diff --git a/.gitignore b/.gitignore index 519d86a..f51e5ec 100644 --- a/.gitignore +++ b/.gitignore @@ -42,3 +42,6 @@ /openjdk-21.0.9+10.tar.xz /openjdk-21.0.10+6-ea.tar.xz /openjdk-21.0.10+7.tar.xz +/openjdk-21.0.11+10.tar.xz +/openjdk-21.0.12+8.tar.xz +/openjdk-21.0.12.1+1.tar.xz diff --git a/NEWS b/NEWS index 1bf13ce..3213d01 100644 --- a/NEWS +++ b/NEWS @@ -3,6 +3,662 @@ Key: JDK-X - https://bugs.openjdk.java.net/browse/JDK-X CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY +New in release OpenJDK 21.0.12.1 (2026-08-18): +============================================== +Live versions of these release notes can be found at: + * https://bit.ly/openjdk210121 + +* CVEs + - CVE-2026-60589 + - CVE-2026-61308 + - CVE-2026-70907 +* Changes + - JDK-8333743: Change .jcheck/conf branches property to match valid branches + - JDK-8382471: Improve Resource Resolving + - JDK-8384708: Enhance HTTP Connections + - JDK-8386205: Enhance TLS server + - JDK-8388789: Bump update version for OpenJDK: jdk-21.0.12.1 + - JDK-8389946: [21u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 21.0.12.1 + +New in release OpenJDK 21.0.12 (2026-07-21): +=========================================== +Live versions of these release notes can be found at: + * https://bit.ly/openjdk2112 + +* CVEs + - CVE-2026-46968 + - CVE-2026-46917 + - CVE-2026-47010 + - CVE-2026-47021 + - CVE-2026-47027 + - CVE-2026-60147 + - CVE-2026-47059 + - CVE-2026-47063 + - CVE-2026-41254 +* Changes + - JDK-7184899: Test sun/java2d/X11SurfaceData/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fail + - JDK-8015444: java/awt/Focus/KeyStrokeTest.java sometimes fails + - JDK-8064922: [macos] Test javax/swing/JTabbedPane/4624207/bug4624207.java fails + - JDK-8068293: [TEST_BUG] Test closed/com/sun/java/swing/plaf/motif/InternalFrame/4150591/bug4150591.java fails with GTKLookAndFeel + - JDK-8068310: [TEST_BUG] Test javax/swing/JColorChooser/Test4234761.java fails with GTKL&F + - JDK-8068378: [TEST_BUG]The java/awt/Modal/PrintDialogsTest/PrintDialogsTest.java instruction need to update + - JDK-8129418: JShell: better highlighting of errors in imports on demand + - JDK-8144124: [macosx] The tabs can't be aligned when we pressing the key of 'R','B','L','C' or 'T'. + - JDK-8183336: Better cleanup for jdk/test/java/lang/module/customfs/ModulesInCustomFileSystem.java + - JDK-8203004: UnixMultiResolutionSplashTest.java fails on Ubuntu16.04 + - JDK-8212084: G1: Implement UseGCOverheadLimit + - JDK-8213530: Test java/awt/Modal/ToFront/DialogToFrontModeless1Test.java fails on Linux + - JDK-8221451: PIT: sun/java2d/X11SurfaceData/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fails + - JDK-8225787: java/awt/Window/GetScreenLocation/GetScreenLocationTest.java fails on Ubuntu + - JDK-8255463: java/nio/channels/spi/SelectorProvider/inheritedChannel/InheritedChannelTest.java failed with ThreadTimeoutException + - JDK-8274082: Wrong test name in jtreg run tag for java/awt/print/PrinterJob/SwingUIText.java + - JDK-8277444: Data race between JvmtiClassFileReconstituter::copy_bytecodes and class linking + - JDK-8278102: containers/docker/TestJcmd.java failed with "RuntimeException: Could not find specified process" + - JDK-8286258: [Accessibility,macOS,VoiceOver] VoiceOver reads the spinner value wrong and sometime partially + - JDK-8286865: vmTestbase/vm/mlvm/meth/stress/jni/nativeAndMH/Test.java fails with Out of space in CodeCache + - JDK-8293484: AArch64: TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails on CPU with SHA512 feature support + - JDK-8297191: [macos] Printing a page range with starting page > 1 results in missing pages + - JDK-8298783: java/lang/ref/FinalizerHistogramTest.java failed with "RuntimeException: MyObject is not found in test output" + - JDK-8298823: [macos] java/awt/Mouse/EnterExitEvents/DragWindowTest.java continues to fail with "No MouseReleased event on label!" + - JDK-8299304: Test "java/awt/print/PrinterJob/PageDialogTest.java" fails on macOS 13 x64 because the Page Dialog blocks the Toolkit + - JDK-8310645: CancelledResponse.java does not use HTTP/2 when testing the HttpClient + - JDK-8311538: CDS InternSharedString test fails on huge pages host - cannot find shared string + - JDK-8315588: JShell does not accept underscore from JEP 443 even with --enable-preview + - JDK-8318365: Test runtime/cds/appcds/sharedStrings/InternSharedString.java fails after JDK-8311538 + - JDK-8318662: Refactor some jdk/java/net/httpclient/http2 tests to JUnit + - JDK-8319326: GC: Make TestParallelRefProc use createTestJavaProcessBuilder + - JDK-8319540: GC: Make TestSelectDefaultGC use createTestJavaProcessBuilder + - JDK-8320677: Printer tests use invalid '@run main/manual=yesno + - JDK-8321303: Intermittent open/test/jdk/java/awt/KeyboardFocusmanager/ConsumeNextMnemonicKeyTypedTest/ConsumeNextMnemonicKeyTypedTest.java failure on Linux + - JDK-8321687: Test vmTestbase/nsk/jvmti/scenarios/contention/TC03/tc03t002/TestDescription.java failed: JVMTI_ERROR_THREAD_NOT_ALIVE + - JDK-8322532: JShell : Unnamed variable issue + - JDK-8323089: networkaddress.cache.ttl is not a system property + - JDK-8323545: java/awt/GraphicsDevice/CheckDisplayModes.java fails with "exit code: 133" + - JDK-8323672: Suppress unwanted autoconf added flags in CC and CXX + - JDK-8323792: ThreadSnapshot::initialize can cause assert in Thread::check_for_dangling_thread_pointer (possibility of dangling Thread pointer) + - JDK-8326458: Menu mnemonics don't toggle in Windows LAF when F10 is pressed + - JDK-8328300: Convert PrintDialogsTest.java from Applet to main program + - JDK-8329273: C2 SuperWord: Some basic MemorySegment IR tests + - JDK-8330704: Clean up non-standard use of /** comments in some langtools tests + - JDK-8330806: test/hotspot/jtreg/compiler/c1/TestLargeMonitorOffset.java fails on ARM32 + - JDK-8332495: java/util/logging/LoggingDeadlock2.java fails with AssertionError: Some tests failed + - JDK-8333729: C2 SuperWord: remove some @requires usages in test/hotspot/jtreg/compiler/loopopts/superword + - JDK-8334928: Test sun/security/ssl/SSLSocketImpl/ReuseAddr.java failed: java.net.BindException: Address already in use + - JDK-8338103: Stabilize and open source a Swing OGL ButtonResizeTest + - JDK-8338554: Fix inconsistencies in javadoc/doclet/testLinkOption/TestRedirectLinks.java + - JDK-8338883: Show warning when CreateCoredumpOnCrash set, but core dump will not happen + - JDK-8339233: Test javax/swing/JButton/SwingButtonResizeTestWithOpenGL.java#id failed: Button renderings are different after window resize + - JDK-8339638: Update vmTestbase/nsk/jvmti/*Field*Watch tests to use virtual thread factory + - JDK-8339879: Open some dialog awt tests + - JDK-8339975: Open some dialog awt tests 2 + - JDK-8340140: Open some dialog awt tests 3 + - JDK-8340336: Open some checkbox awt tests + - JDK-8340494: Open some dialog awt tests 4 + - JDK-8340818: Add a new jtreg test root to test the generated documentation + - JDK-8340851: Open some TextArea awt tests + - JDK-8340987: Open some TextArea awt tests 1 + - JDK-8341055: Open some TextArea awt tests 2 + - JDK-8341292: Open some TextArea awt tests 3 + - JDK-8341376: Open some TextArea awt tests 4 + - JDK-8341427: JFR: Adjust object sampler span handling + - JDK-8341436: containers/docker/TestJcmdWithSideCar.java takes needlessly long to run + - JDK-8341833: incomplete snippet from loaded files from command line is ignored + - JDK-8342401: [TESTBUG] javax/swing/JSpinner/8223788/JSpinnerButtonFocusTest.java test fails in ubuntu 22.04 on SBR Hosts + - JDK-8342836: Automatically determine that a test in the docs test root is requested + - JDK-8344128: Regression: make help broken after JDK-8340818 + - JDK-8345618: javax/swing/text/Caret/8163124/CaretFloatingPointAPITest.java leaves Caret is not complete + - JDK-8346154: [XWayland] Some tests fail intermittently in the CI, but not locally + - JDK-8346683: Problem list automated tests that fail on macOS15 + - JDK-8347836: Disabled PopupMenu shows shortcuts on Mac + - JDK-8349084: Update vectors used in several PQC benchmarks + - JDK-8349192: jvmti/scenarios/contention/TC05/tc05t001 fails: ERROR: tc05t001.cpp, 281: (waitedThreadCpuTime - waitThreadCpuTime) < (EXPECTED_ACCURACY * 1000000) + - JDK-8349533: Refactor validator tests shell files to java + - JDK-8349699: XSL transform fails with certain UTF-8 characters on 1024 byte boundaries + - JDK-8349959: Test CR6740048.java passes unexpectedly missing CR6740048.xsd + - JDK-8350749: Upgrade JLine to 3.29.0 + - JDK-8350808: Small typos in JShell method SnippetEvent.toString() + - JDK-8352020: [CompileFramework] enable compilation for VectorAPI + - JDK-8352147: G1: TestEagerReclaimHumongousRegionsClearMarkBits test takes very long + - JDK-8352149: Test java/awt/Frame/MultiScreenTest.java fails: Window list is empty + - JDK-8352431: java/net/httpclient/EmptyAuthenticate.java uses "localhost" + - JDK-8352685: Opensource JInternalFrame tests - series2 + - JDK-8352733: Improve RotFontBoundsTest test + - JDK-8352877: Opensource Several Font related tests - Batch 1 + - JDK-8353124: java/lang/Thread/virtual/stress/Skynet.java#Z times out on macosx-x64-debug + - JDK-8353488: Open some JComboBox bugs 3 + - JDK-8353552: Opensource Several Font related tests - Batch 3 + - JDK-8354163: Open source Swing tests Batch 1 + - JDK-8354695: Open source several swing tests batch7 + - JDK-8354900: javax/swing/AbstractButton/bug4133768.java failing on macosx-aarch64 + - JDK-8354910: Output by java.io.IO or System.console() corrupted for some non-ASCII characters + - JDK-8355048: ProblemList TestGlyphVectorLayout.java on all platforms + - JDK-8355179: Reinstate javax/swing/JScrollBar/4865918/bug4865918.java headful and macos run + - JDK-8355332: Fix failing semi-manual test EDT issue + - JDK-8355371: NegativeArraySizeException in print methods in IO or System.console() in JShell + - JDK-8355443: [java.io] Use @requires tag instead of exiting based on File.separatorChar value + - JDK-8356695: java/lang/StringBuilder/HugeCapacity.java failing with OOME + - JDK-8356868: Not all cgroup parameters are made available + - JDK-8357062: Update Public Suffix List to 823beb1 + - JDK-8357082: Stabilize and add debug logs to CopyAreaOOB.java + - JDK-8357086: os::xxx functions returning memory size should return size_t + - JDK-8357280: (bf) Remove @requires tags from java/nio/Buffer/LimitDirectMemory[NegativeTest].java + - JDK-8357390: java/awt/Toolkit/ScreenInsetsTest/ScreenInsetsTest.java Test failing on Ubuntu 24.04 Vm Hosts used by Oracle's internal CI system + - JDK-8358058: sun/java2d/OpenGL/DrawImageBg.java Test fails intermittently + - JDK-8359364: java/net/URL/EarlyOrDelayedParsing test fails intermittently + - JDK-8359472: JVM crashes when attaching a dynamic agent before JVMTI_PHASE_LIVE + - JDK-8359978: Test javax/net/ssl/SSLSocket/Tls13PacketSize.java failed again with java.net.SocketException: An established connection was aborted by the software in your host machine + - JDK-8360160: ubuntu-22-04 machine is failing client tests + - JDK-8360395: sun/security/tools/keytool/i18n.java user country is current user location instead of the language + - JDK-8360562: sun/security/tools/keytool/i18n.java add an ability to add comment for failures + - JDK-8360702: runtime/Thread/AsyncExceptionTest.java timed out + - JDK-8360882: Tests throw SkippedException when they should fail + - JDK-8361106: [TEST] com/sun/net/httpserver/Test9.java fails with java.nio.file.FileSystemException + - JDK-8361606: ConsumeNextMnemonicKeyTypedTest.java fails on Windows: character typed with VK_A: a + - JDK-8361894: sun/security/krb5/config/native/TestDynamicStore.java ensure that the test is run with sudo + - JDK-8362428: Update IANA Language Subtag Registry to Version 2025-08-25 + - JDK-8363943: ARM32: Represent Registers as values + - JDK-8363949: Incorrect jtreg header in MonitorWithDeadObjectTest.java + - JDK-8364190: JFR: RemoteRecordingStream withers don't work + - JDK-8364315: Remove unused xml files from test/jaxp/javax/xml/jaxp/functional/javax/xml/transform/xmlfiles + - JDK-8364756: JFR: Improve slow tests + - JDK-8364927: Add @requires annotation to TestReclaimStringsLeaksMemory.java + - JDK-8365379: SU3.applyInsets may produce wrong results + - JDK-8365398: TEST_BUG: java/rmi/transport/checkLeaseInfoLeak/CheckLeaseLeak.java failing intermittently + - JDK-8365423: [macos26] java/awt/MenuBar/8007006/bug8007006.java fails on macOS 26 + - JDK-8365424: [macos26] java/awt/Frame/DisposeTest.java fails on macOS 26 + - JDK-8365623: test/jdk/sun/security/pkcs11/tls/ tests skipped without skip exception + - JDK-8365625: Can't change accelerator colors in Windows L&F + - JDK-8365776: Convert JShell tests to use JUnit instead of TestNG + - JDK-8365861: test/jdk/sun/security/pkcs11/Provider/ tests skipped without SkippedException + - JDK-8365863: /test/jdk/sun/security/pkcs11/Cipher tests skip without SkippedException + - JDK-8365893: test/jdk/java/lang/Thread/virtual/JfrEvents.java failing intermittently + - JDK-8366031: Mark com/sun/nio/sctp/SctpChannel/CloseDescriptors.java as intermittent + - JDK-8366182: Some PKCS11Tests are being skipped when they shouldn't + - JDK-8366369: Add @requires linux for GTK L&F tests + - JDK-8366852: java/awt/Choice/ChoiceMouseWheelTest/ChoiceMouseWheelTest.java test is failing + - JDK-8367096: jdk/open/test/jdk/sun/security/pkcs11/ rsa, ec, config, secmod and sslecc tests are skipping but showing as pass + - JDK-8367485: os::physical_memory is broken in 32-bit JVMs when running on 64-bit OSes + - JDK-8367784: java/awt/Focus/InitialFocusTest/InitialFocusTest1.java failed with Wrong focus owner + - JDK-8368029: Several tests in httpserver/simpleserver should throw SkipException + - JDK-8368041: Enhance TLS certificate handling + - JDK-8368181: ProblemList java/awt/Dialog/ModalExcludedTest/ModalExcludedTest.java + - JDK-8368335: Refactor the rest of Locale TestNG based tests to JUnit + - JDK-8368498: Use JUnit instead of TestNG for jdk_text tests + - JDK-8368524: Tests are skipped and shown as passed in test/jdk/sun/security/pkcs11/Cipher/KeyWrap + - JDK-8368551: Core dump warning may be confusing + - JDK-8368625: com/sun/net/httpserver/ServerStopTerminationTest.java fails intermittently + - JDK-8368670: Deadlock in JFR on event register + class load + - JDK-8368754: runtime/cds/appcds/SignedJar.java log regex is too strict + - JDK-8368866: compiler/codecache/stress/UnexpectedDeoptimizationTest.java intermittent timed out + - JDK-8368885: NMT CommandLine tests can check for error better + - JDK-8368892: Make JEditorPane/TestBrowserBGColor.java headless + - JDK-8369251: Opensource few tests + - JDK-8369335: Two sun/java2d/OpenGL tests fail on Windows after JDK-8358058 + - JDK-8369516: Delete duplicate imaging test + - JDK-8369561: sun/java2d/OpenGL/DrawBitmaskImage.java#id0: Incorrect color for first pixel (actual=ff000000) + - JDK-8369683: Exclude runtime/Monitor/MonitorWithDeadObjectTest.java#DumpThreadsBeforeDetach on Alpine Linux debug + - JDK-8369851: Remove darcy author tags from langtools tests + - JDK-8369950: TLS connection to IPv6 address fails with BCJSSE due to IllegalArgumentException + - JDK-8370378: Some compiler tests inadvertently exclude particular platforms + - JDK-8370489: Some compiler tests miss the @key randomness + - JDK-8370492: [Linux] Update cpu shares to cpu.weight mapping function + - JDK-8370511: test/jdk/javax/swing/JSlider/bug4382876.java does not release previously pressed keys + - JDK-8370732: Use WhiteBox.getWhiteBox().fullGC() to provoking gc for nsk/jvmti tests + - JDK-8370905: Update vm.defmeth tests to use virtual threads + - JDK-8370942: test/jdk/java/security/Provider/NewInstance.java and /test/jdk/java/security/cert/CertStore/NoLDAP.java may skip without notifying + - JDK-8371262: sun/security/pkcs11/Cipher/KeyWrap tests may silently skip + - JDK-8371349: Update NSS library to 3.117 + - JDK-8371364: Refactor javax/swing/JFileChooser/FileSizeCheck.java to use Util.findComponent() + - JDK-8371365: Update javax/swing/JFileChooser/bug4759934.java to use Util.findComponent() + - JDK-8371366: java/net/httpclient/whitebox/RawChannelTestDriver.java fails intermittently in jtreg timeout + - JDK-8371383: Test sun/security/tools/jarsigner/DefaultOptions.java failed due to CertificateNotYetValidException + - JDK-8371503: RETAIN_IMAGE_AFTER_TEST do not work for some tests + - JDK-8371895: Lower GCTimeLimit in TestUseGCOverheadLimit.java + - JDK-8371967: Add Visual Studio 2026 to build toolchain for Windows + - JDK-8372120: Add missing sound keyword to MIDI tests + - JDK-8372272: Hotspot shared lib loading - add load attempts to Events::log + - JDK-8372351: Add 2 WISeKey roots + - JDK-8372609: Bug4944439 does not enforce locale correctly + - JDK-8372661: Add a null-safe static factory method to "jdk.test.lib.net.SimpleSSLContext" + - JDK-8373101: JdkClient and JdkServer test classes ignore namedGroups field + - JDK-8373239: Test java/awt/print/PrinterJob/PageRanges.java fails with incorrect selection of printed pages + - JDK-8373275: Improve DTLS handshaking + - JDK-8373537: Migrate "test/jdk/com/sun/net/httpserver/" to null-safe "SimpleSSLContext" methods + - JDK-8373593: Support latest VS2026 MSC_VER in abstract_vm_version.cpp + - JDK-8373623: Refactor Serialization tests for Records to JUnit + - JDK-8373632: Some sound tests failing in CI due to lack of sound key + - JDK-8373650: Test "javax/swing/JMenuItem/6458123/ManualBug6458123.java" fails because the check icons are not aligned properly as expected + - JDK-8373690: Unexpected Keystore message using jdk.crypto.disabledAlgorithms + - JDK-8373704: Improve "SocketException: Protocol family unavailable" message + - JDK-8373716: Refactor further java/util tests from TestNG to JUnit + - JDK-8373793: TestDynamicStore.java '/manual' disables use of '/timeout' + - JDK-8373796: Refactor java/net/httpclient/ThrowingPublishers*.java tests to use JUnit5 + - JDK-8373807: test/jdk/java/net/httpclient/websocket/DummyWebSocketServer.java getURI() uses "localhost" + - JDK-8373832: Test java/lang/invoke/TestVHInvokerCaching.java tests nothing + - JDK-8373847: Test javax/swing/JMenuItem/MenuItemTest/bug6197830.java failed because The test case automatically fails when clicking any items in the “Nothing” menu in all four windows (Left-to-right)-Menu Item Test and (Right-to-left)-Menu Item Test + - JDK-8373866: Refactor java/net/httpclient/ThrowingSubscribers*.java tests to use JUnit5 + - JDK-8373869: Refactor java/net/httpclient/ThrowingPushPromises*.java tests to use JUnit5 + - JDK-8373928: 4 Dangling pointer defect groups in java.c + - JDK-8373931: Test javax/sound/sampled/Clip/AutoCloseTimeCheck.java timed out + - JDK-8374058: Enhance JPEG handling + - JDK-8374304: MultiResolutionSplashTest.java fails in CI: "Image with wrong resolution is used for splash screen!" + - JDK-8374322: TestMemoryWithSubgroups.java fails Permission denied + - JDK-8374434: Several JShell tests report JUnit discovery warnings + - JDK-8374506: Incorrect positioning of arrow icon in parent JMenu in Windows L&F + - JDK-8374711: Hotspot runtime/CommandLine/OptionsValidation/TestOptionsWithRanges fails without printing the option name + - JDK-8374769: PPC: MASM::pop_cont_fastpath() should reset _cont_fastpath if SP == _cont_fastpath + - JDK-8374888: Implement internal test cache to help UserIterCount test performance + - JDK-8374998: Failing os::write - remove bad file + - JDK-8375065: Update LCMS to 2.18 + - JDK-8375080: The tools/jpackage/windows/Win8365790Test.java may fail with ClassNotFoundException: jtreg.SkippedException + - JDK-8375231: Refactor util/ServiceLoader tests to use JUnit + - JDK-8375232: Refactor util/StringJoiner tests to use JUnit + - JDK-8375233: Refactor util/Vector tests to use JUnit + - JDK-8375742: Test java/lang/invoke/MethodHandleProxies/Driver.java does not run Unnamed.java + - JDK-8376031: HttpsURLConnection.getServerCertificates() throws "java.lang.IllegalStateException: connection not yet open" for the HEAD method + - JDK-8376151: Test javax/swing/JFileChooser/4966171/bug4966171.java is failing with OOME + - JDK-8376152: Test javax/sound/sampled/Clip/bug5070081.java timed out then completed + - JDK-8376233: Clean up code in Desktop native peer + - JDK-8376889: Enhance JfrRecorder::on_create_vm_3() assert output + - JDK-8377158: Enhance XBM image support + - JDK-8377167: javax/imageio/ReadAbortTest.java throw NPE when x11 unavailable + - JDK-8377347: jdk/jfr/event/gc/detailed/TestZAllocationStallEvent.java intermittent OOME + - JDK-8377498: Improve HttpServer handling + - JDK-8377602: Create automated test for PageRange + - JDK-8377727: Ghost caret and focus appear in non‑editable text fields + - JDK-8377833: Enhance Jar file processing + - JDK-8377910: Minor cleanup of java/io/FileDescriptor/Sharing.java + - JDK-8377944: LowMemoryTest2.java#id1 intermittent fails OOME: Metaspace + - JDK-8378113: Add sun/java2d/OpenGL/ScaleParamsOOB.java to the ProblemList.txt file + - JDK-8378201: [OGL] glXMakeContextCurrent() drops the buffers of the unbound drawable + - JDK-8378353: [PPC64] StringCoding.countPositives causes errors when the length is not a proper 32 bit int + - JDK-8378417: Printing All pages results in NPE for 1.1 PrintJob + - JDK-8378561: Mark gc/shenandoah/compiler/TestLinkToNativeRBP.java as /native + - JDK-8378687: Improve delegation of HttpURLConnection + - JDK-8378775: Bump update version for OpenJDK: jdk-21.0.12 + - JDK-8378802: [21u] backport changes to TKit.java by JDK-8352419 + - JDK-8378810: Enable missing FFM test via jtreg requires for RISC-V + - JDK-8378878: Refactor java/nio/channels/AsynchronousSocketChannel test to use JUnit + - JDK-8379464: Enable missing stack walking test via jtreg requires for RISC-V + - JDK-8380011: Path-to-gcroots search should not trigger stack overflows + - JDK-8380222: Refactor test/jdk/java/lang/Character TestNG tests to JUnit + - JDK-8380316: Test runtime/os/AvailableProcessors.java fails Invalid argument + - JDK-8380428: ProblemList containers/docker/TestJcmdWithSideCar.java on linux-all + - JDK-8380474: Crash SEGV in ThreadIdTable::lazy_initialize after JDK-8323792 + - JDK-8380565: PPC64: deoptimization stub should save vector registers + - JDK-8380672: Improve certification checking + - JDK-8380947: Add pull request template + - JDK-8381039: Enhance AWT ImagingLib + - JDK-8381049: Enhance Jar handling + - JDK-8381205: GHA: Upgrade Node.js 20 to 24 + - JDK-8381315: compiler/vectorapi/TestVectorReallocation.java fails with -XX:UseAVX=1 after JDK-8380565 + - JDK-8381519: Enhance Der Value Handling + - JDK-8381796: Enhance Certificate parsing + - JDK-8382018: test/jdk/java/nio/file/spi/SetDefaultProvider.java leaves a directory in /tmp + - JDK-8382242: JFR: Metadata reconstruction invalidates ConstantMap for java.lang.String + - JDK-8382419: Add missed @key randomness after JDK-8370489 + - JDK-8383175: (tz) Update Timezone Data to 2026b + - JDK-8383185: [21u] Backport of JDK-8382925 causes test failure in SetDefaultProvider + - JDK-8383354: Update LCMS to 2.19.1 + - JDK-8383473: Follow on from tzdata2026b time change to include temporary hack BC time change + - JDK-8383601: RISC-V: ShenandoahBarrierSetAssembler::load_reference_barrier calls "weak" on "phantom" path + - JDK-8383630: Fix iteration in tests doing class redefinition + - JDK-8384158: GHA: Downgrade Windows GHA runners to windows-2022 temporarily + - JDK-8384486: NTLM tests fail on Windows 11 and Windows Server 2025 + - JDK-8384495: Update Libpng to 1.6.58 + - JDK-8384540: [25u, 21u, 17u] Update GHA JDKs after Apr/26 updates + - JDK-8384815: SelectOneKeyOutOfMany and PreferredKey fail after expired test certificate + - JDK-8384902: Update GIFlib to 6.1.3 + - JDK-8385390: Update FreeType to 2.14.3 + - JDK-8385490: Update HarfBuzz to 14.2.0 + - JDK-8386551: Windows build broken because of MSys2/Make update + +Notes on individual issues: +=========================== + +hotspot/gc: + +JDK-8212084: G1: Implement UseGCOverheadLimit +============================================= +In this release, the G1 garbage collector now respects the values of +`GCTimeLimit` and `GCHeapFreeLimit`. The garbage collector will throw +an `OutOfMemoryException` (OOME) when the garbage collection overhead +is more than `GCTimeLimit` percent (default: 98%) and the free Java +heap is less than `GCHeapFreeLimit` (default: 2%) for five consecutive +garbage collections. + +This feature is enabled by default. It may be disabled by specifying +the `-XX:-UseGCOverheadLimit` option. The implementation mirrors the +functionality already provided by the parallel garbage collector, +though there may be differences in the exact conditions when an OOME +is triggered, due to differences in the way the collectors calculate +the collection overhead and free Java heap. + +security-libs/java.security: + +JDK-8372351: Add 2 WISeKey roots +================================ +The following root certificates have been added to the cacerts +truststore: + +Alias Name: wisekeyglobalrootgbca +Distinguished Name: CN=OISTE WISeKey Global Root GB CA, OU=OISTE Foundation Endorsed, O=WISeKey, C=CH +Serial Number: 76b1205274f0858746b3f8231af6c2c0 +Valid From: Mon Dec 01 15:00:32 GMT 2014 +Valid Until: Thu Dec 01 15:10:31 GMT 2039 + +Alias Name: wisekeyglobalrootgcca +Distinguished Name: CN=OISTE WISeKey Global Root GC CA, OU=OISTE Foundation Endorsed, O=WISeKey, C=CH +Serial Number: 212a560caeda0cab4045bf2ba22d3aea +Valid From: Tue May 09 09:48:34 GMT 2017 +Valid Until: Fri May 09 09:58:33 GMT 2042 + +JDK-8381796: Enhance Certificate parsing +======================================== +With this release of OpenJDK, a security and system property +`com.sun.security.crl.maxSize` is introduced which acts as a maximum +size limit on a Certificate Revocation List (CRL) downloaded over the +network. For URICertStore requests, the value is the maximum size in +bytes of the DER-encoded CRL. For LDAPCertStore queries, the +threshold is the sum of all CRLs downloaded from a single search. By +default, the maximum size is 20MiB (20971520 bytes) and CRLs larger +than this will be discarded. A value less than zero may be used to +turn off the size limit and non-numeric values will be ignored. A +non-empty value for the system property takes precedence over the +security property. Enabling 'certpath' debug logging will output the +current size limit and note any discarded CRLs. + +New in release OpenJDK 21.0.11 (2026-04-21): +=========================================== +Live versions of these release notes can be found at: + * https://bit.ly/openjdk2111 + +* CVEs + - CVE-2026-22007 + - CVE-2026-22013 + - CVE-2026-22016 + - CVE-2026-22018 + - CVE-2026-22021 + - CVE-2026-23865 + - CVE-2026-34268 + - CVE-2026-34282 +* Changes + - JDK-6899304: java.awt.Toolkit.getScreenInsets(GraphicsConfiguration) returns incorrect values + - JDK-8030957: AIX: Implement OperatingSystemMXBean.getSystemCpuLoad() and .getProcessCpuLoad() on AIX + - JDK-8075917: The regression-swing case failed as the text on label is not painted red with the GTK L&F + - JDK-8114830: (fs) Files.copy fails due to interference from something else changing the file system + - JDK-8244336: Restrict algorithms at JCE layer + - JDK-8256289: java/awt/Focus/AppletInitialFocusTest/AppletInitialFocusTest1.java failed with "RuntimeException: Wrong focus owner: java.awt.Button[button1,41,36,56x23,label=Button1]" + - JDK-8287062: com/sun/jndi/ldap/LdapPoolTimeoutTest.java failed due to different timeout message + - JDK-8298153: Colored text is not shown on disabled checkbox and radio button with GTK LAF for bug4314194 + - JDK-8301875: java.util.TimeZone.getSystemTimeZoneID uses C library default file mode + - JDK-8313319: [linux] mmap should use MAP_FIXED_NOREPLACE if available + - JDK-8314555: Build with mawk fails on Windows + - JDK-8314810: (fs) java/nio/file/Files/CopyInterference.java should use TestUtil::supportsLinks + - JDK-8316274: javax/swing/ButtonGroup/TestButtonGroupFocusTraversal.java fails in Ubuntu 23.10 with Motif LAF + - JDK-8317633: Modernize text.testlib.HexDumpReader + - JDK-8317801: java/net/Socket/asyncClose/Race.java fails intermittently (aix) + - JDK-8317838: java/nio/channels/Channels/SocketChannelStreams.java running into timeout (aix) + - JDK-8318302: ThreadCountLimit.java failed with "Native memory allocation (mprotect) failed to protect 16384 bytes for memory to guard stack pages" + - JDK-8326897: (fs) The utility TestUtil.supportsLinks is wrongly used to check for hard link support + - JDK-8327114: Attach in Linux may have wrong behaviour when pid == ns_pid (Kubernetes debug container) + - JDK-8328608: Multiple NewSessionTicket support for TLS + - JDK-8329337: Problem list BufferStrategyExceptionTest.java on Windows + - JDK-8330016: Stress seed should be initialized for runtime stub compilation + - JDK-8331431: Update to use jtreg 7.4 + - JDK-8333386: TestAbortOnVMOperationTimeout test fails for client VM + - JDK-8333857: Test sun/security/ssl/SSLSessionImpl/ResumeChecksServer.java failed: Existing session was used + - JDK-8334670: SSLSocketOutputRecord buffer miscalculation + - JDK-8334738: os::print_hex_dump should optionally print ASCII + - JDK-8335646: Nimbus : JLabel not painted with LAF defined foreground color on Ubuntu 24.04 + - JDK-8335906: [s390x] Test Failure: GTestWrapper.java + - JDK-8336695: Update Commons BCEL to Version 6.10.0 + - JDK-8337102: JITTester: Fix breaks in static initialization blocks + - JDK-8339238: Update to use jtreg 7.5.1 + - JDK-8339271: giflib attribution correction + - JDK-8339791: Refactor MiscUndecorated/ActiveAWTWindowTest.java + - JDK-8341246: Test com/sun/tools/attach/PermissionTest.java fails access denied after JDK-8327114 + - JDK-8341310: Test TestJcmdWithSideCar.java should skip ACCESS_TMP_VIA_PROC_ROOT (after JDK-8327114) + - JDK-8342175: MemoryEaterMT fails intermittently with ExceptionInInitializerError + - JDK-8342449: reimplement: JDK-8327114 Attach in Linux may have wrong behavior when pid == ns_pid + - JDK-8343234: (bf) Move java/nio/Buffer/LimitDirectMemory.java from ProblemList.txt to ProblemList-Virtual.txt + - JDK-8343377: Performance regression in reflective invocation of native methods + - JDK-8343622: AesDkCrypto.stringToKey should not return null + - JDK-8345578: New test in JDK-8343622 fails with a promoted build + - JDK-8345668: ZoneOffset.ofTotalSeconds performance regression + - JDK-8346048: test/lib/containers/docker/DockerRunOptions.java uses addJavaOpts() from ctor + - JDK-8346962: Test CRLReadTimeout.java fails with -Xcomp on a fastdebug build + - JDK-8347475: GTK: javax/swing/JColorChooser/Test8152419.java there are no swatches or RGB tab in JColorChooser + - JDK-8348014: Enhance certificate processing + - JDK-8348309: MultiNST tests need more debugging and timing + - JDK-8349351: Combine Screen Inset Tests into a Single File + - JDK-8350103: Test containers/systemd/SystemdMemoryAwarenessTest.java fails on Linux ppc64le SLES15 SP6 + - JDK-8351000: StringBuilder getChar and putChar robustness + - JDK-8351458: (ch) Move preClose to UnixDispatcher + - JDK-8351639: Improve debuggability of test/langtools/jdk/jshell/JdiHangingListenExecutionControlTest.java test + - JDK-8353755: Add a helper method to Util - findComponent() + - JDK-8354057: Odd debug output in -Xlog:os+container=debug on certain systems + - JDK-8354145: G1: UseCompressedOops boundary is calculated on maximum heap region size instead of maxiumum ergonomic heap region size + - JDK-8354219: Automate javax/swing/JComboBox/ComboPopupBug.java + - JDK-8354469: Keytool exposes the password in plain text when command is piped using | grep + - JDK-8354559: gc/g1/TestAllocationFailure.java doesn't need WB API + - JDK-8354878: File Leak in CgroupSubsystemFactory::determine_type of cgroupSubsystem_linux.cpp:300 + - JDK-8354922: ZGC: Use MAP_FIXED_NOREPLACE when reserving memory + - JDK-8355278: Improve debuggability of com/sun/jndi/ldap/LdapPoolTimeoutTest.java test + - JDK-8355445: [java.nio] Use @requires tag instead of exiting based on "os.name" property value + - JDK-8355632: WhiteBox.waitForReferenceProcessing() fails assert for return type + - JDK-8356107: [java.lang] Use @requires tag instead of exiting based on os.name or separatorChar property + - JDK-8357141: Update to use jtreg 7.5.2 + - JDK-8357277: Update OpenSSL library for interop tests + - JDK-8357380: java/lang/StringBuilder/RacingSBThreads.java times out with C1 + - JDK-8358077: sun.tools.attach.VirtualMachineImpl::checkCatchesAndSendQuitTo on Linux leaks file handles after JDK-8327114 + - JDK-8358159: Empty mode/padding in cipher transformations + - JDK-8358751: C2: Recursive inlining check for compiled lambda forms is broken + - JDK-8359388: Stricter checking for cipher transformations + - JDK-8359827: Test runtime/Thread/ThreadCountLimit.java need loop increasing the limit + - JDK-8360539: DTLS handshakes fails due to improper cookie validation logic + - JDK-8361067: Test ExtraButtonDrag.java requires frame.dispose in finally block + - JDK-8361530: Test javax/swing/GraphicsConfigNotifier/StalePreferredSize.java timed out + - JDK-8361613: System.console() should only be available for interactive terminal + - JDK-8362834: Several runtime/Thread tests should mark as /native + - JDK-8363950: Incorrect jtreg header in TestLayoutVsICU.java + - JDK-8364373: Transform Affine transformations + - JDK-8364465: Enhance behavior of some intrinsics + - JDK-8364764: java/nio/channels/vthread/BlockingChannelOps.java subtests timed out + - JDK-8365526: Crash with null Symbol passed to SystemDictionary::resolve_or_null + - JDK-8365972: JFR: ThreadDump and ClassLoaderStatistics events may cause back to back rotations + - JDK-8366128: jdk/jdk/nio/zipfs/TestPosix.java::testJarFile uses wrong file + - JDK-8366261: Provide utility methods for sun.security.util.Password + - JDK-8366694: Test JdbStopInNotificationThreadTest.java timed out after 60 second + - JDK-8366817: test/jdk/javax/net/ssl/TLSCommon/interop/JdkProcServer.java and JdkProcClient.java should not delete logs + - JDK-8366850: Test com/sun/jdi/JdbStopInNotificationThreadTest.java failed + - JDK-8366866: SslRMIClientSocketFactory#createSocket lacking priviledges (securitymanger) + - JDK-8366938: Test runtime/handshake/HandshakeTimeoutTest.java crashed + - JDK-8367135: Test compiler/loopstripmining/CheckLoopStripMining.java needs internal timeouts adjusted + - JDK-8367583: sun/security/util/AlgorithmConstraints/InvalidCryptoDisabledAlgos.java fails after JDK-8244336 + - JDK-8367772: Refactor createUI in PassFailJFrame + - JDK-8368683: [process] Increase jtreg debug output maxOutputSize for TreeTest + - JDK-8368787: Error reporting: hs_err files should show instructions when referencing code in nmethods + - JDK-8368882: NPE during text drawing on machine with JP locale + - JDK-8369282: Distrust TLS server certificates anchored by Chunghwa ePKI Root CA + - JDK-8369575: Enhance crypto algorithm support + - JDK-8369858: Remove darcy author tags from jdk tests + - JDK-8369911: Test sun/java2d/marlin/ClipShapeTest.java#CubicDoDash, #Cubic and #Poly fail intermittent + - JDK-8370325: G1: Disallow GC for TLAB allocation + - JDK-8370529: Enhance Path Factories Redux + - JDK-8370572: Cgroups hierarchical memory limit is not honored after JDK-8322420 + - JDK-8370579: PPC: fix inswri immediate argument order + - JDK-8370615: Improve Kerberos credentialing + - JDK-8370636: com/sun/jdi/TwoThreadsTest.java should wait for completion of all threads + - JDK-8370966: Create regression test for the hierarchical memory limit fix in JDK-8370572 + - JDK-8370986: Enhance Zip file reading + - JDK-8370995: Enhance ZipFile usage + - JDK-8371103: vmTestbase/nsk/jvmti/scenarios/events/EM02/em02t006/TestDescription.java failing + - JDK-8371485: ProblemList awt/Mixing/AWT_Mixing/JTableInGlassPaneOverlapping.java for linux + - JDK-8371559: Intermittent timeouts in test javax/net/ssl/Stapling/HttpsUrlConnClient.java + - JDK-8371608: Jtreg test jdk/internal/vm/Continuation/Fuzz.java sometimes fails with (fast)debug binaries + - JDK-8371830: Enhance certificate chain validation + - JDK-8371889: [21u] JFR: Deadlock in ThrowableTracer + - JDK-8371935: Enhance key generation + - JDK-8371978: tools/jar/ReproducibleJar.java fails on XFS + - JDK-8372048: Performance improvement on Linux remote desktop + - JDK-8372321: TestBackToBackSensitive fails intermittently after JDK-8365972 + - JDK-8372348: Adjust some UL / JFR string deduplication output messages + - JDK-8372441: JFR: Improve logging of TestBackToBackSensitive + - JDK-8372464: Bump update version for OpenJDK: jdk-21.0.11 + - JDK-8372710: Update ProcessBuilder/Basic regex + - JDK-8372756: Mouse additional buttons and horizontal scrolling are broken on XWayland GNOME >= 47 after JDK-8351907 + - JDK-8372857: Improve debuggability of java/rmi/server/RemoteServer/AddrInUse.java test + - JDK-8372977: Unnecessary gthread-2.0 loading + - JDK-8372988: Test runtime/Nestmates/membership/TestNestHostErrorWithMultiThread.java failed: Unexpected interrupt + - JDK-8373290: Update FreeType to 2.14.1 + - JDK-8373476: (tz) Update Timezone Data to 2025c + - JDK-8373525: C2: assert(_base == Long) failed: Not a Long + - JDK-8373727: New XBM images parser regression: only the first line of the bitmap array is parsed + - JDK-8374056: RISC-V: Fix argument passing for the RiscvFlushIcache::flush + - JDK-8374178: Missing include in systemDictionary.cpp after JDK-8365526 + - JDK-8374209: [17u,21u] Backout JDK-8361748 due to JDK-8373727 + - JDK-8374433: java/util/Locale/PreserveTagCase.java does not run any tests + - JDK-8374555: No need for visible input warning in s.s.u.Password when not reading from System.in + - JDK-8374557: Enhance TLS connection handling + - JDK-8374642: EscapeHash macro fails with GNU make 4.3 and 4.4 + - JDK-8375057: Update HarfBuzz to 12.3.2 + - JDK-8375063: Update Libpng to 1.6.54 + - JDK-8375530: PPC64: incorrect quick verify_method_data_pointer check causes poor performance in debug build + - JDK-8375549: ConcurrentModificationException if jdk.crypto.disabledAlgorithms has multiple entries with known oid + - JDK-8375999: com/sun/jndi/ldap/LdapPoolTimeoutTest.java fails sporadically on Windows + - JDK-8376251: [macos] java/awt/Frame/I18NTitle.java fails on MacOS (JDK-8355884) + - JDK-8376270: [21u, 17u] Redo JDK-8361748: Enforce limits on the size of an XBM image + - JDK-8377509: Add licenses for gcc 14.2.0 + - JDK-8377526: Update Libpng to 1.6.55 + - JDK-8377905: gcc.md included with every build + - JDK-8378218: MSYS2 reports cygwin triplet causing bash configure failure + - JDK-8378631: Update Zlib Data Compression Library to Version 1.3.2 + - JDK-8378823: AIX build fails after zlib updated by JDK-8378631 + - JDK-8378853: [25u] Make backport of JDK-8244336 comply with differences in CSR + - JDK-8379035: (tz) Update Timezone Data to 2026a + - JDK-8379158: Update FreeType to 2.14.2 + - JDK-8379256: Update GIFlib to 6.1.1 + - JDK-8380078: Update GIFlib to 6.1.2 + - JDK-8380959: Update Libpng to 1.6.56 + - JDK-8382047: Update Libpng to 1.6.57 + - JDK-8382439: [21u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 21.0.11 + +Notes on individual issues: +=========================== + +security-libs/javax.net.ssl: + +JDK-8328608: Multiple NewSessionTicket support for TLS +====================================================== +With this release of OpenJDK, the number of TLSv1.3 resumption tickets +sent by a JSSE server per session can now be configured. The new +system property `jdk.tls.server.newSessionTicketCount` can be set to a +value in the range 0 to 10. The default is 1, which will also be used +if an invalid value is specified for the property. + +JDK-8369282: Distrust TLS server certificates anchored by Chunghwa ePKI Root CA +=============================================================================== +In accordance with similar plans recently announced by Google and +Mozilla, the JDK will not trust Transport Layer Security (TLS) +certificates issued after the 17th of March 2026 which are anchored by +Chungwa root certificates. + +Certificates issued on or before the 17th of March, 2026 will continue +to be trusted until they expire. + +If a server's certificate chain is anchored by an affected +certificate, attempts to negotiate a TLS session will fail with an +Exception that indicates the trust anchor is not trusted. For example, + +"TLS server certificate issued after 2026-03-17 and anchored by a +distrusted legacy Chungwa root CA: OU=ePKI Root Certification +Authority, O="Chunghwa Telecom Co.", Ltd. C=TW" + +To check whether a certificate in a JDK keystore is affected by this +change, you can the `keytool` utility: + +keytool -v -list -alias -keystore + +If any of the certificates in the chain are affected by this change, +then you will need to update the certificate or contact the +organisation responsible for managing the certificate. + +These restrictions apply to the following Chungwa root certificates +included in the JDK: + +Alias name: chunghwaepkirootca +OU=ePKI Root Certification Authority +O="Chunghwa Telecom Co., Ltd." +C=TW +SHA256:A6:F4:DC:63:A2:4B:FD:CF:54:EF:2A:6A:08:2A:0A:72:DE:35:80:3E:2F:F5:FF:52:7A:E5:D8:72:06:DF:D5 + +Users can, *at their own risk*, remove this restriction by modifying +the `java.security` configuration file (or override it by using the +`java.security.properties` system property) so "CHUNGWA_TLS" is no +longer listed in the `jdk.security.caDistrustPolicies` security +property. + +hotspot/jfr: + +JDK-8365972: JFR: ThreadDump and ClassLoaderStatistics events may cause back to back rotations +============================================================================================== +In previous OpenJDK releases, the `jdk.ThreadDump` and +`jdk.ClassLoaderStatistics` events were written at the beginning of a +new file created by a file rotation. However, in applications with +many threads (typically more than a thousand), deep Java stacks +(typically more than three hundred frames) or many class loaders +(typically hundreds of thousands), the size of these events alone +could trigger a further file rotation within one second. This causes +other relevant data to be flushed out very quickly (e.g. about fifteen +seconds if using the default 250MB max file size). In this release, +these events are only written when a recording starts and at the end +of a file rotation. + +security-libs/java.security: + +JDK-8244336: Restrict algorithms at JCE layer +============================================= +A security property named `jdk.crypto.disabledAlgorithms` has been +added that can be used to disable JCE/JCA cryptographic services. The +property accepts a comma-separated list of services, specified as +Service.AlgorithName. The current list of supported services is +`Cipher`, `KeyStore`, `MessageDigest` and `Signature`. Algorithms +should be drawn from those specified by the Java Security Standard +Algorithm Names Specification [0]. For example: + +jdk.crypto.disabledAlgorithms=Cipher.RSA/ECB/PKCS1Padding, MessageDigest.MD2 + +would disable the RSA cipher when used with the ECB cipher algorithm +mode and PKCS #1 algorithm padding, and the MD2 message digest +algorithm. + +The default value for this security property is empty, which means +that no algorithms are disabled out-of-the-box. The value of the +security property specified in `java.security` can be overridden by +specifying a system property of the same name, +`jdk.crypto.disabledAlgorithms`. With the above example in place in +`java.security`, running `java` as: + +$ java -Djdk.crypto.disabledAlgorithms= + +would cause these algorithms to be enabled for that run of the Java +virtual machine. + +[0] https://docs.oracle.com/en/java/javase/25/docs/specs/security/standard-names.html + +JDK-8354469: Keytool exposes the password in plain text when command is piped using | grep +========================================================================================== +The `keytool` and `jarsigner` commands read passwords using the system +console with echoing disabled to avoid them being displayed on screen. +However, the system console is usually only available when both the +standard input and standard output have *not* been redirected. In +previous OpenJDK releases, running these tools with input or output +redirected would cause the password to be echoed to the screen in +plain text. With this release, echoing no longer takes place in such +scenarios when using these tools or the JAAS `TextCallbackHandler` +API. + New in release OpenJDK 21.0.10 (2026-01-20): =========================================== Live versions of these release notes can be found at: diff --git a/TestTranslations.java b/TestTranslations.java index f6a4fe2..66d0d6f 100644 --- a/TestTranslations.java +++ b/TestTranslations.java @@ -1,5 +1,5 @@ /* TestTranslations -- Ensure translations are available for new timezones - Copyright (C) 2022 Red Hat, Inc. + Copyright (C) 2026 Red Hat, Inc. This program is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as @@ -60,15 +60,34 @@ public class TestTranslations { public static void main(String[] args) { + boolean debug = false; + if (args.length < 1) { System.err.println("Test must be started with the name of the locale provider."); System.exit(1); } + if (args.length > 1) { + debug = Boolean.parseBoolean(args[1]); + } + + System.err.printf("Debugging: %s\n", debug); + + testZoneStrings(debug); + + String localeProvider = args[0]; + testZone(localeProvider, KYIV, + new String[] { "Europe/Kiev", "Europe/Kyiv", "Europe/Uzhgorod", "Europe/Zaporozhye" }); + testZone(localeProvider, CIUDAD_JUAREZ, + new String[] { "America/Cambridge_Bay", "America/Ciudad_Juarez" }); + } + + private static void testZoneStrings(final boolean debug) { System.out.println("Checking sanity of full zone string set..."); boolean invalid = Arrays.stream(Locale.getAvailableLocales()) - .peek(l -> System.out.println("Locale: " + l)) + .peek(l -> System.out.printf(debug ? "Locale: %s\n" : "", l)) .map(l -> DateFormatSymbols.getInstance(l).getZoneStrings()) + .peek(df -> System.out.printf(debug ? "Zone string size: %s\n" : "", df.length)) .flatMap(zs -> Arrays.stream(zs)) .flatMap(names -> Arrays.stream(names)) .filter(name -> Objects.isNull(name) || name.isEmpty()) @@ -78,12 +97,6 @@ public class TestTranslations { System.err.println("Zone string for a locale returned null or empty string"); System.exit(2); } - - String localeProvider = args[0]; - testZone(localeProvider, KYIV, - new String[] { "Europe/Kiev", "Europe/Kyiv", "Europe/Uzhgorod", "Europe/Zaporozhye" }); - testZone(localeProvider, CIUDAD_JUAREZ, - new String[] { "America/Cambridge_Bay", "America/Ciudad_Juarez" }); } private static void testZone(String localeProvider, Map exp, String[] ids) { diff --git a/fips-21u-a0fd6e8ed6e.patch b/fips-21u-feef2dc3ca7.patch similarity index 99% rename from fips-21u-a0fd6e8ed6e.patch rename to fips-21u-feef2dc3ca7.patch index 2db9580..1aba133 100644 --- a/fips-21u-a0fd6e8ed6e.patch +++ b/fips-21u-feef2dc3ca7.patch @@ -208,7 +208,7 @@ index 1e0f66726d0..59fe923f2c5 100644 # Create the symbols file for static builds. diff --git a/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java b/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java -index 10093137151..b023c63ae58 100644 +index 6a4e28372e5..6d06f69c50f 100644 --- a/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java +++ b/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java @@ -31,6 +31,7 @@ import java.security.SecureRandom; @@ -230,10 +230,16 @@ index 10093137151..b023c63ae58 100644 @java.io.Serial private static final long serialVersionUID = 6812507587804302833L; -@@ -147,298 +152,299 @@ public final class SunJCE extends Provider { +@@ -147,301 +152,302 @@ public final class SunJCE extends Provider { void putEntries() { // reuse attribute map and reset before each reuse HashMap attrs = new HashMap<>(3); +- attrs.put("SupportedKeyClasses", +- "java.security.interfaces.RSAPublicKey" + +- "|java.security.interfaces.RSAPrivateKey"); +- ps("Signature", "NONEwithRSA", +- "com.sun.crypto.provider.RSACipherAdaptor", null, attrs); +- // continue adding cipher specific attributes - attrs.put("SupportedModes", "ECB"); - attrs.put("SupportedPaddings", "NOPADDING|PKCS1PADDING|OAEPPADDING" - + "|OAEPWITHMD5ANDMGF1PADDING" @@ -245,9 +251,6 @@ index 10093137151..b023c63ae58 100644 - + "|OAEPWITHSHA-512ANDMGF1PADDING" - + "|OAEPWITHSHA-512/224ANDMGF1PADDING" - + "|OAEPWITHSHA-512/256ANDMGF1PADDING"); -- attrs.put("SupportedKeyClasses", -- "java.security.interfaces.RSAPublicKey" + -- "|java.security.interfaces.RSAPrivateKey"); - ps("Cipher", "RSA", - "com.sun.crypto.provider.RSACipher", null, attrs); - @@ -527,6 +530,12 @@ index 10093137151..b023c63ae58 100644 - "com.sun.crypto.provider.DHKeyPairGenerator", - null); + if (!systemFipsEnabled) { ++ attrs.put("SupportedKeyClasses", ++ "java.security.interfaces.RSAPublicKey" + ++ "|java.security.interfaces.RSAPrivateKey"); ++ ps("Signature", "NONEwithRSA", ++ "com.sun.crypto.provider.RSACipherAdaptor", null, attrs); ++ // continue adding cipher specific attributes + attrs.put("SupportedModes", "ECB"); + attrs.put("SupportedPaddings", "NOPADDING|PKCS1PADDING|OAEPPADDING" + + "|OAEPWITHMD5ANDMGF1PADDING" @@ -538,9 +547,6 @@ index 10093137151..b023c63ae58 100644 + + "|OAEPWITHSHA-512ANDMGF1PADDING" + + "|OAEPWITHSHA-512/224ANDMGF1PADDING" + + "|OAEPWITHSHA-512/256ANDMGF1PADDING"); -+ attrs.put("SupportedKeyClasses", -+ "java.security.interfaces.RSAPublicKey" + -+ "|java.security.interfaces.RSAPrivateKey"); + ps("Cipher", "RSA", + "com.sun.crypto.provider.RSACipher", null, attrs); + @@ -822,7 +828,7 @@ index 10093137151..b023c63ae58 100644 /* * Algorithm parameter generation engines -@@ -447,15 +453,17 @@ public final class SunJCE extends Provider { +@@ -450,15 +456,17 @@ public final class SunJCE extends Provider { "DiffieHellman", "com.sun.crypto.provider.DHParameterGenerator", null); @@ -849,7 +855,7 @@ index 10093137151..b023c63ae58 100644 /* * Algorithm Parameter engines -@@ -625,10 +633,10 @@ public final class SunJCE extends Provider { +@@ -628,10 +636,10 @@ public final class SunJCE extends Provider { "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512AndAES_128"); ps("SecretKeyFactory", "PBEWithHmacSHA512/224AndAES_128", @@ -862,7 +868,7 @@ index 10093137151..b023c63ae58 100644 ps("SecretKeyFactory", "PBEWithHmacSHA1AndAES_256", "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA1AndAES_256"); -@@ -651,136 +659,137 @@ public final class SunJCE extends Provider { +@@ -654,136 +662,137 @@ public final class SunJCE extends Provider { ps("SecretKeyFactory", "PBEWithHmacSHA512/256AndAES_256", "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_256AndAES_256"); @@ -1979,7 +1985,7 @@ index 539ef1e8ee8..435f57e3ff2 100644 "sun.security.rsa.PSSParameters", null); } diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security -index 6b0fd201b9b..2af4e3a3e21 100644 +index be473e3f895..1d5cb17e492 100644 --- a/src/java.base/share/conf/security/java.security +++ b/src/java.base/share/conf/security/java.security @@ -85,6 +85,17 @@ security.provider.tbd=Apple @@ -3011,7 +3017,7 @@ index f8dd5a71c2c..6423805d164 100644 } - diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java -index 0a62021633f..0723b69c2bc 100644 +index aaafc373f80..6466581f4ae 100644 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java @@ -26,6 +26,9 @@ @@ -3141,7 +3147,7 @@ index 0a62021633f..0723b69c2bc 100644 } p11 = tmpPKCS11; -@@ -1388,11 +1460,52 @@ public final class SunPKCS11 extends AuthProvider { +@@ -1390,11 +1462,52 @@ public final class SunPKCS11 extends AuthProvider { } @Override @@ -3194,7 +3200,7 @@ index 0a62021633f..0723b69c2bc 100644 try { return newInstance0(param); } catch (PKCS11Exception e) { -@@ -1749,6 +1862,9 @@ public final class SunPKCS11 extends AuthProvider { +@@ -1753,6 +1866,9 @@ public final class SunPKCS11 extends AuthProvider { try { session = token.getOpSession(); p11.C_Logout(session.id()); diff --git a/java-21-openjdk-portable.specfile b/java-21-openjdk-portable.specfile index 6c22ff7..16490ae 100644 --- a/java-21-openjdk-portable.specfile +++ b/java-21-openjdk-portable.specfile @@ -1,5 +1,109 @@ -# debug_package %%{nil} is portable-jdks specific -%define debug_package %{nil} +# New Version-String scheme-style defines +%global featurever 21 +%global interimver 0 +%global updatever 12 +%global patchver 1 +%global buildver 1 +%global portablerelease 2 +%global rpmrelease 0 + +# Define IcedTea version used for SystemTap tapsets and desktop file +%global icedteaver 6.0.0pre00-c848b93a8598 +# Define current Git revision for the FIPS support patches +%global fipsver feef2dc3ca7 +# Define JDK versions +%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver} +%global javaver %{featurever} +# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames +%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn}) +# The tag used to create the OpenJDK tarball +%global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}} + +# Standard JPackage naming and versioning defines +%global origin openjdk +%global origin_nice OpenJDK +%global top_level_dir_name %{vcstag} +%global top_level_dir_name_backup %{top_level_dir_name}-backup +# Define an optional suffix for the OS this package is built on +# The portable package is intended to be built on either RHEL 8 +# or CentOS Stream 9; any other OS will automatically get an +# appropriate suffix +%global rhel_buildos 8 +%global centos_buildos 9 +%if 0%{?centos} == 0 && 0%{?rhel} != 0%{rhel_buildos} +%global pkgos rhel%{?rhel} +%endif +%if 0%{?centos} != 0 && 0%{?centos} != 0%{centos_buildos} +%global pkgos rhel%{?centos} +%endif +%if 0%{?almalinux} +%undefine pkgos +%endif + +# Define milestone (EA for pre-releases, GA for releases) +# Release will be (where N is usually a number starting at 1): +# - 0.N.ea for EA releases, +# - N for GA releases +%global is_ga 1 +%if %{is_ga} +%global build_type GA +%global ea_designator "" +%global ea_designator_zip %{nil} +%global extraver %{nil} +%global eaprefix %{nil} +%else +%global build_type EA +%global ea_designator ea +%global ea_designator_zip -%{ea_designator} +%global extraver .%{ea_designator} +%global eaprefix 0. +%endif + +%global compatiblename java-%{javaver}-%{origin} + +Name: %{compatiblename}-portable%{?pkgos:-%{pkgos}} +Version: %{newjavaver}.%{buildver} +Release: %{?eaprefix}%{portablerelease}.%{rpmrelease}%{?extraver}%{?dist} + +%global fullversion %{compatiblename}-%{version}-%{release} + +# java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons +# and this change was brought into RHEL-4. java-1.5.0-ibm packages +# also included the epoch in their virtual provides. This created a +# situation where in-the-wild java-1.5.0-ibm packages provided "java = +# 1:1.5.0". In RPM terms, "1.6.0 < 1:1.5.0" since 1.6.0 is +# interpreted as 0:1.6.0. So the "java >= 1.6.0" requirement would be +# satisfied by the 1:1.5.0 packages. Thus we need to set the epoch in +# JDK package >= 1.6.0 to 1, and packages referring to JDK virtual +# provides >= 1.6.0 must specify the epoch, "java >= 1:1.6.0". +Epoch: 1 +Summary: %{origin_nice} %{featurever} Runtime Environment portable edition +# Groups are only used up to RHEL 8 and on Fedora versions prior to F30 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) +Group: Development/Languages +%endif + +# HotSpot code is licensed under GPLv2 +# JDK library code is licensed under GPLv2 with the Classpath exception +# The Apache license is used in code taken from Apache projects (primarily xalan & xerces) +# DOM levels 2 & 3 and the XML digital signature schemas are licensed under the W3C Software License +# The JSR166 concurrency code is in the public domain +# The BSD and MIT licenses are used for a number of third-party libraries (see ADDITIONAL_LICENSE_INFO) +# The OpenJDK source tree includes: +# - JPEG library (IJG), zlib & libpng (zlib), giflib (MIT), harfbuzz (ISC), +# - freetype (FTL), jline (BSD) and LCMS (MIT) +# - jquery (MIT), jdk.crypto.cryptoki PKCS 11 wrapper (RSA) +# - public_suffix_list.dat from publicsuffix.org (MPLv2.0) +# The test code includes copies of NSS under the Mozilla Public License v2.0 +# The PCSClite headers are under a BSD with advertising license +# The elliptic curve cryptography (ECC) source code is licensed under the LGPLv2.1 or any later version +License: ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA +URL: http://openjdk.java.net/ + +# We are producing RPMs containing only tarballs +# and checksums so there are no binaries outside +# the tarballs to be processed for debuginfo +%define debug_package %{nil} # RPM conditionals so as to be able to dynamically produce # slowdebug/release builds. See: @@ -96,25 +200,6 @@ %global normal_build %{nil} %endif -# We have hardcoded list of files, which is appearing in alternatives, and in files -# in alternatives those are slaves and master, very often triplicated by man pages -# in files all masters and slaves are ghosted -# the ghosts are here to allow installation via query like `dnf install /usr/bin/java` -# you can list those files, with appropriate sections: cat *.spec | grep -e --install -e --slave -e post_ -# TODO - fix those hardcoded lists via single list -# Those files must *NOT* be ghosted for *slowdebug* packages -# FIXME - if you are moving jshell or jlink or similar, always modify all three sections -# you can check via headless and devels: -# rpm -ql --noghost java-11-openjdk-headless-11.0.1.13-8.fc29.x86_64.rpm | grep bin -# == rpm -ql java-11-openjdk-headless-slowdebug-11.0.1.13-8.fc29.x86_64.rpm | grep bin -# != rpm -ql java-11-openjdk-headless-11.0.1.13-8.fc29.x86_64.rpm | grep bin -# similarly for other %%{_jvmdir}/{jre,java} and %%{_javadocdir}/{java,java-zip} -%define is_release_build() %( if [ "%{?1}" == "%{debug_suffix_unquoted}" -o "%{?1}" == "%{fastdebug_suffix_unquoted}" ]; then echo "0" ; else echo "1"; fi ) - -# while JDK is a techpreview(is_system_jdk=0), some provides are turned off. Once jdk stops to be an techpreview, move it to 1 -# as sytem JDK, we mean any JDK which can run whole system java stack without issues (like bytecode issues, module issues, dependencies...) -%global is_system_jdk 0 - %global aarch64 aarch64 arm64 armv8 # we need to distinguish between big and little endian PPC64 %global ppc64le ppc64le @@ -161,7 +246,7 @@ # Set of architectures for which we have a devkit # Only used on RHEL %if 0%{?centos} == 0 -%global devkit_arches %{aarch64} %{ppc64le} riscv64 s390x x86_64 +%global devkit_arches %{aarch64} %{ppc64le} s390x x86_64 %endif # By default, we build a slowdebug build during main build on JIT architectures @@ -326,17 +411,14 @@ %global with_systemtap 0 %endif -# New Version-String scheme-style defines -%global featurever 21 -%global interimver 0 -%global updatever 10 -%global patchver 0 -# buildjdkver is usually same as %%{featurever}, -# but in time of bootstrap of next jdk, it is featurever-1, + +# buildjdkver is usually same as featurever, +# but at the time of bootstrap of the next jdk, it is featurever-1, # and this it is better to change it here, on single place %global buildjdkver %{featurever} + # We don't add any LTS designator for STS packages (Fedora and EPEL). -# We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined. +# We need to explicitly exclude EPEL as it has the rhel macro defined. %if 0%{?rhel} && !0%{?epel} %global lts_designator "LTS" %global lts_designator_zip -%{lts_designator} @@ -345,7 +427,7 @@ %global lts_designator_zip "" %endif # JDK to use for bootstrapping -%global bootjdk /usr/lib/jvm/java-%{buildjdkver}-openjdk +%global bootjdk /usr/lib/jvm/java-%{featurever}-openjdk # Define whether to use the bootstrap JDK directly or with a fresh libjvm.so # This will only work where the bootstrap JDK is the same major version # as the JDK being built @@ -358,7 +440,8 @@ # Define vendor information used by OpenJDK %global oj_vendor Red Hat, Inc. %global oj_vendor_url https://www.redhat.com/ -# Define what url should JVM offer in case of a crash report + +# Define what url the JVM should offer in case of a crash report # order may be important, epel may have rhel declared %if 0%{?epel} %global oj_vendor_bug_url https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora%20EPEL&component=%{name}&version=epel%{epel} @@ -374,67 +457,13 @@ %endif %endif %endif -%global oj_vendor_version (Red_Hat-%{version}-%{rpmrelease}) +%global oj_vendor_version (Red_Hat-%{version}-%{portablerelease}) -# Define IcedTea version used for SystemTap tapsets and desktop file -%global icedteaver 6.0.0pre00-c848b93a8598 -# Define current Git revision for the FIPS support patches -%global fipsver a0fd6e8ed6e -# Define JDK versions -%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver} -%global javaver %{featurever} -# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames -%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn}) -# The tag used to create the OpenJDK tarball -%global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}} - -# Standard JPackage naming and versioning defines -%global origin openjdk -%global origin_nice OpenJDK -%global top_level_dir_name %{vcstag} -%global top_level_dir_name_backup %{top_level_dir_name}-backup -%global buildver 7 -%global rpmrelease 1 -#%%global tagsuffix %%{nil} -# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit -%if %is_system_jdk -# Using 10 digits may overflow the int used for priority, so we combine the patch and build versions -# It is very unlikely we will ever have a patch version > 4 or a build version > 20, so we combine as (patch * 20) + build. -# This means 11.0.9.0+11 would have had a priority of 11000911 as before -# A 11.0.9.1+1 would have had a priority of 11000921 (20 * 1 + 1), thus ensuring it is bigger than 11.0.9.0+11 -%global combiver $( expr 20 '*' %{patchver} + %{buildver} ) -%global priority %( printf '%02d%02d%02d%02d' %{featurever} %{interimver} %{updatever} %{combiver} ) -%else -# for techpreview, using 1, so slowdebugs can have 0 -%global priority %( printf '%08d' 1 ) -%endif - -# Define milestone (EA for pre-releases, GA for releases) -# Release will be (where N is usually a number starting at 1): -# - 0.N%%{?extraver}%%{?dist} for EA releases, -# - N%%{?extraver}{?dist} for GA releases -%global is_ga 1 -%if %{is_ga} -%global build_type GA -%global ea_designator "" -%global ea_designator_zip %{nil} -%global extraver %{nil} -%global eaprefix %{nil} -%else -%global build_type EA -%global ea_designator ea -%global ea_designator_zip -%{ea_designator} -%global extraver .%{ea_designator} -%global eaprefix 0. -%endif - -# parametrized macros are order-sensitive -%global compatiblename java-%{featurever}-%{origin} -%global fullversion %{compatiblename}-%{version}-%{release} # images directories from upstream build %global jdkimage jdk %global static_libs_image static-libs # output dir stub +# Parameterised macros are order-sensitive %define buildoutputdir() %{expand:build/jdk%{featurever}.build%{?1}} %define installoutputdir() %{expand:install/jdk%{featurever}.install%{?1}} %global altjavaoutputdir install/altjava.install @@ -445,46 +474,30 @@ %define uniquesuffix() %{expand:%{fullversion}.%{_arch}%{?1}} # portable only declarations %global jreimage jre -%define jreportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}\\(_[0-9]\\)*;portable%{1}.jre;g") -%define jdkportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}\\(_[0-9]\\)*;portable%{1}.jdk;g") -%define staticlibsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}\\(_[0-9]\\)*;portable%{1}.static-libs;g") -%define jreportablearchive() %{expand:%{jreportablenameimpl -- %%{1}}.tar.xz} -%define jdkportablearchive() %{expand:%{jdkportablenameimpl -- %%{1}}.tar.xz} -%define staticlibsportablearchive() %{expand:%{staticlibsportablenameimpl -- %%{1}}.tar.xz} +%define jreportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}[^.]*;portable%{1}.jre;g") +%define jdkportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}[^.]*;portable%{1}.jdk;g") +%define staticlibsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}[^.]*;portable%{1}.static-libs;g") + # RPM 4.19 no longer accept our double percentaged %%{nil} passed to %%{1} -# so we have to pass in "" but evaluate it, otherwise files record will include it -%define jreportablearchiveForFiles() %(echo %{jreportablearchive -- ""}) -%define jdkportablearchiveForFiles() %(echo %{jdkportablearchive -- ""}) -%define staticlibsportablearchiveForFiles() %(echo %{staticlibsportablearchive -- ""}) +# so we have to pass in "" but evaluate it, otherwise files will include it +%define jreportablearchive() %{expand:%{jreportablenameimpl -- %%{1}}.tar.xz} +%define jreportablearchive_for_files() %(echo %{jreportablearchive -- ""}) +%define jdkportablearchive() %{expand:%{jdkportablenameimpl -- %%{1}}.tar.xz} +%define jdkportablearchive_for_files() %(echo %{jdkportablearchive -- ""}) +%define staticlibsportablearchive() %{expand:%{staticlibsportablenameimpl -- %%{1}}.tar.xz} +%define staticlibsportablearchive_for_files() %(echo %{staticlibsportablearchive -- ""}) + %define jreportablename() %{expand:%{jreportablenameimpl -- %%{1}}} %define jdkportablename() %{expand:%{jdkportablenameimpl -- %%{1}}} -# Intentionally use jdkportablenameimpl here since we want to have static-libs files overlayed on -# top of the JDK archive +# We intentionally use jdkportablenameimpl here since we want to have +# static-libs files overlayed on top of the JDK archive %define staticlibsportablename() %{expand:%{jdkportablenameimpl -- %%{1}}} -%define docportablename() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}\\(_[0-9]\\)*;portable.docs;g") -%define docportablearchive() %{docportablename}.tar.xz -%define miscportablename() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}\\(_[0-9]\\)*;portable.misc;g") -%define miscportablearchive() %{miscportablename}.tar.xz -################################################################# -# fix for https://bugzilla.redhat.com/show_bug.cgi?id=1111349 -# https://bugzilla.redhat.com/show_bug.cgi?id=1590796#c14 -# https://bugzilla.redhat.com/show_bug.cgi?id=1655938 -%global _privatelibs libsplashscreen[.]so.*|libawt_xawt[.]so.*|libjli[.]so.*|libattach[.]so.*|libawt[.]so.*|libextnet[.]so.*|libawt_headless[.]so.*|libdt_socket[.]so.*|libfontmanager[.]so.*|libinstrument[.]so.*|libj2gss[.]so.*|libj2pcsc[.]so.*|libj2pkcs11[.]so.*|libjaas[.]so.*|libjavajpeg[.]so.*|libjdwp[.]so.*|libjimage[.]so.*|libjsound[.]so.*|liblcms[.]so.*|libmanagement[.]so.*|libmanagement_agent[.]so.*|libmanagement_ext[.]so.*|libmlib_image[.]so.*|libnet[.]so.*|libnio[.]so.*|libprefs[.]so.*|librmi[.]so.*|libsaproc[.]so.*|libsctp[.]so.*|libsystemconf[.]so.*|libzip[.]so.*%{freetype_lib} -%global _publiclibs libjawt[.]so.*|libjava[.]so.*|libjvm[.]so.*|libverify[.]so.*|libjsig[.]so.* -%if %is_system_jdk -%global __provides_exclude ^(%{_privatelibs})$ -%global __requires_exclude ^(%{_privatelibs})$ -# Never generate lib-style provides/requires for slowdebug packages -%global __provides_exclude_from ^.*/%{uniquesuffix -- %{debug_suffix_unquoted}}/.*$ -%global __requires_exclude_from ^.*/%{uniquesuffix -- %{debug_suffix_unquoted}}/.*$ -%global __provides_exclude_from ^.*/%{uniquesuffix -- %{fastdebug_suffix_unquoted}}/.*$ -%global __requires_exclude_from ^.*/%{uniquesuffix -- %{fastdebug_suffix_unquoted}}/.*$ -%else -# Don't generate provides/requires for JDK provided shared libraries at all. -%global __provides_exclude ^(%{_privatelibs}|%{_publiclibs})$ -%global __requires_exclude ^(%{_privatelibs}|%{_publiclibs})$ -%endif +# These macros are not parameterised as the same is shared by all builds +%define docportablename() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}[^.]*;portable.docs;g") +%define docportablearchive() %{docportablename}.tar.xz +%define miscportablename() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}[^.]*;portable.misc;g") +%define miscportablearchive() %{miscportablename}.tar.xz # VM variant being built %ifarch %{zero_arches} @@ -493,28 +506,11 @@ %global vm_variant server %endif -%global etcjavasubdir %{_sysconfdir}/java/java-%{javaver}-%{origin} -%define etcjavadir() %{expand:%{etcjavasubdir}/%{uniquesuffix -- %{?1}}} -# Standard JPackage directories and symbolic links. -%define sdkdir() %{expand:%{uniquesuffix -- %{?1}}} -%define jrelnk() %{expand:jre-%{javaver}-%{origin}-%{version}-%{release}.%{_arch}%{?1}} - -%define sdkbindir() %{expand:%{_jvmdir}/%{sdkdir -- %{?1}}/bin} -%define jrebindir() %{expand:%{_jvmdir}/%{sdkdir -- %{?1}}/bin} - %global alt_java_name alt-java %global devkit_name %{origin}-devkit %global rpm_state_dir %{_localstatedir}/lib/rpm-state/ -# For flatpack builds hard-code /usr/sbin/alternatives, -# otherwise use %%{_sbindir} relative path. -%if 0%{?flatpak} -%global alternatives_requires /usr/sbin/alternatives -%else -%global alternatives_requires %{_sbindir}/alternatives -%endif - # Portables have no repo (requires/provides), but these are awesome for orientation in spec # Also scriptlets are happily missing and files are handled old fashion # not-duplicated requires/provides/obsoletes for normal/debug packages @@ -539,63 +535,27 @@ # Prevent brp-java-repack-jars from being run %global __jar_repack 0 -# Define an optional suffix for the OS this package is built on -%if 0%{?rhel} == 7 -%global pkgos rhel7 -%endif - # Define the architectures on which we build # On RHEL, this should be the architectures with a devkit +# The exception is riscv64, which was introduced too recently +# for a devkit to exist. In that case, we build without devkit %if 0%{?centos} == 0 -ExclusiveArch: %{devkit_arches} +%if 0%{?rhel} >= 10 +ExclusiveArch: %{devkit_arches} riscv64 %else -ExclusiveArch: %{aarch64} %{ppc64le} riscv64 s390x x86_64 +ExclusiveArch: %{devkit_arches} %endif - -Name: java-%{javaver}-%{origin}-portable%{?pkgos:-%{pkgos}} -Version: %{newjavaver}.%{buildver} -Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist} -# java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons -# and this change was brought into RHEL-4. java-1.5.0-ibm packages -# also included the epoch in their virtual provides. This created a -# situation where in-the-wild java-1.5.0-ibm packages provided "java = -# 1:1.5.0". In RPM terms, "1.6.0 < 1:1.5.0" since 1.6.0 is -# interpreted as 0:1.6.0. So the "java >= 1.6.0" requirement would be -# satisfied by the 1:1.5.0 packages. Thus we need to set the epoch in -# JDK package >= 1.6.0 to 1, and packages referring to JDK virtual -# provides >= 1.6.0 must specify the epoch, "java >= 1:1.6.0". - -Epoch: 1 -Summary: %{origin_nice} %{featurever} Runtime Environment portable edition -# Groups are only used up to RHEL 8 and on Fedora versions prior to F30 -%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) -Group: Development/Languages +%else +ExclusiveArch: %{aarch64} %{ppc64le} s390x x86_64 riscv64 %endif -# HotSpot code is licensed under GPLv2 -# JDK library code is licensed under GPLv2 with the Classpath exception -# The Apache license is used in code taken from Apache projects (primarily xalan & xerces) -# DOM levels 2 & 3 and the XML digital signature schemas are licensed under the W3C Software License -# The JSR166 concurrency code is in the public domain -# The BSD and MIT licenses are used for a number of third-party libraries (see ADDITIONAL_LICENSE_INFO) -# The OpenJDK source tree includes: -# - JPEG library (IJG), zlib & libpng (zlib), giflib (MIT), harfbuzz (ISC), -# - freetype (FTL), jline (BSD) and LCMS (MIT) -# - jquery (MIT), jdk.crypto.cryptoki PKCS 11 wrapper (RSA) -# - public_suffix_list.dat from publicsuffix.org (MPLv2.0) -# The test code includes copies of NSS under the Mozilla Public License v2.0 -# The PCSClite headers are under a BSD with advertising license -# The elliptic curve cryptography (ECC) source code is licensed under the LGPLv2.1 or any later version -License: ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA -URL: http://openjdk.java.net/ - # The source tarball, generated using generate_source_tarball.sh Source0: https://openjdk-sources.osci.io/openjdk%{featurever}/open%{vcstag}%{ea_designator_zip}.tar.xz # Use 'icedtea_sync.sh' to update the following # They are based on code contained in the IcedTea project (6.x). # Systemtap tapsets. Zipped up to keep it small. -Source8: tapsets-icedtea-%%{icedteaver}.tar.xz +Source8: tapsets-icedtea-%{icedteaver}.tar.xz # Desktop files. Adapted from IcedTea # Disabled in portables @@ -631,9 +591,11 @@ Source18: TestTranslations.java # ############################################ # Crypto policy and FIPS support patches + # Patch is generated from the fips-21u tree at https://github.com/rh-openjdk/jdk/tree/fips-21u -# as follows: git diff %%{vcstag} src make test > fips-21u-$(git show -s --format=%h HEAD).patch +# as follows: git diff src make test > fips-21u-$(git show -s --format=%h HEAD).patch # Diff is limited to src and make subdirectories to exclude .github changes + # Fixes currently included: # PR3183, RH1340845: Follow system wide crypto policy # PR3695: Allow use of system crypto policy to be disabled by the user @@ -675,7 +637,8 @@ Patch1001: fips-%{featurever}u-%{fipsver}.patch # ############################################# -# Currently empty +# JDK-8375294: (fs) Files.copy can fail with EOPNOTSUPP when copy_file_range not supported +Patch2001: jdk8375294-handle-EOPNOTSUPP-in-copying.patch ############################################# # @@ -737,7 +700,7 @@ BuildRequires: zip BuildRequires: tar BuildRequires: unzip BuildRequires: javapackages-filesystem -BuildRequires: java-%{buildjdkver}-%{origin}%{?pkgos:-%{pkgos}}-devel +BuildRequires: java-%{buildjdkver}-%{origin}-devel # Zero-assembler build requirement %ifarch %{zero_arches} BuildRequires: libffi-devel @@ -766,19 +729,19 @@ BuildRequires: libpng-devel BuildRequires: zlib-devel %else # Version in src/java.desktop/share/native/libfreetype/include/freetype/freetype.h -Provides: bundled(freetype) = 2.13.3 +Provides: bundled(freetype) = 2.14.3 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h -Provides: bundled(giflib) = 5.2.2 +Provides: bundled(giflib) = 6.1.3 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h -Provides: bundled(harfbuzz) = 11.2.0 +Provides: bundled(harfbuzz) = 14.2.0 # Version in src/java.desktop/share/native/liblcms/lcms2.h -Provides: bundled(lcms2) = 2.17.0 +Provides: bundled(lcms2) = 2.19.1 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h Provides: bundled(libjpeg) = 6b # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h -Provides: bundled(libpng) = 1.6.51 +Provides: bundled(libpng) = 1.6.58 # Version in src/java.base/share/native/libzip/zlib/zlib.h -Provides: bundled(zlib) = 1.3.1 +Provides: bundled(zlib) = 1.3.2 # We link statically against libstdc++ to increase portability %ifnarch %{devkit_arches} BuildRequires: libstdc++-static @@ -927,6 +890,7 @@ The %{origin_nice} %{featurever} miscellany. echo "Preparing %{oj_vendor_version}" echo "System is RHEL=%{?rhel}%{!?rhel:0}, CentOS=%{?centos}%{!?centos:0}, EPEL=%{?epel}%{!?epel:0}, Fedora=%{?fedora}%{!?fedora:0}" +echo "Portable suffix is %{?pkgos}%{!?pkgos:unset}" # Using the echo macro breaks rpmdev-bumpspec, as it parses the first line of stdout :-( %if 0%{?stapinstall:1} @@ -966,11 +930,6 @@ echo "Build JDK version is %{buildjdkver}, feature JDK version is %{featurever}" export XZ_OPT="-T0" %setup -q -c -n %{uniquesuffix ""} -T -a 0 # https://bugzilla.redhat.com/show_bug.cgi?id=1189084 -prioritylength=`expr length %{priority}` -if [ $prioritylength -ne 8 ] ; then - echo "priority must be 8 digits in total, violated" - exit 14 -fi # OpenJDK patches @@ -980,22 +939,12 @@ sh %{SOURCE12} %{top_level_dir_name} %endif # Patch the JDK -# This syntax is deprecated: -# %patchN [...] -# and should be replaced with: -# %patch -PN [...] -# For example: -# %patch1001 -p1 -# becomes: -# %patch -P1001 -p1 -# The replacement format suggested by recent (circa Fedora 38) RPM -# deprecation messages: -# %patch N [...] -# is not backward-compatible with prior (circa RHEL-8) versions of -# rpmbuild. + pushd %{top_level_dir_name} # Add crypto policy and FIPS support %patch -P1001 -p1 +# Add EOPNOTSUPP patch +%patch -P2001 -p1 popd # openjdk @@ -1071,12 +1020,11 @@ done export NUM_PROC=%(/usr/bin/getconf _NPROCESSORS_ONLN 2> /dev/null || :) export NUM_PROC=${NUM_PROC:-1} %if 0%{?_smp_ncpus_max} -# Honor %%_smp_ncpus_max [ ${NUM_PROC} -gt %{?_smp_ncpus_max} ] && export NUM_PROC=%{?_smp_ncpus_max} %endif export XZ_OPT="-T0" -%ifarch s390x sparc64 alpha %{power64} %{aarch64} +%ifarch s390x sparc64 alpha %{power64} %{aarch64} riscv64 export ARCH_DATA_MODEL=64 %endif %ifarch alpha @@ -1188,8 +1136,8 @@ function buildjdk() { mkdir -p ${outputdir} pushd ${outputdir} - # Note: zlib and freetype use %{link_type} - # rather than ${link_opt} as the system versions + # Note: zlib and freetype use link_type (macro) + # rather than link_opt (shell var) as the system versions # are always used in a system_libs build, even # for the static library build LD_LIBRARY_PATH=${LIBPATH} \ @@ -1883,8 +1831,8 @@ done %files # main package builds always -%{_jvmdir}/%{jreportablearchiveForFiles} -%{_jvmdir}/%{jreportablearchiveForFiles}.sha256sum +%{_jvmdir}/%{jreportablearchive_for_files} +%{_jvmdir}/%{jreportablearchive_for_files}.sha256sum %else %files # placeholder @@ -1893,15 +1841,15 @@ done %if %{include_normal_build} %files devel -%{_jvmdir}/%{jdkportablearchiveForFiles} +%{_jvmdir}/%{jdkportablearchive_for_files} %{_jvmdir}/%{jdkportablearchive -- .debuginfo} -%{_jvmdir}/%{jdkportablearchiveForFiles}.sha256sum +%{_jvmdir}/%{jdkportablearchive_for_files}.sha256sum %{_jvmdir}/%{jdkportablearchive -- .debuginfo}.sha256sum %if %{include_staticlibs} %files static-libs -%{_jvmdir}/%{staticlibsportablearchiveForFiles} -%{_jvmdir}/%{staticlibsportablearchiveForFiles}.sha256sum +%{_jvmdir}/%{staticlibsportablearchive_for_files} +%{_jvmdir}/%{staticlibsportablearchive_for_files}.sha256sum %endif %files unstripped @@ -1955,6 +1903,89 @@ done %endif %changelog +* Tue Sep 01 2026 Eduard Abdullin - 1:21.0.12.1.1-2.0 +- Portable build + +* Thu Aug 20 2026 Andrew Hughes - 1:21.0.12.1.1-2.0 +- Add CVEs for August 2026 release +- Related: OPENJDK-5042 + +* Mon Aug 10 2026 Andrew Hughes - 1:21.0.12.1.1-1.0 +- Update to jdk-21.0.12.1+1 (GA) +- Update release notes to 21.0.12.1+1 +- Fix double '%' in specification of IcedTea sources +- ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** +- Resolves: OPENJDK-5042 + +* Mon Aug 10 2026 Andrew Hughes - 1:21.0.12.0.8-3.0 +- Make rhel usage in pkgos optional as it may be undefined +- Simplify pkgos conditional to work on RHEL 8 +- Related: OPENJDK-5045 + +* Fri Aug 07 2026 Andrea Bolognani - 1:21.0.12.0.8-3.0 +- Automatically set pkgos when necessary +- Remove now redundant pkgos usage in JDK build dependency +- Don't attempt to use devkit on riscv64 +- Resolves: OPENJDK-5045 +- Resolves: OPENJDK-5046 + +* Wed Jul 29 2026 Andrew Hughes - 1:21.0.12.0.8-2.0 +- Add CVEs to NEWS file +- Update to tarball with final changeset ID +- Related: OPENJDK-4865 + +* Wed Jul 15 2026 Andrew Hughes - 1:21.0.12.0.8-1.0 +- Update to jdk-21.0.12+8 (GA) +- Update release notes to 21.0.12+8 +- Bump freetype version to 2.14.3 following JDK-8385390 +- Bump giflib version to 6.1.3 following JDK-8384902 +- Bump HarfBuzz version to 14.2.0 following JDK-8385490 +- Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354 +- Bump libpng version to 1.6.58 following JDK-8384495 +- ** This tarball is embargoed until 2026-07-21 @ 1pm PT. ** +- Resolves: OPENJDK-4865 + +* Wed Jul 15 2026 Andrea Bolognani - 1:21.0.11.0.10-2.0 +- Strip %%{dist} more thoroughly +- Resolves: OPENJDK-4891 + +* Fri Jun 26 2026 Andrew Hughes - 1:21.0.11.0.10-2.0 +- Port ForFiles patch to RHEL and update to use standard function naming format +- Remove macro references in comments where possible (%dnl not compatible enough yet) +- Drop unused tagsuffix line which causes issues on older RPM versions without %dnl +- Cleanup RPM only macros unused in the portable spec file +- Move version information and core NVR definitions back towards the top of the file +- Specify portablerelease and rpmrelease (always 0 for portables) in the Release field +- Related: OPENJDK-4887 +- Resolves: OPENJDK-4888 +- Resolves: OPENJDK-4889 +- Resolves: OPENJDK-4890 + +* Fri Jun 26 2026 Jiri Vanek - 1:25.0.3.0.9-2.0 +- Redeclared ForFiles release sections as %%nil no longer works with %%1 +- RPM 4.19 no longer accept our double percentaged %%{nil} passed to %%{1} +- so we have to pass in "" but evaluate it, otherwise files record will include it +- Resolves: OPENJDK-4887 + +* Sat Apr 18 2026 Andrew Hughes - 1:21.0.11.0.10-1 +- Update to jdk-21.0.11+10 (GA) +- Update release notes to 21.0.11+10 +- Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336 +- Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158 +- Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078 +- Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047 +- Bump zlib version to 1.3.2 following JDK-8378631 +- Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13 +- ** This tarball is embargoed until 2026-04-21 @ 1pm PT. ** +- Resolves: OPENJDK-4301 +- Resolves: OPENJDK-4521 +- Resolves: OPENJDK-4543 +- Resolves: OPENJDK-4550 +- Resolves: OPENJDK-4653 +- Resolves: OPENJDK-4631 +- Resolves: OPENJDK-4606 +- Resolves: OPENJDK-4676 + * Sun Jan 18 2026 Andrew Hughes - 1:21.0.10.0.7-1 - Update to jdk-21.0.10+7 (GA) - Update release notes to 21.0.10+7 @@ -2123,7 +2154,7 @@ done - Update release notes to 21.0.4+5 - Move unstripped, misc and doc tarball handling into normal build / no suffix blocks - Limit Java only tests to one architecture using jdk_test_arch -- Drop unneeded tzdata-java build dependency following 3e3cf8fa2df7bac2f6a60a0ddd596ec39228a3e1 +- Drop unneeded tzdata-java build dependency following f854bb3955fb57bba4e83d09813e9cfd0e81079e - Resolves: OPENJDK-3133 - Resolves: OPENJDK-3237 - Resolves: OPENJDK-3182 @@ -2142,6 +2173,7 @@ done - Update to jdk-21.0.3+9 (GA) - Update release notes to 21.0.3+9 - Switch to GA mode. +- Update buildjdkver to match the featurever - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. ** * Thu Apr 04 2024 Andrew Hughes - 1:21.0.3.0.7-0.1.ea @@ -2236,6 +2268,10 @@ done - Update release notes to 21.0.2+13 - Bump libpng version to 1.6.40 following JDK-8316030 - Bump HarfBuzz version to 8.2.2 following JDK-8313643 +- pandoc is only available on RHEL/CentOS 8 +- Check for CentOS being defined to determine use of devkit +- Set buildjdkver to 20 until OpenJDK 21 is available in the buildroot +- Use featurever for JDK build dependencies * Mon Mar 11 2024 Andrew Hughes - 1:21.0.1.0.12-2 - Use a devkit to build on architectures where we have one (s390x, aarch64, ppc64le, x86_64) @@ -2245,6 +2281,7 @@ done - Use system gdb for both builds as devkit version fails (needs devkit libraries, then JDK segfaults with them) - Filter out annobin plugin when using the devkit - Drop static libstdc++ build dependency on devkit builds as it should come from the devkit +- Disable devkit build on CentOS where it is unavailable - Introduce tar_opts to avoid repetition of lengthy tar creation options * Thu Feb 08 2024 Thomas Fitzsimmons - 1:21.0.1.0.12-2 @@ -2266,7 +2303,7 @@ done * Fri Oct 27 2023 Andrew Hughes - 1:21.0.0.0.35-4 - Rebuild jmods using the stripped binaries in release builds - Make sure the unstripped JDK is customised by the installjdk function -- Resolves: OPENJDK-1974 +- Resolves: OPENJDK-3224 * Thu Oct 26 2023 Andrew Hughes - 1:21.0.0.0.35-3 - Re-enable SystemTap support and perform only substitutions possible without final NVR available @@ -2278,6 +2315,7 @@ done * Thu Aug 24 2023 Andrew Hughes - 1:21.0.0.0.35-2 - Update documentation (README.md, add missing JEP to release notes) - Replace alt-java patch with a binary separate from the JDK +- Adapt alt-java test to new binary where there is always a set_speculation function - Drop stale patches that are of little use any more: - * nss.cfg has been disabled since early PKCS11 work and long superseded by FIPS work - * No accessibility subpackage to warrant RH1648242 patch any more @@ -2301,27 +2339,31 @@ done - Replace smoke test files used in the staticlibs test, as fdlibm was removed by JDK-8303798 - Related: rhbz#2192749 -* Wed Aug 16 2023 Andrew Hughes - 1:20.0.0.0.36-1 +* Wed Aug 16 2023 Andrew Hughes - 1:20.0.2.0.9-1 - Update to jdk-20.0.2+9 - Update release notes to 20.0.2+9 - Update system crypto policy & FIPS patch from new fips-20u tree - Update generate_tarball.sh ICEDTEA_VERSION - Update CLDR reference data following update to 42 (Rocky Mountain-Normalzeit => Rocky-Mountain-Normalzeit) -- Related: rhbz#2192749 -* Wed Aug 16 2023 Jiri Vanek - 1:20.0.0.0.36-1 +* Wed Aug 16 2023 Jiri Vanek - 1:20.0.2.0.9-1 - Dropped JDK-8295447, JDK-8296239 & JDK-8299439 patches now upstream - Adapted rh1750419-redhat_alt_java.patch -- Related: rhbz#2192749 -* Tue Aug 15 2023 Andrew Hughes - 1:19.0.1.0.10-1 +* Tue Aug 15 2023 Andrew Hughes - 1:19.0.2.0.7-2 +- Bump rpmrelease to rebuild for CentOS 9 + +* Tue Aug 15 2023 Andrew Hughes - 1:19.0.2.0.7-1 - Update to jdk-19.0.2 release - Update release notes to 19.0.2 - Rebase FIPS patches from fips-19u branch - Remove references to sample directory removed by JDK-8284999 - Add local patch JDK-8295447 (javac NPE) which was accepted into 19u upstream but not in the GA tag - Add local patches for JDK-8296239 & JDK-8299439 (Croatia Euro update) which are present in 8u, 11u & 17u releases -- Related: rhbz#2192749 +- Switch buildjdkver to java-21-openjdk + +* Thu Aug 10 2023 Andrew Hughes - 1:18.0.2.0.9-2 +- Bump rpmrelease to rebuild for CentOS 9 * Thu Aug 10 2023 Andrew Hughes - 1:18.0.2.0.9-1 - Update to jdk-18.0.2 release @@ -2331,14 +2373,14 @@ done - Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch - Automatically turn off building a fresh HotSpot first, if the bootstrap JDK is not the same major version as that being built - Drop tzdata patches added for 17.0.7 which will eventually appear in the upstream tarball when we reach OpenJDK 21 -- Switch bootjdkver to java-21-openjdk - Disable tzdata tests until we are on the latest JDK and things are back in sync -- Related: rhbz#2192749 * Thu Aug 10 2023 Petra Alice Mikova - 1:18.0.0.0.37-1 - Update to ea version of jdk18 - Adjust rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch -- Related: rhbz#2192749 + +* Mon May 15 2023 Andrew Hughes - 1:17.0.7.0.7-3 +- Bump rpmrelease to rebuild for CentOS 9 * Mon May 15 2023 Andrew Hughes - 1:17.0.7.0.7-2 - Create java-21-openjdk-portable package based on java-17-openjdk-portable diff --git a/jdk8375294-handle-EOPNOTSUPP-in-copying.patch b/jdk8375294-handle-EOPNOTSUPP-in-copying.patch new file mode 100644 index 0000000..60af1fd --- /dev/null +++ b/jdk8375294-handle-EOPNOTSUPP-in-copying.patch @@ -0,0 +1,47 @@ +diff --git a/src/java.base/linux/native/libnio/ch/FileDispatcherImpl.c b/src/java.base/linux/native/libnio/ch/FileDispatcherImpl.c +index 207e61431dc..7c3761a613c 100644 +--- a/src/java.base/linux/native/libnio/ch/FileDispatcherImpl.c ++++ b/src/java.base/linux/native/libnio/ch/FileDispatcherImpl.c +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2000, 2022, Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 2000, 2026, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -63,7 +63,7 @@ Java_sun_nio_ch_FileDispatcherImpl_transferFrom0(JNIEnv *env, jobject this, + if (n < 0) { + if (errno == EAGAIN) + return IOS_UNAVAILABLE; +- if (errno == ENOSYS) ++ if (errno == ENOSYS || errno == EOPNOTSUPP) + return IOS_UNSUPPORTED_CASE; + if ((errno == EBADF || errno == EINVAL || errno == EXDEV) && + ((ssize_t)count >= 0)) +@@ -103,6 +103,7 @@ Java_sun_nio_ch_FileDispatcherImpl_transferTo0(JNIEnv *env, jobject this, + case EINVAL: + case ENOSYS: + case EXDEV: ++ case EOPNOTSUPP: + // ignore and try sendfile() + break; + default: +diff --git a/src/java.base/linux/native/libnio/fs/LinuxNativeDispatcher.c b/src/java.base/linux/native/libnio/fs/LinuxNativeDispatcher.c +index cf8592e1ced..5f14896ad24 100644 +--- a/src/java.base/linux/native/libnio/fs/LinuxNativeDispatcher.c ++++ b/src/java.base/linux/native/libnio/fs/LinuxNativeDispatcher.c +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2008, 2022, Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 2008, 2026, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -199,6 +199,7 @@ Java_sun_nio_fs_LinuxNativeDispatcher_directCopy0 + case EINVAL: + case ENOSYS: + case EXDEV: ++ case EOPNOTSUPP: + // ignore and try sendfile() + break; + default: diff --git a/rpminspect.yaml b/rpminspect.yaml index 8b4fa58..901c0fb 100644 --- a/rpminspect.yaml +++ b/rpminspect.yaml @@ -1,3 +1,4 @@ --- inspections: javabytecode: off + abidiff: off diff --git a/scripts/builds/build_rhel_7_portable_build.sh b/scripts/builds/build_rhel_7_portable_build.sh deleted file mode 100755 index 0cf02d0..0000000 --- a/scripts/builds/build_rhel_7_portable_build.sh +++ /dev/null @@ -1,29 +0,0 @@ -#!/bin/sh - -# Copyright (C) 2024 Red Hat, Inc. -# Written by: -# Andrew John Hughes -# -# This program is free software: you can redistribute it and/or modify -# it under the terms of the GNU Affero General Public License as -# published by the Free Software Foundation, either version 3 of the -# License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Affero General Public License for more details. -# -# You should have received a copy of the GNU Affero General Public License -# along with this program. If not, see . - -# Builds the portable on RHEL 7 - -rhpkg -v build --target=java-openjdk-rhel-7-build --skip-nvr-check - -# Local Variables: -# compile-command: "shellcheck build_rhel_7_portable_build.sh" -# fill-column: 80 -# indent-tabs-mode: nil -# sh-basic-offset: 4 -# End: diff --git a/scripts/builds/build_vanilla.sh b/scripts/builds/build_vanilla.sh index c4f67f7..933f8c8 100755 --- a/scripts/builds/build_vanilla.sh +++ b/scripts/builds/build_vanilla.sh @@ -1,6 +1,6 @@ -#!/bin/sh +#!/bin/bash -# Copyright (C) 2024 Red Hat, Inc. +# Copyright (C) 2026 Red Hat, Inc. # Written by: # Andrew John Hughes # @@ -20,20 +20,24 @@ # Builds a scratch build of vanilla OpenJDK with no local patches SEPARATE_ARCHES=${1} -CMD="--target java-openjdk-rhel-8-build --skip-nvr-check --nowait"; +CMD=(rhpkg -v build --target java-openjdk-rhel-8-build --skip-nvr-check --nowait); SUPPORTED_ARCHES="aarch64 ppc64le s390x x86_64"; -if [ "x${SEPARATE_ARCHES}" = "x" ] ; then +if [ "${SEPARATE_ARCHES}" = "" ] ; then SEPARATE_ARCHES=0; fi -if [ ${SEPARATE_ARCHES} -eq 1 ] ; then - for arch in ${SUPPORTED_ARCHES}; do \ - rhpkg -v build --arches ${arch} --scratch ${CMD} ; \ - done && brew watch-task --mine +if [ "${SEPARATE_ARCHES}" -eq 1 ] ; then + for arch in ${SUPPORTED_ARCHES}; do \ + ARCH_CMD=("${CMD[@]}" --arches "${arch}" --scratch) ; + echo "Executing ${ARCH_CMD[*]}"; + command "${ARCH_CMD[@]}"; + done else - rhpkg -v build ${CMD} && brew watch-task --mine + echo "Executing ${CMD[*]}"; + command "${CMD[@]}"; fi +brew watch-task --mine # Local Variables: # compile-command: "shellcheck build_vanilla.sh" diff --git a/scripts/builds/check_signatures.sh b/scripts/builds/check_signatures.sh new file mode 100755 index 0000000..c6d30a3 --- /dev/null +++ b/scripts/builds/check_signatures.sh @@ -0,0 +1,77 @@ +#!/bin/sh + +# Copyright (C) 2026 Red Hat, Inc. +# Written by: +# Andrew John Hughes +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +# Check the signatures (if any) in RHEL RPM buildinfo +# This is intended to be run from the tagging scripts + +# Return codes: +# - 1 - Buildinfo file not specified +# - 2 = Missing buildinfo file +# - 3 = No signatures +# - 4 = Multiple signature types found +# - 5 = PQC signature found +# - 6 = Old signature (fd431d51) found +# - 7 = Unknown signature found + +BUILDINFO=${1} +NEW_SIGNATURE="release4"; +OLD_SIGNATURE="fd431d51"; + +if test "${BUILDINFO}" = ""; then + echo "${0} "; + exit 1; +fi + +if ! test -e "${BUILDINFO}" ; then + echo "${BUILDINFO} not found."; + exit 2; +fi + +if grep -q "Signatures" < "${BUILDINFO}" ; then + signature=$(grep "Signatures" < "${BUILDINFO}" | cut -d ' ' -f 2- | uniq -c | sed 's#^\W*##'); + uniq_count=$(echo "${signature}" | wc -l); + if test "${uniq_count}" -gt 1; then + echo "Multiple signature types found:"; + echo "${signature}"; + exit 4; + fi + sig_count=$(echo "${signature}" | cut -d ' ' -f 1); + sig_type=$(echo "${signature}" | cut -d ' ' -f 2); + echo "${sig_count} signatures of type ${sig_type} found"; + if echo "${sig_type}" | grep -q "${NEW_SIGNATURE}" ; then + echo "PQC signature found."; + exit 5; + elif echo "${sig_type}" | grep -q "${OLD_SIGNATURE}"; then + echo "Old pre-PQC signature found."; + exit 6; + else + echo "Unknown signature found."; + exit 7; + fi +else + echo "Build has no signatures."; + exit 3; +fi + +# Local Variables: +# compile-command: "shellcheck check_signatures.sh" +# fill-column: 80 +# indent-tabs-mode: nil +# sh-basic-offset: 4 +# End: diff --git a/scripts/builds/get_gating_results.sh b/scripts/builds/get_gating_results.sh new file mode 100755 index 0000000..82458d6 --- /dev/null +++ b/scripts/builds/get_gating_results.sh @@ -0,0 +1,63 @@ +#!/bin/bash + +# Copyright (C) 2026 Red Hat, Inc. +# Written by: +# Andrew John Hughes +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +# Retrieve the results of a gating test using the ID from the JSON +# retrieved by query_build_gating.sh + +RESULT_ID=${1} + +if test "${RESULT_ID}" = ""; then + echo "No ID specified."; + echo "${0} "; + exit 1; +fi + +CURL=$(command -v curl) +JSON_TOOL=$(command -v jq) + +if test "${CURL}" = ""; then + echo "curl not found"; + exit 2; +fi + +if test "${JSON_TOOL}" = ""; then + echo "jq not found"; + exit 3; +fi + +URL="https://resultsdb-api.engineering.redhat.com/api/v2.0/results/${RESULT_ID}" +JSON_OUT=$(mktemp --tmpdir out.XXXXXX.json) + +CMD=("${CURL}" --silent --show-error "${URL}") + +echo "${CMD[@]}" + +if command "${CMD[@]}" > "${JSON_OUT}" ; then + "${JSON_TOOL}" < "${JSON_OUT}" +else + echo "Failed to obtain JSON"; + exit 4; +fi + +# Local Variables: +# compile-command: "shellcheck get_gating_results.sh" +# fill-column: 80 +# indent-tabs-mode: nil +# sh-basic-offset: 4 +# End: diff --git a/scripts/builds/query_build_gating.sh b/scripts/builds/query_build_gating.sh new file mode 100755 index 0000000..f83f849 --- /dev/null +++ b/scripts/builds/query_build_gating.sh @@ -0,0 +1,94 @@ +#!/bin/bash + +# Copyright (C) 2026 Red Hat, Inc. +# Written by: +# Andrew John Hughes +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +# Retrieve the status of a build's progress through gating + +RHEL_VER=${1} +NVR=${2} + +if test "${RHEL_VER}" = ""; then + echo "No RHEL version specified."; + echo "${0} "; + exit 1; +fi + +if test "${NVR}" = ""; then + echo "No NVR specified."; + echo "${0} "; + exit 2; +fi + +CURL=$(command -v curl) +JSON_TOOL=$(command -v jq) +JSON_FILE=$(mktemp --tmpdir query.XXXXXX.json) +JSON_OUT=$(mktemp --tmpdir out.XXXXXX.json) +URL="https://greenwave.engineering.redhat.com/api/v1.0/decision" + +if test "${CURL}" = ""; then + echo "curl not found"; + exit 3; +fi + +if test "${JSON_TOOL}" = ""; then + echo "jq not found"; + exit 4; +fi + +{ + echo "{"; + printf "\t\"decision_context\":\"osci_compose_gate\",\n"; + printf "\t\"product_version\":\"rhel-%d\",\n" "${RHEL_VER}"; + printf "\t\"subject_type\":\"koji_build\",\n"; + printf "\t\"subject_identifier\":\"%s\",\n" "${NVR}"; + printf "\t\"verbose\":false\n"; + echo "}"; +} > "${JSON_FILE}" + +echo "Sending the following JSON..."; +cat "${JSON_FILE}" + +CMD=("${CURL}" --silent --show-error -X POST) + +JSON_COMMAND="--json"; +# Check --json is available +${CURL} ${JSON_COMMAND} 2> /dev/null +if [ $? -eq 2 ] ; then + echo "--json unsupported; falling back on --data-ascii"; + CMD=("${CMD[@]}" --header Content-Type:application/json --data-ascii); +else + CMD=("${CMD[@]}" "${JSON_COMMAND}"); +fi + +CMD=("${CMD[@]}" "@${JSON_FILE}" "${URL}") + +echo "${CMD[@]}" + +if command "${CMD[@]}" > "${JSON_OUT}" ; then + "${JSON_TOOL}" < "${JSON_OUT}" +else + echo "Failed to obtain JSON"; + exit 5; +fi + +# Local Variables: +# compile-command: "shellcheck query_build_gating.sh" +# fill-column: 80 +# indent-tabs-mode: nil +# sh-basic-offset: 4 +# End: diff --git a/scripts/builds/tag_rhel.sh b/scripts/builds/tag_rhel.sh new file mode 100755 index 0000000..7b733d8 --- /dev/null +++ b/scripts/builds/tag_rhel.sh @@ -0,0 +1,87 @@ +#!/bin/sh + +# Copyright (C) 2026 Red Hat, Inc. +# Written by: +# Andrew John Hughes +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +# Tag public RHEL RPMs into gating for all supported streams +# This is intended to be run from tag_rhel__(public|embargoed).sh + +BUILD="${1}" +BUILDLOG="${2}" +SUFFIX="${3}" +shift 3; +SUPPORTED_VERS="$*" + +CMD_SYNTAX="${0} "; +GATE_SUFFIX="gate" + +if test "${BUILD}" = ""; then + echo "${CMD_SYNTAX}"; + exit 1; +fi + +if test "${BUILDLOG}" = ""; then + echo "${CMD_SYNTAX}"; + exit 2; +fi + +if test "${SUPPORTED_VERS}" = ""; then + echo "${CMD_SYNTAX}"; + exit 3; +fi + +buildtags=$(grep "^Tag" "${BUILDLOG}" | cut -d : -f 2-) +echo "Build has tags ${buildtags}"; + +if [ "${SUFFIX}" = "${GATE_SUFFIX}" ] ; then + echo "Gating system can only handle one tag at a time." + echo "Script will need to be re-run for subsequent tags once previous tag has moved to -candidate." + if echo "${buildtags}" | grep -q "${GATE_SUFFIX}"; then + echo "Tag with \"-${GATE_SUFFIX}\" found. Please complete gating before re-running."; + exit 1; + fi +fi + +done=0; +for ver in ${SUPPORTED_VERS}; do + vertag="rhel-${ver}"; + proposedtag="${vertag}-${SUFFIX}"; + echo "Checking if ${BUILD} has been added to ${vertag}..."; + if echo "${buildtags}" | grep -q "${vertag}" ; then + echo "${BUILD} has been tagged into ${proposedtag}"; + else + if [ "${SUFFIX}" = "${GATE_SUFFIX}" ] && [ "${done}" -eq 1 ]; then + echo "Already added a tag. Need to tag ${proposedtag} in a future run."; + else + echo "Tagging ${BUILD} into ${proposedtag}"; + brew tag-build --nowait "${proposedtag}" "${BUILD}"; + done=1; + fi + fi +done +if [ "${done}" -eq 1 ]; then + brew watch-task --mine; +else + echo "Nothing to do."; +fi + +# Local Variables: +# compile-command: "shellcheck tag_rhel.sh" +# fill-column: 80 +# indent-tabs-mode: nil +# sh-basic-offset: 4 +# End: diff --git a/scripts/builds/tag_rhel_10_embargoed.sh b/scripts/builds/tag_rhel_10_embargoed.sh new file mode 100755 index 0000000..3219a54 --- /dev/null +++ b/scripts/builds/tag_rhel_10_embargoed.sh @@ -0,0 +1,67 @@ +#!/bin/sh + +# Copyright (C) 2026 Red Hat, Inc. +# Written by: +# Andrew John Hughes +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +# Tag older embargoed RHEL 10 RPMs into supported z-streams + +BUILD=${1} + +if test "${BUILD}" = ""; then + echo "${0} "; + exit 1; +fi + +BUILDLOG=$(mktemp --tmpdir "temp-${BUILD}-buildinfo-XXX") +SUPPORTED_VERS="10.0-z" +WORKING_DIR=$(dirname "${0}") +EMBARGOED_SUFFIX="nocompose-candidate" + +echo "Obtaining buildinfo for ${BUILD}..."; +brew buildinfo "${BUILD}" 2>&1 | tee "${BUILDLOG}" > /dev/null + +echo "Checking signatures for ${BUILD}..."; +"${WORKING_DIR}"/check_signatures.sh "${BUILDLOG}" + +# Return codes: +# - 1 - Buildinfo file not specified +# - 2 = Missing buildinfo file +# - 3 = No signatures +# - 4 = Multiple signature types found +# - 5 = PQC signature found +# - 6 = Old signature (fd431d51) found +# - 7 = Unknown signature found +ret=$?; +if [ "${ret}" -eq 5 ] ; then + echo "Build has PQC signatures; use tag_rhel_10_embargoed_pqc.sh"; + exit 2; +elif ! { [ "${ret}" -eq 6 ] || [ "${ret}" -eq 3 ] ; } ; then + echo "Signature check failed."; + exit 3; +fi + +echo "Tagging embargoed build for ${SUPPORTED_VERS}..."; +"${WORKING_DIR}"/tag_rhel.sh "${BUILD}" "${BUILDLOG}" "${EMBARGOED_SUFFIX}" "${SUPPORTED_VERS}" + +rm -f "${BUILDLOG}" + +# Local Variables: +# compile-command: "shellcheck tag_rhel_10_embargoed.sh" +# fill-column: 80 +# indent-tabs-mode: nil +# sh-basic-offset: 4 +# End: diff --git a/scripts/builds/tag_rhel_10_embargoed_pqc.sh b/scripts/builds/tag_rhel_10_embargoed_pqc.sh new file mode 100755 index 0000000..cf2389d --- /dev/null +++ b/scripts/builds/tag_rhel_10_embargoed_pqc.sh @@ -0,0 +1,67 @@ +#!/bin/sh + +# Copyright (C) 2026 Red Hat, Inc. +# Written by: +# Andrew John Hughes +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +# Tag newer PQC embargoed RHEL 10 RPMs into supported z-streams + +BUILD=${1} + +if test "${BUILD}" = ""; then + echo "${0} "; + exit 1; +fi + +BUILDLOG=$(mktemp --tmpdir "temp-${BUILD}-buildinfo-XXX") +SUPPORTED_VERS="10.2-z" +WORKING_DIR=$(dirname "${0}") +EMBARGOED_SUFFIX="nocompose-candidate" + +echo "Obtaining buildinfo for ${BUILD}..."; +brew buildinfo "${BUILD}" 2>&1 | tee "${BUILDLOG}" > /dev/null + +echo "Checking signatures for ${BUILD}..."; +"${WORKING_DIR}"/check_signatures.sh "${BUILDLOG}" + +# Return codes: +# - 1 - Buildinfo file not specified +# - 2 = Missing buildinfo file +# - 3 = No signatures +# - 4 = Multiple signature types found +# - 5 = PQC signature found +# - 6 = Old signature (fd431d51) found +# - 7 = Unknown signature found +ret=$?; +if [ "${ret}" -eq 6 ] ; then + echo "Build has old signatures; use tag_rhel_10_embargoed.sh"; + exit 2; +elif ! { [ "${ret}" -eq 5 ] || [ "${ret}" -eq 3 ] ; } ; then + echo "Signature check failed."; + exit 3; +fi + +echo "Tagging embargoed build for ${SUPPORTED_VERS}..."; +"${WORKING_DIR}"/tag_rhel.sh "${BUILD}" "${BUILDLOG}" "${EMBARGOED_SUFFIX}" "${SUPPORTED_VERS}" + +rm -f "${BUILDLOG}" + +# Local Variables: +# compile-command: "shellcheck tag_rhel_10_embargoed_pqc.sh" +# fill-column: 80 +# indent-tabs-mode: nil +# sh-basic-offset: 4 +# End: diff --git a/scripts/builds/tag_rhel_10_public.sh b/scripts/builds/tag_rhel_10_public.sh new file mode 100755 index 0000000..0b9ab5a --- /dev/null +++ b/scripts/builds/tag_rhel_10_public.sh @@ -0,0 +1,67 @@ +#!/bin/sh + +# Copyright (C) 2026 Red Hat, Inc. +# Written by: +# Andrew John Hughes +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +# Tag older public RHEL 10 RPMs into gating for all supported streams + +BUILD=${1} + +if test "${BUILD}" = ""; then + echo "${0} "; + exit 1; +fi + +BUILDLOG=$(mktemp --tmpdir "temp-${BUILD}-buildinfo-XXX") +SUPPORTED_VERS="10.0-z" +WORKING_DIR=$(dirname "${0}") +GATE_SUFFIX="gate" + +echo "Obtaining buildinfo for ${BUILD}..."; +brew buildinfo "${BUILD}" 2>&1 | tee "${BUILDLOG}" > /dev/null + +echo "Checking signatures for ${BUILD}..."; +"${WORKING_DIR}"/check_signatures.sh "${BUILDLOG}" + +# Return codes: +# - 1 - Buildinfo file not specified +# - 2 = Missing buildinfo file +# - 3 = No signatures +# - 4 = Multiple signature types found +# - 5 = PQC signature found +# - 6 = Old signature (fd431d51) found +# - 7 = Unknown signature found +ret=$?; +if [ "${ret}" -eq 5 ] ; then + echo "Build has PQC signatures; use tag_rhel_10_public_pqc.sh"; + exit 2; +elif ! { [ "${ret}" -eq 6 ] || [ "${ret}" -eq 3 ] ; } ; then + echo "Signature check failed."; + exit 3; +fi + +echo "Tagging build into gating for ${SUPPORTED_VERS}..."; +"${WORKING_DIR}"/tag_rhel.sh "${BUILD}" "${BUILDLOG}" "${GATE_SUFFIX}" "${SUPPORTED_VERS}" + +rm -f "${BUILDLOG}" + +# Local Variables: +# compile-command: "shellcheck tag_rhel_10_public.sh" +# fill-column: 80 +# indent-tabs-mode: nil +# sh-basic-offset: 4 +# End: diff --git a/scripts/builds/tag_rhel_10_public_pqc.sh b/scripts/builds/tag_rhel_10_public_pqc.sh new file mode 100755 index 0000000..b5f9363 --- /dev/null +++ b/scripts/builds/tag_rhel_10_public_pqc.sh @@ -0,0 +1,67 @@ +#!/bin/sh + +# Copyright (C) 2026 Red Hat, Inc. +# Written by: +# Andrew John Hughes +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +# Tag newer PQC public RHEL 10 RPMs into gating for all supported streams + +BUILD=${1} + +if test "${BUILD}" = ""; then + echo "${0} "; + exit 1; +fi + +BUILDLOG=$(mktemp --tmpdir "temp-${BUILD}-buildinfo-XXX") +SUPPORTED_VERS="10.3 10.2-z" +WORKING_DIR=$(dirname "${0}") +GATE_SUFFIX="gate" + +echo "Obtaining buildinfo for ${BUILD}..."; +brew buildinfo "${BUILD}" 2>&1 | tee "${BUILDLOG}" > /dev/null + +echo "Checking signatures for ${BUILD}..."; +"${WORKING_DIR}"/check_signatures.sh "${BUILDLOG}" + +# Return codes: +# - 1 - Buildinfo file not specified +# - 2 = Missing buildinfo file +# - 3 = No signatures +# - 4 = Multiple signature types found +# - 5 = PQC signature found +# - 6 = Old signature (fd431d51) found +# - 7 = Unknown signature found +ret=$?; +if [ "${ret}" -eq 6 ] ; then + echo "Build has old signatures; use tag_rhel_10_public.sh"; + exit 2; +elif ! { [ "${ret}" -eq 5 ] || [ "${ret}" -eq 3 ] ; } ; then + echo "Signature check failed."; + exit 3; +fi + +echo "Tagging build into gating for ${SUPPORTED_VERS}..."; +"${WORKING_DIR}"/tag_rhel.sh "${BUILD}" "${BUILDLOG}" "${GATE_SUFFIX}" "${SUPPORTED_VERS}" + +rm -f "${BUILDLOG}" + +# Local Variables: +# compile-command: "shellcheck tag_rhel_10_public_pqc.sh" +# fill-column: 80 +# indent-tabs-mode: nil +# sh-basic-offset: 4 +# End: diff --git a/scripts/builds/tag_rhel_8_nocompose.sh b/scripts/builds/tag_rhel_8_embargoed.sh similarity index 66% rename from scripts/builds/tag_rhel_8_nocompose.sh rename to scripts/builds/tag_rhel_8_embargoed.sh index 027ea5e..9ea6082 100755 --- a/scripts/builds/tag_rhel_8_nocompose.sh +++ b/scripts/builds/tag_rhel_8_embargoed.sh @@ -1,6 +1,6 @@ #!/bin/sh -# Copyright (C) 2025 Red Hat, Inc. +# Copyright (C) 2026 Red Hat, Inc. # Written by: # Andrew John Hughes # @@ -19,7 +19,6 @@ # Tag embargoed RHEL 8 RPMs into supported z-streams -SUPPORTED_VERS="8.10.0-z" BUILD=${1} if test "${BUILD}" = ""; then @@ -27,15 +26,21 @@ if test "${BUILD}" = ""; then exit 1; fi -for ver in ${SUPPORTED_VERS}; do - tag="rhel-${ver}-nocompose-candidate"; - echo "Tagging ${BUILD} into ${tag}"; - brew tag-build --nowait ${tag} ${BUILD}; -done -brew watch-task --mine +BUILDLOG=$(mktemp --tmpdir "temp-${BUILD}-buildinfo-XXX") +SUPPORTED_VERS="8.10.0-z" +WORKING_DIR=$(dirname "${0}") +EMBARGOED_SUFFIX="nocompose-candidate" + +echo "Obtaining buildinfo for ${BUILD}..."; +brew buildinfo "${BUILD}" 2>&1 | tee "${BUILDLOG}" > /dev/null + +echo "Tagging embargoed build for ${SUPPORTED_VERS}..."; +"${WORKING_DIR}"/tag_rhel.sh "${BUILD}" "${BUILDLOG}" "${EMBARGOED_SUFFIX}" "${SUPPORTED_VERS}" + +rm -f "${BUILDLOG}" # Local Variables: -# compile-command: "shellcheck tag_rhel_8_nocompose.sh" +# compile-command: "shellcheck tag_rhel_8_embargoed.sh" # fill-column: 80 # indent-tabs-mode: nil # sh-basic-offset: 4 diff --git a/scripts/builds/tag_rhel_8.sh b/scripts/builds/tag_rhel_8_public.sh similarity index 67% rename from scripts/builds/tag_rhel_8.sh rename to scripts/builds/tag_rhel_8_public.sh index c3c8c71..ff7980f 100755 --- a/scripts/builds/tag_rhel_8.sh +++ b/scripts/builds/tag_rhel_8_public.sh @@ -1,6 +1,6 @@ #!/bin/sh -# Copyright (C) 2025 Red Hat, Inc. +# Copyright (C) 2026 Red Hat, Inc. # Written by: # Andrew John Hughes # @@ -19,7 +19,6 @@ # Tag RHEL 8 RPMs into all supported streams -SUPPORTED_VERS="8.10.0-z" BUILD=${1} if test "${BUILD}" = ""; then @@ -27,15 +26,21 @@ if test "${BUILD}" = ""; then exit 1; fi -for ver in ${SUPPORTED_VERS}; do - tag="rhel-${ver}-gate"; - echo "Tagging ${BUILD} into ${tag}"; - brew tag-build --nowait ${tag} ${BUILD}; -done -brew watch-task --mine +BUILDLOG=$(mktemp --tmpdir "temp-${BUILD}-buildinfo-XXX") +SUPPORTED_VERS="8.10.0-z" +WORKING_DIR=$(dirname "${0}") +GATE_SUFFIX="gate" + +echo "Obtaining buildinfo for ${BUILD}..."; +brew buildinfo "${BUILD}" 2>&1 | tee "${BUILDLOG}" > /dev/null + +echo "Tagging build into gating for ${SUPPORTED_VERS}..."; +"${WORKING_DIR}"/tag_rhel.sh "${BUILD}" "${BUILDLOG}" "${GATE_SUFFIX}" "${SUPPORTED_VERS}" + +rm -f "${BUILDLOG}" # Local Variables: -# compile-command: "shellcheck tag_rhel_8.sh" +# compile-command: "shellcheck tag_rhel_8_public.sh" # fill-column: 80 # indent-tabs-mode: nil # sh-basic-offset: 4 diff --git a/scripts/builds/tag_rhel_9.sh b/scripts/builds/tag_rhel_9.sh deleted file mode 100755 index 5699c32..0000000 --- a/scripts/builds/tag_rhel_9.sh +++ /dev/null @@ -1,42 +0,0 @@ -#!/bin/sh - -# Copyright (C) 2025 Red Hat, Inc. -# Written by: -# Andrew John Hughes -# -# This program is free software: you can redistribute it and/or modify -# it under the terms of the GNU Affero General Public License as -# published by the Free Software Foundation, either version 3 of the -# License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Affero General Public License for more details. -# -# You should have received a copy of the GNU Affero General Public License -# along with this program. If not, see . - -# Tag RHEL 9 RPMs into all supported streams - -SUPPORTED_VERS="9.4.0-z 9.6.0-z 9.7.0-z 9.8.0" -BUILD=${1} - -if test "${BUILD}" = ""; then - echo "${0} "; - exit 1; -fi - -for ver in ${SUPPORTED_VERS}; do - tag="rhel-${ver}-gate"; - echo "Tagging ${BUILD} into ${tag}"; - brew tag-build --nowait ${tag} ${BUILD}; -done -brew watch-task --mine - -# Local Variables: -# compile-command: "shellcheck tag_rhel_9.sh" -# fill-column: 80 -# indent-tabs-mode: nil -# sh-basic-offset: 4 -# End: diff --git a/scripts/builds/tag_rhel_9_embargoed.sh b/scripts/builds/tag_rhel_9_embargoed.sh new file mode 100755 index 0000000..ceee5c8 --- /dev/null +++ b/scripts/builds/tag_rhel_9_embargoed.sh @@ -0,0 +1,67 @@ +#!/bin/sh + +# Copyright (C) 2026 Red Hat, Inc. +# Written by: +# Andrew John Hughes +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +# Tag older embargoed RHEL 9 RPMs into supported z-streams + +BUILD=${1} + +if test "${BUILD}" = ""; then + echo "${0} "; + exit 1; +fi + +BUILDLOG=$(mktemp --tmpdir "temp-${BUILD}-buildinfo-XXX") +SUPPORTED_VERS="9.4.0-z 9.6.0-z" +WORKING_DIR=$(dirname "${0}") +EMBARGOED_SUFFIX="nocompose-candidate" + +echo "Obtaining buildinfo for ${BUILD}..."; +brew buildinfo "${BUILD}" 2>&1 | tee "${BUILDLOG}" > /dev/null + +echo "Checking signatures for ${BUILD}..."; +"${WORKING_DIR}"/check_signatures.sh "${BUILDLOG}" + +# Return codes: +# - 1 - Buildinfo file not specified +# - 2 = Missing buildinfo file +# - 3 = No signatures +# - 4 = Multiple signature types found +# - 5 = PQC signature found +# - 6 = Old signature (fd431d51) found +# - 7 = Unknown signature found +ret=$?; +if [ "${ret}" -eq 5 ] ; then + echo "Build has PQC signatures; use tag_rhel_9_embargoed_pqc.sh"; + exit 2; +elif ! { [ "${ret}" -eq 6 ] || [ "${ret}" -eq 3 ] ; } ; then + echo "Signature check failed."; + exit 3; +fi + +echo "Tagging embargoed build for ${SUPPORTED_VERS}..."; +"${WORKING_DIR}"/tag_rhel.sh "${BUILD}" "${BUILDLOG}" "${EMBARGOED_SUFFIX}" "${SUPPORTED_VERS}" + +rm -f "${BUILDLOG}" + +# Local Variables: +# compile-command: "shellcheck tag_rhel_9_embargoed.sh" +# fill-column: 80 +# indent-tabs-mode: nil +# sh-basic-offset: 4 +# End: diff --git a/scripts/builds/tag_rhel_9_embargoed_pqc.sh b/scripts/builds/tag_rhel_9_embargoed_pqc.sh new file mode 100755 index 0000000..be3e82e --- /dev/null +++ b/scripts/builds/tag_rhel_9_embargoed_pqc.sh @@ -0,0 +1,67 @@ +#!/bin/sh + +# Copyright (C) 2026 Red Hat, Inc. +# Written by: +# Andrew John Hughes +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +# Tag newer PQC embargoed RHEL 9 RPMs into supported z-streams + +BUILD=${1} + +if test "${BUILD}" = ""; then + echo "${0} "; + exit 1; +fi + +BUILDLOG=$(mktemp --tmpdir "temp-${BUILD}-buildinfo-XXX") +SUPPORTED_VERS="9.8.0-z" +WORKING_DIR=$(dirname "${0}") +EMBARGOED_SUFFIX="nocompose-candidate" + +echo "Obtaining buildinfo for ${BUILD}..."; +brew buildinfo "${BUILD}" 2>&1 | tee "${BUILDLOG}" > /dev/null + +echo "Checking signatures for ${BUILD}..."; +"${WORKING_DIR}"/check_signatures.sh "${BUILDLOG}" + +# Return codes: +# - 1 - Buildinfo file not specified +# - 2 = Missing buildinfo file +# - 3 = No signatures +# - 4 = Multiple signature types found +# - 5 = PQC signature found +# - 6 = Old signature (fd431d51) found +# - 7 = Unknown signature found +ret=$?; +if [ "${ret}" -eq 6 ] ; then + echo "Build has old signatures; use tag_rhel_9_embargoed.sh"; + exit 2; +elif ! { [ "${ret}" -eq 5 ] || [ "${ret}" -eq 3 ] ; } ; then + echo "Signature check failed."; + exit 3; +fi + +echo "Tagging embargoed build for ${SUPPORTED_VERS}..."; +"${WORKING_DIR}"/tag_rhel.sh "${BUILD}" "${BUILDLOG}" "${EMBARGOED_SUFFIX}" "${SUPPORTED_VERS}" + +rm -f "${BUILDLOG}" + +# Local Variables: +# compile-command: "shellcheck tag_rhel_9_embargoed_pqc.sh" +# fill-column: 80 +# indent-tabs-mode: nil +# sh-basic-offset: 4 +# End: diff --git a/scripts/builds/tag_rhel_9_nocompose.sh b/scripts/builds/tag_rhel_9_nocompose.sh deleted file mode 100755 index 3bbe753..0000000 --- a/scripts/builds/tag_rhel_9_nocompose.sh +++ /dev/null @@ -1,42 +0,0 @@ -#!/bin/sh - -# Copyright (C) 2025 Red Hat, Inc. -# Written by: -# Andrew John Hughes -# -# This program is free software: you can redistribute it and/or modify -# it under the terms of the GNU Affero General Public License as -# published by the Free Software Foundation, either version 3 of the -# License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Affero General Public License for more details. -# -# You should have received a copy of the GNU Affero General Public License -# along with this program. If not, see . - -# Tag embargoed RHEL 9 RPMs into supported z-streams - -SUPPORTED_VERS="9.4.0-z 9.6.0-z" -BUILD=${1} - -if test "${BUILD}" = ""; then - echo "${0} "; - exit 1; -fi - -for ver in ${SUPPORTED_VERS}; do - tag="rhel-${ver}-nocompose-candidate"; - echo "Tagging ${BUILD} into ${tag}"; - brew tag-build --nowait ${tag} ${BUILD}; -done -brew watch-task --mine - -# Local Variables: -# compile-command: "shellcheck tag_rhel_9_nocompose.sh" -# fill-column: 80 -# indent-tabs-mode: nil -# sh-basic-offset: 4 -# End: diff --git a/scripts/builds/tag_rhel_9_public.sh b/scripts/builds/tag_rhel_9_public.sh new file mode 100755 index 0000000..cf810a9 --- /dev/null +++ b/scripts/builds/tag_rhel_9_public.sh @@ -0,0 +1,67 @@ +#!/bin/sh + +# Copyright (C) 2026 Red Hat, Inc. +# Written by: +# Andrew John Hughes +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +# Tag older public RHEL 9 RPMs into gating for all supported streams + +BUILD=${1} + +if test "${BUILD}" = ""; then + echo "${0} "; + exit 1; +fi + +BUILDLOG=$(mktemp --tmpdir "temp-${BUILD}-buildinfo-XXX") +SUPPORTED_VERS="9.4.0-z 9.6.0-z" +WORKING_DIR=$(dirname "${0}") +GATE_SUFFIX="gate" + +echo "Obtaining buildinfo for ${BUILD}..."; +brew buildinfo "${BUILD}" 2>&1 | tee "${BUILDLOG}" > /dev/null + +echo "Checking signatures for ${BUILD}..."; +"${WORKING_DIR}"/check_signatures.sh "${BUILDLOG}" + +# Return codes: +# - 1 - Buildinfo file not specified +# - 2 = Missing buildinfo file +# - 3 = No signatures +# - 4 = Multiple signature types found +# - 5 = PQC signature found +# - 6 = Old signature (fd431d51) found +# - 7 = Unknown signature found +ret=$?; +if [ "${ret}" -eq 5 ] ; then + echo "Build has PQC signatures; use tag_rhel_9_public_pqc.sh"; + exit 2; +elif ! { [ "${ret}" -eq 6 ] || [ "${ret}" -eq 3 ] ; } ; then + echo "Signature check failed."; + exit 3; +fi + +echo "Tagging build into gating for ${SUPPORTED_VERS}..."; +"${WORKING_DIR}"/tag_rhel.sh "${BUILD}" "${BUILDLOG}" "${GATE_SUFFIX}" "${SUPPORTED_VERS}" + +rm -f "${BUILDLOG}" + +# Local Variables: +# compile-command: "shellcheck tag_rhel_9_public.sh" +# fill-column: 80 +# indent-tabs-mode: nil +# sh-basic-offset: 4 +# End: diff --git a/scripts/builds/tag_rhel_9_public_pqc.sh b/scripts/builds/tag_rhel_9_public_pqc.sh new file mode 100755 index 0000000..423f5d7 --- /dev/null +++ b/scripts/builds/tag_rhel_9_public_pqc.sh @@ -0,0 +1,67 @@ +#!/bin/sh + +# Copyright (C) 2026 Red Hat, Inc. +# Written by: +# Andrew John Hughes +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +# Tag newer PQC public RHEL 9 RPMs into gating for all supported streams + +BUILD=${1} + +if test "${BUILD}" = ""; then + echo "${0} "; + exit 1; +fi + +BUILDLOG=$(mktemp --tmpdir "temp-${BUILD}-buildinfo-XXX") +SUPPORTED_VERS="9.9.0 9.8.0-z" +WORKING_DIR=$(dirname "${0}") +GATE_SUFFIX="gate" + +echo "Obtaining buildinfo for ${BUILD}..."; +brew buildinfo "${BUILD}" 2>&1 | tee "${BUILDLOG}" > /dev/null + +echo "Checking signatures for ${BUILD}..."; +"${WORKING_DIR}"/check_signatures.sh "${BUILDLOG}" + +# Return codes: +# - 1 - Buildinfo file not specified +# - 2 = Missing buildinfo file +# - 3 = No signatures +# - 4 = Multiple signature types found +# - 5 = PQC signature found +# - 6 = Old signature (fd431d51) found +# - 7 = Unknown signature found +ret=$?; +if [ "${ret}" -eq 6 ] ; then + echo "Build has old signatures; use tag_rhel_9_public.sh"; + exit 2; +elif ! { [ "${ret}" -eq 5 ] || [ "${ret}" -eq 3 ] ; } ; then + echo "Signature check failed."; + exit 3; +fi + +echo "Tagging build into gating for ${SUPPORTED_VERS}..."; +"${WORKING_DIR}"/tag_rhel.sh "${BUILD}" "${BUILDLOG}" "${GATE_SUFFIX}" "${SUPPORTED_VERS}" + +rm -f "${BUILDLOG}" + +# Local Variables: +# compile-command: "shellcheck tag_rhel_9_public_pqc.sh" +# fill-column: 80 +# indent-tabs-mode: nil +# sh-basic-offset: 4 +# End: diff --git a/scripts/builds/waive_issue.sh b/scripts/builds/waive_issue.sh new file mode 100755 index 0000000..88b0f51 --- /dev/null +++ b/scripts/builds/waive_issue.sh @@ -0,0 +1,132 @@ +#!/bin/bash + +# Copyright (C) 2026 Red Hat, Inc. +# Written by: +# Andrew John Hughes +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +# Waive a gating issue + +RHEL_VER=${1} +NVR=${2} +TESTCASE=${3} +COMMENT=${4} + +CURL=$(command -v curl) +JSON_TOOL=$(command -v json_verify) +JSON_FORMAT=$(command -v jq) +JSON_FILE=$(mktemp --tmpdir waive.XXXXXX.json) +HEADER_FILE=$(mktemp --tmpdir waive.XXXXXX.headers) +JSON_OUT=$(mktemp --tmpdir out.XXXXXX.json) + +CACERT=/etc/ssl/certs/2022-IT-Root-CA.pem +CACERT_DIR=$(dirname ${CACERT}) +URL="https://waiverdb.engineering.redhat.com/api/v1.0/waivers/" + +if test -z "${JSON_TOOL}" -o ! -x "${JSON_TOOL}" ; then + echo "JSON verifier not found. Skipping verification."; + SKIP_JSON=1; +else + SKIP_JSON=0; +fi + +if test "${RHEL_VER}" = ""; then + echo "No RHEL version specified."; + echo "${0} "; + exit 1; +fi + +if test "${NVR}" = ""; then + echo "No NVR specified."; + echo "${0} "; + exit 2; +fi + +if test "${TESTCASE}" = ""; then + echo "No testcase specified."; + echo "${0} "; + exit 3; +fi + +if test "${COMMENT}" = ""; then + COMMENT="Gating broken"; + echo "Setting COMMENT to default of '${COMMENT}'" +fi + +if test "${CURL}" = ""; then + echo "curl not found"; + exit 4; +fi + +if test "${JSON_FORMAT}" = ""; then + echo "jq not found"; + exit 5; +fi + +{ + echo "{"; + printf "\t\"subject_type\":\"brew-build\",\n"; + printf "\t\"subject_identifier\":\"%s\",\n" "${NVR}"; + printf "\t\"testcase\":\"%s\",\n" "${TESTCASE}"; + printf "\t\"waived\":true,\n"; + printf "\t\"product_version\":\"rhel-%d\",\n" "${RHEL_VER}" + printf "\t\"comment\":\"%s\"\n" "${COMMENT}"; + echo "}" +} > "${JSON_FILE}" + +if [ "${SKIP_JSON}" -eq 0 ] ; then + "${JSON_TOOL}" < "${JSON_FILE}" || exit 6; +fi + +CMD=("${CURL}" --silent --show-error --capath "${CACERT_DIR}" --negotiate -u :) + +JSON_COMMAND="--json"; +# Check --json is available +${CURL} ${JSON_COMMAND} 2> /dev/null +if [ $? -eq 2 ] ; then + echo "--json unsupported; falling back on --data-binary"; + { + echo "Content-Type: application/json"; + echo "Accept: application/json"; + } > "${HEADER_FILE}" + echo "Header file:"; + cat "${HEADER_FILE}" + CMD=("${CMD[@]}" --header "@${HEADER_FILE}" --data-binary); +else + CMD=("${CMD[@]}" "${JSON_COMMAND}"); +fi +CMD=("${CMD[@]}" "@${JSON_FILE}" "${URL}") + +echo "Sending the following JSON..."; +cat "${JSON_FILE}" + +echo "${CMD[@]}" + +if command "${CMD[@]}" > "${JSON_OUT}" ; then + "${JSON_FORMAT}" < "${JSON_OUT}" +else + echo "Failed to file waiver"; + exit 7; +fi + +rm -v "${JSON_FILE}" +rm -v "${HEADER_FILE}" + +# Local Variables: +# compile-command: "shellcheck waive_issue.sh" +# fill-column: 80 +# indent-tabs-mode: nil +# sh-basic-offset: 4 +# End: diff --git a/scripts/builds/tag_rhel_10.sh b/scripts/builds/waive_leapp_issue.sh similarity index 62% rename from scripts/builds/tag_rhel_10.sh rename to scripts/builds/waive_leapp_issue.sh index af08e32..a556070 100755 --- a/scripts/builds/tag_rhel_10.sh +++ b/scripts/builds/waive_leapp_issue.sh @@ -1,6 +1,6 @@ #!/bin/sh -# Copyright (C) 2025 Red Hat, Inc. +# Copyright (C) 2026 Red Hat, Inc. # Written by: # Andrew John Hughes # @@ -17,25 +17,29 @@ # You should have received a copy of the GNU Affero General Public License # along with this program. If not, see . -# Tag RHEL 10 RPMs into all supported streams +# Waive the leapp gating test which never seems to work -SUPPORTED_VERS="10.0-z 10.1-z 10.2" -BUILD=${1} +RHEL_VER=${1} +NVR=${2} -if test "${BUILD}" = ""; then - echo "${0} "; +WORKING_DIR=$(dirname "${0}") + +if test "${RHEL_VER}" = ""; then + echo "No RHEL version specified."; + echo "${0} "; exit 1; fi -for ver in ${SUPPORTED_VERS}; do - tag="rhel-${ver}-gate"; - echo "Tagging ${BUILD} into ${tag}"; - brew tag-build --nowait ${tag} ${BUILD}; -done -brew watch-task --mine +if test "${NVR}" = ""; then + echo "No NVR specified."; + echo "${0} "; + exit 2; +fi + +"${WORKING_DIR}"/waive_issue.sh "${RHEL_VER}" "${NVR}" leapp.brew-build.upgrade.distro "AWOL" # Local Variables: -# compile-command: "shellcheck tag_rhel_10.sh" +# compile-command: "shellcheck waive_leapp_issue.sh" # fill-column: 80 # indent-tabs-mode: nil # sh-basic-offset: 4 diff --git a/scripts/builds/waive_rpminspect.sh b/scripts/builds/waive_rpminspect.sh new file mode 100755 index 0000000..7912b94 --- /dev/null +++ b/scripts/builds/waive_rpminspect.sh @@ -0,0 +1,53 @@ +#!/bin/sh + +# Copyright (C) 2026 Red Hat, Inc. +# Written by: +# Andrew John Hughes +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +# Waive a rpminspect gating issue + +RHEL_VER=${1} +NVR=${2} +COMMENT=${3} + +WORKING_DIR=$(dirname "${0}") + +if test "${RHEL_VER}" = ""; then + echo "No RHEL version specified."; + echo "${0} "; + exit 1; +fi + +if test "${NVR}" = ""; then + echo "No NVR specified."; + echo "${0} "; + exit 2; +fi + +if test "${COMMENT}" = ""; then + echo "No comment specified."; + echo "${0} "; + exit 3; +fi + +"${WORKING_DIR}"/waive_issue.sh "${RHEL_VER}" "${NVR}" osci.brew-build.rpminspect.static-analysis "${COMMENT}" + +# Local Variables: +# compile-command: "shellcheck waive_rpminspect.sh" +# fill-column: 80 +# indent-tabs-mode: nil +# sh-basic-offset: 4 +# End: diff --git a/scripts/builds/waive_usual_rpminspect.sh b/scripts/builds/waive_usual_rpminspect.sh new file mode 100755 index 0000000..49ec4f8 --- /dev/null +++ b/scripts/builds/waive_usual_rpminspect.sh @@ -0,0 +1,48 @@ +#!/bin/sh + +# Copyright (C) 2026 Red Hat, Inc. +# Written by: +# Andrew John Hughes +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +# Waive the recurring rpminspect gating issues +# Should be resolved by RHELPLAN-102267 + +WORKING_DIR=$(dirname "${0}") + +RHEL_VER=${1} +NVR=${2} + +if test "${RHEL_VER}" = ""; then + echo "No RHEL version specified."; + echo "${0} "; + exit 1; +fi + +if test "${NVR}" = ""; then + echo "No NVR specified."; + echo "${0} "; + exit 2; +fi + +"${WORKING_DIR}"/waive_rpminspect.sh "${RHEL_VER}" "${NVR}" \ + "Usual failures we waived through rpmdiff; slowdebug unoptimised, RPATH and IPv4 functions" + +# Local Variables: +# compile-command: "shellcheck waive_usual_rpminspect.sh" +# fill-column: 80 +# indent-tabs-mode: nil +# sh-basic-offset: 4 +# End: diff --git a/scripts/builds/tag_rhel_10_nocompose.sh b/scripts/builds/waive_usual_tier0.sh similarity index 60% rename from scripts/builds/tag_rhel_10_nocompose.sh rename to scripts/builds/waive_usual_tier0.sh index 61fe498..94227a6 100755 --- a/scripts/builds/tag_rhel_10_nocompose.sh +++ b/scripts/builds/waive_usual_tier0.sh @@ -1,6 +1,6 @@ #!/bin/sh -# Copyright (C) 2025 Red Hat, Inc. +# Copyright (C) 2026 Red Hat, Inc. # Written by: # Andrew John Hughes # @@ -17,25 +17,30 @@ # You should have received a copy of the GNU Affero General Public License # along with this program. If not, see . -# Tag embargoed RHEL 10 RPMs into supported z-streams +# Waive the usual tier0 gating issue +# Should be resolved by OPENJDK-4517 -SUPPORTED_VERS="10.0-z" -BUILD=${1} +RHEL_VER=${1} +NVR=${2} -if test "${BUILD}" = ""; then - echo "${0} "; +WORKING_DIR=$(dirname "${0}") + +if test "${RHEL_VER}" = ""; then + echo "No RHEL version specified."; + echo "${0} "; exit 1; fi -for ver in ${SUPPORTED_VERS}; do - tag="rhel-${ver}-nocompose-candidate"; - echo "Tagging ${BUILD} into ${tag}"; - brew tag-build --nowait ${tag} ${BUILD}; -done -brew watch-task --mine +if test "${NVR}" = ""; then + echo "No NVR specified."; + echo "${0} "; + exit 2; +fi + +"${WORKING_DIR}"/waive_issue.sh "${RHEL_VER}" "${NVR}" osci.brew-build.tier0.functional "Test unable to parse spec file" # Local Variables: -# compile-command: "shellcheck tag_rhel_10_nocompose.sh" +# compile-command: "shellcheck waive_usual_tier0.sh" # fill-column: 80 # indent-tabs-mode: nil # sh-basic-offset: 4 diff --git a/sources b/sources index 92c66c9..d8366fc 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30 -SHA512 (openjdk-21.0.10+7.tar.xz) = 997bae911cd414ae226603f4bb76cae3914dfc324f3c955cb3a3ad767f873b0422d5328fab3813608c59cbe6ec6d6759165c0b1aa57fc6779e051e54729d35cd +SHA512 (openjdk-21.0.12.1+1.tar.xz) = 96cf4f861d7c21ab9a4cd1e761797815c0c7b9b7891157febce980f0b77fff23c84fc5af51e51a8321f200ac447bf2d22230989c415c7e883a65d1d3221fb452