diff --git a/.gitignore b/.gitignore
index b9e676d..7029481 100644
--- a/.gitignore
+++ b/.gitignore
@@ -63,3 +63,6 @@
 /openjdk-17.0.9+9.tar.xz
 /openjdk-17.0.10+6-ea.tar.xz
 /openjdk-17.0.10+7.tar.xz
+/openjdk-17.0.11+6-ea.tar.xz
+/openjdk-17.0.11+7-ea.tar.xz
+/openjdk-17.0.11+9.tar.xz
diff --git a/generate_source_tarball.sh b/generate_source_tarball.sh
index 5dc6d60..575df62 100755
--- a/generate_source_tarball.sh
+++ b/generate_source_tarball.sh
@@ -1,4 +1,20 @@
 #!/bin/bash
+
+# Copyright (C) 2024 Red Hat, Inc.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
 # Generates the 'source tarball' for JDK projects.
 #
 # Example 1:
@@ -20,7 +36,7 @@
 #
 # PROJECT_NAME=openjdk
 # REPO_NAME=jdk17u
-# VERSION=jdk-17.0.3+5
+# VERSION=jdk-17.0.10+7
 #
 # or to e.g., prepare systemtap, icedtea7's jstack and other tapsets:
 #
@@ -81,9 +97,17 @@ if [ "$OPENJDK_LATEST" != "" ] ; then
                           | tail --lines 1)
     PROJECT_NAME=openjdk
     REPO_NAME=jdk"${FEATURE_VERSION}"u
+    # Skip -ga tags since those are the same as the most recent non-ga tag, and
+    # the non-ga tag is the one that is used to generated the official source
+    # tarball.  For example:
+    # ca760c86642aa2e0d9b571aaabac054c0239fbdc  refs/tags/jdk-17.0.10-ga^{}
+    # 25a2e6c20c9a96853714284cabc6b456eb095070  refs/tags/jdk-17.0.10-ga
+    # ca760c86642aa2e0d9b571aaabac054c0239fbdc  refs/tags/jdk-17.0.10+7^{}
+    # e49c5749b10f3e90274b72e9279f794fdd191d27  refs/tags/jdk-17.0.10+7
     VERSION=$(git ls-remote --tags --refs --sort=-version:refname \
                   "${OPENJDK_URL_DEFAULT}/${PROJECT_NAME}/${REPO_NAME}.git" \
                   "jdk-${FEATURE_VERSION}*" \
+                  | grep --invert-match '\-ga$' \
                   | head --lines 1 | cut --characters 52-)
     FILE_NAME_ROOT=open${VERSION}
     WITH_TEMP=1
@@ -178,65 +202,60 @@ echo -e "\tTO_COMPRESS: ${TO_COMPRESS}"
 echo -e "\tBOOT_JDK: ${BOOT_JDK}"
 
 if [ -d "${FILE_NAME_ROOT}" ] ; then
-  echo "exists exists exists exists exists exists exists "
-  echo "reusing reusing reusing reusing reusing reusing "
-  echo "${FILE_NAME_ROOT}"
-  STAT_TIME="$(stat --format=%Y "${FILE_NAME_ROOT}")"
-  TAR_TIME="$(date --date=@"${STAT_TIME}" --iso-8601=seconds)"
+    echo "exists exists exists exists exists exists exists "
+    echo "reusing reusing reusing reusing reusing reusing "
+    echo "${FILE_NAME_ROOT}"
+    STAT_TIME="$(stat --format=%Y "${FILE_NAME_ROOT}")"
+    TAR_TIME="$(date --date=@"${STAT_TIME}" --iso-8601=seconds)"
 else
-  mkdir "${FILE_NAME_ROOT}"
-  pushd "${FILE_NAME_ROOT}"
-    echo "Cloning ${VERSION} root repository from ${REPO_ROOT}"
-    git clone --depth=1 -b "${VERSION}" "${REPO_ROOT}" "${VERSION}"
-    pushd "${VERSION}"
-      TAR_TIME="$(git log --max-count 1 --format=%cI)"
+    mkdir "${FILE_NAME_ROOT}"
+    pushd "${FILE_NAME_ROOT}"
+        echo "Cloning ${VERSION} root repository from ${REPO_ROOT}"
+        git clone --depth=1 -b "${VERSION}" "${REPO_ROOT}" "${VERSION}"
+        pushd "${VERSION}"
+            TAR_TIME="$(git log --max-count 1 --format=%cI)"
+        popd
     popd
-  popd
 fi
 pushd "${FILE_NAME_ROOT}"
-    EA_PART="$(git tag --contains "${VERSION}" \
-                   | grep --quiet '\-ga$' || echo '-ea')"
-
     # Generate .src-rev so build has knowledge of the revision the tarball was
     # created from
     mkdir build
     pushd build
-    sh "${PWD}"/../"${VERSION}"/configure --with-boot-jdk="${BOOT_JDK}"
-    make store-source-revision
+        sh "${PWD}"/../"${VERSION}"/configure --with-boot-jdk="${BOOT_JDK}"
+        make store-source-revision
     popd
     rm -rf build
 
-    # Remove commit checks
-    echo "Removing $(find "${VERSION}" -name '.jcheck' -print)"
-    find "${VERSION}" -name '.jcheck' -print0 | xargs -0 rm -r
-
-    # Remove history and GHA
-    echo "find ${VERSION} -name '.hgtags'"
-    find "${VERSION}" -name '.hgtags' -exec rm -v '{}' '+'
-    echo "find ${VERSION} -name '.hgignore'"
-    find "${VERSION}" -name '.hgignore' -exec rm -v '{}' '+'
-    echo "find ${VERSION} -name '.gitattributes'"
-    find "${VERSION}" -name '.gitattributes' -exec rm -v '{}' '+'
-    echo "find ${VERSION} -name '.gitignore'"
-    find "${VERSION}" -name '.gitignore' -exec rm -v '{}' '+'
-    # Work around some Git objects not having write permissions.
-    echo "chmod --recursive u+w ${VERSION}/.git"
-    chmod --recursive u+w "${VERSION}"/.git
-    echo "find ${VERSION} -name '.git'"
-    find "${VERSION}" -name '.git' -exec rm -rv '{}' '+'
-    echo "find ${VERSION} -name '.github'"
-    find "${VERSION}" -name '.github' -exec rm -rv '{}' '+'
-
+    EA_PART="$(awk -F= \
+               '/^DEFAULT_PROMOTED_VERSION_PRE/ { if ($2) print "-"$2 }' \
+               "${VERSION}"/make/conf/version-numbers.conf)"
+    TARBALL_BASE=${FILE_NAME_ROOT}${EA_PART}.tar
+    pushd "${VERSION}"
+        # Omit commit checks, history, and GHA from archive.
+        for skip in .jcheck .hgtags .hgignore .gitattributes .gitignore .github
+        do
+            echo "${skip}"" export-ignore" >> .git/info/attributes
+        done
+        # Do not bother with --mtime here; specify it to tar below.
+        # Unforunately, git-archive sorts added files like .src-rev at the end;
+        # retar below to use GNU tar --sort=name ordering which sorts .src-rev
+        # at the start.
+        git archive --output "${TARBALL_BASE}" --prefix="${VERSION}"/ \
+            --add-file=.src-rev --format=tar "${VERSION}"
+    popd
+    mv "${VERSION}" "${VERSION}".git
+    tar xf "${VERSION}".git/"${TARBALL_BASE}"
     echo "Compressing remaining forest"
     if [ "$COMPRESSION" = "xz" ] ; then
         SWITCH=cJf
     else
         SWITCH=czf
     fi
-    TARBALL_NAME=${FILE_NAME_ROOT}${EA_PART}.tar.${COMPRESSION}
+    TARBALL_NAME=${TARBALL_BASE}.${COMPRESSION}
     XZ_OPT=${XZ_OPT-"-T0"} \
           tar --mtime="${TAR_TIME}" --owner=root --group=root --sort=name \
-          --exclude-vcs -$SWITCH "${TARBALL_NAME}" "${TO_COMPRESS}"
+          -$SWITCH "${TARBALL_NAME}" "${TO_COMPRESS}"
     mv "${TARBALL_NAME}" ..
 popd
 if [ "$WITH_TEMP" != "" ] ; then
@@ -244,10 +263,12 @@ if [ "$WITH_TEMP" != "" ] ; then
     popd
 else
     echo -n "Done. You may want to remove the uncompressed version"
-    echo " - $FILE_NAME_ROOT."
+    echo " - $FILE_NAME_ROOT"
 fi
 
 # Local Variables:
 # compile-command: "shellcheck generate_source_tarball.sh"
 # fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
 # End:
diff --git a/java-17-openjdk-portable.specfile b/java-17-openjdk-portable.specfile
index 0c39875..f9d4305 100644
--- a/java-17-openjdk-portable.specfile
+++ b/java-17-openjdk-portable.specfile
@@ -1,6 +1,3 @@
-# portable jdk 17 specific bug, _jvmdir being missing
-%define _jvmdir /usr/lib/jvm
-
 # debug_package %%{nil} is portable-jdks specific
 %define  debug_package %{nil}
 
@@ -11,10 +8,10 @@
 # Examples:
 #
 # Produce release, fastdebug *and* slowdebug builds on x86_64 (default):
-# $ rpmbuild -ba java-17-openjdk.spec
+# $ rpmbuild -ba java-*-openjdk.spec
 #
 # Produce only release builds (no debug builds) on x86_64:
-# $ rpmbuild -ba java-17-openjdk.spec --without slowdebug --without fastdebug
+# $ rpmbuild -ba java-*-openjdk.spec --without slowdebug --without fastdebug
 #
 # Only produce a release build on x86_64:
 # $ fedpkg mockbuild --without slowdebug --without fastdebug
@@ -39,13 +36,6 @@
 %global include_staticlibs 0
 %endif
 
-# Define whether to use the bootstrap JDK directly or with a fresh libjvm.so
-%if %{with fresh_libjvm}
-%global build_hotspot_first 1
-%else
-%global build_hotspot_first 0
-%endif
-
 %if %{with system_libs}
 %global system_libs 1
 %global link_type system
@@ -61,10 +51,6 @@
 # See: https://bugzilla.redhat.com/show_bug.cgi?id=1520879
 %global _find_debuginfo_opts -g
 
-# Disable LTO as this causes build failures at the moment.
-# See RHBZ#1861401
-%define _lto_cflags %{nil}
-
 # note: parametrized macros are order-sensitive (unlike not-parametrized) even with normal macros
 # also necessary when passing it as parameter to other macros. If not macro, then it is considered a switch
 # see the difference between global and define:
@@ -239,8 +225,9 @@
 # Target to use to just build HotSpot
 %global hotspot_target hotspot
 
-# JDK to use for bootstrapping
-%global bootjdk /usr/lib/jvm/java-%{buildjdkver}-openjdk
+# Disable LTO as this causes build failures at the moment.
+# See RHBZ#1861401
+%define _lto_cflags %{nil}
 
 # Filter out flags from the optflags macro that cause problems with the OpenJDK build
 # We filter out -O flags so that the optimization of HotSpot is not lowered from O3 to O2
@@ -326,12 +313,12 @@
 # New Version-String scheme-style defines
 %global featurever 17
 %global interimver 0
-%global updatever 10
+%global updatever 11
 %global patchver 0
 # buildjdkver is usually same as %%{featurever},
 # but in time of bootstrap of next jdk, it is featurever-1,
 # and this it is better to change it here, on single place
-%global buildjdkver 17
+%global buildjdkver %{featurever}
 # We don't add any LTS designator for STS packages (Fedora and EPEL).
 # We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined.
 %if 0%{?rhel} && !0%{?epel}
@@ -341,6 +328,16 @@
   %global lts_designator ""
   %global lts_designator_zip ""
 %endif
+# JDK to use for bootstrapping
+%global bootjdk /usr/lib/jvm/java-%{buildjdkver}-openjdk
+# Define whether to use the bootstrap JDK directly or with a fresh libjvm.so
+# This will only work where the bootstrap JDK is the same major version
+# as the JDK being built
+%if %{with fresh_libjvm} && %{buildjdkver} == %{featurever}
+%global build_hotspot_first 1
+%else
+%global build_hotspot_first 0
+%endif
 
 # Define vendor information used by OpenJDK
 %global oj_vendor Red Hat, Inc.
@@ -367,12 +364,11 @@
 %global icedteaver      6.0.0pre00-c848b93a8598
 # Define current Git revision for the FIPS support patches
 %global fipsver d63771ea660
-%global javaver         %{featurever}
+# Define JDK versions
 %global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
-
+%global javaver         %{featurever}
 # Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames
 %global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn})
-
 # The tag used to create the OpenJDK tarball
 %global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}
 
@@ -381,8 +377,8 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{vcstag}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        7
-%global rpmrelease      1
+%global buildver        9
+%global rpmrelease      5
 #%%global tagsuffix     %%{nil}
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
@@ -468,6 +464,9 @@
 %global __requires_exclude ^(%{_privatelibs}|%{_publiclibs})$
 %endif
 
+# VM variant being built
+# This is always 'server' on 17u which doesn't have JDK-8273494
+%global vm_variant server
 
 %global etcjavasubdir     %{_sysconfdir}/java/java-%{javaver}-%{origin}
 %define etcjavadir()      %{expand:%{etcjavasubdir}/%{uniquesuffix -- %{?1}}}
@@ -558,14 +557,13 @@ Group:   Development/Languages
 License:  ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA
 URL:      http://openjdk.java.net/
 
-
 # The source tarball, generated using generate_source_tarball.sh
 Source0: https://openjdk-sources.osci.io/openjdk%{featurever}/open%{vcstag}%{ea_designator_zip}.tar.xz
 
 # Use 'icedtea_sync.sh' to update the following
 # They are based on code contained in the IcedTea project (6.x).
 # Systemtap tapsets. Zipped up to keep it small.
-Source8: tapsets-icedtea-%%{icedteaver}.tar.xz
+Source8: tapsets-icedtea-%{icedteaver}.tar.xz
 
 # Desktop files. Adapted from IcedTea
 # Disabled in portables
@@ -601,13 +599,21 @@ Source18: TestTranslations.java
 #
 ############################################
 
+# This patch is probably not necessary anymore.  I will revisit
+# removing it if I find that QE performs AWT testing on a per-release
+# basis.
 # Ignore AWTError when assistive technologies are loaded
 Patch1:    rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
-Patch3:    rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
-# NSS via SunPKCS11 Provider (disabled due to memory leak).
+# This patch is almost certainly not needed, but I am keeping it
+# forever because java.security has shipped to customers already, and
+# is marked %config(noreplace).  I do not want to risk
+# warnings/confusion/conflict by changing its default contents
+# mid-lifecycle.
+# NSS via SunPKCS11 Provider (commented out due to memory leak).
 Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
 # RH1750419: enable build of speculative store bypass hardened alt-java (CVE-2018-3639)
 Patch600: rh1750419-redhat_alt_java.patch
+# gnu_andrew is working on backporting a fix for this patch to 17u.
 # Depend on pcsc-lite-libs instead of pcsc-lite-devel as this is only in optional repo
 Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
 
@@ -616,7 +622,7 @@ Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-d
 # as follows: git diff %%{vcstag} src make test > fips-17u-$(git show -s --format=%h HEAD).patch
 # Diff is limited to src and make subdirectories to exclude .github changes
 # The following list is generated by:
-# git log %%{vcstag}.. --no-merges --format=%s --reverse:
+# git log %%{vcstag}.. --no-merges --format=%s --reverse
 # Fixes currently included:
 # PR3183, RH1340845: Support Fedora & RHEL system crypto policy
 # PR3695: Allow system crypto policy enforcement to be toggled on/off
@@ -654,7 +660,7 @@ Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-d
 # test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class (#27)
 # RH1940064: Enable XML Signature provider in FIPS mode (#24)
 # RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized (#26)
-Patch1001: fips-17u-%{fipsver}.patch
+Patch1001: fips-%{featurever}u-%{fipsver}.patch
 
 #############################################
 #
@@ -666,23 +672,17 @@ Patch1001: fips-17u-%{fipsver}.patch
 
 #############################################
 #
-# OpenJDK patches appearing in 17.0.10
+# OpenJDK patches which missed last update
 #
 #############################################
 
-# Currently empty
-
 #############################################
 #
 # Portable build specific patches
 #
 #############################################
 
-#############################################
-#
-# OpenJDK patches targetted for 17.0.6
-#
-#############################################
+# Currently empty
 
 BuildRequires: autoconf
 BuildRequires: automake
@@ -715,18 +715,21 @@ BuildRequires: zip
 # to pack portable tarballs
 BuildRequires: tar
 BuildRequires: unzip
-# No javapackages-filesystem on el7,nor is needed for portables
-# BuildRequires: javapackages-filesystem
+# Define _jvmdir macro
+BuildRequires: javapackages-filesystem
 BuildRequires: java-%{buildjdkver}-openjdk-devel
 # Zero-assembler build requirement
 %ifarch %{zero_arches}
 BuildRequires: libffi-devel
 %endif
 # Full documentation build requirements
+# pandoc is only available on RHEL/CentOS 8
+%if 0%{?rhel} == 8
 BuildRequires: graphviz
 BuildRequires: pandoc
-# 2023c required as of JDK-8305113
-BuildRequires: tzdata-java >= 2023c
+%endif
+# 2024a required as of JDK-8325150
+BuildRequires: tzdata-java >= 2024a
 # cacerts build requirement in portable mode
 BuildRequires: ca-certificates
 # Earlier versions have a bug in tree vectorization on PPC
@@ -745,18 +748,18 @@ BuildRequires: lcms2-devel
 BuildRequires: libjpeg-devel
 BuildRequires: libpng-devel
 %else
-# Version in src/java.desktop/share/native/libfreetype/include/freetype/freetype.h
-Provides: bundled(freetype) = 2.13.0
+# Version in src/java.desktop/share/legal/freetype.md
+Provides: bundled(freetype) = 2.13.2
 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
 Provides: bundled(giflib) = 5.2.1
 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h
-Provides: bundled(harfbuzz) = 7.2.0
+Provides: bundled(harfbuzz) = 8.2.2
 # Version in src/java.desktop/share/native/liblcms/lcms2.h
 Provides: bundled(lcms2) = 2.15.0
 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h
 Provides: bundled(libjpeg) = 6b
 # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h
-Provides: bundled(libpng) = 1.6.39
+Provides: bundled(libpng) = 1.6.40
 # We link statically against libstdc++ to increase portability
 BuildRequires: libstdc++-static
 %endif
@@ -932,6 +935,13 @@ if [ %{include_debug_build} -eq 0 -a  %{include_normal_build} -eq 0 -a  %{includ
   echo "You have disabled all builds (normal,fastdebug,slowdebug). That is a no go."
   exit 14
 fi
+
+%if %{with fresh_libjvm} && ! %{build_hotspot_first}
+echo "WARNING: The build of a fresh libjvm has been disabled due to a JDK version mismatch"
+echo "Build JDK version is %{buildjdkver}, feature JDK version is %{featurever}"
+%endif
+
+export XZ_OPT="-T0"
 %setup -q -c -n %{uniquesuffix ""} -T -a 0
 # https://bugzilla.redhat.com/show_bug.cgi?id=1189084
 prioritylength=`expr length %{priority}`
@@ -948,11 +958,21 @@ sh %{SOURCE12} %{top_level_dir_name}
 %endif
 
 # Patch the JDK
-# -P N: apply patch number N, same as passing N as a positional argument on rpm >= 4.18
-# -p N: strip N leading slashes from paths
 pushd %{top_level_dir_name}
+# This syntax is deprecated:
+#    %patchN [...]
+# and should be replaced with:
+#    %patch -PN [...]
+# For example:
+#    %patch1001 -p1
+# becomes:
+#    %patch -P1001 -p1
+# The replacement format suggested by recent (circa Fedora 38) RPM
+# deprecation messages:
+#    %patch N [...]
+# is not backward-compatible with prior (circa RHEL-8) versions of
+# rpmbuild.
 %patch -P1 -p1
-%patch -P3 -p1
 %patch -P6 -p1
 # Add crypto policy and FIPS support
 %patch -P1001 -p1
@@ -962,6 +982,7 @@ pushd %{top_level_dir_name}
 %patch -P600 -p1
 popd # openjdk
 
+
 # The OpenJDK version file includes the current
 # upstream version information. For some reason,
 # configure does not automatically use the
@@ -1008,6 +1029,7 @@ done
 sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE11} > nss.cfg
 
 %build
+
 # How many CPU's do we have?
 export NUM_PROC=%(/usr/bin/getconf _NPROCESSORS_ONLN 2> /dev/null || :)
 export NUM_PROC=${NUM_PROC:-1}
@@ -1015,6 +1037,7 @@ export NUM_PROC=${NUM_PROC:-1}
 # Honor %%_smp_ncpus_max
 [ ${NUM_PROC} -gt %{?_smp_ncpus_max} ] && export NUM_PROC=%{?_smp_ncpus_max}
 %endif
+export XZ_OPT="-T0"
 
 %ifarch s390x sparc64 alpha %{power64} %{aarch64}
 export ARCH_DATA_MODEL=64
@@ -1042,6 +1065,51 @@ export EXTRA_CFLAGS EXTRA_CPP_FLAGS
 
 echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}"
 
+# Set modification times (mtimes) of files within JAR files generated
+# by the OpenJDK build to a timestamp that is constant across RPM
+# rebuilds.  OpenJDK provides the --with-source-date configure option
+# for this purpose.  Potential arguments in the RPM build context are:
+#
+# A) --with-source-date="${SOURCE_DATE_EPOCH}"
+# B) --with-source-date=version
+# C) --with-source-date="${OPENJDK_UPSTREAM_TAG_EPOCH}"
+#
+# Consider Option A.  Fedora 38 (rpm-4.18.2) and RHEL-8 (rpm-4.14.3)
+# have different support for SOURCE_DATE_EPOCH.  To keep
+# SOURCE_DATE_EPOCH constant across RPM rebuilds, one could set the
+# source_date_epoch_from_changelog macro to 1 on both Fedora 38 and
+# RHEL-8.  However, on RHEL-8, this results in the RPM build times
+# being set to the timestamp of the most recent changelog.  This is
+# bad for tracing when RPMs were actually built.  Fedora 38 supports a
+# better behaviour via the introduction of the
+# use_source_date_epoch_as_buildtime macro, set to 0 by default.
+# There is no way to make this work on RHEL-8 as well though, so
+# option A is suboptimal.
+#
+# Option B uses the value of the DEFAULT_VERSION_DATE field from
+# make/conf/version-numbers.conf.  DEFAULT_VERSION_DATE represents the
+# aspirational eventual JDK general availability (GA) release date.
+# When the RPM build occurs prior to GA, generated JAR files will have
+# payload mtimes in the future relative to the RPM build time.
+# Whereas for tarballs some tools will issue warnings about future
+# mtimes, per OPENJDK-2583 apparently this is no problem for Java and
+# JAR files.
+#
+# Option C uses the modification timestamp of files in the source
+# tarball. The reproducibility logic in generate_source_tarball.sh
+# sets them all to the commit time of the release-tagged OpenJDK
+# commit, as archived in the tarball.  This timestamp is deterministic
+# across RPM rebuilds and is reliably in the past.  Any file's mtime
+# will do, so use version-numbers.conf's.
+#
+# Use option B for JAR files, based on the discussion in OPENJDK-2583.
+#
+# For portable tarballs, use option C (OPENJDK_UPSTREAM_TAG_EPOCH) for
+# the modification times of all files in the portable tarballs.  Doing
+# so eliminates one source of variability across RPM rebuilds.
+VERSION_FILE="$(pwd)"/"%{top_level_dir_name}"/make/conf/version-numbers.conf
+OPENJDK_UPSTREAM_TAG_EPOCH="$(stat --format=%Y "${VERSION_FILE}")"
+
 function buildjdk() {
     local outputdir=${1}
     local buildjdk=${2}
@@ -1080,9 +1148,6 @@ function buildjdk() {
     bash ${top_dir_abs_src_path}/configure \
 %ifarch %{zero_arches}
     --with-jvm-variants=zero \
-%endif
-%ifarch %{ppc64le}
-    --with-jobs=1 \
 %endif
     --with-cacerts-file=$(readlink -f %{_sysconfdir}/pki/java/cacerts)  \
     --with-version-build=%{buildver} \
@@ -1110,7 +1175,7 @@ function buildjdk() {
     --with-extra-cflags="$EXTRA_CFLAGS" \
     --with-extra-ldflags="%{ourldflags}" \
     --with-num-cores="$NUM_PROC" \
-    --with-source-date="${SOURCE_DATE_EPOCH}" \
+    --with-source-date=version \
     --disable-javac-server \
 %ifarch %{zgc_arches}
     --with-jvm-features=zgc \
@@ -1119,7 +1184,7 @@ function buildjdk() {
 
     cat spec.gmk
     make LOG=trace $maketargets || \
-        ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name \"hs_err_pid*.log\" | xargs cat && false )
+        ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name "hs_err_pid*.log" | xargs cat && false )
 
     popd
 }
@@ -1255,6 +1320,21 @@ function packagejdk() {
     local packagesdir=$(pwd)/${2}
     local srcdir=$(pwd)/%{top_level_dir_name}
     local tapsetdir=$(pwd)/tapset
+    # See https://reproducible-builds.org/docs/archives/
+    # RHEL-7 has tar 1.26 which does not support --sort=name, so use
+    # find-piped-through-sort instead.  Omit --pax-option since it
+    # made the docs package not reproducible due to PaxHeaders
+    # timestamp differences.
+    local tar_opts="--mtime=@${OPENJDK_UPSTREAM_TAG_EPOCH} \
+                    --owner=0 \
+                    --group=0 \
+                    --numeric-owner \
+                    --no-recursion \
+                    --null \
+                    --files-from - \
+                    --create \
+                    --xz \
+                    --file"
 
     echo "Packaging build from ${imagesdir} to ${packagesdir}..."
     mkdir -p ${packagesdir}
@@ -1285,7 +1365,7 @@ function packagejdk() {
     if [ "x$suffix" = "x" ] ; then
         # Keep the unstripped version for consumption by RHEL RPMs
         mv %{jdkimage}.unstripped ${jdkname}
-        tar -cJf ${unstrippedarchive} ${jdkname}
+        find ${jdkname} -print0 | LC_ALL=C sort -z | tar ${tar_opts} ${unstrippedarchive}
         genchecksum ${unstrippedarchive}
         mv ${jdkname} %{jdkimage}.unstripped
     fi
@@ -1296,13 +1376,13 @@ function packagejdk() {
 
     # Release images have external debug symbols
     if [ "x$suffix" = "x" ] ; then
-        tar -cJf ${debugarchive} $(find ${jdkname} -name \*.debuginfo)
+        find ${jdkname} -name \*.debuginfo -print0 | LC_ALL=C sort -z | tar ${tar_opts} ${debugarchive}
         genchecksum ${debugarchive}
 
         mkdir ${docname}
         mv ${docdir} ${docname}
         mv ${bundledir}/${built_doc_archive} ${docname}
-        tar -cJf ${docarchive} ${docname}
+        find ${docname} -print0 | LC_ALL=C sort -z | tar ${tar_opts} ${docarchive}
         genchecksum ${docarchive}
 
         mkdir ${miscname}
@@ -1313,22 +1393,22 @@ function packagejdk() {
 %if %{with_systemtap}
         cp -a ${tapsetdir}* ${miscname}
 %endif
-        tar -cJf ${miscarchive} ${miscname}
+        find ${miscname} -print0 | LC_ALL=C sort -z | tar ${tar_opts} ${miscarchive}
         genchecksum ${miscarchive}
     fi
 
-    tar -cJf ${jdkarchive} --exclude='**.debuginfo' ${jdkname}
+    find ${jdkname} -print0 | LC_ALL=C sort -z | tar --exclude='**.debuginfo' ${tar_opts} ${jdkarchive}
     genchecksum ${jdkarchive}
 
-    tar -cJf ${jrearchive}  --exclude='**.debuginfo' ${jrename}
+    find ${jrename} -print0 | LC_ALL=C sort -z | tar --exclude='**.debuginfo' ${tar_opts} ${jrearchive}
     genchecksum ${jrearchive}
 
 %if %{include_staticlibs}
     # Static libraries (needed for building graal vm with native image)
     # Tar as overlay. Transform to the JDK name, since we just want to "add"
     # static libraries to that folder
-    tar -cJf ${staticarchive} \
-        --transform "s|^%{static_libs_image}/lib/*|${staticname}/lib/static/linux-%{archinstall}/glibc/|" "%{static_libs_image}/lib"
+    find "%{static_libs_image}/lib" -print0 | LC_ALL=C sort -z \
+        | tar --transform "s|^%{static_libs_image}/lib/*|${staticname}/lib/static/linux-%{archinstall}/glibc/|" ${tar_opts} ${staticarchive}
     genchecksum ${staticarchive}
 %endif
 
@@ -1346,7 +1426,7 @@ function packagejdk() {
   cp -LR --preserve=mode,timestamps %{bootjdk} newboot
   systemjdk=$(pwd)/newboot
   buildjdk build/newboot ${systemjdk} %{hotspot_target} "release" "bundled" "internal"
-  mv build/newboot/jdk/lib/server/libjvm.so newboot/lib/server
+  mv build/newboot/jdk/lib/%{vm_variant}/libjvm.so newboot/lib/%{vm_variant}
 %else
   systemjdk=%{bootjdk}
 %endif
@@ -1430,10 +1510,9 @@ export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage}
 #sed -i -e "s:^security.useSystemPropertiesFile=.*:security.useSystemPropertiesFile=true:" \
 #${JAVA_HOME}/conf/security/java.security
 
-
-#check Shenandoah is enabled
+# Check Shenandoah is enabled
 %if %{use_shenandoah_hotspot}
-$JAVA_HOME//bin/java -XX:+UnlockExperimentalVMOptions -XX:+UseShenandoahGC -version
+$JAVA_HOME/bin/java -XX:+UnlockExperimentalVMOptions -XX:+UseShenandoahGC -version
 %endif
 
 # Check unlimited policy has been used
@@ -1472,6 +1551,7 @@ if ! nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation ; then true ; els
 # Check translations are available for new timezones (during flatpak builds, the
 # tzdb.dat used by this test is not where the test expects it, so this is
 # disabled for flatpak builds)
+# Disable test until we are on the latest JDK
 $JAVA_HOME/bin/javac -d . %{SOURCE18}
 $JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE
 $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR
@@ -1482,9 +1562,8 @@ $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|
 export STATIC_LIBS_HOME=${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image}
 ls -l $STATIC_LIBS_HOME
 ls -l $STATIC_LIBS_HOME/lib
-# they are here, but grep do not find the remainders
-#readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep w_remainder.c
-#readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep e_remainder.c
+readelf --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet4AddressImpl.c
+readelf --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet6AddressImpl.c
 %endif
 
 # Release builds strip the debug symbols into external .debuginfo files
@@ -1701,6 +1780,123 @@ done
 %{_jvmdir}/%{miscportablearchive}.sha256sum
 
 %changelog
+* Mon Jul 29 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.11.0.9-5
+- Bump rpmrelease to rebuild for CentOS 9
+
+* Thu Apr 18 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.11.0.9-4
+- Sync release notes with upstream version: https://bit.ly/openjdk17011
+- Turn off 'fresh_libjvm' until jdk-17.0.9 or later is in the CentOS buildroot
+
+* Wed Apr 10 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.9-3
+- BuildRequires tzdata-java >= 2024a (JDK-8325150)
+
+* Wed Apr 10 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.9-2
+- NEWS: Add CVEs
+- NEWS: Remove backed out items from changes section
+- NEWS: Remove release note for JDK-8225377, which was backed out
+
+* Tue Apr  9 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.9-1
+- Update to jdk-17.0.11+9 (GA)
+- Update NEWS for 17.0.11+9
+- Switch to GA mode for release
+- ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
+
+* Thu Apr  4 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.7-0.1.ea
+- Import like NEWS entries verbatim from 21.0.3
+
+* Thu Mar 28 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.7-0.1.ea
+- Update to jdk-17.0.11+7 (EA)
+
+* Mon Mar 11 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.6-0.1.ea
+- Update to jdk-17.0.11+6 (EA)
+
+* Fri Mar  8 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.5-0.1.ea
+- Update to jdk-17.0.11+5 (EA)
+
+* Mon Feb 26 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.4-0.1.ea
+- Revert: Remove ExcludeArch to match java-21-openjdk
+
+* Wed Feb 21 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.4-0.1.ea
+- Update to jdk-17.0.11+4 (EA)
+
+* Wed Feb 14 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.3-0.1.ea
+- Update to jdk-17.0.11+3 (EA)
+
+* Fri Feb  9 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.2-0.1.ea
+- Remove RH1649512 patch for libjpeg-turbo FAR macro
+- Add some patch commentary
+
+* Thu Feb  8 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.2-0.1.ea
+- Update to jdk-17.0.11+2 (EA)
+
+* Thu Feb  8 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.1-0.2.ea
+- generate_source_tarball.sh: Add license
+- openjdk_news.sh: Use grep -E instead of egrep
+
+* Wed Feb  7 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.1-0.2.ea
+- Fix the quoting of hs_err_pid
+
+* Tue Feb  6 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.1-0.2.ea
+- Use RHEL-7 tar-1.26-compatible invocations for reproducible tarballs
+- On RHEL-7 default to building without a fresh libjvm.so
+
+* Mon Feb  5 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.11.0.1-0.2.ea
+- Require tzdata 2023d due to local inclusion of JDK-8322725
+
+* Mon Feb  5 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.1-0.2.ea
+- Bump rpmrelease to 2
+- Move _lto_cflags setting to match its java-21-openjdk location
+- Remove ExcludeArch to match java-21-openjdk
+- Update comment and whitespace to match java-21-openjdk
+- Update NEWS
+- Remove -T0 argument from systemtap tar invocation
+- Indent a line in buildjdk
+- Remove extra stripjdk from merge
+
+* Fri Feb  2 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.1-0.1.ea
+- Use --with-source-date=version (OPENJDK-2583, OPENJDK-2730)
+- Update freetype bundled provides version from 2.13.0 to 2.13.2
+- Update harfbuzz bundled provides version from 7.2.0 to 8.2.2
+- Update libpng bundled provides version from 1.6.39 to 1.6.40
+- Related: OPENJDK-2730
+
+* Thu Feb  1 2024 Jiri Vanek <jvanek@redhat.com> - 1:17.0.11.0.1-0.1.ea
+- generate_source_tarball.sh: Update version in comment
+- generate_source_tarball.sh: Remove trailing period in echo
+
+* Thu Feb  1 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.11.0.1-0.1.ea
+- BuildRequires javapackages-filesystem for _jvmdir macro
+- Automatically turn off building a fresh HotSpot first, if the bootstrap JDK is not the same major version as that being built
+- Update buildjdkver to match the featurever
+- Use featurever macro to specify fips patch
+- Check debug symbols in libnet.a static library as a smoke test
+- Introduce vm_variant global for consistency with future JDK builds
+- Related: rhbz#2203412
+- Introduce tar_opts to shorten tarball creation lines
+
+* Thu Feb  1 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.1-0.1.ea
+- NEWS: Add initial changes for 17.0.11
+- Sync whitespace and comments from java-21-openjdk.spec
+- Sync macro definition ordering from java-21-openjdk.spec
+- Correct rh1649512 patch name
+- Fix comment to match RHEL 9.2.0 branch
+- Fix icedteaver macro reference syntax
+- Remove extra slash in use_shenandoah_hotspot JAVA_HOME expansion
+- Explain patchN syntax situation in a comment
+- generate_source_tarball.sh: Fix whitespace
+- generate_source_tarball.sh: Skip -ga tags
+- generate_source_tarball.sh: Get -ea suffix from version-numbers.conf
+- generate_source_tarball.sh: Use git archive to generate tarball
+- generate_source_tarball.sh: Add indentation instructions for Emacs
+- Default to without fresh_libjvm now that 17.0.9.0.9-1 is staged
+- double-build.bash: New file
+- Parallelize xz across all available cores
+- Remove ppc64le --with-jobs=1 workaround
+- Make JAR file and portable tarball modification times reproducible
+
+* Wed Jan 31 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.1-0.1.ea
+- Update to jdk-17.0.11+1 (EA)
+
 * Thu Jan 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.10.0.7-1
 - Update to jdk-17.0.10+7 (GA)
 - Update release notes to 17.0.10+7
@@ -1711,7 +1907,7 @@ done
 
 * Thu Jan 11 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.10.0.6-0.1.ea
 - generate_source_tarball.sh: Add note on network usage of OPENJDK_LATEST
-- generate_source_tarball.sh: Remove unneeded FIXME
+- generate_source_tarball.sh: Remove unneeded fix-me
 
 * Thu Jan 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.10.0.6-0.1.ea
 - Update release notes to 17.0.10+6
@@ -1760,6 +1956,10 @@ done
 - Temporarily turn off 'fresh_libjvm' due to removal of JVM_IsThreadAlive (JDK-8305425)
 - ** This tarball is embargoed until 2023-10-17 @ 1pm PT. **
 
+* Sat Sep 02 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.8.1.1-2
+- Bump rpmrelease to rebuild for CentOS 9
+- pandoc is only available on RHEL/CentOS 8
+
 * Sat Sep 02 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.8.1.1-1
 - Update to jdk-17.0.8.1+1 (GA)
 - Update release notes to 17.0.8.1+1
diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec
index 86ebf8b..659e2d4 100644
--- a/java-17-openjdk.spec
+++ b/java-17-openjdk.spec
@@ -322,12 +322,12 @@
 # New Version-String scheme-style defines
 %global featurever 17
 %global interimver 0
-%global updatever 10
+%global updatever 11
 %global patchver 0
 # buildjdkver is usually same as %%{featurever},
 # but in time of bootstrap of next jdk, it is featurever-1,
 # and this it is better to change it here, on single place
-%global buildjdkver 17
+%global buildjdkver %{featurever}
 # We don't add any LTS designator for STS packages (Fedora and EPEL).
 # We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined.
 %if 0%{?rhel} && !0%{?epel}
@@ -377,11 +377,11 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{vcstag}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        7
+%global buildver        9
 # rpmrelease numbering must start at 2 to be later than the 9.0 RPM
 %global rpmrelease      2
 # Settings used by the portable build
-%global portablerelease 2
+%global portablerelease 5
 %global portablesuffix el9
 %global portablebuilddir /builddir/build/BUILD
 
@@ -1124,8 +1124,9 @@ Requires: ca-certificates
 # Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros
 Requires: javapackages-filesystem
 # Require zone-info data provided by tzdata-java sub-package
-# 2023c required as of JDK-8305113
-Requires: tzdata-java >= 2023c
+# 2024a required as of JDK-8325150
+# Use 2023d until 2024a is in the buildroot
+Requires: tzdata-java >= 2023d
 # for support of kernel stream control
 # libsctp.so.1 is being `dlopen`ed on demand
 Requires: lksctp-tools%{?_isa}
@@ -1347,9 +1348,6 @@ Patch600: rh1750419-redhat_alt_java.patch
 
 # Ignore AWTError when assistive technologies are loaded
 Patch1:    rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
-Patch3:    rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
-# Depend on pcsc-lite-libs instead of pcsc-lite-devel as this is only in optional repo
-Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
 
 # Crypto policy and FIPS support patches
 # Patch is generated from the fips-17u tree at https://github.com/rh-openjdk/jdk/tree/fips-17u
@@ -1394,7 +1392,7 @@ Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-d
 # test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class (#27)
 # RH1940064: Enable XML Signature provider in FIPS mode (#24)
 # RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized (#26)
-Patch1001: fips-17u-%{fipsver}.patch
+Patch1001: fips-%{featurever}u-%{fipsver}.patch
 
 #############################################
 #
@@ -1402,6 +1400,9 @@ Patch1001: fips-17u-%{fipsver}.patch
 #
 #############################################
 
+# Depend on pcsc-lite-libs instead of pcsc-lite-devel as this is only in optional repo
+Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
+
 #############################################
 #
 # OpenJDK patches appearing in 17.0.10
@@ -1455,8 +1456,9 @@ BuildRequires: java-%{featurever}-openjdk-portable-misc = %{epoch}:%{version}-%{
 %ifarch %{zero_arches}
 BuildRequires: libffi-devel
 %endif
-# 2023c required as of JDK-8305113
-BuildRequires: tzdata-java >= 2023c
+# 2024a required as of JDK-8325150
+# Use 2023d until 2024a is in the buildroot
+BuildRequires: tzdata-java >= 2023d
 # Earlier versions have a bug in tree vectorization on PPC
 BuildRequires: gcc >= 4.8.3-8
 
@@ -1843,11 +1845,21 @@ sh %{SOURCE12} %{top_level_dir_name}
 %endif
 
 # Patch the JDK
-# -P N: apply patch number N, same as passing N as a positional argument on rpm >= 4.18
-# -p N: strip N leading slashes from paths
 pushd %{top_level_dir_name}
+# This syntax is deprecated:
+#    %patchN [...]
+# and should be replaced with:
+#    %patch -PN [...]
+# For example:
+#    %patch1001 -p1
+# becomes:
+#    %patch -P1001 -p1
+# The replacement format suggested by recent (circa Fedora 38) RPM
+# deprecation messages:
+#    %patch N [...]
+# is not backward-compatible with prior (circa RHEL-8) versions of
+# rpmbuild.
 %patch -P1 -p1
-%patch -P3 -p1
 %patch -P6 -p1
 # Add crypto policy and FIPS support
 %patch -P1001 -p1
@@ -2474,6 +2486,32 @@ cjc.mainProgram(args)
 %endif
 
 %changelog
+* Thu Apr 11 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.9-2
+- Update to jdk-17.0.11+9 (GA)
+- Add openjdk-17.0.11+9.tar.xz to .gitignore
+- Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
+- Update buildver from 7 to 9
+- Update portablerelease from 1 to 3
+- Change is_ga from 0 to 1 to enable GA mode for release
+- Update tzdata Requires comment to mention that 2024a is not yet in the buildroot
+- Update tzdata BuildRequires comment to mention that 2024a is not yet in the buildroot
+- Update tzdata BuildRequires from 2023c to 2023d
+- Update sources from openjdk-17.0.11+7-ea.tar.xz to openjdk-17.0.11+9.tar.xz
+- Resolves: RHEL-45216
+- ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
+
+* Thu Mar 28 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.11.0.7-0.2.ea
+- Update to jdk-17.0.11+7 (EA)
+- Update buildjdkver to match the featurever
+- Use featurever macro to specify fips patch
+- Explain patchN syntax situation in a comment
+- Sync generate_source_tarball.sh
+- Require tzdata 2023d (JDK-8322725)
+- openjdk_news.sh: Use grep -E instead of egrep
+- Remove RH1649512 patch for libjpeg-turbo FAR macro
+- Move pcsc-lite-libs patch to in-need-of-upstreaming section
+- Related: RHEL-45216
+
 * Thu Jan 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.10.0.7-1
 - Update to jdk-17.0.10+7 (GA)
 - Sync the copy of the portable specfile with the latest update
diff --git a/openjdk_news.sh b/openjdk_news.sh
index 386aa53..d1bd061 100755
--- a/openjdk_news.sh
+++ b/openjdk_news.sh
@@ -58,12 +58,12 @@ for repos in . $(${SCRIPT_DIR}/discover_trees.sh ${REPO});
 do
     if test "x$TYPE" = "xhg"; then
 	hg log -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R $REPO/$repos -G -M ${REPO}/${SUBDIR} | \
-	    egrep '^[o:| ]*summary'|grep -v 'Added tag'|sed -r 's#^[o:| ]*summary:\W*([0-9])#  - JDK-\1#'| \
+	    grep -E '^[o:| ]*summary'|grep -v 'Added tag'|sed -r 's#^[o:| ]*summary:\W*([0-9])#  - JDK-\1#'| \
 	    sed 's#^[o:| ]*summary:\W*#  - #' >> ${TMPDIR}/fixes2;
 	hg log -v -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R $REPO/$repos -G -M ${REPO}/${SUBDIR} | \
-	    egrep '^[o:| ]*[0-9]{7}'|sed -r 's#^[o:| ]*([0-9]{7})#  - JDK-\1#' >> ${TMPDIR}/fixes3;
+	    grep -E '^[o:| ]*[0-9]{7}'|sed -r 's#^[o:| ]*([0-9]{7})#  - JDK-\1#' >> ${TMPDIR}/fixes3;
     else
-	git -C ${REPO} log --no-merges --pretty=format:%B ${NEW_RELEASE}...${OLD_RELEASE} -- ${SUBDIR} |egrep '^[0-9]{7}' | \
+	git -C ${REPO} log --no-merges --pretty=format:%B ${NEW_RELEASE}...${OLD_RELEASE} -- ${SUBDIR} |grep -E '^[0-9]{7}' | \
 	    sed -r 's#^([0-9])#  - JDK-\1#' >> ${TMPDIR}/fixes2;
 	touch ${TMPDIR}/fixes3 ; # unused
     fi
diff --git a/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch b/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
deleted file mode 100644
index 1b706a1..0000000
--- a/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-Remove uses of FAR in jpeg code
-
-Upstream libjpeg-trubo removed the (empty) FAR macro:
-http://sourceforge.net/p/libjpeg-turbo/code/1312/
-
-Adjust our code to not use the undefined FAR macro anymore.
-
-diff --git a/jdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c b/jdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c
---- openjdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c
-+++ openjdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c
-@@ -1385,7 +1385,7 @@
-     /* and fill it in */
-     dst_ptr = icc_data;
-     for (seq_no = first; seq_no < last; seq_no++) {
--        JOCTET FAR *src_ptr = icc_markers[seq_no]->data + ICC_OVERHEAD_LEN;
-+        JOCTET *src_ptr = icc_markers[seq_no]->data + ICC_OVERHEAD_LEN;
-         unsigned int length =
-             icc_markers[seq_no]->data_length - ICC_OVERHEAD_LEN;
- 
diff --git a/sources b/sources
index 4fd3575..334092b 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
 SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
-SHA512 (openjdk-17.0.10+7.tar.xz) = 066acec5dbc76d753a3aba3a8a85ef477f9e379ebfd6338c5026e2f8b329b0a08f878fcbb7f6fdefba99ec45415ac22e01e7439831749816717adb1a0d8230d1
+SHA512 (openjdk-17.0.11+9.tar.xz) = 7abbd002a93ede19b0bb40d31afe85445c0a2c4c055813148a1cd577a3fabb217ada00be91ef75dd9e9eec3bb01c0c1d8fabae79d495ad00ce745a3442a7d8c8