On portable architectures, replace build section with extraction of existing builds from portables

Rewrite ELF files so the source file path is correct and debugsources can be assembled
Backport SHA-3 support for PKCS11 provider
Sync patch set with portable build we are using by removing rh1648644-java_access_bridge_privileged_security.patch

Resolves: rhbz#2150201

.gitignore

@@ -113,3 +113,33 @@
 /openjdk-jdk11u-jdk-11.0.18+1-4curve.tar.xz
 /openjdk-jdk11u-jdk-11.0.18+9-4curve.tar.xz
 /openjdk-jdk11u-jdk-11.0.18+10-4curve.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.docs.el.aarch64.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.docs.el.ppc64le.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.docs.el.s390x.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.docs.el.x86_64.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.fastdebug.jdk.el.aarch64.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.fastdebug.jdk.el.ppc64le.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.fastdebug.jdk.el.x86_64.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.fastdebug.static-libs.el.aarch64.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.fastdebug.static-libs.el.ppc64le.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.fastdebug.static-libs.el.x86_64.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.misc.el.aarch64.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.misc.el.ppc64le.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.misc.el.s390x.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.misc.el.x86_64.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.slowdebug.jdk.el.aarch64.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.slowdebug.jdk.el.ppc64le.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.slowdebug.jdk.el.s390x.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.slowdebug.jdk.el.x86_64.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.slowdebug.static-libs.el.aarch64.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.slowdebug.static-libs.el.ppc64le.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.slowdebug.static-libs.el.s390x.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.slowdebug.static-libs.el.x86_64.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.static-libs.el.aarch64.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.static-libs.el.ppc64le.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.static-libs.el.s390x.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.static-libs.el.x86_64.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.unstripped.jdk.el.aarch64.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.unstripped.jdk.el.ppc64le.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.unstripped.jdk.el.s390x.tar.xz
+/java-11-openjdk-11.0.18.0.10-6.portable.unstripped.jdk.el.x86_64.tar.xz

get_sources.sh

@@ -0,0 +1,59 @@
+#!/bin/sh
+
+ID=${1}
+FEATUREVER=11
+
+if [ "x${ID}" = "x" ] ; then
+    echo "$0 <ID>";
+    exit 1;
+fi
+
+if [ "x${TMPDIR}" = "x" ] ; then
+    TMPDIR=/tmp
+fi
+
+downloaddir=${TMPDIR}/download.$$
+mkdir ${downloaddir}
+pushd ${downloaddir}
+echo "Downloading build ${ID} in ${downloaddir}";
+brew download-build ${ID}
+
+versionregexp="[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*\.[0-9]*-[0-9]*"
+basename=$(ls|grep java-${FEATUREVER}-openjdk-portable-${versionregexp}.el7openjdkportable.x86_64.rpm)
+version=$(echo ${basename}|sed -r "s|^.*-(${versionregexp})\.el7.*$|\1|")
+
+echo "Downloaded version ${version}"
+
+# Remove stripped release builds for portable and JREs
+rm -vf java-${FEATUREVER}-openjdk-portable-${FEATUREVER}*
+rm -vf java-${FEATUREVER}-openjdk-portable-devel-${FEATUREVER}*
+rm -vf java-${FEATUREVER}-openjdk-portable-slowdebug-${FEATUREVER}*
+rm -vf java-${FEATUREVER}-openjdk-portable-fastdebug-${FEATUREVER}*
+
+for file in *.rpm; do
+    rpm2archive ${file};
+done
+
+mkdir unpacked
+for file in *.tgz; do
+    tar -C unpacked -xzf ${file};
+done
+
+mkdir ${HOME}/${version}
+mv unpacked/usr/lib/jvm/* ${HOME}/${version}
+
+pushd ${HOME}/${version}
+for file in *.sha256sum; do
+    if ! sha256sum --check ${file} ; then
+	echo "${file} failed checksum.";
+	exit 2;
+    fi
+done
+popd
+
+rm -rf unpacked
+rm -vf *.tgz
+rm -vf *.rpm
+
+popd
+

java-11-openjdk.spec

@@ -146,6 +146,8 @@
 %global ssbd_arches x86_64
 # Set of architectures where we verify backtraces with gdb
 %global gdb_arches %{jit_arches} %{zero_arches}
+# Set of architectures for which we have a portable build
+%global portable_build_arches %{aarch64} %{power64} s390x x86_64
 
 # By default, we build a slowdebug build during main build on JIT architectures
 %if %{with slowdebug}
@@ -243,6 +245,9 @@
 # JDK to use for bootstrapping
 %global bootjdk /usr/lib/jvm/java-%{buildjdkver}-openjdk
 
+# debugedit tool for rewriting ELF file paths
+%global debugedit %{_rpmconfigdir}/debugedit
+
 # Disable LTO as this causes build failures at the moment.
 # See RHBZ#1861401
 %define _lto_cflags %{nil}
@@ -378,7 +383,12 @@
 %global top_level_dir_name   %{origin}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
 %global buildver        10
-%global rpmrelease      3
+%global rpmrelease      4
+# Settings used by the portable build
+%global portablerelease 6
+%global portablesuffix el7openjdkportable
+%global portablebuilddir /builddir/build/BUILD
+
 #%%global tagsuffix     %%{nil}
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
@@ -453,7 +463,6 @@
 %global __requires_exclude ^(%{_privatelibs}|%{_publiclibs})$
 %endif
 
-
 %global etcjavasubdir     %{_sysconfdir}/java/java-%{javaver}-%{origin}
 %define etcjavadir()      %{expand:%{etcjavasubdir}/%{uniquesuffix -- %{?1}}}
 # Standard JPackage directories and symbolic links.
@@ -1341,6 +1350,89 @@ Source17: nss.fips.cfg.in
 # Ensure translations are available for new timezones
 Source18: TestTranslations.java
 
+# TODO: Portable packages are not yet available in buildroot
+# Temporarily add them as sources
+
+# aarch64
+Source1000: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.unstripped.jdk.el.aarch64.tar.xz
+Source1001: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.static-libs.el.aarch64.tar.xz
+Source1002: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.docs.el.aarch64.tar.xz
+Source1003: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.misc.el.aarch64.tar.xz
+Source1004: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.slowdebug.jdk.el.aarch64.tar.xz
+Source1005: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.slowdebug.static-libs.el.aarch64.tar.xz
+Source1006: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.fastdebug.jdk.el.aarch64.tar.xz
+Source1007: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.fastdebug.static-libs.el.aarch64.tar.xz
+
+# ppc64le
+Source2000: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.unstripped.jdk.el.ppc64le.tar.xz
+Source2001: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.static-libs.el.ppc64le.tar.xz
+Source2002: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.docs.el.ppc64le.tar.xz
+Source2003: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.misc.el.ppc64le.tar.xz
+Source2004: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.slowdebug.jdk.el.ppc64le.tar.xz
+Source2005: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.slowdebug.static-libs.el.ppc64le.tar.xz
+Source2006: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.fastdebug.jdk.el.ppc64le.tar.xz
+Source2007: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.fastdebug.static-libs.el.ppc64le.tar.xz
+
+# s390x
+Source3000: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.unstripped.jdk.el.s390x.tar.xz
+Source3001: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.static-libs.el.s390x.tar.xz
+Source3002: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.docs.el.s390x.tar.xz
+Source3003: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.misc.el.s390x.tar.xz
+Source3004: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.slowdebug.jdk.el.s390x.tar.xz
+Source3005: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.slowdebug.static-libs.el.s390x.tar.xz
+
+# x86_64
+Source4000: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.unstripped.jdk.el.x86_64.tar.xz
+Source4001: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.static-libs.el.x86_64.tar.xz
+Source4002: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.docs.el.x86_64.tar.xz
+Source4003: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.misc.el.x86_64.tar.xz
+Source4004: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.slowdebug.jdk.el.x86_64.tar.xz
+Source4005: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.slowdebug.static-libs.el.x86_64.tar.xz
+Source4006: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.fastdebug.jdk.el.x86_64.tar.xz
+Source4007: java-%{featurever}-openjdk-%{VERSION}-%{portablerelease}.portable.fastdebug.static-libs.el.x86_64.tar.xz
+
+# Setup variables to reference correct sources
+%ifarch %{aarch64}
+%global releasezip %{SOURCE1000}
+%global staticlibzip %{SOURCE1001}
+%global docszip %{SOURCE1002}
+%global misczip %{SOURCE1003}
+%global slowdebugzip %{SOURCE1004}
+%global slowdebugstaticlibzip %{SOURCE1005}
+%global fastdebugzip %{SOURCE1006}
+%global fastdebugstaticlibzip %{SOURCE1007}
+%endif
+%ifarch %{ppc64le}
+%global releasezip %{SOURCE2000}
+%global staticlibzip %{SOURCE2001}
+%global docszip %{SOURCE2002}
+%global misczip %{SOURCE2003}
+%global slowdebugzip %{SOURCE2004}
+%global slowdebugstaticlibzip %{SOURCE2005}
+%global fastdebugzip %{SOURCE2006}
+%global fastdebugstaticlibzip %{SOURCE2007}
+%endif
+%ifarch s390x
+%global releasezip %{SOURCE3000}
+%global staticlibzip %{SOURCE3001}
+%global docszip %{SOURCE3002}
+%global misczip %{SOURCE3003}
+%global slowdebugzip %{SOURCE3004}
+%global slowdebugstaticlibzip %{SOURCE3005}
+%global fastdebugzip %{nil}
+%global fastdebugstaticlibzip %{nil}
+%endif
+%ifarch x86_64
+%global releasezip %{SOURCE4000}
+%global staticlibzip %{SOURCE4001}
+%global docszip %{SOURCE4002}
+%global misczip %{SOURCE4003}
+%global slowdebugzip %{SOURCE4004}
+%global slowdebugstaticlibzip %{SOURCE4005}
+%global fastdebugzip %{SOURCE4006}
+%global fastdebugstaticlibzip %{SOURCE4007}
+%endif
+
 ############################################
 #
 # RPM/distribution specific patches
@@ -1349,8 +1441,6 @@ Source18: TestTranslations.java
 
 # Ignore AWTError when assistive technologies are loaded
 Patch1:    rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
-# Restrict access to java-atk-wrapper classes
-Patch2:    rh1648644-java_access_bridge_privileged_security.patch
 # NSS via SunPKCS11 Provider (disabled due to memory leak).
 Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
 # RH1750419: enable build of speculative store bypass hardened alt-java (CVE-2018-3639)
@@ -1397,7 +1487,6 @@ Patch1001: fips-11u-%{fipsver}.patch
 # be reviewed & pushed to the current development
 # tree of OpenJDK.
 #############################################
-
 Patch3:    rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
 
 #############################################
@@ -1409,6 +1498,7 @@ Patch3:    rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk1
 # need to be reviewed & pushed to the appropriate
 # updates tree of OpenJDK.
 #############################################
+Patch2001: jdk8242332-rh2108712-sha3-sunpkcs11.patch
 
 #############################################
 #
@@ -1448,7 +1538,19 @@ BuildRequires: xorg-x11-proto-devel
 BuildRequires: zip
 BuildRequires: unzip
 BuildRequires: javapackages-filesystem
+%ifarch %{portable_build_arches}
+# TODO: Portable packages are not yet available in buildroot
+#BuildRequires: java-%{featurever}-openjdk-portable-unstripped = %{VERSION}
+#BuildRequires: java-%{featurever}-openjdk-portable-static-libs = %{VERSION}
+#BuildRequires: java-%{featurever}-openjdk-portable-docs = %{VERSION}
+#BuildRequires: java-%{featurever}-openjdk-portable-misc = %{VERSION}
+#BuildRequires: java-%{featurever}-openjdk-portable-devel-fastdebug = %{VERSION}
+#BuildRequires: java-%{featurever}-openjdk-portable-static-libs-fastdebug = %{VERSION}
+#BuildRequires: java-%{featurever}-openjdk-portable-devel-slowdebug = %{VERSION}
+#BuildRequires: java-%{featurever}-openjdk-portable-static-libs-slowdebug = %{VERSION}
+%else
 BuildRequires: java-%{buildjdkver}-openjdk-devel
+%endif
 # Zero-assembler build requirement
 %ifarch %{zero_arches}
 BuildRequires: libffi-devel
@@ -1483,9 +1585,11 @@ Provides: bundled(lcms2) = 2.12.0
 Provides: bundled(libjpeg) = 6b
 # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h
 Provides: bundled(libpng) = 1.6.37
+%ifnarch %{portable_build_arches}
 # We link statically against libstdc++ to increase portability
 BuildRequires: libstdc++-static
 %endif
+%endif
 
 # this is always built, also during debug-only build
 # when it is built in debug-only this package is just placeholder
@@ -1831,12 +1935,13 @@ sh %{SOURCE12} %{top_level_dir_name}
 # Patch the JDK
 pushd %{top_level_dir_name}
 %patch1 -p1
-%patch2 -p1
 %patch3 -p1
 # Add crypto policy and FIPS support
 %patch1001 -p1
 # nss.cfg PKCS11 support; must come last as it also alters java.security
 %patch1000 -p1
+# PKCS11 SHA3 backport
+%patch2001 -p1
 popd # openjdk
 
 %patch600
@@ -1895,6 +2000,8 @@ sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE11} > nss.cfg
 sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE17} > nss.fips.cfg
 
 %build
+
+%ifnarch %{portable_build_arches}
 # How many CPU's do we have?
 export NUM_PROC=%(/usr/bin/getconf _NPROCESSORS_ONLN 2> /dev/null || :)
 export NUM_PROC=${NUM_PROC:-1}
@@ -2050,14 +2157,6 @@ function installjdk() {
         # Install nss.fips.cfg: NSS configuration for global FIPS mode (crypto-policies)
         install -m 644 nss.fips.cfg ${imagepath}/conf/security/
 
-	# Turn on system security properties
-	sed -i -e "s:^security.useSystemPropertiesFile=.*:security.useSystemPropertiesFile=true:" \
-	    ${imagepath}/conf/security/java.security
-
-	# Use system-wide tzdata
-	rm ${imagepath}/lib/tzdb.dat
-	ln -s %{_datadir}/javazi-1.8/tzdb.dat ${imagepath}/lib/tzdb.dat
-
         # Create fake alt-java as a placeholder for future alt-java
         pushd ${imagepath}
         # add alt-java man page
@@ -2065,9 +2164,11 @@ function installjdk() {
         cat man/man1/java.1 >> man/man1/%{alt_java_name}.1
         popd
 
+        # Final setup on the main image
+        customisejdk ${imagepath}
+
         # Print release information
         cat ${imagepath}/release
-
     fi
 }
 
@@ -2081,8 +2182,61 @@ function installjdk() {
   systemjdk=%{bootjdk}
 %endif
 
+%endif # !portable_build_arches
+
+function customisejdk() {
+    local imagepath=${1}
+
+    if [ -d ${imagepath} ] ; then
+        # Turn on system security properties
+        sed -i -e "s:^security.useSystemPropertiesFile=.*:security.useSystemPropertiesFile=true:" \
+            ${imagepath}/conf/security/java.security
+
+        # Use system-wide tzdata
+        rm ${imagepath}/lib/tzdb.dat
+        ln -s %{_datadir}/javazi-1.8/tzdb.dat ${imagepath}/lib/tzdb.dat
+    fi
+}
+
 for suffix in %{build_loop} ; do
 
+%ifarch %{portable_build_arches}
+
+  if [ "x$suffix" = "x" ] ; then
+      jdkzip=%{releasezip}
+      staticlibzip=%{staticlibzip}
+  elif [ "x$suffix" = "x%{fastdebug_suffix_unquoted}" ] ; then
+      jdkzip=%{fastdebugzip}
+      staticlibzip=%{fastdebugstaticlibzip}
+  else # slowdebug
+      jdkzip=%{slowdebugzip}
+      staticlibzip=%{slowdebugstaticlibzip}
+  fi
+
+  installdir=%{installoutputdir -- ${suffix}}
+
+  # TODO: should verify checksums when using packages from buildroot
+  tar -xJf ${jdkzip}
+  tar -xJf ${staticlibzip}
+  mkdir -p $(dirname ${installdir})
+  mv java-%{featurever}-openjdk* ${installdir}
+
+  # Fix build paths in ELF files so it looks like we built them
+  portablenvr="%{name}-%{VERSION}-%{portablerelease}.%{portablesuffix}.%{_arch}"
+  for file in $(find ${installdir} -type f) ; do
+      if file ${file} | grep -q 'ELF'; then
+          %{debugedit} -b %{portablebuilddir}/${portablenvr} -d $(pwd) -n ${file}
+      fi
+  done
+
+  # Final setup on the main image
+  customisejdk ${installdir}
+
+  # Print release information
+  cat ${installdir}/release
+
+%else
+
   if [ "x$suffix" = "x" ] ; then
       debugbuild=release
   else
@@ -2090,7 +2244,6 @@ for suffix in %{build_loop} ; do
       debugbuild=`echo $suffix  | sed "s/-//g"`
   fi
 
-
   for loop in %{main_suffix} %{staticlibs_loop} ; do
 
     builddir=%{buildoutputdir -- ${suffix}${loop}}
@@ -2143,24 +2296,42 @@ for suffix in %{build_loop} ; do
 
   done # end of main / staticlibs loop
 
+%endif # !portable_build_arches
+
+
 # build cycles
 done # end of release / debug cycle loop
 
+%ifarch %{portable_build_arches}
+
+docdir=%{installoutputdir -- "-docs"}
+tar -xJf %{docszip}
+mv java-%{featurever}-openjdk*.docs.* ${docdir}
+
+miscdir=%{installoutputdir -- "-misc"}
+tar -xJf %{misczip}
+mv java-%{featurever}-openjdk*.misc.* ${miscdir}
+
+%endif
+
 %check
 
 # We test debug first as it will give better diagnostics on a crash
 for suffix in %{build_loop} ; do
 
+%ifarch %{portable_build_arches}
+export JAVA_HOME=$(pwd)/%{installoutputdir -- ${suffix}}
+%else
 top_dir_abs_main_build_path=$(pwd)/%{installoutputdir -- ${suffix}%{main_suffix}}
 %if %{include_staticlibs}
 top_dir_abs_staticlibs_build_path=$(pwd)/%{installoutputdir -- ${suffix}%{staticlibs_loop}}
+export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage}
+%endif
 %endif
 
-export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage}
+# Check Shenandoah is enabled
-
-#check Shenandoah is enabled
 %if %{use_shenandoah_hotspot}
-$JAVA_HOME//bin/java -XX:+UseShenandoahGC -version
+$JAVA_HOME/bin/java -XX:+UseShenandoahGC -version
 %endif
 
 # Check unlimited policy has been used
@@ -2181,8 +2352,9 @@ $JAVA_HOME/bin/java ${SEC_DEBUG} ${PROG} true
 $JAVA_HOME/bin/java ${SEC_DEBUG} -Djava.security.disableSystemPropertiesFile=true ${PROG} false
 
 # Check correct vendor values have been set
-$JAVA_HOME/bin/javac -d . %{SOURCE16}
+# TODO: Disable for now due to bug URL mismatch with that in portable
-$JAVA_HOME/bin/java $(echo $(basename %{SOURCE16})|sed "s|\.java||") "%{oj_vendor}" "%{oj_vendor_url}" "%{oj_vendor_bug_url}" "%{oj_vendor_version}"
+#$JAVA_HOME/bin/javac -d . %{SOURCE16}
+#$JAVA_HOME/bin/java $(echo $(basename %{SOURCE16})|sed "s|\.java||") "%{oj_vendor}" "%{oj_vendor_url}" "%{oj_vendor_bug_url}" "%{oj_vendor_version}"
 
 # Check java launcher has no SSB mitigation
 if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi
@@ -2200,10 +2372,14 @@ $JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE
 $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR
 
 %if %{include_staticlibs}
+%ifarch %{portable_build_arches}
 # Check debug symbols in static libraries (smoke test)
-export STATIC_LIBS_HOME=${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image}
+export STATIC_LIBS_HOME=${JAVA_HOME}/lib/static/linux-%{archinstall}/glibc
-readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep w_remainder.c
+%else
-readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep e_remainder.c
+export STATIC_LIBS_HOME=${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image}/lib
+%endif
+readelf --debug-dump $STATIC_LIBS_HOME/libfdlibm.a | grep w_remainder.c
+readelf --debug-dump $STATIC_LIBS_HOME/libfdlibm.a | grep e_remainder.c
 %endif
 
 so_suffix="so"
@@ -2293,11 +2469,29 @@ STRIP_KEEP_SYMTAB=libjvm*
 
 for suffix in %{build_loop} ; do
 
+%ifarch %{portable_build_arches}
+jdk_image=$(pwd)/%{installoutputdir -- ${suffix}}
+# Should match same definitions in build section
+docdir=$(pwd)/%{installoutputdir -- "-docs"}
+miscdir=%{installoutputdir -- "-misc"}
+%else
 top_dir_abs_main_build_path=$(pwd)/%{installoutputdir -- ${suffix}%{main_suffix}}
 %if %{include_staticlibs}
 top_dir_abs_staticlibs_build_path=$(pwd)/%{installoutputdir -- ${suffix}%{staticlibs_loop}}
 %endif
 jdk_image=${top_dir_abs_main_build_path}/images/%{jdkimage}
+docdir=${top_dir_abs_main_build_path}/images
+miscdir=%{top_level_dir_name}/src/java.desktop/unix/classes/sun/awt/X11
+%endif
+
+# Install release notes
+commondocdir=${RPM_BUILD_ROOT}%{_defaultdocdir}/%{uniquejavadocdir -- $suffix}
+install -d -m 755 ${commondocdir}
+%ifarch %{portable_build_arches}
+mv ${jdk_image}/NEWS ${commondocdir}
+%else
+cp -a %{SOURCE10} ${commondocdir}
+%endif
 
 # Install the jdk
 mkdir -p $RPM_BUILD_ROOT%{_jvmdir}
@@ -2346,35 +2540,39 @@ pushd ${jdk_image}
   rm -rf $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/man
 
 popd
+
+%ifnarch %{portable_build_arches}
 # Install static libs artefacts
 %if %{include_staticlibs}
 mkdir -p $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/lib/static/linux-%{archinstall}/glibc
 cp -a ${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image}/lib/*.a \
   $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/lib/static/linux-%{archinstall}/glibc
 %endif
+%endif
 
 if ! echo $suffix | grep -q "debug" ; then
     # Install Javadoc documentation
     install -d -m 755 $RPM_BUILD_ROOT%{_javadocdir}
-  cp -a ${top_dir_abs_main_build_path}/images/docs $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}
+    cp -a ${docdir}/docs $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}
     built_doc_archive=jdk-%{filever}%{ea_designator_zip}+%{buildver}%{lts_designator_zip}-docs.zip
+%ifarch %{portable_build_arches}
+    cp -a ${docdir}/${built_doc_archive} \
+       $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip
+%else
     cp -a ${top_dir_abs_main_build_path}/bundles/${built_doc_archive} \
        $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip || ls -l ${top_dir_abs_main_build_path}/bundles/
+%endif
 fi
 
-# Install release notes
-commondocdir=${RPM_BUILD_ROOT}%{_defaultdocdir}/%{uniquejavadocdir -- $suffix}
-install -d -m 755 ${commondocdir}
-cp -a %{SOURCE10} ${commondocdir}
-
 # Install icons and menu entries
 for s in 16 24 32 48 ; do
   install -D -p -m 644 \
-    %{top_level_dir_name}/src/java.desktop/unix/classes/sun/awt/X11/java-icon${s}.png \
+    ${miscdir}/java-icon${s}.png \
     $RPM_BUILD_ROOT%{_datadir}/icons/hicolor/${s}x${s}/apps/java-%{javaver}-%{origin}.png
 done
 
 # Install desktop files
+# TODO: provide desktop files via portable
 install -d -m 755 $RPM_BUILD_ROOT%{_datadir}/{applications,pixmaps}
 for e in jconsole$suffix ; do
     desktop-file-install --vendor=%{uniquesuffix -- $suffix} --mode=644 \
@@ -2386,8 +2584,11 @@ done
 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/.java/.systemPrefs
 
 # copy samples next to demos; samples are mostly js files
+%ifarch %{portable_build_arches}
+cp -r ${miscdir}/sample  $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix}/
+%else
 cp -r %{top_level_dir_name}/src/sample  $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix}/
-
+%endif
 
 # moving config files to /etc
 mkdir -p $RPM_BUILD_ROOT/%{etcjavadir -- $suffix}
@@ -2647,6 +2848,13 @@ require "copy_jdk_configs.lua"
 %endif
 
 %changelog
+* Tue Feb 28 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.10-4
+- On portable architectures, replace build section with extraction of existing builds from portables
+- Rewrite ELF files so the source file path is correct and debugsources can be assembled
+- Backport SHA-3 support for PKCS11 provider
+- Sync patch set with portable build we are using by removing rh1648644-java_access_bridge_privileged_security.patch
+- Resolves: rhbz#2150201
+
 * Wed Jan 11 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.10-3
 - Update to jdk-11.0.18+10 (GA)
 - Update release notes to 11.0.18+10

rh1648644-java_access_bridge_privileged_security.patch

@@ -1,20 +0,0 @@
---- openjdk/src/java.base/share/conf/security/java.security
-+++ openjdk/src/java.base/share/conf/security/java.security
-@@ -304,6 +304,8 @@
- #
- package.access=sun.misc.,\
-                sun.reflect.,\
-+               org.GNOME.Accessibility.,\
-+               org.GNOME.Bonobo.,\
- 
- #
- # List of comma-separated packages that start with or equal this string
-@@ -316,6 +318,8 @@
- #
- package.definition=sun.misc.,\
-                    sun.reflect.,\
-+                   org.GNOME.Accessibility.,\
-+                   org.GNOME.Bonobo.,\
- 
- #
- # Determines whether this properties file can be appended to

sources

@@ -1,2 +1,32 @@
 SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
 SHA512 (openjdk-jdk11u-jdk-11.0.18+10-4curve.tar.xz) = c946ec14e1fb4ec40269e0928734368a6d68712549ae450e346d53ab1ae553a280402c6c7e346c859a3e65ec83fc1adefbad733fe8d5e89f0b6d43314558a0b5
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.docs.el.aarch64.tar.xz) = e4cd47dc2c1891e30b56cc6595509fc1fe759dbe5a56945de1968279239d05e243f247a59c628aa10920c9661ec28520f0cf4f38329a71fadf1db57811f762c3
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.docs.el.ppc64le.tar.xz) = ce86829210e6fe90f63fb4f85b2c39b4cdc6abca12261199c14af3f1ec5a3bc17bcaec85b650664617d44c1821840f45f75e7c49bc95364927ad849d82ad6b12
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.docs.el.s390x.tar.xz) = c479c486e1e69d0d810dd71c3d501ee5b121da467963ff3f554be591b5075a90d39963453e16f6e72b918ddf7a593048dc5c03e7dd7d23ac62cc159cade8f2c7
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.docs.el.x86_64.tar.xz) = 731b0e0d8e2548b8d40731f95ca83d0f45a2c22188788292a6acd2779413248452672578b1c36c5ee160e3d76284075c97d50a03b76be3f6112df2d112e6b0b4
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.fastdebug.jdk.el.aarch64.tar.xz) = e553077b210646305765646d364a8857d7fae8cf822f88f53c358ccba85dbc7f89f240f3e93a81a4bf18d16135ee5745a2daec6a65265dfaaa1916644214517c
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.fastdebug.jdk.el.ppc64le.tar.xz) = 66ee158f1012449ccdbd28472f94b9453d4f4ae4a76d9da67df460569820a2fc4affeacac2ff20aa323b65c0fe595fbd4d92d294d5bb946b7364cf3e661ee478
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.fastdebug.jdk.el.x86_64.tar.xz) = 518d7ca35f952cada6d4bea198583de9e875a49d89f8879eed5b997e70617428647b9963e61fb1fbd0d6576404bfcd7f209347339143887f7011a0d548b1d2cc
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.fastdebug.static-libs.el.aarch64.tar.xz) = cedd2b0576f119184b350cb720935fa81ffed76caac8bab6df8eda5ea3a74e2828abaf6b3a0f8c61757d6eaf1cf88a160cf71c54c3ff121fc8e60881d0aba532
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.fastdebug.static-libs.el.ppc64le.tar.xz) = 1d26146716ece20981b5edeedb210ee61fbe14924e36fefdde94faaabe07e7ff8ae541aecc4c7fd7e027fa9b3d56faa2e551392ba071c535123fdd81ded5fb6b
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.fastdebug.static-libs.el.x86_64.tar.xz) = a2f5364c8fbf9fc603d7ba35d2584b4ebe5450309fe523e4c845141fb48c36d8f99bf7aab35cb7d4136377f4f13e34215171ca427418c5b8faa84c3027a81370
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.misc.el.aarch64.tar.xz) = efed481fd1e99d36275660a2cbe3a6e2821bde88d889c0a3139b84a9c0ce4fbbf2fce93533a8a842cb9227d735db355926dfbdbe899c5200b000aebe3c3eb294
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.misc.el.ppc64le.tar.xz) = 3afeebc64fe7e93773031928d45e1a88eeb2e0a3bf0aa972242a057c908f888d49294e098dae8da00f0df9d51da7a5e4cbcd3c900092e38a3a2469cc68d8abf7
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.misc.el.s390x.tar.xz) = d71081c9494cb224942d8f4d675195cdfb98d88487f718fc54c4e7584c04a54b2402786a3cc66d9134edf212b8c5717cb35e2131c38202edf5eb382e4866e869
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.misc.el.x86_64.tar.xz) = 3b988ee4129930aef6279384c42e03503c598d6d12048374d2d392350d3b93cf634b530e1cbe88b2e05bc7f02bef269db6882be95f11a9203831dbccaf0f4833
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.slowdebug.jdk.el.aarch64.tar.xz) = 8be9b1c0023560eb591cfbb30a86479c2342a0d9210cf1b968f568fb5041b785b2216a9917e1de2d9a98a83416fd24300ac4bb9db2131b2e9d50288ffe43ba8a
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.slowdebug.jdk.el.ppc64le.tar.xz) = 08fbe43c17ff06ab1e01c24c9842293fcc7a4b06248b30c06019b42cd9a5b8a043693c6ff5aaafae21b619949b7e1dc6b41d2b136fabf90c62e194b06c85e875
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.slowdebug.jdk.el.s390x.tar.xz) = f3e587b5de6c9256f02d6ede8e2f9c859cfad7cb8d15e6039fe0d097b85925901eaff90e5dc3dc23be31977d64f1d4a778a14286f3b9bc0636301bbe231ff269
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.slowdebug.jdk.el.x86_64.tar.xz) = 1c4556347123987e30114f38c473fba34a9a6859d1ddea689d601f0205232a0841ddd3609df7944894d623b7dc72be76ec643ddf978c2cd707c0ff3acf63d75c
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.slowdebug.static-libs.el.aarch64.tar.xz) = 95d1db9c040ccf6b42f65d367739b3847959895a93c4a2992085b5deed909bd85eeedcedf81404749ae1b479566910b30cef041a29493fea76da84896da5f0a6
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.slowdebug.static-libs.el.ppc64le.tar.xz) = 445af74379a649859d749b06ce19513c8c3d2d06f924a01ee16c6d2eb11d152fb446239a468062e597ce7df7e5c0a5c70cd2b4ff074125ffd80029450e6e48ae
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.slowdebug.static-libs.el.s390x.tar.xz) = 0142e2634c07915adc1d4c42abe01e9feaf753e417bc22e407ff05b2c58a8ab04ed779c576c11994fc2ec59d82237b8a48cd7bb4f8ae306407bee465a1ccafd4
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.slowdebug.static-libs.el.x86_64.tar.xz) = 10c68b33fff30821585fea6a3c875db4ae4d23022f92b45b97cba65fc09ecb1fe617f394b24cb95ea6c4524ca46a813f03a98c24b1b31b1455119eb15f52a7a8
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.static-libs.el.aarch64.tar.xz) = 2d252699817468f2ede3447cb00b5fa552363c3f3274ee7ab27e33d2c067d0781018ef0a326a20221a034f7c0c67f6fa509c6ec4c26b32e1e6373d4f890e122d
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.static-libs.el.ppc64le.tar.xz) = 2ee93a12dc7cc0d9dc9f362a5c20149ac302306fbe421e7422f0cdf9ade3a24fa9d82d492d7bc532d9cece889db7622ece2d5912b56a5cccf8f760baa9aebc7b
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.static-libs.el.s390x.tar.xz) = 50b700ad7050881cdbd75b75e9595244214c2661b7a06947776508b8e0b5ac14b319eb0ee3bc936555d81958cfb799a5d0305e20ad1c837eb2d1e8b7756762da
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.static-libs.el.x86_64.tar.xz) = e8250c41e1bbb60d58c81c1e72b1cc393a322202978f2e0c120f3a50b3cbd85212c0c3cdf935451e00ebae0cb38122d91455c920131c72ab7c161fa4416c8270
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.unstripped.jdk.el.aarch64.tar.xz) = 0907e5b6a37bec907c7f93ac8b61a5f2bd4ac77561871374600b8c655c4b39ac7b069a95f1678d787dd525c0490dab6a8eb976197d579d2b8282666690877984
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.unstripped.jdk.el.ppc64le.tar.xz) = c677c2793e6c2ea948e8564ff4f6bdb239cb86c55b9ac8e021e8a28395587639f4273ccb491a48c616725a21747aca664a4048f68f99b333512292af655ca8ee
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.unstripped.jdk.el.s390x.tar.xz) = 9acec9f5847518b086f95235b989ec379c890cb8913378a23c207e092ca6c825efa5371614823563fb43c81e2c2b1c4fdbfab995e2f0f98954be7b7dc284a8c1
+SHA512 (java-11-openjdk-11.0.18.0.10-6.portable.unstripped.jdk.el.x86_64.tar.xz) = e0e9795e72934537e11ee13cef605a1e4437c35d7a64d87e67ba07f816d7aa74030ee7a28d50c28fdcb6bfce67b2cb0b8367250ebb9923d0cf436b845b0e8377