diff --git a/.gitignore b/.gitignore
index 280d1b9..6d8d199 100644
--- a/.gitignore
+++ b/.gitignore
@@ -53,3 +53,4 @@
/java-17-openjdk-17.0.6.0.10-6.portable.unstripped.jdk.el.ppc64le.tar.xz
/java-17-openjdk-17.0.6.0.10-6.portable.unstripped.jdk.el.s390x.tar.xz
/java-17-openjdk-17.0.6.0.10-6.portable.unstripped.jdk.el.x86_64.tar.xz
+/openjdk-jdk17u-jdk-17.0.7+7.tar.xz
diff --git a/README.md b/README.md
index ff240f3..8a2724b 100644
--- a/README.md
+++ b/README.md
@@ -9,3 +9,33 @@ release page for OpenJDK 17 and the preceding interim releases:
* 15: https://openjdk.java.net/projects/jdk/15/
* 16: https://openjdk.java.net/projects/jdk/16/
* 17: https://openjdk.java.net/projects/jdk/17/
+
+# Rebuilding the OpenJDK package
+
+The OpenJDK packages are now created from a single build which is then
+packaged for different major versions of Red Hat Enterprise Linux
+(RHEL). This allows the OpenJDK team to focus their efforts on the
+development and testing of this single build, rather than having
+multiple builds which only differ by the platform they were built on.
+
+This does make rebuilding the package slightly more complicated than a
+normal package. Modifications should be made to the
+`java-17-openjdk-portable.specfile` file, which can be found with this
+README file in the source RPM or installed in the documentation tree
+by the `java-17-openjdk-headless` RPM.
+
+Once the modified `java-17-openjdk-portable` RPMs are built, they
+should be installed and will produce a number of tarballs in the
+`/usr/lib/jvm` directory. The `java-17-openjdk` RPMs can then be
+built, which will use these tarballs to create the usual RPMs found in
+RHEL. The `java-17-openjdk-portable` RPMs can be uninstalled once the
+desired final RPMs are produced.
+
+Note that the `java-17-openjdk.spec` file has a hard requirement on
+the exact version of java-17-openjdk-portable to use, so this will
+need to be modified if the version or rpmrelease values are changed in
+`java-17-openjdk-portable.specfile`.
+
+To reduce the number of RPMs involved, the `fastdebug` and `slowdebug`
+builds may be disabled using `--without fastdebug` and `--without
+slowdebug`.
diff --git a/fips-17u-257d544b594.patch b/fips-17u-bf363eecce3.patch
similarity index 81%
rename from fips-17u-257d544b594.patch
rename to fips-17u-bf363eecce3.patch
index 6c03d6f..cd8565c 100644
--- a/fips-17u-257d544b594.patch
+++ b/fips-17u-bf363eecce3.patch
@@ -136,10 +136,10 @@ index a65d91ee974..a8f054c1397 100644
BASIC_JDKLIB_LIBS=""
if test "x$TOOLCHAIN_TYPE" != xmicrosoft; then
diff --git a/make/autoconf/spec.gmk.in b/make/autoconf/spec.gmk.in
-index d557549adb3..1cb44bd2595 100644
+index 537c3e3043c..16ad3df6f09 100644
--- a/make/autoconf/spec.gmk.in
+++ b/make/autoconf/spec.gmk.in
-@@ -840,6 +840,11 @@ INSTALL_SYSCONFDIR=@sysconfdir@
+@@ -841,6 +841,11 @@ INSTALL_SYSCONFDIR=@sysconfdir@
# Libraries
#
@@ -1362,27 +1362,18 @@ index a020e1c15d8..3c064965e82 100644
// Return the instance of this class or create one if needed.
diff --git a/src/java.base/share/classes/java/security/Security.java b/src/java.base/share/classes/java/security/Security.java
-index ff2bc942c03..96a3ba4040c 100644
+index 2477027969c..06b1b6c671c 100644
--- a/src/java.base/share/classes/java/security/Security.java
+++ b/src/java.base/share/classes/java/security/Security.java
-@@ -32,6 +32,7 @@ import java.net.URL;
-
+@@ -33,6 +33,7 @@ import java.net.URL;
+ import jdk.internal.access.JavaSecurityPropertiesAccess;
import jdk.internal.event.EventHelper;
import jdk.internal.event.SecurityPropertyModificationEvent;
+import jdk.internal.access.JavaSecuritySystemConfiguratorAccess;
import jdk.internal.access.SharedSecrets;
import jdk.internal.util.StaticProperty;
import sun.security.util.Debug;
-@@ -47,12 +48,20 @@ import sun.security.jca.*;
- * implementation-specific location, which is typically the properties file
- * {@code conf/security/java.security} in the Java installation directory.
- *
-+ * Additional default values of security properties are read from a
-+ * system-specific location, if available.
-+ *
- * @author Benjamin Renaud
- * @since 1.1
- */
+@@ -57,6 +58,11 @@ import sun.security.jca.*;
public final class Security {
@@ -1394,7 +1385,7 @@ index ff2bc942c03..96a3ba4040c 100644
/* Are we debugging? -- for developers */
private static final Debug sdebug =
Debug.getInstance("properties");
-@@ -67,6 +76,19 @@ public final class Security {
+@@ -74,6 +80,19 @@ public final class Security {
}
static {
@@ -1414,26 +1405,19 @@ index ff2bc942c03..96a3ba4040c 100644
// doPrivileged here because there are multiple
// things in initialize that might require privs.
// (the FileInputStream call and the File.exists call,
-@@ -84,6 +106,7 @@ public final class Security {
+@@ -97,6 +116,7 @@ public final class Security {
+ private static void initialize() {
props = new Properties();
- boolean loadedProps = false;
boolean overrideAll = false;
+ boolean systemSecPropsEnabled = false;
// first load the system properties file
// to determine the value of security.overridePropertiesFile
-@@ -99,6 +122,7 @@ public final class Security {
- if (sdebug != null) {
- sdebug.println("reading security properties file: " +
- propFile);
-+ sdebug.println(props.toString());
- }
- } catch (IOException e) {
- if (sdebug != null) {
-@@ -193,6 +217,61 @@ public final class Security {
+@@ -117,6 +137,60 @@ public final class Security {
}
+ loadProps(null, extraPropFile, overrideAll);
}
-
++
+ boolean sysUseProps = Boolean.valueOf(System.getProperty(SYS_PROP_SWITCH, "false"));
+ boolean secUseProps = Boolean.valueOf(props.getProperty(SEC_PROP_SWITCH));
+ if (sdebug != null) {
@@ -1453,9 +1437,7 @@ index ff2bc942c03..96a3ba4040c 100644
+ }
+ }
+
-+ // FIPS support depends on the contents of java.security so
-+ // ensure it has loaded first
-+ if (loadedProps && systemSecPropsEnabled) {
++ if (systemSecPropsEnabled) {
+ boolean shouldEnable;
+ String sysProp = System.getProperty("com.redhat.fips");
+ if (sysProp == null) {
@@ -1489,15 +1471,27 @@ index ff2bc942c03..96a3ba4040c 100644
+ "system security properties being enabled.");
+ }
+ }
+ initialSecurityProperties = (Properties) props.clone();
+ if (sdebug != null) {
+ for (String key : props.stringPropertyNames()) {
+@@ -124,10 +198,9 @@ public final class Security {
+ props.getProperty(key));
+ }
+ }
+-
}
- /*
+- private static boolean loadProps(File masterFile, String extraPropFile, boolean overrideAll) {
++ static boolean loadProps(File masterFile, String extraPropFile, boolean overrideAll) {
+ InputStream is = null;
+ try {
+ if (masterFile != null && masterFile.exists()) {
diff --git a/src/java.base/share/classes/java/security/SystemConfigurator.java b/src/java.base/share/classes/java/security/SystemConfigurator.java
new file mode 100644
-index 00000000000..98ffced455b
+index 00000000000..9d26a54f5d4
--- /dev/null
+++ b/src/java.base/share/classes/java/security/SystemConfigurator.java
-@@ -0,0 +1,249 @@
+@@ -0,0 +1,232 @@
+/*
+ * Copyright (c) 2019, 2021, Red Hat, Inc.
+ *
@@ -1578,26 +1572,9 @@ index 00000000000..98ffced455b
+ * security.useSystemPropertiesFile is true.
+ */
+ static boolean configureSysProps(Properties props) {
-+ boolean systemSecPropsLoaded = false;
-+
-+ try (BufferedInputStream bis =
-+ new BufferedInputStream(
-+ new FileInputStream(CRYPTO_POLICIES_JAVA_CONFIG))) {
-+ props.load(bis);
-+ systemSecPropsLoaded = true;
-+ if (sdebug != null) {
-+ sdebug.println("reading system security properties file " +
-+ CRYPTO_POLICIES_JAVA_CONFIG);
-+ sdebug.println(props.toString());
-+ }
-+ } catch (IOException e) {
-+ if (sdebug != null) {
-+ sdebug.println("unable to load security properties from " +
-+ CRYPTO_POLICIES_JAVA_CONFIG);
-+ e.printStackTrace();
-+ }
-+ }
-+ return systemSecPropsLoaded;
++ // now load the system file, if it exists, so its values
++ // will win if they conflict with the earlier values
++ return Security.loadProps(null, CRYPTO_POLICIES_JAVA_CONFIG, false);
+ }
+
+ /*
@@ -1652,7 +1629,7 @@ index 00000000000..98ffced455b
+ sdebug.println("FIPS mode default keystore.type = " +
+ keystoreTypeValue);
+ sdebug.println("FIPS mode javax.net.ssl.keyStore = " +
-+ System.getProperty("javax.net.ssl.keyStore", ""));
++ System.getProperty("javax.net.ssl.keyStore", ""));
+ sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " +
+ System.getProperty("javax.net.ssl.trustStoreType", ""));
+ }
@@ -1785,10 +1762,10 @@ index 00000000000..3f3caac64dc
+ boolean isPlainKeySupportEnabled();
+}
diff --git a/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java b/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
-index f6d3638c3dd..a1ee182d913 100644
+index ea28bb8747e..77161eb3844 100644
--- a/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
+++ b/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
-@@ -39,6 +39,7 @@ import java.io.FilePermission;
+@@ -40,6 +40,7 @@ import java.io.FilePermission;
import java.io.ObjectInputStream;
import java.io.RandomAccessFile;
import java.security.ProtectionDomain;
@@ -1796,7 +1773,7 @@ index f6d3638c3dd..a1ee182d913 100644
import java.security.Signature;
/** A repository of "shared secrets", which are a mechanism for
-@@ -81,6 +82,7 @@ public class SharedSecrets {
+@@ -83,6 +84,7 @@ public class SharedSecrets {
private static JavaSecuritySpecAccess javaSecuritySpecAccess;
private static JavaxCryptoSealedObjectAccess javaxCryptoSealedObjectAccess;
private static JavaxCryptoSpecAccess javaxCryptoSpecAccess;
@@ -1804,7 +1781,7 @@ index f6d3638c3dd..a1ee182d913 100644
public static void setJavaUtilCollectionAccess(JavaUtilCollectionAccess juca) {
javaUtilCollectionAccess = juca;
-@@ -442,4 +444,15 @@ public class SharedSecrets {
+@@ -457,4 +459,15 @@ public class SharedSecrets {
MethodHandles.lookup().ensureInitialized(c);
} catch (IllegalAccessException e) {}
}
@@ -1821,7 +1798,7 @@ index f6d3638c3dd..a1ee182d913 100644
+ }
}
diff --git a/src/java.base/share/classes/module-info.java b/src/java.base/share/classes/module-info.java
-index 9faee9cae36..27f43550aa4 100644
+index fad70bdc058..29a813a485f 100644
--- a/src/java.base/share/classes/module-info.java
+++ b/src/java.base/share/classes/module-info.java
@@ -152,6 +152,8 @@ module java.base {
@@ -1832,9 +1809,9 @@ index 9faee9cae36..27f43550aa4 100644
+ jdk.crypto.ec,
jdk.jartool,
jdk.jlink,
- jdk.net,
+ jdk.jfr,
diff --git a/src/java.base/share/classes/sun/security/provider/SunEntries.java b/src/java.base/share/classes/sun/security/provider/SunEntries.java
-index 912cad59714..709d32912ca 100644
+index 912cad59714..7803e97f7ef 100644
--- a/src/java.base/share/classes/sun/security/provider/SunEntries.java
+++ b/src/java.base/share/classes/sun/security/provider/SunEntries.java
@@ -30,6 +30,7 @@ import java.net.*;
@@ -1856,7 +1833,7 @@ index 912cad59714..709d32912ca 100644
// the default algo used by SecureRandom class for new SecureRandom() calls
public static final String DEF_SECURE_RANDOM_ALGO;
-@@ -94,99 +99,101 @@ public final class SunEntries {
+@@ -94,89 +99,92 @@ public final class SunEntries {
// common attribute map
HashMap attrs = new HashMap<>(3);
@@ -1920,8 +1897,6 @@ index 912cad59714..709d32912ca 100644
- "sun.security.provider.DSA$SHA3_384withDSA", attrs);
- addWithAlias(p, "Signature", "SHA3-512withDSA",
- "sun.security.provider.DSA$SHA3_512withDSA", attrs);
--
-- attrs.remove("KeySize");
+ if (!systemFipsEnabled) {
+ /*
+ * SecureRandom engines
@@ -1944,32 +1919,7 @@ index 912cad59714..709d32912ca 100644
+ add(p, "SecureRandom", "SHA1PRNG",
+ "sun.security.provider.SecureRandom", attrs);
-- add(p, "Signature", "SHA1withDSAinP1363Format",
-- "sun.security.provider.DSA$SHA1withDSAinP1363Format");
-- add(p, "Signature", "NONEwithDSAinP1363Format",
-- "sun.security.provider.DSA$RawDSAinP1363Format");
-- add(p, "Signature", "SHA224withDSAinP1363Format",
-- "sun.security.provider.DSA$SHA224withDSAinP1363Format");
-- add(p, "Signature", "SHA256withDSAinP1363Format",
-- "sun.security.provider.DSA$SHA256withDSAinP1363Format");
-- add(p, "Signature", "SHA384withDSAinP1363Format",
-- "sun.security.provider.DSA$SHA384withDSAinP1363Format");
-- add(p, "Signature", "SHA512withDSAinP1363Format",
-- "sun.security.provider.DSA$SHA512withDSAinP1363Format");
-- add(p, "Signature", "SHA3-224withDSAinP1363Format",
-- "sun.security.provider.DSA$SHA3_224withDSAinP1363Format");
-- add(p, "Signature", "SHA3-256withDSAinP1363Format",
-- "sun.security.provider.DSA$SHA3_256withDSAinP1363Format");
-- add(p, "Signature", "SHA3-384withDSAinP1363Format",
-- "sun.security.provider.DSA$SHA3_384withDSAinP1363Format");
-- add(p, "Signature", "SHA3-512withDSAinP1363Format",
-- "sun.security.provider.DSA$SHA3_512withDSAinP1363Format");
-- /*
-- * Key Pair Generator engines
-- */
-- attrs.clear();
-- attrs.put("ImplementedIn", "Software");
-- attrs.put("KeySize", "2048"); // for DSA KPG and APG only
+- attrs.remove("KeySize");
+ /*
+ * Signature engines
+ */
@@ -2032,16 +1982,39 @@ index 912cad59714..709d32912ca 100644
+ "sun.security.provider.DSA$SHA3_384withDSAinP1363Format");
+ add(p, "Signature", "SHA3-512withDSAinP1363Format",
+ "sun.security.provider.DSA$SHA3_512withDSAinP1363Format");
-+ /*
-+ * Key Pair Generator engines
-+ */
-+ attrs.clear();
-+ attrs.put("ImplementedIn", "Software");
-+ attrs.put("KeySize", "2048"); // for DSA KPG and APG only
++ }
+
+- add(p, "Signature", "SHA1withDSAinP1363Format",
+- "sun.security.provider.DSA$SHA1withDSAinP1363Format");
+- add(p, "Signature", "NONEwithDSAinP1363Format",
+- "sun.security.provider.DSA$RawDSAinP1363Format");
+- add(p, "Signature", "SHA224withDSAinP1363Format",
+- "sun.security.provider.DSA$SHA224withDSAinP1363Format");
+- add(p, "Signature", "SHA256withDSAinP1363Format",
+- "sun.security.provider.DSA$SHA256withDSAinP1363Format");
+- add(p, "Signature", "SHA384withDSAinP1363Format",
+- "sun.security.provider.DSA$SHA384withDSAinP1363Format");
+- add(p, "Signature", "SHA512withDSAinP1363Format",
+- "sun.security.provider.DSA$SHA512withDSAinP1363Format");
+- add(p, "Signature", "SHA3-224withDSAinP1363Format",
+- "sun.security.provider.DSA$SHA3_224withDSAinP1363Format");
+- add(p, "Signature", "SHA3-256withDSAinP1363Format",
+- "sun.security.provider.DSA$SHA3_256withDSAinP1363Format");
+- add(p, "Signature", "SHA3-384withDSAinP1363Format",
+- "sun.security.provider.DSA$SHA3_384withDSAinP1363Format");
+- add(p, "Signature", "SHA3-512withDSAinP1363Format",
+- "sun.security.provider.DSA$SHA3_512withDSAinP1363Format");
+ /*
+ * Key Pair Generator engines
+ */
+@@ -184,9 +192,11 @@ public final class SunEntries {
+ attrs.put("ImplementedIn", "Software");
+ attrs.put("KeySize", "2048"); // for DSA KPG and APG only
- String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$";
- dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current");
- addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs);
++ if (!systemFipsEnabled) {
+ String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$";
+ dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current");
+ addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs);
@@ -2049,7 +2022,7 @@ index 912cad59714..709d32912ca 100644
/*
* Algorithm Parameter Generator engines
-@@ -201,40 +208,42 @@ public final class SunEntries {
+@@ -201,40 +211,42 @@ public final class SunEntries {
addWithAlias(p, "AlgorithmParameters", "DSA",
"sun.security.provider.DSAParameters", attrs);
@@ -2126,7 +2099,7 @@ index 912cad59714..709d32912ca 100644
/*
* Certificates
diff --git a/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java b/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java
-index ca79f25cc44..225517ac69b 100644
+index ca79f25cc44..a12fcbbd6e7 100644
--- a/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java
+++ b/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java
@@ -27,6 +27,7 @@ package sun.security.rsa;
@@ -2148,19 +2121,7 @@ index ca79f25cc44..225517ac69b 100644
private void add(Provider p, String type, String algo, String cn,
List aliases, HashMap attrs) {
services.add(new Provider.Service(p, type, algo, cn,
-@@ -56,49 +61,58 @@ public final class SunRsaSignEntries {
- // start populating content using the specified provider
- // common attribute map
- HashMap attrs = new HashMap<>(3);
-- attrs.put("SupportedKeyClasses",
-- "java.security.interfaces.RSAPublicKey" +
-- "|java.security.interfaces.RSAPrivateKey");
-+ if (!systemFipsEnabled) {
-+ attrs.put("SupportedKeyClasses",
-+ "java.security.interfaces.RSAPublicKey" +
-+ "|java.security.interfaces.RSAPrivateKey");
-+ }
-
+@@ -63,42 +68,49 @@ public final class SunRsaSignEntries {
add(p, "KeyFactory", "RSA",
"sun.security.rsa.RSAKeyFactory$Legacy",
getAliases("PKCS1"), null);
@@ -2547,10 +2508,10 @@ index 00000000000..dc8bc72fccb
+ }
+}
diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security
-index 63be286686d..b0a589c3fb4 100644
+index fab52688c04..29337576f37 100644
--- a/src/java.base/share/conf/security/java.security
+++ b/src/java.base/share/conf/security/java.security
-@@ -79,6 +79,16 @@ security.provider.tbd=Apple
+@@ -82,6 +82,17 @@ security.provider.tbd=Apple
#endif
security.provider.tbd=SunPKCS11
@@ -2563,11 +2524,12 @@ index 63be286686d..b0a589c3fb4 100644
+fips.provider.4=SunJSSE
+fips.provider.5=SunJCE
+fips.provider.6=SunRsaSign
++fips.provider.7=XMLDSig
+
#
# A list of preferred providers for specific algorithms. These providers will
# be searched for matching algorithms before the list of registered providers.
-@@ -289,6 +299,47 @@ policy.ignoreIdentityScope=false
+@@ -292,6 +303,47 @@ policy.ignoreIdentityScope=false
#
keystore.type=pkcs12
@@ -2615,7 +2577,7 @@ index 63be286686d..b0a589c3fb4 100644
#
# Controls compatibility mode for JKS and PKCS12 keystore types.
#
-@@ -326,6 +377,13 @@ package.definition=sun.misc.,\
+@@ -329,6 +381,13 @@ package.definition=sun.misc.,\
#
security.overridePropertiesFile=true
@@ -3846,7 +3808,7 @@ index 00000000000..ae4262703e6
+
+}
diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11SecretKeyFactory.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11SecretKeyFactory.java
-index 8d1b8ccb0ae..950ed20cf62 100644
+index 8d1b8ccb0ae..7ea9b4c5e7f 100644
--- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11SecretKeyFactory.java
+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11SecretKeyFactory.java
@@ -31,6 +31,7 @@ import java.security.*;
@@ -3857,7 +3819,7 @@ index 8d1b8ccb0ae..950ed20cf62 100644
import javax.crypto.spec.*;
import static sun.security.pkcs11.TemplateManager.*;
-@@ -194,6 +195,128 @@ final class P11SecretKeyFactory extends SecretKeyFactorySpi {
+@@ -194,6 +195,130 @@ final class P11SecretKeyFactory extends SecretKeyFactorySpi {
return p11Key;
}
@@ -3886,9 +3848,11 @@ index 8d1b8ccb0ae..950ed20cf62 100644
+ }
+
+ if (kdfData.kdfMech == CKM_PKCS5_PBKD2) {
-+ CK_VERSION p11Ver = token.p11.getInfo().cryptokiVersion;
-+ if (P11Util.isNSS(token) || p11Ver.major < 2 ||
-+ p11Ver.major == 2 && p11Ver.minor < 40) {
++ CK_INFO p11Info = token.p11.getInfo();
++ CK_VERSION p11Ver = (p11Info != null ? p11Info.cryptokiVersion
++ : null);
++ if (P11Util.isNSS(token) || p11Ver != null && (p11Ver.major <
++ 2 || p11Ver.major == 2 && p11Ver.minor < 40)) {
+ // NSS keeps using the old structure beyond PKCS #11 v2.40
+ ckMech = new CK_MECHANISM(kdfData.kdfMech,
+ new CK_PKCS5_PBKD2_PARAMS(password, salt,
@@ -3986,7 +3950,7 @@ index 8d1b8ccb0ae..950ed20cf62 100644
static void fixDESParity(byte[] key, int offset) {
for (int i = 0; i < 8; i++) {
int b = key[offset] & 0xfe;
-@@ -320,6 +443,9 @@ final class P11SecretKeyFactory extends SecretKeyFactorySpi {
+@@ -320,6 +445,9 @@ final class P11SecretKeyFactory extends SecretKeyFactorySpi {
keySpec = new SecretKeySpec(keyBytes, "DESede");
return engineGenerateSecret(keySpec);
}
@@ -3996,7 +3960,7 @@ index 8d1b8ccb0ae..950ed20cf62 100644
}
throw new InvalidKeySpecException
("Unsupported spec: " + keySpec.getClass().getName());
-@@ -373,6 +499,9 @@ final class P11SecretKeyFactory extends SecretKeyFactorySpi {
+@@ -373,6 +501,9 @@ final class P11SecretKeyFactory extends SecretKeyFactorySpi {
// see JCE spec
protected SecretKey engineTranslateKey(SecretKey key)
throws InvalidKeyException {
@@ -4952,7 +4916,7 @@ index 1f9c4d39f57..5e3c1b9d29f 100644
public String toString() {
StringBuilder sb = new StringBuilder();
diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
-index 5c0aacd1a67..5fbf8addcba 100644
+index 5c0aacd1a67..d796aaa3075 100644
--- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
@@ -49,6 +49,9 @@ package sun.security.pkcs11.wrapper;
@@ -4969,12 +4933,12 @@ index 5c0aacd1a67..5fbf8addcba 100644
private long pNativeData;
-+ private CK_INFO pInfo;
++ private volatile CK_INFO pInfo;
+
/**
* This method does the initialization of the native library. It is called
* exactly once for this class.
-@@ -145,23 +150,49 @@ public class PKCS11 {
+@@ -145,23 +150,48 @@ public class PKCS11 {
* @postconditions
*/
PKCS11(String pkcs11ModulePath, String functionListName)
@@ -4982,9 +4946,8 @@ index 5c0aacd1a67..5fbf8addcba 100644
+ throws IOException, PKCS11Exception {
connect(pkcs11ModulePath, functionListName);
this.pkcs11ModulePath = pkcs11ModulePath;
-+ pInfo = C_GetInfo();
-+ }
-+
+ }
+
+ /*
+ * Compatibility wrapper to allow this method to work as before
+ * when FIPS mode support is not active.
@@ -4994,8 +4957,8 @@ index 5c0aacd1a67..5fbf8addcba 100644
+ boolean omitInitialize) throws IOException, PKCS11Exception {
+ return getInstance(pkcs11ModulePath, functionList,
+ pInitArgs, omitInitialize, null, null);
- }
-
++ }
++
public static synchronized PKCS11 getInstance(String pkcs11ModulePath,
String functionList, CK_C_INITIALIZE_ARGS pInitArgs,
- boolean omitInitialize) throws IOException, PKCS11Exception {
@@ -5028,7 +4991,7 @@ index 5c0aacd1a67..5fbf8addcba 100644
}
if (omitInitialize == false) {
try {
-@@ -179,6 +210,14 @@ public class PKCS11 {
+@@ -179,6 +209,28 @@ public class PKCS11 {
return pkcs11;
}
@@ -5037,13 +5000,27 @@ index 5c0aacd1a67..5fbf8addcba 100644
+ * C_GetInfo. This structure represent Cryptoki library information.
+ */
+ public CK_INFO getInfo() {
-+ return pInfo;
++ CK_INFO lPInfo = pInfo;
++ if (lPInfo == null) {
++ synchronized (this) {
++ lPInfo = pInfo;
++ if (lPInfo == null) {
++ try {
++ lPInfo = C_GetInfo();
++ pInfo = lPInfo;
++ } catch (PKCS11Exception e) {
++ // Some PKCS #11 tokens require initialization first.
++ }
++ }
++ }
++ }
++ return lPInfo;
+ }
+
/**
* Connects this object to the specified PKCS#11 library. This method is for
* internal use only.
-@@ -1625,7 +1664,7 @@ public class PKCS11 {
+@@ -1625,7 +1677,7 @@ public class PKCS11 {
static class SynchronizedPKCS11 extends PKCS11 {
SynchronizedPKCS11(String pkcs11ModulePath, String functionListName)
@@ -5052,7 +5029,7 @@ index 5c0aacd1a67..5fbf8addcba 100644
super(pkcs11ModulePath, functionListName);
}
-@@ -1911,4 +1950,194 @@ static class SynchronizedPKCS11 extends PKCS11 {
+@@ -1911,4 +1963,194 @@ static class SynchronizedPKCS11 extends PKCS11 {
super.C_GenerateRandom(hSession, randomData);
}
}
@@ -5954,3 +5931,1318 @@ index 8c9e4f9dbe6..883dc04758e 100644
}
}
+diff --git a/test/jdk/sun/security/pkcs11/Cipher/PBECipher.java b/test/jdk/sun/security/pkcs11/Cipher/PBECipher.java
+new file mode 100644
+index 00000000000..a184a169732
+--- /dev/null
++++ b/test/jdk/sun/security/pkcs11/Cipher/PBECipher.java
+@@ -0,0 +1,233 @@
++/*
++ * Copyright (c) 2022, Red Hat, Inc.
++ *
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++import java.math.BigInteger;
++import java.security.AlgorithmParameters;
++import java.security.NoSuchAlgorithmException;
++import java.security.Provider;
++import java.security.SecureRandom;
++import java.security.Security;
++import java.util.Map;
++
++import javax.crypto.Cipher;
++import javax.crypto.SecretKey;
++import javax.crypto.SecretKeyFactory;
++import javax.crypto.interfaces.PBEKey;
++import javax.crypto.spec.IvParameterSpec;
++import javax.crypto.spec.PBEKeySpec;
++import javax.crypto.spec.PBEParameterSpec;
++
++/*
++ * @test
++ * @bug 9999999
++ * @summary test password based encryption on SunPKCS11's Cipher service
++ * @requires (jdk.version.major >= 8)
++ * @library /test/lib ..
++ * @run main/othervm/timeout=30 PBECipher
++ */
++
++public final class PBECipher {
++ public static void main(String[] args) throws Exception {
++ java.security.Security.getProviders();
++ PBECipher2.main(args);
++ }
++}
++
++final class PBECipher2 extends PKCS11Test {
++ private static final char[] password = "123456".toCharArray();
++ private static final byte[] salt = "abcdefgh".getBytes();
++ private static final byte[] iv = new byte[16];
++ private static final int iterations = 1000;
++ private static final String plainText = "This is a know plain text!";
++ private static final String sep =
++ "=========================================================================";
++
++ private static enum Configuration {
++ // Provide salt and iterations through a PBEParameterSpec instance
++ PBEParameterSpec,
++
++ // Provide salt and iterations through a AlgorithmParameters instance
++ AlgorithmParameters,
++
++ // Provide salt and iterations through an anonymous class implementing
++ // the javax.crypto.interfaces.PBEKey interface
++ AnonymousPBEKey,
++ }
++
++ private static Provider sunJCE = Security.getProvider("SunJCE");
++
++ // Generated with SunJCE
++ private static final Map assertionData = Map.of(
++ "PBEWithHmacSHA1AndAES_128", new BigInteger("8eebe98a580fb09d026" +
++ "dbfe60b3733b079e0de9ea7b0b1ccba011a1652d1e257", 16),
++ "PBEWithHmacSHA224AndAES_128", new BigInteger("1cbabdeb5d483af4a" +
++ "841942f4b1095b7d6f60e46fabfd2609c015adc38cc227", 16),
++ "PBEWithHmacSHA256AndAES_128", new BigInteger("4d82f6591df3508d2" +
++ "4531f06cdc4f90f4bdab7aeb07fbb57a3712e999d5b6f59", 16),
++ "PBEWithHmacSHA384AndAES_128", new BigInteger("3a0ed0959d51f40b9" +
++ "ba9f506a5277f430521f2fbe1ba94bae368835f221b6cb9", 16),
++ "PBEWithHmacSHA512AndAES_128", new BigInteger("1388287a446009309" +
++ "1418f4eca3ba1735b1fa025423d74ced36ce578d8ebf9da", 16),
++ "PBEWithHmacSHA1AndAES_256", new BigInteger("80f8208daab27ed02dd" +
++ "8a354ef6f23ff7813c84dd1c8a1b081d6f4dee27182a2", 16),
++ "PBEWithHmacSHA224AndAES_256", new BigInteger("7e3b9ce20aec2e52f" +
++ "f6c781602d4f79a55a88495b5217f1e22e1a068268e6247", 16),
++ "PBEWithHmacSHA256AndAES_256", new BigInteger("9d6a8b6a351dfd0dd" +
++ "9e9f45924b2860dca7719c4c07e207a64ebc1acd16cc157", 16),
++ "PBEWithHmacSHA384AndAES_256", new BigInteger("6f1b386cee3a8e2d9" +
++ "8c2e81828da0467dec8b989d22258efeab5932580d01d53", 16),
++ "PBEWithHmacSHA512AndAES_256", new BigInteger("30aaa346b2edd394f" +
++ "50916187876ac32f1287b19d55c5eea6f7ef9b84aaf291e", 16)
++ );
++
++ private static final class NoRandom extends SecureRandom {
++ @Override
++ public void nextBytes(byte[] bytes) {
++ return;
++ }
++ }
++
++ public void main(Provider sunPKCS11) throws Exception {
++ System.out.println("SunPKCS11: " + sunPKCS11.getName());
++ for (Configuration conf : Configuration.values()) {
++ testWith(sunPKCS11, "PBEWithHmacSHA1AndAES_128", conf);
++ testWith(sunPKCS11, "PBEWithHmacSHA224AndAES_128", conf);
++ testWith(sunPKCS11, "PBEWithHmacSHA256AndAES_128", conf);
++ testWith(sunPKCS11, "PBEWithHmacSHA384AndAES_128", conf);
++ testWith(sunPKCS11, "PBEWithHmacSHA512AndAES_128", conf);
++ testWith(sunPKCS11, "PBEWithHmacSHA1AndAES_256", conf);
++ testWith(sunPKCS11, "PBEWithHmacSHA224AndAES_256", conf);
++ testWith(sunPKCS11, "PBEWithHmacSHA256AndAES_256", conf);
++ testWith(sunPKCS11, "PBEWithHmacSHA384AndAES_256", conf);
++ testWith(sunPKCS11, "PBEWithHmacSHA512AndAES_256", conf);
++ }
++ System.out.println("TEST PASS - OK");
++ }
++
++ private void testWith(Provider sunPKCS11, String algorithm,
++ Configuration conf) throws Exception {
++ System.out.println(sep + System.lineSeparator() + algorithm
++ + " (with " + conf.name() + ")");
++
++ Cipher pbeCipher = getCipher(sunPKCS11, algorithm, conf);
++ BigInteger cipherText = new BigInteger(1, pbeCipher.doFinal(
++ plainText.getBytes()));
++ printByteArray("Cipher Text", cipherText);
++
++ BigInteger expectedCipherText = null;
++ if (sunJCE != null) {
++ Cipher c = getCipher(sunJCE, algorithm, conf);
++ if (c != null) {
++ expectedCipherText = new BigInteger(1, c.doFinal(
++ plainText.getBytes()));
++ } else {
++ // Move to assertionData as it's unlikely that any of
++ // the algorithms are available.
++ sunJCE = null;
++ }
++ }
++ if (expectedCipherText == null) {
++ // If SunJCE or the algorithm are not available, assertionData
++ // is used instead.
++ expectedCipherText = assertionData.get(algorithm);
++ }
++
++ if (!cipherText.equals(expectedCipherText)) {
++ printByteArray("Expected Cipher Text", expectedCipherText);
++ throw new Exception("Expected Cipher Text did not match");
++ }
++ }
++
++ private Cipher getCipher(Provider p, String algorithm,
++ Configuration conf) throws Exception {
++ Cipher pbeCipher = null;
++ try {
++ pbeCipher = Cipher.getInstance(algorithm, p);
++ } catch (NoSuchAlgorithmException e) {
++ return null;
++ }
++ switch (conf) {
++ case PBEParameterSpec, AlgorithmParameters -> {
++ SecretKey key = getPasswordOnlyPBEKey();
++ PBEParameterSpec paramSpec = new PBEParameterSpec(
++ salt, iterations, new IvParameterSpec(iv));
++ switch (conf) {
++ case PBEParameterSpec -> {
++ pbeCipher.init(Cipher.ENCRYPT_MODE, key, paramSpec);
++ }
++ case AlgorithmParameters -> {
++ AlgorithmParameters algoParams =
++ AlgorithmParameters.getInstance("PBES2");
++ algoParams.init(paramSpec);
++ pbeCipher.init(Cipher.ENCRYPT_MODE, key, algoParams);
++ }
++ }
++ }
++ case AnonymousPBEKey -> {
++ SecretKey key = getPasswordSaltIterationsPBEKey();
++ pbeCipher.init(Cipher.ENCRYPT_MODE, key, new NoRandom());
++ }
++ }
++ return pbeCipher;
++ }
++
++ private static SecretKey getPasswordOnlyPBEKey() throws Exception {
++ PBEKeySpec keySpec = new PBEKeySpec(password);
++ SecretKeyFactory skFac = SecretKeyFactory.getInstance("PBE");
++ SecretKey skey = skFac.generateSecret(keySpec);
++ keySpec.clearPassword();
++ return skey;
++ }
++
++ private static SecretKey getPasswordSaltIterationsPBEKey() {
++ return new PBEKey() {
++ public byte[] getSalt() { return salt.clone(); }
++ public int getIterationCount() { return iterations; }
++ public String getAlgorithm() { return "PBE"; }
++ public String getFormat() { return "RAW"; }
++ public char[] getPassword() { return null; } // unused in PBE Cipher
++ public byte[] getEncoded() {
++ byte[] passwdBytes = new byte[password.length];
++ for (int i = 0; i < password.length; i++)
++ passwdBytes[i] = (byte) (password[i] & 0x7f);
++ return passwdBytes;
++ }
++ };
++ }
++
++ private static void printByteArray(String title, BigInteger b) {
++ String repr = (b == null) ? "buffer is null" : b.toString(16);
++ System.out.println(title + ": " + repr + System.lineSeparator());
++ }
++
++ public static void main(String[] args) throws Exception {
++ PBECipher2 test = new PBECipher2();
++ Provider p = Security.getProvider("SunPKCS11-NSS-FIPS");
++ if (p != null) {
++ test.main(p);
++ } else {
++ main(test);
++ }
++ }
++}
+diff --git a/test/jdk/sun/security/pkcs11/KeyStore/ImportKeyToP12.java b/test/jdk/sun/security/pkcs11/KeyStore/ImportKeyToP12.java
+new file mode 100644
+index 00000000000..360e11c339d
+--- /dev/null
++++ b/test/jdk/sun/security/pkcs11/KeyStore/ImportKeyToP12.java
+@@ -0,0 +1,137 @@
++/*
++ * Copyright (c) 2022, Red Hat, Inc.
++ *
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++import java.io.ByteArrayInputStream;
++import java.io.ByteArrayOutputStream;
++import java.security.Key;
++import java.security.KeyStore;
++import java.security.KeyStoreException;
++import java.security.MessageDigest;
++import java.security.Provider;
++import java.security.Security;
++
++import javax.crypto.spec.SecretKeySpec;
++
++/*
++ * @test
++ * @bug 9999999
++ * @summary test SunPKCS11's password based privacy and integrity
++ * applied to PKCS#12 keystores
++ * @requires (jdk.version.major >= 8)
++ * @library /test/lib ..
++ * @modules java.base/sun.security.util
++ * @run main/othervm/timeout=30 -Dcom.redhat.fips=false -DNO_DEFAULT=true ImportKeyToP12
++ */
++
++public final class ImportKeyToP12 {
++ public static void main(String[] args) throws Exception {
++ java.security.Security.getProviders();
++ ImportKeyToP122.main(args);
++ }
++}
++
++final class ImportKeyToP122 extends PKCS11Test {
++ private static final String alias = "alias";
++ private static final char[] password = "123456".toCharArray();
++ private static final Key key = new SecretKeySpec(new byte[] {
++ 0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7,
++ 0x8, 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf }, "AES");
++ private static final String[] pbeCipherAlgs = new String[] {
++ "PBEWithHmacSHA1AndAES_128", "PBEWithHmacSHA224AndAES_128",
++ "PBEWithHmacSHA256AndAES_128", "PBEWithHmacSHA384AndAES_128",
++ "PBEWithHmacSHA512AndAES_128", "PBEWithHmacSHA1AndAES_256",
++ "PBEWithHmacSHA224AndAES_256", "PBEWithHmacSHA256AndAES_256",
++ "PBEWithHmacSHA384AndAES_256", "PBEWithHmacSHA512AndAES_256"
++ };
++ private static final String[] pbeMacAlgs = new String[] {
++ "HmacPBESHA1", "HmacPBESHA224", "HmacPBESHA256",
++ "HmacPBESHA384", "HmacPBESHA512"
++ };
++ private static final KeyStore p12;
++ private static final String sep =
++ "=========================================================================";
++
++ static {
++ KeyStore tP12 = null;
++ try {
++ tP12 = KeyStore.getInstance("PKCS12");
++ } catch (KeyStoreException e) {}
++ p12 = tP12;
++ }
++
++ public void main(Provider sunPKCS11) throws Exception {
++ System.out.println("SunPKCS11: " + sunPKCS11.getName());
++ // Test all privacy PBE algorithms with an integrity algorithm fixed
++ for (String pbeCipherAlg : pbeCipherAlgs) {
++ testWith(sunPKCS11, pbeCipherAlg, pbeMacAlgs[0]);
++ }
++ // Test all integrity PBE algorithms with a privacy algorithm fixed
++ for (String pbeMacAlg : pbeMacAlgs) {
++ testWith(sunPKCS11, pbeCipherAlgs[0], pbeMacAlg);
++ }
++ System.out.println("TEST PASS - OK");
++ }
++
++ /*
++ * Consistency test: 1) store a secret key in a PKCS#12 keystore using
++ * PBE algorithms from SunPKCS11 and, 2) read the secret key from the
++ * PKCS#12 keystore using PBE algorithms from other security providers
++ * such as SunJCE.
++ */
++ private void testWith(Provider sunPKCS11, String pbeCipherAlg,
++ String pbeMacAlg) throws Exception {
++ System.out.println(sep + System.lineSeparator() +
++ "Cipher PBE: " + pbeCipherAlg + System.lineSeparator() +
++ "Mac PBE: " + pbeMacAlg);
++
++ System.setProperty("keystore.pkcs12.macAlgorithm", pbeMacAlg);
++ System.setProperty("keystore.pkcs12.keyProtectionAlgorithm",
++ pbeCipherAlg);
++
++ // Create an empty PKCS#12 keystore
++ ByteArrayOutputStream baos = new ByteArrayOutputStream();
++ p12.load(null, password);
++
++ // Use PBE privacy and integrity algorithms from SunPKCS11 to store
++ // the secret key
++ Security.insertProviderAt(sunPKCS11, 1);
++ p12.setKeyEntry(alias, key, password, null);
++ p12.store(baos, password);
++
++ // Use PBE privacy and integrity algorithms from other security
++ // providers, such as SunJCE, to read the secret key
++ Security.removeProvider(sunPKCS11.getName());
++ p12.load(new ByteArrayInputStream(baos.toByteArray()), password);
++ Key k = p12.getKey(alias, password);
++
++ if (!MessageDigest.isEqual(key.getEncoded(), k.getEncoded())) {
++ throw new Exception("Keys differ. Consistency check failed.");
++ }
++ System.out.println("Secret key import successful" + System.lineSeparator() + sep);
++ }
++
++ public static void main(String[] args) throws Exception {
++ main(new ImportKeyToP122());
++ }
++}
+diff --git a/test/jdk/sun/security/pkcs11/Mac/PBAMac.java b/test/jdk/sun/security/pkcs11/Mac/PBAMac.java
+new file mode 100644
+index 00000000000..6b5662f6b4c
+--- /dev/null
++++ b/test/jdk/sun/security/pkcs11/Mac/PBAMac.java
+@@ -0,0 +1,187 @@
++/*
++ * Copyright (c) 2022, Red Hat, Inc.
++ *
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++import java.math.BigInteger;
++import java.security.NoSuchAlgorithmException;
++import java.security.Provider;
++import java.security.Security;
++import java.util.Map;
++
++import javax.crypto.Mac;
++import javax.crypto.SecretKey;
++import javax.crypto.SecretKeyFactory;
++import javax.crypto.interfaces.PBEKey;
++import javax.crypto.spec.PBEKeySpec;
++import javax.crypto.spec.PBEParameterSpec;
++
++/*
++ * @test
++ * @bug 9999999
++ * @summary test password based authentication on SunPKCS11's Mac service
++ * @requires (jdk.version.major >= 8)
++ * @library /test/lib ..
++ * @run main/othervm/timeout=30 PBAMac
++ */
++
++public final class PBAMac {
++ public static void main(String[] args) throws Exception {
++ java.security.Security.getProviders();
++ PBAMac2.main(args);
++ }
++}
++
++final class PBAMac2 extends PKCS11Test {
++ private static final char[] password = "123456".toCharArray();
++ private static final byte[] salt = "abcdefgh".getBytes();
++ private static final int iterations = 1000;
++ private static final String plainText = "This is a know plain text!";
++ private static final String sep =
++ "=========================================================================";
++
++ private static enum Configuration {
++ // Provide salt & iterations through a PBEParameterSpec instance
++ PBEParameterSpec,
++
++ // Provide salt & iterations through an anonymous class implementing
++ // the javax.crypto.interfaces.PBEKey interface
++ AnonymousPBEKey,
++ }
++
++ // Generated with SunJCE
++ private static final Map assertionData = Map.of(
++ "HmacPBESHA1", new BigInteger("febd26da5d63ce819770a2af1fc2857e" +
++ "e2c9c41c", 16),
++ "HmacPBESHA224", new BigInteger("aa6a3a1c35a4b266fea62d1a871508" +
++ "bd45f8ec326bcf16e09699063", 16),
++ "HmacPBESHA256", new BigInteger("af4d71121fd4e9d52eb42944d99b77" +
++ "8ff64376fcf6af8d1dca3ec688dfada5c8", 16),
++ "HmacPBESHA384", new BigInteger("5d6d37764205985ffca7e4a6222752" +
++ "a8bbd0520858da08ecafdc57e6246894675e375b9ba084f9ce7142" +
++ "35f202cc3452", 16),
++ "HmacPBESHA512", new BigInteger("f586c2006cc2de73fd5743e5cca701" +
++ "c942d3741a7a54a2a649ea36898996cf3c483f2d734179b47751db" +
++ "e8373c980b4072136d2e2810f4e7276024a3e9081cc1", 16)
++ );
++
++ private static Provider sunJCE = Security.getProvider("SunJCE");
++
++ public void main(Provider sunPKCS11) throws Exception {
++ System.out.println("SunPKCS11: " + sunPKCS11.getName());
++ for (Configuration conf : Configuration.values()) {
++ testWith(sunPKCS11, "HmacPBESHA1", conf);
++ testWith(sunPKCS11, "HmacPBESHA224", conf);
++ testWith(sunPKCS11, "HmacPBESHA256", conf);
++ testWith(sunPKCS11, "HmacPBESHA384", conf);
++ testWith(sunPKCS11, "HmacPBESHA512", conf);
++ }
++ System.out.println("TEST PASS - OK");
++ }
++
++ private void testWith(Provider sunPKCS11, String algorithm,
++ Configuration conf) throws Exception {
++ System.out.println(sep + System.lineSeparator() + algorithm
++ + " (with " + conf.name() + ")");
++
++ BigInteger macResult = computeMac(sunPKCS11, algorithm, conf);
++ printByteArray("HMAC Result", macResult);
++
++ BigInteger expectedMacResult = computeExpectedMac(algorithm, conf);
++
++ if (!macResult.equals(expectedMacResult)) {
++ printByteArray("Expected HMAC Result", expectedMacResult);
++ throw new Exception("Expected HMAC Result did not match");
++ }
++ }
++
++ private BigInteger computeMac(Provider p, String algorithm,
++ Configuration conf) throws Exception {
++ Mac pbaMac;
++ try {
++ pbaMac = Mac.getInstance(algorithm, p);
++ } catch (NoSuchAlgorithmException e) {
++ return null;
++ }
++ switch (conf) {
++ case PBEParameterSpec -> {
++ SecretKey key = getPasswordOnlyPBEKey();
++ pbaMac.init(key, new PBEParameterSpec(salt, iterations));
++ }
++ case AnonymousPBEKey -> {
++ SecretKey key = getPasswordSaltIterationsPBEKey();
++ pbaMac.init(key);
++ }
++ }
++ return new BigInteger(1, pbaMac.doFinal(plainText.getBytes()));
++ }
++
++ private BigInteger computeExpectedMac(String algorithm, Configuration conf)
++ throws Exception {
++ if (sunJCE != null) {
++ BigInteger macResult = computeMac(sunJCE, algorithm, conf);
++ if (macResult != null) {
++ return macResult;
++ }
++ // Move to assertionData as it's unlikely that any of
++ // the algorithms are available.
++ sunJCE = null;
++ }
++ // If SunJCE or the algorithm are not available, assertionData
++ // is used instead.
++ return assertionData.get(algorithm);
++ }
++
++ private static SecretKey getPasswordOnlyPBEKey() throws Exception {
++ PBEKeySpec keySpec = new PBEKeySpec(password);
++ SecretKeyFactory skFac = SecretKeyFactory.getInstance("PBE");
++ SecretKey skey = skFac.generateSecret(keySpec);
++ keySpec.clearPassword();
++ return skey;
++ }
++
++ private static SecretKey getPasswordSaltIterationsPBEKey() {
++ return new PBEKey() {
++ public byte[] getSalt() { return salt.clone(); }
++ public int getIterationCount() { return iterations; }
++ public String getAlgorithm() { return "PBE"; }
++ public String getFormat() { return "RAW"; }
++ public char[] getPassword() { return password.clone(); }
++ public byte[] getEncoded() { return null; } // unused in PBA Mac
++ };
++ }
++
++ private static void printByteArray(String title, BigInteger b) {
++ String repr = (b == null) ? "buffer is null" : b.toString(16);
++ System.out.println(title + ": " + repr + System.lineSeparator());
++ }
++
++ public static void main(String[] args) throws Exception {
++ PBAMac2 test = new PBAMac2();
++ Provider p = Security.getProvider("SunPKCS11-NSS-FIPS");
++ if (p != null) {
++ test.main(p);
++ } else {
++ main(test);
++ }
++ }
++}
+diff --git a/test/jdk/sun/security/pkcs11/SecretKeyFactory/TestPBKD.java b/test/jdk/sun/security/pkcs11/SecretKeyFactory/TestPBKD.java
+new file mode 100644
+index 00000000000..67c3cee5970
+--- /dev/null
++++ b/test/jdk/sun/security/pkcs11/SecretKeyFactory/TestPBKD.java
+@@ -0,0 +1,296 @@
++/*
++ * Copyright (c) 2022, Red Hat, Inc.
++ *
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++import java.lang.reflect.Field;
++import java.lang.reflect.Method;
++import java.math.BigInteger;
++import java.security.NoSuchAlgorithmException;
++import java.security.Provider;
++import java.security.Security;
++import java.util.HashMap;
++import java.util.Map;
++
++import javax.crypto.SecretKeyFactory;
++import javax.crypto.spec.PBEKeySpec;
++
++/*
++ * @test
++ * @bug 9999999
++ * @summary test key derivation on SunPKCS11's SecretKeyFactory service
++ * @requires (jdk.version.major >= 8)
++ * @library /test/lib ..
++ * @modules java.base/com.sun.crypto.provider:open
++ * @run main/othervm/timeout=30 TestPBKD
++ */
++
++public final class TestPBKD {
++ public static void main(String[] args) throws Exception {
++ java.security.Security.getProviders();
++ TestPBKD2.main(args);
++ }
++}
++
++final class TestPBKD2 extends PKCS11Test {
++ private static final char[] password = "123456".toCharArray();
++ private static final byte[] salt = "abcdefgh".getBytes();
++ private static final int iterations = 1000;
++ private static final String sep =
++ "=========================================================================";
++
++ private static Provider sunJCE = Security.getProvider("SunJCE");
++
++ // Generated with SunJCE
++ private static final Map assertionData =
++ new HashMap<>() {{
++ put("HmacPBESHA1", new BigInteger("5f7d1c360d1703cede76f47db" +
++ "2fa3facc62e7694", 16));
++ put("HmacPBESHA224", new BigInteger("289563f799b708f522ab2a3" +
++ "8d283d0afa8fc1d3d227fcb9236c3a035", 16));
++ put("HmacPBESHA256", new BigInteger("888defcf4ef37eb0647014a" +
++ "d172dd6fa3b3e9d024b962dba47608eea9b9c4b79", 16));
++ put("HmacPBESHA384", new BigInteger("f5464b34253fadab8838d0d" +
++ "b11980c1787a99bf6f6304f2d8c942e30bada523494f9d5a0f3" +
++ "741e411de21add8b5718a8", 16));
++ put("HmacPBESHA512", new BigInteger("18ae94337b132c68c611bc2" +
++ "e723ac24dcd44a46d900dae2dd6170380d4c34f90fef7bdeb5f" +
++ "6fddeb0d2230003e329b7a7eefcd35810d364ba95d31b68bb61" +
++ "e52", 16));
++ put("PBEWithHmacSHA1AndAES_128", new BigInteger("fdb3dcc2e81" +
++ "244d4d56bf7ec8dd61dd7", 16));
++ put("PBEWithHmacSHA224AndAES_128", new BigInteger("5ef9e5c6f" +
++ "df7c355f3b424233a9f24c2", 16));
++ put("PBEWithHmacSHA256AndAES_128", new BigInteger("c5af597b0" +
++ "1b4f6baac8f62ff6f22bfb1", 16));
++ put("PBEWithHmacSHA384AndAES_128", new BigInteger("c3208ebc5" +
++ "d6db88858988ec00153847d", 16));
++ put("PBEWithHmacSHA512AndAES_128", new BigInteger("b27e8f7fb" +
++ "6a4bd5ebea892cd9a7f5043", 16));
++ put("PBEWithHmacSHA1AndAES_256", new BigInteger("fdb3dcc2e81" +
++ "244d4d56bf7ec8dd61dd78a1b6fb3ad11d9ebd7f62027a2ccde" +
++ "98", 16));
++ put("PBEWithHmacSHA224AndAES_256", new BigInteger("5ef9e5c6f" +
++ "df7c355f3b424233a9f24c2c9c41793cb0948b8ea3aac240b8d" +
++ "f64d", 16));
++ put("PBEWithHmacSHA256AndAES_256", new BigInteger("c5af597b0" +
++ "1b4f6baac8f62ff6f22bfb1f319c3278c8b31cc616294716d4e" +
++ "ab08", 16));
++ put("PBEWithHmacSHA384AndAES_256", new BigInteger("c3208ebc5" +
++ "d6db88858988ec00153847d5b1b7a8723640a022dc332bcaefe" +
++ "b356", 16));
++ put("PBEWithHmacSHA512AndAES_256", new BigInteger("b27e8f7fb" +
++ "6a4bd5ebea892cd9a7f5043cefff9c38b07e599721e8d116189" +
++ "5482", 16));
++ put("PBKDF2WithHmacSHA1", new BigInteger("fdb3dcc2e81244d4d5" +
++ "6bf7ec8dd61dd78a1b6fb3ad11d9ebd7f62027a2cc", 16));
++ put("PBKDF2WithHmacSHA224", new BigInteger("5ef9e5c6fdf7c355" +
++ "f3b424233a9f24c2c9c41793cb0948b8ea3aac240b8df64d1a0" +
++ "736ec1c69eef1c7b2", 16));
++ put("PBKDF2WithHmacSHA256", new BigInteger("c5af597b01b4f6ba" +
++ "ac8f62ff6f22bfb1f319c3278c8b31cc616294716d4eab080b9" +
++ "add9db34a42ceb2fea8d27adc00f4", 16));
++ put("PBKDF2WithHmacSHA384", new BigInteger("c3208ebc5d6db888" +
++ "58988ec00153847d5b1b7a8723640a022dc332bcaefeb356995" +
++ "d076a949d35c42c7e1e1ca936c12f8dc918e497edf279a522b7" +
++ "c99580e2613846b3919af637da", 16));
++ put("PBKDF2WithHmacSHA512", new BigInteger("b27e8f7fb6a4bd5e" +
++ "bea892cd9a7f5043cefff9c38b07e599721e8d1161895482da2" +
++ "55746844cc1030be37ba1969df10ff59554d1ac5468fa9b7297" +
++ "7bb7fd52103a0a7b488cdb8957616c3e23a16bca92120982180" +
++ "c6c11a4f14649b50d0ade3a", 16));
++ }};
++
++ static interface AssertData {
++ BigInteger derive(String pbAlgo, PBEKeySpec keySpec) throws Exception;
++ }
++
++ static final class P12PBKDAssertData implements AssertData {
++ private final int outLen;
++ private final String kdfAlgo;
++ private final int blockLen;
++
++ P12PBKDAssertData(int outLen, String kdfAlgo, int blockLen) {
++ this.outLen = outLen;
++ this.kdfAlgo = kdfAlgo;
++ this.blockLen = blockLen;
++ }
++
++ @Override
++ public BigInteger derive(String pbAlgo, PBEKeySpec keySpec)
++ throws Exception {
++ // Since we need to access an internal SunJCE API, we use reflection
++ Class PKCS12PBECipherCore = Class.forName(
++ "com.sun.crypto.provider.PKCS12PBECipherCore");
++
++ Field macKeyField = PKCS12PBECipherCore.getDeclaredField("MAC_KEY");
++ macKeyField.setAccessible(true);
++ int MAC_KEY = (int) macKeyField.get(null);
++
++ Method deriveMethod = PKCS12PBECipherCore.getDeclaredMethod(
++ "derive", char[].class, byte[].class, int.class,
++ int.class, int.class, String.class, int.class);
++ deriveMethod.setAccessible(true);
++
++ return new BigInteger(1, (byte[]) deriveMethod.invoke(null,
++ keySpec.getPassword(), keySpec.getSalt(),
++ keySpec.getIterationCount(), this.outLen,
++ MAC_KEY, this.kdfAlgo, this.blockLen));
++ }
++ }
++
++ static final class PBKD2AssertData implements AssertData {
++ private final String kdfAlgo;
++ private final int keyLen;
++
++ PBKD2AssertData(String kdfAlgo, int keyLen) {
++ // Key length is pinned by the algorithm name (not kdfAlgo,
++ // but the algorithm under test: PBEWithHmacSHA*AndAES_*)
++ this.kdfAlgo = kdfAlgo;
++ this.keyLen = keyLen;
++ }
++
++ PBKD2AssertData(String kdfAlgo) {
++ // Key length is variable for the algorithm under test
++ // (kdfAlgo is the algorithm under test: PBKDF2WithHmacSHA*)
++ this(kdfAlgo, -1);
++ }
++
++ @Override
++ public BigInteger derive(String pbAlgo, PBEKeySpec keySpec)
++ throws Exception {
++ if (this.keyLen != -1) {
++ keySpec = new PBEKeySpec(
++ keySpec.getPassword(), keySpec.getSalt(),
++ keySpec.getIterationCount(), this.keyLen);
++ }
++ if (sunJCE != null) {
++ try {
++ return new BigInteger(1, SecretKeyFactory.getInstance(
++ this.kdfAlgo, sunJCE).generateSecret(keySpec)
++ .getEncoded());
++ } catch (NoSuchAlgorithmException e) {
++ // Move to assertionData as it's unlikely that any of
++ // the algorithms are available.
++ sunJCE = null;
++ }
++ }
++ // If SunJCE or the algorithm are not available, assertionData
++ // is used instead.
++ return assertionData.get(pbAlgo);
++ }
++ }
++
++ public void main(Provider sunPKCS11) throws Exception {
++ System.out.println("SunPKCS11: " + sunPKCS11.getName());
++ testWith(sunPKCS11, "HmacPBESHA1",
++ new P12PBKDAssertData(20, "SHA-1", 64));
++ testWith(sunPKCS11, "HmacPBESHA224",
++ new P12PBKDAssertData(28, "SHA-224", 64));
++ testWith(sunPKCS11, "HmacPBESHA256",
++ new P12PBKDAssertData(32, "SHA-256", 64));
++ testWith(sunPKCS11, "HmacPBESHA384",
++ new P12PBKDAssertData(48, "SHA-384", 128));
++ testWith(sunPKCS11, "HmacPBESHA512",
++ new P12PBKDAssertData(64, "SHA-512", 128));
++
++ testWith(sunPKCS11, "PBEWithHmacSHA1AndAES_128",
++ new PBKD2AssertData("PBKDF2WithHmacSHA1", 128));
++ testWith(sunPKCS11, "PBEWithHmacSHA224AndAES_128",
++ new PBKD2AssertData("PBKDF2WithHmacSHA224", 128));
++ testWith(sunPKCS11, "PBEWithHmacSHA256AndAES_128",
++ new PBKD2AssertData("PBKDF2WithHmacSHA256", 128));
++ testWith(sunPKCS11, "PBEWithHmacSHA384AndAES_128",
++ new PBKD2AssertData("PBKDF2WithHmacSHA384", 128));
++ testWith(sunPKCS11, "PBEWithHmacSHA512AndAES_128",
++ new PBKD2AssertData("PBKDF2WithHmacSHA512", 128));
++ testWith(sunPKCS11, "PBEWithHmacSHA1AndAES_256",
++ new PBKD2AssertData("PBKDF2WithHmacSHA1", 256));
++ testWith(sunPKCS11, "PBEWithHmacSHA224AndAES_256",
++ new PBKD2AssertData("PBKDF2WithHmacSHA224", 256));
++ testWith(sunPKCS11, "PBEWithHmacSHA256AndAES_256",
++ new PBKD2AssertData("PBKDF2WithHmacSHA256", 256));
++ testWith(sunPKCS11, "PBEWithHmacSHA384AndAES_256",
++ new PBKD2AssertData("PBKDF2WithHmacSHA384", 256));
++ testWith(sunPKCS11, "PBEWithHmacSHA512AndAES_256",
++ new PBKD2AssertData("PBKDF2WithHmacSHA512", 256));
++
++ // Use 1,5 * digest size as the testing derived key length (in bits)
++ testWith(sunPKCS11, "PBKDF2WithHmacSHA1", 240,
++ new PBKD2AssertData("PBKDF2WithHmacSHA1"));
++ testWith(sunPKCS11, "PBKDF2WithHmacSHA224", 336,
++ new PBKD2AssertData("PBKDF2WithHmacSHA224"));
++ testWith(sunPKCS11, "PBKDF2WithHmacSHA256", 384,
++ new PBKD2AssertData("PBKDF2WithHmacSHA256"));
++ testWith(sunPKCS11, "PBKDF2WithHmacSHA384", 576,
++ new PBKD2AssertData("PBKDF2WithHmacSHA384"));
++ testWith(sunPKCS11, "PBKDF2WithHmacSHA512", 768,
++ new PBKD2AssertData("PBKDF2WithHmacSHA512"));
++
++ System.out.println("TEST PASS - OK");
++ }
++
++ private static void testWith(Provider sunPKCS11, String algorithm,
++ AssertData assertData) throws Exception {
++ PBEKeySpec keySpec = new PBEKeySpec(password, salt, iterations);
++ testWith(sunPKCS11, algorithm, keySpec, assertData);
++ }
++
++ private static void testWith(Provider sunPKCS11, String algorithm,
++ int keyLen, AssertData assertData) throws Exception {
++ PBEKeySpec keySpec = new PBEKeySpec(password, salt, iterations, keyLen);
++ testWith(sunPKCS11, algorithm, keySpec, assertData);
++ }
++
++ private static void testWith(Provider sunPKCS11, String algorithm,
++ PBEKeySpec keySpec, AssertData assertData) throws Exception {
++ System.out.println(sep + System.lineSeparator() + algorithm);
++
++ SecretKeyFactory skFac = SecretKeyFactory.getInstance(
++ algorithm, sunPKCS11);
++ BigInteger derivedKey = new BigInteger(1,
++ skFac.generateSecret(keySpec).getEncoded());
++ printByteArray("Derived Key", derivedKey);
++
++ BigInteger expectedDerivedKey = assertData.derive(algorithm, keySpec);
++
++ if (!derivedKey.equals(expectedDerivedKey)) {
++ printByteArray("Expected Derived Key", expectedDerivedKey);
++ throw new Exception("Expected Derived Key did not match");
++ }
++ }
++
++ private static void printByteArray(String title, BigInteger b) {
++ String repr = (b == null) ? "buffer is null" : b.toString(16);
++ System.out.println(title + ": " + repr + System.lineSeparator());
++ }
++
++ public static void main(String[] args) throws Exception {
++ TestPBKD2 test = new TestPBKD2();
++ Provider p = Security.getProvider("SunPKCS11-NSS-FIPS");
++ if (p != null) {
++ test.main(p);
++ } else {
++ main(test);
++ }
++ }
++}
+diff --git a/test/jdk/sun/security/pkcs11/fips/NssdbPin.java b/test/jdk/sun/security/pkcs11/fips/NssdbPin.java
+new file mode 100644
+index 00000000000..ce01c655eb8
+--- /dev/null
++++ b/test/jdk/sun/security/pkcs11/fips/NssdbPin.java
+@@ -0,0 +1,349 @@
++/*
++ * Copyright (c) 2022, Red Hat, Inc.
++ *
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++import java.lang.reflect.Method;
++import java.nio.charset.StandardCharsets;
++import java.nio.file.Files;
++import java.nio.file.Path;
++import java.security.KeyStore;
++import java.security.Provider;
++import java.security.Security;
++import java.util.Arrays;
++import java.util.function.Consumer;
++import java.util.List;
++import javax.crypto.Cipher;
++import javax.crypto.spec.SecretKeySpec;
++
++import jdk.test.lib.process.Proc;
++import jdk.test.lib.util.FileUtils;
++
++/*
++ * @test
++ * @bug 9999999
++ * @summary
++ * Test that the fips.nssdb.path and fips.nssdb.pin properties can be used
++ * for a successful login into an NSS DB. Some additional unitary testing
++ * is then performed. This test depends on NSS modutil and must be run in
++ * FIPS mode (the SunPKCS11-NSS-FIPS security provider has to be available).
++ * @modules jdk.crypto.cryptoki/sun.security.pkcs11:+open
++ * @library /test/lib
++ * @requires (jdk.version.major >= 8)
++ * @run main/othervm/timeout=600 NssdbPin
++ * @author Martin Balao (mbalao@redhat.com)
++ */
++
++public final class NssdbPin {
++
++ // Public properties and names
++ private static final String FIPS_NSSDB_PATH_PROP = "fips.nssdb.path";
++ private static final String FIPS_NSSDB_PIN_PROP = "fips.nssdb.pin";
++ private static final String FIPS_PROVIDER_NAME = "SunPKCS11-NSS-FIPS";
++ private static final String NSSDB_TOKEN_NAME =
++ "NSS FIPS 140-2 Certificate DB";
++
++ // Data to be tested
++ private static final String[] PINS_TO_TEST =
++ new String[] {
++ "",
++ "1234567890abcdef1234567890ABCDEF\uA4F7"
++ };
++ private static enum PropType { SYSTEM, SECURITY }
++ private static enum LoginType { IMPLICIT, EXPLICIT }
++
++ // Internal test fields
++ private static final boolean DEBUG = true;
++ private static class TestContext {
++ String pin;
++ PropType propType;
++ Path workspace;
++ String nssdbPath;
++ Path nssdbPinFile;
++ LoginType loginType;
++ TestContext(String pin, Path workspace) {
++ this.pin = pin;
++ this.workspace = workspace;
++ this.nssdbPath = "sql:" + workspace;
++ this.loginType = LoginType.IMPLICIT;
++ }
++ }
++
++ public static void main(String[] args) throws Throwable {
++ if (args.length == 3) {
++ // Executed by a child process.
++ mainChild(args[0], args[1], LoginType.valueOf(args[2]));
++ } else if (args.length == 0) {
++ // Executed by the parent process.
++ mainLauncher();
++ // Test defaults
++ mainChild("sql:/etc/pki/nssdb", "", LoginType.IMPLICIT);
++ System.out.println("TEST PASS - OK");
++ } else {
++ throw new Exception("Unexpected number of arguments.");
++ }
++ }
++
++ private static void mainChild(String expectedPath, String expectedPin,
++ LoginType loginType) throws Throwable {
++ if (DEBUG) {
++ for (String prop : Arrays.asList(FIPS_NSSDB_PATH_PROP,
++ FIPS_NSSDB_PIN_PROP)) {
++ System.out.println(prop + " (System): " +
++ System.getProperty(prop));
++ System.out.println(prop + " (Security): " +
++ Security.getProperty(prop));
++ }
++ }
++
++ /*
++ * Functional cross-test against an NSS DB generated by modutil
++ * with the same PIN. Check that we can perform a crypto operation
++ * that requires a login. The login might be explicit or implicit.
++ */
++ Provider p = Security.getProvider(FIPS_PROVIDER_NAME);
++ if (DEBUG) {
++ System.out.println(FIPS_PROVIDER_NAME + ": " + p);
++ }
++ if (p == null) {
++ throw new Exception(FIPS_PROVIDER_NAME + " initialization failed.");
++ }
++ if (DEBUG) {
++ System.out.println("Login type: " + loginType);
++ }
++ if (loginType == LoginType.EXPLICIT) {
++ // Do the expansion to account for truncation, so C_Login in
++ // the NSS Software Token gets a UTF-8 encoded PIN.
++ byte[] pinUtf8 = expectedPin.getBytes(StandardCharsets.UTF_8);
++ char[] pinChar = new char[pinUtf8.length];
++ for (int i = 0; i < pinChar.length; i++) {
++ pinChar[i] = (char)(pinUtf8[i] & 0xFF);
++ }
++ KeyStore.getInstance("PKCS11", p).load(null, pinChar);
++ if (DEBUG) {
++ System.out.println("Explicit login succeeded.");
++ }
++ }
++ if (DEBUG) {
++ System.out.println("Trying a crypto operation...");
++ }
++ final int blockSize = 16;
++ Cipher cipher = Cipher.getInstance("AES/ECB/NoPadding", p);
++ cipher.init(Cipher.ENCRYPT_MODE,
++ new SecretKeySpec(new byte[blockSize], "AES"));
++ if (cipher.doFinal(new byte[blockSize]).length != blockSize) {
++ throw new Exception("Could not perform a crypto operation.");
++ }
++ if (DEBUG) {
++ if (loginType == LoginType.IMPLICIT) {
++ System.out.println("Implicit login succeeded.");
++ }
++ System.out.println("Crypto operation after login succeeded.");
++ }
++
++ if (loginType == LoginType.IMPLICIT) {
++ /*
++ * Additional unitary testing. Expected to succeed at this point.
++ */
++ if (DEBUG) {
++ System.out.println("Trying unitary test...");
++ }
++ String sysPathProp = System.getProperty(FIPS_NSSDB_PATH_PROP);
++ if (DEBUG) {
++ System.out.println("Path value (as a System property): " +
++ sysPathProp);
++ }
++ if (!expectedPath.equals(sysPathProp)) {
++ throw new Exception("Path is different than expected: " +
++ sysPathProp + " (actual) vs " + expectedPath +
++ " (expected).");
++ }
++ Class c = Class
++ .forName("sun.security.pkcs11.FIPSTokenLoginHandler");
++ Method m = c.getDeclaredMethod("getFipsNssdbPin");
++ m.setAccessible(true);
++ String pin = null;
++ char[] pinChar = (char[]) m.invoke(c);
++ if (pinChar != null) {
++ byte[] pinUtf8 = new byte[pinChar.length];
++ for (int i = 0; i < pinUtf8.length; i++) {
++ pinUtf8[i] = (byte) pinChar[i];
++ }
++ pin = new String(pinUtf8, StandardCharsets.UTF_8);
++ }
++ if (!expectedPin.isEmpty() && !expectedPin.equals(pin) ||
++ expectedPin.isEmpty() && pin != null) {
++ throw new Exception("PIN is different than expected: '" + pin +
++ "' (actual) vs '" + expectedPin + "' (expected).");
++ }
++ if (DEBUG) {
++ System.out.println("PIN value: " + pin);
++ System.out.println("Unitary test succeeded.");
++ }
++ }
++ }
++
++ private static void mainLauncher() throws Throwable {
++ for (String pin : PINS_TO_TEST) {
++ Path workspace = Files.createTempDirectory(null);
++ try {
++ TestContext ctx = new TestContext(pin, workspace);
++ createNSSDB(ctx);
++ {
++ ctx.loginType = LoginType.IMPLICIT;
++ for (PropType propType : PropType.values()) {
++ ctx.propType = propType;
++ pinLauncher(ctx);
++ envLauncher(ctx);
++ fileLauncher(ctx);
++ }
++ }
++ explicitLoginLauncher(ctx);
++ } finally {
++ FileUtils.deleteFileTreeWithRetry(workspace);
++ }
++ }
++ }
++
++ private static void pinLauncher(TestContext ctx) throws Throwable {
++ launchTest(p -> {}, "pin:" + ctx.pin, ctx);
++ }
++
++ private static void envLauncher(TestContext ctx) throws Throwable {
++ final String NSSDB_PIN_ENV_VAR = "NSSDB_PIN_ENV_VAR";
++ launchTest(p -> p.env(NSSDB_PIN_ENV_VAR, ctx.pin),
++ "env:" + NSSDB_PIN_ENV_VAR, ctx);
++ }
++
++ private static void fileLauncher(TestContext ctx) throws Throwable {
++ // The file containing the PIN (ctx.nssdbPinFile) was created by the
++ // generatePinFile method, called from createNSSDB.
++ launchTest(p -> {}, "file:" + ctx.nssdbPinFile, ctx);
++ }
++
++ private static void explicitLoginLauncher(TestContext ctx)
++ throws Throwable {
++ ctx.loginType = LoginType.EXPLICIT;
++ ctx.propType = PropType.SYSTEM;
++ launchTest(p -> {}, "Invalid PIN, must be ignored", ctx);
++ }
++
++ private static void launchTest(Consumer procCb, String pinPropVal,
++ TestContext ctx) throws Throwable {
++ if (DEBUG) {
++ System.out.println("Launching JVM with " + FIPS_NSSDB_PATH_PROP +
++ "=" + ctx.nssdbPath + " and " + FIPS_NSSDB_PIN_PROP +
++ "=" + pinPropVal);
++ }
++ Proc p = Proc.create(NssdbPin.class.getName())
++ .args(ctx.nssdbPath, ctx.pin, ctx.loginType.name());
++ if (ctx.propType == PropType.SYSTEM) {
++ p.prop(FIPS_NSSDB_PATH_PROP, ctx.nssdbPath);
++ p.prop(FIPS_NSSDB_PIN_PROP, pinPropVal);
++ // Make sure that Security properties defaults are not used.
++ p.secprop(FIPS_NSSDB_PATH_PROP, "");
++ p.secprop(FIPS_NSSDB_PIN_PROP, "");
++ } else if (ctx.propType == PropType.SECURITY) {
++ p.secprop(FIPS_NSSDB_PATH_PROP, ctx.nssdbPath);
++ pinPropVal = escapeForPropsFile(pinPropVal);
++ p.secprop(FIPS_NSSDB_PIN_PROP, pinPropVal);
++ } else {
++ throw new Exception("Unsupported property type.");
++ }
++ if (DEBUG) {
++ p.inheritIO();
++ p.prop("java.security.debug", "sunpkcs11");
++ p.debug(NssdbPin.class.getName());
++
++ // Need the launched process to connect to a debugger?
++ //System.setProperty("test.vm.opts", "-Xdebug -Xrunjdwp:" +
++ // "transport=dt_socket,address=localhost:8000,suspend=y");
++ } else {
++ p.nodump();
++ }
++ procCb.accept(p);
++ p.start().waitFor(0);
++ }
++
++ private static String escapeForPropsFile(String str) throws Throwable {
++ StringBuffer sb = new StringBuffer();
++ for (int i = 0; i < str.length(); i++) {
++ int cp = str.codePointAt(i);
++ if (Character.UnicodeBlock.of(cp)
++ == Character.UnicodeBlock.BASIC_LATIN) {
++ sb.append(Character.toChars(cp));
++ } else {
++ sb.append("\\u").append(String.format("%04X", cp));
++ }
++ }
++ return sb.toString();
++ }
++
++ private static void createNSSDB(TestContext ctx) throws Throwable {
++ ProcessBuilder pb = getModutilPB(ctx, "-create");
++ if (DEBUG) {
++ System.out.println("Creating an NSS DB in " + ctx.workspace +
++ "...");
++ System.out.println("cmd: " + String.join(" ", pb.command()));
++ }
++ if (pb.start().waitFor() != 0) {
++ throw new Exception("NSS DB creation failed.");
++ }
++ generatePinFile(ctx);
++ pb = getModutilPB(ctx, "-changepw", NSSDB_TOKEN_NAME,
++ "-newpwfile", ctx.nssdbPinFile.toString());
++ if (DEBUG) {
++ System.out.println("NSS DB created.");
++ System.out.println("Changing NSS DB PIN...");
++ System.out.println("cmd: " + String.join(" ", pb.command()));
++ }
++ if (pb.start().waitFor() != 0) {
++ throw new Exception("NSS DB PIN change failed.");
++ }
++ if (DEBUG) {
++ System.out.println("NSS DB PIN changed.");
++ }
++ }
++
++ private static ProcessBuilder getModutilPB(TestContext ctx, String... args)
++ throws Throwable {
++ ProcessBuilder pb = new ProcessBuilder("modutil", "-force");
++ List pbCommand = pb.command();
++ if (args != null) {
++ pbCommand.addAll(Arrays.asList(args));
++ }
++ pbCommand.add("-dbdir");
++ pbCommand.add(ctx.nssdbPath);
++ if (DEBUG) {
++ pb.inheritIO();
++ } else {
++ pb.redirectError(ProcessBuilder.Redirect.INHERIT);
++ }
++ return pb;
++ }
++
++ private static void generatePinFile(TestContext ctx) throws Throwable {
++ ctx.nssdbPinFile = Files.createTempFile(ctx.workspace, null, null);
++ Files.writeString(ctx.nssdbPinFile, ctx.pin + System.lineSeparator() +
++ "2nd line with garbage");
++ }
++}
+diff --git a/test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java b/test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java
+new file mode 100644
+index 00000000000..87f1ad04505
+--- /dev/null
++++ b/test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java
+@@ -0,0 +1,77 @@
++/*
++ * Copyright (c) 2022, Red Hat, Inc.
++ *
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++import java.security.Provider;
++import java.security.Security;
++
++/*
++ * @test
++ * @bug 9999999
++ * @requires (jdk.version.major >= 8)
++ * @run main/othervm/timeout=30 VerifyMissingAttributes
++ * @author Martin Balao (mbalao@redhat.com)
++ */
++
++public final class VerifyMissingAttributes {
++
++ private static final String[] svcAlgImplementedIn = {
++ "AlgorithmParameterGenerator.DSA",
++ "AlgorithmParameters.DSA",
++ "CertificateFactory.X.509",
++ "KeyStore.JKS",
++ "KeyStore.CaseExactJKS",
++ "KeyStore.DKS",
++ "CertStore.Collection",
++ "CertStore.com.sun.security.IndexedCollection"
++ };
++
++ public static void main(String[] args) throws Throwable {
++ Provider sunProvider = Security.getProvider("SUN");
++ for (String svcAlg : svcAlgImplementedIn) {
++ String filter = svcAlg + " ImplementedIn:Software";
++ doQuery(sunProvider, filter);
++ }
++ if (Double.parseDouble(
++ System.getProperty("java.specification.version")) >= 17) {
++ String filter = "KeyFactory.RSASSA-PSS SupportedKeyClasses:" +
++ "java.security.interfaces.RSAPublicKey" +
++ "|java.security.interfaces.RSAPrivateKey";
++ doQuery(Security.getProvider("SunRsaSign"), filter);
++ }
++ System.out.println("TEST PASS - OK");
++ }
++
++ private static void doQuery(Provider expectedProvider, String filter)
++ throws Exception {
++ if (expectedProvider == null) {
++ throw new Exception("Provider not found.");
++ }
++ Provider[] providers = Security.getProviders(filter);
++ if (providers == null || providers.length != 1 ||
++ providers[0] != expectedProvider) {
++ throw new Exception("Failure retrieving the provider with this" +
++ " query: " + filter);
++ }
++ }
++}
diff --git a/generate_source_tarball.sh b/generate_source_tarball.sh
index eb99e1a..d32c8d2 100755
--- a/generate_source_tarball.sh
+++ b/generate_source_tarball.sh
@@ -17,7 +17,7 @@
# PROJECT_NAME=release
# OPENJDK_URL=http://icedtea.classpath.org/hg/
# TO_COMPRESS="*/tapset"
-#
+#
# They are used to create correct name and are used in construction of sources url (unless REPO_ROOT is set)
# This script creates a single source tarball out of the repository
@@ -50,26 +50,55 @@ if [ "x$1" = "xhelp" ] ; then
echo "FILE_NAME_ROOT - name of the archive, minus extensions (optional; defaults to PROJECT_NAME-REPO_NAME-VERSION)"
echo "TO_COMPRESS - what part of clone to pack (default is openjdk)"
echo "PR3823 - the path to the PR3823 patch to apply (optional; downloaded if unavailable)"
+ echo "BOOT_JDK - the bootstrap JDK to satisfy the configure run"
exit 1;
fi
if [ "x$VERSION" = "x" ] ; then
echo "No VERSION specified"
- exit -2
+ exit 2
fi
echo "Version: ${VERSION}"
-
+
+NUM_VER=${VERSION##jdk-}
+RELEASE_VER=${NUM_VER%%+*}
+BUILD_VER=${NUM_VER##*+}
+MAJOR_VER=${RELEASE_VER%%.*}
+echo "Major version is ${MAJOR_VER}, release ${RELEASE_VER}, build ${BUILD_VER}"
+
+if [ "x$BOOT_JDK" = "x" ] ; then
+ echo "No boot JDK specified".
+ BOOT_JDK=/usr/lib/jvm/java-${MAJOR_VER}-openjdk;
+ echo -n "Checking for ${BOOT_JDK}...";
+ if [ -d ${BOOT_JDK} -a -x ${BOOT_JDK}/bin/java ] ; then
+ echo "Boot JDK found at ${BOOT_JDK}";
+ else
+ echo "Not found";
+ PREV_VER=$((${MAJOR_VER} - 1));
+ BOOT_JDK=/usr/lib/jvm/java-${PREV_VER}-openjdk;
+ echo -n "Checking for ${BOOT_JDK}...";
+ if [ -d ${BOOT_JDK} -a -x ${BOOT_JDK}/bin/java ] ; then
+ echo "Boot JDK found at ${BOOT_JDK}";
+ else
+ echo "Not found";
+ exit 4;
+ fi
+ fi
+else
+ echo "Boot JDK: ${BOOT_JDK}";
+fi
+
# REPO_NAME is only needed when we default on REPO_ROOT and FILE_NAME_ROOT
if [ "x$FILE_NAME_ROOT" = "x" -o "x$REPO_ROOT" = "x" ] ; then
if [ "x$PROJECT_NAME" = "x" ] ; then
echo "No PROJECT_NAME specified"
- exit -1
+ exit 1
fi
echo "Project name: ${PROJECT_NAME}"
if [ "x$REPO_NAME" = "x" ] ; then
echo "No REPO_NAME specified"
- exit -3
+ exit 3
fi
echo "Repository name: ${REPO_NAME}"
fi
@@ -98,7 +127,7 @@ fi;
if [ "x$TO_COMPRESS" = "x" ] ; then
TO_COMPRESS="openjdk"
- echo "No to be compressed targets specified, ; default to ${TO_COMPRESS}"
+ echo "No targets to be compressed specified, ; default to ${TO_COMPRESS}"
fi;
if [ -d ${FILE_NAME_ROOT} ] ; then
@@ -113,31 +142,31 @@ else
popd
fi
pushd "${FILE_NAME_ROOT}"
- if [ -d openjdk/src ]; then
+ if [ -d openjdk/src ]; then
pushd openjdk
echo "Removing EC source code we don't build"
CRYPTO_PATH=src/jdk.crypto.ec/share/native/libsunec/impl
- rm -vf ${CRYPTO_PATH}/ec2.h
- rm -vf ${CRYPTO_PATH}/ec2_163.c
- rm -vf ${CRYPTO_PATH}/ec2_193.c
- rm -vf ${CRYPTO_PATH}/ec2_233.c
- rm -vf ${CRYPTO_PATH}/ec2_aff.c
- rm -vf ${CRYPTO_PATH}/ec2_mont.c
- rm -vf ${CRYPTO_PATH}/ecp_192.c
- rm -vf ${CRYPTO_PATH}/ecp_224.c
+ rm -vf ${CRYPTO_PATH}/ec2.h
+ rm -vf ${CRYPTO_PATH}/ec2_163.c
+ rm -vf ${CRYPTO_PATH}/ec2_193.c
+ rm -vf ${CRYPTO_PATH}/ec2_233.c
+ rm -vf ${CRYPTO_PATH}/ec2_aff.c
+ rm -vf ${CRYPTO_PATH}/ec2_mont.c
+ rm -vf ${CRYPTO_PATH}/ecp_192.c
+ rm -vf ${CRYPTO_PATH}/ecp_224.c
echo "Syncing EC list with NSS"
if [ "x$PR3823" = "x" ] ; then
# get PR3823.patch (from https://github.com/icedtea-git/icedtea) in the ${ICEDTEA_VERSION} branch
# Do not push it or publish it
- echo "PR3823 not found. Downloading..."
- wget -v https://github.com/icedtea-git/icedtea/raw/${ICEDTEA_VERSION}/patches/pr3823.patch
- echo "Applying ${PWD}/pr3823.patch"
- patch -Np1 < pr3823.patch
- rm pr3823.patch
- else
- echo "Applying ${PR3823}"
- patch -Np1 < $PR3823
+ echo "PR3823 not found. Downloading..."
+ wget -v https://github.com/icedtea-git/icedtea/raw/${ICEDTEA_VERSION}/patches/pr3823.patch
+ echo "Applying ${PWD}/pr3823.patch"
+ patch -Np1 < pr3823.patch
+ rm pr3823.patch
+ else
+ echo "Applying ${PR3823}"
+ patch -Np1 < $PR3823
fi;
find . -name '*.orig' -exec rm -vf '{}' ';'
popd
@@ -146,11 +175,29 @@ pushd "${FILE_NAME_ROOT}"
# Generate .src-rev so build has knowledge of the revision the tarball was created from
mkdir build
pushd build
- sh ${PWD}/../openjdk/configure
+ sh ${PWD}/../openjdk/configure --with-boot-jdk=${BOOT_JDK}
make store-source-revision
popd
rm -rf build
+ # Remove commit checks
+ echo "Removing $(find openjdk -name '.jcheck' -print)"
+ find openjdk -name '.jcheck' -print0 | xargs -0 rm -r
+
+ # Remove history and GHA
+ echo "find openjdk -name '.hgtags'"
+ find openjdk -name '.hgtags' -exec rm -v '{}' '+'
+ echo "find openjdk -name '.hgignore'"
+ find openjdk -name '.hgignore' -exec rm -v '{}' '+'
+ echo "find openjdk -name '.gitattributes'"
+ find openjdk -name '.gitattributes' -exec rm -v '{}' '+'
+ echo "find openjdk -name '.gitignore'"
+ find openjdk -name '.gitignore' -exec rm -v '{}' '+'
+ echo "find openjdk -name '.git'"
+ find openjdk -name '.git' -exec rm -rv '{}' '+'
+ echo "find openjdk -name '.github'"
+ find openjdk -name '.github' -exec rm -rv '{}' '+'
+
echo "Compressing remaining forest"
if [ "X$COMPRESSION" = "Xxz" ] ; then
SWITCH=cJf
diff --git a/java-17-openjdk-portable.specfile b/java-17-openjdk-portable.specfile
new file mode 100644
index 0000000..944f9e7
--- /dev/null
+++ b/java-17-openjdk-portable.specfile
@@ -0,0 +1,1990 @@
+# portable jdk 17 specific bug, _jvmdir being missing
+%define _jvmdir /usr/lib/jvm
+
+# debug_package %%{nil} is portable-jdks specific
+%define debug_package %{nil}
+
+# RPM conditionals so as to be able to dynamically produce
+# slowdebug/release builds. See:
+# http://rpm.org/user_doc/conditional_builds.html
+#
+# Examples:
+#
+# Produce release, fastdebug *and* slowdebug builds on x86_64 (default):
+# $ rpmbuild -ba java-17-openjdk.spec
+#
+# Produce only release builds (no debug builds) on x86_64:
+# $ rpmbuild -ba java-17-openjdk.spec --without slowdebug --without fastdebug
+#
+# Only produce a release build on x86_64:
+# $ fedpkg mockbuild --without slowdebug --without fastdebug
+# Enable fastdebug builds by default on relevant arches.
+%bcond_without fastdebug
+# Enable slowdebug builds by default on relevant arches.
+%bcond_without slowdebug
+# Enable release builds by default on relevant arches.
+%bcond_without release
+# Enable static library builds by default.
+%bcond_without staticlibs
+# Build a fresh libjvm.so for use in a copy of the bootstrap JDK
+%bcond_without fresh_libjvm
+# Build with system libraries
+%bcond_with system_libs
+
+# Workaround for stripping of debug symbols from static libraries
+%if %{with staticlibs}
+%define __brp_strip_static_archive %{nil}
+%global include_staticlibs 1
+%else
+%global include_staticlibs 0
+%endif
+
+# Define whether to use the bootstrap JDK directly or with a fresh libjvm.so
+%if %{with fresh_libjvm}
+%global build_hotspot_first 1
+%else
+%global build_hotspot_first 0
+%endif
+
+%if %{with system_libs}
+%global system_libs 1
+%global link_type system
+%global freetype_lib %{nil}
+%else
+%global system_libs 0
+%global link_type bundled
+%global freetype_lib |libfreetype[.]so.*
+%endif
+
+# The -g flag says to use strip -g instead of full strip on DSOs or EXEs.
+# This fixes detailed NMT and other tools which need minimal debug info.
+# See: https://bugzilla.redhat.com/show_bug.cgi?id=1520879
+%global _find_debuginfo_opts -g
+
+# Disable LTO as this causes build failures at the moment.
+# See RHBZ#1861401
+%define _lto_cflags %{nil}
+
+# note: parametrized macros are order-sensitive (unlike not-parametrized) even with normal macros
+# also necessary when passing it as parameter to other macros. If not macro, then it is considered a switch
+# see the difference between global and define:
+# See https://github.com/rpm-software-management/rpm/issues/127 to comments at "pmatilai commented on Aug 18, 2017"
+# (initiated in https://bugzilla.redhat.com/show_bug.cgi?id=1482192)
+%global debug_suffix_unquoted -slowdebug
+%global fastdebug_suffix_unquoted -fastdebug
+%global main_suffix_unquoted -main
+%global staticlibs_suffix_unquoted -staticlibs
+# quoted one for shell operations
+%global debug_suffix "%{debug_suffix_unquoted}"
+%global fastdebug_suffix "%{fastdebug_suffix_unquoted}"
+%global normal_suffix ""
+%global main_suffix "%{main_suffix_unquoted}"
+%global staticlibs_suffix "%{staticlibs_suffix_unquoted}"
+
+%global debug_warning This package is unoptimised with full debugging. Install only as needed and remove ASAP.
+%global fastdebug_warning This package is optimised with full debugging. Install only as needed and remove ASAP.
+%global debug_on unoptimised with full debugging on
+%global fastdebug_on optimised with full debugging on
+%global for_fastdebug for packages with debugging on and optimisation
+%global for_debug for packages with debugging on and no optimisation
+
+%if %{with release}
+%global include_normal_build 1
+%else
+%global include_normal_build 0
+%endif
+
+%if %{include_normal_build}
+%global normal_build %{normal_suffix}
+%else
+%global normal_build %{nil}
+%endif
+
+# We have hardcoded list of files, which is appearing in alternatives, and in files
+# in alternatives those are slaves and master, very often triplicated by man pages
+# in files all masters and slaves are ghosted
+# the ghosts are here to allow installation via query like `dnf install /usr/bin/java`
+# you can list those files, with appropriate sections: cat *.spec | grep -e --install -e --slave -e post_
+# TODO - fix those hardcoded lists via single list
+# Those files must *NOT* be ghosted for *slowdebug* packages
+# FIXME - if you are moving jshell or jlink or similar, always modify all three sections
+# you can check via headless and devels:
+# rpm -ql --noghost java-11-openjdk-headless-11.0.1.13-8.fc29.x86_64.rpm | grep bin
+# == rpm -ql java-11-openjdk-headless-slowdebug-11.0.1.13-8.fc29.x86_64.rpm | grep bin
+# != rpm -ql java-11-openjdk-headless-11.0.1.13-8.fc29.x86_64.rpm | grep bin
+# similarly for other %%{_jvmdir}/{jre,java} and %%{_javadocdir}/{java,java-zip}
+%define is_release_build() %( if [ "%{?1}" == "%{debug_suffix_unquoted}" -o "%{?1}" == "%{fastdebug_suffix_unquoted}" ]; then echo "0" ; else echo "1"; fi )
+
+# while JDK is a techpreview(is_system_jdk=0), some provides are turned off. Once jdk stops to be an techpreview, move it to 1
+# as sytem JDK, we mean any JDK which can run whole system java stack without issues (like bytecode issues, module issues, dependencies...)
+%global is_system_jdk 0
+
+%global aarch64 aarch64 arm64 armv8
+# we need to distinguish between big and little endian PPC64
+%global ppc64le ppc64le
+%global ppc64be ppc64 ppc64p7
+# Set of architectures which support multiple ABIs
+%global multilib_arches %{power64} sparc64 x86_64
+# Set of architectures for which we build slowdebug builds
+%global debug_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} s390x
+# Set of architectures for which we build fastdebug builds
+%global fastdebug_arches x86_64 ppc64le aarch64
+# Set of architectures with a Just-In-Time (JIT) compiler
+%global jit_arches %{arm} %{aarch64} %{ix86} %{power64} s390x sparcv9 sparc64 x86_64
+# Set of architectures which use the Zero assembler port (!jit_arches)
+%global zero_arches ppc s390
+# Set of architectures which run a full bootstrap cycle
+%global bootstrap_arches %{jit_arches}
+# Set of architectures which support SystemTap tapsets
+%global systemtap_arches %{jit_arches}
+# Set of architectures with a Ahead-Of-Time (AOT) compiler
+%global aot_arches x86_64 %{aarch64}
+# Set of architectures which support the serviceability agent
+%global sa_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} %{arm}
+# Set of architectures which support class data sharing
+# As of JDK-8005165 in OpenJDK 10, class sharing is not arch-specific
+# However, it does segfault on the Zero assembler port, so currently JIT only
+%global share_arches %{jit_arches}
+# Set of architectures for which we build the Shenandoah garbage collector
+%global shenandoah_arches x86_64 %{aarch64}
+# Set of architectures for which we build the Z garbage collector
+%global zgc_arches x86_64
+# Set of architectures for which alt-java has SSB mitigation
+%global ssbd_arches x86_64
+# Set of architectures for which java has short vector math library (libjsvml.so)
+%global svml_arches x86_64
+# Set of architectures where we verify backtraces with gdb
+# s390x fails on RHEL 7 so we exclude it there
+%if (0%{?rhel} > 0 && 0%{?rhel} < 8)
+%global gdb_arches %{arm} %{aarch64} %{ix86} %{power64} sparcv9 sparc64 x86_64 %{zero_arches}
+%else
+%global gdb_arches %{jit_arches} %{zero_arches}
+%endif
+
+# By default, we build a slowdebug build during main build on JIT architectures
+%if %{with slowdebug}
+%ifarch %{debug_arches}
+%global include_debug_build 1
+%else
+%global include_debug_build 0
+%endif
+%else
+%global include_debug_build 0
+%endif
+
+# On certain architectures, we compile the Shenandoah GC
+%ifarch %{shenandoah_arches}
+%global use_shenandoah_hotspot 1
+%else
+%global use_shenandoah_hotspot 0
+%endif
+
+# By default, we build a fastdebug build during main build only on fastdebug architectures
+%if %{with fastdebug}
+%ifarch %{fastdebug_arches}
+%global include_fastdebug_build 1
+%else
+%global include_fastdebug_build 0
+%endif
+%else
+%global include_fastdebug_build 0
+%endif
+
+%if %{include_debug_build}
+%global slowdebug_build %{debug_suffix}
+%else
+%global slowdebug_build %{nil}
+%endif
+
+%if %{include_fastdebug_build}
+%global fastdebug_build %{fastdebug_suffix}
+%else
+%global fastdebug_build %{nil}
+%endif
+
+# If you disable all builds, then the build fails
+# Build and test slowdebug first as it provides the best diagnostics
+%global build_loop %{slowdebug_build} %{fastdebug_build} %{normal_build}
+
+%if %{include_staticlibs}
+%global staticlibs_loop %{staticlibs_suffix}
+%else
+%global staticlibs_loop %{nil}
+%endif
+
+%ifarch %{bootstrap_arches}
+%global bootstrap_build true
+%else
+%global bootstrap_build false
+%endif
+
+%if %{include_staticlibs}
+# Extra target for producing the static-libraries. Separate from
+# other targets since this target is configured to use in-tree
+# AWT dependencies: lcms, libjpeg, libpng, libharfbuzz, giflib
+# and possibly others
+%global static_libs_target static-libs-image
+%else
+%global static_libs_target %{nil}
+%endif
+
+# The static libraries are produced under the same configuration as the main
+# build for portables, as we expect in-tree libraries to be used throughout.
+# If system libraries are enabled, the static libraries will also use them
+# which may cause issues.
+%global bootstrap_targets images %{static_libs_target} legacy-jre-image
+%global release_targets images docs-zip %{static_libs_target} legacy-jre-image
+# No docs nor bootcycle for debug builds
+%global debug_targets images %{static_libs_target} legacy-jre-image
+# Target to use to just build HotSpot
+%global hotspot_target hotspot
+
+# JDK to use for bootstrapping
+%global bootjdk /usr/lib/jvm/java-%{buildjdkver}-openjdk
+
+# Filter out flags from the optflags macro that cause problems with the OpenJDK build
+# We filter out -O flags so that the optimization of HotSpot is not lowered from O3 to O2
+# We filter out -Wall which will otherwise cause HotSpot to produce hundreds of thousands of warnings (100+mb logs)
+# We replace it with -Wformat (required by -Werror=format-security) and -Wno-cpp to avoid FORTIFY_SOURCE warnings
+# We filter out -fexceptions as the HotSpot build explicitly does -fno-exceptions and it's otherwise the default for C++
+%global ourflags %(echo %optflags | sed -e 's|-Wall|-Wformat -Wno-cpp|' | sed -r -e 's|-O[0-9]*||')
+%global ourcppflags %(echo %ourflags | sed -e 's|-fexceptions||')
+%global ourldflags %{__global_ldflags}
+
+# With disabled nss is NSS deactivated, so NSS_LIBDIR can contain the wrong path
+# the initialization must be here. Later the pkg-config have buggy behavior
+# looks like openjdk RPM specific bug
+# Always set this so the nss.cfg file is not broken
+%global NSS_LIBDIR %(pkg-config --variable=libdir nss)
+
+# In some cases, the arch used by the JDK does
+# not match _arch.
+# Also, in some cases, the machine name used by SystemTap
+# does not match that given by _target_cpu
+%ifarch x86_64
+%global archinstall amd64
+%global stapinstall x86_64
+%endif
+%ifarch ppc
+%global archinstall ppc
+%global stapinstall powerpc
+%endif
+%ifarch %{ppc64be}
+%global archinstall ppc64
+%global stapinstall powerpc
+%endif
+%ifarch %{ppc64le}
+%global archinstall ppc64le
+%global stapinstall powerpc
+%endif
+%ifarch %{ix86}
+%global archinstall i686
+%global stapinstall i386
+%endif
+%ifarch ia64
+%global archinstall ia64
+%global stapinstall ia64
+%endif
+%ifarch s390
+%global archinstall s390
+%global stapinstall s390
+%endif
+%ifarch s390x
+%global archinstall s390x
+%global stapinstall s390
+%endif
+%ifarch %{arm}
+%global archinstall arm
+%global stapinstall arm
+%endif
+%ifarch %{aarch64}
+%global archinstall aarch64
+%global stapinstall arm64
+%endif
+# 32 bit sparc, optimized for v9
+%ifarch sparcv9
+%global archinstall sparc
+%global stapinstall %{_target_cpu}
+%endif
+# 64 bit sparc
+%ifarch sparc64
+%global archinstall sparcv9
+%global stapinstall %{_target_cpu}
+%endif
+# Need to support noarch for srpm build
+%ifarch noarch
+%global archinstall %{nil}
+%global stapinstall %{nil}
+%endif
+
+# always off for portable builds
+%ifarch %{systemtap_arches}
+%global with_systemtap 0
+%else
+%global with_systemtap 0
+%endif
+
+# New Version-String scheme-style defines
+%global featurever 17
+%global interimver 0
+%global updatever 7
+%global patchver 0
+# buildjdkver is usually same as %%{featurever},
+# but in time of bootstrap of next jdk, it is featurever-1,
+# and this it is better to change it here, on single place
+%global buildjdkver 17
+# We don't add any LTS designator for STS packages (Fedora and EPEL).
+# We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined.
+%if 0%{?rhel} && !0%{?epel}
+ %global lts_designator "LTS"
+ %global lts_designator_zip -%{lts_designator}
+%else
+ %global lts_designator ""
+ %global lts_designator_zip ""
+%endif
+
+# Define vendor information used by OpenJDK
+%global oj_vendor Red Hat, Inc.
+%global oj_vendor_url https://www.redhat.com/
+# Define what url should JVM offer in case of a crash report
+# order may be important, epel may have rhel declared
+%if 0%{?epel}
+%global oj_vendor_bug_url https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora%20EPEL&component=%{name}&version=epel%{epel}
+%else
+%if 0%{?fedora}
+# Does not work for rawhide, keeps the version field empty
+%global oj_vendor_bug_url https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=%{name}&version=%{fedora}
+%else
+%if 0%{?rhel}
+%global oj_vendor_bug_url https://bugzilla.redhat.com/enter_bug.cgi?product=Red%20Hat%20Enterprise%20Linux%20%{rhel}&component=%{name}
+%else
+%global oj_vendor_bug_url https://bugzilla.redhat.com/enter_bug.cgi
+%endif
+%endif
+%endif
+%global oj_vendor_version (Red_Hat-%{version}-%{rpmrelease})
+
+# Define IcedTea version used for SystemTap tapsets and desktop file
+%global icedteaver 6.0.0pre00-c848b93a8598
+# Define current Git revision for the FIPS support patches
+%global fipsver bf363eecce3
+
+# Standard JPackage naming and versioning defines
+%global origin openjdk
+%global origin_nice OpenJDK
+%global top_level_dir_name %{origin}
+%global top_level_dir_name_backup %{top_level_dir_name}-backup
+%global buildver 7
+%global rpmrelease 2
+#%%global tagsuffix %%{nil}
+# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
+%if %is_system_jdk
+# Using 10 digits may overflow the int used for priority, so we combine the patch and build versions
+# It is very unlikely we will ever have a patch version > 4 or a build version > 20, so we combine as (patch * 20) + build.
+# This means 11.0.9.0+11 would have had a priority of 11000911 as before
+# A 11.0.9.1+1 would have had a priority of 11000921 (20 * 1 + 1), thus ensuring it is bigger than 11.0.9.0+11
+%global combiver $( expr 20 '*' %{patchver} + %{buildver} )
+%global priority %( printf '%02d%02d%02d%02d' %{featurever} %{interimver} %{updatever} %{combiver} )
+%else
+# for techpreview, using 1, so slowdebugs can have 0
+%global priority %( printf '%08d' 1 )
+%endif
+%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
+%global javaver %{featurever}
+
+# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames
+%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn})
+
+# The tag used to create the OpenJDK tarball
+%global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}
+
+# Define milestone (EA for pre-releases, GA for releases)
+# Release will be (where N is usually a number starting at 1):
+# - 0.N%%{?extraver}%%{?dist} for EA releases,
+# - N%%{?extraver}{?dist} for GA releases
+%global is_ga 1
+%if %{is_ga}
+%global build_type GA
+%global ea_designator ""
+%global ea_designator_zip ""
+%global extraver %{nil}
+%global eaprefix %{nil}
+%else
+%global build_type EA
+%global ea_designator ea
+%global ea_designator_zip -%{ea_designator}
+%global extraver .%{ea_designator}
+%global eaprefix 0.
+%endif
+
+# parametrized macros are order-sensitive
+%global compatiblename java-%{featurever}-%{origin}
+%global fullversion %{compatiblename}-%{version}-%{release}
+# images directories from upstream build
+%global jdkimage jdk
+%global static_libs_image static-libs
+# output dir stub
+%define buildoutputdir() %{expand:build/jdk%{featurever}.build%{?1}}
+%define installoutputdir() %{expand:install/jdk%{featurever}.install%{?1}}
+%define packageoutputdir() %{expand:packages/jdk%{featurever}.packages%{?1}}
+# we can copy the javadoc to not arched dir, or make it not noarch
+%define uniquejavadocdir() %{expand:%{fullversion}.%{_arch}%{?1}}
+# main id and dir of this jdk
+%define uniquesuffix() %{expand:%{fullversion}.%{_arch}%{?1}}
+# portable only declarations
+%global jreimage jre
+%define jreportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}\\(_[0-9]\\)*;portable%{1}.jre;g")
+%define jdkportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}\\(_[0-9]\\)*;portable%{1}.jdk;g")
+%define staticlibsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}\\(_[0-9]\\)*;portable%{1}.static-libs;g")
+%define jreportablearchive() %{expand:%{jreportablenameimpl -- %%{1}}.tar.xz}
+%define jdkportablearchive() %{expand:%{jdkportablenameimpl -- %%{1}}.tar.xz}
+%define staticlibsportablearchive() %{expand:%{staticlibsportablenameimpl -- %%{1}}.tar.xz}
+%define jreportablename() %{expand:%{jreportablenameimpl -- %%{1}}}
+%define jdkportablename() %{expand:%{jdkportablenameimpl -- %%{1}}}
+# Intentionally use jdkportablenameimpl here since we want to have static-libs files overlayed on
+# top of the JDK archive
+%define staticlibsportablename() %{expand:%{jdkportablenameimpl -- %%{1}}}
+%define docportablename() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}\\(_[0-9]\\)*;portable.docs;g")
+%define docportablearchive() %{docportablename}.tar.xz
+%define miscportablename() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}\\(_[0-9]\\)*;portable.misc;g")
+%define miscportablearchive() %{miscportablename}.tar.xz
+
+#################################################################
+# fix for https://bugzilla.redhat.com/show_bug.cgi?id=1111349
+# https://bugzilla.redhat.com/show_bug.cgi?id=1590796#c14
+# https://bugzilla.redhat.com/show_bug.cgi?id=1655938
+%global _privatelibs libsplashscreen[.]so.*|libawt_xawt[.]so.*|libjli[.]so.*|libattach[.]so.*|libawt[.]so.*|libextnet[.]so.*|libawt_headless[.]so.*|libdt_socket[.]so.*|libfontmanager[.]so.*|libinstrument[.]so.*|libj2gss[.]so.*|libj2pcsc[.]so.*|libj2pkcs11[.]so.*|libjaas[.]so.*|libjavajpeg[.]so.*|libjdwp[.]so.*|libjimage[.]so.*|libjsound[.]so.*|liblcms[.]so.*|libmanagement[.]so.*|libmanagement_agent[.]so.*|libmanagement_ext[.]so.*|libmlib_image[.]so.*|libnet[.]so.*|libnio[.]so.*|libprefs[.]so.*|librmi[.]so.*|libsaproc[.]so.*|libsctp[.]so.*|libsystemconf[.]so.*|libzip[.]so.*%{freetype_lib}
+%global _publiclibs libjawt[.]so.*|libjava[.]so.*|libjvm[.]so.*|libverify[.]so.*|libjsig[.]so.*
+%if %is_system_jdk
+%global __provides_exclude ^(%{_privatelibs})$
+%global __requires_exclude ^(%{_privatelibs})$
+# Never generate lib-style provides/requires for slowdebug packages
+%global __provides_exclude_from ^.*/%{uniquesuffix -- %{debug_suffix_unquoted}}/.*$
+%global __requires_exclude_from ^.*/%{uniquesuffix -- %{debug_suffix_unquoted}}/.*$
+%global __provides_exclude_from ^.*/%{uniquesuffix -- %{fastdebug_suffix_unquoted}}/.*$
+%global __requires_exclude_from ^.*/%{uniquesuffix -- %{fastdebug_suffix_unquoted}}/.*$
+%else
+# Don't generate provides/requires for JDK provided shared libraries at all.
+%global __provides_exclude ^(%{_privatelibs}|%{_publiclibs})$
+%global __requires_exclude ^(%{_privatelibs}|%{_publiclibs})$
+%endif
+
+
+%global etcjavasubdir %{_sysconfdir}/java/java-%{javaver}-%{origin}
+%define etcjavadir() %{expand:%{etcjavasubdir}/%{uniquesuffix -- %{?1}}}
+# Standard JPackage directories and symbolic links.
+%define sdkdir() %{expand:%{uniquesuffix -- %{?1}}}
+%define jrelnk() %{expand:jre-%{javaver}-%{origin}-%{version}-%{release}.%{_arch}%{?1}}
+
+%define sdkbindir() %{expand:%{_jvmdir}/%{sdkdir -- %{?1}}/bin}
+%define jrebindir() %{expand:%{_jvmdir}/%{sdkdir -- %{?1}}/bin}
+
+%global alt_java_name alt-java
+
+%global rpm_state_dir %{_localstatedir}/lib/rpm-state/
+
+# For flatpack builds hard-code /usr/sbin/alternatives,
+# otherwise use %%{_sbindir} relative path.
+%if 0%{?flatpak}
+%global alternatives_requires /usr/sbin/alternatives
+%else
+%global alternatives_requires %{_sbindir}/alternatives
+%endif
+
+%if %{with_systemtap}
+# Where to install systemtap tapset (links)
+# We would like these to be in a package specific sub-dir,
+# but currently systemtap doesn't support that, so we have to
+# use the root tapset dir for now. To distinguish between 64
+# and 32 bit architectures we place the tapsets under the arch
+# specific dir (note that systemtap will only pickup the tapset
+# for the primary arch for now). Systemtap uses the machine name
+# aka target_cpu as architecture specific directory name.
+%global tapsetroot /usr/share/systemtap
+%global tapsetdirttapset %{tapsetroot}/tapset/
+%global tapsetdir %{tapsetdirttapset}/%{stapinstall}
+%endif
+
+# x86 is not supported by OpenJDK 17
+ExcludeArch: %{ix86}
+
+# Portables have no repo (requires/provides), but these are awesome for orientation in spec
+# Also scriptlets are happily missing and files are handled old fashion
+# not-duplicated requires/provides/obsoletes for normal/debug packages
+%define java_rpo() %{expand:
+}
+
+%define java_devel_rpo() %{expand:
+}
+
+%define java_static_libs_rpo() %{expand:
+}
+
+%define java_unstripped_rpo() %{expand:
+}
+
+%define java_docs_rpo() %{expand:
+}
+
+%define java_misc_rpo() %{expand:
+}
+
+# Prevent brp-java-repack-jars from being run
+%global __jar_repack 0
+
+# portables have grown out of its component, moving back to java-x-vendor
+# this expression, when declared as global, filled component with java-x-vendor portable
+%define component %(echo %{name} | sed "s;-portable;;g")
+
+Name: java-%{javaver}-%{origin}-portable
+Version: %{newjavaver}.%{buildver}
+Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
+# java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons
+# and this change was brought into RHEL-4. java-1.5.0-ibm packages
+# also included the epoch in their virtual provides. This created a
+# situation where in-the-wild java-1.5.0-ibm packages provided "java =
+# 1:1.5.0". In RPM terms, "1.6.0 < 1:1.5.0" since 1.6.0 is
+# interpreted as 0:1.6.0. So the "java >= 1.6.0" requirement would be
+# satisfied by the 1:1.5.0 packages. Thus we need to set the epoch in
+# JDK package >= 1.6.0 to 1, and packages referring to JDK virtual
+# provides >= 1.6.0 must specify the epoch, "java >= 1:1.6.0".
+
+Epoch: 1
+Summary: %{origin_nice} %{featurever} Runtime Environment portable edition
+# Groups are only used up to RHEL 8 and on Fedora versions prior to F30
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30)
+Group: Development/Languages
+%endif
+
+# HotSpot code is licensed under GPLv2
+# JDK library code is licensed under GPLv2 with the Classpath exception
+# The Apache license is used in code taken from Apache projects (primarily xalan & xerces)
+# DOM levels 2 & 3 and the XML digital signature schemas are licensed under the W3C Software License
+# The JSR166 concurrency code is in the public domain
+# The BSD and MIT licenses are used for a number of third-party libraries (see ADDITIONAL_LICENSE_INFO)
+# The OpenJDK source tree includes:
+# - JPEG library (IJG), zlib & libpng (zlib), giflib (MIT), harfbuzz (ISC),
+# - freetype (FTL), jline (BSD) and LCMS (MIT)
+# - jquery (MIT), jdk.crypto.cryptoki PKCS 11 wrapper (RSA)
+# - public_suffix_list.dat from publicsuffix.org (MPLv2.0)
+# The test code includes copies of NSS under the Mozilla Public License v2.0
+# The PCSClite headers are under a BSD with advertising license
+# The elliptic curve cryptography (ECC) source code is licensed under the LGPLv2.1 or any later version
+License: ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA
+URL: http://openjdk.java.net/
+
+
+# The source tarball, generated using generate_source_tarball.sh
+Source0: openjdk-jdk%{featurever}u-%{vcstag}.tar.xz
+
+# Use 'icedtea_sync.sh' to update the following
+# They are based on code contained in the IcedTea project (6.x).
+# Systemtap tapsets. Zipped up to keep it small.
+# Disabled in portables
+#Source8: tapsets-icedtea-%%{icedteaver}.tar.xz
+
+# Desktop files. Adapted from IcedTea
+# Disabled in portables
+#Source9: jconsole.desktop.in
+
+# Release notes
+Source10: NEWS
+
+# nss configuration file
+Source11: nss.cfg.in
+
+# Removed libraries that we link instead
+Source12: remove-intree-libraries.sh
+
+# Ensure we aren't using the limited crypto policy
+Source13: TestCryptoLevel.java
+
+# Ensure ECDSA is working
+Source14: TestECDSA.java
+
+# Verify system crypto (policy) can be disabled via a property
+Source15: TestSecurityProperties.java
+
+# Ensure vendor settings are correct
+Source16: CheckVendor.java
+
+# Ensure translations are available for new timezones
+Source18: TestTranslations.java
+
+############################################
+#
+# RPM/distribution specific patches
+#
+############################################
+
+# Ignore AWTError when assistive technologies are loaded
+Patch1: rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
+Patch3: rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
+# NSS via SunPKCS11 Provider (disabled due to memory leak).
+Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
+# RH1750419: enable build of speculative store bypass hardened alt-java (CVE-2018-3639)
+Patch600: rh1750419-redhat_alt_java.patch
+# Depend on pcsc-lite-libs instead of pcsc-lite-devel as this is only in optional repo
+Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
+
+# Crypto policy and FIPS support patches
+# Patch is generated from the fips-17u tree at https://github.com/rh-openjdk/jdk/tree/fips-17u
+# as follows: git diff %%{vcstag} src make test > fips-17u-$(git show -s --format=%h HEAD).patch
+# Diff is limited to src and make subdirectories to exclude .github changes
+# Fixes currently included:
+# PR3183, RH1340845: Follow system wide crypto policy
+# PR3695: Allow use of system crypto policy to be disabled by the user
+# RH1655466: Support RHEL FIPS mode using SunPKCS11 provider
+# RH1818909: No ciphersuites availale for SSLSocket in FIPS mode
+# RH1860986: Disable TLSv1.3 with the NSS-FIPS provider until PKCS#11 v3.0 support is available
+# RH1915071: Always initialise JavaSecuritySystemConfiguratorAccess
+# RH1929465: Improve system FIPS detection
+# RH1995150: Disable non-FIPS crypto in SUN and SunEC security providers
+# RH1996182: Login to the NSS software token in FIPS mode
+# RH1991003: Allow plain key import unless com.redhat.fips.plainKeySupport is set to false
+# RH2021263: Resolve outstanding FIPS issues
+# RH2052819: Fix FIPS reliance on crypto policies
+# RH2052829: Detect NSS at Runtime for FIPS detection
+# RH2052070: Enable AlgorithmParameters and AlgorithmParameterGenerator services in FIPS mode
+# RH2023467: Enable FIPS keys export
+# RH2094027: SunEC runtime permission for FIPS
+# RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
+# RH2090378: Revert to disabling system security properties and FIPS mode support together
+# RH2104724: Avoid import/export of DH private keys
+# RH2092507: P11Key.getEncoded does not work for DH keys in FIPS mode
+# Build the systemconf library on all platforms
+# RH2048582: Support PKCS#12 keystores
+# RH2020290: Support TLS 1.3 in FIPS mode
+# Add nss.fips.cfg support to OpenJDK tree
+# RH2117972: Extend the support for NSS DBs (PKCS11) in FIPS mode
+# Remove forgotten dead code from RH2020290 and RH2104724
+# OJ1357: Fix issue on FIPS with a SecurityManager in place
+# RH2134669: Add missing attributes when registering services in FIPS mode.
+# test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
+# RH1940064: Enable XML Signature provider in FIPS mode
+# RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized
+Patch1001: fips-17u-%{fipsver}.patch
+
+#############################################
+#
+# OpenJDK patches in need of upstreaming
+#
+#############################################
+
+# Currently empty
+
+#############################################
+#
+# OpenJDK patches appearing in 17.0.8
+#
+#############################################
+# JDK-8274864: Remove Amman/Cairo hacks in ZoneInfoFile
+Patch2001: jdk8274864-remove_amman_cairo_hacks.patch
+# JDK-8305113: (tz) Update Timezone Data to 2023c
+Patch2002: jdk8305113-tzdata2023c.patch
+
+#############################################
+#
+# Portable build specific patches
+#
+#############################################
+
+#############################################
+#
+# OpenJDK patches targetted for 17.0.6
+#
+#############################################
+
+BuildRequires: autoconf
+BuildRequires: automake
+BuildRequires: alsa-lib-devel
+BuildRequires: binutils
+BuildRequires: cups-devel
+BuildRequires: desktop-file-utils
+# elfutils only are OK for build without AOT
+BuildRequires: elfutils-devel
+BuildRequires: file
+BuildRequires: fontconfig-devel
+BuildRequires: gcc-c++
+BuildRequires: gdb
+BuildRequires: libxslt
+BuildRequires: libX11-devel
+BuildRequires: libXi-devel
+BuildRequires: libXinerama-devel
+BuildRequires: libXrandr-devel
+BuildRequires: libXrender-devel
+BuildRequires: libXt-devel
+BuildRequires: libXtst-devel
+# Requirement for setting up nss.cfg
+BuildRequires: nss-devel
+# Requirement for system security property test
+# N/A for portable. RHEL7 doesn't provide them
+#BuildRequires: crypto-policies
+BuildRequires: pkgconfig
+BuildRequires: xorg-x11-proto-devel
+BuildRequires: zip
+# to pack portable tarballs
+BuildRequires: tar
+BuildRequires: unzip
+# No javapackages-filesystem on el7,nor is needed for portables
+# BuildRequires: javapackages-filesystem
+BuildRequires: java-%{buildjdkver}-openjdk-devel
+# Zero-assembler build requirement
+%ifarch %{zero_arches}
+BuildRequires: libffi-devel
+%endif
+# 2023c required as of JDK-8305113
+BuildRequires: tzdata-java >= 2023c
+# cacerts build requirement in portable mode
+BuildRequires: ca-certificates
+# Earlier versions have a bug in tree vectorization on PPC
+BuildRequires: gcc >= 4.8.3-8
+
+%if %{with_systemtap}
+BuildRequires: systemtap-sdt-devel
+%endif
+BuildRequires: make
+
+%if %{system_libs}
+BuildRequires: freetype-devel
+BuildRequires: giflib-devel
+BuildRequires: harfbuzz-devel
+BuildRequires: lcms2-devel
+BuildRequires: libjpeg-devel
+BuildRequires: libpng-devel
+%else
+# Version in src/java.desktop/share/native/libfreetype/include/freetype/freetype.h
+Provides: bundled(freetype) = 2.12.1
+# Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
+Provides: bundled(giflib) = 5.2.1
+# Version in src/java.desktop/share/native/libharfbuzz/hb-version.h
+Provides: bundled(harfbuzz) = 4.4.1
+# Version in src/java.desktop/share/native/liblcms/lcms2.h
+Provides: bundled(lcms2) = 2.12.0
+# Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h
+Provides: bundled(libjpeg) = 6b
+# Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h
+Provides: bundled(libpng) = 1.6.37
+# We link statically against libstdc++ to increase portability
+BuildRequires: libstdc++-static
+%endif
+
+# this is always built, also during debug-only build
+# when it is built in debug-only this package is just placeholder
+%{java_rpo %{nil}}
+
+%description
+The %{origin_nice} %{featurever} runtime environment - portable edition.
+
+%if %{include_debug_build}
+%package slowdebug
+Summary: %{origin_nice} %{featurever} Runtime Environment portable edition %{debug_on}
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30)
+Group: Development/Languages
+%endif
+
+%{java_rpo -- %{debug_suffix_unquoted}}
+%description slowdebug
+The %{origin_nice} %{featurever} runtime environment - portable edition.
+%{debug_warning}
+%endif
+
+%if %{include_fastdebug_build}
+%package fastdebug
+Summary: %{origin_nice} %{featurever} Runtime Environment portable edition %{fastdebug_on}
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30)
+Group: Development/Languages
+%endif
+
+%{java_rpo -- %{fastdebug_suffix_unquoted}}
+%description fastdebug
+The %{origin_nice} %{featurever} runtime environment - portable edition.
+%{fastdebug_warning}
+%endif
+
+%if %{include_normal_build}
+%package devel
+Summary: %{origin_nice} %{featurever} Development Environment portable edition
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30)
+Group: Development/Languages
+%endif
+
+%{java_devel_rpo %{nil}}
+
+%description devel
+The %{origin_nice} %{featurever} development tools - portable edition.
+%endif
+
+%if %{include_debug_build}
+%package devel-slowdebug
+Summary: %{origin_nice} %{featurever} Runtime and Development Environment portable edition %{debug_on}
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30)
+Group: Development/Languages
+%endif
+
+%{java_devel_rpo -- %{debug_suffix_unquoted}}
+
+%description devel-slowdebug
+The %{origin_nice} %{featurever} development tools - portable edition.
+%{debug_warning}
+%endif
+
+%if %{include_fastdebug_build}
+%package devel-fastdebug
+Summary: %{origin_nice} %{featurever} Runtime and Development Environment portable edition %{fastdebug_on}
+%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30)
+Group: Development/Tools
+%endif
+
+%{java_devel_rpo -- %{fastdebug_suffix_unquoted}}
+
+%description devel-fastdebug
+The %{origin_nice} %{featurever} runtime environment and development tools - portable edition
+%{fastdebug_warning}
+%endif
+
+%if %{include_staticlibs}
+
+%if %{include_normal_build}
+%package static-libs
+Summary: %{origin_nice} %{featurever} libraries for static linking - portable edition
+
+%{java_static_libs_rpo %{nil}}
+
+%description static-libs
+The %{origin_nice} %{featurever} libraries for static linking - portable edition.
+%endif
+
+%if %{include_debug_build}
+%package static-libs-slowdebug
+Summary: %{origin_nice} %{featurever} libraries for static linking - portable edition %{debug_on}
+
+%{java_static_libs_rpo -- %{debug_suffix_unquoted}}
+
+%description static-libs-slowdebug
+The %{origin_nice} %{featurever} libraries for static linking - portable edition
+%{debug_warning}
+%endif
+
+%if %{include_fastdebug_build}
+%package static-libs-fastdebug
+Summary: %{origin_nice} %{featurever} libraries for static linking - portable edition %{fastdebug_on}
+
+%{java_static_libs_rpo -- %{fastdebug_suffix_unquoted}}
+
+%description static-libs-fastdebug
+The %{origin_nice} %{featurever} libraries for static linking - portable edition
+%{fastdebug_warning}
+%endif
+
+# staticlibs
+%endif
+
+%if %{include_normal_build}
+%package unstripped
+Summary: The %{origin_nice} %{featurever} runtime environment.
+
+%{java_unstripped_rpo %{nil}}
+
+%description unstripped
+The %{origin_nice} %{featurever} runtime environment.
+
+%endif
+
+%package docs
+Summary: %{origin_nice} %{featurever} API documentation
+
+%{java_docs_rpo %{nil}}
+
+%description docs
+The %{origin_nice} %{featurever} API documentation.
+
+%package misc
+Summary: %{origin_nice} %{featurever} miscellany
+
+%{java_misc_rpo %{nil}}
+
+%description misc
+The %{origin_nice} %{featurever} miscellany.
+
+%prep
+
+echo "Preparing %{oj_vendor_version}"
+
+# Using the echo macro breaks rpmdev-bumpspec, as it parses the first line of stdout :-(
+%if 0%{?stapinstall:1}
+ echo "CPU: %{_target_cpu}, arch install directory: %{archinstall}, SystemTap install directory: %{stapinstall}"
+%else
+ %{error:Unrecognised architecture %{_target_cpu}}
+%endif
+
+if [ %{include_normal_build} -eq 0 -o %{include_normal_build} -eq 1 ] ; then
+ echo "include_normal_build is %{include_normal_build}"
+else
+ echo "include_normal_build is %{include_normal_build}, that is invalid. Use 1 for yes or 0 for no"
+ exit 11
+fi
+if [ %{include_debug_build} -eq 0 -o %{include_debug_build} -eq 1 ] ; then
+ echo "include_debug_build is %{include_debug_build}"
+else
+ echo "include_debug_build is %{include_debug_build}, that is invalid. Use 1 for yes or 0 for no"
+ exit 12
+fi
+if [ %{include_fastdebug_build} -eq 0 -o %{include_fastdebug_build} -eq 1 ] ; then
+ echo "include_fastdebug_build is %{include_fastdebug_build}"
+else
+ echo "include_fastdebug_build is %{include_fastdebug_build}, that is invalid. Use 1 for yes or 0 for no"
+ exit 13
+fi
+if [ %{include_debug_build} -eq 0 -a %{include_normal_build} -eq 0 -a %{include_fastdebug_build} -eq 0 ] ; then
+ echo "You have disabled all builds (normal,fastdebug,slowdebug). That is a no go."
+ exit 14
+fi
+%setup -q -c -n %{uniquesuffix ""} -T -a 0
+# https://bugzilla.redhat.com/show_bug.cgi?id=1189084
+prioritylength=`expr length %{priority}`
+if [ $prioritylength -ne 8 ] ; then
+ echo "priority must be 8 digits in total, violated"
+ exit 14
+fi
+
+# OpenJDK patches
+
+%if %{system_libs}
+# Remove libraries that are linked by both static and dynamic builds
+sh %{SOURCE12} %{top_level_dir_name}
+%endif
+
+# Patch the JDK
+pushd %{top_level_dir_name}
+%patch1 -p1
+%patch3 -p1
+%patch6 -p1
+# Add crypto policy and FIPS support
+%patch1001 -p1
+# nss.cfg PKCS11 support; must come last as it also alters java.security
+%patch1000 -p1
+# tzdata update
+%patch2001 -p1
+%patch2002 -p1
+popd # openjdk
+
+%patch600
+
+# The OpenJDK version file includes the current
+# upstream version information. For some reason,
+# configure does not automatically use the
+# default pre-version supplied there (despite
+# what the file claims), so we pass it manually
+# to configure
+VERSION_FILE=$(pwd)/%{top_level_dir_name}/make/conf/version-numbers.conf
+if [ -f ${VERSION_FILE} ] ; then
+ UPSTREAM_EA_DESIGNATOR=$(grep '^DEFAULT_PROMOTED_VERSION_PRE' ${VERSION_FILE} | cut -d '=' -f 2)
+else
+ echo "Could not find OpenJDK version file.";
+ exit 16
+fi
+if [ "x${UPSTREAM_EA_DESIGNATOR}" != "x%{ea_designator}" ] ; then
+ echo "WARNING: Designator mismatch";
+ echo "Spec file is configured for a %{build_type} build with designator '%{ea_designator}'"
+ echo "Upstream version-pre setting is '${UPSTREAM_EA_DESIGNATOR}'";
+ exit 17
+fi
+
+# Extract systemtap tapsets
+%if %{with_systemtap}
+tar --strip-components=1 -x -I xz -f %{SOURCE8}
+%if %{include_debug_build}
+cp -r tapset tapset%{debug_suffix}
+%endif
+%if %{include_fastdebug_build}
+cp -r tapset tapset%{fastdebug_suffix}
+%endif
+
+for suffix in %{build_loop} ; do
+ for file in "tapset"$suffix/*.in; do
+ OUTPUT_FILE=`echo $file | sed -e "s:\.stp\.in$:-%{version}-%{release}.%{_arch}.stp:g"`
+ sed -e "s:@ABS_SERVER_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/server/libjvm.so:g" $file > $file.1
+ sed -e "s:@JAVA_SPEC_VER@:%{javaver}:g" $file.1 > $file.2
+# TODO find out which architectures other than i686 have a client vm
+%ifarch %{ix86}
+ sed -e "s:@ABS_CLIENT_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/client/libjvm.so:g" $file.2 > $OUTPUT_FILE
+%else
+ sed -e "/@ABS_CLIENT_LIBJVM_SO@/d" $file.2 > $OUTPUT_FILE
+%endif
+ sed -i -e "s:@ABS_JAVA_HOME_DIR@:%{_jvmdir}/%{sdkdir -- $suffix}:g" $OUTPUT_FILE
+ sed -i -e "s:@INSTALL_ARCH_DIR@:%{archinstall}:g" $OUTPUT_FILE
+ sed -i -e "s:@prefix@:%{_jvmdir}/%{sdkdir -- $suffix}/:g" $OUTPUT_FILE
+ done
+done
+# systemtap tapsets ends
+%endif
+
+# Prepare desktop files
+# Portables do not have desktop integration
+
+# Setup nss.cfg
+sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE11} > nss.cfg
+
+%build
+# How many CPU's do we have?
+export NUM_PROC=%(/usr/bin/getconf _NPROCESSORS_ONLN 2> /dev/null || :)
+export NUM_PROC=${NUM_PROC:-1}
+%if 0%{?_smp_ncpus_max}
+# Honor %%_smp_ncpus_max
+[ ${NUM_PROC} -gt %{?_smp_ncpus_max} ] && export NUM_PROC=%{?_smp_ncpus_max}
+%endif
+
+%ifarch s390x sparc64 alpha %{power64} %{aarch64}
+export ARCH_DATA_MODEL=64
+%endif
+%ifarch alpha
+export CFLAGS="$CFLAGS -mieee"
+%endif
+
+# We use ourcppflags because the OpenJDK build seems to
+# pass EXTRA_CFLAGS to the HotSpot C++ compiler...
+# Explicitly set the C++ standard as the default has changed on GCC >= 6
+EXTRA_CFLAGS="%ourcppflags"
+EXTRA_CPP_FLAGS="%ourcppflags"
+
+%ifarch %{power64} ppc
+# fix rpmlint warnings
+EXTRA_CFLAGS="$EXTRA_CFLAGS -fno-strict-aliasing"
+%endif
+%ifarch %{ix86}
+# Align stack boundary on x86_32
+EXTRA_CFLAGS="$(echo ${EXTRA_CFLAGS} | sed -e 's|-mstackrealign|-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4|')"
+EXTRA_CPP_FLAGS="$(echo ${EXTRA_CPP_FLAGS} | sed -e 's|-mstackrealign|-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4|')"
+%endif
+export EXTRA_CFLAGS EXTRA_CPP_FLAGS
+
+echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}"
+
+function buildjdk() {
+ local outputdir=${1}
+ local buildjdk=${2}
+ local maketargets="${3}"
+ local debuglevel=${4}
+ local link_opt=${5}
+ local debug_symbols=${6}
+
+ local top_dir_abs_src_path=$(pwd)/%{top_level_dir_name}
+ local top_dir_abs_build_path=$(pwd)/${outputdir}
+
+ # This must be set using the global, so that the
+ # static libraries still use a dynamic stdc++lib
+ if [ "x%{link_type}" = "xbundled" ] ; then
+ libc_link_opt="static";
+ else
+ libc_link_opt="dynamic";
+ fi
+
+ echo "Using output directory: ${outputdir}";
+ echo "Checking build JDK ${buildjdk} is operational..."
+ ${buildjdk}/bin/java -version
+ echo "Using make targets: ${maketargets}"
+ echo "Using debuglevel: ${debuglevel}"
+ echo "Using link_opt: ${link_opt}"
+ echo "Using debug_symbols: ${debug_symbols}"
+ echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}"
+
+ mkdir -p ${outputdir}
+ pushd ${outputdir}
+
+ # Note: zlib and freetype use %{link_type}
+ # rather than ${link_opt} as the system versions
+ # are always used in a system_libs build, even
+ # for the static library build
+ bash ${top_dir_abs_src_path}/configure \
+%ifarch %{zero_arches}
+ --with-jvm-variants=zero \
+%endif
+%ifarch %{ppc64le}
+ --with-jobs=1 \
+%endif
+ --with-cacerts-file=$(readlink -f %{_sysconfdir}/pki/java/cacerts) \
+ --with-version-build=%{buildver} \
+ --with-version-pre="${ea_designator}" \
+ --with-version-opt=%{lts_designator} \
+ --with-vendor-version-string="%{oj_vendor_version}" \
+ --with-vendor-name="%{oj_vendor}" \
+ --with-vendor-url="%{oj_vendor_url}" \
+ --with-vendor-bug-url="%{oj_vendor_bug_url}" \
+ --with-vendor-vm-bug-url="%{oj_vendor_bug_url}" \
+ --with-boot-jdk=${buildjdk} \
+ --with-debug-level=${debuglevel} \
+ --with-native-debug-symbols="${debug_symbols}" \
+ --disable-sysconf-nss \
+ --enable-unlimited-crypto \
+ --with-zlib=%{link_type} \
+ --with-freetype=%{link_type} \
+ --with-libjpeg=${link_opt} \
+ --with-giflib=${link_opt} \
+ --with-libpng=${link_opt} \
+ --with-lcms=${link_opt} \
+ --with-harfbuzz=${link_opt} \
+ --with-stdc++lib=${libc_link_opt} \
+ --with-extra-cxxflags="$EXTRA_CPP_FLAGS" \
+ --with-extra-cflags="$EXTRA_CFLAGS" \
+ --with-extra-ldflags="%{ourldflags}" \
+ --with-num-cores="$NUM_PROC" \
+ --with-source-date="${SOURCE_DATE_EPOCH}" \
+ --disable-javac-server \
+%ifarch %{zgc_arches}
+ --with-jvm-features=zgc \
+%endif
+ --disable-warnings-as-errors
+
+ cat spec.gmk
+ make LOG=trace $maketargets || \
+ ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name \"hs_err_pid*.log\" | xargs cat && false )
+
+ popd
+}
+
+function installjdk() {
+ local outputdir=${1}
+ local installdir=${2}
+ local jdkimagepath=${installdir}/images/%{jdkimage}
+ local jreimagepath=${installdir}/images/%{jreimage}
+
+ echo "Installing build from ${outputdir} to ${installdir}..."
+ mkdir -p ${installdir}
+ echo "Installing images..."
+ mv ${outputdir}/images ${installdir}
+ if [ -d ${outputdir}/bundles ] ; then
+ echo "Installing bundles...";
+ mv ${outputdir}/bundles ${installdir} ;
+ fi
+
+%if !%{with artifacts}
+ echo "Removing output directory...";
+ rm -rf ${outputdir}
+%endif
+
+ # legacy-jre-image target does not install any man pages for the JRE
+ # We copy the jdk man directory and then remove pages for binaries that
+ # don't exist in the JRE
+ cp -a ${jdkimagepath}/man ${jreimagepath}
+ for manpage in $(find ${jreimagepath}/man -name '*.1'); do
+ filename=$(basename ${manpage});
+ binary=${filename/.1/};
+ if [ ! -f ${jreimagepath}/bin/${binary} ] ; then
+ echo "Removing ${manpage} from JRE for which no binary ${binary} exists";
+ rm -f ${manpage};
+ fi;
+ done
+
+ for imagepath in ${jdkimagepath} ${jreimagepath} ; do
+
+ if [ -d ${imagepath} ] ; then
+ # the build (erroneously) removes read permissions from some jars
+ # this is a regression in OpenJDK 7 (our compiler):
+ # http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=1437
+ find ${imagepath} -iname '*.jar' -exec chmod ugo+r {} \;
+
+ # Build screws up permissions on binaries
+ # https://bugs.openjdk.java.net/browse/JDK-8173610
+ find ${imagepath} -iname '*.so' -exec chmod +x {} \;
+ find ${imagepath}/bin/ -exec chmod +x {} \;
+
+ # Install local files which are distributed with the JDK
+ install -m 644 %{SOURCE10} ${imagepath}
+ install -m 644 nss.cfg ${imagepath}/conf/security/
+
+ # Create fake alt-java as a placeholder for future alt-java
+ pushd ${imagepath}
+ # add alt-java man page
+ echo "Hardened java binary recommended for launching untrusted code from the Web e.g. javaws" > man/man1/%{alt_java_name}.1
+ cat man/man1/java.1 >> man/man1/%{alt_java_name}.1
+ popd
+
+ # Print release information
+ cat ${imagepath}/release
+ fi
+ done
+}
+
+function genchecksum() {
+ local checkedfile=${1}
+
+ checkdir=$(dirname ${1})
+ checkfile=$(basename ${1})
+
+ echo "Generating checksum for ${checkfile} in ${checkdir}..."
+ pushd ${checkdir}
+ sha256sum ${checkfile} > ${checkfile}.sha256sum
+ sha256sum --check ${checkfile}.sha256sum
+ popd
+}
+
+function packagejdk() {
+ local imagesdir=$(pwd)/${1}/images
+ local docdir=$(pwd)/${1}/images/docs
+ local bundledir=$(pwd)/${1}/bundles
+ local packagesdir=$(pwd)/${2}
+ local srcdir=$(pwd)/%{top_level_dir_name}
+
+ echo "Packaging build from ${imagesdir} to ${packagesdir}..."
+ mkdir -p ${packagesdir}
+ pushd ${imagesdir}
+
+ if [ "x$suffix" = "x" ] ; then
+ nameSuffix=""
+ else
+ nameSuffix=`echo "$suffix"| sed s/-/./`
+ fi
+
+ jdkname=%{jdkportablename -- "$nameSuffix"}
+ jdkarchive=${packagesdir}/%{jdkportablearchive -- "$nameSuffix"}
+ jrename=%{jreportablename -- "$nameSuffix"}
+ jrearchive=${packagesdir}/%{jreportablearchive -- "$nameSuffix"}
+ staticname=%{staticlibsportablename -- "$nameSuffix"}
+ staticarchive=${packagesdir}/%{staticlibsportablearchive -- "$nameSuffix"}
+ debugarchive=${packagesdir}/%{jdkportablearchive -- "${nameSuffix}.debuginfo"}
+ unstrippedarchive=${packagesdir}/%{jdkportablearchive -- "${nameSuffix}.unstripped"}
+ # We only use docs for the release build
+ docname=%{docportablename}
+ docarchive=${packagesdir}/%{docportablearchive}
+ built_doc_archive=jdk-%{filever}%{ea_designator_zip}+%{buildver}%{lts_designator_zip}-docs.zip
+ # These are from the source tree so no debug variants
+ miscname=%{miscportablename}
+ miscarchive=${packagesdir}/%{miscportablearchive}
+
+ # Rename directories for packaging
+ mv %{jdkimage} ${jdkname}
+ mv %{jreimage} ${jrename}
+
+ # Release images have external debug symbols
+ if [ "x$suffix" = "x" ] ; then
+ # Keep the unstripped version for consumption by RHEL RPMs
+ tar -cJf ${unstrippedarchive} ${jdkname}
+ genchecksum ${unstrippedarchive}
+
+ # Strip the files
+ for file in $(find ${jdkname} ${jrename} -type f) ; do
+ if file ${file} | grep -q 'ELF'; then
+ noextfile=${file/.so/};
+ objcopy --only-keep-debug ${file} ${noextfile}.debuginfo;
+ objcopy --add-gnu-debuglink=${noextfile}.debuginfo ${file};
+ strip -g ${file};
+ fi
+ done
+
+ tar -cJf ${debugarchive} $(find ${jdkname} -name \*.debuginfo)
+ genchecksum ${debugarchive}
+
+ mkdir ${docname}
+ mv ${docdir} ${docname}
+ mv ${bundledir}/${built_doc_archive} ${docname}
+ tar -cJf ${docarchive} ${docname}
+ genchecksum ${docarchive}
+
+ mkdir ${miscname}
+ for s in 16 24 32 48 ; do
+ cp -av ${srcdir}/src/java.desktop/unix/classes/sun/awt/X11/java-icon${s}.png ${miscname}
+ done
+ cp -a ${srcdir}/src/sample ${miscname}
+ tar -cJf ${miscarchive} ${miscname}
+ genchecksum ${miscarchive}
+ fi
+
+ tar -cJf ${jdkarchive} --exclude='**.debuginfo' ${jdkname}
+ genchecksum ${jdkarchive}
+
+ tar -cJf ${jrearchive} --exclude='**.debuginfo' ${jrename}
+ genchecksum ${jrearchive}
+
+%if %{include_staticlibs}
+ # Static libraries (needed for building graal vm with native image)
+ # Tar as overlay. Transform to the JDK name, since we just want to "add"
+ # static libraries to that folder
+ tar -cJf ${staticarchive} \
+ --transform "s|^%{static_libs_image}/lib/*|${staticname}/lib/static/linux-%{archinstall}/glibc/|" "%{static_libs_image}/lib"
+ genchecksum ${staticarchive}
+%endif
+
+ # Revert directory renaming so testing will run
+ # TODO: testing should run on the packaged JDK
+ mv ${jdkname} %{jdkimage}
+ mv ${jrename} %{jreimage}
+
+ popd #images
+
+}
+
+%if %{build_hotspot_first}
+ # Build a fresh libjvm.so first and use it to bootstrap
+ cp -LR --preserve=mode,timestamps %{bootjdk} newboot
+ systemjdk=$(pwd)/newboot
+ buildjdk build/newboot ${systemjdk} %{hotspot_target} "release" "bundled" "internal"
+ mv build/newboot/jdk/lib/server/libjvm.so newboot/lib/server
+%else
+ systemjdk=%{bootjdk}
+%endif
+
+for suffix in %{build_loop} ; do
+
+ if [ "x$suffix" = "x" ] ; then
+ debugbuild=release
+ else
+ # change --something to something
+ debugbuild=`echo $suffix | sed "s/-//g"`
+ fi
+ # We build with internal debug symbols and do
+ # our own stripping for one version of the
+ # release build
+ debug_symbols=internal
+
+ builddir=%{buildoutputdir -- ${suffix}}
+ bootbuilddir=boot${builddir}
+ installdir=%{installoutputdir -- ${suffix}}
+ bootinstalldir=boot${installdir}
+ packagesdir=%{packageoutputdir -- ${suffix}}
+
+ link_opt="%{link_type}"
+%if %{system_libs}
+ # Copy the source tree so we can remove all in-tree libraries
+ cp -a %{top_level_dir_name} %{top_level_dir_name_backup}
+ # Remove all libraries that are linked
+ sh %{SOURCE12} %{top_level_dir_name} full
+%endif
+ # Debug builds don't need same targets as release for
+ # build speed-up. We also avoid bootstrapping these
+ # slower builds.
+ if echo $debugbuild | grep -q "debug" ; then
+ maketargets="%{debug_targets}"
+ run_bootstrap=false
+ else
+ maketargets="%{release_targets}"
+ run_bootstrap=%{bootstrap_build}
+ fi
+ if ${run_bootstrap} ; then
+ buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild} ${link_opt} ${debug_symbols}
+ installjdk ${bootbuilddir} ${bootinstalldir}
+ buildjdk ${builddir} $(pwd)/${bootinstalldir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols}
+ installjdk ${builddir} ${installdir}
+ %{!?with_artifacts:rm -rf ${bootinstalldir}}
+ else
+ buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols}
+ installjdk ${builddir} ${installdir}
+ fi
+ packagejdk ${installdir} ${packagesdir}
+
+%if %{system_libs}
+ # Restore original source tree we modified by removing full in-tree sources
+ rm -rf %{top_level_dir_name}
+ mv %{top_level_dir_name_backup} %{top_level_dir_name}
+%endif
+
+# build cycles
+done # end of release / debug cycle loop
+
+%check
+
+# We test debug first as it will give better diagnostics on a crash
+for suffix in %{build_loop} ; do
+
+# portable builds have static_libs embedded, thus top_dir_abs_main_build_path is same as top_dir_abs_staticlibs_build_path
+top_dir_abs_main_build_path=$(pwd)/%{installoutputdir -- ${suffix}}
+%if %{include_staticlibs}
+top_dir_abs_staticlibs_build_path=${top_dir_abs_main_build_path}
+%endif
+
+export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage}
+
+# Pre-test setup
+
+# System security properties are disabled by default on portable.
+# Turn on system security properties
+#sed -i -e "s:^security.useSystemPropertiesFile=.*:security.useSystemPropertiesFile=true:" \
+#${JAVA_HOME}/conf/security/java.security
+
+
+#check Shenandoah is enabled
+%if %{use_shenandoah_hotspot}
+$JAVA_HOME//bin/java -XX:+UnlockExperimentalVMOptions -XX:+UseShenandoahGC -version
+%endif
+
+# Check unlimited policy has been used
+$JAVA_HOME/bin/javac -d . %{SOURCE13}
+$JAVA_HOME/bin/java --add-opens java.base/javax.crypto=ALL-UNNAMED TestCryptoLevel
+
+# Check ECC is working
+$JAVA_HOME/bin/javac -d . %{SOURCE14}
+$JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||")
+
+# Check system crypto (policy) is active and can be disabled
+# Test takes a single argument - true or false - to state whether system
+# security properties are enabled or not.
+$JAVA_HOME/bin/javac -d . %{SOURCE15}
+export PROG=$(echo $(basename %{SOURCE15})|sed "s|\.java||")
+export SEC_DEBUG="-Djava.security.debug=properties"
+# Specific to portable:System security properties to be off by default
+$JAVA_HOME/bin/java ${SEC_DEBUG} ${PROG} false
+$JAVA_HOME/bin/java ${SEC_DEBUG} -Djava.security.disableSystemPropertiesFile=true ${PROG} false
+
+# Check correct vendor values have been set
+$JAVA_HOME/bin/javac -d . %{SOURCE16}
+$JAVA_HOME/bin/java $(echo $(basename %{SOURCE16})|sed "s|\.java||") "%{oj_vendor}" "%{oj_vendor_url}" "%{oj_vendor_bug_url}" "%{oj_vendor_version}"
+
+# Check java launcher has no SSB mitigation
+if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi
+
+# Check alt-java launcher has SSB mitigation on supported architectures
+%ifarch %{ssbd_arches}
+nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation
+%else
+if ! nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation ; then true ; else false; fi
+%endif
+
+%if ! 0%{?flatpak}
+# Check translations are available for new timezones (during flatpak builds, the
+# tzdb.dat used by this test is not where the test expects it, so this is
+# disabled for flatpak builds)
+$JAVA_HOME/bin/javac -d . %{SOURCE18}
+$JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE
+$JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR
+%endif
+
+%if %{include_staticlibs}
+# Check debug symbols in static libraries (smoke test)
+export STATIC_LIBS_HOME=${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image}
+ls -l $STATIC_LIBS_HOME
+ls -l $STATIC_LIBS_HOME/lib
+# they are here, but grep do not find the remainders
+#readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep w_remainder.c
+#readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep e_remainder.c
+%endif
+
+# Release builds strip the debug symbols into external .debuginfo files
+if [ "x$suffix" = "x" ] ; then
+ so_suffix="debuginfo"
+else
+ so_suffix="so"
+fi
+# Check debug symbols are present and can identify code
+find "$JAVA_HOME" -iname "*.$so_suffix" -print0 | while read -d $'\0' lib
+do
+ if [ -f "$lib" ] ; then
+ echo "Testing $lib for debug symbols"
+ # All these tests rely on RPM failing the build if the exit code of any set
+ # of piped commands is non-zero.
+
+ # Test for .debug_* sections in the shared object. This is the main test
+ # Stripped objects will not contain these
+ eu-readelf -S "$lib" | grep "] .debug_"
+ test $(eu-readelf -S "$lib" | grep -E "\]\ .debug_(info|abbrev)" | wc --lines) == 2
+
+ # Test FILE symbols. These will most likely be removed by anything that
+ # manipulates symbol tables because it's generally useless. So a nice test
+ # that nothing has messed with symbols
+ old_IFS="$IFS"
+ IFS=$'\n'
+ for line in $(eu-readelf -s "$lib" | grep "00000000 0 FILE LOCAL DEFAULT")
+ do
+ # We expect to see .cpp and .S files, except for architectures like aarch64 and
+ # s390 where we expect .o and .oS files
+ echo "$line" | grep -E "ABS ((.*/)?[-_a-zA-Z0-9]+\.(c|cc|cpp|cxx|o|S|oS))?$"
+ done
+ IFS="$old_IFS"
+
+ # If this is the JVM, look for javaCalls.(cpp|o) in FILEs, for extra sanity checking
+ if [ "`basename $lib`" = "libjvm.so" ]; then
+ eu-readelf -s "$lib" | \
+ grep -E "00000000 0 FILE LOCAL DEFAULT ABS javaCalls.(cpp|o)$"
+ fi
+
+ # Test that there are no .gnu_debuglink sections pointing to another
+ # debuginfo file. There shouldn't be any debuginfo files, so the link makes
+ # no sense either
+ eu-readelf -S "$lib" | grep 'gnu'
+ if eu-readelf -S "$lib" | grep '] .gnu_debuglink' | grep PROGBITS; then
+ echo "bad .gnu_debuglink section."
+ eu-readelf -x .gnu_debuglink "$lib"
+ false
+ fi
+ fi
+done
+
+# Make sure gdb can do a backtrace based on line numbers on libjvm.so
+# javaCalls.cpp:58 should map to:
+# http://hg.openjdk.java.net/jdk8u/jdk8u/hotspot/file/ff3b27e6bcc2/src/share/vm/runtime/javaCalls.cpp#l58
+# Using line number 1 might cause build problems. See:
+# https://bugzilla.redhat.com/show_bug.cgi?id=1539664
+# https://bugzilla.redhat.com/show_bug.cgi?id=1538767
+gdb -q "$JAVA_HOME/bin/java" < - 1:17.0.7.0.7-2
+- Update to jdk-17.0.7.0+7
+- Update release notes to 17.0.7.0+7
+- Require tzdata 2023c due to local inclusion of JDK-8274864 & JDK-8305113
+- Reintroduce generate_source_tarball.sh from RHEL 9
+- Update generate_tarball.sh to add support for passing a boot JDK to the configure run
+- Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
+- Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
+- Update FIPS support against 17.0.7+6 and bring in latest changes:
+- * RH2134669: Add missing attributes when registering services in FIPS mode.
+- * test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
+- * RH1940064: Enable XML Signature provider in FIPS mode
+- * RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized
+- Fix trailing '.' in tarball name
+- Use rpmrelease in vendor version to avoid inclusion of dist tag
+- ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
+- Resolves: rhbz#2185182
+- Resolves: rhbz#2134669
+- Resolves: rhbz#1940064
+- Resolves: rhbz#2173781
+
+* Thu Apr 20 2023 Andrew Hughes - 1:17.0.6.0.10-7
+- Sync with existing RHEL 8 build, in order to start building portables on RHEL 8
+- Restore system bootstrap JDK (RHEL 8 has java-17-openjdk)
+- Remove use of devtoolset (RHEL 8 native compilers should be sufficient)
+- Explicitly exclude x86, as on RHEL RPMs
+
+* Tue Feb 21 2023 Andrew Hughes - 1:17.0.6.0.10-6
+- Add docs, icons and samples to the portable output
+- Make sure generated checksums work and don't include full path
+- The docs directory is a subdirectory of images, so remove confusing separate copying
+
+* Wed Feb 15 2023 Andrew Hughes - 1:17.0.6.0.10-5
+- Build with internal debuginfo as in RHEL and then create a stripped variant ourselves for the portable release build
+- Restore compiler flags to those used in RHEL
+- Drop unused static library patch
+- Drop syslookup workaround which was fixed by JDK-8276572 over a year ago
+
+* Tue Feb 14 2023 Andrew Hughes - 1:17.0.6.0.10-4
+- Separate JDK packaging into a separate function
+- Use variables to make it clearer what is going on
+- Use a package output directory as we do for building and installing
+- Workaround missing manpage directory in the JRE image
+
+* Sun Feb 12 2023 Andrew Hughes - 1:17.0.6.0.10-3
+- Adapt the portable build to use the same system library handling as RHEL builds
+
+* Sat Jan 14 2023 Andrew Hughes - 1:17.0.6.0.10-3
+- Add missing release note for JDK-8295687
+- Resolves: rhbz#2160111
+
+* Fri Jan 13 2023 Andrew Hughes - 1:17.0.6.0.10-2
+- Update FIPS support to bring in latest changes
+- * Add nss.fips.cfg support to OpenJDK tree
+- * RH2117972: Extend the support for NSS DBs (PKCS11) in FIPS mode
+- * Remove forgotten dead code from RH2020290 and RH2104724
+- * OJ1357: Fix issue on FIPS with a SecurityManager in place
+- Drop local nss.fips.cfg.in handling now this is handled in the patched OpenJDK build
+- Resolves: rhbz#2118493
+
+* Fri Jan 13 2023 Stephan Bergmann - 1:17.0.6.0.10-2
+- Fix flatpak builds by disabling TestTranslations test due to missing tzdb.dat
+- Related: rhbz#2160111
+
+* Wed Jan 11 2023 Andrew Hughes - 1:17.0.6.0.10-1
+- Update to jdk-17.0.6.0+10
+- Update release notes to 17.0.6.0+10
+- Re-enable EA upstream status check now it is being actively maintained.
+- Drop JDK-8294357 (tzdata2022d) & JDK-8295173 (tzdata2022e) local patches which are now upstream
+- Drop JDK-8275535 local patch now this has been accepted and backported upstream
+- Drop local copy of JDK-8293834 now this is upstream
+- Require tzdata 2022g due to inclusion of JDK-8296108, JDK-8296715 & JDK-8297804
+- Update TestTranslations.java to test the new America/Ciudad_Juarez zone
+- ** This tarball is embargoed until 2023-01-17 @ 1pm PT. **
+- Resolves: rhbz#2160111
+
+* Sat Oct 15 2022 Andrew Hughes - 1:17.0.5.0.8-2
+- Update in-tree tzdata to 2022e with JDK-8294357 & JDK-8295173
+- Update CLDR data with Europe/Kyiv (JDK-8293834)
+- Drop JDK-8292223 patch which we found to be unnecessary
+- Update TestTranslations.java to use public API based on TimeZoneNamesTest upstream
+- Related: rhbz#2160111
+
+* Thu Oct 13 2022 Andrew Hughes - 1:17.0.5.0.8-1
+- Update to jdk-17.0.5+8 (GA)
+- Update release notes to 17.0.5+8 (GA)
+- Switch to GA mode for final release.
+- * This tarball is embargoed until 2022-10-18 @ 1pm PT. *
+- Resolves: rhbz#2133695
+
+* Fri Sep 02 2022 Andrew Hughes - 1:17.0.4.1.1-2
+- Update FIPS support to bring in latest changes
+- * RH2023467: Enable FIPS keys export
+- * RH2104724: Avoid import/export of DH private keys
+- * RH2092507: P11Key.getEncoded does not work for DH keys in FIPS mode
+- * Build the systemconf library on all platforms
+- * RH2048582: Support PKCS#12 keystores
+- * RH2020290: Support TLS 1.3 in FIPS mode
+- Resolves: rhbz#2123579
+- Resolves: rhbz#2123580
+- Resolves: rhbz#2123581
+- Resolves: rhbz#2123583
+- Resolves: rhbz#2123584
+
+* Sun Aug 21 2022 Jayashree Huttanagoudar - 1:17.0.4.1.1-1
+- Added a missing change to portable NEWS file from upstream.
+
+* Sun Aug 21 2022 Andrew Hughes - 1:17.0.4.1.1-1
+- Update to jdk-17.0.4.1+1
+- Update release notes to 17.0.4.1+1
+- Add patch to provide translations for Europe/Kyiv added in tzdata2022b
+- Add test to ensure timezones can be translated
+- Resolves: rhbz#2119532
+
+* Mon Jul 18 2022 Jayashree Huttanagoudar - 1:17.0.4.0.8-1
+- Commented out: fipsver f8142a23d0a which was from rhel-9-main
+- Picked 17.0.4+8 GA tag from rhel-9.0.0
+- For Jul 2022 CPU fipsver is 765f970aef1 on rhel-9.0.0
+
+* Mon Jul 18 2022 Andrew Hughes - 1:17.0.4.0.8-1
+- Update to jdk-17.0.4.0+8 (GA)
+- Update release notes to 17.0.4.0+8
+- Need to include the '.S' suffix in debuginfo checks after JDK-8284661
+- Switch to GA mode for release
+- ** This tarball is embargoed until 2022-07-19 @ 1pm PT. **
+
+* Thu Jul 14 2022 Jayashree Huttanagoudar - 1:17.0.4.0.1-0.2.ea
+- Fix issue where CheckVendor.java test erroneously passes when it should fail.
+- Add proper quoting so '&' is not treated as a special character by the shell.
+- Related: rhbz#2084779
+
+* Tue Jul 12 2022 Jayashree Huttanagoudar - 1:17.0.4.0.1-0.1.ea
+- Tweaked line to print release information for portable
+
+* Tue Jul 12 2022 Andrew Hughes - 1:17.0.4.0.1-0.1.ea
+- Update to jdk-17.0.4.0+1
+- Update release notes to 17.0.4.0+1
+- Switch to EA mode for 17.0.4 pre-release builds.
+- Print release file during build, which should now include a correct SOURCE value from .src-rev
+- Update tarball script with IcedTea GitHub URL and .src-rev generation
+- Include script to generate bug list for release notes
+- Update tzdata requirement to 2022a to match JDK-8283350
+- Move EA designator check to prep so failures can be caught earlier
+- Make EA designator check non-fatal while upstream is not maintaining it
+- Related: rhbz#2084218
+
+* Thu Jun 30 2022 Jayashree Huttanagoudar - 1:17.0.3.0.7-8
+- Comment line for portable: System security properties to be off by default
+
+* Thu Jun 30 2022 Francisco Ferrari Bihurriet - 1:17.0.3.0.7-8
+- RH2007331: SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode
+- Resolves: rhbz#2102433
+
+* Wed Jun 29 2022 Jayashree Huttanagoudar - 1:17.0.3.0.7-7
+- System security properties are disabled by default on portable.
+- Commented out lines which are not applicable for portable.
+
+* Wed Jun 29 2022 Andrew Hughes - 1:17.0.3.0.7-7
+- Update FIPS support to bring in latest changes
+- * RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
+- * RH2090378: Revert to disabling system security properties and FIPS mode support together
+- Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
+- Enable system security properties in the RPM (now disabled by default in the FIPS repo)
+- Improve security properties test to check both enabled and disabled behaviour
+- Run security properties test with property debugging on
+- Resolves: rhbz#2099844
+- Resolves: rhbz#2100677
+
+* Tue Jun 28 2022 Jayashree Huttanagoudar - 1:17.0.3.0.7-6
+- Removed upstreamed patch2001: aqaCheckSecurityAndProviderFileSocketPermissions.patch
+
+* Sun Jun 12 2022 Andrew Hughes - 1:17.0.3.0.7-6
+- Rebase FIPS patches from fips-17u branch and simplify by using a single patch from that repository
+- Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
+- RH2023467: Enable FIPS keys export
+- RH2094027: SunEC runtime permission for FIPS
+- Resolves: rhbz#2029657
+- Resolves: rhbz#2096117
+
+* Wed May 25 2022 Andrew Hughes - 1:17.0.3.0.7-5
+- Exclude s390x from the gdb test on RHEL 7 where we see failures with the portable build
+
+* Tue May 24 2022 Jiri Vanek - 1:17.0.3.0.7-4
+- to pass aqa, fixing genuie failure in :
+- java/lang/SecurityManager/CheckAccessClassInPackagePermissions.java#CheckAccessClassInPackagePermissions
+- javax/xml/crypto/dsig/FileSocketPermissions.java#FileSocketPermissions
+- added and applied patch2001: aqaCheckSecurityAndProviderFileSocketPermissions.patch
+- this, properly named, patch must go to all our jdk17 builds, and to the fips repo
+
+* Thu May 19 2022 Jiri Vanek - 1:17.0.3.0.7-3
+- to pass aqa:
+- removed copy system tzdb in favour of in-tree
+- removed Patch2: rh1648644-java_access_bridge_privileged_security.patch
+- This is not intended to release untill we decide proper steps
+
+* Thu May 19 2022 Jayashree Huttanagoudar - 1:17.0.3.0.7-2
+- Include BOOT_JDK for s390x for portable
+- BOOT_JDK downlaoded form hydra as
+ java-17-temurin-17.0.3.7-0.private.ojdk17~upstream.hotspot.release.sdk.el7.s390x.tarxz
+ and renamed
+- Added cosmetic changes to bypass a failure for s390x
+
+* Wed Apr 20 2022 Andrew Hughes - 1:17.0.3.0.7-1
+- April 2022 security update to jdk 17.0.3+7
+- Remove JDK-8284548 and JDK-8284920 they are upstreamed now
+- Resolves: rhbz#2073579
+
+* Sat Apr 16 2022 Andrew Hughes - 1:17.0.3.0.6-3
+- Add JDK-8284920 fix for XPath regression
+- Related: rhbz#2073575
+
+* Fri Apr 15 2022 Andrew Hughes - 1:17.0.3.0.6-2
+- Remove the patch jdk8283911-default_promoted_version_pre.patch which missed in previous commit
+- JDK-8275082 should be listed as also resolving JDK-8278008 & CVE-2022-21476
+- Related: rhbz#2073575
+
+* Mon Apr 11 2022 Andrew Hughes - 1:17.0.3.0.6-1
+- April 2022 security update to jdk 17.0.3+6
+- Update to jdk-17.0.3.0+6 pre-release tarball (17usec.17.0.3+5-220408)
+- Add JDK-8284548 regression fix missing from pre-release tarball but in jdk-17.0.3+6/jdk-17.0.3-ga
+- Update release notes to 17.0.3.0+6
+- Add missing README.md and generate_source_tarball.sh
+- Introduce tests/tests.yml, based on the one in java-11-openjdk
+- JDK-8283911 patch no longer needed now we're GA...
+- Switch to GA mode for release
+- ** This tarball is embargoed until 2022-04-19 @ 1pm PT. **
+- Resolves: rhbz#2073575
+
+* Wed Apr 06 2022 Andrew Hughes - 1:17.0.3.0.5-0.1.ea
+- Update to jdk-17.0.3.0+5
+- Update release notes to 17.0.3.0+5
+- Resolves: rhbz#2050460
+
+* Tue Mar 29 2022 Andrew Hughes - 1:17.0.3.0.1-0.1.ea
+- Update to jdk-17.0.3.0+1
+- Update release notes to 17.0.3.0+1
+- Switch to EA mode for 17.0.3 pre-release builds.
+- Add JDK-8283911 to fix bad DEFAULT_PROMOTED_VERSION_PRE value
+- Related: rhbz#2050456
+
+* Mon Feb 28 2022 Jayashree Huttanagoudar - 1:17.0.2.0.8-10
+- Update icedtea_sync.sh with suitable message for portable
+
+* Mon Feb 28 2022 Andrew Hughes - 1:17.0.2.0.8-10
+- Restructure the build so a minimal initial build is then used for the final build (with docs)
+- This reduces pressure on the system JDK and ensures the JDK being built can do a full build
+- Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
+- Handle Fedora in distro conditionals that currently only pertain to RHEL.
+- Run OpenJDK normalizer script on the spec file to fix further rogue whitespace
+- Sync gdb test with java-1.8.0-openjdk and improve architecture restrictions.
+- Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
+- Need to support noarch for creating source RPMs for non-scratch builds.
+- Replace -mstackrealign with -mincoming-stack-boundary=2 -mpreferred-stack-boundary=4 on x86_32 for stack alignment
+- Support a HotSpot-only build so a freshly built libjvm.so can then be used in the bootstrap JDK.
+- Explicitly list JIT architectures rather than relying on those with slowdebug builds
+- Disable the serviceability agent on Zero architectures even when the architecture itself is supported
+- Resolves: rhbz#2022822
+
+* Mon Feb 28 2022 Andrew Hughes - 1:17.0.2.0.8-9
+- Enable AlgorithmParameters and AlgorithmParameterGenerator services in FIPS mode
+- Correction to previous changelog entry
+- Resolves: rhbz#2052070
+
+* Sun Feb 27 2022 Andrew Hughes - 1:17.0.2.0.8-8
+- Detect NSS at runtime for FIPS detection
+- Resolves: rhbz#2051605
+
+* Wed Feb 23 2022 Andrew Hughes - 1:17.0.2.0.8-7
+- Add JDK-8275535 patch to fix LDAP authentication issue.
+- Resolves: rhbz#2053521
+
+* Tue Feb 08 2022 Andrew Hughes - 1:17.0.2.0.8-6
+- Minor cosmetic improvements to make spec more comparable between variants
+- Related: rhbz#2022822
+
+* Thu Feb 03 2022 Andrew Hughes - 1:17.0.2.0.8-5
+- Update tapsets from IcedTea 6.x repository with fix for JDK-8015774 changes (_heap->_heaps) and @JAVA_SPEC_VER@
+- Related: rhbz#2022822
+
+* Thu Feb 03 2022 Andrew Hughes - 1:17.0.2.0.8-4
+- Extend LTS check to exclude EPEL.
+- Related: rhbz#2022822
+
+* Tue Jan 18 2022 Andrew Hughes - 1:17.0.2.0.8-3
+- Separate crypto policy initialisation from FIPS initialisation, now they are no longer interdependent
+
+* Mon Jan 17 2022 Andrew Hughes - 1:17.0.2.0.8-2
+- Fix FIPS issues in native code and with initialisation of java.security.Security
+- Related: rhbz#2039366
+
+* Wed Jan 12 2022 Andrew Hughes - 1:17.0.2.0.8-1
+- January 2022 security update to jdk 17.0.2+8
+- Rebase RH1995150 & RH1996182 patches following JDK-8275863 addition to module-info.java
+- Resolves: rhbz#2039366
+- Minor change to the OUTPUT_FILE value to separate the name from the version with '-'
+
+* Mon Nov 29 2021 Severin Gehwolf - 1:17.0.1.0.12-3
+- Use 'sql:' prefix in nss.fips.cfg as F35+ no longer ship the legacy
+ secmod.db file as part of nss
+- Resolves: rhbz#2023537
+
+* Tue Oct 26 2021 Andrew Hughes - 1:17.0.1.0.12-2
+- Drop JDK-8272332/RH2004078 patch which is upstream in 17.0.1
+- October CPU update to jdk 17.0.1+12
+- Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
+- Add patch to allow plain key import.
+
+* Mon Oct 25 2021 Jiri Vanek - 1:17.0.0.0.35-5
+- cacerts symlink is resolved before passed to configure
+- https://issues.redhat.com/browse/OPENJDK-487
+- Disable FIPS mode detection using NSS in favour of using /proc/sys/crypto/fips_enabled for now, so we don't link against NSS
+-- effectively disabled Patch1008: rh1929465-improve_system_FIPS_detection.patch by settng --enable-sysconf-nss to --disable-sysconf-nss
+-- the enable-sysconf-nss was bringing in hard depndence on nss. Without nss, even in non fips, jvm had not even started
+
+* Thu Sep 30 2021 Jiri Vanek - 1:17.0.0.0.35-4
+- initial import, based on jdk11 portbale, merged with jdk17 rpms and java-latest-openjdk for epel7
diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec
index f0cc8ed..9c55d1a 100644
--- a/java-17-openjdk.spec
+++ b/java-17-openjdk.spec
@@ -313,7 +313,7 @@
# New Version-String scheme-style defines
%global featurever 17
%global interimver 0
-%global updatever 6
+%global updatever 7
%global patchver 0
# buildjdkver is usually same as %%{featurever},
# but in time of bootstrap of next jdk, it is featurever-1,
@@ -348,23 +348,23 @@
%endif
%endif
%endif
-%global oj_vendor_version (Red_Hat-%{version}-%{release})
+%global oj_vendor_version (Red_Hat-%{version}-%{portablerelease})
# Define IcedTea version used for SystemTap tapsets and desktop file
%global icedteaver 6.0.0pre00-c848b93a8598
# Define current Git revision for the FIPS support patches
-%global fipsver 257d544b594
+%global fipsver bf363eecce3
# Standard JPackage naming and versioning defines
%global origin openjdk
%global origin_nice OpenJDK
%global top_level_dir_name %{origin}
%global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver 10
-%global rpmrelease 4
+%global buildver 7
+%global rpmrelease 3
# Settings used by the portable build
-%global portablerelease 6
-%global portablesuffix el7openjdkportable
+%global portablerelease 2
+%global portablesuffix el8
%global portablebuilddir /builddir/build/BUILD
# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
@@ -798,6 +798,8 @@ exit 0
%define files_jre_headless() %{expand:
%license %{_jvmdir}/%{sdkdir -- %{?1}}/legal
%doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/NEWS
+%doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/README.md
+%doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/java-%{featurever}-openjdk-portable.specfile
%dir %{_sysconfdir}/.java/.systemPrefs
%dir %{_sysconfdir}/.java
%dir %{_jvmdir}/%{sdkdir -- %{?1}}
@@ -1308,88 +1310,19 @@ Source16: CheckVendor.java
# Ensure translations are available for new timezones
Source18: TestTranslations.java
-# TODO: Portable packages are not yet available in buildroot
-# Temporarily add them as sources
-
-# aarch64
-Source1000: java-17-openjdk-17.0.6.0.10-6.portable.unstripped.jdk.el.aarch64.tar.xz
-Source1001: java-17-openjdk-17.0.6.0.10-6.portable.static-libs.el.aarch64.tar.xz
-Source1002: java-17-openjdk-17.0.6.0.10-6.portable.docs.el.aarch64.tar.xz
-Source1003: java-17-openjdk-17.0.6.0.10-6.portable.misc.el.aarch64.tar.xz
-Source1004: java-17-openjdk-17.0.6.0.10-6.portable.slowdebug.jdk.el.aarch64.tar.xz
-Source1005: java-17-openjdk-17.0.6.0.10-6.portable.slowdebug.static-libs.el.aarch64.tar.xz
-Source1006: java-17-openjdk-17.0.6.0.10-6.portable.fastdebug.jdk.el.aarch64.tar.xz
-Source1007: java-17-openjdk-17.0.6.0.10-6.portable.fastdebug.static-libs.el.aarch64.tar.xz
-
-# ppc64le
-Source2000: java-17-openjdk-17.0.6.0.10-6.portable.unstripped.jdk.el.ppc64le.tar.xz
-Source2001: java-17-openjdk-17.0.6.0.10-6.portable.static-libs.el.ppc64le.tar.xz
-Source2002: java-17-openjdk-17.0.6.0.10-6.portable.docs.el.ppc64le.tar.xz
-Source2003: java-17-openjdk-17.0.6.0.10-6.portable.misc.el.ppc64le.tar.xz
-Source2004: java-17-openjdk-17.0.6.0.10-6.portable.slowdebug.jdk.el.ppc64le.tar.xz
-Source2005: java-17-openjdk-17.0.6.0.10-6.portable.slowdebug.static-libs.el.ppc64le.tar.xz
-Source2006: java-17-openjdk-17.0.6.0.10-6.portable.fastdebug.jdk.el.ppc64le.tar.xz
-Source2007: java-17-openjdk-17.0.6.0.10-6.portable.fastdebug.static-libs.el.ppc64le.tar.xz
-
-# s390x
-Source3000: java-17-openjdk-17.0.6.0.10-6.portable.unstripped.jdk.el.s390x.tar.xz
-Source3001: java-17-openjdk-17.0.6.0.10-6.portable.static-libs.el.s390x.tar.xz
-Source3002: java-17-openjdk-17.0.6.0.10-6.portable.docs.el.s390x.tar.xz
-Source3003: java-17-openjdk-17.0.6.0.10-6.portable.misc.el.s390x.tar.xz
-Source3004: java-17-openjdk-17.0.6.0.10-6.portable.slowdebug.jdk.el.s390x.tar.xz
-Source3005: java-17-openjdk-17.0.6.0.10-6.portable.slowdebug.static-libs.el.s390x.tar.xz
-
-# x86_64
-Source4000: java-17-openjdk-17.0.6.0.10-6.portable.unstripped.jdk.el.x86_64.tar.xz
-Source4001: java-17-openjdk-17.0.6.0.10-6.portable.static-libs.el.x86_64.tar.xz
-Source4002: java-17-openjdk-17.0.6.0.10-6.portable.docs.el.x86_64.tar.xz
-Source4003: java-17-openjdk-17.0.6.0.10-6.portable.misc.el.x86_64.tar.xz
-Source4004: java-17-openjdk-17.0.6.0.10-6.portable.slowdebug.jdk.el.x86_64.tar.xz
-Source4005: java-17-openjdk-17.0.6.0.10-6.portable.slowdebug.static-libs.el.x86_64.tar.xz
-Source4006: java-17-openjdk-17.0.6.0.10-6.portable.fastdebug.jdk.el.x86_64.tar.xz
-Source4007: java-17-openjdk-17.0.6.0.10-6.portable.fastdebug.static-libs.el.x86_64.tar.xz
+# Include portable spec and instructions on how to rebuild
+Source19: README.md
+Source20: java-%{featurever}-openjdk-portable.specfile
# Setup variables to reference correct sources
-%ifarch %{aarch64}
-%global releasezip %{SOURCE1000}
-%global staticlibzip %{SOURCE1001}
-%global docszip %{SOURCE1002}
-%global misczip %{SOURCE1003}
-%global slowdebugzip %{SOURCE1004}
-%global slowdebugstaticlibzip %{SOURCE1005}
-%global fastdebugzip %{SOURCE1006}
-%global fastdebugstaticlibzip %{SOURCE1007}
-%endif
-%ifarch %{ppc64le}
-%global releasezip %{SOURCE2000}
-%global staticlibzip %{SOURCE2001}
-%global docszip %{SOURCE2002}
-%global misczip %{SOURCE2003}
-%global slowdebugzip %{SOURCE2004}
-%global slowdebugstaticlibzip %{SOURCE2005}
-%global fastdebugzip %{SOURCE2006}
-%global fastdebugstaticlibzip %{SOURCE2007}
-%endif
-%ifarch s390x
-%global releasezip %{SOURCE3000}
-%global staticlibzip %{SOURCE3001}
-%global docszip %{SOURCE3002}
-%global misczip %{SOURCE3003}
-%global slowdebugzip %{SOURCE3004}
-%global slowdebugstaticlibzip %{SOURCE3005}
-%global fastdebugzip %{nil}
-%global fastdebugstaticlibzip %{nil}
-%endif
-%ifarch x86_64
-%global releasezip %{SOURCE4000}
-%global staticlibzip %{SOURCE4001}
-%global docszip %{SOURCE4002}
-%global misczip %{SOURCE4003}
-%global slowdebugzip %{SOURCE4004}
-%global slowdebugstaticlibzip %{SOURCE4005}
-%global fastdebugzip %{SOURCE4006}
-%global fastdebugstaticlibzip %{SOURCE4007}
-%endif
+%global releasezip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.unstripped.jdk.%{_arch}.tar.xz
+%global staticlibzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.static-libs.%{_arch}.tar.xz
+%global docszip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.docs.%{_arch}.tar.xz
+%global misczip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.misc.%{_arch}.tar.xz
+%global slowdebugzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.slowdebug.jdk.%{_arch}.tar.xz
+%global slowdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.slowdebug.static-libs.%{_arch}.tar.xz
+%global fastdebugzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.fastdebug.jdk.%{_arch}.tar.xz
+%global fastdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.fastdebug.static-libs.%{_arch}.tar.xz
############################################
#
@@ -1413,7 +1346,7 @@ Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-d
# Crypto policy and FIPS support patches
# Patch is generated from the fips-17u tree at https://github.com/rh-openjdk/jdk/tree/fips-17u
-# as follows: git diff %%{vcstag} src make > fips-17u-$(git show -s --format=%h HEAD).patch
+# as follows: git diff %%{vcstag} src make test > fips-17u-$(git show -s --format=%h HEAD).patch
# Diff is limited to src and make subdirectories to exclude .github changes
# Fixes currently included:
# PR3183, RH1340845: Follow system wide crypto policy
@@ -1443,6 +1376,10 @@ Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-d
# RH2117972: Extend the support for NSS DBs (PKCS11) in FIPS mode
# Remove forgotten dead code from RH2020290 and RH2104724
# OJ1357: Fix issue on FIPS with a SecurityManager in place
+# RH2134669: Add missing attributes when registering services in FIPS mode.
+# test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
+# RH1940064: Enable XML Signature provider in FIPS mode
+# RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized
Patch1001: fips-17u-%{fipsver}.patch
#############################################
@@ -1453,15 +1390,13 @@ Patch1001: fips-17u-%{fipsver}.patch
#############################################
#
-# OpenJDK patches appearing in 17.0.3
-#
-#############################################
-
-#############################################
-#
-# OpenJDK patches targetted for 17.0.6
+# OpenJDK patches targetted for 17.0.8
#
#############################################
+# JDK-8274864: Remove Amman/Cairo hacks in ZoneInfoFile
+Patch2001: jdk8274864-remove_amman_cairo_hacks.patch
+# JDK-8305113: (tz) Update Timezone Data to 2023c
+Patch2002: jdk8305113-tzdata2023c.patch
BuildRequires: autoconf
BuildRequires: automake
@@ -1490,19 +1425,26 @@ BuildRequires: pkgconfig
BuildRequires: xorg-x11-proto-devel
BuildRequires: zip
BuildRequires: javapackages-filesystem
-# TODO: Portable packages are not yet available in buildroot
-#BuildRequires: java-%{featurever}-openjdk-portable-unstripped = %{version}
-#BuildRequires: java-%{featurever}-openjdk-portable-static-libs = %{version}
-#BuildRequires: java-%{featurever}-openjdk-portable-devel-fastdebug = %{version}
-#BuildRequires: java-%{featurever}-openjdk-portable-static-libs-fastdebug = %{version}
-#BuildRequires: java-%{featurever}-openjdk-portable-devel-slowdebug = %{version}
-#BuildRequires: java-%{featurever}-openjdk-portable-static-libs-slowdebug = %{version}
+%if %{include_normal_build}
+BuildRequires: java-%{featurever}-openjdk-portable-unstripped = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: java-%{featurever}-openjdk-portable-static-libs = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+%endif
+%if %{include_fastdebug_build}
+BuildRequires: java-%{featurever}-openjdk-portable-devel-fastdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: java-%{featurever}-openjdk-portable-static-libs-fastdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+%endif
+%if %{include_debug_build}
+BuildRequires: java-%{featurever}-openjdk-portable-devel-slowdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: java-%{featurever}-openjdk-portable-static-libs-slowdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+%endif
+BuildRequires: java-%{featurever}-openjdk-portable-docs = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: java-%{featurever}-openjdk-portable-misc = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
# Zero-assembler build requirement
%ifarch %{zero_arches}
BuildRequires: libffi-devel
%endif
-# 2022g required as of JDK-8297804
-BuildRequires: tzdata-java >= 2022g
+# 2023c required as of JDK-8305113
+BuildRequires: tzdata-java >= 2023c
# Earlier versions have a bug in tree vectorization on PPC
BuildRequires: gcc >= 4.8.3-8
@@ -1898,6 +1840,9 @@ pushd %{top_level_dir_name}
%patch1001 -p1
# nss.cfg PKCS11 support; must come last as it also alters java.security
%patch1000 -p1
+# tzdata update
+%patch2001 -p1
+%patch2002 -p1
popd # openjdk
%patch600
@@ -2183,10 +2128,11 @@ jdk_image=$(pwd)/%{installoutputdir -- ${suffix}}
docdir=$(pwd)/%{installoutputdir -- "-docs"}
miscdir=%{installoutputdir -- "-misc"}
-# Install release notes
+# Install release notes and rebuild instructions
commondocdir=${RPM_BUILD_ROOT}%{_defaultdocdir}/%{uniquejavadocdir -- $suffix}
install -d -m 755 ${commondocdir}
mv ${jdk_image}/NEWS ${commondocdir}
+cp -a %{SOURCE19} %{SOURCE20} ${commondocdir}
# Install the jdk
mkdir -p $RPM_BUILD_ROOT%{_jvmdir}
@@ -2533,6 +2479,38 @@ cjc.mainProgram(args)
%endif
%changelog
+* Wed Apr 26 2023 Andrew Hughes - 1:17.0.7.0.7-3
+- Sync portable spec file with current version
+- Related: rhbz#2189326
+
+* Wed Apr 26 2023 Andrew Hughes - 1:17.0.7.0.7-2
+- Update to jdk-17.0.7.0+7
+- Update release notes to 17.0.7.0+7
+- Require tzdata 2023c due to local inclusion of JDK-8274864 & JDK-8305113
+- Update generate_tarball.sh to add support for passing a boot JDK to the configure run
+- Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace
+- Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs
+- Update FIPS support against 17.0.7+6 and bring in latest changes:
+- * RH2134669: Add missing attributes when registering services in FIPS mode.
+- * test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
+- * RH1940064: Enable XML Signature provider in FIPS mode
+- * RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized
+- Fix trailing '.' in tarball name
+- Use portablerelease in vendor version to avoid inclusion of dist tag
+- ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
+- Resolves: rhbz#2185182
+- Resolves: rhbz#2186803
+- Resolves: rhbz#2186810
+- Resolves: rhbz#2186806
+
+* Wed Apr 26 2023 Andrew Hughes - 1:17.0.6.0.10-6
+- Include the java-17-openjdk-portable.spec file with instructions on how to rebuild.
+- Related: rhbz#2189326
+
+* Tue Apr 25 2023 Andrew Hughes - 1:17.0.6.0.10-5
+- Replace local copies of JDK portable binaries with build dependencies
+- Resolves: rhbz#2189326
+
* Wed Feb 15 2023 Andrew Hughes - 1:17.0.6.0.10-4
- Replace build section with extraction of existing builds from portables
- Resolves: rhbz#2150200
diff --git a/jdk8274864-remove_amman_cairo_hacks.patch b/jdk8274864-remove_amman_cairo_hacks.patch
new file mode 100644
index 0000000..5a5263a
--- /dev/null
+++ b/jdk8274864-remove_amman_cairo_hacks.patch
@@ -0,0 +1,53 @@
+commit 1b3825db8631e55771fb723d4fcd10040ea15b7e
+Author: duke
+Date: Wed Apr 12 17:25:27 2023 +0000
+
+ Backport ec199072c5867624d66840238cc8828e16ae8da7
+
+diff --git a/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java b/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java
+index 6f6e190efcd..ef278203182 100644
+--- a/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java
++++ b/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java
+@@ -608,34 +608,6 @@ public final class ZoneInfoFile {
+ params[8] = endRule.secondOfDay * 1000;
+ params[9] = toSTZTime[endRule.timeDefinition];
+ dstSavings = (startRule.offsetAfter - startRule.offsetBefore) * 1000;
+-
+- // Note: known mismatching -> Asia/Amman
+- // ZoneInfo : startDayOfWeek=5 <= Thursday
+- // startTime=86400000 <= 24 hours
+- // This: startDayOfWeek=6
+- // startTime=0
+- // Similar workaround needs to be applied to Africa/Cairo and
+- // its endDayOfWeek and endTime
+- // Below is the workarounds, it probably slows down everyone a little
+- if (params[2] == 6 && params[3] == 0 &&
+- (zoneId.equals("Asia/Amman"))) {
+- params[2] = 5;
+- params[3] = 86400000;
+- }
+- // Additional check for startDayOfWeek=6 and starTime=86400000
+- // is needed for Asia/Amman;
+- if (params[2] == 7 && params[3] == 0 &&
+- (zoneId.equals("Asia/Amman"))) {
+- params[2] = 6; // Friday
+- params[3] = 86400000; // 24h
+- }
+- //endDayOfWeek and endTime workaround
+- if (params[7] == 6 && params[8] == 0 &&
+- (zoneId.equals("Africa/Cairo"))) {
+- params[7] = 5;
+- params[8] = 86400000;
+- }
+-
+ } else if (nTrans > 0) { // only do this if there is something in table already
+ if (lastyear < LASTYEAR) {
+ // ZoneInfo has an ending entry for 2037
+@@ -908,7 +880,6 @@ public final class ZoneInfoFile {
+ this.dow = dowByte == 0 ? -1 : dowByte;
+ this.secondOfDay = timeByte == 31 ? in.readInt() : timeByte * 3600;
+ this.timeDefinition = (data & (3 << 12)) >>> 12;
+-
+ this.standardOffset = stdByte == 255 ? in.readInt() : (stdByte - 128) * 900;
+ this.offsetBefore = beforeByte == 3 ? in.readInt() : standardOffset + beforeByte * 1800;
+ this.offsetAfter = afterByte == 3 ? in.readInt() : standardOffset + afterByte * 1800;
diff --git a/jdk8305113-tzdata2023c.patch b/jdk8305113-tzdata2023c.patch
new file mode 100644
index 0000000..6758dfd
--- /dev/null
+++ b/jdk8305113-tzdata2023c.patch
@@ -0,0 +1,1098 @@
+commit 9619cdb7b7f63f2d8a71d35c8672be93fd6255e9
+Author: Yoshiki Sato
+Date: Wed Apr 5 01:19:00 2023 +0000
+
+ Backport ed9592c6e81f82e2bf6508ce45ba15aad8232181
+
+diff --git a/make/data/tzdata/VERSION b/make/data/tzdata/VERSION
+index 0f328a4a7ff..66bd061e8bc 100644
+--- a/make/data/tzdata/VERSION
++++ b/make/data/tzdata/VERSION
+@@ -21,4 +21,4 @@
+ # or visit www.oracle.com if you need additional information or have any
+ # questions.
+ #
+-tzdata2022g
++tzdata2023c
+diff --git a/make/data/tzdata/africa b/make/data/tzdata/africa
+index 830d7d10b7e..a73405fdb01 100644
+--- a/make/data/tzdata/africa
++++ b/make/data/tzdata/africa
+@@ -344,6 +344,14 @@ Rule Egypt 2007 only - Sep Thu>=1 24:00 0 -
+ # From Mina Samuel (2016-07-04):
+ # Egyptian government took the decision to cancel the DST,
+
++# From Ahmad ElDardiry (2023-03-01):
++# Egypt officially announced today that daylight savings will be
++# applied from last Friday of April to last Thursday of October.
++# From Paul Eggert (2023-03-01):
++# Assume transitions are at 00:00 and 24:00 respectively.
++# From Amir Adib (2023-03-07):
++# https://www.facebook.com/EgyptianCabinet/posts/638829614954129/
++
+ Rule Egypt 2008 only - Aug lastThu 24:00 0 -
+ Rule Egypt 2009 only - Aug 20 24:00 0 -
+ Rule Egypt 2010 only - Aug 10 24:00 0 -
+@@ -353,6 +361,8 @@ Rule Egypt 2014 only - May 15 24:00 1:00 S
+ Rule Egypt 2014 only - Jun 26 24:00 0 -
+ Rule Egypt 2014 only - Jul 31 24:00 1:00 S
+ Rule Egypt 2014 only - Sep lastThu 24:00 0 -
++Rule Egypt 2023 max - Apr lastFri 0:00 1:00 S
++Rule Egypt 2023 max - Oct lastThu 24:00 0 -
+
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+ #STDOFF 2:05:08.9
+@@ -452,7 +462,7 @@ Zone Africa/Nairobi 2:27:16 - LMT 1908 May
+ # President William R. Tolbert, Jr., July 23, 1971-July 31, 1972.
+ # Monrovia: Executive Mansion.
+ #
+-# Use the abbreviation "MMT" before 1972, as the more-accurate numeric
++# Use the abbreviation "MMT" before 1972, as the more accurate numeric
+ # abbreviation "-004430" would be one byte over the POSIX limit.
+ #
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+@@ -589,8 +599,8 @@ Zone Africa/Tripoli 0:52:44 - LMT 1920
+ # DST the coming summer...
+ #
+ # Some sources, in French:
+-# http://www.defimedia.info/news/946/Rashid-Beebeejaun-:-%C2%AB-L%E2%80%99heure-d%E2%80%99%C3%A9t%C3%A9-ne-sera-pas-appliqu%C3%A9e-cette-ann%C3%A9e-%C2%BB
+-# http://lexpress.mu/Story/3398~Beebeejaun---Les-objectifs-d-%C3%A9conomie-d-%C3%A9nergie-de-l-heure-d-%C3%A9t%C3%A9-ont-%C3%A9t%C3%A9-atteints-
++# http://www.defimedia.info/news/946/Rashid-Beebeejaun-:-«-L%E2%80%99heure-d%E2%80%99été-ne-sera-pas-appliquée-cette-année-»
++# http://lexpress.mu/Story/3398~Beebeejaun---Les-objectifs-d-économie-d-énergie-de-l-heure-d-été-ont-été-atteints-
+ #
+ # Our wrap-up:
+ # https://www.timeanddate.com/news/time/mauritius-dst-will-not-repeat.html
+@@ -721,7 +731,7 @@ Zone Indian/Mauritius 3:50:00 - LMT 1907 # Port Louis
+ # More articles in the press
+ # https://www.yabiladi.com/articles/details/5058/secret-l-heure-d-ete-maroc-leve.html
+ # http://www.lematin.ma/Actualite/Express/Article.asp?id=148923
+-# http://www.lavieeco.com/actualite/Le-Maroc-passe-sur-GMT%2B1-a-partir-de-dim
++# http://www.lavieeco.com/actualite/Le-Maroc-passe-sur-GMT+1-a-partir-de-dim
+
+ # From Petr Machata (2011-03-30):
+ # They have it written in English here:
+@@ -736,7 +746,7 @@ Zone Indian/Mauritius 3:50:00 - LMT 1907 # Port Louis
+ # According to Infomédiaire web site from Morocco (infomediaire.ma),
+ # on March 9, 2012, (in French) Heure légale:
+ # Le Maroc adopte officiellement l'heure d'été
+-# http://www.infomediaire.ma/news/maroc/heure-l%C3%A9gale-le-maroc-adopte-officiellement-lheure-d%C3%A9t%C3%A9
++# http://www.infomediaire.ma/news/maroc/heure-légale-le-maroc-adopte-officiellement-lheure-dété
+ # Governing Council adopted draft decree, that Morocco DST starts on
+ # the last Sunday of March (March 25, 2012) and ends on
+ # last Sunday of September (September 30, 2012)
+@@ -860,19 +870,28 @@ Zone Indian/Mauritius 3:50:00 - LMT 1907 # Port Louis
+ # Friday or Saturday (and so the 2 days off are on a weekend), the next time
+ # shift will be the next weekend.
+ #
+-# From Paul Eggert (2020-05-31):
++# From Milamber (2021-03-31, 2022-03-10):
++# https://www.mmsp.gov.ma/fr/actualites.aspx?id=2076
++# https://www.ecoactu.ma/horaires-administration-ramadan-gmtheure-gmt-a-partir-de-dimanche-27-mars/
++#
++# From Milamber (2023-03-14, 2023-03-15):
++# The return to legal GMT time will take place this Sunday, March 19 at 3 a.m.
++# ... the return to GMT+1 will be made on Sunday April 23, 2023 at 2 a.m.
++# https://www.mmsp.gov.ma/fr/actualites/passage-à-l%E2%80%99heure-gmt-à-partir-du-dimanche-19-mars-2023
++#
++# From Paul Eggert (2023-03-14):
+ # For now, guess that in the future Morocco will fall back at 03:00
+ # the last Sunday before Ramadan, and spring forward at 02:00 the
+-# first Sunday after two days after Ramadan. To implement this,
++# first Sunday after one day after Ramadan. To implement this,
+ # transition dates and times for 2019 through 2087 were determined by
+-# running the following program under GNU Emacs 26.3. (This algorithm
++# running the following program under GNU Emacs 28.2. (This algorithm
+ # also produces the correct transition dates for 2016 through 2018,
+ # though the times differ due to Morocco's time zone change in 2018.)
+ # (let ((islamic-year 1440))
+ # (require 'cal-islam)
+ # (while (< islamic-year 1511)
+ # (let ((a (calendar-islamic-to-absolute (list 9 1 islamic-year)))
+-# (b (+ 2 (calendar-islamic-to-absolute (list 10 1 islamic-year))))
++# (b (+ 1 (calendar-islamic-to-absolute (list 10 1 islamic-year))))
+ # (sunday 0))
+ # (while (/= sunday (mod (setq a (1- a)) 7)))
+ # (while (/= sunday (mod b 7))
+@@ -886,10 +905,6 @@ Zone Indian/Mauritius 3:50:00 - LMT 1907 # Port Louis
+ # (car (cdr (cdr a))) (calendar-month-name (car a) t) (car (cdr a))
+ # (car (cdr (cdr b))) (calendar-month-name (car b) t) (car (cdr b)))))
+ # (setq islamic-year (+ 1 islamic-year))))
+-#
+-# From Milamber (2021-03-31, 2022-03-10), confirming these predictions:
+-# https://www.mmsp.gov.ma/fr/actualites.aspx?id=2076
+-# https://www.ecoactu.ma/horaires-administration-ramadan-gmtheure-gmt-a-partir-de-dimanche-27-mars/
+
+ # Rule NAME FROM TO - IN ON AT SAVE LETTER/S
+ Rule Morocco 1939 only - Sep 12 0:00 1:00 -
+@@ -942,7 +957,7 @@ Rule Morocco 2021 only - May 16 2:00 0 -
+ Rule Morocco 2022 only - Mar 27 3:00 -1:00 -
+ Rule Morocco 2022 only - May 8 2:00 0 -
+ Rule Morocco 2023 only - Mar 19 3:00 -1:00 -
+-Rule Morocco 2023 only - Apr 30 2:00 0 -
++Rule Morocco 2023 only - Apr 23 2:00 0 -
+ Rule Morocco 2024 only - Mar 10 3:00 -1:00 -
+ Rule Morocco 2024 only - Apr 14 2:00 0 -
+ Rule Morocco 2025 only - Feb 23 3:00 -1:00 -
+@@ -958,7 +973,7 @@ Rule Morocco 2029 only - Feb 18 2:00 0 -
+ Rule Morocco 2029 only - Dec 30 3:00 -1:00 -
+ Rule Morocco 2030 only - Feb 10 2:00 0 -
+ Rule Morocco 2030 only - Dec 22 3:00 -1:00 -
+-Rule Morocco 2031 only - Feb 2 2:00 0 -
++Rule Morocco 2031 only - Jan 26 2:00 0 -
+ Rule Morocco 2031 only - Dec 14 3:00 -1:00 -
+ Rule Morocco 2032 only - Jan 18 2:00 0 -
+ Rule Morocco 2032 only - Nov 28 3:00 -1:00 -
+@@ -974,7 +989,7 @@ Rule Morocco 2036 only - Nov 23 2:00 0 -
+ Rule Morocco 2037 only - Oct 4 3:00 -1:00 -
+ Rule Morocco 2037 only - Nov 15 2:00 0 -
+ Rule Morocco 2038 only - Sep 26 3:00 -1:00 -
+-Rule Morocco 2038 only - Nov 7 2:00 0 -
++Rule Morocco 2038 only - Oct 31 2:00 0 -
+ Rule Morocco 2039 only - Sep 18 3:00 -1:00 -
+ Rule Morocco 2039 only - Oct 23 2:00 0 -
+ Rule Morocco 2040 only - Sep 2 3:00 -1:00 -
+@@ -990,7 +1005,7 @@ Rule Morocco 2044 only - Aug 28 2:00 0 -
+ Rule Morocco 2045 only - Jul 9 3:00 -1:00 -
+ Rule Morocco 2045 only - Aug 20 2:00 0 -
+ Rule Morocco 2046 only - Jul 1 3:00 -1:00 -
+-Rule Morocco 2046 only - Aug 12 2:00 0 -
++Rule Morocco 2046 only - Aug 5 2:00 0 -
+ Rule Morocco 2047 only - Jun 23 3:00 -1:00 -
+ Rule Morocco 2047 only - Jul 28 2:00 0 -
+ Rule Morocco 2048 only - Jun 7 3:00 -1:00 -
+@@ -1006,7 +1021,7 @@ Rule Morocco 2052 only - Jun 2 2:00 0 -
+ Rule Morocco 2053 only - Apr 13 3:00 -1:00 -
+ Rule Morocco 2053 only - May 25 2:00 0 -
+ Rule Morocco 2054 only - Apr 5 3:00 -1:00 -
+-Rule Morocco 2054 only - May 17 2:00 0 -
++Rule Morocco 2054 only - May 10 2:00 0 -
+ Rule Morocco 2055 only - Mar 28 3:00 -1:00 -
+ Rule Morocco 2055 only - May 2 2:00 0 -
+ Rule Morocco 2056 only - Mar 12 3:00 -1:00 -
+@@ -1022,7 +1037,7 @@ Rule Morocco 2060 only - Mar 7 2:00 0 -
+ Rule Morocco 2061 only - Jan 16 3:00 -1:00 -
+ Rule Morocco 2061 only - Feb 27 2:00 0 -
+ Rule Morocco 2062 only - Jan 8 3:00 -1:00 -
+-Rule Morocco 2062 only - Feb 19 2:00 0 -
++Rule Morocco 2062 only - Feb 12 2:00 0 -
+ Rule Morocco 2062 only - Dec 31 3:00 -1:00 -
+ Rule Morocco 2063 only - Feb 4 2:00 0 -
+ Rule Morocco 2063 only - Dec 16 3:00 -1:00 -
+@@ -1038,7 +1053,7 @@ Rule Morocco 2067 only - Dec 11 2:00 0 -
+ Rule Morocco 2068 only - Oct 21 3:00 -1:00 -
+ Rule Morocco 2068 only - Dec 2 2:00 0 -
+ Rule Morocco 2069 only - Oct 13 3:00 -1:00 -
+-Rule Morocco 2069 only - Nov 24 2:00 0 -
++Rule Morocco 2069 only - Nov 17 2:00 0 -
+ Rule Morocco 2070 only - Oct 5 3:00 -1:00 -
+ Rule Morocco 2070 only - Nov 9 2:00 0 -
+ Rule Morocco 2071 only - Sep 20 3:00 -1:00 -
+@@ -1054,7 +1069,7 @@ Rule Morocco 2075 only - Sep 15 2:00 0 -
+ Rule Morocco 2076 only - Jul 26 3:00 -1:00 -
+ Rule Morocco 2076 only - Sep 6 2:00 0 -
+ Rule Morocco 2077 only - Jul 18 3:00 -1:00 -
+-Rule Morocco 2077 only - Aug 29 2:00 0 -
++Rule Morocco 2077 only - Aug 22 2:00 0 -
+ Rule Morocco 2078 only - Jul 10 3:00 -1:00 -
+ Rule Morocco 2078 only - Aug 14 2:00 0 -
+ Rule Morocco 2079 only - Jun 25 3:00 -1:00 -
+@@ -1064,13 +1079,13 @@ Rule Morocco 2080 only - Jul 21 2:00 0 -
+ Rule Morocco 2081 only - Jun 1 3:00 -1:00 -
+ Rule Morocco 2081 only - Jul 13 2:00 0 -
+ Rule Morocco 2082 only - May 24 3:00 -1:00 -
+-Rule Morocco 2082 only - Jul 5 2:00 0 -
++Rule Morocco 2082 only - Jun 28 2:00 0 -
+ Rule Morocco 2083 only - May 16 3:00 -1:00 -
+ Rule Morocco 2083 only - Jun 20 2:00 0 -
+ Rule Morocco 2084 only - Apr 30 3:00 -1:00 -
+ Rule Morocco 2084 only - Jun 11 2:00 0 -
+ Rule Morocco 2085 only - Apr 22 3:00 -1:00 -
+-Rule Morocco 2085 only - Jun 3 2:00 0 -
++Rule Morocco 2085 only - May 27 2:00 0 -
+ Rule Morocco 2086 only - Apr 14 3:00 -1:00 -
+ Rule Morocco 2086 only - May 19 2:00 0 -
+ Rule Morocco 2087 only - Mar 30 3:00 -1:00 -
+@@ -1213,15 +1228,15 @@ Zone Africa/Windhoek 1:08:24 - LMT 1892 Feb 8
+ # From P Chan (2020-12-03):
+ # GMT was adopted as the standard time of Lagos on 1905-07-01.
+ # Lagos Weekly Record, 1905-06-24, p 3
+-# http://ddsnext.crl.edu/titles/31558#?c=0&m=668&s=0&cv=2&r=0&xywh=1446%2C5221%2C1931%2C1235
++# http://ddsnext.crl.edu/titles/31558#?c=0&m=668&s=0&cv=2&r=0&xywh=1446,5221,1931,1235
+ # says "It is officially notified that on and after the 1st of July 1905
+-# Greenwich Mean Solar Time will be adopted thought the Colony and
++# Greenwich Mean Solar Time will be adopted throughout the Colony and
+ # Protectorate, and that it will be necessary to put all clocks 13 minutes and
+ # 35 seconds back, recording local mean time."
+ #
+ # It seemed that Lagos returned to LMT on 1908-07-01.
+ # [The Lagos Standard], 1908-07-01, p 5
+-# http://ddsnext.crl.edu/titles/31556#?c=0&m=78&s=0&cv=4&r=0&xywh=-92%2C3590%2C3944%2C2523
++# http://ddsnext.crl.edu/titles/31556#?c=0&m=78&s=0&cv=4&r=0&xywh=-92,3590,3944,2523
+ # says "Scarcely have the people become accustomed to this new time, when
+ # another official notice has now appeared announcing that from and after the
+ # 1st July next, return will be made to local mean time."
+@@ -1233,7 +1248,7 @@ Zone Africa/Windhoek 1:08:24 - LMT 1892 Feb 8
+ # https://libsysdigi.library.illinois.edu/ilharvest/Africana/Books2011-05/3064634/3064634_1914/3064634_1914_opt.pdf#page=27
+ # "On January 1st [1914], a universal standard time for Nigeria was adopted,
+ # viz., half an hour fast on Greenwich mean time, corresponding to the meridian
+-# 7 [degrees] 30' E. long."
++# 7° 30' E. long."
+ # Lloyd's Register of Shipping (1915) says "Hitherto the time observed in Lagos
+ # was the local mean time. On 1st January, 1914, standard time for the whole of
+ # Nigeria was introduced ... Lagos time has been advanced about 16 minutes
+@@ -1251,7 +1266,7 @@ Zone Africa/Windhoek 1:08:24 - LMT 1892 Feb 8
+ # The Lagos Weekly Record, 1919-09-20, p 3 details discussion on the first
+ # reading of this Bill by the Legislative Council of the Colony of Nigeria on
+ # Thursday 1919-08-28:
+-# http://ddsnext.crl.edu/titles/31558?terms&item_id=303484#?m=1118&c=1&s=0&cv=2&r=0&xywh=1261%2C3408%2C2994%2C1915
++# http://ddsnext.crl.edu/titles/31558?terms&item_id=303484#?m=1118&c=1&s=0&cv=2&r=0&xywh=1261,3408,2994,1915
+ # "The proposal is that the Globe should be divided into twelve zones East and
+ # West of Greenwich, of one hour each, Nigeria falling into the zone with a
+ # standard of one hour fast on Greenwich Mean Time. Nigeria standard time is
+diff --git a/make/data/tzdata/antarctica b/make/data/tzdata/antarctica
+index 792542b9224..3de5e726eb4 100644
+--- a/make/data/tzdata/antarctica
++++ b/make/data/tzdata/antarctica
+@@ -315,7 +315,7 @@ Zone Antarctica/Rothera 0 - -00 1976 Dec 1
+ # but that he found it more convenient to keep GMT+12
+ # as supplies for the station were coming from McMurdo Sound,
+ # which was on GMT+12 because New Zealand was on GMT+12 all year
+-# at that time (1957). (Source: Siple's book 90 Degrees South.)
++# at that time (1957). (Source: Siple's book 90° South.)
+ #
+ # From Susan Smith
+ # http://www.cybertours.com/whs/pole10.html
+diff --git a/make/data/tzdata/asia b/make/data/tzdata/asia
+index ff81978bc47..6a048c3ad28 100644
+--- a/make/data/tzdata/asia
++++ b/make/data/tzdata/asia
+@@ -2714,6 +2714,40 @@ Zone Asia/Pyongyang 8:23:00 - LMT 1908 Apr 1
+
+
+ # Lebanon
++#
++# From Saadallah Itani (2023-03-23):
++# Lebanon ... announced today delay of Spring forward from March 25 to April 20.
++#
++# From Paul Eggert (2023-03-27):
++# This announcement was by the Lebanese caretaker prime minister Najib Mikati.
++# https://www.mtv.com.lb/en/News/Local/1352516/lebanon-postpones-daylight-saving-time-adoption
++# A video was later leaked to the media of parliament speaker Nabih Berri
++# asking Mikati to postpone DST to aid observance of Ramadan, Mikati objecting
++# that this would cause problems such as scheduling airline flights, to which
++# Berri interjected, "What flights?"
++#
++# The change was controversial and led to a partly-sectarian divide.
++# Many Lebanese institutions, including the education ministry, the Maronite
++# church, and two news channels LCBI and MTV, ignored the announcement and
++# went ahead with the long-scheduled spring-forward on March 25/26, some
++# arguing that the prime minister had not followed the law because the change
++# had not been approved by the cabinet. Google went with the announcement;
++# Apple ignored it. At least one bank followed the announcement for its doors,
++# but ignored the announcement in internal computer systems.
++# Beirut international airport listed two times for each departure.
++# Dan Azzi wrote "My view is that this whole thing is a Dumb and Dumber movie."
++# Eventually the prime minister backed down, said the cabinet had decided to
++# stick with its 1998 decision, and that DST would begin midnight March 29/30.
++# https://www.nna-leb.gov.lb/en/miscellaneous/604093/lebanon-has-two-times-of-day-amid-daylight-savings
++# https://www.cnbc.com/2023/03/27/lebanon-in-two-different-time-zones-as-government-disagrees-on-daylight-savings.html
++#
++# Although we could model the chaos with two Zones, that would likely cause
++# more trouble than it would cure. Since so many manual clocks and
++# computer-based timestamps ignored the announcement, stick with official
++# cabinet resolutions in the data while recording the prime minister's
++# announcement as a comment. This is how we treated a similar situation in
++# Rio de Janeiro in spring 1993.
++#
+ # Rule NAME FROM TO - IN ON AT SAVE LETTER/S
+ Rule Lebanon 1920 only - Mar 28 0:00 1:00 S
+ Rule Lebanon 1920 only - Oct 25 0:00 0 -
+@@ -2739,6 +2773,10 @@ Rule Lebanon 1992 only - Oct 4 0:00 0 -
+ Rule Lebanon 1993 max - Mar lastSun 0:00 1:00 S
+ Rule Lebanon 1993 1998 - Sep lastSun 0:00 0 -
+ Rule Lebanon 1999 max - Oct lastSun 0:00 0 -
++# This one-time rule, announced by the prime minister first for April 21
++# then for March 30, is commented out for reasons described above.
++#Rule Lebanon 2023 only - Mar 30 0:00 1:00 S
++
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+ Zone Asia/Beirut 2:22:00 - LMT 1880
+ 2:00 Lebanon EE%sT
+@@ -2977,7 +3015,7 @@ Zone Asia/Kathmandu 5:41:16 - LMT 1920
+ # 9pm and moving clocks forward by one hour for the next three months. ...."
+ #
+ # http://www.worldtimezone.com/dst_news/dst_news_pakistan01.html
+-# http://www.dailytimes.com.pk/default.asp?page=2008%5C05%5C15%5Cstory_15-5-2008_pg1_4
++# http://www.dailytimes.com.pk/default.asp?page=2008\05\15\story_15-5-2008_pg1_4
+
+ # From Arthur David Olson (2008-05-19):
+ # XXX--midnight transitions is a guess; 2008 only is a guess.
+@@ -3300,7 +3338,7 @@ Zone Asia/Karachi 4:28:12 - LMT 1907
+ # Some of many sources in Arabic:
+ # http://www.samanews.com/index.php?act=Show&id=122638
+ #
+-# http://safa.ps/details/news/74352/%D8%A8%D8%AF%D8%A1-%D8%A7%D9%84%D8%AA%D9%88%D9%82%D9%8A%D8%AA-%D8%A7%D9%84%D8%B5%D9%8A%D9%81%D9%8A-%D8%A8%D8%A7%D9%84%D8%B6%D9%81%D8%A9-%D9%88%D8%BA%D8%B2%D8%A9-%D9%84%D9%8A%D9%84%D8%A9-%D8%A7%D9%84%D8%AC%D9%85%D8%B9%D8%A9.html
++# http://safa.ps/details/news/74352/بدء-التوقيت-الصيفي-بالضفة-وغزة-ليلة-الجمعة.html
+ #
+ # Our brief summary:
+ # https://www.timeanddate.com/news/time/gaza-west-bank-dst-2012.html
+@@ -3310,7 +3348,7 @@ Zone Asia/Karachi 4:28:12 - LMT 1907
+ # time from midnight on Friday, March 29, 2013" (translated).
+ # [These are in Arabic and are for Gaza and for Ramallah, respectively.]
+ # http://www.samanews.com/index.php?act=Show&id=154120
+-# http://safa.ps/details/news/99844/%D8%B1%D8%A7%D9%85-%D8%A7%D9%84%D9%84%D9%87-%D8%A8%D8%AF%D8%A1-%D8%A7%D9%84%D8%AA%D9%88%D9%82%D9%8A%D8%AA-%D8%A7%D9%84%D8%B5%D9%8A%D9%81%D9%8A-29-%D8%A7%D9%84%D8%AC%D8%A7%D8%B1%D9%8A.html
++# http://safa.ps/details/news/99844/رام-الله-بدء-التوقيت-الصيفي-29-الجاري.html
+
+ # From Steffen Thorsen (2013-09-24):
+ # The Gaza and West Bank are ending DST Thursday at midnight
+@@ -3408,9 +3446,41 @@ Zone Asia/Karachi 4:28:12 - LMT 1907
+ # (2022-08-31): ... the Saturday before the last Sunday in March and October
+ # at 2:00 AM ,for the years from 2023 to 2026.
+ # (2022-09-05): https://mtit.pna.ps/Site/New/1453
+-#
+-# From Paul Eggert (2022-08-31):
+-# For now, assume that this rule will also be used after 2026.
++
++# From Heba Hamad (2023-03-22):
++# ... summer time will begin in Palestine from Saturday 04-29-2023,
++# 02:00 AM by 60 minutes forward.
++#
++# From Paul Eggert (2023-03-22):
++# For now, guess that spring and fall transitions will normally
++# continue to use 2022's rules, that during DST Palestine will switch
++# to standard time at 02:00 the last Saturday before Ramadan and back
++# to DST at 02:00 the first Saturday after Ramadan, and that
++# if the normal spring-forward or fall-back transition occurs during
++# Ramadan the former is delayed and the latter advanced.
++# To implement this, I predicted Ramadan-oriented transition dates for
++# 2023 through 2086 by running the following program under GNU Emacs 28.2,
++# with the results integrated by hand into the table below.
++# Predictions after 2086 are approximated without Ramadan.
++#
++# (let ((islamic-year 1444))
++# (require 'cal-islam)
++# (while (< islamic-year 1510)
++# (let ((a (calendar-islamic-to-absolute (list 9 1 islamic-year)))
++# (b (+ 1 (calendar-islamic-to-absolute (list 10 1 islamic-year))))
++# (saturday 6))
++# (while (/= saturday (mod (setq a (1- a)) 7)))
++# (while (/= saturday (mod b 7))
++# (setq b (1+ b)))
++# (setq a (calendar-gregorian-from-absolute a))
++# (setq b (calendar-gregorian-from-absolute b))
++# (insert
++# (format
++# (concat "Rule Palestine\t%d\tonly\t-\t%s\t%2d\t2:00\t0\t-\n"
++# "Rule Palestine\t%d\tonly\t-\t%s\t%2d\t2:00\t1:00\tS\n")
++# (car (cdr (cdr a))) (calendar-month-name (car a) t) (car (cdr a))
++# (car (cdr (cdr b))) (calendar-month-name (car b) t) (car (cdr b)))))
++# (setq islamic-year (+ 1 islamic-year))))
+
+ # Rule NAME FROM TO - IN ON AT SAVE LETTER/S
+ Rule EgyptAsia 1957 only - May 10 0:00 1:00 S
+@@ -3450,8 +3520,86 @@ Rule Palestine 2020 2021 - Mar Sat<=30 0:00 1:00 S
+ Rule Palestine 2020 only - Oct 24 1:00 0 -
+ Rule Palestine 2021 only - Oct 29 1:00 0 -
+ Rule Palestine 2022 only - Mar 27 0:00 1:00 S
+-Rule Palestine 2022 max - Oct Sat<=30 2:00 0 -
+-Rule Palestine 2023 max - Mar Sat<=30 2:00 1:00 S
++Rule Palestine 2022 2035 - Oct Sat<=30 2:00 0 -
++Rule Palestine 2023 only - Apr 29 2:00 1:00 S
++Rule Palestine 2024 only - Apr 13 2:00 1:00 S
++Rule Palestine 2025 only - Apr 5 2:00 1:00 S
++Rule Palestine 2026 2054 - Mar Sat<=30 2:00 1:00 S
++Rule Palestine 2036 only - Oct 18 2:00 0 -
++Rule Palestine 2037 only - Oct 10 2:00 0 -
++Rule Palestine 2038 only - Sep 25 2:00 0 -
++Rule Palestine 2039 only - Sep 17 2:00 0 -
++Rule Palestine 2039 only - Oct 22 2:00 1:00 S
++Rule Palestine 2039 2067 - Oct Sat<=30 2:00 0 -
++Rule Palestine 2040 only - Sep 1 2:00 0 -
++Rule Palestine 2040 only - Oct 13 2:00 1:00 S
++Rule Palestine 2041 only - Aug 24 2:00 0 -
++Rule Palestine 2041 only - Sep 28 2:00 1:00 S
++Rule Palestine 2042 only - Aug 16 2:00 0 -
++Rule Palestine 2042 only - Sep 20 2:00 1:00 S
++Rule Palestine 2043 only - Aug 1 2:00 0 -
++Rule Palestine 2043 only - Sep 12 2:00 1:00 S
++Rule Palestine 2044 only - Jul 23 2:00 0 -
++Rule Palestine 2044 only - Aug 27 2:00 1:00 S
++Rule Palestine 2045 only - Jul 15 2:00 0 -
++Rule Palestine 2045 only - Aug 19 2:00 1:00 S
++Rule Palestine 2046 only - Jun 30 2:00 0 -
++Rule Palestine 2046 only - Aug 11 2:00 1:00 S
++Rule Palestine 2047 only - Jun 22 2:00 0 -
++Rule Palestine 2047 only - Jul 27 2:00 1:00 S
++Rule Palestine 2048 only - Jun 6 2:00 0 -
++Rule Palestine 2048 only - Jul 18 2:00 1:00 S
++Rule Palestine 2049 only - May 29 2:00 0 -
++Rule Palestine 2049 only - Jul 3 2:00 1:00 S
++Rule Palestine 2050 only - May 21 2:00 0 -
++Rule Palestine 2050 only - Jun 25 2:00 1:00 S
++Rule Palestine 2051 only - May 6 2:00 0 -
++Rule Palestine 2051 only - Jun 17 2:00 1:00 S
++Rule Palestine 2052 only - Apr 27 2:00 0 -
++Rule Palestine 2052 only - Jun 1 2:00 1:00 S
++Rule Palestine 2053 only - Apr 12 2:00 0 -
++Rule Palestine 2053 only - May 24 2:00 1:00 S
++Rule Palestine 2054 only - Apr 4 2:00 0 -
++Rule Palestine 2054 only - May 16 2:00 1:00 S
++Rule Palestine 2055 only - May 1 2:00 1:00 S
++Rule Palestine 2056 only - Apr 22 2:00 1:00 S
++Rule Palestine 2057 only - Apr 7 2:00 1:00 S
++Rule Palestine 2058 max - Mar Sat<=30 2:00 1:00 S
++Rule Palestine 2068 only - Oct 20 2:00 0 -
++Rule Palestine 2069 only - Oct 12 2:00 0 -
++Rule Palestine 2070 only - Oct 4 2:00 0 -
++Rule Palestine 2071 only - Sep 19 2:00 0 -
++Rule Palestine 2072 only - Sep 10 2:00 0 -
++Rule Palestine 2072 only - Oct 15 2:00 1:00 S
++Rule Palestine 2073 only - Sep 2 2:00 0 -
++Rule Palestine 2073 only - Oct 7 2:00 1:00 S
++Rule Palestine 2074 only - Aug 18 2:00 0 -
++Rule Palestine 2074 only - Sep 29 2:00 1:00 S
++Rule Palestine 2075 only - Aug 10 2:00 0 -
++Rule Palestine 2075 only - Sep 14 2:00 1:00 S
++Rule Palestine 2075 max - Oct Sat<=30 2:00 0 -
++Rule Palestine 2076 only - Jul 25 2:00 0 -
++Rule Palestine 2076 only - Sep 5 2:00 1:00 S
++Rule Palestine 2077 only - Jul 17 2:00 0 -
++Rule Palestine 2077 only - Aug 28 2:00 1:00 S
++Rule Palestine 2078 only - Jul 9 2:00 0 -
++Rule Palestine 2078 only - Aug 13 2:00 1:00 S
++Rule Palestine 2079 only - Jun 24 2:00 0 -
++Rule Palestine 2079 only - Aug 5 2:00 1:00 S
++Rule Palestine 2080 only - Jun 15 2:00 0 -
++Rule Palestine 2080 only - Jul 20 2:00 1:00 S
++Rule Palestine 2081 only - Jun 7 2:00 0 -
++Rule Palestine 2081 only - Jul 12 2:00 1:00 S
++Rule Palestine 2082 only - May 23 2:00 0 -
++Rule Palestine 2082 only - Jul 4 2:00 1:00 S
++Rule Palestine 2083 only - May 15 2:00 0 -
++Rule Palestine 2083 only - Jun 19 2:00 1:00 S
++Rule Palestine 2084 only - Apr 29 2:00 0 -
++Rule Palestine 2084 only - Jun 10 2:00 1:00 S
++Rule Palestine 2085 only - Apr 21 2:00 0 -
++Rule Palestine 2085 only - Jun 2 2:00 1:00 S
++Rule Palestine 2086 only - Apr 13 2:00 0 -
++Rule Palestine 2086 only - May 18 2:00 1:00 S
+
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+ Zone Asia/Gaza 2:17:52 - LMT 1900 Oct
+@@ -3655,7 +3803,7 @@ Zone Asia/Singapore 6:55:25 - LMT 1901 Jan 1
+ # standard time is SLST.
+ #
+ # From Paul Eggert (2016-10-18):
+-# "SLST" seems to be reasonably recent and rarely-used outside time
++# "SLST" seems to be reasonably recent and rarely used outside time
+ # zone nerd sources. I searched Google News and found three uses of
+ # it in the International Business Times of India in February and
+ # March of this year when discussing cricket match times, but nothing
+diff --git a/make/data/tzdata/australasia b/make/data/tzdata/australasia
+index fbe3b8a6d72..893d7055eab 100644
+--- a/make/data/tzdata/australasia
++++ b/make/data/tzdata/australasia
+@@ -346,7 +346,7 @@ Zone Antarctica/Macquarie 0 - -00 1899 Nov
+
+ # From Steffen Thorsen (2013-01-10):
+ # Fiji will end DST on 2014-01-19 02:00:
+-# http://www.fiji.gov.fj/Media-Center/Press-Releases/DAYLIGHT-SAVINGS-TO-END-THIS-MONTH-%281%29.aspx
++# http://www.fiji.gov.fj/Media-Center/Press-Releases/DAYLIGHT-SAVINGS-TO-END-THIS-MONTH-(1).aspx
+
+ # From Ken Rylander (2014-10-20):
+ # DST will start Nov. 2 this year.
+@@ -746,7 +746,7 @@ Zone Pacific/Pago_Pago 12:37:12 - LMT 1892 Jul 5
+ #
+ # Samoa's Daylight Saving Time Act 2009 is available here, but does not
+ # contain any dates:
+-# http://www.parliament.gov.ws/documents/acts/Daylight%20Saving%20Act%20%202009%20%28English%29%20-%20Final%207-7-091.pdf
++# http://www.parliament.gov.ws/documents/acts/Daylight%20Saving%20Act%20%202009%20(English)%20-%20Final%207-7-091.pdf
+
+ # From Laupue Raymond Hughes (2010-10-07):
+ # Please see
+@@ -1831,7 +1831,7 @@ Zone Pacific/Efate 11:13:16 - LMT 1912 Jan 13 # Vila
+ # period. It would probably be reasonable to assume Guam use GMT+9 during
+ # that period of time like the surrounding area.
+
+-# From Paul Eggert (2018-11-18):
++# From Paul Eggert (2023-01-23):
+ # Howse writes (p 153) "The Spaniards, on the other hand, reached the
+ # Philippines and the Ladrones from America," and implies that the Ladrones
+ # (now called the Marianas) kept American date for quite some time.
+@@ -1844,7 +1844,7 @@ Zone Pacific/Efate 11:13:16 - LMT 1912 Jan 13 # Vila
+ # they did as that avoids the need for a separate zone due to our 1970 cutoff.
+ #
+ # US Public Law 106-564 (2000-12-23) made UT +10 the official standard time,
+-# under the name "Chamorro Standard Time". There is no official abbreviation,
++# under the name "Chamorro standard time". There is no official abbreviation,
+ # but Congressman Robert A. Underwood, author of the bill that became law,
+ # wrote in a press release (2000-12-27) that he will seek the use of "ChST".
+
+@@ -2222,24 +2222,18 @@ Zone Pacific/Efate 11:13:16 - LMT 1912 Jan 13 # Vila
+ # an international standard, there are some places on the high seas where the
+ # correct date is ambiguous.
+
+-# From Wikipedia (2005-08-31):
+-# Before 1920, all ships kept local apparent time on the high seas by setting
+-# their clocks at night or at the morning sight so that, given the ship's
+-# speed and direction, it would be 12 o'clock when the Sun crossed the ship's
+-# meridian (12 o'clock = local apparent noon). During 1917, at the
+-# Anglo-French Conference on Time-keeping at Sea, it was recommended that all
+-# ships, both military and civilian, should adopt hourly standard time zones
+-# on the high seas. Whenever a ship was within the territorial waters of any
+-# nation it would use that nation's standard time. The captain was permitted
+-# to change his ship's clocks at a time of his choice following his ship's
+-# entry into another zone time - he often chose midnight. These zones were
+-# adopted by all major fleets between 1920 and 1925 but not by many
+-# independent merchant ships until World War II.
+-
+-# From Paul Eggert, using references suggested by Oscar van Vlijmen
+-# (2005-03-20):
+-#
+-# The American Practical Navigator (2002)
+-# http://pollux.nss.nima.mil/pubs/pubs_j_apn_sections.html?rid=187
+-# talks only about the 180-degree meridian with respect to ships in
+-# international waters; it ignores the international date line.
++# From Wikipedia (2023-01-23):
++# The nautical time zone system is analogous to the terrestrial time zone
++# system for use on high seas. Under the system time changes are required for
++# changes of longitude in one-hour steps. The one-hour step corresponds to a
++# time zone width of 15° longitude. The 15° gore that is offset from GMT or
++# UT1 (not UTC) by twelve hours is bisected by the nautical date line into two
++# 7°30' gores that differ from GMT by ±12 hours. A nautical date line is
++# implied but not explicitly drawn on time zone maps. It follows the 180th
++# meridian except where it is interrupted by territorial waters adjacent to
++# land, forming gaps: it is a pole-to-pole dashed line.
++
++# From Paul Eggert (2023-01-23):
++# The American Practical Navigator ,
++# 2019 edition, merely says that the International Date Line
++# "coincides with the 180th meridian over most of its length."
+diff --git a/make/data/tzdata/backward b/make/data/tzdata/backward
+index fa44f655009..c0746d6dd1b 100644
+--- a/make/data/tzdata/backward
++++ b/make/data/tzdata/backward
+@@ -297,6 +297,7 @@ Link America/Argentina/Cordoba America/Rosario
+ Link America/Tijuana America/Santa_Isabel
+ Link America/Denver America/Shiprock
+ Link America/Toronto America/Thunder_Bay
++Link America/Edmonton America/Yellowknife
+ Link Pacific/Auckland Antarctica/South_Pole
+ Link Asia/Shanghai Asia/Chongqing
+ Link Asia/Shanghai Asia/Harbin
+diff --git a/make/data/tzdata/europe b/make/data/tzdata/europe
+index acc5da3ec79..446d2e1e658 100644
+--- a/make/data/tzdata/europe
++++ b/make/data/tzdata/europe
+@@ -540,9 +540,7 @@ Zone Europe/London -0:01:15 - LMT 1847 Dec 1
+ # other form with a traditional approximation for Irish timestamps
+ # after 1971-10-31 02:00 UTC; although this approximation has tm_isdst
+ # flags that are reversed, its UTC offsets are correct and this often
+-# suffices. This source file currently uses only nonnegative SAVE
+-# values, but this is intended to change and downstream code should
+-# not rely on it.
++# suffices....
+ #
+ # The following is like GB-Eire and EU, except with standard time in
+ # summer and negative daylight saving time in winter. It is for when
+@@ -1136,19 +1134,18 @@ Zone Atlantic/Faroe -0:27:04 - LMT 1908 Jan 11 # Tórshavn
+ #
+ # From Jürgen Appel (2022-11-25):
+ # https://ina.gl/samlinger/oversigt-over-samlinger/samling/dagsordener/dagsorden.aspx?lang=da&day=24-11-2022
+-# If I understand this correctly, from the next planned switch to
+-# summer time, Greenland will permanently stay at that time, i.e. no
+-# switch back to winter time in 2023 will occur.
+-#
+-# From Paul Eggert (2022-11-28):
+-# The official document in Danish
+-# https://naalakkersuisut.gl/-/media/naalakkersuisut/filer/kundgoerelser/2022/11/2511/31_da_inatsisartutlov-om-tidens-bestemmelse.pdf?la=da&hash=A33597D8A38CC7038465241119EF34F3
+-# says standard time for Greenland is -02, that Naalakkersuisut can lay down
+-# rules for DST and can require some areas to use a different time zone,
+-# and that this all takes effect 2023-03-25 22:00. The abovementioned
+-# "bekymringer" URL says the intent is no transition March 25, that
+-# Greenland will not go back to winter time in fall 2023, and that
+-# only America/Nuuk is affected (though further changes may occur).
++#
++# From Thomas M. Steenholdt (2022-12-02):
++# - The bill to move America/Nuuk from UTC-03 to UTC-02 passed.
++# - The bill to stop observing DST did not (Greenland will stop observing DST
++# when EU does).
++# Details on the implementation are here (section 6):
++# https://ina.gl/dvd/EM%202022/pdf/media/2553529/pkt17_em2022_tidens_bestemmelse_bem_da.pdf
++# This is how the change will be implemented:
++# 1. The shift *to* DST in 2023 happens as normal.
++# 2. The shift *from* DST in 2023 happens as normal, but coincides with the
++# shift to UTC-02 normaltime (people will not change their clocks here).
++# 3. After this, DST is still observed, but as -02/-01 instead of -03/-02.
+
+ # Rule NAME FROM TO - IN ON AT SAVE LETTER/S
+ Rule Thule 1991 1992 - Mar lastSun 2:00 1:00 D
+@@ -1172,8 +1169,8 @@ Zone America/Scoresbysund -1:27:52 - LMT 1916 Jul 28 # Ittoqqortoormiit
+ -1:00 EU -01/+00
+ Zone America/Nuuk -3:26:56 - LMT 1916 Jul 28 # Godthåb
+ -3:00 - -03 1980 Apr 6 2:00
+- -3:00 EU -03/-02 2023 Mar 25 22:00
+- -2:00 - -02
++ -3:00 EU -03/-02 2023 Oct 29 1:00u
++ -2:00 EU -02/-01
+ Zone America/Thule -4:35:08 - LMT 1916 Jul 28 # Pituffik
+ -4:00 Thule A%sT
+
+@@ -1509,9 +1506,9 @@ Zone Europe/Paris 0:09:21 - LMT 1891 Mar 16
+ Rule Germany 1946 only - Apr 14 2:00s 1:00 S
+ Rule Germany 1946 only - Oct 7 2:00s 0 -
+ Rule Germany 1947 1949 - Oct Sun>=1 2:00s 0 -
+-# http://www.ptb.de/de/org/4/44/441/salt.htm says the following transition
+-# occurred at 3:00 MEZ, not the 2:00 MEZ given in Shanks & Pottenger.
+-# Go with the PTB.
++# https://www.ptb.de/cms/en/ptb/fachabteilungen/abt4/fb-44/ag-441/realisation-of-legal-time-in-germany/dst-and-midsummer-dst-in-germany-until-1979.html
++# says the following transition occurred at 3:00 MEZ, not the 2:00 MEZ
++# given in Shanks & Pottenger. Go with the PTB.
+ Rule Germany 1947 only - Apr 6 3:00s 1:00 S
+ Rule Germany 1947 only - May 11 2:00s 2:00 M
+ Rule Germany 1947 only - Jun 29 3:00 1:00 S
+@@ -2272,7 +2269,7 @@ Zone Europe/Bucharest 1:44:24 - LMT 1891 Oct
+ # the State Duma has approved ... the draft bill on returning to
+ # winter time standard and return Russia 11 time zones. The new
+ # regulations will come into effect on October 26, 2014 at 02:00 ...
+-# http://asozd2.duma.gov.ru/main.nsf/%28Spravka%29?OpenAgent&RN=431985-6&02
++# http://asozd2.duma.gov.ru/main.nsf/(Spravka)?OpenAgent&RN=431985-6&02
+ # Here is a link where we put together table (based on approved Bill N
+ # 431985-6) with proposed 11 Russian time zones and corresponding
+ # areas/cities/administrative centers in the Russian Federation (in English):
+@@ -2682,13 +2679,13 @@ Zone Europe/Volgograd 2:57:40 - LMT 1920 Jan 3
+ 3:00 - +03 1930 Jun 21
+ 4:00 - +04 1961 Nov 11
+ 4:00 Russia +04/+05 1988 Mar 27 2:00s
+- 3:00 Russia +03/+04 1991 Mar 31 2:00s
++ 3:00 Russia MSK/MSD 1991 Mar 31 2:00s
+ 4:00 - +04 1992 Mar 29 2:00s
+- 3:00 Russia +03/+04 2011 Mar 27 2:00s
+- 4:00 - +04 2014 Oct 26 2:00s
+- 3:00 - +03 2018 Oct 28 2:00s
++ 3:00 Russia MSK/MSD 2011 Mar 27 2:00s
++ 4:00 - MSK 2014 Oct 26 2:00s
++ 3:00 - MSK 2018 Oct 28 2:00s
+ 4:00 - +04 2020 Dec 27 2:00s
+- 3:00 - +03
++ 3:00 - MSK
+
+ # From Paul Eggert (2016-11-11):
+ # Europe/Saratov covers:
+@@ -2719,11 +2716,11 @@ Zone Europe/Saratov 3:04:18 - LMT 1919 Jul 1 0:00u
+ Zone Europe/Kirov 3:18:48 - LMT 1919 Jul 1 0:00u
+ 3:00 - +03 1930 Jun 21
+ 4:00 Russia +04/+05 1989 Mar 26 2:00s
+- 3:00 Russia +03/+04 1991 Mar 31 2:00s
++ 3:00 Russia MSK/MSD 1991 Mar 31 2:00s
+ 4:00 - +04 1992 Mar 29 2:00s
+- 3:00 Russia +03/+04 2011 Mar 27 2:00s
+- 4:00 - +04 2014 Oct 26 2:00s
+- 3:00 - +03
++ 3:00 Russia MSK/MSD 2011 Mar 27 2:00s
++ 4:00 - MSK 2014 Oct 26 2:00s
++ 3:00 - MSK
+
+ # From Tim Parenti (2014-07-03), per Oscar van Vlijmen (2001-08-25):
+ # Europe/Samara covers...
+diff --git a/make/data/tzdata/iso3166.tab b/make/data/tzdata/iso3166.tab
+index fbfb74bec45..cea17732dd1 100644
+--- a/make/data/tzdata/iso3166.tab
++++ b/make/data/tzdata/iso3166.tab
+@@ -261,7 +261,7 @@ SY Syria
+ SZ Eswatini (Swaziland)
+ TC Turks & Caicos Is
+ TD Chad
+-TF French Southern Territories
++TF French S. Terr.
+ TG Togo
+ TH Thailand
+ TJ Tajikistan
+diff --git a/make/data/tzdata/leapseconds b/make/data/tzdata/leapseconds
+index d6fb840f512..89ce8b89cd2 100644
+--- a/make/data/tzdata/leapseconds
++++ b/make/data/tzdata/leapseconds
+@@ -95,11 +95,11 @@ Leap 2016 Dec 31 23:59:60 + S
+ # Any additional leap seconds will come after this.
+ # This Expires line is commented out for now,
+ # so that pre-2020a zic implementations do not reject this file.
+-#Expires 2023 Jun 28 00:00:00
++#Expires 2023 Dec 28 00:00:00
+
+ # POSIX timestamps for the data in this file:
+ #updated 1467936000 (2016-07-08 00:00:00 UTC)
+-#expires 1687910400 (2023-06-28 00:00:00 UTC)
++#expires 1703721600 (2023-12-28 00:00:00 UTC)
+
+-# Updated through IERS Bulletin C64
+-# File expires on: 28 June 2023
++# Updated through IERS Bulletin C65
++# File expires on: 28 December 2023
+diff --git a/make/data/tzdata/northamerica b/make/data/tzdata/northamerica
+index a5fd701f88c..e240cf35103 100644
+--- a/make/data/tzdata/northamerica
++++ b/make/data/tzdata/northamerica
+@@ -1,4 +1,3 @@
+-#
+ # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ #
+ # This code is free software; you can redistribute it and/or modify it
+@@ -299,9 +298,10 @@ Zone PST8PDT -8:00 US P%sT
+ # -10 Standard Alaska Time (AST) Alaska-Hawaii standard time (AHST)
+ # -11 (unofficial) Nome (NST) Bering standard time (BST)
+ #
+-# From Paul Eggert (2000-01-08), following a heads-up from Rives McDow:
+-# Public law 106-564 (2000-12-23) introduced ... "Chamorro Standard Time"
++# From Paul Eggert (2023-01-23), from a 2001-01-08 heads-up from Rives McDow:
++# Public law 106-564 (2000-12-23) introduced "Chamorro standard time"
+ # for time in Guam and the Northern Marianas. See the file "australasia".
++# Also see 15 U.S.C. §263 .
+ #
+ # From Paul Eggert (2015-04-17):
+ # HST and HDT are standardized abbreviations for Hawaii-Aleutian
+@@ -618,7 +618,7 @@ Zone America/Los_Angeles -7:52:58 - LMT 1883 Nov 18 20:00u
+ # local times of other Alaskan locations so that they change simultaneously.
+
+ # From Paul Eggert (2014-07-18):
+-# One opinion of the early-1980s turmoil in Alaska over time zones and
++# One opinion of the early 1980s turmoil in Alaska over time zones and
+ # daylight saving time appeared as graffiti on a Juneau airport wall:
+ # "Welcome to Juneau. Please turn your watch back to the 19th century."
+ # See: Turner W. Alaska's four time zones now two. NY Times 1983-11-01.
+@@ -690,6 +690,10 @@ Zone America/Los_Angeles -7:52:58 - LMT 1883 Nov 18 20:00u
+ # So they won't be waiting for Alaska to join them on 2019-03-10, but will
+ # rather change their clocks twice in seven weeks.
+
++# From Paul Eggert (2023-01-23):
++# America/Adak is for the Aleutian Islands that are part of Alaska
++# and are west of 169.5° W.
++
+ # Zone NAME STDOFF RULES FORMAT [UNTIL]
+ Zone America/Juneau 15:02:19 - LMT 1867 Oct 19 15:33:32
+ -8:57:41 - LMT 1900 Aug 20 12:00
+@@ -2148,10 +2152,6 @@ Zone America/Fort_Nelson -8:10:47 - LMT 1884
+ # Nunavut ... moved ... to incorporate the whole territory into one time zone.
+ # Nunavut moves to single time zone Oct. 31
+ # http://www.nunatsiaq.com/nunavut/nvt90903_13.html
+-#
+-# From Antoine Leca (1999-09-06):
+-# We then need to create a new timezone for the Kitikmeot region of Nunavut
+-# to differentiate it from the Yellowknife region.
+
+ # From Paul Eggert (1999-09-20):
+ # Basic Facts: The New Territory
+@@ -2345,9 +2345,6 @@ Zone America/Cambridge_Bay 0 - -00 1920 # trading post est.?
+ -5:00 - EST 2000 Nov 5 0:00
+ -6:00 - CST 2001 Apr 1 3:00
+ -7:00 Canada M%sT
+-Zone America/Yellowknife 0 - -00 1935 # Yellowknife founded?
+- -7:00 NT_YK M%sT 1980
+- -7:00 Canada M%sT
+ Zone America/Inuvik 0 - -00 1953 # Inuvik founded
+ -8:00 NT_YK P%sT 1979 Apr lastSun 2:00
+ -7:00 NT_YK M%sT 1980
+@@ -2584,7 +2581,7 @@ Zone America/Dawson -9:17:40 - LMT 1900 Aug 20
+ # and in addition changes all of Chihuahua to -06 with no DST.
+
+ # From Heitor David Pinto (2022-11-28):
+-# Now the northern municipalities want to have the same time zone as the
++# Now the northern [municipios] want to have the same time zone as the
+ # respective neighboring cities in the US, for example Juárez in UTC-7 with
+ # DST, matching El Paso, and Ojinaga in UTC-6 with DST, matching Presidio....
+ # the president authorized the publication of the decree for November 29,
+@@ -2621,7 +2618,7 @@ Zone America/Merida -5:58:28 - LMT 1922 Jan 1 6:00u
+ -5:00 - EST 1982 Dec 2
+ -6:00 Mexico C%sT
+ # Coahuila, Nuevo León, Tamaulipas (near US border)
+-# This includes the following municipalities:
++# This includes the following municipios:
+ # in Coahuila: Acuña, Allende, Guerrero, Hidalgo, Jiménez, Morelos, Nava,
+ # Ocampo, Piedras Negras, Villa Unión, Zaragoza
+ # in Nuevo León: Anáhuac
+@@ -2647,8 +2644,8 @@ Zone America/Mexico_City -6:36:36 - LMT 1922 Jan 1 7:00u
+ -6:00 - CST 2002 Feb 20
+ -6:00 Mexico C%sT
+ # Chihuahua (near US border - western side)
+-# This includes the municipalities of Janos, Ascensión, Juárez, Guadalupe,
+-# and Práxedis G Guerrero.
++# This includes the municipios of Janos, Ascensión, Juárez, Guadalupe, and
++# Práxedis G Guerrero.
+ # http://gaceta.diputados.gob.mx/PDF/65/2a022/nov/20221124-VII.pdf
+ Zone America/Ciudad_Juarez -7:05:56 - LMT 1922 Jan 1 7:00u
+ -7:00 - MST 1927 Jun 10 23:00
+@@ -2662,7 +2659,8 @@ Zone America/Ciudad_Juarez -7:05:56 - LMT 1922 Jan 1 7:00u
+ -6:00 - CST 2022 Nov 30 0:00
+ -7:00 US M%sT
+ # Chihuahua (near US border - eastern side)
+-# The municipalities of Coyame del Sotol, Ojinaga, and Manuel Benavides.
++# This includes the municipios of Coyame del Sotol, Ojinaga, and Manuel
++# Benavides.
+ # http://gaceta.diputados.gob.mx/PDF/65/2a022/nov/20221124-VII.pdf
+ Zone America/Ojinaga -6:57:40 - LMT 1922 Jan 1 7:00u
+ -7:00 - MST 1927 Jun 10 23:00
+@@ -3083,7 +3081,7 @@ Zone America/Costa_Rica -5:36:13 - LMT 1890 # San José
+ #
+ # He supplied these references:
+ #
+-# http://www.prensalatina.com.mx/article.asp?ID=%7B4CC32C1B-A9F7-42FB-8A07-8631AFC923AF%7D&language=ES
++# http://www.prensalatina.com.mx/article.asp?ID={4CC32C1B-A9F7-42FB-8A07-8631AFC923AF}&language=ES
+ # http://actualidad.terra.es/sociedad/articulo/cuba_llama_ahorrar_energia_cambio_1957044.htm
+ #
+ # From Alex Krivenyshev (2007-10-25):
+diff --git a/make/data/tzdata/southamerica b/make/data/tzdata/southamerica
+index 81fdd793df4..4024e7180cd 100644
+--- a/make/data/tzdata/southamerica
++++ b/make/data/tzdata/southamerica
+@@ -231,7 +231,7 @@ Rule Arg 2008 only - Oct Sun>=15 0:00 1:00 -
+ # Hora de verano para la República Argentina
+ # http://buenasiembra.com.ar/esoterismo/astrologia/hora-de-verano-de-la-republica-argentina-27.html
+ # says that standard time in Argentina from 1894-10-31
+-# to 1920-05-01 was -4:16:48.25. Go with this more-precise value
++# to 1920-05-01 was -4:16:48.25. Go with this more precise value
+ # over Shanks & Pottenger. It is upward compatible with Milne, who
+ # says Córdoba time was -4:16:48.2.
+
+diff --git a/make/data/tzdata/zone.tab b/make/data/tzdata/zone.tab
+index 939432d3456..3edb0d61c80 100644
+--- a/make/data/tzdata/zone.tab
++++ b/make/data/tzdata/zone.tab
+@@ -144,9 +144,8 @@ CA +744144-0944945 America/Resolute Central - NU (Resolute)
+ CA +624900-0920459 America/Rankin_Inlet Central - NU (central)
+ CA +5024-10439 America/Regina CST - SK (most areas)
+ CA +5017-10750 America/Swift_Current CST - SK (midwest)
+-CA +5333-11328 America/Edmonton Mountain - AB; BC (E); SK (W)
++CA +5333-11328 America/Edmonton Mountain - AB; BC (E); NT (E); SK (W)
+ CA +690650-1050310 America/Cambridge_Bay Mountain - NU (west)
+-CA +6227-11421 America/Yellowknife Mountain - NT (central)
+ CA +682059-1334300 America/Inuvik Mountain - NT (west)
+ CA +4906-11631 America/Creston MST - BC (Creston)
+ CA +5546-12014 America/Dawson_Creek MST - BC (Dawson Cr, Ft St John)
+@@ -162,7 +161,7 @@ CG -0416+01517 Africa/Brazzaville
+ CH +4723+00832 Europe/Zurich
+ CI +0519-00402 Africa/Abidjan
+ CK -2114-15946 Pacific/Rarotonga
+-CL -3327-07040 America/Santiago Chile (most areas)
++CL -3327-07040 America/Santiago most of Chile
+ CL -5309-07055 America/Punta_Arenas Region of Magallanes
+ CL -2709-10926 Pacific/Easter Easter Island
+ CM +0403+00942 Africa/Douala
+@@ -174,10 +173,10 @@ CU +2308-08222 America/Havana
+ CV +1455-02331 Atlantic/Cape_Verde
+ CW +1211-06900 America/Curacao
+ CX -1025+10543 Indian/Christmas
+-CY +3510+03322 Asia/Nicosia Cyprus (most areas)
++CY +3510+03322 Asia/Nicosia most of Cyprus
+ CY +3507+03357 Asia/Famagusta Northern Cyprus
+ CZ +5005+01426 Europe/Prague
+-DE +5230+01322 Europe/Berlin Germany (most areas)
++DE +5230+01322 Europe/Berlin most of Germany
+ DE +4742+00841 Europe/Busingen Busingen
+ DJ +1136+04309 Africa/Djibouti
+ DK +5540+01235 Europe/Copenhagen
+@@ -210,7 +209,7 @@ GF +0456-05220 America/Cayenne
+ GG +492717-0023210 Europe/Guernsey
+ GH +0533-00013 Africa/Accra
+ GI +3608-00521 Europe/Gibraltar
+-GL +6411-05144 America/Nuuk Greenland (most areas)
++GL +6411-05144 America/Nuuk most of Greenland
+ GL +7646-01840 America/Danmarkshavn National Park (east coast)
+ GL +7029-02158 America/Scoresbysund Scoresbysund/Ittoqqortoormiit
+ GL +7634-06847 America/Thule Thule/Pituffik
+@@ -258,7 +257,7 @@ KP +3901+12545 Asia/Pyongyang
+ KR +3733+12658 Asia/Seoul
+ KW +2920+04759 Asia/Kuwait
+ KY +1918-08123 America/Cayman
+-KZ +4315+07657 Asia/Almaty Kazakhstan (most areas)
++KZ +4315+07657 Asia/Almaty most of Kazakhstan
+ KZ +4448+06528 Asia/Qyzylorda Qyzylorda/Kyzylorda/Kzyl-Orda
+ KZ +5312+06337 Asia/Qostanay Qostanay/Kostanay/Kustanay
+ KZ +5017+05710 Asia/Aqtobe Aqtobe/Aktobe
+@@ -282,12 +281,12 @@ MD +4700+02850 Europe/Chisinau
+ ME +4226+01916 Europe/Podgorica
+ MF +1804-06305 America/Marigot
+ MG -1855+04731 Indian/Antananarivo
+-MH +0709+17112 Pacific/Majuro Marshall Islands (most areas)
++MH +0709+17112 Pacific/Majuro most of Marshall Islands
+ MH +0905+16720 Pacific/Kwajalein Kwajalein
+ MK +4159+02126 Europe/Skopje
+ ML +1239-00800 Africa/Bamako
+ MM +1647+09610 Asia/Yangon
+-MN +4755+10653 Asia/Ulaanbaatar Mongolia (most areas)
++MN +4755+10653 Asia/Ulaanbaatar most of Mongolia
+ MN +4801+09139 Asia/Hovd Bayan-Olgiy, Govi-Altai, Hovd, Uvs, Zavkhan
+ MN +4804+11430 Asia/Choibalsan Dornod, Sukhbaatar
+ MO +221150+1133230 Asia/Macau
+@@ -325,7 +324,7 @@ NO +5955+01045 Europe/Oslo
+ NP +2743+08519 Asia/Kathmandu
+ NR -0031+16655 Pacific/Nauru
+ NU -1901-16955 Pacific/Niue
+-NZ -3652+17446 Pacific/Auckland New Zealand (most areas)
++NZ -3652+17446 Pacific/Auckland most of New Zealand
+ NZ -4357-17633 Pacific/Chatham Chatham Islands
+ OM +2336+05835 Asia/Muscat
+ PA +0858-07932 America/Panama
+@@ -333,7 +332,7 @@ PE -1203-07703 America/Lima
+ PF -1732-14934 Pacific/Tahiti Society Islands
+ PF -0900-13930 Pacific/Marquesas Marquesas Islands
+ PF -2308-13457 Pacific/Gambier Gambier Islands
+-PG -0930+14710 Pacific/Port_Moresby Papua New Guinea (most areas)
++PG -0930+14710 Pacific/Port_Moresby most of Papua New Guinea
+ PG -0613+15534 Pacific/Bougainville Bougainville
+ PH +1435+12100 Asia/Manila
+ PK +2452+06703 Asia/Karachi
+@@ -379,7 +378,7 @@ RU +4310+13156 Asia/Vladivostok MSK+07 - Amur River
+ RU +643337+1431336 Asia/Ust-Nera MSK+07 - Oymyakonsky
+ RU +5934+15048 Asia/Magadan MSK+08 - Magadan
+ RU +4658+14242 Asia/Sakhalin MSK+08 - Sakhalin Island
+-RU +6728+15343 Asia/Srednekolymsk MSK+08 - Sakha (E); North Kuril Is
++RU +6728+15343 Asia/Srednekolymsk MSK+08 - Sakha (E); N Kuril Is
+ RU +5301+15839 Asia/Kamchatka MSK+09 - Kamchatka
+ RU +6445+17729 Asia/Anadyr MSK+09 - Bering Sea
+ RW -0157+03004 Africa/Kigali
+@@ -420,7 +419,7 @@ TT +1039-06131 America/Port_of_Spain
+ TV -0831+17913 Pacific/Funafuti
+ TW +2503+12130 Asia/Taipei
+ TZ -0648+03917 Africa/Dar_es_Salaam
+-UA +5026+03031 Europe/Kyiv Ukraine (most areas)
++UA +5026+03031 Europe/Kyiv most of Ukraine
+ UG +0019+03225 Africa/Kampala
+ UM +2813-17722 Pacific/Midway Midway Islands
+ UM +1917+16637 Pacific/Wake Wake Island
+@@ -443,7 +442,7 @@ US +465042-1012439 America/North_Dakota/New_Salem Central - ND (Morton rural)
+ US +471551-1014640 America/North_Dakota/Beulah Central - ND (Mercer)
+ US +394421-1045903 America/Denver Mountain (most areas)
+ US +433649-1161209 America/Boise Mountain - ID (south); OR (east)
+-US +332654-1120424 America/Phoenix MST - Arizona (except Navajo)
++US +332654-1120424 America/Phoenix MST - AZ (except Navajo)
+ US +340308-1181434 America/Los_Angeles Pacific
+ US +611305-1495401 America/Anchorage Alaska (most areas)
+ US +581807-1342511 America/Juneau Alaska - Juneau area
+@@ -451,7 +450,7 @@ US +571035-1351807 America/Sitka Alaska - Sitka area
+ US +550737-1313435 America/Metlakatla Alaska - Annette Island
+ US +593249-1394338 America/Yakutat Alaska - Yakutat
+ US +643004-1652423 America/Nome Alaska (west)
+-US +515248-1763929 America/Adak Aleutian Islands
++US +515248-1763929 America/Adak Alaska - western Aleutians
+ US +211825-1575130 Pacific/Honolulu Hawaii
+ UY -345433-0561245 America/Montevideo
+ UZ +3940+06648 Asia/Samarkand Uzbekistan (west)
+diff --git a/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java b/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java
+index ef278203182..3762eb820bb 100644
+--- a/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java
++++ b/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java
+@@ -608,6 +608,17 @@ public final class ZoneInfoFile {
+ params[8] = endRule.secondOfDay * 1000;
+ params[9] = toSTZTime[endRule.timeDefinition];
+ dstSavings = (startRule.offsetAfter - startRule.offsetBefore) * 1000;
++
++ // Note: known mismatching -> Africa/Cairo
++ // ZoneInfo : startDayOfWeek=5 <= Thursday
++ // startTime=86400000 <= 24:00
++ // This: startDayOfWeek=6 <= Friday
++ // startTime=0 <= 0:00
++ if (zoneId.equals("Africa/Cairo") &&
++ params[7] == Calendar.FRIDAY && params[8] == 0) {
++ params[7] = Calendar.THURSDAY;
++ params[8] = SECONDS_PER_DAY * 1000;
++ }
+ } else if (nTrans > 0) { // only do this if there is something in table already
+ if (lastyear < LASTYEAR) {
+ // ZoneInfo has an ending entry for 2037
+diff --git a/src/java.base/share/classes/sun/util/resources/TimeZoneNames.java b/src/java.base/share/classes/sun/util/resources/TimeZoneNames.java
+index bf7918659ae..2763ac30ca7 100644
+--- a/src/java.base/share/classes/sun/util/resources/TimeZoneNames.java
++++ b/src/java.base/share/classes/sun/util/resources/TimeZoneNames.java
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 1996, 2022, Oracle and/or its affiliates. All rights reserved.
++ * Copyright (c) 1996, 2023, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+@@ -845,9 +845,7 @@ public final class TimeZoneNames extends TimeZoneNamesBundle {
+ {"Europe/Jersey", GMTBST},
+ {"Europe/Kaliningrad", EET},
+ {"Europe/Kiev", EET},
+- {"Europe/Kirov", new String[] {"Kirov Standard Time", "GMT+03:00",
+- "Kirov Daylight Time", "GMT+03:00",
+- "Kirov Time", "GMT+03:00"}},
++ {"Europe/Kirov", MSK},
+ {"Europe/Lisbon", WET},
+ {"Europe/Ljubljana", CET},
+ {"Europe/London", GMTBST},
+diff --git a/test/jdk/java/util/TimeZone/TimeZoneData/VERSION b/test/jdk/java/util/TimeZone/TimeZoneData/VERSION
+index 0f66ee12c94..c5483b48512 100644
+--- a/test/jdk/java/util/TimeZone/TimeZoneData/VERSION
++++ b/test/jdk/java/util/TimeZone/TimeZoneData/VERSION
+@@ -1 +1 @@
+-tzdata2022g
++tzdata2023c
+diff --git a/test/jdk/java/util/TimeZone/TimeZoneData/aliases.txt b/test/jdk/java/util/TimeZone/TimeZoneData/aliases.txt
+index d495743b268..07c5edbafee 100644
+--- a/test/jdk/java/util/TimeZone/TimeZoneData/aliases.txt
++++ b/test/jdk/java/util/TimeZone/TimeZoneData/aliases.txt
+@@ -211,6 +211,7 @@ Link America/Argentina/Cordoba America/Rosario
+ Link America/Tijuana America/Santa_Isabel
+ Link America/Denver America/Shiprock
+ Link America/Toronto America/Thunder_Bay
++Link America/Edmonton America/Yellowknife
+ Link Pacific/Auckland Antarctica/South_Pole
+ Link Asia/Shanghai Asia/Chongqing
+ Link Asia/Shanghai Asia/Harbin
+diff --git a/test/jdk/java/util/TimeZone/TimeZoneData/displaynames.txt b/test/jdk/java/util/TimeZone/TimeZoneData/displaynames.txt
+index 44db4dbdb81..03f5305e65e 100644
+--- a/test/jdk/java/util/TimeZone/TimeZoneData/displaynames.txt
++++ b/test/jdk/java/util/TimeZone/TimeZoneData/displaynames.txt
+@@ -92,7 +92,6 @@ America/Vancouver PST PDT
+ America/Whitehorse MST
+ America/Winnipeg CST CDT
+ America/Yakutat AKST AKDT
+-America/Yellowknife MST MDT
+ Antarctica/Macquarie AEST AEDT
+ Asia/Beirut EET EEST
+ Asia/Famagusta EET EEST
+@@ -144,6 +143,7 @@ Europe/Dublin IST/GMT IST/GMT
+ Europe/Gibraltar CET CEST
+ Europe/Helsinki EET EEST
+ Europe/Kaliningrad EET
++Europe/Kirov MSK
+ Europe/Kyiv EET EEST
+ Europe/Lisbon WET WEST
+ Europe/London GMT/BST GMT/BST
+@@ -160,6 +160,7 @@ Europe/Tallinn EET EEST
+ Europe/Tirane CET CEST
+ Europe/Vienna CET CEST
+ Europe/Vilnius EET EEST
++Europe/Volgograd MSK
+ Europe/Warsaw CET CEST
+ Europe/Zurich CET CEST
+ HST HST
+diff --git a/test/jdk/java/util/TimeZone/TimeZoneTest.java b/test/jdk/java/util/TimeZone/TimeZoneTest.java
+index d31d1722b7b..8e5d403f87b 100644
+--- a/test/jdk/java/util/TimeZone/TimeZoneTest.java
++++ b/test/jdk/java/util/TimeZone/TimeZoneTest.java
+@@ -1,5 +1,5 @@
+ /*
+- * Copyright (c) 1997, 2021, Oracle and/or its affiliates. All rights reserved.
++ * Copyright (c) 1997, 2023, Oracle and/or its affiliates. All rights reserved.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+@@ -25,7 +25,7 @@
+ * @test
+ * @bug 4028006 4044013 4096694 4107276 4107570 4112869 4130885 7039469 7126465 7158483
+ * 8008577 8077685 8098547 8133321 8138716 8148446 8151876 8159684 8166875 8181157
+- * 8228469 8274407
++ * 8228469 8274407 8305113
+ * @modules java.base/sun.util.resources
+ * @library /java/text/testlib
+ * @summary test TimeZone
+@@ -121,7 +121,7 @@ public class TimeZoneTest extends IntlTest
+ new ZoneDescriptor("GMT", 0, false),
+ new ZoneDescriptor("UTC", 0, false),
+ new ZoneDescriptor("ECT", 60, true),
+- new ZoneDescriptor("ART", 120, false),
++ new ZoneDescriptor("ART", 120, true),
+ new ZoneDescriptor("EET", 120, true),
+ new ZoneDescriptor("EAT", 180, false),
+ new ZoneDescriptor("MET", 60, true),
diff --git a/sources b/sources
index 819e508..0c8cba6 100644
--- a/sources
+++ b/sources
@@ -1,32 +1,2 @@
SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
-SHA512 (openjdk-jdk17u-jdk-17.0.6+10.tar.xz) = 2878aae52e2f49146b9631e3b0379370dce1a0a620dc5c5b763d1432b82e705e3aa33a83008391b4845bf0cb493b08179e7ac3419f597fb80fd65df393e12cf1
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.docs.el.aarch64.tar.xz) = d3e8b4c8cb8197b7a9023235f10ef142a5f865de1e05c43ebae9b20e3f38836c9d098317315c2ef465bacf3248d4953cd2ef84b7fccf808a4c8904999cd8d289
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.docs.el.ppc64le.tar.xz) = 80bf8db3245dd4f075b58da2f80df774c89988cf88da288b56e9118c9c759ec41c377341fad9d03672fad657ca02d04859e78e021d42b654f0c4690c1905bab5
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.docs.el.s390x.tar.xz) = 6753fb7288a737eacb41206c2de09ed673e2f852b23b6ded3d6ded78ec37a84719385087ea64712c7c3be9c6c1c2c9dffafb3dae0f5cd9e998febc39657c0537
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.docs.el.x86_64.tar.xz) = 423c964d0f351bbfc06fbcc7f3eba87d763b147a984b1e5fc54ee357a1b71bf0e2a67a446d7fc3596f054b5aaecc3b0a1e043a06a4dcb29598221c2d83e16613
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.fastdebug.jdk.el.aarch64.tar.xz) = e0062a9ed4dfc99c5f309cd33911b98988093e9afd287538c95ad0146b2cd74edf6b537b0f57db7d6b86e4cb0b0075975285736b217e0de1dee4c51a32614f31
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.fastdebug.jdk.el.ppc64le.tar.xz) = 170d5d3e2af07c2e2a2cf897a0ea215d4be146d501d9bc0ba91b0b369aebdc342c721a02417fb7f81d43b3bd684c82e9c6858407729cb5420a5a212fd68350ab
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.fastdebug.jdk.el.x86_64.tar.xz) = e1d360b26640a343b7f28e3ad665e17cd233ea4c34dedefa481b2d589a3b3a824d2c29529dfb0515f56aaa3d932924bbe6087e3f4f52ae37d6c8bcfac3c8475a
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.fastdebug.static-libs.el.aarch64.tar.xz) = 1eba570b6d1b2339b964e9019f95f7313731e75742b31d8c279a90ea9b59ab0d15f2001356164f1c88f231841bdfdd78b7db4193b4eeab4f09f16bee42fe0bbc
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.fastdebug.static-libs.el.ppc64le.tar.xz) = c2cc1e85756a8e1fd226177452ffff4d0e031a8dfc553d31defd95cb69b2041a991ea28d18d8ffb456f03069c774e78ca84bc7a2954ec6a2e3be601fc32e0e65
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.fastdebug.static-libs.el.x86_64.tar.xz) = ae0f202c18a80a41e2a9d5e44cf12f4026a7864018adbeeb0cff38f882fa2cee62ce568fef77100aed3bcd545193248efac8c2065a4cbe7c43e78f6030918b6f
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.misc.el.aarch64.tar.xz) = 91433ef5f1e8b11c8cd8a55b2eceb724d32f7781190a1404c0e637323e62fc6ed8af140e3d2bde4483fc3f92055d92d6d06bbee76136f22c041c35096ad1d19d
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.misc.el.ppc64le.tar.xz) = dca4fdac80f12f2bbf2ebdf13a1dceca42d8b2c401a32665c15667e447d5b2493cb41c16cf9cac2d4919b8fd35e5546803f2d1ec51599b010a82c16d1ef9c185
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.misc.el.s390x.tar.xz) = b9e7ac0ae220cb6fd04dc83adff6158bc3beea289ddd10109a1b8640379d367333a65ab6097339b8f988a9cdee369eb41ce5a41cde579b17f0f4d39118fbff84
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.misc.el.x86_64.tar.xz) = 1cbd58b6aa4c9c19d1f6e987af1092285c43e4c56202519dd4b75a4ff4d68cd07633ba09e22e7d2a62e91ceb0e3629a4878de943cf7a90ed01c74749bff597d5
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.slowdebug.jdk.el.aarch64.tar.xz) = 6e9d71bfcd5499b18e8503213201b4a918d3c3cbfb32f9d6e67f5a9b0de8ee9df349617ecd8935a38080eae59f2230d1b78dbd91135fba8b65e620da3e1538cf
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.slowdebug.jdk.el.ppc64le.tar.xz) = f5fb6a3bba17d36a4dcdc9a91916f4d0dde5a232e0f3c80297c45ff741efd8978bc96f661513ac9518b6e1d21607e5f751807d5803b998be2a68b5f0ee6b83f3
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.slowdebug.jdk.el.s390x.tar.xz) = 7d564c48a0299ac61c8cfa09b579c81a46ca0373ecf62dd6ae86268632e5672c9fa5e6f4ee5a6ff2e8d8b6fa75a7ba7e7203a432a6a34d2a10f2238395e12c40
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.slowdebug.jdk.el.x86_64.tar.xz) = 29e7d7c9a7a57bfe5bd0397adf8a70e466e8a6dc8dd7045851331990d496d4e8ba6ca0b633dd7add4aa29c1c60e01391461dc37ed787dd4f64a20445c83529c9
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.slowdebug.static-libs.el.aarch64.tar.xz) = ce658bc5b3a3503b7548f02ce8b3fef21ca819dc345a69e4551242a6310fdd858ebe54dd25ed8336bdbfc4ffc408f83a1630ffbd61da006cc71d53602d4181b2
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.slowdebug.static-libs.el.ppc64le.tar.xz) = 5f16ead60b099f8bdad44c187406107ff8767aca8d4172919883017b22dd454c44d3e70c339c1d6439d9e8f39f1a040f87ee5ea56dfb13b89638a7f02648bbbc
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.slowdebug.static-libs.el.s390x.tar.xz) = a1308681c47f32b63b896611989acc3f1230a3ad161b618cc1af0524e0990d95b6d851df1d5a93d8cb20dc27ca1aad374bba60198530e2f65045f443bc44ccc9
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.slowdebug.static-libs.el.x86_64.tar.xz) = 9e481ca7367dc6bf25b85c6d68f6a3ea1a684d4d80e1535fa59ab0adebd6f13f12c95fc2f08a039ed2ec1bac749255ca033ca290e7fc553cc93da496768f7419
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.static-libs.el.aarch64.tar.xz) = 3d57209da953e084c7633c13fe6ec6f808f13486648b054e344a6dd1aadac5025c9c95275b01b3fb83539cb86a36cd8845a38758d70749596e237ced492a9b63
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.static-libs.el.ppc64le.tar.xz) = eaf9d01e19852d75bf99fc6b9b60499285405a6b328dd2ca9d080f1cf28da59e925bec802c248544415e3f1f023f64148a95faece98318d0e2e59c7425f3f033
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.static-libs.el.s390x.tar.xz) = 6d57b3fad5fd2015050c441cca5bd1c47c1ffed4e15842386c302936c123690f95293c7ef01cf17b588b0520e939fb362ac3781f9ae9d7194add6172ab1bd423
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.static-libs.el.x86_64.tar.xz) = 7cf2b2645310f6d61fd38c1d8400a97e9f5ce118c607d455f97e897c903828d01711aedcede3ece052da52ceae39fe93e9897f4d4f315a5de7c1c0b505e4144b
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.unstripped.jdk.el.aarch64.tar.xz) = bc317b65efefb0e62819e2f182bcc6b28648c1f5b1ebf1314ee818aa7b96dba0735ba15f08125f0f9fbc0bcdb97ebf46551d9d2c09362f642221c45169282bfe
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.unstripped.jdk.el.ppc64le.tar.xz) = 3d871a04a201b29fac74c9ad33b7f43c31dd3d6353bad33dab5fdda218284bb0d0367b96a2f7e0d11c95ae2fa9cba2c5103247b6d05035f1c71e0fac7ae921e7
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.unstripped.jdk.el.s390x.tar.xz) = 3b97c4a23929e5e8d9da10bf2853003af66cb92b33f54d6702c7f8aa4096e78f0f3b4449c9a63eff7fc4c1ddb6cda1a32393a6bf52c592b096fca2767bd634ac
-SHA512 (java-17-openjdk-17.0.6.0.10-6.portable.unstripped.jdk.el.x86_64.tar.xz) = 5c12f586ac9f00bfc62948716def3d880af46519a8972a5722c8f1869fc69e2f03974248f89c4053aa340d08d9873fd6c3a5b5ba2f6e538771c2164a6c836f69
+SHA512 (openjdk-jdk17u-jdk-17.0.7+7.tar.xz) = 2f231e83fabef6299b16beee1e0c8d52501e22fd71a26ed2ace6fadabe38e73e66f3b8fb8bc994e8b2b9bbdb91d1143661941f623bb94793500f4f3b6495bf58