Sync the copy of the portable specfile with the latest update

Related: RHEL-32424
Related: RHEL-30946

java-21-openjdk-portable.specfile

@@ -315,12 +315,12 @@
 # New Version-String scheme-style defines
 %global featurever 21
 %global interimver 0
-%global updatever 2
+%global updatever 3
 %global patchver 0
 # buildjdkver is usually same as %%{featurever},
 # but in time of bootstrap of next jdk, it is featurever-1,
 # and this it is better to change it here, on single place
-%global buildjdkver 20
+%global buildjdkver %{featurever}
 # We don't add any LTS designator for STS packages (Fedora and EPEL).
 # We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined.
 %if 0%{?rhel} && !0%{?epel}
@@ -365,7 +365,7 @@
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      6.0.0pre00-c848b93a8598
 # Define current Git revision for the FIPS support patches
-%global fipsver 75ffdc48eda
+%global fipsver 0a42e29b391
 # Define JDK versions
 %global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
 %global javaver         %{featurever}
@@ -379,7 +379,7 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{vcstag}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        13
+%global buildver        9
 %global rpmrelease      1
 #%%global tagsuffix     %%{nil}
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
@@ -649,10 +649,6 @@ Patch1001: fips-%{featurever}u-%{fipsver}.patch
 #
 #############################################
 
-# JDK-8009550, RH910107: Depend on pcsc-lite-libs instead of pcsc-lite-devel as this is only in optional repo
-# PR: https://github.com/openjdk/jdk/pull/15409
-Patch6: jdk8009550-rh910107-fail_to_load_pcsc_library.patch
-
 # Currently empty
 
 #############################################
@@ -682,7 +678,7 @@ BuildRequires: elfutils-devel
 BuildRequires: file
 BuildRequires: fontconfig-devel
 %ifarch %{devkit_arches}
-BuildRequires: openjdk-devkit >= 1.0-2
+BuildRequires: %{devkit_name} >= 1.0-6
 %else
 # Earlier versions have a bug in tree vectorization on PPC
 BuildRequires: gcc >= 4.8.3-8
@@ -721,8 +717,9 @@ BuildRequires: libffi-devel
 BuildRequires: graphviz
 BuildRequires: pandoc
 %endif
-# 2023c required as of JDK-8305113
+# 2024a required as of JDK-8325150
-BuildRequires: tzdata-java >= 2023c
+# Use 2023d until 2024a is in the buildroot
+BuildRequires: tzdata-java >= 2023d
 # cacerts build requirement in portable mode
 BuildRequires: ca-certificates
 
@@ -740,7 +737,7 @@ BuildRequires: libjpeg-devel
 BuildRequires: libpng-devel
 %else
 # Version in src/java.desktop/share/legal/freetype.md
-Provides: bundled(freetype) = 2.13.0
+Provides: bundled(freetype) = 2.13.2
 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
 Provides: bundled(giflib) = 5.2.1
 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h
@@ -952,11 +949,22 @@ sh %{SOURCE12} %{top_level_dir_name}
 %endif
 
 # Patch the JDK
+# This syntax is deprecated:
+#    %patchN [...]
+# and should be replaced with:
+#    %patch -PN [...]
+# For example:
+#    %patch1001 -p1
+# becomes:
+#    %patch -P1001 -p1
+# The replacement format suggested by recent (circa Fedora 38) RPM
+# deprecation messages:
+#    %patch N [...]
+# is not backward-compatible with prior (circa RHEL-8) versions of
+# rpmbuild.
 pushd %{top_level_dir_name}
 # Add crypto policy and FIPS support
-%patch1001 -p1
+%patch -P1001 -p1
-# Patches in need of upstreaming
-%patch6 -p1
 popd # openjdk
 
 
@@ -982,7 +990,7 @@ fi
 
 # Extract systemtap tapsets
 %if %{with_systemtap}
-tar --strip-components=1 -x -I 'xz -T0' -f %{SOURCE8}
+tar --strip-components=1 -x -I xz -f %{SOURCE8}
 %if %{include_debug_build}
 cp -r tapset tapset%{debug_suffix}
 %endif
@@ -1059,6 +1067,51 @@ EXTRA_CPP_FLAGS="$(echo ${EXTRA_CFLAGS} | sed -e 's|-specs=/usr/lib/rpm/redhat/r
 
 export EXTRA_CFLAGS EXTRA_CPP_FLAGS
 
+# Set modification times (mtimes) of files within JAR files generated
+# by the OpenJDK build to a timestamp that is constant across RPM
+# rebuilds.  OpenJDK provides the --with-source-date configure option
+# for this purpose.  Potential arguments in the RPM build context are:
+#
+# A) --with-source-date="${SOURCE_DATE_EPOCH}"
+# B) --with-source-date=version
+# C) --with-source-date="${OPENJDK_UPSTREAM_TAG_EPOCH}"
+#
+# Consider Option A.  Fedora 38 (rpm-4.18.2) and RHEL-8 (rpm-4.14.3)
+# have different support for SOURCE_DATE_EPOCH.  To keep
+# SOURCE_DATE_EPOCH constant across RPM rebuilds, one could set the
+# source_date_epoch_from_changelog macro to 1 on both Fedora 38 and
+# RHEL-8.  However, on RHEL-8, this results in the RPM build times
+# being set to the timestamp of the most recent changelog.  This is
+# bad for tracing when RPMs were actually built.  Fedora 38 supports a
+# better behaviour via the introduction of the
+# use_source_date_epoch_as_buildtime macro, set to 0 by default.
+# There is no way to make this work on RHEL-8 as well though, so
+# option A is suboptimal.
+#
+# Option B uses the value of the DEFAULT_VERSION_DATE field from
+# make/conf/version-numbers.conf.  DEFAULT_VERSION_DATE represents the
+# aspirational eventual JDK general availability (GA) release date.
+# When the RPM build occurs prior to GA, generated JAR files will have
+# payload mtimes in the future relative to the RPM build time.
+# Whereas for tarballs some tools will issue warnings about future
+# mtimes, per OPENJDK-2583 apparently this is no problem for Java and
+# JAR files.
+#
+# Option C uses the modification timestamp of files in the source
+# tarball. The reproducibility logic in generate_source_tarball.sh
+# sets them all to the commit time of the release-tagged OpenJDK
+# commit, as archived in the tarball.  This timestamp is deterministic
+# across RPM rebuilds and is reliably in the past.  Any file's mtime
+# will do, so use version-numbers.conf's.
+#
+# Use option B for JAR files, based on the discussion in OPENJDK-2583.
+#
+# For portable tarballs, use option C (OPENJDK_UPSTREAM_TAG_EPOCH) for
+# the modification times of all files in the portable tarballs.  Doing
+# so eliminates one source of variability across RPM rebuilds.
+VERSION_FILE="$(pwd)"/"%{top_level_dir_name}"/make/conf/version-numbers.conf
+OPENJDK_UPSTREAM_TAG_EPOCH="$(stat --format=%Y "${VERSION_FILE}")"
+
 function buildjdk() {
     local outputdir=${1}
     local buildjdk=${2}
@@ -1094,6 +1147,11 @@ function buildjdk() {
     echo "Using debug_symbols: ${debug_symbols}"
     echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}"
 
+%ifarch %{devkit_arches}
+    LIBPATH="${devkit}/lib:${devkit}/lib64"
+    echo "Setting library path to ${LIBPATH}"
+%endif
+
     mkdir -p ${outputdir}
     pushd ${outputdir}
 
@@ -1101,6 +1159,7 @@ function buildjdk() {
     # rather than ${link_opt} as the system versions
     # are always used in a system_libs build, even
     # for the static library build
+    LD_LIBRARY_PATH=${LIBPATH} \
     bash ${top_dir_abs_src_path}/configure \
 %ifarch %{zero_arches}
     --with-jvm-variants=zero \
@@ -1134,7 +1193,7 @@ function buildjdk() {
     --with-extra-cflags="$EXTRA_CFLAGS" \
     --with-extra-ldflags="%{ourldflags}" \
     --with-num-cores="$NUM_PROC" \
-    --with-source-date="${SOURCE_DATE_EPOCH}" \
+    --with-source-date="version" \
     --disable-javac-server \
 %ifarch %{zgc_arches}
     --with-jvm-features=zgc \
@@ -1142,6 +1201,7 @@ function buildjdk() {
     --disable-warnings-as-errors
 
     cat spec.gmk
+    LD_LIBRARY_PATH=${LIBPATH} \
     make LOG=trace $maketargets || \
         ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name \"hs_err_pid*.log\" | xargs cat && false )
 
@@ -1151,10 +1211,14 @@ function buildjdk() {
 function stripjdk() {
     local outputdir=${1}
     local toolpath=${2}
-    local jdkimagepath=${outputdir}/images/%{jdkimage}
+    local jdkimagepath=images/%{jdkimage}
-    local jreimagepath=${outputdir}/images/%{jreimage}
+    local jreimagepath=images/%{jreimage}
-    local jmodimagepath=${outputdir}/images/jmods
+    local jmodimagepath=images/jmods
+    local modulefile=lib/modules
     local supportdir=${outputdir}/support
+    local modulebuildpath=${outputdir}/jdk/modules
+    local jdkoutdir=${outputdir}/${jdkimagepath}
+    local jreoutdir=${outputdir}/${jreimagepath}
 
 %ifarch %{devkit_arches}
     OBJCOPY=${toolpath}/objcopy
@@ -1166,11 +1230,11 @@ function stripjdk() {
 
     if [ "x$suffix" = "x" ] ; then
         # Keep the unstripped version for consumption by RHEL RPMs
-        cp -a ${jdkimagepath}{,.unstripped}
+        cp -a ${jdkoutdir}{,.unstripped}
 
         # Strip the files
-        for file in $(find ${jdkimagepath} ${jreimagepath} ${supportdir} -type f) ; do
+        for file in $(find ${jdkoutdir} ${jreoutdir} ${supportdir} ${modulebuildpath} -type f) ; do
-            if file ${file} | grep -q 'ELF'; then
+            if file ${file} | cut -d ':' -f 2 | grep -q 'ELF'; then
                 noextfile=${file/.so/};
                 ${OBJCOPY} --only-keep-debug ${file} ${noextfile}.debuginfo;
                 ${OBJCOPY} --add-gnu-debuglink=${noextfile}.debuginfo ${file};
@@ -1183,24 +1247,53 @@ function stripjdk() {
             echo "Support directory missing.";
             exit 15
         fi
-        for cmd in $(find ${supportdir} -name '*.jmod_exec.cmdline') ; do
+        # Build the java.base jmod a third time to fix the hashes of dependent jmods
+        for cmd in $(find ${supportdir}/${jmodimagepath} -name '*.jmod_exec.cmdline') \
+                   ${supportdir}/${jmodimagepath}/*java.base*exec.cmdline ; do
             pre=${cmd/_exec/_pre};
             post=${cmd/_exec/_post};
             jmod=$(echo ${cmd}|sed 's#.*_create_##'|sed 's#_exec.cmdline##')
             echo "Rebuilding ${jmod} against stripped binaries...";
             if [ -e ${pre} ] ; then
-                echo "Executing ${pre}...";
+                echo -e "Executing ${pre}...\n$(cat ${pre})";
                 cat ${pre} | sh -s ;
             fi
-            echo "Executing ${cmd}...";
+            echo "Executing ${cmd}...$(cat ${cmd})";
             cat ${cmd} | sh -s ;
             if [ -e ${post} ] ; then
-                echo "Executing ${post}...";
+                echo -e "Executing ${post}...\n$(cat ${post})";
                 cat ${post} | sh -s ;
             fi
         done
-        rm -rf ${jdkimagepath}/jmods
+
-        cp -a ${jmodimagepath} ${jdkimagepath}
+        # Rebuild the image with the stripped modules
+        for image in ${jdkimagepath} ${jreimagepath} ; do
+            outdir=${outputdir}/${image};
+            jlink=${supportdir}/${image}/_jlink*_exec.cmdline;
+            # Backup the existing image as it contains
+            # files not generated by jlink
+            mv ${outdir}{,.bak};
+            # Regenerate the image using the command
+            # generated using the initial build
+            echo -e "Executing ${jlink}...\n$(cat ${jlink})";
+            cat ${jlink} | sh -s;
+            # Move the new jmods and module file from the new
+            # image to the old one
+            if [ -e ${outdir}.bak/jmods ] ; then
+                rm -rf ${outdir}.bak/jmods;
+                mv ${outdir}/jmods ${outdir}.bak;
+            fi
+            rm -f ${outdir}.bak/${modulefile};
+            mv ${outdir}/${modulefile} ${outdir}.bak/$(dirname ${modulefile});
+            # Restore the original image
+            rm -rf ${outdir};
+            mv ${outdir}{.bak,};
+            # Update the CDS archives
+            for cmd in ${supportdir}/${image}/*_gen_cds*_exec.cmdline ; do
+                echo -e "Executing ${cmd}...\n$(cat ${cmd})";
+                cat ${cmd} | sh -s;
+            done
+        done
     fi
 }
 
@@ -1254,13 +1347,6 @@ function installjdk() {
             # Install local files which are distributed with the JDK
             install -m 644 %{SOURCE10} ${imagepath}
 
-            # Create fake alt-java as a placeholder for future alt-java
-            pushd ${imagepath}
-            # add alt-java man page
-            echo "Hardened java binary recommended for launching untrusted code from the Web e.g. javaws" > man/man1/%{alt_java_name}.1
-            cat man/man1/java.1 >> man/man1/%{alt_java_name}.1
-            popd
-
             # Print release information
             cat ${imagepath}/release
         fi
@@ -1280,13 +1366,54 @@ function genchecksum() {
     popd
 }
 
-function packagejdk() {
+# Create a reproducible tarball in an appropriate way for
-    # Reusing OPENJDK_UPSTREAM_TAG_EPOCH for the modification times of all
+# the version of tar in use
-    # files in the portable tarballs eliminates one source of variability
+function createtar() {
-    # across RPM rebuilds.
+    local directory=${1}
-    VERSION_FILE="$(pwd)"/"%{top_level_dir_name}"/make/conf/version-numbers.conf
+    local archive=${2}
-    OPENJDK_UPSTREAM_TAG_EPOCH="$(stat --format=%Y "${VERSION_FILE}")"
+    local filter=${3}
+    local transform=${4}
+    local exclude=${5}
 
+    if [ "x${filter}" != "x" ] ; then
+        local filteroption="-name ${filter}";
+    fi
+    if [ "x${transform}" != "x" ] ; then
+        local transoption="--transform ${transform}";
+    fi
+    if [ "x${exclude}" != "x" ] ; then
+        local excludeoption="--exclude=${exclude}";
+    fi
+
+    local common_tar_opts="--owner=0 --group=0 --numeric-owner \
+                           ${transoption} ${excludeoption} --create --xz"
+    # Capture tar version, removing the decimal point (so 1.28 => 128)
+    tarver=$(tar --version|head -n1|sed -re 's|tar \(GNU tar\) ([0-9]).([0-9]*)|\1\2|')
+    echo "Detected tar ${tarver}"
+    if [ ${tarver} -gt 128 ] ; then
+        local tar_time="$(date --utc --iso-8601=seconds --date=@"${OPENJDK_UPSTREAM_TAG_EPOCH}")"
+        local tar_opts="--mtime=${tar_time} --sort=name ${common_tar_opts}"
+        if test "x${filteroption}" = "x"; then
+            tar ${tar_opts} --file ${archive} ${directory}
+        else
+            tar ${tar_opts} --file ${archive} $(find ${directory} ${filteroption})
+        fi
+    else
+        # See https://reproducible-builds.org/docs/archives/
+        # RHEL-7 has tar 1.26 which does not support --sort=name (added
+        # in 1.28), so use find-piped-through-sort instead.  Omit
+        # --pax-option since it made the docs package not reproducible
+        # due to PaxHeaders timestamp differences.
+        local tar_opts="--mtime=@${OPENJDK_UPSTREAM_TAG_EPOCH} \
+                        --no-recursion --null --files-from - \
+                        ${common_tar_opts}"
+        find ${directory} ${filteroption} -print0 | \
+            LC_ALL=C sort -z | \
+            tar ${tar_opts} --file ${archive}
+    fi
+}
+
+function packagejdk() {
     local imagesdir=$(pwd)/${1}/images
     local docdir=$(pwd)/${1}/images/docs
     local bundledir=$(pwd)/${1}/bundles
@@ -1294,8 +1421,6 @@ function packagejdk() {
     local srcdir=$(pwd)/%{top_level_dir_name}
     local tapsetdir=$(pwd)/tapset
     local altjavadir=$(pwd)/${3}
-    local tar_time="$(date --utc --iso-8601=seconds --date=@"${OPENJDK_UPSTREAM_TAG_EPOCH}")"
-    local tar_opts="--mtime=${tar_time} --sort=name -cJf"
 
     echo "Packaging build from ${imagesdir} to ${packagesdir}..."
     mkdir -p ${packagesdir}
@@ -1326,7 +1451,7 @@ function packagejdk() {
     if [ "x$suffix" = "x" ] ; then
         # Keep the unstripped version for consumption by RHEL RPMs
         mv %{jdkimage}.unstripped ${jdkname}
-        tar ${tar_opts} ${unstrippedarchive} ${jdkname}
+        createtar ${jdkname} ${unstrippedarchive}
         genchecksum ${unstrippedarchive}
         mv ${jdkname} %{jdkimage}.unstripped
     fi
@@ -1337,13 +1462,13 @@ function packagejdk() {
 
     # Release images have external debug symbols
     if [ "x$suffix" = "x" ] ; then
-        tar ${tar_opts} ${debugarchive} $(find ${jdkname} -name \*.debuginfo)
+        createtar ${jdkname} ${debugarchive} \*.debuginfo
         genchecksum ${debugarchive}
 
         mkdir ${docname}
         mv ${docdir} ${docname}
         mv ${bundledir}/${built_doc_archive} ${docname}
-        tar ${tar_opts} ${docarchive} ${docname}
+        createtar ${docname} ${docarchive}
         genchecksum ${docarchive}
 
         mkdir ${miscname}
@@ -1353,23 +1478,23 @@ function packagejdk() {
 %if %{with_systemtap}
         cp -a ${tapsetdir}* ${miscname}
 %endif
-        cp -av ${altjavadir}/%{alt_java_name} ${miscname}
+        cp -av ${altjavadir}/%{alt_java_name}{,.1} ${miscname}
-        tar ${tar_opts} ${miscarchive} ${miscname}
+        createtar ${miscname} ${miscarchive}
         genchecksum ${miscarchive}
     fi
 
-    tar ${tar_opts} ${jdkarchive} --exclude='**.debuginfo' ${jdkname}
+    createtar ${jdkname} ${jdkarchive} "" "" "**.debuginfo"
     genchecksum ${jdkarchive}
 
-    tar ${tar_opts} ${jrearchive}  --exclude='**.debuginfo' ${jrename}
+    createtar ${jrename} ${jrearchive} "" "" "**.debuginfo"
     genchecksum ${jrearchive}
 
 %if %{include_staticlibs}
     # Static libraries (needed for building graal vm with native image)
     # Tar as overlay. Transform to the JDK name, since we just want to "add"
     # static libraries to that folder
-    tar ${tar_opts} ${staticarchive} \
+    createtar "%{static_libs_image}/lib" ${staticarchive} "" \
-        --transform "s|^%{static_libs_image}/lib/*|${staticname}/lib/static/linux-%{archinstall}/glibc/|" "%{static_libs_image}/lib"
+        "s|^%{static_libs_image}/lib/*|${staticname}/lib/static/linux-%{archinstall}/glibc/|"
     genchecksum ${staticarchive}
 %endif
 
@@ -1386,13 +1511,18 @@ function packagejdk() {
   DEVKIT_ROOT=$(pwd)/devkit
   source ${DEVKIT_ROOT}/devkit.info
   GCC="${DEVKIT_TOOLCHAIN_PATH}/gcc --sysroot=${DEVKIT_SYSROOT}"
+  LIBPATH="${DEVKIT_ROOT}/lib:${DEVKIT_ROOT}/lib64"
 %else
   GCC=$(which gcc)
 %endif
 
 echo "Building %{SOURCE11}"
 mkdir -p %{altjavaoutputdir}
-${GCC} ${EXTRA_CFLAGS} -o %{altjavaoutputdir}/%{alt_java_name} %{SOURCE11}
+LD_LIBRARY_PATH="${LIBPATH}" ${GCC} ${EXTRA_CFLAGS} -o %{altjavaoutputdir}/%{alt_java_name} %{SOURCE11}
+echo "Generating %{alt_java_name} man page"
+altjavamanpage=%{altjavaoutputdir}/%{alt_java_name}.1
+echo "Hardened java binary recommended for launching untrusted code from the Web e.g. javaws" > ${altjavamanpage}
+cat %{top_level_dir_name}/src/java.base/share/man/java.1 >> ${altjavamanpage}
 
 echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}"
 
@@ -1773,6 +1903,100 @@ done
 %{_jvmdir}/%{miscportablearchive}.sha256sum
 
 %changelog
+* Sat Apr 13 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.9-1
+- Update to jdk-21.0.3+9 (GA)
+- Update release notes to 21.0.3+9
+- Switch to GA mode.
+- Update buildjdkver to match the featurever
+- ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
+
+* Thu Apr 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.7-0.1.ea
+- Update to jdk-21.0.3+7 (EA)
+- Update release notes to 21.0.3+7
+- Require tzdata 2024a due to upstream inclusion of JDK-8322725
+- Only require tzdata 2023d for now as 2024a is unavailable in buildroot
+- Drop JDK-8009550 which is now available upstream
+- Re-generate FIPS patch against 21.0.3+7 following backport of JDK-8325254
+
+* Wed Mar 20 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.1-0.1.ea
+- generate_source_tarball.sh: Add WITH_TEMP environment variable
+- generate_source_tarball.sh: Multithread xz on all available cores
+- generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
+- generate_source_tarball.sh: Update comment about tarball naming
+- generate_source_tarball.sh: Reformat comment header
+- generate_source_tarball.sh: Reformat and update help output
+- generate_source_tarball.sh: Do a shallow clone, for speed
+- generate_source_tarball.sh: Append -ea designator when required
+- generate_source_tarball.sh: Eliminate some removal prompting
+- generate_source_tarball.sh: Make tarball reproducible
+- generate_source_tarball.sh: Prefix temporary directory with temp-
+- generate_source_tarball.sh: Remove temporary directory exit conditions
+- generate_source_tarball.sh: Fix -ea logic to add dash
+- generate_source_tarball.sh: Set compile-command in Emacs
+- generate_source_tarball.sh: Remove REPO_NAME from FILE_NAME_ROOT
+- generate_source_tarball.sh: Move PROJECT_NAME and REPO_NAME checks
+- generate_source_tarball.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
+- generate_source_tarball.sh: shellcheck: Double-quote variable references (SC2086)
+- generate_source_tarball.sh: shellcheck: Do not use -a (SC2166)
+- generate_source_tarball.sh: shellcheck: Do not use $ on arithmetic variables (SC2004)
+- Use backward-compatible patch syntax
+- generate_source_tarball.sh: Ignore -ga tags with OPENJDK_LATEST
+- generate_source_tarball.sh: Fix whitespace
+- generate_source_tarball.sh: Remove trailing period in echo
+- generate_source_tarball.sh: Use long-style argument to grep
+- generate_source_tarball.sh: Add license
+- generate_source_tarball.sh: Add indentation instructions for Emacs
+- Remove -T0 argument from systemtap tar invocation
+- Use RHEL-7 tar-1.26-compatible invocations for reproducible tarballs
+- createtar: Add exclude option
+- packagejdk: Exclude debuginfo when creating jdkarchive and jrearchive tarballs
+- Resolves: OPENJDK-2995
+
+* Mon Mar 18 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.1.ea
+- Update to jdk-21.0.3+1 (EA)
+- Update release notes to 21.0.3+1
+- Switch to EA mode
+- Require tzdata 2023d due to upstream inclusion of JDK-8322725
+- Bump FreeType version to 2.13.2 following JDK-8316028
+- Add module build path to stripped directories to catch jpackageapplauncher files
+- Move alt-java man page to the misc tarball so it is not in the JDK image
+- generate_source_tarball.sh: Update examples in header for clarity
+- generate_source_tarball.sh: Cleanup message issued when checkout already exists
+- generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
+- generate_source_tarball.sh: Only add --depth=1 on non-local repositories
+- icedtea_sync.sh: Reinstate from rhel-8.9.0 branch
+- Move maintenance scripts to a scripts subdirectory
+- discover_trees.sh: Set compile-command and indentation instructions for Emacs
+- discover_trees.sh: shellcheck: Do not use -o (SC2166)
+- discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
+- discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
+- generate_source_tarball.sh: Add authorship
+- icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
+- icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
+- icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
+- openjdk_news.sh: Set compile-command and indentation instructions for Emacs
+- openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
+- openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
+- openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
+- generate_source_tarball.sh: Output values of new options WITH_TEMP and OPENJDK_LATEST
+- generate_source_tarball.sh: Double-quote DEPTH reference (SC2086)
+- generate_source_tarball.sh: Avoid empty DEPTH reference while still appeasing shellcheck
+- Vary reproducible tar creation by version of tar detected
+- Set OPENJDK_UPSTREAM_TAG_EPOCH & VERSION_FILE at start of build section as in 17u
+- Change --with-source-date value to 'version' to match Temurin builds
+- Re-run jlink to regenerate the jmods directory and lib/modules with stripped libraries
+- Rebuild CDS archives against the updated lib/modules
+- Require openjdk-devkit 1.0-4 to bring in fixes for .comment section and deterministic archives
+- Bump devkit requirement to 1.0-5 to bring in the bootstrapped version
+- Set LD_LIBRARY_PATH when calling gcc to build alt-java
+- Set LD_LIBRARY_PATH when calling configure
+- Set LD_LIBRARY_PATH when calling make
+- Bump devkit requirement to 1.0-6 to bring in the AS=<path>/as fix
+- Resolves: OPENJDK-2820
+- Resolves: OPENJDK-2821
+- Resolves: OPENJDK-2585
+- Resolves: OPENJDK-3138
+
 * Fri Mar 15 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-1
 - Update to jdk-21.0.2+13 (GA)
 - Update release notes to 21.0.2+13
@@ -1831,6 +2055,7 @@ done
 - * No accessibility subpackage to warrant RH1648242 patch any more
 - * No use of system libjpeg turbo to warrant RH649512 patch any more
 - Replace RH1684077 pcsc-lite-libs patch with better JDK-8009550 fix being upstreamed
+- Related: rhbz#2192749
 
 * Mon Aug 21 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-1
 - Update to jdk-21.0.0+35
@@ -1842,9 +2067,11 @@ done
 - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
 - Use upstream release URL for OpenJDK source
 - Re-enable tzdata tests now we are on the latest JDK and things are back in sync
+- Related: rhbz#2192749
 
 * Mon Aug 21 2023 Petra Alice Mikova <pmikova@redhat.com> - 1:21.0.0.0.35-1
 - Replace smoke test files used in the staticlibs test, as fdlibm was removed by JDK-8303798
+- Related: rhbz#2192749
 
 * Wed Aug 16 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:20.0.2.0.9-1
 - Update to jdk-20.0.2+9

java-21-openjdk.spec

@@ -2503,6 +2503,7 @@ cjc.mainProgram(args)
 - Update to jdk-21.0.3+9 (GA)
 - Update release notes to 21.0.3+9
 - Switch to GA mode.
+- Sync the copy of the portable specfile with the latest update
 - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
 - Resolves: RHEL-32424