import UBI java-21-openjdk-21.0.1.0.12-2.el8

2023-11-15 06:27:04 +00:00 · 2023-11-15 06:27:04 +00:00 · 726bc53b0f
commit 726bc53b0f
parent 8dd1c3363f
32 changed files with 1092 additions and 5595 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1,2 +1,2 @@
-/openjdk-jdk17u-jdk-17.0.7+7.tar.xz
-/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz
+SOURCES/openjdk-21.0.1+12.tar.xz
+SOURCES/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz
--- a/.java-21-openjdk.metadata
+++ b/.java-21-openjdk.metadata
@ -0,0 +1,2 @@
+062c60df2265006e2be6e2cec33b961d5183acd9 SOURCES/openjdk-21.0.1+12.tar.xz
+c8281ee37b77d535c9c1af86609a531958ff7b34 SOURCES/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz
--- a/SOURCES/CheckVendor.java
+++ b/SOURCES/CheckVendor.java
--- a/SOURCES/README.md
+++ b/SOURCES/README.md
@ -1,14 +1,12 @@
-OpenJDK 17 is the latest Long-Term Support (LTS) release of the Java platform.
+OpenJDK 21 is the latest Long-Term Support (LTS) release of the Java platform.

-For a list of major changes from OpenJDK 11 (java-11-openjdk), see the upstream
-release page for OpenJDK 17 and the preceding interim releases:
+For a list of major changes from OpenJDK 17 (java-17-openjdk), see the upstream
+release page for OpenJDK 21 and the preceding interim releases:

-* 12: https://openjdk.java.net/projects/jdk/12/
-* 13: https://openjdk.java.net/projects/jdk/13/
-* 14: https://openjdk.java.net/projects/jdk/14/
-* 15: https://openjdk.java.net/projects/jdk/15/
-* 16: https://openjdk.java.net/projects/jdk/16/
-* 17: https://openjdk.java.net/projects/jdk/17/
+* 18: https://openjdk.java.net/projects/jdk/18/
+* 19: https://openjdk.java.net/projects/jdk/19/
+* 20: https://openjdk.java.net/projects/jdk/20/
+* 21: https://openjdk.java.net/projects/jdk/21/

 # Rebuilding the OpenJDK package

@ -20,21 +18,21 @@ multiple builds which only differ by the platform they were built on.

 This does make rebuilding the package slightly more complicated than a
 normal package. Modifications should be made to the
-`java-17-openjdk-portable.specfile` file, which can be found with this
+`java-21-openjdk-portable.specfile` file, which can be found with this
 README file in the source RPM or installed in the documentation tree
-by the `java-17-openjdk-headless` RPM.
+by the `java-21-openjdk-headless` RPM.

-Once the modified `java-17-openjdk-portable` RPMs are built, they
+Once the modified `java-21-openjdk-portable` RPMs are built, they
 should be installed and will produce a number of tarballs in the
-`/usr/lib/jvm` directory. The `java-17-openjdk` RPMs can then be
+`/usr/lib/jvm` directory. The `java-21-openjdk` RPMs can then be
 built, which will use these tarballs to create the usual RPMs found in
-RHEL. The `java-17-openjdk-portable` RPMs can be uninstalled once the
+RHEL. The `java-21-openjdk-portable` RPMs can be uninstalled once the
 desired final RPMs are produced.

-Note that the `java-17-openjdk.spec` file has a hard requirement on
-the exact version of java-17-openjdk-portable to use, so this will
+Note that the `java-21-openjdk.spec` file has a hard requirement on
+the exact version of java-21-openjdk-portable to use, so this will
 need to be modified if the version or rpmrelease values are changed in
-`java-17-openjdk-portable.specfile`.
+`java-21-openjdk-portable.specfile`.

 To reduce the number of RPMs involved, the `fastdebug` and `slowdebug`
 builds may be disabled using `--without fastdebug` and `--without
--- a/SOURCES/TestCryptoLevel.java
+++ b/SOURCES/TestCryptoLevel.java
--- a/SOURCES/TestECDSA.java
+++ b/SOURCES/TestECDSA.java
--- a/SOURCES/TestSecurityProperties.java
+++ b/SOURCES/TestSecurityProperties.java
--- a/SOURCES/TestTranslations.java
+++ b/SOURCES/TestTranslations.java
@ -52,7 +52,7 @@ public class TestTranslations {
        map.put(Locale.FRANCE, new String[] { "heure normale des Rocheuses", "UTC\u221207:00", "MST",
                                              "heure d\u2019\u00e9t\u00e9 des Rocheuses", "UTC\u221206:00", "MDT",
                                              "heure des Rocheuses", "UTC\u221207:00", "MT"});
-        map.put(Locale.GERMANY, new String[] { "Rocky Mountain-Normalzeit", "GMT-07:00", "MST",
+        map.put(Locale.GERMANY, new String[] { "Rocky-Mountain-Normalzeit", "GMT-07:00", "MST",
                                               "Rocky-Mountain-Sommerzeit", "GMT-06:00", "MDT",
                                               "Rocky-Mountain-Zeit", "GMT-07:00", "MT"});
        CIUDAD_JUAREZ = Collections.unmodifiableMap(map);
--- a/SOURCES/alt-java.c
+++ b/SOURCES/alt-java.c
@ -0,0 +1,100 @@
+/*
+ * Copyright (C) 2023 Red Hat, Inc.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 only, as
+ * published by the Free Software Foundation.  Red Hat designates this
+ * particular file as subject to the "Classpath" exception as provided
+ * by Red Hat in the LICENSE file that accompanied this code.
+ *
+ * This code is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+ * version 2 for more details (a copy is included in the LICENSE file that
+ * accompanied this code).
+ *
+ * You should have received a copy of the GNU General Public License version
+ * 2 along with this work; if not, write to the Free Software Foundation,
+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ */
+
+#include <errno.h>
+#include <libgen.h>
+#include <linux/limits.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <string.h>
+#include <sys/prctl.h>
+#include <unistd.h>
+
+/* Per task speculation control */
+#ifndef PR_GET_SPECULATION_CTRL
+# define PR_GET_SPECULATION_CTRL    52
+#endif
+#ifndef PR_SET_SPECULATION_CTRL
+# define PR_SET_SPECULATION_CTRL    53
+#endif
+/* Speculation control variants */
+#ifndef PR_SPEC_STORE_BYPASS
+# define PR_SPEC_STORE_BYPASS          0
+#endif
+/* Return and control values for PR_SET/GET_SPECULATION_CTRL */
+
+#ifndef PR_SPEC_NOT_AFFECTED
+# define PR_SPEC_NOT_AFFECTED          0
+#endif
+#ifndef PR_SPEC_PRCTL
+# define PR_SPEC_PRCTL                 (1UL << 0)
+#endif
+#ifndef PR_SPEC_ENABLE
+# define PR_SPEC_ENABLE                (1UL << 1)
+#endif
+#ifndef PR_SPEC_DISABLE
+# define PR_SPEC_DISABLE               (1UL << 2)
+#endif
+#ifndef PR_SPEC_FORCE_DISABLE
+# define PR_SPEC_FORCE_DISABLE         (1UL << 3)
+#endif
+#ifndef PR_SPEC_DISABLE_NOEXEC
+# define PR_SPEC_DISABLE_NOEXEC        (1UL << 4)
+#endif
+
+static void set_speculation() {
+#if defined(__linux__) && defined(__x86_64__)
+  // PR_SPEC_DISABLE_NOEXEC doesn't survive execve, so we can't use it
+  //  if ( prctl(PR_SET_SPECULATION_CTRL,
+  //           PR_SPEC_STORE_BYPASS,
+  //           PR_SPEC_DISABLE_NOEXEC, 0, 0) == 0 ) {
+  //  return;
+  // }
+  prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0);
+#else
+#warning alt-java requested but SSB mitigation not available on this platform.
+#endif
+}
+
+int main(int argc, char **argv) {
+  set_speculation();
+
+  char our_name[PATH_MAX], java_name[PATH_MAX];
+  ssize_t len = readlink("/proc/self/exe", our_name, PATH_MAX - 1);
+  if (len < 0) {
+    perror("I can't find myself");
+    exit(2);
+  }
+
+  our_name[len] = '\0'; // readlink(2) doesn't append a null byte
+  char *path = dirname(our_name);
+  strncpy(java_name, path, PATH_MAX - 1);
+
+  size_t remaining_bytes = PATH_MAX - strlen(path) - 1;
+  strncat(java_name, "/java", remaining_bytes);
+
+  execv(java_name, argv);
+  fprintf(stderr, "%s failed to launch: %s\n", java_name, strerror(errno));
+
+  exit(1);
+}
+
--- a/SOURCES/fips-21u-75ffdc48eda.patch
+++ b/SOURCES/fips-21u-75ffdc48eda.patch
--- a/SOURCES/java-21-openjdk-portable.specfile
+++ b/SOURCES/java-21-openjdk-portable.specfile
@ -1,6 +1,3 @@
-# portable jdk 21 specific bug, _jvmdir being missing
-%define _jvmdir /usr/lib/jvm
-
 # debug_package %%{nil} is portable-jdks specific
 %define  debug_package %{nil}

@ -31,6 +28,10 @@
 # Build with system libraries
 %bcond_with system_libs

+# This is RHEL 7 specific as it doesn't seem to have the
+# __brp_strip_static_archive macro.
+%define __os_install_post %{nil}
+
 # Workaround for stripping of debug symbols from static libraries
 %if %{with staticlibs}
 %define __brp_strip_static_archive %{nil}
@ -39,13 +40,6 @@
 %global include_staticlibs 0
 %endif

-# Define whether to use the bootstrap JDK directly or with a fresh libjvm.so
-%if %{with fresh_libjvm}
-%global build_hotspot_first 1
-%else
-%global build_hotspot_first 0
-%endif
-
 %if %{with system_libs}
 %global system_libs 1
 %global link_type system
@ -61,10 +55,6 @@
 # See: https://bugzilla.redhat.com/show_bug.cgi?id=1520879
 %global _find_debuginfo_opts -g

-# Disable LTO as this causes build failures at the moment.
-# See RHBZ#1861401
-%define _lto_cflags %{nil}
-
 # note: parametrized macros are order-sensitive (unlike not-parametrized) even with normal macros
 # also necessary when passing it as parameter to other macros. If not macro, then it is considered a switch
 # see the difference between global and define:
@ -151,7 +141,7 @@
 %global zgc_arches x86_64
 # Set of architectures for which alt-java has SSB mitigation
 %global ssbd_arches x86_64
-# Set of architectures for which java has short vector math library (libjsvml.so)
+# Set of architectures for which java has short vector math library (libsvml.so)
 %global svml_arches x86_64
 # Set of architectures where we verify backtraces with gdb
 # s390x fails on RHEL 7 so we exclude it there
@ -239,8 +229,12 @@
 # Target to use to just build HotSpot
 %global hotspot_target hotspot

-# JDK to use for bootstrapping
-%global bootjdk /usr/lib/jvm/java-%{buildjdkver}-openjdk
+# DTS toolset to use to provide gcc & binutils
+%global dtsversion 10
+
+# Disable LTO as this causes build failures at the moment.
+# See RHBZ#1861401
+%define _lto_cflags %{nil}

 # Filter out flags from the optflags macro that cause problems with the OpenJDK build
 # We filter out -O flags so that the optimization of HotSpot is not lowered from O3 to O2
@ -251,12 +245,6 @@
 %global ourcppflags %(echo %ourflags | sed -e 's|-fexceptions||')
 %global ourldflags %{__global_ldflags}

-# With disabled nss is NSS deactivated, so NSS_LIBDIR can contain the wrong path
-# the initialization must be here. Later the pkg-config have buggy behavior
-# looks like openjdk RPM specific bug
-# Always set this so the nss.cfg file is not broken
-%global NSS_LIBDIR %(pkg-config --variable=libdir nss)
-
 # In some cases, the arch used by the JDK does
 # not match _arch.
 # Also, in some cases, the machine name used by SystemTap
@ -317,23 +305,21 @@
 %global stapinstall %{nil}
 %endif

-# always off for portable builds
 %ifarch %{systemtap_arches}
-%global with_systemtap 0
+%global with_systemtap 1
 %else
 %global with_systemtap 0
 %endif

 # New Version-String scheme-style defines
-%global featurever 17
-%global fakefeaturever 21
+%global featurever 21
 %global interimver 0
-%global updatever 7
+%global updatever 1
 %global patchver 0
 # buildjdkver is usually same as %%{featurever},
 # but in time of bootstrap of next jdk, it is featurever-1,
 # and this it is better to change it here, on single place
-%global buildjdkver 17
+%global buildjdkver %{featurever}
 # We don't add any LTS designator for STS packages (Fedora and EPEL).
 # We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined.
 %if 0%{?rhel} && !0%{?epel}
@ -343,6 +329,16 @@
  %global lts_designator ""
  %global lts_designator_zip ""
 %endif
+# JDK to use for bootstrapping
+%global bootjdk /usr/lib/jvm/java-%{buildjdkver}-openjdk
+# Define whether to use the bootstrap JDK directly or with a fresh libjvm.so
+# This will only work where the bootstrap JDK is the same major version
+# as the JDK being built
+%if %{with fresh_libjvm} && %{buildjdkver} == %{featurever}
+%global build_hotspot_first 1
+%else
+%global build_hotspot_first 0
+%endif

 # Define vendor information used by OpenJDK
 %global oj_vendor Red Hat, Inc.
@ -357,7 +353,7 @@
 %global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=%{name}&version=%{fedora}
 %else
 %if 0%{?rhel}
-%global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi?product=Red%20Hat%20Enterprise%20Linux%20%{rhel}&component=%{name}
+%global oj_vendor_bug_url https://access.redhat.com/support/cases/
 %else
 %global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi
 %endif
@ -368,15 +364,22 @@
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      6.0.0pre00-c848b93a8598
 # Define current Git revision for the FIPS support patches
-%global fipsver bf363eecce3
+%global fipsver 75ffdc48eda
+# Define JDK versions
+%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
+%global javaver         %{featurever}
+# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames
+%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn})
+# The tag used to create the OpenJDK tarball
+%global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}

 # Standard JPackage naming and versioning defines
 %global origin          openjdk
 %global origin_nice     OpenJDK
-%global top_level_dir_name   %{origin}
+%global top_level_dir_name   %{vcstag}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        7
-%global rpmrelease      2
+%global buildver        12
+%global rpmrelease      1
 #%%global tagsuffix     %%{nil}
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
@ -390,15 +393,6 @@
 # for techpreview, using 1, so slowdebugs can have 0
 %global priority %( printf '%08d' 1 )
 %endif
-%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
-# Force 21 until we are actually ready to build that JDK version
-%global javaver         %{fakefeaturever}
-
-# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames
-%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn})
-
-# The tag used to create the OpenJDK tarball
-%global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}

 # Define milestone (EA for pre-releases, GA for releases)
 # Release will be (where N is usually a number starting at 1):
@ -408,7 +402,7 @@
 %if %{is_ga}
 %global build_type GA
 %global ea_designator ""
-%global ea_designator_zip ""
+%global ea_designator_zip %{nil}
 %global extraver %{nil}
 %global eaprefix %{nil}
 %else
@ -420,15 +414,16 @@
 %endif

 # parametrized macros are order-sensitive
-%global compatiblename  java-%{fakefeaturever}-%{origin}
+%global compatiblename  java-%{featurever}-%{origin}
 %global fullversion     %{compatiblename}-%{version}-%{release}
 # images directories from upstream build
 %global jdkimage                jdk
 %global static_libs_image       static-libs
 # output dir stub
-%define buildoutputdir() %{expand:build/jdk%{fakefeaturever}.build%{?1}}
-%define installoutputdir() %{expand:install/jdk%{fakefeaturever}.install%{?1}}
-%define packageoutputdir() %{expand:packages/jdk%{fakefeaturever}.packages%{?1}}
+%define buildoutputdir() %{expand:build/jdk%{featurever}.build%{?1}}
+%define installoutputdir() %{expand:install/jdk%{featurever}.install%{?1}}
+%global altjavaoutputdir install/altjava.install
+%define packageoutputdir() %{expand:packages/jdk%{featurever}.packages%{?1}}
 # we can copy the javadoc to not arched dir, or make it not noarch
 %define uniquejavadocdir()    %{expand:%{fullversion}.%{_arch}%{?1}}
 # main id and dir of this jdk
@ -471,6 +466,12 @@
 %global __requires_exclude ^(%{_privatelibs}|%{_publiclibs})$
 %endif

+# VM variant being built
+%ifarch %{zero_arches}
+%global vm_variant zero
+%else
+%global vm_variant server
+%endif

 %global etcjavasubdir     %{_sysconfdir}/java/java-%{javaver}-%{origin}
 %define etcjavadir()      %{expand:%{etcjavasubdir}/%{uniquesuffix -- %{?1}}}
@ -493,23 +494,6 @@
 %global alternatives_requires %{_sbindir}/alternatives
 %endif

-%if %{with_systemtap}
-# Where to install systemtap tapset (links)
-# We would like these to be in a package specific sub-dir,
-# but currently systemtap doesn't support that, so we have to
-# use the root tapset dir for now. To distinguish between 64
-# and 32 bit architectures we place the tapsets under the arch
-# specific dir (note that systemtap will only pickup the tapset
-# for the primary arch for now). Systemtap uses the machine name
-# aka target_cpu as architecture specific directory name.
-%global tapsetroot /usr/share/systemtap
-%global tapsetdirttapset %{tapsetroot}/tapset/
-%global tapsetdir %{tapsetdirttapset}/%{stapinstall}
-%endif
-
-# x86 is not supported by OpenJDK 17
-ExcludeArch: %{ix86}
-
 # Portables have no repo (requires/provides), but these are awesome for orientation in spec
 # Also scriptlets are happily missing and files are handled old fashion
 # not-duplicated requires/provides/obsoletes for normal/debug packages
@ -533,12 +517,12 @@ ExcludeArch: %{ix86}

 # Prevent brp-java-repack-jars from being run
 %global __jar_repack 0
+# Define the architectures on which we build
+ExclusiveArch: %{aarch64} %{ppc64le} s390x x86_64
+# Define the OS this package is built on
+%global pkgos rhel7

-# portables have grown out of its component, moving back to java-x-vendor
-# this expression, when declared as global, filled component with java-x-vendor portable
-%define component %(echo %{name} | sed "s;-portable;;g")
-
-Name:    java-%{javaver}-%{origin}-portable
+Name:    java-%{javaver}-%{origin}-portable%{?pkgos:-%{pkgos}}
 Version: %{newjavaver}.%{buildver}
 Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
 # java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons
@ -552,6 +536,11 @@ Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
 # provides >= 1.6.0 must specify the epoch, "java >= 1:1.6.0".

 Epoch:   1
+
+# portables have grown out of its component, moving back to java-x-vendor
+# this expression, when declared as global, filled component with java-x-vendor portable
+%define component %(echo %{name} | sed "s;-portable%{?pkgos:-%{pkgos}};;g")
+
 Summary: %{origin_nice} %{featurever} Runtime Environment portable edition
 # Groups are only used up to RHEL 8 and on Fedora versions prior to F30
 %if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30)
@ -575,15 +564,13 @@ Group:   Development/Languages
 License:  ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA
 URL:      http://openjdk.java.net/

-
 # The source tarball, generated using generate_source_tarball.sh
-Source0: openjdk-jdk%{featurever}u-%{vcstag}.tar.xz
+Source0: https://openjdk-sources.osci.io/openjdk%{featurever}/open%{vcstag}%{ea_designator_zip}.tar.xz

 # Use 'icedtea_sync.sh' to update the following
 # They are based on code contained in the IcedTea project (6.x).
 # Systemtap tapsets. Zipped up to keep it small.
-# Disabled in portables
-#Source8: tapsets-icedtea-%%{icedteaver}.tar.xz
+Source8: tapsets-icedtea-%%{icedteaver}.tar.xz

 # Desktop files. Adapted from IcedTea
 # Disabled in portables
@ -592,8 +579,8 @@ Source0: openjdk-jdk%{featurever}u-%{vcstag}.tar.xz
 # Release notes
 Source10: NEWS

-# nss configuration file
-Source11: nss.cfg.in
+# Source code for alt-java
+Source11: alt-java.c

 # Removed libraries that we link instead
 Source12: remove-intree-libraries.sh
@ -619,19 +606,9 @@ Source18: TestTranslations.java
 #
 ############################################

-# Ignore AWTError when assistive technologies are loaded
-Patch1:    rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
-Patch3:    rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
-# NSS via SunPKCS11 Provider (disabled due to memory leak).
-Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
-# RH1750419: enable build of speculative store bypass hardened alt-java (CVE-2018-3639)
-Patch600: rh1750419-redhat_alt_java.patch
-# Depend on pcsc-lite-libs instead of pcsc-lite-devel as this is only in optional repo
-Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
-
 # Crypto policy and FIPS support patches
-# Patch is generated from the fips-17u tree at https://github.com/rh-openjdk/jdk/tree/fips-17u
-# as follows: git diff %%{vcstag} src make test > fips-17u-$(git show -s --format=%h HEAD).patch
+# Patch is generated from the fips-21u tree at https://github.com/rh-openjdk/jdk/tree/fips-21u
+# as follows: git diff %%{vcstag} src make test > fips-21u-$(git show -s --format=%h HEAD).patch
 # Diff is limited to src and make subdirectories to exclude .github changes
 # Fixes currently included:
 # PR3183, RH1340845: Follow system wide crypto policy
@ -655,7 +632,7 @@ Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-d
 # RH2104724: Avoid import/export of DH private keys
 # RH2092507: P11Key.getEncoded does not work for DH keys in FIPS mode
 # Build the systemconf library on all platforms
-# RH2048582: Support PKCS#12 keystores
+# RH2048582: Support PKCS#12 keystores [now part of JDK-8301553 upstream]
 # RH2020290: Support TLS 1.3 in FIPS mode
 # Add nss.fips.cfg support to OpenJDK tree
 # RH2117972: Extend the support for NSS DBs (PKCS11) in FIPS mode
@ -664,8 +641,8 @@ Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-d
 # RH2134669: Add missing attributes when registering services in FIPS mode.
 # test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
 # RH1940064: Enable XML Signature provider in FIPS mode
-# RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized
-Patch1001: fips-17u-%{fipsver}.patch
+# RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized [now part of JDK-8301553 upstream]
+Patch1001: fips-%{featurever}u-%{fipsver}.patch

 #############################################
 #
@ -673,17 +650,19 @@ Patch1001: fips-17u-%{fipsver}.patch
 #
 #############################################

+# JDK-8009550, RH910107: Depend on pcsc-lite-libs instead of pcsc-lite-devel as this is only in optional repo
+# PR: https://github.com/openjdk/jdk/pull/15409
+Patch6: jdk8009550-rh910107-fail_to_load_pcsc_library.patch
+
 # Currently empty

 #############################################
 #
-# OpenJDK patches appearing in 17.0.8
+# OpenJDK patches which missed last update
 #
 #############################################
-# JDK-8274864: Remove Amman/Cairo hacks in ZoneInfoFile
-Patch2001: jdk8274864-remove_amman_cairo_hacks.patch
-# JDK-8305113: (tz) Update Timezone Data to 2023c
-Patch2002: jdk8305113-tzdata2023c.patch
+
+# Currently empty

 #############################################
 #
@ -691,11 +670,7 @@ Patch2002: jdk8305113-tzdata2023c.patch
 #
 #############################################

-#############################################
-#
-# OpenJDK patches targetted for 17.0.6
-#
-#############################################
+# Currently empty

 BuildRequires: autoconf
 BuildRequires: automake
@ -707,6 +682,8 @@ BuildRequires: desktop-file-utils
 BuildRequires: elfutils-devel
 BuildRequires: file
 BuildRequires: fontconfig-devel
+BuildRequires: devtoolset-%{dtsversion}-gcc
+BuildRequires: devtoolset-%{dtsversion}-gcc-c++
 BuildRequires: gcc-c++
 BuildRequires: gdb
 BuildRequires: libxslt
@ -717,7 +694,7 @@ BuildRequires: libXrandr-devel
 BuildRequires: libXrender-devel
 BuildRequires: libXt-devel
 BuildRequires: libXtst-devel
-# Requirement for setting up nss.cfg
+# Requirement for setting up nss.fips.cfg
 BuildRequires: nss-devel
 # Requirement for system security property test
 # N/A for portable. RHEL7 doesn't provide them
@ -728,9 +705,8 @@ BuildRequires: zip
 # to pack portable tarballs
 BuildRequires: tar
 BuildRequires: unzip
-# No javapackages-filesystem on el7,nor is needed for portables
-# BuildRequires: javapackages-filesystem
-BuildRequires: java-%{buildjdkver}-openjdk-devel
+BuildRequires: javapackages-tools
+BuildRequires: java-%{buildjdkver}-%{origin}%{?pkgos:-%{pkgos}}-devel
 # Zero-assembler build requirement
 %ifarch %{zero_arches}
 BuildRequires: libffi-devel
@ -755,18 +731,18 @@ BuildRequires: lcms2-devel
 BuildRequires: libjpeg-devel
 BuildRequires: libpng-devel
 %else
-# Version in src/java.desktop/share/native/libfreetype/include/freetype/freetype.h
-Provides: bundled(freetype) = 2.12.1
+# Version in src/java.desktop/share/legal/freetype.md
+Provides: bundled(freetype) = 2.13.0
 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
 Provides: bundled(giflib) = 5.2.1
 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h
-Provides: bundled(harfbuzz) = 4.4.1
+Provides: bundled(harfbuzz) = 7.2.0
 # Version in src/java.desktop/share/native/liblcms/lcms2.h
-Provides: bundled(lcms2) = 2.12.0
+Provides: bundled(lcms2) = 2.15.0
 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h
 Provides: bundled(libjpeg) = 6b
 # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h
-Provides: bundled(libpng) = 1.6.37
+Provides: bundled(libpng) = 1.6.39
 # We link statically against libstdc++ to increase portability
 BuildRequires: libstdc++-static
 %endif
@ -914,10 +890,10 @@ The %{origin_nice} %{featurever} miscellany.
 echo "Preparing %{oj_vendor_version}"

 # Using the echo macro breaks rpmdev-bumpspec, as it parses the first line of stdout :-(
-%if 0%{?stapinstall:1}
-  echo "CPU: %{_target_cpu}, arch install directory: %{archinstall}, SystemTap install directory: %{stapinstall}"
+%if 0%{?_build_cpu:1}
+  echo "CPU: %{_target_cpu}, arch install directory: %{archinstall}, SystemTap install directory: %{_build_cpu}"
 %else
-  %{error:Unrecognised architecture %{_target_cpu}}
+  %{error:Unrecognised architecture %{_build_cpu}}
 %endif

 if [ %{include_normal_build} -eq 0 -o  %{include_normal_build} -eq 1 ] ; then
@ -942,6 +918,12 @@ if [ %{include_debug_build} -eq 0 -a  %{include_normal_build} -eq 0 -a  %{includ
  echo "You have disabled all builds (normal,fastdebug,slowdebug). That is a no go."
  exit 14
 fi
+
+%if %{with fresh_libjvm} && ! %{build_hotspot_first}
+echo "WARNING: The build of a fresh libjvm has been disabled due to a JDK version mismatch"
+echo "Build JDK version is %{buildjdkver}, feature JDK version is %{featurever}"
+%endif
+
 %setup -q -c -n %{uniquesuffix ""} -T -a 0
 # https://bugzilla.redhat.com/show_bug.cgi?id=1189084
 prioritylength=`expr length %{priority}`
@ -959,19 +941,12 @@ sh %{SOURCE12} %{top_level_dir_name}

 # Patch the JDK
 pushd %{top_level_dir_name}
-%patch1 -p1
-%patch3 -p1
-%patch6 -p1
 # Add crypto policy and FIPS support
 %patch1001 -p1
-# nss.cfg PKCS11 support; must come last as it also alters java.security
-%patch1000 -p1
-# tzdata update
-%patch2001 -p1
-%patch2002 -p1
+# Patches in need of upstreaming
+%patch6 -p1
 popd # openjdk

-%patch600

 # The OpenJDK version file includes the current
 # upstream version information. For some reason,
@ -1005,18 +980,8 @@ cp -r tapset tapset%{fastdebug_suffix}

 for suffix in %{build_loop} ; do
  for file in "tapset"$suffix/*.in; do
-    OUTPUT_FILE=`echo $file | sed -e "s:\.stp\.in$:-%{version}-%{release}.%{_arch}.stp:g"`
-    sed -e "s:@ABS_SERVER_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/server/libjvm.so:g" $file > $file.1
-    sed -e "s:@JAVA_SPEC_VER@:%{javaver}:g" $file.1 > $file.2
-# TODO find out which architectures other than i686 have a client vm
-%ifarch %{ix86}
-    sed -e "s:@ABS_CLIENT_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/client/libjvm.so:g" $file.2 > $OUTPUT_FILE
-%else
-    sed -e "/@ABS_CLIENT_LIBJVM_SO@/d" $file.2 > $OUTPUT_FILE
-%endif
-    sed -i -e "s:@ABS_JAVA_HOME_DIR@:%{_jvmdir}/%{sdkdir -- $suffix}:g" $OUTPUT_FILE
-    sed -i -e "s:@INSTALL_ARCH_DIR@:%{archinstall}:g" $OUTPUT_FILE
-    sed -i -e "s:@prefix@:%{_jvmdir}/%{sdkdir -- $suffix}/:g" $OUTPUT_FILE
+    sed -i -e "s:@JAVA_SPEC_VER@:%{javaver}:g" $file
+    sed -i -e "s:@INSTALL_ARCH_DIR@:%{archinstall}:g" $file
  done
 done
 # systemtap tapsets ends
@ -1025,10 +990,8 @@ done
 # Prepare desktop files
 # Portables do not have desktop integration

-# Setup nss.cfg
-sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE11} > nss.cfg
-
 %build
+
 # How many CPU's do we have?
 export NUM_PROC=%(/usr/bin/getconf _NPROCESSORS_ONLN 2> /dev/null || :)
 export NUM_PROC=${NUM_PROC:-1}
@ -1061,6 +1024,10 @@ EXTRA_CPP_FLAGS="$(echo ${EXTRA_CPP_FLAGS} | sed -e 's|-mstackrealign|-mincoming
 %endif
 export EXTRA_CFLAGS EXTRA_CPP_FLAGS

+echo "Building %{SOURCE11}"
+mkdir -p %{altjavaoutputdir}
+gcc ${EXTRA_CFLAGS} -o %{altjavaoutputdir}/%{alt_java_name} %{SOURCE11}
+
 echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}"

 function buildjdk() {
@ -1098,22 +1065,22 @@ function buildjdk() {
    # rather than ${link_opt} as the system versions
    # are always used in a system_libs build, even
    # for the static library build
-    bash ${top_dir_abs_src_path}/configure \
+    scl enable devtoolset-%{dtsversion} "bash ${top_dir_abs_src_path}/configure \
 %ifarch %{zero_arches}
    --with-jvm-variants=zero \
 %endif
 %ifarch %{ppc64le}
    --with-jobs=1 \
 %endif
-    --with-cacerts-file=$(readlink -f %{_sysconfdir}/pki/java/cacerts)  \
+    --with-cacerts-file=`readlink -f %{_sysconfdir}/pki/java/cacerts`  \
    --with-version-build=%{buildver} \
-    --with-version-pre="${ea_designator}" \
-    --with-version-opt=%{lts_designator} \
-    --with-vendor-version-string="%{oj_vendor_version}" \
-    --with-vendor-name="%{oj_vendor}" \
-    --with-vendor-url="%{oj_vendor_url}" \
-    --with-vendor-bug-url="%{oj_vendor_bug_url}" \
-    --with-vendor-vm-bug-url="%{oj_vendor_bug_url}" \
+    --with-version-pre=\"%{ea_designator}\" \
+    --with-version-opt=\"%{lts_designator}\" \
+    --with-vendor-version-string=\"%{oj_vendor_version}\" \
+    --with-vendor-name=\"%{oj_vendor}\" \
+    --with-vendor-url=\"%{oj_vendor_url}\" \
+    --with-vendor-bug-url=\"%{oj_vendor_bug_url}\" \
+    --with-vendor-vm-bug-url=\"%{oj_vendor_bug_url}\" \
    --with-boot-jdk=${buildjdk} \
    --with-debug-level=${debuglevel} \
    --with-native-debug-symbols="${debug_symbols}" \
@ -1127,29 +1094,76 @@ function buildjdk() {
    --with-lcms=${link_opt} \
    --with-harfbuzz=${link_opt} \
    --with-stdc++lib=${libc_link_opt} \
-    --with-extra-cxxflags="$EXTRA_CPP_FLAGS" \
-    --with-extra-cflags="$EXTRA_CFLAGS" \
-    --with-extra-ldflags="%{ourldflags}" \
-    --with-num-cores="$NUM_PROC" \
-    --with-source-date="${SOURCE_DATE_EPOCH}" \
+    --with-extra-cxxflags=\"$EXTRA_CPP_FLAGS\" \
+    --with-extra-cflags=\"$EXTRA_CFLAGS\" \
+    --with-extra-ldflags=\"%{ourldflags}\" \
+    --with-num-cores=\"$NUM_PROC\" \
+    --with-source-date=\"${SOURCE_DATE_EPOCH}\" \
    --disable-javac-server \
 %ifarch %{zgc_arches}
    --with-jvm-features=zgc \
 %endif
-    --disable-warnings-as-errors
+    --disable-warnings-as-errors"

    cat spec.gmk
-    make LOG=trace $maketargets || \
-	( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name \"hs_err_pid*.log\" | xargs cat && false )
-
+    scl enable devtoolset-%{dtsversion} "make LOG=trace $maketargets || \
+        ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name \"hs_err_pid*.log\" | xargs cat && false )"
    popd
 }

+function stripjdk() {
+    local outputdir=${1}
+    local jdkimagepath=${outputdir}/images/%{jdkimage}
+    local jreimagepath=${outputdir}/images/%{jreimage}
+    local jmodimagepath=${outputdir}/images/jmods
+    local supportdir=${outputdir}/support
+
+    if [ "x$suffix" = "x" ] ; then
+        # Keep the unstripped version for consumption by RHEL RPMs
+        cp -a ${jdkimagepath}{,.unstripped}
+
+        # Strip the files
+        for file in $(find ${jdkimagepath} ${jreimagepath} ${supportdir} -type f) ; do
+            if file ${file} | grep -q 'ELF'; then
+                noextfile=${file/.so/};
+                scl enable devtoolset-%{dtsversion} "objcopy --only-keep-debug ${file} ${noextfile}.debuginfo";
+                scl enable devtoolset-%{dtsversion} "objcopy --add-gnu-debuglink=${noextfile}.debuginfo ${file}";
+                scl enable devtoolset-%{dtsversion} "strip -g ${file}";
+            fi
+        done
+
+        # Rebuild jmod files against the stripped binaries
+        if [ ! -d ${supportdir} ] ; then
+            echo "Support directory missing.";
+            exit 15
+        fi
+        for cmd in $(find ${supportdir} -name '*.jmod_exec.cmdline') ; do
+            pre=${cmd/_exec/_pre};
+            post=${cmd/_exec/_post};
+            jmod=$(echo ${cmd}|sed 's#.*_create_##'|sed 's#_exec.cmdline##')
+            echo "Rebuilding ${jmod} against stripped binaries...";
+            if [ -e ${pre} ] ; then
+                echo "Executing ${pre}...";
+                cat ${pre} | sh -s ;
+            fi
+            echo "Executing ${cmd}...";
+            cat ${cmd} | sh -s ;
+            if [ -e ${post} ] ; then
+                echo "Executing ${post}...";
+                cat ${post} | sh -s ;
+            fi
+        done
+        rm -rf ${jdkimagepath}/jmods
+        cp -a ${jmodimagepath} ${jdkimagepath}
+    fi
+}
+
 function installjdk() {
    local outputdir=${1}
    local installdir=${2}
    local jdkimagepath=${installdir}/images/%{jdkimage}
    local jreimagepath=${installdir}/images/%{jreimage}
+    local unstripped=${jdkimagepath}.unstripped

    echo "Installing build from ${outputdir} to ${installdir}..."
    mkdir -p ${installdir}
@ -1178,7 +1192,7 @@ function installjdk() {
        fi;
    done

-    for imagepath in ${jdkimagepath} ${jreimagepath} ; do
+    for imagepath in ${jdkimagepath} ${jreimagepath} ${unstripped}; do

        if [ -d ${imagepath} ] ; then
            # the build (erroneously) removes read permissions from some jars
@ -1193,7 +1207,6 @@ function installjdk() {

            # Install local files which are distributed with the JDK
            install -m 644 %{SOURCE10} ${imagepath}
-            install -m 644 nss.cfg ${imagepath}/conf/security/

            # Create fake alt-java as a placeholder for future alt-java
            pushd ${imagepath}
@ -1227,6 +1240,8 @@ function packagejdk() {
    local bundledir=$(pwd)/${1}/bundles
    local packagesdir=$(pwd)/${2}
    local srcdir=$(pwd)/%{top_level_dir_name}
+    local tapsetdir=$(pwd)/tapset
+    local altjavadir=$(pwd)/${3}

    echo "Packaging build from ${imagesdir} to ${packagesdir}..."
    mkdir -p ${packagesdir}
@ -1254,42 +1269,39 @@ function packagejdk() {
    miscname=%{miscportablename}
    miscarchive=${packagesdir}/%{miscportablearchive}

+    if [ "x$suffix" = "x" ] ; then
+        # Keep the unstripped version for consumption by RHEL RPMs
+        mv %{jdkimage}.unstripped ${jdkname}
+        tar -cJf ${unstrippedarchive} ${jdkname}
+        genchecksum ${unstrippedarchive}
+        mv ${jdkname} %{jdkimage}.unstripped
+    fi
+
    # Rename directories for packaging
    mv %{jdkimage} ${jdkname}
    mv %{jreimage} ${jrename}

    # Release images have external debug symbols
    if [ "x$suffix" = "x" ] ; then
-        # Keep the unstripped version for consumption by RHEL RPMs
-        tar -cJf ${unstrippedarchive} ${jdkname}
-        genchecksum ${unstrippedarchive}
-
-        # Strip the files
-        for file in $(find ${jdkname} ${jrename} -type f) ; do
-            if file ${file} | grep -q 'ELF'; then
-                noextfile=${file/.so/};
-                objcopy --only-keep-debug ${file} ${noextfile}.debuginfo;
-                objcopy --add-gnu-debuglink=${noextfile}.debuginfo ${file};
-                strip -g ${file};
-            fi
-        done
-
        tar -cJf ${debugarchive} $(find ${jdkname} -name \*.debuginfo)
        genchecksum ${debugarchive}

-	mkdir ${docname}
-	mv ${docdir} ${docname}
-	mv ${bundledir}/${built_doc_archive} ${docname}
-	tar -cJf ${docarchive} ${docname}
-	genchecksum ${docarchive}
+        mkdir ${docname}
+        mv ${docdir} ${docname}
+        mv ${bundledir}/${built_doc_archive} ${docname}
+        tar -cJf ${docarchive} ${docname}
+        genchecksum ${docarchive}

-	mkdir ${miscname}
-	for s in 16 24 32 48 ; do
-	    cp -av ${srcdir}/src/java.desktop/unix/classes/sun/awt/X11/java-icon${s}.png ${miscname}
-	done
-	cp -a ${srcdir}/src/sample ${miscname}
-	tar -cJf ${miscarchive} ${miscname}
-	genchecksum ${miscarchive}
+        mkdir ${miscname}
+        for s in 16 24 32 48 ; do
+            cp -av ${srcdir}/src/java.desktop/unix/classes/sun/awt/X11/java-icon${s}.png ${miscname}
+        done
+%if %{with_systemtap}
+        cp -a ${tapsetdir}* ${miscname}
+%endif
+        cp -av ${altjavadir}/%{alt_java_name} ${miscname}
+        tar -cJf ${miscarchive} ${miscname}
+        genchecksum ${miscarchive}
    fi

    tar -cJf ${jdkarchive} --exclude='**.debuginfo' ${jdkname}
@ -1321,7 +1333,7 @@ function packagejdk() {
  cp -LR --preserve=mode,timestamps %{bootjdk} newboot
  systemjdk=$(pwd)/newboot
  buildjdk build/newboot ${systemjdk} %{hotspot_target} "release" "bundled" "internal"
-  mv build/newboot/jdk/lib/server/libjvm.so newboot/lib/server
+  mv build/newboot/jdk/lib/%{vm_variant}/libjvm.so newboot/lib/%{vm_variant}
 %else
  systemjdk=%{bootjdk}
 %endif
@ -1366,13 +1378,15 @@ for suffix in %{build_loop} ; do
      buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild} ${link_opt} ${debug_symbols}
      installjdk ${bootbuilddir} ${bootinstalldir}
      buildjdk ${builddir} $(pwd)/${bootinstalldir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols}
+      stripjdk ${builddir}
      installjdk ${builddir} ${installdir}
      %{!?with_artifacts:rm -rf ${bootinstalldir}}
  else
      buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols}
+      stripjdk ${builddir}
      installjdk ${builddir} ${installdir}
  fi
-  packagejdk ${installdir} ${packagesdir}
+  packagejdk ${installdir} ${packagesdir} %{altjavaoutputdir}

 %if %{system_libs}
  # Restore original source tree we modified by removing full in-tree sources
@ -1403,8 +1417,7 @@ export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage}
 #sed -i -e "s:^security.useSystemPropertiesFile=.*:security.useSystemPropertiesFile=true:" \
 #${JAVA_HOME}/conf/security/java.security

-
-#check Shenandoah is enabled
+# Check Shenandoah is enabled
 %if %{use_shenandoah_hotspot}
 $JAVA_HOME//bin/java -XX:+UnlockExperimentalVMOptions -XX:+UseShenandoahGC -version
 %endif
@ -1435,16 +1448,18 @@ $JAVA_HOME/bin/java $(echo $(basename %{SOURCE16})|sed "s|\.java||") "%{oj_vendo
 if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi

 # Check alt-java launcher has SSB mitigation on supported architectures
+# set_speculation function exists in both cases, so check for prctl call
 %ifarch %{ssbd_arches}
-nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation
+nm %{altjavaoutputdir}/%{alt_java_name} | grep prctl
 %else
-if ! nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation ; then true ; else false; fi
+if ! nm %{altjavaoutputdir}/%{alt_java_name} | grep prctl ; then true ; else false; fi
 %endif

 %if ! 0%{?flatpak}
 # Check translations are available for new timezones (during flatpak builds, the
 # tzdb.dat used by this test is not where the test expects it, so this is
 # disabled for flatpak builds)
+# Disable test until we are on the latest JDK
 $JAVA_HOME/bin/javac -d . %{SOURCE18}
 $JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE
 $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR
@ -1455,9 +1470,8 @@ $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|
 export STATIC_LIBS_HOME=${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image}
 ls -l $STATIC_LIBS_HOME
 ls -l $STATIC_LIBS_HOME/lib
-# they are here, but grep do not find the remainders
-#readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep w_remainder.c
-#readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep e_remainder.c
+readelf --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet4AddressImpl.c
+readelf --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet6AddressImpl.c
 %endif

 # Release builds strip the debug symbols into external .debuginfo files
@ -1674,11 +1688,98 @@ done
 %{_jvmdir}/%{miscportablearchive}.sha256sum

 %changelog
+* Sun Oct 29 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-1
+- Update to jdk-21.0.1.0+12 (GA)
+- Update release notes to 21.0.1.0+12
+- Update openjdk_news script to specify subdirectory last
+- Add missing discover_trees script required by openjdk_news
+- Synchronise bundled versions with 21u sources (FreeType, LCMS, HarfBuzz, libpng)
+- Sync generate_tarball.sh with 11u & 17u version
+- Update bug URL for RHEL to point to the Red Hat customer portal
+- Fix upstream release URL for OpenJDK source
+- Update buildjdkver to match the featurever
+- Re-enable SystemTap support and perform only substitutions possible without final NVR available
+- Fix typo which stops the EA designator being included in the build
+- Include tapsets in the miscellaneous tarball
+- Drop unused globals for tapset installation
+- Rebuild jmods using the stripped binaries in release builds
+- Make sure the unstripped JDK is customised by the installjdk function
+
+* Sat Oct 28 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-1
+- Update to jdk-21.0.0+35
+- Update release notes to 21.0.0+35
+- Update documentation (README.md)
+- Update system crypto policy & FIPS patch from new fips-21u tree
+- Update generate_tarball.sh to sync with upstream vanilla script inc. no more ECC removal
+- Drop fakefeaturever now it is no longer needed
+- Hardcode buildjdkver while the build JDK is not yet 21
+- Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
+- Use upstream release URL for OpenJDK source
+- Re-enable tzdata tests now we are on the latest JDK and things are back in sync
+- Fix trailing '.' in tarball name
+- Use rpmrelease in vendor version to avoid inclusion of dist tag
+- Replace alt-java patch with a binary separate from the JDK
+- Drop stale patches that are of little use any more:
+- * nss.cfg has been disabled since early PKCS11 work and long superseded by FIPS work
+- * No accessibility subpackage to warrant RH1648242 patch any more
+- * No use of system libjpeg turbo to warrant RH649512 patch any more
+- Replace RH1684077 pcsc-lite-libs patch with better JDK-8009550 fix being upstreamed
+
+* Sat Oct 28 2023 Petra Alice Mikova <pmikova@redhat.com> - 1:21.0.0.0.35-1
+- Replace smoke test files used in the staticlibs test, as fdlibm was removed by JDK-8303798
+- Related: rhbz#2192749
+
+* Fri Oct 27 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:20.0.2.0.9-1.1
+- Update to jdk-20.0.2+9
+- Update release notes to 20.0.2+9
+- Update system crypto policy & FIPS patch from new fips-20u tree
+- Update generate_tarball.sh ICEDTEA_VERSION
+- Update CLDR reference data following update to 42 (Rocky Mountain-Normalzeit => Rocky-Mountain-Normalzeit)
+- Related: rhbz#2192749
+
+* Fri Oct 27 2023 Jiri Vanek <jvanek@redhat.com> - 1:20.0.0.0.36-1
+- Dropped JDK-8295447, JDK-8296239 & JDK-8299439 patches now upstream
+- Adapted rh1750419-redhat_alt_java.patch
+- Related: rhbz#2192749
+
+* Fri Oct 27 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:19.0.1.0.10-1
+- Update to jdk-19.0.2 release
+- Update release notes to 19.0.2
+- Rebase FIPS patches from fips-19u branch
+- Remove references to sample directory removed by JDK-8284999
+- Add local patch JDK-8295447 (javac NPE) which was accepted into 19u upstream but not in the GA tag
+- Add local patches for JDK-8296239 & JDK-8299439 (Croatia Euro update) which are present in 8u, 11u & 17u releases
+- Related: rhbz#2192749
+
+* Tue Oct 24 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:18.0.2.0.9-1
+- Update to jdk-18.0.2 release
+- Update release notes to actually reflect OpenJDK 18
+- Support JVM variant zero following JDK-8273494 no longer installing Zero's libjvm.so in the server directory
+- Rebase FIPS patches from fips-18u branch
+- Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
+- Automatically turn off building a fresh HotSpot first, if the bootstrap JDK is not the same major version as that being built
+- Drop tzdata patches added for 17.0.7 which will eventually appear in the upstream tarball when we reach OpenJDK 21
+- Switch bootjdkver to java-21-openjdk
+- Disable tzdata tests until we are on the latest JDK and things are back in sync
+- Drop bootstrap JDKs and use the java-21-openjdk-rhel7 build
+- Related: rhbz#2192749
+
+* Tue Oct 24 2023 Petra Alice Mikova <pmikova@redhat.com> - 1:18.0.0.0.37-1
+- Update to ea version of jdk18
+- Adjust rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
+
+* Tue Aug 22 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-2
+- Define architectures we build on to avoid those without DTS 10 (e.g. s390)
+
+* Tue Aug 22 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-2
+- Switch to DTS 10
+- Related: rhbz#2192749
+
 * Mon May 15 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-2
 - Create java-21-openjdk-portable package based on java-17-openjdk-portable
 - Related: rhbz#2192749

-* Tue Apr 25 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-2
+* Thu Apr 13 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-1
 - Update to jdk-17.0.7.0+7
 - Update release notes to 17.0.7.0+7
 - Require tzdata 2023c due to local inclusion of JDK-8274864 & JDK-8305113
@ -1691,20 +1792,12 @@ done
 - * test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
 - * RH1940064: Enable XML Signature provider in FIPS mode
 - * RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized
- Fix trailing '.' in tarball name
- Use rpmrelease in vendor version to avoid inclusion of dist tag
 - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
 - Resolves: rhbz#2185182
 - Resolves: rhbz#2134669
 - Resolves: rhbz#1940064
 - Resolves: rhbz#2173781

-* Thu Apr 20 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.6.0.10-7
- Sync with existing RHEL 8 build, in order to start building portables on RHEL 8
- Restore system bootstrap JDK (RHEL 8 has java-17-openjdk)
- Remove use of devtoolset (RHEL 8 native compilers should be sufficient)
- Explicitly exclude x86, as on RHEL RPMs
-
 * Tue Feb 21 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.6.0.10-6
 - Add docs, icons and samples to the portable output
 - Make sure generated checksums work and don't include full path
--- a/SOURCES/jconsole.desktop.in
+++ b/SOURCES/jconsole.desktop.in
--- a/SOURCES/jdk8009550-rh910107-fail_to_load_pcsc_library.patch
+++ b/SOURCES/jdk8009550-rh910107-fail_to_load_pcsc_library.patch
@ -0,0 +1,125 @@
+commit d0523302416bc6507696f20d1068f16427bcf6b8
+Author: Andrew Hughes <gnu.andrew@redhat.com>
+Date:   Thu Aug 24 01:23:49 2023 +0100
+
+    8009550: PlatformPCSC should load versioned so
+
+diff --git a/src/java.base/share/classes/sun/security/util/Debug.java b/src/java.base/share/classes/sun/security/util/Debug.java
+index bff273c6548..e5a6b288ff8 100644
+--- a/src/java.base/share/classes/sun/security/util/Debug.java
+++ b/src/java.base/share/classes/sun/security/util/Debug.java
+@@ -81,6 +81,7 @@ public static void Help()
+         System.err.println("logincontext  login context results");
+         System.err.println("jca           JCA engine class debugging");
+         System.err.println("keystore      KeyStore debugging");
+        System.err.println("pcsc          Smartcard library debugging");
+         System.err.println("policy        loading and granting");
+         System.err.println("provider      security provider debugging");
+         System.err.println("pkcs11        PKCS11 session manager debugging");
+diff --git a/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java b/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java
+index bacff32efbc..d9f605ada1e 100644
+--- a/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java
+++ b/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java
+@@ -1,5 +1,6 @@
+ /*
+  * Copyright (c) 2005, 2021, Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2023, Red Hat Inc. All rights reserved.
+  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+  *
+  * This code is free software; you can redistribute it and/or modify it
+@@ -46,8 +47,13 @@ class PlatformPCSC {
+ 
+     private static final String PROP_NAME = "sun.security.smartcardio.library";
+ 
+-    private static final String LIB1 = "/usr/$LIBISA/libpcsclite.so";
+-    private static final String LIB2 = "/usr/local/$LIBISA/libpcsclite.so";
+    private static final String[] LIB_TEMPLATES = { "/usr/$LIBISA/libpcsclite.so",
+                                                    "/usr/local/$LIBISA/libpcsclite.so",
+                                                    "/usr/lib/$ARCH-linux-gnu/libpcsclite.so",
+                                                    "/usr/lib/arm-linux-gnueabi/libpcsclite.so",
+                                                    "/usr/lib/arm-linux-gnueabihf/libpcsclite.so",
+                                                    "/usr/lib/$ARCH-kfreebsd-gnu/libpcsclite.so" };
+    private static final String[] LIB_SUFFIXES = { ".1", ".0", "" };
+     private static final String PCSC_FRAMEWORK = "/System/Library/Frameworks/PCSC.framework/Versions/Current/PCSC";
+ 
+     PlatformPCSC() {
+@@ -73,23 +79,38 @@ public Throwable run() {
+     });
+ 
+     // expand $LIBISA to the system specific directory name for libraries
+    // expand $ARCH to the Debian system architecture in use
+     private static String expand(String lib) {
+         int k = lib.indexOf("$LIBISA");
+-        if (k == -1) {
+-            return lib;
+        if (k != -1) {
+            String libDir;
+            if ("64".equals(System.getProperty("sun.arch.data.model"))) {
+                // assume Linux convention
+                libDir = "lib64";
+            } else {
+                // must be 32-bit
+                libDir = "lib";
+            }
+            lib = lib.replace("$LIBISA", libDir);
+         }
+-        String s1 = lib.substring(0, k);
+-        String s2 = lib.substring(k + 7);
+-        String libDir;
+-        if ("64".equals(System.getProperty("sun.arch.data.model"))) {
+-            // assume Linux convention
+-            libDir = "lib64";
+-        } else {
+-            // must be 32-bit
+-            libDir = "lib";
+
+        k = lib.indexOf("$ARCH");
+        if (k != -1) {
+            String arch = System.getProperty("os.arch");
+            lib = lib.replace("$ARCH", getDebianArchitecture(arch));
+         }
+-        String s = s1 + libDir + s2;
+-        return s;
+
+        return lib;
+    }
+
+    private static String getDebianArchitecture(String jdkArch) {
+        return switch (jdkArch) {
+            case "amd64" -> "x86_64";
+            case "ppc" -> "powerpc";
+            case "ppc64" -> "powerpc64";
+            case "ppc64le" -> "powerpc64le";
+            default -> jdkArch;
+        };
+     }
+ 
+     private static String getLibraryName() throws IOException {
+@@ -98,15 +119,18 @@ private static String getLibraryName() throws IOException {
+         if (lib.length() != 0) {
+             return lib;
+         }
+-        lib = expand(LIB1);
+-        if (new File(lib).isFile()) {
+-            // if LIB1 exists, use that
+-            return lib;
+-        }
+-        lib = expand(LIB2);
+-        if (new File(lib).isFile()) {
+-            // if LIB2 exists, use that
+-            return lib;
+
+        for (String template : LIB_TEMPLATES) {
+            for (String suffix : LIB_SUFFIXES) {
+                lib = expand(template) + suffix;
+                if (debug != null) {
+                    debug.println("Looking for " + lib);
+                }
+                if (new File(lib).isFile()) {
+                    // if library exists, use that
+                    return lib;
+                }
+            }
+         }
+ 
+         // As of macos 11, framework libraries have been removed from the file
--- a/SOURCES/remove-intree-libraries.sh
+++ b/SOURCES/remove-intree-libraries.sh
--- a/SPECS/java-21-openjdk.spec
+++ b/SPECS/java-21-openjdk.spec
--- a/discover_trees.sh
+++ b/discover_trees.sh
@ -1,54 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) 2020 Red Hat, Inc.
-# Written by Andrew John Hughes <gnu.andrew@redhat.com>.
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU Affero General Public License as
-# published by the Free Software Foundation, either version 3 of the
-# License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU Affero General Public License for more details.
-#
-# You should have received a copy of the GNU Affero General Public License
-# along with this program.  If not, see <https://www.gnu.org/licenses/>.
-
-TREE=${1}
-
-if test "x${TREE}" = "x"; then
-    TREE=${PWD}
-fi
-
-if [ -e ${TREE}/nashorn/.hg -o -e ${TREE}/nashorn/merge.changeset ] ; then
-    NASHORN="nashorn" ;
-fi
-
-if [ -e ${TREE}/corba/.hg -o -e ${TREE}/corba/merge.changeset ] ; then
-    CORBA="corba";
-fi
-
-if [ -e ${TREE}/jaxp/.hg -o -e ${TREE}/jaxp/merge.changeset ] ; then
-    JAXP="jaxp";
-fi
-
-if [ -e ${TREE}/jaxws/.hg -o -e ${TREE}/jaxws/merge.changeset ] ; then
-    JAXWS="jaxws";
-fi
-
-if [ -e ${TREE}/langtools/.hg -o -e ${TREE}/langtools/merge.changeset ] ; then
-    LANGTOOLS="langtools";
-fi
-
-if [ -e ${TREE}/jdk/.hg -o -e ${TREE}/jdk/merge.changeset ] ; then
-    JDK="jdk";
-fi
-
-if [ -e ${TREE}/hotspot/.hg -o -e ${TREE}/hotspot/merge.changeset ] ; then
-    HOTSPOT="hotspot";
-fi
-
-SUBTREES="${CORBA} ${JAXP} ${JAXWS} ${LANGTOOLS} ${NASHORN} ${JDK} ${HOTSPOT}";
-echo ${SUBTREES}
--- a/gating.yaml
+++ b/gating.yaml
@ -1,7 +0,0 @@
-# recipients: java-qa
--- !Policy
-product_versions:
-  - rhel-9
-decision_context: osci_compose_gate
-rules:
-  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
--- a/generate_source_tarball.sh
+++ b/generate_source_tarball.sh
@ -1,210 +0,0 @@
-#!/bin/bash
-# Generates the 'source tarball' for JDK projects.
-#
-# Example:
-# When used from local repo set REPO_ROOT pointing to file:// with your repo
-# If your local repo follows upstream forests conventions, it may be enough to set OPENJDK_URL
-# If you want to use a local copy of patch PR3788, set the path to it in the PR3788 variable
-#
-# In any case you have to set PROJECT_NAME REPO_NAME and VERSION. eg:
-# PROJECT_NAME=openjdk
-# REPO_NAME=jdk17u
-# VERSION=jdk-17.0.3+5
-# or to eg prepare systemtap:
-# icedtea7's jstack and other tapsets
-# VERSION=6327cf1cea9e
-# REPO_NAME=icedtea7-2.6
-# PROJECT_NAME=release
-# OPENJDK_URL=http://icedtea.classpath.org/hg/
-# TO_COMPRESS="*/tapset"
-#
-# They are used to create correct name and are used in construction of sources url (unless REPO_ROOT is set)
-
-# This script creates a single source tarball out of the repository
-# based on the given tag and removes code not allowed in fedora/rhel. For
-# consistency, the source tarball will always contain 'openjdk' as the top
-# level folder, name is created, based on parameter
-#
-
-if [ ! "x$PR3823" = "x" ] ; then
-  if [ ! -f "$PR3823" ] ; then
-    echo "You have specified PR3823 as $PR3823 but it does not exist. Exiting"
-    exit 1
-  fi
-fi
-
-set -e
-
-OPENJDK_URL_DEFAULT=https://github.com
-COMPRESSION_DEFAULT=xz
-# Corresponding IcedTea version
-ICEDTEA_VERSION=12.0
-
-if [ "x$1" = "xhelp" ] ; then
-    echo -e "Behaviour may be specified by setting the following variables:\n"
-    echo "VERSION - the version of the specified OpenJDK project"
-    echo "PROJECT_NAME -- the name of the OpenJDK project being archived (optional; only needed by defaults)"
-    echo "REPO_NAME - the name of the OpenJDK repository (optional; only needed by defaults)"
-    echo "OPENJDK_URL - the URL to retrieve code from (optional; defaults to ${OPENJDK_URL_DEFAULT})"
-    echo "COMPRESSION - the compression type to use (optional; defaults to ${COMPRESSION_DEFAULT})"
-    echo "FILE_NAME_ROOT - name of the archive, minus extensions (optional; defaults to PROJECT_NAME-REPO_NAME-VERSION)"
-    echo "TO_COMPRESS - what part of clone to pack (default is openjdk)"
-    echo "PR3823 - the path to the PR3823 patch to apply (optional; downloaded if unavailable)"
-    echo "BOOT_JDK - the bootstrap JDK to satisfy the configure run"
-    exit 1;
-fi
-
-
-if [ "x$VERSION" = "x" ] ; then
-    echo "No VERSION specified"
-    exit 2
-fi
-echo "Version: ${VERSION}"
-
-NUM_VER=${VERSION##jdk-}
-RELEASE_VER=${NUM_VER%%+*}
-BUILD_VER=${NUM_VER##*+}
-MAJOR_VER=${RELEASE_VER%%.*}
-echo "Major version is ${MAJOR_VER}, release ${RELEASE_VER}, build ${BUILD_VER}"
-
-if [ "x$BOOT_JDK" = "x" ] ; then
-    echo "No boot JDK specified".
-    BOOT_JDK=/usr/lib/jvm/java-${MAJOR_VER}-openjdk;
-    echo -n "Checking for ${BOOT_JDK}...";
-    if [ -d ${BOOT_JDK} -a -x ${BOOT_JDK}/bin/java ] ; then
-        echo "Boot JDK found at ${BOOT_JDK}";
-    else
-        echo "Not found";
-        PREV_VER=$((${MAJOR_VER} - 1));
-        BOOT_JDK=/usr/lib/jvm/java-${PREV_VER}-openjdk;
-        echo -n "Checking for ${BOOT_JDK}...";
-        if [ -d ${BOOT_JDK} -a -x ${BOOT_JDK}/bin/java ] ; then
-            echo "Boot JDK found at ${BOOT_JDK}";
-        else
-            echo "Not found";
-            exit 4;
-        fi
-    fi
-else
-    echo "Boot JDK: ${BOOT_JDK}";
-fi
-
-# REPO_NAME is only needed when we default on REPO_ROOT and FILE_NAME_ROOT
-if [ "x$FILE_NAME_ROOT" = "x" -o "x$REPO_ROOT" = "x" ] ; then
-  if [ "x$PROJECT_NAME" = "x" ] ; then
-    echo "No PROJECT_NAME specified"
-    exit 1
-  fi
-  echo "Project name: ${PROJECT_NAME}"
-  if [ "x$REPO_NAME" = "x" ] ; then
-    echo "No REPO_NAME specified"
-    exit 3
-  fi
-  echo "Repository name: ${REPO_NAME}"
-fi
-
-if [ "x$OPENJDK_URL" = "x" ] ; then
-    OPENJDK_URL=${OPENJDK_URL_DEFAULT}
-    echo "No OpenJDK URL specified; defaulting to ${OPENJDK_URL}"
-else
-    echo "OpenJDK URL: ${OPENJDK_URL}"
-fi
-
-if [ "x$COMPRESSION" = "x" ] ; then
-    # rhel 5 needs tar.gz
-    COMPRESSION=${COMPRESSION_DEFAULT}
-fi
-echo "Creating a tar.${COMPRESSION} archive"
-
-if [ "x$FILE_NAME_ROOT" = "x" ] ; then
-    FILE_NAME_ROOT=${PROJECT_NAME}-${REPO_NAME}-${VERSION}
-    echo "No file name root specified; default to ${FILE_NAME_ROOT}"
-fi
-if [ "x$REPO_ROOT" = "x" ] ; then
-    REPO_ROOT="${OPENJDK_URL}/${PROJECT_NAME}/${REPO_NAME}.git"
-    echo "No repository root specified; default to ${REPO_ROOT}"
-fi;
-
-if [ "x$TO_COMPRESS" = "x" ] ; then
-    TO_COMPRESS="openjdk"
-    echo "No targets to be compressed specified, ; default to ${TO_COMPRESS}"
-fi;
-
-if [ -d ${FILE_NAME_ROOT} ] ; then
-  echo "exists exists exists exists exists exists exists "
-  echo "reusing reusing reusing reusing reusing reusing "
-  echo ${FILE_NAME_ROOT}
-else
-  mkdir "${FILE_NAME_ROOT}"
-  pushd "${FILE_NAME_ROOT}"
-    echo "Cloning ${VERSION} root repository from ${REPO_ROOT}"
-    git clone -b ${VERSION} ${REPO_ROOT} openjdk
-  popd
-fi
-pushd "${FILE_NAME_ROOT}"
-    if [ -d openjdk/src ]; then
-        pushd openjdk
-            echo "Removing EC source code we don't build"
-            CRYPTO_PATH=src/jdk.crypto.ec/share/native/libsunec/impl
-            rm -vf ${CRYPTO_PATH}/ec2.h
-            rm -vf ${CRYPTO_PATH}/ec2_163.c
-            rm -vf ${CRYPTO_PATH}/ec2_193.c
-            rm -vf ${CRYPTO_PATH}/ec2_233.c
-            rm -vf ${CRYPTO_PATH}/ec2_aff.c
-            rm -vf ${CRYPTO_PATH}/ec2_mont.c
-            rm -vf ${CRYPTO_PATH}/ecp_192.c
-            rm -vf ${CRYPTO_PATH}/ecp_224.c
-
-            echo "Syncing EC list with NSS"
-            if [ "x$PR3823" = "x" ] ; then
-                # get PR3823.patch (from https://github.com/icedtea-git/icedtea) in the ${ICEDTEA_VERSION} branch
-                # Do not push it or publish it
-                echo "PR3823 not found. Downloading..."
-                wget -v https://github.com/icedtea-git/icedtea/raw/${ICEDTEA_VERSION}/patches/pr3823.patch
-                echo "Applying ${PWD}/pr3823.patch"
-                patch -Np1 < pr3823.patch
-                rm pr3823.patch
-            else
-                echo "Applying ${PR3823}"
-                patch -Np1 < $PR3823
-            fi;
-            find . -name '*.orig' -exec rm -vf '{}' ';'
-        popd
-    fi
-
-    # Generate .src-rev so build has knowledge of the revision the tarball was created from
-    mkdir build
-    pushd build
-    sh ${PWD}/../openjdk/configure --with-boot-jdk=${BOOT_JDK}
-    make store-source-revision
-    popd
-    rm -rf build
-
-    # Remove commit checks
-    echo "Removing $(find openjdk -name '.jcheck' -print)"
-    find openjdk -name '.jcheck' -print0 | xargs -0 rm -r
-
-    # Remove history and GHA
-    echo "find openjdk -name '.hgtags'"
-    find openjdk -name '.hgtags' -exec rm -v '{}' '+'
-    echo "find openjdk -name '.hgignore'"
-    find openjdk -name '.hgignore' -exec rm -v '{}' '+'
-    echo "find openjdk -name '.gitattributes'"
-    find openjdk -name '.gitattributes' -exec rm -v '{}' '+'
-    echo "find openjdk -name '.gitignore'"
-    find openjdk -name '.gitignore' -exec rm -v '{}' '+'
-    echo "find openjdk -name '.git'"
-    find openjdk -name '.git' -exec rm -rv '{}' '+'
-    echo "find openjdk -name '.github'"
-    find openjdk -name '.github' -exec rm -rv '{}' '+'
-
-    echo "Compressing remaining forest"
-    if [ "X$COMPRESSION" = "Xxz" ] ; then
-        SWITCH=cJf
-    else
-        SWITCH=czf
-    fi
-    tar --exclude-vcs -$SWITCH ${FILE_NAME_ROOT}.tar.${COMPRESSION} $TO_COMPRESS
-    mv ${FILE_NAME_ROOT}.tar.${COMPRESSION}  ..
-popd
-echo "Done. You may want to remove the uncompressed version - $FILE_NAME_ROOT."
--- a/icedtea_sync.sh
+++ b/icedtea_sync.sh
@ -1,191 +0,0 @@
-#!/bin/bash
-
-# Copyright (C) 2019 Red Hat, Inc.
-# Written by Andrew John Hughes <gnu.andrew@redhat.com>.
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU Affero General Public License as
-# published by the Free Software Foundation, either version 3 of the
-# License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU Affero General Public License for more details.
-#
-# You should have received a copy of the GNU Affero General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-ICEDTEA_USE_VCS=true
-
-ICEDTEA_VERSION=3.15.0
-ICEDTEA_URL=https://icedtea.classpath.org/download/source
-ICEDTEA_SIGNING_KEY=CFDA0F9B35964222
-
-ICEDTEA_HG_URL=https://icedtea.classpath.org/hg/icedtea11
-set -e
-
-RPM_DIR=${PWD}
-if [ ! -f ${RPM_DIR}/jconsole.desktop.in ] ; then
-    echo "Not in RPM source tree.";
-    exit 1;
-fi
-
-if test "x${TMPDIR}" = "x"; then
-    TMPDIR=/tmp;
-fi
-WORKDIR=${TMPDIR}/it.sync
-
-echo "Using working directory ${WORKDIR}"
-mkdir ${WORKDIR}
-pushd ${WORKDIR}
-
-if test "x${WGET}" = "x"; then
-    WGET=$(which wget);
-    if test "x${WGET}" = "x"; then
-	echo "wget not found";
-	exit 1;
-    fi
-fi
-
-if test "x${TAR}" = "x"; then
-    TAR=$(which tar)
-    if test "x${TAR}" = "x"; then
-	echo "tar not found";
-	exit 2;
-    fi
-fi
-
-echo "Dependencies:";
-echo -e "\tWGET: ${WGET}";
-echo -e "\tTAR: ${TAR}\n";
-
-if test "x${ICEDTEA_USE_VCS}" = "xtrue"; then
-    echo "Mode: Using VCS";
-
-    if test "x${GREP}" = "x"; then
-	GREP=$(which grep);
-	if test "x${GREP}" = "x"; then
-	    echo "grep not found";
-	    exit 3;
-	fi
-    fi
-
-    if test "x${CUT}" = "x"; then
-	CUT=$(which cut);
-	if test "x${CUT}" = "x"; then
-	    echo "cut not found";
-	    exit 4;
-	fi
-    fi
-
-    if test "x${TR}" = "x"; then
-	TR=$(which tr);
-	if test "x${TR}" = "x"; then
-	    echo "tr not found";
-	    exit 5;
-	fi
-    fi
-
-    if test "x${HG}" = "x"; then
-	HG=$(which hg);
-	if test "x${HG}" = "x"; then
-	    echo "hg not found";
-	    exit 6;
-	fi
-    fi
-
-    echo "Dependencies:";
-    echo -e "\tGREP: ${GREP}";
-    echo -e "\tCUT: ${CUT}";
-    echo -e "\tTR: ${TR}";
-    echo -e "\tHG: ${HG}";
-
-    echo "Checking out repository from VCS...";
-    ${HG} clone ${ICEDTEA_HG_URL} icedtea
-
-    echo "Obtaining version from configure.ac...";
-    ROOT_VER=$(${GREP} '^AC_INIT' icedtea/configure.ac|${CUT} -d ',' -f 2|${TR} -d '[][:space:]')
-    echo "Root version from configure: ${ROOT_VER}";
-
-    VCS_REV=$(${HG} log -R icedtea --template '{node|short}' -r tip)
-    echo "VCS revision: ${VCS_REV}";
-
-    ICEDTEA_VERSION="${ROOT_VER}-${VCS_REV}"
-    echo "Creating icedtea-${ICEDTEA_VERSION}";
-    mkdir icedtea-${ICEDTEA_VERSION}
-    echo "Copying required files from checkout to icedtea-${ICEDTEA_VERSION}";
-    # Commented out for now as IcedTea 6's jconsole.desktop.in is outdated
-    #cp -a icedtea/jconsole.desktop.in ../icedtea-${ICEDTEA_VERSION}
-    cp -a ${RPM_DIR}/jconsole.desktop.in icedtea-${ICEDTEA_VERSION}
-    cp -a icedtea/tapset icedtea-${ICEDTEA_VERSION}
-
-    rm -rf icedtea
-else
-    echo "Mode: Using tarball";
-
-    if test "x${ICEDTEA_VERSION}" = "x"; then
-	echo "No IcedTea version specified for tarball download.";
-	exit 3;
-    fi
-
-    if test "x${CHECKSUM}" = "x"; then
-	CHECKSUM=$(which sha256sum)
-	if test "x${CHECKSUM}" = "x"; then
-	    echo "sha256sum not found";
-	    exit 4;
-	fi
-    fi
-
-    if test "x${PGP}" = "x"; then
-	PGP=$(which gpg)
-	if test "x${PGP}" = "x"; then
-	    echo "gpg not found";
-	    exit 5;
-	fi
-    fi
-
-    echo "Dependencies:";
-    echo -e "\tCHECKSUM: ${CHECKSUM}";
-    echo -e "\tPGP: ${PGP}\n";
-
-    echo "Checking for IcedTea signing key ${ICEDTEA_SIGNING_KEY}...";
-    if ! gpg --list-keys ${ICEDTEA_SIGNING_KEY}; then
-	echo "IcedTea signing key ${ICEDTEA_SIGNING_KEY} not installed.";
-	exit 6;
-    fi
-
-    echo "Downloading IcedTea release tarball...";
-    ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz
-    echo "Downloading IcedTea tarball signature...";
-    ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz.sig
-    echo "Downloading IcedTea tarball checksums...";
-    ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.sha256
-
-    echo "Verifying checksums...";
-    ${CHECKSUM} --check --ignore-missing icedtea-${ICEDTEA_VERSION}.sha256
-
-    echo "Checking signature...";
-    ${PGP} --verify icedtea-${ICEDTEA_VERSION}.tar.xz.sig
-
-    echo "Extracting files...";
-    ${TAR} xJf icedtea-${ICEDTEA_VERSION}.tar.xz \
-       icedtea-${ICEDTEA_VERSION}/tapset \
-       icedtea-${ICEDTEA_VERSION}/jconsole.desktop.in
-
-    rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz
-    rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz.sig
-    rm -vf icedtea-${ICEDTEA_VERSION}.sha256
-fi
-
-echo "Replacing desktop files...";
-mv -v icedtea-${ICEDTEA_VERSION}/jconsole.desktop.in ${RPM_DIR}
-
-echo "Creating new tapset tarball...";
-mv -v icedtea-${ICEDTEA_VERSION} openjdk
-${TAR} cJf ${RPM_DIR}/tapsets-icedtea-${ICEDTEA_VERSION}.tar.xz openjdk
-
-rm -rvf openjdk
-
-popd
-rm -rf ${WORKDIR}
--- a/jdk8274864-remove_amman_cairo_hacks.patch
+++ b/jdk8274864-remove_amman_cairo_hacks.patch
@ -1,53 +0,0 @@
-commit 1b3825db8631e55771fb723d4fcd10040ea15b7e
-Author: duke <duke@openjdk.org>
-Date:   Wed Apr 12 17:25:27 2023 +0000
-
-    Backport ec199072c5867624d66840238cc8828e16ae8da7
-
-diff --git a/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java b/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java
-index 6f6e190efcd..ef278203182 100644
--- a/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java
-+++ b/src/java.base/share/classes/sun/util/calendar/ZoneInfoFile.java
-@@ -608,34 +608,6 @@ public final class ZoneInfoFile {
-                 params[8] = endRule.secondOfDay * 1000;
-                 params[9] = toSTZTime[endRule.timeDefinition];
-                 dstSavings = (startRule.offsetAfter - startRule.offsetBefore) * 1000;
-
-                // Note: known mismatching -> Asia/Amman
-                // ZoneInfo :      startDayOfWeek=5     <= Thursday
-                //                 startTime=86400000   <= 24 hours
-                // This:           startDayOfWeek=6
-                //                 startTime=0
-                // Similar workaround needs to be applied to Africa/Cairo and
-                // its endDayOfWeek and endTime
-                // Below is the workarounds, it probably slows down everyone a little
-                if (params[2] == 6 && params[3] == 0 &&
-                    (zoneId.equals("Asia/Amman"))) {
-                    params[2] = 5;
-                    params[3] = 86400000;
-                }
-                // Additional check for startDayOfWeek=6 and starTime=86400000
-                // is needed for Asia/Amman;
-                if (params[2] == 7 && params[3] == 0 &&
-                     (zoneId.equals("Asia/Amman"))) {
-                    params[2] = 6;        // Friday
-                    params[3] = 86400000; // 24h
-                }
-                //endDayOfWeek and endTime workaround
-                if (params[7] == 6 && params[8] == 0 &&
-                    (zoneId.equals("Africa/Cairo"))) {
-                    params[7] = 5;
-                    params[8] = 86400000;
-                }
-
-             } else if (nTrans > 0) {  // only do this if there is something in table already
-                 if (lastyear < LASTYEAR) {
-                     // ZoneInfo has an ending entry for 2037
-@@ -908,7 +880,6 @@ public final class ZoneInfoFile {
-             this.dow = dowByte == 0 ? -1 : dowByte;
-             this.secondOfDay = timeByte == 31 ? in.readInt() : timeByte * 3600;
-             this.timeDefinition = (data & (3 << 12)) >>> 12;
-
-             this.standardOffset = stdByte == 255 ? in.readInt() : (stdByte - 128) * 900;
-             this.offsetBefore = beforeByte == 3 ? in.readInt() : standardOffset + beforeByte * 1800;
-             this.offsetAfter = afterByte == 3 ? in.readInt() : standardOffset + afterByte * 1800;
--- a/jdk8305113-tzdata2023c.patch
+++ b/jdk8305113-tzdata2023c.patch
--- a/nss.cfg.in
+++ b/nss.cfg.in
@ -1,5 +0,0 @@
-name = NSS
-nssLibraryDirectory = @NSS_LIBDIR@
-nssDbMode = noDb
-attributes = compatibility
-handleStartupErrors = ignoreMultipleInitialisation
--- a/openjdk_news.sh
+++ b/openjdk_news.sh
@ -1,76 +0,0 @@
-#!/bin/bash
-
-# Copyright (C) 2022 Red Hat, Inc.
-# Written by Andrew John Hughes <gnu.andrew@redhat.com>, 2012-2022
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU Affero General Public License as
-# published by the Free Software Foundation, either version 3 of the
-# License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU Affero General Public License for more details.
-#
-# You should have received a copy of the GNU Affero General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-OLD_RELEASE=$1
-NEW_RELEASE=$2
-SUBDIR=$3
-REPO=$4
-SCRIPT_DIR=$(dirname ${0})
-
-if test "x${SUBDIR}" = "x"; then
-    echo "No subdirectory specified; using .";
-    SUBDIR=".";
-fi
-
-if test "x$REPO" = "x"; then
-    echo "No repository specified; using ${PWD}"
-    REPO=${PWD}
-fi
-
-if test x${TMPDIR} = x; then
-    TMPDIR=/tmp;
-fi
-
-echo "Repository: ${REPO}"
-
-if [ -e ${REPO}/.git ] ; then
-    TYPE=git;
-elif [ -e ${REPO}/.hg ] ; then
-    TYPE=hg;
-else
-    echo "No Mercurial or Git repository detected.";
-    exit 1;
-fi
-
-if test "x$OLD_RELEASE" = "x" || test "x$NEW_RELEASE" = "x"; then
-    echo "ERROR: Need to specify old and new release";
-    exit 2;
-fi
-
-echo "Listing fixes between $OLD_RELEASE and $NEW_RELEASE in $REPO"
-rm -f ${TMPDIR}/fixes2 ${TMPDIR}/fixes3 ${TMPDIR}/fixes
-for repos in . $(${SCRIPT_DIR}/discover_trees.sh ${REPO});
-do
-    if test "x$TYPE" = "xhg"; then
-	hg log -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R $REPO/$repos -G -M ${REPO}/${SUBDIR} | \
-	    egrep '^[o:| ]*summary'|grep -v 'Added tag'|sed -r 's#^[o:| ]*summary:\W*([0-9])#  - JDK-\1#'| \
-	    sed 's#^[o:| ]*summary:\W*#  - #' >> ${TMPDIR}/fixes2;
-	hg log -v -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R $REPO/$repos -G -M ${REPO}/${SUBDIR} | \
-	    egrep '^[o:| ]*[0-9]{7}'|sed -r 's#^[o:| ]*([0-9]{7})#  - JDK-\1#' >> ${TMPDIR}/fixes3;
-    else
-	git -C ${REPO} log --no-merges --pretty=format:%B ${NEW_RELEASE}...${OLD_RELEASE} -- ${SUBDIR} |egrep '^[0-9]{7}' | \
-	    sed -r 's#^([0-9])#  - JDK-\1#' >> ${TMPDIR}/fixes2;
-	touch ${TMPDIR}/fixes3 ; # unused
-    fi
-done
-
-sort ${TMPDIR}/fixes2 ${TMPDIR}/fixes3 | uniq > ${TMPDIR}/fixes
-rm -f ${TMPDIR}/fixes2 ${TMPDIR}/fixes3
-
-echo "In ${TMPDIR}/fixes:"
-cat ${TMPDIR}/fixes
--- a/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
+++ b/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
@ -1,16 +0,0 @@
-diff -r 618ad1237e73 src/java.desktop/share/classes/java/awt/Toolkit.java
--- a/src/java.desktop/share/classes/java/awt/Toolkit.java	Thu Jun 13 19:37:49 2019 +0200
-+++ b/src/java.desktop/share/classes/java/awt/Toolkit.java	Thu Jul 04 10:35:42 2019 +0200
-@@ -595,7 +595,11 @@
-                 toolkit = new HeadlessToolkit(toolkit);
-             }
-             if (!GraphicsEnvironment.isHeadless()) {
-                loadAssistiveTechnologies();
-+                try {
-+                    loadAssistiveTechnologies();
-+                } catch (AWTError error) {
-+                    // ignore silently
-+                }
-             }
-         }
-         return toolkit;
--- a/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
+++ b/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
@ -1,12 +0,0 @@
-diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security
-index adfaf57d29e..abf89bbf327 100644
--- a/src/java.base/share/conf/security/java.security
-+++ b/src/java.base/share/conf/security/java.security
-@@ -78,6 +78,7 @@ security.provider.tbd=SunMSCAPI
- security.provider.tbd=Apple
- #endif
- security.provider.tbd=SunPKCS11
-+#security.provider.tbd=SunPKCS11 ${java.home}/lib/security/nss.cfg
- 
- #
- # Security providers used when FIPS mode support is active
--- a/rh1648644-java_access_bridge_privileged_security.patch
+++ b/rh1648644-java_access_bridge_privileged_security.patch
@ -1,20 +0,0 @@
--- openjdk/src/java.base/share/conf/security/java.security
-+++ openjdk/src/java.base/share/conf/security/java.security
-@@ -304,6 +304,8 @@
- #
- package.access=sun.misc.,\
-                sun.reflect.,\
-+               org.GNOME.Accessibility.,\
-+               org.GNOME.Bonobo.,\
- 
- #
- # List of comma-separated packages that start with or equal this string
-@@ -316,6 +318,8 @@
- #
- package.definition=sun.misc.,\
-                    sun.reflect.,\
-+                   org.GNOME.Accessibility.,\
-+                   org.GNOME.Bonobo.,\
- 
- #
- # Determines whether this properties file can be appended to
--- a/rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
+++ b/rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
@ -1,13 +0,0 @@
--- openjdk/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java	2013-03-01 10:48:12.038189968 +0100
-+++ openjdk/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java	2013-03-01 10:48:11.913188505 +0100
-@@ -48,8 +48,8 @@
- 
-     private final static String PROP_NAME = "sun.security.smartcardio.library";
- 
-    private final static String LIB1 = "/usr/$LIBISA/libpcsclite.so";
-    private final static String LIB2 = "/usr/local/$LIBISA/libpcsclite.so";
-+    private final static String LIB1 = "/usr/$LIBISA/libpcsclite.so.1";
-+    private final static String LIB2 = "/usr/local/$LIBISA/libpcsclite.so.1";
-     private final static String PCSC_FRAMEWORK = "/System/Library/Frameworks/PCSC.framework/Versions/Current/PCSC";
- 
-     PlatformPCSC() {
--- a/rh1750419-redhat_alt_java.patch
+++ b/rh1750419-redhat_alt_java.patch
@ -1,117 +0,0 @@
-diff --git openjdk.orig/make/modules/java.base/Launcher.gmk openjdk/make/modules/java.base/Launcher.gmk
-index 700ddefda49..2882de68eb2 100644
--- openjdk.orig/make/modules/java.base/Launcher.gmk
-+++ openjdk/make/modules/java.base/Launcher.gmk
-@@ -41,6 +41,14 @@ $(eval $(call SetupBuildLauncher, java, \
-     OPTIMIZATION := HIGH, \
- ))
- 
-+#Wno-error=cpp is present to allow commented warning in ifdef part of main.c
-+$(eval $(call SetupBuildLauncher, alt-java, \
-+    CFLAGS := -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES -DREDHAT_ALT_JAVA -Wno-error=cpp, \
-+    EXTRA_RCFLAGS := $(JAVA_RCFLAGS), \
-+    VERSION_INFO_RESOURCE := $(JAVA_VERSION_INFO_RESOURCE), \
-+    OPTIMIZATION := HIGH, \
-+))
-+
- ifeq ($(call isTargetOs, windows), true)
-   $(eval $(call SetupBuildLauncher, javaw, \
-       CFLAGS := -DJAVAW -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES, \
-diff --git openjdk.orig/src/java.base/share/native/launcher/alt_main.h openjdk/src/java.base/share/native/launcher/alt_main.h
-new file mode 100644
-index 00000000000..697df2898ac
--- /dev/null
-+++ openjdk/src/java.base/share/native/launcher/alt_main.h
-@@ -0,0 +1,73 @@
-+/*
-+ * Copyright (c) 2019, Red Hat, Inc. All rights reserved.
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation.  Oracle designates this
-+ * particular file as subject to the "Classpath" exception as provided
-+ * by Oracle in the LICENSE file that accompanied this code.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+#ifdef REDHAT_ALT_JAVA
-+
-+#include <sys/prctl.h>
-+
-+
-+/* Per task speculation control */
-+#ifndef PR_GET_SPECULATION_CTRL
-+# define PR_GET_SPECULATION_CTRL    52
-+#endif
-+#ifndef PR_SET_SPECULATION_CTRL
-+# define PR_SET_SPECULATION_CTRL    53
-+#endif
-+/* Speculation control variants */
-+#ifndef PR_SPEC_STORE_BYPASS
-+# define PR_SPEC_STORE_BYPASS          0
-+#endif
-+/* Return and control values for PR_SET/GET_SPECULATION_CTRL */
-+
-+#ifndef PR_SPEC_NOT_AFFECTED
-+# define PR_SPEC_NOT_AFFECTED          0
-+#endif
-+#ifndef PR_SPEC_PRCTL
-+# define PR_SPEC_PRCTL                 (1UL << 0)
-+#endif
-+#ifndef PR_SPEC_ENABLE
-+# define PR_SPEC_ENABLE                (1UL << 1)
-+#endif
-+#ifndef PR_SPEC_DISABLE
-+# define PR_SPEC_DISABLE               (1UL << 2)
-+#endif
-+#ifndef PR_SPEC_FORCE_DISABLE
-+# define PR_SPEC_FORCE_DISABLE         (1UL << 3)
-+#endif
-+#ifndef PR_SPEC_DISABLE_NOEXEC
-+# define PR_SPEC_DISABLE_NOEXEC        (1UL << 4)
-+#endif
-+
-+static void set_speculation() __attribute__((constructor));
-+static void set_speculation() {
-+  if ( prctl(PR_SET_SPECULATION_CTRL,
-+             PR_SPEC_STORE_BYPASS,
-+             PR_SPEC_DISABLE_NOEXEC, 0, 0) == 0 ) {
-+    return;
-+  }
-+  prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0);
-+}
-+
-+#endif // REDHAT_ALT_JAVA
-diff --git openjdk.orig/src/java.base/share/native/launcher/main.c openjdk/src/java.base/share/native/launcher/main.c
-index b734fe2ba78..79dc8307650 100644
--- openjdk.orig/src/java.base/share/native/launcher/main.c
-+++ openjdk/src/java.base/share/native/launcher/main.c
-@@ -34,6 +34,14 @@
- #include "jli_util.h"
- #include "jni.h"
- 
-+#ifdef REDHAT_ALT_JAVA
-+#if defined(__linux__) && defined(__x86_64__)
-+#include "alt_main.h"
-+#else
-+#warning alt-java requested but SSB mitigation not available on this platform.
-+#endif
-+#endif
-+
- #ifdef _MSC_VER
- #if _MSC_VER > 1400 && _MSC_VER < 1600
- 
--- a/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
+++ b/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
@ -1,19 +0,0 @@
-Remove uses of FAR in jpeg code
-
-Upstream libjpeg-trubo removed the (empty) FAR macro:
-http://sourceforge.net/p/libjpeg-turbo/code/1312/
-
-Adjust our code to not use the undefined FAR macro anymore.
-
-diff --git a/jdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c b/jdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c
--- openjdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c
-+++ openjdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c
-@@ -1385,7 +1385,7 @@
-     /* and fill it in */
-     dst_ptr = icc_data;
-     for (seq_no = first; seq_no < last; seq_no++) {
-        JOCTET FAR *src_ptr = icc_markers[seq_no]->data + ICC_OVERHEAD_LEN;
-+        JOCTET *src_ptr = icc_markers[seq_no]->data + ICC_OVERHEAD_LEN;
-         unsigned int length =
-             icc_markers[seq_no]->data_length - ICC_OVERHEAD_LEN;
- 
--- a/rpminspect.yaml
+++ b/rpminspect.yaml
@ -1,3 +0,0 @@
---
-inspections:
-    javabytecode: off
--- a/2
+++ b/2
@ -1,2 +0,0 @@
-SHA512 (openjdk-jdk17u-jdk-17.0.7+7.tar.xz) = 2f231e83fabef6299b16beee1e0c8d52501e22fd71a26ed2ace6fadabe38e73e66f3b8fb8bc994e8b2b9bbdb91d1143661941f623bb94793500f4f3b6495bf58
-SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
--- a/tests/tests.yml
+++ b/tests/tests.yml
@ -1,21 +0,0 @@
---
- hosts: localhost
-  roles:
-  - role: standard-test-source
-    tags:
-    - always
-  - role: standard-test-basic
-    tags:
-    - classic
-    - atomic
-    required_packages:
-    - java-21-openjdk-devel
-    tests:
-      - javaVersion1:
-          dir: ~
-          run: set -ex; useradd franta1;  su franta1 -c 'java -version';
-          run: set -ex; useradd franta4;  su franta4 -c 'javac -version';
-          run: ls -l /usr/lib/jvm;
-      - javaVersion2:
-          dir: ~
-          run: set -ex; useradd franta2;  su franta2 -c 'java --version'