19 changed files with 2607 additions and 286 deletions
--- a/.gitignore
+++ b/.gitignore
@ -26,3 +26,15 @@
 /openjdk-21.0.5+9-ea.tar.xz
 /openjdk-21.0.5+10.tar.xz
 /openjdk-21.0.5+11.tar.xz
+/openjdk-21.0.6+6-ea.tar.xz
+/openjdk-21.0.6+7.tar.xz
+/openjdk-21.0.7+1-ea.tar.xz
+/openjdk-21.0.7+2-ea.tar.xz
+/openjdk-21.0.7+3-ea.tar.xz
+/openjdk-21.0.7+4-ea.tar.xz
+/openjdk-21.0.7+5-ea.tar.xz
+/openjdk-21.0.7+6.tar.xz
+/openjdk-21.0.8+1-ea.tar.xz
+/openjdk-21.0.8+2-ea.tar.xz
+/openjdk-21.0.8+8-ea.tar.xz
+/openjdk-21.0.8+9.tar.xz
--- a/0001-Allow-devkit-to-work-with-RHEL.patch
+++ b/0001-Allow-devkit-to-work-with-RHEL.patch
@ -0,0 +1,54 @@
+From 7733d625ebdea5a6f323a0c5944fb8ab728d1b2b Mon Sep 17 00:00:00 2001
+From: Andrew Hughes <gnu.andrew@redhat.com>
+Date: Sat, 25 Nov 2023 17:29:36 +0000
+Subject: [PATCH] Allow devkit to work with RHEL
+
+---
+ make/devkit/Makefile  |  2 +-
+ make/devkit/Tools.gmk | 10 +++++++++-
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/make/devkit/Makefile b/make/devkit/Makefile
+index c85a7c21d29..8f69d23c325 100644
+--- a/make/devkit/Makefile
+++ b/make/devkit/Makefile
+@@ -58,7 +58,7 @@
+ COMMA := ,
+ 
+ os := $(shell uname -o)
+-cpu := $(shell uname -p)
+cpu := $(shell uname -m)
+ 
+ # Figure out what platform this is building on.
+ me := $(cpu)-$(if $(findstring Linux,$(os)),linux-gnu)
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index 187320ca26e..001f4b1870c 100644
+--- a/make/devkit/Tools.gmk
+++ b/make/devkit/Tools.gmk
+@@ -62,6 +62,14 @@ ifeq ($(BASE_OS), OL)
+     BASE_URL := http://yum.oracle.com/repo/OracleLinux/OL6/4/base/$(ARCH)/
+     LINUX_VERSION := OL6.4
+   endif
+else ifeq ($(BASE_OS), RHEL)
+  ifeq ($(ARCH), aarch64)
+    BASE_URL := https://download.eng.brq.redhat.com/rhel-7/rel-eng/RHEL-7/latest-RHEL-ALT-7/compose/Server/$(ARCH)/os/Packages/
+    LINUX_VERSION := RHEL7.6
+  else
+    BASE_URL := https://download.eng.brq.redhat.com/rhel-7/rel-eng/RHEL-7/latest-RHEL-7/compose/Server/$(ARCH)/os/Packages/
+    LINUX_VERSION := RHEL7.9
+  endif
+ else ifeq ($(BASE_OS), Fedora)
+   ifeq ($(ARCH), riscv64)
+     DEFAULT_OS_VERSION := rawhide/68692
+@@ -246,7 +254,7 @@ download-rpms:
+         # Only run this if rpm dir is empty.
+         ifeq ($(wildcard $(DOWNLOAD_RPMS)/*.rpm), )
+ 	  cd $(DOWNLOAD_RPMS) && \
+-	      wget -r -np -nd $(patsubst %, -A "*%*.rpm", $(RPM_LIST)) $(BASE_URL)
+	      wget -r -e robots=off -np -nd $(patsubst %, -A "*%*.rpm", $(RPM_LIST)) $(BASE_URL)
+         endif
+ 
+ ##########################################################################################
+-- 
+2.45.2
+
--- a/0002-Disable-multilib-on-x86_64.patch
+++ b/0002-Disable-multilib-on-x86_64.patch
@ -0,0 +1,50 @@
+From e55afc691c0105623e04a6e76369cf1438afb874 Mon Sep 17 00:00:00 2001
+From: Andrew Hughes <gnu.andrew@redhat.com>
+Date: Fri, 8 Dec 2023 21:22:02 +0000
+Subject: [PATCH] Disable multilib on x86_64
+
+---
+ make/devkit/Tools.gmk | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index 001f4b1870c..9ede781413d 100644
+--- a/make/devkit/Tools.gmk
+++ b/make/devkit/Tools.gmk
+@@ -225,13 +225,7 @@ RPM_LIST := \
+ ##########################################################################################
+ # Define common directories and files
+ 
+-# Ensure we have 32-bit libs also for x64. We enable mixed-mode.
+-ifeq (x86_64,$(ARCH))
+-  LIBDIRS := lib64 lib
+-  CFLAGS_lib := -m32
+-else
+-  LIBDIRS := lib
+-endif
+LIBDIRS := lib
+ 
+ # Define directories
+ BUILDDIR := $(OUTPUT_ROOT)/$(HOST)/$(TARGET)
+@@ -289,8 +283,7 @@ $(foreach p,GCC BINUTILS CCACHE MPFR GMP MPC GDB,$(eval $(call Download,$(p))))
+ 
+ RPM_ARCHS := $(ARCH) noarch
+ ifeq ($(ARCH),x86_64)
+-  # Enable mixed mode.
+-  RPM_ARCHS += i386 i686
+  RPM_ARCHS += i686
+ else ifeq ($(ARCH),i686)
+   RPM_ARCHS += i386
+ else ifeq ($(ARCH), armhfp)
+@@ -526,7 +519,7 @@ ifeq ($(ARCH), armhfp)
+   $(BUILDDIR)/$(gcc_ver)/Makefile : CONFIG +=  --with-float=hard
+ endif
+ 
+-ifneq ($(filter riscv64 ppc64 ppc64le s390x, $(ARCH)), )
+ifneq ($(filter riscv64 ppc64 ppc64le s390x x86_64, $(ARCH)), )
+   # We only support 64-bit on these platforms anyway
+   CONFIG += --disable-multilib
+ endif
+-- 
+2.45.2
+
--- a/0003-Log-devkit-build-to-stdout.patch
+++ b/0003-Log-devkit-build-to-stdout.patch
@ -0,0 +1,92 @@
+From fbc27183b35df7778cf106450b144474f8e2a35c Mon Sep 17 00:00:00 2001
+From: Andrew Hughes <gnu.andrew@redhat.com>
+Date: Wed, 30 Oct 2024 00:42:06 +0000
+Subject: [PATCH] Log devkit build to stdout
+
+Resolves: OPENJDK-3071
+---
+ make/devkit/Tools.gmk | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index 9ede781413d..b6f895f5a25 100644
+--- a/make/devkit/Tools.gmk
+++ b/make/devkit/Tools.gmk
+@@ -458,7 +458,7 @@ $(BUILDDIR)/$(binutils_ver)/Makefile \
+ 	      --enable-multilib \
+ 	      --enable-threads \
+ 	      --enable-plugins \
+-	) > $(@D)/log.config 2>&1
+	) 2>&1 | tee $(@D)/log.config 
+ 	@echo 'done'
+ 
+ $(BUILDDIR)/$(mpfr_ver)/Makefile \
+@@ -473,7 +473,7 @@ $(BUILDDIR)/$(mpfr_ver)/Makefile \
+ 	      --program-prefix=$(TARGET)- \
+ 	      --enable-shared=no \
+ 	      --with-gmp=$(PREFIX) \
+-	) > $(@D)/log.config 2>&1
+	) 2>&1 | tee $(@D)/log.config
+ 	@echo 'done'
+ 
+ $(BUILDDIR)/$(gmp_ver)/Makefile \
+@@ -490,7 +490,7 @@ $(BUILDDIR)/$(gmp_ver)/Makefile \
+ 	      --program-prefix=$(TARGET)- \
+ 	      --enable-shared=no \
+ 	      --with-mpfr=$(PREFIX) \
+-	) > $(@D)/log.config 2>&1
+	) 2>&1 | tee $(@D)/log.config
+ 	@echo 'done'
+ 
+ $(BUILDDIR)/$(mpc_ver)/Makefile \
+@@ -506,7 +506,7 @@ $(BUILDDIR)/$(mpc_ver)/Makefile \
+ 	      --enable-shared=no \
+ 	      --with-mpfr=$(PREFIX) \
+ 	      --with-gmp=$(PREFIX) \
+-	) > $(@D)/log.config 2>&1
+	) 2>&1 | tee $(@D)/log.config
+ 	@echo 'done'
+ 
+ # Only valid if glibc target -> linux
+@@ -549,7 +549,7 @@ $(BUILDDIR)/$(gcc_ver)/Makefile \
+ 	      --with-mpfr=$(PREFIX) \
+ 	      --with-gmp=$(PREFIX) \
+ 	      --with-mpc=$(PREFIX) \
+-	) > $(@D)/log.config 2>&1
+	) 2>&1 | tee $(@D)/log.config
+ 	@echo 'done'
+ 
+ # need binutils for gcc
+@@ -571,7 +571,7 @@ ifeq ($(HOST), $(TARGET))
+ 	  $(PATHPRE) $(ENVS) CFLAGS="$(CFLAGS)" $(GDB_CFG) \
+ 	      $(CONFIG) \
+ 	      --with-sysroot=$(SYSROOT) \
+-	) > $(@D)/log.config 2>&1
+	) 2>&1 | tee $(@D)/log.config
+ 	@echo 'done'
+ 
+   $(gdb): $(gcc)
+@@ -593,7 +593,7 @@ $(BUILDDIR)/$(ccache_ver)/Makefile \
+ 	  cd $(@D) ; \
+ 	  $(PATHPRE) $(ENVS) $(CCACHE_CFG) \
+ 	      $(CONFIG) \
+-	) > $(@D)/log.config 2>&1
+	) 2>&1 | tee $(@D)/log.config
+ 	@echo 'done'
+ 
+ gccpatch = $(TARGETDIR)/gcc-patched
+@@ -641,9 +641,9 @@ endif
+ # Always need to build cross tools for build host self.
+ $(TARGETDIR)/%.done : $(BUILDDIR)/%/Makefile
+ 	$(info Building $(basename $@). Log in $(<D)/log.build)
+-	$(PATHPRE) $(ENVS) $(MAKE) $(BUILDPAR) -f $< -C $(<D) $(MAKECMD) $(MAKECMD.$(notdir $@)) > $(<D)/log.build 2>&1
+	$(PATHPRE) $(ENVS) $(MAKE) $(BUILDPAR) -f $< -C $(<D) $(MAKECMD) $(MAKECMD.$(notdir $@)) 2>&1 | tee $(<D)/log.build
+ 	@echo -n 'installing...'
+-	$(PATHPRE) $(MAKE) $(INSTALLPAR) -f $< -C $(<D) $(INSTALLCMD) $(MAKECMD.$(notdir $@)) > $(<D)/log.install 2>&1
+	$(PATHPRE) $(MAKE) $(INSTALLPAR) -f $< -C $(<D) $(INSTALLCMD) $(MAKECMD.$(notdir $@)) 2>&1 | tee $(<D)/log.install
+ 	@mkdir -p $(@D)
+ 	@touch $@
+ 	@echo 'done'
+-- 
+2.45.2
+
--- a/0004-devkit-Remove-.comment-sections-from-sysroot-objects.patch
+++ b/0004-devkit-Remove-.comment-sections-from-sysroot-objects.patch
@ -0,0 +1,41 @@
+From 3d81d23118aab95214e24ccc81eff61ac245a1ac Mon Sep 17 00:00:00 2001
+From: Thomas Fitzsimmons <fitzsim@redhat.com>
+Date: Wed, 20 Mar 2024 13:01:47 -0400
+Subject: [PATCH] devkit: Remove .comment sections from sysroot objects
+
+Otherwise the comment sections of C runtime objects, including those
+in static libraries like libc_nonshared.a, contribute RPM package
+version strings to the .comment section in devkit-produced binaries
+and libraries.  These RPM package strings change frequently, even
+across minor toolchain updates.  Their presence interferes when
+comparing binaries built with devkits that use different sysroot RPM
+package sets.
+---
+ make/devkit/Tools.gmk | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index b6f895f5a25..37ea1a6a287 100644
+--- a/make/devkit/Tools.gmk
+++ b/make/devkit/Tools.gmk
+@@ -324,6 +324,9 @@ $(foreach p,$(RPM_FILE_LIST),$(eval $(call unrpm,$(p))))
+ # have it anyway, but just to make sure...
+ # Patch libc.so and libpthread.so to force linking against libraries in sysroot
+ # and not the ones installed on the build machine.
+# Remove comment sections from static libraries and C runtime objects
+# to prevent leaking RHEL-specific package versions into
+# devkit-produced binaries.
+ $(libs) : $(rpms)
+ 	@echo Patching libc and pthreads
+ 	@(for f in `find $(SYSROOT) -name libc.so -o -name libpthread.so`; do \
+@@ -333,6 +336,7 @@ $(libs) : $(rpms)
+ 	      -e 's|/lib/||g' ) > $$f.tmp ; \
+ 	  mv $$f.tmp $$f ; \
+ 	done)
+	@find $(SYSROOT) -name '*.[ao]' -exec objcopy --remove-section .comment '{}' ';'
+ 	@mkdir -p $(SYSROOT)/usr/lib
+ 	@touch $@
+ 
+-- 
+2.45.2
+
--- a/0005-Tools.gmk-Configure-binutils-with-enable-determinist.patch
+++ b/0005-Tools.gmk-Configure-binutils-with-enable-determinist.patch
@ -0,0 +1,35 @@
+From c370e1194c707f3f6c470e147ec497cc4e76957e Mon Sep 17 00:00:00 2001
+From: Thomas Fitzsimmons <fitzsim@redhat.com>
+Date: Fri, 22 Mar 2024 16:03:17 -0400
+Subject: [PATCH] Tools.gmk: Configure binutils with
+ --enable-deterministic-archives
+
+---
+ make/devkit/Tools.gmk | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index 37ea1a6a287..22c6007000b 100644
+--- a/make/devkit/Tools.gmk
+++ b/make/devkit/Tools.gmk
+@@ -445,6 +445,9 @@ endif
+ 
+ # Makefile creation. Simply run configure in build dir.
+ # Setting CFLAGS to -O2 generates a much faster ld.
+# Use --enable-deterministic-archives so that make targets that
+# generate "ar" archives, such as "static-libs-image", produce
+# deterministic .a files.
+ $(bfdmakes) \
+ $(BUILDDIR)/$(binutils_ver)/Makefile \
+     : $(BINUTILS_CFG)
+@@ -459,6 +462,7 @@ $(BUILDDIR)/$(binutils_ver)/Makefile \
+ 	      --with-sysroot=$(SYSROOT) \
+ 	      --disable-nls \
+ 	      --program-prefix=$(TARGET)- \
+	      --enable-deterministic-archives \
+ 	      --enable-multilib \
+ 	      --enable-threads \
+ 	      --enable-plugins \
+-- 
+2.45.2
+
--- a/0006-Tools.gmk-Add-enable-linker-build-id-to-gcc-build.patch
+++ b/0006-Tools.gmk-Add-enable-linker-build-id-to-gcc-build.patch
@ -0,0 +1,35 @@
+From 5958274571b957617d0572101a92217fd5b2f312 Mon Sep 17 00:00:00 2001
+From: Andrew Hughes <gnu.andrew@redhat.com>
+Date: Wed, 27 Nov 2024 17:04:19 +0000
+Subject: [PATCH] Tools.gmk: Add --enable-linker-build-id to gcc build
+
+This causes --build-id to be passed to the linker, and the
+.note.gnu.build-id section is added (OPENJDK-3068)
+---
+ make/devkit/Tools.gmk | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index 22c6007000b..57d48ec5114 100644
+--- a/make/devkit/Tools.gmk
+++ b/make/devkit/Tools.gmk
+@@ -539,6 +539,8 @@ endif
+ # skip native language.
+ # and link and assemble with the binutils we created
+ # earlier, so --with-gnu*
+# Add --enable-linker-build-id so the .note.gnu.build-id
+# section is added by the linker (OPENJDK-3068)
+ $(BUILDDIR)/$(gcc_ver)/Makefile \
+     : $(GCC_CFG)
+ 	$(info Configuring $@. Log in $(@D)/log.config)
+@@ -557,6 +559,7 @@ $(BUILDDIR)/$(gcc_ver)/Makefile \
+ 	      --with-mpfr=$(PREFIX) \
+ 	      --with-gmp=$(PREFIX) \
+ 	      --with-mpc=$(PREFIX) \
+	      --enable-linker-build-id \
+ 	) 2>&1 | tee $(@D)/log.config
+ 	@echo 'done'
+ 
+-- 
+2.45.2
+
--- a/0007-Tools.gmk-Exclude-systemtap-sdt-devel-on-s390x-ppc64.patch
+++ b/0007-Tools.gmk-Exclude-systemtap-sdt-devel-on-s390x-ppc64.patch
@ -0,0 +1,38 @@
+From 2617c050a909265444b32063b2d271eca42dcaa6 Mon Sep 17 00:00:00 2001
+From: Andrew Hughes <gnu.andrew@redhat.com>
+Date: Fri, 17 Jan 2025 21:11:01 +0000
+Subject: [PATCH] Tools.gmk: Exclude systemtap-sdt-devel on s390x & ppc64*
+
+There is no DTrace support on s390x (JDK-8305174) and ppc64
+(JDK-8304867) so we don't need the RPMs. They also cause issues with
+static linkage of libstdc++.a on s390x. It fails with 'error:
+relocation refers to local symbol "" [9], which is defined in a
+discarded section'.
+
+Resolves: OPENJDK-3070
+---
+ make/devkit/Tools.gmk | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index 57d48ec5114..07928f69ceb 100644
+--- a/make/devkit/Tools.gmk
+++ b/make/devkit/Tools.gmk
+@@ -219,9 +219,13 @@ RPM_LIST := \
+     zlib zlib-devel \
+     libffi libffi-devel \
+     fontconfig fontconfig-devel \
+-    systemtap-sdt-devel \
+     #
+ 
+# Only include SystemTap on supported architectures
+ifeq ($(filter ppc64 ppc64le s390x, $(ARCH)), )
+  RPM_LIST += systemtap-sdt-devel
+endif
+
+ ##########################################################################################
+ # Define common directories and files
+ 
+-- 
+2.45.2
+
--- a/0008-Tools.gmk-Use-update-repository-on-RHEL-rather-than-.patch
+++ b/0008-Tools.gmk-Use-update-repository-on-RHEL-rather-than-.patch
@ -0,0 +1,33 @@
+From 9766818f55726cea630b432f09cce8f9c17c014d Mon Sep 17 00:00:00 2001
+From: Andrew Hughes <gnu.andrew@redhat.com>
+Date: Fri, 17 Jan 2025 21:27:58 +0000
+Subject: [PATCH] Tools.gmk: Use update repository on RHEL rather than GA
+
+It looks like we were using 7.6 & 7.9 GA repositories rather than
+the latest updates.
+
+Resolves: OPENJDK-3589
+---
+ make/devkit/Tools.gmk | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index 07928f69ceb..5b39560ab11 100644
+--- a/make/devkit/Tools.gmk
+++ b/make/devkit/Tools.gmk
+@@ -64,10 +64,10 @@ ifeq ($(BASE_OS), OL)
+   endif
+ else ifeq ($(BASE_OS), RHEL)
+   ifeq ($(ARCH), aarch64)
+-    BASE_URL := https://download.eng.brq.redhat.com/rhel-7/rel-eng/RHEL-7/latest-RHEL-ALT-7/compose/Server/$(ARCH)/os/Packages/
+    BASE_URL := https://download.eng.brq.redhat.com/rhel-7/rel-eng/updates/RHEL-ALT-7/latest-RHEL-ALT-7/compose/Server/$(ARCH)/os/Packages/
+     LINUX_VERSION := RHEL7.6
+   else
+-    BASE_URL := https://download.eng.brq.redhat.com/rhel-7/rel-eng/RHEL-7/latest-RHEL-7/compose/Server/$(ARCH)/os/Packages/
+    BASE_URL := https://download.eng.brq.redhat.com/rhel-7/rel-eng/updates/RHEL-7/latest-RHEL-7/compose/Server/$(ARCH)/os/Packages/
+     LINUX_VERSION := RHEL7.9
+   endif
+ else ifeq ($(BASE_OS), Fedora)
+-- 
+2.45.2
+
--- a/1174
+++ b/1174
--- a/README.md
+++ b/README.md
@ -37,3 +37,10 @@ need to be modified if the version or rpmrelease values are changed in
 To reduce the number of RPMs involved, the `fastdebug` and `slowdebug`
 builds may be disabled using `--without fastdebug` and `--without
 slowdebug`.
+
+By default, the portable build on RHEL also uses a "devkit" (a
+toolchain and system libraries) to build.  This aids reproducibility
+by removing build differences caused by differing system toolchains
+and libraries.  This dependency can be dropped by defining 'centos' to
+a non-zero value (e.g. --define='centos 1') or a devkit can be built
+using the `openjdk-devkit.specfile` and associated patches.
--- a/fips-21u-9203d50836c.patch
+++ b/fips-21u-9203d50836c.patch
@ -1979,7 +1979,7 @@ index 539ef1e8ee8..435f57e3ff2 100644
                 "sun.security.rsa.PSSParameters", null);
     }
 diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security
-index 5149edba0e5..8227d650a03 100644
+index f8b01a4ea1e..b325bf7e9fc 100644
 --- a/src/java.base/share/conf/security/java.security
 +++ b/src/java.base/share/conf/security/java.security
@@ -85,6 +85,17 @@ security.provider.tbd=Apple
@ -2959,7 +2959,7 @@ index 00000000000..f8d505ca815
 +}
 \ No newline at end of file
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
-index c3b412885a6..0e7ce73b158 100644
+index 01fc06ae283..e3ca000d309 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
@@ -37,6 +37,8 @@ import javax.crypto.*;
@ -2981,7 +2981,7 @@ index c3b412885a6..0e7ce73b158 100644
     private static final String PUBLIC = "public";
     private static final String PRIVATE = "private";
     private static final String SECRET = "secret";
-@@ -401,9 +406,10 @@ abstract class P11Key implements Key, Length {
+@@ -414,9 +419,10 @@ abstract class P11Key implements Key, Length {
                     new CK_ATTRIBUTE(CKA_EXTRACTABLE),
         });
 
@ -2995,7 +2995,7 @@ index c3b412885a6..0e7ce73b158 100644
 
         return switch (algorithm) {
             case "RSA" -> P11RSAPrivateKeyInternal.of(session, keyID, algorithm,
-@@ -455,7 +461,8 @@ abstract class P11Key implements Key, Length {
+@@ -468,7 +474,8 @@ abstract class P11Key implements Key, Length {
 
         public String getFormat() {
             token.ensureValid();
@ -3005,13 +3005,13 @@ index c3b412885a6..0e7ce73b158 100644
                 return null;
             } else {
                 return "RAW";
-@@ -1625,4 +1632,3 @@ final class SessionKeyRef extends PhantomReference<P11Key> {
+@@ -1638,4 +1645,3 @@ final class SessionKeyRef extends PhantomReference<P11Key> {
         this.clear();
     }
 }
 -
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
-index 5cd6828d293..bae49c4e8a9 100644
+index 0a62021633f..0723b69c2bc 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
@@ -26,6 +26,9 @@
@ -3022,7 +3022,7 @@ index 5cd6828d293..bae49c4e8a9 100644
 +import java.lang.invoke.MethodHandles;
 +import java.lang.invoke.MethodType;
 import java.util.*;
- 
+ import java.util.stream.Collectors;
 import java.security.*;
@@ -42,10 +45,12 @@ import javax.security.auth.callback.PasswordCallback;
 
@ -3141,7 +3141,7 @@ index 5cd6828d293..bae49c4e8a9 100644
             }
             p11 = tmpPKCS11;
 
-@@ -1389,11 +1461,52 @@ public final class SunPKCS11 extends AuthProvider {
+@@ -1388,11 +1460,52 @@ public final class SunPKCS11 extends AuthProvider {
         }
 
         @Override
@ -3194,7 +3194,7 @@ index 5cd6828d293..bae49c4e8a9 100644
             try {
                 return newInstance0(param);
             } catch (PKCS11Exception e) {
-@@ -1750,6 +1863,9 @@ public final class SunPKCS11 extends AuthProvider {
+@@ -1749,6 +1862,9 @@ public final class SunPKCS11 extends AuthProvider {
         try {
             session = token.getOpSession();
             p11.C_Logout(session.id());
@ -3252,7 +3252,7 @@ index a6f5f0a8764..9a07c96ca4e 100644
     }
 
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
-index 4b06daaf264..55e14945469 100644
+index 0fd13fd6fa6..3c959c942a1 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
@@ -49,6 +49,9 @@ package sun.security.pkcs11.wrapper;
@ -3312,7 +3312,7 @@ index 4b06daaf264..55e14945469 100644
             }
             if (omitInitialize == false) {
                 try {
-@@ -1976,4 +2004,194 @@ static class SynchronizedPKCS11 extends PKCS11 {
+@@ -2012,4 +2040,194 @@ static class SynchronizedPKCS11 extends PKCS11 {
         super.C_GenerateRandom(hSession, randomData);
     }
 }
--- a/gating.yaml
+++ b/gating.yaml
@ -1,7 +1,7 @@
 # recipients: java-qa
 --- !Policy
 product_versions:
-  - rhel-10
+  - rhel-9
 decision_context: osci_compose_gate
 rules:
  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
--- a/java-21-openjdk-portable.specfile
+++ b/java-21-openjdk-portable.specfile
--- a/java-21-openjdk.spec
+++ b/java-21-openjdk.spec
@ -102,9 +102,9 @@
 # similarly for other %%{_jvmdir}/{jre,java} and %%{_javadocdir}/{java,java-zip}
 %define is_release_build() %( if [ "%{?1}" == "%{debug_suffix_unquoted}" -o "%{?1}" == "%{fastdebug_suffix_unquoted}" ]; then echo "0" ; else echo "1"; fi )

-# Indicates whether this is the default JDK on this version of RHEL
-# Only the default/system JDK provides unversioned Provides like 'java', 'jre' and 'java-devel'
-%global is_system_jdk 1
+# while JDK is a techpreview(is_system_jdk=0), some provides are turned off. Once jdk stops to be an techpreview, move it to 1
+# as sytem JDK, we mean any JDK which can run whole system java stack without issues (like bytecode issues, module issues, dependencies...)
+%global is_system_jdk 0

 %global aarch64         aarch64 arm64 armv8
 # we need to distinguish between big and little endian PPC64
@ -308,7 +308,7 @@
 # New Version-String scheme-style defines
 %global featurever 21
 %global interimver 0
-%global updatever 5
+%global updatever 8
 %global patchver 0
 # We don't add any LTS designator for STS packages (Fedora and EPEL).
 # We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined.
@ -344,7 +344,7 @@
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      6.0.0pre00-c848b93a8598
 # Define current Git revision for the FIPS support patches
-%global fipsver 0a42e29b391
+%global fipsver 9203d50836c
 # Define JDK versions
 %global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
 %global javaver         %{featurever}
@ -356,7 +356,7 @@
 # Define the OS the portable JDK is built on
 # This is undefined for CentOS & openjdk-portable-rhel-8 builds and
 # equals 'rhel7' for openjdk-portable-rhel-7 builds
-%if 0%{?centos} == 0
+%if 0
 %global pkgos rhel7
 %endif

@ -365,8 +365,8 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{vcstag}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        11
-%global rpmrelease      2
+%global buildver        9
+%global rpmrelease      1
 # Settings used by the portable build
 %global portablerelease 1
 # Portable suffix differs between RHEL and CentOS
@ -377,10 +377,6 @@
 %endif
 %global portablebuilddir /builddir/build/BUILD

-%if 0%{?almalinux}
-%global portablesuffix el8
-%endif
-
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
 # Using 10 digits may overflow the int used for priority, so we combine the patch and build versions
@ -837,6 +833,8 @@ exit 0
 %doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/NEWS
 %doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/README.md
 %doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/java-%{featurever}-openjdk-portable.specfile
+%doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/openjdk-devkit.specfile
+%doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/0*.patch
 %dir %{_sysconfdir}/.java/.systemPrefs
 %dir %{_sysconfdir}/.java
 %dir %{_jvmdir}/%{sdkdir -- %{?1}}
@ -1140,6 +1138,10 @@ OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release
 %if 0%{?rhel} >= 8 || 0%{?fedora} > 0
 Recommends: gtk3%{?_isa}
 %endif
+# Recommend PipeWire for screenshots under Wayland.
+%if 0%{?rhel} >= 9 || 0%{?fedora} > 0
+Recommends: pipewire%{?_isa}
+%endif

 Provides: java-%{javaver}-%{origin}%{?1} = %{epoch}:%{version}-%{release}

@ -1161,8 +1163,8 @@ Requires: ca-certificates
 # Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros
 Requires: javapackages-filesystem
 # Require zone-info data provided by tzdata-java sub-package
-# 2024a required as of JDK-8325150
-Requires: tzdata-java >= 2024a
+# 2025a required as of JDK-8347965
+Requires: tzdata-java >= 2025a
 # for support of kernel stream control
 # libsctp.so.1 is being `dlopen`ed on demand
 Requires: lksctp-tools%{?_isa}
@ -1291,7 +1293,7 @@ ExclusiveArch: %{aarch64} %{ppc64le} s390x x86_64

 Name:    java-%{javaver}-%{origin}
 Version: %{newjavaver}.%{buildver}
-Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}.1.alma.1
+Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
 # Equivalent for the portable build
 %global prelease %{?eaprefix}%{portablerelease}%{?extraver}
 # java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons
@ -1364,6 +1366,25 @@ Source18: TestTranslations.java
 Source19: README.md
 Source20: java-%{featurever}-openjdk-portable.specfile
 Source21: NEWS
+Source22: openjdk-devkit.specfile
+# Devkit patches; see https://github.com/rh-openjdk/jdk/tree/devkit
+# To regenerate, use git format-patch -N jdk21u/master
+# Add RHEL RPM URLs and turn off robots
+Source23: 0001-Allow-devkit-to-work-with-RHEL.patch
+# Turn off multilib on x86_64
+Source24: 0002-Disable-multilib-on-x86_64.patch
+# Improve build logging (OPENJDK-3071)
+Source25: 0003-Log-devkit-build-to-stdout.patch
+# Remove .comment sections from sysroot objects
+Source26: 0004-devkit-Remove-.comment-sections-from-sysroot-objects.patch
+# Configure binutils with --enable-deterministic-archives
+Source27: 0005-Tools.gmk-Configure-binutils-with-enable-determinist.patch
+# Configure gcc with --enable-linker-build-id (OPENJDK-3068)
+Source28: 0006-Tools.gmk-Add-enable-linker-build-id-to-gcc-build.patch
+# Exclude systemtap-sdt-devel on s390x & ppc64* (OPENJDK-3070)
+Source29: 0007-Tools.gmk-Exclude-systemtap-sdt-devel-on-s390x-ppc64.patch
+# Use update repository on RHEL rather than GA (OPENJDK-3589)
+Source30: 0008-Tools.gmk-Use-update-repository-on-RHEL-rather-than-.patch

 # Setup variables to reference correct sources
 %global releasezip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.unstripped.jdk.%{_arch}.tar.xz
@ -1433,6 +1454,8 @@ Patch1001: fips-%{featurever}u-%{fipsver}.patch
 #
 #############################################

+# Currently empty
+
 #############################################
 #
 # Portable build specific patches
@ -1490,8 +1513,8 @@ BuildRequires: %{pkgnameroot}-misc = %{epoch}:%{version}-%{prelease}.%{portables
 %ifarch %{zero_arches}
 BuildRequires: libffi-devel
 %endif
-# 2024a required as of JDK-8325150
-BuildRequires: tzdata-java >= 2024a
+# 2025a required as of JDK-8347965
+BuildRequires: tzdata-java >= 2025a
 # Earlier versions have a bug in tree vectorization on PPC
 BuildRequires: gcc >= 4.8.3-8

@ -1510,17 +1533,17 @@ BuildRequires: libpng-devel
 BuildRequires: zlib-devel
 %else
 # Version in src/java.desktop/share/legal/freetype.md
-Provides: bundled(freetype) = 2.13.2
+Provides: bundled(freetype) = 2.13.3
 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
 Provides: bundled(giflib) = 5.2.2
 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h
-Provides: bundled(harfbuzz) = 8.2.2
+Provides: bundled(harfbuzz) = 10.4.0
 # Version in src/java.desktop/share/native/liblcms/lcms2.h
-Provides: bundled(lcms2) = 2.16.0
+Provides: bundled(lcms2) = 2.17.0
 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h
 Provides: bundled(libjpeg) = 6b
 # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h
-Provides: bundled(libpng) = 1.6.43
+Provides: bundled(libpng) = 1.6.47
 # Version in src/java.base/share/native/libzip/zlib/zlib.h
 Provides: bundled(zlib) = 1.3.1
 %endif
@ -1835,6 +1858,7 @@ The %{origin_nice} %{featurever} API documentation compressed in a single archiv
 %prep

 echo "Preparing %{oj_vendor_version}"
+echo "System is RHEL=%{?rhel}%{!?rhel:0}, CentOS=%{?centos}%{!?centos:0}, EPEL=%{?epel}%{!?epel:0}, Fedora=%{?fedora}%{!?fedora:0}"

 # Using the echo macro breaks rpmdev-bumpspec, as it parses the first line of stdout :-(
 %if 0%{?stapinstall:1}
@ -2102,10 +2126,13 @@ if ! nm ${alt_java_binary} | grep prctl ; then true ; else false; fi

 %if %{include_staticlibs}
 # Check debug symbols in static libraries (smoke test)
+# Temporary workaround for debuginfo failure on x86_64 with devkit build
+%ifnarch x86_64
 export STATIC_LIBS_HOME=${JAVA_HOME}/lib/static/linux-%{archinstall}/glibc
 readelf --debug-dump $STATIC_LIBS_HOME/libnet.a | grep Inet4AddressImpl.c
 readelf --debug-dump $STATIC_LIBS_HOME/libnet.a | grep Inet6AddressImpl.c
 %endif
+%endif

 so_suffix="so"
 # Check debug symbols are present and can identify code
@ -2191,7 +2218,11 @@ miscdir=$(pwd)/%{installoutputdir -- "-misc"}
 commondocdir=${RPM_BUILD_ROOT}%{_defaultdocdir}/%{uniquejavadocdir -- $suffix}
 install -d -m 755 ${commondocdir}
 mv ${jdk_image}/NEWS ${commondocdir}
-cp -a %{SOURCE19} %{SOURCE20} ${commondocdir}
+# Copy portable and devkit specfiles and README.md
+cp -a %{SOURCE19} %{SOURCE20} %{SOURCE22} ${commondocdir}
+# Copy devkit patches
+cp -a  %{SOURCE23} %{SOURCE24} %{SOURCE25} %{SOURCE26} \
+       %{SOURCE27} %{SOURCE28} %{SOURCE29} %{SOURCE30} ${commondocdir}

 # Install the jdk
 mkdir -p $RPM_BUILD_ROOT%{_jvmdir}
@ -2536,24 +2567,114 @@ cjc.mainProgram(args)
 %endif

 %changelog
-* Tue Dec 17 2024 Eduard Abdullin <eabdullin@almalinux.org> - 1:21.0.5.0.11-2.1.alma.1
- Use el8 portable packages
+* Thu Jul 10 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.9-1.1
+- Update to jdk-21.0.8+9 (GA)
+- Update release notes to 21.0.8+9
+- Switch to GA mode
+- Sync the copy of the portable specfile with the latest update
+- ** This tarball is embargoed until 2025-07-15 @ 1pm PT. **
+- Resolves: RHEL-102289

-* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 1:21.0.5.0.11-2.1
- Bump release for October 2024 mass rebuild:
-  Resolves: RHEL-64018
+* Thu Jul 10 2025 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.7.0.6-3
+- Recommend PipeWire on RHEL 9 and later for java.awt.Robot screenshots under Wayland
+- Resolves: RHEL-102677
+
+* Thu Jul 10 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.8-0.1.ea
+- Update to jdk-21.0.8+8 (EA)
+- Update release notes to 21.0.8+8
+- Sync the copy of the portable specfile with the latest update
+- Resolves: RHEL-101798
+
+* Wed Jul 09 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.2-0.1.ea
+- Update to jdk-21.0.8+2 (EA)
+- Update release notes to 21.0.8+2
+- Sync the copy of the portable specfile with the latest update
+- Add timezone data update check to openjdk_news.sh
+- Add duplicate check to openjdk_news.sh
+- Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh
+- Related: RHEL-101798
+- Resolves: RHEL-103209
+
+* Wed Jul 09 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.1-0.1.ea
+- Update get_bundle_versions.sh to match other scripts
+- * get_bundle_versions.sh: Add license
+- * get_bundle_versions.sh: Set compile-command in Emacs
+- * get_bundle_versions.sh: Use different error codes for different failures
+- * get_bundle_versions.sh: Remove unneeded '.' in JPEG version
+- * get_bundle_versions.sh: shellcheck: Double-quote variable references (SC2086)
+- * get_bundle_versions.sh: shellcheck: Drop use of cat and pass file to awk directly (SC2002)
+- Add OpenJDK 8u support to get_bundle_versions.sh
+- Print bundle updates and backouts at end of openjdk_news.sh output
+- Refer user to get_bundle_versions.sh when bundle updates are found by openjdk_news.sh
+- Related: RHEL-103209
+
+* Wed Jul 09 2025 Antonio Vieiro <avieirov@redhat.com> - 1:21.0.8.0.1-0.1.ea
+- Add script to obtain bundled library versions from OpenJDK sources
+- Related: RHEL-103209
+
+* Wed Jul 09 2025 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.8.0.1-0.1.ea
+- Warn about bundled provide version bumps and backouts in openjdk_news.sh
+- Related: RHEL-103209
+
+* Wed Jul 09 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.1-0.1.ea
+- Update to jdk-21.0.8+1 (EA)
+- Update release notes to 21.0.8+1
+- Bump freetype version to 2.13.3 following JDK-8348596
+- Bump harfbuzz version to 10.4.0 following JDK-8348597
+- Bump lcms2 version to 2.17.0 following JDK-8348110
+- Bump libpng version to 1.6.47 following JDK-8348598
+- Switch to EA mode
+- Drop JDK-8351500 local patch which is now available in 21.0.8+1 upstream
+- Sync the copy of the portable specfile with the latest update
+- Related: RHEL-101798
+
+* Thu May 08 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.7.0.6-2
+- Add local version of JDK-8351500 for early interim release before 21.0.8
+- Sync the copy of the portable specfile with the latest update
+- Resolves: RHEL-90309
+
+* Fri Apr 11 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.7.0.6-1
+- Update to jdk-21.0.7+6 (GA)
+- Update release notes to 21.0.7+6
+- Rebase FIPS support against 21.0.7+5
+- Require tzdata 2025a due to upstream inclusion of JDK-8347965
+- Sync the copy of the portable specfile with the latest update
+- ** This tarball is embargoed until 2025-04-15 @ 1pm PT. **
+- Resolves: RHEL-86984
+- Resolves: RHEL-86635
+
+* Thu Feb 06 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.6.0.7-2
+- Bump tzdata requirement to 2024b for JDK-8339637
+- Resolves: RHEL-74001
+
+* Sat Jan 18 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.6.0.7-1
+- Update to jdk-21.0.6+7 (GA)
+- Update release notes to 21.0.6+7
+- Sync the copy of the portable & devkit specfiles with the latest update
+- Include the latest devkit patches
+- Update README.md to list an easier way of disabling the devkit
+- ** This tarball is embargoed until 2025-01-21 @ 1pm PT. **
+- Resolves: RHEL-73562
+
+* Fri Jan 17 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.11-3
+- Transition to the devkit build by not defining pkgos
+- Exempt x86_64 from the static libs debuginfo test until portable uses an older DWARF version
+- Sync the copy of the portable specfile with the devkit version
+- Include the devkit specfile and patches
+- Document the devkit in README.md
+- Resolves: RHEL-74403

 * Wed Oct 16 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.11-2
 - Update to jdk-21.0.5+11 (GA)
 - Update release notes to 21.0.5+11
 - Remove local JDK-8327501 & JDK-8328366 backport as this is now upstream.
 - Sync the copy of the portable specfile with the latest update
- Related: RHEL-61276
+- Related: RHEL-61344

 * Sun Oct 13 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.10-3
 - Sync the copy of the portable specfile with the latest update
 - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **
- Related: RHEL-61276
+- Related: RHEL-61344

 * Sat Oct 12 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.10-2
 - Update to jdk-21.0.5+10 (GA)
@ -2561,9 +2682,9 @@ cjc.mainProgram(args)
 - Switch to GA mode.
 - Revert JDK-8327501 & JDK-8328366 backport until more mature.
 - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **
- Resolves: RHEL-61276
+- Resolves: RHEL-61344

-* Fri Oct 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.9-0.1.ea
+* Fri Oct 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.9-0.2.ea
 - Update to jdk-21.0.5+9 (EA)
 - Update release notes to 21.0.5+9
 - Switch to EA mode
@ -2572,32 +2693,35 @@ cjc.mainProgram(args)
 - Sync with RHEL 7 portable build:
  - Use ExclusiveArch over ExcludeArch
  - pkgos definition needs to be early enough to be used in portablesuffix
- Add build scripts to repository to ease remembering all CentOS & RHEL targets and options
 - Make build scripts executable
 - Sync the copy of the portable specfile with the latest update
- Resolves: RHEL-62239
- Resolves: RHEL-62241
+- Resolves: RHEL-58797
+- Resolves: RHEL-17191

-* Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.7-1
+* Mon Oct 07 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.7-2
+- Vary portablesuffix depending on whether we are on RHEL ('el8') or CentOS ('el9')
+- Handle debugedit being a separate package installed in /usr on RHEL/CentOS 10
+- Add build scripts to repository to ease remembering all CentOS & RHEL targets and options
+- Related: RHEL-58797
+
+* Fri Jul 12 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.7-1
 - Update to jdk-21.0.4+7 (GA)
 - Update release notes to 21.0.4+7
 - Switch to GA mode.
 - Sync the copy of the portable specfile with the latest update
 - Add missing section headers in NEWS
- Vary portablesuffix depending on whether we are on RHEL ('el8') or CentOS ('el9')
 - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **
- Resolves: RHEL-47024
+- Resolves: RHEL-47023

-* Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.5-0.1.ea
+* Wed Jun 26 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.5-0.1.ea
 - Update to jdk-21.0.4+5 (EA)
 - Update release notes to 21.0.4+5
 - Limit Java only tests to one architecture using jdk_test_arch
 - Actually require tzdata 2024a now it is available in the buildroot
- Resolves: RHEL-45357
- Resolves: RHEL-52735
- Related: RHEL-52723
+- Resolves: RHEL-45355
+- Resolves: RHEL-47395

-* Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.1-0.1.ea
+* Sat Jun 22 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.1-0.1.ea
 - Update to jdk-21.0.4+1 (EA)
 - Update release notes to 21.0.4+1
 - Switch to EA mode
@ -2605,27 +2729,27 @@ cjc.mainProgram(args)
 - Add zlib build requirement or bundled version (1.3.1), depending on system_libs setting
 - Restore NEWS file so portable can be rebuilt
 - Sync the copy of the portable specfile with the latest update
- Related: RHEL-45357
- Resolves: RHEL-46026
+- Related: RHEL-45355
+- Resolves: RHEL-46029

-* Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.9-1
+* Sun Apr 14 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.9-1
 - Update to jdk-21.0.3+9 (GA)
 - Update release notes to 21.0.3+9
 - Switch to GA mode.
 - Sync the copy of the portable specfile with the latest update
 - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
- Resolves: RHEL-32427
+- Resolves: RHEL-32424

-* Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.7-0.1.ea
+* Sun Apr 14 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.7-0.1.ea
 - Update to jdk-21.0.3+7 (EA)
 - Update release notes to 21.0.3+7
 - Require tzdata 2024a due to upstream inclusion of JDK-8322725
 - Only require tzdata 2023d for now as 2024a is unavailable in buildroot
 - Drop JDK-8009550 which is now available upstream
 - Re-generate FIPS patch against 21.0.3+7 following backport of JDK-8325254
- Resolves: RHEL-52723
+- Resolves: RHEL-30946

-* Sat Aug 03 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.1-0.1.ea
+* Sun Apr 14 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.1-0.2.ea
 - Invoke xz in multi-threaded mode
 - generate_source_tarball.sh: Add WITH_TEMP environment variable
 - generate_source_tarball.sh: Multithread xz on all available cores
@ -2654,14 +2778,9 @@ cjc.mainProgram(args)
 - generate_source_tarball.sh: Use long-style argument to grep
 - generate_source_tarball.sh: Add license
 - generate_source_tarball.sh: Add indentation instructions for Emacs
- Related: RHEL-52723
+- Related: RHEL-30946

-* Sat Aug 03 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.1.ea
- Update to jdk-21.0.3+1 (EA)
- Update release notes to 21.0.3+1
- Switch to EA mode
- Require tzdata 2023d due to local inclusion of JDK-8322725
- Bump FreeType version to 2.13.2 following JDK-8316028
+* Sun Apr 14 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.2.ea
 - Install alt-java man page from the misc tarball as it is no longer in the JDK image
 - generate_source_tarball.sh: Update examples in header for clarity
 - generate_source_tarball.sh: Cleanup message issued when checkout already exists
@ -2683,18 +2802,19 @@ cjc.mainProgram(args)
 - generate_source_tarball.sh: Output values of new options WITH_TEMP and OPENJDK_LATEST
 - generate_source_tarball.sh: Double-quote DEPTH reference (SC2086)
 - generate_source_tarball.sh: Avoid empty DEPTH reference while still appeasing shellcheck
- Related: RHEL-52723
+- Related: RHEL-30946

-* Tue Jul 30 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-3
- Fix gating.yaml to reference RHEL 10
- Set this to be the default/system JDK providing 'java', 'jre', 'java-devel' ,etc.
- Resolves: RHEL-34597
- Resolves: RHEL-51617
+* Sun Apr 14 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.1.ea
+- Update to jdk-21.0.3+1 (EA)
+- Update release notes to 21.0.3+1
+- Switch to EA mode
+- Require tzdata 2023d due to upstream inclusion of JDK-8322725
+- Bump FreeType version to 2.13.2 following JDK-8316028
+- Related: RHEL-30946

 * Fri Apr 12 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-2
 - Define portablesuffix according to whether pkgos is defined or not
- Handle debugedit being a separate package installed in /usr on RHEL/CentOS 10
- Related: RHEL-45217
+- Related: RHEL-30946

 * Tue Jan 09 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-1
 - Update to jdk-21.0.2+13 (GA)
@ -2703,16 +2823,16 @@ cjc.mainProgram(args)
 - Bump HarfBuzz version to 8.2.2 following JDK-8313643
 - Drop local JDK-8311630 patch which is now upstream
 - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
- Resolves: RHEL-45217
+- Resolves: RHEL-20999

 * Mon Nov 06 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-3
 - Include JDK-8311630 patch to implement Foreign Function & Memory preview API on s390x
 - Sync the copy of the portable specfile with the latest update
- Related: RHEL-45217
+- Resolves: RHEL-16290

 * Mon Oct 30 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-2
 - Define pkgnameroot to simplify build requirements and allow '-rhel7' suffix on RHEL
- Related: RHEL-45217
+- Related: RHEL-12998

 * Fri Oct 27 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-1
 - Update to jdk-21.0.1.0+12 (GA)
@ -2734,15 +2854,21 @@ cjc.mainProgram(args)
 - Add missing jfr, jpackage and jwebserver alternative ghosts
 - Move jcmd to the headless package
 - Revert alt-java binary location to being within the JDK tree
- Related: RHEL-45217
+- Resolves: RHEL-12998
+- Resolves: RHEL-14953
+- Resolves: RHEL-13925
+- Resolves: RHEL-14957
+- Related: RHEL-14945
+- Resolves: RHEL-11321
+- Resolves: RHEL-14947

 * Fri Oct 27 2023 Jiri Vanek <jvanek@redhat.com> - 1:21.0.1.0.12-1
 - Exclude classes_nocoops.jsa on i686 and arm32
- Related: RHEL-45217
+- Related: RHEL-14945

 * Fri Oct 27 2023 Severin Gehwolf <sgehwolf@redhat.com> - 1:21.0.1.0.12-1
 - Fix packaging of CDS archives
- Resolves: RHEL-45217
+- Resolves: RHEL-14945

 * Thu Aug 24 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-2
 - Update documentation (README.md)
@ -2753,7 +2879,7 @@ cjc.mainProgram(args)
 - * No use of system libjpeg turbo to warrant RH649512 patch any more
 - Replace RH1684077 pcsc-lite-libs patch with better JDK-8009550 fix being upstreamed
 - Adapt alt-java test to new binary where there is always a set_speculation function
- Related: RHEL-45217
+- Related: RHEL-12998

 * Mon Aug 21 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-1
 - Update to jdk-21.0.0+35
@ -2765,11 +2891,12 @@ cjc.mainProgram(args)
 - Re-enable tzdata tests now we are on the latest JDK and things are back in sync
 - Install jaxp.properties introduced by JDK-8303530
 - Install lible.so introduced by JDK-8306983
- Related: RHEL-45217
+- Related: RHEL-12998
+- Resolves: RHEL-41087

 * Mon Aug 21 2023 Petra Alice Mikova <pmikova@redhat.com> - 1:21.0.0.0.35-1
 - Replace smoke test files used in the staticlibs test, as fdlibm was removed by JDK-8303798
- Related: RHEL-45217
+- Related: RHEL-12998

 * Wed Aug 16 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:20.0.0.0.36-1
 - Update to jdk-20.0.2+9
@ -2777,12 +2904,12 @@ cjc.mainProgram(args)
 - Update system crypto policy & FIPS patch from new fips-20u tree
 - Update generate_tarball.sh ICEDTEA_VERSION
 - Update CLDR reference data following update to 42 (Rocky Mountain-Normalzeit => Rocky-Mountain-Normalzeit)
- Related: RHEL-45217
+- Related: RHEL-12998

 * Wed Aug 16 2023 Jiri Vanek <jvanek@redhat.com> - 1:20.0.0.0.36-1
 - Dropped JDK-8295447, JDK-8296239 & JDK-8299439 patches now upstream
 - Adapted rh1750419-redhat_alt_java.patch
- Related: RHEL-45217
+- Related: RHEL-12998

 * Tue Aug 15 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:19.0.1.0.10-1
 - Update to jdk-19.0.2 release
@ -2791,7 +2918,7 @@ cjc.mainProgram(args)
 - Remove references to sample directory removed by JDK-8284999
 - Add local patch JDK-8295447 (javac NPE) which was accepted into 19u upstream but not in the GA tag
 - Add local patches for JDK-8296239 & JDK-8299439 (Croatia Euro update) which are present in 8u, 11u & 17u releases
- Related: RHEL-45217
+- Related: RHEL-12998

 * Thu Aug 10 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:18.0.2.0.9-1
 - Update to jdk-18.0.2 release
@ -2802,26 +2929,26 @@ cjc.mainProgram(args)
 - Drop tzdata patches added for 17.0.7 which will eventually appear in the upstream tarball when we reach OpenJDK 21
 - Disable tzdata tests until we are on the latest JDK and things are back in sync
 - Use empty nss.fips.cfg until it is again available via the FIPS patch
- Related: RHEL-45217
+- Related: RHEL-12998

 * Thu Aug 10 2023 Petra Alice Mikova <pmikova@redhat.com> - 1:18.0.2.0.9-1
 - Update to ea version of jdk18
 - Add new slave jwebserver and corresponding manpage
 - Adjust rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
- Related: RHEL-45217
+- Related: RHEL-12998

 * Thu Aug 10 2023 FeRD (Frank Dana) <ferdnyc@gmail.com> - 1:18.0.2.0.9-1
 - Add javaver- and origin-specific javadoc and javadoczip alternatives.
- Related: RHEL-45217
+- Related: RHEL-12998

 * Tue Aug 08 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-4
 - Set portablerelease and portablerhel to use the CentOS 9 build
- Related: RHEL-45217
+- Related: RHEL-12998

 * Tue Aug 08 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-4
 - Add files missed by centpkg import.
- Related: RHEL-45217
+- Related: rhbz#2192748

 * Fri Aug 04 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-3
 - Create java-21-openjdk package based on java-17-openjdk
- Related: RHEL-45217
+- Related: rhbz#2192748
--- a/openjdk-devkit.specfile
+++ b/openjdk-devkit.specfile
@ -0,0 +1,230 @@
+# Spec file for building a devkit for OpenJDK builds
+
+# We do not want debug packages
+%global debug_package %{nil}
+# Arch definitions from java-*-openjdk RPM
+%global aarch64         aarch64 arm64 armv8
+# x86 is not supported by OpenJDK 17
+ExcludeArch: %{ix86}
+
+# New Version-String scheme-style defines
+%global featurever 21
+%global interimver 0
+%global updatever 5
+%global patchver 0
+%global buildver 11
+# Define JDK versions
+%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
+%global javaver         %{featurever}
+# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames
+%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn})
+# The tag used to create the OpenJDK tarball
+%global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}
+
+# Define milestone (EA for pre-releases, GA for releases)
+# Release will be (where N is usually a number starting at 1):
+# - 0.N%%{?extraver}%%{?dist} for EA releases,
+# - N%%{?extraver}{?dist} for GA releases
+%global is_ga           1
+%if %{is_ga}
+%global build_type GA
+%global ea_designator ""
+%global ea_designator_zip %{nil}
+%global extraver %{nil}
+%global eaprefix %{nil}
+%else
+%global build_type EA
+%global ea_designator ea
+%global ea_designator_zip -%{ea_designator}
+%global extraver .%{ea_designator}
+%global eaprefix 0.
+%endif
+
+# Date devkit RPMs were download
+%global rpm_download_date 20250117
+
+Name: openjdk-devkit
+Version: 1.0
+Release: 9%{?dist}
+License: GPLv2
+URL: http://openjdk.java.net/
+Summary: OpenJDK Devkit
+
+# The source tarball, generated using generate_source_tarball.sh
+Source0: https://openjdk-sources.osci.io/openjdk%{featurever}/open%{vcstag}%{ea_designator_zip}.tar.xz
+# The buildroot RPMs for each architecture
+Source1: devkit-rpms-aarch64-%{rpm_download_date}.tar.xz
+Source2: devkit-rpms-ppc64le-%{rpm_download_date}.tar.xz
+Source3: devkit-rpms-s390x-%{rpm_download_date}.tar.xz
+Source4: devkit-rpms-x86_64-%{rpm_download_date}.tar.xz
+# Toolchain sources
+Source5: binutils-2.39.tar.gz
+Source6: gcc-11.3.0.tar.xz
+Source7: gmp-6.2.1.tar.bz2
+Source8: mpc-1.2.1.tar.gz
+Source9: mpfr-4.1.1.tar.bz2
+Source10: gdb-11.2.tar.xz
+
+# Devkit patches; see https://github.com/rh-openjdk/jdk/tree/devkit
+# To regenerate, use git format-patch -N jdk21u/master
+# Add RHEL RPM URLs and turn off robots
+Patch0: 0001-Allow-devkit-to-work-with-RHEL.patch
+# Turn off multilib on x86_64
+Patch1: 0002-Disable-multilib-on-x86_64.patch
+# Improve build logging (OPENJDK-3071)
+Patch2: 0003-Log-devkit-build-to-stdout.patch
+# Remove .comment sections from sysroot objects
+Patch3: 0004-devkit-Remove-.comment-sections-from-sysroot-objects.patch
+# Configure binutils with --enable-deterministic-archives
+Patch4: 0005-Tools.gmk-Configure-binutils-with-enable-determinist.patch
+# Configure gcc with --enable-linker-build-id (OPENJDK-3068)
+Patch5: 0006-Tools.gmk-Add-enable-linker-build-id-to-gcc-build.patch
+# Exclude systemtap-sdt-devel on s390x & ppc64* (OPENJDK-3070)
+Patch6: 0007-Tools.gmk-Exclude-systemtap-sdt-devel-on-s390x-ppc64.patch
+# Use update repository on RHEL rather than GA (OPENJDK-3589)
+Patch7: 0008-Tools.gmk-Use-update-repository-on-RHEL-rather-than-.patch
+
+BuildRequires: make autoconf automake libtool gcc gcc-c++ wget glibc-devel texinfo tar bison
+
+# Setup variables to reference correct sources
+%ifarch %{aarch64}
+%global rpmtarball %{SOURCE1}
+%endif
+%ifarch ppc64le
+%global rpmtarball %{SOURCE2}
+%endif
+%ifarch s390x
+%global rpmtarball %{SOURCE3}
+%endif
+%ifarch x86_64
+%global rpmtarball %{SOURCE4}
+%endif
+
+%description
+OpenJDK Devkit
+
+%prep
+
+# Unpack OpenJDK sources only in build directory
+%setup -q -T -c -a 0
+
+# This syntax is deprecated:
+#    %patchN [...]
+# and should be replaced with:
+#    %patch -PN [...]
+# For example:
+#    %patch1001 -p1
+# becomes:
+#    %patch -P1001 -p1
+# The replacement format suggested by recent (circa Fedora 38) RPM
+# deprecation messages:
+#    %patch N [...]
+# is not backward-compatible with prior (circa RHEL-8) versions of
+# rpmbuild.
+pushd jdk-*
+%patch -P0 -p1
+%patch -P1 -p1
+%patch -P2 -p1
+%patch -P3 -p1
+%patch -P4 -p1
+%patch -P5 -p1
+%patch -P6 -p1
+%patch -P7 -p1
+popd
+
+mkdir -p devkit/download
+pushd devkit/download
+tar -xJf %{rpmtarball}
+ln -s %{SOURCE5}
+ln -s %{SOURCE6}
+ln -s %{SOURCE7}
+ln -s %{SOURCE8}
+ln -s %{SOURCE9}
+ln -s %{SOURCE10}
+
+%build
+
+devkit_dir=$(pwd)/devkit
+today=$(date +%Y%m%d)
+arch=%{_target_cpu}
+result_name=${arch}-linux-gnu-to-${arch}-linux-gnu
+result_path=result/${result_name}
+
+pushd jdk-*/make/devkit
+
+# Build devkit first using the native toolchain,
+# than again using itself
+for variant in bootstrap product ; do
+    if [ -e ${devkit_dir}-bootstrap/${result_path}/bin/gcc ] ; then
+        ROOTDIR=${devkit_dir}-bootstrap/${result_path};
+        BINDIR=${ROOTDIR}/bin;
+        TOOLS="CC=${BINDIR}/gcc CXX=${BINDIR}/g++ LD=${BINDIR}/ld \
+               AR=${BINDIR}/ar AS=${BINDIR}/as RANLIB=${BINDIR}/ranlib \
+               OBJDUMP=${BINDIR}/objdump"
+        LIBPATH="${ROOTDIR}/lib64:${ROOTDIR}/lib"
+    else
+        TOOLS="CC=$(which gcc) CXX=$(which g++) LD=$(which ld) \
+               AR=$(which ar) AS=$(which as) RANLIB=$(which ranlib) \
+               OBJDUMP=$(which objdump)"
+    fi
+    mkdir -p ${devkit_dir}-${variant}
+    ln -s ${devkit_dir}/download ${devkit_dir}-${variant}
+    LD_LIBRARY_PATH="${LIBPATH}" \
+        make -f Tools.gmk all ${TOOLS} \
+        HOST=${arch}-linux-gnu \
+        BUILD=${arch}-linux-gnu \
+        RESULT=${devkit_dir}-${variant}/result \
+        OUTPUT_ROOT=${devkit_dir}-${variant} \
+        TARGET=${arch}-linux-gnu \
+        PREFIX=${devkit_dir}-${variant}/${result_path} \
+        BASE_OS=RHEL
+done
+
+make -r -f Tars.gmk \
+     SRC_DIR=${devkit_dir}-product/${result_path} \
+     TAR_FILE=${devkit_dir}-product/result/sdk-${result_name}-${today}.tar.gz
+popd
+
+%install
+mkdir -p %{buildroot}%{_datadir}/%{name}
+cp -p devkit-product/result/*.tar.gz %{buildroot}%{_datadir}/%{name}/
+
+%files
+%{_datadir}/%{name}
+
+%changelog
+* Fri Jan 17 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-9
+- Update devkit RPMs to latest updates
+- Exclude SystemTap RPMs from s390x and ppc64le
+- Add a date stamp to the RPM bundles
+- Resolves: OPENJDK-3070
+= Resolves: OPENJDK-3589
+
+* Wed Nov 27 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-8
+- Add --enable-linker-build-id to gcc build
+- Resolves: OPENJDK-3068
+
+* Wed Oct 30 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-7
+- Improve build logging by also writing to stdout
+- Cleanup patches and rebase on jdk-21.0.5-ga
+- Drop JDK-8323671 patch which is upstream as of 21.0.3+3
+- Resolves: OPENJDK-3071
+
+* Tue Jun 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-6
+- Fix typo where 'as' binary is accidentally capitalised in AS=<path>/as
+
+* Wed May 01 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-5
+- Bootstrap the devkit, building it again with itself
+
+* Mon Apr 08 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-4
+- Include Thomas' patches to drop .comment sections and build binutils with deterministic archives
+- Use backward-compatible patch syntax
+
+* Tue Feb 06 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-3
+- Include JDK-8323671 patch so the binaries don't contain the full source path
+
+* Fri Dec 08 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-2
+- Try to turn off multlib on x86_64 as we don't have the dependencies for it
+
+* Tue Dec 05 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-1
+- Create RHEL 7 based devkit for building OpenJDK
--- a/scripts/get_bundle_versions.sh
+++ b/scripts/get_bundle_versions.sh
@ -0,0 +1,172 @@
+#!/usr/bin/env sh
+
+# Copyright (C) 2025 Red Hat, Inc.
+# Original written by Antonio Vieiro <avieirov@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+if [ $# -ne 1 ]; then
+    echo "Usage: $0 openjdk-root-directory"
+    exit 1
+fi
+
+JDKROOT=$1
+
+if [ ! -d "${JDKROOT}" ] ; then
+    echo "${JDKROOT} is not a directory.";
+    exit 2
+fi
+
+# Work out the OpenJDK version
+# OpenJDK >= 10 has its version in the build machinery
+# OpenJDK >= 17 stores it in a new location (JDK-8258246)
+VERSION_FILE="${JDKROOT}"/make/conf/version-numbers.conf
+printf "Checking for %s..." "${VERSION_FILE}";
+if [ ! -f "${VERSION_FILE}" ] ; then
+    VERSION_FILE="${JDKROOT}"/make/autoconf/version-numbers
+    echo "Not found; using old version file ${VERSION_FILE}";
+else
+    echo "found.";
+fi
+if [ -e "${VERSION_FILE}" ] ; then
+    openjdk_version=$(grep '^DEFAULT_VERSION_FEATURE' "${VERSION_FILE}" | cut -d '=' -f 2)
+elif [ -e "${JDKROOT}"/jdk/src/java.base/share/classes/java/lang/Object.java ] ; then
+    openjdk_version=9;
+elif [ -e "${JDKROOT}"/common/autoconf ] ; then
+    openjdk_version=8;
+else
+    openjdk_version=7;
+fi
+echo "OpenJDK version: ${openjdk_version}";
+
+#
+# Freetype
+#
+if [ "${openjdk_version}" -gt 8 ] ; then
+    FREETYPE=src/java.desktop/share/native/libfreetype/include/freetype/freetype.h
+    ABS_FREETYPE="${JDKROOT}"/"${FREETYPE}"
+    if [ ! -f "${ABS_FREETYPE}" ]; then
+        echo "Freetype header not found!"
+        exit 2
+    fi
+    FREETYPE_VERSION=$(awk '/#define FREETYPE_MAJOR/ {MAJOR=$3} /#define FREETYPE_MINOR/ {MINOR=$3} /#define FREETYPE_PATCH/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_FREETYPE}")
+else
+    echo "No bundled FreeType on ${openjdk_version}";
+fi
+
+# giflib
+if [ "${openjdk_version}" -gt 8 ] ; then
+    GIFLIB=src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
+else
+    GIFLIB=jdk/src/share/native/sun/awt/giflib/gif_lib.h
+fi
+ABS_GIFLIB="${JDKROOT}"/"${GIFLIB}"
+if [ ! -f "${ABS_GIFLIB}" ]; then
+    echo "giflib header not found!"
+    exit 3
+fi
+GIFLIB_VERSION=$(awk '/#define GIFLIB_MAJOR/ {MAJOR=$3} /#define GIFLIB_MINOR/ {MINOR=$3} /#define GIFLIB_RELEASE/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_GIFLIB}")
+
+# harfbuzz
+if [ "${openjdk_version}" -gt 8 ] ; then
+    HARFBUZZ=src/java.desktop/share/native/libharfbuzz/hb-version.h
+    ABS_HARFBUZZ="${JDKROOT}/${HARFBUZZ}"
+    if [ ! -f "${ABS_HARFBUZZ}" ]; then
+        echo "HarfBuzz header not found!"
+        exit 4
+    fi
+    HARFBUZZ_VERSION=$(awk '/#define HB_VERSION_MAJOR/ {MAJOR=$3} /#define HB_VERSION_MINOR/ {MINOR=$3} /#define HB_VERSION_MICRO/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_HARFBUZZ}")
+else
+    echo "No HarfBuzz on ${openjdk_version}";
+fi
+
+# lcms
+if [ "${openjdk_version}" -gt 8 ] ; then
+    LCMS=src/java.desktop/share/native/liblcms/lcms2.h
+else
+    LCMS=jdk/src/share/native/sun/java2d/cmm/lcms/lcms2.h
+fi
+ABS_LCMS="${JDKROOT}"/"${LCMS}"
+if [ ! -f "${ABS_LCMS}" ]; then
+    echo "lcms header not found!"
+    exit 5
+fi
+LCMS_VERSION=$(awk '/#define LCMS_VERSION/ { MAJOR=int($3 / 1000); REST=$3 % 1000; MINOR=int(REST / 10); PATCH=REST % 10; } END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_LCMS}")
+
+# jpeg
+if [ "${openjdk_version}" -gt 8 ] ; then
+    JPEG=src/java.desktop/share/native/libjavajpeg/jpeglib.h
+else
+    JPEG=jdk/src/share/native/sun/awt/image/jpeg/jpeglib.h
+fi
+ABS_JPEG="${JDKROOT}"/"${JPEG}"
+if [ ! -f "${ABS_JPEG}" ]; then
+    echo "jpeg header not found!"
+    exit 6
+fi
+JPEG_VERSION=$(awk '/#define JPEG_LIB_VERSION/ { VERSION=$3; MAJOR=int(VERSION / 10); MINOR=VERSION%10; } END {printf "%s%c", MAJOR, (MINOR+96)}' "${ABS_JPEG}")
+
+# png
+if [ "${openjdk_version}" -gt 8 ] ; then
+    PNG=src/java.desktop/share/native/libsplashscreen/libpng/png.h
+else
+    PNG=jdk/src/share/native/sun/awt/libpng/png.h
+fi
+ABS_PNG="${JDKROOT}"/"${PNG}"
+if [ ! -f "${ABS_PNG}" ]; then
+    echo "png header not found!"
+    exit 7
+fi
+PNG_VERSION=$(awk '/#define PNG_LIBPNG_VER_STRING/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_PNG}")
+
+# zlib
+if [ "${openjdk_version}" -gt 8 ] ; then
+    ZLIB=src/java.base/share/native/libzip/zlib/zlib.h
+else
+    ZLIB=jdk/src/share/native/java/util/zip/zlib/zlib.h
+fi
+ABS_ZLIB="${JDKROOT}"/"${ZLIB}"
+if [ ! -f "${ABS_ZLIB}" ]; then
+    echo "zlib header not found!"
+    exit 8
+fi
+ZLIB_VERSION=$(awk '/#define ZLIB_VERSION/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_ZLIB}")
+
+# Print output
+printf "\nRPM definitions:\n"
+if [ "${openjdk_version}" -gt 8 ] ; then
+    echo "# Version in ${FREETYPE}"
+    echo "Provides: bundled(freetype) = ${FREETYPE_VERSION}"
+fi
+echo "# Version in ${GIFLIB}"
+echo "Provides: bundled(giflib) = ${GIFLIB_VERSION}"
+if [ "${openjdk_version}" -gt 8 ] ; then
+    echo "# Version in ${HARFBUZZ}"
+    echo "Provides: bundled(harfbuzz) = ${HARFBUZZ_VERSION}"
+fi
+echo "# Version in ${LCMS}"
+echo "Provides: bundled(lcms2) = ${LCMS_VERSION}"
+echo "# Version in ${JPEG}"
+echo "Provides: bundled(libjpeg) = ${JPEG_VERSION}"
+echo "# Version in ${PNG}"
+echo "Provides: bundled(libpng) = ${PNG_VERSION}"
+echo "# Version in ${ZLIB}"
+echo "Provides: bundled(zlib) = ${ZLIB_VERSION}"
+
+# Local Variables:
+# compile-command: "shellcheck get_bundle_versions.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
--- a/scripts/openjdk_news.sh
+++ b/scripts/openjdk_news.sh
@ -69,12 +69,43 @@ do
    fi
 done

-sort "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" | uniq > "${TMPDIR}/fixes"
+sort "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" > "${TMPDIR}/fixes4"
+uniq "${TMPDIR}/fixes4" > "${TMPDIR}/fixes"
 rm -f "${TMPDIR}/fixes2" "${TMPDIR}/fixes3"

+if ! [ -s "${TMPDIR}/fixes" ] ; then
+    echo "Failed to obtain fixes.";
+    exit 3;
+fi
+
 echo "In ${TMPDIR}/fixes:"
 cat "${TMPDIR}/fixes"

+printf "\nChecking for duplicates...";
+if uniq -d "${TMPDIR}/fixes4" | grep 'JDK' > "${TMPDIR}/dupes"; then
+    printf "found.\nWARNING: Review the following duplicates:\n";
+    cat "${TMPDIR}/dupes";
+else
+    echo "No apparent duplicates.";
+fi
+rm -f "${TMPDIR}/fixes4";
+
+printf "\nChecking for backouts...";
+if grep -i 'backout' "${TMPDIR}/fixes" > "${TMPDIR}/backouts"; then
+    printf "found.\nWARNING: Review the following backouts:\n"
+    cat "${TMPDIR}/backouts";
+else
+    echo "No apparent backouts.";
+fi
+printf "\nChecking for bundled library updates...";
+if grep -iE ':( \(tz\))? update.*(freetype|gif|harfbuzz|lcms|jpeg|png|timezone|zlib)' "${TMPDIR}/fixes" > "${TMPDIR}/bundles"; then
+    printf "found.\nWARNING: Review the following with respect to bundled provides:\n";
+    cat "${TMPDIR}/bundles";
+    echo "Compare the output of $(dirname "${0}")/get_bundle_versions.sh with the RPM using the JDK source tree"
+else
+    echo "No apparent library updates.";
+fi
+
 # Local Variables:
 # compile-command: "shellcheck openjdk_news.sh"
 # fill-column: 80
--- a/2
+++ b/2
@ -1,2 +1,2 @@
 SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
-SHA512 (openjdk-21.0.5+11.tar.xz) = f416e746593589cc7d37dbde55098038412939947c41c05baf2da31e44c42d0242cb8f6a4a5659d3d7b9a27e775d9ef375f754acda5e143ada5987e288dbe87a
+SHA512 (openjdk-21.0.8+9.tar.xz) = 81be6d151fdca910fbee9ea1a93b20af037d2dbafeb12fa368a6091096a22dcf997cf419bebe0261f016ce0fe1e74acd4fca54ca0840a3d69ad76ae7a1336e4c