diff --git a/.gitignore b/.gitignore index caa7737..ed3b4a4 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,2 @@ -/openjdk-jdk17u-jdk-17.0.7+7.tar.xz -/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz +SOURCES/openjdk-21.0.1+12.tar.xz +SOURCES/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz diff --git a/.java-21-openjdk.metadata b/.java-21-openjdk.metadata new file mode 100644 index 0000000..a86ae45 --- /dev/null +++ b/.java-21-openjdk.metadata @@ -0,0 +1,2 @@ +062c60df2265006e2be6e2cec33b961d5183acd9 SOURCES/openjdk-21.0.1+12.tar.xz +c8281ee37b77d535c9c1af86609a531958ff7b34 SOURCES/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz diff --git a/CheckVendor.java b/SOURCES/CheckVendor.java similarity index 100% rename from CheckVendor.java rename to SOURCES/CheckVendor.java diff --git a/README.md b/SOURCES/README.md similarity index 51% rename from README.md rename to SOURCES/README.md index 8a2724b..cf5e219 100644 --- a/README.md +++ b/SOURCES/README.md @@ -1,14 +1,12 @@ -OpenJDK 17 is the latest Long-Term Support (LTS) release of the Java platform. +OpenJDK 21 is the latest Long-Term Support (LTS) release of the Java platform. -For a list of major changes from OpenJDK 11 (java-11-openjdk), see the upstream -release page for OpenJDK 17 and the preceding interim releases: +For a list of major changes from OpenJDK 17 (java-17-openjdk), see the upstream +release page for OpenJDK 21 and the preceding interim releases: -* 12: https://openjdk.java.net/projects/jdk/12/ -* 13: https://openjdk.java.net/projects/jdk/13/ -* 14: https://openjdk.java.net/projects/jdk/14/ -* 15: https://openjdk.java.net/projects/jdk/15/ -* 16: https://openjdk.java.net/projects/jdk/16/ -* 17: https://openjdk.java.net/projects/jdk/17/ +* 18: https://openjdk.java.net/projects/jdk/18/ +* 19: https://openjdk.java.net/projects/jdk/19/ +* 20: https://openjdk.java.net/projects/jdk/20/ +* 21: https://openjdk.java.net/projects/jdk/21/ # Rebuilding the OpenJDK package @@ -20,21 +18,21 @@ multiple builds which only differ by the platform they were built on. This does make rebuilding the package slightly more complicated than a normal package. Modifications should be made to the -`java-17-openjdk-portable.specfile` file, which can be found with this +`java-21-openjdk-portable.specfile` file, which can be found with this README file in the source RPM or installed in the documentation tree -by the `java-17-openjdk-headless` RPM. +by the `java-21-openjdk-headless` RPM. -Once the modified `java-17-openjdk-portable` RPMs are built, they +Once the modified `java-21-openjdk-portable` RPMs are built, they should be installed and will produce a number of tarballs in the -`/usr/lib/jvm` directory. The `java-17-openjdk` RPMs can then be +`/usr/lib/jvm` directory. The `java-21-openjdk` RPMs can then be built, which will use these tarballs to create the usual RPMs found in -RHEL. The `java-17-openjdk-portable` RPMs can be uninstalled once the +RHEL. The `java-21-openjdk-portable` RPMs can be uninstalled once the desired final RPMs are produced. -Note that the `java-17-openjdk.spec` file has a hard requirement on -the exact version of java-17-openjdk-portable to use, so this will +Note that the `java-21-openjdk.spec` file has a hard requirement on +the exact version of java-21-openjdk-portable to use, so this will need to be modified if the version or rpmrelease values are changed in -`java-17-openjdk-portable.specfile`. +`java-21-openjdk-portable.specfile`. To reduce the number of RPMs involved, the `fastdebug` and `slowdebug` builds may be disabled using `--without fastdebug` and `--without diff --git a/TestCryptoLevel.java b/SOURCES/TestCryptoLevel.java similarity index 100% rename from TestCryptoLevel.java rename to SOURCES/TestCryptoLevel.java diff --git a/TestECDSA.java b/SOURCES/TestECDSA.java similarity index 100% rename from TestECDSA.java rename to SOURCES/TestECDSA.java diff --git a/TestSecurityProperties.java b/SOURCES/TestSecurityProperties.java similarity index 100% rename from TestSecurityProperties.java rename to SOURCES/TestSecurityProperties.java diff --git a/TestTranslations.java b/SOURCES/TestTranslations.java similarity index 99% rename from TestTranslations.java rename to SOURCES/TestTranslations.java index d87647a..f6a4fe2 100644 --- a/TestTranslations.java +++ b/SOURCES/TestTranslations.java @@ -52,7 +52,7 @@ public class TestTranslations { map.put(Locale.FRANCE, new String[] { "heure normale des Rocheuses", "UTC\u221207:00", "MST", "heure d\u2019\u00e9t\u00e9 des Rocheuses", "UTC\u221206:00", "MDT", "heure des Rocheuses", "UTC\u221207:00", "MT"}); - map.put(Locale.GERMANY, new String[] { "Rocky Mountain-Normalzeit", "GMT-07:00", "MST", + map.put(Locale.GERMANY, new String[] { "Rocky-Mountain-Normalzeit", "GMT-07:00", "MST", "Rocky-Mountain-Sommerzeit", "GMT-06:00", "MDT", "Rocky-Mountain-Zeit", "GMT-07:00", "MT"}); CIUDAD_JUAREZ = Collections.unmodifiableMap(map); diff --git a/SOURCES/alt-java.c b/SOURCES/alt-java.c new file mode 100644 index 0000000..644d002 --- /dev/null +++ b/SOURCES/alt-java.c @@ -0,0 +1,100 @@ +/* + * Copyright (C) 2023 Red Hat, Inc. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as + * published by the Free Software Foundation. Red Hat designates this + * particular file as subject to the "Classpath" exception as provided + * by Red Hat in the LICENSE file that accompanied this code. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License + * version 2 for more details (a copy is included in the LICENSE file that + * accompanied this code). + * + * You should have received a copy of the GNU General Public License version + * 2 along with this work; if not, write to the Free Software Foundation, + * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. + * + */ + +#include +#include +#include +#include +#include +#include +#include +#include + +/* Per task speculation control */ +#ifndef PR_GET_SPECULATION_CTRL +# define PR_GET_SPECULATION_CTRL 52 +#endif +#ifndef PR_SET_SPECULATION_CTRL +# define PR_SET_SPECULATION_CTRL 53 +#endif +/* Speculation control variants */ +#ifndef PR_SPEC_STORE_BYPASS +# define PR_SPEC_STORE_BYPASS 0 +#endif +/* Return and control values for PR_SET/GET_SPECULATION_CTRL */ + +#ifndef PR_SPEC_NOT_AFFECTED +# define PR_SPEC_NOT_AFFECTED 0 +#endif +#ifndef PR_SPEC_PRCTL +# define PR_SPEC_PRCTL (1UL << 0) +#endif +#ifndef PR_SPEC_ENABLE +# define PR_SPEC_ENABLE (1UL << 1) +#endif +#ifndef PR_SPEC_DISABLE +# define PR_SPEC_DISABLE (1UL << 2) +#endif +#ifndef PR_SPEC_FORCE_DISABLE +# define PR_SPEC_FORCE_DISABLE (1UL << 3) +#endif +#ifndef PR_SPEC_DISABLE_NOEXEC +# define PR_SPEC_DISABLE_NOEXEC (1UL << 4) +#endif + +static void set_speculation() { +#if defined(__linux__) && defined(__x86_64__) + // PR_SPEC_DISABLE_NOEXEC doesn't survive execve, so we can't use it + // if ( prctl(PR_SET_SPECULATION_CTRL, + // PR_SPEC_STORE_BYPASS, + // PR_SPEC_DISABLE_NOEXEC, 0, 0) == 0 ) { + // return; + // } + prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0); +#else +#warning alt-java requested but SSB mitigation not available on this platform. +#endif +} + +int main(int argc, char **argv) { + set_speculation(); + + char our_name[PATH_MAX], java_name[PATH_MAX]; + ssize_t len = readlink("/proc/self/exe", our_name, PATH_MAX - 1); + if (len < 0) { + perror("I can't find myself"); + exit(2); + } + + our_name[len] = '\0'; // readlink(2) doesn't append a null byte + char *path = dirname(our_name); + strncpy(java_name, path, PATH_MAX - 1); + + size_t remaining_bytes = PATH_MAX - strlen(path) - 1; + strncat(java_name, "/java", remaining_bytes); + + execv(java_name, argv); + fprintf(stderr, "%s failed to launch: %s\n", java_name, strerror(errno)); + + exit(1); +} + diff --git a/fips-17u-bf363eecce3.patch b/SOURCES/fips-21u-75ffdc48eda.patch similarity index 55% rename from fips-17u-bf363eecce3.patch rename to SOURCES/fips-21u-75ffdc48eda.patch index cd8565c..8413fe1 100644 --- a/fips-17u-bf363eecce3.patch +++ b/SOURCES/fips-21u-75ffdc48eda.patch @@ -116,30 +116,30 @@ index 00000000000..f48fc7f7e80 + AC_SUBST(NSS_LIBDIR) +]) diff --git a/make/autoconf/libraries.m4 b/make/autoconf/libraries.m4 -index a65d91ee974..a8f054c1397 100644 +index a1fc81564b1..ebad69d9dcf 100644 --- a/make/autoconf/libraries.m4 +++ b/make/autoconf/libraries.m4 -@@ -33,6 +33,7 @@ m4_include([lib-std.m4]) +@@ -35,6 +35,7 @@ m4_include([lib-std.m4]) m4_include([lib-x11.m4]) - m4_include([lib-fontconfig.m4]) + m4_include([lib-tests.m4]) +m4_include([lib-sysconf.m4]) ################################################################################ # Determine which libraries are needed for this configuration -@@ -104,6 +105,7 @@ AC_DEFUN_ONCE([LIB_SETUP_LIBRARIES], - LIB_SETUP_BUNDLED_LIBS - LIB_SETUP_MISC_LIBS +@@ -134,6 +135,7 @@ AC_DEFUN_ONCE([LIB_SETUP_LIBRARIES], + LIB_SETUP_X11 + LIB_TESTS_SETUP_GTEST + LIB_SETUP_SYSCONF_LIBS BASIC_JDKLIB_LIBS="" - if test "x$TOOLCHAIN_TYPE" != xmicrosoft; then + BASIC_JDKLIB_LIBS_TARGET="" diff --git a/make/autoconf/spec.gmk.in b/make/autoconf/spec.gmk.in -index 537c3e3043c..16ad3df6f09 100644 +index 0f85917814e..9419562b654 100644 --- a/make/autoconf/spec.gmk.in +++ b/make/autoconf/spec.gmk.in -@@ -841,6 +841,11 @@ INSTALL_SYSCONFDIR=@sysconfdir@ +@@ -867,6 +867,11 @@ INSTALL_SYSCONFDIR=@sysconfdir@ # Libraries # @@ -152,7 +152,7 @@ index 537c3e3043c..16ad3df6f09 100644 LCMS_CFLAGS:=@LCMS_CFLAGS@ LCMS_LIBS:=@LCMS_LIBS@ diff --git a/make/modules/java.base/Gendata.gmk b/make/modules/java.base/Gendata.gmk -index 4b894eeae4a..51567071aa8 100644 +index 9e5cfe2d0fc..434ade8e182 100644 --- a/make/modules/java.base/Gendata.gmk +++ b/make/modules/java.base/Gendata.gmk @@ -98,3 +98,17 @@ $(GENDATA_JAVA_SECURITY): $(BUILD_TOOLS_JDK) $(GENDATA_JAVA_SECURITY_SRC) $(REST @@ -174,10 +174,10 @@ index 4b894eeae4a..51567071aa8 100644 + +################################################################################ diff --git a/make/modules/java.base/Lib.gmk b/make/modules/java.base/Lib.gmk -index 5658ff342e5..c8bc5bde1e1 100644 +index 1e0f66726d0..59fe923f2c5 100644 --- a/make/modules/java.base/Lib.gmk +++ b/make/modules/java.base/Lib.gmk -@@ -167,6 +167,29 @@ ifeq ($(call isTargetOsType, unix), true) +@@ -163,6 +163,29 @@ ifeq ($(call isTargetOsType, unix), true) endif endif @@ -207,312 +207,8 @@ index 5658ff342e5..c8bc5bde1e1 100644 ################################################################################ # Create the symbols file for static builds. -diff --git a/src/java.base/share/classes/com/sun/crypto/provider/HmacPKCS12PBECore.java b/src/java.base/share/classes/com/sun/crypto/provider/HmacPKCS12PBECore.java -index 1fd6230d83b..683e3dd3a8d 100644 ---- a/src/java.base/share/classes/com/sun/crypto/provider/HmacPKCS12PBECore.java -+++ b/src/java.base/share/classes/com/sun/crypto/provider/HmacPKCS12PBECore.java -@@ -25,13 +25,12 @@ - - package com.sun.crypto.provider; - --import java.util.Arrays; -- - import javax.crypto.SecretKey; - import javax.crypto.spec.SecretKeySpec; --import javax.crypto.spec.PBEParameterSpec; -+import javax.crypto.spec.PBEKeySpec; - import java.security.*; - import java.security.spec.*; -+import sun.security.util.PBEUtil; - - /** - * This is an implementation of the HMAC algorithms as defined -@@ -108,79 +107,15 @@ abstract class HmacPKCS12PBECore extends HmacCore { - */ - protected void engineInit(Key key, AlgorithmParameterSpec params) - throws InvalidKeyException, InvalidAlgorithmParameterException { -- char[] passwdChars; -- byte[] salt = null; -- int iCount = 0; -- if (key instanceof javax.crypto.interfaces.PBEKey) { -- javax.crypto.interfaces.PBEKey pbeKey = -- (javax.crypto.interfaces.PBEKey) key; -- passwdChars = pbeKey.getPassword(); -- salt = pbeKey.getSalt(); // maybe null if unspecified -- iCount = pbeKey.getIterationCount(); // maybe 0 if unspecified -- } else if (key instanceof SecretKey) { -- byte[] passwdBytes; -- if (!(key.getAlgorithm().regionMatches(true, 0, "PBE", 0, 3)) || -- (passwdBytes = key.getEncoded()) == null) { -- throw new InvalidKeyException("Missing password"); -- } -- passwdChars = new char[passwdBytes.length]; -- for (int i=0; i attrs = new HashMap<>(3); @@ -742,6 +438,13 @@ index a020e1c15d8..3c064965e82 100644 - ps("Cipher", "PBEWithHmacSHA512AndAES_128", - "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_128"); - +- ps("Cipher", "PBEWithHmacSHA512/224AndAES_128", +- "com.sun.crypto.provider.PBES2Core$HmacSHA512_224AndAES_128"); +- +- ps("Cipher", "PBEWithHmacSHA512/256AndAES_128", +- "com.sun.crypto.provider.PBES2Core$HmacSHA512_256AndAES_128"); +- +- - ps("Cipher", "PBEWithHmacSHA1AndAES_256", - "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_256"); - @@ -757,6 +460,12 @@ index a020e1c15d8..3c064965e82 100644 - ps("Cipher", "PBEWithHmacSHA512AndAES_256", - "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_256"); - +- ps("Cipher", "PBEWithHmacSHA512/224AndAES_256", +- "com.sun.crypto.provider.PBES2Core$HmacSHA512_224AndAES_256"); +- +- ps("Cipher", "PBEWithHmacSHA512/256AndAES_256", +- "com.sun.crypto.provider.PBES2Core$HmacSHA512_256AndAES_256"); +- - /* - * Key(pair) Generator engines - */ @@ -1022,6 +731,12 @@ index a020e1c15d8..3c064965e82 100644 + ps("Cipher", "PBEWithHmacSHA512AndAES_128", + "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_128"); + ++ ps("Cipher", "PBEWithHmacSHA512/224AndAES_128", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA512_224AndAES_128"); ++ ++ ps("Cipher", "PBEWithHmacSHA512/256AndAES_128", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA512_256AndAES_128"); ++ + ps("Cipher", "PBEWithHmacSHA1AndAES_256", + "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_256"); + @@ -1037,6 +752,12 @@ index a020e1c15d8..3c064965e82 100644 + ps("Cipher", "PBEWithHmacSHA512AndAES_256", + "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_256"); + ++ ps("Cipher", "PBEWithHmacSHA512/224AndAES_256", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA512_224AndAES_256"); ++ ++ ps("Cipher", "PBEWithHmacSHA512/256AndAES_256", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA512_256AndAES_256"); ++ + /* + * Key(pair) Generator engines + */ @@ -1101,7 +822,7 @@ index a020e1c15d8..3c064965e82 100644 /* * Algorithm parameter generation engines -@@ -430,15 +437,17 @@ public final class SunJCE extends Provider { +@@ -447,15 +453,17 @@ public final class SunJCE extends Provider { "DiffieHellman", "com.sun.crypto.provider.DHParameterGenerator", null); @@ -1128,9 +849,22 @@ index a020e1c15d8..3c064965e82 100644 /* * Algorithm Parameter engines -@@ -610,118 +619,120 @@ public final class SunJCE extends Provider { - ps("SecretKeyFactory", "PBEWithHmacSHA512AndAES_256", - "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512AndAES_256"); +@@ -625,10 +633,10 @@ public final class SunJCE extends Provider { + "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512AndAES_128"); + + ps("SecretKeyFactory", "PBEWithHmacSHA512/224AndAES_128", +- "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_224AndAES_128"); ++ "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_224AndAES_128"); + + ps("SecretKeyFactory", "PBEWithHmacSHA512/256AndAES_128", +- "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_256AndAES_128"); ++ "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_256AndAES_128"); + + ps("SecretKeyFactory", "PBEWithHmacSHA1AndAES_256", + "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA1AndAES_256"); +@@ -651,136 +659,137 @@ public final class SunJCE extends Provider { + ps("SecretKeyFactory", "PBEWithHmacSHA512/256AndAES_256", + "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_256AndAES_256"); - // PBKDF2 - psA("SecretKeyFactory", "PBKDF2WithHmacSHA1", @@ -1144,6 +878,10 @@ index a020e1c15d8..3c064965e82 100644 - "com.sun.crypto.provider.PBKDF2Core$HmacSHA384"); - ps("SecretKeyFactory", "PBKDF2WithHmacSHA512", - "com.sun.crypto.provider.PBKDF2Core$HmacSHA512"); +- ps("SecretKeyFactory", "PBKDF2WithHmacSHA512/224", +- "com.sun.crypto.provider.PBKDF2Core$HmacSHA512_224"); +- ps("SecretKeyFactory", "PBKDF2WithHmacSHA512/256", +- "com.sun.crypto.provider.PBKDF2Core$HmacSHA512_256"); - - /* - * MAC @@ -1208,6 +946,11 @@ index a020e1c15d8..3c064965e82 100644 - "com.sun.crypto.provider.PBMAC1Core$HmacSHA384", null, attrs); - ps("Mac", "PBEWithHmacSHA512", - "com.sun.crypto.provider.PBMAC1Core$HmacSHA512", null, attrs); +- ps("Mac", "PBEWithHmacSHA512/224", +- "com.sun.crypto.provider.PBMAC1Core$HmacSHA512_224", null, attrs); +- ps("Mac", "PBEWithHmacSHA512/256", +- "com.sun.crypto.provider.PBMAC1Core$HmacSHA512_256", null, attrs); +- - ps("Mac", "SslMacMD5", - "com.sun.crypto.provider.SslMacCore$SslMacMD5", null, attrs); - ps("Mac", "SslMacSHA1", @@ -1220,6 +963,15 @@ index a020e1c15d8..3c064965e82 100644 - "com.sun.crypto.provider.JceKeyStore"); - - /* +- * KEMs +- */ +- attrs.clear(); +- attrs.put("ImplementedIn", "Software"); +- attrs.put("SupportedKeyClasses", "java.security.interfaces.ECKey" + +- "|java.security.interfaces.XECKey"); +- ps("KEM", "DHKEM", "com.sun.crypto.provider.DHKEM", null, attrs); +- +- /* - * SSL/TLS mechanisms - * - * These are strictly internal implementations and may @@ -1257,6 +1009,10 @@ index a020e1c15d8..3c064965e82 100644 + "com.sun.crypto.provider.PBKDF2Core$HmacSHA384"); + ps("SecretKeyFactory", "PBKDF2WithHmacSHA512", + "com.sun.crypto.provider.PBKDF2Core$HmacSHA512"); ++ ps("SecretKeyFactory", "PBKDF2WithHmacSHA512/224", ++ "com.sun.crypto.provider.PBKDF2Core$HmacSHA512_224"); ++ ps("SecretKeyFactory", "PBKDF2WithHmacSHA512/256", ++ "com.sun.crypto.provider.PBKDF2Core$HmacSHA512_256"); + + /* + * MAC @@ -1309,7 +1065,6 @@ index a020e1c15d8..3c064965e82 100644 + "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512_256", + null, attrs); + -+ + // PBMAC1 + ps("Mac", "PBEWithHmacSHA1", + "com.sun.crypto.provider.PBMAC1Core$HmacSHA1", null, attrs); @@ -1321,6 +1076,11 @@ index a020e1c15d8..3c064965e82 100644 + "com.sun.crypto.provider.PBMAC1Core$HmacSHA384", null, attrs); + ps("Mac", "PBEWithHmacSHA512", + "com.sun.crypto.provider.PBMAC1Core$HmacSHA512", null, attrs); ++ ps("Mac", "PBEWithHmacSHA512/224", ++ "com.sun.crypto.provider.PBMAC1Core$HmacSHA512_224", null, attrs); ++ ps("Mac", "PBEWithHmacSHA512/256", ++ "com.sun.crypto.provider.PBMAC1Core$HmacSHA512_256", null, attrs); ++ + ps("Mac", "SslMacMD5", + "com.sun.crypto.provider.SslMacCore$SslMacMD5", null, attrs); + ps("Mac", "SslMacSHA1", @@ -1333,6 +1093,15 @@ index a020e1c15d8..3c064965e82 100644 + "com.sun.crypto.provider.JceKeyStore"); + + /* ++ * KEMs ++ */ ++ attrs.clear(); ++ attrs.put("ImplementedIn", "Software"); ++ attrs.put("SupportedKeyClasses", "java.security.interfaces.ECKey" + ++ "|java.security.interfaces.XECKey"); ++ ps("KEM", "DHKEM", "com.sun.crypto.provider.DHKEM", null, attrs); ++ ++ /* + * SSL/TLS mechanisms + * + * These are strictly internal implementations and may @@ -1362,10 +1131,10 @@ index a020e1c15d8..3c064965e82 100644 // Return the instance of this class or create one if needed. diff --git a/src/java.base/share/classes/java/security/Security.java b/src/java.base/share/classes/java/security/Security.java -index 2477027969c..06b1b6c671c 100644 +index 671529f71a1..af632936921 100644 --- a/src/java.base/share/classes/java/security/Security.java +++ b/src/java.base/share/classes/java/security/Security.java -@@ -33,6 +33,7 @@ import java.net.URL; +@@ -34,6 +34,7 @@ import java.net.URL; import jdk.internal.access.JavaSecurityPropertiesAccess; import jdk.internal.event.EventHelper; import jdk.internal.event.SecurityPropertyModificationEvent; @@ -1373,7 +1142,7 @@ index 2477027969c..06b1b6c671c 100644 import jdk.internal.access.SharedSecrets; import jdk.internal.util.StaticProperty; import sun.security.util.Debug; -@@ -57,6 +58,11 @@ import sun.security.jca.*; +@@ -58,6 +59,11 @@ import sun.security.jca.*; public final class Security { @@ -1385,7 +1154,7 @@ index 2477027969c..06b1b6c671c 100644 /* Are we debugging? -- for developers */ private static final Debug sdebug = Debug.getInstance("properties"); -@@ -74,6 +80,19 @@ public final class Security { +@@ -75,6 +81,19 @@ public final class Security { } static { @@ -1405,7 +1174,7 @@ index 2477027969c..06b1b6c671c 100644 // doPrivileged here because there are multiple // things in initialize that might require privs. // (the FileInputStream call and the File.exists call, -@@ -97,6 +116,7 @@ public final class Security { +@@ -96,6 +115,7 @@ public final class Security { private static void initialize() { props = new Properties(); boolean overrideAll = false; @@ -1413,7 +1182,7 @@ index 2477027969c..06b1b6c671c 100644 // first load the system properties file // to determine the value of security.overridePropertiesFile -@@ -117,6 +137,60 @@ public final class Security { +@@ -116,6 +136,61 @@ public final class Security { } loadProps(null, extraPropFile, overrideAll); } @@ -1471,14 +1240,12 @@ index 2477027969c..06b1b6c671c 100644 + "system security properties being enabled."); + } + } ++ initialSecurityProperties = (Properties) props.clone(); if (sdebug != null) { for (String key : props.stringPropertyNames()) { -@@ -124,10 +198,9 @@ public final class Security { - props.getProperty(key)); - } - } -- +@@ -126,7 +201,7 @@ public final class Security { + } - private static boolean loadProps(File masterFile, String extraPropFile, boolean overrideAll) { @@ -1762,26 +1529,26 @@ index 00000000000..3f3caac64dc + boolean isPlainKeySupportEnabled(); +} diff --git a/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java b/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java -index ea28bb8747e..77161eb3844 100644 +index 919d758a6e3..b1e5fbaf84a 100644 --- a/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java +++ b/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java -@@ -40,6 +40,7 @@ import java.io.FilePermission; - import java.io.ObjectInputStream; +@@ -43,6 +43,7 @@ import java.io.PrintStream; + import java.io.PrintWriter; import java.io.RandomAccessFile; import java.security.ProtectionDomain; +import java.security.Security; import java.security.Signature; /** A repository of "shared secrets", which are a mechanism for -@@ -83,6 +84,7 @@ public class SharedSecrets { - private static JavaSecuritySpecAccess javaSecuritySpecAccess; +@@ -90,6 +91,7 @@ public class SharedSecrets { private static JavaxCryptoSealedObjectAccess javaxCryptoSealedObjectAccess; private static JavaxCryptoSpecAccess javaxCryptoSpecAccess; + private static JavaTemplateAccess javaTemplateAccess; + private static JavaSecuritySystemConfiguratorAccess javaSecuritySystemConfiguratorAccess; public static void setJavaUtilCollectionAccess(JavaUtilCollectionAccess juca) { javaUtilCollectionAccess = juca; -@@ -457,4 +459,15 @@ public class SharedSecrets { +@@ -537,4 +539,15 @@ public class SharedSecrets { MethodHandles.lookup().ensureInitialized(c); } catch (IllegalAccessException e) {} } @@ -1798,31 +1565,30 @@ index ea28bb8747e..77161eb3844 100644 + } } diff --git a/src/java.base/share/classes/module-info.java b/src/java.base/share/classes/module-info.java -index fad70bdc058..29a813a485f 100644 +index 06b141dcf22..e8cbf7f15d7 100644 --- a/src/java.base/share/classes/module-info.java +++ b/src/java.base/share/classes/module-info.java -@@ -152,6 +152,8 @@ module java.base { +@@ -158,6 +158,7 @@ module java.base { java.naming, java.rmi, jdk.charsets, -+ jdk.crypto.cryptoki, + jdk.crypto.ec, jdk.jartool, jdk.jlink, jdk.jfr, diff --git a/src/java.base/share/classes/sun/security/provider/SunEntries.java b/src/java.base/share/classes/sun/security/provider/SunEntries.java -index 912cad59714..7803e97f7ef 100644 +index f036a411f1d..1e9de933bd9 100644 --- a/src/java.base/share/classes/sun/security/provider/SunEntries.java +++ b/src/java.base/share/classes/sun/security/provider/SunEntries.java -@@ -30,6 +30,7 @@ import java.net.*; - import java.util.*; - import java.security.*; +@@ -38,6 +38,7 @@ import java.util.HashMap; + import java.util.Iterator; + import java.util.LinkedHashSet; +import jdk.internal.access.SharedSecrets; import jdk.internal.util.StaticProperty; - import sun.security.action.GetPropertyAction; - import sun.security.util.SecurityProviderConstants; -@@ -83,6 +84,10 @@ import static sun.security.util.SecurityProviderConstants.getAliases; + import sun.security.action.GetBooleanAction; + +@@ -91,6 +92,10 @@ import static sun.security.util.SecurityProviderConstants.getAliases; public final class SunEntries { @@ -1833,7 +1599,7 @@ index 912cad59714..7803e97f7ef 100644 // the default algo used by SecureRandom class for new SecureRandom() calls public static final String DEF_SECURE_RANDOM_ALGO; -@@ -94,89 +99,92 @@ public final class SunEntries { +@@ -102,89 +107,92 @@ public final class SunEntries { // common attribute map HashMap attrs = new HashMap<>(3); @@ -1982,7 +1748,6 @@ index 912cad59714..7803e97f7ef 100644 + "sun.security.provider.DSA$SHA3_384withDSAinP1363Format"); + add(p, "Signature", "SHA3-512withDSAinP1363Format", + "sun.security.provider.DSA$SHA3_512withDSAinP1363Format"); -+ } - add(p, "Signature", "SHA1withDSAinP1363Format", - "sun.security.provider.DSA$SHA1withDSAinP1363Format"); @@ -2004,10 +1769,11 @@ index 912cad59714..7803e97f7ef 100644 - "sun.security.provider.DSA$SHA3_384withDSAinP1363Format"); - add(p, "Signature", "SHA3-512withDSAinP1363Format", - "sun.security.provider.DSA$SHA3_512withDSAinP1363Format"); - /* - * Key Pair Generator engines - */ -@@ -184,9 +192,11 @@ public final class SunEntries { ++ } + + attrs.clear(); + attrs.put("ImplementedIn", "Software"); +@@ -196,9 +204,11 @@ public final class SunEntries { attrs.put("ImplementedIn", "Software"); attrs.put("KeySize", "2048"); // for DSA KPG and APG only @@ -2022,7 +1788,7 @@ index 912cad59714..7803e97f7ef 100644 /* * Algorithm Parameter Generator engines -@@ -201,40 +211,42 @@ public final class SunEntries { +@@ -213,44 +223,46 @@ public final class SunEntries { addWithAlias(p, "AlgorithmParameters", "DSA", "sun.security.provider.DSAParameters", attrs); @@ -2031,12 +1797,16 @@ index 912cad59714..7803e97f7ef 100644 - */ - addWithAlias(p, "KeyFactory", "DSA", - "sun.security.provider.DSAKeyFactory", attrs); +- addWithAlias(p, "KeyFactory", "HSS/LMS", +- "sun.security.provider.HSS$KeyFactoryImpl", attrs); - - /* - * Digest engines - */ -- add(p, "MessageDigest", "MD2", "sun.security.provider.MD2", attrs); -- add(p, "MessageDigest", "MD5", "sun.security.provider.MD5", attrs); +- addWithAlias(p, "MessageDigest", "MD2", "sun.security.provider.MD2", +- attrs); +- addWithAlias(p, "MessageDigest", "MD5", "sun.security.provider.MD5", +- attrs); - addWithAlias(p, "MessageDigest", "SHA-1", "sun.security.provider.SHA", - attrs); + if (!systemFipsEnabled) { @@ -2045,6 +1815,8 @@ index 912cad59714..7803e97f7ef 100644 + */ + addWithAlias(p, "KeyFactory", "DSA", + "sun.security.provider.DSAKeyFactory", attrs); ++ addWithAlias(p, "KeyFactory", "HSS/LMS", ++ "sun.security.provider.HSS$KeyFactoryImpl", attrs); - addWithAlias(p, "MessageDigest", "SHA-224", - "sun.security.provider.SHA2$SHA224", attrs); @@ -2069,10 +1841,12 @@ index 912cad59714..7803e97f7ef 100644 + /* + * Digest engines + */ -+ add(p, "MessageDigest", "MD2", "sun.security.provider.MD2", attrs); -+ add(p, "MessageDigest", "MD5", "sun.security.provider.MD5", attrs); ++ addWithAlias(p, "MessageDigest", "MD2", "sun.security.provider.MD2", ++ attrs); ++ addWithAlias(p, "MessageDigest", "MD5", "sun.security.provider.MD5", ++ attrs); + addWithAlias(p, "MessageDigest", "SHA-1", "sun.security.provider.SHA", -+ attrs); ++ attrs); + + addWithAlias(p, "MessageDigest", "SHA-224", + "sun.security.provider.SHA2$SHA224", attrs); @@ -2099,7 +1873,7 @@ index 912cad59714..7803e97f7ef 100644 /* * Certificates diff --git a/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java b/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java -index ca79f25cc44..a12fcbbd6e7 100644 +index 539ef1e8ee8..435f57e3ff2 100644 --- a/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java +++ b/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java @@ -27,6 +27,7 @@ package sun.security.rsa; @@ -2204,314 +1978,11 @@ index ca79f25cc44..a12fcbbd6e7 100644 addA(p, "AlgorithmParameters", "RSASSA-PSS", "sun.security.rsa.PSSParameters", null); } -diff --git a/src/java.base/share/classes/sun/security/util/PBEUtil.java b/src/java.base/share/classes/sun/security/util/PBEUtil.java -new file mode 100644 -index 00000000000..dc8bc72fccb ---- /dev/null -+++ b/src/java.base/share/classes/sun/security/util/PBEUtil.java -@@ -0,0 +1,297 @@ -+/* -+ * Copyright (c) 2022, Red Hat, Inc. -+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. -+ * -+ * This code is free software; you can redistribute it and/or modify it -+ * under the terms of the GNU General Public License version 2 only, as -+ * published by the Free Software Foundation. Oracle designates this -+ * particular file as subject to the "Classpath" exception as provided -+ * by Oracle in the LICENSE file that accompanied this code. -+ * -+ * This code is distributed in the hope that it will be useful, but WITHOUT -+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -+ * version 2 for more details (a copy is included in the LICENSE file that -+ * accompanied this code). -+ * -+ * You should have received a copy of the GNU General Public License version -+ * 2 along with this work; if not, write to the Free Software Foundation, -+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. -+ * -+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA -+ * or visit www.oracle.com if you need additional information or have any -+ * questions. -+ */ -+ -+package sun.security.util; -+ -+import java.security.AlgorithmParameters; -+import java.security.InvalidAlgorithmParameterException; -+import java.security.InvalidKeyException; -+import java.security.Key; -+import java.security.NoSuchAlgorithmException; -+import java.security.Provider; -+import java.security.SecureRandom; -+import java.security.spec.AlgorithmParameterSpec; -+import java.security.spec.InvalidParameterSpecException; -+import java.util.Arrays; -+import javax.crypto.Cipher; -+import javax.crypto.SecretKey; -+import javax.crypto.spec.IvParameterSpec; -+import javax.crypto.spec.PBEKeySpec; -+import javax.crypto.spec.PBEParameterSpec; -+ -+public final class PBEUtil { -+ -+ // Used by SunJCE and SunPKCS11 -+ public final static class PBES2Helper { -+ private int iCount; -+ private byte[] salt; -+ private IvParameterSpec ivSpec; -+ private final int defaultSaltLength; -+ private final int defaultCount; -+ -+ public PBES2Helper(int defaultSaltLength, int defaultCount) { -+ this.defaultSaltLength = defaultSaltLength; -+ this.defaultCount = defaultCount; -+ } -+ -+ public IvParameterSpec getIvSpec() { -+ return ivSpec; -+ } -+ -+ public AlgorithmParameters getAlgorithmParameters( -+ int blkSize, String pbeAlgo, Provider p, SecureRandom random) { -+ AlgorithmParameters params = null; -+ if (salt == null) { -+ // generate random salt and use default iteration count -+ salt = new byte[defaultSaltLength]; -+ random.nextBytes(salt); -+ iCount = defaultCount; -+ } -+ if (ivSpec == null) { -+ // generate random IV -+ byte[] ivBytes = new byte[blkSize]; -+ random.nextBytes(ivBytes); -+ ivSpec = new IvParameterSpec(ivBytes); -+ } -+ PBEParameterSpec pbeSpec = new PBEParameterSpec( -+ salt, iCount, ivSpec); -+ try { -+ params = (p == null) ? -+ AlgorithmParameters.getInstance(pbeAlgo) : -+ AlgorithmParameters.getInstance(pbeAlgo, p); -+ params.init(pbeSpec); -+ } catch (NoSuchAlgorithmException nsae) { -+ // should never happen -+ throw new RuntimeException("AlgorithmParameters for " -+ + pbeAlgo + " not configured"); -+ } catch (InvalidParameterSpecException ipse) { -+ // should never happen -+ throw new RuntimeException("PBEParameterSpec not supported"); -+ } -+ return params; -+ } -+ -+ public PBEKeySpec getPBEKeySpec( -+ int blkSize, int keyLength, int opmode, Key key, -+ AlgorithmParameterSpec params, SecureRandom random) -+ throws InvalidKeyException, InvalidAlgorithmParameterException { -+ -+ if (key == null) { -+ throw new InvalidKeyException("Null key"); -+ } -+ -+ byte[] passwdBytes = key.getEncoded(); -+ char[] passwdChars = null; -+ PBEKeySpec pbeSpec; -+ try { -+ if ((passwdBytes == null) || !(key.getAlgorithm().regionMatches( -+ true, 0, "PBE", 0, 3))) { -+ throw new InvalidKeyException("Missing password"); -+ } -+ -+ // TBD: consolidate the salt, ic and IV parameter checks below -+ -+ // Extract salt and iteration count from the key, if present -+ if (key instanceof javax.crypto.interfaces.PBEKey) { -+ salt = ((javax.crypto.interfaces.PBEKey)key).getSalt(); -+ if (salt != null && salt.length < 8) { -+ throw new InvalidAlgorithmParameterException( -+ "Salt must be at least 8 bytes long"); -+ } -+ iCount = ((javax.crypto.interfaces.PBEKey)key) -+ .getIterationCount(); -+ if (iCount == 0) { -+ iCount = defaultCount; -+ } else if (iCount < 0) { -+ throw new InvalidAlgorithmParameterException( -+ "Iteration count must be a positive number"); -+ } -+ } -+ -+ // Extract salt, iteration count and IV from the params, -+ // if present -+ if (params == null) { -+ if (salt == null) { -+ // generate random salt and use default iteration count -+ salt = new byte[defaultSaltLength]; -+ random.nextBytes(salt); -+ iCount = defaultCount; -+ } -+ if ((opmode == Cipher.ENCRYPT_MODE) || -+ (opmode == Cipher.WRAP_MODE)) { -+ // generate random IV -+ byte[] ivBytes = new byte[blkSize]; -+ random.nextBytes(ivBytes); -+ ivSpec = new IvParameterSpec(ivBytes); -+ } -+ } else { -+ if (!(params instanceof PBEParameterSpec)) { -+ throw new InvalidAlgorithmParameterException -+ ("Wrong parameter type: PBE expected"); -+ } -+ // salt and iteration count from the params take precedence -+ byte[] specSalt = ((PBEParameterSpec) params).getSalt(); -+ if (specSalt != null && specSalt.length < 8) { -+ throw new InvalidAlgorithmParameterException( -+ "Salt must be at least 8 bytes long"); -+ } -+ salt = specSalt; -+ int specICount = ((PBEParameterSpec) params) -+ .getIterationCount(); -+ if (specICount == 0) { -+ specICount = defaultCount; -+ } else if (specICount < 0) { -+ throw new InvalidAlgorithmParameterException( -+ "Iteration count must be a positive number"); -+ } -+ iCount = specICount; -+ -+ AlgorithmParameterSpec specParams = -+ ((PBEParameterSpec) params).getParameterSpec(); -+ if (specParams != null) { -+ if (specParams instanceof IvParameterSpec) { -+ ivSpec = (IvParameterSpec)specParams; -+ } else { -+ throw new InvalidAlgorithmParameterException( -+ "Wrong parameter type: IV expected"); -+ } -+ } else if ((opmode == Cipher.ENCRYPT_MODE) || -+ (opmode == Cipher.WRAP_MODE)) { -+ // generate random IV -+ byte[] ivBytes = new byte[blkSize]; -+ random.nextBytes(ivBytes); -+ ivSpec = new IvParameterSpec(ivBytes); -+ } else { -+ throw new InvalidAlgorithmParameterException( -+ "Missing parameter type: IV expected"); -+ } -+ } -+ -+ passwdChars = new char[passwdBytes.length]; -+ for (int i = 0; i < passwdChars.length; i++) -+ passwdChars[i] = (char) (passwdBytes[i] & 0x7f); -+ -+ pbeSpec = new PBEKeySpec(passwdChars, salt, iCount, keyLength); -+ // password char[] was cloned in PBEKeySpec constructor, -+ // so we can zero it out here -+ } finally { -+ if (passwdChars != null) Arrays.fill(passwdChars, '\0'); -+ if (passwdBytes != null) Arrays.fill(passwdBytes, (byte)0x00); -+ } -+ return pbeSpec; -+ } -+ -+ public static AlgorithmParameterSpec getParameterSpec( -+ AlgorithmParameters params) -+ throws InvalidAlgorithmParameterException { -+ AlgorithmParameterSpec pbeSpec = null; -+ if (params != null) { -+ try { -+ pbeSpec = params.getParameterSpec(PBEParameterSpec.class); -+ } catch (InvalidParameterSpecException ipse) { -+ throw new InvalidAlgorithmParameterException( -+ "Wrong parameter type: PBE expected"); -+ } -+ } -+ return pbeSpec; -+ } -+ } -+ -+ // Used by SunJCE and SunPKCS11 -+ public static PBEKeySpec getPBAKeySpec(Key key, AlgorithmParameterSpec params) -+ throws InvalidKeyException, InvalidAlgorithmParameterException { -+ char[] passwdChars; -+ byte[] salt = null; -+ int iCount = 0; -+ if (key instanceof javax.crypto.interfaces.PBEKey) { -+ javax.crypto.interfaces.PBEKey pbeKey = -+ (javax.crypto.interfaces.PBEKey) key; -+ passwdChars = pbeKey.getPassword(); -+ salt = pbeKey.getSalt(); // maybe null if unspecified -+ iCount = pbeKey.getIterationCount(); // maybe 0 if unspecified -+ } else if (key instanceof SecretKey) { -+ byte[] passwdBytes; -+ if (!(key.getAlgorithm().regionMatches(true, 0, "PBE", 0, 3)) || -+ (passwdBytes = key.getEncoded()) == null) { -+ throw new InvalidKeyException("Missing password"); -+ } -+ passwdChars = new char[passwdBytes.length]; -+ for (int i=0; i P11RSAPrivateKeyInternal.of(session, keyID, algorithm, +@@ -454,7 +461,8 @@ abstract class P11Key implements Key, Length { + public String getFormat() { token.ensureValid(); -- if (sensitive || (extractable == false)) { +- if (sensitive || !extractable || (isNSS && tokenObject)) { + if (!plainKeySupportEnabled && -+ (sensitive || (extractable == false))) { ++ (sensitive || !extractable || (isNSS && tokenObject))) { return null; } else { return "RAW"; -diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Mac.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Mac.java -index ba0b7faf3f8..4840a116b34 100644 ---- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Mac.java -+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Mac.java -@@ -29,14 +29,17 @@ import java.nio.ByteBuffer; - - import java.security.*; - import java.security.spec.AlgorithmParameterSpec; -+import java.security.spec.InvalidKeySpecException; - - import javax.crypto.MacSpi; -+import javax.crypto.spec.PBEKeySpec; - - import sun.nio.ch.DirectBuffer; - - import sun.security.pkcs11.wrapper.*; - import static sun.security.pkcs11.wrapper.PKCS11Constants.*; - import static sun.security.pkcs11.wrapper.PKCS11Exception.*; -+import sun.security.util.PBEUtil; - - /** - * MAC implementation class. This class currently supports HMAC using -@@ -202,12 +205,23 @@ final class P11Mac extends MacSpi { - // see JCE spec - protected void engineInit(Key key, AlgorithmParameterSpec params) - throws InvalidKeyException, InvalidAlgorithmParameterException { -- if (params != null) { -- throw new InvalidAlgorithmParameterException -- ("Parameters not supported"); -+ if (algorithm.startsWith("HmacPBE")) { -+ PBEKeySpec pbeSpec = PBEUtil.getPBAKeySpec(key, params); -+ reset(true); -+ try { -+ p11Key = P11SecretKeyFactory.derivePBEKey( -+ token, pbeSpec, algorithm); -+ } catch (InvalidKeySpecException e) { -+ throw new InvalidKeyException(e); -+ } -+ } else { -+ if (params != null) { -+ throw new InvalidAlgorithmParameterException -+ ("Parameters not supported"); -+ } -+ reset(true); -+ p11Key = P11SecretKeyFactory.convertKey(token, key, algorithm); - } -- reset(true); -- p11Key = P11SecretKeyFactory.convertKey(token, key, algorithm); - try { - initialize(); - } catch (PKCS11Exception e) { -diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11PBECipher.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11PBECipher.java -new file mode 100644 -index 00000000000..ae4262703e6 ---- /dev/null -+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11PBECipher.java -@@ -0,0 +1,200 @@ -+/* -+ * Copyright (c) 2022, Red Hat, Inc. -+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. -+ * -+ * This code is free software; you can redistribute it and/or modify it -+ * under the terms of the GNU General Public License version 2 only, as -+ * published by the Free Software Foundation. Oracle designates this -+ * particular file as subject to the "Classpath" exception as provided -+ * by Oracle in the LICENSE file that accompanied this code. -+ * -+ * This code is distributed in the hope that it will be useful, but WITHOUT -+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -+ * version 2 for more details (a copy is included in the LICENSE file that -+ * accompanied this code). -+ * -+ * You should have received a copy of the GNU General Public License version -+ * 2 along with this work; if not, write to the Free Software Foundation, -+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. -+ * -+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA -+ * or visit www.oracle.com if you need additional information or have any -+ * questions. -+ */ -+ -+package sun.security.pkcs11; -+ -+import java.security.AlgorithmParameters; -+import java.security.Key; -+import java.security.InvalidAlgorithmParameterException; -+import java.security.InvalidKeyException; -+import java.security.NoSuchAlgorithmException; -+import java.security.SecureRandom; -+import java.security.spec.AlgorithmParameterSpec; -+import java.security.spec.InvalidKeySpecException; -+import javax.crypto.BadPaddingException; -+import javax.crypto.CipherSpi; -+import javax.crypto.IllegalBlockSizeException; -+import javax.crypto.NoSuchPaddingException; -+import javax.crypto.ShortBufferException; -+import javax.crypto.spec.PBEKeySpec; -+ -+import static sun.security.pkcs11.wrapper.PKCS11Constants.*; -+import sun.security.jca.JCAUtil; -+import sun.security.pkcs11.wrapper.PKCS11Exception; -+import sun.security.util.PBEUtil; -+ -+final class P11PBECipher extends CipherSpi { -+ -+ private static final int DEFAULT_SALT_LENGTH = 20; -+ private static final int DEFAULT_COUNT = 4096; -+ -+ private final Token token; -+ private final String pbeAlg; -+ private final P11Cipher cipher; -+ private final int blkSize; -+ private final int keyLen; -+ private final PBEUtil.PBES2Helper pbes2Helper = new PBEUtil.PBES2Helper( -+ DEFAULT_SALT_LENGTH, DEFAULT_COUNT); -+ -+ P11PBECipher(Token token, String pbeAlg, long cipherMech) -+ throws PKCS11Exception, NoSuchAlgorithmException { -+ super(); -+ String cipherTrans; -+ if (cipherMech == CKM_AES_CBC_PAD || cipherMech == CKM_AES_CBC) { -+ cipherTrans = "AES/CBC/PKCS5Padding"; -+ } else { -+ throw new NoSuchAlgorithmException( -+ "Cipher transformation not supported."); -+ } -+ cipher = new P11Cipher(token, cipherTrans, cipherMech); -+ blkSize = cipher.engineGetBlockSize(); -+ assert P11Util.kdfDataMap.get(pbeAlg) != null; -+ keyLen = P11Util.kdfDataMap.get(pbeAlg).keyLen; -+ this.pbeAlg = pbeAlg; -+ this.token = token; -+ } -+ -+ // see JCE spec -+ @Override -+ protected void engineSetMode(String mode) -+ throws NoSuchAlgorithmException { -+ cipher.engineSetMode(mode); -+ } -+ -+ // see JCE spec -+ @Override -+ protected void engineSetPadding(String padding) -+ throws NoSuchPaddingException { -+ cipher.engineSetPadding(padding); -+ } -+ -+ // see JCE spec -+ @Override -+ protected int engineGetBlockSize() { -+ return cipher.engineGetBlockSize(); -+ } -+ -+ // see JCE spec -+ @Override -+ protected int engineGetOutputSize(int inputLen) { -+ return cipher.engineGetOutputSize(inputLen); -+ } -+ -+ // see JCE spec -+ @Override -+ protected byte[] engineGetIV() { -+ return cipher.engineGetIV(); -+ } -+ -+ // see JCE spec -+ @Override -+ protected AlgorithmParameters engineGetParameters() { -+ return pbes2Helper.getAlgorithmParameters( -+ blkSize, pbeAlg, null, JCAUtil.getSecureRandom()); -+ } -+ -+ // see JCE spec -+ @Override -+ protected void engineInit(int opmode, Key key, -+ SecureRandom random) throws InvalidKeyException { -+ try { -+ engineInit(opmode, key, (AlgorithmParameterSpec) null, random); -+ } catch (InvalidAlgorithmParameterException e) { -+ throw new InvalidKeyException("requires PBE parameters", e); -+ } -+ } -+ -+ // see JCE spec -+ @Override -+ protected void engineInit(int opmode, Key key, -+ AlgorithmParameterSpec params, SecureRandom random) -+ throws InvalidKeyException, -+ InvalidAlgorithmParameterException { -+ -+ PBEKeySpec pbeSpec = pbes2Helper.getPBEKeySpec(blkSize, keyLen, -+ opmode, key, params, random); -+ -+ Key derivedKey; -+ try { -+ derivedKey = P11SecretKeyFactory.derivePBEKey( -+ token, pbeSpec, pbeAlg); -+ } catch (InvalidKeySpecException e) { -+ throw new InvalidKeyException(e); -+ } -+ cipher.engineInit(opmode, derivedKey, pbes2Helper.getIvSpec(), random); -+ } -+ -+ // see JCE spec -+ @Override -+ protected void engineInit(int opmode, Key key, -+ AlgorithmParameters params, SecureRandom random) -+ throws InvalidKeyException, -+ InvalidAlgorithmParameterException { -+ engineInit(opmode, key, PBEUtil.PBES2Helper.getParameterSpec(params), -+ random); -+ } -+ -+ // see JCE spec -+ @Override -+ protected byte[] engineUpdate(byte[] input, int inputOffset, -+ int inputLen) { -+ return cipher.engineUpdate(input, inputOffset, inputLen); -+ } -+ -+ // see JCE spec -+ @Override -+ protected int engineUpdate(byte[] input, int inputOffset, -+ int inputLen, byte[] output, int outputOffset) -+ throws ShortBufferException { -+ return cipher.engineUpdate(input, inputOffset, inputLen, -+ output, outputOffset); -+ } -+ -+ // see JCE spec -+ @Override -+ protected byte[] engineDoFinal(byte[] input, int inputOffset, -+ int inputLen) -+ throws IllegalBlockSizeException, BadPaddingException { -+ return cipher.engineDoFinal(input, inputOffset, inputLen); -+ } -+ -+ // see JCE spec -+ @Override -+ protected int engineDoFinal(byte[] input, int inputOffset, -+ int inputLen, byte[] output, int outputOffset) -+ throws ShortBufferException, IllegalBlockSizeException, -+ BadPaddingException { -+ return cipher.engineDoFinal(input, inputOffset, inputLen, output, -+ outputOffset); -+ } -+ -+ // see JCE spec -+ @Override -+ protected int engineGetKeySize(Key key) -+ throws InvalidKeyException { -+ return cipher.engineGetKeySize(key); -+ } -+ -+} -diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11SecretKeyFactory.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11SecretKeyFactory.java -index 8d1b8ccb0ae..7ea9b4c5e7f 100644 ---- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11SecretKeyFactory.java -+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11SecretKeyFactory.java -@@ -31,6 +31,7 @@ import java.security.*; - import java.security.spec.*; - - import javax.crypto.*; -+import javax.crypto.interfaces.PBEKey; - import javax.crypto.spec.*; - - import static sun.security.pkcs11.TemplateManager.*; -@@ -194,6 +195,130 @@ final class P11SecretKeyFactory extends SecretKeyFactorySpi { - return p11Key; +@@ -1624,4 +1632,3 @@ final class SessionKeyRef extends PhantomReference { + this.clear(); } - -+ static P11Key derivePBEKey(Token token, PBEKeySpec keySpec, String algo) -+ throws InvalidKeySpecException { -+ token.ensureValid(); -+ if (keySpec == null) { -+ throw new InvalidKeySpecException("PBEKeySpec must not be null"); -+ } -+ Session session = null; -+ try { -+ session = token.getObjSession(); -+ P11Util.KDFData kdfData = P11Util.kdfDataMap.get(algo); -+ CK_MECHANISM ckMech; -+ char[] password = keySpec.getPassword(); -+ byte[] salt = keySpec.getSalt(); -+ int itCount = keySpec.getIterationCount(); -+ int keySize = keySpec.getKeyLength(); -+ if (kdfData.keyLen != -1) { -+ if (keySize == 0) { -+ keySize = kdfData.keyLen; -+ } else if (keySize != kdfData.keyLen) { -+ throw new InvalidKeySpecException( -+ "Key length is invalid for " + algo); -+ } -+ } -+ -+ if (kdfData.kdfMech == CKM_PKCS5_PBKD2) { -+ CK_INFO p11Info = token.p11.getInfo(); -+ CK_VERSION p11Ver = (p11Info != null ? p11Info.cryptokiVersion -+ : null); -+ if (P11Util.isNSS(token) || p11Ver != null && (p11Ver.major < -+ 2 || p11Ver.major == 2 && p11Ver.minor < 40)) { -+ // NSS keeps using the old structure beyond PKCS #11 v2.40 -+ ckMech = new CK_MECHANISM(kdfData.kdfMech, -+ new CK_PKCS5_PBKD2_PARAMS(password, salt, -+ itCount, kdfData.prfMech)); -+ } else { -+ ckMech = new CK_MECHANISM(kdfData.kdfMech, -+ new CK_PKCS5_PBKD2_PARAMS2(password, salt, -+ itCount, kdfData.prfMech)); -+ } -+ } else { -+ // PKCS #12 "General Method" PBKD (RFC 7292, Appendix B.2) -+ if (P11Util.isNSS(token)) { -+ // According to PKCS #11, "password" in CK_PBE_PARAMS has -+ // a CK_UTF8CHAR_PTR type. This suggests that it is encoded -+ // in UTF-8. However, NSS expects the password to be encoded -+ // as BMPString with a NULL terminator when C_GenerateKey -+ // is called for a PKCS #12 "General Method" derivation -+ // (see RFC 7292, Appendix B.1). -+ // -+ // The char size in Java is 2 bytes. When a char is -+ // converted to a CK_UTF8CHAR, the high-order byte is -+ // discarded (see jCharArrayToCKUTF8CharArray in -+ // p11_util.c). In order to have a BMPString passed to -+ // C_GenerateKey, we need to account for that and expand: -+ // the high and low parts of each char are split into 2 -+ // chars. As an example, this is the transformation for -+ // a NULL terminated password "a": -+ // char[] => [ 0x0061, 0x0000 ] -+ // / \ / \ -+ // Expansion => [0x0000, 0x0061, 0x0000, 0x0000] -+ // | | | | -+ // BMPString => [ 0x00, 0x61, 0x00, 0x00] -+ // -+ int inputLength = (password == null) ? 0 : password.length; -+ char[] expPassword = new char[inputLength * 2 + 2]; -+ for (int i = 0, j = 0; i < inputLength; i++, j += 2) { -+ expPassword[j] = (char) ((password[i] >>> 8) & 0xFF); -+ expPassword[j + 1] = (char) (password[i] & 0xFF); -+ } -+ password = expPassword; -+ } -+ ckMech = new CK_MECHANISM(kdfData.kdfMech, -+ new CK_PBE_PARAMS(password, salt, itCount)); -+ } -+ -+ long keyType = getKeyType(kdfData.keyAlgo); -+ CK_ATTRIBUTE[] attrs = new CK_ATTRIBUTE[ -+ switch (kdfData.op) { -+ case ENCRYPTION, AUTHENTICATION -> 4; -+ case GENERIC -> 5; -+ }]; -+ attrs[0] = new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY); -+ attrs[1] = new CK_ATTRIBUTE(CKA_VALUE_LEN, keySize >> 3); -+ attrs[2] = new CK_ATTRIBUTE(CKA_KEY_TYPE, keyType); -+ switch (kdfData.op) { -+ case ENCRYPTION -> attrs[3] = CK_ATTRIBUTE.ENCRYPT_TRUE; -+ case AUTHENTICATION -> attrs[3] = CK_ATTRIBUTE.SIGN_TRUE; -+ case GENERIC -> { -+ attrs[3] = CK_ATTRIBUTE.ENCRYPT_TRUE; -+ attrs[4] = CK_ATTRIBUTE.SIGN_TRUE; -+ } -+ } -+ CK_ATTRIBUTE[] attr = token.getAttributes( -+ O_GENERATE, CKO_SECRET_KEY, keyType, attrs); -+ long keyID = token.p11.C_GenerateKey(session.id(), ckMech, attr); -+ return (P11Key)P11Key.secretKey( -+ session, keyID, kdfData.keyAlgo, keySize, attr); -+ } catch (PKCS11Exception e) { -+ throw new InvalidKeySpecException("Could not create key", e); -+ } finally { -+ token.releaseSession(session); -+ } -+ } -+ -+ static P11Key derivePBEKey(Token token, PBEKey key, String algo) -+ throws InvalidKeyException { -+ token.ensureValid(); -+ if (key == null) { -+ throw new InvalidKeyException("PBEKey must not be null"); -+ } -+ P11Key p11Key = token.secretCache.get(key); -+ if (p11Key != null) { -+ return p11Key; -+ } -+ try { -+ p11Key = derivePBEKey(token, new PBEKeySpec(key.getPassword(), -+ key.getSalt(), key.getIterationCount()), algo); -+ } catch (InvalidKeySpecException e) { -+ throw new InvalidKeyException(e); -+ } -+ token.secretCache.put(key, p11Key); -+ return p11Key; -+ } -+ - static void fixDESParity(byte[] key, int offset) { - for (int i = 0; i < 8; i++) { - int b = key[offset] & 0xfe; -@@ -320,6 +445,9 @@ final class P11SecretKeyFactory extends SecretKeyFactorySpi { - keySpec = new SecretKeySpec(keyBytes, "DESede"); - return engineGenerateSecret(keySpec); - } -+ } else if (keySpec instanceof PBEKeySpec) { -+ return (SecretKey)derivePBEKey(token, -+ (PBEKeySpec)keySpec, algorithm); - } - throw new InvalidKeySpecException - ("Unsupported spec: " + keySpec.getClass().getName()); -@@ -373,6 +501,9 @@ final class P11SecretKeyFactory extends SecretKeyFactorySpi { - // see JCE spec - protected SecretKey engineTranslateKey(SecretKey key) - throws InvalidKeyException { -+ if (key instanceof PBEKey) { -+ return (SecretKey)derivePBEKey(token, (PBEKey)key, algorithm); -+ } - return (SecretKey)convertKey(token, key, algorithm); - } - -diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Util.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Util.java -index 262cfc062ad..72b64f72c0a 100644 ---- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Util.java -+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Util.java -@@ -27,6 +27,10 @@ package sun.security.pkcs11; - - import java.math.BigInteger; - import java.security.*; -+import java.util.HashMap; -+import java.util.Map; -+ -+import static sun.security.pkcs11.wrapper.PKCS11Constants.*; - - /** - * Collection of static utility methods. -@@ -40,10 +44,106 @@ public final class P11Util { - - private static volatile Provider sun, sunRsaSign, sunJce; - -+ // Used by PBE -+ static final class KDFData { -+ public enum Operation {ENCRYPTION, AUTHENTICATION, GENERIC} -+ public long kdfMech; -+ public long prfMech; -+ public String keyAlgo; -+ public int keyLen; -+ public Operation op; -+ KDFData(long kdfMech, long prfMech, String keyAlgo, -+ int keyLen, Operation op) { -+ this.kdfMech = kdfMech; -+ this.prfMech = prfMech; -+ this.keyAlgo = keyAlgo; -+ this.keyLen = keyLen; -+ this.op = op; -+ } -+ -+ public static void addPbkdf2Data(String algo, long kdfMech, -+ long prfMech) { -+ kdfDataMap.put(algo, new KDFData(kdfMech, prfMech, -+ "Generic", -1, Operation.GENERIC)); -+ } -+ -+ public static void addPbkdf2AesData(String algo, long kdfMech, -+ long prfMech, int keyLen) { -+ kdfDataMap.put(algo, new KDFData(kdfMech, prfMech, -+ "AES", keyLen, Operation.ENCRYPTION)); -+ } -+ -+ public static void addPkcs12KDData(String algo, long kdfMech, -+ int keyLen) { -+ kdfDataMap.put(algo, new KDFData(kdfMech, -1, -+ "Generic", keyLen, Operation.AUTHENTICATION)); -+ } -+ } -+ -+ static final Map kdfDataMap = new HashMap<>(); -+ -+ static { -+ KDFData.addPbkdf2AesData("PBEWithHmacSHA1AndAES_128", -+ CKM_PKCS5_PBKD2, CKP_PKCS5_PBKD2_HMAC_SHA1, 128); -+ KDFData.addPbkdf2AesData("PBEWithHmacSHA224AndAES_128", -+ CKM_PKCS5_PBKD2, CKP_PKCS5_PBKD2_HMAC_SHA224, 128); -+ KDFData.addPbkdf2AesData("PBEWithHmacSHA256AndAES_128", -+ CKM_PKCS5_PBKD2, CKP_PKCS5_PBKD2_HMAC_SHA256, 128); -+ KDFData.addPbkdf2AesData("PBEWithHmacSHA384AndAES_128", -+ CKM_PKCS5_PBKD2, CKP_PKCS5_PBKD2_HMAC_SHA384, 128); -+ KDFData.addPbkdf2AesData("PBEWithHmacSHA512AndAES_128", -+ CKM_PKCS5_PBKD2, CKP_PKCS5_PBKD2_HMAC_SHA512, 128); -+ KDFData.addPbkdf2AesData("PBEWithHmacSHA1AndAES_256", -+ CKM_PKCS5_PBKD2, CKP_PKCS5_PBKD2_HMAC_SHA1, 256); -+ KDFData.addPbkdf2AesData("PBEWithHmacSHA224AndAES_256", -+ CKM_PKCS5_PBKD2, CKP_PKCS5_PBKD2_HMAC_SHA224, 256); -+ KDFData.addPbkdf2AesData("PBEWithHmacSHA256AndAES_256", -+ CKM_PKCS5_PBKD2, CKP_PKCS5_PBKD2_HMAC_SHA256, 256); -+ KDFData.addPbkdf2AesData("PBEWithHmacSHA384AndAES_256", -+ CKM_PKCS5_PBKD2, CKP_PKCS5_PBKD2_HMAC_SHA384, 256); -+ KDFData.addPbkdf2AesData("PBEWithHmacSHA512AndAES_256", -+ CKM_PKCS5_PBKD2, CKP_PKCS5_PBKD2_HMAC_SHA512, 256); -+ -+ KDFData.addPbkdf2Data("PBKDF2WithHmacSHA1", -+ CKM_PKCS5_PBKD2, CKP_PKCS5_PBKD2_HMAC_SHA1); -+ KDFData.addPbkdf2Data("PBKDF2WithHmacSHA224", -+ CKM_PKCS5_PBKD2, CKP_PKCS5_PBKD2_HMAC_SHA224); -+ KDFData.addPbkdf2Data("PBKDF2WithHmacSHA256", -+ CKM_PKCS5_PBKD2, CKP_PKCS5_PBKD2_HMAC_SHA256); -+ KDFData.addPbkdf2Data("PBKDF2WithHmacSHA384", -+ CKM_PKCS5_PBKD2, CKP_PKCS5_PBKD2_HMAC_SHA384); -+ KDFData.addPbkdf2Data("PBKDF2WithHmacSHA512", -+ CKM_PKCS5_PBKD2, CKP_PKCS5_PBKD2_HMAC_SHA512); -+ -+ KDFData.addPkcs12KDData("HmacPBESHA1", -+ CKM_PBA_SHA1_WITH_SHA1_HMAC, 160); -+ KDFData.addPkcs12KDData("HmacPBESHA224", -+ CKM_NSS_PKCS12_PBE_SHA224_HMAC_KEY_GEN, 224); -+ KDFData.addPkcs12KDData("HmacPBESHA256", -+ CKM_NSS_PKCS12_PBE_SHA256_HMAC_KEY_GEN, 256); -+ KDFData.addPkcs12KDData("HmacPBESHA384", -+ CKM_NSS_PKCS12_PBE_SHA384_HMAC_KEY_GEN, 384); -+ KDFData.addPkcs12KDData("HmacPBESHA512", -+ CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN, 512); -+ KDFData.addPkcs12KDData("HmacPBESHA512/224", -+ CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN, 512); -+ KDFData.addPkcs12KDData("HmacPBESHA512/256", -+ CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN, 512); -+ } -+ - private P11Util() { - // empty - } - -+ static boolean isNSS(Token token) { -+ char[] tokenLabel = token.tokenInfo.label; -+ if (tokenLabel != null && tokenLabel.length >= 3) { -+ return (tokenLabel[0] == 'N' && tokenLabel[1] == 'S' -+ && tokenLabel[2] == 'S'); -+ } -+ return false; -+ } -+ - static Provider getSunProvider() { - Provider p = sun; - if (p == null) { + } +- diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java -index aa35e8fa668..1855e5631bd 100644 +index 5cd6828d293..bae49c4e8a9 100644 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java @@ -26,6 +26,9 @@ @@ -4119,9 +3036,9 @@ index aa35e8fa668..1855e5631bd 100644 import static sun.security.util.SecurityProviderConstants.getAliases; import sun.security.pkcs11.Secmod.*; -@@ -62,6 +67,39 @@ import static sun.security.pkcs11.wrapper.PKCS11Exception.*; - */ - public final class SunPKCS11 extends AuthProvider { +@@ -65,6 +70,39 @@ public final class SunPKCS11 extends AuthProvider { + @Serial + private static final long serialVersionUID = -1354835039035306505L; + private static final boolean systemFipsEnabled = SharedSecrets + .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled(); @@ -4156,10 +3073,10 @@ index aa35e8fa668..1855e5631bd 100644 + + private static final String FIPS_NSSDB_PATH_PROP = "fips.nssdb.path"; + - private static final long serialVersionUID = -1354835039035306505L; - static final Debug debug = Debug.getInstance("sunpkcs11"); -@@ -115,6 +153,29 @@ public final class SunPKCS11 extends AuthProvider { + // the PKCS11 object through which we make the native calls + @SuppressWarnings("serial") // Type of field is not Serializable; +@@ -123,6 +161,29 @@ public final class SunPKCS11 extends AuthProvider { return AccessController.doPrivileged(new PrivilegedExceptionAction<>() { @Override public SunPKCS11 run() throws Exception { @@ -4189,7 +3106,7 @@ index aa35e8fa668..1855e5631bd 100644 return new SunPKCS11(new Config(newConfigName)); } }); -@@ -320,10 +381,19 @@ public final class SunPKCS11 extends AuthProvider { +@@ -325,9 +386,19 @@ public final class SunPKCS11 extends AuthProvider { // request multithreaded access first initArgs.flags = CKF_OS_LOCKING_OK; PKCS11 tmpPKCS11; @@ -4202,266 +3119,35 @@ index aa35e8fa668..1855e5631bd 100644 + fipsExportKey, 0, this); + } try { - tmpPKCS11 = PKCS11.getInstance( - library, functionList, initArgs, +- tmpPKCS11 = PKCS11.getInstance(library, functionList, initArgs, - config.getOmitInitialize()); ++ tmpPKCS11 = PKCS11.getInstance( ++ library, functionList, initArgs, + config.getOmitInitialize(), fipsKeyImporter, + fipsKeyExporter); } catch (PKCS11Exception e) { if (debug != null) { debug.println("Multi-threaded initialization failed: " + e); -@@ -339,11 +409,12 @@ public final class SunPKCS11 extends AuthProvider { +@@ -342,8 +413,9 @@ public final class SunPKCS11 extends AuthProvider { + } else { initArgs.flags = 0; } - tmpPKCS11 = PKCS11.getInstance(library, -- functionList, initArgs, config.getOmitInitialize()); +- tmpPKCS11 = PKCS11.getInstance(library, functionList, initArgs, +- config.getOmitInitialize()); ++ tmpPKCS11 = PKCS11.getInstance(library, + functionList, initArgs, config.getOmitInitialize(), fipsKeyImporter, + fipsKeyExporter); } p11 = tmpPKCS11; -- CK_INFO p11Info = p11.C_GetInfo(); -+ CK_INFO p11Info = p11.getInfo(); - if (p11Info.cryptokiVersion.major < 2) { - throw new ProviderException("Only PKCS#11 v2.0 and later " - + "supported, library version is v" + p11Info.cryptokiVersion); -@@ -417,14 +488,19 @@ public final class SunPKCS11 extends AuthProvider { - final String className; - final List aliases; - final int[] mechanisms; -+ final int[] requiredMechs; - -+ // mechanisms is a list of possible mechanisms that implement the -+ // algorithm, at least one of them must be available. requiredMechs -+ // is a list of auxiliary mechanisms, all of them must be available - private Descriptor(String type, String algorithm, String className, -- List aliases, int[] mechanisms) { -+ List aliases, int[] mechanisms, int[] requiredMechs) { - this.type = type; - this.algorithm = algorithm; - this.className = className; - this.aliases = aliases; - this.mechanisms = mechanisms; -+ this.requiredMechs = requiredMechs; - } - private P11Service service(Token token, int mechanism) { - return new P11Service -@@ -458,18 +534,29 @@ public final class SunPKCS11 extends AuthProvider { - - private static void d(String type, String algorithm, String className, - int[] m) { -- register(new Descriptor(type, algorithm, className, null, m)); -+ register(new Descriptor(type, algorithm, className, null, m, null)); - } - - private static void d(String type, String algorithm, String className, - List aliases, int[] m) { -- register(new Descriptor(type, algorithm, className, aliases, m)); -+ register(new Descriptor(type, algorithm, className, aliases, m, null)); -+ } -+ -+ private static void d(String type, String algorithm, String className, -+ int[] m, int[] requiredMechs) { -+ register(new Descriptor(type, algorithm, className, null, m, -+ requiredMechs)); -+ } -+ private static void dA(String type, String algorithm, String className, -+ int[] m, int[] requiredMechs) { -+ register(new Descriptor(type, algorithm, className, -+ getAliases(algorithm), m, requiredMechs)); - } - - private static void dA(String type, String algorithm, String className, - int[] m) { - register(new Descriptor(type, algorithm, className, -- getAliases(algorithm), m)); -+ getAliases(algorithm), m, null)); - } - - private static void register(Descriptor d) { -@@ -525,6 +612,7 @@ public final class SunPKCS11 extends AuthProvider { - String P11Cipher = "sun.security.pkcs11.P11Cipher"; - String P11RSACipher = "sun.security.pkcs11.P11RSACipher"; - String P11AEADCipher = "sun.security.pkcs11.P11AEADCipher"; -+ String P11PBECipher = "sun.security.pkcs11.P11PBECipher"; - String P11Signature = "sun.security.pkcs11.P11Signature"; - String P11PSSSignature = "sun.security.pkcs11.P11PSSSignature"; - -@@ -587,6 +675,30 @@ public final class SunPKCS11 extends AuthProvider { - d(MAC, "SslMacSHA1", P11Mac, - m(CKM_SSL3_SHA1_MAC)); - -+ if (systemFipsEnabled) { -+ /* -+ * PBA HMacs -+ * -+ * KeyDerivationMech must be supported -+ * for these services to be available. -+ * -+ */ -+ d(MAC, "HmacPBESHA1", P11Mac, m(CKM_SHA_1_HMAC), -+ m(CKM_PBA_SHA1_WITH_SHA1_HMAC)); -+ d(MAC, "HmacPBESHA224", P11Mac, m(CKM_SHA224_HMAC), -+ m(CKM_NSS_PKCS12_PBE_SHA224_HMAC_KEY_GEN)); -+ d(MAC, "HmacPBESHA256", P11Mac, m(CKM_SHA256_HMAC), -+ m(CKM_NSS_PKCS12_PBE_SHA256_HMAC_KEY_GEN)); -+ d(MAC, "HmacPBESHA384", P11Mac, m(CKM_SHA384_HMAC), -+ m(CKM_NSS_PKCS12_PBE_SHA384_HMAC_KEY_GEN)); -+ d(MAC, "HmacPBESHA512", P11Mac, m(CKM_SHA512_HMAC), -+ m(CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN)); -+ d(MAC, "HmacPBESHA512/224", P11Mac, m(CKM_SHA512_224_HMAC), -+ m(CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN)); -+ d(MAC, "HmacPBESHA512/256", P11Mac, m(CKM_SHA512_256_HMAC), -+ m(CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN)); -+ } -+ - d(KPG, "RSA", P11KeyPairGenerator, - getAliases("PKCS1"), - m(CKM_RSA_PKCS_KEY_PAIR_GEN)); -@@ -685,6 +797,66 @@ public final class SunPKCS11 extends AuthProvider { - d(SKF, "ChaCha20", P11SecretKeyFactory, - m(CKM_CHACHA20_POLY1305)); - -+ if (systemFipsEnabled) { -+ /* -+ * PBE Secret Key Factories -+ * -+ * KeyDerivationPrf must be supported for these services -+ * to be available. -+ * -+ */ -+ d(SKF, "PBEWithHmacSHA1AndAES_128", -+ P11SecretKeyFactory, m(CKM_PKCS5_PBKD2), m(CKM_SHA_1_HMAC)); -+ d(SKF, "PBEWithHmacSHA224AndAES_128", -+ P11SecretKeyFactory, m(CKM_PKCS5_PBKD2), m(CKM_SHA224_HMAC)); -+ d(SKF, "PBEWithHmacSHA256AndAES_128", -+ P11SecretKeyFactory, m(CKM_PKCS5_PBKD2), m(CKM_SHA256_HMAC)); -+ d(SKF, "PBEWithHmacSHA384AndAES_128", -+ P11SecretKeyFactory, m(CKM_PKCS5_PBKD2), m(CKM_SHA384_HMAC)); -+ d(SKF, "PBEWithHmacSHA512AndAES_128", -+ P11SecretKeyFactory, m(CKM_PKCS5_PBKD2), m(CKM_SHA512_HMAC)); -+ d(SKF, "PBEWithHmacSHA1AndAES_256", -+ P11SecretKeyFactory, m(CKM_PKCS5_PBKD2), m(CKM_SHA_1_HMAC)); -+ d(SKF, "PBEWithHmacSHA224AndAES_256", -+ P11SecretKeyFactory, m(CKM_PKCS5_PBKD2), m(CKM_SHA224_HMAC)); -+ d(SKF, "PBEWithHmacSHA256AndAES_256", -+ P11SecretKeyFactory, m(CKM_PKCS5_PBKD2), m(CKM_SHA256_HMAC)); -+ d(SKF, "PBEWithHmacSHA384AndAES_256", -+ P11SecretKeyFactory, m(CKM_PKCS5_PBKD2), m(CKM_SHA384_HMAC)); -+ d(SKF, "PBEWithHmacSHA512AndAES_256", -+ P11SecretKeyFactory, m(CKM_PKCS5_PBKD2), m(CKM_SHA512_HMAC)); -+ /* -+ * PBA Secret Key Factories -+ */ -+ d(SKF, "HmacPBESHA1", P11SecretKeyFactory, -+ m(CKM_PBA_SHA1_WITH_SHA1_HMAC)); -+ d(SKF, "HmacPBESHA224", P11SecretKeyFactory, -+ m(CKM_NSS_PKCS12_PBE_SHA224_HMAC_KEY_GEN)); -+ d(SKF, "HmacPBESHA256", P11SecretKeyFactory, -+ m(CKM_NSS_PKCS12_PBE_SHA256_HMAC_KEY_GEN)); -+ d(SKF, "HmacPBESHA384", P11SecretKeyFactory, -+ m(CKM_NSS_PKCS12_PBE_SHA384_HMAC_KEY_GEN)); -+ d(SKF, "HmacPBESHA512", P11SecretKeyFactory, -+ m(CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN)); -+ d(SKF, "HmacPBESHA512/224", P11SecretKeyFactory, -+ m(CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN)); -+ d(SKF, "HmacPBESHA512/256", P11SecretKeyFactory, -+ m(CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN)); -+ /* -+ * PBKDF2 Secret Key Factories -+ */ -+ dA(SKF, "PBKDF2WithHmacSHA1", P11SecretKeyFactory, -+ m(CKM_PKCS5_PBKD2), m(CKM_SHA_1_HMAC)); -+ d(SKF, "PBKDF2WithHmacSHA224", P11SecretKeyFactory, -+ m(CKM_PKCS5_PBKD2), m(CKM_SHA224_HMAC)); -+ d(SKF, "PBKDF2WithHmacSHA256", P11SecretKeyFactory, -+ m(CKM_PKCS5_PBKD2), m(CKM_SHA256_HMAC)); -+ d(SKF, "PBKDF2WithHmacSHA384", P11SecretKeyFactory, -+ m(CKM_PKCS5_PBKD2), m(CKM_SHA384_HMAC)); -+ d(SKF, "PBKDF2WithHmacSHA512", P11SecretKeyFactory, -+ m(CKM_PKCS5_PBKD2), m(CKM_SHA512_HMAC)); -+ } -+ - // XXX attributes for Ciphers (supported modes, padding) - dA(CIP, "ARCFOUR", P11Cipher, - m(CKM_RC4)); -@@ -754,6 +926,46 @@ public final class SunPKCS11 extends AuthProvider { - d(CIP, "RSA/ECB/NoPadding", P11RSACipher, - m(CKM_RSA_X_509)); - -+ if (systemFipsEnabled) { -+ /* -+ * PBE Ciphers -+ * -+ * KeyDerivationMech and KeyDerivationPrf must be supported -+ * for these services to be available. -+ * -+ */ -+ d(CIP, "PBEWithHmacSHA1AndAES_128", P11PBECipher, -+ m(CKM_AES_CBC_PAD, CKM_AES_CBC), -+ m(CKM_PKCS5_PBKD2, CKM_SHA_1_HMAC)); -+ d(CIP, "PBEWithHmacSHA224AndAES_128", P11PBECipher, -+ m(CKM_AES_CBC_PAD, CKM_AES_CBC), -+ m(CKM_PKCS5_PBKD2, CKM_SHA224_HMAC)); -+ d(CIP, "PBEWithHmacSHA256AndAES_128", P11PBECipher, -+ m(CKM_AES_CBC_PAD, CKM_AES_CBC), -+ m(CKM_PKCS5_PBKD2, CKM_SHA256_HMAC)); -+ d(CIP, "PBEWithHmacSHA384AndAES_128", P11PBECipher, -+ m(CKM_AES_CBC_PAD, CKM_AES_CBC), -+ m(CKM_PKCS5_PBKD2, CKM_SHA384_HMAC)); -+ d(CIP, "PBEWithHmacSHA512AndAES_128", P11PBECipher, -+ m(CKM_AES_CBC_PAD, CKM_AES_CBC), -+ m(CKM_PKCS5_PBKD2, CKM_SHA512_HMAC)); -+ d(CIP, "PBEWithHmacSHA1AndAES_256", P11PBECipher, -+ m(CKM_AES_CBC_PAD, CKM_AES_CBC), -+ m(CKM_PKCS5_PBKD2, CKM_SHA_1_HMAC)); -+ d(CIP, "PBEWithHmacSHA224AndAES_256", P11PBECipher, -+ m(CKM_AES_CBC_PAD, CKM_AES_CBC), -+ m(CKM_PKCS5_PBKD2, CKM_SHA224_HMAC)); -+ d(CIP, "PBEWithHmacSHA256AndAES_256", P11PBECipher, -+ m(CKM_AES_CBC_PAD, CKM_AES_CBC), -+ m(CKM_PKCS5_PBKD2, CKM_SHA256_HMAC)); -+ d(CIP, "PBEWithHmacSHA384AndAES_256", P11PBECipher, -+ m(CKM_AES_CBC_PAD, CKM_AES_CBC), -+ m(CKM_PKCS5_PBKD2, CKM_SHA384_HMAC)); -+ d(CIP, "PBEWithHmacSHA512AndAES_256", P11PBECipher, -+ m(CKM_AES_CBC_PAD, CKM_AES_CBC), -+ m(CKM_PKCS5_PBKD2, CKM_SHA512_HMAC)); -+ } -+ - d(SIG, "RawDSA", P11Signature, - List.of("NONEwithDSA"), - m(CKM_DSA)); -@@ -1144,9 +1356,21 @@ public final class SunPKCS11 extends AuthProvider { - if (ds == null) { - continue; - } -+ descLoop: - for (Descriptor d : ds) { - Integer oldMech = supportedAlgs.get(d); - if (oldMech == null) { -+ if (d.requiredMechs != null) { -+ // Check that other mechanisms required for the -+ // service are supported before listing it as -+ // available for the first time. -+ for (int requiredMech : d.requiredMechs) { -+ if (token.getMechanismInfo( -+ requiredMech & 0xFFFFFFFFL) == null) { -+ continue descLoop; -+ } -+ } -+ } - supportedAlgs.put(d, integerMech); - continue; - } -@@ -1220,11 +1444,52 @@ public final class SunPKCS11 extends AuthProvider { +@@ -1389,11 +1461,52 @@ public final class SunPKCS11 extends AuthProvider { } @Override + @SuppressWarnings("removal") public Object newInstance(Object param) throws NoSuchAlgorithmException { - if (token.isValid() == false) { + if (!token.isValid()) { throw new NoSuchAlgorithmException("Token has been removed"); } + if (systemFipsEnabled && !token.fipsLoggedIn && @@ -4507,16 +3193,7 @@ index aa35e8fa668..1855e5631bd 100644 try { return newInstance0(param); } catch (PKCS11Exception e) { -@@ -1244,6 +1509,8 @@ public final class SunPKCS11 extends AuthProvider { - } else if (algorithm.endsWith("GCM/NoPadding") || - algorithm.startsWith("ChaCha20-Poly1305")) { - return new P11AEADCipher(token, algorithm, mechanism); -+ } else if (algorithm.startsWith("PBE")) { -+ return new P11PBECipher(token, algorithm, mechanism); - } else { - return new P11Cipher(token, algorithm, mechanism); - } -@@ -1579,6 +1846,9 @@ public final class SunPKCS11 extends AuthProvider { +@@ -1750,6 +1863,9 @@ public final class SunPKCS11 extends AuthProvider { try { session = token.getOpSession(); p11.C_Logout(session.id()); @@ -4527,7 +3204,7 @@ index aa35e8fa668..1855e5631bd 100644 debug.println("logout succeeded"); } diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java -index 9858a5faedf..e63585486d9 100644 +index 3378409ca1c..7602a92a252 100644 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java @@ -33,6 +33,7 @@ import java.lang.ref.*; @@ -4538,17 +3215,17 @@ index 9858a5faedf..e63585486d9 100644 import sun.security.jca.JCAUtil; import sun.security.pkcs11.wrapper.*; -@@ -48,6 +49,9 @@ import static sun.security.pkcs11.wrapper.PKCS11Exception.*; +@@ -48,6 +49,9 @@ import static sun.security.pkcs11.wrapper.PKCS11Exception.RV.*; */ - class Token implements Serializable { + final class Token implements Serializable { + private static final boolean systemFipsEnabled = SharedSecrets + .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled(); + // need to be serializable to allow SecureRandom to be serialized + @Serial private static final long serialVersionUID = 2541527649100571747L; - -@@ -114,6 +118,10 @@ class Token implements Serializable { +@@ -125,6 +129,10 @@ final class Token implements Serializable { // flag indicating whether we are logged in private volatile boolean loggedIn; @@ -4559,10 +3236,10 @@ index 9858a5faedf..e63585486d9 100644 // time we last checked login status private long lastLoginCheck; -@@ -232,7 +240,12 @@ class Token implements Serializable { +@@ -242,7 +250,12 @@ final class Token implements Serializable { // call provider.login() if not void ensureLoggedIn(Session session) throws PKCS11Exception, LoginException { - if (isLoggedIn(session) == false) { + if (!isLoggedIn(session)) { - provider.login(null, null); + if (systemFipsEnabled) { + provider.login(null, new FIPSTokenLoginHandler()); @@ -4573,350 +3250,8 @@ index 9858a5faedf..e63585486d9 100644 } } -diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_ECDH1_DERIVE_PARAMS.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_ECDH1_DERIVE_PARAMS.java -index 88ff8a71fc3..47a2f97eddf 100644 ---- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_ECDH1_DERIVE_PARAMS.java -+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_ECDH1_DERIVE_PARAMS.java -@@ -100,9 +100,9 @@ public class CK_ECDH1_DERIVE_PARAMS { - } - - /** -- * Returns the string representation of CK_PKCS5_PBKD2_PARAMS. -+ * Returns the string representation of CK_ECDH1_DERIVE_PARAMS. - * -- * @return the string representation of CK_PKCS5_PBKD2_PARAMS -+ * @return the string representation of CK_ECDH1_DERIVE_PARAMS - */ - public String toString() { - StringBuilder sb = new StringBuilder(); -diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_MECHANISM.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_MECHANISM.java -index 0c9ebb289c1..b4b2448464d 100644 ---- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_MECHANISM.java -+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_MECHANISM.java -@@ -160,6 +160,18 @@ public class CK_MECHANISM { - init(mechanism, params); - } - -+ public CK_MECHANISM(long mechanism, CK_PBE_PARAMS params) { -+ init(mechanism, params); -+ } -+ -+ public CK_MECHANISM(long mechanism, CK_PKCS5_PBKD2_PARAMS params) { -+ init(mechanism, params); -+ } -+ -+ public CK_MECHANISM(long mechanism, CK_PKCS5_PBKD2_PARAMS2 params) { -+ init(mechanism, params); -+ } -+ - // For PSS. the parameter may be set multiple times, use the - // CK_MECHANISM(long) constructor and setParameter(CK_RSA_PKCS_PSS_PARAMS) - // methods instead of creating yet another constructor -diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_PBE_PARAMS.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_PBE_PARAMS.java -index e8b048869c4..a25fa1c39e5 100644 ---- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_PBE_PARAMS.java -+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_PBE_PARAMS.java -@@ -50,15 +50,15 @@ package sun.security.pkcs11.wrapper; - - - /** -- * class CK_PBE_PARAMS provides all of the necessary information required byte -+ * class CK_PBE_PARAMS provides all the necessary information required by - * the CKM_PBE mechanisms and the CKM_PBA_SHA1_WITH_SHA1_HMAC mechanism.

- * PKCS#11 structure: - * 

-  * typedef struct CK_PBE_PARAMS {
-- *   CK_CHAR_PTR pInitVector;
-- *   CK_CHAR_PTR pPassword;
-+ *   CK_BYTE_PTR pInitVector;
-+ *   CK_UTF8CHAR_PTR pPassword;
-  *   CK_ULONG ulPasswordLen;
-- *   CK_CHAR_PTR pSalt;
-+ *   CK_BYTE_PTR pSalt;
-  *   CK_ULONG ulSaltLen;
-  *   CK_ULONG ulIteration;
-  * } CK_PBE_PARAMS;
-@@ -72,15 +72,15 @@ public class CK_PBE_PARAMS {
-     /**
-      * PKCS#11:
-      * 
--     *   CK_CHAR_PTR pInitVector;
-+     *   CK_BYTE_PTR pInitVector;
-      * 

-      */
--    public char[] pInitVector;
-+    public byte[] pInitVector;
- 
-     /**
-      * PKCS#11:
-      * 
--     *   CK_CHAR_PTR pPassword;
-+     *   CK_UTF8CHAR_PTR pPassword;
-      *   CK_ULONG ulPasswordLen;
-      * 

-      */
-@@ -89,11 +89,11 @@ public class CK_PBE_PARAMS {
-     /**
-      * PKCS#11:
-      * 
--     *   CK_CHAR_PTR pSalt
-+     *   CK_BYTE_PTR pSalt
-      *   CK_ULONG ulSaltLen;
-      * 

-      */
--    public char[] pSalt;
-+    public byte[] pSalt;
- 
-     /**
-      * PKCS#11:
-@@ -103,6 +103,12 @@ public class CK_PBE_PARAMS {
-      */
-     public long ulIteration;
- 
-+    public CK_PBE_PARAMS(char[] pPassword, byte[] pSalt, long ulIteration) {
-+         this.pPassword = pPassword;
-+         this.pSalt = pSalt;
-+         this.ulIteration = ulIteration;
-+     }
-+
-     /**
-      * Returns the string representation of CK_PBE_PARAMS.
-      *
-diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_PKCS5_PBKD2_PARAMS.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_PKCS5_PBKD2_PARAMS.java
-index fb90bfced27..a01beb0753a 100644
---- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_PKCS5_PBKD2_PARAMS.java
-+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_PKCS5_PBKD2_PARAMS.java
-@@ -47,7 +47,7 @@
- 
- package sun.security.pkcs11.wrapper;
- 
--
-+import static sun.security.pkcs11.wrapper.PKCS11Constants.*;
- 
- /**
-  * class CK_PKCS5_PBKD2_PARAMS provides the parameters to the CKM_PKCS5_PBKD2
-@@ -55,13 +55,15 @@ package sun.security.pkcs11.wrapper;
-  * PKCS#11 structure:
-  * 
-  * typedef struct CK_PKCS5_PBKD2_PARAMS {
-- *   CK_PKCS5_PBKD2_SALT_SOURCE_TYPE saltSource;
-+ *   CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE saltSource;
-  *   CK_VOID_PTR pSaltSourceData;
-  *   CK_ULONG ulSaltSourceDataLen;
-  *   CK_ULONG iterations;
-  *   CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE prf;
-  *   CK_VOID_PTR pPrfData;
-  *   CK_ULONG ulPrfDataLen;
-+ *   CK_UTF8CHAR_PTR pPassword;
-+ *   CK_ULONG_PTR ulPasswordLen;
-  * } CK_PKCS5_PBKD2_PARAMS;
-  * 

-  *
-@@ -112,6 +114,24 @@ public class CK_PKCS5_PBKD2_PARAMS {
-      */
-     public byte[] pPrfData;
- 
-+    /**
-+     * PKCS#11:
-+     * 
-+     *   CK_UTF8CHAR_PTR pPassword
-+     *   CK_ULONG_PTR ulPasswordLen;
-+     * 

-+     */
-+    public char[] pPassword;
-+
-+    public CK_PKCS5_PBKD2_PARAMS(char[] pPassword, byte[] pSalt,
-+            long iterations, long prf) {
-+        this.pPassword = pPassword;
-+        this.pSaltSourceData = pSalt;
-+        this.iterations = iterations;
-+        this.prf = prf;
-+        this.saltSource = CKZ_SALT_SPECIFIED;
-+    }
-+
-     /**
-      * Returns the string representation of CK_PKCS5_PBKD2_PARAMS.
-      *
-diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_PKCS5_PBKD2_PARAMS2.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_PKCS5_PBKD2_PARAMS2.java
-new file mode 100644
-index 00000000000..935db656639
---- /dev/null
-+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_PKCS5_PBKD2_PARAMS2.java
-@@ -0,0 +1,156 @@
-+/*
-+ * Copyright (c) 2022, Red Hat, Inc.
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation.  Oracle designates this
-+ * particular file as subject to the "Classpath" exception as provided
-+ * by Oracle in the LICENSE file that accompanied this code.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+package sun.security.pkcs11.wrapper;
-+
-+import static sun.security.pkcs11.wrapper.PKCS11Constants.*;
-+
-+/**
-+ * class CK_PKCS5_PBKD2_PARAMS2 provides the parameters to the CKM_PKCS5_PBKD2
-+ * mechanism.

-+ * PKCS#11 structure:
-+ * 
-+ * typedef struct CK_PKCS5_PBKD2_PARAMS2 {
-+ *   CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE saltSource;
-+ *   CK_VOID_PTR pSaltSourceData;
-+ *   CK_ULONG ulSaltSourceDataLen;
-+ *   CK_ULONG iterations;
-+ *   CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE prf;
-+ *   CK_VOID_PTR pPrfData;
-+ *   CK_ULONG ulPrfDataLen;
-+ *   CK_UTF8CHAR_PTR pPassword;
-+ *   CK_ULONG ulPasswordLen;
-+ * } CK_PKCS5_PBKD2_PARAMS2;
-+ * 

-+ *
-+ */
-+public class CK_PKCS5_PBKD2_PARAMS2 {
-+
-+    /**
-+     * PKCS#11:
-+     * 
-+     *   CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE saltSource;
-+     * 

-+     */
-+    public long saltSource;
-+
-+    /**
-+     * PKCS#11:
-+     * 
-+     *   CK_VOID_PTR pSaltSourceData;
-+     *   CK_ULONG ulSaltSourceDataLen;
-+     * 

-+     */
-+    public byte[] pSaltSourceData;
-+
-+    /**
-+     * PKCS#11:
-+     * 
-+     *   CK_ULONG iterations;
-+     * 

-+     */
-+    public long iterations;
-+
-+    /**
-+     * PKCS#11:
-+     * 
-+     *   CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE prf;
-+     * 

-+     */
-+    public long prf;
-+
-+    /**
-+     * PKCS#11:
-+     * 
-+     *   CK_VOID_PTR pPrfData;
-+     *   CK_ULONG ulPrfDataLen;
-+     * 

-+     */
-+    public byte[] pPrfData;
-+
-+    /**
-+     * PKCS#11:
-+     * 
-+     *   CK_UTF8CHAR_PTR pPassword
-+     *   CK_ULONG ulPasswordLen;
-+     * 

-+     */
-+    public char[] pPassword;
-+
-+    public CK_PKCS5_PBKD2_PARAMS2(char[] pPassword, byte[] pSalt,
-+            long iterations, long prf) {
-+        this.pPassword = pPassword;
-+        this.pSaltSourceData = pSalt;
-+        this.iterations = iterations;
-+        this.prf = prf;
-+        this.saltSource = CKZ_SALT_SPECIFIED;
-+    }
-+
-+    /**
-+     * Returns the string representation of CK_PKCS5_PBKD2_PARAMS2.
-+     *
-+     * @return the string representation of CK_PKCS5_PBKD2_PARAMS2
-+     */
-+    public String toString() {
-+        StringBuilder sb = new StringBuilder();
-+
-+        sb.append(Constants.INDENT);
-+        sb.append("saltSource: ");
-+        sb.append(saltSource);
-+        sb.append(Constants.NEWLINE);
-+
-+        sb.append(Constants.INDENT);
-+        sb.append("pSaltSourceData: ");
-+        sb.append(Functions.toHexString(pSaltSourceData));
-+        sb.append(Constants.NEWLINE);
-+
-+        sb.append(Constants.INDENT);
-+        sb.append("ulSaltSourceDataLen: ");
-+        sb.append(pSaltSourceData.length);
-+        sb.append(Constants.NEWLINE);
-+
-+        sb.append(Constants.INDENT);
-+        sb.append("iterations: ");
-+        sb.append(iterations);
-+        sb.append(Constants.NEWLINE);
-+
-+        sb.append(Constants.INDENT);
-+        sb.append("prf: ");
-+        sb.append(prf);
-+        sb.append(Constants.NEWLINE);
-+
-+        sb.append(Constants.INDENT);
-+        sb.append("pPrfData: ");
-+        sb.append(Functions.toHexString(pPrfData));
-+        sb.append(Constants.NEWLINE);
-+
-+        sb.append(Constants.INDENT);
-+        sb.append("ulPrfDataLen: ");
-+        sb.append(pPrfData.length);
-+
-+        return sb.toString();
-+    }
-+
-+}
-diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_X9_42_DH1_DERIVE_PARAMS.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_X9_42_DH1_DERIVE_PARAMS.java
-index 1f9c4d39f57..5e3c1b9d29f 100644
---- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_X9_42_DH1_DERIVE_PARAMS.java
-+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/CK_X9_42_DH1_DERIVE_PARAMS.java
-@@ -94,9 +94,9 @@ public class CK_X9_42_DH1_DERIVE_PARAMS {
-     public byte[] pPublicData;
- 
-     /**
--     * Returns the string representation of CK_PKCS5_PBKD2_PARAMS.
-+     * Returns the string representation of CK_X9_42_DH1_DERIVE_PARAMS.
-      *
--     * @return the string representation of CK_PKCS5_PBKD2_PARAMS
-+     * @return the string representation of CK_X9_42_DH1_DERIVE_PARAMS
-      */
-     public String toString() {
-         StringBuilder sb = new StringBuilder();
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
-index 5c0aacd1a67..d796aaa3075 100644
+index 4b06daaf264..55e14945469 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
 @@ -49,6 +49,9 @@ package sun.security.pkcs11.wrapper;
@@ -4929,23 +3264,8 @@ index 5c0aacd1a67..d796aaa3075 100644
  import java.util.*;
  
  import java.security.AccessController;
-@@ -113,6 +116,8 @@ public class PKCS11 {
- 
-     private long pNativeData;
- 
-+    private volatile CK_INFO pInfo;
-+
-     /**
-      * This method does the initialization of the native library. It is called
-      * exactly once for this class.
-@@ -145,23 +150,48 @@ public class PKCS11 {
-      * @postconditions
-      */
-     PKCS11(String pkcs11ModulePath, String functionListName)
--            throws IOException {
-+            throws IOException, PKCS11Exception {
-         connect(pkcs11ModulePath, functionListName);
-         this.pkcs11ModulePath = pkcs11ModulePath;
+@@ -174,18 +177,43 @@ public class PKCS11 {
+         return version;
      }
  
 +    /*
@@ -4991,45 +3311,7 @@ index 5c0aacd1a67..d796aaa3075 100644
              }
              if (omitInitialize == false) {
                  try {
-@@ -179,6 +209,28 @@ public class PKCS11 {
-         return pkcs11;
-     }
- 
-+    /**
-+     * Returns the CK_INFO structure fetched at initialization with
-+     * C_GetInfo. This structure represent Cryptoki library information.
-+     */
-+    public CK_INFO getInfo() {
-+        CK_INFO lPInfo = pInfo;
-+        if (lPInfo == null) {
-+            synchronized (this) {
-+                lPInfo = pInfo;
-+                if (lPInfo == null) {
-+                    try {
-+                        lPInfo = C_GetInfo();
-+                        pInfo = lPInfo;
-+                    } catch (PKCS11Exception e) {
-+                        // Some PKCS #11 tokens require initialization first.
-+                    }
-+                }
-+            }
-+        }
-+        return lPInfo;
-+    }
-+
-     /**
-      * Connects this object to the specified PKCS#11 library. This method is for
-      * internal use only.
-@@ -1625,7 +1677,7 @@ public class PKCS11 {
- static class SynchronizedPKCS11 extends PKCS11 {
- 
-     SynchronizedPKCS11(String pkcs11ModulePath, String functionListName)
--            throws IOException {
-+            throws IOException, PKCS11Exception {
-         super(pkcs11ModulePath, functionListName);
-     }
- 
-@@ -1911,4 +1963,194 @@ static class SynchronizedPKCS11 extends PKCS11 {
+@@ -1976,4 +2004,194 @@ static class SynchronizedPKCS11 extends PKCS11 {
          super.C_GenerateRandom(hSession, randomData);
      }
  }
@@ -5043,7 +3325,7 @@ index 5c0aacd1a67..d796aaa3075 100644
 +    private MethodHandle hC_GetAttributeValue;
 +    FIPSPKCS11(String pkcs11ModulePath, String functionListName,
 +            MethodHandle fipsKeyImporter, MethodHandle fipsKeyExporter)
-+                    throws IOException, PKCS11Exception {
++                    throws IOException {
 +        super(pkcs11ModulePath, functionListName);
 +        this.fipsKeyImporter = fipsKeyImporter;
 +        this.fipsKeyExporter = fipsKeyExporter;
@@ -5095,7 +3377,7 @@ index 5c0aacd1a67..d796aaa3075 100644
 +    private MethodHandle hC_GetAttributeValue;
 +    SynchronizedFIPSPKCS11(String pkcs11ModulePath, String functionListName,
 +            MethodHandle fipsKeyImporter, MethodHandle fipsKeyExporter)
-+                    throws IOException, PKCS11Exception {
++                    throws IOException {
 +        super(pkcs11ModulePath, functionListName);
 +        this.fipsKeyImporter = fipsKeyImporter;
 +        this.fipsKeyExporter = fipsKeyExporter;
@@ -5224,455 +3506,38 @@ index 5c0aacd1a67..d796aaa3075 100644
 +    }
 +}
  }
-diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Constants.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Constants.java
-index 0d65ee26805..38fd4aff1f3 100644
---- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Constants.java
-+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Constants.java
-@@ -1104,17 +1104,6 @@ public interface PKCS11Constants {
-     public static final long  CKD_BLAKE2B_384_KDF      = 0x00000019L;
-     public static final long  CKD_BLAKE2B_512_KDF      = 0x0000001aL;
- 
--    public static final long  CKP_PKCS5_PBKD2_HMAC_SHA1        = 0x00000001L;
--    public static final long  CKP_PKCS5_PBKD2_HMAC_GOSTR3411   = 0x00000002L;
--    public static final long  CKP_PKCS5_PBKD2_HMAC_SHA224      = 0x00000003L;
--    public static final long  CKP_PKCS5_PBKD2_HMAC_SHA256      = 0x00000004L;
--    public static final long  CKP_PKCS5_PBKD2_HMAC_SHA384      = 0x00000005L;
--    public static final long  CKP_PKCS5_PBKD2_HMAC_SHA512      = 0x00000006L;
--    public static final long  CKP_PKCS5_PBKD2_HMAC_SHA512_224  = 0x00000007L;
--    public static final long  CKP_PKCS5_PBKD2_HMAC_SHA512_256  = 0x00000008L;
--
--    public static final long  CKZ_SALT_SPECIFIED      = 0x00000001L;
--
-     public static final long  CK_OTP_VALUE            = 0x00000000L;
-     public static final long  CK_OTP_PIN              = 0x00000001L;
-     public static final long  CK_OTP_CHALLENGE        = 0x00000002L;
-@@ -1150,12 +1139,23 @@ public interface PKCS11Constants {
-     public static final long  CKF_HKDF_SALT_KEY    = 0x00000004L;
-     */
- 
-+    // PBKDF2 support, used in P11Util
-+    public static final long  CKZ_SALT_SPECIFIED      = 0x00000001L;
-+    public static final long  CKP_PKCS5_PBKD2_HMAC_SHA1        = 0x00000001L;
-+    public static final long  CKP_PKCS5_PBKD2_HMAC_GOSTR3411   = 0x00000002L;
-+    public static final long  CKP_PKCS5_PBKD2_HMAC_SHA224      = 0x00000003L;
-+    public static final long  CKP_PKCS5_PBKD2_HMAC_SHA256      = 0x00000004L;
-+    public static final long  CKP_PKCS5_PBKD2_HMAC_SHA384      = 0x00000005L;
-+    public static final long  CKP_PKCS5_PBKD2_HMAC_SHA512      = 0x00000006L;
-+    public static final long  CKP_PKCS5_PBKD2_HMAC_SHA512_224  = 0x00000007L;
-+    public static final long  CKP_PKCS5_PBKD2_HMAC_SHA512_256  = 0x00000008L;
-+
-     // private NSS attribute (for DSA and DH private keys)
-     public static final long  CKA_NETSCAPE_DB         = 0xD5A0DB00L;
- 
-     // base number of NSS private attributes
-     public static final long  CKA_NETSCAPE_BASE /*0x80000000L + 0x4E534350L*/
--                                                      = 0xCE534350L;
-+    /*          now known as CKM_NSS ^        */      = 0xCE534350L;
- 
-     // object type for NSS trust
-     public static final long  CKO_NETSCAPE_TRUST      = 0xCE534353L;
-@@ -1180,4 +1180,14 @@ public interface PKCS11Constants {
-                                                              = 0xCE534355L;
-     public static final long  CKT_NETSCAPE_VALID             = 0xCE53435AL;
-     public static final long  CKT_NETSCAPE_VALID_DELEGATOR   = 0xCE53435BL;
-+
-+    // Additional PKCS #12 PBE key derivation algorithms defined in NSS v3.29
-+    public static final long  CKM_NSS_PKCS12_PBE_SHA224_HMAC_KEY_GEN
-+                                        /* (CKM_NSS + 29) */ = 0xCE53436DL;
-+    public static final long  CKM_NSS_PKCS12_PBE_SHA256_HMAC_KEY_GEN
-+                                        /* (CKM_NSS + 30) */ = 0xCE53436EL;
-+    public static final long  CKM_NSS_PKCS12_PBE_SHA384_HMAC_KEY_GEN
-+                                        /* (CKM_NSS + 31) */ = 0xCE53436FL;
-+    public static final long  CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN
-+                                        /* (CKM_NSS + 32) */ = 0xCE534370L;
- }
-diff --git a/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_convert.c b/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_convert.c
-index d941b574cc7..e2de13648be 100644
---- a/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_convert.c
-+++ b/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_convert.c
-@@ -1515,6 +1515,10 @@ CK_VOID_PTR jMechParamToCKMechParamPtrSlow(JNIEnv *env, jobject jParam,
-         case CKM_PBE_SHA1_DES3_EDE_CBC:
-         case CKM_PBE_SHA1_DES2_EDE_CBC:
-         case CKM_PBA_SHA1_WITH_SHA1_HMAC:
-+        case CKM_NSS_PKCS12_PBE_SHA224_HMAC_KEY_GEN:
-+        case CKM_NSS_PKCS12_PBE_SHA256_HMAC_KEY_GEN:
-+        case CKM_NSS_PKCS12_PBE_SHA384_HMAC_KEY_GEN:
-+        case CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN:
-             ckpParamPtr = jPbeParamToCKPbeParamPtr(env, jParam, ckpLength);
-             break;
-         case CKM_PKCS5_PBKD2:
-@@ -1658,13 +1662,13 @@ jPbeParamToCKPbeParamPtr(JNIEnv *env, jobject jParam, CK_ULONG *pLength)
-     // retrieve java values
-     jPbeParamsClass = (*env)->FindClass(env, CLASS_PBE_PARAMS);
-     if (jPbeParamsClass == NULL) { return NULL; }
--    fieldID = (*env)->GetFieldID(env, jPbeParamsClass, "pInitVector", "[C");
-+    fieldID = (*env)->GetFieldID(env, jPbeParamsClass, "pInitVector", "[B");
-     if (fieldID == NULL) { return NULL; }
-     jInitVector = (*env)->GetObjectField(env, jParam, fieldID);
-     fieldID = (*env)->GetFieldID(env, jPbeParamsClass, "pPassword", "[C");
-     if (fieldID == NULL) { return NULL; }
-     jPassword = (*env)->GetObjectField(env, jParam, fieldID);
--    fieldID = (*env)->GetFieldID(env, jPbeParamsClass, "pSalt", "[C");
-+    fieldID = (*env)->GetFieldID(env, jPbeParamsClass, "pSalt", "[B");
-     if (fieldID == NULL) { return NULL; }
-     jSalt = (*env)->GetObjectField(env, jParam, fieldID);
-     fieldID = (*env)->GetFieldID(env, jPbeParamsClass, "ulIteration", "J");
-@@ -1680,15 +1684,15 @@ jPbeParamToCKPbeParamPtr(JNIEnv *env, jobject jParam, CK_ULONG *pLength)
- 
-     // populate using java values
-     ckParamPtr->ulIteration = jLongToCKULong(jIteration);
--    jCharArrayToCKCharArray(env, jInitVector, &(ckParamPtr->pInitVector), &ckTemp);
-+    jByteArrayToCKByteArray(env, jInitVector, &(ckParamPtr->pInitVector), &ckTemp);
-     if ((*env)->ExceptionCheck(env)) {
-         goto cleanup;
-     }
--    jCharArrayToCKCharArray(env, jPassword, &(ckParamPtr->pPassword), &(ckParamPtr->ulPasswordLen));
-+    jCharArrayToCKUTF8CharArray(env, jPassword, &(ckParamPtr->pPassword), &(ckParamPtr->ulPasswordLen));
-     if ((*env)->ExceptionCheck(env)) {
-         goto cleanup;
-     }
--    jCharArrayToCKCharArray(env, jSalt, &(ckParamPtr->pSalt), &(ckParamPtr->ulSaltLen));
-+    jByteArrayToCKByteArray(env, jSalt, &(ckParamPtr->pSalt), &(ckParamPtr->ulSaltLen));
-     if ((*env)->ExceptionCheck(env)) {
-         goto cleanup;
-     }
-@@ -1767,31 +1771,59 @@ void copyBackPBEInitializationVector(JNIEnv *env, CK_MECHANISM *ckMechanism, job
-     }
- }
- 
-+#define PBKD2_PARAM_SET(member, value)                              \
-+    do {                                                            \
-+        if(ckParamPtr->version == PARAMS) {                         \
-+            ckParamPtr->params.v1.member = value;                   \
-+        } else {                                                    \
-+            ckParamPtr->params.v2.member = value;                   \
-+        }                                                           \
-+    } while(0)
-+
-+#define PBKD2_PARAM_ADDR(member)                                    \
-+    (                                                               \
-+        (ckParamPtr->version == PARAMS) ?                           \
-+        (void*) &ckParamPtr->params.v1.member :                     \
-+        (void*) &ckParamPtr->params.v2.member                       \
-+    )
-+
- /*
-- * converts the Java CK_PKCS5_PBKD2_PARAMS object to a CK_PKCS5_PBKD2_PARAMS
-+ * converts a Java CK_PKCS5_PBKD2_PARAMS object to a CK_PKCS5_PBKD2_PARAMS
-+ * pointer, or a Java CK_PKCS5_PBKD2_PARAMS2 object to a CK_PKCS5_PBKD2_PARAMS2
-  * pointer
-  *
-- * @param env - used to call JNI funktions to get the Java classes and objects
-- * @param jParam - the Java CK_PKCS5_PBKD2_PARAMS object to convert
-+ * @param env - used to call JNI functions to get the Java classes and objects
-+ * @param jParam - the Java object to convert
-  * @param pLength - length of the allocated memory of the returned pointer
-- * @return pointer to the new CK_PKCS5_PBKD2_PARAMS structure
-+ * @return pointer to the new structure
-  */
--CK_PKCS5_PBKD2_PARAMS_PTR
-+CK_VOID_PTR
- jPkcs5Pbkd2ParamToCKPkcs5Pbkd2ParamPtr(JNIEnv *env, jobject jParam, CK_ULONG *pLength)
- {
--    CK_PKCS5_PBKD2_PARAMS_PTR ckParamPtr;
-+    VersionedPbkd2ParamsPtr ckParamPtr;
-+    ParamVersion paramVersion;
-+    CK_ULONG_PTR pUlPasswordLen;
-     jclass jPkcs5Pbkd2ParamsClass;
-     jfieldID fieldID;
-     jlong jSaltSource, jIteration, jPrf;
--    jobject jSaltSourceData, jPrfData;
-+    jobject jSaltSourceData, jPrfData, jPassword;
- 
-     if (pLength != NULL) {
-         *pLength = 0L;
+diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java
+index 920422376f8..6aa308fa5f8 100644
+--- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java
++++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java
+@@ -215,6 +215,14 @@ public class PKCS11Exception extends Exception {
+         return res;
      }
  
-     // retrieve java values
--    jPkcs5Pbkd2ParamsClass = (*env)->FindClass(env, CLASS_PKCS5_PBKD2_PARAMS);
--    if (jPkcs5Pbkd2ParamsClass == NULL) { return NULL; }
-+    if ((jPkcs5Pbkd2ParamsClass =
-+            (*env)->FindClass(env, CLASS_PKCS5_PBKD2_PARAMS)) != NULL
-+            && (*env)->IsInstanceOf(env, jParam, jPkcs5Pbkd2ParamsClass)) {
-+        paramVersion = PARAMS;
-+    } else if ((jPkcs5Pbkd2ParamsClass =
-+            (*env)->FindClass(env, CLASS_PKCS5_PBKD2_PARAMS2)) != NULL
-+            && (*env)->IsInstanceOf(env, jParam, jPkcs5Pbkd2ParamsClass)) {
-+        paramVersion = PARAMS2;
-+    } else {
-+        return NULL;
++    /**
++     * Constructor taking the error code from the RV enum and
++     * extra info for error message.
++     */
++    public PKCS11Exception(RV errorEnum, String extraInfo) {
++        this(errorEnum.value, extraInfo);
 +    }
-     fieldID = (*env)->GetFieldID(env, jPkcs5Pbkd2ParamsClass, "saltSource", "J");
-     if (fieldID == NULL) { return NULL; }
-     jSaltSource = (*env)->GetLongField(env, jParam, fieldID);
-@@ -1807,36 +1839,60 @@ jPkcs5Pbkd2ParamToCKPkcs5Pbkd2ParamPtr(JNIEnv *env, jobject jParam, CK_ULONG *pL
-     fieldID = (*env)->GetFieldID(env, jPkcs5Pbkd2ParamsClass, "pPrfData", "[B");
-     if (fieldID == NULL) { return NULL; }
-     jPrfData = (*env)->GetObjectField(env, jParam, fieldID);
-+    fieldID = (*env)->GetFieldID(env, jPkcs5Pbkd2ParamsClass, "pPassword", "[C");
-+    if (fieldID == NULL) { return NULL; }
-+    jPassword = (*env)->GetObjectField(env, jParam, fieldID);
- 
--    // allocate memory for CK_PKCS5_PBKD2_PARAMS pointer
--    ckParamPtr = calloc(1, sizeof(CK_PKCS5_PBKD2_PARAMS));
-+    // allocate memory for VersionedPbkd2Params and store the structure version
-+    ckParamPtr = calloc(1, sizeof(VersionedPbkd2Params));
-     if (ckParamPtr == NULL) {
-         throwOutOfMemoryError(env, 0);
-         return NULL;
-     }
-+    ckParamPtr->version = paramVersion;
- 
-     // populate using java values
--    ckParamPtr->saltSource = jLongToCKULong(jSaltSource);
--    jByteArrayToCKByteArray(env, jSaltSourceData, (CK_BYTE_PTR *)
--            &(ckParamPtr->pSaltSourceData), &(ckParamPtr->ulSaltSourceDataLen));
-+    PBKD2_PARAM_SET(saltSource, jLongToCKULong(jSaltSource));
-+    jByteArrayToCKByteArray(env, jSaltSourceData,
-+            (CK_BYTE_PTR *) PBKD2_PARAM_ADDR(pSaltSourceData),
-+            PBKD2_PARAM_ADDR(ulSaltSourceDataLen));
-     if ((*env)->ExceptionCheck(env)) {
-         goto cleanup;
-     }
--    ckParamPtr->iterations = jLongToCKULong(jIteration);
--    ckParamPtr->prf = jLongToCKULong(jPrf);
--    jByteArrayToCKByteArray(env, jPrfData, (CK_BYTE_PTR *)
--            &(ckParamPtr->pPrfData), &(ckParamPtr->ulPrfDataLen));
-+    PBKD2_PARAM_SET(iterations, jLongToCKULong(jIteration));
-+    PBKD2_PARAM_SET(prf, jLongToCKULong(jPrf));
-+    jByteArrayToCKByteArray(env, jPrfData,
-+            (CK_BYTE_PTR *) PBKD2_PARAM_ADDR(pPrfData),
-+            PBKD2_PARAM_ADDR(ulPrfDataLen));
-+    if ((*env)->ExceptionCheck(env)) {
-+        goto cleanup;
-+    }
-+    if (ckParamPtr->version == PARAMS) {
-+        pUlPasswordLen = calloc(1, sizeof(CK_ULONG));
-+        if (pUlPasswordLen == NULL) {
-+            throwOutOfMemoryError(env, 0);
-+            goto cleanup;
-+        }
-+        ckParamPtr->params.v1.ulPasswordLen = pUlPasswordLen;
-+    } else {
-+        pUlPasswordLen = &ckParamPtr->params.v2.ulPasswordLen;
-+    }
-+    jCharArrayToCKUTF8CharArray(env, jPassword,
-+            (CK_CHAR_PTR *) PBKD2_PARAM_ADDR(pPassword),
-+            pUlPasswordLen);
-     if ((*env)->ExceptionCheck(env)) {
-         goto cleanup;
-     }
- 
-     if (pLength != NULL) {
--        *pLength = sizeof(CK_PKCS5_PBKD2_PARAMS);
-+        *pLength = (ckParamPtr->version == PARAMS ?
-+            sizeof(ckParamPtr->params.v1) :
-+            sizeof(ckParamPtr->params.v2));
-     }
-+    // VersionedPbkd2ParamsPtr is equivalent to CK_PKCS5_PBKD2_PARAMS[2]_PTR
-     return ckParamPtr;
- cleanup:
--    free(ckParamPtr->pSaltSourceData);
--    free(ckParamPtr->pPrfData);
-+    FREE_VERSIONED_PBKD2_MEMBERS(ckParamPtr);
-     free(ckParamPtr);
-     return NULL;
- 
-diff --git a/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_util.c b/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_util.c
-index 520bd52a2cd..aa76945283d 100644
---- a/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_util.c
-+++ b/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_util.c
-@@ -410,11 +410,27 @@ void freeCKMechanismPtr(CK_MECHANISM_PTR mechPtr) {
-                  case CKM_CAMELLIA_CTR:
-                      // params do not contain pointers
-                      break;
-+                 case CKM_PKCS5_PBKD2:
-+                     // get the versioned structure from behind memory
-+                     TRACE0(((VersionedPbkd2ParamsPtr)tmp)->version == PARAMS ?
-+                             "[ CK_PKCS5_PBKD2_PARAMS ]\n" :
-+                             "[ CK_PKCS5_PBKD2_PARAMS2 ]\n");
-+                     FREE_VERSIONED_PBKD2_MEMBERS((VersionedPbkd2ParamsPtr)tmp);
-+                     break;
-+                 case CKM_PBA_SHA1_WITH_SHA1_HMAC:
-+                 case CKM_NSS_PKCS12_PBE_SHA224_HMAC_KEY_GEN:
-+                 case CKM_NSS_PKCS12_PBE_SHA256_HMAC_KEY_GEN:
-+                 case CKM_NSS_PKCS12_PBE_SHA384_HMAC_KEY_GEN:
-+                 case CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN:
-+                     free(((CK_PBE_PARAMS_PTR)tmp)->pInitVector);
-+                     free(((CK_PBE_PARAMS_PTR)tmp)->pPassword);
-+                     free(((CK_PBE_PARAMS_PTR)tmp)->pSalt);
-+                     break;
-                  default:
-                      // currently unsupported mechs by SunPKCS11 provider
-                      // CKM_RSA_PKCS_OAEP, CKM_ECMQV_DERIVE,
-                      // CKM_X9_42_*, CKM_KEA_DERIVE, CKM_RC2_*, CKM_RC5_*,
--                     // CKM_SKIPJACK_*, CKM_KEY_WRAP_SET_OAEP, CKM_PKCS5_PBKD2,
-+                     // CKM_SKIPJACK_*, CKM_KEY_WRAP_SET_OAEP,
-                      // PBE mechs, WTLS mechs, CMS mechs,
-                      // CKM_EXTRACT_KEY_FROM_KEY, CKM_OTP, CKM_KIP,
-                      // CKM_DSA_PARAMETER_GEN?, CKM_GOSTR3410_*
-@@ -517,12 +533,11 @@ void jBooleanArrayToCKBBoolArray(JNIEnv *env, const jbooleanArray jArray, CK_BBO
-     jboolean* jpTemp;
-     CK_ULONG i;
- 
--    if(jArray == NULL) {
-+    *ckpLength = jArray == NULL ? 0L : (*env)->GetArrayLength(env, jArray);
-+    if(*ckpLength == 0L) {
-         *ckpArray = NULL_PTR;
--        *ckpLength = 0L;
-         return;
-     }
--    *ckpLength = (*env)->GetArrayLength(env, jArray);
-     jpTemp = (jboolean*) calloc(*ckpLength, sizeof(jboolean));
-     if (jpTemp == NULL) {
-         throwOutOfMemoryError(env, 0);
-@@ -559,12 +574,11 @@ void jByteArrayToCKByteArray(JNIEnv *env, const jbyteArray jArray, CK_BYTE_PTR *
-     jbyte* jpTemp;
-     CK_ULONG i;
- 
--    if(jArray == NULL) {
-+    *ckpLength = jArray == NULL ? 0L : (*env)->GetArrayLength(env, jArray);
-+    if(*ckpLength == 0L) {
-         *ckpArray = NULL_PTR;
--        *ckpLength = 0L;
-         return;
-     }
--    *ckpLength = (*env)->GetArrayLength(env, jArray);
-     jpTemp = (jbyte*) calloc(*ckpLength, sizeof(jbyte));
-     if (jpTemp == NULL) {
-         throwOutOfMemoryError(env, 0);
-@@ -606,12 +620,11 @@ void jLongArrayToCKULongArray(JNIEnv *env, const jlongArray jArray, CK_ULONG_PTR
-     jlong* jTemp;
-     CK_ULONG i;
- 
--    if(jArray == NULL) {
-+    *ckpLength = jArray == NULL ? 0L : (*env)->GetArrayLength(env, jArray);
-+    if(*ckpLength == 0L) {
-         *ckpArray = NULL_PTR;
--        *ckpLength = 0L;
-         return;
-     }
--    *ckpLength = (*env)->GetArrayLength(env, jArray);
-     jTemp = (jlong*) calloc(*ckpLength, sizeof(jlong));
-     if (jTemp == NULL) {
-         throwOutOfMemoryError(env, 0);
-@@ -648,12 +661,11 @@ void jCharArrayToCKCharArray(JNIEnv *env, const jcharArray jArray, CK_CHAR_PTR *
-     jchar* jpTemp;
-     CK_ULONG i;
- 
--    if(jArray == NULL) {
-+    *ckpLength = jArray == NULL ? 0L : (*env)->GetArrayLength(env, jArray);
-+    if(*ckpLength == 0L) {
-         *ckpArray = NULL_PTR;
--        *ckpLength = 0L;
-         return;
-     }
--    *ckpLength = (*env)->GetArrayLength(env, jArray);
-     jpTemp = (jchar*) calloc(*ckpLength, sizeof(jchar));
-     if (jpTemp == NULL) {
-         throwOutOfMemoryError(env, 0);
-@@ -690,12 +702,11 @@ void jCharArrayToCKUTF8CharArray(JNIEnv *env, const jcharArray jArray, CK_UTF8CH
-     jchar* jTemp;
-     CK_ULONG i;
- 
--    if(jArray == NULL) {
-+    *ckpLength = jArray == NULL ? 0L : (*env)->GetArrayLength(env, jArray);
-+    if(*ckpLength == 0L) {
-         *ckpArray = NULL_PTR;
--        *ckpLength = 0L;
-         return;
-     }
--    *ckpLength = (*env)->GetArrayLength(env, jArray);
-     jTemp = (jchar*) calloc(*ckpLength, sizeof(jchar));
-     if (jTemp == NULL) {
-         throwOutOfMemoryError(env, 0);
-diff --git a/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/pkcs11wrapper.h b/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/pkcs11wrapper.h
-index eb6d01b9e47..450e4d27d62 100644
---- a/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/pkcs11wrapper.h
-+++ b/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/pkcs11wrapper.h
-@@ -68,6 +68,7 @@
- /* extra PKCS#11 constants not in the standard include files */
- 
- #define CKA_NETSCAPE_BASE                       (0x80000000 + 0x4E534350)
-+/*             ^ now known as CKM_NSS   (CKM_VENDOR_DEFINED | NSSCK_VENDOR_NSS) */
- #define CKA_NETSCAPE_TRUST_BASE                 (CKA_NETSCAPE_BASE + 0x2000)
- #define CKA_NETSCAPE_TRUST_SERVER_AUTH          (CKA_NETSCAPE_TRUST_BASE + 8)
- #define CKA_NETSCAPE_TRUST_CLIENT_AUTH          (CKA_NETSCAPE_TRUST_BASE + 9)
-@@ -76,6 +77,12 @@
- #define CKA_NETSCAPE_DB                         0xD5A0DB00
- #define CKM_NSS_TLS_PRF_GENERAL                 0x80000373
- 
-+/* additional PKCS #12 PBE key derivation algorithms defined in NSS v3.29 */
-+#define CKM_NSS_PKCS12_PBE_SHA224_HMAC_KEY_GEN  (CKA_NETSCAPE_BASE + 29)
-+#define CKM_NSS_PKCS12_PBE_SHA256_HMAC_KEY_GEN  (CKA_NETSCAPE_BASE + 30)
-+#define CKM_NSS_PKCS12_PBE_SHA384_HMAC_KEY_GEN  (CKA_NETSCAPE_BASE + 31)
-+#define CKM_NSS_PKCS12_PBE_SHA512_HMAC_KEY_GEN  (CKA_NETSCAPE_BASE + 32)
 +
- /*
- 
-  Define the PKCS#11 functions to include and exclude. Reduces the size
-@@ -265,6 +272,7 @@ void printDebug(const char *format, ...);
- #define CLASS_PBE_PARAMS "sun/security/pkcs11/wrapper/CK_PBE_PARAMS"
- #define PBE_INIT_VECTOR_SIZE 8
- #define CLASS_PKCS5_PBKD2_PARAMS "sun/security/pkcs11/wrapper/CK_PKCS5_PBKD2_PARAMS"
-+#define CLASS_PKCS5_PBKD2_PARAMS2 "sun/security/pkcs11/wrapper/CK_PKCS5_PBKD2_PARAMS2"
- #define CLASS_EXTRACT_PARAMS "sun/security/pkcs11/wrapper/CK_EXTRACT_PARAMS"
- 
- #define CLASS_ECDH1_DERIVE_PARAMS "sun/security/pkcs11/wrapper/CK_ECDH1_DERIVE_PARAMS"
-@@ -378,7 +386,7 @@ CK_VOID_PTR jMechParamToCKMechParamPtr(JNIEnv *env, jobject jParam, CK_MECHANISM
- CK_RSA_PKCS_OAEP_PARAMS_PTR jRsaPkcsOaepParamToCKRsaPkcsOaepParamPtr(JNIEnv *env,
-     jobject jParam, CK_ULONG* pLength);
- CK_PBE_PARAMS_PTR jPbeParamToCKPbeParamPtr(JNIEnv *env, jobject jParam, CK_ULONG* pLength);
--CK_PKCS5_PBKD2_PARAMS_PTR jPkcs5Pbkd2ParamToCKPkcs5Pbkd2ParamPtr(JNIEnv *env, jobject jParam, CK_ULONG* pLength);
-+CK_VOID_PTR jPkcs5Pbkd2ParamToCKPkcs5Pbkd2ParamPtr(JNIEnv *env, jobject jParam, CK_ULONG* pLength);
- CK_SSL3_MASTER_KEY_DERIVE_PARAMS_PTR jSsl3MasterKeyDeriveParamToCKSsl3MasterKeyDeriveParamPtr(JNIEnv *env, jobject jParam, CK_ULONG* pLength);
- CK_SSL3_KEY_MAT_PARAMS_PTR jSsl3KeyMatParamToCKSsl3KeyMatParamPtr(JNIEnv *env, jobject jParam, CK_ULONG* pLength);
- CK_KEY_DERIVATION_STRING_DATA jKeyDerivationStringDataToCKKeyDerivationStringData(JNIEnv *env, jobject jParam);
-@@ -388,6 +396,31 @@ CK_ECDH2_DERIVE_PARAMS_PTR jEcdh2DeriveParamToCKEcdh2DeriveParamPtr(JNIEnv *env,
- CK_X9_42_DH1_DERIVE_PARAMS_PTR jX942Dh1DeriveParamToCKX942Dh1DeriveParamPtr(JNIEnv *env, jobject jParam, CK_ULONG* pLength);
- CK_X9_42_DH2_DERIVE_PARAMS_PTR jX942Dh2DeriveParamToCKX942Dh2DeriveParamPtr(JNIEnv *env, jobject jParam, CK_ULONG* pLength);
- 
-+/* handling of CK_PKCS5_PBKD2_PARAMS and CK_PKCS5_PBKD2_PARAMS2 */
-+typedef enum {PARAMS=0, PARAMS2} ParamVersion;
-+
-+typedef struct {
-+    union {
-+        CK_PKCS5_PBKD2_PARAMS v1;
-+        CK_PKCS5_PBKD2_PARAMS2 v2;
-+    } params;
-+    ParamVersion version;
-+} VersionedPbkd2Params, *VersionedPbkd2ParamsPtr;
-+
-+#define FREE_VERSIONED_PBKD2_MEMBERS(verParamsPtr)                  \
-+    do {                                                            \
-+        if ((verParamsPtr)->version == PARAMS) {                    \
-+            free((verParamsPtr)->params.v1.pSaltSourceData);        \
-+            free((verParamsPtr)->params.v1.pPrfData);               \
-+            free((verParamsPtr)->params.v1.pPassword);              \
-+            free((verParamsPtr)->params.v1.ulPasswordLen);          \
-+        } else {                                                    \
-+            free((verParamsPtr)->params.v2.pSaltSourceData);        \
-+            free((verParamsPtr)->params.v2.pPrfData);               \
-+            free((verParamsPtr)->params.v2.pPassword);              \
-+        }                                                           \
-+    } while(0)
-+
- /* functions to copy the returned values inside CK-mechanism back to Java object */
- 
- void copyBackPBEInitializationVector(JNIEnv *env, CK_MECHANISM *ckMechanism, jobject jMechanism);
+     /**
+      * Constructor taking the error code (the CKR_* constants in PKCS#11) and
+      * extra info for error message.
 diff --git a/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java b/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
-index 8c9e4f9dbe6..883dc04758e 100644
+index 7f8c4dba002..e65b11fc3ee 100644
 --- a/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
 +++ b/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
-@@ -38,6 +38,7 @@ import java.util.HashMap;
- import java.util.Iterator;
+@@ -34,6 +34,7 @@ import java.security.ProviderException;
+ import java.util.HashMap;
  import java.util.List;
  
 +import jdk.internal.access.SharedSecrets;
- import sun.security.ec.ed.EdDSAAlgorithmParameters;
  import sun.security.ec.ed.EdDSAKeyFactory;
  import sun.security.ec.ed.EdDSAKeyPairGenerator;
-@@ -56,6 +57,10 @@ public final class SunEC extends Provider {
+ import sun.security.ec.ed.EdDSASignature;
+@@ -50,6 +51,10 @@ public final class SunEC extends Provider {
  
      private static final long serialVersionUID = -2279741672933606418L;
  
@@ -5683,11 +3548,10 @@ index 8c9e4f9dbe6..883dc04758e 100644
      private static class ProviderServiceA extends ProviderService {
          ProviderServiceA(Provider p, String type, String algo, String cn,
              HashMap attrs) {
-@@ -249,85 +254,86 @@ public final class SunEC extends Provider {
- 
+@@ -240,83 +245,85 @@ public final class SunEC extends Provider {
          putXDHEntries();
          putEdDSAEntries();
--
+ 
 -        /*
 -         * Signature engines
 -         */
@@ -5757,9 +3621,8 @@ index 8c9e4f9dbe6..883dc04758e 100644
 -        /*
 -         *  Key Pair Generator engine
 -         */
--        putService(new ProviderService(this, "KeyPairGenerator",
--            "EC", "sun.security.ec.ECKeyPairGenerator",
--            List.of("EllipticCurve"), ATTRS));
+-        putService(new ProviderServiceA(this, "KeyPairGenerator",
+-            "EC", "sun.security.ec.ECKeyPairGenerator", ATTRS));
 -
 -        /*
 -         * Key Agreement engine
@@ -5836,9 +3699,8 @@ index 8c9e4f9dbe6..883dc04758e 100644
 +            /*
 +             *  Key Pair Generator engine
 +             */
-+            putService(new ProviderService(this, "KeyPairGenerator",
-+                "EC", "sun.security.ec.ECKeyPairGenerator",
-+                List.of("EllipticCurve"), ATTRS));
++            putService(new ProviderServiceA(this, "KeyPairGenerator",
++                "EC", "sun.security.ec.ECKeyPairGenerator", ATTRS));
 +
 +            /*
 +             * Key Agreement engine
@@ -5849,7 +3711,7 @@ index 8c9e4f9dbe6..883dc04758e 100644
      }
  
      private void putXDHEntries() {
-@@ -344,23 +350,25 @@ public final class SunEC extends Provider {
+@@ -333,23 +340,25 @@ public final class SunEC extends Provider {
              "X448", "sun.security.ec.XDHKeyFactory.X448",
              ATTRS));
  
@@ -5892,7 +3754,7 @@ index 8c9e4f9dbe6..883dc04758e 100644
      }
  
      private void putEdDSAEntries() {
-@@ -375,21 +383,23 @@ public final class SunEC extends Provider {
+@@ -364,21 +373,23 @@ public final class SunEC extends Provider {
          putService(new ProviderServiceA(this, "KeyFactory",
              "Ed448", "sun.security.ec.ed.EdDSAKeyFactory.Ed448", ATTRS));
  
@@ -5931,883 +3793,6 @@ index 8c9e4f9dbe6..883dc04758e 100644
  
      }
  }
-diff --git a/test/jdk/sun/security/pkcs11/Cipher/PBECipher.java b/test/jdk/sun/security/pkcs11/Cipher/PBECipher.java
-new file mode 100644
-index 00000000000..a184a169732
---- /dev/null
-+++ b/test/jdk/sun/security/pkcs11/Cipher/PBECipher.java
-@@ -0,0 +1,233 @@
-+/*
-+ * Copyright (c) 2022, Red Hat, Inc.
-+ *
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+import java.math.BigInteger;
-+import java.security.AlgorithmParameters;
-+import java.security.NoSuchAlgorithmException;
-+import java.security.Provider;
-+import java.security.SecureRandom;
-+import java.security.Security;
-+import java.util.Map;
-+
-+import javax.crypto.Cipher;
-+import javax.crypto.SecretKey;
-+import javax.crypto.SecretKeyFactory;
-+import javax.crypto.interfaces.PBEKey;
-+import javax.crypto.spec.IvParameterSpec;
-+import javax.crypto.spec.PBEKeySpec;
-+import javax.crypto.spec.PBEParameterSpec;
-+
-+/*
-+ * @test
-+ * @bug 9999999
-+ * @summary test password based encryption on SunPKCS11's Cipher service
-+ * @requires (jdk.version.major >= 8)
-+ * @library /test/lib ..
-+ * @run main/othervm/timeout=30 PBECipher
-+ */
-+
-+public final class PBECipher {
-+    public static void main(String[] args) throws Exception {
-+        java.security.Security.getProviders();
-+        PBECipher2.main(args);
-+    }
-+}
-+
-+final class PBECipher2 extends PKCS11Test {
-+    private static final char[] password = "123456".toCharArray();
-+    private static final byte[] salt = "abcdefgh".getBytes();
-+    private static final byte[] iv = new byte[16];
-+    private static final int iterations = 1000;
-+    private static final String plainText = "This is a know plain text!";
-+    private static final String sep =
-+    "=========================================================================";
-+
-+    private static enum Configuration {
-+        // Provide salt and iterations through a PBEParameterSpec instance
-+        PBEParameterSpec,
-+
-+        // Provide salt and iterations through a AlgorithmParameters instance
-+        AlgorithmParameters,
-+
-+        // Provide salt and iterations through an anonymous class implementing
-+        // the javax.crypto.interfaces.PBEKey interface
-+        AnonymousPBEKey,
-+    }
-+
-+    private static Provider sunJCE = Security.getProvider("SunJCE");
-+
-+    // Generated with SunJCE
-+    private static final Map assertionData = Map.of(
-+            "PBEWithHmacSHA1AndAES_128", new BigInteger("8eebe98a580fb09d026" +
-+                    "dbfe60b3733b079e0de9ea7b0b1ccba011a1652d1e257", 16),
-+            "PBEWithHmacSHA224AndAES_128", new BigInteger("1cbabdeb5d483af4a" +
-+                    "841942f4b1095b7d6f60e46fabfd2609c015adc38cc227", 16),
-+            "PBEWithHmacSHA256AndAES_128", new BigInteger("4d82f6591df3508d2" +
-+                    "4531f06cdc4f90f4bdab7aeb07fbb57a3712e999d5b6f59", 16),
-+            "PBEWithHmacSHA384AndAES_128", new BigInteger("3a0ed0959d51f40b9" +
-+                    "ba9f506a5277f430521f2fbe1ba94bae368835f221b6cb9", 16),
-+            "PBEWithHmacSHA512AndAES_128", new BigInteger("1388287a446009309" +
-+                    "1418f4eca3ba1735b1fa025423d74ced36ce578d8ebf9da", 16),
-+            "PBEWithHmacSHA1AndAES_256", new BigInteger("80f8208daab27ed02dd" +
-+                    "8a354ef6f23ff7813c84dd1c8a1b081d6f4dee27182a2", 16),
-+            "PBEWithHmacSHA224AndAES_256", new BigInteger("7e3b9ce20aec2e52f" +
-+                    "f6c781602d4f79a55a88495b5217f1e22e1a068268e6247", 16),
-+            "PBEWithHmacSHA256AndAES_256", new BigInteger("9d6a8b6a351dfd0dd" +
-+                    "9e9f45924b2860dca7719c4c07e207a64ebc1acd16cc157", 16),
-+            "PBEWithHmacSHA384AndAES_256", new BigInteger("6f1b386cee3a8e2d9" +
-+                    "8c2e81828da0467dec8b989d22258efeab5932580d01d53", 16),
-+            "PBEWithHmacSHA512AndAES_256", new BigInteger("30aaa346b2edd394f" +
-+                    "50916187876ac32f1287b19d55c5eea6f7ef9b84aaf291e", 16)
-+            );
-+
-+    private static final class NoRandom extends SecureRandom {
-+        @Override
-+        public void nextBytes(byte[] bytes) {
-+            return;
-+        }
-+    }
-+
-+    public void main(Provider sunPKCS11) throws Exception {
-+        System.out.println("SunPKCS11: " + sunPKCS11.getName());
-+        for (Configuration conf : Configuration.values()) {
-+            testWith(sunPKCS11, "PBEWithHmacSHA1AndAES_128", conf);
-+            testWith(sunPKCS11, "PBEWithHmacSHA224AndAES_128", conf);
-+            testWith(sunPKCS11, "PBEWithHmacSHA256AndAES_128", conf);
-+            testWith(sunPKCS11, "PBEWithHmacSHA384AndAES_128", conf);
-+            testWith(sunPKCS11, "PBEWithHmacSHA512AndAES_128", conf);
-+            testWith(sunPKCS11, "PBEWithHmacSHA1AndAES_256", conf);
-+            testWith(sunPKCS11, "PBEWithHmacSHA224AndAES_256", conf);
-+            testWith(sunPKCS11, "PBEWithHmacSHA256AndAES_256", conf);
-+            testWith(sunPKCS11, "PBEWithHmacSHA384AndAES_256", conf);
-+            testWith(sunPKCS11, "PBEWithHmacSHA512AndAES_256", conf);
-+        }
-+        System.out.println("TEST PASS - OK");
-+    }
-+
-+    private void testWith(Provider sunPKCS11, String algorithm,
-+            Configuration conf) throws Exception {
-+        System.out.println(sep + System.lineSeparator() + algorithm
-+                + " (with " + conf.name() + ")");
-+
-+        Cipher pbeCipher = getCipher(sunPKCS11, algorithm, conf);
-+        BigInteger cipherText = new BigInteger(1, pbeCipher.doFinal(
-+                plainText.getBytes()));
-+        printByteArray("Cipher Text", cipherText);
-+
-+        BigInteger expectedCipherText = null;
-+        if (sunJCE != null) {
-+            Cipher c = getCipher(sunJCE, algorithm, conf);
-+            if (c != null) {
-+                expectedCipherText = new BigInteger(1, c.doFinal(
-+                        plainText.getBytes()));
-+            } else {
-+                // Move to assertionData as it's unlikely that any of
-+                // the algorithms are available.
-+                sunJCE = null;
-+            }
-+        }
-+        if (expectedCipherText == null) {
-+            // If SunJCE or the algorithm are not available, assertionData
-+            // is used instead.
-+            expectedCipherText = assertionData.get(algorithm);
-+        }
-+
-+        if (!cipherText.equals(expectedCipherText)) {
-+            printByteArray("Expected Cipher Text", expectedCipherText);
-+            throw new Exception("Expected Cipher Text did not match");
-+        }
-+    }
-+
-+    private Cipher getCipher(Provider p, String algorithm,
-+            Configuration conf) throws Exception {
-+        Cipher pbeCipher = null;
-+        try {
-+            pbeCipher = Cipher.getInstance(algorithm, p);
-+        } catch (NoSuchAlgorithmException e) {
-+            return null;
-+        }
-+        switch (conf) {
-+            case PBEParameterSpec, AlgorithmParameters -> {
-+                SecretKey key = getPasswordOnlyPBEKey();
-+                PBEParameterSpec paramSpec = new PBEParameterSpec(
-+                        salt, iterations, new IvParameterSpec(iv));
-+                switch (conf) {
-+                    case PBEParameterSpec -> {
-+                        pbeCipher.init(Cipher.ENCRYPT_MODE, key, paramSpec);
-+                    }
-+                    case AlgorithmParameters -> {
-+                        AlgorithmParameters algoParams =
-+                                AlgorithmParameters.getInstance("PBES2");
-+                        algoParams.init(paramSpec);
-+                        pbeCipher.init(Cipher.ENCRYPT_MODE, key, algoParams);
-+                    }
-+                }
-+            }
-+            case AnonymousPBEKey -> {
-+                SecretKey key = getPasswordSaltIterationsPBEKey();
-+                pbeCipher.init(Cipher.ENCRYPT_MODE, key, new NoRandom());
-+            }
-+        }
-+        return pbeCipher;
-+    }
-+
-+    private static SecretKey getPasswordOnlyPBEKey() throws Exception {
-+        PBEKeySpec keySpec = new PBEKeySpec(password);
-+        SecretKeyFactory skFac = SecretKeyFactory.getInstance("PBE");
-+        SecretKey skey = skFac.generateSecret(keySpec);
-+        keySpec.clearPassword();
-+        return skey;
-+    }
-+
-+    private static SecretKey getPasswordSaltIterationsPBEKey() {
-+        return new PBEKey() {
-+            public byte[] getSalt() { return salt.clone(); }
-+            public int getIterationCount() { return iterations; }
-+            public String getAlgorithm() { return "PBE"; }
-+            public String getFormat() { return "RAW"; }
-+            public char[] getPassword() { return null; } // unused in PBE Cipher
-+            public byte[] getEncoded() {
-+                byte[] passwdBytes = new byte[password.length];
-+                for (int i = 0; i < password.length; i++)
-+                    passwdBytes[i] = (byte) (password[i] & 0x7f);
-+                return passwdBytes;
-+            }
-+        };
-+    }
-+
-+    private static void printByteArray(String title, BigInteger b) {
-+        String repr = (b == null) ? "buffer is null" : b.toString(16);
-+        System.out.println(title + ": " + repr + System.lineSeparator());
-+    }
-+
-+    public static void main(String[] args) throws Exception {
-+        PBECipher2 test = new PBECipher2();
-+        Provider p = Security.getProvider("SunPKCS11-NSS-FIPS");
-+        if (p != null) {
-+            test.main(p);
-+        } else {
-+            main(test);
-+        }
-+    }
-+}
-diff --git a/test/jdk/sun/security/pkcs11/KeyStore/ImportKeyToP12.java b/test/jdk/sun/security/pkcs11/KeyStore/ImportKeyToP12.java
-new file mode 100644
-index 00000000000..360e11c339d
---- /dev/null
-+++ b/test/jdk/sun/security/pkcs11/KeyStore/ImportKeyToP12.java
-@@ -0,0 +1,137 @@
-+/*
-+ * Copyright (c) 2022, Red Hat, Inc.
-+ *
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+import java.io.ByteArrayInputStream;
-+import java.io.ByteArrayOutputStream;
-+import java.security.Key;
-+import java.security.KeyStore;
-+import java.security.KeyStoreException;
-+import java.security.MessageDigest;
-+import java.security.Provider;
-+import java.security.Security;
-+
-+import javax.crypto.spec.SecretKeySpec;
-+
-+/*
-+ * @test
-+ * @bug 9999999
-+ * @summary test SunPKCS11's password based privacy and integrity
-+ *          applied to PKCS#12 keystores
-+ * @requires (jdk.version.major >= 8)
-+ * @library /test/lib ..
-+ * @modules java.base/sun.security.util
-+ * @run main/othervm/timeout=30 -Dcom.redhat.fips=false -DNO_DEFAULT=true ImportKeyToP12
-+ */
-+
-+public final class ImportKeyToP12 {
-+    public static void main(String[] args) throws Exception {
-+        java.security.Security.getProviders();
-+        ImportKeyToP122.main(args);
-+    }
-+}
-+
-+final class ImportKeyToP122 extends PKCS11Test {
-+    private static final String alias = "alias";
-+    private static final char[] password = "123456".toCharArray();
-+    private static final Key key = new SecretKeySpec(new byte[] {
-+            0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7,
-+            0x8, 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf }, "AES");
-+    private static final String[] pbeCipherAlgs = new String[] {
-+            "PBEWithHmacSHA1AndAES_128", "PBEWithHmacSHA224AndAES_128",
-+            "PBEWithHmacSHA256AndAES_128", "PBEWithHmacSHA384AndAES_128",
-+            "PBEWithHmacSHA512AndAES_128", "PBEWithHmacSHA1AndAES_256",
-+            "PBEWithHmacSHA224AndAES_256", "PBEWithHmacSHA256AndAES_256",
-+            "PBEWithHmacSHA384AndAES_256", "PBEWithHmacSHA512AndAES_256"
-+    };
-+    private static final String[] pbeMacAlgs = new String[] {
-+            "HmacPBESHA1", "HmacPBESHA224", "HmacPBESHA256",
-+            "HmacPBESHA384", "HmacPBESHA512"
-+    };
-+    private static final KeyStore p12;
-+    private static final String sep =
-+    "=========================================================================";
-+
-+    static {
-+        KeyStore tP12 = null;
-+        try {
-+            tP12 = KeyStore.getInstance("PKCS12");
-+        } catch (KeyStoreException e) {}
-+        p12 = tP12;
-+    }
-+
-+    public void main(Provider sunPKCS11) throws Exception {
-+        System.out.println("SunPKCS11: " + sunPKCS11.getName());
-+        // Test all privacy PBE algorithms with an integrity algorithm fixed
-+        for (String pbeCipherAlg : pbeCipherAlgs) {
-+            testWith(sunPKCS11, pbeCipherAlg, pbeMacAlgs[0]);
-+        }
-+        // Test all integrity PBE algorithms with a privacy algorithm fixed
-+        for (String pbeMacAlg : pbeMacAlgs) {
-+            testWith(sunPKCS11, pbeCipherAlgs[0], pbeMacAlg);
-+        }
-+        System.out.println("TEST PASS - OK");
-+    }
-+
-+    /*
-+     * Consistency test: 1) store a secret key in a PKCS#12 keystore using
-+     * PBE algorithms from SunPKCS11 and, 2) read the secret key from the
-+     * PKCS#12 keystore using PBE algorithms from other security providers
-+     * such as SunJCE.
-+     */
-+    private void testWith(Provider sunPKCS11, String pbeCipherAlg,
-+            String pbeMacAlg) throws Exception {
-+        System.out.println(sep + System.lineSeparator() +
-+                "Cipher PBE: " + pbeCipherAlg + System.lineSeparator() +
-+                "Mac PBE: " + pbeMacAlg);
-+
-+        System.setProperty("keystore.pkcs12.macAlgorithm", pbeMacAlg);
-+        System.setProperty("keystore.pkcs12.keyProtectionAlgorithm",
-+                pbeCipherAlg);
-+
-+        // Create an empty PKCS#12 keystore
-+        ByteArrayOutputStream baos = new ByteArrayOutputStream();
-+        p12.load(null, password);
-+
-+        // Use PBE privacy and integrity algorithms from SunPKCS11 to store
-+        // the secret key
-+        Security.insertProviderAt(sunPKCS11, 1);
-+        p12.setKeyEntry(alias, key, password, null);
-+        p12.store(baos, password);
-+
-+        // Use PBE privacy and integrity algorithms from other security
-+        // providers, such as SunJCE, to read the secret key
-+        Security.removeProvider(sunPKCS11.getName());
-+        p12.load(new ByteArrayInputStream(baos.toByteArray()), password);
-+        Key k = p12.getKey(alias, password);
-+
-+        if (!MessageDigest.isEqual(key.getEncoded(), k.getEncoded())) {
-+            throw new Exception("Keys differ. Consistency check failed.");
-+        }
-+        System.out.println("Secret key import successful" + System.lineSeparator() + sep);
-+    }
-+
-+    public static void main(String[] args) throws Exception {
-+        main(new ImportKeyToP122());
-+    }
-+}
-diff --git a/test/jdk/sun/security/pkcs11/Mac/PBAMac.java b/test/jdk/sun/security/pkcs11/Mac/PBAMac.java
-new file mode 100644
-index 00000000000..6b5662f6b4c
---- /dev/null
-+++ b/test/jdk/sun/security/pkcs11/Mac/PBAMac.java
-@@ -0,0 +1,187 @@
-+/*
-+ * Copyright (c) 2022, Red Hat, Inc.
-+ *
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+import java.math.BigInteger;
-+import java.security.NoSuchAlgorithmException;
-+import java.security.Provider;
-+import java.security.Security;
-+import java.util.Map;
-+
-+import javax.crypto.Mac;
-+import javax.crypto.SecretKey;
-+import javax.crypto.SecretKeyFactory;
-+import javax.crypto.interfaces.PBEKey;
-+import javax.crypto.spec.PBEKeySpec;
-+import javax.crypto.spec.PBEParameterSpec;
-+
-+/*
-+ * @test
-+ * @bug 9999999
-+ * @summary test password based authentication on SunPKCS11's Mac service
-+ * @requires (jdk.version.major >= 8)
-+ * @library /test/lib ..
-+ * @run main/othervm/timeout=30 PBAMac
-+ */
-+
-+public final class PBAMac {
-+    public static void main(String[] args) throws Exception {
-+        java.security.Security.getProviders();
-+        PBAMac2.main(args);
-+    }
-+}
-+
-+final class PBAMac2 extends PKCS11Test {
-+    private static final char[] password = "123456".toCharArray();
-+    private static final byte[] salt = "abcdefgh".getBytes();
-+    private static final int iterations = 1000;
-+    private static final String plainText = "This is a know plain text!";
-+    private static final String sep =
-+    "=========================================================================";
-+
-+    private static enum Configuration {
-+        // Provide salt & iterations through a PBEParameterSpec instance
-+        PBEParameterSpec,
-+
-+        // Provide salt & iterations through an anonymous class implementing
-+        // the javax.crypto.interfaces.PBEKey interface
-+        AnonymousPBEKey,
-+    }
-+
-+    // Generated with SunJCE
-+    private static final Map assertionData = Map.of(
-+            "HmacPBESHA1", new BigInteger("febd26da5d63ce819770a2af1fc2857e" +
-+                    "e2c9c41c", 16),
-+            "HmacPBESHA224", new BigInteger("aa6a3a1c35a4b266fea62d1a871508" +
-+                    "bd45f8ec326bcf16e09699063", 16),
-+            "HmacPBESHA256", new BigInteger("af4d71121fd4e9d52eb42944d99b77" +
-+                    "8ff64376fcf6af8d1dca3ec688dfada5c8", 16),
-+            "HmacPBESHA384", new BigInteger("5d6d37764205985ffca7e4a6222752" +
-+                    "a8bbd0520858da08ecafdc57e6246894675e375b9ba084f9ce7142" +
-+                    "35f202cc3452", 16),
-+            "HmacPBESHA512", new BigInteger("f586c2006cc2de73fd5743e5cca701" +
-+                    "c942d3741a7a54a2a649ea36898996cf3c483f2d734179b47751db" +
-+                    "e8373c980b4072136d2e2810f4e7276024a3e9081cc1", 16)
-+            );
-+
-+    private static Provider sunJCE = Security.getProvider("SunJCE");
-+
-+    public void main(Provider sunPKCS11) throws Exception {
-+        System.out.println("SunPKCS11: " + sunPKCS11.getName());
-+        for (Configuration conf : Configuration.values()) {
-+            testWith(sunPKCS11, "HmacPBESHA1", conf);
-+            testWith(sunPKCS11, "HmacPBESHA224", conf);
-+            testWith(sunPKCS11, "HmacPBESHA256", conf);
-+            testWith(sunPKCS11, "HmacPBESHA384", conf);
-+            testWith(sunPKCS11, "HmacPBESHA512", conf);
-+        }
-+        System.out.println("TEST PASS - OK");
-+    }
-+
-+    private void testWith(Provider sunPKCS11, String algorithm,
-+            Configuration conf) throws Exception {
-+        System.out.println(sep + System.lineSeparator() + algorithm
-+                + " (with " + conf.name() + ")");
-+
-+        BigInteger macResult = computeMac(sunPKCS11, algorithm, conf);
-+        printByteArray("HMAC Result", macResult);
-+
-+        BigInteger expectedMacResult = computeExpectedMac(algorithm, conf);
-+
-+        if (!macResult.equals(expectedMacResult)) {
-+            printByteArray("Expected HMAC Result", expectedMacResult);
-+            throw new Exception("Expected HMAC Result did not match");
-+        }
-+    }
-+
-+    private BigInteger computeMac(Provider p, String algorithm,
-+            Configuration conf) throws Exception {
-+        Mac pbaMac;
-+        try {
-+            pbaMac = Mac.getInstance(algorithm, p);
-+        } catch (NoSuchAlgorithmException e) {
-+            return null;
-+        }
-+        switch (conf) {
-+            case PBEParameterSpec -> {
-+                SecretKey key = getPasswordOnlyPBEKey();
-+                pbaMac.init(key, new PBEParameterSpec(salt, iterations));
-+            }
-+            case AnonymousPBEKey -> {
-+                SecretKey key = getPasswordSaltIterationsPBEKey();
-+                pbaMac.init(key);
-+            }
-+        }
-+        return new BigInteger(1, pbaMac.doFinal(plainText.getBytes()));
-+    }
-+
-+    private BigInteger computeExpectedMac(String algorithm, Configuration conf)
-+            throws Exception {
-+        if (sunJCE != null) {
-+            BigInteger macResult = computeMac(sunJCE, algorithm, conf);
-+            if (macResult != null) {
-+                return macResult;
-+            }
-+            // Move to assertionData as it's unlikely that any of
-+            // the algorithms are available.
-+            sunJCE = null;
-+        }
-+        // If SunJCE or the algorithm are not available, assertionData
-+        // is used instead.
-+        return assertionData.get(algorithm);
-+    }
-+
-+    private static SecretKey getPasswordOnlyPBEKey() throws Exception {
-+        PBEKeySpec keySpec = new PBEKeySpec(password);
-+        SecretKeyFactory skFac = SecretKeyFactory.getInstance("PBE");
-+        SecretKey skey = skFac.generateSecret(keySpec);
-+        keySpec.clearPassword();
-+        return skey;
-+    }
-+
-+    private static SecretKey getPasswordSaltIterationsPBEKey() {
-+        return new PBEKey() {
-+            public byte[] getSalt() { return salt.clone(); }
-+            public int getIterationCount() { return iterations; }
-+            public String getAlgorithm() { return "PBE"; }
-+            public String getFormat() { return "RAW"; }
-+            public char[] getPassword() { return password.clone(); }
-+            public byte[] getEncoded() { return null; } // unused in PBA Mac
-+        };
-+    }
-+
-+    private static void printByteArray(String title, BigInteger b) {
-+        String repr = (b == null) ? "buffer is null" : b.toString(16);
-+        System.out.println(title + ": " + repr + System.lineSeparator());
-+    }
-+
-+    public static void main(String[] args) throws Exception {
-+        PBAMac2 test = new PBAMac2();
-+        Provider p = Security.getProvider("SunPKCS11-NSS-FIPS");
-+        if (p != null) {
-+            test.main(p);
-+        } else {
-+            main(test);
-+        }
-+    }
-+}
-diff --git a/test/jdk/sun/security/pkcs11/SecretKeyFactory/TestPBKD.java b/test/jdk/sun/security/pkcs11/SecretKeyFactory/TestPBKD.java
-new file mode 100644
-index 00000000000..67c3cee5970
---- /dev/null
-+++ b/test/jdk/sun/security/pkcs11/SecretKeyFactory/TestPBKD.java
-@@ -0,0 +1,296 @@
-+/*
-+ * Copyright (c) 2022, Red Hat, Inc.
-+ *
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+import java.lang.reflect.Field;
-+import java.lang.reflect.Method;
-+import java.math.BigInteger;
-+import java.security.NoSuchAlgorithmException;
-+import java.security.Provider;
-+import java.security.Security;
-+import java.util.HashMap;
-+import java.util.Map;
-+
-+import javax.crypto.SecretKeyFactory;
-+import javax.crypto.spec.PBEKeySpec;
-+
-+/*
-+ * @test
-+ * @bug 9999999
-+ * @summary test key derivation on SunPKCS11's SecretKeyFactory service
-+ * @requires (jdk.version.major >= 8)
-+ * @library /test/lib ..
-+ * @modules java.base/com.sun.crypto.provider:open
-+ * @run main/othervm/timeout=30 TestPBKD
-+ */
-+
-+public final class TestPBKD {
-+    public static void main(String[] args) throws Exception {
-+        java.security.Security.getProviders();
-+        TestPBKD2.main(args);
-+    }
-+}
-+
-+final class TestPBKD2 extends PKCS11Test {
-+    private static final char[] password = "123456".toCharArray();
-+    private static final byte[] salt = "abcdefgh".getBytes();
-+    private static final int iterations = 1000;
-+    private static final String sep =
-+    "=========================================================================";
-+
-+    private static Provider sunJCE = Security.getProvider("SunJCE");
-+
-+    // Generated with SunJCE
-+    private static final Map assertionData =
-+            new HashMap<>() {{
-+                put("HmacPBESHA1", new BigInteger("5f7d1c360d1703cede76f47db" +
-+                        "2fa3facc62e7694", 16));
-+                put("HmacPBESHA224", new BigInteger("289563f799b708f522ab2a3" +
-+                        "8d283d0afa8fc1d3d227fcb9236c3a035", 16));
-+                put("HmacPBESHA256", new BigInteger("888defcf4ef37eb0647014a" +
-+                        "d172dd6fa3b3e9d024b962dba47608eea9b9c4b79", 16));
-+                put("HmacPBESHA384", new BigInteger("f5464b34253fadab8838d0d" +
-+                        "b11980c1787a99bf6f6304f2d8c942e30bada523494f9d5a0f3" +
-+                        "741e411de21add8b5718a8", 16));
-+                put("HmacPBESHA512", new BigInteger("18ae94337b132c68c611bc2" +
-+                        "e723ac24dcd44a46d900dae2dd6170380d4c34f90fef7bdeb5f" +
-+                        "6fddeb0d2230003e329b7a7eefcd35810d364ba95d31b68bb61" +
-+                        "e52", 16));
-+                put("PBEWithHmacSHA1AndAES_128", new BigInteger("fdb3dcc2e81" +
-+                        "244d4d56bf7ec8dd61dd7", 16));
-+                put("PBEWithHmacSHA224AndAES_128", new BigInteger("5ef9e5c6f" +
-+                        "df7c355f3b424233a9f24c2", 16));
-+                put("PBEWithHmacSHA256AndAES_128", new BigInteger("c5af597b0" +
-+                        "1b4f6baac8f62ff6f22bfb1", 16));
-+                put("PBEWithHmacSHA384AndAES_128", new BigInteger("c3208ebc5" +
-+                        "d6db88858988ec00153847d", 16));
-+                put("PBEWithHmacSHA512AndAES_128", new BigInteger("b27e8f7fb" +
-+                        "6a4bd5ebea892cd9a7f5043", 16));
-+                put("PBEWithHmacSHA1AndAES_256", new BigInteger("fdb3dcc2e81" +
-+                        "244d4d56bf7ec8dd61dd78a1b6fb3ad11d9ebd7f62027a2ccde" +
-+                        "98", 16));
-+                put("PBEWithHmacSHA224AndAES_256", new BigInteger("5ef9e5c6f" +
-+                        "df7c355f3b424233a9f24c2c9c41793cb0948b8ea3aac240b8d" +
-+                        "f64d", 16));
-+                put("PBEWithHmacSHA256AndAES_256", new BigInteger("c5af597b0" +
-+                        "1b4f6baac8f62ff6f22bfb1f319c3278c8b31cc616294716d4e" +
-+                        "ab08", 16));
-+                put("PBEWithHmacSHA384AndAES_256", new BigInteger("c3208ebc5" +
-+                        "d6db88858988ec00153847d5b1b7a8723640a022dc332bcaefe" +
-+                        "b356", 16));
-+                put("PBEWithHmacSHA512AndAES_256", new BigInteger("b27e8f7fb" +
-+                        "6a4bd5ebea892cd9a7f5043cefff9c38b07e599721e8d116189" +
-+                        "5482", 16));
-+                put("PBKDF2WithHmacSHA1", new BigInteger("fdb3dcc2e81244d4d5" +
-+                        "6bf7ec8dd61dd78a1b6fb3ad11d9ebd7f62027a2cc", 16));
-+                put("PBKDF2WithHmacSHA224", new BigInteger("5ef9e5c6fdf7c355" +
-+                        "f3b424233a9f24c2c9c41793cb0948b8ea3aac240b8df64d1a0" +
-+                        "736ec1c69eef1c7b2", 16));
-+                put("PBKDF2WithHmacSHA256", new BigInteger("c5af597b01b4f6ba" +
-+                        "ac8f62ff6f22bfb1f319c3278c8b31cc616294716d4eab080b9" +
-+                        "add9db34a42ceb2fea8d27adc00f4", 16));
-+                put("PBKDF2WithHmacSHA384", new BigInteger("c3208ebc5d6db888" +
-+                        "58988ec00153847d5b1b7a8723640a022dc332bcaefeb356995" +
-+                        "d076a949d35c42c7e1e1ca936c12f8dc918e497edf279a522b7" +
-+                        "c99580e2613846b3919af637da", 16));
-+                put("PBKDF2WithHmacSHA512", new BigInteger("b27e8f7fb6a4bd5e" +
-+                        "bea892cd9a7f5043cefff9c38b07e599721e8d1161895482da2" +
-+                        "55746844cc1030be37ba1969df10ff59554d1ac5468fa9b7297" +
-+                        "7bb7fd52103a0a7b488cdb8957616c3e23a16bca92120982180" +
-+                        "c6c11a4f14649b50d0ade3a", 16));
-+                }};
-+
-+    static interface AssertData {
-+        BigInteger derive(String pbAlgo, PBEKeySpec keySpec) throws Exception;
-+    }
-+
-+    static final class P12PBKDAssertData implements AssertData {
-+        private final int outLen;
-+        private final String kdfAlgo;
-+        private final int blockLen;
-+
-+        P12PBKDAssertData(int outLen, String kdfAlgo, int blockLen) {
-+            this.outLen = outLen;
-+            this.kdfAlgo = kdfAlgo;
-+            this.blockLen = blockLen;
-+        }
-+
-+        @Override
-+        public BigInteger derive(String pbAlgo, PBEKeySpec keySpec)
-+                throws Exception {
-+            // Since we need to access an internal SunJCE API, we use reflection
-+            Class PKCS12PBECipherCore = Class.forName(
-+                    "com.sun.crypto.provider.PKCS12PBECipherCore");
-+
-+            Field macKeyField = PKCS12PBECipherCore.getDeclaredField("MAC_KEY");
-+            macKeyField.setAccessible(true);
-+            int MAC_KEY = (int) macKeyField.get(null);
-+
-+            Method deriveMethod = PKCS12PBECipherCore.getDeclaredMethod(
-+                    "derive", char[].class, byte[].class, int.class,
-+                    int.class, int.class, String.class, int.class);
-+            deriveMethod.setAccessible(true);
-+
-+            return new BigInteger(1, (byte[]) deriveMethod.invoke(null,
-+                    keySpec.getPassword(), keySpec.getSalt(),
-+                    keySpec.getIterationCount(), this.outLen,
-+                    MAC_KEY, this.kdfAlgo, this.blockLen));
-+        }
-+    }
-+
-+    static final class PBKD2AssertData implements AssertData {
-+        private final String kdfAlgo;
-+        private final int keyLen;
-+
-+        PBKD2AssertData(String kdfAlgo, int keyLen) {
-+            // Key length is pinned by the algorithm name (not kdfAlgo,
-+            // but the algorithm under test: PBEWithHmacSHA*AndAES_*)
-+            this.kdfAlgo = kdfAlgo;
-+            this.keyLen = keyLen;
-+        }
-+
-+        PBKD2AssertData(String kdfAlgo) {
-+            // Key length is variable for the algorithm under test
-+            // (kdfAlgo is the algorithm under test: PBKDF2WithHmacSHA*)
-+            this(kdfAlgo, -1);
-+        }
-+
-+        @Override
-+        public BigInteger derive(String pbAlgo, PBEKeySpec keySpec)
-+                throws Exception {
-+            if (this.keyLen != -1) {
-+                keySpec = new PBEKeySpec(
-+                        keySpec.getPassword(), keySpec.getSalt(),
-+                        keySpec.getIterationCount(), this.keyLen);
-+            }
-+            if (sunJCE != null) {
-+                try {
-+                    return new BigInteger(1, SecretKeyFactory.getInstance(
-+                            this.kdfAlgo, sunJCE).generateSecret(keySpec)
-+                            .getEncoded());
-+                } catch (NoSuchAlgorithmException e) {
-+                    // Move to assertionData as it's unlikely that any of
-+                    // the algorithms are available.
-+                    sunJCE = null;
-+                }
-+            }
-+            // If SunJCE or the algorithm are not available, assertionData
-+            // is used instead.
-+            return assertionData.get(pbAlgo);
-+        }
-+    }
-+
-+    public void main(Provider sunPKCS11) throws Exception {
-+        System.out.println("SunPKCS11: " + sunPKCS11.getName());
-+        testWith(sunPKCS11, "HmacPBESHA1",
-+                new P12PBKDAssertData(20, "SHA-1", 64));
-+        testWith(sunPKCS11, "HmacPBESHA224",
-+                new P12PBKDAssertData(28, "SHA-224", 64));
-+        testWith(sunPKCS11, "HmacPBESHA256",
-+                new P12PBKDAssertData(32, "SHA-256", 64));
-+        testWith(sunPKCS11, "HmacPBESHA384",
-+                new P12PBKDAssertData(48, "SHA-384", 128));
-+        testWith(sunPKCS11, "HmacPBESHA512",
-+                new P12PBKDAssertData(64, "SHA-512", 128));
-+
-+        testWith(sunPKCS11, "PBEWithHmacSHA1AndAES_128",
-+                new PBKD2AssertData("PBKDF2WithHmacSHA1", 128));
-+        testWith(sunPKCS11, "PBEWithHmacSHA224AndAES_128",
-+                new PBKD2AssertData("PBKDF2WithHmacSHA224", 128));
-+        testWith(sunPKCS11, "PBEWithHmacSHA256AndAES_128",
-+                new PBKD2AssertData("PBKDF2WithHmacSHA256", 128));
-+        testWith(sunPKCS11, "PBEWithHmacSHA384AndAES_128",
-+                new PBKD2AssertData("PBKDF2WithHmacSHA384", 128));
-+        testWith(sunPKCS11, "PBEWithHmacSHA512AndAES_128",
-+                new PBKD2AssertData("PBKDF2WithHmacSHA512", 128));
-+        testWith(sunPKCS11, "PBEWithHmacSHA1AndAES_256",
-+                new PBKD2AssertData("PBKDF2WithHmacSHA1", 256));
-+        testWith(sunPKCS11, "PBEWithHmacSHA224AndAES_256",
-+                new PBKD2AssertData("PBKDF2WithHmacSHA224", 256));
-+        testWith(sunPKCS11, "PBEWithHmacSHA256AndAES_256",
-+                new PBKD2AssertData("PBKDF2WithHmacSHA256", 256));
-+        testWith(sunPKCS11, "PBEWithHmacSHA384AndAES_256",
-+                new PBKD2AssertData("PBKDF2WithHmacSHA384", 256));
-+        testWith(sunPKCS11, "PBEWithHmacSHA512AndAES_256",
-+                new PBKD2AssertData("PBKDF2WithHmacSHA512", 256));
-+
-+        // Use 1,5 * digest size as the testing derived key length (in bits)
-+        testWith(sunPKCS11, "PBKDF2WithHmacSHA1", 240,
-+                new PBKD2AssertData("PBKDF2WithHmacSHA1"));
-+        testWith(sunPKCS11, "PBKDF2WithHmacSHA224", 336,
-+                new PBKD2AssertData("PBKDF2WithHmacSHA224"));
-+        testWith(sunPKCS11, "PBKDF2WithHmacSHA256", 384,
-+                new PBKD2AssertData("PBKDF2WithHmacSHA256"));
-+        testWith(sunPKCS11, "PBKDF2WithHmacSHA384", 576,
-+                new PBKD2AssertData("PBKDF2WithHmacSHA384"));
-+        testWith(sunPKCS11, "PBKDF2WithHmacSHA512", 768,
-+                new PBKD2AssertData("PBKDF2WithHmacSHA512"));
-+
-+        System.out.println("TEST PASS - OK");
-+    }
-+
-+    private static void testWith(Provider sunPKCS11, String algorithm,
-+            AssertData assertData) throws Exception {
-+        PBEKeySpec keySpec = new PBEKeySpec(password, salt, iterations);
-+        testWith(sunPKCS11, algorithm, keySpec, assertData);
-+    }
-+
-+    private static void testWith(Provider sunPKCS11, String algorithm,
-+            int keyLen, AssertData assertData) throws Exception {
-+        PBEKeySpec keySpec = new PBEKeySpec(password, salt, iterations, keyLen);
-+        testWith(sunPKCS11, algorithm, keySpec, assertData);
-+    }
-+
-+    private static void testWith(Provider sunPKCS11, String algorithm,
-+            PBEKeySpec keySpec, AssertData assertData) throws Exception {
-+        System.out.println(sep + System.lineSeparator() + algorithm);
-+
-+        SecretKeyFactory skFac = SecretKeyFactory.getInstance(
-+                algorithm, sunPKCS11);
-+        BigInteger derivedKey = new BigInteger(1,
-+                skFac.generateSecret(keySpec).getEncoded());
-+        printByteArray("Derived Key", derivedKey);
-+
-+        BigInteger expectedDerivedKey = assertData.derive(algorithm, keySpec);
-+
-+        if (!derivedKey.equals(expectedDerivedKey)) {
-+            printByteArray("Expected Derived Key", expectedDerivedKey);
-+            throw new Exception("Expected Derived Key did not match");
-+        }
-+    }
-+
-+    private static void printByteArray(String title, BigInteger b) {
-+        String repr = (b == null) ? "buffer is null" : b.toString(16);
-+        System.out.println(title + ": " + repr + System.lineSeparator());
-+    }
-+
-+    public static void main(String[] args) throws Exception {
-+        TestPBKD2 test = new TestPBKD2();
-+        Provider p = Security.getProvider("SunPKCS11-NSS-FIPS");
-+        if (p != null) {
-+            test.main(p);
-+        } else {
-+            main(test);
-+        }
-+    }
-+}
 diff --git a/test/jdk/sun/security/pkcs11/fips/NssdbPin.java b/test/jdk/sun/security/pkcs11/fips/NssdbPin.java
 new file mode 100644
 index 00000000000..ce01c655eb8
diff --git a/java-21-openjdk-portable.specfile b/SOURCES/java-21-openjdk-portable.specfile
similarity index 85%
rename from java-21-openjdk-portable.specfile
rename to SOURCES/java-21-openjdk-portable.specfile
index 1f3ad8d..045e803 100644
--- a/java-21-openjdk-portable.specfile
+++ b/SOURCES/java-21-openjdk-portable.specfile
@@ -1,6 +1,3 @@
-# portable jdk 21 specific bug, _jvmdir being missing
-%define _jvmdir /usr/lib/jvm
-
 # debug_package %%{nil} is portable-jdks specific
 %define  debug_package %{nil}
 
@@ -31,6 +28,10 @@
 # Build with system libraries
 %bcond_with system_libs
 
+# This is RHEL 7 specific as it doesn't seem to have the
+# __brp_strip_static_archive macro.
+%define __os_install_post %{nil}
+
 # Workaround for stripping of debug symbols from static libraries
 %if %{with staticlibs}
 %define __brp_strip_static_archive %{nil}
@@ -39,13 +40,6 @@
 %global include_staticlibs 0
 %endif
 
-# Define whether to use the bootstrap JDK directly or with a fresh libjvm.so
-%if %{with fresh_libjvm}
-%global build_hotspot_first 1
-%else
-%global build_hotspot_first 0
-%endif
-
 %if %{with system_libs}
 %global system_libs 1
 %global link_type system
@@ -61,10 +55,6 @@
 # See: https://bugzilla.redhat.com/show_bug.cgi?id=1520879
 %global _find_debuginfo_opts -g
 
-# Disable LTO as this causes build failures at the moment.
-# See RHBZ#1861401
-%define _lto_cflags %{nil}
-
 # note: parametrized macros are order-sensitive (unlike not-parametrized) even with normal macros
 # also necessary when passing it as parameter to other macros. If not macro, then it is considered a switch
 # see the difference between global and define:
@@ -151,7 +141,7 @@
 %global zgc_arches x86_64
 # Set of architectures for which alt-java has SSB mitigation
 %global ssbd_arches x86_64
-# Set of architectures for which java has short vector math library (libjsvml.so)
+# Set of architectures for which java has short vector math library (libsvml.so)
 %global svml_arches x86_64
 # Set of architectures where we verify backtraces with gdb
 # s390x fails on RHEL 7 so we exclude it there
@@ -239,8 +229,12 @@
 # Target to use to just build HotSpot
 %global hotspot_target hotspot
 
-# JDK to use for bootstrapping
-%global bootjdk /usr/lib/jvm/java-%{buildjdkver}-openjdk
+# DTS toolset to use to provide gcc & binutils
+%global dtsversion 10
+
+# Disable LTO as this causes build failures at the moment.
+# See RHBZ#1861401
+%define _lto_cflags %{nil}
 
 # Filter out flags from the optflags macro that cause problems with the OpenJDK build
 # We filter out -O flags so that the optimization of HotSpot is not lowered from O3 to O2
@@ -251,12 +245,6 @@
 %global ourcppflags %(echo %ourflags | sed -e 's|-fexceptions||')
 %global ourldflags %{__global_ldflags}
 
-# With disabled nss is NSS deactivated, so NSS_LIBDIR can contain the wrong path
-# the initialization must be here. Later the pkg-config have buggy behavior
-# looks like openjdk RPM specific bug
-# Always set this so the nss.cfg file is not broken
-%global NSS_LIBDIR %(pkg-config --variable=libdir nss)
-
 # In some cases, the arch used by the JDK does
 # not match _arch.
 # Also, in some cases, the machine name used by SystemTap
@@ -317,23 +305,21 @@
 %global stapinstall %{nil}
 %endif
 
-# always off for portable builds
 %ifarch %{systemtap_arches}
-%global with_systemtap 0
+%global with_systemtap 1
 %else
 %global with_systemtap 0
 %endif
 
 # New Version-String scheme-style defines
-%global featurever 17
-%global fakefeaturever 21
+%global featurever 21
 %global interimver 0
-%global updatever 7
+%global updatever 1
 %global patchver 0
 # buildjdkver is usually same as %%{featurever},
 # but in time of bootstrap of next jdk, it is featurever-1,
 # and this it is better to change it here, on single place
-%global buildjdkver 17
+%global buildjdkver %{featurever}
 # We don't add any LTS designator for STS packages (Fedora and EPEL).
 # We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined.
 %if 0%{?rhel} && !0%{?epel}
@@ -343,6 +329,16 @@
   %global lts_designator ""
   %global lts_designator_zip ""
 %endif
+# JDK to use for bootstrapping
+%global bootjdk /usr/lib/jvm/java-%{buildjdkver}-openjdk
+# Define whether to use the bootstrap JDK directly or with a fresh libjvm.so
+# This will only work where the bootstrap JDK is the same major version
+# as the JDK being built
+%if %{with fresh_libjvm} && %{buildjdkver} == %{featurever}
+%global build_hotspot_first 1
+%else
+%global build_hotspot_first 0
+%endif
 
 # Define vendor information used by OpenJDK
 %global oj_vendor Red Hat, Inc.
@@ -357,7 +353,7 @@
 %global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=%{name}&version=%{fedora}
 %else
 %if 0%{?rhel}
-%global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi?product=Red%20Hat%20Enterprise%20Linux%20%{rhel}&component=%{name}
+%global oj_vendor_bug_url https://access.redhat.com/support/cases/
 %else
 %global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi
 %endif
@@ -368,15 +364,22 @@
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      6.0.0pre00-c848b93a8598
 # Define current Git revision for the FIPS support patches
-%global fipsver bf363eecce3
+%global fipsver 75ffdc48eda
+# Define JDK versions
+%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
+%global javaver         %{featurever}
+# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames
+%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn})
+# The tag used to create the OpenJDK tarball
+%global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}
 
 # Standard JPackage naming and versioning defines
 %global origin          openjdk
 %global origin_nice     OpenJDK
-%global top_level_dir_name   %{origin}
+%global top_level_dir_name   %{vcstag}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        7
-%global rpmrelease      2
+%global buildver        12
+%global rpmrelease      1
 #%%global tagsuffix     %%{nil}
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
@@ -390,15 +393,6 @@
 # for techpreview, using 1, so slowdebugs can have 0
 %global priority %( printf '%08d' 1 )
 %endif
-%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
-# Force 21 until we are actually ready to build that JDK version
-%global javaver         %{fakefeaturever}
-
-# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames
-%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn})
-
-# The tag used to create the OpenJDK tarball
-%global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}
 
 # Define milestone (EA for pre-releases, GA for releases)
 # Release will be (where N is usually a number starting at 1):
@@ -408,7 +402,7 @@
 %if %{is_ga}
 %global build_type GA
 %global ea_designator ""
-%global ea_designator_zip ""
+%global ea_designator_zip %{nil}
 %global extraver %{nil}
 %global eaprefix %{nil}
 %else
@@ -420,15 +414,16 @@
 %endif
 
 # parametrized macros are order-sensitive
-%global compatiblename  java-%{fakefeaturever}-%{origin}
+%global compatiblename  java-%{featurever}-%{origin}
 %global fullversion     %{compatiblename}-%{version}-%{release}
 # images directories from upstream build
 %global jdkimage                jdk
 %global static_libs_image       static-libs
 # output dir stub
-%define buildoutputdir() %{expand:build/jdk%{fakefeaturever}.build%{?1}}
-%define installoutputdir() %{expand:install/jdk%{fakefeaturever}.install%{?1}}
-%define packageoutputdir() %{expand:packages/jdk%{fakefeaturever}.packages%{?1}}
+%define buildoutputdir() %{expand:build/jdk%{featurever}.build%{?1}}
+%define installoutputdir() %{expand:install/jdk%{featurever}.install%{?1}}
+%global altjavaoutputdir install/altjava.install
+%define packageoutputdir() %{expand:packages/jdk%{featurever}.packages%{?1}}
 # we can copy the javadoc to not arched dir, or make it not noarch
 %define uniquejavadocdir()    %{expand:%{fullversion}.%{_arch}%{?1}}
 # main id and dir of this jdk
@@ -471,6 +466,12 @@
 %global __requires_exclude ^(%{_privatelibs}|%{_publiclibs})$
 %endif
 
+# VM variant being built
+%ifarch %{zero_arches}
+%global vm_variant zero
+%else
+%global vm_variant server
+%endif
 
 %global etcjavasubdir     %{_sysconfdir}/java/java-%{javaver}-%{origin}
 %define etcjavadir()      %{expand:%{etcjavasubdir}/%{uniquesuffix -- %{?1}}}
@@ -493,23 +494,6 @@
 %global alternatives_requires %{_sbindir}/alternatives
 %endif
 
-%if %{with_systemtap}
-# Where to install systemtap tapset (links)
-# We would like these to be in a package specific sub-dir,
-# but currently systemtap doesn't support that, so we have to
-# use the root tapset dir for now. To distinguish between 64
-# and 32 bit architectures we place the tapsets under the arch
-# specific dir (note that systemtap will only pickup the tapset
-# for the primary arch for now). Systemtap uses the machine name
-# aka target_cpu as architecture specific directory name.
-%global tapsetroot /usr/share/systemtap
-%global tapsetdirttapset %{tapsetroot}/tapset/
-%global tapsetdir %{tapsetdirttapset}/%{stapinstall}
-%endif
-
-# x86 is not supported by OpenJDK 17
-ExcludeArch: %{ix86}
-
 # Portables have no repo (requires/provides), but these are awesome for orientation in spec
 # Also scriptlets are happily missing and files are handled old fashion
 # not-duplicated requires/provides/obsoletes for normal/debug packages
@@ -533,12 +517,12 @@ ExcludeArch: %{ix86}
 
 # Prevent brp-java-repack-jars from being run
 %global __jar_repack 0
+# Define the architectures on which we build
+ExclusiveArch: %{aarch64} %{ppc64le} s390x x86_64
+# Define the OS this package is built on
+%global pkgos rhel7
 
-# portables have grown out of its component, moving back to java-x-vendor
-# this expression, when declared as global, filled component with java-x-vendor portable
-%define component %(echo %{name} | sed "s;-portable;;g")
-
-Name:    java-%{javaver}-%{origin}-portable
+Name:    java-%{javaver}-%{origin}-portable%{?pkgos:-%{pkgos}}
 Version: %{newjavaver}.%{buildver}
 Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
 # java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons
@@ -552,6 +536,11 @@ Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
 # provides >= 1.6.0 must specify the epoch, "java >= 1:1.6.0".
 
 Epoch:   1
+
+# portables have grown out of its component, moving back to java-x-vendor
+# this expression, when declared as global, filled component with java-x-vendor portable
+%define component %(echo %{name} | sed "s;-portable%{?pkgos:-%{pkgos}};;g")
+
 Summary: %{origin_nice} %{featurever} Runtime Environment portable edition
 # Groups are only used up to RHEL 8 and on Fedora versions prior to F30
 %if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30)
@@ -575,15 +564,13 @@ Group:   Development/Languages
 License:  ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA
 URL:      http://openjdk.java.net/
 
-
 # The source tarball, generated using generate_source_tarball.sh
-Source0: openjdk-jdk%{featurever}u-%{vcstag}.tar.xz
+Source0: https://openjdk-sources.osci.io/openjdk%{featurever}/open%{vcstag}%{ea_designator_zip}.tar.xz
 
 # Use 'icedtea_sync.sh' to update the following
 # They are based on code contained in the IcedTea project (6.x).
 # Systemtap tapsets. Zipped up to keep it small.
-# Disabled in portables
-#Source8: tapsets-icedtea-%%{icedteaver}.tar.xz
+Source8: tapsets-icedtea-%%{icedteaver}.tar.xz
 
 # Desktop files. Adapted from IcedTea
 # Disabled in portables
@@ -592,8 +579,8 @@ Source0: openjdk-jdk%{featurever}u-%{vcstag}.tar.xz
 # Release notes
 Source10: NEWS
 
-# nss configuration file
-Source11: nss.cfg.in
+# Source code for alt-java
+Source11: alt-java.c
 
 # Removed libraries that we link instead
 Source12: remove-intree-libraries.sh
@@ -619,19 +606,9 @@ Source18: TestTranslations.java
 #
 ############################################
 
-# Ignore AWTError when assistive technologies are loaded
-Patch1:    rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
-Patch3:    rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
-# NSS via SunPKCS11 Provider (disabled due to memory leak).
-Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
-# RH1750419: enable build of speculative store bypass hardened alt-java (CVE-2018-3639)
-Patch600: rh1750419-redhat_alt_java.patch
-# Depend on pcsc-lite-libs instead of pcsc-lite-devel as this is only in optional repo
-Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
-
 # Crypto policy and FIPS support patches
-# Patch is generated from the fips-17u tree at https://github.com/rh-openjdk/jdk/tree/fips-17u
-# as follows: git diff %%{vcstag} src make test > fips-17u-$(git show -s --format=%h HEAD).patch
+# Patch is generated from the fips-21u tree at https://github.com/rh-openjdk/jdk/tree/fips-21u
+# as follows: git diff %%{vcstag} src make test > fips-21u-$(git show -s --format=%h HEAD).patch
 # Diff is limited to src and make subdirectories to exclude .github changes
 # Fixes currently included:
 # PR3183, RH1340845: Follow system wide crypto policy
@@ -655,7 +632,7 @@ Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-d
 # RH2104724: Avoid import/export of DH private keys
 # RH2092507: P11Key.getEncoded does not work for DH keys in FIPS mode
 # Build the systemconf library on all platforms
-# RH2048582: Support PKCS#12 keystores
+# RH2048582: Support PKCS#12 keystores [now part of JDK-8301553 upstream]
 # RH2020290: Support TLS 1.3 in FIPS mode
 # Add nss.fips.cfg support to OpenJDK tree
 # RH2117972: Extend the support for NSS DBs (PKCS11) in FIPS mode
@@ -664,8 +641,8 @@ Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-d
 # RH2134669: Add missing attributes when registering services in FIPS mode.
 # test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
 # RH1940064: Enable XML Signature provider in FIPS mode
-# RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized
-Patch1001: fips-17u-%{fipsver}.patch
+# RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized [now part of JDK-8301553 upstream]
+Patch1001: fips-%{featurever}u-%{fipsver}.patch
 
 #############################################
 #
@@ -673,17 +650,19 @@ Patch1001: fips-17u-%{fipsver}.patch
 #
 #############################################
 
+# JDK-8009550, RH910107: Depend on pcsc-lite-libs instead of pcsc-lite-devel as this is only in optional repo
+# PR: https://github.com/openjdk/jdk/pull/15409
+Patch6: jdk8009550-rh910107-fail_to_load_pcsc_library.patch
+
 # Currently empty
 
 #############################################
 #
-# OpenJDK patches appearing in 17.0.8
+# OpenJDK patches which missed last update
 #
 #############################################
-# JDK-8274864: Remove Amman/Cairo hacks in ZoneInfoFile
-Patch2001: jdk8274864-remove_amman_cairo_hacks.patch
-# JDK-8305113: (tz) Update Timezone Data to 2023c
-Patch2002: jdk8305113-tzdata2023c.patch
+
+# Currently empty
 
 #############################################
 #
@@ -691,11 +670,7 @@ Patch2002: jdk8305113-tzdata2023c.patch
 #
 #############################################
 
-#############################################
-#
-# OpenJDK patches targetted for 17.0.6
-#
-#############################################
+# Currently empty
 
 BuildRequires: autoconf
 BuildRequires: automake
@@ -707,6 +682,8 @@ BuildRequires: desktop-file-utils
 BuildRequires: elfutils-devel
 BuildRequires: file
 BuildRequires: fontconfig-devel
+BuildRequires: devtoolset-%{dtsversion}-gcc
+BuildRequires: devtoolset-%{dtsversion}-gcc-c++
 BuildRequires: gcc-c++
 BuildRequires: gdb
 BuildRequires: libxslt
@@ -717,7 +694,7 @@ BuildRequires: libXrandr-devel
 BuildRequires: libXrender-devel
 BuildRequires: libXt-devel
 BuildRequires: libXtst-devel
-# Requirement for setting up nss.cfg
+# Requirement for setting up nss.fips.cfg
 BuildRequires: nss-devel
 # Requirement for system security property test
 # N/A for portable. RHEL7 doesn't provide them
@@ -728,9 +705,8 @@ BuildRequires: zip
 # to pack portable tarballs
 BuildRequires: tar
 BuildRequires: unzip
-# No javapackages-filesystem on el7,nor is needed for portables
-# BuildRequires: javapackages-filesystem
-BuildRequires: java-%{buildjdkver}-openjdk-devel
+BuildRequires: javapackages-tools
+BuildRequires: java-%{buildjdkver}-%{origin}%{?pkgos:-%{pkgos}}-devel
 # Zero-assembler build requirement
 %ifarch %{zero_arches}
 BuildRequires: libffi-devel
@@ -755,18 +731,18 @@ BuildRequires: lcms2-devel
 BuildRequires: libjpeg-devel
 BuildRequires: libpng-devel
 %else
-# Version in src/java.desktop/share/native/libfreetype/include/freetype/freetype.h
-Provides: bundled(freetype) = 2.12.1
+# Version in src/java.desktop/share/legal/freetype.md
+Provides: bundled(freetype) = 2.13.0
 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
 Provides: bundled(giflib) = 5.2.1
 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h
-Provides: bundled(harfbuzz) = 4.4.1
+Provides: bundled(harfbuzz) = 7.2.0
 # Version in src/java.desktop/share/native/liblcms/lcms2.h
-Provides: bundled(lcms2) = 2.12.0
+Provides: bundled(lcms2) = 2.15.0
 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h
 Provides: bundled(libjpeg) = 6b
 # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h
-Provides: bundled(libpng) = 1.6.37
+Provides: bundled(libpng) = 1.6.39
 # We link statically against libstdc++ to increase portability
 BuildRequires: libstdc++-static
 %endif
@@ -914,10 +890,10 @@ The %{origin_nice} %{featurever} miscellany.
 echo "Preparing %{oj_vendor_version}"
 
 # Using the echo macro breaks rpmdev-bumpspec, as it parses the first line of stdout :-(
-%if 0%{?stapinstall:1}
-  echo "CPU: %{_target_cpu}, arch install directory: %{archinstall}, SystemTap install directory: %{stapinstall}"
+%if 0%{?_build_cpu:1}
+  echo "CPU: %{_target_cpu}, arch install directory: %{archinstall}, SystemTap install directory: %{_build_cpu}"
 %else
-  %{error:Unrecognised architecture %{_target_cpu}}
+  %{error:Unrecognised architecture %{_build_cpu}}
 %endif
 
 if [ %{include_normal_build} -eq 0 -o  %{include_normal_build} -eq 1 ] ; then
@@ -942,6 +918,12 @@ if [ %{include_debug_build} -eq 0 -a  %{include_normal_build} -eq 0 -a  %{includ
   echo "You have disabled all builds (normal,fastdebug,slowdebug). That is a no go."
   exit 14
 fi
+
+%if %{with fresh_libjvm} && ! %{build_hotspot_first}
+echo "WARNING: The build of a fresh libjvm has been disabled due to a JDK version mismatch"
+echo "Build JDK version is %{buildjdkver}, feature JDK version is %{featurever}"
+%endif
+
 %setup -q -c -n %{uniquesuffix ""} -T -a 0
 # https://bugzilla.redhat.com/show_bug.cgi?id=1189084
 prioritylength=`expr length %{priority}`
@@ -959,19 +941,12 @@ sh %{SOURCE12} %{top_level_dir_name}
 
 # Patch the JDK
 pushd %{top_level_dir_name}
-%patch1 -p1
-%patch3 -p1
-%patch6 -p1
 # Add crypto policy and FIPS support
 %patch1001 -p1
-# nss.cfg PKCS11 support; must come last as it also alters java.security
-%patch1000 -p1
-# tzdata update
-%patch2001 -p1
-%patch2002 -p1
+# Patches in need of upstreaming
+%patch6 -p1
 popd # openjdk
 
-%patch600
 
 # The OpenJDK version file includes the current
 # upstream version information. For some reason,
@@ -1005,18 +980,8 @@ cp -r tapset tapset%{fastdebug_suffix}
 
 for suffix in %{build_loop} ; do
   for file in "tapset"$suffix/*.in; do
-    OUTPUT_FILE=`echo $file | sed -e "s:\.stp\.in$:-%{version}-%{release}.%{_arch}.stp:g"`
-    sed -e "s:@ABS_SERVER_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/server/libjvm.so:g" $file > $file.1
-    sed -e "s:@JAVA_SPEC_VER@:%{javaver}:g" $file.1 > $file.2
-# TODO find out which architectures other than i686 have a client vm
-%ifarch %{ix86}
-    sed -e "s:@ABS_CLIENT_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/client/libjvm.so:g" $file.2 > $OUTPUT_FILE
-%else
-    sed -e "/@ABS_CLIENT_LIBJVM_SO@/d" $file.2 > $OUTPUT_FILE
-%endif
-    sed -i -e "s:@ABS_JAVA_HOME_DIR@:%{_jvmdir}/%{sdkdir -- $suffix}:g" $OUTPUT_FILE
-    sed -i -e "s:@INSTALL_ARCH_DIR@:%{archinstall}:g" $OUTPUT_FILE
-    sed -i -e "s:@prefix@:%{_jvmdir}/%{sdkdir -- $suffix}/:g" $OUTPUT_FILE
+    sed -i -e "s:@JAVA_SPEC_VER@:%{javaver}:g" $file
+    sed -i -e "s:@INSTALL_ARCH_DIR@:%{archinstall}:g" $file
   done
 done
 # systemtap tapsets ends
@@ -1025,10 +990,8 @@ done
 # Prepare desktop files
 # Portables do not have desktop integration
 
-# Setup nss.cfg
-sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE11} > nss.cfg
-
 %build
+
 # How many CPU's do we have?
 export NUM_PROC=%(/usr/bin/getconf _NPROCESSORS_ONLN 2> /dev/null || :)
 export NUM_PROC=${NUM_PROC:-1}
@@ -1061,6 +1024,10 @@ EXTRA_CPP_FLAGS="$(echo ${EXTRA_CPP_FLAGS} | sed -e 's|-mstackrealign|-mincoming
 %endif
 export EXTRA_CFLAGS EXTRA_CPP_FLAGS
 
+echo "Building %{SOURCE11}"
+mkdir -p %{altjavaoutputdir}
+gcc ${EXTRA_CFLAGS} -o %{altjavaoutputdir}/%{alt_java_name} %{SOURCE11}
+
 echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}"
 
 function buildjdk() {
@@ -1098,22 +1065,22 @@ function buildjdk() {
     # rather than ${link_opt} as the system versions
     # are always used in a system_libs build, even
     # for the static library build
-    bash ${top_dir_abs_src_path}/configure \
+    scl enable devtoolset-%{dtsversion} "bash ${top_dir_abs_src_path}/configure \
 %ifarch %{zero_arches}
     --with-jvm-variants=zero \
 %endif
 %ifarch %{ppc64le}
     --with-jobs=1 \
 %endif
-    --with-cacerts-file=$(readlink -f %{_sysconfdir}/pki/java/cacerts)  \
+    --with-cacerts-file=`readlink -f %{_sysconfdir}/pki/java/cacerts`  \
     --with-version-build=%{buildver} \
-    --with-version-pre="${ea_designator}" \
-    --with-version-opt=%{lts_designator} \
-    --with-vendor-version-string="%{oj_vendor_version}" \
-    --with-vendor-name="%{oj_vendor}" \
-    --with-vendor-url="%{oj_vendor_url}" \
-    --with-vendor-bug-url="%{oj_vendor_bug_url}" \
-    --with-vendor-vm-bug-url="%{oj_vendor_bug_url}" \
+    --with-version-pre=\"%{ea_designator}\" \
+    --with-version-opt=\"%{lts_designator}\" \
+    --with-vendor-version-string=\"%{oj_vendor_version}\" \
+    --with-vendor-name=\"%{oj_vendor}\" \
+    --with-vendor-url=\"%{oj_vendor_url}\" \
+    --with-vendor-bug-url=\"%{oj_vendor_bug_url}\" \
+    --with-vendor-vm-bug-url=\"%{oj_vendor_bug_url}\" \
     --with-boot-jdk=${buildjdk} \
     --with-debug-level=${debuglevel} \
     --with-native-debug-symbols="${debug_symbols}" \
@@ -1127,29 +1094,76 @@ function buildjdk() {
     --with-lcms=${link_opt} \
     --with-harfbuzz=${link_opt} \
     --with-stdc++lib=${libc_link_opt} \
-    --with-extra-cxxflags="$EXTRA_CPP_FLAGS" \
-    --with-extra-cflags="$EXTRA_CFLAGS" \
-    --with-extra-ldflags="%{ourldflags}" \
-    --with-num-cores="$NUM_PROC" \
-    --with-source-date="${SOURCE_DATE_EPOCH}" \
+    --with-extra-cxxflags=\"$EXTRA_CPP_FLAGS\" \
+    --with-extra-cflags=\"$EXTRA_CFLAGS\" \
+    --with-extra-ldflags=\"%{ourldflags}\" \
+    --with-num-cores=\"$NUM_PROC\" \
+    --with-source-date=\"${SOURCE_DATE_EPOCH}\" \
     --disable-javac-server \
 %ifarch %{zgc_arches}
     --with-jvm-features=zgc \
 %endif
-    --disable-warnings-as-errors
+    --disable-warnings-as-errors"
 
     cat spec.gmk
-    make LOG=trace $maketargets || \
-	( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name \"hs_err_pid*.log\" | xargs cat && false )
-
+    scl enable devtoolset-%{dtsversion} "make LOG=trace $maketargets || \
+        ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name \"hs_err_pid*.log\" | xargs cat && false )"
     popd
 }
 
+function stripjdk() {
+    local outputdir=${1}
+    local jdkimagepath=${outputdir}/images/%{jdkimage}
+    local jreimagepath=${outputdir}/images/%{jreimage}
+    local jmodimagepath=${outputdir}/images/jmods
+    local supportdir=${outputdir}/support
+
+    if [ "x$suffix" = "x" ] ; then
+        # Keep the unstripped version for consumption by RHEL RPMs
+        cp -a ${jdkimagepath}{,.unstripped}
+
+        # Strip the files
+        for file in $(find ${jdkimagepath} ${jreimagepath} ${supportdir} -type f) ; do
+            if file ${file} | grep -q 'ELF'; then
+                noextfile=${file/.so/};
+                scl enable devtoolset-%{dtsversion} "objcopy --only-keep-debug ${file} ${noextfile}.debuginfo";
+                scl enable devtoolset-%{dtsversion} "objcopy --add-gnu-debuglink=${noextfile}.debuginfo ${file}";
+                scl enable devtoolset-%{dtsversion} "strip -g ${file}";
+            fi
+        done
+
+        # Rebuild jmod files against the stripped binaries
+        if [ ! -d ${supportdir} ] ; then
+            echo "Support directory missing.";
+            exit 15
+        fi
+        for cmd in $(find ${supportdir} -name '*.jmod_exec.cmdline') ; do
+            pre=${cmd/_exec/_pre};
+            post=${cmd/_exec/_post};
+            jmod=$(echo ${cmd}|sed 's#.*_create_##'|sed 's#_exec.cmdline##')
+            echo "Rebuilding ${jmod} against stripped binaries...";
+            if [ -e ${pre} ] ; then
+                echo "Executing ${pre}...";
+                cat ${pre} | sh -s ;
+            fi
+            echo "Executing ${cmd}...";
+            cat ${cmd} | sh -s ;
+            if [ -e ${post} ] ; then
+                echo "Executing ${post}...";
+                cat ${post} | sh -s ;
+            fi
+        done
+        rm -rf ${jdkimagepath}/jmods
+        cp -a ${jmodimagepath} ${jdkimagepath}
+    fi
+}
+
 function installjdk() {
     local outputdir=${1}
     local installdir=${2}
     local jdkimagepath=${installdir}/images/%{jdkimage}
     local jreimagepath=${installdir}/images/%{jreimage}
+    local unstripped=${jdkimagepath}.unstripped
 
     echo "Installing build from ${outputdir} to ${installdir}..."
     mkdir -p ${installdir}
@@ -1178,7 +1192,7 @@ function installjdk() {
         fi;
     done
 
-    for imagepath in ${jdkimagepath} ${jreimagepath} ; do
+    for imagepath in ${jdkimagepath} ${jreimagepath} ${unstripped}; do
 
         if [ -d ${imagepath} ] ; then
             # the build (erroneously) removes read permissions from some jars
@@ -1193,7 +1207,6 @@ function installjdk() {
 
             # Install local files which are distributed with the JDK
             install -m 644 %{SOURCE10} ${imagepath}
-            install -m 644 nss.cfg ${imagepath}/conf/security/
 
             # Create fake alt-java as a placeholder for future alt-java
             pushd ${imagepath}
@@ -1227,6 +1240,8 @@ function packagejdk() {
     local bundledir=$(pwd)/${1}/bundles
     local packagesdir=$(pwd)/${2}
     local srcdir=$(pwd)/%{top_level_dir_name}
+    local tapsetdir=$(pwd)/tapset
+    local altjavadir=$(pwd)/${3}
 
     echo "Packaging build from ${imagesdir} to ${packagesdir}..."
     mkdir -p ${packagesdir}
@@ -1254,42 +1269,39 @@ function packagejdk() {
     miscname=%{miscportablename}
     miscarchive=${packagesdir}/%{miscportablearchive}
 
+    if [ "x$suffix" = "x" ] ; then
+        # Keep the unstripped version for consumption by RHEL RPMs
+        mv %{jdkimage}.unstripped ${jdkname}
+        tar -cJf ${unstrippedarchive} ${jdkname}
+        genchecksum ${unstrippedarchive}
+        mv ${jdkname} %{jdkimage}.unstripped
+    fi
+
     # Rename directories for packaging
     mv %{jdkimage} ${jdkname}
     mv %{jreimage} ${jrename}
 
     # Release images have external debug symbols
     if [ "x$suffix" = "x" ] ; then
-        # Keep the unstripped version for consumption by RHEL RPMs
-        tar -cJf ${unstrippedarchive} ${jdkname}
-        genchecksum ${unstrippedarchive}
-
-        # Strip the files
-        for file in $(find ${jdkname} ${jrename} -type f) ; do
-            if file ${file} | grep -q 'ELF'; then
-                noextfile=${file/.so/};
-                objcopy --only-keep-debug ${file} ${noextfile}.debuginfo;
-                objcopy --add-gnu-debuglink=${noextfile}.debuginfo ${file};
-                strip -g ${file};
-            fi
-        done
-
         tar -cJf ${debugarchive} $(find ${jdkname} -name \*.debuginfo)
         genchecksum ${debugarchive}
 
-	mkdir ${docname}
-	mv ${docdir} ${docname}
-	mv ${bundledir}/${built_doc_archive} ${docname}
-	tar -cJf ${docarchive} ${docname}
-	genchecksum ${docarchive}
+        mkdir ${docname}
+        mv ${docdir} ${docname}
+        mv ${bundledir}/${built_doc_archive} ${docname}
+        tar -cJf ${docarchive} ${docname}
+        genchecksum ${docarchive}
 
-	mkdir ${miscname}
-	for s in 16 24 32 48 ; do
-	    cp -av ${srcdir}/src/java.desktop/unix/classes/sun/awt/X11/java-icon${s}.png ${miscname}
-	done
-	cp -a ${srcdir}/src/sample ${miscname}
-	tar -cJf ${miscarchive} ${miscname}
-	genchecksum ${miscarchive}
+        mkdir ${miscname}
+        for s in 16 24 32 48 ; do
+            cp -av ${srcdir}/src/java.desktop/unix/classes/sun/awt/X11/java-icon${s}.png ${miscname}
+        done
+%if %{with_systemtap}
+        cp -a ${tapsetdir}* ${miscname}
+%endif
+        cp -av ${altjavadir}/%{alt_java_name} ${miscname}
+        tar -cJf ${miscarchive} ${miscname}
+        genchecksum ${miscarchive}
     fi
 
     tar -cJf ${jdkarchive} --exclude='**.debuginfo' ${jdkname}
@@ -1321,7 +1333,7 @@ function packagejdk() {
   cp -LR --preserve=mode,timestamps %{bootjdk} newboot
   systemjdk=$(pwd)/newboot
   buildjdk build/newboot ${systemjdk} %{hotspot_target} "release" "bundled" "internal"
-  mv build/newboot/jdk/lib/server/libjvm.so newboot/lib/server
+  mv build/newboot/jdk/lib/%{vm_variant}/libjvm.so newboot/lib/%{vm_variant}
 %else
   systemjdk=%{bootjdk}
 %endif
@@ -1366,13 +1378,15 @@ for suffix in %{build_loop} ; do
       buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild} ${link_opt} ${debug_symbols}
       installjdk ${bootbuilddir} ${bootinstalldir}
       buildjdk ${builddir} $(pwd)/${bootinstalldir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols}
+      stripjdk ${builddir}
       installjdk ${builddir} ${installdir}
       %{!?with_artifacts:rm -rf ${bootinstalldir}}
   else
       buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols}
+      stripjdk ${builddir}
       installjdk ${builddir} ${installdir}
   fi
-  packagejdk ${installdir} ${packagesdir}
+  packagejdk ${installdir} ${packagesdir} %{altjavaoutputdir}
 
 %if %{system_libs}
   # Restore original source tree we modified by removing full in-tree sources
@@ -1403,8 +1417,7 @@ export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage}
 #sed -i -e "s:^security.useSystemPropertiesFile=.*:security.useSystemPropertiesFile=true:" \
 #${JAVA_HOME}/conf/security/java.security
 
-
-#check Shenandoah is enabled
+# Check Shenandoah is enabled
 %if %{use_shenandoah_hotspot}
 $JAVA_HOME//bin/java -XX:+UnlockExperimentalVMOptions -XX:+UseShenandoahGC -version
 %endif
@@ -1435,16 +1448,18 @@ $JAVA_HOME/bin/java $(echo $(basename %{SOURCE16})|sed "s|\.java||") "%{oj_vendo
 if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi
 
 # Check alt-java launcher has SSB mitigation on supported architectures
+# set_speculation function exists in both cases, so check for prctl call
 %ifarch %{ssbd_arches}
-nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation
+nm %{altjavaoutputdir}/%{alt_java_name} | grep prctl
 %else
-if ! nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation ; then true ; else false; fi
+if ! nm %{altjavaoutputdir}/%{alt_java_name} | grep prctl ; then true ; else false; fi
 %endif
 
 %if ! 0%{?flatpak}
 # Check translations are available for new timezones (during flatpak builds, the
 # tzdb.dat used by this test is not where the test expects it, so this is
 # disabled for flatpak builds)
+# Disable test until we are on the latest JDK
 $JAVA_HOME/bin/javac -d . %{SOURCE18}
 $JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE
 $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR
@@ -1455,9 +1470,8 @@ $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|
 export STATIC_LIBS_HOME=${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image}
 ls -l $STATIC_LIBS_HOME
 ls -l $STATIC_LIBS_HOME/lib
-# they are here, but grep do not find the remainders
-#readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep w_remainder.c
-#readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep e_remainder.c
+readelf --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet4AddressImpl.c
+readelf --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet6AddressImpl.c
 %endif
 
 # Release builds strip the debug symbols into external .debuginfo files
@@ -1674,11 +1688,98 @@ done
 %{_jvmdir}/%{miscportablearchive}.sha256sum
 
 %changelog
+* Sun Oct 29 2023 Andrew Hughes  - 1:21.0.1.0.12-1
+- Update to jdk-21.0.1.0+12 (GA)
+- Update release notes to 21.0.1.0+12
+- Update openjdk_news script to specify subdirectory last
+- Add missing discover_trees script required by openjdk_news
+- Synchronise bundled versions with 21u sources (FreeType, LCMS, HarfBuzz, libpng)
+- Sync generate_tarball.sh with 11u & 17u version
+- Update bug URL for RHEL to point to the Red Hat customer portal
+- Fix upstream release URL for OpenJDK source
+- Update buildjdkver to match the featurever
+- Re-enable SystemTap support and perform only substitutions possible without final NVR available
+- Fix typo which stops the EA designator being included in the build
+- Include tapsets in the miscellaneous tarball
+- Drop unused globals for tapset installation
+- Rebuild jmods using the stripped binaries in release builds
+- Make sure the unstripped JDK is customised by the installjdk function
+
+* Sat Oct 28 2023 Andrew Hughes  - 1:21.0.0.0.35-1
+- Update to jdk-21.0.0+35
+- Update release notes to 21.0.0+35
+- Update documentation (README.md)
+- Update system crypto policy & FIPS patch from new fips-21u tree
+- Update generate_tarball.sh to sync with upstream vanilla script inc. no more ECC removal
+- Drop fakefeaturever now it is no longer needed
+- Hardcode buildjdkver while the build JDK is not yet 21
+- Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
+- Use upstream release URL for OpenJDK source
+- Re-enable tzdata tests now we are on the latest JDK and things are back in sync
+- Fix trailing '.' in tarball name
+- Use rpmrelease in vendor version to avoid inclusion of dist tag
+- Replace alt-java patch with a binary separate from the JDK
+- Drop stale patches that are of little use any more:
+- * nss.cfg has been disabled since early PKCS11 work and long superseded by FIPS work
+- * No accessibility subpackage to warrant RH1648242 patch any more
+- * No use of system libjpeg turbo to warrant RH649512 patch any more
+- Replace RH1684077 pcsc-lite-libs patch with better JDK-8009550 fix being upstreamed
+
+* Sat Oct 28 2023 Petra Alice Mikova  - 1:21.0.0.0.35-1
+- Replace smoke test files used in the staticlibs test, as fdlibm was removed by JDK-8303798
+- Related: rhbz#2192749
+
+* Fri Oct 27 2023 Andrew Hughes  - 1:20.0.2.0.9-1.1
+- Update to jdk-20.0.2+9
+- Update release notes to 20.0.2+9
+- Update system crypto policy & FIPS patch from new fips-20u tree
+- Update generate_tarball.sh ICEDTEA_VERSION
+- Update CLDR reference data following update to 42 (Rocky Mountain-Normalzeit => Rocky-Mountain-Normalzeit)
+- Related: rhbz#2192749
+
+* Fri Oct 27 2023 Jiri Vanek  - 1:20.0.0.0.36-1
+- Dropped JDK-8295447, JDK-8296239 & JDK-8299439 patches now upstream
+- Adapted rh1750419-redhat_alt_java.patch
+- Related: rhbz#2192749
+
+* Fri Oct 27 2023 Andrew Hughes  - 1:19.0.1.0.10-1
+- Update to jdk-19.0.2 release
+- Update release notes to 19.0.2
+- Rebase FIPS patches from fips-19u branch
+- Remove references to sample directory removed by JDK-8284999
+- Add local patch JDK-8295447 (javac NPE) which was accepted into 19u upstream but not in the GA tag
+- Add local patches for JDK-8296239 & JDK-8299439 (Croatia Euro update) which are present in 8u, 11u & 17u releases
+- Related: rhbz#2192749
+
+* Tue Oct 24 2023 Andrew Hughes  - 1:18.0.2.0.9-1
+- Update to jdk-18.0.2 release
+- Update release notes to actually reflect OpenJDK 18
+- Support JVM variant zero following JDK-8273494 no longer installing Zero's libjvm.so in the server directory
+- Rebase FIPS patches from fips-18u branch
+- Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
+- Automatically turn off building a fresh HotSpot first, if the bootstrap JDK is not the same major version as that being built
+- Drop tzdata patches added for 17.0.7 which will eventually appear in the upstream tarball when we reach OpenJDK 21
+- Switch bootjdkver to java-21-openjdk
+- Disable tzdata tests until we are on the latest JDK and things are back in sync
+- Drop bootstrap JDKs and use the java-21-openjdk-rhel7 build
+- Related: rhbz#2192749
+
+* Tue Oct 24 2023 Petra Alice Mikova  - 1:18.0.0.0.37-1
+- Update to ea version of jdk18
+- Adjust rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
+
+* Tue Aug 22 2023 Andrew Hughes  - 1:17.0.7.0.7-2
+- Define architectures we build on to avoid those without DTS 10 (e.g. s390)
+
+* Tue Aug 22 2023 Andrew Hughes  - 1:17.0.7.0.7-2
+- Switch to DTS 10
+- Related: rhbz#2192749
+
 * Mon May 15 2023 Andrew Hughes  - 1:17.0.7.0.7-2
 - Create java-21-openjdk-portable package based on java-17-openjdk-portable
 - Related: rhbz#2192749
 
-* Tue Apr 25 2023 Andrew Hughes  - 1:17.0.7.0.7-2
+* Thu Apr 13 2023 Andrew Hughes  - 1:17.0.7.0.7-1
 - Update to jdk-17.0.7.0+7
 - Update release notes to 17.0.7.0+7
 - Require tzdata 2023c due to local inclusion of JDK-8274864 & JDK-8305113
@@ -1691,20 +1792,12 @@ done
 - * test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
 - * RH1940064: Enable XML Signature provider in FIPS mode
 - * RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized
-- Fix trailing '.' in tarball name
-- Use rpmrelease in vendor version to avoid inclusion of dist tag
 - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
 - Resolves: rhbz#2185182
 - Resolves: rhbz#2134669
 - Resolves: rhbz#1940064
 - Resolves: rhbz#2173781
 
-* Thu Apr 20 2023 Andrew Hughes  - 1:17.0.6.0.10-7
-- Sync with existing RHEL 8 build, in order to start building portables on RHEL 8
-- Restore system bootstrap JDK (RHEL 8 has java-17-openjdk)
-- Remove use of devtoolset (RHEL 8 native compilers should be sufficient)
-- Explicitly exclude x86, as on RHEL RPMs
-
 * Tue Feb 21 2023 Andrew Hughes  - 1:17.0.6.0.10-6
 - Add docs, icons and samples to the portable output
 - Make sure generated checksums work and don't include full path
diff --git a/jconsole.desktop.in b/SOURCES/jconsole.desktop.in
similarity index 100%
rename from jconsole.desktop.in
rename to SOURCES/jconsole.desktop.in
diff --git a/SOURCES/jdk8009550-rh910107-fail_to_load_pcsc_library.patch b/SOURCES/jdk8009550-rh910107-fail_to_load_pcsc_library.patch
new file mode 100644
index 0000000..9213937
--- /dev/null
+++ b/SOURCES/jdk8009550-rh910107-fail_to_load_pcsc_library.patch
@@ -0,0 +1,125 @@
+commit d0523302416bc6507696f20d1068f16427bcf6b8
+Author: Andrew Hughes 
+Date:   Thu Aug 24 01:23:49 2023 +0100
+
+    8009550: PlatformPCSC should load versioned so
+
+diff --git a/src/java.base/share/classes/sun/security/util/Debug.java b/src/java.base/share/classes/sun/security/util/Debug.java
+index bff273c6548..e5a6b288ff8 100644
+--- a/src/java.base/share/classes/sun/security/util/Debug.java
++++ b/src/java.base/share/classes/sun/security/util/Debug.java
+@@ -81,6 +81,7 @@ public static void Help()
+         System.err.println("logincontext  login context results");
+         System.err.println("jca           JCA engine class debugging");
+         System.err.println("keystore      KeyStore debugging");
++        System.err.println("pcsc          Smartcard library debugging");
+         System.err.println("policy        loading and granting");
+         System.err.println("provider      security provider debugging");
+         System.err.println("pkcs11        PKCS11 session manager debugging");
+diff --git a/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java b/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java
+index bacff32efbc..d9f605ada1e 100644
+--- a/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java
++++ b/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java
+@@ -1,5 +1,6 @@
+ /*
+  * Copyright (c) 2005, 2021, Oracle and/or its affiliates. All rights reserved.
++ * Copyright (c) 2023, Red Hat Inc. All rights reserved.
+  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+  *
+  * This code is free software; you can redistribute it and/or modify it
+@@ -46,8 +47,13 @@ class PlatformPCSC {
+ 
+     private static final String PROP_NAME = "sun.security.smartcardio.library";
+ 
+-    private static final String LIB1 = "/usr/$LIBISA/libpcsclite.so";
+-    private static final String LIB2 = "/usr/local/$LIBISA/libpcsclite.so";
++    private static final String[] LIB_TEMPLATES = { "/usr/$LIBISA/libpcsclite.so",
++                                                    "/usr/local/$LIBISA/libpcsclite.so",
++                                                    "/usr/lib/$ARCH-linux-gnu/libpcsclite.so",
++                                                    "/usr/lib/arm-linux-gnueabi/libpcsclite.so",
++                                                    "/usr/lib/arm-linux-gnueabihf/libpcsclite.so",
++                                                    "/usr/lib/$ARCH-kfreebsd-gnu/libpcsclite.so" };
++    private static final String[] LIB_SUFFIXES = { ".1", ".0", "" };
+     private static final String PCSC_FRAMEWORK = "/System/Library/Frameworks/PCSC.framework/Versions/Current/PCSC";
+ 
+     PlatformPCSC() {
+@@ -73,23 +79,38 @@ public Throwable run() {
+     });
+ 
+     // expand $LIBISA to the system specific directory name for libraries
++    // expand $ARCH to the Debian system architecture in use
+     private static String expand(String lib) {
+         int k = lib.indexOf("$LIBISA");
+-        if (k == -1) {
+-            return lib;
++        if (k != -1) {
++            String libDir;
++            if ("64".equals(System.getProperty("sun.arch.data.model"))) {
++                // assume Linux convention
++                libDir = "lib64";
++            } else {
++                // must be 32-bit
++                libDir = "lib";
++            }
++            lib = lib.replace("$LIBISA", libDir);
+         }
+-        String s1 = lib.substring(0, k);
+-        String s2 = lib.substring(k + 7);
+-        String libDir;
+-        if ("64".equals(System.getProperty("sun.arch.data.model"))) {
+-            // assume Linux convention
+-            libDir = "lib64";
+-        } else {
+-            // must be 32-bit
+-            libDir = "lib";
++
++        k = lib.indexOf("$ARCH");
++        if (k != -1) {
++            String arch = System.getProperty("os.arch");
++            lib = lib.replace("$ARCH", getDebianArchitecture(arch));
+         }
+-        String s = s1 + libDir + s2;
+-        return s;
++
++        return lib;
++    }
++
++    private static String getDebianArchitecture(String jdkArch) {
++        return switch (jdkArch) {
++            case "amd64" -> "x86_64";
++            case "ppc" -> "powerpc";
++            case "ppc64" -> "powerpc64";
++            case "ppc64le" -> "powerpc64le";
++            default -> jdkArch;
++        };
+     }
+ 
+     private static String getLibraryName() throws IOException {
+@@ -98,15 +119,18 @@ private static String getLibraryName() throws IOException {
+         if (lib.length() != 0) {
+             return lib;
+         }
+-        lib = expand(LIB1);
+-        if (new File(lib).isFile()) {
+-            // if LIB1 exists, use that
+-            return lib;
+-        }
+-        lib = expand(LIB2);
+-        if (new File(lib).isFile()) {
+-            // if LIB2 exists, use that
+-            return lib;
++
++        for (String template : LIB_TEMPLATES) {
++            for (String suffix : LIB_SUFFIXES) {
++                lib = expand(template) + suffix;
++                if (debug != null) {
++                    debug.println("Looking for " + lib);
++                }
++                if (new File(lib).isFile()) {
++                    // if library exists, use that
++                    return lib;
++                }
++            }
+         }
+ 
+         // As of macos 11, framework libraries have been removed from the file
diff --git a/remove-intree-libraries.sh b/SOURCES/remove-intree-libraries.sh
similarity index 100%
rename from remove-intree-libraries.sh
rename to SOURCES/remove-intree-libraries.sh
diff --git a/java-21-openjdk.spec b/SPECS/java-21-openjdk.spec
similarity index 84%
rename from java-21-openjdk.spec
rename to SPECS/java-21-openjdk.spec
index 439481a..782d622 100644
--- a/java-21-openjdk.spec
+++ b/SPECS/java-21-openjdk.spec
@@ -1,3 +1,8 @@
+# To rebuild this RPM, you must first rebuild the portable
+# RPM using the java-21-openjdk-portable.specfile, install
+# it and then adjust portablerelease and portablesuffix
+# to match the new portable.
+
 # RPM conditionals so as to be able to dynamically produce
 # slowdebug/release builds. See:
 # http://rpm.org/user_doc/conditional_builds.html
@@ -21,8 +26,6 @@
 %bcond_without release
 # Enable static library builds by default.
 %bcond_without staticlibs
-# Build a fresh libjvm.so for use in a copy of the bootstrap JDK
-%bcond_without fresh_libjvm
 # Build with system libraries
 %bcond_with system_libs
 
@@ -34,13 +37,6 @@
 %global include_staticlibs 0
 %endif
 
-# Define whether to use the bootstrap JDK directly or with a fresh libjvm.so
-%if %{with fresh_libjvm}
-%global build_hotspot_first 1
-%else
-%global build_hotspot_first 0
-%endif
-
 %if %{with system_libs}
 %global system_libs 1
 %global link_type system
@@ -133,9 +129,9 @@
 # Set of architectures which support the serviceability agent
 %global sa_arches       %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} %{arm}
 # Set of architectures which support class data sharing
-# See https://bugzilla.redhat.com/show_bug.cgi?id=513605
-# MetaspaceShared::generate_vtable_methods is not implemented for the PPC JIT
-%global share_arches    %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{arm} s390x
+# As of JDK-8005165 in OpenJDK 10, class sharing is not arch-specific
+# However, it does segfault on the Zero assembler port, so currently JIT only
+%global share_arches    %{jit_arches}
 # Set of architectures for which we build the Shenandoah garbage collector
 %global shenandoah_arches x86_64 %{aarch64}
 # Set of architectures for which we build the Z garbage collector
@@ -223,9 +219,6 @@
 # Target to use to just build HotSpot
 %global hotspot_target hotspot
 
-# JDK to use for bootstrapping
-%global bootjdk /usr/lib/jvm/java-%{buildjdkver}-openjdk
-
 # debugedit tool for rewriting ELF file paths
 %global debugedit %{_rpmconfigdir}/debugedit
 
@@ -238,12 +231,6 @@
 %global ourcppflags %(echo %ourflags | sed -e 's|-fexceptions||')
 %global ourldflags %{__global_ldflags}
 
-# With disabled nss is NSS deactivated, so NSS_LIBDIR can contain the wrong path
-# the initialization must be here. Later the pkg-config have buggy behavior
-# looks like openjdk RPM specific bug
-# Always set this so the nss.cfg file is not broken
-%global NSS_LIBDIR %(pkg-config --variable=libdir nss)
-
 # In some cases, the arch used by the JDK does
 # not match _arch.
 # Also, in some cases, the machine name used by SystemTap
@@ -311,23 +298,18 @@
 %endif
 
 # New Version-String scheme-style defines
-%global featurever 17
-%global fakefeaturever 21
+%global featurever 21
 %global interimver 0
-%global updatever 7
+%global updatever 1
 %global patchver 0
-# buildjdkver is usually same as %%{featurever},
-# but in time of bootstrap of next jdk, it is featurever-1,
-# and this it is better to change it here, on single place
-%global buildjdkver 17
 # We don't add any LTS designator for STS packages (Fedora and EPEL).
 # We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined.
 %if 0%{?rhel} && !0%{?epel}
   %global lts_designator "LTS"
   %global lts_designator_zip -%{lts_designator}
 %else
- %global lts_designator ""
- %global lts_designator_zip ""
+  %global lts_designator ""
+  %global lts_designator_zip ""
 %endif
 
 # Define vendor information used by OpenJDK
@@ -343,7 +325,7 @@
 %global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=%{name}&version=%{fedora}
 %else
 %if 0%{?rhel}
-%global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi?product=Red%20Hat%20Enterprise%20Linux%20%{rhel}&component=%{name}
+%global oj_vendor_bug_url https://access.redhat.com/support/cases/
 %else
 %global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi
 %endif
@@ -354,18 +336,25 @@
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      6.0.0pre00-c848b93a8598
 # Define current Git revision for the FIPS support patches
-%global fipsver bf363eecce3
+%global fipsver 75ffdc48eda
+# Define JDK versions
+%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
+%global javaver         %{featurever}
+# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames
+%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn})
+# The tag used to create the OpenJDK tarball
+%global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}
 
 # Standard JPackage naming and versioning defines
 %global origin          openjdk
 %global origin_nice     OpenJDK
-%global top_level_dir_name   %{origin}
+%global top_level_dir_name   %{vcstag}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        7
-%global rpmrelease      4
+%global buildver        12
+%global rpmrelease      2
 # Settings used by the portable build
-%global portablerelease 2
-%global portablesuffix el8
+%global portablerelease 1
+%global portablesuffix el7_9
 %global portablebuilddir /builddir/build/BUILD
 
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
@@ -380,15 +369,6 @@
 # for techpreview, using 1, so slowdebugs can have 0
 %global priority %( printf '%08d' 1 )
 %endif
-%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
-# Force 21 until we are actually ready to build that JDK version
-%global javaver         %{fakefeaturever}
-
-# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames
-%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn})
-
-# The tag used to create the OpenJDK tarball
-%global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}
 
 # Define milestone (EA for pre-releases, GA for releases)
 # Release will be (where N is usually a number starting at 1):
@@ -398,7 +378,7 @@
 %if %{is_ga}
 %global build_type GA
 %global ea_designator ""
-%global ea_designator_zip ""
+%global ea_designator_zip %{nil}
 %global extraver %{nil}
 %global eaprefix %{nil}
 %else
@@ -410,13 +390,13 @@
 %endif
 
 # parametrized macros are order-sensitive
-%global compatiblename  java-%{fakefeaturever}-%{origin}
+%global compatiblename  java-%{featurever}-%{origin}
 %global fullversion     %{compatiblename}-%{version}-%{release}
 # images directories from upstream build
 %global jdkimage                jdk
 %global static_libs_image       static-libs
 # output dir stub
-%define installoutputdir() %{expand:install/jdk%{fakefeaturever}.install%{?1}}
+%define installoutputdir() %{expand:install/jdk%{featurever}.install%{?1}}
 # we can copy the javadoc to not arched dir, or make it not noarch
 %define uniquejavadocdir()    %{expand:%{fullversion}.%{_arch}%{?1}}
 # main id and dir of this jdk
@@ -426,7 +406,7 @@
 # fix for https://bugzilla.redhat.com/show_bug.cgi?id=1111349
 #         https://bugzilla.redhat.com/show_bug.cgi?id=1590796#c14
 #         https://bugzilla.redhat.com/show_bug.cgi?id=1655938
-%global _privatelibs libsplashscreen[.]so.*|libawt_xawt[.]so.*|libjli[.]so.*|libattach[.]so.*|libawt[.]so.*|libextnet[.]so.*|libawt_headless[.]so.*|libdt_socket[.]so.*|libfontmanager[.]so.*|libinstrument[.]so.*|libj2gss[.]so.*|libj2pcsc[.]so.*|libj2pkcs11[.]so.*|libjaas[.]so.*|libjavajpeg[.]so.*|libjdwp[.]so.*|libjimage[.]so.*|libjsound[.]so.*|liblcms[.]so.*|libmanagement[.]so.*|libmanagement_agent[.]so.*|libmanagement_ext[.]so.*|libmlib_image[.]so.*|libnet[.]so.*|libnio[.]so.*|libprefs[.]so.*|librmi[.]so.*|libsaproc[.]so.*|libsctp[.]so.*|libsystemconf[.]so.*|libzip[.]so.*%{freetype_lib}
+%global _privatelibs libsplashscreen[.]so.*|libawt_xawt[.]so.*|libjli[.]so.*|libattach[.]so.*|libawt[.]so.*|libextnet[.]so.*|libawt_headless[.]so.*|libdt_socket[.]so.*|libfontmanager[.]so.*|libinstrument[.]so.*|libj2gss[.]so.*|libj2pcsc[.]so.*|libj2pkcs11[.]so.*|libjaas[.]so.*|libjavajpeg[.]so.*|libjdwp[.]so.*|libjimage[.]so.*|libjsound[.]so.*|liblcms[.]so.*|lible[.]so.*|libmanagement[.]so.*|libmanagement_agent[.]so.*|libmanagement_ext[.]so.*|libmlib_image[.]so.*|libnet[.]so.*|libnio[.]so.*|libprefs[.]so.*|librmi[.]so.*|libsaproc[.]so.*|libsctp[.]so.*|libsystemconf[.]so.*|libzip[.]so.*%{freetype_lib}
 %global _publiclibs libjawt[.]so.*|libjava[.]so.*|libjvm[.]so.*|libverify[.]so.*|libjsig[.]so.*
 %if %is_system_jdk
 %global __provides_exclude ^(%{_privatelibs})$
@@ -442,6 +422,12 @@
 %global __requires_exclude ^(%{_privatelibs}|%{_publiclibs})$
 %endif
 
+# VM variant being built
+%ifarch %{zero_arches}
+%global vm_variant zero
+%else
+%global vm_variant server
+%endif
 
 %global etcjavasubdir     %{_sysconfdir}/java/java-%{javaver}-%{origin}
 %define etcjavadir()      %{expand:%{etcjavasubdir}/%{uniquesuffix -- %{?1}}}
@@ -550,12 +536,15 @@ alternatives \\
   --install %{_bindir}/java $key %{jrebindir -- %{?1}}/java $PRIORITY  --family %{family} \\
   --slave %{_jvmdir}/jre jre %{_jvmdir}/%{sdkdir -- %{?1}} \\
   --slave %{_bindir}/%{alt_java_name} %{alt_java_name} %{jrebindir -- %{?1}}/%{alt_java_name} \\
+  --slave %{_bindir}/jcmd jcmd %{sdkbindir -- %{?1}}/jcmd \\
   --slave %{_bindir}/keytool keytool %{jrebindir -- %{?1}}/keytool \\
   --slave %{_bindir}/rmiregistry rmiregistry %{jrebindir -- %{?1}}/rmiregistry \\
   --slave %{_mandir}/man1/java.1$ext java.1$ext \\
   %{_mandir}/man1/java-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/%{alt_java_name}.1$ext %{alt_java_name}.1$ext \\
   %{_mandir}/man1/%{alt_java_name}-%{uniquesuffix -- %{?1}}.1$ext \\
+  --slave %{_mandir}/man1/jcmd.1$ext jcmd.1$ext \\
+  %{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/keytool.1$ext keytool.1$ext \\
   %{_mandir}/man1/keytool-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/rmiregistry.1$ext rmiregistry.1$ext \\
@@ -575,10 +564,6 @@ alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} $key %{_jvmdir}/%{jre
 }
 
 %define post_headless() %{expand:
-%ifarch %{share_arches}
-%{jrebindir -- %{?1}}/java -Xshare:dump >/dev/null 2>/dev/null
-%endif
-
 update-desktop-database %{_datadir}/applications &> /dev/null || :
 /bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || :
 
@@ -644,7 +629,6 @@ alternatives \\
   --slave %{_bindir}/jarsigner jarsigner %{sdkbindir -- %{?1}}/jarsigner \\
   --slave %{_bindir}/javadoc javadoc %{sdkbindir -- %{?1}}/javadoc \\
   --slave %{_bindir}/javap javap %{sdkbindir -- %{?1}}/javap \\
-  --slave %{_bindir}/jcmd jcmd %{sdkbindir -- %{?1}}/jcmd \\
   --slave %{_bindir}/jconsole jconsole %{sdkbindir -- %{?1}}/jconsole \\
   --slave %{_bindir}/jdb jdb %{sdkbindir -- %{?1}}/jdb \\
   --slave %{_bindir}/jdeps jdeps %{sdkbindir -- %{?1}}/jdeps \\
@@ -660,6 +644,7 @@ alternatives \\
   --slave %{_bindir}/jstack jstack %{sdkbindir -- %{?1}}/jstack \\
   --slave %{_bindir}/jstat jstat %{sdkbindir -- %{?1}}/jstat \\
   --slave %{_bindir}/jstatd jstatd %{sdkbindir -- %{?1}}/jstatd \\
+  --slave %{_bindir}/jwebserver jwebserver %{sdkbindir -- %{?1}}/jwebserver \\
   --slave %{_bindir}/serialver serialver %{sdkbindir -- %{?1}}/serialver \\
   --slave %{_mandir}/man1/jar.1$ext jar.1$ext \\
   %{_mandir}/man1/jar-%{uniquesuffix -- %{?1}}.1$ext \\
@@ -671,8 +656,6 @@ alternatives \\
   %{_mandir}/man1/javadoc-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/javap.1$ext javap.1$ext \\
   %{_mandir}/man1/javap-%{uniquesuffix -- %{?1}}.1$ext \\
-  --slave %{_mandir}/man1/jcmd.1$ext jcmd.1$ext \\
-  %{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/jconsole.1$ext jconsole.1$ext \\
   %{_mandir}/man1/jconsole-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/jdb.1$ext jdb.1$ext \\
@@ -693,6 +676,8 @@ alternatives \\
   %{_mandir}/man1/jstack-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/jstat.1$ext jstat.1$ext \\
   %{_mandir}/man1/jstat-%{uniquesuffix -- %{?1}}.1$ext \\
+  --slave %{_mandir}/man1/jwebserver.1$ext jwebserver.1$ext \\
+  %{_mandir}/man1/jwebserver-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/jstatd.1$ext jstatd.1$ext \\
   %{_mandir}/man1/jstatd-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/serialver.1$ext serialver.1$ext \\
@@ -750,10 +735,19 @@ PRIORITY=%{priority}
 if [ "%{?1}" == %{debug_suffix} ]; then
   let PRIORITY=PRIORITY-1
 fi
+  for X in %{origin} %{javaver} ; do
+    key=javadocdir_"$X"
+    alternatives --install %{_javadocdir}/java-"$X" $key %{_javadocdir}/%{uniquejavadocdir -- %{?1}}/api $PRIORITY --family %{family_noarch}
+    %{set_if_needed_alternatives $key %{family_noarch}}
+  done
 
-key=javadocdir
-alternatives --install %{_javadocdir}/java $key %{_javadocdir}/%{uniquejavadocdir -- %{?1}}/api $PRIORITY  --family %{family_noarch}
-%{set_if_needed_alternatives  $key %{family_noarch}}
+  key=javadocdir_%{javaver}_%{origin}
+  alternatives --install %{_javadocdir}/java-%{javaver}-%{origin} $key %{_javadocdir}/%{uniquejavadocdir -- %{?1}}/api $PRIORITY --family %{family_noarch}
+  %{set_if_needed_alternatives  $key %{family_noarch}}
+
+  key=javadocdir
+  alternatives --install %{_javadocdir}/java $key %{_javadocdir}/%{uniquejavadocdir -- %{?1}}/api $PRIORITY --family %{family_noarch}
+  %{set_if_needed_alternatives  $key %{family_noarch}}
 exit 0
 }
 
@@ -763,6 +757,9 @@ if [ "x$debug"  == "xtrue" ] ; then
 fi
   post_state=$1 # from postun, https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax
   %{save_and_remove_alternatives  javadocdir  %{_javadocdir}/%{uniquejavadocdir -- %{?1}}/api $post_state %{family_noarch}}
+  %{save_and_remove_alternatives  javadocdir_%{origin} %{_javadocdir}/%{uniquejavadocdir -- %{?1}}/api $post_state %{family_noarch}}
+  %{save_and_remove_alternatives  javadocdir_%{javaver} %{_javadocdir}/%{uniquejavadocdir -- %{?1}}/api $post_state %{family_noarch}}
+  %{save_and_remove_alternatives  javadocdir_%{javaver}_%{origin} %{_javadocdir}/%{uniquejavadocdir -- %{?1}}/api $post_state %{family_noarch}}
 exit 0
 }
 
@@ -774,9 +771,20 @@ PRIORITY=%{priority}
 if [ "%{?1}" == %{debug_suffix} ]; then
   let PRIORITY=PRIORITY-1
 fi
-key=javadoczip
-alternatives --install %{_javadocdir}/java-zip $key %{_javadocdir}/%{uniquejavadocdir -- %{?1}}.zip $PRIORITY  --family %{family_noarch}
-%{set_if_needed_alternatives  $key %{family_noarch}}
+  for X in %{origin} %{javaver} ; do
+    key=javadoczip_"$X"
+    alternatives --install %{_javadocdir}/java-"$X".zip $key %{_javadocdir}/%{uniquejavadocdir -- %{?1}}.zip $PRIORITY --family %{family_noarch}
+    %{set_if_needed_alternatives $key %{family_noarch}}
+  done
+
+  key=javadoczip_%{javaver}_%{origin}
+  alternatives --install %{_javadocdir}/java-%{javaver}-%{origin}.zip $key %{_javadocdir}/%{uniquejavadocdir -- %{?1}}.zip $PRIORITY --family %{family_noarch}
+  %{set_if_needed_alternatives  $key %{family_noarch}}
+
+  # Weird legacy filename for backwards-compatibility
+  key=javadoczip
+  alternatives --install %{_javadocdir}/java-zip $key %{_javadocdir}/%{uniquejavadocdir -- %{?1}}.zip $PRIORITY  --family %{family_noarch}
+  %{set_if_needed_alternatives  $key %{family_noarch}}
 exit 0
 }
 
@@ -786,6 +794,9 @@ exit 0
   fi
   post_state=$1 # from postun, https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax
   %{save_and_remove_alternatives  javadoczip  %{_javadocdir}/%{uniquejavadocdir -- %{?1}}.zip $post_state %{family_noarch}}
+  %{save_and_remove_alternatives  javadoczip_%{origin}  %{_javadocdir}/%{uniquejavadocdir -- %{?1}}.zip $post_state %{family_noarch}}
+  %{save_and_remove_alternatives  javadoczip_%{javaver}  %{_javadocdir}/%{uniquejavadocdir -- %{?1}}.zip $post_state %{family_noarch}}
+  %{save_and_remove_alternatives  javadoczip_%{javaver}_%{origin}  %{_javadocdir}/%{uniquejavadocdir -- %{?1}}.zip $post_state %{family_noarch}}
 exit 0
 }
 
@@ -801,7 +812,7 @@ exit 0
 %license %{_jvmdir}/%{sdkdir -- %{?1}}/legal
 %doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/NEWS
 %doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/README.md
-%doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/java-%{fakefeaturever}-openjdk-portable.specfile
+%doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/java-%{featurever}-openjdk-portable.specfile
 %dir %{_sysconfdir}/.java/.systemPrefs
 %dir %{_sysconfdir}/.java
 %dir %{_jvmdir}/%{sdkdir -- %{?1}}
@@ -810,6 +821,7 @@ exit 0
 %dir %{_jvmdir}/%{sdkdir -- %{?1}}/bin
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/java
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/%{alt_java_name}
+%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jcmd
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/keytool
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/rmiregistry
 %dir %{_jvmdir}/%{sdkdir -- %{?1}}/lib
@@ -846,6 +858,7 @@ exit 0
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjimage.so
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjsound.so
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/liblcms.so
+%{_jvmdir}/%{sdkdir -- %{?1}}/lib/lible.so
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/libmanagement.so
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/libmanagement_agent.so
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/libmanagement_ext.so
@@ -873,11 +886,15 @@ exit 0
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/jfr/profile.jfc
 %{_mandir}/man1/java-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/%{alt_java_name}-%{uniquesuffix -- %{?1}}.1*
+%{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/keytool-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/rmiregistry-%{uniquesuffix -- %{?1}}.1*
-%{_jvmdir}/%{sdkdir -- %{?1}}/lib/server/
+%{_jvmdir}/%{sdkdir -- %{?1}}/lib/%{vm_variant}/
 %ifarch %{share_arches}
-%attr(444, root, root) %ghost %{_jvmdir}/%{sdkdir -- %{?1}}/lib/server/classes.jsa
+%attr(444, root, root) %{_jvmdir}/%{sdkdir -- %{?1}}/lib/%{vm_variant}/classes.jsa
+%ifnarch %{ix86} %{arm32}
+%attr(444, root, root) %{_jvmdir}/%{sdkdir -- %{?1}}/lib/%{vm_variant}/classes_nocoops.jsa
+%endif
 %endif
 %dir %{etcjavasubdir}
 %dir %{etcjavadir -- %{?1}}
@@ -902,14 +919,14 @@ exit 0
  %{etcjavadir -- %{?1}}/conf/security/policy/README.txt
 %config(noreplace) %{etcjavadir -- %{?1}}/conf/security/java.policy
 %config(noreplace) %{etcjavadir -- %{?1}}/conf/security/java.security
-%config(noreplace) %{etcjavadir -- %{?1}}/conf/logging.properties
-%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/nss.cfg
 %config(noreplace) %{etcjavadir -- %{?1}}/conf/security/nss.fips.cfg
 %config(noreplace) %{etcjavadir -- %{?1}}/conf/management/jmxremote.access
 # This is a config template, thus not config-noreplace
 %config  %{etcjavadir -- %{?1}}/conf/management/jmxremote.password.template
 %config  %{etcjavadir -- %{?1}}/conf/sdp/sdp.conf.template
 %config(noreplace) %{etcjavadir -- %{?1}}/conf/management/management.properties
+%config(noreplace) %{etcjavadir -- %{?1}}/conf/jaxp.properties
+%config(noreplace) %{etcjavadir -- %{?1}}/conf/logging.properties
 %config(noreplace) %{etcjavadir -- %{?1}}/conf/net.properties
 %config(noreplace) %{etcjavadir -- %{?1}}/conf/sound.properties
 %{_jvmdir}/%{sdkdir -- %{?1}}/conf
@@ -917,13 +934,11 @@ exit 0
 %if %is_system_jdk
 %if %{is_release_build -- %{?1}}
 %ghost %{_bindir}/java
-%ghost %{_bindir}/%{alt_java_name}
 %ghost %{_jvmdir}/jre
+%ghost %{_bindir}/%{alt_java_name}
+%ghost %{_bindir}/jcmd
 %ghost %{_bindir}/keytool
-%ghost %{_bindir}/pack200
-%ghost %{_bindir}/rmid
 %ghost %{_bindir}/rmiregistry
-%ghost %{_bindir}/unpack200
 %ghost %{_jvmdir}/jre-%{origin}
 %ghost %{_jvmdir}/jre-%{javaver}
 %ghost %{_jvmdir}/jre-%{javaver}-%{origin}
@@ -943,7 +958,6 @@ exit 0
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/javadoc
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/javap
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jconsole
-%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jcmd
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jdb
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jdeps
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jdeprscan
@@ -967,6 +981,7 @@ exit 0
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jstack
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jstat
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jstatd
+%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jwebserver
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/serialver
 %{_jvmdir}/%{sdkdir -- %{?1}}/include
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/ct.sym
@@ -980,23 +995,23 @@ exit 0
 %{_mandir}/man1/javadoc-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/javap-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jconsole-%{uniquesuffix -- %{?1}}.1*
-%{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jdb-%{uniquesuffix -- %{?1}}.1*
+%{_mandir}/man1/jdeprscan-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jdeps-%{uniquesuffix -- %{?1}}.1*
+%{_mandir}/man1/jfr-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jinfo-%{uniquesuffix -- %{?1}}.1*
+%{_mandir}/man1/jlink-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jmap-%{uniquesuffix -- %{?1}}.1*
+%{_mandir}/man1/jmod-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jps-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jpackage-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jrunscript-%{uniquesuffix -- %{?1}}.1*
+%{_mandir}/man1/jshell-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jstack-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jstat-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jstatd-%{uniquesuffix -- %{?1}}.1*
+%{_mandir}/man1/jwebserver-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/serialver-%{uniquesuffix -- %{?1}}.1*
-%{_mandir}/man1/jdeprscan-%{uniquesuffix -- %{?1}}.1*
-%{_mandir}/man1/jlink-%{uniquesuffix -- %{?1}}.1*
-%{_mandir}/man1/jmod-%{uniquesuffix -- %{?1}}.1*
-%{_mandir}/man1/jshell-%{uniquesuffix -- %{?1}}.1*
-%{_mandir}/man1/jfr-%{uniquesuffix -- %{?1}}.1*
 
 %if %{with_systemtap}
 %dir %{tapsetroot}
@@ -1008,7 +1023,6 @@ exit 0
 %if %{is_release_build -- %{?1}}
 %ghost %{_bindir}/javac
 %ghost %{_jvmdir}/java
-%ghost %{_jvmdir}/%{alt_java_name}
 %ghost %{_bindir}/jlink
 %ghost %{_bindir}/jmod
 %ghost %{_bindir}/jhsdb
@@ -1016,20 +1030,22 @@ exit 0
 %ghost %{_bindir}/jarsigner
 %ghost %{_bindir}/javadoc
 %ghost %{_bindir}/javap
-%ghost %{_bindir}/jcmd
 %ghost %{_bindir}/jconsole
 %ghost %{_bindir}/jdb
 %ghost %{_bindir}/jdeps
 %ghost %{_bindir}/jdeprscan
+%ghost %{_bindir}/jfr
 %ghost %{_bindir}/jimage
 %ghost %{_bindir}/jinfo
 %ghost %{_bindir}/jmap
 %ghost %{_bindir}/jps
+%ghost %{_bindir}/jpackage
 %ghost %{_bindir}/jrunscript
 %ghost %{_bindir}/jshell
 %ghost %{_bindir}/jstack
 %ghost %{_bindir}/jstat
 %ghost %{_bindir}/jstatd
+%ghost %{_bindir}/jwebserver
 %ghost %{_bindir}/serialver
 %ghost %{_jvmdir}/java-%{origin}
 %ghost %{_jvmdir}/java-%{javaver}
@@ -1045,7 +1061,6 @@ exit 0
 %define files_demo() %{expand:
 %license %{_jvmdir}/%{sdkdir -- %{?1}}/legal
 %{_jvmdir}/%{sdkdir -- %{?1}}/demo
-%{_jvmdir}/%{sdkdir -- %{?1}}/sample
 }
 
 %define files_src() %{expand:
@@ -1066,6 +1081,9 @@ exit 0
 %if %is_system_jdk
 %if %{is_release_build -- %{?1}}
 %ghost %{_javadocdir}/java
+%ghost %{_javadocdir}/java-%{origin}
+%ghost %{_javadocdir}/java-%{javaver}
+%ghost %{_javadocdir}/java-%{javaver}-%{origin}
 %endif
 %endif
 }
@@ -1076,6 +1094,9 @@ exit 0
 %if %is_system_jdk
 %if %{is_release_build -- %{?1}}
 %ghost %{_javadocdir}/java-zip
+%ghost %{_javadocdir}/java-%{origin}.zip
+%ghost %{_javadocdir}/java-%{javaver}.zip
+%ghost %{_javadocdir}/java-%{javaver}-%{origin}.zip
 %endif
 %endif
 }
@@ -1119,8 +1140,8 @@ Requires: ca-certificates
 # Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros
 Requires: javapackages-filesystem
 # Require zone-info data provided by tzdata-java sub-package
-# 2022g required as of JDK-8297804
-Requires: tzdata-java >= 2022g
+# 2023c required as of JDK-8305113
+Requires: tzdata-java >= 2023c
 # for support of kernel stream control
 # libsctp.so.1 is being `dlopen`ed on demand
 Requires: lksctp-tools%{?_isa}
@@ -1241,10 +1262,16 @@ Provides: java-%{origin}-src%{?1} = %{epoch}:%{version}-%{release}
 
 # Prevent brp-java-repack-jars from being run
 %global __jar_repack 0
+# Define the OS the portable JDK is built on
+%global pkgos rhel7
+# Define the root name of the portable packages
+%global pkgnameroot java-%{featurever}-%{origin}-portable%{?pkgos:-%{pkgos}}
 
 Name:    java-%{javaver}-%{origin}
 Version: %{newjavaver}.%{buildver}
 Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
+# Equivalent for the portable build
+%global prelease %{?eaprefix}%{portablerelease}%{?extraver}
 # java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons
 # and this change was brought into RHEL-4. java-1.5.0-ibm packages
 # also included the epoch in their virtual provides. This created a
@@ -1279,9 +1306,8 @@ Group:   Development/Languages
 License:  ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA
 URL:      http://openjdk.java.net/
 
-
 # The source tarball, generated using generate_source_tarball.sh
-Source0: openjdk-jdk%{featurever}u-%{vcstag}.tar.xz
+Source0: https://openjdk-sources.osci.io/openjdk%{featurever}/open%{vcstag}%{ea_designator_zip}.tar.xz
 
 # Use 'icedtea_sync.sh' to update the following
 # They are based on code contained in the IcedTea project (6.x).
@@ -1291,8 +1317,8 @@ Source8: tapsets-icedtea-%{icedteaver}.tar.xz
 # Desktop files. Adapted from IcedTea
 Source9: jconsole.desktop.in
 
-# nss configuration file
-Source11: nss.cfg.in
+# Source code for alt-java
+Source11: alt-java.c
 
 # Removed libraries that we link instead
 Source12: remove-intree-libraries.sh
@@ -1314,17 +1340,17 @@ Source18: TestTranslations.java
 
 # Include portable spec and instructions on how to rebuild
 Source19: README.md
-Source20: java-%{fakefeaturever}-openjdk-portable.specfile
+Source20: java-%{featurever}-openjdk-portable.specfile
 
 # Setup variables to reference correct sources
-%global releasezip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.unstripped.jdk.%{_arch}.tar.xz
-%global staticlibzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.static-libs.%{_arch}.tar.xz
-%global docszip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.docs.%{_arch}.tar.xz
-%global misczip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.misc.%{_arch}.tar.xz
-%global slowdebugzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.slowdebug.jdk.%{_arch}.tar.xz
-%global slowdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.slowdebug.static-libs.%{_arch}.tar.xz
-%global fastdebugzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.fastdebug.jdk.%{_arch}.tar.xz
-%global fastdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.fastdebug.static-libs.%{_arch}.tar.xz
+%global releasezip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.unstripped.jdk.%{_arch}.tar.xz
+%global staticlibzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.static-libs.%{_arch}.tar.xz
+%global docszip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.docs.%{_arch}.tar.xz
+%global misczip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.misc.%{_arch}.tar.xz
+%global slowdebugzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.slowdebug.jdk.%{_arch}.tar.xz
+%global slowdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.slowdebug.static-libs.%{_arch}.tar.xz
+%global fastdebugzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.fastdebug.jdk.%{_arch}.tar.xz
+%global fastdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.fastdebug.static-libs.%{_arch}.tar.xz
 
 ############################################
 #
@@ -1332,23 +1358,9 @@ Source20: java-%{fakefeaturever}-openjdk-portable.specfile
 #
 ############################################
 
-# NSS via SunPKCS11 Provider (disabled comment
-# due to memory leak).
-Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
-# RH1750419: enable build of speculative store bypass hardened alt-java (CVE-2018-3639)
-Patch600: rh1750419-redhat_alt_java.patch
-
-# Ignore AWTError when assistive technologies are loaded
-Patch1:    rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
-# Restrict access to java-atk-wrapper classes
-Patch2:    rh1648644-java_access_bridge_privileged_security.patch
-Patch3:    rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
-# Depend on pcsc-lite-libs instead of pcsc-lite-devel as this is only in optional repo
-Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
-
 # Crypto policy and FIPS support patches
-# Patch is generated from the fips-17u tree at https://github.com/rh-openjdk/jdk/tree/fips-17u
-# as follows: git diff %%{vcstag} src make test > fips-17u-$(git show -s --format=%h HEAD).patch
+# Patch is generated from the fips-21u tree at https://github.com/rh-openjdk/jdk/tree/fips-21u
+# as follows: git diff %%{vcstag} src make test > fips-21u-$(git show -s --format=%h HEAD).patch
 # Diff is limited to src and make subdirectories to exclude .github changes
 # Fixes currently included:
 # PR3183, RH1340845: Follow system wide crypto policy
@@ -1372,7 +1384,7 @@ Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-d
 # RH2104724: Avoid import/export of DH private keys
 # RH2092507: P11Key.getEncoded does not work for DH keys in FIPS mode
 # Build the systemconf library on all platforms
-# RH2048582: Support PKCS#12 keystores
+# RH2048582: Support PKCS#12 keystores [now part of JDK-8301553 upstream]
 # RH2020290: Support TLS 1.3 in FIPS mode
 # Add nss.fips.cfg support to OpenJDK tree
 # RH2117972: Extend the support for NSS DBs (PKCS11) in FIPS mode
@@ -1381,8 +1393,8 @@ Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-d
 # RH2134669: Add missing attributes when registering services in FIPS mode.
 # test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
 # RH1940064: Enable XML Signature provider in FIPS mode
-# RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized
-Patch1001: fips-17u-%{fipsver}.patch
+# RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized [now part of JDK-8301553 upstream]
+Patch1001: fips-%{featurever}u-%{fipsver}.patch
 
 #############################################
 #
@@ -1390,15 +1402,27 @@ Patch1001: fips-17u-%{fipsver}.patch
 #
 #############################################
 
+# JDK-8009550, RH910107: Depend on pcsc-lite-libs instead of pcsc-lite-devel as this is only in optional repo
+# PR: https://github.com/openjdk/jdk/pull/15409
+Patch6: jdk8009550-rh910107-fail_to_load_pcsc_library.patch
+
+# Currently empty
+
 #############################################
 #
-# OpenJDK patches targetted for 17.0.8
+# OpenJDK patches which missed last update
 #
 #############################################
-# JDK-8274864: Remove Amman/Cairo hacks in ZoneInfoFile
-Patch2001: jdk8274864-remove_amman_cairo_hacks.patch
-# JDK-8305113: (tz) Update Timezone Data to 2023c
-Patch2002: jdk8305113-tzdata2023c.patch
+
+# Currently empty
+
+#############################################
+#
+# Portable build specific patches
+#
+#############################################
+
+# Currently empty
 
 BuildRequires: autoconf
 BuildRequires: automake
@@ -1419,7 +1443,7 @@ BuildRequires: libXrandr-devel
 BuildRequires: libXrender-devel
 BuildRequires: libXt-devel
 BuildRequires: libXtst-devel
-# Requirement for setting up nss.cfg and nss.fips.cfg
+# Requirement for setting up nss.fips.cfg
 BuildRequires: nss-devel
 # Requirement for system security property test
 BuildRequires: crypto-policies
@@ -1428,19 +1452,19 @@ BuildRequires: xorg-x11-proto-devel
 BuildRequires: zip
 BuildRequires: javapackages-filesystem
 %if %{include_normal_build}
-BuildRequires: java-%{fakefeaturever}-openjdk-portable-unstripped = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
-BuildRequires: java-%{fakefeaturever}-openjdk-portable-static-libs = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: %{pkgnameroot}-unstripped = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
+BuildRequires: %{pkgnameroot}-static-libs = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
 %endif
 %if %{include_fastdebug_build}
-BuildRequires: java-%{fakefeaturever}-openjdk-portable-devel-fastdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
-BuildRequires: java-%{fakefeaturever}-openjdk-portable-static-libs-fastdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: %{pkgnameroot}-devel-fastdebug = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
+BuildRequires: %{pkgnameroot}-static-libs-fastdebug = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
 %endif
 %if %{include_debug_build}
-BuildRequires: java-%{fakefeaturever}-openjdk-portable-devel-slowdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
-BuildRequires: java-%{fakefeaturever}-openjdk-portable-static-libs-slowdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: %{pkgnameroot}-devel-slowdebug = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
+BuildRequires: %{pkgnameroot}-static-libs-slowdebug = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
 %endif
-BuildRequires: java-%{fakefeaturever}-openjdk-portable-docs = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
-BuildRequires: java-%{fakefeaturever}-openjdk-portable-misc = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: %{pkgnameroot}-docs = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
+BuildRequires: %{pkgnameroot}-misc = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
 # Zero-assembler build requirement
 %ifarch %{zero_arches}
 BuildRequires: libffi-devel
@@ -1463,18 +1487,18 @@ BuildRequires: lcms2-devel
 BuildRequires: libjpeg-devel
 BuildRequires: libpng-devel
 %else
-# Version in src/java.desktop/share/native/libfreetype/include/freetype/freetype.h
-Provides: bundled(freetype) = 2.12.1
+# Version in src/java.desktop/share/legal/freetype.md
+Provides: bundled(freetype) = 2.13.0
 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
 Provides: bundled(giflib) = 5.2.1
 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h
-Provides: bundled(harfbuzz) = 4.4.1
+Provides: bundled(harfbuzz) = 7.2.0
 # Version in src/java.desktop/share/native/liblcms/lcms2.h
-Provides: bundled(lcms2) = 2.12.0
+Provides: bundled(lcms2) = 2.15.0
 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h
 Provides: bundled(libjpeg) = 6b
 # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h
-Provides: bundled(libpng) = 1.6.37
+Provides: bundled(libpng) = 1.6.39
 %endif
 
 # this is always built, also during debug-only build
@@ -1817,6 +1841,7 @@ if [ %{include_debug_build} -eq 0 -a  %{include_normal_build} -eq 0 -a  %{includ
   echo "You have disabled all builds (normal,fastdebug,slowdebug). That is a no go."
   exit 14
 fi
+
 %setup -q -c -n %{uniquesuffix ""} -T -a 0
 # https://bugzilla.redhat.com/show_bug.cgi?id=1189084
 prioritylength=`expr length %{priority}`
@@ -1834,20 +1859,12 @@ sh %{SOURCE12} %{top_level_dir_name}
 
 # Patch the JDK
 pushd %{top_level_dir_name}
-%patch1 -p1
-%patch2 -p1
-%patch3 -p1
-%patch6 -p1
 # Add crypto policy and FIPS support
 %patch1001 -p1
-# nss.cfg PKCS11 support; must come last as it also alters java.security
-%patch1000 -p1
-# tzdata update
-%patch2001 -p1
-%patch2002 -p1
+# Patches in need of upstreaming
+%patch6 -p1
 popd # openjdk
 
-%patch600
 
 # The OpenJDK version file includes the current
 # upstream version information. For some reason,
@@ -1869,35 +1886,6 @@ if [ "x${UPSTREAM_EA_DESIGNATOR}" != "x%{ea_designator}" ] ; then
     exit 17
 fi
 
-# Extract systemtap tapsets
-%if %{with_systemtap}
-tar --strip-components=1 -x -I xz -f %{SOURCE8}
-%if %{include_debug_build}
-cp -r tapset tapset%{debug_suffix}
-%endif
-%if %{include_fastdebug_build}
-cp -r tapset tapset%{fastdebug_suffix}
-%endif
-
-for suffix in %{build_loop} ; do
-  for file in "tapset"$suffix/*.in; do
-    OUTPUT_FILE=`echo $file | sed -e "s:\.stp\.in$:-%{version}-%{release}.%{_arch}.stp:g"`
-    sed -e "s:@ABS_SERVER_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/server/libjvm.so:g" $file > $file.1
-    sed -e "s:@JAVA_SPEC_VER@:%{javaver}:g" $file.1 > $file.2
-# TODO find out which architectures other than i686 have a client vm
-%ifarch %{ix86}
-    sed -e "s:@ABS_CLIENT_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/client/libjvm.so:g" $file.2 > $OUTPUT_FILE
-%else
-    sed -e "/@ABS_CLIENT_LIBJVM_SO@/d" $file.2 > $OUTPUT_FILE
-%endif
-    sed -i -e "s:@ABS_JAVA_HOME_DIR@:%{_jvmdir}/%{sdkdir -- $suffix}:g" $OUTPUT_FILE
-    sed -i -e "s:@INSTALL_ARCH_DIR@:%{archinstall}:g" $OUTPUT_FILE
-    sed -i -e "s:@prefix@:%{_jvmdir}/%{sdkdir -- $suffix}/:g" $OUTPUT_FILE
-  done
-done
-# systemtap tapsets ends
-%endif
-
 # Prepare desktop files
 # The _X_ syntax indicates variables that are replaced by make upstream
 # The @X@ syntax indicates variables that are replaced by configure upstream
@@ -1915,9 +1903,6 @@ for file in %{SOURCE9}; do
 done
 done
 
-# Setup nss.cfg
-sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE11} > nss.cfg
-
 %build
 
 function customisejdk() {
@@ -1934,6 +1919,16 @@ function customisejdk() {
     fi
 }
 
+mkdir -p $(dirname %{installoutputdir})
+
+docdir=%{installoutputdir -- "-docs"}
+tar -xJf %{docszip}
+mv java-%{featurever}-openjdk*.docs.* ${docdir}
+
+miscdir=%{installoutputdir -- "-misc"}
+tar -xJf %{misczip}
+mv java-%{featurever}-openjdk*.misc.* ${miscdir}
+
 for suffix in %{build_loop} ; do
 
   if [ "x$suffix" = "x" ] ; then
@@ -1952,17 +1947,32 @@ for suffix in %{build_loop} ; do
   # TODO: should verify checksums when using packages from buildroot
   tar -xJf ${jdkzip}
   tar -xJf ${staticlibzip}
-  mkdir -p $(dirname ${installdir})
-  mv java-%{fakefeaturever}-openjdk* ${installdir}
+  mv java-%{featurever}-openjdk* ${installdir}
 
   # Fix build paths in ELF files so it looks like we built them
-  portablenvr="%{name}-%{VERSION}-%{portablerelease}.%{portablesuffix}.%{_arch}"
+  portablenvr="%{name}-%{VERSION}-%{prelease}.%{portablesuffix}.%{_arch}"
   for file in $(find ${installdir} -type f) ; do
       if file ${file} | grep -q 'ELF'; then
-	  %{debugedit} -b %{portablebuilddir}/${portablenvr} -d $(pwd) -n ${file}
+          %{debugedit} -b %{portablebuilddir}/${portablenvr} -d $(pwd) -n ${file}
       fi
   done
 
+  # Set tapset variables to match this build
+%if %{with_systemtap}
+  for file in ${miscdir}/tapset${suffix}/*.in; do
+    OUTPUT_FILE=`echo $file | sed -e "s:\.stp\.in$:-%{version}-%{release}.%{_arch}.stp:g"`
+    sed -e "s:@ABS_SERVER_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/%{vm_variant}/libjvm.so:g" $file > ${OUTPUT_FILE}
+# TODO find out which architectures other than i686 have a client vm
+%ifarch %{ix86}
+    sed -i -e "s:@ABS_CLIENT_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/client/libjvm.so:g" ${OUTPUT_FILE}
+%else
+    sed -i -e "/@ABS_CLIENT_LIBJVM_SO@/d" ${OUTPUT_FILE}
+%endif
+    sed -i -e "s:@ABS_JAVA_HOME_DIR@:%{_jvmdir}/%{sdkdir -- $suffix}:g" $OUTPUT_FILE
+    sed -i -e "s:@prefix@:%{_jvmdir}/%{sdkdir -- $suffix}/:g" $OUTPUT_FILE
+  done
+%endif
+
   # Final setup on the main image
   customisejdk ${installdir}
 
@@ -1972,14 +1982,6 @@ for suffix in %{build_loop} ; do
 # build cycles
 done # end of release / debug cycle loop
 
-docdir=%{installoutputdir -- "-docs"}
-tar -xJf %{docszip}
-mv java-%{fakefeaturever}-openjdk*.docs.* ${docdir}
-
-miscdir=%{installoutputdir -- "-misc"}
-tar -xJf %{misczip}
-mv java-%{fakefeaturever}-openjdk*.misc.* ${miscdir}
-
 %check
 
 # We test debug first as it will give better diagnostics on a crash
@@ -2015,16 +2017,19 @@ $JAVA_HOME/bin/java ${SEC_DEBUG} -Djava.security.disableSystemPropertiesFile=tru
 if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi
 
 # Check alt-java launcher has SSB mitigation on supported architectures
+# set_speculation function exists in both cases, so check for prctl call
+alt_java_binary=$RPM_BUILD_ROOT%{jrebindir -- $suffix}/%{alt_java_name}
 %ifarch %{ssbd_arches}
-nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation
+nm ${alt_java_binary} | grep prctl
 %else
-if ! nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation ; then true ; else false; fi
+if ! nm ${alt_java_binary} | grep prctl ; then true ; else false; fi
 %endif
 
 %if ! 0%{?flatpak}
 # Check translations are available for new timezones (during flatpak builds, the
 # tzdb.dat used by this test is not where the test expects it, so this is
 # disabled for flatpak builds)
+# Disable test until we are on the latest JDK
 $JAVA_HOME/bin/javac -d . %{SOURCE18}
 $JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE
 $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR
@@ -2033,8 +2038,8 @@ $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|
 %if %{include_staticlibs}
 # Check debug symbols in static libraries (smoke test)
 export STATIC_LIBS_HOME=${JAVA_HOME}/lib/static/linux-%{archinstall}/glibc
-readelf --debug-dump $STATIC_LIBS_HOME/libfdlibm.a | grep w_remainder.c
-readelf --debug-dump $STATIC_LIBS_HOME/libfdlibm.a | grep e_remainder.c
+readelf --debug-dump $STATIC_LIBS_HOME/libnet.a | grep Inet4AddressImpl.c
+readelf --debug-dump $STATIC_LIBS_HOME/libnet.a | grep Inet6AddressImpl.c
 %endif
 
 so_suffix="so"
@@ -2128,7 +2133,7 @@ for suffix in %{build_loop} ; do
 jdk_image=$(pwd)/%{installoutputdir -- ${suffix}}
 # Should match same definitions in build section
 docdir=$(pwd)/%{installoutputdir -- "-docs"}
-miscdir=%{installoutputdir -- "-misc"}
+miscdir=$(pwd)/%{installoutputdir -- "-misc"}
 
 # Install release notes and rebuild instructions
 commondocdir=${RPM_BUILD_ROOT}%{_defaultdocdir}/%{uniquejavadocdir -- $suffix}
@@ -2139,14 +2144,13 @@ cp -a %{SOURCE19} %{SOURCE20} ${commondocdir}
 # Install the jdk
 mkdir -p $RPM_BUILD_ROOT%{_jvmdir}
 cp -a ${jdk_image} $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}
-
-pushd ${jdk_image}
+# Install %{alt_java_name} binary
+install -D -p -m 755 ${miscdir}/%{alt_java_name} $RPM_BUILD_ROOT%{jrebindir -- $suffix}
 
 %if %{with_systemtap}
   # Install systemtap support files
   install -dm 755 $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset
-  # note, that uniquesuffix  is in BUILD dir in this case
-  cp -a $RPM_BUILD_DIR/%{uniquesuffix ""}/tapset$suffix/*.stp $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset/
+  cp -a ${miscdir}/tapset$suffix/*.stp $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset/
   pushd  $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset/
    tapsetFiles=`ls *.stp`
   popd
@@ -2171,6 +2175,7 @@ pushd ${jdk_image}
 
   # Install man pages
   install -d -m 755 $RPM_BUILD_ROOT%{_mandir}/man1
+  pushd ${jdk_image}
   for manpage in man/man1/*
   do
     # Convert man pages to UTF8 encoding
@@ -2181,8 +2186,7 @@ pushd ${jdk_image}
   done
   # Remove man pages from jdk image
   rm -rf $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/man
-
-popd
+  popd
 
 if ! echo $suffix | grep -q "debug" ; then
     # Install Javadoc documentation
@@ -2213,9 +2217,6 @@ done
 # See https://bugzilla.redhat.com/show_bug.cgi?id=741821
 mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/.java/.systemPrefs
 
-# copy samples next to demos; samples are mostly js files
-cp -r ${miscdir}/sample  $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix}/
-
 # moving config files to /etc
 mkdir -p $RPM_BUILD_ROOT/%{etcjavadir -- $suffix}
 mkdir -p $RPM_BUILD_ROOT/%{etcjavadir -- $suffix}/lib
@@ -2481,6 +2482,117 @@ cjc.mainProgram(args)
 %endif
 
 %changelog
+* Mon Oct 30 2023 Andrew Hughes  - 1:21.0.1.0.12-2
+- Switch to using portable binaries built on RHEL 7
+- Sync the copy of the portable specfile with the RHEL 7 version
+- Related: RHEL-12997
+
+* Fri Oct 27 2023 Andrew Hughes  - 1:21.0.1.0.12-1
+- Update to jdk-21.0.1.0+12 (GA)
+- Update release notes to 21.0.1.0+12
+- Sync the copy of the portable specfile with the latest update
+- Update openjdk_news script to specify subdirectory last
+- Add missing discover_trees script required by openjdk_news
+- Synchronise bundled versions with 21u sources (FreeType, LCMS, HarfBuzz, libpng)
+- Sync generate_tarball.sh with 11u & 17u version
+- Update bug URL for RHEL to point to the Red Hat customer portal
+- Fix upstream release URL for OpenJDK source
+- Following JDK-8005165, class data sharing can be enabled on all JIT architectures
+- Use tapsets from the misc tarball
+- Introduce 'prelease' for the portable release versioning, to handle EA builds
+- Make sure root installation directory is created first
+- Use in-place substitution for all but the first of the tapset changes
+- Synchronise runtime and buildtime tzdata requirements
+- Remove ghosts for binaries not in java-21-openjdk (pack200, rmid, unpack200)
+- Add missing jfr, jpackage and jwebserver alternative ghosts
+- Move jcmd to the headless package
+- Revert alt-java binary location to being within the JDK tree
+- Resolves: RHEL-12997
+- Resolves: RHEL-14954
+- Resolves: RHEL-14962
+- Resolves: RHEL-14958
+- Related: RHEL-14946
+- Resolves: RHEL-14959
+- Resolves: RHEL-14948
+
+* Fri Oct 27 2023 Jiri Vanek  - 1:21.0.1.0.12-1
+- Exclude classes_nocoops.jsa on i686 and arm32
+- Related: RHEL-14946
+
+* Fri Oct 27 2023 Severin Gehwolf  - 1:21.0.1.0.12-1
+- Fix packaging of CDS archives
+- Resolves: RHEL-14946
+
+* Thu Aug 24 2023 Andrew Hughes  - 1:21.0.0.0.35-2
+- Update documentation (README.md)
+- Replace alt-java patch with a binary separate from the JDK
+- Drop stale patches that are of little use any more:
+- * nss.cfg has been disabled since early PKCS11 work and long superseded by FIPS work
+- * No accessibility subpackage to warrant RH1648242 & RH1648644 patches any more
+- * No use of system libjpeg turbo to warrant RH649512 patch any more
+- Replace RH1684077 pcsc-lite-libs patch with better JDK-8009550 fix being upstreamed
+- Adapt alt-java test to new binary where there is always a set_speculation function
+- Related: RHEL-12997
+
+* Mon Aug 21 2023 Andrew Hughes  - 1:21.0.0.0.35-1
+- Update to jdk-21.0.0+35
+- Update system crypto policy & FIPS patch from new fips-21u tree
+- Update generate_tarball.sh to sync with upstream vanilla script inc. no more ECC removal
+- Drop fakefeaturever now it is no longer needed
+- Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
+- Use upstream release URL for OpenJDK source
+- Re-enable tzdata tests now we are on the latest JDK and things are back in sync
+- Install jaxp.properties introduced by JDK-8303530
+- Install lible.so introduced by JDK-8306983
+- Related: RHEL-12997
+
+* Mon Aug 21 2023 Petra Alice Mikova  - 1:21.0.0.0.35-1
+- Replace smoke test files used in the staticlibs test, as fdlibm was removed by JDK-8303798
+- Related: RHEL-12997
+
+* Wed Aug 16 2023 Andrew Hughes  - 1:20.0.0.0.36-1
+- Update to jdk-20.0.2+9
+- Update release notes to 20.0.2+9
+- Update system crypto policy & FIPS patch from new fips-20u tree
+- Update generate_tarball.sh ICEDTEA_VERSION
+- Update CLDR reference data following update to 42 (Rocky Mountain-Normalzeit => Rocky-Mountain-Normalzeit)
+- Related: RHEL-12997
+
+* Wed Aug 16 2023 Jiri Vanek  - 1:20.0.0.0.36-1
+- Dropped JDK-8295447, JDK-8296239 & JDK-8299439 patches now upstream
+- Adapted rh1750419-redhat_alt_java.patch
+- Related: RHEL-12997
+
+* Tue Aug 15 2023 Andrew Hughes  - 1:19.0.1.0.10-1
+- Update to jdk-19.0.2 release
+- Update release notes to 19.0.2
+- Rebase FIPS patches from fips-19u branch
+- Remove references to sample directory removed by JDK-8284999
+- Add local patch JDK-8295447 (javac NPE) which was accepted into 19u upstream but not in the GA tag
+- Add local patches for JDK-8296239 & JDK-8299439 (Croatia Euro update) which are present in 8u, 11u & 17u releases
+- Related: RHEL-12997
+
+* Thu Aug 10 2023 Andrew Hughes  - 1:18.0.2.0.9-1
+- Update to jdk-18.0.2 release
+- Support JVM variant zero following JDK-8273494 no longer installing Zero's libjvm.so in the server directory
+- Rebase FIPS patches from fips-18u branch
+- Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
+- Drop now unused fresh_libjvm, build_hotspot_first, bootjdk and buildjdkver variables, as we don't build a JDK here
+- Drop tzdata patches added for 17.0.7 which will eventually appear in the upstream tarball when we reach OpenJDK 21
+- Disable tzdata tests until we are on the latest JDK and things are back in sync
+- Use empty nss.fips.cfg until it is again available via the FIPS patch
+- Related: RHEL-12997
+
+* Thu Aug 10 2023 Petra Alice Mikova  - 1:18.0.2.0.9-1
+- Update to ea version of jdk18
+- Add new slave jwebserver and corresponding manpage
+- Adjust rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
+- Related: RHEL-12997
+
+* Thu Aug 10 2023 FeRD (Frank Dana)  - 1:18.0.2.0.9-1
+- Add javaver- and origin-specific javadoc and javadoczip alternatives.
+- Related: RHEL-12997
+
 * Tue Aug 08 2023 Andrew Hughes  - 1:17.0.7.0.7-4
 - Add files missed by centpkg import.
 - Related: rhbz#2192748
diff --git a/discover_trees.sh b/discover_trees.sh
deleted file mode 100755
index 8c31278..0000000
--- a/discover_trees.sh
+++ /dev/null
@@ -1,54 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) 2020 Red Hat, Inc.
-# Written by Andrew John Hughes .
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU Affero General Public License as
-# published by the Free Software Foundation, either version 3 of the
-# License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU Affero General Public License for more details.
-#
-# You should have received a copy of the GNU Affero General Public License
-# along with this program.  If not, see .
-
-TREE=${1}
-
-if test "x${TREE}" = "x"; then
-    TREE=${PWD}
-fi
-
-if [ -e ${TREE}/nashorn/.hg -o -e ${TREE}/nashorn/merge.changeset ] ; then
-    NASHORN="nashorn" ;
-fi
-
-if [ -e ${TREE}/corba/.hg -o -e ${TREE}/corba/merge.changeset ] ; then
-    CORBA="corba";
-fi
-
-if [ -e ${TREE}/jaxp/.hg -o -e ${TREE}/jaxp/merge.changeset ] ; then
-    JAXP="jaxp";
-fi
-
-if [ -e ${TREE}/jaxws/.hg -o -e ${TREE}/jaxws/merge.changeset ] ; then
-    JAXWS="jaxws";
-fi
-
-if [ -e ${TREE}/langtools/.hg -o -e ${TREE}/langtools/merge.changeset ] ; then
-    LANGTOOLS="langtools";
-fi
-
-if [ -e ${TREE}/jdk/.hg -o -e ${TREE}/jdk/merge.changeset ] ; then
-    JDK="jdk";
-fi
-
-if [ -e ${TREE}/hotspot/.hg -o -e ${TREE}/hotspot/merge.changeset ] ; then
-    HOTSPOT="hotspot";
-fi
-
-SUBTREES="${CORBA} ${JAXP} ${JAXWS} ${LANGTOOLS} ${NASHORN} ${JDK} ${HOTSPOT}";
-echo ${SUBTREES}
diff --git a/gating.yaml b/gating.yaml
deleted file mode 100644
index c7412f1..0000000
--- a/gating.yaml
+++ /dev/null
@@ -1,7 +0,0 @@
-# recipients: java-qa
---- !Policy
-product_versions:
-  - rhel-9
-decision_context: osci_compose_gate
-rules:
-  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
diff --git a/generate_source_tarball.sh b/generate_source_tarball.sh
deleted file mode 100755
index d32c8d2..0000000
--- a/generate_source_tarball.sh
+++ /dev/null
@@ -1,210 +0,0 @@
-#!/bin/bash
-# Generates the 'source tarball' for JDK projects.
-#
-# Example:
-# When used from local repo set REPO_ROOT pointing to file:// with your repo
-# If your local repo follows upstream forests conventions, it may be enough to set OPENJDK_URL
-# If you want to use a local copy of patch PR3788, set the path to it in the PR3788 variable
-#
-# In any case you have to set PROJECT_NAME REPO_NAME and VERSION. eg:
-# PROJECT_NAME=openjdk
-# REPO_NAME=jdk17u
-# VERSION=jdk-17.0.3+5
-# or to eg prepare systemtap:
-# icedtea7's jstack and other tapsets
-# VERSION=6327cf1cea9e
-# REPO_NAME=icedtea7-2.6
-# PROJECT_NAME=release
-# OPENJDK_URL=http://icedtea.classpath.org/hg/
-# TO_COMPRESS="*/tapset"
-#
-# They are used to create correct name and are used in construction of sources url (unless REPO_ROOT is set)
-
-# This script creates a single source tarball out of the repository
-# based on the given tag and removes code not allowed in fedora/rhel. For
-# consistency, the source tarball will always contain 'openjdk' as the top
-# level folder, name is created, based on parameter
-#
-
-if [ ! "x$PR3823" = "x" ] ; then
-  if [ ! -f "$PR3823" ] ; then
-    echo "You have specified PR3823 as $PR3823 but it does not exist. Exiting"
-    exit 1
-  fi
-fi
-
-set -e
-
-OPENJDK_URL_DEFAULT=https://github.com
-COMPRESSION_DEFAULT=xz
-# Corresponding IcedTea version
-ICEDTEA_VERSION=12.0
-
-if [ "x$1" = "xhelp" ] ; then
-    echo -e "Behaviour may be specified by setting the following variables:\n"
-    echo "VERSION - the version of the specified OpenJDK project"
-    echo "PROJECT_NAME -- the name of the OpenJDK project being archived (optional; only needed by defaults)"
-    echo "REPO_NAME - the name of the OpenJDK repository (optional; only needed by defaults)"
-    echo "OPENJDK_URL - the URL to retrieve code from (optional; defaults to ${OPENJDK_URL_DEFAULT})"
-    echo "COMPRESSION - the compression type to use (optional; defaults to ${COMPRESSION_DEFAULT})"
-    echo "FILE_NAME_ROOT - name of the archive, minus extensions (optional; defaults to PROJECT_NAME-REPO_NAME-VERSION)"
-    echo "TO_COMPRESS - what part of clone to pack (default is openjdk)"
-    echo "PR3823 - the path to the PR3823 patch to apply (optional; downloaded if unavailable)"
-    echo "BOOT_JDK - the bootstrap JDK to satisfy the configure run"
-    exit 1;
-fi
-
-
-if [ "x$VERSION" = "x" ] ; then
-    echo "No VERSION specified"
-    exit 2
-fi
-echo "Version: ${VERSION}"
-
-NUM_VER=${VERSION##jdk-}
-RELEASE_VER=${NUM_VER%%+*}
-BUILD_VER=${NUM_VER##*+}
-MAJOR_VER=${RELEASE_VER%%.*}
-echo "Major version is ${MAJOR_VER}, release ${RELEASE_VER}, build ${BUILD_VER}"
-
-if [ "x$BOOT_JDK" = "x" ] ; then
-    echo "No boot JDK specified".
-    BOOT_JDK=/usr/lib/jvm/java-${MAJOR_VER}-openjdk;
-    echo -n "Checking for ${BOOT_JDK}...";
-    if [ -d ${BOOT_JDK} -a -x ${BOOT_JDK}/bin/java ] ; then
-        echo "Boot JDK found at ${BOOT_JDK}";
-    else
-        echo "Not found";
-        PREV_VER=$((${MAJOR_VER} - 1));
-        BOOT_JDK=/usr/lib/jvm/java-${PREV_VER}-openjdk;
-        echo -n "Checking for ${BOOT_JDK}...";
-        if [ -d ${BOOT_JDK} -a -x ${BOOT_JDK}/bin/java ] ; then
-            echo "Boot JDK found at ${BOOT_JDK}";
-        else
-            echo "Not found";
-            exit 4;
-        fi
-    fi
-else
-    echo "Boot JDK: ${BOOT_JDK}";
-fi
-
-# REPO_NAME is only needed when we default on REPO_ROOT and FILE_NAME_ROOT
-if [ "x$FILE_NAME_ROOT" = "x" -o "x$REPO_ROOT" = "x" ] ; then
-  if [ "x$PROJECT_NAME" = "x" ] ; then
-    echo "No PROJECT_NAME specified"
-    exit 1
-  fi
-  echo "Project name: ${PROJECT_NAME}"
-  if [ "x$REPO_NAME" = "x" ] ; then
-    echo "No REPO_NAME specified"
-    exit 3
-  fi
-  echo "Repository name: ${REPO_NAME}"
-fi
-
-if [ "x$OPENJDK_URL" = "x" ] ; then
-    OPENJDK_URL=${OPENJDK_URL_DEFAULT}
-    echo "No OpenJDK URL specified; defaulting to ${OPENJDK_URL}"
-else
-    echo "OpenJDK URL: ${OPENJDK_URL}"
-fi
-
-if [ "x$COMPRESSION" = "x" ] ; then
-    # rhel 5 needs tar.gz
-    COMPRESSION=${COMPRESSION_DEFAULT}
-fi
-echo "Creating a tar.${COMPRESSION} archive"
-
-if [ "x$FILE_NAME_ROOT" = "x" ] ; then
-    FILE_NAME_ROOT=${PROJECT_NAME}-${REPO_NAME}-${VERSION}
-    echo "No file name root specified; default to ${FILE_NAME_ROOT}"
-fi
-if [ "x$REPO_ROOT" = "x" ] ; then
-    REPO_ROOT="${OPENJDK_URL}/${PROJECT_NAME}/${REPO_NAME}.git"
-    echo "No repository root specified; default to ${REPO_ROOT}"
-fi;
-
-if [ "x$TO_COMPRESS" = "x" ] ; then
-    TO_COMPRESS="openjdk"
-    echo "No targets to be compressed specified, ; default to ${TO_COMPRESS}"
-fi;
-
-if [ -d ${FILE_NAME_ROOT} ] ; then
-  echo "exists exists exists exists exists exists exists "
-  echo "reusing reusing reusing reusing reusing reusing "
-  echo ${FILE_NAME_ROOT}
-else
-  mkdir "${FILE_NAME_ROOT}"
-  pushd "${FILE_NAME_ROOT}"
-    echo "Cloning ${VERSION} root repository from ${REPO_ROOT}"
-    git clone -b ${VERSION} ${REPO_ROOT} openjdk
-  popd
-fi
-pushd "${FILE_NAME_ROOT}"
-    if [ -d openjdk/src ]; then
-        pushd openjdk
-            echo "Removing EC source code we don't build"
-            CRYPTO_PATH=src/jdk.crypto.ec/share/native/libsunec/impl
-            rm -vf ${CRYPTO_PATH}/ec2.h
-            rm -vf ${CRYPTO_PATH}/ec2_163.c
-            rm -vf ${CRYPTO_PATH}/ec2_193.c
-            rm -vf ${CRYPTO_PATH}/ec2_233.c
-            rm -vf ${CRYPTO_PATH}/ec2_aff.c
-            rm -vf ${CRYPTO_PATH}/ec2_mont.c
-            rm -vf ${CRYPTO_PATH}/ecp_192.c
-            rm -vf ${CRYPTO_PATH}/ecp_224.c
-
-            echo "Syncing EC list with NSS"
-            if [ "x$PR3823" = "x" ] ; then
-                # get PR3823.patch (from https://github.com/icedtea-git/icedtea) in the ${ICEDTEA_VERSION} branch
-                # Do not push it or publish it
-                echo "PR3823 not found. Downloading..."
-                wget -v https://github.com/icedtea-git/icedtea/raw/${ICEDTEA_VERSION}/patches/pr3823.patch
-                echo "Applying ${PWD}/pr3823.patch"
-                patch -Np1 < pr3823.patch
-                rm pr3823.patch
-            else
-                echo "Applying ${PR3823}"
-                patch -Np1 < $PR3823
-            fi;
-            find . -name '*.orig' -exec rm -vf '{}' ';'
-        popd
-    fi
-
-    # Generate .src-rev so build has knowledge of the revision the tarball was created from
-    mkdir build
-    pushd build
-    sh ${PWD}/../openjdk/configure --with-boot-jdk=${BOOT_JDK}
-    make store-source-revision
-    popd
-    rm -rf build
-
-    # Remove commit checks
-    echo "Removing $(find openjdk -name '.jcheck' -print)"
-    find openjdk -name '.jcheck' -print0 | xargs -0 rm -r
-
-    # Remove history and GHA
-    echo "find openjdk -name '.hgtags'"
-    find openjdk -name '.hgtags' -exec rm -v '{}' '+'
-    echo "find openjdk -name '.hgignore'"
-    find openjdk -name '.hgignore' -exec rm -v '{}' '+'
-    echo "find openjdk -name '.gitattributes'"
-    find openjdk -name '.gitattributes' -exec rm -v '{}' '+'
-    echo "find openjdk -name '.gitignore'"
-    find openjdk -name '.gitignore' -exec rm -v '{}' '+'
-    echo "find openjdk -name '.git'"
-    find openjdk -name '.git' -exec rm -rv '{}' '+'
-    echo "find openjdk -name '.github'"
-    find openjdk -name '.github' -exec rm -rv '{}' '+'
-
-    echo "Compressing remaining forest"
-    if [ "X$COMPRESSION" = "Xxz" ] ; then
-        SWITCH=cJf
-    else
-        SWITCH=czf
-    fi
-    tar --exclude-vcs -$SWITCH ${FILE_NAME_ROOT}.tar.${COMPRESSION} $TO_COMPRESS
-    mv ${FILE_NAME_ROOT}.tar.${COMPRESSION}  ..
-popd
-echo "Done. You may want to remove the uncompressed version - $FILE_NAME_ROOT."
diff --git a/icedtea_sync.sh b/icedtea_sync.sh
deleted file mode 100755
index 022d199..0000000
--- a/icedtea_sync.sh
+++ /dev/null
@@ -1,191 +0,0 @@
-#!/bin/bash
-
-# Copyright (C) 2019 Red Hat, Inc.
-# Written by Andrew John Hughes .
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU Affero General Public License as
-# published by the Free Software Foundation, either version 3 of the
-# License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU Affero General Public License for more details.
-#
-# You should have received a copy of the GNU Affero General Public License
-# along with this program.  If not, see .
-
-ICEDTEA_USE_VCS=true
-
-ICEDTEA_VERSION=3.15.0
-ICEDTEA_URL=https://icedtea.classpath.org/download/source
-ICEDTEA_SIGNING_KEY=CFDA0F9B35964222
-
-ICEDTEA_HG_URL=https://icedtea.classpath.org/hg/icedtea11
-set -e
-
-RPM_DIR=${PWD}
-if [ ! -f ${RPM_DIR}/jconsole.desktop.in ] ; then
-    echo "Not in RPM source tree.";
-    exit 1;
-fi
-
-if test "x${TMPDIR}" = "x"; then
-    TMPDIR=/tmp;
-fi
-WORKDIR=${TMPDIR}/it.sync
-
-echo "Using working directory ${WORKDIR}"
-mkdir ${WORKDIR}
-pushd ${WORKDIR}
-
-if test "x${WGET}" = "x"; then
-    WGET=$(which wget);
-    if test "x${WGET}" = "x"; then
-	echo "wget not found";
-	exit 1;
-    fi
-fi
-
-if test "x${TAR}" = "x"; then
-    TAR=$(which tar)
-    if test "x${TAR}" = "x"; then
-	echo "tar not found";
-	exit 2;
-    fi
-fi
-
-echo "Dependencies:";
-echo -e "\tWGET: ${WGET}";
-echo -e "\tTAR: ${TAR}\n";
-
-if test "x${ICEDTEA_USE_VCS}" = "xtrue"; then
-    echo "Mode: Using VCS";
-
-    if test "x${GREP}" = "x"; then
-	GREP=$(which grep);
-	if test "x${GREP}" = "x"; then
-	    echo "grep not found";
-	    exit 3;
-	fi
-    fi
-
-    if test "x${CUT}" = "x"; then
-	CUT=$(which cut);
-	if test "x${CUT}" = "x"; then
-	    echo "cut not found";
-	    exit 4;
-	fi
-    fi
-
-    if test "x${TR}" = "x"; then
-	TR=$(which tr);
-	if test "x${TR}" = "x"; then
-	    echo "tr not found";
-	    exit 5;
-	fi
-    fi
-
-    if test "x${HG}" = "x"; then
-	HG=$(which hg);
-	if test "x${HG}" = "x"; then
-	    echo "hg not found";
-	    exit 6;
-	fi
-    fi
-
-    echo "Dependencies:";
-    echo -e "\tGREP: ${GREP}";
-    echo -e "\tCUT: ${CUT}";
-    echo -e "\tTR: ${TR}";
-    echo -e "\tHG: ${HG}";
-
-    echo "Checking out repository from VCS...";
-    ${HG} clone ${ICEDTEA_HG_URL} icedtea
-
-    echo "Obtaining version from configure.ac...";
-    ROOT_VER=$(${GREP} '^AC_INIT' icedtea/configure.ac|${CUT} -d ',' -f 2|${TR} -d '[][:space:]')
-    echo "Root version from configure: ${ROOT_VER}";
-
-    VCS_REV=$(${HG} log -R icedtea --template '{node|short}' -r tip)
-    echo "VCS revision: ${VCS_REV}";
-
-    ICEDTEA_VERSION="${ROOT_VER}-${VCS_REV}"
-    echo "Creating icedtea-${ICEDTEA_VERSION}";
-    mkdir icedtea-${ICEDTEA_VERSION}
-    echo "Copying required files from checkout to icedtea-${ICEDTEA_VERSION}";
-    # Commented out for now as IcedTea 6's jconsole.desktop.in is outdated
-    #cp -a icedtea/jconsole.desktop.in ../icedtea-${ICEDTEA_VERSION}
-    cp -a ${RPM_DIR}/jconsole.desktop.in icedtea-${ICEDTEA_VERSION}
-    cp -a icedtea/tapset icedtea-${ICEDTEA_VERSION}
-
-    rm -rf icedtea
-else
-    echo "Mode: Using tarball";
-
-    if test "x${ICEDTEA_VERSION}" = "x"; then
-	echo "No IcedTea version specified for tarball download.";
-	exit 3;
-    fi
-
-    if test "x${CHECKSUM}" = "x"; then
-	CHECKSUM=$(which sha256sum)
-	if test "x${CHECKSUM}" = "x"; then
-	    echo "sha256sum not found";
-	    exit 4;
-	fi
-    fi
-
-    if test "x${PGP}" = "x"; then
-	PGP=$(which gpg)
-	if test "x${PGP}" = "x"; then
-	    echo "gpg not found";
-	    exit 5;
-	fi
-    fi
-
-    echo "Dependencies:";
-    echo -e "\tCHECKSUM: ${CHECKSUM}";
-    echo -e "\tPGP: ${PGP}\n";
-
-    echo "Checking for IcedTea signing key ${ICEDTEA_SIGNING_KEY}...";
-    if ! gpg --list-keys ${ICEDTEA_SIGNING_KEY}; then
-	echo "IcedTea signing key ${ICEDTEA_SIGNING_KEY} not installed.";
-	exit 6;
-    fi
-
-    echo "Downloading IcedTea release tarball...";
-    ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz
-    echo "Downloading IcedTea tarball signature...";
-    ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz.sig
-    echo "Downloading IcedTea tarball checksums...";
-    ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.sha256
-
-    echo "Verifying checksums...";
-    ${CHECKSUM} --check --ignore-missing icedtea-${ICEDTEA_VERSION}.sha256
-
-    echo "Checking signature...";
-    ${PGP} --verify icedtea-${ICEDTEA_VERSION}.tar.xz.sig
-
-    echo "Extracting files...";
-    ${TAR} xJf icedtea-${ICEDTEA_VERSION}.tar.xz \
-       icedtea-${ICEDTEA_VERSION}/tapset \
-       icedtea-${ICEDTEA_VERSION}/jconsole.desktop.in
-
-    rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz
-    rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz.sig
-    rm -vf icedtea-${ICEDTEA_VERSION}.sha256
-fi
-
-echo "Replacing desktop files...";
-mv -v icedtea-${ICEDTEA_VERSION}/jconsole.desktop.in ${RPM_DIR}
-
-echo "Creating new tapset tarball...";
-mv -v icedtea-${ICEDTEA_VERSION} openjdk
-${TAR} cJf ${RPM_DIR}/tapsets-icedtea-${ICEDTEA_VERSION}.tar.xz openjdk
-
-rm -rvf openjdk
-
-popd
-rm -rf ${WORKDIR}
diff --git a/jdk8274864-remove_amman_cairo_hacks.patch b/jdk8274864-remove_amman_cairo_hacks.patch
deleted file mode 100644
index 5a5263a..0000000
--- a/jdk8274864-remove_amman_cairo_hacks.patch
+++ /dev/null
@@ -1,53 +0,0 @@
-commit 1b3825db8631e55771fb723d4fcd10040ea15b7e
-Author: duke 
-Date:   Wed Apr 12 17:25:27 2023 +0000
-
-    Backport ec199072c5867624d66840238cc8828e16ae8da7
-
-diff --git a/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java b/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java
-index 6f6e190efcd..ef278203182 100644
---- a/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java
-+++ b/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java
-@@ -608,34 +608,6 @@ public final class ZoneInfoFile {
-                 params[8] = endRule.secondOfDay * 1000;
-                 params[9] = toSTZTime[endRule.timeDefinition];
-                 dstSavings = (startRule.offsetAfter - startRule.offsetBefore) * 1000;
--
--                // Note: known mismatching -> Asia/Amman
--                // ZoneInfo :      startDayOfWeek=5     <= Thursday
--                //                 startTime=86400000   <= 24 hours
--                // This:           startDayOfWeek=6
--                //                 startTime=0
--                // Similar workaround needs to be applied to Africa/Cairo and
--                // its endDayOfWeek and endTime
--                // Below is the workarounds, it probably slows down everyone a little
--                if (params[2] == 6 && params[3] == 0 &&
--                    (zoneId.equals("Asia/Amman"))) {
--                    params[2] = 5;
--                    params[3] = 86400000;
--                }
--                // Additional check for startDayOfWeek=6 and starTime=86400000
--                // is needed for Asia/Amman;
--                if (params[2] == 7 && params[3] == 0 &&
--                     (zoneId.equals("Asia/Amman"))) {
--                    params[2] = 6;        // Friday
--                    params[3] = 86400000; // 24h
--                }
--                //endDayOfWeek and endTime workaround
--                if (params[7] == 6 && params[8] == 0 &&
--                    (zoneId.equals("Africa/Cairo"))) {
--                    params[7] = 5;
--                    params[8] = 86400000;
--                }
--
-             } else if (nTrans > 0) {  // only do this if there is something in table already
-                 if (lastyear < LASTYEAR) {
-                     // ZoneInfo has an ending entry for 2037
-@@ -908,7 +880,6 @@ public final class ZoneInfoFile {
-             this.dow = dowByte == 0 ? -1 : dowByte;
-             this.secondOfDay = timeByte == 31 ? in.readInt() : timeByte * 3600;
-             this.timeDefinition = (data & (3 << 12)) >>> 12;
--
-             this.standardOffset = stdByte == 255 ? in.readInt() : (stdByte - 128) * 900;
-             this.offsetBefore = beforeByte == 3 ? in.readInt() : standardOffset + beforeByte * 1800;
-             this.offsetAfter = afterByte == 3 ? in.readInt() : standardOffset + afterByte * 1800;
diff --git a/jdk8305113-tzdata2023c.patch b/jdk8305113-tzdata2023c.patch
deleted file mode 100644
index 6758dfd..0000000
--- a/jdk8305113-tzdata2023c.patch
+++ /dev/null
@@ -1,1098 +0,0 @@
-commit 9619cdb7b7f63f2d8a71d35c8672be93fd6255e9
-Author: Yoshiki Sato 
-Date:   Wed Apr 5 01:19:00 2023 +0000
-
-    Backport ed9592c6e81f82e2bf6508ce45ba15aad8232181
-
-diff --git a/make/data/tzdata/VERSION b/make/data/tzdata/VERSION
-index 0f328a4a7ff..66bd061e8bc 100644
---- a/make/data/tzdata/VERSION
-+++ b/make/data/tzdata/VERSION
-@@ -21,4 +21,4 @@
- # or visit www.oracle.com if you need additional information or have any
- # questions.
- #
--tzdata2022g
-+tzdata2023c
-diff --git a/make/data/tzdata/africa b/make/data/tzdata/africa
-index 830d7d10b7e..a73405fdb01 100644
---- a/make/data/tzdata/africa
-+++ b/make/data/tzdata/africa
-@@ -344,6 +344,14 @@ Rule	Egypt	2007	only	-	Sep	Thu>=1	24:00	0	-
- # From Mina Samuel (2016-07-04):
- # Egyptian government took the decision to cancel the DST,
- 
-+# From Ahmad ElDardiry (2023-03-01):
-+# Egypt officially announced today that daylight savings will be
-+# applied from last Friday of April to last Thursday of October.
-+# From Paul Eggert (2023-03-01):
-+# Assume transitions are at 00:00 and 24:00 respectively.
-+# From Amir Adib (2023-03-07):
-+# https://www.facebook.com/EgyptianCabinet/posts/638829614954129/
-+
- Rule	Egypt	2008	only	-	Aug	lastThu	24:00	0	-
- Rule	Egypt	2009	only	-	Aug	20	24:00	0	-
- Rule	Egypt	2010	only	-	Aug	10	24:00	0	-
-@@ -353,6 +361,8 @@ Rule	Egypt	2014	only	-	May	15	24:00	1:00	S
- Rule	Egypt	2014	only	-	Jun	26	24:00	0	-
- Rule	Egypt	2014	only	-	Jul	31	24:00	1:00	S
- Rule	Egypt	2014	only	-	Sep	lastThu	24:00	0	-
-+Rule	Egypt	2023	max	-	Apr	lastFri	 0:00	1:00	S
-+Rule	Egypt	2023	max	-	Oct	lastThu	24:00	0	-
- 
- # Zone	NAME		STDOFF	RULES	FORMAT	[UNTIL]
- 		#STDOFF	2:05:08.9
-@@ -452,7 +462,7 @@ Zone	Africa/Nairobi	2:27:16	-	LMT	1908 May
- # President William R. Tolbert, Jr., July 23, 1971-July 31, 1972.
- # Monrovia: Executive Mansion.
- #
--# Use the abbreviation "MMT" before 1972, as the more-accurate numeric
-+# Use the abbreviation "MMT" before 1972, as the more accurate numeric
- # abbreviation "-004430" would be one byte over the POSIX limit.
- #
- # Zone	NAME		STDOFF	RULES	FORMAT	[UNTIL]
-@@ -589,8 +599,8 @@ Zone	Africa/Tripoli	0:52:44 -	LMT	1920
- # DST the coming summer...
- #
- # Some sources, in French:
--# http://www.defimedia.info/news/946/Rashid-Beebeejaun-:-%C2%AB-L%E2%80%99heure-d%E2%80%99%C3%A9t%C3%A9-ne-sera-pas-appliqu%C3%A9e-cette-ann%C3%A9e-%C2%BB
--# http://lexpress.mu/Story/3398~Beebeejaun---Les-objectifs-d-%C3%A9conomie-d-%C3%A9nergie-de-l-heure-d-%C3%A9t%C3%A9-ont-%C3%A9t%C3%A9-atteints-
-+# http://www.defimedia.info/news/946/Rashid-Beebeejaun-:-«-L%E2%80%99heure-d%E2%80%99été-ne-sera-pas-appliquée-cette-année-»
-+# http://lexpress.mu/Story/3398~Beebeejaun---Les-objectifs-d-économie-d-énergie-de-l-heure-d-été-ont-été-atteints-
- #
- # Our wrap-up:
- # https://www.timeanddate.com/news/time/mauritius-dst-will-not-repeat.html
-@@ -721,7 +731,7 @@ Zone Indian/Mauritius	3:50:00 -	LMT	1907 # Port Louis
- # More articles in the press
- # https://www.yabiladi.com/articles/details/5058/secret-l-heure-d-ete-maroc-leve.html
- # http://www.lematin.ma/Actualite/Express/Article.asp?id=148923
--# http://www.lavieeco.com/actualite/Le-Maroc-passe-sur-GMT%2B1-a-partir-de-dim
-+# http://www.lavieeco.com/actualite/Le-Maroc-passe-sur-GMT+1-a-partir-de-dim
- 
- # From Petr Machata (2011-03-30):
- # They have it written in English here:
-@@ -736,7 +746,7 @@ Zone Indian/Mauritius	3:50:00 -	LMT	1907 # Port Louis
- # According to Infomédiaire web site from Morocco (infomediaire.ma),
- # on March 9, 2012, (in French) Heure légale:
- # Le Maroc adopte officiellement l'heure d'été
--# http://www.infomediaire.ma/news/maroc/heure-l%C3%A9gale-le-maroc-adopte-officiellement-lheure-d%C3%A9t%C3%A9
-+# http://www.infomediaire.ma/news/maroc/heure-légale-le-maroc-adopte-officiellement-lheure-dété
- # Governing Council adopted draft decree, that Morocco DST starts on
- # the last Sunday of March (March 25, 2012) and ends on
- # last Sunday of September (September 30, 2012)
-@@ -860,19 +870,28 @@ Zone Indian/Mauritius	3:50:00 -	LMT	1907 # Port Louis
- # Friday or Saturday (and so the 2 days off are on a weekend), the next time
- # shift will be the next weekend.
- #
--# From Paul Eggert (2020-05-31):
-+# From Milamber (2021-03-31, 2022-03-10):
-+# https://www.mmsp.gov.ma/fr/actualites.aspx?id=2076
-+# https://www.ecoactu.ma/horaires-administration-ramadan-gmtheure-gmt-a-partir-de-dimanche-27-mars/
-+#
-+# From Milamber (2023-03-14, 2023-03-15):
-+# The return to legal GMT time will take place this Sunday, March 19 at 3 a.m.
-+# ... the return to GMT+1 will be made on Sunday April 23, 2023 at 2 a.m.
-+# https://www.mmsp.gov.ma/fr/actualites/passage-à-l%E2%80%99heure-gmt-à-partir-du-dimanche-19-mars-2023
-+#
-+# From Paul Eggert (2023-03-14):
- # For now, guess that in the future Morocco will fall back at 03:00
- # the last Sunday before Ramadan, and spring forward at 02:00 the
--# first Sunday after two days after Ramadan.  To implement this,
-+# first Sunday after one day after Ramadan.  To implement this,
- # transition dates and times for 2019 through 2087 were determined by
--# running the following program under GNU Emacs 26.3.  (This algorithm
-+# running the following program under GNU Emacs 28.2.  (This algorithm
- # also produces the correct transition dates for 2016 through 2018,
- # though the times differ due to Morocco's time zone change in 2018.)
- # (let ((islamic-year 1440))
- #   (require 'cal-islam)
- #   (while (< islamic-year 1511)
- #     (let ((a (calendar-islamic-to-absolute (list 9 1 islamic-year)))
--#           (b (+ 2 (calendar-islamic-to-absolute (list 10 1 islamic-year))))
-+#           (b (+ 1 (calendar-islamic-to-absolute (list 10 1 islamic-year))))
- #           (sunday 0))
- #       (while (/= sunday (mod (setq a (1- a)) 7)))
- #       (while (/= sunday (mod b 7))
-@@ -886,10 +905,6 @@ Zone Indian/Mauritius	3:50:00 -	LMT	1907 # Port Louis
- #         (car (cdr (cdr a))) (calendar-month-name (car a) t) (car (cdr a))
- #         (car (cdr (cdr b))) (calendar-month-name (car b) t) (car (cdr b)))))
- #     (setq islamic-year (+ 1 islamic-year))))
--#
--# From Milamber (2021-03-31, 2022-03-10), confirming these predictions:
--# https://www.mmsp.gov.ma/fr/actualites.aspx?id=2076
--# https://www.ecoactu.ma/horaires-administration-ramadan-gmtheure-gmt-a-partir-de-dimanche-27-mars/
- 
- # Rule	NAME	FROM	TO	-	IN	ON	AT	SAVE	LETTER/S
- Rule	Morocco	1939	only	-	Sep	12	 0:00	1:00	-
-@@ -942,7 +957,7 @@ Rule	Morocco	2021	only	-	May	16	 2:00	0	-
- Rule	Morocco	2022	only	-	Mar	27	 3:00	-1:00	-
- Rule	Morocco	2022	only	-	May	 8	 2:00	0	-
- Rule	Morocco	2023	only	-	Mar	19	 3:00	-1:00	-
--Rule	Morocco	2023	only	-	Apr	30	 2:00	0	-
-+Rule	Morocco	2023	only	-	Apr	23	 2:00	0	-
- Rule	Morocco	2024	only	-	Mar	10	 3:00	-1:00	-
- Rule	Morocco	2024	only	-	Apr	14	 2:00	0	-
- Rule	Morocco	2025	only	-	Feb	23	 3:00	-1:00	-
-@@ -958,7 +973,7 @@ Rule	Morocco	2029	only	-	Feb	18	 2:00	0	-
- Rule	Morocco	2029	only	-	Dec	30	 3:00	-1:00	-
- Rule	Morocco	2030	only	-	Feb	10	 2:00	0	-
- Rule	Morocco	2030	only	-	Dec	22	 3:00	-1:00	-
--Rule	Morocco	2031	only	-	Feb	 2	 2:00	0	-
-+Rule	Morocco	2031	only	-	Jan	26	 2:00	0	-
- Rule	Morocco	2031	only	-	Dec	14	 3:00	-1:00	-
- Rule	Morocco	2032	only	-	Jan	18	 2:00	0	-
- Rule	Morocco	2032	only	-	Nov	28	 3:00	-1:00	-
-@@ -974,7 +989,7 @@ Rule	Morocco	2036	only	-	Nov	23	 2:00	0	-
- Rule	Morocco	2037	only	-	Oct	 4	 3:00	-1:00	-
- Rule	Morocco	2037	only	-	Nov	15	 2:00	0	-
- Rule	Morocco	2038	only	-	Sep	26	 3:00	-1:00	-
--Rule	Morocco	2038	only	-	Nov	 7	 2:00	0	-
-+Rule	Morocco	2038	only	-	Oct	31	 2:00	0	-
- Rule	Morocco	2039	only	-	Sep	18	 3:00	-1:00	-
- Rule	Morocco	2039	only	-	Oct	23	 2:00	0	-
- Rule	Morocco	2040	only	-	Sep	 2	 3:00	-1:00	-
-@@ -990,7 +1005,7 @@ Rule	Morocco	2044	only	-	Aug	28	 2:00	0	-
- Rule	Morocco	2045	only	-	Jul	 9	 3:00	-1:00	-
- Rule	Morocco	2045	only	-	Aug	20	 2:00	0	-
- Rule	Morocco	2046	only	-	Jul	 1	 3:00	-1:00	-
--Rule	Morocco	2046	only	-	Aug	12	 2:00	0	-
-+Rule	Morocco	2046	only	-	Aug	 5	 2:00	0	-
- Rule	Morocco	2047	only	-	Jun	23	 3:00	-1:00	-
- Rule	Morocco	2047	only	-	Jul	28	 2:00	0	-
- Rule	Morocco	2048	only	-	Jun	 7	 3:00	-1:00	-
-@@ -1006,7 +1021,7 @@ Rule	Morocco	2052	only	-	Jun	 2	 2:00	0	-
- Rule	Morocco	2053	only	-	Apr	13	 3:00	-1:00	-
- Rule	Morocco	2053	only	-	May	25	 2:00	0	-
- Rule	Morocco	2054	only	-	Apr	 5	 3:00	-1:00	-
--Rule	Morocco	2054	only	-	May	17	 2:00	0	-
-+Rule	Morocco	2054	only	-	May	10	 2:00	0	-
- Rule	Morocco	2055	only	-	Mar	28	 3:00	-1:00	-
- Rule	Morocco	2055	only	-	May	 2	 2:00	0	-
- Rule	Morocco	2056	only	-	Mar	12	 3:00	-1:00	-
-@@ -1022,7 +1037,7 @@ Rule	Morocco	2060	only	-	Mar	 7	 2:00	0	-
- Rule	Morocco	2061	only	-	Jan	16	 3:00	-1:00	-
- Rule	Morocco	2061	only	-	Feb	27	 2:00	0	-
- Rule	Morocco	2062	only	-	Jan	 8	 3:00	-1:00	-
--Rule	Morocco	2062	only	-	Feb	19	 2:00	0	-
-+Rule	Morocco	2062	only	-	Feb	12	 2:00	0	-
- Rule	Morocco	2062	only	-	Dec	31	 3:00	-1:00	-
- Rule	Morocco	2063	only	-	Feb	 4	 2:00	0	-
- Rule	Morocco	2063	only	-	Dec	16	 3:00	-1:00	-
-@@ -1038,7 +1053,7 @@ Rule	Morocco	2067	only	-	Dec	11	 2:00	0	-
- Rule	Morocco	2068	only	-	Oct	21	 3:00	-1:00	-
- Rule	Morocco	2068	only	-	Dec	 2	 2:00	0	-
- Rule	Morocco	2069	only	-	Oct	13	 3:00	-1:00	-
--Rule	Morocco	2069	only	-	Nov	24	 2:00	0	-
-+Rule	Morocco	2069	only	-	Nov	17	 2:00	0	-
- Rule	Morocco	2070	only	-	Oct	 5	 3:00	-1:00	-
- Rule	Morocco	2070	only	-	Nov	 9	 2:00	0	-
- Rule	Morocco	2071	only	-	Sep	20	 3:00	-1:00	-
-@@ -1054,7 +1069,7 @@ Rule	Morocco	2075	only	-	Sep	15	 2:00	0	-
- Rule	Morocco	2076	only	-	Jul	26	 3:00	-1:00	-
- Rule	Morocco	2076	only	-	Sep	 6	 2:00	0	-
- Rule	Morocco	2077	only	-	Jul	18	 3:00	-1:00	-
--Rule	Morocco	2077	only	-	Aug	29	 2:00	0	-
-+Rule	Morocco	2077	only	-	Aug	22	 2:00	0	-
- Rule	Morocco	2078	only	-	Jul	10	 3:00	-1:00	-
- Rule	Morocco	2078	only	-	Aug	14	 2:00	0	-
- Rule	Morocco	2079	only	-	Jun	25	 3:00	-1:00	-
-@@ -1064,13 +1079,13 @@ Rule	Morocco	2080	only	-	Jul	21	 2:00	0	-
- Rule	Morocco	2081	only	-	Jun	 1	 3:00	-1:00	-
- Rule	Morocco	2081	only	-	Jul	13	 2:00	0	-
- Rule	Morocco	2082	only	-	May	24	 3:00	-1:00	-
--Rule	Morocco	2082	only	-	Jul	 5	 2:00	0	-
-+Rule	Morocco	2082	only	-	Jun	28	 2:00	0	-
- Rule	Morocco	2083	only	-	May	16	 3:00	-1:00	-
- Rule	Morocco	2083	only	-	Jun	20	 2:00	0	-
- Rule	Morocco	2084	only	-	Apr	30	 3:00	-1:00	-
- Rule	Morocco	2084	only	-	Jun	11	 2:00	0	-
- Rule	Morocco	2085	only	-	Apr	22	 3:00	-1:00	-
--Rule	Morocco	2085	only	-	Jun	 3	 2:00	0	-
-+Rule	Morocco	2085	only	-	May	27	 2:00	0	-
- Rule	Morocco	2086	only	-	Apr	14	 3:00	-1:00	-
- Rule	Morocco	2086	only	-	May	19	 2:00	0	-
- Rule	Morocco	2087	only	-	Mar	30	 3:00	-1:00	-
-@@ -1213,15 +1228,15 @@ Zone	Africa/Windhoek	1:08:24 -	LMT	1892 Feb 8
- # From P Chan (2020-12-03):
- # GMT was adopted as the standard time of Lagos on 1905-07-01.
- # Lagos Weekly Record, 1905-06-24, p 3
--# http://ddsnext.crl.edu/titles/31558#?c=0&m=668&s=0&cv=2&r=0&xywh=1446%2C5221%2C1931%2C1235
-+# http://ddsnext.crl.edu/titles/31558#?c=0&m=668&s=0&cv=2&r=0&xywh=1446,5221,1931,1235
- # says "It is officially notified that on and after the 1st of July 1905
--# Greenwich Mean Solar Time will be adopted thought the Colony and
-+# Greenwich Mean Solar Time will be adopted throughout the Colony and
- # Protectorate, and that it will be necessary to put all clocks 13 minutes and
- # 35 seconds back, recording local mean time."
- #
- # It seemed that Lagos returned to LMT on 1908-07-01.
- # [The Lagos Standard], 1908-07-01, p 5
--# http://ddsnext.crl.edu/titles/31556#?c=0&m=78&s=0&cv=4&r=0&xywh=-92%2C3590%2C3944%2C2523
-+# http://ddsnext.crl.edu/titles/31556#?c=0&m=78&s=0&cv=4&r=0&xywh=-92,3590,3944,2523
- # says "Scarcely have the people become accustomed to this new time, when
- # another official notice has now appeared announcing that from and after the
- # 1st July next, return will be made to local mean time."
-@@ -1233,7 +1248,7 @@ Zone	Africa/Windhoek	1:08:24 -	LMT	1892 Feb 8
- # https://libsysdigi.library.illinois.edu/ilharvest/Africana/Books2011-05/3064634/3064634_1914/3064634_1914_opt.pdf#page=27
- # "On January 1st [1914], a universal standard time for Nigeria was adopted,
- # viz., half an hour fast on Greenwich mean time, corresponding to the meridian
--# 7 [degrees] 30' E. long."
-+# 7° 30' E. long."
- # Lloyd's Register of Shipping (1915) says "Hitherto the time observed in Lagos
- # was the local mean time. On 1st January, 1914, standard time for the whole of
- # Nigeria was introduced ... Lagos time has been advanced about 16 minutes
-@@ -1251,7 +1266,7 @@ Zone	Africa/Windhoek	1:08:24 -	LMT	1892 Feb 8
- # The Lagos Weekly Record, 1919-09-20, p 3 details discussion on the first
- # reading of this Bill by the Legislative Council of the Colony of Nigeria on
- # Thursday 1919-08-28:
--# http://ddsnext.crl.edu/titles/31558?terms&item_id=303484#?m=1118&c=1&s=0&cv=2&r=0&xywh=1261%2C3408%2C2994%2C1915
-+# http://ddsnext.crl.edu/titles/31558?terms&item_id=303484#?m=1118&c=1&s=0&cv=2&r=0&xywh=1261,3408,2994,1915
- # "The proposal is that the Globe should be divided into twelve zones East and
- # West of Greenwich, of one hour each, Nigeria falling into the zone with a
- # standard of one hour fast on Greenwich Mean Time.  Nigeria standard time is
-diff --git a/make/data/tzdata/antarctica b/make/data/tzdata/antarctica
-index 792542b9224..3de5e726eb4 100644
---- a/make/data/tzdata/antarctica
-+++ b/make/data/tzdata/antarctica
-@@ -315,7 +315,7 @@ Zone Antarctica/Rothera	0	-	-00	1976 Dec  1
- # but that he found it more convenient to keep GMT+12
- # as supplies for the station were coming from McMurdo Sound,
- # which was on GMT+12 because New Zealand was on GMT+12 all year
--# at that time (1957).  (Source: Siple's book 90 Degrees South.)
-+# at that time (1957).  (Source: Siple's book 90° South.)
- #
- # From Susan Smith
- # http://www.cybertours.com/whs/pole10.html
-diff --git a/make/data/tzdata/asia b/make/data/tzdata/asia
-index ff81978bc47..6a048c3ad28 100644
---- a/make/data/tzdata/asia
-+++ b/make/data/tzdata/asia
-@@ -2714,6 +2714,40 @@ Zone	Asia/Pyongyang	8:23:00 -	LMT	1908 Apr  1
- 
- 
- # Lebanon
-+#
-+# From Saadallah Itani (2023-03-23):
-+# Lebanon ... announced today delay of Spring forward from March 25 to April 20.
-+#
-+# From Paul Eggert (2023-03-27):
-+# This announcement was by the Lebanese caretaker prime minister Najib Mikati.
-+# https://www.mtv.com.lb/en/News/Local/1352516/lebanon-postpones-daylight-saving-time-adoption
-+# A video was later leaked to the media of parliament speaker Nabih Berri
-+# asking Mikati to postpone DST to aid observance of Ramadan, Mikati objecting
-+# that this would cause problems such as scheduling airline flights, to which
-+# Berri interjected, "What flights?"
-+#
-+# The change was controversial and led to a partly-sectarian divide.
-+# Many Lebanese institutions, including the education ministry, the Maronite
-+# church, and two news channels LCBI and MTV, ignored the announcement and
-+# went ahead with the long-scheduled spring-forward on March 25/26, some
-+# arguing that the prime minister had not followed the law because the change
-+# had not been approved by the cabinet.  Google went with the announcement;
-+# Apple ignored it.  At least one bank followed the announcement for its doors,
-+# but ignored the announcement in internal computer systems.
-+# Beirut international airport listed two times for each departure.
-+# Dan Azzi wrote "My view is that this whole thing is a Dumb and Dumber movie."
-+# Eventually the prime minister backed down, said the cabinet had decided to
-+# stick with its 1998 decision, and that DST would begin midnight March 29/30.
-+# https://www.nna-leb.gov.lb/en/miscellaneous/604093/lebanon-has-two-times-of-day-amid-daylight-savings
-+# https://www.cnbc.com/2023/03/27/lebanon-in-two-different-time-zones-as-government-disagrees-on-daylight-savings.html
-+#
-+# Although we could model the chaos with two Zones, that would likely cause
-+# more trouble than it would cure.  Since so many manual clocks and
-+# computer-based timestamps ignored the announcement, stick with official
-+# cabinet resolutions in the data while recording the prime minister's
-+# announcement as a comment.  This is how we treated a similar situation in
-+# Rio de Janeiro in spring 1993.
-+#
- # Rule	NAME	FROM	TO	-	IN	ON	AT	SAVE	LETTER/S
- Rule	Lebanon	1920	only	-	Mar	28	0:00	1:00	S
- Rule	Lebanon	1920	only	-	Oct	25	0:00	0	-
-@@ -2739,6 +2773,10 @@ Rule	Lebanon	1992	only	-	Oct	4	0:00	0	-
- Rule	Lebanon	1993	max	-	Mar	lastSun	0:00	1:00	S
- Rule	Lebanon	1993	1998	-	Sep	lastSun	0:00	0	-
- Rule	Lebanon	1999	max	-	Oct	lastSun	0:00	0	-
-+# This one-time rule, announced by the prime minister first for April 21
-+# then for March 30, is commented out for reasons described above.
-+#Rule	Lebanon	2023	only	-	Mar	30	0:00	1:00	S
-+
- # Zone	NAME		STDOFF	RULES	FORMAT	[UNTIL]
- Zone	Asia/Beirut	2:22:00 -	LMT	1880
- 			2:00	Lebanon	EE%sT
-@@ -2977,7 +3015,7 @@ Zone	Asia/Kathmandu	5:41:16 -	LMT	1920
- # 9pm and moving clocks forward by one hour for the next three months. ...."
- #
- # http://www.worldtimezone.com/dst_news/dst_news_pakistan01.html
--# http://www.dailytimes.com.pk/default.asp?page=2008%5C05%5C15%5Cstory_15-5-2008_pg1_4
-+# http://www.dailytimes.com.pk/default.asp?page=2008\05\15\story_15-5-2008_pg1_4
- 
- # From Arthur David Olson (2008-05-19):
- # XXX--midnight transitions is a guess; 2008 only is a guess.
-@@ -3300,7 +3338,7 @@ Zone	Asia/Karachi	4:28:12 -	LMT	1907
- # Some of many sources in Arabic:
- # http://www.samanews.com/index.php?act=Show&id=122638
- #
--# http://safa.ps/details/news/74352/%D8%A8%D8%AF%D8%A1-%D8%A7%D9%84%D8%AA%D9%88%D9%82%D9%8A%D8%AA-%D8%A7%D9%84%D8%B5%D9%8A%D9%81%D9%8A-%D8%A8%D8%A7%D9%84%D8%B6%D9%81%D8%A9-%D9%88%D8%BA%D8%B2%D8%A9-%D9%84%D9%8A%D9%84%D8%A9-%D8%A7%D9%84%D8%AC%D9%85%D8%B9%D8%A9.html
-+# http://safa.ps/details/news/74352/بدء-التوقيت-الصيفي-بالضفة-وغزة-ليلة-الجمعة.html
- #
- # Our brief summary:
- # https://www.timeanddate.com/news/time/gaza-west-bank-dst-2012.html
-@@ -3310,7 +3348,7 @@ Zone	Asia/Karachi	4:28:12 -	LMT	1907
- # time from midnight on Friday, March 29, 2013" (translated).
- # [These are in Arabic and are for Gaza and for Ramallah, respectively.]
- # http://www.samanews.com/index.php?act=Show&id=154120
--# http://safa.ps/details/news/99844/%D8%B1%D8%A7%D9%85-%D8%A7%D9%84%D9%84%D9%87-%D8%A8%D8%AF%D8%A1-%D8%A7%D9%84%D8%AA%D9%88%D9%82%D9%8A%D8%AA-%D8%A7%D9%84%D8%B5%D9%8A%D9%81%D9%8A-29-%D8%A7%D9%84%D8%AC%D8%A7%D8%B1%D9%8A.html
-+# http://safa.ps/details/news/99844/رام-الله-بدء-التوقيت-الصيفي-29-الجاري.html
- 
- # From Steffen Thorsen (2013-09-24):
- # The Gaza and West Bank are ending DST Thursday at midnight
-@@ -3408,9 +3446,41 @@ Zone	Asia/Karachi	4:28:12 -	LMT	1907
- # (2022-08-31): ... the Saturday before the last Sunday in March and October
- # at 2:00 AM ,for the years from 2023 to 2026.
- # (2022-09-05): https://mtit.pna.ps/Site/New/1453
--#
--# From Paul Eggert (2022-08-31):
--# For now, assume that this rule will also be used after 2026.
-+
-+# From Heba Hamad (2023-03-22):
-+# ... summer time will begin in Palestine from Saturday 04-29-2023,
-+# 02:00 AM by 60 minutes forward.
-+#
-+# From Paul Eggert (2023-03-22):
-+# For now, guess that spring and fall transitions will normally
-+# continue to use 2022's rules, that during DST Palestine will switch
-+# to standard time at 02:00 the last Saturday before Ramadan and back
-+# to DST at 02:00 the first Saturday after Ramadan, and that
-+# if the normal spring-forward or fall-back transition occurs during
-+# Ramadan the former is delayed and the latter advanced.
-+# To implement this, I predicted Ramadan-oriented transition dates for
-+# 2023 through 2086 by running the following program under GNU Emacs 28.2,
-+# with the results integrated by hand into the table below.
-+# Predictions after 2086 are approximated without Ramadan.
-+#
-+# (let ((islamic-year 1444))
-+#   (require 'cal-islam)
-+#   (while (< islamic-year 1510)
-+#     (let ((a (calendar-islamic-to-absolute (list 9 1 islamic-year)))
-+#           (b (+ 1 (calendar-islamic-to-absolute (list 10 1 islamic-year))))
-+#           (saturday 6))
-+#       (while (/= saturday (mod (setq a (1- a)) 7)))
-+#       (while (/= saturday (mod b 7))
-+#         (setq b (1+ b)))
-+#       (setq a (calendar-gregorian-from-absolute a))
-+#       (setq b (calendar-gregorian-from-absolute b))
-+#       (insert
-+#        (format
-+#         (concat "Rule Palestine\t%d\tonly\t-\t%s\t%2d\t2:00\t0\t-\n"
-+#                 "Rule Palestine\t%d\tonly\t-\t%s\t%2d\t2:00\t1:00\tS\n")
-+#         (car (cdr (cdr a))) (calendar-month-name (car a) t) (car (cdr a))
-+#         (car (cdr (cdr b))) (calendar-month-name (car b) t) (car (cdr b)))))
-+#     (setq islamic-year (+ 1 islamic-year))))
- 
- # Rule	NAME	FROM	TO	-	IN	ON	AT	SAVE	LETTER/S
- Rule EgyptAsia	1957	only	-	May	10	0:00	1:00	S
-@@ -3450,8 +3520,86 @@ Rule Palestine	2020	2021	-	Mar	Sat<=30	0:00	1:00	S
- Rule Palestine	2020	only	-	Oct	24	1:00	0	-
- Rule Palestine	2021	only	-	Oct	29	1:00	0	-
- Rule Palestine	2022	only	-	Mar	27	0:00	1:00	S
--Rule Palestine	2022	max	-	Oct	Sat<=30	2:00	0	-
--Rule Palestine	2023	max	-	Mar	Sat<=30	2:00	1:00	S
-+Rule Palestine	2022	2035	-	Oct	Sat<=30	2:00	0	-
-+Rule Palestine	2023	only	-	Apr	29	2:00	1:00	S
-+Rule Palestine	2024	only	-	Apr	13	2:00	1:00	S
-+Rule Palestine	2025	only	-	Apr	 5	2:00	1:00	S
-+Rule Palestine	2026	2054	-	Mar	Sat<=30	2:00	1:00	S
-+Rule Palestine	2036	only	-	Oct	18	2:00	0	-
-+Rule Palestine	2037	only	-	Oct	10	2:00	0	-
-+Rule Palestine	2038	only	-	Sep	25	2:00	0	-
-+Rule Palestine	2039	only	-	Sep	17	2:00	0	-
-+Rule Palestine	2039	only	-	Oct	22	2:00	1:00	S
-+Rule Palestine	2039	2067	-	Oct	Sat<=30	2:00	0	-
-+Rule Palestine	2040	only	-	Sep	 1	2:00	0	-
-+Rule Palestine	2040	only	-	Oct	13	2:00	1:00	S
-+Rule Palestine	2041	only	-	Aug	24	2:00	0	-
-+Rule Palestine	2041	only	-	Sep	28	2:00	1:00	S
-+Rule Palestine	2042	only	-	Aug	16	2:00	0	-
-+Rule Palestine	2042	only	-	Sep	20	2:00	1:00	S
-+Rule Palestine	2043	only	-	Aug	 1	2:00	0	-
-+Rule Palestine	2043	only	-	Sep	12	2:00	1:00	S
-+Rule Palestine	2044	only	-	Jul	23	2:00	0	-
-+Rule Palestine	2044	only	-	Aug	27	2:00	1:00	S
-+Rule Palestine	2045	only	-	Jul	15	2:00	0	-
-+Rule Palestine	2045	only	-	Aug	19	2:00	1:00	S
-+Rule Palestine	2046	only	-	Jun	30	2:00	0	-
-+Rule Palestine	2046	only	-	Aug	11	2:00	1:00	S
-+Rule Palestine	2047	only	-	Jun	22	2:00	0	-
-+Rule Palestine	2047	only	-	Jul	27	2:00	1:00	S
-+Rule Palestine	2048	only	-	Jun	 6	2:00	0	-
-+Rule Palestine	2048	only	-	Jul	18	2:00	1:00	S
-+Rule Palestine	2049	only	-	May	29	2:00	0	-
-+Rule Palestine	2049	only	-	Jul	 3	2:00	1:00	S
-+Rule Palestine	2050	only	-	May	21	2:00	0	-
-+Rule Palestine	2050	only	-	Jun	25	2:00	1:00	S
-+Rule Palestine	2051	only	-	May	 6	2:00	0	-
-+Rule Palestine	2051	only	-	Jun	17	2:00	1:00	S
-+Rule Palestine	2052	only	-	Apr	27	2:00	0	-
-+Rule Palestine	2052	only	-	Jun	 1	2:00	1:00	S
-+Rule Palestine	2053	only	-	Apr	12	2:00	0	-
-+Rule Palestine	2053	only	-	May	24	2:00	1:00	S
-+Rule Palestine	2054	only	-	Apr	 4	2:00	0	-
-+Rule Palestine	2054	only	-	May	16	2:00	1:00	S
-+Rule Palestine	2055	only	-	May	 1	2:00	1:00	S
-+Rule Palestine	2056	only	-	Apr	22	2:00	1:00	S
-+Rule Palestine	2057	only	-	Apr	 7	2:00	1:00	S
-+Rule Palestine	2058	max	-	Mar	Sat<=30	2:00	1:00	S
-+Rule Palestine	2068	only	-	Oct	20	2:00	0	-
-+Rule Palestine	2069	only	-	Oct	12	2:00	0	-
-+Rule Palestine	2070	only	-	Oct	 4	2:00	0	-
-+Rule Palestine	2071	only	-	Sep	19	2:00	0	-
-+Rule Palestine	2072	only	-	Sep	10	2:00	0	-
-+Rule Palestine	2072	only	-	Oct	15	2:00	1:00	S
-+Rule Palestine	2073	only	-	Sep	 2	2:00	0	-
-+Rule Palestine	2073	only	-	Oct	 7	2:00	1:00	S
-+Rule Palestine	2074	only	-	Aug	18	2:00	0	-
-+Rule Palestine	2074	only	-	Sep	29	2:00	1:00	S
-+Rule Palestine	2075	only	-	Aug	10	2:00	0	-
-+Rule Palestine	2075	only	-	Sep	14	2:00	1:00	S
-+Rule Palestine	2075	max	-	Oct	Sat<=30	2:00	0	-
-+Rule Palestine	2076	only	-	Jul	25	2:00	0	-
-+Rule Palestine	2076	only	-	Sep	 5	2:00	1:00	S
-+Rule Palestine	2077	only	-	Jul	17	2:00	0	-
-+Rule Palestine	2077	only	-	Aug	28	2:00	1:00	S
-+Rule Palestine	2078	only	-	Jul	 9	2:00	0	-
-+Rule Palestine	2078	only	-	Aug	13	2:00	1:00	S
-+Rule Palestine	2079	only	-	Jun	24	2:00	0	-
-+Rule Palestine	2079	only	-	Aug	 5	2:00	1:00	S
-+Rule Palestine	2080	only	-	Jun	15	2:00	0	-
-+Rule Palestine	2080	only	-	Jul	20	2:00	1:00	S
-+Rule Palestine	2081	only	-	Jun	 7	2:00	0	-
-+Rule Palestine	2081	only	-	Jul	12	2:00	1:00	S
-+Rule Palestine	2082	only	-	May	23	2:00	0	-
-+Rule Palestine	2082	only	-	Jul	 4	2:00	1:00	S
-+Rule Palestine	2083	only	-	May	15	2:00	0	-
-+Rule Palestine	2083	only	-	Jun	19	2:00	1:00	S
-+Rule Palestine	2084	only	-	Apr	29	2:00	0	-
-+Rule Palestine	2084	only	-	Jun	10	2:00	1:00	S
-+Rule Palestine	2085	only	-	Apr	21	2:00	0	-
-+Rule Palestine	2085	only	-	Jun	 2	2:00	1:00	S
-+Rule Palestine	2086	only	-	Apr	13	2:00	0	-
-+Rule Palestine	2086	only	-	May	18	2:00	1:00	S
- 
- # Zone	NAME		STDOFF	RULES	FORMAT	[UNTIL]
- Zone	Asia/Gaza	2:17:52	-	LMT	1900 Oct
-@@ -3655,7 +3803,7 @@ Zone	Asia/Singapore	6:55:25 -	LMT	1901 Jan  1
- # standard time is SLST.
- #
- # From Paul Eggert (2016-10-18):
--# "SLST" seems to be reasonably recent and rarely-used outside time
-+# "SLST" seems to be reasonably recent and rarely used outside time
- # zone nerd sources.  I searched Google News and found three uses of
- # it in the International Business Times of India in February and
- # March of this year when discussing cricket match times, but nothing
-diff --git a/make/data/tzdata/australasia b/make/data/tzdata/australasia
-index fbe3b8a6d72..893d7055eab 100644
---- a/make/data/tzdata/australasia
-+++ b/make/data/tzdata/australasia
-@@ -346,7 +346,7 @@ Zone Antarctica/Macquarie 0	-	-00	1899 Nov
- 
- # From Steffen Thorsen (2013-01-10):
- # Fiji will end DST on 2014-01-19 02:00:
--# http://www.fiji.gov.fj/Media-Center/Press-Releases/DAYLIGHT-SAVINGS-TO-END-THIS-MONTH-%281%29.aspx
-+# http://www.fiji.gov.fj/Media-Center/Press-Releases/DAYLIGHT-SAVINGS-TO-END-THIS-MONTH-(1).aspx
- 
- # From Ken Rylander (2014-10-20):
- # DST will start Nov. 2 this year.
-@@ -746,7 +746,7 @@ Zone Pacific/Pago_Pago	 12:37:12 -	LMT	1892 Jul  5
- #
- # Samoa's Daylight Saving Time Act 2009 is available here, but does not
- # contain any dates:
--# http://www.parliament.gov.ws/documents/acts/Daylight%20Saving%20Act%20%202009%20%28English%29%20-%20Final%207-7-091.pdf
-+# http://www.parliament.gov.ws/documents/acts/Daylight%20Saving%20Act%20%202009%20(English)%20-%20Final%207-7-091.pdf
- 
- # From Laupue Raymond Hughes (2010-10-07):
- # Please see
-@@ -1831,7 +1831,7 @@ Zone	Pacific/Efate	11:13:16 -	LMT	1912 Jan 13 # Vila
- # period.  It would probably be reasonable to assume Guam use GMT+9 during
- # that period of time like the surrounding area.
- 
--# From Paul Eggert (2018-11-18):
-+# From Paul Eggert (2023-01-23):
- # Howse writes (p 153) "The Spaniards, on the other hand, reached the
- # Philippines and the Ladrones from America," and implies that the Ladrones
- # (now called the Marianas) kept American date for quite some time.
-@@ -1844,7 +1844,7 @@ Zone	Pacific/Efate	11:13:16 -	LMT	1912 Jan 13 # Vila
- # they did as that avoids the need for a separate zone due to our 1970 cutoff.
- #
- # US Public Law 106-564 (2000-12-23) made UT +10 the official standard time,
--# under the name "Chamorro Standard Time".  There is no official abbreviation,
-+# under the name "Chamorro standard time".  There is no official abbreviation,
- # but Congressman Robert A. Underwood, author of the bill that became law,
- # wrote in a press release (2000-12-27) that he will seek the use of "ChST".
- 
-@@ -2222,24 +2222,18 @@ Zone	Pacific/Efate	11:13:16 -	LMT	1912 Jan 13 # Vila
- # an international standard, there are some places on the high seas where the
- # correct date is ambiguous.
- 
--# From Wikipedia  (2005-08-31):
--# Before 1920, all ships kept local apparent time on the high seas by setting
--# their clocks at night or at the morning sight so that, given the ship's
--# speed and direction, it would be 12 o'clock when the Sun crossed the ship's
--# meridian (12 o'clock = local apparent noon).  During 1917, at the
--# Anglo-French Conference on Time-keeping at Sea, it was recommended that all
--# ships, both military and civilian, should adopt hourly standard time zones
--# on the high seas.  Whenever a ship was within the territorial waters of any
--# nation it would use that nation's standard time.  The captain was permitted
--# to change his ship's clocks at a time of his choice following his ship's
--# entry into another zone time - he often chose midnight.  These zones were
--# adopted by all major fleets between 1920 and 1925 but not by many
--# independent merchant ships until World War II.
--
--# From Paul Eggert, using references suggested by Oscar van Vlijmen
--# (2005-03-20):
--#
--# The American Practical Navigator (2002)
--# http://pollux.nss.nima.mil/pubs/pubs_j_apn_sections.html?rid=187
--# talks only about the 180-degree meridian with respect to ships in
--# international waters; it ignores the international date line.
-+# From Wikipedia  (2023-01-23):
-+# The nautical time zone system is analogous to the terrestrial time zone
-+# system for use on high seas.  Under the system time changes are required for
-+# changes of longitude in one-hour steps.  The one-hour step corresponds to a
-+# time zone width of 15° longitude.  The 15° gore that is offset from GMT or
-+# UT1 (not UTC) by twelve hours is bisected by the nautical date line into two
-+# 7°30' gores that differ from GMT by ±12 hours.  A nautical date line is
-+# implied but not explicitly drawn on time zone maps.  It follows the 180th
-+# meridian except where it is interrupted by territorial waters adjacent to
-+# land, forming gaps: it is a pole-to-pole dashed line.
-+
-+# From Paul Eggert (2023-01-23):
-+# The American Practical Navigator ,
-+# 2019 edition, merely says that the International Date Line
-+# "coincides with the 180th meridian over most of its length."
-diff --git a/make/data/tzdata/backward b/make/data/tzdata/backward
-index fa44f655009..c0746d6dd1b 100644
---- a/make/data/tzdata/backward
-+++ b/make/data/tzdata/backward
-@@ -297,6 +297,7 @@ Link	America/Argentina/Cordoba	America/Rosario
- Link	America/Tijuana		America/Santa_Isabel
- Link	America/Denver		America/Shiprock
- Link	America/Toronto		America/Thunder_Bay
-+Link	America/Edmonton	America/Yellowknife
- Link	Pacific/Auckland	Antarctica/South_Pole
- Link	Asia/Shanghai		Asia/Chongqing
- Link	Asia/Shanghai		Asia/Harbin
-diff --git a/make/data/tzdata/europe b/make/data/tzdata/europe
-index acc5da3ec79..446d2e1e658 100644
---- a/make/data/tzdata/europe
-+++ b/make/data/tzdata/europe
-@@ -540,9 +540,7 @@ Zone	Europe/London	-0:01:15 -	LMT	1847 Dec  1
- # other form with a traditional approximation for Irish timestamps
- # after 1971-10-31 02:00 UTC; although this approximation has tm_isdst
- # flags that are reversed, its UTC offsets are correct and this often
--# suffices.  This source file currently uses only nonnegative SAVE
--# values, but this is intended to change and downstream code should
--# not rely on it.
-+# suffices....
- #
- # The following is like GB-Eire and EU, except with standard time in
- # summer and negative daylight saving time in winter.  It is for when
-@@ -1136,19 +1134,18 @@ Zone Atlantic/Faroe	-0:27:04 -	LMT	1908 Jan 11 # Tórshavn
- #
- # From Jürgen Appel (2022-11-25):
- # https://ina.gl/samlinger/oversigt-over-samlinger/samling/dagsordener/dagsorden.aspx?lang=da&day=24-11-2022
--# If I understand this correctly, from the next planned switch to
--# summer time, Greenland will permanently stay at that time, i.e. no
--# switch back to winter time in 2023 will occur.
--#
--# From Paul Eggert (2022-11-28):
--# The official document in Danish
--# https://naalakkersuisut.gl/-/media/naalakkersuisut/filer/kundgoerelser/2022/11/2511/31_da_inatsisartutlov-om-tidens-bestemmelse.pdf?la=da&hash=A33597D8A38CC7038465241119EF34F3
--# says standard time for Greenland is -02, that Naalakkersuisut can lay down
--# rules for DST and can require some areas to use a different time zone,
--# and that this all takes effect 2023-03-25 22:00.  The abovementioned
--# "bekymringer" URL says the intent is no transition March 25, that
--# Greenland will not go back to winter time in fall 2023, and that
--# only America/Nuuk is affected (though further changes may occur).
-+#
-+# From Thomas M. Steenholdt (2022-12-02):
-+# - The bill to move America/Nuuk from UTC-03 to UTC-02 passed.
-+# - The bill to stop observing DST did not (Greenland will stop observing DST
-+#   when EU does).
-+# Details on the implementation are here (section 6):
-+# https://ina.gl/dvd/EM%202022/pdf/media/2553529/pkt17_em2022_tidens_bestemmelse_bem_da.pdf
-+# This is how the change will be implemented:
-+# 1. The shift *to* DST in 2023 happens as normal.
-+# 2. The shift *from* DST in 2023 happens as normal, but coincides with the
-+#    shift to UTC-02 normaltime (people will not change their clocks here).
-+# 3. After this, DST is still observed, but as -02/-01 instead of -03/-02.
- 
- # Rule	NAME	FROM	TO	-	IN	ON	AT	SAVE	LETTER/S
- Rule	Thule	1991	1992	-	Mar	lastSun	2:00	1:00	D
-@@ -1172,8 +1169,8 @@ Zone America/Scoresbysund -1:27:52 -	LMT	1916 Jul 28 # Ittoqqortoormiit
- 			-1:00	EU	-01/+00
- Zone America/Nuuk	-3:26:56 -	LMT	1916 Jul 28 # Godthåb
- 			-3:00	-	-03	1980 Apr  6  2:00
--			-3:00	EU	-03/-02	2023 Mar 25 22:00
--			-2:00	-	-02
-+			-3:00	EU	-03/-02	2023 Oct 29  1:00u
-+			-2:00	EU	-02/-01
- Zone America/Thule	-4:35:08 -	LMT	1916 Jul 28 # Pituffik
- 			-4:00	Thule	A%sT
- 
-@@ -1509,9 +1506,9 @@ Zone	Europe/Paris	0:09:21 -	LMT	1891 Mar 16
- Rule	Germany	1946	only	-	Apr	14	2:00s	1:00	S
- Rule	Germany	1946	only	-	Oct	 7	2:00s	0	-
- Rule	Germany	1947	1949	-	Oct	Sun>=1	2:00s	0	-
--# http://www.ptb.de/de/org/4/44/441/salt.htm says the following transition
--# occurred at 3:00 MEZ, not the 2:00 MEZ given in Shanks & Pottenger.
--# Go with the PTB.
-+# https://www.ptb.de/cms/en/ptb/fachabteilungen/abt4/fb-44/ag-441/realisation-of-legal-time-in-germany/dst-and-midsummer-dst-in-germany-until-1979.html
-+# says the following transition occurred at 3:00 MEZ, not the 2:00 MEZ
-+# given in Shanks & Pottenger. Go with the PTB.
- Rule	Germany	1947	only	-	Apr	 6	3:00s	1:00	S
- Rule	Germany	1947	only	-	May	11	2:00s	2:00	M
- Rule	Germany	1947	only	-	Jun	29	3:00	1:00	S
-@@ -2272,7 +2269,7 @@ Zone Europe/Bucharest	1:44:24 -	LMT	1891 Oct
- # the State Duma has approved ... the draft bill on returning to
- # winter time standard and return Russia 11 time zones.  The new
- # regulations will come into effect on October 26, 2014 at 02:00 ...
--# http://asozd2.duma.gov.ru/main.nsf/%28Spravka%29?OpenAgent&RN=431985-6&02
-+# http://asozd2.duma.gov.ru/main.nsf/(Spravka)?OpenAgent&RN=431985-6&02
- # Here is a link where we put together table (based on approved Bill N
- # 431985-6) with proposed 11 Russian time zones and corresponding
- # areas/cities/administrative centers in the Russian Federation (in English):
-@@ -2682,13 +2679,13 @@ Zone Europe/Volgograd	 2:57:40 -	LMT	1920 Jan  3
- 			 3:00	-	+03	1930 Jun 21
- 			 4:00	-	+04	1961 Nov 11
- 			 4:00	Russia	+04/+05	1988 Mar 27  2:00s
--			 3:00	Russia	+03/+04	1991 Mar 31  2:00s
-+			 3:00	Russia	MSK/MSD	1991 Mar 31  2:00s
- 			 4:00	-	+04	1992 Mar 29  2:00s
--			 3:00	Russia	+03/+04	2011 Mar 27  2:00s
--			 4:00	-	+04	2014 Oct 26  2:00s
--			 3:00	-	+03	2018 Oct 28  2:00s
-+			 3:00	Russia	MSK/MSD	2011 Mar 27  2:00s
-+			 4:00	-	MSK	2014 Oct 26  2:00s
-+			 3:00	-	MSK	2018 Oct 28  2:00s
- 			 4:00	-	+04	2020 Dec 27  2:00s
--			 3:00	-	+03
-+			 3:00	-	MSK
- 
- # From Paul Eggert (2016-11-11):
- # Europe/Saratov covers:
-@@ -2719,11 +2716,11 @@ Zone Europe/Saratov	 3:04:18 -	LMT	1919 Jul  1  0:00u
- Zone Europe/Kirov	 3:18:48 -	LMT	1919 Jul  1  0:00u
- 			 3:00	-	+03	1930 Jun 21
- 			 4:00	Russia	+04/+05	1989 Mar 26  2:00s
--			 3:00	Russia	+03/+04	1991 Mar 31  2:00s
-+			 3:00	Russia	MSK/MSD	1991 Mar 31  2:00s
- 			 4:00	-	+04	1992 Mar 29  2:00s
--			 3:00	Russia	+03/+04	2011 Mar 27  2:00s
--			 4:00	-	+04	2014 Oct 26  2:00s
--			 3:00	-	+03
-+			 3:00	Russia	MSK/MSD	2011 Mar 27  2:00s
-+			 4:00	-	MSK	2014 Oct 26  2:00s
-+			 3:00	-	MSK
- 
- # From Tim Parenti (2014-07-03), per Oscar van Vlijmen (2001-08-25):
- # Europe/Samara covers...
-diff --git a/make/data/tzdata/iso3166.tab b/make/data/tzdata/iso3166.tab
-index fbfb74bec45..cea17732dd1 100644
---- a/make/data/tzdata/iso3166.tab
-+++ b/make/data/tzdata/iso3166.tab
-@@ -261,7 +261,7 @@ SY	Syria
- SZ	Eswatini (Swaziland)
- TC	Turks & Caicos Is
- TD	Chad
--TF	French Southern Territories
-+TF	French S. Terr.
- TG	Togo
- TH	Thailand
- TJ	Tajikistan
-diff --git a/make/data/tzdata/leapseconds b/make/data/tzdata/leapseconds
-index d6fb840f512..89ce8b89cd2 100644
---- a/make/data/tzdata/leapseconds
-+++ b/make/data/tzdata/leapseconds
-@@ -95,11 +95,11 @@ Leap	2016	Dec	31	23:59:60	+	S
- # Any additional leap seconds will come after this.
- # This Expires line is commented out for now,
- # so that pre-2020a zic implementations do not reject this file.
--#Expires 2023	Jun	28	00:00:00
-+#Expires 2023	Dec	28	00:00:00
- 
- # POSIX timestamps for the data in this file:
- #updated 1467936000 (2016-07-08 00:00:00 UTC)
--#expires 1687910400 (2023-06-28 00:00:00 UTC)
-+#expires 1703721600 (2023-12-28 00:00:00 UTC)
- 
--#	Updated through IERS Bulletin C64
--#	File expires on:  28 June 2023
-+#	Updated through IERS Bulletin C65
-+#	File expires on:  28 December 2023
-diff --git a/make/data/tzdata/northamerica b/make/data/tzdata/northamerica
-index a5fd701f88c..e240cf35103 100644
---- a/make/data/tzdata/northamerica
-+++ b/make/data/tzdata/northamerica
-@@ -1,4 +1,3 @@
--#
- # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
- #
- # This code is free software; you can redistribute it and/or modify it
-@@ -299,9 +298,10 @@ Zone	PST8PDT		 -8:00	US	P%sT
- #  -10	Standard Alaska Time (AST)	Alaska-Hawaii standard time (AHST)
- #  -11	(unofficial) Nome (NST)		Bering standard time (BST)
- #
--# From Paul Eggert (2000-01-08), following a heads-up from Rives McDow:
--# Public law 106-564 (2000-12-23) introduced ... "Chamorro Standard Time"
-+# From Paul Eggert (2023-01-23), from a 2001-01-08 heads-up from Rives McDow:
-+# Public law 106-564 (2000-12-23) introduced "Chamorro standard time"
- # for time in Guam and the Northern Marianas.  See the file "australasia".
-+# Also see 15 U.S.C. §263 .
- #
- # From Paul Eggert (2015-04-17):
- # HST and HDT are standardized abbreviations for Hawaii-Aleutian
-@@ -618,7 +618,7 @@ Zone America/Los_Angeles -7:52:58 -	LMT	1883 Nov 18 20:00u
- # local times of other Alaskan locations so that they change simultaneously.
- 
- # From Paul Eggert (2014-07-18):
--# One opinion of the early-1980s turmoil in Alaska over time zones and
-+# One opinion of the early 1980s turmoil in Alaska over time zones and
- # daylight saving time appeared as graffiti on a Juneau airport wall:
- # "Welcome to Juneau.  Please turn your watch back to the 19th century."
- # See: Turner W. Alaska's four time zones now two. NY Times 1983-11-01.
-@@ -690,6 +690,10 @@ Zone America/Los_Angeles -7:52:58 -	LMT	1883 Nov 18 20:00u
- # So they won't be waiting for Alaska to join them on 2019-03-10, but will
- # rather change their clocks twice in seven weeks.
- 
-+# From Paul Eggert (2023-01-23):
-+# America/Adak is for the Aleutian Islands that are part of Alaska
-+# and are west of 169.5° W.
-+
- # Zone	NAME		STDOFF	RULES	FORMAT	[UNTIL]
- Zone America/Juneau	 15:02:19 -	LMT	1867 Oct 19 15:33:32
- 			 -8:57:41 -	LMT	1900 Aug 20 12:00
-@@ -2148,10 +2152,6 @@ Zone America/Fort_Nelson	-8:10:47 -	LMT	1884
- # Nunavut ... moved ... to incorporate the whole territory into one time zone.
- # Nunavut moves to single time zone Oct. 31
- # http://www.nunatsiaq.com/nunavut/nvt90903_13.html
--#
--# From Antoine Leca (1999-09-06):
--# We then need to create a new timezone for the Kitikmeot region of Nunavut
--# to differentiate it from the Yellowknife region.
- 
- # From Paul Eggert (1999-09-20):
- # Basic Facts: The New Territory
-@@ -2345,9 +2345,6 @@ Zone America/Cambridge_Bay 0	-	-00	1920 # trading post est.?
- 			-5:00	-	EST	2000 Nov  5  0:00
- 			-6:00	-	CST	2001 Apr  1  3:00
- 			-7:00	Canada	M%sT
--Zone America/Yellowknife 0	-	-00	1935 # Yellowknife founded?
--			-7:00	NT_YK	M%sT	1980
--			-7:00	Canada	M%sT
- Zone America/Inuvik	0	-	-00	1953 # Inuvik founded
- 			-8:00	NT_YK	P%sT	1979 Apr lastSun  2:00
- 			-7:00	NT_YK	M%sT	1980
-@@ -2584,7 +2581,7 @@ Zone America/Dawson	-9:17:40 -	LMT	1900 Aug 20
- # and in addition changes all of Chihuahua to -06 with no DST.
- 
- # From Heitor David Pinto (2022-11-28):
--# Now the northern municipalities want to have the same time zone as the
-+# Now the northern [municipios] want to have the same time zone as the
- # respective neighboring cities in the US, for example Juárez in UTC-7 with
- # DST, matching El Paso, and Ojinaga in UTC-6 with DST, matching Presidio....
- # the president authorized the publication of the decree for November 29,
-@@ -2621,7 +2618,7 @@ Zone America/Merida	-5:58:28 -	LMT	1922 Jan  1  6:00u
- 			-5:00	-	EST	1982 Dec  2
- 			-6:00	Mexico	C%sT
- # Coahuila, Nuevo León, Tamaulipas (near US border)
--# This includes the following municipalities:
-+# This includes the following municipios:
- #   in Coahuila: Acuña, Allende, Guerrero, Hidalgo, Jiménez, Morelos, Nava,
- #     Ocampo, Piedras Negras, Villa Unión, Zaragoza
- #   in Nuevo León: Anáhuac
-@@ -2647,8 +2644,8 @@ Zone America/Mexico_City -6:36:36 -	LMT	1922 Jan  1  7:00u
- 			-6:00	-	CST	2002 Feb 20
- 			-6:00	Mexico	C%sT
- # Chihuahua (near US border - western side)
--# This includes the municipalities of Janos, Ascensión, Juárez, Guadalupe,
--# and Práxedis G Guerrero.
-+# This includes the municipios of Janos, Ascensión, Juárez, Guadalupe, and
-+# Práxedis G Guerrero.
- # http://gaceta.diputados.gob.mx/PDF/65/2a022/nov/20221124-VII.pdf
- Zone America/Ciudad_Juarez -7:05:56 -	LMT	1922 Jan  1  7:00u
- 			-7:00	-	MST	1927 Jun 10 23:00
-@@ -2662,7 +2659,8 @@ Zone America/Ciudad_Juarez -7:05:56 -	LMT	1922 Jan  1  7:00u
- 			-6:00	-	CST	2022 Nov 30  0:00
- 			-7:00	US	M%sT
- # Chihuahua (near US border - eastern side)
--# The municipalities of Coyame del Sotol, Ojinaga, and Manuel Benavides.
-+# This includes the municipios of Coyame del Sotol, Ojinaga, and Manuel
-+# Benavides.
- # http://gaceta.diputados.gob.mx/PDF/65/2a022/nov/20221124-VII.pdf
- Zone America/Ojinaga	-6:57:40 -	LMT	1922 Jan  1  7:00u
- 			-7:00	-	MST	1927 Jun 10 23:00
-@@ -3083,7 +3081,7 @@ Zone America/Costa_Rica	-5:36:13 -	LMT	1890        # San José
- #
- # He supplied these references:
- #
--# http://www.prensalatina.com.mx/article.asp?ID=%7B4CC32C1B-A9F7-42FB-8A07-8631AFC923AF%7D&language=ES
-+# http://www.prensalatina.com.mx/article.asp?ID={4CC32C1B-A9F7-42FB-8A07-8631AFC923AF}&language=ES
- # http://actualidad.terra.es/sociedad/articulo/cuba_llama_ahorrar_energia_cambio_1957044.htm
- #
- # From Alex Krivenyshev (2007-10-25):
-diff --git a/make/data/tzdata/southamerica b/make/data/tzdata/southamerica
-index 81fdd793df4..4024e7180cd 100644
---- a/make/data/tzdata/southamerica
-+++ b/make/data/tzdata/southamerica
-@@ -231,7 +231,7 @@ Rule	Arg	2008	only	-	Oct	Sun>=15	0:00	1:00	-
- # Hora de verano para la República Argentina
- # http://buenasiembra.com.ar/esoterismo/astrologia/hora-de-verano-de-la-republica-argentina-27.html
- # says that standard time in Argentina from 1894-10-31
--# to 1920-05-01 was -4:16:48.25.  Go with this more-precise value
-+# to 1920-05-01 was -4:16:48.25.  Go with this more precise value
- # over Shanks & Pottenger.  It is upward compatible with Milne, who
- # says Córdoba time was -4:16:48.2.
- 
-diff --git a/make/data/tzdata/zone.tab b/make/data/tzdata/zone.tab
-index 939432d3456..3edb0d61c80 100644
---- a/make/data/tzdata/zone.tab
-+++ b/make/data/tzdata/zone.tab
-@@ -144,9 +144,8 @@ CA	+744144-0944945	America/Resolute	Central - NU (Resolute)
- CA	+624900-0920459	America/Rankin_Inlet	Central - NU (central)
- CA	+5024-10439	America/Regina	CST - SK (most areas)
- CA	+5017-10750	America/Swift_Current	CST - SK (midwest)
--CA	+5333-11328	America/Edmonton	Mountain - AB; BC (E); SK (W)
-+CA	+5333-11328	America/Edmonton	Mountain - AB; BC (E); NT (E); SK (W)
- CA	+690650-1050310	America/Cambridge_Bay	Mountain - NU (west)
--CA	+6227-11421	America/Yellowknife	Mountain - NT (central)
- CA	+682059-1334300	America/Inuvik	Mountain - NT (west)
- CA	+4906-11631	America/Creston	MST - BC (Creston)
- CA	+5546-12014	America/Dawson_Creek	MST - BC (Dawson Cr, Ft St John)
-@@ -162,7 +161,7 @@ CG	-0416+01517	Africa/Brazzaville
- CH	+4723+00832	Europe/Zurich
- CI	+0519-00402	Africa/Abidjan
- CK	-2114-15946	Pacific/Rarotonga
--CL	-3327-07040	America/Santiago	Chile (most areas)
-+CL	-3327-07040	America/Santiago	most of Chile
- CL	-5309-07055	America/Punta_Arenas	Region of Magallanes
- CL	-2709-10926	Pacific/Easter	Easter Island
- CM	+0403+00942	Africa/Douala
-@@ -174,10 +173,10 @@ CU	+2308-08222	America/Havana
- CV	+1455-02331	Atlantic/Cape_Verde
- CW	+1211-06900	America/Curacao
- CX	-1025+10543	Indian/Christmas
--CY	+3510+03322	Asia/Nicosia	Cyprus (most areas)
-+CY	+3510+03322	Asia/Nicosia	most of Cyprus
- CY	+3507+03357	Asia/Famagusta	Northern Cyprus
- CZ	+5005+01426	Europe/Prague
--DE	+5230+01322	Europe/Berlin	Germany (most areas)
-+DE	+5230+01322	Europe/Berlin	most of Germany
- DE	+4742+00841	Europe/Busingen	Busingen
- DJ	+1136+04309	Africa/Djibouti
- DK	+5540+01235	Europe/Copenhagen
-@@ -210,7 +209,7 @@ GF	+0456-05220	America/Cayenne
- GG	+492717-0023210	Europe/Guernsey
- GH	+0533-00013	Africa/Accra
- GI	+3608-00521	Europe/Gibraltar
--GL	+6411-05144	America/Nuuk	Greenland (most areas)
-+GL	+6411-05144	America/Nuuk	most of Greenland
- GL	+7646-01840	America/Danmarkshavn	National Park (east coast)
- GL	+7029-02158	America/Scoresbysund	Scoresbysund/Ittoqqortoormiit
- GL	+7634-06847	America/Thule	Thule/Pituffik
-@@ -258,7 +257,7 @@ KP	+3901+12545	Asia/Pyongyang
- KR	+3733+12658	Asia/Seoul
- KW	+2920+04759	Asia/Kuwait
- KY	+1918-08123	America/Cayman
--KZ	+4315+07657	Asia/Almaty	Kazakhstan (most areas)
-+KZ	+4315+07657	Asia/Almaty	most of Kazakhstan
- KZ	+4448+06528	Asia/Qyzylorda	Qyzylorda/Kyzylorda/Kzyl-Orda
- KZ	+5312+06337	Asia/Qostanay	Qostanay/Kostanay/Kustanay
- KZ	+5017+05710	Asia/Aqtobe	Aqtobe/Aktobe
-@@ -282,12 +281,12 @@ MD	+4700+02850	Europe/Chisinau
- ME	+4226+01916	Europe/Podgorica
- MF	+1804-06305	America/Marigot
- MG	-1855+04731	Indian/Antananarivo
--MH	+0709+17112	Pacific/Majuro	Marshall Islands (most areas)
-+MH	+0709+17112	Pacific/Majuro	most of Marshall Islands
- MH	+0905+16720	Pacific/Kwajalein	Kwajalein
- MK	+4159+02126	Europe/Skopje
- ML	+1239-00800	Africa/Bamako
- MM	+1647+09610	Asia/Yangon
--MN	+4755+10653	Asia/Ulaanbaatar	Mongolia (most areas)
-+MN	+4755+10653	Asia/Ulaanbaatar	most of Mongolia
- MN	+4801+09139	Asia/Hovd	Bayan-Olgiy, Govi-Altai, Hovd, Uvs, Zavkhan
- MN	+4804+11430	Asia/Choibalsan	Dornod, Sukhbaatar
- MO	+221150+1133230	Asia/Macau
-@@ -325,7 +324,7 @@ NO	+5955+01045	Europe/Oslo
- NP	+2743+08519	Asia/Kathmandu
- NR	-0031+16655	Pacific/Nauru
- NU	-1901-16955	Pacific/Niue
--NZ	-3652+17446	Pacific/Auckland	New Zealand (most areas)
-+NZ	-3652+17446	Pacific/Auckland	most of New Zealand
- NZ	-4357-17633	Pacific/Chatham	Chatham Islands
- OM	+2336+05835	Asia/Muscat
- PA	+0858-07932	America/Panama
-@@ -333,7 +332,7 @@ PE	-1203-07703	America/Lima
- PF	-1732-14934	Pacific/Tahiti	Society Islands
- PF	-0900-13930	Pacific/Marquesas	Marquesas Islands
- PF	-2308-13457	Pacific/Gambier	Gambier Islands
--PG	-0930+14710	Pacific/Port_Moresby	Papua New Guinea (most areas)
-+PG	-0930+14710	Pacific/Port_Moresby	most of Papua New Guinea
- PG	-0613+15534	Pacific/Bougainville	Bougainville
- PH	+1435+12100	Asia/Manila
- PK	+2452+06703	Asia/Karachi
-@@ -379,7 +378,7 @@ RU	+4310+13156	Asia/Vladivostok	MSK+07 - Amur River
- RU	+643337+1431336	Asia/Ust-Nera	MSK+07 - Oymyakonsky
- RU	+5934+15048	Asia/Magadan	MSK+08 - Magadan
- RU	+4658+14242	Asia/Sakhalin	MSK+08 - Sakhalin Island
--RU	+6728+15343	Asia/Srednekolymsk	MSK+08 - Sakha (E); North Kuril Is
-+RU	+6728+15343	Asia/Srednekolymsk	MSK+08 - Sakha (E); N Kuril Is
- RU	+5301+15839	Asia/Kamchatka	MSK+09 - Kamchatka
- RU	+6445+17729	Asia/Anadyr	MSK+09 - Bering Sea
- RW	-0157+03004	Africa/Kigali
-@@ -420,7 +419,7 @@ TT	+1039-06131	America/Port_of_Spain
- TV	-0831+17913	Pacific/Funafuti
- TW	+2503+12130	Asia/Taipei
- TZ	-0648+03917	Africa/Dar_es_Salaam
--UA	+5026+03031	Europe/Kyiv	Ukraine (most areas)
-+UA	+5026+03031	Europe/Kyiv	most of Ukraine
- UG	+0019+03225	Africa/Kampala
- UM	+2813-17722	Pacific/Midway	Midway Islands
- UM	+1917+16637	Pacific/Wake	Wake Island
-@@ -443,7 +442,7 @@ US	+465042-1012439	America/North_Dakota/New_Salem	Central - ND (Morton rural)
- US	+471551-1014640	America/North_Dakota/Beulah	Central - ND (Mercer)
- US	+394421-1045903	America/Denver	Mountain (most areas)
- US	+433649-1161209	America/Boise	Mountain - ID (south); OR (east)
--US	+332654-1120424	America/Phoenix	MST - Arizona (except Navajo)
-+US	+332654-1120424	America/Phoenix	MST - AZ (except Navajo)
- US	+340308-1181434	America/Los_Angeles	Pacific
- US	+611305-1495401	America/Anchorage	Alaska (most areas)
- US	+581807-1342511	America/Juneau	Alaska - Juneau area
-@@ -451,7 +450,7 @@ US	+571035-1351807	America/Sitka	Alaska - Sitka area
- US	+550737-1313435	America/Metlakatla	Alaska - Annette Island
- US	+593249-1394338	America/Yakutat	Alaska - Yakutat
- US	+643004-1652423	America/Nome	Alaska (west)
--US	+515248-1763929	America/Adak	Aleutian Islands
-+US	+515248-1763929	America/Adak	Alaska - western Aleutians
- US	+211825-1575130	Pacific/Honolulu	Hawaii
- UY	-345433-0561245	America/Montevideo
- UZ	+3940+06648	Asia/Samarkand	Uzbekistan (west)
-diff --git a/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java b/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java
-index ef278203182..3762eb820bb 100644
---- a/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java
-+++ b/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java
-@@ -608,6 +608,17 @@ public final class ZoneInfoFile {
-                 params[8] = endRule.secondOfDay * 1000;
-                 params[9] = toSTZTime[endRule.timeDefinition];
-                 dstSavings = (startRule.offsetAfter - startRule.offsetBefore) * 1000;
-+
-+                // Note: known mismatching -> Africa/Cairo
-+                // ZoneInfo :      startDayOfWeek=5     <= Thursday
-+                //                 startTime=86400000   <= 24:00
-+                // This:           startDayOfWeek=6     <= Friday
-+                //                 startTime=0          <= 0:00
-+                if (zoneId.equals("Africa/Cairo") &&
-+                        params[7] == Calendar.FRIDAY && params[8] == 0) {
-+                    params[7] = Calendar.THURSDAY;
-+                    params[8] = SECONDS_PER_DAY * 1000;
-+                }
-             } else if (nTrans > 0) {  // only do this if there is something in table already
-                 if (lastyear < LASTYEAR) {
-                     // ZoneInfo has an ending entry for 2037
-diff --git a/src/java.base/share/classes/sun/util/resources/TimeZoneNames.java b/src/java.base/share/classes/sun/util/resources/TimeZoneNames.java
-index bf7918659ae..2763ac30ca7 100644
---- a/src/java.base/share/classes/sun/util/resources/TimeZoneNames.java
-+++ b/src/java.base/share/classes/sun/util/resources/TimeZoneNames.java
-@@ -1,5 +1,5 @@
- /*
-- * Copyright (c) 1996, 2022, Oracle and/or its affiliates. All rights reserved.
-+ * Copyright (c) 1996, 2023, Oracle and/or its affiliates. All rights reserved.
-  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-  *
-  * This code is free software; you can redistribute it and/or modify it
-@@ -845,9 +845,7 @@ public final class TimeZoneNames extends TimeZoneNamesBundle {
-             {"Europe/Jersey", GMTBST},
-             {"Europe/Kaliningrad", EET},
-             {"Europe/Kiev", EET},
--            {"Europe/Kirov", new String[] {"Kirov Standard Time", "GMT+03:00",
--                                           "Kirov Daylight Time", "GMT+03:00",
--                                           "Kirov Time", "GMT+03:00"}},
-+            {"Europe/Kirov", MSK},
-             {"Europe/Lisbon", WET},
-             {"Europe/Ljubljana", CET},
-             {"Europe/London", GMTBST},
-diff --git a/test/jdk/java/util/TimeZone/TimeZoneData/VERSION b/test/jdk/java/util/TimeZone/TimeZoneData/VERSION
-index 0f66ee12c94..c5483b48512 100644
---- a/test/jdk/java/util/TimeZone/TimeZoneData/VERSION
-+++ b/test/jdk/java/util/TimeZone/TimeZoneData/VERSION
-@@ -1 +1 @@
--tzdata2022g
-+tzdata2023c
-diff --git a/test/jdk/java/util/TimeZone/TimeZoneData/aliases.txt b/test/jdk/java/util/TimeZone/TimeZoneData/aliases.txt
-index d495743b268..07c5edbafee 100644
---- a/test/jdk/java/util/TimeZone/TimeZoneData/aliases.txt
-+++ b/test/jdk/java/util/TimeZone/TimeZoneData/aliases.txt
-@@ -211,6 +211,7 @@ Link	America/Argentina/Cordoba	America/Rosario
- Link	America/Tijuana		America/Santa_Isabel
- Link	America/Denver		America/Shiprock
- Link	America/Toronto		America/Thunder_Bay
-+Link	America/Edmonton	America/Yellowknife
- Link	Pacific/Auckland	Antarctica/South_Pole
- Link	Asia/Shanghai		Asia/Chongqing
- Link	Asia/Shanghai		Asia/Harbin
-diff --git a/test/jdk/java/util/TimeZone/TimeZoneData/displaynames.txt b/test/jdk/java/util/TimeZone/TimeZoneData/displaynames.txt
-index 44db4dbdb81..03f5305e65e 100644
---- a/test/jdk/java/util/TimeZone/TimeZoneData/displaynames.txt
-+++ b/test/jdk/java/util/TimeZone/TimeZoneData/displaynames.txt
-@@ -92,7 +92,6 @@ America/Vancouver PST PDT
- America/Whitehorse MST
- America/Winnipeg CST CDT
- America/Yakutat AKST AKDT
--America/Yellowknife MST MDT
- Antarctica/Macquarie AEST AEDT
- Asia/Beirut EET EEST
- Asia/Famagusta EET EEST
-@@ -144,6 +143,7 @@ Europe/Dublin IST/GMT IST/GMT
- Europe/Gibraltar CET CEST
- Europe/Helsinki EET EEST
- Europe/Kaliningrad EET
-+Europe/Kirov MSK
- Europe/Kyiv EET EEST
- Europe/Lisbon WET WEST
- Europe/London GMT/BST GMT/BST
-@@ -160,6 +160,7 @@ Europe/Tallinn EET EEST
- Europe/Tirane CET CEST
- Europe/Vienna CET CEST
- Europe/Vilnius EET EEST
-+Europe/Volgograd MSK
- Europe/Warsaw CET CEST
- Europe/Zurich CET CEST
- HST HST
-diff --git a/test/jdk/java/util/TimeZone/TimeZoneTest.java b/test/jdk/java/util/TimeZone/TimeZoneTest.java
-index d31d1722b7b..8e5d403f87b 100644
---- a/test/jdk/java/util/TimeZone/TimeZoneTest.java
-+++ b/test/jdk/java/util/TimeZone/TimeZoneTest.java
-@@ -1,5 +1,5 @@
- /*
-- * Copyright (c) 1997, 2021, Oracle and/or its affiliates. All rights reserved.
-+ * Copyright (c) 1997, 2023, Oracle and/or its affiliates. All rights reserved.
-  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-  *
-  * This code is free software; you can redistribute it and/or modify it
-@@ -25,7 +25,7 @@
-  * @test
-  * @bug 4028006 4044013 4096694 4107276 4107570 4112869 4130885 7039469 7126465 7158483
-  *      8008577 8077685 8098547 8133321 8138716 8148446 8151876 8159684 8166875 8181157
-- *      8228469 8274407
-+ *      8228469 8274407 8305113
-  * @modules java.base/sun.util.resources
-  * @library /java/text/testlib
-  * @summary test TimeZone
-@@ -121,7 +121,7 @@ public class TimeZoneTest extends IntlTest
-             new ZoneDescriptor("GMT", 0, false),
-             new ZoneDescriptor("UTC", 0, false),
-             new ZoneDescriptor("ECT", 60, true),
--            new ZoneDescriptor("ART", 120, false),
-+            new ZoneDescriptor("ART", 120, true),
-             new ZoneDescriptor("EET", 120, true),
-             new ZoneDescriptor("EAT", 180, false),
-             new ZoneDescriptor("MET", 60, true),
diff --git a/nss.cfg.in b/nss.cfg.in
deleted file mode 100644
index 377a39c..0000000
--- a/nss.cfg.in
+++ /dev/null
@@ -1,5 +0,0 @@
-name = NSS
-nssLibraryDirectory = @NSS_LIBDIR@
-nssDbMode = noDb
-attributes = compatibility
-handleStartupErrors = ignoreMultipleInitialisation
diff --git a/openjdk_news.sh b/openjdk_news.sh
deleted file mode 100755
index 560b356..0000000
--- a/openjdk_news.sh
+++ /dev/null
@@ -1,76 +0,0 @@
-#!/bin/bash
-
-# Copyright (C) 2022 Red Hat, Inc.
-# Written by Andrew John Hughes , 2012-2022
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU Affero General Public License as
-# published by the Free Software Foundation, either version 3 of the
-# License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU Affero General Public License for more details.
-#
-# You should have received a copy of the GNU Affero General Public License
-# along with this program.  If not, see .
-
-OLD_RELEASE=$1
-NEW_RELEASE=$2
-SUBDIR=$3
-REPO=$4
-SCRIPT_DIR=$(dirname ${0})
-
-if test "x${SUBDIR}" = "x"; then
-    echo "No subdirectory specified; using .";
-    SUBDIR=".";
-fi
-
-if test "x$REPO" = "x"; then
-    echo "No repository specified; using ${PWD}"
-    REPO=${PWD}
-fi
-
-if test x${TMPDIR} = x; then
-    TMPDIR=/tmp;
-fi
-
-echo "Repository: ${REPO}"
-
-if [ -e ${REPO}/.git ] ; then
-    TYPE=git;
-elif [ -e ${REPO}/.hg ] ; then
-    TYPE=hg;
-else
-    echo "No Mercurial or Git repository detected.";
-    exit 1;
-fi
-
-if test "x$OLD_RELEASE" = "x" || test "x$NEW_RELEASE" = "x"; then
-    echo "ERROR: Need to specify old and new release";
-    exit 2;
-fi
-
-echo "Listing fixes between $OLD_RELEASE and $NEW_RELEASE in $REPO"
-rm -f ${TMPDIR}/fixes2 ${TMPDIR}/fixes3 ${TMPDIR}/fixes
-for repos in . $(${SCRIPT_DIR}/discover_trees.sh ${REPO});
-do
-    if test "x$TYPE" = "xhg"; then
-	hg log -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R $REPO/$repos -G -M ${REPO}/${SUBDIR} | \
-	    egrep '^[o:| ]*summary'|grep -v 'Added tag'|sed -r 's#^[o:| ]*summary:\W*([0-9])#  - JDK-\1#'| \
-	    sed 's#^[o:| ]*summary:\W*#  - #' >> ${TMPDIR}/fixes2;
-	hg log -v -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R $REPO/$repos -G -M ${REPO}/${SUBDIR} | \
-	    egrep '^[o:| ]*[0-9]{7}'|sed -r 's#^[o:| ]*([0-9]{7})#  - JDK-\1#' >> ${TMPDIR}/fixes3;
-    else
-	git -C ${REPO} log --no-merges --pretty=format:%B ${NEW_RELEASE}...${OLD_RELEASE} -- ${SUBDIR} |egrep '^[0-9]{7}' | \
-	    sed -r 's#^([0-9])#  - JDK-\1#' >> ${TMPDIR}/fixes2;
-	touch ${TMPDIR}/fixes3 ; # unused
-    fi
-done
-
-sort ${TMPDIR}/fixes2 ${TMPDIR}/fixes3 | uniq > ${TMPDIR}/fixes
-rm -f ${TMPDIR}/fixes2 ${TMPDIR}/fixes3
-
-echo "In ${TMPDIR}/fixes:"
-cat ${TMPDIR}/fixes
diff --git a/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch b/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
deleted file mode 100644
index 3042186..0000000
--- a/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
+++ /dev/null
@@ -1,16 +0,0 @@
-diff -r 618ad1237e73 src/java.desktop/share/classes/java/awt/Toolkit.java
---- a/src/java.desktop/share/classes/java/awt/Toolkit.java	Thu Jun 13 19:37:49 2019 +0200
-+++ b/src/java.desktop/share/classes/java/awt/Toolkit.java	Thu Jul 04 10:35:42 2019 +0200
-@@ -595,7 +595,11 @@
-                 toolkit = new HeadlessToolkit(toolkit);
-             }
-             if (!GraphicsEnvironment.isHeadless()) {
--                loadAssistiveTechnologies();
-+                try {
-+                    loadAssistiveTechnologies();
-+                } catch (AWTError error) {
-+                    // ignore silently
-+                }
-             }
-         }
-         return toolkit;
diff --git a/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch b/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
deleted file mode 100644
index 6d2342a..0000000
--- a/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security
-index adfaf57d29e..abf89bbf327 100644
---- a/src/java.base/share/conf/security/java.security
-+++ b/src/java.base/share/conf/security/java.security
-@@ -78,6 +78,7 @@ security.provider.tbd=SunMSCAPI
- security.provider.tbd=Apple
- #endif
- security.provider.tbd=SunPKCS11
-+#security.provider.tbd=SunPKCS11 ${java.home}/lib/security/nss.cfg
- 
- #
- # Security providers used when FIPS mode support is active
diff --git a/rh1648644-java_access_bridge_privileged_security.patch b/rh1648644-java_access_bridge_privileged_security.patch
deleted file mode 100644
index 53026ad..0000000
--- a/rh1648644-java_access_bridge_privileged_security.patch
+++ /dev/null
@@ -1,20 +0,0 @@
---- openjdk/src/java.base/share/conf/security/java.security
-+++ openjdk/src/java.base/share/conf/security/java.security
-@@ -304,6 +304,8 @@
- #
- package.access=sun.misc.,\
-                sun.reflect.,\
-+               org.GNOME.Accessibility.,\
-+               org.GNOME.Bonobo.,\
- 
- #
- # List of comma-separated packages that start with or equal this string
-@@ -316,6 +318,8 @@
- #
- package.definition=sun.misc.,\
-                    sun.reflect.,\
-+                   org.GNOME.Accessibility.,\
-+                   org.GNOME.Bonobo.,\
- 
- #
- # Determines whether this properties file can be appended to
diff --git a/rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch b/rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
deleted file mode 100644
index 5e2b254..0000000
--- a/rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
+++ /dev/null
@@ -1,13 +0,0 @@
---- openjdk/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java	2013-03-01 10:48:12.038189968 +0100
-+++ openjdk/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java	2013-03-01 10:48:11.913188505 +0100
-@@ -48,8 +48,8 @@
- 
-     private final static String PROP_NAME = "sun.security.smartcardio.library";
- 
--    private final static String LIB1 = "/usr/$LIBISA/libpcsclite.so";
--    private final static String LIB2 = "/usr/local/$LIBISA/libpcsclite.so";
-+    private final static String LIB1 = "/usr/$LIBISA/libpcsclite.so.1";
-+    private final static String LIB2 = "/usr/local/$LIBISA/libpcsclite.so.1";
-     private final static String PCSC_FRAMEWORK = "/System/Library/Frameworks/PCSC.framework/Versions/Current/PCSC";
- 
-     PlatformPCSC() {
diff --git a/rh1750419-redhat_alt_java.patch b/rh1750419-redhat_alt_java.patch
deleted file mode 100644
index 88f5e5a..0000000
--- a/rh1750419-redhat_alt_java.patch
+++ /dev/null
@@ -1,117 +0,0 @@
-diff --git openjdk.orig/make/modules/java.base/Launcher.gmk openjdk/make/modules/java.base/Launcher.gmk
-index 700ddefda49..2882de68eb2 100644
---- openjdk.orig/make/modules/java.base/Launcher.gmk
-+++ openjdk/make/modules/java.base/Launcher.gmk
-@@ -41,6 +41,14 @@ $(eval $(call SetupBuildLauncher, java, \
-     OPTIMIZATION := HIGH, \
- ))
- 
-+#Wno-error=cpp is present to allow commented warning in ifdef part of main.c
-+$(eval $(call SetupBuildLauncher, alt-java, \
-+    CFLAGS := -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES -DREDHAT_ALT_JAVA -Wno-error=cpp, \
-+    EXTRA_RCFLAGS := $(JAVA_RCFLAGS), \
-+    VERSION_INFO_RESOURCE := $(JAVA_VERSION_INFO_RESOURCE), \
-+    OPTIMIZATION := HIGH, \
-+))
-+
- ifeq ($(call isTargetOs, windows), true)
-   $(eval $(call SetupBuildLauncher, javaw, \
-       CFLAGS := -DJAVAW -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES, \
-diff --git openjdk.orig/src/java.base/share/native/launcher/alt_main.h openjdk/src/java.base/share/native/launcher/alt_main.h
-new file mode 100644
-index 00000000000..697df2898ac
---- /dev/null
-+++ openjdk/src/java.base/share/native/launcher/alt_main.h
-@@ -0,0 +1,73 @@
-+/*
-+ * Copyright (c) 2019, Red Hat, Inc. All rights reserved.
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation.  Oracle designates this
-+ * particular file as subject to the "Classpath" exception as provided
-+ * by Oracle in the LICENSE file that accompanied this code.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+#ifdef REDHAT_ALT_JAVA
-+
-+#include 
-+
-+
-+/* Per task speculation control */
-+#ifndef PR_GET_SPECULATION_CTRL
-+# define PR_GET_SPECULATION_CTRL    52
-+#endif
-+#ifndef PR_SET_SPECULATION_CTRL
-+# define PR_SET_SPECULATION_CTRL    53
-+#endif
-+/* Speculation control variants */
-+#ifndef PR_SPEC_STORE_BYPASS
-+# define PR_SPEC_STORE_BYPASS          0
-+#endif
-+/* Return and control values for PR_SET/GET_SPECULATION_CTRL */
-+
-+#ifndef PR_SPEC_NOT_AFFECTED
-+# define PR_SPEC_NOT_AFFECTED          0
-+#endif
-+#ifndef PR_SPEC_PRCTL
-+# define PR_SPEC_PRCTL                 (1UL << 0)
-+#endif
-+#ifndef PR_SPEC_ENABLE
-+# define PR_SPEC_ENABLE                (1UL << 1)
-+#endif
-+#ifndef PR_SPEC_DISABLE
-+# define PR_SPEC_DISABLE               (1UL << 2)
-+#endif
-+#ifndef PR_SPEC_FORCE_DISABLE
-+# define PR_SPEC_FORCE_DISABLE         (1UL << 3)
-+#endif
-+#ifndef PR_SPEC_DISABLE_NOEXEC
-+# define PR_SPEC_DISABLE_NOEXEC        (1UL << 4)
-+#endif
-+
-+static void set_speculation() __attribute__((constructor));
-+static void set_speculation() {
-+  if ( prctl(PR_SET_SPECULATION_CTRL,
-+             PR_SPEC_STORE_BYPASS,
-+             PR_SPEC_DISABLE_NOEXEC, 0, 0) == 0 ) {
-+    return;
-+  }
-+  prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0);
-+}
-+
-+#endif // REDHAT_ALT_JAVA
-diff --git openjdk.orig/src/java.base/share/native/launcher/main.c openjdk/src/java.base/share/native/launcher/main.c
-index b734fe2ba78..79dc8307650 100644
---- openjdk.orig/src/java.base/share/native/launcher/main.c
-+++ openjdk/src/java.base/share/native/launcher/main.c
-@@ -34,6 +34,14 @@
- #include "jli_util.h"
- #include "jni.h"
- 
-+#ifdef REDHAT_ALT_JAVA
-+#if defined(__linux__) && defined(__x86_64__)
-+#include "alt_main.h"
-+#else
-+#warning alt-java requested but SSB mitigation not available on this platform.
-+#endif
-+#endif
-+
- #ifdef _MSC_VER
- #if _MSC_VER > 1400 && _MSC_VER < 1600
- 
diff --git a/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch b/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
deleted file mode 100644
index 1b706a1..0000000
--- a/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
+++ /dev/null
@@ -1,19 +0,0 @@
-Remove uses of FAR in jpeg code
-
-Upstream libjpeg-trubo removed the (empty) FAR macro:
-http://sourceforge.net/p/libjpeg-turbo/code/1312/
-
-Adjust our code to not use the undefined FAR macro anymore.
-
-diff --git a/jdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c b/jdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c
---- openjdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c
-+++ openjdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c
-@@ -1385,7 +1385,7 @@
-     /* and fill it in */
-     dst_ptr = icc_data;
-     for (seq_no = first; seq_no < last; seq_no++) {
--        JOCTET FAR *src_ptr = icc_markers[seq_no]->data + ICC_OVERHEAD_LEN;
-+        JOCTET *src_ptr = icc_markers[seq_no]->data + ICC_OVERHEAD_LEN;
-         unsigned int length =
-             icc_markers[seq_no]->data_length - ICC_OVERHEAD_LEN;
- 
diff --git a/rpminspect.yaml b/rpminspect.yaml
deleted file mode 100644
index 8b4fa58..0000000
--- a/rpminspect.yaml
+++ /dev/null
@@ -1,3 +0,0 @@
----
-inspections:
-    javabytecode: off
diff --git a/sources b/sources
deleted file mode 100644
index ec61884..0000000
--- a/sources
+++ /dev/null
@@ -1,2 +0,0 @@
-SHA512 (openjdk-jdk17u-jdk-17.0.7+7.tar.xz) = 2f231e83fabef6299b16beee1e0c8d52501e22fd71a26ed2ace6fadabe38e73e66f3b8fb8bc994e8b2b9bbdb91d1143661941f623bb94793500f4f3b6495bf58
-SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
diff --git a/tests/tests.yml b/tests/tests.yml
deleted file mode 100644
index c912769..0000000
--- a/tests/tests.yml
+++ /dev/null
@@ -1,21 +0,0 @@
----
-- hosts: localhost
-  roles:
-  - role: standard-test-source
-    tags:
-    - always
-  - role: standard-test-basic
-    tags:
-    - classic
-    - atomic
-    required_packages:
-    - java-21-openjdk-devel
-    tests:
-      - javaVersion1:
-          dir: ~
-          run: set -ex; useradd franta1;  su franta1 -c 'java -version';
-          run: set -ex; useradd franta4;  su franta4 -c 'javac -version';
-          run: ls -l /usr/lib/jvm;
-      - javaVersion2:
-          dir: ~
-          run: set -ex; useradd franta2;  su franta2 -c 'java --version'