Commit Graph

54 Commits

Author SHA1 Message Date
Andrew Hughes
524bc89b41 Update to jdk-11.0.16+7
Update release notes to 11.0.16+7
Switch to EA mode for 11.0.16 pre-release builds.
Use same tarball naming style as java-17-openjdk and java-latest-openjdk
Drop JDK-8257794 patch now upstreamed
Print release file during build, which should now include a correct SOURCE value from .src-rev
Update tarball script with IcedTea GitHub URL and .src-rev generation
Use "git apply" with patches in the tarball script to allow binary diffs
Include script to generate bug list for release notes
Update tzdata requirement to 2022a to match JDK-8283350
Make use of the vendor version string to store our version & release rather than an upstream release date
Explicitly require crypto-policies during build and runtime for system security properties
Add additional patch during tarball generation to align tests with ECC changes

Resolves: rhbz#2083325
2022-07-17 00:26:36 +01:00
Andrew Hughes
409bcec3d8 Rebase FIPS patches from fips branch and simplify by using a single patch from that repository
* RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
* RH2090378: Revert to disabling system security properties and FIPS mode support together

Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
Enable system security properties in the RPM (now disabled by default in the FIPS repo)
Improve security properties test to check both enabled and disabled behaviour
Run security properties test with property debugging on

Resolves: rhbz#2099839
Resolves: rhbz#2100676
2022-07-08 17:21:37 +01:00
Francisco Ferrari Bihurriet
ecd7dd9860 RH2007331: SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode
Use SunPKCS11 Attributes Configuration to set CKA_SIGN=true on SecretKey generate/import operations in FIPS mode, see:
https://docs.oracle.com/en/java/javase/11/security/pkcs11-reference-guide1.html#GUID-C4ABFACB-B2C9-4E71-A313-79F881488BB9__PKCS11-ATTRIBUTES-CONFIGURATION

Resolves: rhbz#2102434
2022-07-08 03:39:33 +01:00
Stephan Bergmann
57e78ff50f Fix flatpak builds
...after 19065a8b01 "Temporarily move x86 to use
Zero in order to get a working build":

When building the

>       if ${run_bootstrap} ; then

branch for suffix='' and loop='-main', the second

>           buildjdk ${builddir} $(pwd)/${bootinstalldir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt}

uses the JDK (`$(pwd)/${bootinstalldir}/images/%{jdkimage}`) from the installjdk
on the previous line.  But installjdk does

> 	rm ${imagepath}/lib/tzdb.dat
> 	ln -s %{_datadir}/javazi-1.8/tzdb.dat ${imagepath}/lib/tzdb.dat

which made that JDK's tzdb.dat link to /app/share/javazi-1.8/tzdb.dat in a
flatpak build (rather than the usual /usr/share/javazi-1.8/tzdb.dat in a non-
flatpak build) which is not present at build-time (but will be present at
runtime in at least the LibreOffice flatpak, which bundles tzdata-java built for
the flatpak /app prefix).  So using that JDK's compiler during the build kept
failing due to java.io.FileNotFoundException for its lib/tzdb.dat.

(This was not an issue prior to 19065a8b01, as
installjdk's modification of lib/tzdb.dat used to be done only for the "Final
setup on the main image" at the very end of the build, not during the build for
JDKs that are themselves used later during the build.)

The easiest workaround for this issue appears to be to just not bootstrap_build
in the flatpak case, avoiding the situation that a JDK whose lib/tzdb.dat has
been modified through installjdk is used during the build.

Resolves: rhbz#2067189
2022-06-30 02:28:51 +01:00
Andrew Hughes
662ffaef92 Update to jdk-11.0.15.0+10
Update release notes to 11.0.15.0+10
Switch to GA mode for release

Resolves: rhbz#2073595
2022-04-24 21:42:02 +01:00
Andrew Hughes
e5ae23fa36 Update to jdk-11.0.15.0+8
Update release notes to 11.0.15.0+8
Rebase RH1996182 FIPS patch after JDK-8254410

Resolves: rhbz#2050458
2022-04-12 18:10:43 +01:00
Andrew Hughes
3b828b2713 Update to jdk-11.0.15.0+1
Update release notes to 11.0.15.0+1
Switch to EA mode for 11.0.15 pre-release builds.

Related: rhbz#2050458
2022-04-12 02:24:24 +01:00
Andrew Hughes
1e74ba104c Detect NSS at runtime for FIPS detection
Turn off build-time NSS linking and go back to an explicit Requires on NSS

Resolves: rhbz#2052831
2022-02-28 05:47:18 +00:00
Andrew Hughes
0e6237743a Introduce tests/tests.yml, based on the one in RHEL 8
Resolves: rhbz#2058489
2022-02-27 03:08:07 +00:00
Jiri
1e24ad6c0b Storing and restoring alterntives during update manually
Fixing:
Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives and select (as auto) system JDK/JRE

The move of alternatives creation to posttrans to fix:
Bug 1200302 - dnf reinstall breaks alternatives
Had caused the alternatives to be removed, and then created again,
instead of being added, and then removing the old, and thus persisting
the selection in family

Thus this fix, is storing the family of manually selected master, and if
stored, then it is restoring the family of the master
2022-02-26 12:02:19 +01:00
Andrew Hughes
35ef9f747b Family extracted to globals
Resolves: rhbz#2008205
2022-02-25 17:39:14 +00:00
Andrew Hughes
9d274e8023 Add JDK-8275535 patch to fix LDAP authentication issue.
Resolves: rhbz#2053523
2022-02-23 04:03:20 +00:00
Andrew Hughes
3e6e30fbbb Update to jdk-11.0.14.1+1
Update release notes to 11.0.14.1+1
Require tzdata 2021e as of JDK-8275766.

Resolves: rhbz#2052834
2022-02-18 02:59:57 +00:00
Andrew Hughes
fcceab5ade Separate crypto policy initialisation from FIPS initialisation, now they are no longer interdependent
Resolves: rhbz#2052820
2022-02-17 19:43:01 +00:00
Andrew Hughes
8bb8c1f9ac Update to jdk-11.0.14.0+9
Update release notes to 11.0.14.0+9
Switch to GA mode for final release.

Resolves: rhbz#2039395
2022-02-16 03:44:21 +00:00
Andrew Hughes
4272f7b1a6 Fix FIPS issues in native code and with initialisation of java.security.Security
Resolves: rhbz#2023530
2022-02-16 00:15:34 +00:00
Andrew Hughes
6fcdd14967 Refactor build functions so we can build just HotSpot without any attempt at installation.
Sync gdb test with java-1.8.0-openjdk.
Improve architecture restrictions for the gdb test.
Replace -mstackrealign with -mincoming-stack-boundary=2 -mpreferred-stack-boundary=4 on x86_32 for stack alignment
Explicitly list JIT architectures rather than relying on those with slowdebug builds
Disable the serviceability agent on Zero architectures even when the architecture itself is supported
Add backport of JDK-8257794 to fix bogus assert on slowdebug x86-32 Zero builds
Give javadoc-zip its own Provides, next to the plain javadoc ones

Related: rhbz#2052834
2022-02-11 16:00:03 +00:00
Andrew Hughes
233f2edf10 Update to jdk-11.0.14.0+8
Update release notes to 11.0.14.0+8
Switch to EA mode for 11.0.14 pre-release builds.
Rename blacklisted.certs to blocked.certs following JDK-8253866
Rebase RH1996182 login patch and drop redundant security policy extension after JDK-8269034

Resolves: rhbz#2022825
2022-02-11 12:22:22 +00:00
Andrew Hughes
35d6b3a4f0 Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
Related: rhbz#2022825
2022-02-10 18:11:32 +00:00
Andrew John Hughes
0fd8f1db3f Use 'sql:' prefix in nss.fips.cfg
Fedora 35 and better no longer ship the legacy
secmod.db file as part of the nss package. Explicitly
tell OpenJDK to use sqlite-based sec mode.

Resolves: rhbz#2023535
2021-12-02 02:39:26 +00:00
Andrew John Hughes
bdb34159ca Replaced hardcoded 11 by featurever where appropriate
Fixed comment of `for slowdebug` to correct `any debug`

Related: rhbz#2022825
2021-12-01 20:17:40 +00:00
Jiri Vanek
3c57ec91b9 alternatives creation moved to posttrans
- Thus fixing the old reisntall issue:
- https://bugzilla.redhat.com/show_bug.cgi?id=1200302
- https://bugzilla.redhat.com/show_bug.cgi?id=1976053
2021-11-09 14:13:07 +01:00
Andrew Hughes
23cc423f3a Update to jdk-11.0.13.0+8
Update release notes to 11.0.13.0+8
Update tarball generation script to use git following OpenJDK 11u's move to github
Remove "-clean" suffix as no 11.0.13 builds are unclean.
Drop JDK-8269668 patch which is now applied upstream.

Resolves: rhbz#2013845
2021-11-07 02:38:02 +00:00
Andrew Hughes
42db25eae5 Reduce disk footprint by removing build artifacts by default.
Related: rhbz#1999940
2021-10-12 03:50:02 +01:00
Andrew Hughes
7eeb37f129 Restructure the build so a minimal initial build is then used for the final build (with docs)
This reduces pressure on the system JDK and ensures the JDK being built can do a full build

Related: rhbz#1999940
2021-10-11 15:07:34 +01:00
Andrew Hughes
4db117d817 Add FIPS patch to allow plain key import
Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false

Resolves: rhbz#1994681
2021-10-10 22:59:12 +01:00
Andrew Hughes
358d95621b Minor cosmetic improvements to make spec more comparable between variants
Related: rhbz#1999940
2021-10-04 04:11:23 +01:00
Andrew Hughes
5db4334bb9 Extend the default security policy to accomodate PKCS11 accessing jdk.internal.misc.
Resolves: rhbz#1997360
2021-08-30 17:03:02 +01:00
Andrew Hughes
25304fcaf5 Add patch to login to the NSS software token when in FIPS mode.
Resolves: rhbz#1997360
2021-08-27 20:35:51 +01:00
Mohan Boddu
f61cab7066 Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688
Signed-off-by: Mohan Boddu <mboddu@redhat.com>
2021-08-09 21:03:40 +00:00
Andrew Hughes
d3a8a110b5 Update to jdk-11.0.12.0+7
Update release notes to 11.0.12.0+7
Switch to GA mode for final release.
Add patch in order to fix java.library.path issue on aarch64 (JDK-8269668)
Remove non-Free test from source tarball.

Resolves: rhbz#1967815
2021-08-09 02:23:17 +01:00
Andrew Hughes
16c1b3ca09 Update to jdk-11.0.12.0+6
Update release notes to 11.0.12.0+6
Correct bug ID JDK-8264846 to intended ID of JDK-8264848
Switch to EA mode for 11.0.12 pre-release builds.
Update ECC patch following JDK-8226374 (bug ID yet to be confirmed)
Use the "reverse" build loop (debug first) as the main and only build loop to get more diagnostics.
Remove restriction on disabling product build, as debug packages no longer have javadoc packages.

Resolves: rhbz#1967815
2021-07-20 22:52:26 +01:00
Andrew Hughes
51b93a0a4a Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library.
Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled in configure.
Remove unneeded Requires on NSS as it will now be dynamically linked and detected by RPM.

Resolves: rhbz#1971689
2021-07-20 18:07:12 +01:00
Andrew Hughes
e4c9f84506 Support the FIPS mode crypto policy (RH1655466)
Update RH1655466 FIPS patch with changes in OpenJDK 8 version.
SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the name in the config file.
Change nss.fips.cfg config name to "NSS-FIPS" to avoid confusion with nss.cfg.
No need to substitute path to nss.fips.cfg as java.security file supports a java.home variable.
Disable FIPS mode support unless com.redhat.fips is set to "true".
Use appropriate keystore types when in FIPS mode (RH1818909)
Enable alignment with FIPS crypto policy by default (-Dcom.redhat.fips=false to disable).
Disable TLSv1.3 when the FIPS crypto policy and the NSS-FIPS provider are in use (RH1860986)
Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode
Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always occurs (RH1915071)

Resolves: rhbz#1971689
2021-07-06 19:00:18 +01:00
Andrew Hughes
a8c3b495b8 Update to jdk-11.0.11.0+9
Update release notes to 11.0.11.0+9
Perform static library build on a separate source tree with bundled image libraries
Make static library build optional
Hardcode /usr/sbin/alternatives for Flatpak builds
Require tzdata 2020f to match upstream change JDK-8259048
Require tzdata 2021a to match upstream change JDK-8260356
Remove upstreamed patch JDK-8259949
Fix issue where CheckVendor.java test erroneously passes when it should fail.
Add proper quoting so '&' is not treated as a special character by the shell.
Update tapsets from IcedTea 6.x repository with fix for JDK-8015774 changes (_heap->_heaps)
Update icedtea_sync.sh with a VCS mode that retrieves sources from a Mercurial repository
Remove -fcommon work-around as the OpenJDK 11 code has been fixed.

Resolves: rhbz#1967815
2021-07-06 03:42:00 +01:00
Lukas Zachar
a106e8d1bc Add gating.yaml from RHEL 2021-06-02 12:59:08 +02:00
Mohan Boddu
2b84538c63 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
Signed-off-by: Mohan Boddu <mboddu@redhat.com>
2021-04-16 00:43:40 +00:00
DistroBaker
33254fcae7 Merged update from upstream sources
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/java-11-openjdk.git#dd24375015a1b6fd41f6c654f974a0b27a966614
2021-02-01 08:54:47 +00:00
DistroBaker
7ac543a5c3 Merged update from upstream sources
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/java-11-openjdk.git#6f7c0e716b4ad0217b9a09151d65906ca4ce8345
2021-01-25 23:54:01 +00:00
DistroBaker
dd091e228c Merged update from upstream sources
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/java-11-openjdk.git#3fa84eff002dc9568888a16c24d7436bc8135b80
2021-01-25 02:38:01 +00:00
DistroBaker
d69a8df074 Merged update from upstream sources
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/java-11-openjdk.git#214b0d1ac4a1cd82127afd8b10689ac290018c27
2021-01-24 10:43:32 +00:00
DistroBaker
f08c095083 Merged update from upstream sources
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/java-11-openjdk.git#4581efb916c29a7a9ed2f20c363b50ef4761d768
2021-01-24 05:58:05 +00:00
DistroBaker
3fa674d2e7 Merged update from upstream sources
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/java-11-openjdk.git#876286a0d45be91f899b08bc7498f017de9a35c8
2021-01-23 12:12:32 +00:00
DistroBaker
947d295af9 Merged update from upstream sources
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/java-11-openjdk.git#7f58eb6adf071f9f2660fb9093a45d4c62697b77
2021-01-15 12:16:00 +00:00
DistroBaker
33ebc08a1c Merged update from upstream sources
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/java-11-openjdk.git#e474513f0429a9bd77597aa2706f9324e48d1e7e
2020-12-23 23:00:25 +00:00
DistroBaker
d898dbf94e Merged update from upstream sources
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/java-11-openjdk.git#cef412cef76d21e033ba122cec239e88170aeb0a
2020-12-18 19:56:48 +00:00
DistroBaker
433bf3fadd Merged update from upstream sources
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/java-11-openjdk.git#3ad7305a74c731e98ecb906804db60a45cffddd1
2020-12-15 11:02:51 +00:00
DistroBaker
be78a65a84 Merged update from upstream sources
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/java-11-openjdk.git#b1fa8704eed2a7457d56acdd8c5aa5fdbc219e2d
2020-11-24 02:50:53 +00:00
DistroBaker
4140d33434 Merged update from upstream sources
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/java-11-openjdk.git#fadbaad5b8327359df29fc6c08b6372c42885ce1
2020-11-06 12:22:31 +00:00
DistroBaker
e715abb1ea Merged update from upstream sources
This is an automated DistroBaker update from upstream sources.
If you do not know what this is about or would like to opt out,
contact the OSCI team.

Source: https://src.fedoraproject.org/rpms/java-11-openjdk.git#a0e5d76a580be19b73dea968c38d1f2b2e054926
2020-11-06 03:40:14 +00:00