", l))
+            .peek(l -> System.out.println("Locale: " + l))
             .map(l -> DateFormatSymbols.getInstance(l).getZoneStrings())
-            .peek(df -> System.out.printf(debug ? "Zone string size: %s\n" : "", df.length))
             .flatMap(zs -> Arrays.stream(zs))
             .flatMap(names -> Arrays.stream(names))
             .filter(name -> Objects.isNull(name) || name.isEmpty())
@@ -97,6 +78,12 @@ public class TestTranslations {
             System.err.println("Zone string for a locale returned null or empty string");
             System.exit(2);
         }
+
+        String localeProvider = args[0];
+        testZone(localeProvider, KYIV,
+                 new String[] { "Europe/Kiev", "Europe/Kyiv", "Europe/Uzhgorod", "Europe/Zaporozhye" });
+        testZone(localeProvider, CIUDAD_JUAREZ,
+                 new String[] { "America/Cambridge_Bay", "America/Ciudad_Juarez" });
     }
 
     private static void testZone(String localeProvider, Map<Locale,String[]> exp, String[] ids) {

SOURCES/java-1.8.0-openjdk-portable.specfile

@@ -1,86 +1,3 @@
-# New Version-String scheme-style defines
-%global majorver 8
-# Define version of OpenJDK 8 used
-%global project openjdk
-%global repo shenandoah-jdk8u
-%global openjdk_revision 8u502-b07
-%global shenandoah_revision shenandoah%{openjdk_revision}
-# e.g. aarch64-shenandoah-jdk8u212-b04-shenandoah-merge-2019-04-30 -> aarch64-shenandoah-jdk8u212-b04
-%global version_tag     %(VERSION=%{shenandoah_revision}; echo ${VERSION%%-shenandoah-merge*})
-# eg # jdk8u60-b27 -> jdk8u60 or # aarch64-jdk8u60-b27 -> aarch64-jdk8u60  (dont forget spec escape % by %%)
-%global whole_update    %(VERSION=%{version_tag}; echo ${VERSION%%-*})
-# eg  jdk8u60 -> 60 or aarch64-jdk8u60 -> 60
-%global updatever       %(VERSION=%{whole_update}; echo ${VERSION##*u})
-# eg jdk8u60-b27 -> b27
-%global buildver        %(VERSION=%{version_tag}; echo ${VERSION##*-})
-%global portablerelease 1
-%global rpmrelease 0
-
-# Define IcedTea version used for SystemTap tapsets and desktop file
-%global icedteaver      3.15.0
-# Define current Git revision for the FIPS support patches
-%global fipsver 6d1aade0648
-# Define current Git revision for the cacerts patch
-%global cacertsver 8139f2361c2
-%global javaver         1.%{majorver}.0
-
-# Standard JPackage naming and versioning defines
-%global origin          openjdk
-%global origin_nice     OpenJDK
-%global top_level_dir_name   %{shenandoah_revision}
-
-# Define milestone (EA for pre-releases, GA ("fcs") for releases)
-# Release will be (where N is usually a number starting at 1):
-# - 0.N.ea<dist> for EA releases,
-# - N<dist> for GA releases
-%global is_ga           1
-%if %{is_ga}
-%global milestone          fcs
-%global milestone_version  %{nil}
-%global extraver %{nil}
-%global eaprefix %{nil}
-%else
-%global milestone          ea
-%global milestone_version  "-ea"
-%global extraver .%{milestone}
-%global eaprefix 0.
-%endif
-
-%global compatiblename  java-%{javaver}-%{origin}
-
-Name:    %{compatiblename}-portable%{?pkgos:-%{pkgos}}
-Version: %{javaver}.%{updatever}.%{buildver}
-Release: %{?eaprefix}%{portablerelease}.%{rpmrelease}%{?extraver}%{?dist}
-
-%global fullversion     %{compatiblename}-%{version}-%{release}
-
-# java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons
-# and this change was brought into RHEL-4. java-1.5.0-ibm packages
-# also included the epoch in their virtual provides. This created a
-# situation where in-the-wild java-1.5.0-ibm packages provided "java =
-# 1:1.5.0". In RPM terms, "1.6.0 < 1:1.5.0" since 1.6.0 is
-# interpreted as 0:1.6.0. So the "java >= 1.6.0" requirement would be
-# satisfied by the 1:1.5.0 packages. Thus we need to set the epoch in
-# JDK package >= 1.6.0 to 1, and packages referring to JDK virtual
-# provides >= 1.6.0 must specify the epoch, "java >= 1:1.6.0".
-
-Epoch:   1
-Summary: %{origin_nice} %{majorver} Runtime Environment portable edition
-Group:   Development/Languages
-
-# HotSpot code is licensed under GPLv2
-# JDK library code is licensed under GPLv2 with the Classpath exception
-# The Apache license is used in code taken from Apache projects (primarily JAXP & JAXWS)
-# DOM levels 2 & 3 and the XML digital signature schemas are licensed under the W3C Software License
-# The JSR166 concurrency code is in the public domain
-# The BSD and MIT licenses are used for a number of third-party libraries (see THIRD_PARTY_README)
-# The OpenJDK source tree includes the JPEG library (IJG), zlib & libpng (zlib), giflib and LCMS (MIT)
-# The test code includes copies of NSS under the Mozilla Public License v2.0
-# The PCSClite headers are under a BSD with advertising license
-# The elliptic curve cryptography (ECC) source code is licensed under the LGPLv2.1 or any later version
-License:  ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib
-URL:      http://openjdk.java.net/
-
 # RPM conditionals so as to be able to dynamically produce
 # slowdebug/release builds. See:
 # http://rpm.org/user_doc/conditional_builds.html
@@ -166,9 +83,6 @@ URL:      http://openjdk.java.net/
 # we need to distinguish between big and little endian PPC64
 %global ppc64le         ppc64le
 %global ppc64be         ppc64 ppc64p7
-
-# Define the architectures on which we build
-ExclusiveArch: %{aarch64} %{ix86} %{ppc64le} s390x x86_64
 # Set of architectures which support multiple ABIs
 %global multilib_arches %{power64} sparc64 x86_64
 # Set of architectures for which we build slowdebug builds
@@ -263,10 +177,6 @@ ExclusiveArch: %{aarch64} %{ix86} %{ppc64le} s390x x86_64
 %endif
 %global bootjdk /usr/lib/jvm/java-%{buildjdkver}-openjdk
 
-# Disable LTO as this causes build failures at the moment.
-# See RHBZ#1861401 and https://bugs.gentoo.org/833097
-%define _lto_cflags %{nil}
-
 # Filter out flags from the optflags macro that cause problems with the OpenJDK build
 # We filter out -O flags so that the optimization of HotSpot is not lowered from O3 to O2
 # We filter out -Wall which will otherwise cause HotSpot to produce hundreds of thousands of warnings (100+mb logs)
@@ -356,6 +266,25 @@ ExclusiveArch: %{aarch64} %{ix86} %{ppc64le} s390x x86_64
 %global with_systemtap 0
 %endif
 
+# New Version-String scheme-style defines
+%global majorver 8
+# Define version of OpenJDK 8 used
+%global project openjdk
+%global repo shenandoah-jdk8u
+%global openjdk_revision 8u482-b08
+%global shenandoah_revision shenandoah%{openjdk_revision}
+# Define IcedTea version used for SystemTap tapsets and desktop file
+%global icedteaver      3.15.0
+# Define current Git revision for the FIPS support patches
+%global fipsver 6d1aade0648
+# Define current Git revision for the cacerts patch
+%global cacertsver 8139f2361c2
+
+# Standard JPackage naming and versioning defines
+%global origin          openjdk
+%global origin_nice     OpenJDK
+%global top_level_dir_name   %{shenandoah_revision}
+
 # Settings for local security configuration
 %global security_file %{top_level_dir_name}/jdk/src/share/lib/security/java.security-%{_target_os}
 %global cacerts_file /etc/pki/java/cacerts
@@ -366,11 +295,11 @@ ExclusiveArch: %{aarch64} %{ix86} %{ppc64le} s390x x86_64
 # Define what url should JVM offer in case of a crash report
 # order may be important, epel may have rhel declared
 %if 0%{?epel}
-%global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora%20EPEL&component=%{compatiblename}&version=epel%{epel}
+%global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora%20EPEL&component=%{component}&version=epel%{epel}
 %else
 %if 0%{?fedora}
 # Does not work for rawhide, keeps the version field empty
-%global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=%{compatiblename}&version=%{fedora}
+%global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=%{component}&version=%{fedora}
 %else
 %if 0%{?rhel}
 %global oj_vendor_bug_url https://access.redhat.com/support/cases/
@@ -380,6 +309,39 @@ ExclusiveArch: %{aarch64} %{ix86} %{ppc64le} s390x x86_64
 %endif
 %endif
 
+# e.g. aarch64-shenandoah-jdk8u212-b04-shenandoah-merge-2019-04-30 -> aarch64-shenandoah-jdk8u212-b04
+%global version_tag     %(VERSION=%{shenandoah_revision}; echo ${VERSION%%-shenandoah-merge*})
+# eg # jdk8u60-b27 -> jdk8u60 or # aarch64-jdk8u60-b27 -> aarch64-jdk8u60  (dont forget spec escape % by %%)
+%global whole_update    %(VERSION=%{version_tag}; echo ${VERSION%%-*})
+# eg  jdk8u60 -> 60 or aarch64-jdk8u60 -> 60
+%global updatever       %(VERSION=%{whole_update}; echo ${VERSION##*u})
+# eg jdk8u60-b27 -> b27
+%global buildver        %(VERSION=%{version_tag}; echo ${VERSION##*-})
+%global rpmrelease      1
+# Define milestone (EA for pre-releases, GA ("fcs") for releases)
+# Release will be (where N is usually a number starting at 1):
+# - 0.N%%{?extraver}%%{?dist} for EA releases,
+# - N%%{?extraver}{?dist} for GA releases
+%global is_ga           1
+%if %{is_ga}
+%global milestone          fcs
+%global milestone_version  %{nil}
+%global extraver %{nil}
+%global eaprefix %{nil}
+%else
+%global milestone          ea
+%global milestone_version  "-ea"
+%global extraver .%{milestone}
+%global eaprefix 0.
+%endif
+# priority must be 7 digits in total. The expression is workarounding tip
+%global priority        %(TIP=1800%{updatever};  echo ${TIP/tip/999})
+
+%global javaver         1.%{majorver}.0
+
+# parametrized macros are order-sensitive
+%global compatiblename  %{name}
+%global fullversion     %{compatiblename}-%{version}-%{release}
 # images stub
 %global jdkimage       j2sdk-image
 %global jreimage       j2re-image
@@ -391,34 +353,91 @@ ExclusiveArch: %{aarch64} %{ix86} %{ppc64le} s390x x86_64
 %define uniquejavadocdir()    %{expand:%{fullversion}%{?1}}
 # main id and dir of this jdk
 %define uniquesuffix()        %{expand:%{fullversion}.%{_arch}%{?1}}
-%define jreportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}[^.]*;portable%{1}.jre;g")
+%define jreportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}\\(_[0-9]\\)*;portable%{1}.jre;g")
-%define jdkportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}[^.]*;portable%{1}.jdk;g")
+%define jdkportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}\\(_[0-9]\\)*;portable%{1}.jdk;g")
-# RPM 4.19 no longer accept our double percentaged %%{nil} passed to %%{1}
-# so we have to pass in "" but evaluate it, otherwise files will include it
 %define jreportablearchive()  %{expand:%{jreportablenameimpl -- %%{1}}.tar.xz}
-%define jreportablearchive_for_files()  %(echo %{jreportablearchive -- ""})
 %define jdkportablearchive()  %{expand:%{jdkportablenameimpl -- %%{1}}.tar.xz}
-%define jdkportablearchive_for_files()  %(echo %{jdkportablearchive -- ""})
 %define jreportablename()     %{expand:%{jreportablenameimpl -- %%{1}}}
 %define jdkportablename()     %{expand:%{jdkportablenameimpl -- %%{1}}}
-%define docportablename() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}[^.]*;portable.docs;g")
+%define docportablename() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}\\(_[0-9]\\)*;portable.docs;g")
 %define docportablearchive()  %{docportablename}.tar.xz
-%define miscportablename() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}[^.]*;portable.misc;g")
+%define miscportablename() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}\\(_[0-9]\\)*;portable.misc;g")
 %define miscportablearchive()  %{miscportablename}.tar.xz
 
+# Fix for https://bugzilla.redhat.com/show_bug.cgi?id=1111349.
+# See also https://bugzilla.redhat.com/show_bug.cgi?id=1590796
+# as to why some libraries *cannot* be excluded. In particular,
+# these are:
+# libjsig.so, libjava.so, libjawt.so, libjvm.so and libverify.so
+%global _privatelibs libatk-wrapper[.]so.*|libattach[.]so.*|libawt_headless[.]so.*|libawt[.]so.*|libawt_xawt[.]so.*|libdt_socket[.]so.*|libfontmanager[.]so.*%{freetype_lib}|libhprof[.]so.*|libinstrument[.]so.*|libj2gss[.]so.*|libj2pcsc[.]so.*|libj2pkcs11[.]so.*|libjaas_unix[.]so.*|libjava_crw_demo[.]so.*%{jpeg_lib}|libjdwp[.]so.*|libjli[.]so.*|libjsdt[.]so.*|libjsoundalsa[.]so.*|libjsound[.]so.*|liblcms[.]so.*|libmanagement[.]so.*|libmlib_image[.]so.*|libnet[.]so.*|libnio[.]so.*|libnpt[.]so.*|libsaproc[.]so.*|libsctp[.]so.*|libsplashscreen[.]so.*|libsunec[.]so.*|libsystemconf[.]so.*|libunpack[.]so.*|libzip[.]so.*|lib[.]so\\(SUNWprivate_.*
+%global __provides_exclude ^(%{_privatelibs})$
+%global __requires_exclude ^(%{_privatelibs})$
+
+# Standard JPackage directories and symbolic links.
+%global sdkdir()        %{expand:%{uniquesuffix %%1}}
+%global jrelnk()        %{expand:jre-%{javaver}-%{origin}-%{version}-%{release}.%{_arch}%1}
+
+%global jredir()        %{expand:%{sdkdir %%1}/jre}
+%global sdkbindir()     %{expand:%{_jvmdir}/%{sdkdir %%1}/bin}
+%global jrebindir()     %{expand:%{_jvmdir}/%{jredir %%1}/bin}
 %global alt_java_name     alt-java
+%global jvmjardir()     %{expand:%{_jvmjardir}/%{uniquesuffix %%1}}
+
+%global rpm_state_dir %{_localstatedir}/lib/rpm-state/
+
+# For flatpack builds hard-code /usr/sbin/alternatives,
+# otherwise use %%{_sbindir} relative path.
+%if 0%{?flatpak}
+%global alternatives_requires /usr/sbin/alternatives
+%else
+%global alternatives_requires %{_sbindir}/alternatives
+%endif
 
 # Prevent brp-java-repack-jars from being run.
 %global __jar_repack 0
 
+# portables have grown out of its component, moving back to java-x-vendor
+# this expression, when declared as global, filled component with java-x-vendor portable
+%define component %(echo %{name} | sed "s;-portable;;g")
+
+Name:    java-%{javaver}-%{origin}-portable
+Version: %{javaver}.%{updatever}.%{buildver}
+Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
+# java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons
+# and this change was brought into RHEL-4. java-1.5.0-ibm packages
+# also included the epoch in their virtual provides. This created a
+# situation where in-the-wild java-1.5.0-ibm packages provided "java =
+# 1:1.5.0". In RPM terms, "1.6.0 < 1:1.5.0" since 1.6.0 is
+# interpreted as 0:1.6.0. So the "java >= 1.6.0" requirement would be
+# satisfied by the 1:1.5.0 packages. Thus we need to set the epoch in
+# JDK package >= 1.6.0 to 1, and packages referring to JDK virtual
+# provides >= 1.6.0 must specify the epoch, "java >= 1:1.6.0".
+
+Epoch:   1
+Summary: %{origin_nice} %{majorver} Runtime Environment portable edition
+Group:   Development/Languages
+
+# HotSpot code is licensed under GPLv2
+# JDK library code is licensed under GPLv2 with the Classpath exception
+# The Apache license is used in code taken from Apache projects (primarily JAXP & JAXWS)
+# DOM levels 2 & 3 and the XML digital signature schemas are licensed under the W3C Software License
+# The JSR166 concurrency code is in the public domain
+# The BSD and MIT licenses are used for a number of third-party libraries (see THIRD_PARTY_README)
+# The OpenJDK source tree includes the JPEG library (IJG), zlib & libpng (zlib), giflib and LCMS (MIT)
+# The test code includes copies of NSS under the Mozilla Public License v2.0
+# The PCSClite headers are under a BSD with advertising license
+# The elliptic curve cryptography (ECC) source code is licensed under the LGPLv2.1 or any later version
+License:  ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib
+URL:      http://openjdk.java.net/
+
 # Shenandoah HotSpot
 # openjdk/shenandoah-jdk8u contains an integration forest of
 # OpenJDK 8u and the Shenandoah garbage collector
 # To regenerate, use:
-# VERSION=<shenandoah_revision>
+# VERSION=%%{shenandoah_revision}
 # FILE_NAME_ROOT=${VERSION}
 # REPO_ROOT=<path to checked-out repository> generate_source_tarball.sh
-# where the source is obtained from http://github.com/<project>/<repo>
+# where the source is obtained from http://github.com/%%{project}/%%{repo}
 Source0: %{shenandoah_revision}.tar.xz
 
 # Custom README for -src subpackage
@@ -482,14 +501,11 @@ Patch534: rh1648246-always_instruct_vm_to_assume_multiple_processors_are_availab
 Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
 # RH1582504: Use RSA as default for keytool, as DSA is disabled in all crypto policies except LEGACY
 Patch1003: rh1582504-rsa_default_for_keytool.patch
-# RH1750419: Enable build of speculative store bypass hardened alt-java (CVE-2018-3639)
-Patch600: rh1750419-redhat_alt_java.patch
 
 # Crypto policy and FIPS support patches
 # Patch is generated from the fips tree at https://github.com/rh-openjdk/jdk8u/tree/fips
-# as follows: git diff <openjdk_revision> common jdk > fips-8u-$(git show -s --format=%h HEAD).patch
+# as follows: git diff %%{openjdk_revision} common jdk > fips-8u-$(git show -s --format=%h HEAD).patch
 # Diff is limited to src and make subdirectories to exclude .github changes
-
 # Fixes currently included:
 # PR3183, RH1340845: Support Fedora/RHEL8 system crypto policy
 # PR3655: Allow use of system crypto policy to be disabled by the user
@@ -531,8 +547,8 @@ Patch528: pr3083-rh1346460-for_ssl_debug_return_null_instead_of_exception_when_t
 # as follows: git diff fips > pr2888-rh2055274-support_system_cacerts-$(git show -s --format=%h HEAD).patch
 Patch539: pr2888-rh2055274-support_system_cacerts-%{cacertsver}.patch
 Patch541: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
-# JDK-8385876: [8u] hotspot/src/share/vm/code/compiledIC.cpp:406:30: error: 'this' pointer is null
+# RH1750419: Enable build of speculative store bypass hardened alt-java (CVE-2018-3639)
-Patch542: jdk8385876-zero_this_pointer_is_null.patch
+Patch600: rh1750419-redhat_alt_java.patch
 
 #############################################
 #
@@ -579,6 +595,8 @@ Patch204: jdk8042159-allow_using_system_installed_lcms2-jdk.patch
 Patch581: jdk8257794-remove_broken_assert.patch
 # JDK-8186464, RH1433262: ZipFile cannot read some InfoZip ZIP64 zip files
 Patch12: jdk8186464-rh1433262-zip64_failure.patch
+# JDK-8328999, RH2251025 - Update GIFlib to 5.2.2 (PR#571)
+Patch13: jdk8328999-update_giflib_5.2.2.patch
 # JDK-8141590 - Cannot build Zero with devkit
 Patch14: jdk8141590-bundle_libffi.patch
 Patch15: jdk8141590-bundle_libffi-followup.patch
@@ -679,17 +697,17 @@ BuildRequires: libpng-devel
 BuildRequires: zlib-devel
 %else
 # Version in jdk/src/share/native/sun/awt/libfreetype/include/freetype/freetype.h
-Provides: bundled(freetype) = 2.14.2
+Provides: bundled(freetype) = 2.13.3
 # Version in jdk/src/share/native/sun/awt/giflib/gif_lib.h
-Provides: bundled(giflib) = 6.1.2
+Provides: bundled(giflib) = 5.2.2
 # Version in jdk/src/share/native/sun/java2d/cmm/lcms/lcms2.h
-Provides: bundled(lcms2) = 2.19.1
+Provides: bundled(lcms2) = 2.14.0
 # Version in jdk/src/share/native/sun/awt/image/jpeg/jpeglib.h
 Provides: bundled(libjpeg) = 6b
 # Version in jdk/src/share/native/sun/awt/libpng/png.h
-Provides: bundled(libpng) = 1.6.57
+Provides: bundled(libpng) = 1.6.51
 # Version in jdk/src/share/native/java/util/zip/zlib/zlib.h
-Provides: bundled(zlib) = 1.3.2
+Provides: bundled(zlib) = 1.3.1
 # We link statically against libstdc++ to increase portability
 BuildRequires: libstdc++-static
 %endif
@@ -789,7 +807,11 @@ export XZ_OPT="-T0"
 %endif
 %setup -q -c -n %{uniquesuffix ""} -T -a 0
 # https://bugzilla.redhat.com/show_bug.cgi?id=1189084
-
+prioritylength=`expr length %{priority}`
+if [ $prioritylength -ne 7 ] ; then
+ echo "priority must be 7 digits in total, violated"
+ exit 14
+fi
 # For old patches
 ln -s %{top_level_dir_name} jdk8
 ln -s %{top_level_dir_name} openjdk
@@ -805,6 +827,20 @@ cp %{SOURCE101} %{top_level_dir_name}/common/autoconf/build-aux/
 
 # OpenJDK patches
 
+# This syntax is deprecated:
+#    %patchN [...]
+# and should be replaced with:
+#    %patch -PN [...]
+# For example:
+#    %patch1001 -p1
+# becomes:
+#    %patch -P1001 -p1
+# The replacement format suggested by recent (circa Fedora 38) RPM
+# deprecation messages:
+#    %patch N [...]
+# is not backward-compatible with prior (circa RHEL-8) versions of
+# rpmbuild.
+
 %if %{system_libs}
 # Remove libraries that are linked
 sh %{SOURCE12}
@@ -842,12 +878,12 @@ popd
 %patch -P574
 %patch -P581
 %patch -P541
+%patch -P12
 pushd %{top_level_dir_name}
-%patch -P12 -p1
 %patch -P502 -p1
+%patch -P13 -p1
 %patch -P14 -p1
 %patch -P15 -p1
-%patch -P542 -p1
 popd
 
 # Early fixes
@@ -916,6 +952,7 @@ sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE17} > nss.fips.cfg
 export NUM_PROC=%(/usr/bin/getconf _NPROCESSORS_ONLN 2> /dev/null || :)
 export NUM_PROC=${NUM_PROC:-1}
 %if 0%{?_smp_ncpus_max}
+# Honor %%_smp_ncpus_max
 [ ${NUM_PROC} -gt %{?_smp_ncpus_max} ] && export NUM_PROC=%{?_smp_ncpus_max}
 %endif
 %ifnarch %{ix86}
@@ -925,33 +962,21 @@ export XZ_OPT="-T0"
 %ifarch s390x sparc64 alpha %{power64} %{aarch64}
 export ARCH_DATA_MODEL=64
 %endif
-
-# HotSpot uses EXTRA_CPP_FLAGS since JDK-8374917 in 8u492-b01
-EXTRA_CFLAGS="%ourcppflags -Wno-error"
-EXTRA_CPP_FLAGS="%ourcppflags"
-
 %ifarch alpha
-export EXTRA_CPP_FLAGS="$CFLAGS -mieee"
+export CFLAGS="$CFLAGS -mieee"
 %endif
 
+# We use ourcppflags because the OpenJDK build seems to
+# pass EXTRA_CFLAGS to the HotSpot C++ compiler...
+EXTRA_CFLAGS="%ourcppflags -Wno-error"
+EXTRA_CPP_FLAGS="%ourcppflags"
 %ifarch %{power64} ppc
 EXTRA_CFLAGS="$EXTRA_CFLAGS -fno-tree-vectorize"
 # fix rpmlint warnings
 EXTRA_CFLAGS="$EXTRA_CFLAGS -fno-strict-aliasing"
-# Workaround -Wnonnull warnings (OPENJDK-4894)
-EXTRA_CPP_FLAGS="$EXTRA_CPP_FLAGS -Wno-nonnull"
 %endif
-
-%ifnarch %{zero_arches}
-# -Wstringop-overflow is not supported on RHEL 7's gcc
-%if 0%{?rhel} != 7
-EXTRA_CPP_FLAGS="$EXTRA_CPP_FLAGS -Wno-error=stringop-overflow"
-%endif
-%endif
-
 EXTRA_ASFLAGS="${EXTRA_CFLAGS} -Wa,--generate-missing-build-notes=yes"
-
+export EXTRA_CFLAGS EXTRA_ASFLAGS
-export EXTRA_CFLAGS EXTRA_CPP_FLAGS EXTRA_ASFLAGS
 
 function buildjdk() {
     local outputdir=${1}
@@ -1479,9 +1504,9 @@ done
 
 %files
 # main package builds always
-%{_jvmdir}/%{jreportablearchive_for_files}
+%{_jvmdir}/%{jreportablearchive -- %%{nil}}
 %{_jvmdir}/%{jreportablearchive -- .debuginfo}
-%{_jvmdir}/%{jreportablearchive_for_files}.sha256sum
+%{_jvmdir}/%{jreportablearchive -- %%{nil}}.sha256sum
 %{_jvmdir}/%{jreportablearchive -- .debuginfo}.sha256sum
 
 %else
@@ -1494,9 +1519,9 @@ done
 %if %{include_normal_build}
 
 %files devel
-%{_jvmdir}/%{jdkportablearchive_for_files}
+%{_jvmdir}/%{jdkportablearchive -- %%{nil}}
 %{_jvmdir}/%{jdkportablearchive -- .debuginfo}
-%{_jvmdir}/%{jdkportablearchive_for_files}.sha256sum
+%{_jvmdir}/%{jdkportablearchive -- %%{nil}}.sha256sum
 %{_jvmdir}/%{jdkportablearchive -- .debuginfo}.sha256sum
 
 %files unstripped
@@ -1538,68 +1563,6 @@ done
 %endif
 
 %changelog
-* Fri Jul 17 2026 Andrea Bolognani <abologna@redhat.com> - 1:1.8.0.502.b07-1.0
-- Strip %%{dist} more thoroughly
-- Resolves: OPENJDK-4907
-
-* Thu Jul 16 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.502.b07-1.0
-- Update to 8u502-b07 (GA).
-- Update release notes for 8u502-b07.
-- Bump lcms2 version to 2.19.1 following JDK-8321489, JDK-8348110, JDK-8375065 & JDK-8383354
-- Bump zlib version to 1.3.2 following JDK-8378631
-- Port ForFiles patch to RHEL and update to use standard function naming format
-- Remove macro references in comments where possible (%dnl not compatible enough yet)
-- Cleanup RPM only macros unused in the portable spec file
-- Move version information and core NVR definitions back towards the top of the file
-- Explictly define supported architectures
-- Specify portablerelease and rpmrelease (always 0 for portables) in the Release field
-- Make zone string debug output optional in TestTranslations
-- Add RHEL 7 opt-out on -Werror=stringop-overflow which is unsupported on its gcc
-- ** This tarball is embargoed until 2026-07-21 @ 1pm PT. **
-- Resolves: OPENJDK-4869
-- Related: OPENJDK-4896
-- Resolves: OPENJDK-4903
-- Resolves: OPENJDK-4904
-- Resolves: OPENJDK-4906
-- Resolves: OPENJDK-4908
-- Related: OPENJDK-4895
-
-* Wed Jul 15 2026 Jiri Vanek <jvanek@redhat.com> - 1:1.8.0.502.b07-1.0
-- Redeclared ForFiles release sections as %%nil no longer works with %%1
-- RPM 4.19 no longer accept our double percentaged %%{nil} passed to %%{1}
-- so we have to pass in "" but evaluate it, otherwise files record will include it
-- Resolves: OPENJDK-4896
-
-* Sat Apr 18 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.492.b09-2
-- Add CVEs for 8u482 & 8u492 to NEWS
-- Add attempted patch for JDK-8385876 to fix -Wnonnull build failure with s390x Zero on CentOS 9
-- Workaround -Wnonull failure with ppc64le on CentOS 9 using -Wno-nonnull
-- Workaround -Werror=stringop-overflow failure with JIT debug builds on CentOS 9 using -Wno-error=stringop-overflow
-- Workaround undefined symbol: _ZN16G1TriggerClosure9do_oop_nvIjEEvPT_ by disabling LTO
-- Resolves: OPENJDK-4893
-- Resolves: OPENJDK-4894
-- Resolves: OPENJDK-4895
-- Resolves: OPENJDK-4909
-
-* Fri Apr 17 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.492.b09-1
-- Update to 8u492-b09 (GA)
-- Update release notes for 8u492-b09.
-- Regenerate JDK-8199936/PR3533 patch following JDK-8374917
-- Regenerate JDK-8186464/RH1433262 patch following JDK-8370986
-- Drop local giflib 5.2.2 patch now JDK-8328999 is included upstream
-- Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158
-- Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078
-- Bump LCMS 2 version to 2.15.0 following JDK-8303482
-- Bump libpng version to 1.6.57 following JDK-8375063, JDK-8377526, JDK-8380959 & JDK-8382047
-- ** This tarball is embargoed until 2026-04-21 @ 1pm PT. **
-- Resolves: OPENJDK-4601
-- Resolves: OPENJDK-4294
-- Resolves: OPENJDK-4518
-- Resolves: OPENJDK-4538
-- Resolves: OPENJDK-4547
-- Resolves: OPENJDK-4613
-- Resolves: OPENJDK-4635
-
 * Mon Jan 19 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.482.b08-1
 - Update to 8u482-b08 (GA).
 - Update release notes for 8u482-b08.

SOURCES/jdk8186464-rh1433262-zip64_failure.patch

@@ -7,10 +7,10 @@
 8186464: ZipFile cannot read some InfoZip ZIP64 zip files
 Reviewed-by: martin
 
-diff --git a/jdk/src/share/demo/nio/zipfs/src/com/sun/nio/zipfs/ZipFileSystem.java b/jdk/src/share/demo/nio/zipfs/src/com/sun/nio/zipfs/ZipFileSystem.java
+diff --git openjdk.orig/jdk/src/share/demo/nio/zipfs/src/com/sun/nio/zipfs/ZipFileSystem.java openjdk/jdk/src/share/demo/nio/zipfs/src/com/sun/nio/zipfs/ZipFileSystem.java
-index d3c68e5e06..fd249461e8 100644
+index 26e2a5bf9e9..2630c118817 100644
---- a/jdk/src/share/demo/nio/zipfs/src/com/sun/nio/zipfs/ZipFileSystem.java
+--- openjdk.orig/jdk/src/share/demo/nio/zipfs/src/com/sun/nio/zipfs/ZipFileSystem.java
-+++ b/jdk/src/share/demo/nio/zipfs/src/com/sun/nio/zipfs/ZipFileSystem.java
++++ openjdk/jdk/src/share/demo/nio/zipfs/src/com/sun/nio/zipfs/ZipFileSystem.java
 @@ -92,6 +92,7 @@ public class ZipFileSystem extends FileSystem {
      private final boolean createNew;     // create a new zip if not exists
      private static final boolean isWindows =
@@ -132,10 +132,10 @@ index d3c68e5e06..fd249461e8 100644
                  writeLong(os, cenlen);            // length of central directory
                  writeLong(os, cenoff);            // offset of central directory
  
-diff --git a/jdk/src/share/native/java/util/zip/zip_util.c b/jdk/src/share/native/java/util/zip/zip_util.c
+diff --git openjdk.orig/jdk/src/share/native/java/util/zip/zip_util.c openjdk/jdk/src/share/native/java/util/zip/zip_util.c
-index a5f164f750..30596d5baf 100644
+index 5fd6fea049d..858e5814e92 100644
---- a/jdk/src/share/native/java/util/zip/zip_util.c
+--- openjdk.orig/jdk/src/share/native/java/util/zip/zip_util.c
-+++ b/jdk/src/share/native/java/util/zip/zip_util.c
++++ openjdk/jdk/src/share/native/java/util/zip/zip_util.c
 @@ -385,6 +385,9 @@ findEND64(jzfile *zip, void *end64buf, jlong endpos)
  {
      char loc64[ZIP64_LOCHDR];
@@ -149,7 +149,7 @@ index a5f164f750..30596d5baf 100644
 @@ -567,6 +570,7 @@ readCEN(jzfile *zip, jint knownTotal)
  {
      /* Following are unsigned 32-bit */
-     jlong endpos, end64pos, cenpos, cenlen, cenoff, total64;
+     jlong endpos, end64pos, cenpos, cenlen, cenoff;
 +    jlong cenlen64, cenoff64, centot64;
      /* Following are unsigned 16-bit */
      jint total, tablelen, i, j;
@@ -164,7 +164,7 @@ index a5f164f750..30596d5baf 100644
 -        if ((end64pos = findEND64(zip, end64buf, endpos)) != -1) {
 -            cenlen = ZIP64_ENDSIZ(end64buf);
 -            cenoff = ZIP64_ENDOFF(end64buf);
--            total64 = ZIP64_ENDTOT(end64buf);
+-            total = (jint)ZIP64_ENDTOT(end64buf);
 +    unsigned char end64buf[ZIP64_ENDHDR];
 +    if ((end64pos = findEND64(zip, end64buf, endpos)) != -1) {
 +	// end64 candidate found,
@@ -178,14 +178,14 @@ index a5f164f750..30596d5baf 100644
 +	    // to use the end64 values
 +            cenlen = cenlen64;
 +            cenoff = cenoff64;
-+            total64 = centot64;
++            total = (jint)centot64;
-             /* ZIP64 size, offset and total-count fields are unsigned 64-bit
+             endpos = end64pos;
-              * values. Sizes and offsets that do not fit in signed jlong
+             endhdrlen = ZIP64_ENDHDR;
-              * (i.e., >= 2^63), or total values that do not fit in jint, are
+         }
-diff --git a/jdk/test/java/util/zip/ZipFile/ReadZip.java b/jdk/test/java/util/zip/ZipFile/ReadZip.java
+diff --git openjdk.orig/jdk/test/java/util/zip/ZipFile/ReadZip.java openjdk/jdk/test/java/util/zip/ZipFile/ReadZip.java
-index ffe8a8ed71..9b38000389 100644
+index ffe8a8ed712..9b380003893 100644
---- a/jdk/test/java/util/zip/ZipFile/ReadZip.java
+--- openjdk.orig/jdk/test/java/util/zip/ZipFile/ReadZip.java
-+++ b/jdk/test/java/util/zip/ZipFile/ReadZip.java
++++ openjdk/jdk/test/java/util/zip/ZipFile/ReadZip.java
 @@ -22,7 +22,7 @@
   */
  

SOURCES/jdk8199936-pr3533-enable_mstackrealign_on_x86_linux_as_well_as_x86_mac_os_x.patch

@@ -8,10 +8,10 @@ PR3533: HotSpot generates code with unaligned stack, crashes on SSE operations
 Summary: Enable -mstackrealign on x86 Linux as well as x86 Mac OS X
 
 diff --git a/common/autoconf/flags.m4 b/common/autoconf/flags.m4
-index 5d1ef8732f..3394c2030a 100644
+index 113bf367e2..bed030e8d1 100644
 --- a/common/autoconf/flags.m4
 +++ b/common/autoconf/flags.m4
-@@ -421,6 +421,21 @@ AC_DEFUN_ONCE([FLAGS_SETUP_COMPILER_FLAGS_FOR_JDK],
+@@ -451,6 +451,21 @@ AC_DEFUN_ONCE([FLAGS_SETUP_COMPILER_FLAGS_FOR_JDK],
      AC_SUBST($2CXXSTD_CXXFLAG)
    fi
  
@@ -34,22 +34,35 @@ index 5d1ef8732f..3394c2030a 100644
      AC_MSG_WARN([Ignoring CFLAGS($CFLAGS) found in environment. Use --with-extra-cflags])
    fi
 diff --git a/common/autoconf/hotspot-spec.gmk.in b/common/autoconf/hotspot-spec.gmk.in
-index 449788025f..907ea8ed0c 100644
+index 3f86751d2b..f8a271383f 100644
 --- a/common/autoconf/hotspot-spec.gmk.in
 +++ b/common/autoconf/hotspot-spec.gmk.in
-@@ -113,12 +113,14 @@ RC:=@HOTSPOT_RC@
+@@ -114,13 +114,14 @@ RC:=@HOTSPOT_RC@
+ # Retain EXTRA_{CFLAGS,CXXFLAGS,LDFLAGS,ASFLAGS} for the target flags to
+ # maintain compatibility with the existing Makefiles
+ EXTRA_CFLAGS=@LEGACY_TARGET_CFLAGS@ $(NO_DELETE_NULL_POINTER_CHECKS_CFLAG) \
+-				    $(NO_LIFETIME_DSE_CFLAG) $(CXXSTD_CXXFLAG)
++                                   $(NO_LIFETIME_DSE_CFLAG) $(CXXSTD_CXXFLAG) \
++                                   $(REALIGN_CFLAG)
+ EXTRA_CXXFLAGS=@LEGACY_TARGET_CXXFLAGS@
+ EXTRA_LDFLAGS=@LEGACY_TARGET_LDFLAGS@
+ EXTRA_ASFLAGS=@LEGACY_TARGET_ASFLAGS@
+ # Define an equivalent set for the host flags (i.e. without sysroot options)
+ HOST_CFLAGS=@LEGACY_HOST_CFLAGS@ $(NO_DELETE_NULL_POINTER_CHECKS_CFLAG) \
+-				 $(NO_LIFETIME_DSE_CFLAG) $(CXXSTD_CXXFLAG)
++                                 $(NO_LIFETIME_DSE_CFLAG) $(CXXSTD_CXXFLAG)
+ HOST_CXXFLAGS=@LEGACY_HOST_CXXFLAGS@
+ HOST_LDFLAGS=@LEGACY_HOST_LDFLAGS@
+ HOST_ASFLAGS=@LEGACY_HOST_ASFLAGS@
+diff --git a/common/autoconf/spec.gmk.in b/common/autoconf/spec.gmk.in
+index 9573bb2cbd..fe7efc130c 100644
+--- a/common/autoconf/spec.gmk.in
++++ b/common/autoconf/spec.gmk.in
+@@ -366,6 +366,7 @@ CXXFLAGS_JDKEXE:=@CXXFLAGS_JDKEXE@
  
  NO_DELETE_NULL_POINTER_CHECKS_CFLAG=@NO_DELETE_NULL_POINTER_CHECKS_CFLAG@
  NO_LIFETIME_DSE_CFLAG=@NO_LIFETIME_DSE_CFLAG@
 +REALIGN_CFLAG=@REALIGN_CFLAG@
  CXXSTD_CXXFLAG=@CXXSTD_CXXFLAG@
  
- # Retain EXTRA_{CFLAGS,CXXFLAGS,LDFLAGS,ASFLAGS} for the target flags to
+ CXX:=@FIXPATH@ @CCACHE@ @CXX@
- # maintain compatibility with the existing Makefiles
- EXTRA_CXXFLAGS=@LEGACY_TARGET_CXXFLAGS@ $(NO_DELETE_NULL_POINTER_CHECKS_CFLAG) \
--				        $(NO_LIFETIME_DSE_CFLAG) $(CXXSTD_CXXFLAG)
-+                                       $(NO_LIFETIME_DSE_CFLAG) $(CXXSTD_CXXFLAG) \
-+                                       $(REALIGN_CFLAG)
- EXTRA_CFLAGS=@LEGACY_TARGET_CFLAGS@
- EXTRA_LDFLAGS=@LEGACY_TARGET_LDFLAGS@
- EXTRA_ASFLAGS=@LEGACY_TARGET_ASFLAGS@

SOURCES/jdk8385876-zero_this_pointer_is_null.patch

@@ -1,28 +0,0 @@
-diff --git a/hotspot/src/share/vm/code/compiledIC.cpp b/hotspot/src/share/vm/code/compiledIC.cpp
-index 63821c0613..b0e3d057ca 100644
---- a/hotspot/src/share/vm/code/compiledIC.cpp
-+++ b/hotspot/src/share/vm/code/compiledIC.cpp
-@@ -403,7 +403,8 @@ void CompiledIC::set_to_monomorphic(CompiledICInfo& info) {
-       assert(info.cached_metadata() != NULL && info.cached_metadata()->is_method(), "sanity check");
-       CompiledStaticCall* csc = compiledStaticCall_at(instruction_address());
-       methodHandle method (thread, (Method*)info.cached_metadata());
--      csc->set_to_interpreted(method, info.entry());
-+      // Compiler sees 'this' as null on Zero but it should never actually get called
-+      NOT_ZERO(csc->set_to_interpreted(method, info.entry()));
-       if (TraceICs) {
-          ResourceMark rm(thread);
-          tty->print_cr ("IC@" INTPTR_FORMAT ": monomorphic to interpreter: %s",
-diff --git a/hotspot/src/share/vm/runtime/sharedRuntime.cpp b/hotspot/src/share/vm/runtime/sharedRuntime.cpp
-index a136da9054..39fb84628b 100644
---- a/hotspot/src/share/vm/runtime/sharedRuntime.cpp
-+++ b/hotspot/src/share/vm/runtime/sharedRuntime.cpp
-@@ -1319,7 +1319,8 @@ methodHandle SharedRuntime::resolve_sub_helper(JavaThread *thread,
-         }
-       } else {
-         CompiledStaticCall* ssc = compiledStaticCall_before(caller_frame.pc());
--        if (ssc->is_clean()) ssc->set(static_call_info);
-+        // Compiler sees 'this' as null on Zero but it should never actually get called
-+        NOT_ZERO(if (ssc->is_clean()) ssc->set(static_call_info));
-       }
-     }
- 

SOURCES/s390-8214206_fix.patch

@@ -16,7 +16,7 @@ diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/shenandoah/shenan
    Atomic::add(val, &_sum);
  
 -  int mag = log2_intptr(val) + 1;
-+  int mag = log2_long(val) + 1;
++  int mag = log2_intptr((uintptr_t)val) + 1;
  
    // Defensively saturate for product bits:
    if (mag < 0) {