diff --git a/.gitignore b/.gitignore index 3c4bce6..cb2f371 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ SOURCES/jdk-updates-jdk11u-jdk-11.0.11+9-4curve.tar.xz -SOURCES/tapsets-icedtea-3.15.0.tar.xz +SOURCES/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz diff --git a/.java-11-openjdk.metadata b/.java-11-openjdk.metadata index 5e1952f..35e6794 100644 --- a/.java-11-openjdk.metadata +++ b/.java-11-openjdk.metadata @@ -1,2 +1,2 @@ a339f6e108c16a23c47504565b602a6fc395bf2e SOURCES/jdk-updates-jdk11u-jdk-11.0.11+9-4curve.tar.xz -7ae2cba67467825b2c2a5fec7aea041865023002 SOURCES/tapsets-icedtea-3.15.0.tar.xz +c8281ee37b77d535c9c1af86609a531958ff7b34 SOURCES/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz diff --git a/SPECS/java-11-openjdk.spec b/SPECS/java-11-openjdk.spec index 3f77f67..8359953 100644 --- a/SPECS/java-11-openjdk.spec +++ b/SPECS/java-11-openjdk.spec @@ -331,7 +331,7 @@ %endif # Define IcedTea version used for SystemTap tapsets and desktop file -%global icedteaver 3.15.0 +%global icedteaver 6.0.0pre00-c848b93a8598 # Standard JPackage naming and versioning defines %global origin openjdk @@ -339,7 +339,7 @@ %global top_level_dir_name %{origin} %global top_level_dir_name_backup %{top_level_dir_name}-backup %global buildver 9 -%global rpmrelease 0 +%global rpmrelease 2 #%%global tagsuffix %%{nil} # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit %if %is_system_jdk @@ -428,6 +428,14 @@ %global rpm_state_dir %{_localstatedir}/lib/rpm-state/ +# For flatpack builds hard-code /usr/sbin/alternatives, +# otherwise use %%{_sbindir} relative path. +%if 0%{?flatpak} +%global alternatives_requires /usr/sbin/alternatives +%else +%global alternatives_requires %{_sbindir}/alternatives +%endif + %if %{with_systemtap} # Where to install systemtap tapset (links) # We would like these to be in a package specific sub-dir, @@ -1014,11 +1022,11 @@ Requires: cups-libs # for FIPS PKCS11 provider Requires: nss # Post requires alternatives to install tool alternatives -Requires(post): %{_sbindir}/alternatives +Requires(post): %{alternatives_requires} # in version 1.7 and higher for --family switch Requires(post): chkconfig >= 1.7 # Postun requires alternatives to uninstall tool alternatives -Requires(postun): %{_sbindir}/alternatives +Requires(postun): %{alternatives_requires} # in version 1.7 and higher for --family switch Requires(postun): chkconfig >= 1.7 # for optional support of kernel stream control, card reader and printing bindings @@ -1044,11 +1052,11 @@ Provides: java-headless%{?1} = %{epoch}:%{version}-%{release} Requires: %{name}%{?1}%{?_isa} = %{epoch}:%{version}-%{release} OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release} # Post requires alternatives to install tool alternatives -Requires(post): %{_sbindir}/alternatives +Requires(post): %{alternatives_requires} # in version 1.7 and higher for --family switch Requires(post): chkconfig >= 1.7 # Postun requires alternatives to uninstall tool alternatives -Requires(postun): %{_sbindir}/alternatives +Requires(postun): %{alternatives_requires} # in version 1.7 and higher for --family switch Requires(postun): chkconfig >= 1.7 @@ -1097,11 +1105,11 @@ Provides: java-demo%{?1} = %{epoch}:%{version}-%{release} %define java_javadoc_rpo() %{expand: OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release} # Post requires alternatives to install javadoc alternative -Requires(post): %{_sbindir}/alternatives +Requires(post): %{alternatives_requires} # in version 1.7 and higher for --family switch Requires(post): chkconfig >= 1.7 # Postun requires alternatives to uninstall javadoc alternative -Requires(postun): %{_sbindir}/alternatives +Requires(postun): %{alternatives_requires} # in version 1.7 and higher for --family switch Requires(postun): chkconfig >= 1.7 @@ -1167,7 +1175,7 @@ URL: http://openjdk.java.net/ Source0: jdk-updates-jdk%{featurever}u-jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}-4curve.tar.xz # Use 'icedtea_sync.sh' to update the following -# They are based on code contained in the IcedTea project (3.x). +# They are based on code contained in the IcedTea project (6.x). # Systemtap tapsets. Zipped up to keep it small. Source8: tapsets-icedtea-%{icedteaver}.tar.xz @@ -1207,7 +1215,7 @@ Patch1: rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch Patch2: rh1648644-java_access_bridge_privileged_security.patch # NSS via SunPKCS11 Provider (disabled due to memory leak). Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch -# RH1750419: Enable build of speculative store bypass hardened alt-java (CVE-2018-3639) +# enable build of speculative store bypass hardened alt-java Patch600: rh1750419-redhat_alt_java.patch # RH1582504: Use RSA as default for keytool, as DSA is disabled in all crypto policies except LEGACY Patch1003: rh1842572-rsa_default_for_keytool.patch @@ -1646,11 +1654,12 @@ for suffix in %{build_loop} ; do for file in "tapset"$suffix/*.in; do OUTPUT_FILE=`echo $file | sed -e "s:\.stp\.in$:-%{version}-%{release}.%{_arch}.stp:g"` sed -e "s:@ABS_SERVER_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/server/libjvm.so:g" $file > $file.1 + sed -e "s:@JAVA_SPEC_VER@:%{javaver}:g" $file.1 > $file.2 # TODO find out which architectures other than i686 have a client vm %ifarch %{ix86} - sed -e "s:@ABS_CLIENT_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/client/libjvm.so:g" $file.1 > $OUTPUT_FILE + sed -e "s:@ABS_CLIENT_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/client/libjvm.so:g" $file.2 > $OUTPUT_FILE %else - sed -e "/@ABS_CLIENT_LIBJVM_SO@/d" $file.1 > $OUTPUT_FILE + sed -e "/@ABS_CLIENT_LIBJVM_SO@/d" $file.2 > $OUTPUT_FILE %endif sed -i -e "s:@ABS_JAVA_HOME_DIR@:%{_jvmdir}/%{sdkdir -- $suffix}:g" $OUTPUT_FILE sed -i -e "s:@INSTALL_ARCH_DIR@:%{archinstall}:g" $OUTPUT_FILE @@ -2334,65 +2343,83 @@ end %endif %changelog -* Thu Apr 15 2021 Andrew Hughes - 1:11.0.11.0.9-0 +* Thu Apr 15 2021 Andrew Hughes - 1:11.0.11.0.9-2 +- Require tzdata 2021a to match upstream change JDK-8260356 +- Resolves: rhbz#1942310 + +* Tue Apr 13 2021 Andrew Hughes - 1:11.0.11.0.9-1 - Update to jdk-11.0.11.0+9 - Update release notes to 11.0.11.0+9 -- Require tzdata 2020f to match upstream change JDK-8259048 -- Require tzdata 2021a to match upstream change JDK-8260356 -- Remove RH1868754 patch as this is now resolved upstream by JDK-8258833 -- Remove RH1868740 & RH1883849 patches as these are now resolved by JDK-8259319 +- Switch to GA mode for final release. - This tarball is embargoed until 2021-04-20 @ 1pm PT. - Resolves: rhbz#1938201 -* Thu Apr 15 2021 Jayashree Huttanagoudar - 1:11.0.11.0.9-0 +* Tue Apr 13 2021 Andrew Hughes - 1:11.0.11.0.7-0.1.ea +- Update to jdk-11.0.11.0+7 +- Update release notes to 11.0.11.0+7 +- Switch to EA mode for 11.0.11 pre-release builds. +- Require tzdata 2020f to match upstream change JDK-8259048 +- Remove RH1868754 patch as this is now resolved upstream by JDK-8258833 +- Remove RH1868740 & RH1883849 patches as these are now resolved by JDK-8259319 +- Resolves: rhbz#1942310 + +* Tue Apr 13 2021 Jayashree Huttanagoudar - 1:11.0.11.0.7-0.1.ea - Fix issue where CheckVendor.java test erroneously passes when it should fail. - Add proper quoting so '&' is not treated as a special character by the shell. - Fixed not-including fastdebug build in case of --without fastdebug -- Resolves: rhbz#1938201 +- Resolves: rhbz#1942310 -* Mon Feb 22 2021 Andrew Hughes - 1:11.0.10.0.9-5 +* Mon Feb 22 2021 Andrew Hughes - 1:11.0.10.0.9-8 - Perform static library build on a separate source tree with bundled image libraries - Make static library build optional - Based on initial work by Severin Gehwolf - Resolves: rhbz#1930513 -* Mon Jan 18 2021 Andrew Hughes - 1:11.0.10.0.9-4 +* Mon Feb 22 2021 Andrew Hughes - 1:11.0.10.0.9-7 +- Update tapsets from IcedTea 6.x repository with fix for JDK-8015774 changes (_heap->_heaps) +- Update icedtea_sync.sh with a VCS mode that retrieves sources from a Mercurial repository +- Resolves: rhbz#1814915 + +* Mon Feb 22 2021 Stephan Bergmann - 1:11.0.10.0.9-6 +- Hardcode /usr/sbin/alternatives for Flatpak builds +- Resolves: rhbz#1930370 + +* Mon Jan 18 2021 Andrew Hughes - 1:11.0.10.0.9-5 - Fix accidental use of $ instead of % for variable reference. - Resolves: rhbz#1908972 -* Mon Jan 18 2021 Andrew Hughes - 1:11.0.10.0.9-3 +* Mon Jan 18 2021 Andrew Hughes - 1:11.0.10.0.9-4 - Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always occurs. - Resolves: rhbz#1915071 -* Sun Jan 17 2021 Andrew Hughes - 1:11.0.10.0.9-2 +* Sun Jan 17 2021 Andrew Hughes - 1:11.0.10.0.9-3 - Fix debug and fastdebug descriptions to emphasise the difference is optimisation or no optimisation. - Resolves: rhbz#1908972 -* Sun Jan 17 2021 Jiri Vanek - 1:11.0.10.0.9-2 +* Sun Jan 17 2021 Jiri Vanek - 1:11.0.10.0.9-3 - Removed lib-style provides for fastdebug_suffix_unquoted - Fixed missing condition for fastdebug packages being counted as debug ones - Fix typo in variable - Resolves: rhbz#1908972 -* Sun Jan 17 2021 Andrew Hughes - 1:11.0.10.0.9-1 +* Sun Jan 17 2021 Andrew Hughes - 1:11.0.10.0.9-2 - Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode - Resolves: rhbz#1894083 -* Fri Jan 15 2021 Andrew Hughes - 1:11.0.10.0.9-0 +* Fri Jan 15 2021 Andrew Hughes - 1:11.0.10.0.9-1 - Update to jdk-11.0.10.0+9 - Update release notes to 11.0.10.0+9 - Switch to GA mode for final release. -- This tarball is embargoed until 2021-01-19 @ 1pm PT. - Resolves: rhbz#1908972 -* Thu Jan 14 2021 Andrew Hughes - 1:11.0.10.0.8-0.0.ea +* Thu Jan 14 2021 Andrew Hughes - 1:11.0.10.0.8-0.1.ea - Update to jdk-11.0.10.0+8 - Update release notes to 11.0.10.0+8. - Update tarball generation script to use PR3818 which handles JDK-8171279 changes - Drop JDK-8250861 as applied upstream. - Resolves: rhbz#1903908 -* Tue Jan 12 2021 Andrew John Hughes - 1:11.0.10.0.1-0.0.ea +* Tue Jan 12 2021 Andrew John Hughes - 1:11.0.10.0.1-0.1.ea - Update to jdk-11.0.10.0+1 - Update release notes to 11.0.10.0+1 - Use JEP-322 Time-Based Versioning so we can handle a future 11.0.9.1-like release correctly. @@ -2406,41 +2433,47 @@ end - Adjust RH1842572 patch due to context change from JDK-8213400 - Resolves: rhbz#1903908 -* Tue Dec 29 2020 Andrew Hughes - 1:11.0.9.11-6 +* Tue Dec 29 2020 Andrew Hughes - 1:11.0.9.11-9 - Introduced ssbd_arches to denote architectures with SSBD mitigation (currently only x86_64) - Introduced nm-based check to verify alt-java on ssbd_arches is patched, and no other alt-java or java binaries are patched - RH1750419 patch amended to emit a warning on architectures where alt-java is the same as java - Resolves: rhbz#1784116 -* Tue Dec 29 2020 Jiri Vanek - 1:11.0.9.11-6 +* Tue Dec 29 2020 Jiri Vanek - 1:11.0.9.11-9 - Redefined linux -> __linux__ and __x86_64 -> __x86_64__ in RH1750419 patch - Resolves: rhbz#1784116 -* Tue Dec 29 2020 Andrew Hughes - 1:11.0.9.11-5 +* Tue Dec 29 2020 Andrew Hughes - 1:11.0.9.11-8 - Update release notes for 11.0.9.1 release. - Resolves: rhbz#1895274 -* Tue Dec 01 2020 Jiri Vanek - 1:11.0.9.11-4 -- Removed patch6: rh1566890-CVE_2018_3639-speculative_store_bypass.patch, surpassed by new patch -- Added patch600: rh1750419-redhat_alt_java.patch, surpassing removed patch -- No longer copy java->alt-java as it is created by patch600 +* Tue Dec 01 2020 Jiri Vanek - 1:11.0.9.11-7 +- removed patch6, rh1566890-CVE_2018_3639-speculative_store_bypass.patch, surpassed by new patch +- added patch600, rh1750419-redhat_alt_java.patch, suprassing removed patch +- no longer copying of java->alt-java as it is created by patch600 - Resolves: rhbz#1784116 -* Wed Nov 11 2020 Andrew Hughes - 1:11.0.9.11-3 +* Wed Nov 11 2020 Andrew Hughes - 1:11.0.9.11-6 - Fix typo of build_doc_archive/built_doc_archive - Resolves: rhbz#1895274 -* Wed Nov 04 2020 Severin Gehwolf - 1:11.0.9.11-3 +* Wed Nov 04 2020 Severin Gehwolf - 1:11.0.9.11-5 - Update to jdk-11.0.9.1+1 - RPM version stays at 11.0.9.11 so as to not break upgrade path. - Adds a single patch for JDK-8250861. - Resolves: rhbz#1895274 -* Thu Oct 29 2020 Jiri Vanek - 1:11.0.9.11-3 +* Thu Oct 29 2020 Jiri Vanek - 1:11.0.9.11-4 - Move all license files to NVR-specific JVM directory. - This bad placement was killing parallel installability and thus having a bad impact on leapp, if used. - Resolves: rhbz#1889481 +* Tue Oct 27 2020 Andrew Hughes - 1:11.0.9.11-3 +- Bump release number to build on RHEL 8.4.0 branch. +- Resolves: rhbz#1876665 +- Resolves: rhbz#1889497 +- Resolves: rhbz#1883849 + * Wed Oct 21 2020 Andrew Hughes - 1:11.0.9.11-2 - Add backport of JDK-8236512 to correct use of killSession - Resolves: rhbz#1889497 @@ -2463,13 +2496,13 @@ end * Thu Oct 15 2020 Andrew Hughes - 1:11.0.9.10-0.3.ea - Improve quoting of vendor name -- Resolves: rhbz#1883849 +- Resolves: rhbz#1876665 * Wed Oct 14 2020 Jiri Vanek - 1:11.0.9.10-0.3.ea - Set vendor property and vendor URLs - Made URLs to be preconfigured by OS - Moved vendor_version_string to a better place -- Resolves: rhbz#1883849 +- Resolves: rhbz#1876665 * Wed Oct 14 2020 Andrew Hughes - 1:11.0.9.10-0.2.ea - Add patch to allow the PKCS11 provider access to the SunJCE provider with the security manager enabled