* Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
* RH2023467: Enable FIPS keys export
* RH2094027: SunEC runtime permission for FIPS
- Update FIPS support to bring in latest changes
* RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
* RH2090378: Revert to disabling system security properties and FIPS mode support together
- Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
- Enable system security properties in the RPM (now disabled by default in the FIPS repo)
- Improve security properties test to check both enabled and disabled behaviour
- Run security properties test with property debugging on
- RH2007331: SecretKey generate/import operations don't add the CKA_SIGN attribute in FIPS mode
- Use SunPKCS11 Attributes Configuration to set CKA_SIGN=true on SecretKey generate/import operations in FIPS mode, see:
https://docs.oracle.com/en/java/javase/17/security/pkcs11-reference-guide1.html#GUID-C4ABFACB-B2C9-4E71-A313-79F881488BB9__PKCS11-ATTRIBUTES-CONFIGURATION
- Turn on system security properties as part of the build's install section
- Move cacerts replacement to install section and retain original of this and tzdb.dat
- Run tests on the installed image, rather than the build image
- Introduce variables to refer to the static library installation directories
- Use relative symlinks so they work within the image
- Run debug symbols check during build stage, before the install strips them
Related: RHEL-45216
- Update release notes to 17.0.3.0+7
- Add JDK-8283911 to fix bad DEFAULT_PROMOTED_VERSION_PRE value
- Add missing README.md and generate_source_tarball.sh
- JDK-8283911 patch no longer needed now we're GA...
Related: RHEL-45216
Fixing:
Bug 2001567 - update of JDK/JRE is removing its manually selected alterantives and select (as auto) system JDK/JRE
The move of alternatives creation to posttrans to fix:
Bug 1200302 - dnf reinstall breaks alternatives
Had caused the alternatives to be removed, and then created again,
instead of being added, and then removing the old, and thus persisting
the selection in family
Thus this fix, is storing the family of manually selected master, and if
stored, then it is restoring the family of the master
Related: RHEL-45216
* Restructure the build so a minimal initial build is then used for the final build (with docs)
- This reduces pressure on the system JDK and ensures the JDK being built can do a full build
* Turn off bootstrapping for slow debug builds, which are particularly slow on ppc64le.
* Handle Fedora in distro conditionals that currently only pertain to RHEL.
* Replace tabs by sets of spaces to make rpmlint happy
- Run OpenJDK normalizer script on the spec file to fix further rogue whitespace
* javadoc-zip gets its own provides next to plain javadoc ones
* Sync gdb test with java-1.8.0-openjdk and improve architecture restrictions.
* Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
- Need to support noarch for creating source RPMs for non-scratch builds.
* Support a HotSpot-only build so a freshly built libjvm.so can then be used in the bootstrap JDK.
- Replace -mstackrealign with -mincoming-stack-boundary=2 -mpreferred-stack-boundary=4 on x86_32 for stack alignment
- Explicitly list JIT architectures rather than relying on those with slowdebug builds
- Disable the serviceability agent on Zero architectures even when the architecture itself is supported
Related: RHEL-45216
Rebase RH1995150 & RH1996182 patches following JDK-8275863 addition to module-info.java
Rename libsvml.so to libjsvml.so following JDK-8276025
Drop JDK-8276572 patch which is now upstream
Related: RHEL-45216
- Update to jdk-17+35, also known as jdk-17-ga.
- Remove boot JDKs in favour of OpenJDK 17 build now in the buildroot.
- Update buildjdkver to 17 so as to build with itself
- Add possibility to disable system crypto policy
- Add PR3695 to allow the system crypto policy to be turned off
- Re-enable TestSecurityProperties after inclusion of PR3695
- Added gating.yaml
- Fix patch rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
- Use the "reverse" build loop (debug first) as the main and only build loop to get more diagnostics.
- Remove restriction on disabling product build, as debug packages no longer have javadoc packages.
- Update to jdk-17+33, including JDWP fix and July 2021 CPU
- Support the FIPS mode crypto policy (RH1655466)
- Update RH1655466 FIPS patch with changes in OpenJDK 8 version.
- SunPKCS11 runtime provider name is a concatenation of "SunPKCS11-" and the name in the config file.
- Change nss.fips.cfg config name to "NSS-FIPS" to avoid confusion with nss.cfg.
- No need to substitute path to nss.fips.cfg as java.security file supports a java.home variable.
- Disable FIPS mode support unless com.redhat.fips is set to "true".
- Use appropriate keystore types when in FIPS mode (RH1818909)
- Enable alignment with FIPS crypto policy by default (-Dcom.redhat.fips=false to disable).
- Disable TLSv1.3 when the FIPS crypto policy and the NSS-FIPS provider are in use (RH1860986)
- Add explicit runtime dependency on NSS for the PKCS11 provider in FIPS mode
- Move setup of JavaSecuritySystemConfiguratorAccess to Security class so it always occurs (RH1915071)
- Detect FIPS using SECMOD_GetSystemFIPSEnabled in the new libsystemconf JDK library.
- Minor code cleanups on FIPS detection patch and check for SECMOD_GetSystemFIPSEnabled in configure.
- Remove unneeded Requires on NSS as it will now be dynamically linked and detected by RPM.
- Add patch to disable non-FIPS crypto in the SUN and SunEC security providers.
- Add patch to login to the NSS software token when in FIPS mode.
- Fix unused function compiler warning found in systemconf.c
- Extend the default security policy to accomodate PKCS11 accessing jdk.internal.access.
- Add JDK-8272332 fix so we actually link against HarfBuzz.
- Update release notes to document the major changes between OpenJDK 11 & 17.
- Add FIPS patch to allow plain key import.
- Allow plain key import to be disabled with -Dcom.redhat.fips.plainKeySupport=false
- Patch syslookup.c so it actually has some code to be compiled into libsyslookup
- alternatives creation moved to posttrans
- Set LTS designator on RHEL, but not Fedora or EPEL.
Related: RHEL-45216
cpio: jdk-17.0.9+9/make/NONE: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hb-buffer-deserialize-json.hh: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hb-buffer-deserialize-json.rl: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hb-buffer-deserialize-text-glyphs.hh: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hb-buffer-deserialize-text-glyphs.rl: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hb-buffer-deserialize-text-unicode.hh: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hb-buffer-deserialize-text-unicode.rl: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hb-number-parser.hh: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hb-number-parser.rl: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hb-ot-shaper-indic-machine.hh: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hb-ot-shaper-indic-machine.rl: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hb-ot-shaper-khmer-machine.hh: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hb-ot-shaper-khmer-machine.rl: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hb-ot-shaper-myanmar-machine.hh: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hb-ot-shaper-myanmar-machine.rl: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hb-ot-shaper-use-machine.hh: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hb-ot-shaper-use-machine.rl: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hotspot/adGlobals_aarch64.hpp: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hotspot/ad_aarch64.cpp: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hotspot/ad_aarch64.hpp: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hotspot/ad_aarch64_clone.cpp: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hotspot/ad_aarch64_expand.cpp: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hotspot/ad_aarch64_format.cpp: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hotspot/ad_aarch64_gen.cpp: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hotspot/ad_aarch64_misc.cpp: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hotspot/ad_aarch64_pipeline.cpp: Cannot stat: No such file or directory
cpio: jdk-17.0.9+9/make/hotspot/dfa_aarch64.cpp: Cannot stat: No such file or directory
adapted tests to jdk17 like stile
by addedd symlinks restructuring the structure for original build sources
according to logs, some are still missing
probably generated during the build, and thus not existing in prep,
when the sources subpkg is created after patching
java-X-openjdk-portable must not be rebuilt for flatpaks, nor do we want
to rebuild tzdata for tzdata-java, so it will be added to the runtimes.
Therefore, we need to take into account the possibility of different
prefixes for those compared to java-X-openjdk.
The JDK build includes CDS archives, classes.jsa and classes_nocoops.jsa
already since JEP 341. Executing -Xshare:dump in the headless post
script breaks AppCDS workflows using dynamic dumps since that relies
on the base CDS archive from the JDK to be unchanged.
Removed many pre-steps, build requires and patching. Removed build.
added dependencies on portables
extracted portabels to BUILD
keep systemtap
todo, repack it properly
removed nss setup, enabled buildr and tuned "install"
check debuginfo for jre only
Print release
repacked portables
Remove javadoc.zip only for release build
