import java-11-openjdk-11.0.19.0.7-4.el8

SOURCES/README.md

@@ -0,0 +1,39 @@
+OpenJDK 11 is a Long-Term Support (LTS) release of the Java platform.
+
+For a list of major changes from OpenJDK 8 (java-1.8.0-openjdk), see
+the upstream release page for OpenJDK 11 and the preceding interim
+releases:
+
+* 9: https://openjdk.org/projects/jdk9/
+* 10: https://openjdk.java.net/projects/jdk/10/
+* 11: https://openjdk.java.net/projects/jdk/11/
+
+# Rebuilding the OpenJDK package
+
+The OpenJDK packages are now created from a single build which is then
+packaged for different major versions of Red Hat Enterprise Linux
+(RHEL). This allows the OpenJDK team to focus their efforts on the
+development and testing of this single build, rather than having
+multiple builds which only differ by the platform they were built on.
+
+This does make rebuilding the package slightly more complicated than a
+normal package. Modifications should be made to the
+`java-11-openjdk-portable.specfile` file, which can be found with this
+README file in the source RPM or installed in the documentation tree
+by the `java-11-openjdk-headless` RPM.
+
+Once the modified `java-11-openjdk-portable` RPMs are built, they
+should be installed and will produce a number of tarballs in the
+`/usr/lib/jvm` directory. The `java-11-openjdk` RPMs can then be
+built, which will use these tarballs to create the usual RPMs found in
+RHEL. The `java-11-openjdk-portable` RPMs can be uninstalled once the
+desired final RPMs are produced.
+
+Note that the `java-11-openjdk.spec` file has a hard requirement on
+the exact version of java-11-openjdk-portable to use, so this will
+need to be modified if the version or rpmrelease values are changed in
+`java-11-openjdk-portable.specfile`.
+
+To reduce the number of RPMs involved, the `fastdebug` and `slowdebug`
+builds may be disabled using `--without fastdebug` and `--without
+slowdebug`.

SOURCES/rh1648644-java_access_bridge_privileged_security.patch

@@ -1,20 +0,0 @@
---- openjdk/src/java.base/share/conf/security/java.security
-+++ openjdk/src/java.base/share/conf/security/java.security
-@@ -304,6 +304,8 @@
- #
- package.access=sun.misc.,\
-                sun.reflect.,\
-+               org.GNOME.Accessibility.,\
-+               org.GNOME.Bonobo.,\
- 
- #
- # List of comma-separated packages that start with or equal this string
-@@ -316,6 +318,8 @@
- #
- package.definition=sun.misc.,\
-                    sun.reflect.,\
-+                   org.GNOME.Accessibility.,\
-+                   org.GNOME.Bonobo.,\
- 
- #
- # Determines whether this properties file can be appended to

SPECS/java-11-openjdk.spec

@@ -65,14 +65,10 @@
 # (initiated in https://bugzilla.redhat.com/show_bug.cgi?id=1482192)
 %global debug_suffix_unquoted -slowdebug
 %global fastdebug_suffix_unquoted -fastdebug
-%global main_suffix_unquoted -main
-%global staticlibs_suffix_unquoted -staticlibs
 # quoted one for shell operations
 %global debug_suffix "%{debug_suffix_unquoted}"
 %global fastdebug_suffix "%{fastdebug_suffix_unquoted}"
 %global normal_suffix ""
-%global main_suffix "%{main_suffix_unquoted}"
-%global staticlibs_suffix "%{staticlibs_suffix_unquoted}"
 
 %global debug_warning This package is unoptimised with full debugging. Install only as needed and remove ASAP.
 %global fastdebug_warning This package is optimised with full debugging. Install only as needed and remove ASAP.
@@ -146,6 +142,8 @@
 %global ssbd_arches x86_64
 # Set of architectures where we verify backtraces with gdb
 %global gdb_arches %{jit_arches} %{zero_arches}
+# Set of architectures for which we have a portable build
+%global portable_build_arches %{aarch64} %{ix86} %{power64} s390x x86_64
 
 # By default, we build a slowdebug build during main build on JIT architectures
 %if %{with slowdebug}
@@ -203,12 +201,6 @@
 # Build and test slowdebug first as it provides the best diagnostics
 %global build_loop %{slowdebug_build} %{fastdebug_build} %{normal_build}
 
-%if %{include_staticlibs}
-%global staticlibs_loop %{staticlibs_suffix}
-%else
-%global staticlibs_loop %{nil}
-%endif
-
 %if 0%{?flatpak}
 %global bootstrap_build false
 %else
@@ -243,6 +235,9 @@
 # JDK to use for bootstrapping
 %global bootjdk /usr/lib/jvm/java-%{buildjdkver}-openjdk
 
+# debugedit tool for rewriting ELF file paths
+%global debugedit %{_rpmconfigdir}/debugedit
+
 # Disable LTO as this causes build failures at the moment.
 # See RHBZ#1861401
 %define _lto_cflags %{nil}
@@ -365,7 +360,7 @@
 %endif
 %endif
 %endif
-%global oj_vendor_version (Red_Hat-%{version}-%{release})
+%global oj_vendor_version (Red_Hat-%{version}-%{portablerelease})
 
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      6.0.0pre00-c848b93a8598
@@ -378,7 +373,12 @@
 %global top_level_dir_name   %{origin}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
 %global buildver        7
-%global rpmrelease      1
+%global rpmrelease      4
+# Settings used by the portable build
+%global portablerelease 2
+%global portablesuffix el8
+%global portablebuilddir /builddir/build/BUILD
+
 #%%global tagsuffix     %%{nil}
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
@@ -426,7 +426,6 @@
 %global jdkimage                jdk
 %global static_libs_image       static-libs
 # output dir stub
-%define buildoutputdir() %{expand:build/jdk%{featurever}.build%{?1}}
 %define installoutputdir() %{expand:install/jdk%{featurever}.install%{?1}}
 # we can copy the javadoc to not arched dir, or make it not noarch
 %define uniquejavadocdir()    %{expand:%{fullversion}.%{_arch}%{?1}}
@@ -453,7 +452,6 @@
 %global __requires_exclude ^(%{_privatelibs}|%{_publiclibs})$
 %endif
 
-
 %global etcjavasubdir     %{_sysconfdir}/java/java-%{javaver}-%{origin}
 %define etcjavadir()      %{expand:%{etcjavasubdir}/%{uniquesuffix -- %{?1}}}
 # Standard JPackage directories and symbolic links.
@@ -826,6 +824,8 @@ exit 0
 %define files_jre_headless() %{expand:
 %license %{_jvmdir}/%{sdkdir -- %{?1}}/legal
 %doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/NEWS
+%doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/README.md
+%doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/java-%{featurever}-openjdk-portable.specfile
 %dir %{_sysconfdir}/.java/.systemPrefs
 %dir %{_sysconfdir}/.java
 %dir %{_jvmdir}/%{sdkdir -- %{?1}}
@@ -1314,9 +1314,6 @@ Source8: tapsets-icedtea-%{icedteaver}.tar.xz
 # Desktop files. Adapted from IcedTea
 Source9: jconsole.desktop.in
 
-# Release notes
-Source10: NEWS
-
 # nss configuration file
 Source11: nss.cfg.in
 
@@ -1341,6 +1338,20 @@ Source17: nss.fips.cfg.in
 # Ensure translations are available for new timezones
 Source18: TestTranslations.java
 
+# Include portable spec and instructions on how to rebuild
+Source19: README.md
+Source20: java-%{featurever}-openjdk-portable.specfile
+
+# Setup variables to reference correct sources
+%global releasezip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.unstripped.jdk..%{_arch}.tar.xz
+%global staticlibzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.static-libs..%{_arch}.tar.xz
+%global docszip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.docs..%{_arch}.tar.xz
+%global misczip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.misc..%{_arch}.tar.xz
+%global slowdebugzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.slowdebug.jdk..%{_arch}.tar.xz
+%global slowdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.slowdebug.static-libs..%{_arch}.tar.xz
+%global fastdebugzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.fastdebug.jdk..%{_arch}.tar.xz
+%global fastdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.fastdebug.static-libs..%{_arch}.tar.xz
+
 ############################################
 #
 # RPM/distribution specific patches
@@ -1349,8 +1360,6 @@ Source18: TestTranslations.java
 
 # Ignore AWTError when assistive technologies are loaded
 Patch1:    rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
-# Restrict access to java-atk-wrapper classes
-Patch2:    rh1648644-java_access_bridge_privileged_security.patch
 # NSS via SunPKCS11 Provider (disabled due to memory leak).
 Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
 # RH1750419: enable build of speculative store bypass hardened alt-java (CVE-2018-3639)
@@ -1397,7 +1406,6 @@ Patch1001: fips-11u-%{fipsver}.patch
 # be reviewed & pushed to the current development
 # tree of OpenJDK.
 #############################################
-
 Patch3:    rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
 
 #############################################
@@ -1409,6 +1417,7 @@ Patch3:    rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk1
 # need to be reviewed & pushed to the appropriate
 # updates tree of OpenJDK.
 #############################################
+Patch2001: jdk8242332-rh2108712-sha3-sunpkcs11.patch
 
 #############################################
 #
@@ -1452,7 +1461,20 @@ BuildRequires: xorg-x11-proto-devel
 BuildRequires: zip
 BuildRequires: unzip
 BuildRequires: javapackages-filesystem
-BuildRequires: java-%{buildjdkver}-openjdk-devel
+%if %{include_normal_build}
+BuildRequires: java-%{featurever}-openjdk-portable-unstripped = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: java-%{featurever}-openjdk-portable-static-libs = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+%endif
+%if %{include_fastdebug_build}
+BuildRequires: java-%{featurever}-openjdk-portable-devel-fastdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: java-%{featurever}-openjdk-portable-static-libs-fastdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+%endif
+%if %{include_debug_build}
+BuildRequires: java-%{featurever}-openjdk-portable-devel-slowdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: java-%{featurever}-openjdk-portable-static-libs-slowdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+%endif
+BuildRequires: java-%{featurever}-openjdk-portable-docs = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: java-%{featurever}-openjdk-portable-misc = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
 # Zero-assembler build requirement
 %ifarch %{zero_arches}
 BuildRequires: libffi-devel
@@ -1487,8 +1509,6 @@ Provides: bundled(lcms2) = 2.12.0
 Provides: bundled(libjpeg) = 6b
 # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h
 Provides: bundled(libpng) = 1.6.37
-# We link statically against libstdc++ to increase portability
-BuildRequires: libstdc++-static
 %endif
 
 # this is always built, also during debug-only build
@@ -1835,12 +1855,13 @@ sh %{SOURCE12} %{top_level_dir_name}
 # Patch the JDK
 pushd %{top_level_dir_name}
 %patch1 -p1
-%patch2 -p1
 %patch3 -p1
 # Add crypto policy and FIPS support
 %patch1001 -p1
 # nss.cfg PKCS11 support; must come last as it also alters java.security
 %patch1000 -p1
+# PKCS11 SHA3 backport
+%patch2001 -p1
 # tzdata update
 %patch2002 -p1
 %patch2003 -p1
@@ -1902,272 +1923,78 @@ sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE11} > nss.cfg
 sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE17} > nss.fips.cfg
 
 %build
-# How many CPU's do we have?
-export NUM_PROC=%(/usr/bin/getconf _NPROCESSORS_ONLN 2> /dev/null || :)
-export NUM_PROC=${NUM_PROC:-1}
-%if 0%{?_smp_ncpus_max}
-# Honor %%_smp_ncpus_max
-[ ${NUM_PROC} -gt %{?_smp_ncpus_max} ] && export NUM_PROC=%{?_smp_ncpus_max}
-%endif
 
-%ifarch s390x sparc64 alpha %{power64} %{aarch64}
+function customisejdk() {
-export ARCH_DATA_MODEL=64
+    local imagepath=${1}
-%endif
-%ifarch alpha
-export CFLAGS="$CFLAGS -mieee"
-%endif
 
-# We use ourcppflags because the OpenJDK build seems to
-# pass EXTRA_CFLAGS to the HotSpot C++ compiler...
-EXTRA_CFLAGS="%ourcppflags -Wno-error"
-EXTRA_CPP_FLAGS="%ourcppflags"
 
-%ifarch %{power64} ppc
+     if [ -d ${imagepath} ] ; then
-# fix rpmlint warnings
+        # Turn on system security properties
-EXTRA_CFLAGS="$EXTRA_CFLAGS -fno-strict-aliasing"
+        sed -i -e "s:^security.useSystemPropertiesFile=.*:security.useSystemPropertiesFile=true:" \
-%endif
+            ${imagepath}/conf/security/java.security
-%ifarch %{ix86}
-# Align stack boundary on x86_32
-EXTRA_CFLAGS="$(echo ${EXTRA_CFLAGS} | sed -e 's|-mstackrealign|-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4|')"
-EXTRA_CPP_FLAGS="$(echo ${EXTRA_CPP_FLAGS} | sed -e 's|-mstackrealign|-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4|')"
-%endif
-# Fixes annocheck warnings in assembler files due to missing build notes
-EXTRA_ASFLAGS="${EXTRA_CFLAGS} -Wa,--generate-missing-build-notes=yes"
-export EXTRA_CFLAGS EXTRA_CPP_FLAGS EXTRA_ASFLAGS
 
-function buildjdk() {
+        # Use system-wide tzdata
-    local outputdir=${1}
+        rm ${imagepath}/lib/tzdb.dat
-    local buildjdk=${2}
+        ln -s %{_datadir}/javazi-1.8/tzdb.dat ${imagepath}/lib/tzdb.dat
-    local maketargets="${3}"
+     fi
-    local debuglevel=${4}
-    local link_opt=${5}
-
-    local top_dir_abs_src_path=$(pwd)/%{top_level_dir_name}
-    local top_dir_abs_build_path=$(pwd)/${outputdir}
-
-    # This must be set using the global, so that the
-    # static libraries still use a dynamic stdc++lib
-    if [ "x%{link_type}" = "xbundled" ] ; then
-        libc_link_opt="static";
-    else
-        libc_link_opt="dynamic";
-    fi
-
-    echo "Using output directory: ${outputdir}";
-    echo "Checking build JDK ${buildjdk} is operational..."
-    ${buildjdk}/bin/java -version
-    echo "Using make targets: ${maketargets}"
-    echo "Using debuglevel: ${debuglevel}"
-    echo "Using link_opt: ${link_opt}"
-    echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}"
-
-    mkdir -p ${outputdir}
-    pushd ${outputdir}
-
-    # Note: zlib and freetype use %{link_type}
-    # rather than ${link_opt} as the system versions
-    # are always used in a system_libs build, even
-    # for the static library build
-    bash ${top_dir_abs_src_path}/configure \
-%ifarch %{zero_arches}
-    --with-jvm-variants=zero \
-%endif
-%ifarch %{ppc64le}
-    --with-jobs=1 \
-%endif
-    --with-version-build=%{buildver} \
-    --with-version-pre="%{ea_designator}" \
-    --with-version-opt=%{lts_designator} \
-    --with-vendor-version-string="%{oj_vendor_version}" \
-    --with-vendor-name="%{oj_vendor}" \
-    --with-vendor-url="%{oj_vendor_url}" \
-    --with-vendor-bug-url="%{oj_vendor_bug_url}" \
-    --with-vendor-vm-bug-url="%{oj_vendor_bug_url}" \
-    --with-boot-jdk=${buildjdk} \
-    --with-debug-level=${debuglevel} \
-    --with-native-debug-symbols="%{debug_symbols}" \
-    --disable-sysconf-nss \
-    --enable-unlimited-crypto \
-    --with-zlib=%{link_type} \
-    --with-freetype=%{link_type} \
-    --with-libjpeg=${link_opt} \
-    --with-giflib=${link_opt} \
-    --with-libpng=${link_opt} \
-    --with-lcms=${link_opt} \
-    --with-harfbuzz=${link_opt} \
-    --with-stdc++lib=${libc_link_opt} \
-    --with-extra-cxxflags="$EXTRA_CPP_FLAGS" \
-    --with-extra-cflags="$EXTRA_CFLAGS" \
-    --with-extra-asflags="$EXTRA_ASFLAGS" \
-    --with-extra-ldflags="%{ourldflags}" \
-    --with-num-cores="$NUM_PROC" \
-    --disable-javac-server \
-    --with-jvm-features="%{shenandoah_feature},%{zgc_feature}" \
-    --disable-warnings-as-errors
-
-    cat spec.gmk
-
-    make \
-      JAVAC_FLAGS=-g \
-      LOG=trace \
-      WARNINGS_ARE_ERRORS="-Wno-error" \
-      CFLAGS_WARNINGS_ARE_ERRORS="-Wno-error" \
-      $maketargets || ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name "hs_err_pid*.log" | xargs cat && false )
-
-    popd
 }
 
-function installjdk() {
-    local outputdir=${1}
-    local installdir=${2}
-    local imagepath=${installdir}/images/%{jdkimage}
-
-    echo "Installing build from ${outputdir} to ${installdir}..."
-    mkdir -p ${installdir}
-    echo "Installing images..."
-    mv ${outputdir}/images ${installdir}
-    if [ -d ${outputdir}/bundles ] ; then
-	echo "Installing bundles...";
-	mv ${outputdir}/bundles ${installdir} ;
-    fi
-    if [ -d ${outputdir}/docs ] ; then
-	echo "Installing docs...";
-	mv ${outputdir}/docs ${installdir} ;
-    fi
-
-%if !%{with artifacts}
-    echo "Removing output directory...";
-    rm -rf ${outputdir}
-%endif
-
-    if [ -d ${imagepath} ] ; then
-	# the build (erroneously) removes read permissions from some jars
-	# this is a regression in OpenJDK 7 (our compiler):
-	# http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=1437
-	find ${imagepath} -iname '*.jar' -exec chmod ugo+r {} \;
-
-	# Build screws up permissions on binaries
-	# https://bugs.openjdk.java.net/browse/JDK-8173610
-	find ${imagepath} -iname '*.so' -exec chmod +x {} \;
-	find ${imagepath}/bin/ -exec chmod +x {} \;
-
-	# Install nss.cfg right away as we will be using the JRE above
-	install -m 644 nss.cfg ${imagepath}/conf/security/
-
-	# Install nss.fips.cfg: NSS configuration for global FIPS mode (crypto-policies)
-	install -m 644 nss.fips.cfg ${imagepath}/conf/security/
-
-	# Turn on system security properties
-	sed -i -e "s:^security.useSystemPropertiesFile=.*:security.useSystemPropertiesFile=true:" \
-	    ${imagepath}/conf/security/java.security
-
-	# Use system-wide tzdata
-	rm ${imagepath}/lib/tzdb.dat
-	ln -s %{_datadir}/javazi-1.8/tzdb.dat ${imagepath}/lib/tzdb.dat
-
-	# Create fake alt-java as a placeholder for future alt-java
-	pushd ${imagepath}
-	# add alt-java man page
-	echo "Hardened java binary recommended for launching untrusted code from the Web e.g. javaws" > man/man1/%{alt_java_name}.1
-	cat man/man1/java.1 >> man/man1/%{alt_java_name}.1
-	popd
-
-	# Print release information
-	cat ${imagepath}/release
-
-    fi
-}
-
-%if %{build_hotspot_first}
-  # Build a fresh libjvm.so first and use it to bootstrap
-  cp -LR --preserve=mode,timestamps %{bootjdk} newboot
-  systemjdk=$(pwd)/newboot
-  buildjdk build/newboot ${systemjdk} %{hotspot_target} "release" "bundled"
-  mv build/newboot/jdk/lib/server/libjvm.so newboot/lib/server
-%else
-  systemjdk=%{bootjdk}
-%endif
-
 for suffix in %{build_loop} ; do
 
   if [ "x$suffix" = "x" ] ; then
-      debugbuild=release
+      jdkzip=%{releasezip}
-  else
+      staticlibzip=%{staticlibzip}
-      # change --something to something
+  elif [ "x$suffix" = "x%{fastdebug_suffix_unquoted}" ] ; then
-      debugbuild=`echo $suffix  | sed "s/-//g"`
+      jdkzip=%{fastdebugzip}
+      staticlibzip=%{fastdebugstaticlibzip}
+  else # slowdebug
+      jdkzip=%{slowdebugzip}
+      staticlibzip=%{slowdebugstaticlibzip}
   fi
 
+  installdir=%{installoutputdir -- ${suffix}}
 
-  for loop in %{main_suffix} %{staticlibs_loop} ; do
+  # TODO: should verify checksums when using packages from buildroot
+  tar -xJf ${jdkzip}
+  tar -xJf ${staticlibzip}
+  mkdir -p $(dirname ${installdir})
+  mv java-%{featurever}-openjdk* ${installdir}
 
-    builddir=%{buildoutputdir -- ${suffix}${loop}}
+  # Fix build paths in ELF files so it looks like we built them
-    bootbuilddir=boot${builddir}
+  portablenvr="%{name}-%{VERSION}-%{portablerelease}.%{portablesuffix}.%{_arch}"
-    installdir=%{installoutputdir -- ${suffix}${loop}}
+  for file in $(find ${installdir} -type f) ; do
-    bootinstalldir=boot${installdir}
+      if file ${file} | grep -q 'ELF'; then
-
+          %{debugedit} -b %{portablebuilddir}/${portablenvr} -d $(pwd) -n ${file}
-    if test "x${loop}" = "x%{main_suffix}" ; then
-      link_opt="%{link_type}"
-%if %{system_libs}
-      # Copy the source tree so we can remove all in-tree libraries
-      cp -a %{top_level_dir_name} %{top_level_dir_name_backup}
-      # Remove all libraries that are linked
-      sh %{SOURCE12} %{top_level_dir_name} full
-%endif
-      # Debug builds don't need same targets as release for
-      # build speed-up. We also avoid bootstrapping these
-      # slower builds.
-      if echo $debugbuild | grep -q "debug" ; then
-        maketargets="%{debug_targets}"
-        run_bootstrap=false
-      else
-        maketargets="%{release_targets}"
-        run_bootstrap=%{bootstrap_build}
       fi
-      if ${run_bootstrap} ; then
+  done
-          buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild} ${link_opt}
-          installjdk ${bootbuilddir} ${bootinstalldir}
-          buildjdk ${builddir} $(pwd)/${bootinstalldir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt}
-          installjdk ${builddir} ${installdir}
-          %{!?with_artifacts:rm -rf ${bootinstalldir}}
-      else
-          buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt}
-          installjdk ${builddir} ${installdir}
-      fi
-%if %{system_libs}
-      # Restore original source tree we modified by removing full in-tree sources
-      rm -rf %{top_level_dir_name}
-      mv %{top_level_dir_name_backup} %{top_level_dir_name}
-%endif
-    else
-      # Use bundled libraries for building statically
-      link_opt="bundled"
-      # Static library cycle only builds the static libraries
-      maketargets="%{static_libs_target}"
-      # Always just do the one build for the static libraries
-      buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt}
-      installjdk ${builddir} ${installdir}
-    fi
 
-  done # end of main / staticlibs loop
+  # Final setup on the main image
+  customisejdk ${installdir}
+
+  # Print release information
+  cat ${installdir}/release
 
 # build cycles
 done # end of release / debug cycle loop
 
+docdir=%{installoutputdir -- "-docs"}
+tar -xJf %{docszip}
+mv java-%{featurever}-openjdk*.docs.* ${docdir}
+
+miscdir=%{installoutputdir -- "-misc"}
+tar -xJf %{misczip}
+mv java-%{featurever}-openjdk*.misc.* ${miscdir}
+
 %check
 
 # We test debug first as it will give better diagnostics on a crash
 for suffix in %{build_loop} ; do
 
-top_dir_abs_main_build_path=$(pwd)/%{installoutputdir -- ${suffix}%{main_suffix}}
+export JAVA_HOME=$(pwd)/%{installoutputdir -- ${suffix}}
-%if %{include_staticlibs}
-top_dir_abs_staticlibs_build_path=$(pwd)/%{installoutputdir -- ${suffix}%{staticlibs_loop}}
-%endif
 
-export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage}
+# Check Shenandoah is enabled
-
-#check Shenandoah is enabled
 %if %{use_shenandoah_hotspot}
-$JAVA_HOME//bin/java -XX:+UseShenandoahGC -version
+$JAVA_HOME/bin/java -XX:+UseShenandoahGC -version
 %endif
 
 # Check unlimited policy has been used
@@ -2208,9 +2035,9 @@ $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|
 
 %if %{include_staticlibs}
 # Check debug symbols in static libraries (smoke test)
-export STATIC_LIBS_HOME=${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image}
+export STATIC_LIBS_HOME=${JAVA_HOME}/lib/static/linux-%{archinstall}/glibc
-readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep w_remainder.c
+readelf --debug-dump $STATIC_LIBS_HOME/libfdlibm.a | grep w_remainder.c
-readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep e_remainder.c
+readelf --debug-dump $STATIC_LIBS_HOME/libfdlibm.a | grep e_remainder.c
 %endif
 
 so_suffix="so"
@@ -2300,11 +2127,16 @@ STRIP_KEEP_SYMTAB=libjvm*
 
 for suffix in %{build_loop} ; do
 
-top_dir_abs_main_build_path=$(pwd)/%{installoutputdir -- ${suffix}%{main_suffix}}
+jdk_image=$(pwd)/%{installoutputdir -- ${suffix}}
-%if %{include_staticlibs}
+# Should match same definitions in build section
-top_dir_abs_staticlibs_build_path=$(pwd)/%{installoutputdir -- ${suffix}%{staticlibs_loop}}
+docdir=$(pwd)/%{installoutputdir -- "-docs"}
-%endif
+miscdir=%{installoutputdir -- "-misc"}
-jdk_image=${top_dir_abs_main_build_path}/images/%{jdkimage}
+
+# Install release notes and rebuild instructions
+commondocdir=${RPM_BUILD_ROOT}%{_defaultdocdir}/%{uniquejavadocdir -- $suffix}
+install -d -m 755 ${commondocdir}
+mv ${jdk_image}/NEWS ${commondocdir}
+cp -a %{SOURCE19} %{SOURCE20} ${commondocdir}
 
 # Install the jdk
 mkdir -p $RPM_BUILD_ROOT%{_jvmdir}
@@ -2353,35 +2185,25 @@ pushd ${jdk_image}
   rm -rf $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/man
 
 popd
-# Install static libs artefacts
-%if %{include_staticlibs}
-mkdir -p $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/lib/static/linux-%{archinstall}/glibc
-cp -a ${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image}/lib/*.a \
-  $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/lib/static/linux-%{archinstall}/glibc
-%endif
 
 if ! echo $suffix | grep -q "debug" ; then
-  # Install Javadoc documentation
+    # Install Javadoc documentation
-  install -d -m 755 $RPM_BUILD_ROOT%{_javadocdir}
+    install -d -m 755 $RPM_BUILD_ROOT%{_javadocdir}
-  cp -a ${top_dir_abs_main_build_path}/images/docs $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}
+    cp -a ${docdir}/docs $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}
-  built_doc_archive=jdk-%{filever}%{ea_designator_zip}+%{buildver}%{lts_designator_zip}-docs.zip
+    built_doc_archive=jdk-%{filever}%{ea_designator_zip}+%{buildver}%{lts_designator_zip}-docs.zip
-  cp -a ${top_dir_abs_main_build_path}/bundles/${built_doc_archive} \
+    cp -a ${docdir}/${built_doc_archive} \
-     $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip || ls -l ${top_dir_abs_main_build_path}/bundles/
+        $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip
 fi
 
-# Install release notes
-commondocdir=${RPM_BUILD_ROOT}%{_defaultdocdir}/%{uniquejavadocdir -- $suffix}
-install -d -m 755 ${commondocdir}
-cp -a %{SOURCE10} ${commondocdir}
-
 # Install icons and menu entries
 for s in 16 24 32 48 ; do
   install -D -p -m 644 \
-    %{top_level_dir_name}/src/java.desktop/unix/classes/sun/awt/X11/java-icon${s}.png \
+    ${miscdir}/java-icon${s}.png \
     $RPM_BUILD_ROOT%{_datadir}/icons/hicolor/${s}x${s}/apps/java-%{javaver}-%{origin}.png
 done
 
 # Install desktop files
+# TODO: provide desktop files via portable
 install -d -m 755 $RPM_BUILD_ROOT%{_datadir}/{applications,pixmaps}
 for e in jconsole$suffix ; do
     desktop-file-install --vendor=%{uniquesuffix -- $suffix} --mode=644 \
@@ -2393,8 +2215,7 @@ done
 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/.java/.systemPrefs
 
 # copy samples next to demos; samples are mostly js files
-cp -r %{top_level_dir_name}/src/sample  $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix}/
+cp -r ${miscdir}/sample  $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix}/
-
 
 # moving config files to /etc
 mkdir -p $RPM_BUILD_ROOT/%{etcjavadir -- $suffix}
@@ -2683,59 +2504,90 @@ end
 %endif
 
 %changelog
-* Fri Apr 14 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.19.0.7-1
+* Wed Apr 26 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.19.0.7-4
+- Include the java-11-openjdk-portable.spec file with instructions on how to rebuild.
+- Related: rhbz#2189327
+
+* Wed Apr 26 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.19.0.7-3
+- Adjust oj_vendor_version to match the portable so test passes
+- Related: rhbz#2189327
+
+* Wed Apr 26 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.19.0.7-3
+- Revert "Restore native build for x86 as there is no portable build"
+- Reintroduce useful cleanups from x86 reversion
+- Related: rhbz#2189327
+
+* Wed Apr 26 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.19.0.7-2
 - Update to jdk-11.0.19.0+7
 - Update release notes to 11.0.19.0+7
 - Require tzdata 2023c due to local inclusion of JDK-8274864 & JDK-8305113
+- Reintroduce generate_source_tarball.sh from RHEL 9
 - Update generate_tarball.sh to add support for passing a boot JDK to the configure run
 - Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
 - Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
 - Rebase FIPS support against 11.0.19+6
 - Rebase RH1750419 alt-java patch against 11.0.19+6
+- Replace local copies of JDK portable binaries with build dependencies
+- Use portable build on x86_32 now one is available
 - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
 - Resolves: rhbz#2185182
+- Resolves: rhbz#2189327
 
-* Fri Jan 13 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.10-3
+* Tue Feb 28 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.10-4
-- Add missing release note for JDK-8295687
+- On portable architectures, replace build section with extraction of existing builds from portables
-- Resolves: rhbz#2160111
+- Rewrite ELF files so the source file path is correct and debugsources can be assembled
+- Backport SHA-3 support for PKCS11 provider
+- Sync patch set with portable build we are using by removing rh1648644-java_access_bridge_privileged_security.patch
+- Resolves: rhbz#2150204
+- Resolves: rhbz#2108712
 
-* Wed Jan 11 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.10-2
+* Wed Jan 11 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.10-3
 - Update to jdk-11.0.18+10 (GA)
 - Update release notes to 11.0.18+10
 - Switch to GA mode for release
-- ** This tarball is embargoed until 2023-01-17 @ 1pm PT. **
+- Resolves: rhbz#2160111
-- Related: rhbz#2157797
 
-* Tue Jan 03 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.9-0.2.ea
+* Tue Jan 03 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.9-0.3.ea
 - Update to jdk-11.0.18+9
 - Update release notes to 11.0.18+9
 - Drop local copy of JDK-8293834 now this is upstream
 - Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
 - Update TestTranslations.java to test the new America/Ciudad_Juarez zone
-- Resolves: rhbz#2157797
+- Resolves: rhbz#2150194
 
-* Thu Dec 15 2022 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.1-0.2.ea
+* Thu Dec 15 2022 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.1-0.3.ea
 - Update to jdk-11.0.18+1
 - Update release notes to 11.0.18+1
 - Switch to EA mode for 11.0.18 pre-release builds.
 - Drop local copies of JDK-8294357 & JDK-8295173 now upstream contains tzdata 2022e
 - Drop local copy of JDK-8275535 which is finally upstream
-- Related: rhbz#2157797
+- Related: rhbz#2150194
 
-* Wed Oct 26 2022 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.8-1
+* Wed Oct 26 2022 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.8-2
 - Update to jdk-11.0.17+8 (GA)
 - Update release notes to 11.0.17+8
-- Bump HarfBuzz bundled version to 4.4.1 following JDK-8289853
+- Switch to GA mode for release
-- Bump FreeType bundled version to 2.12.1 following JDK-8290334
 - Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
 - Update CLDR data with Europe/Kyiv (JDK-8293834)
 - Drop JDK-8292223 patch which we found to be unnecessary
 - Update TestTranslations.java to use public API based on TimeZoneNamesTest upstream
 - The stdc++lib, zlib & freetype options should always be set from the global, so they are not altered for staticlibs builds
 - Remove freetype sources along with zlib sources
-- Resolves: rhbz#2131862
 - Resolves: rhbz#2133695
 
+* Wed Oct 05 2022 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.7-0.2.ea
+- Update to jdk-11.0.17+7
+- Update release notes to 11.0.17+7
+- Resolves: rhbz#2130374
+
+* Tue Sep 06 2022 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.17.0.1-0.2.ea
+- Update to jdk-11.0.17+1
+- Update release notes to 11.0.17+1
+- Switch to EA mode for 11.0.17 pre-release builds.
+- Bump HarfBuzz bundled version to 4.4.1 following JDK-8289853
+- Bump FreeType bundled version to 2.12.1 following JDK-8290334
+- Related: rhbz#2130374
+
 * Tue Aug 30 2022 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.16.1.1-3
 - Switch to static builds, reducing system dependencies and making build more portable
 - Resolves: rhbz#2121266