Add scripts to handle tagging of portable-based RPMs

Related: RHEL-118774
Related: RHEL-119466

.gitignore

@@ -1,2 +1,42 @@
-SOURCES/openjdk-21.0.10+7.tar.xz
-SOURCES/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz
+/openjdk-jdk17u-jdk-17.0.7+7.tar.xz
+/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz
+/openjdk-jdk18u-jdk-18.0.1+0.tar.xz
+/openjdk-jdk18u-jdk-18.0.1+10.tar.xz
+/openjdk-jdk18u-jdk-18.0.1.1+2.tar.xz
+/openjdk-jdk18u-jdk-18.0.2+9.tar.xz
+/openjdk-jdk19u-jdk-19+36.tar.xz
+/openjdk-jdk19u-jdk-19.0.1+10.tar.xz
+/openjdk-jdk19u-jdk-19.0.2+7.tar.xz
+/openjdk-jdk20u-jdk-20+36.tar.xz
+/openjdk-jdk20u-jdk-20.0.1+9.tar.xz
+/openjdk-jdk20u-jdk-20.0.2+9.tar.xz
+/openjdk-jdk21u-jdk-21+35.tar.xz
+/openjdk-21.0.1+12.tar.xz
+/openjdk-21.0.2+11.tar.xz
+/openjdk-21.0.2+12.tar.xz
+/openjdk-21.0.2+13.tar.xz
+/openjdk-21.0.3+1-ea.tar.xz
+/openjdk-21.0.3+7-ea.tar.xz
+/openjdk-21.0.3+9.tar.xz
+/openjdk-21.0.4+1-ea.tar.xz
+/openjdk-21.0.4+5-ea.tar.xz
+/openjdk-21.0.4+7.tar.xz
+/openjdk-21.0.5+1-ea.tar.xz
+/openjdk-21.0.5+5-ea.tar.xz
+/openjdk-21.0.5+9-ea.tar.xz
+/openjdk-21.0.5+10.tar.xz
+/openjdk-21.0.5+11.tar.xz
+/openjdk-21.0.6+6-ea.tar.xz
+/openjdk-21.0.6+7.tar.xz
+/openjdk-21.0.7+1-ea.tar.xz
+/openjdk-21.0.7+2-ea.tar.xz
+/openjdk-21.0.7+3-ea.tar.xz
+/openjdk-21.0.7+4-ea.tar.xz
+/openjdk-21.0.7+5-ea.tar.xz
+/openjdk-21.0.7+6.tar.xz
+/openjdk-21.0.8+1-ea.tar.xz
+/openjdk-21.0.8+2-ea.tar.xz
+/openjdk-21.0.8+8-ea.tar.xz
+/openjdk-21.0.8+9.tar.xz
+/openjdk-21.0.9+1-ea.tar.xz
+/openjdk-21.0.9+10.tar.xz

.java-21-openjdk.metadata

@@ -1,2 +0,0 @@
-1e24e8b2c4802b336ecf71428de9e38abecc0d05 SOURCES/openjdk-21.0.10+7.tar.xz
-c8281ee37b77d535c9c1af86609a531958ff7b34 SOURCES/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz

NEWS

@@ -3,480 +3,6 @@ Key:
 JDK-X  - https://bugs.openjdk.java.net/browse/JDK-X
 CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
 
-New in release OpenJDK 21.0.10 (2026-01-20):
-===========================================
-Live versions of these release notes can be found at:
-  * https://bit.ly/openjdk2110
-
-* CVEs
-  - CVE-2026-21925
-  - CVE-2026-21932
-  - CVE-2026-21933
-  - CVE-2026-21945
-* Changes
-  - JDK-7191877: TEST_BUG: java/rmi/transport/checkLeaseInfoLeak/CheckLeaseLeak.java failing intermittently
-  - JDK-8072701: resume001 failed due to ERROR: timeout for waiting for a BreakpintEvent
-  - JDK-8139228: JFileChooser renders file names as HTML document
-  - JDK-8139392: JInternalFrame has incorrect padding
-  - JDK-8140527: JInternalFrame has incorrect title button width
-  - JDK-8162380: [TEST_BUG] MouseEvent/.../AltGraphModifierTest.java has only "Fail" button
-  - JDK-8199149: Improve the exception message thrown by VarHandle of unsupported operation
-  - JDK-8201183: sjavac build failures: "Connection attempt failed: Connection refused"
-  - JDK-8201778: Speed up test javax/net/ssl/DTLS/PacketLossRetransmission.java
-  - JDK-8204868: java/util/zip/ZipFile/TestCleaner.java still fails with "cleaner failed to clean zipfile."
-  - JDK-8210807: Printing a JTable with a JScrollPane prints table without rows populated
-  - JDK-8216437: PPC64: Add intrinsic for GHASH algorithm
-  - JDK-8219408: Tests should handle ${} in the view of jtreg "smart action"
-  - JDK-8230016: re-visit test sun/security/pkcs11/Serialize/SerializeProvider.java
-  - JDK-8245545: Disable TLS_RSA cipher suites
-  - JDK-8265429: Improve GCM encryption
-  - JDK-8277424: javax/net/ssl/TLSCommon/TLSTest.java  fails with connection refused
-  - JDK-8280482: Window transparency bug on Linux
-  - JDK-8290043: serviceability/attach/ConcAttachTest.java failed "guarantee(!CheckJNICalls) failed: Attached JNI thread exited without being detached"
-  - JDK-8297531: sun/security/krb5/MicroTime.java fails with "Exception: What? only 100 musec precision?"
-  - JDK-8300708: Some nsk jvmti tests fail with virtual thread wrapper due to jvmti missing some virtual thread support
-  - JDK-8304065: HttpServer.stop should terminate immediately if no exchanges are in progress
-  - JDK-8304811: vmTestbase/vm/mlvm/indy/func/jvmti/stepBreakPopReturn/INDIFY_Test.java fails with JVMTI_ERROR_TYPE_MISMATCH
-  - JDK-8305186: Reference.waitForReferenceProcessing should be more accessible to tests
-  - JDK-8305567: serviceability/tmtools/jstat/GcTest01.java failed  utils.JstatGcResults.assertConsistency
-  - JDK-8306579: Consider building with /Zc:throwingNew
-  - JDK-8307160: Fix AWT/2D/A11Y to support the permissive- flag on the Microsoft Visual C compiler
-  - JDK-8308780: Fix the Java Integer types on Windows
-  - JDK-8309511: Regression test ExtraImportSemicolon.java refers to the wrong bug
-  - JDK-8310049: Refactor Charset tests to use JUnit
-  - JDK-8310915: Typo in aarch64.ad: "envcodings"
-  - JDK-8311076: RedefineClasses doesn't check for ConstantPool overflow
-  - JDK-8311906: Improve robustness of String constructors with mutable array inputs
-  - JDK-8313231: Redundant if statement in ZoneInfoFile
-  - JDK-8313770: jdk/internal/platform/docker/TestSystemMetrics.java fails on Ubuntu
-  - JDK-8315130: java.lang.IllegalAccessError when processing classlist to create CDS archive
-  - JDK-8315990: Amend problemlisted tests to proper position
-  - JDK-8316422: TestIntegerUnsignedDivMod.java triggers "invalid layout" assert in FrameValues::validate
-  - JDK-8317132: Prepare HotSpot for permissive-
-  - JDK-8317332: Prepare security for permissive-
-  - JDK-8317970: Bump target macosx-x64 version to 11.00.00
-  - JDK-8318467: [jmh] tests concurrent.Queues and concurrent.ProducerConsumer hang with 101+ threads
-  - JDK-8318730: MonitorVmStartTerminate.java still times out after JDK-8209595
-  - JDK-8318850: Duplicate code in the LCMSImageLayout
-  - JDK-8319570: Change to GCC 13.2.0 for building on Linux at Oracle
-  - JDK-8320049: PKCS10 would not discard the cause when throw SignatureException on invalid key
-  - JDK-8320577: Improve MessageHeader's toString() function to make HttpURLConnection's debug log readable
-  - JDK-8320836: jtreg gtest runs should limit heap size
-  - JDK-8321180: Condition for non-latin1 string size too large exception is off by one
-  - JDK-8321183: Incorrect warning from cds about the modules file
-  - JDK-8321514: UTF16 string gets constructed incorrectly from codepoints if CompactStrings is not enabled
-  - JDK-8322018: Test java/lang/String/CompactString/MaxSizeUTF16String.java fails with -Xcomp
-  - JDK-8322135: Printing JTable in Windows L&F throws InternalError: HTHEME is null
-  - JDK-8322140: javax/swing/JTable/JTableScrollPrintTest.java does not print the rows and columns of the table in Nimbus and Aqua LookAndFeel
-  - JDK-8323803: ConstantOopReadValue::print_on should print 'null' instead of 'nullptr'
-  - JDK-8324065: Daylight saving information for `Africa/Casablanca` are incorrect
-  - JDK-8324491: Keyboard layout didn't keep its state if it was changed when dialog was active
-  - JDK-8325277: [21u] Backout test change of JDK-8291809
-  - JDK-8325530: Vague error message when com.sun.tools.attach.VirtualMachine fails to load agent library
-  - JDK-8325590: Regression in round-tripping UTF-16 strings after JDK-8311906
-  - JDK-8325647: [IR framework] Only prints stdout if exitCode is 134
-  - JDK-8325731: Installation instructions for Debian/Ubuntu don't mention autoconf
-  - JDK-8325766: Extend CertificateBuilder to create trust and end entity certificates programmatically
-  - JDK-8327434: Test java/util/PluggableLocale/TimeZoneNameProviderTest.java timed out
-  - JDK-8327704: Update nsk/jdi tests to use driver instead of othervm
-  - JDK-8327757: Convert javax/swing/JSlider/6524424/bug6524424.java applet to main
-  - JDK-8327856: Convert applet test SpanishDiacriticsTest.java to a main program
-  - JDK-8327980: Convert javax/swing/JToggleButton/4128979/bug4128979.java applet test to main
-  - JDK-8328124: Convert java/awt/Frame/ShownOnPack/ShownOnPack.html applet test to main
-  - JDK-8328247: Remove redundant dir for tests converted from applet to main
-  - JDK-8328299: Convert DnDFileGroupDescriptor.html applet test to main
-  - JDK-8328377: Convert java/awt/Cursor/MultiResolutionCursorTest test to main
-  - JDK-8328562: Convert java/awt/InputMethods/DiacriticsTest/DiacriticsTest.java applet test to main
-  - JDK-8331231: containers/docker/TestContainerInfo.java fails
-  - JDK-8333200: Test containers/docker/TestPids.java fails Limit value -1 is not accepted as unlimited
-  - JDK-8333526: Restructure java/nio/channels/DatagramChannel/StressNativeSignal.java to a fail fast exception handling policy
-  - JDK-8333569: jpackage tests must run app launchers with retries on Linux only
-  - JDK-8333783: java/nio/channels/FileChannel/directio/DirectIOTest.java is unstable with AV software
-  - JDK-8334217: [AIX] Misleading error messages after JDK-8320005
-  - JDK-8334509: Cancelling PageDialog does not return the same PageFormat object
-  - JDK-8334756: javac crashed on call to non-existent generic method with explicit annotated type arg
-  - JDK-8334771: [TESTBUG] Run TestDockerMemoryMetrics.java with -Xcomp fails exitValue = 137
-  - JDK-8335986: Test javax/swing/JCheckBox/4449413/bug4449413.java fails on Windows 11 x64 because RBMenuItem's and CBMenuItem's checkmark on the left side are not visible
-  - JDK-8337723: Remove redundant tests from com/sun/security/sasl/gsskerb
-  - JDK-8338428: Add logging of final VM flags while setting properties
-  - JDK-8338740: java/net/httpclient/HttpsTunnelAuthTest.java fails with java.io.IOException: HTTP/1.1 header parser received no bytes
-  - JDK-8339280: jarsigner -verify performs cross-checking between CEN and LOC
-  - JDK-8339366: [jittester] Make it possible to generate tests without execution
-  - JDK-8340015: Open source several AWT focus tests - series 7
-  - JDK-8340321: Disable SHA-1 in TLS/DTLS 1.2 handshake signatures
-  - JDK-8340354: Open source AWT desktop properties and print related tests
-  - JDK-8341097: GHA: Demote Mac x86 jobs to build only
-  - JDK-8341131: Some jdk/jfr/event/compiler tests shouldn't be executed with Xcomp
-  - JDK-8341138: Rename jtreg property docker.support as container.support
-  - JDK-8341443: [macos] AppContentTest and SigningOptionsTest failed due to "codesign" does not fails with "--app-content" on macOS 15
-  - JDK-8341496: Improve JMX connections
-  - JDK-8342576: [macos] AppContentTest still fails after JDK-8341443 for same reason on older macOS versions
-  - JDK-8342582: user.region for formatting number no longer works for 21.0.5
-  - JDK-8342934: TYPE_USE annotations printed with error causing "," in toString output
-  - JDK-8343191: Cgroup v1 subsystem fails to set subsystem path
-  - JDK-8343340: Swapping checking do not work for MetricsMemoryTester failcount
-  - JDK-8343875: Minor improvements of jpackage test library
-  - JDK-8343876: Enhancements to jpackage test lib
-  - JDK-8344143: Test jdk/java/lang/Thread/virtual/stress/GetStackTraceALotWhenPinned.java timed out on  macosx-x64
-  - JDK-8344577: Virtual thread tests are timing out on some macOS systems
-  - JDK-8345213: JVM Prefers /etc/timezone Over /etc/localtime on Debian 12
-  - JDK-8346142: [perf] scalability issue for the specjvm2008::xml.validation workload
-  - JDK-8346234: javax/swing/text/DefaultEditorKit/4278839/bug4278839.java still fails in CI
-  - JDK-8346753: Test javax/swing/JMenuItem/RightLeftOrientation/RightLeftOrientation.java fails on Windows Server 2025 x64 because the icons of RBMenuItem and CBMenuItem are not visible in Nimbus LookAndFeel
-  - JDK-8346839: [TESTBUG] "java/awt/textfield/setechochartest4/setechochartest4.java" failed because the test frame disappears on clicking "Click Several Times" button
-  - JDK-8346875: Test jdk/jdk/jfr/event/os/TestCPULoad.java fails on macOS
-  - JDK-8347143: [aix] Fix strdup use in os::dll_load
-  - JDK-8347277: java/awt/Focus/ComponentLostFocusTest.java fails intermittently
-  - JDK-8347300: Don't exclude the "PATH" var from the environment when running app launchers in jpackage tests
-  - JDK-8347377: Add validation checks for ICC_Profile header fields
-  - JDK-8347434: Richer VM operations events logging
-  - JDK-8347811: Container detection code for cgroups v2 should use cgroup.controllers
-  - JDK-8347841: Test fixes that use deprecated time zone IDs
-  - JDK-8348240: Remove SystemDictionaryShared::lookup_super_for_unregistered_class()
-  - JDK-8348402: PerfDataManager stalls shutdown for 1ms
-  - JDK-8349188: LineBorder does not scale correctly
-  - JDK-8349534: Refactor jdk/sun/security/krb5/runNameEquals.sh to java test
-  - JDK-8349705: java.net.URI.scanIPv4Address throws unnecessary URISyntaxException
-  - JDK-8349988: Change cgroup version detection logic to not depend on /proc/cgroups
-  - JDK-8350102: Decouple jpackage test-lib Executor.Result and Executor classes
-  - JDK-8350623: Fix -Wzero-as-null-pointer-constant warnings in nsk native test utilities
-  - JDK-8350813: Rendering of bulky sound bank from MIDI sequence can cause OutOfMemoryError
-  - JDK-8351110: ImageIO.write for JPEG can write corrupt JPEG for certain thumbnail dimensions
-  - JDK-8351359: OperatingSystemMXBean: values from getCpuLoad and getProcessCpuLoad are stale after 24.8 days (Windows)
-  - JDK-8351382: New test containers/docker/TestMemoryWithSubgroups.java is failing
-  - JDK-8351567: Jar Manifest test ValueUtf8Coding produces misleading diagnostic output
-  - JDK-8352016: Improve java/lang/RuntimeTests/RuntimeExitLogTest.java
-  - JDK-8352533: Report useful IOExceptions when jspawnhelper fails
-  - JDK-8352678: Opensource few JMenuItem tests
-  - JDK-8352682: Opensource JComponent tests
-  - JDK-8352686: Opensource JInternalFrame tests - series3
-  - JDK-8352687: Opensource few JInternalFrame and JTextField tests
-  - JDK-8352793: Open source several AWT TextComponent tests - Batch 1
-  - JDK-8352865: Open source several AWT TextComponent tests - Batch 2
-  - JDK-8352905: Open some JComboBox bugs 1
-  - JDK-8352926: New test TestDockerMemoryMetricsSubgroup.java fails
-  - JDK-8352966: Opensource Several Font related tests - Batch 2
-  - JDK-8352997: Open source several Swing JTabbedPane tests
-  - JDK-8353007: Open some JComboBox bugs 2
-  - JDK-8353011: Open source Swing JButton tests - Set 1
-  - JDK-8353013: java.net.URI.create(String) may have low performance to scan the host/domain name from URI string when the hostname starts with number
-  - JDK-8353175: Eliminate double iteration of stream in FieldDescriptor reinitialization
-  - JDK-8353201: Open source Swing Tooltip tests - Set 2
-  - JDK-8353299: VerifyJarEntryName.java test fails
-  - JDK-8353309: Open source several Swing text tests
-  - JDK-8353319: Open source Swing tests - Set 3
-  - JDK-8353445: Open source several AWT Menu tests - Batch 1
-  - JDK-8353470: Clean up and open source couple AWT Graphics related tests (Part 2)
-  - JDK-8353483: Open source some JProgressBar tests
-  - JDK-8353486: Open source Swing Tests - Set 4
-  - JDK-8353585: Provide ChoiceFormat#parse(String, ParsePosition) tests
-  - JDK-8353586: Open source several toolkit tests
-  - JDK-8353589: Open source a few Swing menu-related tests
-  - JDK-8353592: Open source several scrollbar tests
-  - JDK-8353661: Open source several swing tests batch5
-  - JDK-8353832: Opensource FontClass, Selection and Icon tests
-  - JDK-8353953: com/sun/jdi tests should be fixed to not always require includevirtualthreads=y
-  - JDK-8353957: Open source several AWT ScrollPane tests - Batch 1
-  - JDK-8353958: Open source several AWT ScrollPane tests - Batch 2
-  - JDK-8354095: Open some JTable bugs 5
-  - JDK-8354106: Clean up and open source KeyEvent related tests (Part 2)
-  - JDK-8354214: Open source Swing tests Batch 2
-  - JDK-8354233: Open some JTable bugs 6
-  - JDK-8354235: Test javax/net/ssl/SSLSocket/Tls13PacketSize.java failed with java.net.SocketException: An established connection was aborted by the software in your host machine
-  - JDK-8354248: Open source several AWT GridBagLayout and List tests
-  - JDK-8354340: Open source Swing Tests - Set 6
-  - JDK-8354341: Open some JTable bugs 7
-  - JDK-8354365: Opensource few Modal and Full Screen related tests
-  - JDK-8354418: Open source Swing tests Batch 4
-  - JDK-8354451: Open source some more Swing popup menu tests
-  - JDK-8354465: Open some JTable bugs 8
-  - JDK-8354466: Open some misc Swing bugs 9
-  - JDK-8354472: Clean up and open source KeyEvent related tests (Part 3)
-  - JDK-8354475: TestDockerMemoryMetricsSubgroup.java fails with exitValue = 1
-  - JDK-8354493: Opensource Several MultiScreen and Insets related tests
-  - JDK-8354495: Open source several AWT DataTransfer tests
-  - JDK-8354532: Open source JFileChooser Tests - Set 7
-  - JDK-8354552: Open source a few Swing tests
-  - JDK-8354553: Open source several clipboard tests batch0
-  - JDK-8354561: Open source several swing tests batch0
-  - JDK-8354646: java.awt.TextField allows to identify the spaces in a password when double clicked at the starting and end of the text
-  - JDK-8354653: Clean up and open source KeyEvent related tests (Part 4)
-  - JDK-8354701: Open source few JToolTip tests
-  - JDK-8354873: javax/swing/plaf/metal/MetalIconFactory/bug4952462.java failing on CI
-  - JDK-8354928: Clean up and open source some miscellaneous AWT tests
-  - JDK-8355071: Fix nsk/jdi test to not require lookup of main thread in order to set the breakpoint used for communication
-  - JDK-8355077: Compiler error at splashscreen_gif.c due to unterminated string initialization
-  - JDK-8355241: Move NativeDialogToFrontBackTest.java PL test to manual category
-  - JDK-8355333: Some Problem list entries point to non-existent / wrong files
-  - JDK-8355387: [jittester] Disable downcasts by default
-  - JDK-8355444: [java.io] Use @requires tag instead of exiting based on "os.name" property value
-  - JDK-8355478: DoubleActionESC.java fails intermittently
-  - JDK-8355558: SJIS.java test is always ignored
-  - JDK-8355561: [macos] Build failure with Xcode 16.3
-  - JDK-8355569: Some nsk/jdi tests can glean the "main" thread by using the ClassPrepareEvent for the debuggee main class
-  - JDK-8355773: Some nsk/jdi tests can fetch ThreadReference from static field in the debuggee
-  - JDK-8356023: Some nsk/jdi tests can fetch ThreadReference from static field in the debuggee: part 2
-  - JDK-8356040: java/util/PluggableLocale/LocaleNameProviderTest.java timed out
-  - JDK-8356145: ListEnterExitTest.java fails on macos
-  - JDK-8356187: TestJcmd.java may incorrectly parse podman version
-  - JDK-8356588: Some nsk/jdi tests can fetch ThreadReference from static field in the debuggee: part 3
-  - JDK-8356752: Log mouse enter and exit events for debugging
-  - JDK-8356811: Some nsk/jdi tests can fetch ThreadReference from static field in the debuggee: part 4
-  - JDK-8356897: Update NSS library to 3.111
-  - JDK-8357172: Extend try block in nsk/jdi tests to capture exceptions thrown by Debuggee.classByName()
-  - JDK-8357305: Compilation failure in javax/swing/JMenuItem/bug6197830.java
-  - JDK-8357561: BootstrapLoggerTest does not work on Ubuntu 24 with LANG de_DE.UTF-8
-  - JDK-8357799: Improve instructions for JFileChooser/HTMLFileName.java
-  - JDK-8357822: C2: Multiple string optimization tests are no longer testing string concatenation optimizations
-  - JDK-8357882: Use UTF-8 encoded data in LocaleDataTest
-  - JDK-8358048: java/net/httpclient/HttpsTunnelAuthTest.java incorrectly calls Thread::stop
-  - JDK-8358532: JFileChooser in GTK L&F still displays HTML filename
-  - JDK-8358577: Test serviceability/jvmti/thread/GetCurrentContendedMonitor/contmon01/contmon01.java failed: unexpexcted monitor object
-  - JDK-8358679: [asan] vmTestbase/nsk/jvmti tests show memory issues
-  - JDK-8358748: Large page size initialization fails with assert "page_size must be a power of 2"
-  - JDK-8358764: (sc) SocketChannel.close when thread blocked in read causes connection to be reset (win)
-  - JDK-8358813: JPasswordField identifies spaces in password via delete shortcuts
-  - JDK-8359061: Update and ProblemList manual test java/awt/Cursor/CursorDragTest/ListDragCursor.java
-  - JDK-8359167: Remove unused test/hotspot/jtreg/vmTestbase/nsk/share/jpda/BindServer.java
-  - JDK-8359182: Use @requires instead of SkippedException for MaxPath.java
-  - JDK-8359207: Remove runtime/signal/TestSigusr2.java since it is always skipped
-  - JDK-8359418: Test "javax/swing/text/GlyphView/bug4188841.java" failed because the phrase of text pane does not match the instructions
-  - JDK-8359428: Test 'javax/swing/JTabbedPane/bug4499556.java' failed because after selecting one of L&F items, the test case automatically failed when clicking on L&F Menu button again
-  - JDK-8359449: [TEST] open/test/jdk/java/io/File/SymLinks.java Refactor extract method for Windows specific test
-  - JDK-8359477: com/sun/net/httpserver/Test12.java appears to have a temp file race
-  - JDK-8359501: Enhance Handling of URIs
-  - JDK-8359687: Use PassFailJFrame for java/awt/print/Dialog/DialogType.java
-  - JDK-8360022: ClassRefDupInConstantPoolTest.java fails when running in repeat
-  - JDK-8360178: TestArguments.atojulong gtest has incorrect format string
-  - JDK-8360288: Shenandoah crash at size_given_klass in op_degenerated
-  - JDK-8360408: [TEST] Use @requires tag instead of exiting based on "os.name" property value for sun/net/www/protocol/file/FileURLTest.java
-  - JDK-8360411: [TEST] open/test/jdk/java/io/File/MaxPathLength.java Refactor extract method to encapsulate Windows specific test logic
-  - JDK-8360478: libjsig related tier3 jtreg tests fail when asan is configured
-  - JDK-8360533: ContainerRuntimeVersionTestUtils fromVersionString fails with some docker versions
-  - JDK-8360981: Remove use of Thread.stop in test/jdk/java/net/Socket/DeadlockTest.java
-  - JDK-8361253: CommandLineOptionTest library should report observed values on failure
-  - JDK-8361298: SwingUtilities/bug4967768.java fails where character P is not underline
-  - JDK-8361314: Test serviceability/jvmti/VMEvent/MyPackage/VMEventRecursionTest.java FATAL ERROR in native method: Failed during the GetClassSignature call
-  - JDK-8361423: Add IPSupport::printPlatformSupport to java/net/NetworkInterface/IPv4Only.java
-  - JDK-8361447: [REDO] Checked version of JNI Release<type>ArrayElements needs to filter out known wrapped arrays
-  - JDK-8361599: [PPC64] enable missing tests via jtreg requires
-  - JDK-8361751: Test sun/tools/jcmd/TestJcmdSanity.java timed out on Windows
-  - JDK-8361754: New test runtime/jni/checked/TestCharArrayReleasing.java can cause disk full errors
-  - JDK-8361868: [GCC static analyzer] complains about missing calloc - NULL checks in p11_util.c
-  - JDK-8361871: [GCC static analyzer] complains about use of uninitialized value ckpObject in p11_util.c
-  - JDK-8362123: ClassLoader Leak via Executors.newSingleThreadExecutor(...)
-  - JDK-8362204: test/jdk/sun/awt/font/TestDevTransform.java fails on Ubuntu 24.04
-  - JDK-8362207: Add more test cases for possible double-rounding in fma
-  - JDK-8362308: Enhance Bitmap operations
-  - JDK-8362516: Support of GCC static analyzer (-fanalyzer)
-  - JDK-8362532: Test gc/g1/plab/* duplicate command-line options
-  - JDK-8362533: Tests sun/management/jmxremote/bootstrap/* duplicate VM flags
-  - JDK-8362602: Add test.timeout.factor to CompileFactory to avoid test timeouts
-  - JDK-8362632: Improve HttpServer Request handling
-  - JDK-8363676: [GCC static analyzer] missing return value check of malloc in OGLContext_SetTransform
-  - JDK-8363720: Follow up to JDK-8360411 with post review comments
-  - JDK-8363966: GHA: Switch cross-compiling sysroots to Debian trixie
-  - JDK-8364198: NMT should have a better corruption message
-  - JDK-8364199: Enhance list of environment variables printed in hserr/hsinfo file
-  - JDK-8364214: Enhance polygon data support
-  - JDK-8364235: Fix for JDK-8361447 breaks the alignment requirements for GuardedMemory
-  - JDK-8364257: JFR: User-defined events and settings with a one-letter name cannot be configured
-  - JDK-8364258: ThreadGroup constant pool serialization is not normalized
-  - JDK-8364263: HttpClient: Improve encapsulation of ProxyServer
-  - JDK-8364484: misc tests fail with Received fatal alert: handshake_failure
-  - JDK-8364514: [asan] runtime/jni/checked/TestCharArrayReleasing.java heap-buffer-overflow
-  - JDK-8364556: JFR:  Disable SymbolTableStatistics and StringTableStatistics in default.jfc
-  - JDK-8364597: Replace THL A29 Limited with Tencent
-  - JDK-8364660: ClassVerifier::ends_in_athrow() should be removed
-  - JDK-8364786: Test java/net/vthread/HttpALot.java intermittently fails - 24999 handled, expected 25000
-  - JDK-8364993: JFR: Disable jdk.ModuleExport in default.jfc
-  - JDK-8364996: java/awt/font/FontNames/LocaleFamilyNames.java times out on Windows
-  - JDK-8365058: Enhance CopyOnWriteArraySet
-  - JDK-8365086: CookieStore.getURIs() and get(URI) should return an immutable List
-  - JDK-8365098: make/RunTests.gmk generates a wrong path to test artifacts on Alpine
-  - JDK-8365168: Use 64-bit aligned addresses for CK_ULONG access in PKCS11 native key code
-  - JDK-8365240: [asan] exclude some tests when using asan enabled binaries
-  - JDK-8365271: Improve Swing supports
-  - JDK-8365280: Enhance JOptionPane
-  - JDK-8365425: [macos26] javax/swing/JInternalFrame/8160248/JInternalFrameDraggingTest.java fails on macOS 26
-  - JDK-8365442: [asan] runtime/ErrorHandling/CreateCoredumpOnCrash.java fails
-  - JDK-8365487: [asan] some oops (mode) related tests fail
-  - JDK-8365615: Improve JMenuBar/RightLeftOrientation.java
-  - JDK-8365660: test/jdk/sun/security/pkcs11/KeyAgreement/ tests skipped without SkipExceprion
-  - JDK-8365790: Shutdown hook for application image does not work on Windows
-  - JDK-8365834: Mark java/net/httpclient/ManyRequests.java  as intermittent
-  - JDK-8365913: Support latest MSC_VER in abstract_vm_version.cpp
-  - JDK-8365919: Replace currentTimeMillis with nanoTime in Stresser.java
-  - JDK-8365983: Tests should throw SkippedException when SCTP not supported
-  - JDK-8366092: [GCC static analyzer] UnixOperatingSystem.c warning: use of uninitialized value 'systemTicks'
-  - JDK-8366159: SkippedException is treated as a pass for pkcs11/KeyStore, pkcs11/SecretKeyFactory and pkcs11/SecureRandom
-  - JDK-8366208: Unexpected exception in sun.java2d.cmm.lcms.LCMSImageLayout
-  - JDK-8366229: runtime/Thread/TooSmallStackSize.java runs with all collectors
-  - JDK-8366231: Bump update version for OpenJDK: jdk-21.0.10
-  - JDK-8366342: Key generator and key pair generator tests skipping, but showing as passed
-  - JDK-8366359: Test should throw SkippedException when there is no lpstat
-  - JDK-8366558: Gtests leave /tmp/cgroups-test* files
-  - JDK-8366750: Remove test 'java/awt/Choice/ChoiceMouseWheelTest/ChoiceMouseWheelTest.java' from problemlist
-  - JDK-8366764: Deproblemlist java/awt/ScrollPane/ScrollPositionTest.java
-  - JDK-8366844: Update and automate MouseDraggedOriginatedByScrollBarTest.java
-  - JDK-8366893: java/lang/Thread/virtual/stress/GetStackTraceALotWhenPinned.java timed out on macos-aarch64
-  - JDK-8367017: Remove legacy checks from WrappedToolkitTest and convert from bash
-  - JDK-8367021: Regression in LocaleDataTest refactoring
-  - JDK-8367131: Test com/sun/jdi/ThreadMemoryLeakTest.java fails on 32 bits
-  - JDK-8367133: DTLS: fragmentation of Finished message results in handshake failure
-  - JDK-8367237: Thread-Safety Usage Warning for java.text.Collator Classes
-  - JDK-8367348: Enhance PassFailJFrame to support links in HTML
-  - JDK-8367372: Test `test/hotspot/jtreg/gc/TestObjectAlignmentCardSize.java` fails on 32 bit systems
-  - JDK-8367384: The ICC_Profile class may throw exceptions during serialization
-  - JDK-8367782: VerifyJarEntryName.java: Fix modifyJarEntryName to operate on bytes and re-introduce verifySignatureEntryName
-  - JDK-8367869: Test java/io/FileDescriptor/Sync.java timed out
-  - JDK-8367904: Test java/net/InetAddress/ptr/Lookup.java should throw SkippedException
-  - JDK-8368032: Enhance Certificate Checking
-  - JDK-8368192: Test java/lang/ProcessBuilder/Basic.java#id0 fails with Exception: Stack trace
-  - JDK-8368668: Several vmTestbase/vm/gc/compact tests timed out on large memory machine
-  - JDK-8368960: Adjust java UL logging in the build
-  - JDK-8368982: Test sun/security/tools/jarsigner/EC.java completed and timed out
-  - JDK-8369032: Add test to ensure serialized ICC_Profile stores only necessary optional data
-  - JDK-8369078: Fix faulty test conversion in IllegalCharsetName.java
-  - JDK-8369184: SimpleTimeZone equals() Returns True for Unequal Instances with Different hashCode Values
-  - JDK-8369226: GHA: Switch to MacOS 15
-  - JDK-8369319: java/net/httpclient/CancelRequestTest.java fails intermittently
-  - JDK-8369450: [Ubuntu 25.10] openjdk fails to build due to rust-coreutils date
-  - JDK-8369506: Bytecode rewriting causes Java heap corruption on AArch64
-  - JDK-8369563: Gtest dll_address_to_function_and_library_name has issues with stripped pdb files
-  - JDK-8369616: JavaFrameAnchor on RISC-V has unnecessary barriers and wrong store order in MacroAssembler
-  - JDK-8369946: Bytecode rewriting causes Java heap corruption on PPC
-  - JDK-8369947: Bytecode rewriting causes Java heap corruption on RISC-V
-  - JDK-8370214: [21u] Remove -Xdebug and -Xnoagent from tests: backport parts of 8227229 and 8312072
-  - JDK-8370465: Right to Left Orientation Issues with MenuItem Component
-  - JDK-8372534: Update Libpng to 1.6.51
-  - JDK-8375447: Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 21.0.10
-
-Notes on individual issues:
-===========================
-
-core-libs/java.util:i18n:
-
-JDK-8345213: JVM Prefers /etc/timezone Over /etc/localtime on Debian 12
-=======================================================================
-On older Debian-based GNU/Linux systems, the /etc/timezone file
-contained the name of the timezone in use on the system and so was
-preferred by OpenJDK for determining the default timezone returned by
-`TimeZone.getDefault()`.  Since Debian 3.1 in 2005, the /etc/localtime
-file has also been provided as either a link to or a copy of the zone
-data file provided by the tzdata database and this is now the
-preferred source of the system timezone following Debian's adoption of
-systemd.  OpenJDK's continued preference for /etc/timezone meant that
-it may be reading a timezone setting which was no longer updated on
-modern Debian systems. With this OpenJDK update, OpenJDK only reads
-/etc/localtime as on other GNU/Linux systems.
-
-See https://wiki.debian.org/TimeZoneChanges#Check_Configured_Timezone
-for more details.
-
-core-libs/java.lang:
-
-JDK-8311906: Improve robustness of String constructors with mutable array inputs
-================================================================================
-The introduction of Compact Strings (JEP 254, OpenJDK 9) changed the
-implementation of the String class to use a byte array to store
-character data in either ISO-8859-1/Latin-1 (one byte per character)
-or UTF-16 (two bytes per character). This optimisation reduced the
-memory usage over a character array when String objects with only
-Latin-1 characters were used.  However, this also introduced a
-potential race condition if the input character array was modified
-externally while being converted to bytes.  With this release of
-OpenJDK, the conversion now includes an additional verification step
-which checks that the first character that is not Latin-1 is still not
-Latin-1 in the original array after all characters have been copied.
-If it has changed to Latin-1, a second attempt is made to compress the
-character data to Latin-1.  A note is also added to the documentation
-of the relevant methods in AbstractStringBuilder, Appendable and
-String to indicate that the contents of the final String are
-unspecified if the character array is modified during construction.
-
-See https://openjdk.org/jeps/254 for more details on Compact Strings.
-
-core-svc/javax.management:
-
-JDK-8341496: Improve JMX connections
-====================================
-With this release of OpenJDK, SSL connections created by
-javax.rmi.ssl.SslRMIClientSocketFactory now enable HTTPS-based
-endpoint identification by default.  This can be disabled by setting
-the new system property
-jdk.rmi.ssl.client.enableEndpointIdentification to false.
-
-security-libs/java.security:
-
-JDK-8368032: Enhance Certificate Checking
-=========================================
-OpenJDK supports the authorityInfoAccess extension in X.509
-certificates when the `com.sun.security.enableAIAcaIssuers` system
-property is set to `true`.  With this release of OpenJDK, a security
-and system property `com.sun.security.allowedAIALocations` is
-introduced which acts as a filter on the URIs specified in the
-extension.  By default, the property is empty, which will cause all
-URIs to be denied when the extension is enabled.  A value of `any` may
-be used to allow all URIs or a whitespace-separated list of filters
-may be used for more fine-grained control.  The syntax of the filters
-is specified in the `java.security` file.  A non-empty value for the
-system property takes precedence over the security property.
-
-security-libs/javax.net.ssl:
-
-JDK-8245545: Disable TLS_RSA cipher suites
-==========================================
-The TLS_RSA cipher suites do not preserve forward secrecy and are
-rarely used in practice. With this release, they are disabled by
-adding "TLS_RSA_*" to the `jdk.tls.disabledAlgorithms` security
-property in the `java.security` configuration file. Attempts to use
-these suites with this release will result in a
-`SSLHandshakeException` being thrown. Note that RSA cipher suites
-which use DES, 3DES, RC4 or NULL were already disabled prior to this
-change.
-
-Users can, *at their own risk*, remove this restriction by modifying
-the `java.security` configuration file (or override it by using the
-`java.security.properties` system property) so "TLS_RSA_*" is no
-longer listed in the `jdk.tls.disabledAlgorithms` security property.
-
-This change results in the following cipher suites being disabled:
-
-* TLS_RSA_WITH_AES_256_GCM_SHA384
-* TLS_RSA_WITH_AES_256_CBC_SHA256
-* TLS_RSA_WITH_AES_256_CBC_SHA
-* TLS_RSA_WITH_AES_128_GCM_SHA256
-* TLS_RSA_WITH_AES_128_CBC_SHA256
-* TLS_RSA_WITH_AES_128_CBC_SHA
-
-JDK-8340321: Disable SHA-1 in TLS/DTLS 1.2 handshake signatures
-===============================================================
-
-RFC 9155 deprecates the use of SHA-1 in TLS 1.2 and DTLS 1.2. The
-algorithm has been regarded as insecure since 2005 and the first
-public attack was published on the 23rd of February, 2017.  With this
-release of OpenJDK, SHA-1 is disabled in TLS 1.2 and DTLS 1.2
-handshake signature by adding "rsa_pkcs1_sha1 usage
-HandshakeSignature, ecdsa_sha1 usage HandshakeSignature, dsa_sha1
-usage HandshakeSignature" to the `jdk.tls.disabledAlgorithms` security
-property in the `java.security` configuration file. Attempts to use
-these suites with this release will result in a
-`SSLHandshakeException` being thrown.
-
-Users can, *at their own risk*, remove this restriction by modifying
-the `java.security` configuration file (or override it by using the
-`java.security.properties` system property) so the handshake
-signatures are no longer listed in the `jdk.tls.disabledAlgorithms`
-security property.
-
-This change results in the following signature schemes being disabled
-for handshaking:
-
-* dsa_sha1
-* ecdsa_sha1
-* rsa_pkcs1_sha1
-
 New in release OpenJDK 21.0.9 (2025-10-21):
 ===========================================
 Live versions of these release notes can be found at:

SPECS/java-21-openjdk.spec

@@ -1 +0,0 @@
-../SOURCES/java-21-openjdk-portable.specfile

fips-21u-9203d50836c.patch

@@ -136,10 +136,10 @@ index 51d4f724c33..feb0bcf3e75 100644
    BASIC_JDKLIB_LIBS=""
    BASIC_JDKLIB_LIBS_TARGET=""
 diff --git a/make/autoconf/spec.gmk.in b/make/autoconf/spec.gmk.in
-index 7f085676ca9..2476b9ae964 100644
+index f6def153c82..4d7abc33427 100644
 --- a/make/autoconf/spec.gmk.in
 +++ b/make/autoconf/spec.gmk.in
-@@ -822,6 +822,11 @@ PANDOC_MARKDOWN_FLAG:=@PANDOC_MARKDOWN_FLAG@
+@@ -873,6 +873,11 @@ INSTALL_SYSCONFDIR=@sysconfdir@
  # Libraries
  #
  
@@ -1979,7 +1979,7 @@ index 539ef1e8ee8..435f57e3ff2 100644
                  "sun.security.rsa.PSSParameters", null);
      }
 diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security
-index 6b0fd201b9b..2af4e3a3e21 100644
+index f8b01a4ea1e..b325bf7e9fc 100644
 --- a/src/java.base/share/conf/security/java.security
 +++ b/src/java.base/share/conf/security/java.security
 @@ -85,6 +85,17 @@ security.provider.tbd=Apple
@@ -2064,7 +2064,7 @@ index 6b0fd201b9b..2af4e3a3e21 100644
  # the javax.net.ssl package.
 diff --git a/src/java.base/share/conf/security/nss.fips.cfg.in b/src/java.base/share/conf/security/nss.fips.cfg.in
 new file mode 100644
-index 00000000000..6de716e6b42
+index 00000000000..55bbba98b7a
 --- /dev/null
 +++ b/src/java.base/share/conf/security/nss.fips.cfg.in
 @@ -0,0 +1,8 @@
@@ -2074,7 +2074,7 @@ index 00000000000..6de716e6b42
 +nssDbMode = readWrite
 +nssModule = fips
 +
-+attributes(*,CKO_SECRET_KEY,*)={ CKA_SIGN=true CKA_ENCRYPT=true }
++attributes(*,CKO_SECRET_KEY,CKK_GENERIC_SECRET)={ CKA_SIGN=true }
 +
 diff --git a/src/java.base/share/lib/security/default.policy b/src/java.base/share/lib/security/default.policy
 index 86d45147709..22fd8675503 100644
@@ -2959,7 +2959,7 @@ index 00000000000..f8d505ca815
 +}
 \ No newline at end of file
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
-index f8dd5a71c2c..6423805d164 100644
+index 01fc06ae283..e3ca000d309 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
 @@ -37,6 +37,8 @@ import javax.crypto.*;
@@ -3005,7 +3005,7 @@ index f8dd5a71c2c..6423805d164 100644
                  return null;
              } else {
                  return "RAW";
-@@ -1664,4 +1671,3 @@ final class SessionKeyRef extends PhantomReference<P11Key> {
+@@ -1638,4 +1645,3 @@ final class SessionKeyRef extends PhantomReference<P11Key> {
          this.clear();
      }
  }

gating.yaml

@@ -0,0 +1,7 @@
+# recipients: java-qa
+--- !Policy
+product_versions:
+  - rhel-9
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

java-21-openjdk-portable.specfile

@@ -15,10 +15,6 @@
 #
 # Only produce a release build on x86_64:
 # $ fedpkg mockbuild --without slowdebug --without fastdebug
-%ifarch riscv64
-%define  debug_package %{nil}
-%endif
-
 # Enable fastdebug builds by default on relevant arches.
 %bcond_without fastdebug
 # Enable slowdebug builds by default on relevant arches.
@@ -333,7 +329,7 @@
 # New Version-String scheme-style defines
 %global featurever 21
 %global interimver 0
-%global updatever 10
+%global updatever 9
 %global patchver 0
 # buildjdkver is usually same as %%{featurever},
 # but in time of bootstrap of next jdk, it is featurever-1,
@@ -383,7 +379,7 @@
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      6.0.0pre00-c848b93a8598
 # Define current Git revision for the FIPS support patches
-%global fipsver a0fd6e8ed6e
+%global fipsver 9203d50836c
 # Define JDK versions
 %global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
 %global javaver         %{featurever}
@@ -397,7 +393,7 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{vcstag}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        7
+%global buildver        10
 %global rpmrelease      1
 #%%global tagsuffix     %%{nil}
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
@@ -420,8 +416,8 @@
 %global is_ga           1
 %if %{is_ga}
 %global build_type GA
-%global ea_designator beta
-%global ea_designator_zip -%{ea_designator}
+%global ea_designator ""
+%global ea_designator_zip %{nil}
 %global extraver %{nil}
 %global eaprefix %{nil}
 %else
@@ -465,12 +461,6 @@
 %define miscportablename() %(echo %{uniquesuffix ""} | sed "s;el%{rhel}\\(_[0-9]\\)*;portable.misc;g")
 %define miscportablearchive()  %{miscportablename}.tar.xz
 
-# RPM 4.19 no longer accept our double percentaged %%{nil} passed to %%{1}
-# so we have to pass in "" but evaluate it, otherwise files record will include it
-%define jreportablearchiveForFiles()  %(echo %{jreportablearchive -- ""})
-%define jdkportablearchiveForFiles()  %(echo %{jdkportablearchive -- ""})
-%define staticlibsportablearchiveForFiles()  %(echo %{staticlibsportablearchive -- ""})
-
 #################################################################
 # fix for https://bugzilla.redhat.com/show_bug.cgi?id=1111349
 #         https://bugzilla.redhat.com/show_bug.cgi?id=1590796#c14
@@ -595,7 +585,7 @@ License:  ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv
 URL:      http://openjdk.java.net/
 
 # The source tarball, generated using generate_source_tarball.sh
-Source0: https://openjdk-sources.osci.io/openjdk%{featurever}/open%{vcstag}.tar.xz
+Source0: https://openjdk-sources.osci.io/openjdk%{featurever}/open%{vcstag}%{ea_designator_zip}.tar.xz
 
 # Use 'icedtea_sync.sh' to update the following
 # They are based on code contained in the IcedTea project (6.x).
@@ -671,7 +661,6 @@ Source18: TestTranslations.java
 # test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
 # RH1940064: Enable XML Signature provider in FIPS mode
 # RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized [now part of JDK-8301553 upstream]
-# OPENJDK-4013: Update nss.fips.cfg to grant CKA_SIGN and CKA_ENCRYPT to any CKO_SECRET_KEY
 Patch1001: fips-%{featurever}u-%{fipsver}.patch
 
 #############################################
@@ -781,7 +770,7 @@ Provides: bundled(lcms2) = 2.17.0
 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h
 Provides: bundled(libjpeg) = 6b
 # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h
-Provides: bundled(libpng) = 1.6.51
+Provides: bundled(libpng) = 1.6.47
 # Version in src/java.base/share/native/libzip/zlib/zlib.h
 Provides: bundled(zlib) = 1.3.1
 # We link statically against libstdc++ to increase portability
@@ -1021,7 +1010,7 @@ if [ "x${UPSTREAM_EA_DESIGNATOR}" != "x%{ea_designator}" ] ; then
     echo "WARNING: Designator mismatch";
     echo "Spec file is configured for a %{build_type} build with designator '%{ea_designator}'"
     echo "Upstream version-pre setting is '${UPSTREAM_EA_DESIGNATOR}'";
-    # exit 17
+    exit 17
 fi
 
 # Extract systemtap tapsets
@@ -1081,7 +1070,7 @@ export NUM_PROC=${NUM_PROC:-1}
 %endif
 export XZ_OPT="-T0"
 
-%ifarch s390x sparc64 alpha %{power64} %{aarch64} riscv64
+%ifarch s390x sparc64 alpha %{power64} %{aarch64}
 export ARCH_DATA_MODEL=64
 %endif
 %ifarch alpha
@@ -1712,11 +1701,6 @@ $JAVA_HOME/bin/java -XX:+UnlockExperimentalVMOptions -XX:+UseShenandoahGC -versi
   $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR
 %endif
 
-  # Check blocked.certs is valid (OPENJDK-4362)
-  jtreg_test=$(pwd)/%{top_level_dir_name}/test/jdk/sun/security/lib/CheckBlockedCerts.java
-  jtreg_dir=$(dirname ${jtreg_test})
-  $JAVA_HOME/bin/java --add-exports java.base/sun.security.util=ALL-UNNAMED -Dtest.src=${jtreg_dir} ${jtreg_test}
-
   # Check src.zip has all sources. See RHBZ#1130490
   unzip -l $JAVA_HOME/lib/src.zip | grep 'sun.misc.Unsafe'
 
@@ -1888,7 +1872,7 @@ done
 
 %files
 # main package builds always
-%{_jvmdir}/%{jreportablearchiveForFiles}
+%{_jvmdir}/%{jreportablearchive -- %%{nil}}
 %{_jvmdir}/%{jreportablearchive -- %%{nil}}.sha256sum
 %else
 %files
@@ -1905,7 +1889,7 @@ done
 
 %if %{include_staticlibs}
 %files static-libs
-%{_jvmdir}/%{staticlibsportablearchiveForFiles}
+%{_jvmdir}/%{staticlibsportablearchive -- %%{nil}}
 %{_jvmdir}/%{staticlibsportablearchive -- %%{nil}}.sha256sum
 %endif
 
@@ -1960,24 +1944,6 @@ done
 %endif
 
 %changelog
-* Fri Jan 23 2026 alukoshko <alukoshko@almalinux.org> - 1:21.0.10.0.7-1
-- Portable build for riscv64
-
-* Sun Jan 18 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.10.0.7-1
-- Update to jdk-21.0.10+7 (GA)
-- Update release notes to 21.0.10+7
-- Bump libpng version to 1.6.51 following JDK-8372534
-- Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT
-- Add test to ensure blocked.certs is valid (OPENJDK-4362)
-- Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh
-- Resolves: OPENJDK-4273
-- Resolves: OPENJDK-4281
-- Resolves: OPENJDK-4357
-- Resolves: OPENJDK-4397
-- Resolves: OPENJDK-4380
-- Resolves: OPENJDK-4388
-- ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **
-
 * Fri Oct 17 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.9.0.10-1
 - Update to jdk-21.0.9+10 (GA)
 - Update release notes to 21.0.9+10

rpminspect.yaml

@@ -0,0 +1,3 @@
+---
+inspections:
+    javabytecode: off

scripts/builds/build_centos.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds the RPM on CentOS 9 or 10
+
+centpkg -v build
+
+# Local Variables:
+# compile-command: "shellcheck build_centos.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/build_centos_portable_build.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds the portable on CentOS
+
+centpkg -v build --target java-openjdk-portable-build --rhel-target none
+
+# Local Variables:
+# compile-command: "shellcheck build_centos_portable_build.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/build_rhel_10.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds the RPM on RHEL 10
+
+NVR=${1}
+USER=${2}
+
+if test "${NVR}" = ""; then
+    echo "${0} <NVR> <USER>";
+    exit 1;
+fi
+
+if test "${USER}" = ""; then
+    echo "${0} <NVR> <USER>";
+    exit 2;
+fi
+
+METADATA="{\"osci\": {\"upstream_nvr\": \"${NVR}\", \"upstream_owner_name\": \"${USER}\"}, \"rhel-target\": \"latest\"}"
+rhpkg -v build --target=java-openjdk-rhel-10-build --custom-user-metadata "${METADATA}"
+
+# Local Variables:
+# compile-command: "shellcheck build_rhel_10.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/build_rhel_7_portable_build.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds the portable on RHEL 7
+
+rhpkg -v build --target=java-openjdk-rhel-7-build --skip-nvr-check
+
+# Local Variables:
+# compile-command: "shellcheck build_rhel_7_portable_build.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/build_rhel_8.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds the RPM on RHEL 8
+
+NVR=${1}
+USER=${2}
+
+if test "${NVR}" = ""; then
+    echo "${0} <NVR> <USER>";
+    exit 1;
+fi
+
+if test "${USER}" = ""; then
+    echo "${0} <NVR> <USER>";
+    exit 2;
+fi
+
+METADATA="{\"osci\": {\"upstream_nvr\": \"${NVR}\", \"upstream_owner_name\": \"${USER}\"}, \"rhel-target\": \"latest\"}"
+rhpkg -v build --target=java-openjdk-rhel-8-build --custom-user-metadata "${METADATA}"
+
+# Local Variables:
+# compile-command: "shellcheck build_rhel_8.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/build_rhel_9.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds the RPM on RHEL 9
+
+NVR=${1}
+USER=${2}
+
+if test "${NVR}" = ""; then
+    echo "${0} <NVR> <USER>";
+    exit 1;
+fi
+
+if test "${USER}" = ""; then
+    echo "${0} <NVR> <USER>";
+    exit 2;
+fi
+
+METADATA="{\"osci\": {\"upstream_nvr\": \"${NVR}\", \"upstream_owner_name\": \"${USER}\"}, \"rhel-target\": \"latest\"}"
+rhpkg -v build --target=java-openjdk-rhel-9-build --custom-user-metadata "${METADATA}"
+
+# Local Variables:
+# compile-command: "shellcheck build_rhel_9.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/build_rhel_portable_build.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds the portable on RHEL 8
+
+rhpkg -v build --target=java-openjdk-rhel-8-build --skip-nvr-check
+
+# Local Variables:
+# compile-command: "shellcheck build_rhel_portable_build.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/build_vanilla.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds a scratch build of vanilla OpenJDK with no local patches
+
+SEPARATE_ARCHES=${1}
+CMD="--target java-openjdk-rhel-8-build --skip-nvr-check --nowait";
+SUPPORTED_ARCHES="aarch64 ppc64le s390x x86_64";
+
+if [ "x${SEPARATE_ARCHES}" = "x" ] ; then
+    SEPARATE_ARCHES=0;
+fi
+
+if [ ${SEPARATE_ARCHES} -eq 1 ] ; then
+	for arch in ${SUPPORTED_ARCHES}; do \
+	    rhpkg -v build --arches ${arch} --scratch ${CMD} ; \
+	done && brew watch-task --mine
+else
+    rhpkg -v build ${CMD} && brew watch-task --mine
+fi
+
+# Local Variables:
+# compile-command: "shellcheck build_vanilla.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/tag_rhel_10.sh

@@ -0,0 +1,42 @@
+#!/bin/sh
+
+# Copyright (C) 2025 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Tag RHEL 10 RPMs into all supported streams
+
+SUPPORTED_VERS="10.0-z 10.1-z 10.2"
+BUILD=${1}
+
+if test "${BUILD}" = ""; then
+    echo "${0} <BUILD>";
+    exit 1;
+fi
+
+for ver in ${SUPPORTED_VERS}; do
+    tag="rhel-${ver}-gate";
+    echo "Tagging ${BUILD} into ${tag}";
+    brew tag-build --nowait ${tag} ${BUILD};
+done
+brew watch-task --mine
+
+# Local Variables:
+# compile-command: "shellcheck tag_rhel_10.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/tag_rhel_10_nocompose.sh

@@ -0,0 +1,42 @@
+#!/bin/sh
+
+# Copyright (C) 2025 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Tag embargoed RHEL 10 RPMs into supported z-streams
+
+SUPPORTED_VERS="10.0-z"
+BUILD=${1}
+
+if test "${BUILD}" = ""; then
+    echo "${0} <BUILD>";
+    exit 1;
+fi
+
+for ver in ${SUPPORTED_VERS}; do
+    tag="rhel-${ver}-nocompose-candidate";
+    echo "Tagging ${BUILD} into ${tag}";
+    brew tag-build --nowait ${tag} ${BUILD};
+done
+brew watch-task --mine
+
+# Local Variables:
+# compile-command: "shellcheck tag_rhel_10_nocompose.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/tag_rhel_8.sh

@@ -0,0 +1,42 @@
+#!/bin/sh
+
+# Copyright (C) 2025 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Tag RHEL 8 RPMs into all supported streams
+
+SUPPORTED_VERS="8.10.0-z"
+BUILD=${1}
+
+if test "${BUILD}" = ""; then
+    echo "${0} <BUILD>";
+    exit 1;
+fi
+
+for ver in ${SUPPORTED_VERS}; do
+    tag="rhel-${ver}-gate";
+    echo "Tagging ${BUILD} into ${tag}";
+    brew tag-build --nowait ${tag} ${BUILD};
+done
+brew watch-task --mine
+
+# Local Variables:
+# compile-command: "shellcheck tag_rhel_8.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/tag_rhel_8_nocompose.sh

@@ -0,0 +1,42 @@
+#!/bin/sh
+
+# Copyright (C) 2025 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Tag embargoed RHEL 8 RPMs into supported z-streams
+
+SUPPORTED_VERS="8.10.0-z"
+BUILD=${1}
+
+if test "${BUILD}" = ""; then
+    echo "${0} <BUILD>";
+    exit 1;
+fi
+
+for ver in ${SUPPORTED_VERS}; do
+    tag="rhel-${ver}-nocompose-candidate";
+    echo "Tagging ${BUILD} into ${tag}";
+    brew tag-build --nowait ${tag} ${BUILD};
+done
+brew watch-task --mine
+
+# Local Variables:
+# compile-command: "shellcheck tag_rhel_8_nocompose.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/tag_rhel_9.sh

@@ -0,0 +1,42 @@
+#!/bin/sh
+
+# Copyright (C) 2025 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Tag RHEL 9 RPMs into all supported streams
+
+SUPPORTED_VERS="9.4.0-z 9.6.0-z 9.7.0-z 9.8.0"
+BUILD=${1}
+
+if test "${BUILD}" = ""; then
+    echo "${0} <BUILD>";
+    exit 1;
+fi
+
+for ver in ${SUPPORTED_VERS}; do
+    tag="rhel-${ver}-gate";
+    echo "Tagging ${BUILD} into ${tag}";
+    brew tag-build --nowait ${tag} ${BUILD};
+done
+brew watch-task --mine
+
+# Local Variables:
+# compile-command: "shellcheck tag_rhel_9.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/tag_rhel_9_nocompose.sh

@@ -0,0 +1,42 @@
+#!/bin/sh
+
+# Copyright (C) 2025 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Tag embargoed RHEL 9 RPMs into supported z-streams
+
+SUPPORTED_VERS="9.4.0-z 9.6.0-z"
+BUILD=${1}
+
+if test "${BUILD}" = ""; then
+    echo "${0} <BUILD>";
+    exit 1;
+fi
+
+for ver in ${SUPPORTED_VERS}; do
+    tag="rhel-${ver}-nocompose-candidate";
+    echo "Tagging ${BUILD} into ${tag}";
+    brew tag-build --nowait ${tag} ${BUILD};
+done
+brew watch-task --mine
+
+# Local Variables:
+# compile-command: "shellcheck tag_rhel_9_nocompose.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/discover_trees.sh

@@ -0,0 +1,61 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by Andrew John Hughes <gnu.andrew@redhat.com>.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+TREE=${1}
+
+if test "${TREE}" = ""; then
+    TREE=${PWD}
+fi
+
+if [ -e "${TREE}"/nashorn/.hg ] || [ -e "${TREE}"/nashorn/merge.changeset ] ; then
+    NASHORN="nashorn" ;
+fi
+
+if [ -e "${TREE}"/corba/.hg ] || [ -e "${TREE}"/corba/merge.changeset ] ; then
+    CORBA="corba";
+fi
+
+if [ -e "${TREE}"/jaxp/.hg ] || [ -e "${TREE}"/jaxp/merge.changeset ] ; then
+    JAXP="jaxp";
+fi
+
+if [ -e "${TREE}"/jaxws/.hg ] || [ -e "${TREE}"/jaxws/merge.changeset ] ; then
+    JAXWS="jaxws";
+fi
+
+if [ -e "${TREE}"/langtools/.hg ] || [ -e "${TREE}"/langtools/merge.changeset ] ; then
+    LANGTOOLS="langtools";
+fi
+
+if [ -e "${TREE}"/jdk/.hg ] || [ -e "${TREE}"/jdk/merge.changeset ] ; then
+    JDK="jdk";
+fi
+
+if [ -e "${TREE}"/hotspot/.hg ] || [ -e "${TREE}"/hotspot/merge.changeset ] ; then
+    HOTSPOT="hotspot";
+fi
+
+SUBTREES="${CORBA} ${JAXP} ${JAXWS} ${LANGTOOLS} ${NASHORN} ${JDK} ${HOTSPOT}";
+echo "${SUBTREES}"
+
+# Local Variables:
+# compile-command: "shellcheck discover_trees.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/generate_source_tarball.sh

@@ -0,0 +1,294 @@
+#!/bin/bash
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#     Thomas Fitzsimmons <fitzsim@redhat.com>
+#     Jiri Vanek <jvanek@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Generates the source tarball for OpenJDK projects.
+#
+# There are multiple ways to specify the source code location and version:
+#
+# 1. Specify the version (VERSION), the location of the Git repository
+#    (REPO_ROOT) and the root of the output tarball name (FILE_NAME_ROOT)
+# 2. Specify the version (VERSION) along with an upstream project name
+#    (PROJECT_NAME) and repository name (REPO_NAME) that can be used
+#    to construct the URL of the upstream OpenJDK repository.
+# 3. Specify OPENJDK_LATEST=1 and allow the script to obtain the JDK
+#    feature version from the spec file, which is then used to
+#    obtain the latest build promotion from the upstream repository.
+#
+# An appropriate bootstrap JDK is also required for when ./configure
+# is run within the checked out repository to generate the .src-rev.
+# file. This can be specified by setting BOOT_JDK.
+#
+# Example 1:
+# This will check out the specified version from the specified
+# repository and construct a tarball called openjdk-17.0.3+5.tar.xz:
+#
+# $ VERSION=jdk-17.0.3+5 FILE_NAME_ROOT=open${VERSION} \
+#   REPO_ROOT=$HOME/projects/openjdk/upstream/17u \
+#   BOOT_JDK=/usr/lib/jvm/java-17-openjdk ./generate_source_tarball.sh
+#
+# Example 2:
+# This will check out the same version as example 1, but from the
+# upstream repository:
+#
+# $ VERSION=jdk-17.0.3+5 PROJECT_NAME=openjdk REPO_NAME=jdk17u \
+#   BOOT_JDK=/usr/lib/jvm/java-17-openjdk ./generate_source_tarball.sh
+#
+# Example 3:
+# This will read the OpenJDK feature version from the spec file, then create a
+# tarball from the most recent tag for that version in the upstream Git
+# repository.
+#
+# $ OPENJDK_LATEST=1 \
+#   BOOT_JDK=/usr/lib/jvm/java-17-openjdk ./generate_source_tarball.sh
+#
+
+set -e
+
+OPENJDK_URL_DEFAULT=https://github.com
+COMPRESSION_DEFAULT=xz
+
+if [ "$1" = "help" ] ; then
+    echo "Behaviour may be specified by setting the following variables:"
+    echo
+    echo "VERSION        - the version of the specified OpenJDK project"
+    echo "                 (required unless OPENJDK_LATEST is set)"
+    echo "PROJECT_NAME   - the name of the OpenJDK project being archived"
+    echo "                 (needed to compute REPO_ROOT and/or"
+    echo "                  FILE_NAME_ROOT automatically;"
+    echo "                  optional if they are set explicitly)"
+    echo "REPO_NAME      - the name of the OpenJDK repository"
+    echo "                 (needed to compute REPO_ROOT automatically;"
+    echo "                  optional if REPO_ROOT is set explicitly)"
+    echo "OPENJDK_URL    - the URL to retrieve code from"
+    echo "                 (defaults to ${OPENJDK_URL_DEFAULT})"
+    echo "COMPRESSION    - the compression type to use"
+    echo "                 (defaults to ${COMPRESSION_DEFAULT})"
+    echo "FILE_NAME_ROOT - name of the archive, minus extensions"
+    echo "                 (defaults to PROJECT_NAME-VERSION)"
+    echo "REPO_ROOT      - the location of the Git repository to archive"
+    echo "                 (defaults to OPENJDK_URL/PROJECT_NAME/REPO_NAME.git)"
+    echo "TO_COMPRESS    - what part of clone to pack"
+    echo "                 (defaults to ${VERSION})"
+    echo "BOOT_JDK       - the bootstrap JDK to satisfy the configure run"
+    echo "                 (defaults to packaged JDK version)"
+    echo "WITH_TEMP      - run in a temporary directory"
+    echo "                 (defaults to disabled)"
+    echo "OPENJDK_LATEST - deduce VERSION from most recent upstream tag"
+    echo "                 (implies WITH_TEMP, computes everything else"
+    echo "                  automatically; Note: accesses network to read"
+    echo "                  tag list from remote Git repository)"
+    exit 1;
+fi
+
+if [ "$OPENJDK_LATEST" != "" ] ; then
+    FEATURE_VERSION=$(echo '%featurever' \
+                          | rpmspec --shell ./*.spec 2>/dev/null \
+                          | grep --after-context 1 featurever \
+                          | tail --lines 1)
+    PROJECT_NAME=openjdk
+    REPO_NAME=jdk"${FEATURE_VERSION}"u
+    # Skip -ga tags since those are the same as the most recent non-ga tag, and
+    # the non-ga tag is the one that is used to generated the official source
+    # tarball.  For example:
+    # ca760c86642aa2e0d9b571aaabac054c0239fbdc  refs/tags/jdk-17.0.10-ga^{}
+    # 25a2e6c20c9a96853714284cabc6b456eb095070  refs/tags/jdk-17.0.10-ga
+    # ca760c86642aa2e0d9b571aaabac054c0239fbdc  refs/tags/jdk-17.0.10+7^{}
+    # e49c5749b10f3e90274b72e9279f794fdd191d27  refs/tags/jdk-17.0.10+7
+    VERSION=$(git ls-remote --tags --refs --sort=-version:refname \
+                  "${OPENJDK_URL_DEFAULT}/${PROJECT_NAME}/${REPO_NAME}.git" \
+                  "jdk-${FEATURE_VERSION}*" \
+                  | grep --invert-match '\-ga$' \
+                  | head --lines 1 | cut --characters 52-)
+    FILE_NAME_ROOT=open${VERSION}
+    WITH_TEMP=1
+fi
+
+if [ "$WITH_TEMP" != "" ] ; then
+    pushd "$(mktemp --directory --tmpdir temp-generated-source-tarball-XXX)"
+fi
+
+if [ "$VERSION" = "" ] ; then
+    echo "No VERSION specified"
+    exit 2
+fi
+echo "Version: ${VERSION}"
+
+NUM_VER=${VERSION##jdk-}
+RELEASE_VER=${NUM_VER%%+*}
+BUILD_VER=${NUM_VER##*+}
+MAJOR_VER=${RELEASE_VER%%.*}
+echo "Major version is ${MAJOR_VER}, release ${RELEASE_VER}, build ${BUILD_VER}"
+
+if [ "$BOOT_JDK" = "" ] ; then
+    echo "No boot JDK specified".
+    BOOT_JDK=/usr/lib/jvm/java-${MAJOR_VER}-openjdk;
+    echo -n "Checking for ${BOOT_JDK}...";
+    if [ -d "${BOOT_JDK}" ] && [ -x "${BOOT_JDK}"/bin/java ] ; then
+        echo "Boot JDK found at ${BOOT_JDK}";
+    else
+        echo "Not found";
+        PREV_VER=$((MAJOR_VER - 1));
+        BOOT_JDK=/usr/lib/jvm/java-${PREV_VER}-openjdk;
+        echo -n "Checking for ${BOOT_JDK}...";
+        if [ -d ${BOOT_JDK} ] && [ -x ${BOOT_JDK}/bin/java ] ; then
+            echo "Boot JDK found at ${BOOT_JDK}";
+        else
+            echo "Not found";
+            exit 4;
+        fi
+    fi
+else
+    echo "Boot JDK: ${BOOT_JDK}";
+fi
+
+if [ "$OPENJDK_URL" = "" ] ; then
+    OPENJDK_URL=${OPENJDK_URL_DEFAULT}
+    echo "No OpenJDK URL specified; defaulting to ${OPENJDK_URL}"
+else
+    echo "OpenJDK URL: ${OPENJDK_URL}"
+fi
+
+if [ "$COMPRESSION" = "" ] ; then
+    # rhel 5 needs tar.gz
+    COMPRESSION=${COMPRESSION_DEFAULT}
+fi
+echo "Creating a tar.${COMPRESSION} archive"
+
+if [ "$FILE_NAME_ROOT" = "" ] ; then
+    if [ "$PROJECT_NAME" = "" ] ; then
+        echo "No PROJECT_NAME specified, needed by FILE_NAME_ROOT"
+        exit 1
+    fi
+    FILE_NAME_ROOT=${PROJECT_NAME}-${VERSION}
+    echo "No file name root specified; default to ${FILE_NAME_ROOT}"
+fi
+if [ "$REPO_ROOT" = "" ] ; then
+    if [ "$PROJECT_NAME" = "" ] ; then
+        echo "No PROJECT_NAME specified, needed by REPO_ROOT"
+        exit 1
+    fi
+    if [ "$REPO_NAME" = "" ] ; then
+        echo "No REPO_NAME specified, needed by REPO_ROOT"
+        exit 3
+    fi
+    REPO_ROOT="${OPENJDK_URL}/${PROJECT_NAME}/${REPO_NAME}.git"
+    echo "No repository root specified; default to ${REPO_ROOT}"
+fi;
+
+if [ "$TO_COMPRESS" = "" ] ; then
+    TO_COMPRESS="${VERSION}"
+    echo "No targets to be compressed specified ; default to ${TO_COMPRESS}"
+fi;
+
+echo -e "Settings:"
+echo -e "\tVERSION: ${VERSION}"
+echo -e "\tPROJECT_NAME: ${PROJECT_NAME}"
+echo -e "\tREPO_NAME: ${REPO_NAME}"
+echo -e "\tOPENJDK_URL: ${OPENJDK_URL}"
+echo -e "\tCOMPRESSION: ${COMPRESSION}"
+echo -e "\tFILE_NAME_ROOT: ${FILE_NAME_ROOT}"
+echo -e "\tREPO_ROOT: ${REPO_ROOT}"
+echo -e "\tTO_COMPRESS: ${TO_COMPRESS}"
+echo -e "\tBOOT_JDK: ${BOOT_JDK}"
+echo -e "\tWITH_TEMP: ${WITH_TEMP}"
+echo -e "\tOPENJDK_LATEST: ${OPENJDK_LATEST}"
+
+if [ -d "${FILE_NAME_ROOT}" ] ; then
+    echo "Reusing existing ${FILE_NAME_ROOT}"
+    STAT_TIME="$(stat --format=%Y "${FILE_NAME_ROOT}")"
+    TAR_TIME="$(date --date=@"${STAT_TIME}" --iso-8601=seconds)"
+else
+    mkdir "${FILE_NAME_ROOT}"
+    pushd "${FILE_NAME_ROOT}"
+        echo "Cloning ${VERSION} root repository from ${REPO_ROOT}"
+        if realpath -q "${REPO_ROOT}"; then
+            echo "Local path detected; not adding depth argument";
+            DEPTH="--";
+        else
+            DEPTH="--depth=1";
+            echo "Remote repository detected; adding ${DEPTH}";
+        fi
+        git clone -b "${VERSION}" "${DEPTH}" "${REPO_ROOT}" "${VERSION}"
+        pushd "${VERSION}"
+            TAR_TIME="$(git log --max-count 1 --format=%cI)"
+        popd
+    popd
+fi
+pushd "${FILE_NAME_ROOT}"
+    # Generate .src-rev so build has knowledge of the revision the tarball was
+    # created from
+    mkdir build
+    pushd build
+        sh "${PWD}"/../"${VERSION}"/configure --with-boot-jdk="${BOOT_JDK}"
+        make store-source-revision
+    popd
+    rm -rf build
+
+    # Remove commit checks
+    echo "Removing $(find "${VERSION}" -name '.jcheck' -print)"
+    find "${VERSION}" -name '.jcheck' -print0 | xargs -0 rm -r
+
+    # Remove history and GHA
+    echo "find ${VERSION} -name '.hgtags'"
+    find "${VERSION}" -name '.hgtags' -exec rm -v '{}' '+'
+    echo "find ${VERSION} -name '.hgignore'"
+    find "${VERSION}" -name '.hgignore' -exec rm -v '{}' '+'
+    echo "find ${VERSION} -name '.gitattributes'"
+    find "${VERSION}" -name '.gitattributes' -exec rm -v '{}' '+'
+    echo "find ${VERSION} -name '.gitignore'"
+    find "${VERSION}" -name '.gitignore' -exec rm -v '{}' '+'
+    # Work around some Git objects not having write permissions.
+    echo "chmod --recursive u+w ${VERSION}/.git"
+    chmod --recursive u+w "${VERSION}"/.git
+    echo "find ${VERSION} -name '.git'"
+    find "${VERSION}" -name '.git' -exec rm -rv '{}' '+'
+    echo "find ${VERSION} -name '.github'"
+    find "${VERSION}" -name '.github' -exec rm -rv '{}' '+'
+
+    echo "Compressing remaining forest"
+    if [ "$COMPRESSION" = "xz" ] ; then
+        SWITCH=cJf
+    else
+        SWITCH=czf
+    fi
+    EA_PART="$(awk -F= \
+               '/^DEFAULT_PROMOTED_VERSION_PRE/ { if ($2) print "-"$2 }' \
+               "${VERSION}"/make/conf/version-numbers.conf)"
+    TARBALL_NAME=${FILE_NAME_ROOT}${EA_PART}.tar.${COMPRESSION}
+    XZ_OPT=${XZ_OPT-"-T0"} \
+          tar --mtime="${TAR_TIME}" --owner=root --group=root --sort=name \
+          --exclude-vcs -$SWITCH "${TARBALL_NAME}" "${TO_COMPRESS}"
+    mv "${TARBALL_NAME}" ..
+popd
+if [ "$WITH_TEMP" != "" ] ; then
+    echo "Tarball is: $(realpath .)/${TARBALL_NAME}"
+    popd
+else
+    echo -n "Done. You may want to remove the uncompressed version"
+    echo " - $FILE_NAME_ROOT"
+fi
+
+# Local Variables:
+# compile-command: "shellcheck generate_source_tarball.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/get_bundle_versions.sh

@@ -0,0 +1,172 @@
+#!/usr/bin/env sh
+
+# Copyright (C) 2025 Red Hat, Inc.
+# Original written by Antonio Vieiro <avieirov@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+if [ $# -ne 1 ]; then
+    echo "Usage: $0 openjdk-root-directory"
+    exit 1
+fi
+
+JDKROOT=$1
+
+if [ ! -d "${JDKROOT}" ] ; then
+    echo "${JDKROOT} is not a directory.";
+    exit 2
+fi
+
+# Work out the OpenJDK version
+# OpenJDK >= 10 has its version in the build machinery
+# OpenJDK >= 17 stores it in a new location (JDK-8258246)
+VERSION_FILE="${JDKROOT}"/make/conf/version-numbers.conf
+printf "Checking for %s..." "${VERSION_FILE}";
+if [ ! -f "${VERSION_FILE}" ] ; then
+    VERSION_FILE="${JDKROOT}"/make/autoconf/version-numbers
+    echo "Not found; using old version file ${VERSION_FILE}";
+else
+    echo "found.";
+fi
+if [ -e "${VERSION_FILE}" ] ; then
+    openjdk_version=$(grep '^DEFAULT_VERSION_FEATURE' "${VERSION_FILE}" | cut -d '=' -f 2)
+elif [ -e "${JDKROOT}"/jdk/src/java.base/share/classes/java/lang/Object.java ] ; then
+    openjdk_version=9;
+elif [ -e "${JDKROOT}"/common/autoconf ] ; then
+    openjdk_version=8;
+else
+    openjdk_version=7;
+fi
+echo "OpenJDK version: ${openjdk_version}";
+
+#
+# Freetype
+#
+if [ "${openjdk_version}" -gt 8 ] ; then
+    FREETYPE=src/java.desktop/share/native/libfreetype/include/freetype/freetype.h
+    ABS_FREETYPE="${JDKROOT}"/"${FREETYPE}"
+    if [ ! -f "${ABS_FREETYPE}" ]; then
+        echo "Freetype header not found!"
+        exit 2
+    fi
+    FREETYPE_VERSION=$(awk '/#define FREETYPE_MAJOR/ {MAJOR=$3} /#define FREETYPE_MINOR/ {MINOR=$3} /#define FREETYPE_PATCH/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_FREETYPE}")
+else
+    echo "No bundled FreeType on ${openjdk_version}";
+fi
+
+# giflib
+if [ "${openjdk_version}" -gt 8 ] ; then
+    GIFLIB=src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
+else
+    GIFLIB=jdk/src/share/native/sun/awt/giflib/gif_lib.h
+fi
+ABS_GIFLIB="${JDKROOT}"/"${GIFLIB}"
+if [ ! -f "${ABS_GIFLIB}" ]; then
+    echo "giflib header not found!"
+    exit 3
+fi
+GIFLIB_VERSION=$(awk '/#define GIFLIB_MAJOR/ {MAJOR=$3} /#define GIFLIB_MINOR/ {MINOR=$3} /#define GIFLIB_RELEASE/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_GIFLIB}")
+
+# harfbuzz
+if [ "${openjdk_version}" -gt 8 ] ; then
+    HARFBUZZ=src/java.desktop/share/native/libharfbuzz/hb-version.h
+    ABS_HARFBUZZ="${JDKROOT}/${HARFBUZZ}"
+    if [ ! -f "${ABS_HARFBUZZ}" ]; then
+        echo "HarfBuzz header not found!"
+        exit 4
+    fi
+    HARFBUZZ_VERSION=$(awk '/#define HB_VERSION_MAJOR/ {MAJOR=$3} /#define HB_VERSION_MINOR/ {MINOR=$3} /#define HB_VERSION_MICRO/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_HARFBUZZ}")
+else
+    echo "No HarfBuzz on ${openjdk_version}";
+fi
+
+# lcms
+if [ "${openjdk_version}" -gt 8 ] ; then
+    LCMS=src/java.desktop/share/native/liblcms/lcms2.h
+else
+    LCMS=jdk/src/share/native/sun/java2d/cmm/lcms/lcms2.h
+fi
+ABS_LCMS="${JDKROOT}"/"${LCMS}"
+if [ ! -f "${ABS_LCMS}" ]; then
+    echo "lcms header not found!"
+    exit 5
+fi
+LCMS_VERSION=$(awk '/#define LCMS_VERSION/ { MAJOR=int($3 / 1000); REST=$3 % 1000; MINOR=int(REST / 10); PATCH=REST % 10; } END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_LCMS}")
+
+# jpeg
+if [ "${openjdk_version}" -gt 8 ] ; then
+    JPEG=src/java.desktop/share/native/libjavajpeg/jpeglib.h
+else
+    JPEG=jdk/src/share/native/sun/awt/image/jpeg/jpeglib.h
+fi
+ABS_JPEG="${JDKROOT}"/"${JPEG}"
+if [ ! -f "${ABS_JPEG}" ]; then
+    echo "jpeg header not found!"
+    exit 6
+fi
+JPEG_VERSION=$(awk '/#define JPEG_LIB_VERSION/ { VERSION=$3; MAJOR=int(VERSION / 10); MINOR=VERSION%10; } END {printf "%s%c", MAJOR, (MINOR+96)}' "${ABS_JPEG}")
+
+# png
+if [ "${openjdk_version}" -gt 8 ] ; then
+    PNG=src/java.desktop/share/native/libsplashscreen/libpng/png.h
+else
+    PNG=jdk/src/share/native/sun/awt/libpng/png.h
+fi
+ABS_PNG="${JDKROOT}"/"${PNG}"
+if [ ! -f "${ABS_PNG}" ]; then
+    echo "png header not found!"
+    exit 7
+fi
+PNG_VERSION=$(awk '/#define PNG_LIBPNG_VER_STRING/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_PNG}")
+
+# zlib
+if [ "${openjdk_version}" -gt 8 ] ; then
+    ZLIB=src/java.base/share/native/libzip/zlib/zlib.h
+else
+    ZLIB=jdk/src/share/native/java/util/zip/zlib/zlib.h
+fi
+ABS_ZLIB="${JDKROOT}"/"${ZLIB}"
+if [ ! -f "${ABS_ZLIB}" ]; then
+    echo "zlib header not found!"
+    exit 8
+fi
+ZLIB_VERSION=$(awk '/#define ZLIB_VERSION/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_ZLIB}")
+
+# Print output
+printf "\nRPM definitions:\n"
+if [ "${openjdk_version}" -gt 8 ] ; then
+    echo "# Version in ${FREETYPE}"
+    echo "Provides: bundled(freetype) = ${FREETYPE_VERSION}"
+fi
+echo "# Version in ${GIFLIB}"
+echo "Provides: bundled(giflib) = ${GIFLIB_VERSION}"
+if [ "${openjdk_version}" -gt 8 ] ; then
+    echo "# Version in ${HARFBUZZ}"
+    echo "Provides: bundled(harfbuzz) = ${HARFBUZZ_VERSION}"
+fi
+echo "# Version in ${LCMS}"
+echo "Provides: bundled(lcms2) = ${LCMS_VERSION}"
+echo "# Version in ${JPEG}"
+echo "Provides: bundled(libjpeg) = ${JPEG_VERSION}"
+echo "# Version in ${PNG}"
+echo "Provides: bundled(libpng) = ${PNG_VERSION}"
+echo "# Version in ${ZLIB}"
+echo "Provides: bundled(zlib) = ${ZLIB_VERSION}"
+
+# Local Variables:
+# compile-command: "shellcheck get_bundle_versions.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/icedtea_sync.sh

@@ -0,0 +1,198 @@
+#!/bin/bash
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by Andrew John Hughes <gnu.andrew@redhat.com>.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+ICEDTEA_USE_VCS=true
+
+ICEDTEA_VERSION=3.15.0
+ICEDTEA_URL=https://icedtea.classpath.org/download/source
+ICEDTEA_SIGNING_KEY=CFDA0F9B35964222
+
+ICEDTEA_HG_URL=https://icedtea.classpath.org/hg/icedtea11
+set -e
+
+RPM_DIR=${PWD}
+if [ ! -f "${RPM_DIR}/jconsole.desktop.in" ] ; then
+    echo "Not in RPM source tree.";
+    exit 1;
+fi
+
+if test "${TMPDIR}" = ""; then
+    TMPDIR=/tmp;
+fi
+WORKDIR=${TMPDIR}/it.sync
+
+echo "Using working directory ${WORKDIR}"
+mkdir "${WORKDIR}"
+pushd "${WORKDIR}"
+
+if test "${WGET}" = ""; then
+    WGET=$(which wget);
+    if test "${WGET}" = ""; then
+	echo "wget not found";
+	exit 1;
+    fi
+fi
+
+if test "${TAR}" = ""; then
+    TAR=$(which tar)
+    if test "${TAR}" = ""; then
+	echo "tar not found";
+	exit 2;
+    fi
+fi
+
+echo "Dependencies:";
+echo -e "\tWGET: ${WGET}";
+echo -e "\tTAR: ${TAR}\n";
+
+if test "${ICEDTEA_USE_VCS}" = "true"; then
+    echo "Mode: Using VCS";
+
+    if test "${GREP}" = ""; then
+	GREP=$(which grep);
+	if test "${GREP}" = ""; then
+	    echo "grep not found";
+	    exit 3;
+	fi
+    fi
+
+    if test "${CUT}" = ""; then
+	CUT=$(which cut);
+	if test "${CUT}" = ""; then
+	    echo "cut not found";
+	    exit 4;
+	fi
+    fi
+
+    if test "${TR}" = ""; then
+	TR=$(which tr);
+	if test "${TR}" = ""; then
+	    echo "tr not found";
+	    exit 5;
+	fi
+    fi
+
+    if test "${HG}" = ""; then
+	HG=$(which hg);
+	if test "${HG}" = ""; then
+	    echo "hg not found";
+	    exit 6;
+	fi
+    fi
+
+    echo "Dependencies:";
+    echo -e "\tGREP: ${GREP}";
+    echo -e "\tCUT: ${CUT}";
+    echo -e "\tTR: ${TR}";
+    echo -e "\tHG: ${HG}";
+
+    echo "Checking out repository from VCS...";
+    ${HG} clone ${ICEDTEA_HG_URL} icedtea
+
+    echo "Obtaining version from configure.ac...";
+    ROOT_VER=$(${GREP} '^AC_INIT' icedtea/configure.ac|${CUT} -d ',' -f 2|${TR} -d '[][:space:]')
+    echo "Root version from configure: ${ROOT_VER}";
+
+    VCS_REV=$(${HG} log -R icedtea --template '{node|short}' -r tip)
+    echo "VCS revision: ${VCS_REV}";
+
+    ICEDTEA_VERSION="${ROOT_VER}-${VCS_REV}"
+    echo "Creating icedtea-${ICEDTEA_VERSION}";
+    mkdir "icedtea-${ICEDTEA_VERSION}"
+    echo "Copying required files from checkout to icedtea-${ICEDTEA_VERSION}";
+    # Commented out for now as IcedTea 6's jconsole.desktop.in is outdated
+    #cp -a icedtea/jconsole.desktop.in ../icedtea-${ICEDTEA_VERSION}
+    cp -a "${RPM_DIR}/jconsole.desktop.in" "icedtea-${ICEDTEA_VERSION}"
+    cp -a icedtea/tapset "icedtea-${ICEDTEA_VERSION}"
+
+    rm -rf icedtea
+else
+    echo "Mode: Using tarball";
+
+    if test "${ICEDTEA_VERSION}" = ""; then
+	echo "No IcedTea version specified for tarball download.";
+	exit 3;
+    fi
+
+    if test "${CHECKSUM}" = ""; then
+	CHECKSUM=$(which sha256sum)
+	if test "${CHECKSUM}" = ""; then
+	    echo "sha256sum not found";
+	    exit 4;
+	fi
+    fi
+
+    if test "${PGP}" = ""; then
+	PGP=$(which gpg)
+	if test "${PGP}" = ""; then
+	    echo "gpg not found";
+	    exit 5;
+	fi
+    fi
+
+    echo "Dependencies:";
+    echo -e "\tCHECKSUM: ${CHECKSUM}";
+    echo -e "\tPGP: ${PGP}\n";
+
+    echo "Checking for IcedTea signing key ${ICEDTEA_SIGNING_KEY}...";
+    if ! gpg --list-keys ${ICEDTEA_SIGNING_KEY}; then
+	echo "IcedTea signing key ${ICEDTEA_SIGNING_KEY} not installed.";
+	exit 6;
+    fi
+
+    echo "Downloading IcedTea release tarball...";
+    ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz
+    echo "Downloading IcedTea tarball signature...";
+    ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz.sig
+    echo "Downloading IcedTea tarball checksums...";
+    ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.sha256
+
+    echo "Verifying checksums...";
+    ${CHECKSUM} --check --ignore-missing icedtea-${ICEDTEA_VERSION}.sha256
+
+    echo "Checking signature...";
+    ${PGP} --verify icedtea-${ICEDTEA_VERSION}.tar.xz.sig
+
+    echo "Extracting files...";
+    ${TAR} xJf icedtea-${ICEDTEA_VERSION}.tar.xz \
+       icedtea-${ICEDTEA_VERSION}/tapset \
+       icedtea-${ICEDTEA_VERSION}/jconsole.desktop.in
+
+    rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz
+    rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz.sig
+    rm -vf icedtea-${ICEDTEA_VERSION}.sha256
+fi
+
+echo "Replacing desktop files...";
+mv -v "icedtea-${ICEDTEA_VERSION}/jconsole.desktop.in" "${RPM_DIR}"
+
+echo "Creating new tapset tarball...";
+mv -v "icedtea-${ICEDTEA_VERSION}" openjdk
+${TAR} cJf "${RPM_DIR}/tapsets-icedtea-${ICEDTEA_VERSION}.tar.xz" openjdk
+
+rm -rvf openjdk
+
+popd
+rm -rf "${WORKDIR}"
+
+# Local Variables:
+# compile-command: "shellcheck icedtea_sync.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/openjdk_news.sh

@@ -0,0 +1,114 @@
+#!/bin/bash
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by Andrew John Hughes <gnu.andrew@redhat.com>, 2012-2022
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+OLD_RELEASE=$1
+NEW_RELEASE=$2
+REPO=$3
+SUBDIR=$4
+SCRIPT_DIR=$(dirname "${0}")
+
+if test "${SUBDIR}" = ""; then
+    echo "No subdirectory specified; using .";
+    SUBDIR=".";
+fi
+
+if test "$REPO" = ""; then
+    echo "No repository specified; using ${PWD}"
+    REPO=${PWD}
+fi
+
+if test "${TMPDIR}" = ""; then
+    TMPDIR=/tmp;
+fi
+
+echo "Repository: ${REPO}"
+
+if [ -e "${REPO}/.git" ] ; then
+    TYPE=git;
+elif [ -e "${REPO}/.hg" ] ; then
+    TYPE=hg;
+else
+    echo "No Mercurial or Git repository detected.";
+    exit 1;
+fi
+
+if test "$OLD_RELEASE" = "" || test "$NEW_RELEASE" = ""; then
+    echo "ERROR: Need to specify old and new release";
+    exit 2;
+fi
+
+echo "Listing fixes between $OLD_RELEASE and $NEW_RELEASE in $REPO"
+rm -f "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" "${TMPDIR}/fixes"
+for repos in . $("${SCRIPT_DIR}/discover_trees.sh" "${REPO}");
+do
+    if test "$TYPE" = "hg"; then
+	hg log -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R "$REPO/$repos" -G -M "${REPO}/${SUBDIR}" | \
+	    grep -E '^[o:| ]*summary'|grep -v 'Added tag'|sed -r 's#^[o:| ]*summary:\W*([0-9])#  - JDK-\1#'| \
+	    sed 's#^[o:| ]*summary:\W*#  - #' >> "${TMPDIR}/fixes2";
+	hg log -v -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R "$REPO/$repos" -G -M "${REPO}/${SUBDIR}" | \
+	    grep -E '^[o:| ]*[0-9]{7}'|sed -r 's#^[o:| ]*([0-9]{7})#  - JDK-\1#' >> "${TMPDIR}/fixes3";
+    else
+	git -C "${REPO}" log --no-merges --pretty=format:%B "${NEW_RELEASE}...${OLD_RELEASE}" -- "${SUBDIR}" |grep -E '^[0-9]{7}' | \
+	    sed -r 's#^([0-9])#  - JDK-\1#' >> "${TMPDIR}/fixes2";
+	touch "${TMPDIR}/fixes3" ; # unused
+    fi
+done
+
+sort "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" > "${TMPDIR}/fixes4"
+uniq "${TMPDIR}/fixes4" > "${TMPDIR}/fixes"
+rm -f "${TMPDIR}/fixes2" "${TMPDIR}/fixes3"
+
+if ! [ -s "${TMPDIR}/fixes" ] ; then
+    echo "Failed to obtain fixes.";
+    exit 3;
+fi
+
+echo "In ${TMPDIR}/fixes:"
+cat "${TMPDIR}/fixes"
+
+printf "\nChecking for duplicates...";
+if uniq -d "${TMPDIR}/fixes4" | grep 'JDK' > "${TMPDIR}/dupes"; then
+    printf "found.\nWARNING: Review the following duplicates:\n";
+    cat "${TMPDIR}/dupes";
+else
+    echo "No apparent duplicates.";
+fi
+rm -f "${TMPDIR}/fixes4";
+
+printf "\nChecking for backouts...";
+if grep -i 'backout' "${TMPDIR}/fixes" > "${TMPDIR}/backouts"; then
+    printf "found.\nWARNING: Review the following backouts:\n"
+    cat "${TMPDIR}/backouts";
+else
+    echo "No apparent backouts.";
+fi
+printf "\nChecking for bundled library updates...";
+if grep -iE ':( \(tz\))? update.*(freetype|gif|harfbuzz|lcms|jpeg|png|timezone|zlib)' "${TMPDIR}/fixes" > "${TMPDIR}/bundles"; then
+    printf "found.\nWARNING: Review the following with respect to bundled provides:\n";
+    cat "${TMPDIR}/bundles";
+    echo "Compare the output of $(dirname "${0}")/get_bundle_versions.sh with the RPM using the JDK source tree"
+else
+    echo "No apparent library updates.";
+fi
+
+# Local Variables:
+# compile-command: "shellcheck openjdk_news.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

sources

@@ -0,0 +1,2 @@
+SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
+SHA512 (openjdk-21.0.9+10.tar.xz) = 95da8df167a2ce632614280ae50dee74aaba96001ec33e9a8b59abf8805f4c06b6ebc9eec1b0b03fe489ce8778adb83d94fe3648b343816b8d9ab2a621c580b8

tests/tests.yml

@@ -0,0 +1,21 @@
+---
+- hosts: localhost
+  roles:
+  - role: standard-test-source
+    tags:
+    - always
+  - role: standard-test-basic
+    tags:
+    - classic
+    - atomic
+    required_packages:
+    - java-21-openjdk-devel
+    tests:
+      - javaVersion1:
+          dir: ~
+          run: set -ex; useradd franta1;  su franta1 -c 'java -version';
+          run: set -ex; useradd franta4;  su franta4 -c 'javac -version';
+          run: ls -l /usr/lib/jvm;
+      - javaVersion2:
+          dir: ~
+          run: set -ex; useradd franta2;  su franta2 -c 'java --version'