Merge branch 'c9' into a9

2024-11-12 18:56:52 +03:00 · 2024-11-12 18:56:52 +03:00 · 97b3a82a13
commit 97b3a82a13
parent 39d1a69bd5 64d27f1abd
9 changed files with 1244 additions and 1587 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,2 +1,2 @@
-SOURCES/openjdk-jdk17u-jdk-17.0.7+7.tar.xz
+SOURCES/openjdk-17.0.13+11.tar.xz
 SOURCES/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz
--- a/.java-17-openjdk.metadata
+++ b/.java-17-openjdk.metadata
@ -1,2 +1,2 @@
-bc3222a9f338eeb1c03f2b95f429b954c5da3fa7 SOURCES/openjdk-jdk17u-jdk-17.0.7+7.tar.xz
+d8fdb1feceb3941a7f42642a070453290e336135 SOURCES/openjdk-17.0.13+11.tar.xz
 c8281ee37b77d535c9c1af86609a531958ff7b34 SOURCES/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz
--- a/SOURCES/fips-17u-e893be00150.patch
+++ b/SOURCES/fips-17u-e893be00150.patch
@ -116,7 +116,7 @@ index 00000000000..f48fc7f7e80
 +  AC_SUBST(NSS_LIBDIR)
 +])
 diff --git a/make/autoconf/libraries.m4 b/make/autoconf/libraries.m4
-index a65d91ee974..a8f054c1397 100644
+index 62db5b16c31..f0bb4333fc9 100644
 --- a/make/autoconf/libraries.m4
 +++ b/make/autoconf/libraries.m4
@@ -33,6 +33,7 @@ m4_include([lib-std.m4])
@ -136,10 +136,10 @@ index a65d91ee974..a8f054c1397 100644
   BASIC_JDKLIB_LIBS=""
   if test "x$TOOLCHAIN_TYPE" != xmicrosoft; then
 diff --git a/make/autoconf/spec.gmk.in b/make/autoconf/spec.gmk.in
-index 537c3e3043c..16ad3df6f09 100644
+index 807ba27589b..47cb6b7753b 100644
 --- a/make/autoconf/spec.gmk.in
 +++ b/make/autoconf/spec.gmk.in
-@@ -841,6 +841,11 @@ INSTALL_SYSCONFDIR=@sysconfdir@
+@@ -844,6 +844,11 @@ INSTALL_SYSCONFDIR=@sysconfdir@
 # Libraries
 #
 
@ -2508,7 +2508,7 @@ index 00000000000..dc8bc72fccb
 +    }
 +}
 diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security
-index fab52688c04..29337576f37 100644
+index 8f6e1e12a7e..2726391bcea 100644
 --- a/src/java.base/share/conf/security/java.security
 +++ b/src/java.base/share/conf/security/java.security
@@ -82,6 +82,17 @@ security.provider.tbd=Apple
@ -2606,10 +2606,10 @@ index 00000000000..55bbba98b7a
 +attributes(*,CKO_SECRET_KEY,CKK_GENERIC_SECRET)={ CKA_SIGN=true }
 +
 diff --git a/src/java.base/share/lib/security/default.policy b/src/java.base/share/lib/security/default.policy
-index b22f26947af..02bea84e210 100644
+index 4e3c326cb2f..c39faee2f43 100644
 --- a/src/java.base/share/lib/security/default.policy
 +++ b/src/java.base/share/lib/security/default.policy
-@@ -121,6 +121,7 @@ grant codeBase "jrt:/jdk.charsets" {
+@@ -123,6 +123,7 @@ grant codeBase "jrt:/jdk.charsets" {
 grant codeBase "jrt:/jdk.crypto.ec" {
     permission java.lang.RuntimePermission
                    "accessClassInPackage.sun.security.*";
@ -2617,7 +2617,7 @@ index b22f26947af..02bea84e210 100644
     permission java.lang.RuntimePermission "loadLibrary.sunec";
     permission java.security.SecurityPermission "putProviderProperty.SunEC";
     permission java.security.SecurityPermission "clearProviderProperties.SunEC";
-@@ -130,6 +131,7 @@ grant codeBase "jrt:/jdk.crypto.ec" {
+@@ -132,6 +133,7 @@ grant codeBase "jrt:/jdk.crypto.ec" {
 grant codeBase "jrt:/jdk.crypto.cryptoki" {
     permission java.lang.RuntimePermission
                    "accessClassInPackage.com.sun.crypto.provider";
@ -2625,7 +2625,7 @@ index b22f26947af..02bea84e210 100644
     permission java.lang.RuntimePermission "accessClassInPackage.jdk.internal.misc";
     permission java.lang.RuntimePermission
                    "accessClassInPackage.sun.security.*";
-@@ -140,6 +142,8 @@ grant codeBase "jrt:/jdk.crypto.cryptoki" {
+@@ -142,6 +144,8 @@ grant codeBase "jrt:/jdk.crypto.cryptoki" {
     permission java.util.PropertyPermission "os.name", "read";
     permission java.util.PropertyPermission "os.arch", "read";
     permission java.util.PropertyPermission "jdk.crypto.KeyAgreement.legacyKDF", "read";
@ -3496,7 +3496,7 @@ index 00000000000..f8d505ca815
 +}
 \ No newline at end of file
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
-index 9b69072280e..5696b904979 100644
+index d12244337a5..f2e8e4094c8 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
@@ -37,6 +37,8 @@ import javax.crypto.*;
@ -3518,35 +3518,27 @@ index 9b69072280e..5696b904979 100644
     private static final long serialVersionUID = -2575874101938349339L;
 
     private static final String PUBLIC = "public";
-@@ -136,9 +141,7 @@ abstract class P11Key implements Key, Length {
-         this.tokenObject = tokenObject;
-         this.sensitive = sensitive;
-         this.extractable = extractable;
-        char[] tokenLabel = this.token.tokenInfo.label;
-        boolean isNSS = (tokenLabel[0] == 'N' && tokenLabel[1] == 'S'
-                && tokenLabel[2] == 'S');
-+        boolean isNSS = P11Util.isNSS(this.token);
-         boolean extractKeyInfo = (!DISABLE_NATIVE_KEYS_EXTRACTION && isNSS &&
-                 extractable && !tokenObject);
-         this.keyIDHolder = new NativeKeyHolder(this, keyID, session,
-@@ -379,7 +382,9 @@ abstract class P11Key implements Key, Length {
-             new CK_ATTRIBUTE(CKA_SENSITIVE),
-             new CK_ATTRIBUTE(CKA_EXTRACTABLE),
+@@ -393,9 +398,10 @@ abstract class P11Key implements Key, Length {
+                     new CK_ATTRIBUTE(CKA_EXTRACTABLE),
         });
-        if (attributes[1].getBoolean() || (attributes[2].getBoolean() == false)) {
+ 
+-        boolean keySensitive =
+-                (attrs[0].getBoolean() && P11Util.isNSS(session.token)) ||
+-                attrs[1].getBoolean() || !attrs[2].getBoolean();
 +        boolean exportable = plainKeySupportEnabled && !algorithm.equals("DH");
-+        if (!exportable && (attributes[1].getBoolean() ||
-+                (attributes[2].getBoolean() == false))) {
-             return new P11PrivateKey
-                 (session, keyID, algorithm, keyLength, attributes);
-         } else {
-@@ -461,7 +466,8 @@ abstract class P11Key implements Key, Length {
-         }
+        boolean keySensitive = (!exportable &&
+            ((attrs[0].getBoolean() && P11Util.isNSS(session.token)) ||
+             attrs[1].getBoolean() || !attrs[2].getBoolean()));
+ 
+         switch (algorithm) {
+         case "RSA":
+@@ -450,7 +456,8 @@ abstract class P11Key implements Key, Length {
+ 
         public String getFormat() {
             token.ensureValid();
-            if (sensitive || (extractable == false)) {
+-            if (sensitive || !extractable || (isNSS && tokenObject)) {
 +            if (!plainKeySupportEnabled &&
-+                    (sensitive || (extractable == false))) {
+                    (sensitive || !extractable || (isNSS && tokenObject))) {
                 return null;
             } else {
                 return "RAW";
@ -3971,7 +3963,7 @@ index 8d1b8ccb0ae..7ea9b4c5e7f 100644
     }
 
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Util.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Util.java
-index 262cfc062ad..72b64f72c0a 100644
+index cabee449346..72b64f72c0a 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Util.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Util.java
@@ -27,6 +27,10 @@ package sun.security.pkcs11;
@ -3985,7 +3977,7 @@ index 262cfc062ad..72b64f72c0a 100644
 
 /**
  * Collection of static utility methods.
-@@ -40,10 +44,106 @@ public final class P11Util {
+@@ -40,6 +44,93 @@ public final class P11Util {
 
     private static volatile Provider sun, sunRsaSign, sunJce;
 
@ -4079,19 +4071,6 @@ index 262cfc062ad..72b64f72c0a 100644
     private P11Util() {
         // empty
     }
- 
-+    static boolean isNSS(Token token) {
-+        char[] tokenLabel = token.tokenInfo.label;
-+        if (tokenLabel != null && tokenLabel.length >= 3) {
-+            return (tokenLabel[0] == 'N' && tokenLabel[1] == 'S'
-+                    && tokenLabel[2] == 'S');
-+        }
-+        return false;
-+    }
-+
-     static Provider getSunProvider() {
-         Provider p = sun;
-         if (p == null) {
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
 index aa35e8fa668..1855e5631bd 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
@ -4527,7 +4506,7 @@ index aa35e8fa668..1855e5631bd 100644
                 debug.println("logout succeeded");
             }
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java
-index 9858a5faedf..e63585486d9 100644
+index 1f94fe3e18a..99eec2114e4 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java
@@ -33,6 +33,7 @@ import java.lang.ref.*;
--- a/SOURCES/java-17-openjdk-portable.specfile
+++ b/SOURCES/java-17-openjdk-portable.specfile
--- a/SOURCES/jdk8274864-remove_amman_cairo_hacks.patch
+++ b/SOURCES/jdk8274864-remove_amman_cairo_hacks.patch
@ -1,53 +0,0 @@
-commit 1b3825db8631e55771fb723d4fcd10040ea15b7e
-Author: duke <duke@openjdk.org>
-Date:   Wed Apr 12 17:25:27 2023 +0000
-
-    Backport ec199072c5867624d66840238cc8828e16ae8da7
-
-diff --git a/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java b/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java
-index 6f6e190efcd..ef278203182 100644
--- a/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java
-+++ b/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java
-@@ -608,34 +608,6 @@ public final class ZoneInfoFile {
-                 params[8] = endRule.secondOfDay * 1000;
-                 params[9] = toSTZTime[endRule.timeDefinition];
-                 dstSavings = (startRule.offsetAfter - startRule.offsetBefore) * 1000;
-
-                // Note: known mismatching -> Asia/Amman
-                // ZoneInfo :      startDayOfWeek=5     <= Thursday
-                //                 startTime=86400000   <= 24 hours
-                // This:           startDayOfWeek=6
-                //                 startTime=0
-                // Similar workaround needs to be applied to Africa/Cairo and
-                // its endDayOfWeek and endTime
-                // Below is the workarounds, it probably slows down everyone a little
-                if (params[2] == 6 && params[3] == 0 &&
-                    (zoneId.equals("Asia/Amman"))) {
-                    params[2] = 5;
-                    params[3] = 86400000;
-                }
-                // Additional check for startDayOfWeek=6 and starTime=86400000
-                // is needed for Asia/Amman;
-                if (params[2] == 7 && params[3] == 0 &&
-                     (zoneId.equals("Asia/Amman"))) {
-                    params[2] = 6;        // Friday
-                    params[3] = 86400000; // 24h
-                }
-                //endDayOfWeek and endTime workaround
-                if (params[7] == 6 && params[8] == 0 &&
-                    (zoneId.equals("Africa/Cairo"))) {
-                    params[7] = 5;
-                    params[8] = 86400000;
-                }
-
-             } else if (nTrans > 0) {  // only do this if there is something in table already
-                 if (lastyear < LASTYEAR) {
-                     // ZoneInfo has an ending entry for 2037
-@@ -908,7 +880,6 @@ public final class ZoneInfoFile {
-             this.dow = dowByte == 0 ? -1 : dowByte;
-             this.secondOfDay = timeByte == 31 ? in.readInt() : timeByte * 3600;
-             this.timeDefinition = (data & (3 << 12)) >>> 12;
-
-             this.standardOffset = stdByte == 255 ? in.readInt() : (stdByte - 128) * 900;
-             this.offsetBefore = beforeByte == 3 ? in.readInt() : standardOffset + beforeByte * 1800;
-             this.offsetAfter = afterByte == 3 ? in.readInt() : standardOffset + afterByte * 1800;
--- a/SOURCES/jdk8305113-tzdata2023c.patch
+++ b/SOURCES/jdk8305113-tzdata2023c.patch
--- a/SOURCES/rh1648644-java_access_bridge_privileged_security.patch
+++ b/SOURCES/rh1648644-java_access_bridge_privileged_security.patch
@ -1,20 +0,0 @@
--- openjdk/src/java.base/share/conf/security/java.security
-+++ openjdk/src/java.base/share/conf/security/java.security
-@@ -304,6 +304,8 @@
- #
- package.access=sun.misc.,\
-                sun.reflect.,\
-+               org.GNOME.Accessibility.,\
-+               org.GNOME.Bonobo.,\
- 
- #
- # List of comma-separated packages that start with or equal this string
-@@ -316,6 +318,8 @@
- #
- package.definition=sun.misc.,\
-                    sun.reflect.,\
-+                   org.GNOME.Accessibility.,\
-+                   org.GNOME.Bonobo.,\
- 
- #
- # Determines whether this properties file can be appended to
--- a/SOURCES/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
+++ b/SOURCES/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
@ -1,19 +0,0 @@
-Remove uses of FAR in jpeg code
-
-Upstream libjpeg-trubo removed the (empty) FAR macro:
-http://sourceforge.net/p/libjpeg-turbo/code/1312/
-
-Adjust our code to not use the undefined FAR macro anymore.
-
-diff --git a/jdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c b/jdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c
--- openjdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c
-+++ openjdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c
-@@ -1385,7 +1385,7 @@
-     /* and fill it in */
-     dst_ptr = icc_data;
-     for (seq_no = first; seq_no < last; seq_no++) {
-        JOCTET FAR *src_ptr = icc_markers[seq_no]->data + ICC_OVERHEAD_LEN;
-+        JOCTET *src_ptr = icc_markers[seq_no]->data + ICC_OVERHEAD_LEN;
-         unsigned int length =
-             icc_markers[seq_no]->data_length - ICC_OVERHEAD_LEN;
- 
--- a/SPECS/java-17-openjdk.spec
+++ b/SPECS/java-17-openjdk.spec
@ -1,3 +1,8 @@
+# To rebuild this RPM, you must first rebuild the portable
+# RPM using the java-17-openjdk-portable.specfile, install
+# it and then adjust portablerelease and portablesuffix
+# to match the new portable.
+
 # RPM conditionals so as to be able to dynamically produce
 # slowdebug/release builds. See:
 # http://rpm.org/user_doc/conditional_builds.html
@ -22,7 +27,7 @@
 # Enable static library builds by default.
 %bcond_without staticlibs
 # Build a fresh libjvm.so for use in a copy of the bootstrap JDK
-%bcond_without fresh_libjvm
+%bcond_with fresh_libjvm
 # Build with system libraries
 %bcond_with system_libs

@ -54,6 +59,10 @@
 # The -g flag says to use strip -g instead of full strip on DSOs or EXEs.
 # This fixes detailed NMT and other tools which need minimal debug info.
 # See: https://bugzilla.redhat.com/show_bug.cgi?id=1520879
+# To silence rpminspect's .symtab warnings due to this option, our
+# rpminspect.yaml needs:
+# debuginfo:
+#     debuginfo_sections: .debug_info .gdb_index
 %global _find_debuginfo_opts -g

 # With LTO flags enabled, debuginfo checks fail for some reason. Disable
@ -98,7 +107,7 @@
 # you can list those files, with appropriate sections: cat *.spec | grep -e --install -e --slave -e post_ -e alternatives
 # TODO - fix those hardcoded lists via single list
 # Those files must *NOT* be ghosted for *slowdebug* packages
-# FIXME - if you are moving jshell or jlink or similar, always modify all three sections
+# NOTE - if you are moving jshell or jlink or similar, always modify all three sections
 # you can check via headless and devels:
 #    rpm -ql --noghost java-11-openjdk-headless-11.0.1.13-8.fc29.x86_64.rpm  | grep bin
 # == rpm -ql           java-11-openjdk-headless-slowdebug-11.0.1.13-8.fc29.x86_64.rpm  | grep bin
@ -106,9 +115,9 @@
 # similarly for other %%{_jvmdir}/{jre,java} and %%{_javadocdir}/{java,java-zip}
 %define is_release_build() %( if [ "%{?1}" == "%{debug_suffix_unquoted}" -o "%{?1}" == "%{fastdebug_suffix_unquoted}" ]; then echo "0" ; else echo "1"; fi )

-# while JDK is a techpreview(is_system_jdk=0), some provides are turned off. Once jdk stops to be an techpreview, move it to 1
-# as sytem JDK, we mean any JDK which can run whole system java stack without issues (like bytecode issues, module issues, dependencies...)
-%global is_system_jdk 0
+# Indicates whether this is the default JDK on this version of RHEL
+# Only the default/system JDK provides unversioned Provides like 'java', 'jre' and 'java-devel'
+%global is_system_jdk 1

 %global aarch64         aarch64 arm64 armv8
 # we need to distinguish between big and little endian PPC64
@ -133,9 +142,9 @@
 # Set of architectures which support the serviceability agent
 %global sa_arches       %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} %{arm}
 # Set of architectures which support class data sharing
-# See https://bugzilla.redhat.com/show_bug.cgi?id=513605
-# MetaspaceShared::generate_vtable_methods is not implemented for the PPC JIT
-%global share_arches    %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{arm} s390x
+# As of JDK-8005165 in OpenJDK 10, class sharing is not arch-specific
+# However, it does segfault on the Zero assembler port, so currently JIT only
+%global share_arches    %{jit_arches}
 # Set of architectures for which we build the Shenandoah garbage collector
 %global shenandoah_arches x86_64 %{aarch64}
 # Set of architectures for which we build the Z garbage collector
@ -226,6 +235,10 @@
 # JDK to use for bootstrapping
 %global bootjdk /usr/lib/jvm/java-%{buildjdkver}-openjdk

+# VM variant being built
+# This is always 'server' on 17u which doesn't have JDK-8273494
+%global vm_variant server
+
 # debugedit tool for rewriting ELF file paths
 %global debugedit %{_rpmconfigdir}/debugedit

@ -313,12 +326,12 @@
 # New Version-String scheme-style defines
 %global featurever 17
 %global interimver 0
-%global updatever 7
+%global updatever 13
 %global patchver 0
 # buildjdkver is usually same as %%{featurever},
 # but in time of bootstrap of next jdk, it is featurever-1,
 # and this it is better to change it here, on single place
-%global buildjdkver 17
+%global buildjdkver %{featurever}
 # We don't add any LTS designator for STS packages (Fedora and EPEL).
 # We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined.
 %if 0%{?rhel} && !0%{?epel}
@ -342,7 +355,7 @@
 %global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=%{name}&version=%{fedora}
 %else
 %if 0%{?rhel}
-%global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi?product=Red%20Hat%20Enterprise%20Linux%20%{rhel}&component=%{name}
+%global oj_vendor_bug_url https://access.redhat.com/support/cases/
 %else
 %global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi
 %endif
@ -353,18 +366,38 @@
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      6.0.0pre00-c848b93a8598
 # Define current Git revision for the FIPS support patches
-%global fipsver bf363eecce3
+%global fipsver e893be00150
+%global javaver         %{featurever}
+%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
+
+# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames
+%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn})
+
+# The tag used to create the OpenJDK tarball
+%global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}

 # Standard JPackage naming and versioning defines
 %global origin          openjdk
 %global origin_nice     OpenJDK
-%global top_level_dir_name   %{origin}
+%global top_level_dir_name   %{vcstag}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        7
-%global rpmrelease      3
+%global buildver 11
+# rpmrelease numbering must start at 2 to be later than the 9.0 RPM
+%global rpmrelease 4
 # Settings used by the portable build
-%global portablerelease 2
-%global portablesuffix el%{rhel}
+%global portablerelease 1
+# Portable suffix differs between RHEL and CentOS
+%if 0%{?centos} == 0
+%global portablesuffix el8
+%else
+%global portablesuffix el9
+%endif
+
+%if 0%{?almalinux}
+%global portablesuffix el8
+%endif
+
+
 %global portablebuilddir /builddir/build/BUILD

 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
@ -379,24 +412,16 @@
 # for techpreview, using 1, so slowdebugs can have 0
 %global priority %( printf '%08d' 1 )
 %endif
-%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
-%global javaver         %{featurever}
-
-# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames
-%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn})
-
-# The tag used to create the OpenJDK tarball
-%global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}

 # Define milestone (EA for pre-releases, GA for releases)
 # Release will be (where N is usually a number starting at 1):
 # - 0.N%%{?extraver}%%{?dist} for EA releases,
 # - N%%{?extraver}{?dist} for GA releases
-%global is_ga           1
+%global is_ga 1
 %if %{is_ga}
 %global build_type GA
 %global ea_designator ""
-%global ea_designator_zip ""
+%global ea_designator_zip %{nil}
 %global extraver %{nil}
 %global eaprefix %{nil}
 %else
@ -548,12 +573,15 @@ alternatives \\
  --install %{_bindir}/java $key %{jrebindir -- %{?1}}/java $PRIORITY  --family %{family} \\
  --slave %{_jvmdir}/jre jre %{_jvmdir}/%{sdkdir -- %{?1}} \\
  --slave %{_bindir}/%{alt_java_name} %{alt_java_name} %{jrebindir -- %{?1}}/%{alt_java_name} \\
+  --slave %{_bindir}/jcmd jcmd %{sdkbindir -- %{?1}}/jcmd \\
  --slave %{_bindir}/keytool keytool %{jrebindir -- %{?1}}/keytool \\
  --slave %{_bindir}/rmiregistry rmiregistry %{jrebindir -- %{?1}}/rmiregistry \\
  --slave %{_mandir}/man1/java.1$ext java.1$ext \\
  %{_mandir}/man1/java-%{uniquesuffix -- %{?1}}.1$ext \\
  --slave %{_mandir}/man1/%{alt_java_name}.1$ext %{alt_java_name}.1$ext \\
  %{_mandir}/man1/%{alt_java_name}-%{uniquesuffix -- %{?1}}.1$ext \\
+  --slave %{_mandir}/man1/jcmd.1$ext jcmd.1$ext \\
+  %{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1$ext \\
  --slave %{_mandir}/man1/keytool.1$ext keytool.1$ext \\
  %{_mandir}/man1/keytool-%{uniquesuffix -- %{?1}}.1$ext \\
  --slave %{_mandir}/man1/rmiregistry.1$ext rmiregistry.1$ext \\
@ -573,10 +601,6 @@ alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} $key %{_jvmdir}/%{jre
 }

 %define post_headless() %{expand:
-%ifarch %{share_arches}
-%{jrebindir -- %{?1}}/java -Xshare:dump >/dev/null 2>/dev/null
-%endif
-
 update-desktop-database %{_datadir}/applications &> /dev/null || :
 /bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || :

@ -642,7 +666,6 @@ alternatives \\
  --slave %{_bindir}/jarsigner jarsigner %{sdkbindir -- %{?1}}/jarsigner \\
  --slave %{_bindir}/javadoc javadoc %{sdkbindir -- %{?1}}/javadoc \\
  --slave %{_bindir}/javap javap %{sdkbindir -- %{?1}}/javap \\
-  --slave %{_bindir}/jcmd jcmd %{sdkbindir -- %{?1}}/jcmd \\
  --slave %{_bindir}/jconsole jconsole %{sdkbindir -- %{?1}}/jconsole \\
  --slave %{_bindir}/jdb jdb %{sdkbindir -- %{?1}}/jdb \\
  --slave %{_bindir}/jdeps jdeps %{sdkbindir -- %{?1}}/jdeps \\
@ -669,8 +692,6 @@ alternatives \\
  %{_mandir}/man1/javadoc-%{uniquesuffix -- %{?1}}.1$ext \\
  --slave %{_mandir}/man1/javap.1$ext javap.1$ext \\
  %{_mandir}/man1/javap-%{uniquesuffix -- %{?1}}.1$ext \\
-  --slave %{_mandir}/man1/jcmd.1$ext jcmd.1$ext \\
-  %{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1$ext \\
  --slave %{_mandir}/man1/jconsole.1$ext jconsole.1$ext \\
  %{_mandir}/man1/jconsole-%{uniquesuffix -- %{?1}}.1$ext \\
  --slave %{_mandir}/man1/jdb.1$ext jdb.1$ext \\
@ -808,6 +829,7 @@ exit 0
 %dir %{_jvmdir}/%{sdkdir -- %{?1}}/bin
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/java
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/%{alt_java_name}
+%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jcmd
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/keytool
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/rmiregistry
 %dir %{_jvmdir}/%{sdkdir -- %{?1}}/lib
@ -871,11 +893,15 @@ exit 0
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/jfr/profile.jfc
 %{_mandir}/man1/java-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/%{alt_java_name}-%{uniquesuffix -- %{?1}}.1*
+%{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/keytool-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/rmiregistry-%{uniquesuffix -- %{?1}}.1*
-%{_jvmdir}/%{sdkdir -- %{?1}}/lib/server/
+%{_jvmdir}/%{sdkdir -- %{?1}}/lib/%{vm_variant}/
 %ifarch %{share_arches}
-%attr(444, root, root) %ghost %{_jvmdir}/%{sdkdir -- %{?1}}/lib/server/classes.jsa
+%attr(444, root, root) %{_jvmdir}/%{sdkdir -- %{?1}}/lib/%{vm_variant}/classes.jsa
+%ifnarch %{ix86} %{arm32}
+%attr(444, root, root) %{_jvmdir}/%{sdkdir -- %{?1}}/lib/%{vm_variant}/classes_nocoops.jsa
+%endif
 %endif
 %dir %{etcjavasubdir}
 %dir %{etcjavadir -- %{?1}}
@ -915,13 +941,11 @@ exit 0
 %if %is_system_jdk
 %if %{is_release_build -- %{?1}}
 %ghost %{_bindir}/java
-%ghost %{_bindir}/%{alt_java_name}
 %ghost %{_jvmdir}/jre
+%ghost %{_bindir}/%{alt_java_name}
+%ghost %{_bindir}/jcmd
 %ghost %{_bindir}/keytool
-%ghost %{_bindir}/pack200
-%ghost %{_bindir}/rmid
 %ghost %{_bindir}/rmiregistry
-%ghost %{_bindir}/unpack200
 %ghost %{_jvmdir}/jre-%{origin}
 %ghost %{_jvmdir}/jre-%{javaver}
 %ghost %{_jvmdir}/jre-%{javaver}-%{origin}
@ -941,7 +965,6 @@ exit 0
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/javadoc
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/javap
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jconsole
-%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jcmd
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jdb
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jdeps
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jdeprscan
@ -978,7 +1001,6 @@ exit 0
 %{_mandir}/man1/javadoc-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/javap-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jconsole-%{uniquesuffix -- %{?1}}.1*
-%{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jdb-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jdeps-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jinfo-%{uniquesuffix -- %{?1}}.1*
@ -1006,7 +1028,6 @@ exit 0
 %if %{is_release_build -- %{?1}}
 %ghost %{_bindir}/javac
 %ghost %{_jvmdir}/java
-%ghost %{_jvmdir}/%{alt_java_name}
 %ghost %{_bindir}/jlink
 %ghost %{_bindir}/jmod
 %ghost %{_bindir}/jhsdb
@ -1014,15 +1035,16 @@ exit 0
 %ghost %{_bindir}/jarsigner
 %ghost %{_bindir}/javadoc
 %ghost %{_bindir}/javap
-%ghost %{_bindir}/jcmd
 %ghost %{_bindir}/jconsole
 %ghost %{_bindir}/jdb
 %ghost %{_bindir}/jdeps
 %ghost %{_bindir}/jdeprscan
+%ghost %{_bindir}/jfr
 %ghost %{_bindir}/jimage
 %ghost %{_bindir}/jinfo
 %ghost %{_bindir}/jmap
 %ghost %{_bindir}/jps
+%ghost %{_bindir}/jpackage
 %ghost %{_bindir}/jrunscript
 %ghost %{_bindir}/jshell
 %ghost %{_bindir}/jstack
@ -1117,8 +1139,8 @@ Requires: ca-certificates
 # Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros
 Requires: javapackages-filesystem
 # Require zone-info data provided by tzdata-java sub-package
-# 2022g required as of JDK-8297804
-Requires: tzdata-java >= 2022g
+# 2024a required as of JDK-8325150
+Requires: tzdata-java >= 2024a
 # for support of kernel stream control
 # libsctp.so.1 is being `dlopen`ed on demand
 Requires: lksctp-tools%{?_isa}
@ -1242,7 +1264,9 @@ Provides: java-%{origin}-src%{?1} = %{epoch}:%{version}-%{release}

 Name:    java-%{javaver}-%{origin}
 Version: %{newjavaver}.%{buildver}
-Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}.alma
+Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}.alma.1
+# Equivalent for the portable build
+%global prelease %{?eaprefix}%{portablerelease}%{?extraver}
 # java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons
 # and this change was brought into RHEL-4. java-1.5.0-ibm packages
 # also included the epoch in their virtual provides. This created a
@ -1279,7 +1303,7 @@ URL:      http://openjdk.java.net/


 # The source tarball, generated using generate_source_tarball.sh
-Source0: openjdk-jdk%{featurever}u-%{vcstag}.tar.xz
+Source0: https://openjdk-sources.osci.io/openjdk%{featurever}/open%{vcstag}%{ea_designator_zip}.tar.xz

 # Use 'icedtea_sync.sh' to update the following
 # They are based on code contained in the IcedTea project (6.x).
@ -1315,14 +1339,14 @@ Source19: README.md
 Source20: java-%{featurever}-openjdk-portable.specfile

 # Setup variables to reference correct sources
-%global releasezip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.unstripped.jdk.%{_arch}.tar.xz
-%global staticlibzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.static-libs.%{_arch}.tar.xz
-%global docszip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.docs.%{_arch}.tar.xz
-%global misczip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.misc.%{_arch}.tar.xz
-%global slowdebugzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.slowdebug.jdk.%{_arch}.tar.xz
-%global slowdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.slowdebug.static-libs.%{_arch}.tar.xz
-%global fastdebugzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.fastdebug.jdk.%{_arch}.tar.xz
-%global fastdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.fastdebug.static-libs.%{_arch}.tar.xz
+%global releasezip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.unstripped.jdk.%{_arch}.tar.xz
+%global staticlibzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.static-libs.%{_arch}.tar.xz
+%global docszip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.docs.%{_arch}.tar.xz
+%global misczip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.misc.%{_arch}.tar.xz
+%global slowdebugzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.slowdebug.jdk.%{_arch}.tar.xz
+%global slowdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.slowdebug.static-libs.%{_arch}.tar.xz
+%global fastdebugzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.fastdebug.jdk.%{_arch}.tar.xz
+%global fastdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.fastdebug.static-libs.%{_arch}.tar.xz

 ############################################
 #
@ -1338,49 +1362,51 @@ Patch600: rh1750419-redhat_alt_java.patch

 # Ignore AWTError when assistive technologies are loaded
 Patch1:    rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
-# Restrict access to java-atk-wrapper classes
-Patch2:    rh1648644-java_access_bridge_privileged_security.patch
-Patch3:    rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
-# Depend on pcsc-lite-libs instead of pcsc-lite-devel as this is only in optional repo
-Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch

 # Crypto policy and FIPS support patches
 # Patch is generated from the fips-17u tree at https://github.com/rh-openjdk/jdk/tree/fips-17u
 # as follows: git diff %%{vcstag} src make test > fips-17u-$(git show -s --format=%h HEAD).patch
 # Diff is limited to src and make subdirectories to exclude .github changes
+# The following list is generated by:
+# git log %%{vcstag}.. --no-merges --format=%s --reverse:
 # Fixes currently included:
-# PR3183, RH1340845: Follow system wide crypto policy
-# PR3695: Allow use of system crypto policy to be disabled by the user
-# RH1655466: Support RHEL FIPS mode using SunPKCS11 provider
-# RH1818909: No ciphersuites availale for SSLSocket in FIPS mode
-# RH1860986: Disable TLSv1.3 with the NSS-FIPS provider until PKCS#11 v3.0 support is available
-# RH1915071: Always initialise JavaSecuritySystemConfiguratorAccess
+# PR3183, RH1340845: Support Fedora & RHEL system crypto policy
+# PR3695: Allow system crypto policy enforcement to be toggled on/off
+# RH1655466: Support global RHEL crypto policy
+# RH1818909: Set default keystore type for PKCS11 provider in FIPS mode
+# RH1860986: Disable TLSv1.3 in FIPS mode
+# RH1915071: Always initialise configurator access.patch
 # RH1929465: Improve system FIPS detection
-# RH1995150: Disable non-FIPS crypto in SUN and SunEC security providers
-# RH1996182: Login to the NSS software token in FIPS mode
-# RH1991003: Allow plain key import unless com.redhat.fips.plainKeySupport is set to false
-# RH2021263: Resolve outstanding FIPS issues
-# RH2052819: Fix FIPS reliance on crypto policies
-# RH2052829: Detect NSS at Runtime for FIPS detection
+# RH1995150: Disable non-FIPS crypto in the SUN and SunEC providers
+# RH1996182: Login to the NSS Software Token in FIPS Mode
+# RH1929465: Don't define unused throwIOException function when using NSS detection
+# RH1996182: Extend default security policy to allow SunPKCS11 access to jdk.internal.access
+# RH1991003: Enable the import of plain keys into the NSS software token.
+# RH2021263: Return in C code after having generated Java exception
+# RH2021263: Make sure java.security.Security is initialised when retrieving JavaSecuritySystemConfiguratorAccess instance
+# RH2021263: Improve Security initialisation, now FIPS support no longer relies on crypto policy support
+# RH2051605: Detect NSS at Runtime for FIPS detection
 # RH2052070: Enable AlgorithmParameters and AlgorithmParameterGenerator services in FIPS mode
-# RH2023467: Enable FIPS keys export
-# RH2094027: SunEC runtime permission for FIPS
-# RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
-# RH2090378: Revert to disabling system security properties and FIPS mode support together
-# RH2104724: Avoid import/export of DH private keys
-# RH2092507: P11Key.getEncoded does not work for DH keys in FIPS mode
-# Build the systemconf library on all platforms
-# RH2048582: Support PKCS#12 keystores
-# RH2020290: Support TLS 1.3 in FIPS mode
-# Add nss.fips.cfg support to OpenJDK tree
-# RH2117972: Extend the support for NSS DBs (PKCS11) in FIPS mode
-# Remove forgotten dead code from RH2020290 and RH2104724
-# OJ1357: Fix issue on FIPS with a SecurityManager in place
-# RH2134669: Add missing attributes when registering services in FIPS mode.
-# test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
-# RH1940064: Enable XML Signature provider in FIPS mode
-# RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized
-Patch1001: fips-17u-%{fipsver}.patch
+# RH2023467: Enable FIPS keys export (#1)
+# Run workflows on pull request, as we are not using SKARA.
+# RH2094027: SunEC runtime permission for FIPS (#5)
+# RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage (#8)
+# RH2090378: Revert to disabling system security properties and FIPS mode support together (#4)
+# Use encoded space rather than quoting for JTReg JAVA_OPTIONS
+# RH2104724: Avoid import/export of DH private keys (#14)
+# RH2092507: P11Key.getEncoded does not work for DH keys in FIPS mode (#16)
+# Build the systemconf library on all platforms (#7)
+# RH2048582: Support PKCS#12 keystores (#2)
+# RH2020290: Support TLS 1.3 in FIPS mode (#13)
+# Add nss.fips.cfg support to OpenJDK tree (#22)
+# RH2117972 - Extend the support for NSS DBs (PKCS11) in FIPS mode (#17)
+# Remove forgotten dead code from #13 and #14 (#21)
+# Fix issue on FIPS with a SecurityManager in place (#25)
+# RH2134669: Add missing attributes when registering services in FIPS mode. (#19)
+# test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class (#27)
+# RH1940064: Enable XML Signature provider in FIPS mode (#24)
+# RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized (#26)
+Patch1001: fips-%{featurever}u-%{fipsver}.patch

 #############################################
 #
@ -1388,15 +1414,16 @@ Patch1001: fips-17u-%{fipsver}.patch
 #
 #############################################

+# Depend on pcsc-lite-libs instead of pcsc-lite-devel as this is only in optional repo
+Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
+
 #############################################
 #
-# OpenJDK patches targetted for 17.0.8
+# OpenJDK patches which missed last update
 #
 #############################################
-# JDK-8274864: Remove Amman/Cairo hacks in ZoneInfoFile
-Patch2001: jdk8274864-remove_amman_cairo_hacks.patch
-# JDK-8305113: (tz) Update Timezone Data to 2023c
-Patch2002: jdk8305113-tzdata2023c.patch
+
+# Currently empty

 BuildRequires: autoconf
 BuildRequires: automake
@ -1426,25 +1453,25 @@ BuildRequires: xorg-x11-proto-devel
 BuildRequires: zip
 BuildRequires: javapackages-filesystem
 %if %{include_normal_build}
-BuildRequires: java-%{featurever}-openjdk-portable-unstripped = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
-BuildRequires: java-%{featurever}-openjdk-portable-static-libs = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: java-%{featurever}-openjdk-portable-unstripped = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
+BuildRequires: java-%{featurever}-openjdk-portable-static-libs = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
 %endif
 %if %{include_fastdebug_build}
-BuildRequires: java-%{featurever}-openjdk-portable-devel-fastdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
-BuildRequires: java-%{featurever}-openjdk-portable-static-libs-fastdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: java-%{featurever}-openjdk-portable-devel-fastdebug = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
+BuildRequires: java-%{featurever}-openjdk-portable-static-libs-fastdebug = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
 %endif
 %if %{include_debug_build}
-BuildRequires: java-%{featurever}-openjdk-portable-devel-slowdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
-BuildRequires: java-%{featurever}-openjdk-portable-static-libs-slowdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: java-%{featurever}-openjdk-portable-devel-slowdebug = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
+BuildRequires: java-%{featurever}-openjdk-portable-static-libs-slowdebug = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
 %endif
-BuildRequires: java-%{featurever}-openjdk-portable-docs = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
-BuildRequires: java-%{featurever}-openjdk-portable-misc = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: java-%{featurever}-openjdk-portable-docs = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
+BuildRequires: java-%{featurever}-openjdk-portable-misc = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
 # Zero-assembler build requirement
 %ifarch %{zero_arches}
 BuildRequires: libffi-devel
 %endif
-# 2023c required as of JDK-8305113
-BuildRequires: tzdata-java >= 2023c
+# 2024a required as of JDK-8325150
+BuildRequires: tzdata-java >= 2024a
 # Earlier versions have a bug in tree vectorization on PPC
 BuildRequires: gcc >= 4.8.3-8

@ -1460,19 +1487,22 @@ BuildRequires: harfbuzz-devel
 BuildRequires: lcms2-devel
 BuildRequires: libjpeg-devel
 BuildRequires: libpng-devel
+BuildRequires: zlib-devel
 %else
 # Version in src/java.desktop/share/native/libfreetype/include/freetype/freetype.h
-Provides: bundled(freetype) = 2.12.1
+Provides: bundled(freetype) = 2.13.0
 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
 Provides: bundled(giflib) = 5.2.1
 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h
-Provides: bundled(harfbuzz) = 4.4.1
-# Version in src/java.desktop/share/native/liblcms/lcms2.h
-Provides: bundled(lcms2) = 2.12.0
+Provides: bundled(harfbuzz) = 7.2.0
+# Version in src/java.desktop/share/legal/lcms.md
+Provides: bundled(lcms2) = 2.16.0
 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h
 Provides: bundled(libjpeg) = 6b
 # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h
-Provides: bundled(libpng) = 1.6.37
+Provides: bundled(libpng) = 1.6.39
+# Version in src/java.base/share/native/libzip/zlib/zlib.h
+Provides: bundled(zlib) = 1.3.1
 %endif

 # this is always built, also during debug-only build
@ -1832,21 +1862,29 @@ sh %{SOURCE12} %{top_level_dir_name}

 # Patch the JDK
 pushd %{top_level_dir_name}
-%patch1 -p1
-%patch2 -p1
-%patch3 -p1
-%patch6 -p1
+# This syntax is deprecated:
+#    %patchN [...]
+# and should be replaced with:
+#    %patch -PN [...]
+# For example:
+#    %patch1001 -p1
+# becomes:
+#    %patch -P1001 -p1
+# The replacement format suggested by recent (circa Fedora 38) RPM
+# deprecation messages:
+#    %patch N [...]
+# is not backward-compatible with prior (circa RHEL-8) versions of
+# rpmbuild.
+%patch -P1 -p1
+%patch -P6 -p1
 # Add crypto policy and FIPS support
-%patch1001 -p1
+%patch -P1001 -p1
 # nss.cfg PKCS11 support; must come last as it also alters java.security
-%patch1000 -p1
-# tzdata update
-%patch2001 -p1
-%patch2002 -p1
+%patch -P1000 -p1
+# alt-java support
+%patch -P600 -p1
 popd # openjdk

-%patch600
-
 # The OpenJDK version file includes the current
 # upstream version information. For some reason,
 # configure does not automatically use the
@ -1861,41 +1899,12 @@ else
    exit 16
 fi
 if [ "x${UPSTREAM_EA_DESIGNATOR}" != "x%{ea_designator}" ] ; then
-    echo "WARNING: Designator mismatch";
+    echo "ERROR: Designator mismatch";
    echo "Spec file is configured for a %{build_type} build with designator '%{ea_designator}'"
    echo "Upstream version-pre setting is '${UPSTREAM_EA_DESIGNATOR}'";
    exit 17
 fi

-# Extract systemtap tapsets
-%if %{with_systemtap}
-tar --strip-components=1 -x -I xz -f %{SOURCE8}
-%if %{include_debug_build}
-cp -r tapset tapset%{debug_suffix}
-%endif
-%if %{include_fastdebug_build}
-cp -r tapset tapset%{fastdebug_suffix}
-%endif
-
-for suffix in %{build_loop} ; do
-  for file in "tapset"$suffix/*.in; do
-    OUTPUT_FILE=`echo $file | sed -e "s:\.stp\.in$:-%{version}-%{release}.%{_arch}.stp:g"`
-    sed -e "s:@ABS_SERVER_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/server/libjvm.so:g" $file > $file.1
-    sed -e "s:@JAVA_SPEC_VER@:%{javaver}:g" $file.1 > $file.2
-# TODO find out which architectures other than i686 have a client vm
-%ifarch %{ix86}
-    sed -e "s:@ABS_CLIENT_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/client/libjvm.so:g" $file.2 > $OUTPUT_FILE
-%else
-    sed -e "/@ABS_CLIENT_LIBJVM_SO@/d" $file.2 > $OUTPUT_FILE
-%endif
-    sed -i -e "s:@ABS_JAVA_HOME_DIR@:%{_jvmdir}/%{sdkdir -- $suffix}:g" $OUTPUT_FILE
-    sed -i -e "s:@INSTALL_ARCH_DIR@:%{archinstall}:g" $OUTPUT_FILE
-    sed -i -e "s:@prefix@:%{_jvmdir}/%{sdkdir -- $suffix}/:g" $OUTPUT_FILE
-  done
-done
-# systemtap tapsets ends
-%endif
-
 # Prepare desktop files
 # The _X_ syntax indicates variables that are replaced by make upstream
 # The @X@ syntax indicates variables that are replaced by configure upstream
@ -1932,6 +1941,16 @@ function customisejdk() {
    fi
 }

+mkdir -p $(dirname %{installoutputdir})
+
+docdir=%{installoutputdir -- "-docs"}
+tar -xJf %{docszip}
+mv java-%{featurever}-openjdk*.docs.* ${docdir}
+
+miscdir=%{installoutputdir -- "-misc"}
+tar -xJf %{misczip}
+mv java-%{featurever}-openjdk*.misc.* ${miscdir}
+
 for suffix in %{build_loop} ; do

  if [ "x$suffix" = "x" ] ; then
@ -1950,17 +1969,32 @@ for suffix in %{build_loop} ; do
  # TODO: should verify checksums when using packages from buildroot
  tar -xJf ${jdkzip}
  tar -xJf ${staticlibzip}
-  mkdir -p $(dirname ${installdir})
  mv java-%{featurever}-openjdk* ${installdir}

  # Fix build paths in ELF files so it looks like we built them
-  portablenvr="%{name}-%{VERSION}-%{portablerelease}.%{portablesuffix}.%{_arch}"
+  portablenvr="%{name}-%{VERSION}-%{prelease}.%{portablesuffix}.%{_arch}"
  for file in $(find ${installdir} -type f) ; do
      if file ${file} | grep -q 'ELF'; then
 	  %{debugedit} -b %{portablebuilddir}/${portablenvr} -d $(pwd) -n ${file}
      fi
  done

+  # Set tapset variables to match this build
+%if %{with_systemtap}
+  for file in ${miscdir}/tapset${suffix}/*.in; do
+    OUTPUT_FILE=`echo $file | sed -e "s:\.stp\.in$:-%{version}-%{release}.%{_arch}.stp:g"`
+    sed -e "s:@ABS_SERVER_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/server/libjvm.so:g" $file > ${OUTPUT_FILE}
+# TODO find out which architectures other than i686 have a client vm
+%ifarch %{ix86}
+    sed -i -e "s:@ABS_CLIENT_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/client/libjvm.so:g" ${OUTPUT_FILE}
+%else
+    sed -i -e "/@ABS_CLIENT_LIBJVM_SO@/d" ${OUTPUT_FILE}
+%endif
+    sed -i -e "s:@ABS_JAVA_HOME_DIR@:%{_jvmdir}/%{sdkdir -- $suffix}:g" $OUTPUT_FILE
+    sed -i -e "s:@prefix@:%{_jvmdir}/%{sdkdir -- $suffix}/:g" $OUTPUT_FILE
+  done
+%endif
+
  # Final setup on the main image
  customisejdk ${installdir}

@ -1970,14 +2004,6 @@ for suffix in %{build_loop} ; do
 # build cycles
 done # end of release / debug cycle loop

-docdir=%{installoutputdir -- "-docs"}
-tar -xJf %{docszip}
-mv java-%{featurever}-openjdk*.docs.* ${docdir}
-
-miscdir=%{installoutputdir -- "-misc"}
-tar -xJf %{misczip}
-mv java-%{featurever}-openjdk*.misc.* ${miscdir}
-
 %check

 # We test debug first as it will give better diagnostics on a crash
@ -2126,7 +2152,7 @@ for suffix in %{build_loop} ; do
 jdk_image=$(pwd)/%{installoutputdir -- ${suffix}}
 # Should match same definitions in build section
 docdir=$(pwd)/%{installoutputdir -- "-docs"}
-miscdir=%{installoutputdir -- "-misc"}
+miscdir=$(pwd)/%{installoutputdir -- "-misc"}

 # Install release notes and rebuild instructions
 commondocdir=${RPM_BUILD_ROOT}%{_defaultdocdir}/%{uniquejavadocdir -- $suffix}
@ -2138,13 +2164,10 @@ cp -a %{SOURCE19} %{SOURCE20} ${commondocdir}
 mkdir -p $RPM_BUILD_ROOT%{_jvmdir}
 cp -a ${jdk_image} $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}

-pushd ${jdk_image}
-
 %if %{with_systemtap}
  # Install systemtap support files
  install -dm 755 $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset
-  # note, that uniquesuffix  is in BUILD dir in this case
-  cp -a $RPM_BUILD_DIR/%{uniquesuffix ""}/tapset$suffix/*.stp $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset/
+  cp -a ${miscdir}/tapset$suffix/*.stp $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset/
  pushd  $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset/
   tapsetFiles=`ls *.stp`
  popd
@ -2169,6 +2192,7 @@ pushd ${jdk_image}

  # Install man pages
  install -d -m 755 $RPM_BUILD_ROOT%{_mandir}/man1
+  pushd ${jdk_image}
  for manpage in man/man1/*
  do
    # Convert man pages to UTF8 encoding
@ -2179,8 +2203,7 @@ pushd ${jdk_image}
  done
  # Remove man pages from jdk image
  rm -rf $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/man
-
-popd
+  popd

 if ! echo $suffix | grep -q "debug" ; then
    # Install Javadoc documentation
@ -2479,9 +2502,298 @@ cjc.mainProgram(args)
 %endif

 %changelog
-* Thu May 11 2023 Eduard Abdullin <eabdullin@almalinux.org> - 1:17.0.7.0.7-3.alma
+* Tue Nov 12 2024 Eduard Abdullin <eabdullin@almalinux.org> - 1:17.0.13.0.11-4.alma.1
 - Change portablesiffix

+* Fri Oct 18 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.13.0.11-4
+- Set this to be the default/system JDK providing 'java', 'jre', 'java-devel', etc.
+- Set rpmrelease to 4
+- Resolves: RHEL-63034
+
+* Wed Oct  9 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.13.0.11-3
+- Correct version suffix in "Update to jdk-17.0.13+11 (GA)" changelog entry
+- Related: RHEL-58785
+
+* Tue Oct  8 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.13.0.11-2
+- Update to jdk-17.0.13+11 (GA)
+- Update .gitignore to ignore openjdk-17.0.13+11.tar.xz
+- Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
+- Set buildver to 11
+- Set is_ga to 1
+- Update sources to openjdk-17.0.13+11.tar.xz
+- Resolves: RHEL-58785
+- ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **
+
+* Fri Oct  4 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.13.0.10-0.2.ea
+- Vary portablesuffix depending on whether we are on RHEL ('el8') or CentOS ('el9')
+- Set rpmrelease to 2
+- Related: RHEL-58785
+
+* Fri Oct  4 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.13.0.10-0.1.ea
+- Update to jdk-17.0.13+10 (EA)
+- Update .gitignore to ignore openjdk-17.0.13+10-ea.tar.xz
+- Sync java-17-openjdk-portable.specfile from openjdk-portable-centos-9
+- Set buildver to 10
+- Update sources to openjdk-17.0.13+10-ea.tar.xz
+- Related: RHEL-58785
+
+* Thu Oct  3 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.13.0.9-0.1.ea
+- Update to jdk-17.0.13+9 (EA)
+- Update .gitignore to ignore openjdk-17.0.13+9-ea.tar.xz
+- Sync java-17-openjdk-portable.specfile from openjdk-portable-centos-9
+- Set buildver to 9
+- Set rpmrelease to 1
+- Set portablerelease to 1
+- Update sources to openjdk-17.0.13+9-ea.tar.xz
+- Related: RHEL-58785
+
+* Thu Oct  3 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.13.0.1-0.4.ea
+- Set rpmrelease to 4
+- Set portablerelease to 2
+- Related: RHEL-58785
+
+* Thu Oct  3 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.13.0.1-0.3.ea
+- Synchronize java-17-openjdk-portable.specfile
+- Set rpmrelease to 3
+- Related: RHEL-58785
+
+* Thu Oct  3 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.13.0.1-0.2.ea
+- Update to jdk-17.0.13+1 (EA)
+- Update .gitignore to ignore openjdk-17.0.13+1-ea.tar.xz
+- Synchronize java-17-openjdk-portable.specfile
+- Set updatever to 13
+- Set buildver to 1
+- Set is_ga to 0
+- Update sources to openjdk-17.0.13+1-ea.tar.xz
+- Related: RHEL-58785
+- Remove 0001-8332174-Remove-2-unpaired-RLO-Unicode-characters-in-.patch
+- Remove unicode section from rpminspect.yml, fixed instead by
+  https://gitlab.cee.redhat.com/osci/rpminspect-data-redhat/-/merge_requests/180
+  (OPENJDK-2904)
+- Related: RHEL-58785
+
+* Mon Sep 23 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.7-3
+- Sync java-17-openjdk-portable.specfile from openjdk-portable-centos-9
+- Set rpmrelease to 3
+- Set portablesuffix to el9
+
+* Wed Jul 10 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.7-2
+- Update to jdk-17.0.12+7 (GA)
+- Update .gitignore to ignore openjdk-17.0.12+7.tar.xz
+- Sync java-17-openjdk-portable.specfile
+- Set buildver to 7
+- Set portablerelease 1
+- Set is_ga to 1
+- Update sources to openjdk-17.0.12+7.tar.xz
+- Resolves: RHEL-46635
+- Resolves: RHEL-47021
+- ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **
+
+* Tue Jul  9 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.6-0.1.ea
+- Add debuginfo section to rpminspect.yaml (OPENJDK-2904)
+- Add unicode section to rpminspect.yaml (OPENJDK-2904)
+
+* Mon Jul  8 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.6-0.1.ea
+- Add upstream patch that removes illegal RLO Unicode characters (JDK-8332174)
+- Sync the copy of the portable specfile with the latest update
+
+* Mon Jul  8 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.6-0.1.ea
+- Delete fips-17u-d63771ea660.patch
+- Add fips-17u-e893be00150.patch
+- Update fipsver to e893be00150
+
+* Mon Jul  8 2024 Anton Bobrov <abobrov@redhat.com> - 1:17.0.12.0.6-0.1.ea
+- generate_source_tarball.sh: Use tar exclude options for VCS files
+- generate_source_tarball.sh: Improve VCS exclusion
+
+* Mon Jul  8 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.12.0.6-0.1.ea
+- generate_source_tarball.sh: Update examples in header for clarity
+- generate_source_tarball.sh: Cleanup message issued when checkout already exists
+- generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
+- generate_source_tarball.sh: Only add --depth=1 on non-local repositories
+- icedtea_sync.sh: Reinstate from rhel-8.9.0 branch
+- Move maintenance scripts to a scripts subdirectory
+- discover_trees.sh: Set compile-command and indentation instructions for Emacs
+- discover_trees.sh: shellcheck: Do not use -o (SC2166)
+- discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
+- discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
+- generate_source_tarball.sh: Add authorship
+- icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
+- icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
+- icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
+- openjdk_news.sh: Set compile-command and indentation instructions for Emacs
+- openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
+- openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
+- openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
+- generate_source_tarball.sh: Output values of new options WITH_TEMP and OPENJDK_LATEST
+- generate_source_tarball.sh: Double-quote DEPTH reference (SC2086)
+- generate_source_tarball.sh: Avoid empty DEPTH reference while still appeasing shellcheck
+
+* Mon Jul  8 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.12.0.6-0.1.ea
+- Update to jdk-17.0.12+6 (EA)
+- Add openjdk-17.0.12+6-ea.tar.xz to .gitignore
+- Set updatever to 12
+- Set buildver to 6
+- Set rpmrelease to 1
+- Set is_ga to 0
+- Update sources to openjdk-17.0.12+6-ea.tar.xz
+- Require tzdata-java 2024a at runtime and for build (JDK-8325150)
+- Update lcms2 bundled provides to 2.16.0
+- Add zlib 1.3.1 bundled provides and zlib-devel build requirement (OPENJDK-3065)
+- Label as error a designator mismatch
+- Change a fix-me comment to a note instead
+- Sync generate_source_tarball.sh from Fedora rawhide
+
+* Thu Apr 11 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.9-2
+- Update to jdk-17.0.11+9 (GA)
+- Add openjdk-17.0.11+9.tar.xz to .gitignore
+- Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
+- Update buildver from 7 to 9
+- Update portablerelease from 1 to 3
+- Change is_ga from 0 to 1 to enable GA mode for release
+- Update tzdata Requires comment to mention that 2024a is not yet in the buildroot
+- Update tzdata BuildRequires comment to mention that 2024a is not yet in the buildroot
+- Update tzdata BuildRequires from 2023c to 2023d
+- Update sources from openjdk-17.0.11+7-ea.tar.xz to openjdk-17.0.11+9.tar.xz
+- Resolves: RHEL-30941
+- Resolves: RHEL-32421
+- ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
+
+* Thu Mar 28 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.7-0.2.ea
+- Update to jdk-17.0.11+7 (EA)
+- Update buildjdkver to match the featurever
+- Use featurever macro to specify fips patch
+- Explain patchN syntax situation in a comment
+- Sync generate_source_tarball.sh
+- Require tzdata 2023d (JDK-8322725)
+- openjdk_news.sh: Use grep -E instead of egrep
+- Remove RH1649512 patch for libjpeg-turbo FAR macro
+- Move pcsc-lite-libs patch to in-need-of-upstreaming section
+- Related: RHEL-30941
+
+* Thu Jan 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.10.0.7-1
+- Update to jdk-17.0.10+7 (GA)
+- Sync the copy of the portable specfile with the latest update
+- Move to -P<n> usage for patch macro which works on all RPM versions
+- Remove RH1648644 patch not in portable build (and so not applied to binary used)
+- Re-enable DEFAULT_PROMOTED_VERSION_PRE check disabled for the July 2023 release
+- generate_source_tarball.sh: Add --sort=name to tar invocation for reproducibility
+- ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
+- Resolves: RHEL-20997
+
+* Thu Jan 11 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.10.0.7-1
+- Update to jdk-17.0.10+6 (EA)
+- fips-17u-d63771ea660.patch: Regenerate from gnu-andrew branch
+- generate_source_tarball.sh: Add WITH_TEMP environment variable
+- generate_source_tarball.sh: Multithread xz on all available cores
+- generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
+- generate_source_tarball.sh: Update comment about tarball naming
+- generate_source_tarball.sh: Remove REPO_NAME from FILE_NAME_ROOT
+- generate_source_tarball.sh: Set compile-command in Emacs
+- generate_source_tarball.sh: Reformat comment header
+- generate_source_tarball.sh: Reformat and update help output
+- generate_source_tarball.sh: Move PROJECT_NAME and REPO_NAME checks
+- generate_source_tarball.sh: Do a shallow clone, for speed
+- generate_source_tarball.sh: Append -ea designator when required
+- generate_source_tarball.sh: Eliminate some removal prompting
+- generate_source_tarball.sh: Make tarball reproducible
+- generate_source_tarball.sh: Prefix temporary directory with temp-
+- generate_source_tarball.sh: shellcheck: Remove x-prefixes since we use Bash
+- generate_source_tarball.sh: shellcheck: Double-quote variable references
+- generate_source_tarball.sh: shellcheck: Do not use -a
+- generate_source_tarball.sh: shellcheck: Do not use $ in expression
+- generate_source_tarball.sh: Remove temporary directory exit conditions
+- generate_source_tarball.sh: Add note on network usage of OPENJDK_LATEST
+- Related: RHEL-20997
+
+* Thu Oct 12 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.9.0.9-1
+- Update to jdk-17.0.9+9 (GA)
+- Sync the copy of the portable specfile with the latest update
+- Re-generate FIPS patch against 17.0.9+1 following backport of JDK-8209398
+- Bump libpng version to 1.6.39 following JDK-8305815
+- Bump HarfBuzz version to 7.2.0 following JDK-8307301
+- Bump freetype version to 2.13.0 following JDK-8306881
+- Update generate_tarball.sh to be closer to upstream vanilla script inc. no more ECC removal
+- Sync generate_tarball.sh with 11u version
+- Update bug URL for RHEL to point to the Red Hat customer portal
+- Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
+- Use upstream release URL for OpenJDK source
+- Apply all patches using -p1
+- Temporarily turn off 'fresh_libjvm' due to removal of JVM_IsThreadAlive (JDK-8305425)
+- Add missing JFR and jpackage alternative ghosts
+- Move jcmd to the headless package
+- ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
+- Resolves: RHEL-12228
+- Resolves: RHEL-13660
+- Resolves: RHEL-13665
+- Resolves: RHEL-3494
+- Resolves: RHEL-11317
+- Resolves: RHEL-3461
+
+* Mon Sep 04 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.8.1.1-2
+- Set portablerelease and portablerhel to use the CentOS 9 build
+- Resolves: RHEL-36137
+
+* Mon Sep 04 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.8.1.1-2
+- Bump release number so we are newer than 9.0
+- Related: rhbz#2236592
+
+* Sat Sep 02 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.8.1.1-1
+- Update to jdk-17.0.8.1+1 (GA)
+- Update release notes to 17.0.8.1+1
+- Add backport of JDK-8312489 already upstream in 17.0.10 (see OPENJDK-2095)
+- Update openjdk_news script to specify subdirectory last
+- Add missing discover_trees script required by openjdk_news
+- Synchronise runtime and buildtime tzdata requirements
+- Resolves: rhbz#2236592
+
+* Wed Jul 19 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.8.0.7-2
+- Bump release number so we are newer than 9.0
+- Related: rhbz#2221106
+
+* Fri Jul 14 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.8.0.7-1
+- Update to jdk-17.0.8+7 (GA)
+- Update release notes to 17.0.8+7
+- Switch to GA mode for final release.
+- Sync the copy of the portable specfile with the latest update
+- Add note at top of spec file about rebuilding
+- * This tarball is embargoed until 2023-07-18 @ 1pm PT. *
+- Resolves: rhbz#2221106
+
+* Thu Jul 13 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.8.0.6-0.1.ea
+- Update to jdk-17.0.8+6 (EA)
+- Sync the copy of the portable specfile with the latest update
+- Resolves: rhbz#2217716
+
+* Wed Jul 12 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.8.0.1-0.1.ea
+- Update to jdk-17.0.8+1 (EA)
+- Update release notes to 17.0.8+1
+- Switch to EA mode
+- Drop local inclusion of JDK-8274864 & JDK-8305113 as they are included in 17.0.8+1
+- Bump bundled LCMS version to 2.15 as in jdk-17.0.8+1.
+- Bump bundled HarfBuzz version to 7.0.1 as in jdk-17.0.8+1
+- Use tapsets from the misc tarball
+- Introduce 'prelease' for the portable release versioning, to handle EA builds
+- Make sure root installation directory is created first
+- Use in-place substitution for all but the first of the tapset changes
+- Related: rhbz#2217716
+
+* Tue Jul 11 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-4
+- Introduce vm_variant global for consistency with future JDK builds
+- Related: rhbz#2203412
+
+* Mon May 15 2023 Jiri Vanek <jvanek@redhat.com> - 1:17.0.7.0.7-4
+- Exclude classes_nocoops.jsa on i686 and arm32
+- Related: rhbz#2203412
+
+* Mon May 15 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-4
+- Following JDK-8005165, class data sharing can be enabled on all JIT architectures
+- Related: rhbz#2203412
+
+* Wed May 10 2023 Severin Gehwolf <sgehwolf@redhat.com> - 1:17.0.7.0.7-4
+- Fix packaging of CDS archives
+- Resolves: rhbz#2203412
+
 * Wed Apr 26 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-3
 - Sync portable spec file with current version
 - Related: rhbz#2189326