Update to jdk-17.0.8.1+1 (GA)

Update release notes to 17.0.8.1+1
Add backport of JDK-8312489 already upstream in 17.0.10 (see OPENJDK-2095)
Update openjdk_news script to specify subdirectory last
Add missing discover_trees script required by openjdk_news
Synchronise runtime and buildtime tzdata requirements

Resolves: RHEL-35288

.gitignore

@@ -57,3 +57,4 @@
 /openjdk-jdk17u-jdk-17.0.8+1.tar.xz
 /openjdk-jdk17u-jdk-17.0.8+6.tar.xz
 /openjdk-jdk17u-jdk-17.0.8+7.tar.xz
+/openjdk-jdk17u-jdk-17.0.8.1+1.tar.xz

discover_trees.sh

@@ -0,0 +1,54 @@
+#!/bin/sh
+
+# Copyright (C) 2020 Red Hat, Inc.
+# Written by Andrew John Hughes <gnu.andrew@redhat.com>.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+TREE=${1}
+
+if test "x${TREE}" = "x"; then
+    TREE=${PWD}
+fi
+
+if [ -e ${TREE}/nashorn/.hg -o -e ${TREE}/nashorn/merge.changeset ] ; then
+    NASHORN="nashorn" ;
+fi
+
+if [ -e ${TREE}/corba/.hg -o -e ${TREE}/corba/merge.changeset ] ; then
+    CORBA="corba";
+fi
+
+if [ -e ${TREE}/jaxp/.hg -o -e ${TREE}/jaxp/merge.changeset ] ; then
+    JAXP="jaxp";
+fi
+
+if [ -e ${TREE}/jaxws/.hg -o -e ${TREE}/jaxws/merge.changeset ] ; then
+    JAXWS="jaxws";
+fi
+
+if [ -e ${TREE}/langtools/.hg -o -e ${TREE}/langtools/merge.changeset ] ; then
+    LANGTOOLS="langtools";
+fi
+
+if [ -e ${TREE}/jdk/.hg -o -e ${TREE}/jdk/merge.changeset ] ; then
+    JDK="jdk";
+fi
+
+if [ -e ${TREE}/hotspot/.hg -o -e ${TREE}/hotspot/merge.changeset ] ; then
+    HOTSPOT="hotspot";
+fi
+
+SUBTREES="${CORBA} ${JAXP} ${JAXWS} ${LANGTOOLS} ${NASHORN} ${JDK} ${HOTSPOT}";
+echo ${SUBTREES}

java-17-openjdk.spec

@@ -323,7 +323,7 @@
 %global featurever 17
 %global interimver 0
 %global updatever 8
-%global patchver 0
+%global patchver 1
 # buildjdkver is usually same as %%{featurever},
 # but in time of bootstrap of next jdk, it is featurever-1,
 # and this it is better to change it here, on single place
@@ -369,7 +369,8 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{origin}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        7
+%global buildver        1
+# rpmrelease numbering must start at 2 to be later than the 9.0 RPM
 %global rpmrelease      2
 # Settings used by the portable build
 %global portablerelease 1
@@ -1125,8 +1126,8 @@ Requires: ca-certificates
 # Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros
 Requires: javapackages-filesystem
 # Require zone-info data provided by tzdata-java sub-package
-# 2022g required as of JDK-8297804
+# 2023c required as of JDK-8305113
-Requires: tzdata-java >= 2022g
+Requires: tzdata-java >= 2023c
 # for support of kernel stream control
 # libsctp.so.1 is being `dlopen`ed on demand
 Requires: lksctp-tools%{?_isa}
@@ -1400,9 +1401,11 @@ Patch1001: fips-17u-%{fipsver}.patch
 
 #############################################
 #
-# OpenJDK patches targetted for 17.0.8
+# OpenJDK patches appearing in 17.0.10
 #
 #############################################
+# JDK-8312489, OJ2095: Increase jdk.jar.maxSignatureFileSize default which is too low for JARs such as WhiteSource/Mend unified agent jar
+Patch2000: jdk8312489-max_sig_default_increase.patch
 
 BuildRequires: autoconf
 BuildRequires: automake
@@ -1846,6 +1849,8 @@ pushd %{top_level_dir_name}
 %patch1001 -p1
 # nss.cfg PKCS11 support; must come last as it also alters java.security
 %patch1000 -p1
+# JDK-8312489 backport, coming in 17.0.10
+%patch2000 -p1
 popd # openjdk
 
 %patch600
@@ -2468,6 +2473,15 @@ require "copy_jdk_configs.lua"
 %endif
 
 %changelog
+* Mon Sep 04 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.8.1.1-2
+- Update to jdk-17.0.8.1+1 (GA)
+- Update release notes to 17.0.8.1+1
+- Add backport of JDK-8312489 already upstream in 17.0.10 (see OPENJDK-2095)
+- Update openjdk_news script to specify subdirectory last
+- Add missing discover_trees script required by openjdk_news
+- Synchronise runtime and buildtime tzdata requirements
+- Resolves: RHEL-35288
+
 * Fri Jul 14 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.8.0.7-2
 - Update to jdk-17.0.8+7 (GA)
 - Update release notes to 17.0.8+7

jdk8312489-max_sig_default_increase.patch

@@ -0,0 +1,50 @@
+commit 5b613e3ebed6c141146e743e64c894fe4f39421e
+Author: Andrew John Hughes <andrew@openjdk.org>
+Date:   Fri Sep 1 15:53:41 2023 +0000
+
+    8312489: Increase jdk.jar.maxSignatureFileSize default which is too low for JARs such as WhiteSource/Mend unified agent jar
+    
+    Backport-of: e47a84f23dd2608c6f5748093eefe301fb5bf750
+
+diff --git a/src/java.base/share/classes/java/util/jar/JarFile.java b/src/java.base/share/classes/java/util/jar/JarFile.java
+index bd538649a4f..70cf99504e4 100644
+--- a/src/java.base/share/classes/java/util/jar/JarFile.java
++++ b/src/java.base/share/classes/java/util/jar/JarFile.java
+@@ -803,7 +803,9 @@ private byte[] getBytes(ZipEntry ze) throws IOException {
+                 throw new IOException("Unsupported size: " + uncompressedSize +
+                         " for JarEntry " + ze.getName() +
+                         ". Allowed max size: " +
+-                        SignatureFileVerifier.MAX_SIG_FILE_SIZE + " bytes");
++                        SignatureFileVerifier.MAX_SIG_FILE_SIZE + " bytes. " +
++                        "You can use the jdk.jar.maxSignatureFileSize " +
++                        "system property to increase the default value.");
+             }
+             int len = (int)uncompressedSize;
+             int bytesRead;
+diff --git a/src/java.base/share/classes/sun/security/util/SignatureFileVerifier.java b/src/java.base/share/classes/sun/security/util/SignatureFileVerifier.java
+index 4ea9255ba0a..05acdcb9474 100644
+--- a/src/java.base/share/classes/sun/security/util/SignatureFileVerifier.java
++++ b/src/java.base/share/classes/sun/security/util/SignatureFileVerifier.java
+@@ -856,16 +856,16 @@ private static int initializeMaxSigFileSize() {
+          * the maximum allowed number of bytes for the signature-related files
+          * in a JAR file.
+          */
+-        Integer tmp = GetIntegerAction.privilegedGetProperty(
+-                "jdk.jar.maxSignatureFileSize", 8000000);
++        int tmp = GetIntegerAction.privilegedGetProperty(
++                "jdk.jar.maxSignatureFileSize", 16000000);
+         if (tmp < 0 || tmp > MAX_ARRAY_SIZE) {
+             if (debug != null) {
+-                debug.println("Default signature file size 8000000 bytes " +
+-                        "is used as the specified size for the " +
+-                        "jdk.jar.maxSignatureFileSize system property " +
++                debug.println("The default signature file size of 16000000 bytes " +
++                        "will be used for the jdk.jar.maxSignatureFileSize " +
++                        "system property since the specified value " +
+                         "is out of range: " + tmp);
+             }
+-            tmp = 8000000;
++            tmp = 16000000;
+         }
+         return tmp;
+     }

openjdk_news.sh

@@ -18,8 +18,8 @@
 
 OLD_RELEASE=$1
 NEW_RELEASE=$2
-SUBDIR=$3
+REPO=$3
-REPO=$4
+SUBDIR=$4
 SCRIPT_DIR=$(dirname ${0})
 
 if test "x${SUBDIR}" = "x"; then

sources

@@ -1,2 +1,2 @@
 SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
-SHA512 (openjdk-jdk17u-jdk-17.0.8+7.tar.xz) = 6bc6862ae1637b7da9bb5c729f91734d294ec3a137925ed5d39136b98a0aa5023f708bb3d6cd71bfaa5259b2a958987d7ae86ea95d2b0f3c45ffb36af8370ea3
+SHA512 (openjdk-jdk17u-jdk-17.0.8.1+1.tar.xz) = cd0bd2d3b54e99f8b05185999b106fef1de7331e7892baf261714307bb657327e3305ee95cfd978adadaf72dbb8862955d3845a8f3c5987055e61c605e24dbb1