From 6cd790a2b6bebeaae4a362d334ba45c367674050 Mon Sep 17 00:00:00 2001 From: Andrew Hughes Date: Tue, 29 Mar 2022 04:05:53 +0100 Subject: [PATCH] April 2022 security update to jdk 17.0.3+7 - Update release notes to 17.0.3.0+7 - Add JDK-8283911 to fix bad DEFAULT_PROMOTED_VERSION_PRE value - Add missing README.md and generate_source_tarball.sh - JDK-8283911 patch no longer needed now we're GA... Related: RHEL-45216 --- .gitignore | 4 + NEWS | 205 +++++++++++++++++++++++++++++++++++++ README.md | 11 ++ generate_source_tarball.sh | 156 ++++++++++++++++++++++++++++ java-17-openjdk.spec | 38 +++++-- sources | 2 +- 6 files changed, 408 insertions(+), 8 deletions(-) create mode 100644 README.md create mode 100755 generate_source_tarball.sh diff --git a/.gitignore b/.gitignore index 42a0ea6..8e5c34e 100644 --- a/.gitignore +++ b/.gitignore @@ -9,3 +9,7 @@ /openjdk-jdk17u-jdk-17.0.1+12.tar.xz /openjdk-jdk17u-jdk-17.0.2+8.tar.xz /tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz +/openjdk-jdk17u-jdk-17.0.3+1.tar.xz +/openjdk-jdk17u-jdk-17.0.3+5.tar.xz +/openjdk-jdk17u-17usec.17.0.3+5-220408.tar.xz +/openjdk-jdk17u-jdk-17.0.3+7.tar.xz diff --git a/NEWS b/NEWS index 78938f4..b0e58ad 100644 --- a/NEWS +++ b/NEWS @@ -3,6 +3,211 @@ Key: JDK-X - https://bugs.openjdk.java.net/browse/JDK-X CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY +New in release OpenJDK 17.0.3 (2022-04-19): +=========================================== +Live versions of these release notes can be found at: + * https://bitly.com/openjdk1703 + * https://builds.shipilev.net/backports-monitor/release-notes-17.0.3.txt + +* Security fixes + - JDK-8269938: Enhance XML processing passes redux + - JDK-8270504, CVE-2022-21426: Better XPath expression handling + - JDK-8272255: Completely handle MIDI files + - JDK-8272261: Improve JFR recording file processing + - JDK-8272588: Enhanced recording parsing + - JDK-8272594: Better record of recordings + - JDK-8274221: More definite BER encodings + - JDK-8275082, JDK-8278008, CVE-2022-21476: Update XML Security for Java to 2.3.0 + - JDK-8275151, CVE-2022-21443: Improved Object Identification + - JDK-8277227: Better identification of OIDs + - JDK-8277233, CVE-2022-21449: Improve ECDSA signature support + - JDK-8277672, CVE-2022-21434: Better invocation handler handling + - JDK-8278356: Improve file creation + - JDK-8278449: Improve keychain support + - JDK-8278798: Improve supported intrinsic + - JDK-8278805: Enhance BMP image loading + - JDK-8278972, CVE-2022-21496: Improve URL supports + - JDK-8281388: Change wrapping of EncryptedPrivateKeyInfo +* Other changes + - JDK-8177814: jdk/editpad is not in jdk TEST.groups + - JDK-8186670: Implement _onSpinWait() intrinsic for AArch64 + - JDK-8190748: java/text/Format/DateFormat/DateFormatTest.java and NonGregorianFormatTest fail intermittently + - JDK-8225559: assertion error at TransTypes.visitApply + - JDK-8236505: Mark jdk/editpad/EditPadTest.java as @headful + - JDK-8239502: [TEST_BUG] Test javax/swing/text/FlowView/6318524/bug6318524.java never fails + - JDK-8244602: Add JTREG_REPEAT_COUNT to repeat execution of a test + - JDK-8247980: Exclusive execution of java/util/stream tests slows down tier1 + - JDK-8251216: Implement MD5 intrinsics on AArch64 + - JDK-8253197: vmTestbase/nsk/jvmti/StopThread/stopthrd007/TestDescription.java fails with "ERROR: DebuggeeSleepingThread: ThreadDeath lost" + - JDK-8262134: compiler/uncommontrap/TestDeoptOOM.java failed with "guarantee(false) failed: wrong number of expression stack elements during deopt" + - JDK-8263567: gtests don't terminate the VM safely + - JDK-8265150: AsyncGetCallTrace crashes on ResourceMark + - JDK-8266490: Extend the OSContainer API to support the pids controller of cgroups + - JDK-8269032: Stringdedup tests are failing if the ergonomically select GC does not support it + - JDK-8269037: jsig/Testjsig.java doesn't have to be restricted to linux only + - JDK-8269087: CheckSegmentedCodeCache test fails in an emulated-client VM + - JDK-8269175: [macosx-aarch64] wrong CPU speed in hs_err file + - JDK-8269206: A small typo in comment in test/lib/sun/hotspot/WhiteBox.java + - JDK-8269523: runtime/Safepoint/TestAbortOnVMOperationTimeout.java failed when expecting 'VM operation took too long' + - JDK-8269616: serviceability/dcmd/framework/VMVersionTest.java fails with Address already in use error + - JDK-8269849: vmTestbase/gc/gctests/PhantomReference/phantom002/TestDescription.java failed with "OutOfMemoryError: Java heap space: failed reallocation of scalar replaced objects" + - JDK-8270117: Broken jtreg link in "Building the JDK" page + - JDK-8270874: JFrame paint artifacts when dragged from standard monitor to HiDPI monitor + - JDK-8271056: C2: "assert(no_dead_loop) failed: dead loop detected" due to cmoving identity + - JDK-8271199: Mutual TLS handshake fails signing client certificate with custom sensitive PKCS11 key + - JDK-8271202: C1: assert(false) failed: live_in set of first block must be empty + - JDK-8271506: Add ResourceHashtable support for deleting selected entries + - JDK-8271721: Split gc/g1/TestMixedGCLiveThreshold into separate tests + - JDK-8272167: AbsPathsInImage.java should skip *.dSYM directories + - JDK-8272327: Shenandoah: Avoid enqueuing duplicate string candidates + - JDK-8272398: Update DockerTestUtils.buildJdkDockerImage() + - JDK-8272541: Incorrect overflow test in Toom-Cook branch of BigInteger multiplication + - JDK-8272553: several hotspot runtime/CommandLine tests don't check exit code + - JDK-8272600: (test) Use native "sleep" in Basic.java + - JDK-8272866: java.util.random package summary contains incorrect mixing function in table + - JDK-8272996: JNDI DNS provider fails to resolve SRV entries when IPV6 stack is enabled + - JDK-8273162: AbstractSplittableWithBrineGenerator does not create a random salt + - JDK-8273277: C2: Move conditional negation into rc_predicate + - JDK-8273341: Update Siphash to version 1.0 + - JDK-8273351: bad tag in jdk.random module-info.java + - JDK-8273366: [testbug] javax/swing/UIDefaults/6302464/bug6302464.java fails on macOS12 + - JDK-8273381: Assert in PtrQueueBufferAllocatorTest.stress_free_list_allocator_vm + - JDK-8273387: remove some unreferenced gtk-related functions + - JDK-8273433: Enable parallelism in vmTestbase_nsk_sysdict tests + - JDK-8273438: Enable parallelism in vmTestbase/metaspace/stressHierarchy tests + - JDK-8273526: Extend the OSContainer API pids controller with pids.current + - JDK-8273634: [TEST_BUG] Improve javax/swing/text/ParagraphView/6364882/bug6364882.java + - JDK-8273655: content-types.properties files are missing some common types + - JDK-8273682: Upgrade Jline to 3.20.0 + - JDK-8273704: DrawStringWithInfiniteXform.java failed : drawString with InfiniteXform transform takes long time + - JDK-8273895: compiler/ciReplay/TestVMNoCompLevel.java fails due to wrong data size with TieredStopAtLevel=2,3 + - JDK-8273933: [TESTBUG] Test must run without preallocated exceptions + - JDK-8273967: gtest os.dll_address_to_function_and_library_name_vm fails on macOS12 + - JDK-8273972: Multi-core choke point in CMM engine (LCMSTransform.doTransform) + - JDK-8274130: C2: MulNode::Ideal chained transformations may act on wrong nodes + - JDK-8274171: java/nio/file/Files/probeContentType/Basic.java failed on "Content type" mismatches + - JDK-8274465: Fix javax/swing/text/ParagraphView/6364882/bug6364882.java failures + - JDK-8274471: Add support for RSASSA-PSS in OCSP Response + - JDK-8274506: TestPids.java and TestPidsLimit.java fail with podman run as root + - JDK-8274524: SSLSocket.close() hangs if it is called during the ssl handshake + - JDK-8274562: (fs) UserDefinedFileAttributeView doesn't correctly determine if supported when using OverlayFS + - JDK-8274658: ISO 4217 Amendment 170 Update + - JDK-8274714: Incorrect verifier protected access error message + - JDK-8274750: java/io/File/GetXSpace.java failed: '/dev': 191488 != 190976 + - JDK-8274753: ZGC: SEGV in MetaspaceShared::link_shared_classes + - JDK-8274795: AArch64: avoid spilling and restoring r18 in macro assembler + - JDK-8274935: dumptime_table has stale entry + - JDK-8274944: AppCDS dump causes SEGV in VM thread while adjusting lambda proxy class info + - JDK-8275326: C2: assert(no_dead_loop) failed: dead loop detected + - JDK-8275330: C2: assert(n->is_Root() || n->is_Region() || n->is_Phi() || n->is_MachMerge() || def_block->dominates(block)) failed: uses must be dominated by definitions + - JDK-8275536: Add test to check that File::lastModified returns same time stamp as Files.getLastModifiedTime + - JDK-8275586: Zero: Simplify interpreter initialization + - JDK-8275608: runtime/Metaspace/elastic/TestMetaspaceAllocationMT2 too slow + - JDK-8275610: C2: Object field load floats above its null check resulting in a segfault + - JDK-8275643: C2's unaryOp vector intrinsic does not properly handle LongVector.neg + - JDK-8275645: [JVMCI] avoid unaligned volatile reads on AArch64 + - JDK-8275650: Problemlist java/io/File/createTempFile/SpecialTempFile.java for Windows 11 + - JDK-8275687: runtime/CommandLine/PrintTouchedMethods test shouldn't catch RuntimeException + - JDK-8275800: Redefinition leaks MethodData::_extra_data_lock + - JDK-8275847: Scheduling fails with "too many D-U pinch points" on small method + - JDK-8275874: [JVMCI] only support aligned reads in c2v_readFieldValue + - JDK-8276057: Update JMH devkit to 1.33 + - JDK-8276141: XPathFactory set/getProperty method + - JDK-8276177: nsk/jvmti/RedefineClasses/StressRedefineWithoutBytecodeCorruption failed with "assert(def_ik->is_being_redefined()) failed: should be being redefined to get here" + - JDK-8276314: [JVMCI] check alignment of call displacement during code installation + - JDK-8276623: JDK-8275650 accidentally pushed "out" file + - JDK-8276654: element-list order is non deterministic + - JDK-8276662: Scalability bottleneck in SymbolTable::lookup_common() + - JDK-8276764: Enable deterministic file content ordering for Jar and Jmod + - JDK-8276766: Enable jar and jmod to produce deterministic timestamped content + - JDK-8276841: Add support for Visual Studio 2022 + - JDK-8277069: [REDO] JDK-8276743 Make openjdk build Zip Archive generation "reproducible" + - JDK-8277137: Set OnSpinWaitInst/OnSpinWaitInstCount defaults to "isb"/1 for Arm Neoverse N1 + - JDK-8277180: Intrinsify recursive ObjectMonitor locking for C2 x64 and A64 + - JDK-8277299: STACK_OVERFLOW in Java_sun_awt_shell_Win32ShellFolder2_getIconBits + - JDK-8277328: jdk/jshell/CommandCompletionTest.java failures on Windows + - JDK-8277342: vmTestbase/nsk/stress/strace/strace004.java fails with SIGSEGV in InstanceKlass::jni_id_for + - JDK-8277383: VM.metaspace optionally show chunk freelist details + - JDK-8277385: Zero: Enable CompactStrings support + - JDK-8277441: CompileQueue::add fails with assert(_last->next() == __null) failed: not last + - JDK-8277447: Hotspot C1 compiler crashes on Kotlin suspend fun with loop + - JDK-8277449: compiler/vectorapi/TestLongVectorNeg.java fails with release VMs + - JDK-8277488: Add expiry exception for Digicert (geotrustglobalca) expiring in May 2022 + - JDK-8277497: Last column cell in the JTable row is read as empty cell + - JDK-8277503: compiler/onSpinWait/TestOnSpinWaitAArch64DefaultFlags.java failed with "OnSpinWaitInst with the expected value 'isb' not found." + - JDK-8277762: Allow configuration of HOTSPOT_BUILD_USER + - JDK-8277777: [Vector API] assert(r->is_XMMRegister()) failed: must be in x86_32.ad + - JDK-8277795: ldap connection timeout not honoured under contention + - JDK-8277846: Implement fast-path for ASCII-compatible CharsetEncoders on ppc64 + - JDK-8277919: OldObjectSample event causing bloat in the class constant pool in JFR recording + - JDK-8277992: Add fast jdk_svc subtests to jdk:tier3 + - JDK-8278016: Add compiler tests to tier{2,3} + - JDK-8278020: ~13% variation in Renaissance-Scrabble + - JDK-8278080: Add --with-cacerts-src='user cacerts folder' to enable deterministic cacerts generation + - JDK-8278099: two sun/security/pkcs11/Signature tests failed with AssertionError + - JDK-8278104: C1 should support the compiler directive 'BreakAtExecute' + - JDK-8278115: gc/stress/gclocker/TestGCLockerWithSerial.java has duplicate -Xmx + - JDK-8278116: runtime/modules/LoadUnloadModuleStress.java has duplicate -Xmx + - JDK-8278163: --with-cacerts-src variable resolved after GenerateCacerts recipe setup + - JDK-8278172: java/nio/channels/FileChannel/BlockDeviceSize.java should only run on Linux + - JDK-8278185: Custom JRE cannot find non-ASCII named module inside + - JDK-8278239: vmTestbase/nsk/jvmti/RedefineClasses/StressRedefine failed with EXCEPTION_ACCESS_VIOLATION at 0x000000000000000d + - JDK-8278241: Implement JVM SpinPause on linux-aarch64 + - JDK-8278309: [windows] use of uninitialized OSThread::_state + - JDK-8278344: sun/security/pkcs12/KeytoolOpensslInteropTest.java test fails because of different openssl output + - JDK-8278346: java/nio/file/Files/probeContentType/Basic.java fails on Linux SLES15 machine + - JDK-8278381: [GCC 11] Address::make_raw() does not initialize rspec + - JDK-8278384: Bytecodes::result_type() for arraylength returns T_VOID instead of T_INT + - JDK-8278389: SuspendibleThreadSet::_suspend_all should be volatile/atomic + - JDK-8278526: [macos] Screen reader reads SwingSet2 JTable row selection as null, dimmed row for last column + - JDK-8278604: SwingSet2 table demo does not have accessible description set for images + - JDK-8278627: Shenandoah: TestHeapDump test failed + - JDK-8278758: runtime/BootstrapMethod/BSMCalledTwice.java fails with release VMs after JDK-8262134 + - JDK-8278822: Bump update version for OpenJDK: jdk-17.0.3 + - JDK-8278824: Uneven work distribution when scanning heap roots in G1 + - JDK-8278871: [JVMCI] assert((uint)reason < 2* _trap_hist_limit) failed: oob + - JDK-8278951: containers/cgroup/PlainRead.java fails on Ubuntu 21.10 + - JDK-8278987: RunThese24H.java failed with EXCEPTION_ACCESS_VIOLATION in __write_sample_info__ + - JDK-8279011: JFR: JfrChunkWriter incorrectly handles int64_t chunk size as size_t + - JDK-8279076: C2: Bad AD file when matching SqrtF with UseSSE=0 + - JDK-8279124: VM does not handle SIGQUIT during initialization + - JDK-8279225: [arm32] C1 longs comparison operation destroys argument registers + - JDK-8279300: [arm32] SIGILL when running GetObjectSizeIntrinsicsTest + - JDK-8279379: GHA: Print tests that are in error + - JDK-8279385: [test] Adjust sun/security/pkcs12/KeytoolOpensslInteropTest.java after 8278344 + - JDK-8279412: [JVMCI] failed speculations list must outlive any nmethod that refers to it + - JDK-8279445: Update JMH devkit to 1.34 + - JDK-8279453: Disable tools/jar/ReproducibleJar.java on 32-bit platforms + - JDK-8279505: Update documentation for RETRY_COUNT and REPEAT_COUNT + - JDK-8279669: test/jdk/com/sun/jdi/TestScaffold.java uses wrong condition + - JDK-8279695: [TESTBUG] modify compiler/loopopts/TestSkeletonPredicateNegation.java to run on C1 also + - JDK-8279702: [macosx] ignore xcodebuild warnings on M1 + - JDK-8279833: Loop optimization issue in String.encodeUTF8_UTF16 + - JDK-8279924: [PPC64, s390] implement frame::is_interpreted_frame_valid checks + - JDK-8279998: PPC64 debug builds fail with "untested: RangeCheckStub: predicate_failed_trap_id" + - JDK-8280002: jmap -histo may leak stream + - JDK-8280155: [PPC64, s390] frame size checks are not yet correct + - JDK-8280373: Update Xalan serializer / SystemIDResolver to align with JDK-8270492 + - JDK-8280414: Memory leak in DefaultProxySelector + - JDK-8280526: x86_32 Math.sqrt performance regression with -XX:UseSSE={0,1} + - JDK-8281061: [s390] JFR runs into assertions while validating interpreter frames + - JDK-8281460: Let ObjectMonitor have its own NMT category + - JDK-8282219: jdk/java/lang/ProcessBuilder/Basic.java fails on AIX + - JDK-8282300: Throws NamingException instead of InvalidNameException after JDK-8278972 + - JDK-8282397: createTempFile method of java.io.File is failing when called with suffix of spaces character + - JDK-8282761: XPathFactoryImpl remove setProperty and getProperty methods + - JDK-8284548: Invalid XPath expression causes StringIndexOutOfBoundsException + - JDK-8284920: Incorrect Token type causes XPath expression to return empty result + +Notes on individual issues: +=========================== + +security-libs/java.security: + +JDK-8274791: Support for RSASSA-PSS in OCSP Response +==================================================== +An OCSP response signed with the RSASSA-PSS algorithm is now supported. + New in release OpenJDK 17.0.2 (2022-01-18): =========================================== Live versions of these release notes can be found at: diff --git a/README.md b/README.md new file mode 100644 index 0000000..ff240f3 --- /dev/null +++ b/README.md @@ -0,0 +1,11 @@ +OpenJDK 17 is the latest Long-Term Support (LTS) release of the Java platform. + +For a list of major changes from OpenJDK 11 (java-11-openjdk), see the upstream +release page for OpenJDK 17 and the preceding interim releases: + +* 12: https://openjdk.java.net/projects/jdk/12/ +* 13: https://openjdk.java.net/projects/jdk/13/ +* 14: https://openjdk.java.net/projects/jdk/14/ +* 15: https://openjdk.java.net/projects/jdk/15/ +* 16: https://openjdk.java.net/projects/jdk/16/ +* 17: https://openjdk.java.net/projects/jdk/17/ diff --git a/generate_source_tarball.sh b/generate_source_tarball.sh new file mode 100755 index 0000000..bf21bc4 --- /dev/null +++ b/generate_source_tarball.sh @@ -0,0 +1,156 @@ +#!/bin/bash +# Generates the 'source tarball' for JDK projects. +# +# Example: +# When used from local repo set REPO_ROOT pointing to file:// with your repo +# If your local repo follows upstream forests conventions, it may be enough to set OPENJDK_URL +# If you want to use a local copy of patch PR3788, set the path to it in the PR3788 variable +# +# In any case you have to set PROJECT_NAME REPO_NAME and VERSION. eg: +# PROJECT_NAME=openjdk +# REPO_NAME=jdk17u +# VERSION=jdk-17.0.3+5 +# or to eg prepare systemtap: +# icedtea7's jstack and other tapsets +# VERSION=6327cf1cea9e +# REPO_NAME=icedtea7-2.6 +# PROJECT_NAME=release +# OPENJDK_URL=http://icedtea.classpath.org/hg/ +# TO_COMPRESS="*/tapset" +# +# They are used to create correct name and are used in construction of sources url (unless REPO_ROOT is set) + +# This script creates a single source tarball out of the repository +# based on the given tag and removes code not allowed in fedora/rhel. For +# consistency, the source tarball will always contain 'openjdk' as the top +# level folder, name is created, based on parameter +# + +if [ ! "x$PR3823" = "x" ] ; then + if [ ! -f "$PR3823" ] ; then + echo "You have specified PR3823 as $PR3823 but it does not exist. Exiting" + exit 1 + fi +fi + +set -e + +OPENJDK_URL_DEFAULT=https://github.com +COMPRESSION_DEFAULT=xz + +if [ "x$1" = "xhelp" ] ; then + echo -e "Behaviour may be specified by setting the following variables:\n" + echo "VERSION - the version of the specified OpenJDK project" + echo "PROJECT_NAME -- the name of the OpenJDK project being archived (optional; only needed by defaults)" + echo "REPO_NAME - the name of the OpenJDK repository (optional; only needed by defaults)" + echo "OPENJDK_URL - the URL to retrieve code from (optional; defaults to ${OPENJDK_URL_DEFAULT})" + echo "COMPRESSION - the compression type to use (optional; defaults to ${COMPRESSION_DEFAULT})" + echo "FILE_NAME_ROOT - name of the archive, minus extensions (optional; defaults to PROJECT_NAME-REPO_NAME-VERSION)" + echo "TO_COMPRESS - what part of clone to pack (default is openjdk)" + echo "PR3823 - the path to the PR3823 patch to apply (optional; downloaded if unavailable)" + exit 1; +fi + + +if [ "x$VERSION" = "x" ] ; then + echo "No VERSION specified" + exit -2 +fi +echo "Version: ${VERSION}" + +# REPO_NAME is only needed when we default on REPO_ROOT and FILE_NAME_ROOT +if [ "x$FILE_NAME_ROOT" = "x" -o "x$REPO_ROOT" = "x" ] ; then + if [ "x$PROJECT_NAME" = "x" ] ; then + echo "No PROJECT_NAME specified" + exit -1 + fi + echo "Project name: ${PROJECT_NAME}" + if [ "x$REPO_NAME" = "x" ] ; then + echo "No REPO_NAME specified" + exit -3 + fi + echo "Repository name: ${REPO_NAME}" +fi + +if [ "x$OPENJDK_URL" = "x" ] ; then + OPENJDK_URL=${OPENJDK_URL_DEFAULT} + echo "No OpenJDK URL specified; defaulting to ${OPENJDK_URL}" +else + echo "OpenJDK URL: ${OPENJDK_URL}" +fi + +if [ "x$COMPRESSION" = "x" ] ; then + # rhel 5 needs tar.gz + COMPRESSION=${COMPRESSION_DEFAULT} +fi +echo "Creating a tar.${COMPRESSION} archive" + +if [ "x$FILE_NAME_ROOT" = "x" ] ; then + FILE_NAME_ROOT=${PROJECT_NAME}-${REPO_NAME}-${VERSION} + echo "No file name root specified; default to ${FILE_NAME_ROOT}" +fi +if [ "x$REPO_ROOT" = "x" ] ; then + REPO_ROOT="${OPENJDK_URL}/${PROJECT_NAME}/${REPO_NAME}.git" + echo "No repository root specified; default to ${REPO_ROOT}" +fi; + +if [ "x$TO_COMPRESS" = "x" ] ; then + TO_COMPRESS="openjdk" + echo "No to be compressed targets specified, ; default to ${TO_COMPRESS}" +fi; + +if [ -d ${FILE_NAME_ROOT} ] ; then + echo "exists exists exists exists exists exists exists " + echo "reusing reusing reusing reusing reusing reusing " + echo ${FILE_NAME_ROOT} +else + mkdir "${FILE_NAME_ROOT}" + pushd "${FILE_NAME_ROOT}" + echo "Cloning ${VERSION} root repository from ${REPO_ROOT}" + git clone -b ${VERSION} ${REPO_ROOT} openjdk + popd +fi +pushd "${FILE_NAME_ROOT}" + if [ -d openjdk/src ]; then + pushd openjdk + echo "Removing EC source code we don't build" + CRYPTO_PATH=src/jdk.crypto.ec/share/native/libsunec/impl + rm -vf ${CRYPTO_PATH}/ec2.h + rm -vf ${CRYPTO_PATH}/ec2_163.c + rm -vf ${CRYPTO_PATH}/ec2_193.c + rm -vf ${CRYPTO_PATH}/ec2_233.c + rm -vf ${CRYPTO_PATH}/ec2_aff.c + rm -vf ${CRYPTO_PATH}/ec2_mont.c + rm -vf ${CRYPTO_PATH}/ecp_192.c + rm -vf ${CRYPTO_PATH}/ecp_224.c + + echo "Syncing EC list with NSS" + if [ "x$PR3823" = "x" ] ; then + # originally for 8: + # get PR3823.patch (from http://icedtea.classpath.org/hg/icedtea16) from most correct tag + # Do not push it or publish it (see https://icedtea.classpath.org/bugzilla/show_bug.cgi?id=3823) + echo "PR3823 not found. Downloading..." + wget https://icedtea.wildebeest.org/hg/icedtea16/raw-file/tip/patches/pr3823.patch + echo "Applying ${PWD}/pr3823.patch" + patch -Np1 < pr3823.patch + rm pr3823.patch + else + echo "Applying ${PR3823}" + patch -Np1 < $PR3823 + fi; + find . -name '*.orig' -exec rm -vf '{}' ';' + popd + fi + + echo "Compressing remaining forest" + if [ "X$COMPRESSION" = "Xxz" ] ; then + SWITCH=cJf + else + SWITCH=czf + fi + tar --exclude-vcs -$SWITCH ${FILE_NAME_ROOT}.tar.${COMPRESSION} $TO_COMPRESS + mv ${FILE_NAME_ROOT}.tar.${COMPRESSION} .. +popd +echo "Done. You may want to remove the uncompressed version - $FILE_NAME_ROOT." + + diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec index 4cb253a..933c24f 100644 --- a/java-17-openjdk.spec +++ b/java-17-openjdk.spec @@ -305,7 +305,7 @@ # New Version-String scheme-style defines %global featurever 17 %global interimver 0 -%global updatever 2 +%global updatever 3 %global patchver 0 # If you bump featurever, you must also bump vendor_version_string # Used via new version scheme. JDK 17 was @@ -333,8 +333,8 @@ %global origin_nice OpenJDK %global top_level_dir_name %{origin} %global top_level_dir_name_backup %{top_level_dir_name}-backup -%global buildver 8 -%global rpmrelease 13 +%global buildver 7 +%global rpmrelease 1 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit %if %is_system_jdk # Using 10 digits may overflow the int used for priority, so we combine the patch and build versions @@ -353,6 +353,9 @@ # Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames %global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn}) +# The tag used to create the OpenJDK tarball +%global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}} + # Define milestone (EA for pre-releases, GA for releases) # Release will be (where N is usually a number starting at 1): # - 0.N%%{?extraver}%%{?dist} for EA releases, @@ -1252,9 +1255,8 @@ License: ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv URL: http://openjdk.java.net/ -# to regenerate source0 (jdk) run update_package.sh -# update_package.sh contains hard-coded repos, revisions, tags, and projects to regenerate the source archives -Source0: openjdk-jdk%{featurever}u-jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}.tar.xz +# The source tarball, generated using generate_source_tarball.sh +Source0: openjdk-jdk%{featurever}u-%{vcstag}.tar.xz # Use 'icedtea_sync.sh' to update the following # They are based on code contained in the IcedTea project (6.x). @@ -1348,7 +1350,7 @@ Patch2000: jdk8275535-rh2053256-ldap_auth.patch ############################################# # -# OpenJDK patches appearing in 17.0.1 +# OpenJDK patches appearing in 17.0.3 # ############################################# @@ -2548,6 +2550,28 @@ cjc.mainProgram(args) %endif %changelog +* Wed Apr 20 2022 Andrew Hughes - 1:17.0.3.0.7-1 +- April 2022 security update to jdk 17.0.3+6 +- Update to jdk-17.0.3.0+6 pre-release tarball (17usec.17.0.3+5-220408) +- Add JDK-8284548 regression fix missing from pre-release tarball but in jdk-17.0.3+6/jdk-17.0.3-ga +- Update release notes to 17.0.3.0+6 +- Add missing README.md and generate_source_tarball.sh +- Switch to GA mode for release +- JDK-8283911 patch no longer needed now we're GA... +- Related: RHEL-45216 + +* Wed Apr 06 2022 Andrew Hughes - 1:17.0.3.0.5-0.1.ea +- Update to jdk-17.0.3.0+5 +- Update release notes to 17.0.3.0+5 +- Related: RHEL-45216 + +* Tue Mar 29 2022 Andrew Hughes - 1:17.0.3.0.1-0.1.ea +- Update to jdk-17.0.3.0+1 +- Update release notes to 17.0.3.0+1 +- Switch to EA mode for 17.0.3 pre-release builds. +- Add JDK-8283911 to fix bad DEFAULT_PROMOTED_VERSION_PRE value +- Related: RHEL-45216 + * Mon Feb 28 2022 Andrew Hughes - 1:17.0.2.0.8-13 - Enable AlgorithmParameters and AlgorithmParameterGenerator services in FIPS mode - Related: RHEL-45216 diff --git a/sources b/sources index 22e666f..e4816a7 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30 -SHA512 (openjdk-jdk17u-jdk-17.0.2+8.tar.xz) = 03371771574c19c38f9091eaad7c46d1638c95e5a3ab16e5ce540bf0f9dcbf8f60fd3848f75fd6fb5eb5fa35a91ca8a6a7b582ce4cf5c7cd2efe6c0957c98719 +SHA512 (openjdk-jdk17u-jdk-17.0.3+7.tar.xz) = 9f6aa266ff26bee08a6c6e9060f616d0acd0613567526463386ee7a8b7ad367a1347b9d6db6e05d73f20bf08d02e8650e33ccd83c8e62587710d885191d1b567