.gitignore

@@ -1,2 +1,2 @@
-SOURCES/openjdk-jdk11u-jdk-11.0.23+9.tar.xz
+SOURCES/openjdk-jdk11u-jdk-11.0.18+10-4curve.tar.xz
 SOURCES/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz

.java-11-openjdk.metadata

@@ -1,2 +1,2 @@
-db99bc0a0912f824db1043d18b199c154d57bb5b SOURCES/openjdk-jdk11u-jdk-11.0.23+9.tar.xz
+65abc412a085af5ba08c019cf6d0e7e44cfe94eb SOURCES/openjdk-jdk11u-jdk-11.0.18+10-4curve.tar.xz
 c8281ee37b77d535c9c1af86609a531958ff7b34 SOURCES/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz

SOURCES/README.md

@@ -1,39 +0,0 @@
-OpenJDK 11 is a Long-Term Support (LTS) release of the Java platform.
-
-For a list of major changes from OpenJDK 8 (java-1.8.0-openjdk), see
-the upstream release page for OpenJDK 11 and the preceding interim
-releases:
-
-* 9: https://openjdk.org/projects/jdk9/
-* 10: https://openjdk.java.net/projects/jdk/10/
-* 11: https://openjdk.java.net/projects/jdk/11/
-
-# Rebuilding the OpenJDK package
-
-The OpenJDK packages are now created from a single build which is then
-packaged for different major versions of Red Hat Enterprise Linux
-(RHEL). This allows the OpenJDK team to focus their efforts on the
-development and testing of this single build, rather than having
-multiple builds which only differ by the platform they were built on.
-
-This does make rebuilding the package slightly more complicated than a
-normal package. Modifications should be made to the
-`java-11-openjdk-portable.specfile` file, which can be found with this
-README file in the source RPM or installed in the documentation tree
-by the `java-11-openjdk-headless` RPM.
-
-Once the modified `java-11-openjdk-portable` RPMs are built, they
-should be installed and will produce a number of tarballs in the
-`/usr/lib/jvm` directory. The `java-11-openjdk` RPMs can then be
-built, which will use these tarballs to create the usual RPMs found in
-RHEL. The `java-11-openjdk-portable` RPMs can be uninstalled once the
-desired final RPMs are produced.
-
-Note that the `java-11-openjdk.spec` file has a hard requirement on
-the exact version of java-11-openjdk-portable to use, so this will
-need to be modified if the version or rpmrelease values are changed in
-`java-11-openjdk-portable.specfile`.
-
-To reduce the number of RPMs involved, the `fastdebug` and `slowdebug`
-builds may be disabled using `--without fastdebug` and `--without
-slowdebug`.

SOURCES/fips-11u-9087e80d0ab.patch

@@ -1,5 +1,5 @@
 diff --git a/make/autoconf/libraries.m4 b/make/autoconf/libraries.m4
-index 16e906bdc6..1a352e5a32 100644
+index a73c0f38181..80710886ed8 100644
 --- a/make/autoconf/libraries.m4
 +++ b/make/autoconf/libraries.m4
 @@ -101,6 +101,7 @@ AC_DEFUN_ONCE([LIB_SETUP_LIBRARIES],
@@ -74,10 +74,10 @@ index 16e906bdc6..1a352e5a32 100644
 +  AC_SUBST(USE_SYSCONF_NSS)
 +])
 diff --git a/make/autoconf/spec.gmk.in b/make/autoconf/spec.gmk.in
-index 3787b12600..dab108a82b 100644
+index 0ae23b93167..a242acc1234 100644
 --- a/make/autoconf/spec.gmk.in
 +++ b/make/autoconf/spec.gmk.in
-@@ -848,6 +848,10 @@ INSTALL_SYSCONFDIR=@sysconfdir@
+@@ -826,6 +826,10 @@ INSTALL_SYSCONFDIR=@sysconfdir@
  # Libraries
  #
  
@@ -89,10 +89,10 @@ index 3787b12600..dab108a82b 100644
  LCMS_CFLAGS:=@LCMS_CFLAGS@
  LCMS_LIBS:=@LCMS_LIBS@
 diff --git a/make/lib/Lib-java.base.gmk b/make/lib/Lib-java.base.gmk
-index b40d3114b9..0d1d83cf3e 100644
+index a529768f39e..daf9c947172 100644
 --- a/make/lib/Lib-java.base.gmk
 +++ b/make/lib/Lib-java.base.gmk
-@@ -178,6 +178,31 @@ ifeq ($(call isTargetOsType, unix), true)
+@@ -178,6 +178,31 @@ ifeq ($(OPENJDK_TARGET_OS_TYPE), unix)
    endif
  endif
  
@@ -125,7 +125,7 @@ index b40d3114b9..0d1d83cf3e 100644
  # Create the symbols file for static builds.
  
 diff --git a/make/nb_native/nbproject/configurations.xml b/make/nb_native/nbproject/configurations.xml
-index fb07d54c1f..c5813e2b7a 100644
+index fb07d54c1f0..c5813e2b7aa 100644
 --- a/make/nb_native/nbproject/configurations.xml
 +++ b/make/nb_native/nbproject/configurations.xml
 @@ -2950,6 +2950,9 @@
@@ -151,7 +151,7 @@ index fb07d54c1f..c5813e2b7a 100644
              ex="false"
              tool="3"
 diff --git a/make/scripts/compare_exceptions.sh.incl b/make/scripts/compare_exceptions.sh.incl
-index 6327040964..6b3780123b 100644
+index 6327040964d..6b3780123b6 100644
 --- a/make/scripts/compare_exceptions.sh.incl
 +++ b/make/scripts/compare_exceptions.sh.incl
 @@ -179,6 +179,7 @@ if [ "$OPENJDK_TARGET_OS" = "solaris" ] && [ "$OPENJDK_TARGET_CPU" = "x86_64" ];
@@ -172,7 +172,7 @@ index 6327040964..6b3780123b 100644
        ./lib/libzip.so
 diff --git a/src/java.base/linux/native/libsystemconf/systemconf.c b/src/java.base/linux/native/libsystemconf/systemconf.c
 new file mode 100644
-index 0000000000..8dcb7d9073
+index 00000000000..8dcb7d9073f
 --- /dev/null
 +++ b/src/java.base/linux/native/libsystemconf/systemconf.c
 @@ -0,0 +1,224 @@
@@ -401,7 +401,7 @@ index 0000000000..8dcb7d9073
 +    }
 +}
 diff --git a/src/java.base/share/classes/java/security/Security.java b/src/java.base/share/classes/java/security/Security.java
-index 5b9552058b..b46de49211 100644
+index b36510a376b..ad5182e1e7c 100644
 --- a/src/java.base/share/classes/java/security/Security.java
 +++ b/src/java.base/share/classes/java/security/Security.java
 @@ -32,6 +32,7 @@ import java.net.URL;
@@ -412,17 +412,16 @@ index 5b9552058b..b46de49211 100644
  import jdk.internal.misc.SharedSecrets;
  import jdk.internal.util.StaticProperty;
  import sun.security.util.Debug;
-@@ -47,6 +48,9 @@ import sun.security.jca.*;
+@@ -47,12 +48,20 @@ import sun.security.jca.*;
   * implementation-specific location, which is typically the properties file
   * {@code conf/security/java.security} in the Java installation directory.
   *
 + * <p>Additional default values of security properties are read from a
 + * system-specific location, if available.</p>
 + *
-  * @implNote If the properties file fails to load, the JDK implementation will
-  * throw an unspecified error when initializing the {@code Security} class.
-  *
-@@ -56,6 +60,11 @@ import sun.security.jca.*;
+  * @author Benjamin Renaud
+  * @since 1.1
+  */
  
  public final class Security {
  
@@ -434,7 +433,7 @@ index 5b9552058b..b46de49211 100644
      /* Are we debugging? -- for developers */
      private static final Debug sdebug =
                          Debug.getInstance("properties");
-@@ -70,6 +79,19 @@ public final class Security {
+@@ -67,6 +76,19 @@ public final class Security {
      }
  
      static {
@@ -454,19 +453,26 @@ index 5b9552058b..b46de49211 100644
          // doPrivileged here because there are multiple
          // things in initialize that might require privs.
          // (the FileInputStream call and the File.exists call,
-@@ -85,6 +107,7 @@ public final class Security {
-     private static void initialize() {
+@@ -83,6 +105,7 @@ public final class Security {
          props = new Properties();
+         boolean loadedProps = false;
          boolean overrideAll = false;
 +        boolean systemSecPropsEnabled = false;
  
          // first load the system properties file
          // to determine the value of security.overridePropertiesFile
-@@ -105,9 +128,63 @@ public final class Security {
+@@ -98,6 +121,7 @@ public final class Security {
+                 if (sdebug != null) {
+                     sdebug.println("reading security properties file: " +
+                                 propFile);
++                    sdebug.println(props.toString());
                  }
-             loadProps(null, extraPropFile, overrideAll);
+             } catch (IOException e) {
+                 if (sdebug != null) {
+@@ -192,6 +216,61 @@ public final class Security {
              }
-+
+         }
+ 
 +        boolean sysUseProps = Boolean.valueOf(System.getProperty(SYS_PROP_SWITCH, "false"));
 +        boolean secUseProps = Boolean.valueOf(props.getProperty(SEC_PROP_SWITCH));
 +        if (sdebug != null) {
@@ -486,7 +492,9 @@ index 5b9552058b..b46de49211 100644
 +            }
 +        }
 +
-+        if (systemSecPropsEnabled) {
++        // FIPS support depends on the contents of java.security so
++        // ensure it has loaded first
++        if (loadedProps && systemSecPropsEnabled) {
 +            boolean shouldEnable;
 +            String sysProp = System.getProperty("com.redhat.fips");
 +            if (sysProp == null) {
@@ -522,19 +530,15 @@ index 5b9552058b..b46de49211 100644
 +        }
      }
  
--    private static boolean loadProps(File masterFile, String extraPropFile, boolean overrideAll) {
-+    static boolean loadProps(File masterFile, String extraPropFile, boolean overrideAll) {
-         InputStream is = null;
-         try {
-             if (masterFile != null && masterFile.exists()) {
+     /*
 diff --git a/src/java.base/share/classes/java/security/SystemConfigurator.java b/src/java.base/share/classes/java/security/SystemConfigurator.java
 new file mode 100644
-index 0000000000..49bf17ea17
+index 00000000000..90f6dd2ebc0
 --- /dev/null
 +++ b/src/java.base/share/classes/java/security/SystemConfigurator.java
-@@ -0,0 +1,231 @@
+@@ -0,0 +1,248 @@
 +/*
-+ * Copyright (c) 2019, 2023, Red Hat, Inc.
++ * Copyright (c) 2019, 2021, Red Hat, Inc.
 + *
 + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 + *
@@ -612,9 +616,26 @@ index 0000000000..49bf17ea17
 +     * security.useSystemPropertiesFile is true.
 +     */
 +    static boolean configureSysProps(Properties props) {
-+        // now load the system file, if it exists, so its values
-+        // will win if they conflict with the earlier values
-+        return Security.loadProps(null, CRYPTO_POLICIES_JAVA_CONFIG, false);
++        boolean systemSecPropsLoaded = false;
++
++        try (BufferedInputStream bis =
++                new BufferedInputStream(
++                        new FileInputStream(CRYPTO_POLICIES_JAVA_CONFIG))) {
++            props.load(bis);
++            systemSecPropsLoaded = true;
++            if (sdebug != null) {
++                sdebug.println("reading system security properties file " +
++                        CRYPTO_POLICIES_JAVA_CONFIG);
++                sdebug.println(props.toString());
++            }
++        } catch (IOException e) {
++            if (sdebug != null) {
++                sdebug.println("unable to load security properties from " +
++                        CRYPTO_POLICIES_JAVA_CONFIG);
++                e.printStackTrace();
++            }
++        }
++        return systemSecPropsLoaded;
 +    }
 +
 +    /*
@@ -766,7 +787,7 @@ index 0000000000..49bf17ea17
 +}
 diff --git a/src/java.base/share/classes/jdk/internal/misc/JavaSecuritySystemConfiguratorAccess.java b/src/java.base/share/classes/jdk/internal/misc/JavaSecuritySystemConfiguratorAccess.java
 new file mode 100644
-index 0000000000..21bc6d0b59
+index 00000000000..21bc6d0b591
 --- /dev/null
 +++ b/src/java.base/share/classes/jdk/internal/misc/JavaSecuritySystemConfiguratorAccess.java
 @@ -0,0 +1,31 @@
@@ -802,7 +823,7 @@ index 0000000000..21bc6d0b59
 +    boolean isPlainKeySupportEnabled();
 +}
 diff --git a/src/java.base/share/classes/jdk/internal/misc/SharedSecrets.java b/src/java.base/share/classes/jdk/internal/misc/SharedSecrets.java
-index 688ec9f091..8489b940c4 100644
+index 688ec9f0915..8489b940c43 100644
 --- a/src/java.base/share/classes/jdk/internal/misc/SharedSecrets.java
 +++ b/src/java.base/share/classes/jdk/internal/misc/SharedSecrets.java
 @@ -36,6 +36,7 @@ import java.io.FilePermission;
@@ -838,7 +859,7 @@ index 688ec9f091..8489b940c4 100644
 +    }
  }
 diff --git a/src/java.base/share/classes/module-info.java b/src/java.base/share/classes/module-info.java
-index 7351627db3..859591890d 100644
+index 5460efcf8c5..f08dc2fafc5 100644
 --- a/src/java.base/share/classes/module-info.java
 +++ b/src/java.base/share/classes/module-info.java
 @@ -182,6 +182,7 @@ module java.base {
@@ -850,7 +871,7 @@ index 7351627db3..859591890d 100644
          jdk.attach,
          jdk.charsets,
 diff --git a/src/java.base/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java b/src/java.base/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
-index ffee2c1603..ff3d5e0e4a 100644
+index ffee2c1603b..ff3d5e0e4ab 100644
 --- a/src/java.base/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
 +++ b/src/java.base/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
 @@ -33,8 +33,13 @@ import java.security.KeyStore.*;
@@ -889,7 +910,7 @@ index ffee2c1603..ff3d5e0e4a 100644
                          "FIPS mode: KeyStore must be " +
                          "from provider " + SunJSSE.cryptoProvider.getName());
 diff --git a/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java b/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java
-index e06b2a588c..315a2ce370 100644
+index de7da5c3379..5c3813dda7b 100644
 --- a/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java
 +++ b/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java
 @@ -31,6 +31,7 @@ import java.security.*;
@@ -910,14 +931,6 @@ index e06b2a588c..315a2ce370 100644
 -                    ProtocolVersion.TLS11,
 -                    ProtocolVersion.TLS10
 -                );
--
--                serverDefaultProtocols = getAvailableProtocols(
--                        new ProtocolVersion[] {
--                    ProtocolVersion.TLS13,
--                    ProtocolVersion.TLS12,
--                    ProtocolVersion.TLS11,
--                    ProtocolVersion.TLS10
--                });
 +                if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
 +                        .isSystemFipsEnabled()) {
 +                    // RH1860986: TLSv1.3 key derivation not supported with
@@ -927,7 +940,14 @@ index e06b2a588c..315a2ce370 100644
 +                        ProtocolVersion.TLS11,
 +                        ProtocolVersion.TLS10
 +                    );
-+
+ 
+-                serverDefaultProtocols = getAvailableProtocols(
+-                        new ProtocolVersion[] {
+-                    ProtocolVersion.TLS13,
+-                    ProtocolVersion.TLS12,
+-                    ProtocolVersion.TLS11,
+-                    ProtocolVersion.TLS10
+-                });
 +                    serverDefaultProtocols = getAvailableProtocols(
 +                            new ProtocolVersion[] {
 +                        ProtocolVersion.TLS12,
@@ -953,68 +973,42 @@ index e06b2a588c..315a2ce370 100644
              } else {
                  supportedProtocols = Arrays.asList(
                      ProtocolVersion.TLS13,
-@@ -910,12 +929,23 @@ public abstract class SSLContextImpl extends SSLContextSpi {
-                 if (client) {
-                     // default client protocols
+@@ -620,6 +639,16 @@ public abstract class SSLContextImpl extends SSLContextSpi {
+ 
+         static ProtocolVersion[] getSupportedProtocols() {
              if (SunJSSE.isFIPS()) {
--                        candidates = new ProtocolVersion[] {
--                            ProtocolVersion.TLS13,
--                            ProtocolVersion.TLS12,
--                            ProtocolVersion.TLS11,
--                            ProtocolVersion.TLS10
--                        };
 +                if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
 +                        .isSystemFipsEnabled()) {
 +                    // RH1860986: TLSv1.3 key derivation not supported with
 +                    // the Security Providers available in system FIPS mode.
-+                            candidates = new ProtocolVersion[] {
-+                                ProtocolVersion.TLS12,
-+                                ProtocolVersion.TLS11,
-+                                ProtocolVersion.TLS10
-+                            };
-+                        } else {
-+                            candidates = new ProtocolVersion[] {
-+                                ProtocolVersion.TLS13,
++                    return new ProtocolVersion[] {
 +                            ProtocolVersion.TLS12,
 +                            ProtocolVersion.TLS11,
 +                            ProtocolVersion.TLS10
 +                    };
 +                }
-                     } else {
-                         candidates = new ProtocolVersion[] {
+                 return new ProtocolVersion[] {
                          ProtocolVersion.TLS13,
-@@ -927,12 +957,23 @@ public abstract class SSLContextImpl extends SSLContextSpi {
-                 } else {
-                     // default server protocols
+                         ProtocolVersion.TLS12,
+@@ -949,6 +978,16 @@ public abstract class SSLContextImpl extends SSLContextSpi {
+ 
+         static ProtocolVersion[] getProtocols() {
              if (SunJSSE.isFIPS()) {
--                        candidates = new ProtocolVersion[] {
--                            ProtocolVersion.TLS13,
--                            ProtocolVersion.TLS12,
--                            ProtocolVersion.TLS11,
--                            ProtocolVersion.TLS10
--                        };
 +                if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
 +                        .isSystemFipsEnabled()) {
 +                    // RH1860986: TLSv1.3 key derivation not supported with
 +                    // the Security Providers available in system FIPS mode.
-+                            candidates = new ProtocolVersion[] {
-+                                ProtocolVersion.TLS12,
-+                                ProtocolVersion.TLS11,
-+                                ProtocolVersion.TLS10
-+                            };
-+                        } else {
-+                            candidates = new ProtocolVersion[] {
-+                                ProtocolVersion.TLS13,
++                    return new ProtocolVersion[] {
 +                            ProtocolVersion.TLS12,
 +                            ProtocolVersion.TLS11,
 +                            ProtocolVersion.TLS10
 +                    };
 +                }
-                     } else {
-                         candidates = new ProtocolVersion[] {
+                 return new ProtocolVersion[]{
                          ProtocolVersion.TLS13,
+                         ProtocolVersion.TLS12,
 diff --git a/src/java.base/share/classes/sun/security/ssl/SunJSSE.java b/src/java.base/share/classes/sun/security/ssl/SunJSSE.java
-index 2a2b5d7568..891796f19b 100644
+index c50ba93ecfc..de2a91a478c 100644
 --- a/src/java.base/share/classes/sun/security/ssl/SunJSSE.java
 +++ b/src/java.base/share/classes/sun/security/ssl/SunJSSE.java
 @@ -27,6 +27,8 @@ package sun.security.ssl;
@@ -1025,7 +1019,7 @@ index 2a2b5d7568..891796f19b 100644
 +import jdk.internal.misc.SharedSecrets;
  import sun.security.rsa.SunRsaSignEntries;
  import static sun.security.util.SecurityConstants.PROVIDER_VER;
- import static sun.security.util.SecurityProviderConstants.*;
+ import static sun.security.provider.SunEntries.createAliases;
 @@ -195,8 +197,13 @@ public abstract class SunJSSE extends java.security.Provider {
              "sun.security.ssl.SSLContextImpl$TLS11Context", null, null);
          ps("SSLContext", "TLSv1.2",
@@ -1041,12 +1035,12 @@ index 2a2b5d7568..891796f19b 100644
 +        }
          ps("SSLContext", "TLS",
              "sun.security.ssl.SSLContextImpl$TLSContext",
-             (isfips? null : List.of("SSL")), null);
+             (isfips? null : createAliases("SSL")), null);
 diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security
-index c0eed3f884..b03bd9f896 100644
+index 097517926d1..474fe6f401f 100644
 --- a/src/java.base/share/conf/security/java.security
 +++ b/src/java.base/share/conf/security/java.security
-@@ -88,6 +88,14 @@ security.provider.tbd=Apple
+@@ -85,6 +85,14 @@ security.provider.tbd=Apple
  security.provider.tbd=SunPKCS11
  #endif
  
@@ -1061,7 +1055,7 @@ index c0eed3f884..b03bd9f896 100644
  #
  # A list of preferred providers for specific algorithms. These providers will
  # be searched for matching algorithms before the list of registered providers.
-@@ -301,6 +309,11 @@ policy.ignoreIdentityScope=false
+@@ -298,6 +306,11 @@ policy.ignoreIdentityScope=false
  #
  keystore.type=pkcs12
  
@@ -1073,7 +1067,7 @@ index c0eed3f884..b03bd9f896 100644
  #
  # Controls compatibility mode for JKS and PKCS12 keystore types.
  #
-@@ -338,6 +351,13 @@ package.definition=sun.misc.,\
+@@ -335,6 +348,13 @@ package.definition=sun.misc.,\
  #
  security.overridePropertiesFile=true
  
@@ -1089,7 +1083,7 @@ index c0eed3f884..b03bd9f896 100644
  # the javax.net.ssl package.
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
 new file mode 100644
-index 0000000000..b848a1fd78
+index 00000000000..b848a1fd783
 --- /dev/null
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
 @@ -0,0 +1,290 @@
@@ -1384,7 +1378,7 @@ index 0000000000..b848a1fd78
 +    }
 +}
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
-index ffbd671246..bdaad67e06 100644
+index 099caac605f..977e5332bd1 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
 @@ -26,6 +26,9 @@
@@ -1406,7 +1400,7 @@ index ffbd671246..bdaad67e06 100644
  import sun.security.util.Debug;
  import sun.security.util.ResourcesMgr;
  import static sun.security.util.SecurityConstants.PROVIDER_VER;
-@@ -61,6 +66,29 @@ import static sun.security.pkcs11.wrapper.PKCS11Constants.*;
+@@ -60,6 +65,29 @@ import static sun.security.pkcs11.wrapper.PKCS11Constants.*;
   */
  public final class SunPKCS11 extends AuthProvider {
  
@@ -1436,7 +1430,7 @@ index ffbd671246..bdaad67e06 100644
      private static final long serialVersionUID = -1354835039035306505L;
  
      static final Debug debug = Debug.getInstance("sunpkcs11");
-@@ -318,10 +346,15 @@ public final class SunPKCS11 extends AuthProvider {
+@@ -317,10 +345,15 @@ public final class SunPKCS11 extends AuthProvider {
              // request multithreaded access first
              initArgs.flags = CKF_OS_LOCKING_OK;
              PKCS11 tmpPKCS11;
@@ -1453,7 +1447,7 @@ index ffbd671246..bdaad67e06 100644
              } catch (PKCS11Exception e) {
                  if (debug != null) {
                      debug.println("Multi-threaded initialization failed: " + e);
-@@ -337,7 +370,7 @@ public final class SunPKCS11 extends AuthProvider {
+@@ -336,7 +369,7 @@ public final class SunPKCS11 extends AuthProvider {
                      initArgs.flags = 0;
                  }
                  tmpPKCS11 = PKCS11.getInstance(library,
@@ -1462,7 +1456,7 @@ index ffbd671246..bdaad67e06 100644
              }
              p11 = tmpPKCS11;
  
-@@ -377,6 +410,24 @@ public final class SunPKCS11 extends AuthProvider {
+@@ -376,6 +409,24 @@ public final class SunPKCS11 extends AuthProvider {
              if (nssModule != null) {
                  nssModule.setProvider(this);
              }
@@ -1488,7 +1482,7 @@ index ffbd671246..bdaad67e06 100644
              if (config.getHandleStartupErrors() == Config.ERR_IGNORE_ALL) {
                  throw new UnsupportedOperationException
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
-index 04a369f453..f033fe4759 100644
+index 04a369f453c..f033fe47593 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
 @@ -49,6 +49,7 @@ package sun.security.pkcs11.wrapper;

SOURCES/rh1648644-java_access_bridge_privileged_security.patch

@@ -0,0 +1,20 @@
+--- openjdk/src/java.base/share/conf/security/java.security
++++ openjdk/src/java.base/share/conf/security/java.security
+@@ -304,6 +304,8 @@
+ #
+ package.access=sun.misc.,\
+                sun.reflect.,\
++               org.GNOME.Accessibility.,\
++               org.GNOME.Bonobo.,\
+ 
+ #
+ # List of comma-separated packages that start with or equal this string
+@@ -316,6 +318,8 @@
+ #
+ package.definition=sun.misc.,\
+                    sun.reflect.,\
++                   org.GNOME.Accessibility.,\
++                   org.GNOME.Bonobo.,\
+ 
+ #
+ # Determines whether this properties file can be appended to

SOURCES/rh1750419-redhat_alt_java.patch

@@ -1,8 +1,7 @@
-diff --git openjdk.orig/make/launcher/Launcher-java.base.gmk openjdk/make/launcher/Launcher-java.base.gmk
-index a8990dd0ef..320fec6e51 100644
---- openjdk.orig/make/launcher/Launcher-java.base.gmk
-+++ openjdk/make/launcher/Launcher-java.base.gmk
-@@ -41,6 +41,16 @@ $(eval $(call SetupBuildLauncher, java, \
+diff -r 1356affa5e44 make/launcher/Launcher-java.base.gmk
+--- openjdk/make/launcher/Launcher-java.base.gmk      Wed Nov 25 08:27:15 2020 +0100
++++ openjdk/make/launcher/Launcher-java.base.gmk      Tue Dec 01 12:29:30 2020 +0100
+@@ -41,6 +41,16 @@
      OPTIMIZATION := HIGH, \
  ))
  
@@ -16,14 +15,13 @@ index a8990dd0ef..320fec6e51 100644
 +    OPTIMIZATION := HIGH, \
 +))
 +
- ifeq ($(call isTargetOs, windows), true)
+ ifeq ($(OPENJDK_TARGET_OS), windows)
    $(eval $(call SetupBuildLauncher, javaw, \
        CFLAGS := -DJAVAW -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES, \
-diff --git openjdk.orig/src/java.base/share/native/launcher/alt_main.h openjdk/src/java.base/share/native/launcher/alt_main.h
-new file mode 100644
-index 0000000000..697df2898a
---- /dev/null
-+++ openjdk/src/java.base/share/native/launcher/alt_main.h
+
+diff -r 25e94aa812b2 src/share/bin/alt_main.h
+--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
++++ openjdk/src/java.base/share/native/launcher/alt_main.h	Tue Jun 02 17:15:28 2020 +0100
 @@ -0,0 +1,73 @@
 +/*
 + * Copyright (c) 2019, Red Hat, Inc. All rights reserved.
@@ -98,10 +96,9 @@ index 0000000000..697df2898a
 +}
 +
 +#endif // REDHAT_ALT_JAVA
-diff --git openjdk.orig/src/java.base/share/native/launcher/main.c openjdk/src/java.base/share/native/launcher/main.c
-index b734fe2ba7..79dc830765 100644
---- openjdk.orig/src/java.base/share/native/launcher/main.c
-+++ openjdk/src/java.base/share/native/launcher/main.c
+diff -r 25e94aa812b2 src/share/bin/main.c
+--- openjdk/src/java.base/share/native/launcher/main.c	Wed Feb 05 12:20:36 2020 -0300
++++ openjdk/src/java.base/share/native/launcher/main.c	Tue Jun 02 17:15:28 2020 +0100
 @@ -34,6 +34,14 @@
  #include "jli_util.h"
  #include "jni.h"

SPECS/java-11-openjdk.spec

@@ -1,8 +1,3 @@
-# To rebuild this RPM, you must first rebuild the portable
-# RPM using the java-11-openjdk-portable.specfile, install
-# it and then adjust portablerelease and portablesuffix
-# to match the new portable.
-
 # RPM conditionals so as to be able to dynamically produce
 # slowdebug/release builds. See:
 # http://rpm.org/user_doc/conditional_builds.html
@@ -70,10 +65,14 @@
 # (initiated in https://bugzilla.redhat.com/show_bug.cgi?id=1482192)
 %global debug_suffix_unquoted -slowdebug
 %global fastdebug_suffix_unquoted -fastdebug
+%global main_suffix_unquoted -main
+%global staticlibs_suffix_unquoted -staticlibs
 # quoted one for shell operations
 %global debug_suffix "%{debug_suffix_unquoted}"
 %global fastdebug_suffix "%{fastdebug_suffix_unquoted}"
 %global normal_suffix ""
+%global main_suffix "%{main_suffix_unquoted}"
+%global staticlibs_suffix "%{staticlibs_suffix_unquoted}"
 
 %global debug_warning This package is unoptimised with full debugging. Install only as needed and remove ASAP.
 %global fastdebug_warning This package is optimised with full debugging. Install only as needed and remove ASAP.
@@ -109,7 +108,8 @@
 # similarly for other %%{_jvmdir}/{jre,java} and %%{_javadocdir}/{java,java-zip}
 %define is_release_build() %( if [ "%{?1}" == "%{debug_suffix_unquoted}" -o "%{?1}" == "%{fastdebug_suffix_unquoted}" ]; then echo "0" ; else echo "1"; fi )
 
-# Indicates whether this is the default JDK on this version of RHEL
+# while JDK is a techpreview(is_system_jdk=0), some provides are turned off. Once jdk stops to be an techpreview, move it to 1
+# as sytem JDK, we mean any JDK which can run whole system java stack without issues (like bytecode issues, module issues, dependencies...)
 %global is_system_jdk 0
 
 %global aarch64         aarch64 arm64 armv8
@@ -146,8 +146,6 @@
 %global ssbd_arches x86_64
 # Set of architectures where we verify backtraces with gdb
 %global gdb_arches %{jit_arches} %{zero_arches}
-# Set of architectures for which we have a portable build
-%global portable_build_arches %{aarch64} %{ix86} %{power64} s390x x86_64
 
 # By default, we build a slowdebug build during main build on JIT architectures
 %if %{with slowdebug}
@@ -205,6 +203,12 @@
 # Build and test slowdebug first as it provides the best diagnostics
 %global build_loop %{slowdebug_build} %{fastdebug_build} %{normal_build}
 
+%if %{include_staticlibs}
+%global staticlibs_loop %{staticlibs_suffix}
+%else
+%global staticlibs_loop %{nil}
+%endif
+
 %if 0%{?flatpak}
 %global bootstrap_build false
 %else
@@ -239,9 +243,6 @@
 # JDK to use for bootstrapping
 %global bootjdk /usr/lib/jvm/java-%{buildjdkver}-openjdk
 
-# debugedit tool for rewriting ELF file paths
-%global debugedit %{_rpmconfigdir}/debugedit
-
 # Disable LTO as this causes build failures at the moment.
 # See RHBZ#1861401
 %define _lto_cflags %{nil}
@@ -330,7 +331,7 @@
 # New Version-String scheme-style defines
 %global featurever 11
 %global interimver 0
-%global updatever 23
+%global updatever 18
 %global patchver 0
 # buildjdkver is usually same as %%{featurever},
 # but in time of bootstrap of next jdk, it is featurever-1,
@@ -358,39 +359,26 @@
 %global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=%{name}&version=%{fedora}
 %else
 %if 0%{?rhel}
-%global oj_vendor_bug_url https://access.redhat.com/support/cases/
+%global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi?product=Red%20Hat%20Enterprise%20Linux%20%{rhel}&component=%{name}
 %else
 %global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi
 %endif
 %endif
 %endif
-%global oj_vendor_version (Red_Hat-%{version}-%{portablerelease})
+%global oj_vendor_version (Red_Hat-%{version}-%{release})
 
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      6.0.0pre00-c848b93a8598
 # Define current Git revision for the FIPS support patches
-%global fipsver f93a863b56
-# Define JDK versions
-%global javaver         %{featurever}
-%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
-# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames
-%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn})
-# The tag used to create the OpenJDK tarball
-%global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}
+%global fipsver 9087e80d0ab
 
 # Standard JPackage naming and versioning defines
 %global origin          openjdk
 %global origin_nice     OpenJDK
-%global top_level_dir_name   %{vcstag}
+%global top_level_dir_name   %{origin}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        9
-# rpmrelease numbering must start at 2 to be later than the 8.6 RPM
+%global buildver        10
 %global rpmrelease      3
-# Settings used by the portable build
-%global portablerelease 2
-%global portablesuffix el8
-%global portablebuilddir /builddir/build/BUILD
-
 #%%global tagsuffix     %%{nil}
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
@@ -401,9 +389,18 @@
 %global combiver $( expr 20 '*' %{patchver} + %{buildver} )
 %global priority %( printf '%02d%02d%02d%02d' %{featurever} %{interimver} %{updatever} %{combiver} )
 %else
-# for non-default, using 1, so slowdebugs can have 0
+# for techpreview, using 1, so slowdebugs can have 0
 %global priority %( printf '%08d' 1 )
 %endif
+%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
+
+# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames
+%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn})
+
+# The tag used to create the OpenJDK tarball
+%global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}
+
+%global javaver         %{featurever}
 
 # Define milestone (EA for pre-releases, GA for releases)
 # Release will be (where N is usually a number starting at 1):
@@ -429,6 +426,7 @@
 %global jdkimage                jdk
 %global static_libs_image       static-libs
 # output dir stub
+%define buildoutputdir() %{expand:build/jdk%{featurever}.build%{?1}}
 %define installoutputdir() %{expand:install/jdk%{featurever}.install%{?1}}
 # we can copy the javadoc to not arched dir, or make it not noarch
 %define uniquejavadocdir()    %{expand:%{fullversion}.%{_arch}%{?1}}
@@ -455,6 +453,7 @@
 %global __requires_exclude ^(%{_privatelibs}|%{_publiclibs})$
 %endif
 
+
 %global etcjavasubdir     %{_sysconfdir}/java/java-%{javaver}-%{origin}
 %define etcjavadir()      %{expand:%{etcjavasubdir}/%{uniquesuffix -- %{?1}}}
 # Standard JPackage directories and symbolic links.
@@ -562,7 +561,6 @@ alternatives \\
   --install %{_bindir}/java $key %{jrebindir -- %{?1}}/java $PRIORITY  --family %{family} \\
   --slave %{_jvmdir}/jre jre %{_jvmdir}/%{sdkdir -- %{?1}} \\
   --slave %{_bindir}/%{alt_java_name} %{alt_java_name} %{jrebindir -- %{?1}}/%{alt_java_name} \\
-  --slave %{_bindir}/jcmd jcmd %{sdkbindir -- %{?1}}/jcmd \\
   --slave %{_bindir}/jjs jjs %{jrebindir -- %{?1}}/jjs \\
   --slave %{_bindir}/keytool keytool %{jrebindir -- %{?1}}/keytool \\
   --slave %{_bindir}/pack200 pack200 %{jrebindir -- %{?1}}/pack200 \\
@@ -573,8 +571,6 @@ alternatives \\
   %{_mandir}/man1/java-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/%{alt_java_name}.1$ext %{alt_java_name}.1$ext \\
   %{_mandir}/man1/%{alt_java_name}-%{uniquesuffix -- %{?1}}.1$ext \\
-  --slave %{_mandir}/man1/jcmd.1$ext jcmd.1$ext \\
-  %{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/jjs.1$ext jjs.1$ext \\
   %{_mandir}/man1/jjs-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/keytool.1$ext keytool.1$ext \\
@@ -674,6 +670,7 @@ alternatives \\
   --slave %{_bindir}/jarsigner jarsigner %{sdkbindir -- %{?1}}/jarsigner \\
   --slave %{_bindir}/javadoc javadoc %{sdkbindir -- %{?1}}/javadoc \\
   --slave %{_bindir}/javap javap %{sdkbindir -- %{?1}}/javap \\
+  --slave %{_bindir}/jcmd jcmd %{sdkbindir -- %{?1}}/jcmd \\
   --slave %{_bindir}/jconsole jconsole %{sdkbindir -- %{?1}}/jconsole \\
   --slave %{_bindir}/jdb jdb %{sdkbindir -- %{?1}}/jdb \\
   --slave %{_bindir}/jdeps jdeps %{sdkbindir -- %{?1}}/jdeps \\
@@ -700,6 +697,8 @@ alternatives \\
   %{_mandir}/man1/javadoc-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/javap.1$ext javap.1$ext \\
   %{_mandir}/man1/javap-%{uniquesuffix -- %{?1}}.1$ext \\
+  --slave %{_mandir}/man1/jcmd.1$ext jcmd.1$ext \\
+  %{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/jconsole.1$ext jconsole.1$ext \\
   %{_mandir}/man1/jconsole-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/jdb.1$ext jdb.1$ext \\
@@ -827,8 +826,6 @@ exit 0
 %define files_jre_headless() %{expand:
 %license %{_jvmdir}/%{sdkdir -- %{?1}}/legal
 %doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/NEWS
-%doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/README.md
-%doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/java-%{featurever}-openjdk-portable.specfile
 %dir %{_sysconfdir}/.java/.systemPrefs
 %dir %{_sysconfdir}/.java
 %dir %{_jvmdir}/%{sdkdir -- %{?1}}
@@ -837,7 +834,6 @@ exit 0
 %dir %{_jvmdir}/%{sdkdir -- %{?1}}/bin
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/java
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/%{alt_java_name}
-%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jcmd
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jjs
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/keytool
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/pack200
@@ -904,7 +900,6 @@ exit 0
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/jfr/profile.jfc
 %{_mandir}/man1/java-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/%{alt_java_name}-%{uniquesuffix -- %{?1}}.1*
-%{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jjs-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/keytool-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/pack200-%{uniquesuffix -- %{?1}}.1*
@@ -950,11 +945,10 @@ exit 0
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/security
 %if %is_system_jdk
 %if %{is_release_build -- %{?1}}
-# RHEL-11313; alternatives not owned by packages
 %ghost %{_bindir}/java
-%ghost %{_jvmdir}/jre
 %ghost %{_bindir}/%{alt_java_name}
-%ghost %{_bindir}/jcmd
+%ghost %{_jvmdir}/jre
+# https://bugzilla.redhat.com/show_bug.cgi?id=1312019
 %ghost %{_bindir}/jjs
 %ghost %{_bindir}/keytool
 %ghost %{_bindir}/pack200
@@ -980,6 +974,7 @@ exit 0
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/javadoc
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/javap
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jconsole
+%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jcmd
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jdb
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jdeps
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jdeprscan
@@ -1018,6 +1013,7 @@ exit 0
 %{_mandir}/man1/javadoc-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/javap-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jconsole-%{uniquesuffix -- %{?1}}.1*
+%{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jdb-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jdeps-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jinfo-%{uniquesuffix -- %{?1}}.1*
@@ -1037,9 +1033,9 @@ exit 0
 %endif
 %if %is_system_jdk
 %if %{is_release_build -- %{?1}}
-# RHEL-11313; alternatives not owned by packages
 %ghost %{_bindir}/javac
 %ghost %{_jvmdir}/java
+%ghost %{_jvmdir}/%{alt_java_name}
 %ghost %{_bindir}/jaotc
 %ghost %{_bindir}/jlink
 %ghost %{_bindir}/jmod
@@ -1048,11 +1044,11 @@ exit 0
 %ghost %{_bindir}/jarsigner
 %ghost %{_bindir}/javadoc
 %ghost %{_bindir}/javap
+%ghost %{_bindir}/jcmd
 %ghost %{_bindir}/jconsole
 %ghost %{_bindir}/jdb
 %ghost %{_bindir}/jdeps
 %ghost %{_bindir}/jdeprscan
-%ghost %{_bindir}/jfr
 %ghost %{_bindir}/jimage
 %ghost %{_bindir}/jinfo
 %ghost %{_bindir}/jmap
@@ -1147,9 +1143,8 @@ Provides: jre%{?1} = %{epoch}:%{version}-%{release}
 Requires: ca-certificates
 # Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros
 Requires: javapackages-filesystem
-# 2024a required as of JDK-8325150
-# Use 2023d until 2024a is in the buildroot
-Requires: tzdata-java >= 2023d
+# 2022g required as of JDK-8297804
+Requires: tzdata-java >= 2022g
 # for support of kernel stream control
 # libsctp.so.1 is being `dlopen`ed on demand
 Requires: lksctp-tools%{?_isa}
@@ -1273,8 +1268,6 @@ Provides: java-%{origin}-src%{?1} = %{epoch}:%{version}-%{release}
 Name:    java-%{javaver}-%{origin}
 Version: %{newjavaver}.%{buildver}
 Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
-# Equivalent for the portable build
-%global prelease %{?eaprefix}%{portablerelease}%{?extraver}
 # java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons
 # and this change was brought into RHEL-4. java-1.5.0-ibm packages
 # also included the epoch in their virtual provides. This created a
@@ -1311,7 +1304,7 @@ URL:      http://openjdk.java.net/
 
 # to regenerate source0 (jdk) run update_package.sh
 # update_package.sh contains hard-coded repos, revisions, tags, and projects to regenerate the source archives
-Source0: openjdk-jdk%{featurever}u-%{vcstag}.tar.xz
+Source0: openjdk-jdk%{featurever}u-%{vcstag}-4curve.tar.xz
 
 # Use 'icedtea_sync.sh' to update the following
 # They are based on code contained in the IcedTea project (6.x).
@@ -1321,6 +1314,9 @@ Source8: tapsets-icedtea-%{icedteaver}.tar.xz
 # Desktop files. Adapted from IcedTea
 Source9: jconsole.desktop.in
 
+# Release notes
+Source10: NEWS
+
 # nss configuration file
 Source11: nss.cfg.in
 
@@ -1345,20 +1341,6 @@ Source17: nss.fips.cfg.in
 # Ensure translations are available for new timezones
 Source18: TestTranslations.java
 
-# Include portable spec and instructions on how to rebuild
-Source19: README.md
-Source20: java-%{featurever}-openjdk-portable.specfile
-
-# Setup variables to reference correct sources
-%global releasezip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.unstripped.jdk.%{_arch}.tar.xz
-%global staticlibzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.static-libs.%{_arch}.tar.xz
-%global docszip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.docs.%{_arch}.tar.xz
-%global misczip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.misc.%{_arch}.tar.xz
-%global slowdebugzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.slowdebug.jdk.%{_arch}.tar.xz
-%global slowdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.slowdebug.static-libs.%{_arch}.tar.xz
-%global fastdebugzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.fastdebug.jdk.%{_arch}.tar.xz
-%global fastdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.fastdebug.static-libs.%{_arch}.tar.xz
-
 ############################################
 #
 # RPM/distribution specific patches
@@ -1367,6 +1349,8 @@ Source20: java-%{featurever}-openjdk-portable.specfile
 
 # Ignore AWTError when assistive technologies are loaded
 Patch1:    rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
+# Restrict access to java-atk-wrapper classes
+Patch2:    rh1648644-java_access_bridge_privileged_security.patch
 # NSS via SunPKCS11 Provider (disabled due to memory leak).
 Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
 # RH1750419: enable build of speculative store bypass hardened alt-java (CVE-2018-3639)
@@ -1376,7 +1360,7 @@ Patch1003: rh1842572-rsa_default_for_keytool.patch
 
 # Crypto policy and FIPS support patches
 # Patch is generated from the fips tree at https://github.com/rh-openjdk/jdk11u/tree/fips
-# as follows: git diff %%{vcstag} src make test > fips-11u-$(git show -s --format=%h HEAD).patch
+# as follows: git diff %%{vcstag} src make > fips-11u-$(git show -s --format=%h HEAD).patch
 # Diff is limited to src and make subdirectories to exclude .github changes
 # Fixes currently included:
 # PR3694, RH1340845: Add security.useSystemPropertiesFile option to java.security to use system crypto policy
@@ -1413,6 +1397,7 @@ Patch1001: fips-11u-%{fipsver}.patch
 # be reviewed & pushed to the current development
 # tree of OpenJDK.
 #############################################
+
 Patch3:    rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
 
 #############################################
@@ -1424,14 +1409,13 @@ Patch3:    rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk1
 # need to be reviewed & pushed to the appropriate
 # updates tree of OpenJDK.
 #############################################
-Patch2002: jdk8242332-rh2108712-sha3-sunpkcs11.patch
 
 #############################################
 #
-# Patches appearing in 11.0.23
+# Patches appearing in 11.0.18
 #
 # This section includes patches which are present
-# in the listed OpenJDK 8u release and should be
+# in the listed OpenJDK 11u release and should be
 # able to be removed once that release is out
 # and used by this RPM.
 #############################################
@@ -1464,27 +1448,13 @@ BuildRequires: xorg-x11-proto-devel
 BuildRequires: zip
 BuildRequires: unzip
 BuildRequires: javapackages-filesystem
-%if %{include_normal_build}
-BuildRequires: java-%{featurever}-openjdk-portable-unstripped = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
-BuildRequires: java-%{featurever}-openjdk-portable-static-libs = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
-%endif
-%if %{include_fastdebug_build}
-BuildRequires: java-%{featurever}-openjdk-portable-devel-fastdebug = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
-BuildRequires: java-%{featurever}-openjdk-portable-static-libs-fastdebug = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
-%endif
-%if %{include_debug_build}
-BuildRequires: java-%{featurever}-openjdk-portable-devel-slowdebug = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
-BuildRequires: java-%{featurever}-openjdk-portable-static-libs-slowdebug = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
-%endif
-BuildRequires: java-%{featurever}-openjdk-portable-docs = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
-BuildRequires: java-%{featurever}-openjdk-portable-misc = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
+BuildRequires: java-%{buildjdkver}-openjdk-devel
 # Zero-assembler build requirement
 %ifarch %{zero_arches}
 BuildRequires: libffi-devel
 %endif
-# 2024a required as of JDK-8325150
-# Use 2023d until 2024a is in the buildroot
-BuildRequires: tzdata-java >= 2023d
+# 2022g required as of JDK-8297804
+BuildRequires: tzdata-java >= 2022g
 # Earlier versions have a bug in tree vectorization on PPC
 BuildRequires: gcc >= 4.8.3-8
 
@@ -1502,17 +1472,19 @@ BuildRequires: libjpeg-devel
 BuildRequires: libpng-devel
 %else
 # Version in src/java.desktop/share/native/libfreetype/include/freetype/freetype.h
-Provides: bundled(freetype) = 2.13.2
+Provides: bundled(freetype) = 2.12.1
 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
 Provides: bundled(giflib) = 5.2.1
 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h
-Provides: bundled(harfbuzz) = 8.2.2
+Provides: bundled(harfbuzz) = 4.4.1
 # Version in src/java.desktop/share/native/liblcms/lcms2.h
-Provides: bundled(lcms2) = 2.15.0
+Provides: bundled(lcms2) = 2.12.0
 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h
 Provides: bundled(libjpeg) = 6b
 # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h
-Provides: bundled(libpng) = 1.6.40
+Provides: bundled(libpng) = 1.6.37
+# We link statically against libstdc++ to increase portability
+BuildRequires: libstdc++-static
 %endif
 
 # this is always built, also during debug-only build
@@ -1859,19 +1831,45 @@ sh %{SOURCE12} %{top_level_dir_name}
 # Patch the JDK
 pushd %{top_level_dir_name}
 %patch1 -p1
+%patch2 -p1
 %patch3 -p1
 # Add crypto policy and FIPS support
 %patch1001 -p1
 # nss.cfg PKCS11 support; must come last as it also alters java.security
 %patch1000 -p1
-# PKCS11 SHA3 backport
-%patch2002 -p1
-# alt-java
-%patch600 -p1
-# RSA default
-%patch1003 -p1
 popd # openjdk
 
+%patch600
+%patch1003
+
+# Extract systemtap tapsets
+%if %{with_systemtap}
+tar --strip-components=1 -x -I xz -f %{SOURCE8}
+%if %{include_debug_build}
+cp -r tapset tapset%{debug_suffix}
+%endif
+%if %{include_fastdebug_build}
+cp -r tapset tapset%{fastdebug_suffix}
+%endif
+
+for suffix in %{build_loop} ; do
+  for file in "tapset"$suffix/*.in; do
+    OUTPUT_FILE=`echo $file | sed -e "s:\.stp\.in$:-%{version}-%{release}.%{_arch}.stp:g"`
+    sed -e "s:@ABS_SERVER_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/server/libjvm.so:g" $file > $file.1
+    sed -e "s:@JAVA_SPEC_VER@:%{javaver}:g" $file.1 > $file.2
+# TODO find out which architectures other than i686 have a client vm
+%ifarch %{ix86}
+    sed -e "s:@ABS_CLIENT_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/client/libjvm.so:g" $file.2 > $OUTPUT_FILE
+%else
+    sed -e "/@ABS_CLIENT_LIBJVM_SO@/d" $file.2 > $OUTPUT_FILE
+%endif
+    sed -i -e "s:@ABS_JAVA_HOME_DIR@:%{_jvmdir}/%{sdkdir -- $suffix}:g" $OUTPUT_FILE
+    sed -i -e "s:@INSTALL_ARCH_DIR@:%{archinstall}:g" $OUTPUT_FILE
+    sed -i -e "s:@prefix@:%{_jvmdir}/%{sdkdir -- $suffix}/:g" $OUTPUT_FILE
+  done
+done
+# systemtap tapsets ends
+%endif
 
 # Prepare desktop files
 # The _X_ syntax indicates variables that are replaced by make upstream
@@ -1897,12 +1895,161 @@ sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE11} > nss.cfg
 sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE17} > nss.fips.cfg
 
 %build
+# How many CPU's do we have?
+export NUM_PROC=%(/usr/bin/getconf _NPROCESSORS_ONLN 2> /dev/null || :)
+export NUM_PROC=${NUM_PROC:-1}
+%if 0%{?_smp_ncpus_max}
+# Honor %%_smp_ncpus_max
+[ ${NUM_PROC} -gt %{?_smp_ncpus_max} ] && export NUM_PROC=%{?_smp_ncpus_max}
+%endif
 
-function customisejdk() {
-    local imagepath=${1}
+%ifarch s390x sparc64 alpha %{power64} %{aarch64}
+export ARCH_DATA_MODEL=64
+%endif
+%ifarch alpha
+export CFLAGS="$CFLAGS -mieee"
+%endif
 
+# We use ourcppflags because the OpenJDK build seems to
+# pass EXTRA_CFLAGS to the HotSpot C++ compiler...
+EXTRA_CFLAGS="%ourcppflags -Wno-error"
+EXTRA_CPP_FLAGS="%ourcppflags"
+
+%ifarch %{power64} ppc
+# fix rpmlint warnings
+EXTRA_CFLAGS="$EXTRA_CFLAGS -fno-strict-aliasing"
+%endif
+%ifarch %{ix86}
+# Align stack boundary on x86_32
+EXTRA_CFLAGS="$(echo ${EXTRA_CFLAGS} | sed -e 's|-mstackrealign|-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4|')"
+EXTRA_CPP_FLAGS="$(echo ${EXTRA_CPP_FLAGS} | sed -e 's|-mstackrealign|-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4|')"
+%endif
+# Fixes annocheck warnings in assembler files due to missing build notes
+EXTRA_ASFLAGS="${EXTRA_CFLAGS} -Wa,--generate-missing-build-notes=yes"
+export EXTRA_CFLAGS EXTRA_CPP_FLAGS EXTRA_ASFLAGS
+
+function buildjdk() {
+    local outputdir=${1}
+    local buildjdk=${2}
+    local maketargets="${3}"
+    local debuglevel=${4}
+    local link_opt=${5}
+
+    local top_dir_abs_src_path=$(pwd)/%{top_level_dir_name}
+    local top_dir_abs_build_path=$(pwd)/${outputdir}
+
+    # This must be set using the global, so that the
+    # static libraries still use a dynamic stdc++lib
+    if [ "x%{link_type}" = "xbundled" ] ; then
+        libc_link_opt="static";
+    else
+        libc_link_opt="dynamic";
+    fi
+
+    echo "Using output directory: ${outputdir}";
+    echo "Checking build JDK ${buildjdk} is operational..."
+    ${buildjdk}/bin/java -version
+    echo "Using make targets: ${maketargets}"
+    echo "Using debuglevel: ${debuglevel}"
+    echo "Using link_opt: ${link_opt}"
+    echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}"
+
+    mkdir -p ${outputdir}
+    pushd ${outputdir}
+
+    # Note: zlib and freetype use %{link_type}
+    # rather than ${link_opt} as the system versions
+    # are always used in a system_libs build, even
+    # for the static library build
+    bash ${top_dir_abs_src_path}/configure \
+%ifarch %{zero_arches}
+    --with-jvm-variants=zero \
+%endif
+%ifarch %{ppc64le}
+    --with-jobs=1 \
+%endif
+    --with-version-build=%{buildver} \
+    --with-version-pre="%{ea_designator}" \
+    --with-version-opt=%{lts_designator} \
+    --with-vendor-version-string="%{oj_vendor_version}" \
+    --with-vendor-name="%{oj_vendor}" \
+    --with-vendor-url="%{oj_vendor_url}" \
+    --with-vendor-bug-url="%{oj_vendor_bug_url}" \
+    --with-vendor-vm-bug-url="%{oj_vendor_bug_url}" \
+    --with-boot-jdk=${buildjdk} \
+    --with-debug-level=${debuglevel} \
+    --with-native-debug-symbols="%{debug_symbols}" \
+    --disable-sysconf-nss \
+    --enable-unlimited-crypto \
+    --with-zlib=%{link_type} \
+    --with-freetype=%{link_type} \
+    --with-libjpeg=${link_opt} \
+    --with-giflib=${link_opt} \
+    --with-libpng=${link_opt} \
+    --with-lcms=${link_opt} \
+    --with-harfbuzz=${link_opt} \
+    --with-stdc++lib=${libc_link_opt} \
+    --with-extra-cxxflags="$EXTRA_CPP_FLAGS" \
+    --with-extra-cflags="$EXTRA_CFLAGS" \
+    --with-extra-asflags="$EXTRA_ASFLAGS" \
+    --with-extra-ldflags="%{ourldflags}" \
+    --with-num-cores="$NUM_PROC" \
+    --disable-javac-server \
+    --with-jvm-features="%{shenandoah_feature},%{zgc_feature}" \
+    --disable-warnings-as-errors
+
+    cat spec.gmk
+
+    make \
+      JAVAC_FLAGS=-g \
+      LOG=trace \
+      WARNINGS_ARE_ERRORS="-Wno-error" \
+      CFLAGS_WARNINGS_ARE_ERRORS="-Wno-error" \
+      $maketargets || ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name "hs_err_pid*.log" | xargs cat && false )
+
+    popd
+}
+
+function installjdk() {
+    local outputdir=${1}
+    local installdir=${2}
+    local imagepath=${installdir}/images/%{jdkimage}
+
+    echo "Installing build from ${outputdir} to ${installdir}..."
+    mkdir -p ${installdir}
+    echo "Installing images..."
+    mv ${outputdir}/images ${installdir}
+    if [ -d ${outputdir}/bundles ] ; then
+	echo "Installing bundles...";
+	mv ${outputdir}/bundles ${installdir} ;
+    fi
+    if [ -d ${outputdir}/docs ] ; then
+	echo "Installing docs...";
+	mv ${outputdir}/docs ${installdir} ;
+    fi
+
+%if !%{with artifacts}
+    echo "Removing output directory...";
+    rm -rf ${outputdir}
+%endif
 
     if [ -d ${imagepath} ] ; then
+	# the build (erroneously) removes read permissions from some jars
+	# this is a regression in OpenJDK 7 (our compiler):
+	# http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=1437
+	find ${imagepath} -iname '*.jar' -exec chmod ugo+r {} \;
+
+	# Build screws up permissions on binaries
+	# https://bugs.openjdk.java.net/browse/JDK-8173610
+	find ${imagepath} -iname '*.so' -exec chmod +x {} \;
+	find ${imagepath}/bin/ -exec chmod +x {} \;
+
+	# Install nss.cfg right away as we will be using the JRE above
+	install -m 644 nss.cfg ${imagepath}/conf/security/
+
+	# Install nss.fips.cfg: NSS configuration for global FIPS mode (crypto-policies)
+	install -m 644 nss.fips.cfg ${imagepath}/conf/security/
+
 	# Turn on system security properties
 	sed -i -e "s:^security.useSystemPropertiesFile=.*:security.useSystemPropertiesFile=true:" \
 	    ${imagepath}/conf/security/java.security
@@ -1910,68 +2057,91 @@ function customisejdk() {
 	# Use system-wide tzdata
 	rm ${imagepath}/lib/tzdb.dat
 	ln -s %{_datadir}/javazi-1.8/tzdb.dat ${imagepath}/lib/tzdb.dat
+
+	# Create fake alt-java as a placeholder for future alt-java
+	pushd ${imagepath}
+	# add alt-java man page
+	echo "Hardened java binary recommended for launching untrusted code from the Web e.g. javaws" > man/man1/%{alt_java_name}.1
+	cat man/man1/java.1 >> man/man1/%{alt_java_name}.1
+	popd
+
+	# Print release information
+	cat ${imagepath}/release
+
     fi
 }
 
-mkdir -p $(dirname %{installoutputdir})
-
-docdir=%{installoutputdir -- "-docs"}
-tar -xJf %{docszip}
-mv java-%{featurever}-openjdk*.docs.* ${docdir}
-
-miscdir=%{installoutputdir -- "-misc"}
-tar -xJf %{misczip}
-mv java-%{featurever}-openjdk*.misc.* ${miscdir}
+%if %{build_hotspot_first}
+  # Build a fresh libjvm.so first and use it to bootstrap
+  cp -LR --preserve=mode,timestamps %{bootjdk} newboot
+  systemjdk=$(pwd)/newboot
+  buildjdk build/newboot ${systemjdk} %{hotspot_target} "release" "bundled"
+  mv build/newboot/jdk/lib/server/libjvm.so newboot/lib/server
+%else
+  systemjdk=%{bootjdk}
+%endif
 
 for suffix in %{build_loop} ; do
 
   if [ "x$suffix" = "x" ] ; then
-      jdkzip=%{releasezip}
-      staticlibzip=%{staticlibzip}
-  elif [ "x$suffix" = "x%{fastdebug_suffix_unquoted}" ] ; then
-      jdkzip=%{fastdebugzip}
-      staticlibzip=%{fastdebugstaticlibzip}
-  else # slowdebug
-      jdkzip=%{slowdebugzip}
-      staticlibzip=%{slowdebugstaticlibzip}
+      debugbuild=release
+  else
+      # change --something to something
+      debugbuild=`echo $suffix  | sed "s/-//g"`
   fi
 
-  installdir=%{installoutputdir -- ${suffix}}
 
-  # TODO: should verify checksums when using packages from buildroot
-  tar -xJf ${jdkzip}
-  tar -xJf ${staticlibzip}
-  mv java-%{featurever}-openjdk* ${installdir}
+  for loop in %{main_suffix} %{staticlibs_loop} ; do
 
-  # Fix build paths in ELF files so it looks like we built them
-  portablenvr="%{name}-%{VERSION}-%{prelease}.%{portablesuffix}.%{_arch}"
-  for file in $(find ${installdir} -type f) ; do
-      if file ${file} | grep -q 'ELF'; then
-          %{debugedit} -b %{portablebuilddir}/${portablenvr} -d $(pwd) -n ${file}
+    builddir=%{buildoutputdir -- ${suffix}${loop}}
+    bootbuilddir=boot${builddir}
+    installdir=%{installoutputdir -- ${suffix}${loop}}
+    bootinstalldir=boot${installdir}
+
+    if test "x${loop}" = "x%{main_suffix}" ; then
+      link_opt="%{link_type}"
+%if %{system_libs}
+      # Copy the source tree so we can remove all in-tree libraries
+      cp -a %{top_level_dir_name} %{top_level_dir_name_backup}
+      # Remove all libraries that are linked
+      sh %{SOURCE12} %{top_level_dir_name} full
+%endif
+      # Debug builds don't need same targets as release for
+      # build speed-up. We also avoid bootstrapping these
+      # slower builds.
+      if echo $debugbuild | grep -q "debug" ; then
+        maketargets="%{debug_targets}"
+        run_bootstrap=false
+      else
+        maketargets="%{release_targets}"
+        run_bootstrap=%{bootstrap_build}
       fi
-  done
-
-  # Set tapset variables to match this build
-%if %{with_systemtap}
-  for file in ${miscdir}/tapset${suffix}/*.in; do
-    OUTPUT_FILE=`echo $file | sed -e "s:\.stp\.in$:-%{version}-%{release}.%{_arch}.stp:g"`
-    sed -e "s:@ABS_SERVER_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/server/libjvm.so:g" $file > ${OUTPUT_FILE}
-# TODO find out which architectures other than i686 have a client vm
-%ifarch %{ix86}
-    sed -i -e "s:@ABS_CLIENT_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/client/libjvm.so:g" ${OUTPUT_FILE}
-%else
-    sed -i -e "/@ABS_CLIENT_LIBJVM_SO@/d" ${OUTPUT_FILE}
-%endif
-    sed -i -e "s:@ABS_JAVA_HOME_DIR@:%{_jvmdir}/%{sdkdir -- $suffix}:g" $OUTPUT_FILE
-    sed -i -e "s:@prefix@:%{_jvmdir}/%{sdkdir -- $suffix}/:g" $OUTPUT_FILE
-  done
+      if ${run_bootstrap} ; then
+          buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild} ${link_opt}
+          installjdk ${bootbuilddir} ${bootinstalldir}
+          buildjdk ${builddir} $(pwd)/${bootinstalldir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt}
+          installjdk ${builddir} ${installdir}
+          %{!?with_artifacts:rm -rf ${bootinstalldir}}
+      else
+          buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt}
+          installjdk ${builddir} ${installdir}
+      fi
+%if %{system_libs}
+      # Restore original source tree we modified by removing full in-tree sources
+      rm -rf %{top_level_dir_name}
+      mv %{top_level_dir_name_backup} %{top_level_dir_name}
 %endif
+    else
+      # Use bundled libraries for building statically
+      link_opt="bundled"
+      # Static library cycle only builds the static libraries
+      maketargets="%{static_libs_target}"
+      # Always just do the one build for the static libraries
+      buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt}
+      installjdk ${builddir} ${installdir}
+    fi
 
-  # Final setup on the main image
-  customisejdk ${installdir}
-
-  # Print release information
-  cat ${installdir}/release
+  done # end of main / staticlibs loop
 
 # build cycles
 done # end of release / debug cycle loop
@@ -1981,11 +2151,16 @@ done # end of release / debug cycle loop
 # We test debug first as it will give better diagnostics on a crash
 for suffix in %{build_loop} ; do
 
-export JAVA_HOME=$(pwd)/%{installoutputdir -- ${suffix}}
+top_dir_abs_main_build_path=$(pwd)/%{installoutputdir -- ${suffix}%{main_suffix}}
+%if %{include_staticlibs}
+top_dir_abs_staticlibs_build_path=$(pwd)/%{installoutputdir -- ${suffix}%{staticlibs_loop}}
+%endif
 
-# Check Shenandoah is enabled
+export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage}
+
+#check Shenandoah is enabled
 %if %{use_shenandoah_hotspot}
-$JAVA_HOME/bin/java -XX:+UseShenandoahGC -version
+$JAVA_HOME//bin/java -XX:+UseShenandoahGC -version
 %endif
 
 # Check unlimited policy has been used
@@ -2026,9 +2201,9 @@ $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|
 
 %if %{include_staticlibs}
 # Check debug symbols in static libraries (smoke test)
-export STATIC_LIBS_HOME=${JAVA_HOME}/lib/static/linux-%{archinstall}/glibc
-readelf --debug-dump $STATIC_LIBS_HOME/libfdlibm.a | grep w_remainder.c
-readelf --debug-dump $STATIC_LIBS_HOME/libfdlibm.a | grep e_remainder.c
+export STATIC_LIBS_HOME=${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image}
+readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep w_remainder.c
+readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep e_remainder.c
 %endif
 
 so_suffix="so"
@@ -2118,25 +2293,23 @@ STRIP_KEEP_SYMTAB=libjvm*
 
 for suffix in %{build_loop} ; do
 
-jdk_image=$(pwd)/%{installoutputdir -- ${suffix}}
-# Should match same definitions in build section
-docdir=$(pwd)/%{installoutputdir -- "-docs"}
-miscdir=$(pwd)/%{installoutputdir -- "-misc"}
-
-# Install release notes and rebuild instructions
-commondocdir=${RPM_BUILD_ROOT}%{_defaultdocdir}/%{uniquejavadocdir -- $suffix}
-install -d -m 755 ${commondocdir}
-mv ${jdk_image}/NEWS ${commondocdir}
-cp -a %{SOURCE19} %{SOURCE20} ${commondocdir}
+top_dir_abs_main_build_path=$(pwd)/%{installoutputdir -- ${suffix}%{main_suffix}}
+%if %{include_staticlibs}
+top_dir_abs_staticlibs_build_path=$(pwd)/%{installoutputdir -- ${suffix}%{staticlibs_loop}}
+%endif
+jdk_image=${top_dir_abs_main_build_path}/images/%{jdkimage}
 
 # Install the jdk
 mkdir -p $RPM_BUILD_ROOT%{_jvmdir}
 cp -a ${jdk_image} $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}
 
+pushd ${jdk_image}
+
 %if %{with_systemtap}
   # Install systemtap support files
   install -dm 755 $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset
-  cp -a ${miscdir}/tapset$suffix/*.stp $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset/
+  # note, that uniquesuffix  is in BUILD dir in this case
+  cp -a $RPM_BUILD_DIR/%{uniquesuffix ""}/tapset$suffix/*.stp $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset/
   pushd  $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset/
    tapsetFiles=`ls *.stp`
   popd
@@ -2160,7 +2333,6 @@ cp -a ${jdk_image} $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}
   popd
 
   # Install man pages
-  pushd ${jdk_image}
   install -d -m 755 $RPM_BUILD_ROOT%{_mandir}/man1
   for manpage in man/man1/*
   do
@@ -2172,26 +2344,37 @@ cp -a ${jdk_image} $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}
   done
   # Remove man pages from jdk image
   rm -rf $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/man
-  popd
+
+popd
+# Install static libs artefacts
+%if %{include_staticlibs}
+mkdir -p $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/lib/static/linux-%{archinstall}/glibc
+cp -a ${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image}/lib/*.a \
+  $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/lib/static/linux-%{archinstall}/glibc
+%endif
 
 if ! echo $suffix | grep -q "debug" ; then
   # Install Javadoc documentation
   install -d -m 755 $RPM_BUILD_ROOT%{_javadocdir}
-    cp -a ${docdir}/docs $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}
+  cp -a ${top_dir_abs_main_build_path}/images/docs $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}
   built_doc_archive=jdk-%{filever}%{ea_designator_zip}+%{buildver}%{lts_designator_zip}-docs.zip
-    cp -a ${docdir}/${built_doc_archive} \
-        $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip
+  cp -a ${top_dir_abs_main_build_path}/bundles/${built_doc_archive} \
+     $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip || ls -l ${top_dir_abs_main_build_path}/bundles/
 fi
 
+# Install release notes
+commondocdir=${RPM_BUILD_ROOT}%{_defaultdocdir}/%{uniquejavadocdir -- $suffix}
+install -d -m 755 ${commondocdir}
+cp -a %{SOURCE10} ${commondocdir}
+
 # Install icons and menu entries
 for s in 16 24 32 48 ; do
   install -D -p -m 644 \
-    ${miscdir}/java-icon${s}.png \
+    %{top_level_dir_name}/src/java.desktop/unix/classes/sun/awt/X11/java-icon${s}.png \
     $RPM_BUILD_ROOT%{_datadir}/icons/hicolor/${s}x${s}/apps/java-%{javaver}-%{origin}.png
 done
 
 # Install desktop files
-# TODO: provide desktop files via portable
 install -d -m 755 $RPM_BUILD_ROOT%{_datadir}/{applications,pixmaps}
 for e in jconsole$suffix ; do
     desktop-file-install --vendor=%{uniquesuffix -- $suffix} --mode=644 \
@@ -2203,7 +2386,8 @@ done
 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/.java/.systemPrefs
 
 # copy samples next to demos; samples are mostly js files
-cp -r ${miscdir}/sample  $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix}/
+cp -r %{top_level_dir_name}/src/sample  $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix}/
+
 
 # moving config files to /etc
 mkdir -p $RPM_BUILD_ROOT/%{etcjavadir -- $suffix}
@@ -2492,127 +2676,6 @@ end
 %endif
 
 %changelog
-* Thu Apr 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.23.0.9-2
-- Fix 11.0.22 release date in NEWS
-
-* Wed Apr 10 2024 Anton Bobrov <abobrov@redhat.com> - 1:11.0.23.0.9-1
-- Update to jdk-11.0.23+9 (GA)
-- Update release notes to 11.0.23+9
-- Switch to GA mode for release
-- Require tzdata 2024a due to upstream inclusion of JDK-8322725
-- Only require tzdata 2023d for now as 2024a is unavailable in buildroot
-- ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
-- Resolves: RHEL-30917
-
-* Thu Mar 28 2024 Anton Bobrov <abobrov@redhat.com> - 1:11.0.23.0.1-0.1.ea
-- Update to jdk-11.0.23+1 (EA)
-- Update release notes to 11.0.23+1
-- Switch to EA mode
-
-* Wed Jan 10 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.22.0.7-1
-- Update to jdk-11.0.22+7 (GA)
-- Sync the copy of the portable specfile with the latest update
-- Drop local copy of JDK-8312489 which is now included upstream
-- ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
-- Resolves: RHEL-20981
-
-* Fri Oct 13 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.21.0.9-2
-- Update to jdk-11.0.21+9 (GA)
-- Sync the copy of the portable specfile with the latest update
-- Re-generate FIPS patch against 11.0.21+1 following backport of JDK-8155246
-- Re-generate SHA3 patch following backport of JDK-8242151
-- Bump libpng version to 1.6.39 following JDK-8305815
-- Bump HarfBuzz version to 7.2.0 following JDK-8307301
-- Bump freetype version to 2.13.0 following JDK-8306881
-- Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
-- Update bug URL for RHEL to point to the Red Hat customer portal
-- Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
-- Apply all patches using -p1
-- Drop local backport of JDK-8243210 which is upstream from 11.0.21+2
-- Add missing JFR alternative ghost
-- Move jcmd to the headless package
-- ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
-- Resolves: RHEL-12222
-- Resolves: RHEL-13546
-- Resolves: RHEL-13553
-- Resolves: RHEL-13559
-- Resolves: RHEL-13566
-- Resolves: RHEL-13572
-
-* Fri Sep 08 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.1.1-2
-- Bump release number so we are newer than 8.6
-- Related: rhbz#2236589
-
-* Tue Sep 05 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.1.1-1
-- Update to jdk-11.0.20.1+1 (GA)
-- Add backport of JDK-8312489 already upstream in 11.0.22 (see OPENJDK-2095)
-- Add backport of JDK-8243210 already upstream in 11.0.21 (see RH2229269)
-- Update openjdk_news script to specify subdirectory last
-- Add missing discover_trees script required by openjdk_news
-- Resolves: rhbz#2236589
-
-* Thu Jul 20 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.8-3
-- Fix tzdata requirement copy-and-paste error that led to two BuildRequires and no Requires
-- Resolves: rhbz#2224411
-
-* Sat Jul 15 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.8-2
-- Sync the copy of the portable specfile with the latest update
-- Add note at top of spec file about rebuilding
-- Related: rhbz#2221106
-
-* Fri Jul 14 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.20.0.8-1
-- Update to jdk-11.0.20.0+8 (GA)
-- Update release notes to 11.0.20.0+8
-- Drop local inclusion of JDK-8274864 & JDK-8305113 as they are included in 11.0.20+1
-- Bump tzdata requirement to 2023c now it is available in the buildroot
-- Bump bundled LCMS version to 2.15 as in jdk-11.0.20+1.
-- Bump bundled HarfBuzz version to 7.0.1 as in jdk-11.0.20+7
-- Use tapsets from the misc tarball
-- Introduce 'prelease' for the portable release versioning, to handle EA builds
-- Make sure root installation directory is created first
-- Use in-place substitution for all but the first of the tapset changes
-- ** This tarball is embargoed until 2023-07-18 @ 1pm PT. **
-- Resolves: rhbz#2217713
-- Resolves: rhbz#2196318
-- Resolves: rhbz#2221106
-
-* Wed Apr 26 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.19.0.7-4
-- Include the java-11-openjdk-portable.spec file with instructions on how to rebuild.
-- Related: rhbz#2189327
-
-* Wed Apr 26 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.19.0.7-3
-- Adjust oj_vendor_version to match the portable so test passes
-- Related: rhbz#2189327
-
-* Wed Apr 26 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.19.0.7-3
-- Revert "Restore native build for x86 as there is no portable build"
-- Reintroduce useful cleanups from x86 reversion
-- Related: rhbz#2189327
-
-* Wed Apr 26 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.19.0.7-2
-- Update to jdk-11.0.19.0+7
-- Update release notes to 11.0.19.0+7
-- Require tzdata 2023c due to local inclusion of JDK-8274864 & JDK-8305113
-- Reintroduce generate_source_tarball.sh from RHEL 9
-- Update generate_tarball.sh to add support for passing a boot JDK to the configure run
-- Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
-- Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
-- Rebase FIPS support against 11.0.19+6
-- Rebase RH1750419 alt-java patch against 11.0.19+6
-- Replace local copies of JDK portable binaries with build dependencies
-- Use portable build on x86_32 now one is available
-- ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
-- Resolves: rhbz#2185182
-- Resolves: rhbz#2189327
-
-* Tue Feb 28 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.10-4
-- On portable architectures, replace build section with extraction of existing builds from portables
-- Rewrite ELF files so the source file path is correct and debugsources can be assembled
-- Backport SHA-3 support for PKCS11 provider
-- Sync patch set with portable build we are using by removing rh1648644-java_access_bridge_privileged_security.patch
-- Resolves: rhbz#2150204
-- Resolves: rhbz#2108712
-
 * Wed Jan 11 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.18.0.10-3
 - Update to jdk-11.0.18+10 (GA)
 - Update release notes to 11.0.18+10