18 changed files with 2030 additions and 282 deletions
--- a/.gitignore
+++ b/.gitignore
@ -26,3 +26,11 @@
 /openjdk-21.0.5+9-ea.tar.xz
 /openjdk-21.0.5+10.tar.xz
 /openjdk-21.0.5+11.tar.xz
+/openjdk-21.0.6+6-ea.tar.xz
+/openjdk-21.0.6+7.tar.xz
+/openjdk-21.0.7+1-ea.tar.xz
+/openjdk-21.0.7+2-ea.tar.xz
+/openjdk-21.0.7+3-ea.tar.xz
+/openjdk-21.0.7+4-ea.tar.xz
+/openjdk-21.0.7+5-ea.tar.xz
+/openjdk-21.0.7+6.tar.xz
--- a/0001-Allow-devkit-to-work-with-RHEL.patch
+++ b/0001-Allow-devkit-to-work-with-RHEL.patch
@ -0,0 +1,54 @@
+From 7733d625ebdea5a6f323a0c5944fb8ab728d1b2b Mon Sep 17 00:00:00 2001
+From: Andrew Hughes <gnu.andrew@redhat.com>
+Date: Sat, 25 Nov 2023 17:29:36 +0000
+Subject: [PATCH] Allow devkit to work with RHEL
+
+---
+ make/devkit/Makefile  |  2 +-
+ make/devkit/Tools.gmk | 10 +++++++++-
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/make/devkit/Makefile b/make/devkit/Makefile
+index c85a7c21d29..8f69d23c325 100644
+--- a/make/devkit/Makefile
+++ b/make/devkit/Makefile
+@@ -58,7 +58,7 @@
+ COMMA := ,
+ 
+ os := $(shell uname -o)
+-cpu := $(shell uname -p)
+cpu := $(shell uname -m)
+ 
+ # Figure out what platform this is building on.
+ me := $(cpu)-$(if $(findstring Linux,$(os)),linux-gnu)
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index 187320ca26e..001f4b1870c 100644
+--- a/make/devkit/Tools.gmk
+++ b/make/devkit/Tools.gmk
+@@ -62,6 +62,14 @@ ifeq ($(BASE_OS), OL)
+     BASE_URL := http://yum.oracle.com/repo/OracleLinux/OL6/4/base/$(ARCH)/
+     LINUX_VERSION := OL6.4
+   endif
+else ifeq ($(BASE_OS), RHEL)
+  ifeq ($(ARCH), aarch64)
+    BASE_URL := https://download.eng.brq.redhat.com/rhel-7/rel-eng/RHEL-7/latest-RHEL-ALT-7/compose/Server/$(ARCH)/os/Packages/
+    LINUX_VERSION := RHEL7.6
+  else
+    BASE_URL := https://download.eng.brq.redhat.com/rhel-7/rel-eng/RHEL-7/latest-RHEL-7/compose/Server/$(ARCH)/os/Packages/
+    LINUX_VERSION := RHEL7.9
+  endif
+ else ifeq ($(BASE_OS), Fedora)
+   ifeq ($(ARCH), riscv64)
+     DEFAULT_OS_VERSION := rawhide/68692
+@@ -246,7 +254,7 @@ download-rpms:
+         # Only run this if rpm dir is empty.
+         ifeq ($(wildcard $(DOWNLOAD_RPMS)/*.rpm), )
+ 	  cd $(DOWNLOAD_RPMS) && \
+-	      wget -r -np -nd $(patsubst %, -A "*%*.rpm", $(RPM_LIST)) $(BASE_URL)
+	      wget -r -e robots=off -np -nd $(patsubst %, -A "*%*.rpm", $(RPM_LIST)) $(BASE_URL)
+         endif
+ 
+ ##########################################################################################
+-- 
+2.45.2
+
--- a/0002-Disable-multilib-on-x86_64.patch
+++ b/0002-Disable-multilib-on-x86_64.patch
@ -0,0 +1,50 @@
+From e55afc691c0105623e04a6e76369cf1438afb874 Mon Sep 17 00:00:00 2001
+From: Andrew Hughes <gnu.andrew@redhat.com>
+Date: Fri, 8 Dec 2023 21:22:02 +0000
+Subject: [PATCH] Disable multilib on x86_64
+
+---
+ make/devkit/Tools.gmk | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index 001f4b1870c..9ede781413d 100644
+--- a/make/devkit/Tools.gmk
+++ b/make/devkit/Tools.gmk
+@@ -225,13 +225,7 @@ RPM_LIST := \
+ ##########################################################################################
+ # Define common directories and files
+ 
+-# Ensure we have 32-bit libs also for x64. We enable mixed-mode.
+-ifeq (x86_64,$(ARCH))
+-  LIBDIRS := lib64 lib
+-  CFLAGS_lib := -m32
+-else
+-  LIBDIRS := lib
+-endif
+LIBDIRS := lib
+ 
+ # Define directories
+ BUILDDIR := $(OUTPUT_ROOT)/$(HOST)/$(TARGET)
+@@ -289,8 +283,7 @@ $(foreach p,GCC BINUTILS CCACHE MPFR GMP MPC GDB,$(eval $(call Download,$(p))))
+ 
+ RPM_ARCHS := $(ARCH) noarch
+ ifeq ($(ARCH),x86_64)
+-  # Enable mixed mode.
+-  RPM_ARCHS += i386 i686
+  RPM_ARCHS += i686
+ else ifeq ($(ARCH),i686)
+   RPM_ARCHS += i386
+ else ifeq ($(ARCH), armhfp)
+@@ -526,7 +519,7 @@ ifeq ($(ARCH), armhfp)
+   $(BUILDDIR)/$(gcc_ver)/Makefile : CONFIG +=  --with-float=hard
+ endif
+ 
+-ifneq ($(filter riscv64 ppc64 ppc64le s390x, $(ARCH)), )
+ifneq ($(filter riscv64 ppc64 ppc64le s390x x86_64, $(ARCH)), )
+   # We only support 64-bit on these platforms anyway
+   CONFIG += --disable-multilib
+ endif
+-- 
+2.45.2
+
--- a/0003-Log-devkit-build-to-stdout.patch
+++ b/0003-Log-devkit-build-to-stdout.patch
@ -0,0 +1,92 @@
+From fbc27183b35df7778cf106450b144474f8e2a35c Mon Sep 17 00:00:00 2001
+From: Andrew Hughes <gnu.andrew@redhat.com>
+Date: Wed, 30 Oct 2024 00:42:06 +0000
+Subject: [PATCH] Log devkit build to stdout
+
+Resolves: OPENJDK-3071
+---
+ make/devkit/Tools.gmk | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index 9ede781413d..b6f895f5a25 100644
+--- a/make/devkit/Tools.gmk
+++ b/make/devkit/Tools.gmk
+@@ -458,7 +458,7 @@ $(BUILDDIR)/$(binutils_ver)/Makefile \
+ 	      --enable-multilib \
+ 	      --enable-threads \
+ 	      --enable-plugins \
+-	) > $(@D)/log.config 2>&1
+	) 2>&1 | tee $(@D)/log.config 
+ 	@echo 'done'
+ 
+ $(BUILDDIR)/$(mpfr_ver)/Makefile \
+@@ -473,7 +473,7 @@ $(BUILDDIR)/$(mpfr_ver)/Makefile \
+ 	      --program-prefix=$(TARGET)- \
+ 	      --enable-shared=no \
+ 	      --with-gmp=$(PREFIX) \
+-	) > $(@D)/log.config 2>&1
+	) 2>&1 | tee $(@D)/log.config
+ 	@echo 'done'
+ 
+ $(BUILDDIR)/$(gmp_ver)/Makefile \
+@@ -490,7 +490,7 @@ $(BUILDDIR)/$(gmp_ver)/Makefile \
+ 	      --program-prefix=$(TARGET)- \
+ 	      --enable-shared=no \
+ 	      --with-mpfr=$(PREFIX) \
+-	) > $(@D)/log.config 2>&1
+	) 2>&1 | tee $(@D)/log.config
+ 	@echo 'done'
+ 
+ $(BUILDDIR)/$(mpc_ver)/Makefile \
+@@ -506,7 +506,7 @@ $(BUILDDIR)/$(mpc_ver)/Makefile \
+ 	      --enable-shared=no \
+ 	      --with-mpfr=$(PREFIX) \
+ 	      --with-gmp=$(PREFIX) \
+-	) > $(@D)/log.config 2>&1
+	) 2>&1 | tee $(@D)/log.config
+ 	@echo 'done'
+ 
+ # Only valid if glibc target -> linux
+@@ -549,7 +549,7 @@ $(BUILDDIR)/$(gcc_ver)/Makefile \
+ 	      --with-mpfr=$(PREFIX) \
+ 	      --with-gmp=$(PREFIX) \
+ 	      --with-mpc=$(PREFIX) \
+-	) > $(@D)/log.config 2>&1
+	) 2>&1 | tee $(@D)/log.config
+ 	@echo 'done'
+ 
+ # need binutils for gcc
+@@ -571,7 +571,7 @@ ifeq ($(HOST), $(TARGET))
+ 	  $(PATHPRE) $(ENVS) CFLAGS="$(CFLAGS)" $(GDB_CFG) \
+ 	      $(CONFIG) \
+ 	      --with-sysroot=$(SYSROOT) \
+-	) > $(@D)/log.config 2>&1
+	) 2>&1 | tee $(@D)/log.config
+ 	@echo 'done'
+ 
+   $(gdb): $(gcc)
+@@ -593,7 +593,7 @@ $(BUILDDIR)/$(ccache_ver)/Makefile \
+ 	  cd $(@D) ; \
+ 	  $(PATHPRE) $(ENVS) $(CCACHE_CFG) \
+ 	      $(CONFIG) \
+-	) > $(@D)/log.config 2>&1
+	) 2>&1 | tee $(@D)/log.config
+ 	@echo 'done'
+ 
+ gccpatch = $(TARGETDIR)/gcc-patched
+@@ -641,9 +641,9 @@ endif
+ # Always need to build cross tools for build host self.
+ $(TARGETDIR)/%.done : $(BUILDDIR)/%/Makefile
+ 	$(info Building $(basename $@). Log in $(<D)/log.build)
+-	$(PATHPRE) $(ENVS) $(MAKE) $(BUILDPAR) -f $< -C $(<D) $(MAKECMD) $(MAKECMD.$(notdir $@)) > $(<D)/log.build 2>&1
+	$(PATHPRE) $(ENVS) $(MAKE) $(BUILDPAR) -f $< -C $(<D) $(MAKECMD) $(MAKECMD.$(notdir $@)) 2>&1 | tee $(<D)/log.build
+ 	@echo -n 'installing...'
+-	$(PATHPRE) $(MAKE) $(INSTALLPAR) -f $< -C $(<D) $(INSTALLCMD) $(MAKECMD.$(notdir $@)) > $(<D)/log.install 2>&1
+	$(PATHPRE) $(MAKE) $(INSTALLPAR) -f $< -C $(<D) $(INSTALLCMD) $(MAKECMD.$(notdir $@)) 2>&1 | tee $(<D)/log.install
+ 	@mkdir -p $(@D)
+ 	@touch $@
+ 	@echo 'done'
+-- 
+2.45.2
+
--- a/0004-devkit-Remove-.comment-sections-from-sysroot-objects.patch
+++ b/0004-devkit-Remove-.comment-sections-from-sysroot-objects.patch
@ -0,0 +1,41 @@
+From 3d81d23118aab95214e24ccc81eff61ac245a1ac Mon Sep 17 00:00:00 2001
+From: Thomas Fitzsimmons <fitzsim@redhat.com>
+Date: Wed, 20 Mar 2024 13:01:47 -0400
+Subject: [PATCH] devkit: Remove .comment sections from sysroot objects
+
+Otherwise the comment sections of C runtime objects, including those
+in static libraries like libc_nonshared.a, contribute RPM package
+version strings to the .comment section in devkit-produced binaries
+and libraries.  These RPM package strings change frequently, even
+across minor toolchain updates.  Their presence interferes when
+comparing binaries built with devkits that use different sysroot RPM
+package sets.
+---
+ make/devkit/Tools.gmk | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index b6f895f5a25..37ea1a6a287 100644
+--- a/make/devkit/Tools.gmk
+++ b/make/devkit/Tools.gmk
+@@ -324,6 +324,9 @@ $(foreach p,$(RPM_FILE_LIST),$(eval $(call unrpm,$(p))))
+ # have it anyway, but just to make sure...
+ # Patch libc.so and libpthread.so to force linking against libraries in sysroot
+ # and not the ones installed on the build machine.
+# Remove comment sections from static libraries and C runtime objects
+# to prevent leaking RHEL-specific package versions into
+# devkit-produced binaries.
+ $(libs) : $(rpms)
+ 	@echo Patching libc and pthreads
+ 	@(for f in `find $(SYSROOT) -name libc.so -o -name libpthread.so`; do \
+@@ -333,6 +336,7 @@ $(libs) : $(rpms)
+ 	      -e 's|/lib/||g' ) > $$f.tmp ; \
+ 	  mv $$f.tmp $$f ; \
+ 	done)
+	@find $(SYSROOT) -name '*.[ao]' -exec objcopy --remove-section .comment '{}' ';'
+ 	@mkdir -p $(SYSROOT)/usr/lib
+ 	@touch $@
+ 
+-- 
+2.45.2
+
--- a/0005-Tools.gmk-Configure-binutils-with-enable-determinist.patch
+++ b/0005-Tools.gmk-Configure-binutils-with-enable-determinist.patch
@ -0,0 +1,35 @@
+From c370e1194c707f3f6c470e147ec497cc4e76957e Mon Sep 17 00:00:00 2001
+From: Thomas Fitzsimmons <fitzsim@redhat.com>
+Date: Fri, 22 Mar 2024 16:03:17 -0400
+Subject: [PATCH] Tools.gmk: Configure binutils with
+ --enable-deterministic-archives
+
+---
+ make/devkit/Tools.gmk | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index 37ea1a6a287..22c6007000b 100644
+--- a/make/devkit/Tools.gmk
+++ b/make/devkit/Tools.gmk
+@@ -445,6 +445,9 @@ endif
+ 
+ # Makefile creation. Simply run configure in build dir.
+ # Setting CFLAGS to -O2 generates a much faster ld.
+# Use --enable-deterministic-archives so that make targets that
+# generate "ar" archives, such as "static-libs-image", produce
+# deterministic .a files.
+ $(bfdmakes) \
+ $(BUILDDIR)/$(binutils_ver)/Makefile \
+     : $(BINUTILS_CFG)
+@@ -459,6 +462,7 @@ $(BUILDDIR)/$(binutils_ver)/Makefile \
+ 	      --with-sysroot=$(SYSROOT) \
+ 	      --disable-nls \
+ 	      --program-prefix=$(TARGET)- \
+	      --enable-deterministic-archives \
+ 	      --enable-multilib \
+ 	      --enable-threads \
+ 	      --enable-plugins \
+-- 
+2.45.2
+
--- a/0006-Tools.gmk-Add-enable-linker-build-id-to-gcc-build.patch
+++ b/0006-Tools.gmk-Add-enable-linker-build-id-to-gcc-build.patch
@ -0,0 +1,35 @@
+From 5958274571b957617d0572101a92217fd5b2f312 Mon Sep 17 00:00:00 2001
+From: Andrew Hughes <gnu.andrew@redhat.com>
+Date: Wed, 27 Nov 2024 17:04:19 +0000
+Subject: [PATCH] Tools.gmk: Add --enable-linker-build-id to gcc build
+
+This causes --build-id to be passed to the linker, and the
+.note.gnu.build-id section is added (OPENJDK-3068)
+---
+ make/devkit/Tools.gmk | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index 22c6007000b..57d48ec5114 100644
+--- a/make/devkit/Tools.gmk
+++ b/make/devkit/Tools.gmk
+@@ -539,6 +539,8 @@ endif
+ # skip native language.
+ # and link and assemble with the binutils we created
+ # earlier, so --with-gnu*
+# Add --enable-linker-build-id so the .note.gnu.build-id
+# section is added by the linker (OPENJDK-3068)
+ $(BUILDDIR)/$(gcc_ver)/Makefile \
+     : $(GCC_CFG)
+ 	$(info Configuring $@. Log in $(@D)/log.config)
+@@ -557,6 +559,7 @@ $(BUILDDIR)/$(gcc_ver)/Makefile \
+ 	      --with-mpfr=$(PREFIX) \
+ 	      --with-gmp=$(PREFIX) \
+ 	      --with-mpc=$(PREFIX) \
+	      --enable-linker-build-id \
+ 	) 2>&1 | tee $(@D)/log.config
+ 	@echo 'done'
+ 
+-- 
+2.45.2
+
--- a/0007-Tools.gmk-Exclude-systemtap-sdt-devel-on-s390x-ppc64.patch
+++ b/0007-Tools.gmk-Exclude-systemtap-sdt-devel-on-s390x-ppc64.patch
@ -0,0 +1,38 @@
+From 2617c050a909265444b32063b2d271eca42dcaa6 Mon Sep 17 00:00:00 2001
+From: Andrew Hughes <gnu.andrew@redhat.com>
+Date: Fri, 17 Jan 2025 21:11:01 +0000
+Subject: [PATCH] Tools.gmk: Exclude systemtap-sdt-devel on s390x & ppc64*
+
+There is no DTrace support on s390x (JDK-8305174) and ppc64
+(JDK-8304867) so we don't need the RPMs. They also cause issues with
+static linkage of libstdc++.a on s390x. It fails with 'error:
+relocation refers to local symbol "" [9], which is defined in a
+discarded section'.
+
+Resolves: OPENJDK-3070
+---
+ make/devkit/Tools.gmk | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index 57d48ec5114..07928f69ceb 100644
+--- a/make/devkit/Tools.gmk
+++ b/make/devkit/Tools.gmk
+@@ -219,9 +219,13 @@ RPM_LIST := \
+     zlib zlib-devel \
+     libffi libffi-devel \
+     fontconfig fontconfig-devel \
+-    systemtap-sdt-devel \
+     #
+ 
+# Only include SystemTap on supported architectures
+ifeq ($(filter ppc64 ppc64le s390x, $(ARCH)), )
+  RPM_LIST += systemtap-sdt-devel
+endif
+
+ ##########################################################################################
+ # Define common directories and files
+ 
+-- 
+2.45.2
+
--- a/0008-Tools.gmk-Use-update-repository-on-RHEL-rather-than-.patch
+++ b/0008-Tools.gmk-Use-update-repository-on-RHEL-rather-than-.patch
@ -0,0 +1,33 @@
+From 9766818f55726cea630b432f09cce8f9c17c014d Mon Sep 17 00:00:00 2001
+From: Andrew Hughes <gnu.andrew@redhat.com>
+Date: Fri, 17 Jan 2025 21:27:58 +0000
+Subject: [PATCH] Tools.gmk: Use update repository on RHEL rather than GA
+
+It looks like we were using 7.6 & 7.9 GA repositories rather than
+the latest updates.
+
+Resolves: OPENJDK-3589
+---
+ make/devkit/Tools.gmk | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index 07928f69ceb..5b39560ab11 100644
+--- a/make/devkit/Tools.gmk
+++ b/make/devkit/Tools.gmk
+@@ -64,10 +64,10 @@ ifeq ($(BASE_OS), OL)
+   endif
+ else ifeq ($(BASE_OS), RHEL)
+   ifeq ($(ARCH), aarch64)
+-    BASE_URL := https://download.eng.brq.redhat.com/rhel-7/rel-eng/RHEL-7/latest-RHEL-ALT-7/compose/Server/$(ARCH)/os/Packages/
+    BASE_URL := https://download.eng.brq.redhat.com/rhel-7/rel-eng/updates/RHEL-ALT-7/latest-RHEL-ALT-7/compose/Server/$(ARCH)/os/Packages/
+     LINUX_VERSION := RHEL7.6
+   else
+-    BASE_URL := https://download.eng.brq.redhat.com/rhel-7/rel-eng/RHEL-7/latest-RHEL-7/compose/Server/$(ARCH)/os/Packages/
+    BASE_URL := https://download.eng.brq.redhat.com/rhel-7/rel-eng/updates/RHEL-7/latest-RHEL-7/compose/Server/$(ARCH)/os/Packages/
+     LINUX_VERSION := RHEL7.9
+   endif
+ else ifeq ($(BASE_OS), Fedora)
+-- 
+2.45.2
+
--- a/641
+++ b/641
@ -3,6 +3,647 @@ Key:
 JDK-X  - https://bugs.openjdk.java.net/browse/JDK-X
 CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY

+New in release OpenJDK 21.0.7 (2025-04-15):
+===========================================
+Live versions of these release notes can be found at:
+  * https://bit.ly/openjdk2107
+
+* CVEs
+  - CVE-2025-21587
+  - CVE-2025-30691
+  - CVE-2025-30698
+* Changes
+  - JDK-8198237: [macos] Test java/awt/Frame/ExceptionOnSetExtendedStateTest/ExceptionOnSetExtendedStateTest.java fails
+  - JDK-8211851: (ch) java/nio/channels/AsynchronousSocketChannel/StressLoopback.java times out (aix)
+  - JDK-8226933: [TEST_BUG]GTK L&F: There is no swatches or RGB tab in JColorChooser
+  - JDK-8226938: [TEST_BUG]GTK L&F: There is no Details button in FileChooser Dialog
+  - JDK-8227529: With malformed --app-image the error messages are awful
+  - JDK-8277240: java/awt/Graphics2D/ScaledTransform/ScaledTransform.java dialog does not get disposed
+  - JDK-8283664: Remove jtreg tag manual=yesno for java/awt/print/PrinterJob/PrintTextTest.java
+  - JDK-8286875: ProgrammableUpcallHandler::on_entry/on_exit access thread fields from native
+  - JDK-8293345: SunPKCS11 provider checks on PKCS11 Mechanism are problematic
+  - JDK-8294316: SA core file support is broken on macosx-x64 starting with macOS 12.x
+  - JDK-8295159: DSO created with -ffast-math breaks Java floating-point arithmetic
+  - JDK-8302111: Serialization considerations
+  - JDK-8304701: Request with timeout aborts later in-flight request on HTTP/1.1 cxn
+  - JDK-8309841: Jarsigner should print a warning if an entry is removed
+  - JDK-8311546: Certificate name constraints improperly validated with leading period
+  - JDK-8312570: [TESTBUG] Jtreg compiler/loopopts/superword/TestDependencyOffsets.java fails on 512-bit SVE
+  - JDK-8313633: [macOS] java/awt/dnd/NextDropActionTest/NextDropActionTest.java fails with java.lang.RuntimeException: wrong next drop action!
+  - JDK-8313905: Checked_cast assert in CDS compare_by_loader
+  - JDK-8314752: Use google test string comparison macros
+  - JDK-8314909: tools/jpackage/windows/Win8282351Test.java fails with java.lang.AssertionError: Expected [0]. Actual [1618]:
+  - JDK-8315486: vmTestbase/nsk/jdwp/ThreadReference/ForceEarlyReturn/forceEarlyReturn002/forceEarlyReturn002.java timed out
+  - JDK-8315825: Open some swing tests
+  - JDK-8315882: Open some swing tests 2
+  - JDK-8315883: Open source several Swing JToolbar tests
+  - JDK-8315952: Open source several Swing JToolbar JTooltip JTree tests
+  - JDK-8316056: Open source several Swing JTree tests
+  - JDK-8316146: Open some swing tests 4
+  - JDK-8316149: Open source several Swing JTree JViewport KeyboardManager tests
+  - JDK-8316218: Open some swing tests 5
+  - JDK-8316371: Open some swing tests 6
+  - JDK-8316627: JViewport Test headless failure
+  - JDK-8316885: jcmd: Compiler.CodeHeap_Analytics cmd does not inform about missing aggregate
+  - JDK-8317283: jpackage tests run osx-specific checks on windows and linux
+  - JDK-8317636: Improve heap walking API tests to verify correctness of field indexes
+  - JDK-8317808: HTTP/2 stream cancelImpl may leave subscriber registered
+  - JDK-8317919: pthread_attr_init handle return value and destroy pthread_attr_t object
+  - JDK-8319233: AArch64: Build failure with clang due to -Wformat-nonliteral warning
+  - JDK-8320372: test/jdk/sun/security/x509/DNSName/LeadingPeriod.java validity check failed
+  - JDK-8320676: Manual printer tests have no Pass/Fail buttons, instructions close set 1
+  - JDK-8320691: Timeout handler on Windows takes 2 hours to complete
+  - JDK-8320706: RuntimePackageTest.testUsrInstallDir test fails on Linux
+  - JDK-8320916: jdk/jfr/event/gc/stacktrace/TestParallelMarkSweepAllocationPendingStackTrace.java failed with "OutOfMemoryError: GC overhead limit exceeded"
+  - JDK-8321818: vmTestbase/nsk/stress/strace/strace015.java failed with 'Cannot read the array length because "<local4>" is null'
+  - JDK-8322983: Virtual Threads: exclude 2 tests
+  - JDK-8324672: Update jdk/java/time/tck/java/time/TCKInstant.java now() to be more robust
+  - JDK-8324807: Manual printer tests have no Pass/Fail buttons, instructions close set 2
+  - JDK-8324838: test_nmt_locationprinting.cpp broken in the gcc windows build
+  - JDK-8325042: Remove unused JVMDITools test files
+  - JDK-8325529: Remove unused imports from `ModuleGenerator` test file
+  - JDK-8325659: Normalize Random usage by incubator vector tests
+  - JDK-8325937: runtime/handshake/HandshakeDirectTest.java causes "monitor end should be strictly below the frame pointer" assertion failure on AArch64
+  - JDK-8326421: Add jtreg test for large arrayCopy disjoint case.
+  - JDK-8326525: com/sun/tools/attach/BasicTests.java does not verify AgentLoadException case
+  - JDK-8327098: GTest needs larger combination limit
+  - JDK-8327390: JitTester: Implement temporary folder functionality
+  - JDK-8327460: Compile tests with the same visibility rules as product code
+  - JDK-8327476: Upgrade JLine to 3.26.1
+  - JDK-8327505: Test com/sun/jmx/remote/NotificationMarshalVersions/TestSerializationMismatch.java fails
+  - JDK-8327857: Remove applet usage from JColorChooser tests Test4222508
+  - JDK-8327859: Remove applet usage from JColorChooser tests Test4319113
+  - JDK-8327986: ASAN reports use-after-free in DirectivesParserTest.empty_object_vm
+  - JDK-8327994: Update code gen in CallGeneratorHelper
+  - JDK-8328005: Convert java/awt/im/JTextFieldTest.java applet test to main
+  - JDK-8328085: C2: Use after free in PhaseChaitin::Register_Allocate()
+  - JDK-8328121: Remove applet usage from JColorChooser tests Test4759306
+  - JDK-8328130: Remove applet usage from JColorChooser tests Test4759934
+  - JDK-8328185: Convert java/awt/image/MemoryLeakTest/MemoryLeakTest.java applet test to main
+  - JDK-8328227: Remove applet usage from JColorChooser tests Test4887836
+  - JDK-8328368: Convert java/awt/image/multiresolution/MultiDisplayTest/MultiDisplayTest.java applet test to main
+  - JDK-8328370: Convert java/awt/print/Dialog/PrintApplet.java applet test to main
+  - JDK-8328380: Remove applet usage from JColorChooser tests Test6348456
+  - JDK-8328387: Convert java/awt/Frame/FrameStateTest/FrameStateTest.html applet test to main
+  - JDK-8328403: Remove applet usage from JColorChooser tests Test6977726
+  - JDK-8328553: Get rid of JApplet in test/jdk/sanity/client/lib/SwingSet2/src/DemoModule.java
+  - JDK-8328558: Convert javax/swing/JCheckBox/8032667/bug8032667.java applet test to main
+  - JDK-8328717: Convert javax/swing/JColorChooser/8065098/bug8065098.java applet test to main
+  - JDK-8328719: Convert java/awt/print/PageFormat/SetOrient.html applet test to main
+  - JDK-8328730: Convert java/awt/print/bug8023392/bug8023392.html applet test to main
+  - JDK-8328753: Open source few Undecorated Frame tests
+  - JDK-8328819: Remove applet usage from JFileChooser tests bug6698013
+  - JDK-8328827: Convert java/awt/print/PrinterJob/PrinterDialogsModalityTest/PrinterDialogsModalityTest.html applet test to main
+  - JDK-8329210: Delete Redundant Printer Dialog Modality Test
+  - JDK-8329320: Simplify awt/print/PageFormat/NullPaper.java test
+  - JDK-8329322: Convert PageFormat/Orient.java to use PassFailJFrame
+  - JDK-8329692: Add more details to FrameStateTest.java test instructions
+  - JDK-8330647: Two CDS tests fail with -UseCompressedOops and UseSerialGC/UseParallelGC
+  - JDK-8330702: Update failure handler to don't generate Error message if cores actions are empty
+  - JDK-8331735: UpcallLinker::on_exit races with GC when copying frame anchor
+  - JDK-8331959: Update PKCS#11 Cryptographic Token Interface to v3.1
+  - JDK-8331977: Crash: SIGSEGV in dlerror()
+  - JDK-8331993: Add counting leading/trailing zero tests for Integer
+  - JDK-8332158: [XWayland] test/jdk/java/awt/Mouse/EnterExitEvents/ResizingFrameTest.java
+  - JDK-8332494: java/util/zip/EntryCount64k.java failing with java.lang.RuntimeException: '\\A\\Z' missing from stderr
+  - JDK-8332917: failure_handler should execute gdb "info threads" command on linux
+  - JDK-8333116: test/jdk/tools/jpackage/share/ServiceTest.java test fails
+  - JDK-8333360: PrintNullString.java doesn't use float arguments
+  - JDK-8333391: Test com/sun/jdi/InterruptHangTest.java failed: Thread was never interrupted during sleep
+  - JDK-8333403: Write a test to check various components events are triggered properly
+  - JDK-8333647: C2 SuperWord: some additional PopulateIndex tests
+  - JDK-8334305: Remove all code for  nsk.share.Log verbose mode
+  - JDK-8334371: [AIX] Beginning with AIX 7.3 TL1 mmap() supports 64K memory pages
+  - JDK-8334490: Normalize string with locale invariant `toLowerCase()`
+  - JDK-8334777: Test javax/management/remote/mandatory/notif/NotifReconnectDeadlockTest.java failed with NullPointerException
+  - JDK-8335288: SunPKCS11 initialization will call C_GetMechanismInfo on unsupported mechanisms
+  - JDK-8335468: [XWayland] JavaFX hangs when calling java.awt.Robot.getPixelColor
+  - JDK-8335789: [TESTBUG] XparColor.java test fails with Error. Parse Exception: Invalid or unrecognized bugid: @
+  - JDK-8336012: Fix usages of jtreg-reserved properties
+  - JDK-8336498: [macos] [build]: install-file macro may run into permission denied error
+  - JDK-8336692: Redo fix for JDK-8284620
+  - JDK-8336942: Improve test coverage for class loading elements with annotations of different retentions
+  - JDK-8337222: gc/TestDisableExplicitGC.java fails due to unexpected CodeCache GC
+  - JDK-8337494: Clarify JarInputStream behavior
+  - JDK-8337660: C2: basic blocks with only BoxLock nodes are wrongly treated as empty
+  - JDK-8337692: Better TLS connection support
+  - JDK-8337886: java/awt/Frame/MaximizeUndecoratedTest.java fails in OEL due to a slight color difference
+  - JDK-8337951: Test sun/security/validator/samedn.sh CertificateNotYetValidException: NotBefore validation
+  - JDK-8337994: [REDO] Native memory leak when not recording any events
+  - JDK-8338100: C2: assert(!n_loop->is_member(get_loop(lca))) failed: control must not be back in the loop
+  - JDK-8338303: Linux ppc64le with toolchain clang - detection failure in early JVM startup
+  - JDK-8338426: Test java/nio/channels/Selector/WakeupNow.java failed
+  - JDK-8338430: Improve compiler transformations
+  - JDK-8338571: [TestBug] DefaultCloseOperation.java test not working as expected wrt instruction after JDK-8325851 fix
+  - JDK-8338595: Add more linesize for MIME decoder in macro bench test Base64Decode
+  - JDK-8338668: Test javax/swing/JFileChooser/8080628/bug8080628.java doesn't test for GTK L&F
+  - JDK-8339154: Cleanups and JUnit conversion of test/jdk/java/util/zip/Available.java
+  - JDK-8339261: Logs truncated in test javax/net/ssl/DTLS/DTLSRehandshakeTest.java
+  - JDK-8339356: Test javax/net/ssl/SSLSocket/Tls13PacketSize.java failed with java.net.SocketException: An established connection was aborted by the software in your host machine
+  - JDK-8339475: Clean up return code handling for pthread calls in library coding
+  - JDK-8339524: Clean up a few ExtendedRobot tests
+  - JDK-8339542: compiler/codecache/CheckSegmentedCodeCache.java fails
+  - JDK-8339687: Rearrange reachabilityFence()s in jdk.test.lib.util.ForceGC
+  - JDK-8339728: [Accessibility,Windows,JAWS] Bug in the getKeyChar method of the AccessBridge class
+  - JDK-8339810: Clean up the code in sun.tools.jar.Main to properly close resources and use ZipFile during extract
+  - JDK-8339834: Replace usages of -mx and -ms in some tests
+  - JDK-8339883: Open source several AWT/2D related tests
+  - JDK-8339902: Open source couple TextField related tests
+  - JDK-8339943: Frame not disposed in java/awt/dnd/DropActionChangeTest.java
+  - JDK-8340078: Open source several 2D tests
+  - JDK-8340116: test/jdk/sun/security/tools/jarsigner/PreserveRawManifestEntryAndDigest.java can fail due to regex
+  - JDK-8340313: Crash due to invalid oop in nmethod after C1 patching
+  - JDK-8340411: open source several 2D imaging tests
+  - JDK-8340480: Bad copyright notices in changes from JDK-8339902
+  - JDK-8340687: Open source closed frame tests #1
+  - JDK-8340719: Open source AWT List tests
+  - JDK-8340824: C2: Memory for TypeInterfaces not reclaimed by hashcons()
+  - JDK-8340969: jdk/jfr/startupargs/TestStartDuration.java should be marked as flagless
+  - JDK-8341037: Use standard layouts in DefaultFrameIconTest.java and MenuCrash.java
+  - JDK-8341111: open source several AWT tests including menu shortcut tests
+  - JDK-8341135: Incorrect format string after JDK-8339475
+  - JDK-8341194: [REDO] Implement C2 VectorizedHashCode on AArch64
+  - JDK-8341316: [macos] javax/swing/ProgressMonitor/ProgressMonitorEscapeKeyPress.java fails sometimes in macos
+  - JDK-8341412: Various test failures after JDK-8334305
+  - JDK-8341424: GHA: Collect hs_errs from build time failures
+  - JDK-8341453: java/awt/a11y/AccessibleJTableTest.java fails in some cases where the test tables are not visible
+  - JDK-8341715: PPC64: ObjectMonitor::_owner should be reset unconditionally in nmethod unlocking
+  - JDK-8341820: Check return value of hcreate_r
+  - JDK-8341862: PPC64: C1 unwind_handler fails to unlock synchronized methods with LM_MONITOR
+  - JDK-8341881: [REDO] java/nio/file/attribute/BasicFileAttributeView/CreationTime.java#tmp fails on alinux3
+  - JDK-8341978: Improve JButton/bug4490179.java
+  - JDK-8341982: Simplify JButton/bug4323121.java
+  - JDK-8342098: Write a test to compare the images
+  - JDK-8342145: File libCreationTimeHelper.c compile fails on Alpine
+  - JDK-8342270: Test sun/security/pkcs11/Provider/RequiredMechCheck.java needs write access to src tree
+  - JDK-8342498: Add test for Allocation elimination after use as alignment reference by SuperWord
+  - JDK-8342508: Use latch in BasicMenuUI/bug4983388.java instead of delay
+  - JDK-8342541: Exclude List/KeyEventsTest/KeyEventsTest.java from running on macOS
+  - JDK-8342562: Enhance Deflater operations
+  - JDK-8342602: Remove JButton/PressedButtonRightClickTest test
+  - JDK-8342609: jpackage test helper function incorrectly removes a directory instead of its contents only
+  - JDK-8342634: javax/imageio/plugins/wbmp/WBMPStreamTruncateTest.java creates temp file in src dir
+  - JDK-8342635: javax/swing/JFileChooser/FileSystemView/WindowsDefaultIconSizeTest.java creates tmp file in src dir
+  - JDK-8342704: GHA: Report truncation is broken after JDK-8341424
+  - JDK-8342811: java/net/httpclient/PlainProxyConnectionTest.java failed: Unexpected connection count: 5
+  - JDK-8342858: Make target mac-jdk-bundle fails on chmod command
+  - JDK-8342988: GHA: Build JTReg in single step
+  - JDK-8343007: Enhance Buffered Image handling
+  - JDK-8343100: Consolidate EmptyFolderTest and EmptyFolderPackageTest jpackage tests into single java file
+  - JDK-8343101: Rework BasicTest.testTemp test cases
+  - JDK-8343102: Remove `--compress` from jlink command lines from jpackage tests
+  - JDK-8343118: [TESTBUG] java/awt/PrintJob/PrintCheckboxTest/PrintCheckboxManualTest.java fails with rror. Can't find HTML file PrintCheckboxManualTest.html
+  - JDK-8343128: PassFailJFrame.java test result: Error. Bad action for script: build}
+  - JDK-8343129: Disable unstable check of ThreadsListHandle.sanity_vm ThreadList values
+  - JDK-8343144: UpcallLinker::on_entry racingly clears pending exception with GC safepoints
+  - JDK-8343149: Cleanup os::print_tos_pc on AIX
+  - JDK-8343178: Test BasicTest.java javac compile fails cannot find symbol
+  - JDK-8343205: CompileBroker::possibly_add_compiler_threads excessively polls available memory
+  - JDK-8343314: Move common properties from jpackage jtreg test declarations to TEST.properties file
+  - JDK-8343343: Misc crash dump improvements on more platforms after JDK-8294160
+  - JDK-8343378: Exceptions in javax/management DeadLockTest.java do not cause test failure
+  - JDK-8343396: Use OperatingSystem, Architecture, and OSVersion in jpackage tests
+  - JDK-8343491: javax/management/remote/mandatory/connection/DeadLockTest.java failing with NoSuchObjectException: no such object in table
+  - JDK-8343599: Kmem limit and max values swapped when printing container information
+  - JDK-8343882: BasicAnnoTests doesn't handle multiple annotations at the same position
+  - JDK-8344275: tools/jpackage/windows/Win8301247Test.java fails on localized Windows platform
+  - JDK-8344326: Move jpackage tests from "jdk.jpackage.tests" package to the default package
+  - JDK-8344581: [TESTBUG] java/awt/Robot/ScreenCaptureRobotTest.java failing on macOS
+  - JDK-8344589: Update IANA Language Subtag Registry to Version 2024-11-19
+  - JDK-8344646: The libjsig deprecation warning should go to stderr not stdout
+  - JDK-8345296: AArch64: VM crashes with SIGILL when prctl is disallowed
+  - JDK-8345368: java/io/File/createTempFile/SpecialTempFile.java fails on Windows Server 2025
+  - JDK-8345370: Bump update version for OpenJDK: jdk-21.0.7
+  - JDK-8345375: Improve debuggability of test/jdk/java/net/Socket/CloseAvailable.java
+  - JDK-8345414: Google CAInterop test failures
+  - JDK-8345468: test/jdk/javax/swing/JScrollBar/4865918/bug4865918.java fails in ubuntu22.04
+  - JDK-8345569: [ubsan] adjustments to filemap.cpp and virtualspace.cpp for macOS aarch64
+  - JDK-8345614: Improve AnnotationFormatError message for duplicate annotation interfaces
+  - JDK-8345676: [ubsan] ProcessImpl_md.c:561:40: runtime error: applying zero offset to null pointer on macOS aarch64
+  - JDK-8345684: OperatingSystemMXBean.getSystemCpuLoad() throws NPE
+  - JDK-8345750: Shenandoah: Test TestJcmdHeapDump.java#aggressive intermittent assert(gc_cause() == GCCause::_no_gc) failed: Over-writing cause
+  - JDK-8346055: javax/swing/text/StyledEditorKit/4506788/bug4506788.java fails in ubuntu22.04
+  - JDK-8346108: [21u][BACKOUT] 8337994: [REDO] Native memory leak when not recording any events
+  - JDK-8346324: javax/swing/JScrollBar/4865918/bug4865918.java fails in CI
+  - JDK-8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs
+  - JDK-8346671: java/nio/file/Files/probeContentType/Basic.java fails on Windows 2025
+  - JDK-8346713: [testsuite] NeverActAsServerClassMachine breaks TestPLABAdaptToMinTLABSize.java TestPinnedHumongousFragmentation.java TestPinnedObjectContents.java
+  - JDK-8346828: javax/swing/JScrollBar/4865918/bug4865918.java still fails in CI
+  - JDK-8346847: [s390x] minimal build failure
+  - JDK-8346880: [aix] java/lang/ProcessHandle/InfoTest.java still fails: "reported cputime less than expected"
+  - JDK-8346881: [ubsan] logSelection.cpp:154:24  / logSelectionList.cpp:72:94 : runtime error: applying non-zero offset 1 to null pointer
+  - JDK-8346887: DrawFocusRect() may cause an assertion failure
+  - JDK-8346972: Test java/nio/channels/FileChannel/LoopingTruncate.java fails sometimes with IOException: There is not enough space on the disk
+  - JDK-8347038: [JMH] jdk.incubator.vector.SpiltReplicate fails NoClassDefFoundError
+  - JDK-8347129: cpuset cgroups controller is required for no good reason
+  - JDK-8347171: (dc) java/nio/channels/DatagramChannel/InterruptibleOrNot.java fails with virtual thread factory
+  - JDK-8347256: Epsilon: Demote heap size and AlwaysPreTouch warnings to info level
+  - JDK-8347267: [macOS]: UnixOperatingSystem.c:67:40: runtime error: division by zero
+  - JDK-8347268: [ubsan] logOutput.cpp:357:21: runtime error: applying non-zero offset 1 to null pointer
+  - JDK-8347424: Fix and rewrite sun/security/x509/DNSName/LeadingPeriod.java test
+  - JDK-8347427: JTabbedPane/8134116/Bug8134116.java has no license header
+  - JDK-8347576: Error output in libjsound has non matching format strings
+  - JDK-8347740: java/io/File/createTempFile/SpecialTempFile.java failing
+  - JDK-8347847: Enhance jar file support
+  - JDK-8347911: Limit the length of inflated text chunks
+  - JDK-8347965: (tz) Update Timezone Data to 2025a
+  - JDK-8348562: ZGC: segmentation fault due to missing node type check in barrier elision analysis
+  - JDK-8348625: [21u, 17u] Revert JDK-8185862 to restore old java.awt.headless behavior on Windows
+  - JDK-8348675: TrayIcon tests fail in Ubuntu 24.10 Wayland
+  - JDK-8349039: Adjust exception No type named <ThreadType> in database
+  - JDK-8349603: [21u, 17u, 11u] Update GHA JDKs after Jan/25 updates
+  - JDK-8349729: [21u] AIX jtreg tests fail to compile with qvisibility=hidden
+  - JDK-8352097: (tz) zone.tab update missed in 2025a backport
+  - JDK-8353904: [21u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 21.0.7
+
+Notes on individual issues:
+===========================
+
+security-libs/java.security:
+
+JDK-8309841: Jarsigner should print a warning if an entry is removed
+====================================================================
+In previous OpenJDK releases, the jarsigner tool did not detect the
+case where a file was removed from a signed JAR file but its signature
+was still present. With this release, `jarsigner -verify` checks that
+every signature has a matching file entry and prints a warning if this
+is not the case. The `-verbose` option can also be added to the
+command to see the names of the mismatched entries.
+
+security-libs/javax.net.ssl:
+
+JDK-8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs
+=============================================================================
+In accordance with similar plans recently announced by Google,
+Mozilla, Apple and Microsoft, the JDK will not trust Transport Layer
+Security (TLS) certificates issued after the 15th of April 2025 which
+are anchored by Camerfirma root certificates.
+
+Certificates issued on or before April 15th, 2025 will continue to
+be trusted until they expire.
+
+If a server's certificate chain is anchored by an affected
+certificate, attempts to negotiate a TLS session will fail with an
+Exception that indicates the trust anchor is not trusted. For example,
+
+"TLS server certificate issued after 2025-04-15 and anchored by a
+distrusted legacy Camerfirma root CA: CN=Chambers of Commerce Root -
+2008, O=AC Camerfirma S.A., SERIALNUMBER=A82743287, L=Madrid (see
+current address at www.camerfirma.com/address), C=EU"
+
+To check whether a certificate in a JDK keystore is affected by this
+change, you can the `keytool` utility:
+
+keytool -v -list -alias <your_server_alias> -keystore <your_keystore_filename>
+
+If any of the certificates in the chain are affected by this change,
+then you will need to update the certificate or contact the
+organisation responsible for managing the certificate.
+
+These restrictions apply to the following Camerfirma root certificates
+included in the JDK:
+
+Alias name: camerfirmachamberscommerceca [jdk]
+CN=Chambers of Commerce Root
+OU=http://www.chambersign.org
+O=AC Camerfirma SA CIF A82743287
+C=EU
+SHA256: 0C:25:8A:12:A5:67:4A:EF:25:F2:8B:A7:DC:FA:EC:EE:A3:48:E5:41:E6:F5:CC:4E:E6:3B:71:B3:61:60:6A:C3
+
+Alias name: camerfirmachambersca [jdk]
+CN=Chambers of Commerce Root - 2008
+O=AC Camerfirma S.A.
+SERIALNUMBER=A82743287
+L=Madrid (see current address at www.camerfirma.com/address)
+C=EU
+SHA256: 06:3E:4A:FA:C4:91:DF:D3:32:F3:08:9B:85:42:E9:46:17:D8:93:D7:FE:94:4E:10:A7:93:7E:E2:9D:96:93:C0
+
+Alias name: camerfirmachambersignca [jdk]
+CN=Global Chambersign Root - 2008
+O=AC Camerfirma S.A.
+SERIALNUMBER=A82743287
+L=Madrid (see current address at www.camerfirma.com/address)
+C=EU
+SHA256: 13:63:35:43:93:34:A7:69:80:16:A0:D3:24:DE:72:28:4E:07:9D:7B:52:20:BB:8F:BD:74:78:16:EE:BE:BA:CA
+
+Users can, *at their own risk*, remove this restriction by modifying
+the `java.security` configuration file (or override it by using the
+`java.security.properties` system property) so "CAMERFIRMA_TLS" is no
+longer listed in the `jdk.security.caDistrustPolicies` security
+property.
+
+security-libs/javax.crypto:pkcs11:
+
+JDK-8293345: SunPKCS11 provider checks on PKCS11 Mechanism are problematic
+==========================================================================
+In OpenJDK 14, the notion of legacy mechanisms was introduced into the
+SunPKCS11 provider.  If a mechanism was found to be using a weak
+algorithm, it was determined to be legacy and disabled.
+
+However, this approach has proved inflexible. There was no way for the
+user to override the legacy determination and enable the mechanism
+anyway.  Also, a mechanism being used for signing would be declared
+legacy and disabled if it had a weak encryption algorithm, even though
+encryption was not being used. Similarly, a weak signing algorithm
+would prevent the mechanism's use as a cipher for encryption or
+decryption.
+
+This OpenJDK release resolves these issues. It introduces the PKCS11
+provider configuration attribute "allowLegacy" which can be set to
+`true` if the user wishes to override the legacy determination. By
+default, it is set to `false`. The legacy determination now also
+considers the service type and will only check encryption algorithms
+for Ciphers and only signature algorithms for Signatures.
+
+New in release OpenJDK 21.0.6 (2025-01-21):
+===========================================
+Live versions of these release notes can be found at:
+  * https://bit.ly/openjdk2106
+
+* CVEs
+  - CVE-2025-21502
+* Changes
+  - JDK-6942632: Hotspot should be able to use more than 64 logical processors on Windows
+  - JDK-8028127: Regtest java/security/Security/SynchronizedAccess.java is incorrect
+  - JDK-8195675: Call to insertText with single character from custom Input Method ignored
+  - JDK-8207908: JMXStatusTest.java fails assertion intermittently
+  - JDK-8225220: When the Tab Policy is checked,the scroll button direction displayed incorrectly.
+  - JDK-8240343: JDI stopListening/stoplis001 "FAILED: listening is successfully stopped without starting listening"
+  - JDK-8283214: [macos] Screen magnifier does not show the magnified text for JComboBox
+  - JDK-8296787: Unify debug printing format of X.509 cert serial numbers
+  - JDK-8296972: [macos13] java/awt/Frame/MaximizedToIconified/MaximizedToIconified.java: getExtendedState() != 6 as expected.
+  - JDK-8306446: java/lang/management/ThreadMXBean/Locks.java transient failures
+  - JDK-8308429: jvmti/StopThread/stopthrd007 failed with "NoClassDefFoundError: Could not initialize class jdk.internal.misc.VirtualThreads"
+  - JDK-8309218: java/util/concurrent/locks/Lock/OOMEInAQS.java still times out with ZGC, Generational ZGC, and SerialGC
+  - JDK-8311301: MethodExitTest may fail with stack buffer overrun
+  - JDK-8311656: Shenandoah: Unused ShenandoahSATBAndRemarkThreadsClosure::_claim_token
+  - JDK-8312518: [macos13] setFullScreenWindow() shows black screen on macOS 13 & above
+  - JDK-8313374: --enable-ccache's CCACHE_BASEDIR breaks builds
+  - JDK-8313878: Exclude two compiler/rtm/locking tests on ppc64le
+  - JDK-8315701: [macos] Regression: KeyEvent has different keycode on different keyboard layouts
+  - JDK-8316428: G1: Nmethod count statistics only count last code root set iterated
+  - JDK-8316893: Compile without -fno-delete-null-pointer-checks
+  - JDK-8316895: SeenThread::print_action_queue called on a null pointer
+  - JDK-8316907: Fix nonnull-compare warnings
+  - JDK-8317116: Provide layouts for multiple test UI in PassFailJFrame
+  - JDK-8317575: AArch64: C2_MacroAssembler::fast_lock uses rscratch1 for cmpxchg result
+  - JDK-8318105: [jmh] the test java.security.HSS failed with 2 active threads
+  - JDK-8318442: java/net/httpclient/ManyRequests2.java fails intermittently on Linux
+  - JDK-8319640: ClassicFormat::parseObject (from DateTimeFormatter) does not conform to the javadoc and may leak DateTimeException
+  - JDK-8319673: Few security tests ignore VM flags
+  - JDK-8319678: Several tests from corelibs areas ignore VM flags
+  - JDK-8319960: RISC-V: compiler/intrinsics/TestInteger/LongUnsignedDivMod.java failed with "counts: Graph contains wrong number of nodes"
+  - JDK-8319970: AArch64: enable tests compiler/intrinsics/Test(Long|Integer)UnsignedDivMod.java on aarch64
+  - JDK-8319973: AArch64: Save and restore FPCR in the call stub
+  - JDK-8320192: SHAKE256 does not work correctly if n >= 137
+  - JDK-8320397: RISC-V: Avoid passing t0 as temp register to MacroAssembler:: cmpxchg_obj_header/cmpxchgptr
+  - JDK-8320575: generic type information lost on mandated parameters of record's compact constructors
+  - JDK-8320586: update manual test/jdk/TEST.groups
+  - JDK-8320665: update jdk_core at open/test/jdk/TEST.groups
+  - JDK-8320673: PageFormat/CustomPaper.java has no Pass/Fail buttons; multiple instructions
+  - JDK-8320682: [AArch64] C1 compilation fails with "Field too big for insn"
+  - JDK-8320892: AArch64: Restore FPU control state after JNI
+  - JDK-8321299: runtime/logging/ClassLoadUnloadTest.java doesn't reliably trigger class unloading
+  - JDK-8321470: ThreadLocal.nextHashCode can be static final
+  - JDK-8321474: TestAutoCreateSharedArchiveUpgrade.java should be updated with JDK 21
+  - JDK-8321543: Update NSS to version 3.96
+  - JDK-8321550: Update several runtime/cds tests to use vm flags or mark as flagless
+  - JDK-8321616: Retire binary test vectors in test/jdk/java/util/zip/ZipFile
+  - JDK-8321940: Improve CDSHeapVerifier in handling of interned strings
+  - JDK-8322166: Files.isReadable/isWritable/isExecutable expensive when file does not exist
+  - JDK-8322754: click JComboBox when dialog about to close causes IllegalComponentStateException
+  - JDK-8322809: SystemModulesMap::classNames and moduleNames arrays do not match the order
+  - JDK-8322830: Add test case for ZipFile opening a ZIP with no entries
+  - JDK-8323562: SaslInputStream.read() may return wrong value
+  - JDK-8323688: C2: Fix UB of jlong overflow in PhaseIdealLoop::is_counted_loop()
+  - JDK-8324841: PKCS11 tests still skip execution
+  - JDK-8324861: Exceptions::wrap_dynamic_exception() doesn't have ResourceMark
+  - JDK-8325038: runtime/cds/appcds/ProhibitedPackage.java can fail with UseLargePages
+  - JDK-8325399: Add tests for virtual threads doing Selector operations
+  - JDK-8325506: Ensure randomness is only read from provided SecureRandom object
+  - JDK-8325525: Create jtreg test case for JDK-8325203
+  - JDK-8325610: CTW: Add StressIncrementalInlining to stress options
+  - JDK-8325762: Use PassFailJFrame.Builder.splitUI() in PrintLatinCJKTest.java
+  - JDK-8325851: Hide PassFailJFrame.Builder constructor
+  - JDK-8325906: Problemlist vmTestbase/vm/mlvm/meth/stress/compiler/deoptimize/Test.java#id1 until JDK-8320865 is fixed
+  - JDK-8326100: DeflaterDictionaryTests should use Deflater.getBytesWritten instead of Deflater.getTotalOut
+  - JDK-8326121: vmTestbase/gc/g1/unloading/tests/unloading_keepRef_rootClass_inMemoryCompilation_keep_cl failed with Full gc happened. Test was useless.
+  - JDK-8326611: Clean up vmTestbase/nsk/stress/stack tests
+  - JDK-8326898: NSK tests should listen on loopback addresses only
+  - JDK-8327924: Simplify TrayIconScalingTest.java
+  - JDK-8328021: Convert applet test java/awt/List/SetFontTest/SetFontTest.html to main program
+  - JDK-8328242: Add a log area to the PassFailJFrame
+  - JDK-8328303: 3 JDI tests timed out with UT enabled
+  - JDK-8328379: Convert URLDragTest.html applet test to main
+  - JDK-8328402: Implement pausing functionality for the PassFailJFrame
+  - JDK-8328619: sun/management/jmxremote/bootstrap/SSLConfigFilePermissionTest.java failed with BindException: Address already in use
+  - JDK-8328665: serviceability/jvmti/vthread/PopFrameTest failed with a timeout
+  - JDK-8328723: IP Address error when client enables HTTPS endpoint check on server socket
+  - JDK-8329353: ResolvedReferencesNotNullTest.java failed with Incorrect resolved references array, quxString should not be archived
+  - JDK-8329533: TestCDSVMCrash fails on libgraal
+  - JDK-8330045: Enhance array handling
+  - JDK-8330278: Have SSLSocketTemplate.doClientSide use loopback address
+  - JDK-8330621: Make 5 compiler tests use ProcessTools.executeProcess
+  - JDK-8331391: Enhance the keytool code by invoking the buildTrustedCerts method for essential options
+  - JDK-8331393: AArch64: u32 _partial_subtype_ctr loaded/stored as 64
+  - JDK-8331864: Update Public Suffix List to 1cbd6e7
+  - JDK-8332112: Update nsk.share.Log to don't print summary during VM shutdown hook
+  - JDK-8332340: Add JavacBench as a test case for CDS
+  - JDK-8332461: ubsan : dependencies.cpp:906:3: runtime error: load of value 4294967295, which is not a valid value for type 'DepType'
+  - JDK-8332724: x86 MacroAssembler may over-align code
+  - JDK-8332777: Update JCStress test suite
+  - JDK-8332866: Crash in ImageIO JPEG decoding when MEM_STATS in enabled
+  - JDK-8332901: Select{Current,New}ItemTest.java for Choice don't open popup on macOS
+  - JDK-8333098: ubsan: bytecodeInfo.cpp:318:59: runtime error: division by zero
+  - JDK-8333108: Update vmTestbase/nsk/share/DebugeeProcess.java to don't use finalization
+  - JDK-8333144: docker tests do not work when ubsan is configured
+  - JDK-8333235: vmTestbase/nsk/jdb/kill/kill001/kill001.java fails with C1
+  - JDK-8333248: VectorGatherMaskFoldingTest.java failed when maximum vector bits is 64
+  - JDK-8333317: Test sun/security/pkcs11/sslecc/ClientJSSEServerJSSE.java failed with: Invalid ECDH ServerKeyExchange signature
+  - JDK-8333427: langtools/tools/javac/newlines/NewLineTest.java is failing on Japanese Windows
+  - JDK-8333728: ubsan: shenandoahFreeSet.cpp:1347:24: runtime error: division by zero
+  - JDK-8333754: Add a Test against ECDSA and ECDH NIST Test vector
+  - JDK-8333824: Unused ClassValue in VarHandles
+  - JDK-8334057: JLinkReproducibleTest.java support receive test.tool.vm.opts
+  - JDK-8334405: java/nio/channels/Selector/SelectWithConsumer.java#id0 failed in testWakeupDuringSelect
+  - JDK-8334475: UnsafeIntrinsicsTest.java#ZGenerationalDebug assert(!assert_on_failure) failed: Has low-order bits set
+  - JDK-8334560: [PPC64]: postalloc_expand_java_dynamic_call_sched does not copy all fields
+  - JDK-8334562: Automate com/sun/security/auth/callback/TextCallbackHandler/Default.java test
+  - JDK-8334567: [test] runtime/os/TestTracePageSizes move ppc handling
+  - JDK-8334719: (se) Deferred close of SelectableChannel may result in a Selector doing the final close before concurrent I/O on channel has completed
+  - JDK-8335142: compiler/c1/TestTraceLinearScanLevel.java occasionally times out with -Xcomp
+  - JDK-8335172: Add manual steps to run security/auth/callback/TextCallbackHandler/Password.java test
+  - JDK-8335267: [XWayland] move screencast tokens from .awt to .java folder
+  - JDK-8335344: test/jdk/sun/security/tools/keytool/NssTest.java fails to compile
+  - JDK-8335428: Enhanced Building of Processes
+  - JDK-8335449: runtime/cds/DeterministicDump.java fails with File content different at byte ...
+  - JDK-8335530: Java file extension missing in AuthenticatorTest
+  - JDK-8335664: Parsing jsr broken: assert(bci>= 0 && bci < c->method()->code_size()) failed: index out of bounds
+  - JDK-8335709: C2: assert(!loop->is_member(get_loop(useblock))) failed: must be outside loop
+  - JDK-8335912, JDK-8337499: Add an operation mode to the jar command when extracting to not overwriting existing files
+  - JDK-8336240: Test com/sun/crypto/provider/Cipher/DES/PerformanceTest.java fails with java.lang.ArithmeticException
+  - JDK-8336257: Additional tests in jmxremote/startstop to match on PID not app name
+  - JDK-8336315: tools/jpackage/windows/WinChildProcessTest.java Failed: Check is calculator process is alive
+  - JDK-8336413: gtk headers : Fix typedef redeclaration of GMainContext and GdkPixbuf
+  - JDK-8336564: Enhance mask blit functionality redux
+  - JDK-8336640: Shenandoah: Parallel worker use in parallel_heap_region_iterate
+  - JDK-8336854: CAInterop.java#actalisauthenticationrootca conflicted with /manual and /timeout
+  - JDK-8336911: ZGC: Division by zero in heuristics after JDK-8332717
+  - JDK-8337066: Repeated call of StringBuffer.reverse with double byte string returns wrong result
+  - JDK-8337067: Test runtime/classFileParserBug/Bad_NCDFE_Msg.java won't compile
+  - JDK-8337320: Update ProblemList.txt with tests known to fail on XWayland
+  - JDK-8337331: crash: pinned virtual thread will lead to jvm crash when running with the javaagent option
+  - JDK-8337410: The makefiles should set problemlist and adjust timeout basing on the given VM flags
+  - JDK-8337780: RISC-V: C2: Change C calling convention for sp to NS
+  - JDK-8337810: ProblemList BasicDirectoryModel/LoaderThreadCount.java on Windows
+  - JDK-8337826: Improve logging in OCSPTimeout and SimpleOCSPResponder to help diagnose JDK-8309754
+  - JDK-8337851: Some tests have name which confuse jtreg
+  - JDK-8337876: [IR Framework] Add support for IR tests with @Stable
+  - JDK-8337966: (fs) Files.readAttributes fails with Operation not permitted on older docker releases
+  - JDK-8338058: map_or_reserve_memory_aligned Windows enhance remap assertion
+  - JDK-8338101: remove old remap assertion in map_or_reserve_memory_aligned  after JDK-8338058
+  - JDK-8338109: java/awt/Mouse/EnterExitEvents/ResizingFrameTest.java duplicate in ProblemList
+  - JDK-8338110: Exclude Fingerprinter::do_type from ubsan checks
+  - JDK-8338112: Test testlibrary_tests/ir_framework/tests/TestPrivilegedMode.java fails with release build
+  - JDK-8338344: Test TestPrivilegedMode.java intermittent fails java.lang.NoClassDefFoundError: jdk/test/lib/Platform
+  - JDK-8338380: Update TLSCommon/interop/AbstractServer to specify an interface to listen for connections
+  - JDK-8338389: [JFR] Long strings should be added to the string pool
+  - JDK-8338402: GHA: some of bundles may not get removed
+  - JDK-8338449: ubsan: division by zero in sharedRuntimeTrans.cpp
+  - JDK-8338550: Do libubsan1 installation in test container only if requested
+  - JDK-8338748: [17u,21u] Test Disconnect.java compile error: cannot find symbol after JDK-8299813
+  - JDK-8338751: ConfigureNotify behavior has changed in KWin 6.2
+  - JDK-8338759: Add extra diagnostic to java/net/InetAddress/ptr/Lookup.java
+  - JDK-8338924: C1: assert(0 <= i && i < _len) failed: illegal index 5 for length 5
+  - JDK-8339080: Bump update version for OpenJDK: jdk-21.0.6
+  - JDK-8339180: Enhanced Building of Processes: Follow-on Issue
+  - JDK-8339248: RISC-V: Remove li64 macro assembler routine and related code
+  - JDK-8339384: Unintentional IOException in jdk.jdi module when JDWP end of stream occurs
+  - JDK-8339386: Assertion on AIX - original PC must be in the main code section of the compiled method
+  - JDK-8339416: [s390x] Provide implementation for resolve_global_jobject
+  - JDK-8339487: ProcessHandleImpl os_getChildren sysctl call - retry in case of ENOMEM and enhance exception message
+  - JDK-8339548: GHA: RISC-V: Use Debian snapshot archive for bootstrap
+  - JDK-8339560: Unaddressed comments during code review of JDK-8337664
+  - JDK-8339591: Mark jdk/jshell/ExceptionMessageTest.java intermittent
+  - JDK-8339637: (tz) Update Timezone Data to 2024b
+  - JDK-8339644: Improve parsing of Day/Month in tzdata rules
+  - JDK-8339648: ZGC: Division by zero in rule_major_allocation_rate
+  - JDK-8339725: Concurrent GC crashed due to GetMethodDeclaringClass
+  - JDK-8339731: java.desktop/share/classes/javax/swing/text/html/default.css typo in margin settings
+  - JDK-8339741: RISC-V: C ABI breakage for integer on stack
+  - JDK-8339787: Add some additional diagnostic output to java/net/ipv6tests/UdpTest.java
+  - JDK-8339803: Acknowledge case insensitive unambiguous keywords in tzdata files
+  - JDK-8339892: Several security shell tests don't set TESTJAVAOPTS
+  - JDK-8340007: Refactor KeyEvent/FunctionKeyTest.java
+  - JDK-8340008: KeyEvent/KeyTyped/Numpad1KeyTyped.java has 15 seconds timeout
+  - JDK-8340109: Ubsan: ciEnv.cpp:1660:65: runtime error: member call on null pointer of type 'struct CompileTask'
+  - JDK-8340210: Add positionTestUI() to PassFailJFrame.Builder
+  - JDK-8340214: C2 compilation asserts with "no node with a side effect" in PhaseIdealLoop::try_sink_out_of_loop
+  - JDK-8340230: Tests crash: assert(is_in_encoding_range || k->is_interface() || k->is_abstract()) failed: sanity
+  - JDK-8340306: Add border around instructions in PassFailJFrame
+  - JDK-8340308: PassFailJFrame: Make rows default to number of lines in instructions
+  - JDK-8340365: Position the first window of a window list
+  - JDK-8340383: VM issues warning failure to find kernel32.dll on Windows nanoserver
+  - JDK-8340387: Update OS detection code to recognize Windows Server 2025
+  - JDK-8340398: [JVMCI] Unintuitive behavior of UseJVMCICompiler option
+  - JDK-8340418: GHA: MacOS AArch64 bundles can be removed prematurely
+  - JDK-8340461: Amend description for logArea
+  - JDK-8340466: Add description for PassFailJFrame constructors
+  - JDK-8340552: Harden TzdbZoneRulesCompiler against missing zone names
+  - JDK-8340590: RISC-V: C2: Small improvement to vector gather load and scatter store
+  - JDK-8340632: ProblemList java/nio/channels/DatagramChannel/ for Macos
+  - JDK-8340657: [PPC64] SA determines wrong unextendedSP
+  - JDK-8340684: Reading from an input stream backed by a closed ZipFile has no test coverage
+  - JDK-8340785: Update description of PassFailJFrame and samples
+  - JDK-8340799: Add border inside instruction frame in PassFailJFrame
+  - JDK-8340801: Disable ubsan checks in some awt/2d coding
+  - JDK-8340804: doc/building.md update Xcode instructions to note that full install is required
+  - JDK-8340812: LambdaForm customization via MethodHandle::updateForm is not thread safe
+  - JDK-8340815: Add SECURITY.md file
+  - JDK-8340899: Remove wildcard bound in PositionWindows.positionTestWindows
+  - JDK-8340923: The class LogSelection copies uninitialized memory
+  - JDK-8341024: [test] build/AbsPathsInImage.java fails with OOM when using ubsan-enabled binaries
+  - JDK-8341146: RISC-V: Unnecessary fences used for load-acquire in template interpreter
+  - JDK-8341235: Improve default instruction frame title in PassFailJFrame
+  - JDK-8341261: Tests assume UnlockExperimentalVMOptions is disabled by default
+  - JDK-8341562: RISC-V: Generate comments in -XX:+PrintInterpreter to link to source code
+  - JDK-8341688: Aarch64: Generate comments in -XX:+PrintInterpreter to link to source code
+  - JDK-8341722: Fix some warnings as errors when building on Linux with toolchain clang
+  - JDK-8341806: Gcc version detection failure on Alinux3
+  - JDK-8341927: Replace hardcoded security providers with new test.provider.name system property
+  - JDK-8341997: Tests create files in src tree instead of scratch dir
+  - JDK-8342014: RISC-V: ZStoreBarrierStubC2 clobbers rflags
+  - JDK-8342063: [21u][aix] Backport introduced redundant line in ProblemList
+  - JDK-8342181: Update tests to use stronger Key and Salt size
+  - JDK-8342183: Update tests to use stronger algorithms and keys
+  - JDK-8342188: Update tests to use stronger key parameters and certificates
+  - JDK-8342409: [s390x] C1 unwind_handler fails to unlock synchronized methods with LM_MONITOR
+  - JDK-8342496: C2/Shenandoah: SEGV in compiled code when running jcstress
+  - JDK-8342578: GHA: RISC-V: Bootstrap using Debian snapshot is still failing
+  - JDK-8342607: Enhance register printing on x86_64 platforms
+  - JDK-8342669: [21u] Fix TestArrayAllocatorMallocLimit after backport of JDK-8315097
+  - JDK-8342681: TestLoadBypassesNullCheck.java fails improperly specified VM option
+  - JDK-8342701: [PPC64] TestOSRLotsOfLocals.java crashes
+  - JDK-8342765: [21u] RTM tests assume UnlockExperimentalVMOptions is disabled by default
+  - JDK-8342823: Ubsan: ciEnv.cpp:1614:65: runtime error: member call on null pointer of type 'struct CompileTask'
+  - JDK-8342905: Thread.setContextClassloader from thread in FJP commonPool task no longer works after JDK-8327501 redux
+  - JDK-8342962: [s390x] TestOSRLotsOfLocals.java crashes
+  - JDK-8343285: java.lang.Process is unresponsive and CPU usage spikes to 100%
+  - JDK-8343474: [updates] Customize README.md to specifics of update project
+  - JDK-8343506: [s390x] multiple test failures with ubsan
+  - JDK-8343724: [PPC64] Disallow OptoScheduling
+  - JDK-8343848: Fix typo of property name in TestOAEPPadding after 8341927
+  - JDK-8343877: Test AsyncClose.java intermittent fails - Socket.getInputStream().read() wasn't preempted
+  - JDK-8343884: [s390x]  Disallow OptoScheduling
+  - JDK-8343923: GHA: Switch to Xcode 15 on MacOS AArch64 runners
+  - JDK-8344164: [s390x] ProblemList hotspot/jtreg/runtime/NMT/VirtualAllocCommitMerge.java
+  - JDK-8344628: Test TestEnableJVMCIProduct.java run with virtual thread intermittent fails
+  - JDK-8344993: [21u] [REDO] Backport JDK-8327501 and JDK-8328366 to JDK 21
+  - JDK-8345055: [21u] ProblemList failing rtm tests on ppc platforms
+  - JDK-8347010: [21u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 21.0.6
+
+Notes on individual issues:
+===========================
+
+core-libs/java.util.jar:
+
+JDK-8335912/JDK-8337499: Add an operation mode to the jar command when extracting to not overwriting existing files
+===================================================================================================================
+In previous OpenJDK releases, when the jar tool extracted files from
+an archive, it would overwrite any existing files with the same name
+in the target directory. With this release, a new option ('-k' or
+'--keep-old-files') may be specified so that existing files are not
+overwritten.
+
+The option may be specified in short or long option form, as in the
+following examples:
+
+* jar xkf foo.jar
+* jar --extract --keep-old-files --file foo.jar
+
+By default, the old behaviour remains in place and files will be
+overwritten.
+
+core-libs/java.time:
+
+JDK-8339637: (tz) Update Timezone Data to 2024b
+===============================================
+This OpenJDK release upgrades the in-tree copy of the IANA timezone
+database to 2024b.  This timezone update is primarily concerned with
+improving historical data for Mexico, Monogolia and Portugal. It also
+makes Asia/Choibalsan an alias for Asia/Ulaanbaatar and makes the MET
+timezone the same as CET.
+
+The 2024b update also makes a number of legacy timezone IDs equal to
+geographical names rather than fixed offsets, as follows:
+
+* EST => America/Panama instead of -5:00
+* MST => America/Phoenix instead of -7:00
+* HST => Pacific/Honolulu instead of -10:00
+
+For long term support releases of OpenJDK, this change is overridden
+locally to retain the existing fixed offset mapping.
+
 New in release OpenJDK 21.0.5 (2024-10-15):
 ===========================================
 Live versions of these release notes can be found at:
--- a/README.md
+++ b/README.md
@ -37,3 +37,10 @@ need to be modified if the version or rpmrelease values are changed in
 To reduce the number of RPMs involved, the `fastdebug` and `slowdebug`
 builds may be disabled using `--without fastdebug` and `--without
 slowdebug`.
+
+By default, the portable build on RHEL also uses a "devkit" (a
+toolchain and system libraries) to build.  This aids reproducibility
+by removing build differences caused by differing system toolchains
+and libraries.  This dependency can be dropped by defining 'centos' to
+a non-zero value (e.g. --define='centos 1') or a devkit can be built
+using the `openjdk-devkit.specfile` and associated patches.
--- a/fips-21u-9203d50836c.patch
+++ b/fips-21u-9203d50836c.patch
@ -1979,7 +1979,7 @@ index 539ef1e8ee8..435f57e3ff2 100644
                 "sun.security.rsa.PSSParameters", null);
     }
 diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security
-index 5149edba0e5..8227d650a03 100644
+index f8b01a4ea1e..b325bf7e9fc 100644
 --- a/src/java.base/share/conf/security/java.security
 +++ b/src/java.base/share/conf/security/java.security
@@ -85,6 +85,17 @@ security.provider.tbd=Apple
@ -2959,7 +2959,7 @@ index 00000000000..f8d505ca815
 +}
 \ No newline at end of file
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
-index c3b412885a6..0e7ce73b158 100644
+index 01fc06ae283..e3ca000d309 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
@@ -37,6 +37,8 @@ import javax.crypto.*;
@ -2981,7 +2981,7 @@ index c3b412885a6..0e7ce73b158 100644
     private static final String PUBLIC = "public";
     private static final String PRIVATE = "private";
     private static final String SECRET = "secret";
-@@ -401,9 +406,10 @@ abstract class P11Key implements Key, Length {
+@@ -414,9 +419,10 @@ abstract class P11Key implements Key, Length {
                     new CK_ATTRIBUTE(CKA_EXTRACTABLE),
         });
 
@ -2995,7 +2995,7 @@ index c3b412885a6..0e7ce73b158 100644
 
         return switch (algorithm) {
             case "RSA" -> P11RSAPrivateKeyInternal.of(session, keyID, algorithm,
-@@ -455,7 +461,8 @@ abstract class P11Key implements Key, Length {
+@@ -468,7 +474,8 @@ abstract class P11Key implements Key, Length {
 
         public String getFormat() {
             token.ensureValid();
@ -3005,13 +3005,13 @@ index c3b412885a6..0e7ce73b158 100644
                 return null;
             } else {
                 return "RAW";
-@@ -1625,4 +1632,3 @@ final class SessionKeyRef extends PhantomReference<P11Key> {
+@@ -1638,4 +1645,3 @@ final class SessionKeyRef extends PhantomReference<P11Key> {
         this.clear();
     }
 }
 -
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
-index 5cd6828d293..bae49c4e8a9 100644
+index 0a62021633f..0723b69c2bc 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
@@ -26,6 +26,9 @@
@ -3022,7 +3022,7 @@ index 5cd6828d293..bae49c4e8a9 100644
 +import java.lang.invoke.MethodHandles;
 +import java.lang.invoke.MethodType;
 import java.util.*;
- 
+ import java.util.stream.Collectors;
 import java.security.*;
@@ -42,10 +45,12 @@ import javax.security.auth.callback.PasswordCallback;
 
@ -3141,7 +3141,7 @@ index 5cd6828d293..bae49c4e8a9 100644
             }
             p11 = tmpPKCS11;
 
-@@ -1389,11 +1461,52 @@ public final class SunPKCS11 extends AuthProvider {
+@@ -1388,11 +1460,52 @@ public final class SunPKCS11 extends AuthProvider {
         }
 
         @Override
@ -3194,7 +3194,7 @@ index 5cd6828d293..bae49c4e8a9 100644
             try {
                 return newInstance0(param);
             } catch (PKCS11Exception e) {
-@@ -1750,6 +1863,9 @@ public final class SunPKCS11 extends AuthProvider {
+@@ -1749,6 +1862,9 @@ public final class SunPKCS11 extends AuthProvider {
         try {
             session = token.getOpSession();
             p11.C_Logout(session.id());
@ -3252,7 +3252,7 @@ index a6f5f0a8764..9a07c96ca4e 100644
     }
 
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
-index 4b06daaf264..55e14945469 100644
+index 0fd13fd6fa6..3c959c942a1 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
@@ -49,6 +49,9 @@ package sun.security.pkcs11.wrapper;
@ -3312,7 +3312,7 @@ index 4b06daaf264..55e14945469 100644
             }
             if (omitInitialize == false) {
                 try {
-@@ -1976,4 +2004,194 @@ static class SynchronizedPKCS11 extends PKCS11 {
+@@ -2012,4 +2040,194 @@ static class SynchronizedPKCS11 extends PKCS11 {
         super.C_GenerateRandom(hSession, randomData);
     }
 }
--- a/gating.yaml
+++ b/gating.yaml
@ -1,7 +1,7 @@
 # recipients: java-qa
 --- !Policy
 product_versions:
-  - rhel-10
+  - rhel-9
 decision_context: osci_compose_gate
 rules:
  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
--- a/java-21-openjdk-portable.specfile
+++ b/java-21-openjdk-portable.specfile
@ -24,14 +24,15 @@
 # Enable static library builds by default.
 %bcond_without staticlibs
 # Build a fresh libjvm.so for use in a copy of the bootstrap JDK
-# Turned off until 21.0.5+1 or higher is in the buildroot
-%bcond_with fresh_libjvm
+%bcond_without fresh_libjvm
 # Build with system libraries
 %bcond_with system_libs

 # This is RHEL 7 specific as it doesn't seem to have the
 # __brp_strip_static_archive macro.
+%if 0%{?rhel} == 7
 %define __os_install_post %{nil}
+%endif

 # Workaround for stripping of debug symbols from static libraries
 %if %{with staticlibs}
@ -56,6 +57,10 @@
 # See: https://bugzilla.redhat.com/show_bug.cgi?id=1520879
 %global _find_debuginfo_opts -g

+# Disable LTO as this causes build failures at the moment.
+# See RHBZ#1861401
+%define _lto_cflags %{nil}
+
 # note: parametrized macros are order-sensitive (unlike not-parametrized) even with normal macros
 # also necessary when passing it as parameter to other macros. If not macro, then it is considered a switch
 # see the difference between global and define:
@ -142,7 +147,7 @@
 %global zgc_arches x86_64
 # Set of architectures for which alt-java has SSB mitigation
 %global ssbd_arches x86_64
-# Set of architectures for which java has short vector math library (libsvml.so)
+# Set of architectures for which java has short vector math library (libjsvml.so)
 %global svml_arches x86_64
 # Set of architectures where we verify backtraces with gdb
 # s390x fails on RHEL 7 so we exclude it there
@ -153,6 +158,11 @@
 %endif
 # Architecture on which we run Java only tests
 %global jdk_test_arch x86_64
+# Set of architectures for which we have a devkit
+# Only used on RHEL
+%if 0%{?centos} == 0
+%global devkit_arches %{aarch64} %{ppc64le} s390x x86_64
+%endif

 # By default, we build a slowdebug build during main build on JIT architectures
 %if %{with slowdebug}
@ -233,11 +243,9 @@
 %global hotspot_target hotspot

 # DTS toolset to use to provide gcc & binutils
+%if 0%{?rhel} == 7
 %global dtsversion 10
-
-# Disable LTO as this causes build failures at the moment.
-# See RHBZ#1861401
-%define _lto_cflags %{nil}
+%endif

 # Filter out flags from the optflags macro that cause problems with the OpenJDK build
 # We filter out -O flags so that the optimization of HotSpot is not lowered from O3 to O2
@ -317,7 +325,7 @@
 # New Version-String scheme-style defines
 %global featurever 21
 %global interimver 0
-%global updatever 5
+%global updatever 7
 %global patchver 0
 # buildjdkver is usually same as %%{featurever},
 # but in time of bootstrap of next jdk, it is featurever-1,
@ -333,7 +341,7 @@
  %global lts_designator_zip ""
 %endif
 # JDK to use for bootstrapping
-%global bootjdk /usr/lib/jvm/java-%{buildjdkver}-openjdk
+%global bootjdk /usr/lib/jvm/java-%{featurever}-openjdk
 # Define whether to use the bootstrap JDK directly or with a fresh libjvm.so
 # This will only work where the bootstrap JDK is the same major version
 # as the JDK being built
@ -367,7 +375,7 @@
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      6.0.0pre00-c848b93a8598
 # Define current Git revision for the FIPS support patches
-%global fipsver 0a42e29b391
+%global fipsver 9203d50836c
 # Define JDK versions
 %global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
 %global javaver         %{featurever}
@ -381,8 +389,8 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{vcstag}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        11
-%global rpmrelease      1
+%global buildver        6
+%global rpmrelease      2
 #%%global tagsuffix     %%{nil}
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
@ -486,6 +494,7 @@
 %define jrebindir()     %{expand:%{_jvmdir}/%{sdkdir -- %{?1}}/bin}

 %global alt_java_name     alt-java
+%global devkit_name %{origin}-devkit

 %global rpm_state_dir %{_localstatedir}/lib/rpm-state/

@ -520,10 +529,19 @@

 # Prevent brp-java-repack-jars from being run
 %global __jar_repack 0
-# Define the architectures on which we build
-ExclusiveArch: %{aarch64} %{ppc64le} s390x x86_64
-# Define the OS this package is built on
+
+# Define an optional suffix for the OS this package is built on
+%if 0%{?rhel} == 7
 %global pkgos rhel7
+%endif
+
+# Define the architectures on which we build
+# On RHEL, this should be the architectures with a devkit
+%if 0%{?centos} == 0
+ExclusiveArch: %{devkit_arches}
+%else
+ExclusiveArch: %{aarch64} %{ppc64le} s390x x86_64
+%endif

 Name:    java-%{javaver}-%{origin}-portable%{?pkgos:-%{pkgos}}
 Version: %{newjavaver}.%{buildver}
@ -539,11 +557,6 @@ Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
 # provides >= 1.6.0 must specify the epoch, "java >= 1:1.6.0".

 Epoch:   1
-
-# portables have grown out of its component, moving back to java-x-vendor
-# this expression, when declared as global, filled component with java-x-vendor portable
-%define component %(echo %{name} | sed "s;-portable%{?pkgos:-%{pkgos}};;g")
-
 Summary: %{origin_nice} %{featurever} Runtime Environment portable edition
 # Groups are only used up to RHEL 8 and on Fedora versions prior to F30
 %if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30)
@ -608,7 +621,6 @@ Source18: TestTranslations.java
 # RPM/distribution specific patches
 #
 ############################################
-
 # Crypto policy and FIPS support patches
 # Patch is generated from the fips-21u tree at https://github.com/rh-openjdk/jdk/tree/fips-21u
 # as follows: git diff %%{vcstag} src make test > fips-21u-$(git show -s --format=%h HEAD).patch
@ -661,6 +673,10 @@ Patch1001: fips-%{featurever}u-%{fipsver}.patch
 #
 #############################################

+# JDK-8351500: G1: NUMA migrations cause crashes in region allocation
+# Upstream in 21.0.8+1
+Patch2001: jdk8351500-numa_migration_crashes.patch
+
 #############################################
 #
 # Portable build specific patches
@ -679,9 +695,19 @@ BuildRequires: desktop-file-utils
 BuildRequires: elfutils-devel
 BuildRequires: file
 BuildRequires: fontconfig-devel
+# RHEL 7 builds obtain a newer compiler from DTS
+%if 0%{?rhel} == 7
 BuildRequires: devtoolset-%{dtsversion}-gcc
 BuildRequires: devtoolset-%{dtsversion}-gcc-c++
+%else
+%ifarch %{devkit_arches}
+BuildRequires: %{devkit_name} >= 1.0-9
+%else
+# Earlier versions have a bug in tree vectorization on PPC
+BuildRequires: gcc >= 4.8.3-8
 BuildRequires: gcc-c++
+%endif
+%endif
 BuildRequires: gdb
 BuildRequires: libxslt
 BuildRequires: libX11-devel
@ -694,7 +720,7 @@ BuildRequires: libXtst-devel
 # Requirement for setting up nss.fips.cfg
 BuildRequires: nss-devel
 # Requirement for system security property test
-# N/A for portable. RHEL7 doesn't provide them
+# N/A for portable as we don't enable support for them
 #BuildRequires: crypto-policies
 BuildRequires: pkgconfig
 BuildRequires: xorg-x11-proto-devel
@ -702,22 +728,20 @@ BuildRequires: zip
 # to pack portable tarballs
 BuildRequires: tar
 BuildRequires: unzip
-BuildRequires: javapackages-tools
-BuildRequires: java-%{buildjdkver}-%{origin}%{?pkgos:-%{pkgos}}-devel
+BuildRequires: javapackages-filesystem
+BuildRequires: java-%{featurever}-%{origin}%{?pkgos:-%{pkgos}}-devel
 # Zero-assembler build requirement
 %ifarch %{zero_arches}
 BuildRequires: libffi-devel
 %endif
 # Full documentation build requirements
-# pandoc is not available on RHEL 7
-%if 0%{?rhel} >= 8
+# pandoc is only available on RHEL/CentOS 8
+%if 0%{?rhel} == 8
 BuildRequires: graphviz
 BuildRequires: pandoc
 %endif
 # cacerts build requirement in portable mode
 BuildRequires: ca-certificates
-# Earlier versions have a bug in tree vectorization on PPC
-BuildRequires: gcc >= 4.8.3-8

 %if %{with_systemtap}
 BuildRequires: systemtap-sdt-devel
@ -748,8 +772,10 @@ Provides: bundled(libpng) = 1.6.43
 # Version in src/java.base/share/native/libzip/zlib/zlib.h
 Provides: bundled(zlib) = 1.3.1
 # We link statically against libstdc++ to increase portability
+%ifnarch %{devkit_arches}
 BuildRequires: libstdc++-static
 %endif
+%endif

 # this is always built, also during debug-only build
 # when it is built in debug-only this package is just placeholder
@ -892,12 +918,13 @@ The %{origin_nice} %{featurever} miscellany.
 %prep

 echo "Preparing %{oj_vendor_version}"
+echo "System is RHEL=%{?rhel}%{!?rhel:0}, CentOS=%{?centos}%{!?centos:0}, EPEL=%{?epel}%{!?epel:0}, Fedora=%{?fedora}%{!?fedora:0}"

 # Using the echo macro breaks rpmdev-bumpspec, as it parses the first line of stdout :-(
-%if 0%{?_build_cpu:1}
-  echo "CPU: %{_target_cpu}, arch install directory: %{archinstall}, SystemTap install directory: %{_build_cpu}"
+%if 0%{?stapinstall:1}
+  echo "CPU: %{_target_cpu}, arch install directory: %{archinstall}, SystemTap install directory: %{stapinstall}"
 %else
-  %{error:Unrecognised architecture %{_build_cpu}}
+  %{error:Unrecognised architecture %{_target_cpu}}
 %endif

 if [ %{include_normal_build} -eq 0 -o  %{include_normal_build} -eq 1 ] ; then
@ -961,6 +988,8 @@ sh %{SOURCE12} %{top_level_dir_name}
 pushd %{top_level_dir_name}
 # Add crypto policy and FIPS support
 %patch -P1001 -p1
+# Add early JDK-8351500
+%patch -P2001 -p1
 popd # openjdk


@ -1006,8 +1035,24 @@ done
 # Prepare desktop files
 # Portables do not have desktop integration

-%build
+# Extract devkit
+%ifarch %{devkit_arches}
+  devkittarball=%{_datadir}/%{devkit_name}/sdk-%{_target_cpu}-%{_target_os}-gnu*.tar.gz
+  echo "Extracting devkit ${devkittarball}";
+  mkdir devkit;
+  tar -C devkit --strip-components=1 -xzf ${devkittarball}
+  DEVKIT_ROOT=$(pwd)/devkit
+  source ${DEVKIT_ROOT}/devkit.info
+  echo "Installed ${DEVKIT_NAME} devkit"
+%else
+%if 0%{?centos} > 0
+  echo "No devkit for CentOS %{?centos}"
+%else
+  echo "No devkit for %{_target_cpu} on RHEL %{?rhel}";
+%endif
+%endif

+%build
 # How many CPU's do we have?
 export NUM_PROC=%(/usr/bin/getconf _NPROCESSORS_ONLN 2> /dev/null || :)
 export NUM_PROC=${NUM_PROC:-1}
@ -1039,6 +1084,15 @@ EXTRA_CFLAGS="$EXTRA_CFLAGS -fno-strict-aliasing"
 EXTRA_CFLAGS="$(echo ${EXTRA_CFLAGS} | sed -e 's|-mstackrealign|-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4|')"
 EXTRA_CPP_FLAGS="$(echo ${EXTRA_CPP_FLAGS} | sed -e 's|-mstackrealign|-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4|')"
 %endif
+%ifarch %{devkit_arches}
+# Remove annobin plugin reference which isn't available in the devkit
+EXTRA_CFLAGS="$(echo ${EXTRA_CFLAGS} | sed -e 's|-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1||')"
+EXTRA_CPP_FLAGS="$(echo ${EXTRA_CPP_FLAGS} | sed -e 's|-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1||')"
+# Force DWARF 4 for compatibility
+EXTRA_CFLAGS="${EXTRA_CFLAGS} -gdwarf-4"
+EXTRA_CPP_FLAGS="${EXTRA_CPP_FLAGS} -gdwarf-4"
+%endif
+
 export EXTRA_CFLAGS EXTRA_CPP_FLAGS

 # Set modification times (mtimes) of files within JAR files generated
@ -1086,16 +1140,6 @@ export EXTRA_CFLAGS EXTRA_CPP_FLAGS
 VERSION_FILE="$(pwd)"/"%{top_level_dir_name}"/make/conf/version-numbers.conf
 OPENJDK_UPSTREAM_TAG_EPOCH="$(stat --format=%Y "${VERSION_FILE}")"

-echo "Building %{SOURCE11}"
-mkdir -p %{altjavaoutputdir}
-gcc ${EXTRA_CFLAGS} -o %{altjavaoutputdir}/%{alt_java_name} %{SOURCE11}
-echo "Generating %{alt_java_name} man page"
-altjavamanpage=%{altjavaoutputdir}/%{alt_java_name}.1
-echo "Hardened java binary recommended for launching untrusted code from the Web e.g. javaws" > ${altjavamanpage}
-cat %{top_level_dir_name}/src/java.base/share/man/java.1 >> ${altjavamanpage}
-
-echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}"
-
 function buildjdk() {
    local outputdir=${1}
    local buildjdk=${2}
@ -1103,6 +1147,7 @@ function buildjdk() {
    local debuglevel=${4}
    local link_opt=${5}
    local debug_symbols=${6}
+    local devkit=${7}

    local top_dir_abs_src_path=$(pwd)/%{top_level_dir_name}
    local top_dir_abs_build_path=$(pwd)/${outputdir}
@ -1124,6 +1169,11 @@ function buildjdk() {
    echo "Using debug_symbols: ${debug_symbols}"
    echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}"

+%ifarch %{devkit_arches}
+    LIBPATH="${devkit}/lib:${devkit}/lib64"
+    echo "Setting library path to ${LIBPATH}"
+%endif
+
    mkdir -p ${outputdir}
    pushd ${outputdir}

@ -1131,19 +1181,23 @@ function buildjdk() {
    # rather than ${link_opt} as the system versions
    # are always used in a system_libs build, even
    # for the static library build
-    scl enable devtoolset-%{dtsversion} "bash ${top_dir_abs_src_path}/configure \
+    LD_LIBRARY_PATH=${LIBPATH} \
+    bash ${top_dir_abs_src_path}/configure \
 %ifarch %{zero_arches}
    --with-jvm-variants=zero \
 %endif
-    --with-cacerts-file=`readlink -f %{_sysconfdir}/pki/java/cacerts`  \
+%ifarch %{devkit_arches}
+    --with-devkit=${devkit} \
+%endif
+    --with-cacerts-file=$(readlink -f %{_sysconfdir}/pki/java/cacerts)  \
    --with-version-build=%{buildver} \
-    --with-version-pre=\"%{ea_designator}\" \
-    --with-version-opt=\"%{lts_designator}\" \
-    --with-vendor-version-string=\"%{oj_vendor_version}\" \
-    --with-vendor-name=\"%{oj_vendor}\" \
-    --with-vendor-url=\"%{oj_vendor_url}\" \
-    --with-vendor-bug-url=\"%{oj_vendor_bug_url}\" \
-    --with-vendor-vm-bug-url=\"%{oj_vendor_bug_url}\" \
+    --with-version-pre="%{ea_designator}" \
+    --with-version-opt="%{lts_designator}" \
+    --with-vendor-version-string="%{oj_vendor_version}" \
+    --with-vendor-name="%{oj_vendor}" \
+    --with-vendor-url="%{oj_vendor_url}" \
+    --with-vendor-bug-url="%{oj_vendor_bug_url}" \
+    --with-vendor-vm-bug-url="%{oj_vendor_bug_url}" \
    --with-boot-jdk=${buildjdk} \
    --with-debug-level=${debuglevel} \
    --with-native-debug-symbols="${debug_symbols}" \
@ -1157,25 +1211,28 @@ function buildjdk() {
    --with-lcms=${link_opt} \
    --with-harfbuzz=${link_opt} \
    --with-stdc++lib=${libc_link_opt} \
-    --with-extra-cxxflags=\"$EXTRA_CPP_FLAGS\" \
-    --with-extra-cflags=\"$EXTRA_CFLAGS\" \
-    --with-extra-ldflags=\"%{ourldflags}\" \
-    --with-num-cores=\"$NUM_PROC\" \
-    --with-source-date=\"version\" \
+    --with-extra-cxxflags="$EXTRA_CPP_FLAGS" \
+    --with-extra-cflags="$EXTRA_CFLAGS" \
+    --with-extra-ldflags="%{ourldflags}" \
+    --with-num-cores="$NUM_PROC" \
+    --with-source-date="version" \
    --disable-javac-server \
 %ifarch %{zgc_arches}
    --with-jvm-features=zgc \
 %endif
-    --disable-warnings-as-errors"
+    --disable-warnings-as-errors

    cat spec.gmk
-    scl enable devtoolset-%{dtsversion} "make LOG=trace $maketargets || \
-        ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name \"hs_err_pid*.log\" | xargs cat && false )"
+    LD_LIBRARY_PATH=${LIBPATH} \
+    make LOG=trace $maketargets || \
+        ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name \"hs_err_pid*.log\" | xargs cat && false )
+
    popd
 }

 function stripjdk() {
    local outputdir=${1}
+    local toolpath=${2}
    local jdkimagepath=images/%{jdkimage}
    local jreimagepath=images/%{jreimage}
    local jmodimagepath=images/jmods
@ -1185,6 +1242,14 @@ function stripjdk() {
    local jdkoutdir=${outputdir}/${jdkimagepath}
    local jreoutdir=${outputdir}/${jreimagepath}

+%ifarch %{devkit_arches}
+    OBJCOPY=${toolpath}/objcopy
+    STRIP=${toolpath}/strip
+%else
+    OBJCOPY=$(which objcopy)
+    STRIP=$(which strip)
+%endif
+
    if [ "x$suffix" = "x" ] ; then
        # Keep the unstripped version for consumption by RHEL RPMs
        cp -a ${jdkoutdir}{,.unstripped}
@ -1193,9 +1258,9 @@ function stripjdk() {
        for file in $(find ${jdkoutdir} ${jreoutdir} ${supportdir} ${modulebuildpath} -type f) ; do
            if file ${file} | cut -d ':' -f 2 | grep -q 'ELF'; then
                noextfile=${file/.so/};
-                scl enable devtoolset-%{dtsversion} "objcopy --only-keep-debug ${file} ${noextfile}.debuginfo";
-                scl enable devtoolset-%{dtsversion} "objcopy --add-gnu-debuglink=${noextfile}.debuginfo ${file}";
-                scl enable devtoolset-%{dtsversion} "strip -g ${file}";
+                ${OBJCOPY} --only-keep-debug ${file} ${noextfile}.debuginfo;
+                ${OBJCOPY} --add-gnu-debuglink=${noextfile}.debuginfo ${file};
+                ${STRIP} -g ${file};
            fi
        done

@ -1466,11 +1531,31 @@ function packagejdk() {

 }

+%ifarch %{devkit_arches}
+  DEVKIT_ROOT=$(pwd)/devkit
+  source ${DEVKIT_ROOT}/devkit.info
+  GCC="${DEVKIT_TOOLCHAIN_PATH}/gcc --sysroot=${DEVKIT_SYSROOT}"
+  LIBPATH="${DEVKIT_ROOT}/lib:${DEVKIT_ROOT}/lib64"
+%else
+  GCC=$(which gcc)
+%endif
+
+echo "Building %{SOURCE11}"
+mkdir -p %{altjavaoutputdir}
+LD_LIBRARY_PATH="${LIBPATH}" ${GCC} ${EXTRA_CFLAGS} -o %{altjavaoutputdir}/%{alt_java_name} %{SOURCE11}
+echo "Generating %{alt_java_name} man page"
+altjavamanpage=%{altjavaoutputdir}/%{alt_java_name}.1
+echo "Hardened java binary recommended for launching untrusted code from the Web e.g. javaws" > ${altjavamanpage}
+cat %{top_level_dir_name}/src/java.base/share/man/java.1 >> ${altjavamanpage}
+
+echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}"
+
 %if %{build_hotspot_first}
  # Build a fresh libjvm.so first and use it to bootstrap
+  echo "Building HotSpot only for the latest libjvm.so"
  cp -LR --preserve=mode,timestamps %{bootjdk} newboot
  systemjdk=$(pwd)/newboot
-  buildjdk build/newboot ${systemjdk} %{hotspot_target} "release" "bundled" "internal"
+  buildjdk build/newboot ${systemjdk} %{hotspot_target} "release" "bundled" "internal" ${DEVKIT_ROOT}
  mv build/newboot/jdk/lib/%{vm_variant}/libjvm.so newboot/lib/%{vm_variant}
 %else
  systemjdk=%{bootjdk}
@ -1513,15 +1598,15 @@ for suffix in %{build_loop} ; do
      run_bootstrap=%{bootstrap_build}
  fi
  if ${run_bootstrap} ; then
-      buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild} ${link_opt} ${debug_symbols}
+      buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild} ${link_opt} ${debug_symbols} ${DEVKIT_ROOT}
      installjdk ${bootbuilddir} ${bootinstalldir}
-      buildjdk ${builddir} $(pwd)/${bootinstalldir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols}
-      stripjdk ${builddir}
+      buildjdk ${builddir} $(pwd)/${bootinstalldir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} ${DEVKIT_ROOT}
+      stripjdk ${builddir} ${DEVKIT_TOOLCHAIN_PATH}
      installjdk ${builddir} ${installdir}
      %{!?with_artifacts:rm -rf ${bootinstalldir}}
  else
-      buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols}
-      stripjdk ${builddir}
+      buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} ${DEVKIT_ROOT}
+      stripjdk ${builddir} ${DEVKIT_TOOLCHAIN_PATH}
      installjdk ${builddir} ${installdir}
  fi
  packagejdk ${installdir} ${packagesdir} %{altjavaoutputdir}
@ -1555,6 +1640,22 @@ export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage}
 #sed -i -e "s:^security.useSystemPropertiesFile=.*:security.useSystemPropertiesFile=true:" \
 #${JAVA_HOME}/conf/security/java.security

+# Set up tools
+%ifarch %{devkit_arches}
+  DEVKIT_ROOT=$(pwd)/devkit
+  source ${DEVKIT_ROOT}/devkit.info
+  NM="${DEVKIT_TOOLCHAIN_PATH}/nm"
+%else
+  NM=$(which nm)
+%endif
+# elfutils readelf supports more binaries than binutils version on RHEL 8
+# and debug symbols tests below were designed around this version
+READELF=$(which eu-readelf)
+# Only native gdb seems to work
+# The devkit gdb needs the devkit stdc++ library but then the JVM
+# segfaults when this is on the LD_LIBRARY_PATH
+GDB=$(which gdb)
+
 # Check Shenandoah is enabled
 %if %{use_shenandoah_hotspot}
 $JAVA_HOME/bin/java -XX:+UnlockExperimentalVMOptions -XX:+UseShenandoahGC -version
@ -1616,14 +1717,14 @@ $JAVA_HOME/bin/java -XX:+UnlockExperimentalVMOptions -XX:+UseShenandoahGC -versi
 %endif

 # Check java launcher has no SSB mitigation
-if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi
+if ! ${NM} $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi

 # Check alt-java launcher has SSB mitigation on supported architectures
 # set_speculation function exists in both cases, so check for prctl call
 %ifarch %{ssbd_arches}
-nm %{altjavaoutputdir}/%{alt_java_name} | grep prctl
+${NM} %{altjavaoutputdir}/%{alt_java_name} | grep prctl
 %else
-if ! nm %{altjavaoutputdir}/%{alt_java_name} | grep prctl ; then true ; else false; fi
+if ! ${NM} %{altjavaoutputdir}/%{alt_java_name} | grep prctl ; then true ; else false; fi
 %endif

 %if %{include_staticlibs}
@ -1631,8 +1732,8 @@ if ! nm %{altjavaoutputdir}/%{alt_java_name} | grep prctl ; then true ; else fal
 export STATIC_LIBS_HOME=${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image}
 ls -l $STATIC_LIBS_HOME
 ls -l $STATIC_LIBS_HOME/lib
-readelf --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet4AddressImpl.c
-readelf --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet6AddressImpl.c
+${READELF} --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet4AddressImpl.c
+${READELF} --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet6AddressImpl.c
 %endif

 # Release builds strip the debug symbols into external .debuginfo files
@ -1651,15 +1752,15 @@ do

    # Test for .debug_* sections in the shared object. This is the main test
    # Stripped objects will not contain these
-    eu-readelf -S "$lib" | grep "] .debug_"
-    test $(eu-readelf -S "$lib" | grep -E "\]\ .debug_(info|abbrev)" | wc --lines) == 2
+    ${READELF} -S "$lib" | grep "] .debug_"
+    test $(${READELF} -S "$lib" | grep -E "\]\ .debug_(info|abbrev)" | wc --lines) == 2

    # Test FILE symbols. These will most likely be removed by anything that
    # manipulates symbol tables because it's generally useless. So a nice test
    # that nothing has messed with symbols
    old_IFS="$IFS"
    IFS=$'\n'
-    for line in $(eu-readelf -s "$lib" | grep "00000000      0 FILE    LOCAL  DEFAULT")
+    for line in $(${READELF} -s "$lib" | grep "00000000      0 FILE    LOCAL  DEFAULT")
    do
     # We expect to see .cpp and .S files, except for architectures like aarch64 and
     # s390 where we expect .o and .oS files
@ -1669,17 +1770,17 @@ do

    # If this is the JVM, look for javaCalls.(cpp|o) in FILEs, for extra sanity checking
    if [ "`basename $lib`" = "libjvm.so" ]; then
-      eu-readelf -s "$lib" | \
+      ${READELF} -s "$lib" | \
        grep -E "00000000      0 FILE    LOCAL  DEFAULT      ABS javaCalls.(cpp|o)$"
    fi

    # Test that there are no .gnu_debuglink sections pointing to another
    # debuginfo file. There shouldn't be any debuginfo files, so the link makes
    # no sense either
-    eu-readelf -S "$lib" | grep 'gnu'
-    if eu-readelf -S "$lib" | grep '] .gnu_debuglink' | grep PROGBITS; then
+    ${READELF} -S "$lib" | grep 'gnu'
+    if ${READELF} -S "$lib" | grep '] .gnu_debuglink' | grep PROGBITS; then
      echo "bad .gnu_debuglink section."
-      eu-readelf -x .gnu_debuglink "$lib"
+      ${READELF} -x .gnu_debuglink "$lib"
      false
    fi
  fi
@ -1691,7 +1792,7 @@ done
 # Using line number 1 might cause build problems. See:
 # https://bugzilla.redhat.com/show_bug.cgi?id=1539664
 # https://bugzilla.redhat.com/show_bug.cgi?id=1538767
-gdb -q "$JAVA_HOME/bin/java" <<EOF | tee gdb.out
+${GDB} -q "$JAVA_HOME/bin/java" <<EOF | tee gdb.out
 handle SIGSEGV pass nostop noprint
 handle SIGILL pass nostop noprint
 set breakpoint pending on
@ -1838,6 +1939,34 @@ done
 %endif

 %changelog
+* Thu May 08 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.7.0.6-2
+- Add local version of JDK-8351500 for early interim release before 21.0.8
+- Resolves: OPENJDK-3679
+
+* Fri Apr 11 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.7.0.6-1
+- Update to jdk-21.0.7+6 (GA)
+- Update release notes to 21.0.7+6
+- Rebase FIPS support against 21.0.7+5
+- ** This tarball is embargoed until 2025-04-15 @ 1pm PT. **
+- Resolves: OPENJDK-3789
+
+* Sat Jan 11 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.6.0.7-1
+- Update to jdk-21.0.6+7 (GA)
+- Update release notes to 21.0.6+7
+- Build with DWARF 4 debuginfo for compatibility with older toolchains
+- Check for CentOS being defined to determine use of devkit
+- Bump devkit requirement to 1.0-9 to bring in updated sysroot
+- Drop workaround of building s390x with dynamic libstdc++
+- Turn on fresh_libjvm now 21.0.5 with JDK-8329088 is released
+- ** This tarball is embargoed until 2025-01-21 @ 1pm PT. **
+- Resolves: OPENJDK-3556
+- Resolves: OPENJDK-3590
+- Related: OPENJDK-3070
+
+* Thu Nov 28 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.11-2
+- Bump devkit requirement to 1.0-8 to bring in the gcc with --enable-linker-build-id
+- Related: OPENJDK-3068
+
 * Wed Oct 16 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.11-1
 - Update to jdk-21.0.5+11 (GA)
 - Update release notes to 21.0.5+11
@ -1874,6 +2003,14 @@ done
 - Update to jdk-21.0.4+7 (GA)
 - Update release notes to 21.0.4+7
 - Switch to GA mode.
+- Sync with RHEL 7 portable build:
+  - Conditionally define __os_install_post, dtsversion & pkgos only on RHEL 7
+  - Use ExclusiveArch over ExcludeArch
+  - Depend on devtoolset only on RHEL 7
+  - Use javapackages-filesystem rather than manually defining _jvmdir
+  - Restrict pandoc dependency to RHEL/CentOS 8
+  - Drop unused component macro
+- Sync ExclusiveArch with devkit_arches on RHEL only
 - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **
 - Resolves: OPENJDK-2756
 - Resolves: OPENJDK-3163
@ -1883,11 +2020,11 @@ done
 - Update release notes to 21.0.4+5
 - Move unstripped, misc and doc tarball handling into normal build / no suffix blocks
 - Limit Java only tests to one architecture using jdk_test_arch
- Drop unneeded tzdata-java build dependency following 3e3cf8fa2df7bac2f6a60a0ddd596ec39228a3e1
- Resolves: OPENJDK-3132
- Resolves: OPENJDK-3194
- Resolves: OPENJDK-3181
- Resolves: OPENJDK-3189
+- Drop unneeded tzdata-java build dependency following f854bb3955fb57bba4e83d09813e9cfd0e81079e
+- Resolves: OPENJDK-3133
+- Resolves: OPENJDK-3237
+- Resolves: OPENJDK-3182
+- Resolves: OPENJDK-3190

 * Sat Jun 22 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.1-0.1.ea
 - Update to jdk-21.0.4+1 (EA)
@ -1895,26 +2032,15 @@ done
 - Switch to EA mode
 - Bump LCMS 2 version to 2.16.0 following JDK-8321489
 - Add zlib build requirement or bundled version (1.3.1), depending on system_libs setting
- Resolves: OPENJDK-3060
- Resolves: OPENJDK-3063
-
-* Tue Jun 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.9-3
- Re-run jlink to regenerate the jmods directory and lib/modules with stripped libraries
- Rebuild CDS archives against the updated lib/modules
- Resolves: OPENJDK-2829
-
-* Wed May 01 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.9-2
- createtar: Add exclude option
- packagejdk: Exclude debuginfo when creating jdkarchive and jrearchive tarballs
- Resolves: OPENJDK-2995
+- Resolves: OPENJDK-3061
+- Resolves: OPENJDK-3064

 * Sat Apr 13 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.9-1
 - Update to jdk-21.0.3+9 (GA)
 - Update release notes to 21.0.3+9
 - Switch to GA mode.
- Change --with-source-date value to 'version' to match Temurin builds
+- Update buildjdkver to match the featurever
 - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
- Resolves: OPENJDK-2585

 * Thu Apr 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.7-0.1.ea
 - Update to jdk-21.0.3+7 (EA)
@ -1924,32 +2050,7 @@ done
 - Drop JDK-8009550 which is now available upstream
 - Re-generate FIPS patch against 21.0.3+7 following backport of JDK-8325254

-* Thu Mar 21 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.2.ea
- generate_source_tarball.sh: Update examples in header for clarity
- generate_source_tarball.sh: Cleanup message issued when checkout already exists
- generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
- generate_source_tarball.sh: Only add --depth=1 on non-local repositories
- icedtea_sync.sh: Reinstate from rhel-8.9.0 branch
- Move maintenance scripts to a scripts subdirectory
- discover_trees.sh: Set compile-command and indentation instructions for Emacs
- discover_trees.sh: shellcheck: Do not use -o (SC2166)
- discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
- discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
- generate_source_tarball.sh: Add authorship
- icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
- icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
- icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
- openjdk_news.sh: Set compile-command and indentation instructions for Emacs
- openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
- openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
- openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
- generate_source_tarball.sh: Output values of new options WITH_TEMP and OPENJDK_LATEST
- generate_source_tarball.sh: Double-quote DEPTH reference (SC2086)
- Vary reproducible tar creation by version of tar detected
- Set OPENJDK_UPSTREAM_TAG_EPOCH & VERSION_FILE at start of build section as in 17u
- generate_source_tarball.sh: Avoid empty DEPTH reference while still appeasing shellcheck
-
-* Wed Mar 20 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.1-0.2.ea
+* Wed Mar 20 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.1-0.1.ea
 - generate_source_tarball.sh: Add WITH_TEMP environment variable
 - generate_source_tarball.sh: Multithread xz on all available cores
 - generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
@ -1978,54 +2079,83 @@ done
 - generate_source_tarball.sh: Add license
 - generate_source_tarball.sh: Add indentation instructions for Emacs
 - Remove -T0 argument from systemtap tar invocation
-
-* Mon Mar 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.2.ea
- Introduce tar_opts to avoid repetition of lengthy tar creation options
- Add module build path to stripped directories to catch jpackageapplauncher files
- Move alt-java man page to the misc tarball so it is not in the JDK image
- Resolves: OPENJDK-2820
- Resolves: OPENJDK-2821
-
-* Thu Feb 08 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.1-0.2.ea
- Invoke xz in multi-threaded mode
- Remove ppc64le with-jobs=1 workaround
- Make portable tarball modification times reproducible
 - Use RHEL-7 tar-1.26-compatible invocations for reproducible tarballs
+- createtar: Add exclude option
+- packagejdk: Exclude debuginfo when creating jdkarchive and jrearchive tarballs
+- Resolves: OPENJDK-2995

-* Fri Feb 02 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.1.ea
+* Mon Mar 18 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.1.ea
 - Update to jdk-21.0.3+1 (EA)
 - Update release notes to 21.0.3+1
 - Switch to EA mode
 - Require tzdata 2023d due to upstream inclusion of JDK-8322725
 - Bump FreeType version to 2.13.2 following JDK-8316028
+- Add module build path to stripped directories to catch jpackageapplauncher files
+- Move alt-java man page to the misc tarball so it is not in the JDK image
+- generate_source_tarball.sh: Update examples in header for clarity
+- generate_source_tarball.sh: Cleanup message issued when checkout already exists
+- generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
+- generate_source_tarball.sh: Only add --depth=1 on non-local repositories
+- icedtea_sync.sh: Reinstate from rhel-8.9.0 branch
+- Move maintenance scripts to a scripts subdirectory
+- discover_trees.sh: Set compile-command and indentation instructions for Emacs
+- discover_trees.sh: shellcheck: Do not use -o (SC2166)
+- discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
+- discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
+- generate_source_tarball.sh: Add authorship
+- icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
+- icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
+- icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
+- openjdk_news.sh: Set compile-command and indentation instructions for Emacs
+- openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
+- openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
+- openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
+- generate_source_tarball.sh: Output values of new options WITH_TEMP and OPENJDK_LATEST
+- generate_source_tarball.sh: Double-quote DEPTH reference (SC2086)
+- generate_source_tarball.sh: Avoid empty DEPTH reference while still appeasing shellcheck
+- Vary reproducible tar creation by version of tar detected
+- Set OPENJDK_UPSTREAM_TAG_EPOCH & VERSION_FILE at start of build section as in 17u
+- Change --with-source-date value to 'version' to match Temurin builds
+- Re-run jlink to regenerate the jmods directory and lib/modules with stripped libraries
+- Rebuild CDS archives against the updated lib/modules
+- Require openjdk-devkit 1.0-4 to bring in fixes for .comment section and deterministic archives
+- Bump devkit requirement to 1.0-5 to bring in the bootstrapped version
+- Set LD_LIBRARY_PATH when calling gcc to build alt-java
+- Set LD_LIBRARY_PATH when calling configure
+- Set LD_LIBRARY_PATH when calling make
+- Bump devkit requirement to 1.0-6 to bring in the AS=<path>/as fix
+- Resolves: OPENJDK-2820
+- Resolves: OPENJDK-2821
+- Resolves: OPENJDK-2585
+- Resolves: OPENJDK-3138

-* Sat Jan 27 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-2
- Sync with upstream release notes
-
-* Tue Jan 09 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-1
+* Fri Mar 15 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-1
 - Update to jdk-21.0.2+13 (GA)
 - Update release notes to 21.0.2+13
- Drop no longer needed local patch to fix versioning
- ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
-
-* Mon Jan 08 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.12-1
- Update to jdk-21.0.2+12 (GA)
- Update release notes to 21.0.2+12
- ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
-
-* Sat Jan 06 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.11-1
- Update to jdk-21.0.2+11 (GA)
- Update release notes to 21.0.2+11
 - Bump libpng version to 1.6.40 following JDK-8316030
 - Bump HarfBuzz version to 8.2.2 following JDK-8313643
- Drop local JDK-8311630 patch which is now upstream
- Locally patch versioning to be 21.0.2 released on 2014-01-16
- ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
+- pandoc is only available on RHEL/CentOS 8
+- Check for CentOS being defined to determine use of devkit
+- Set buildjdkver to 20 until OpenJDK 21 is available in the buildroot
+- Use featurever for JDK build dependencies

-* Mon Nov 06 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-2
- Include JDK-8311630 patch to implement Foreign Function & Memory preview API on s390x
+* Mon Mar 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-2
+- Use a devkit to build on architectures where we have one (s390x, aarch64, ppc64le, x86_64)
+- Use a dynamic libstdc++ on s390x to workaround failure with static libstdc++
+- Use the devkit tools during the check stage so they can understand the generated binaries
+- Use eu-readelf on devkit and non-devkit builds as debug symbol tests rely on its behaviour
+- Use system gdb for both builds as devkit version fails (needs devkit libraries, then JDK segfaults with them)
+- Filter out annobin plugin when using the devkit
+- Drop static libstdc++ build dependency on devkit builds as it should come from the devkit
+- Disable devkit build on CentOS where it is unavailable
+- Introduce tar_opts to avoid repetition of lengthy tar creation options

-* Sun Oct 29 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-1
+* Thu Feb 08 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.1.0.12-2
+- Invoke xz in multi-threaded mode
+- Remove ppc64le with-jobs=1 workaround
+- Make portable tarball modification times reproducible
+
+* Fri Oct 27 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-1
 - Update to jdk-21.0.1.0+12 (GA)
 - Update release notes to 21.0.1.0+12
 - Update openjdk_news script to specify subdirectory last
@ -2035,17 +2165,33 @@ done
 - Update bug URL for RHEL to point to the Red Hat customer portal
 - Fix upstream release URL for OpenJDK source
 - Update buildjdkver to match the featurever
+
+* Fri Oct 27 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-4
+- Rebuild jmods using the stripped binaries in release builds
+- Make sure the unstripped JDK is customised by the installjdk function
+- Resolves: OPENJDK-3224
+
+* Thu Oct 26 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-3
 - Re-enable SystemTap support and perform only substitutions possible without final NVR available
+- Depend on graphviz & pandoc for full documentation support
 - Fix typo which stops the EA designator being included in the build
 - Include tapsets in the miscellaneous tarball
 - Drop unused globals for tapset installation
- Rebuild jmods using the stripped binaries in release builds
- Make sure the unstripped JDK is customised by the installjdk function

-* Sat Oct 28 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-1
+* Thu Aug 24 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-2
+- Update documentation (README.md, add missing JEP to release notes)
+- Replace alt-java patch with a binary separate from the JDK
+- Adapt alt-java test to new binary where there is always a set_speculation function
+- Drop stale patches that are of little use any more:
+- * nss.cfg has been disabled since early PKCS11 work and long superseded by FIPS work
+- * No accessibility subpackage to warrant RH1648242 patch any more
+- * No use of system libjpeg turbo to warrant RH649512 patch any more
+- Replace RH1684077 pcsc-lite-libs patch with better JDK-8009550 fix being upstreamed
+- Related: rhbz#2192749
+
+* Mon Aug 21 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-1
 - Update to jdk-21.0.0+35
 - Update release notes to 21.0.0+35
- Update documentation (README.md)
 - Update system crypto policy & FIPS patch from new fips-21u tree
 - Update generate_tarball.sh to sync with upstream vanilla script inc. no more ECC removal
 - Drop fakefeaturever now it is no longer needed
@ -2053,42 +2199,39 @@ done
 - Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
 - Use upstream release URL for OpenJDK source
 - Re-enable tzdata tests now we are on the latest JDK and things are back in sync
- Fix trailing '.' in tarball name
- Use rpmrelease in vendor version to avoid inclusion of dist tag
- Replace alt-java patch with a binary separate from the JDK
- Drop stale patches that are of little use any more:
- * nss.cfg has been disabled since early PKCS11 work and long superseded by FIPS work
- * No accessibility subpackage to warrant RH1648242 patch any more
- * No use of system libjpeg turbo to warrant RH649512 patch any more
- Replace RH1684077 pcsc-lite-libs patch with better JDK-8009550 fix being upstreamed
+- Related: rhbz#2192749

-* Sat Oct 28 2023 Petra Alice Mikova <pmikova@redhat.com> - 1:21.0.0.0.35-1
+* Mon Aug 21 2023 Petra Alice Mikova <pmikova@redhat.com> - 1:21.0.0.0.35-1
 - Replace smoke test files used in the staticlibs test, as fdlibm was removed by JDK-8303798
 - Related: rhbz#2192749

-* Fri Oct 27 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:20.0.2.0.9-1.1
+* Wed Aug 16 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:20.0.2.0.9-1
 - Update to jdk-20.0.2+9
 - Update release notes to 20.0.2+9
 - Update system crypto policy & FIPS patch from new fips-20u tree
 - Update generate_tarball.sh ICEDTEA_VERSION
 - Update CLDR reference data following update to 42 (Rocky Mountain-Normalzeit => Rocky-Mountain-Normalzeit)
- Related: rhbz#2192749

-* Fri Oct 27 2023 Jiri Vanek <jvanek@redhat.com> - 1:20.0.0.0.36-1
+* Wed Aug 16 2023 Jiri Vanek <jvanek@redhat.com> - 1:20.0.2.0.9-1
 - Dropped JDK-8295447, JDK-8296239 & JDK-8299439 patches now upstream
 - Adapted rh1750419-redhat_alt_java.patch
- Related: rhbz#2192749

-* Fri Oct 27 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:19.0.1.0.10-1
+* Tue Aug 15 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:19.0.2.0.7-2
+- Bump rpmrelease to rebuild for CentOS 9
+
+* Tue Aug 15 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:19.0.2.0.7-1
 - Update to jdk-19.0.2 release
 - Update release notes to 19.0.2
 - Rebase FIPS patches from fips-19u branch
 - Remove references to sample directory removed by JDK-8284999
 - Add local patch JDK-8295447 (javac NPE) which was accepted into 19u upstream but not in the GA tag
 - Add local patches for JDK-8296239 & JDK-8299439 (Croatia Euro update) which are present in 8u, 11u & 17u releases
- Related: rhbz#2192749
+- Switch buildjdkver to java-21-openjdk

-* Tue Oct 24 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:18.0.2.0.9-1
+* Thu Aug 10 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:18.0.2.0.9-2
+- Bump rpmrelease to rebuild for CentOS 9
+
+* Thu Aug 10 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:18.0.2.0.9-1
 - Update to jdk-18.0.2 release
 - Update release notes to actually reflect OpenJDK 18
 - Support JVM variant zero following JDK-8273494 no longer installing Zero's libjvm.so in the server directory
@ -2096,27 +2239,20 @@ done
 - Rebase RH1648249 nss.cfg patch so it applies after the FIPS patch
 - Automatically turn off building a fresh HotSpot first, if the bootstrap JDK is not the same major version as that being built
 - Drop tzdata patches added for 17.0.7 which will eventually appear in the upstream tarball when we reach OpenJDK 21
- Switch bootjdkver to java-21-openjdk
 - Disable tzdata tests until we are on the latest JDK and things are back in sync
- Drop bootstrap JDKs and use the java-21-openjdk-rhel7 build
- Related: rhbz#2192749

-* Tue Oct 24 2023 Petra Alice Mikova <pmikova@redhat.com> - 1:18.0.0.0.37-1
+* Thu Aug 10 2023 Petra Alice Mikova <pmikova@redhat.com> - 1:18.0.0.0.37-1
 - Update to ea version of jdk18
 - Adjust rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch

-* Tue Aug 22 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-2
- Define architectures we build on to avoid those without DTS 10 (e.g. s390)
-
-* Tue Aug 22 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-2
- Switch to DTS 10
- Related: rhbz#2192749
+* Mon May 15 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-3
+- Bump rpmrelease to rebuild for CentOS 9

 * Mon May 15 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-2
 - Create java-21-openjdk-portable package based on java-17-openjdk-portable
 - Related: rhbz#2192749

-* Thu Apr 13 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-1
+* Tue Apr 25 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-2
 - Update to jdk-17.0.7.0+7
 - Update release notes to 17.0.7.0+7
 - Require tzdata 2023c due to local inclusion of JDK-8274864 & JDK-8305113
@ -2129,12 +2265,20 @@ done
 - * test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
 - * RH1940064: Enable XML Signature provider in FIPS mode
 - * RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized
+- Fix trailing '.' in tarball name
+- Use rpmrelease in vendor version to avoid inclusion of dist tag
 - ** This tarball is embargoed until 2023-04-18 @ 1pm PT. **
 - Resolves: rhbz#2185182
 - Resolves: rhbz#2134669
 - Resolves: rhbz#1940064
 - Resolves: rhbz#2173781

+* Thu Apr 20 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.6.0.10-7
+- Sync with existing RHEL 8 build, in order to start building portables on RHEL 8
+- Restore system bootstrap JDK (RHEL 8 has java-17-openjdk)
+- Remove use of devtoolset (RHEL 8 native compilers should be sufficient)
+- Explicitly exclude x86, as on RHEL RPMs
+
 * Tue Feb 21 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.6.0.10-6
 - Add docs, icons and samples to the portable output
 - Make sure generated checksums work and don't include full path
--- a/java-21-openjdk.spec
+++ b/java-21-openjdk.spec
@ -102,9 +102,9 @@
 # similarly for other %%{_jvmdir}/{jre,java} and %%{_javadocdir}/{java,java-zip}
 %define is_release_build() %( if [ "%{?1}" == "%{debug_suffix_unquoted}" -o "%{?1}" == "%{fastdebug_suffix_unquoted}" ]; then echo "0" ; else echo "1"; fi )

-# Indicates whether this is the default JDK on this version of RHEL
-# Only the default/system JDK provides unversioned Provides like 'java', 'jre' and 'java-devel'
-%global is_system_jdk 1
+# while JDK is a techpreview(is_system_jdk=0), some provides are turned off. Once jdk stops to be an techpreview, move it to 1
+# as sytem JDK, we mean any JDK which can run whole system java stack without issues (like bytecode issues, module issues, dependencies...)
+%global is_system_jdk 0

 %global aarch64         aarch64 arm64 armv8
 # we need to distinguish between big and little endian PPC64
@ -308,7 +308,7 @@
 # New Version-String scheme-style defines
 %global featurever 21
 %global interimver 0
-%global updatever 5
+%global updatever 7
 %global patchver 0
 # We don't add any LTS designator for STS packages (Fedora and EPEL).
 # We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined.
@ -344,7 +344,7 @@
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      6.0.0pre00-c848b93a8598
 # Define current Git revision for the FIPS support patches
-%global fipsver 0a42e29b391
+%global fipsver 9203d50836c
 # Define JDK versions
 %global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
 %global javaver         %{featurever}
@ -356,7 +356,7 @@
 # Define the OS the portable JDK is built on
 # This is undefined for CentOS & openjdk-portable-rhel-8 builds and
 # equals 'rhel7' for openjdk-portable-rhel-7 builds
-%if 0%{?centos} == 0
+%if 0
 %global pkgos rhel7
 %endif

@ -365,10 +365,10 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{vcstag}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        11
+%global buildver        6
 %global rpmrelease      2
 # Settings used by the portable build
-%global portablerelease 1
+%global portablerelease 2
 # Portable suffix differs between RHEL and CentOS
 %if 0%{?centos} == 0
 %global portablesuffix %{?pkgos:el7_9}%{!?pkgos:el8}
@ -377,10 +377,6 @@
 %endif
 %global portablebuilddir /builddir/build/BUILD

-%if 0%{?almalinux}
-%global portablesuffix el8
-%endif
-
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
 # Using 10 digits may overflow the int used for priority, so we combine the patch and build versions
@ -837,6 +833,8 @@ exit 0
 %doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/NEWS
 %doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/README.md
 %doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/java-%{featurever}-openjdk-portable.specfile
+%doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/openjdk-devkit.specfile
+%doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/0*.patch
 %dir %{_sysconfdir}/.java/.systemPrefs
 %dir %{_sysconfdir}/.java
 %dir %{_jvmdir}/%{sdkdir -- %{?1}}
@ -1161,8 +1159,8 @@ Requires: ca-certificates
 # Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros
 Requires: javapackages-filesystem
 # Require zone-info data provided by tzdata-java sub-package
-# 2024a required as of JDK-8325150
-Requires: tzdata-java >= 2024a
+# 2025a required as of JDK-8347965
+Requires: tzdata-java >= 2025a
 # for support of kernel stream control
 # libsctp.so.1 is being `dlopen`ed on demand
 Requires: lksctp-tools%{?_isa}
@ -1291,7 +1289,7 @@ ExclusiveArch: %{aarch64} %{ppc64le} s390x x86_64

 Name:    java-%{javaver}-%{origin}
 Version: %{newjavaver}.%{buildver}
-Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}.1.alma.1
+Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
 # Equivalent for the portable build
 %global prelease %{?eaprefix}%{portablerelease}%{?extraver}
 # java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons
@ -1364,6 +1362,25 @@ Source18: TestTranslations.java
 Source19: README.md
 Source20: java-%{featurever}-openjdk-portable.specfile
 Source21: NEWS
+Source22: openjdk-devkit.specfile
+# Devkit patches; see https://github.com/rh-openjdk/jdk/tree/devkit
+# To regenerate, use git format-patch -N jdk21u/master
+# Add RHEL RPM URLs and turn off robots
+Source23: 0001-Allow-devkit-to-work-with-RHEL.patch
+# Turn off multilib on x86_64
+Source24: 0002-Disable-multilib-on-x86_64.patch
+# Improve build logging (OPENJDK-3071)
+Source25: 0003-Log-devkit-build-to-stdout.patch
+# Remove .comment sections from sysroot objects
+Source26: 0004-devkit-Remove-.comment-sections-from-sysroot-objects.patch
+# Configure binutils with --enable-deterministic-archives
+Source27: 0005-Tools.gmk-Configure-binutils-with-enable-determinist.patch
+# Configure gcc with --enable-linker-build-id (OPENJDK-3068)
+Source28: 0006-Tools.gmk-Add-enable-linker-build-id-to-gcc-build.patch
+# Exclude systemtap-sdt-devel on s390x & ppc64* (OPENJDK-3070)
+Source29: 0007-Tools.gmk-Exclude-systemtap-sdt-devel-on-s390x-ppc64.patch
+# Use update repository on RHEL rather than GA (OPENJDK-3589)
+Source30: 0008-Tools.gmk-Use-update-repository-on-RHEL-rather-than-.patch

 # Setup variables to reference correct sources
 %global releasezip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.unstripped.jdk.%{_arch}.tar.xz
@ -1433,6 +1450,10 @@ Patch1001: fips-%{featurever}u-%{fipsver}.patch
 #
 #############################################

+# JDK-8351500: G1: NUMA migrations cause crashes in region allocation
+# Upstream in 21.0.8+1
+Patch2001: jdk8351500-numa_migration_crashes.patch
+
 #############################################
 #
 # Portable build specific patches
@ -1490,8 +1511,8 @@ BuildRequires: %{pkgnameroot}-misc = %{epoch}:%{version}-%{prelease}.%{portables
 %ifarch %{zero_arches}
 BuildRequires: libffi-devel
 %endif
-# 2024a required as of JDK-8325150
-BuildRequires: tzdata-java >= 2024a
+# 2025a required as of JDK-8347965
+BuildRequires: tzdata-java >= 2025a
 # Earlier versions have a bug in tree vectorization on PPC
 BuildRequires: gcc >= 4.8.3-8

@ -1835,6 +1856,7 @@ The %{origin_nice} %{featurever} API documentation compressed in a single archiv
 %prep

 echo "Preparing %{oj_vendor_version}"
+echo "System is RHEL=%{?rhel}%{!?rhel:0}, CentOS=%{?centos}%{!?centos:0}, EPEL=%{?epel}%{!?epel:0}, Fedora=%{?fedora}%{!?fedora:0}"

 # Using the echo macro breaks rpmdev-bumpspec, as it parses the first line of stdout :-(
 %if 0%{?stapinstall:1}
@ -1899,6 +1921,8 @@ sh %{SOURCE12} %{top_level_dir_name}
 pushd %{top_level_dir_name}
 # Add crypto policy and FIPS support
 %patch -P1001 -p1
+# Add early JDK-8351500
+%patch -P2001 -p1
 popd # openjdk


@ -2102,10 +2126,13 @@ if ! nm ${alt_java_binary} | grep prctl ; then true ; else false; fi

 %if %{include_staticlibs}
 # Check debug symbols in static libraries (smoke test)
+# Temporary workaround for debuginfo failure on x86_64 with devkit build
+%ifnarch x86_64
 export STATIC_LIBS_HOME=${JAVA_HOME}/lib/static/linux-%{archinstall}/glibc
 readelf --debug-dump $STATIC_LIBS_HOME/libnet.a | grep Inet4AddressImpl.c
 readelf --debug-dump $STATIC_LIBS_HOME/libnet.a | grep Inet6AddressImpl.c
 %endif
+%endif

 so_suffix="so"
 # Check debug symbols are present and can identify code
@ -2191,7 +2218,11 @@ miscdir=$(pwd)/%{installoutputdir -- "-misc"}
 commondocdir=${RPM_BUILD_ROOT}%{_defaultdocdir}/%{uniquejavadocdir -- $suffix}
 install -d -m 755 ${commondocdir}
 mv ${jdk_image}/NEWS ${commondocdir}
-cp -a %{SOURCE19} %{SOURCE20} ${commondocdir}
+# Copy portable and devkit specfiles and README.md
+cp -a %{SOURCE19} %{SOURCE20} %{SOURCE22} ${commondocdir}
+# Copy devkit patches
+cp -a  %{SOURCE23} %{SOURCE24} %{SOURCE25} %{SOURCE26} \
+       %{SOURCE27} %{SOURCE28} %{SOURCE29} %{SOURCE30} ${commondocdir}

 # Install the jdk
 mkdir -p $RPM_BUILD_ROOT%{_jvmdir}
@ -2536,24 +2567,53 @@ cjc.mainProgram(args)
 %endif

 %changelog
-* Tue Dec 17 2024 Eduard Abdullin <eabdullin@almalinux.org> - 1:21.0.5.0.11-2.1.alma.1
- Use el8 portable packages
+* Thu May 08 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.7.0.6-2
+- Add local version of JDK-8351500 for early interim release before 21.0.8
+- Sync the copy of the portable specfile with the latest update
+- Resolves: RHEL-90309

-* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 1:21.0.5.0.11-2.1
- Bump release for October 2024 mass rebuild:
-  Resolves: RHEL-64018
+* Fri Apr 11 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.7.0.6-1
+- Update to jdk-21.0.7+6 (GA)
+- Update release notes to 21.0.7+6
+- Rebase FIPS support against 21.0.7+5
+- Require tzdata 2025a due to upstream inclusion of JDK-8347965
+- Sync the copy of the portable specfile with the latest update
+- ** This tarball is embargoed until 2025-04-15 @ 1pm PT. **
+- Resolves: RHEL-86984
+- Resolves: RHEL-86635
+
+* Thu Feb 06 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.6.0.7-2
+- Bump tzdata requirement to 2024b for JDK-8339637
+- Resolves: RHEL-74001
+
+* Sat Jan 18 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.6.0.7-1
+- Update to jdk-21.0.6+7 (GA)
+- Update release notes to 21.0.6+7
+- Sync the copy of the portable & devkit specfiles with the latest update
+- Include the latest devkit patches
+- Update README.md to list an easier way of disabling the devkit
+- ** This tarball is embargoed until 2025-01-21 @ 1pm PT. **
+- Resolves: RHEL-73562
+
+* Fri Jan 17 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.11-3
+- Transition to the devkit build by not defining pkgos
+- Exempt x86_64 from the static libs debuginfo test until portable uses an older DWARF version
+- Sync the copy of the portable specfile with the devkit version
+- Include the devkit specfile and patches
+- Document the devkit in README.md
+- Resolves: RHEL-74403

 * Wed Oct 16 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.11-2
 - Update to jdk-21.0.5+11 (GA)
 - Update release notes to 21.0.5+11
 - Remove local JDK-8327501 & JDK-8328366 backport as this is now upstream.
 - Sync the copy of the portable specfile with the latest update
- Related: RHEL-61276
+- Related: RHEL-61344

 * Sun Oct 13 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.10-3
 - Sync the copy of the portable specfile with the latest update
 - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **
- Related: RHEL-61276
+- Related: RHEL-61344

 * Sat Oct 12 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.10-2
 - Update to jdk-21.0.5+10 (GA)
@ -2561,9 +2621,9 @@ cjc.mainProgram(args)
 - Switch to GA mode.
 - Revert JDK-8327501 & JDK-8328366 backport until more mature.
 - ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **
- Resolves: RHEL-61276
+- Resolves: RHEL-61344

-* Fri Oct 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.9-0.1.ea
+* Fri Oct 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.9-0.2.ea
 - Update to jdk-21.0.5+9 (EA)
 - Update release notes to 21.0.5+9
 - Switch to EA mode
@ -2572,32 +2632,35 @@ cjc.mainProgram(args)
 - Sync with RHEL 7 portable build:
  - Use ExclusiveArch over ExcludeArch
  - pkgos definition needs to be early enough to be used in portablesuffix
- Add build scripts to repository to ease remembering all CentOS & RHEL targets and options
 - Make build scripts executable
 - Sync the copy of the portable specfile with the latest update
- Resolves: RHEL-62239
- Resolves: RHEL-62241
+- Resolves: RHEL-58797
+- Resolves: RHEL-17191

-* Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.7-1
+* Mon Oct 07 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.7-2
+- Vary portablesuffix depending on whether we are on RHEL ('el8') or CentOS ('el9')
+- Handle debugedit being a separate package installed in /usr on RHEL/CentOS 10
+- Add build scripts to repository to ease remembering all CentOS & RHEL targets and options
+- Related: RHEL-58797
+
+* Fri Jul 12 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.7-1
 - Update to jdk-21.0.4+7 (GA)
 - Update release notes to 21.0.4+7
 - Switch to GA mode.
 - Sync the copy of the portable specfile with the latest update
 - Add missing section headers in NEWS
- Vary portablesuffix depending on whether we are on RHEL ('el8') or CentOS ('el9')
 - ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **
- Resolves: RHEL-47024
+- Resolves: RHEL-47023

-* Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.5-0.1.ea
+* Wed Jun 26 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.5-0.1.ea
 - Update to jdk-21.0.4+5 (EA)
 - Update release notes to 21.0.4+5
 - Limit Java only tests to one architecture using jdk_test_arch
 - Actually require tzdata 2024a now it is available in the buildroot
- Resolves: RHEL-45357
- Resolves: RHEL-52735
- Related: RHEL-52723
+- Resolves: RHEL-45355
+- Resolves: RHEL-47395

-* Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.1-0.1.ea
+* Sat Jun 22 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.1-0.1.ea
 - Update to jdk-21.0.4+1 (EA)
 - Update release notes to 21.0.4+1
 - Switch to EA mode
@ -2605,27 +2668,27 @@ cjc.mainProgram(args)
 - Add zlib build requirement or bundled version (1.3.1), depending on system_libs setting
 - Restore NEWS file so portable can be rebuilt
 - Sync the copy of the portable specfile with the latest update
- Related: RHEL-45357
- Resolves: RHEL-46026
+- Related: RHEL-45355
+- Resolves: RHEL-46029

-* Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.9-1
+* Sun Apr 14 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.9-1
 - Update to jdk-21.0.3+9 (GA)
 - Update release notes to 21.0.3+9
 - Switch to GA mode.
 - Sync the copy of the portable specfile with the latest update
 - ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
- Resolves: RHEL-32427
+- Resolves: RHEL-32424

-* Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.7-0.1.ea
+* Sun Apr 14 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.7-0.1.ea
 - Update to jdk-21.0.3+7 (EA)
 - Update release notes to 21.0.3+7
 - Require tzdata 2024a due to upstream inclusion of JDK-8322725
 - Only require tzdata 2023d for now as 2024a is unavailable in buildroot
 - Drop JDK-8009550 which is now available upstream
 - Re-generate FIPS patch against 21.0.3+7 following backport of JDK-8325254
- Resolves: RHEL-52723
+- Resolves: RHEL-30946

-* Sat Aug 03 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.1-0.1.ea
+* Sun Apr 14 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.1-0.2.ea
 - Invoke xz in multi-threaded mode
 - generate_source_tarball.sh: Add WITH_TEMP environment variable
 - generate_source_tarball.sh: Multithread xz on all available cores
@ -2654,14 +2717,9 @@ cjc.mainProgram(args)
 - generate_source_tarball.sh: Use long-style argument to grep
 - generate_source_tarball.sh: Add license
 - generate_source_tarball.sh: Add indentation instructions for Emacs
- Related: RHEL-52723
+- Related: RHEL-30946

-* Sat Aug 03 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.1.ea
- Update to jdk-21.0.3+1 (EA)
- Update release notes to 21.0.3+1
- Switch to EA mode
- Require tzdata 2023d due to local inclusion of JDK-8322725
- Bump FreeType version to 2.13.2 following JDK-8316028
+* Sun Apr 14 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.2.ea
 - Install alt-java man page from the misc tarball as it is no longer in the JDK image
 - generate_source_tarball.sh: Update examples in header for clarity
 - generate_source_tarball.sh: Cleanup message issued when checkout already exists
@ -2683,18 +2741,19 @@ cjc.mainProgram(args)
 - generate_source_tarball.sh: Output values of new options WITH_TEMP and OPENJDK_LATEST
 - generate_source_tarball.sh: Double-quote DEPTH reference (SC2086)
 - generate_source_tarball.sh: Avoid empty DEPTH reference while still appeasing shellcheck
- Related: RHEL-52723
+- Related: RHEL-30946

-* Tue Jul 30 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-3
- Fix gating.yaml to reference RHEL 10
- Set this to be the default/system JDK providing 'java', 'jre', 'java-devel' ,etc.
- Resolves: RHEL-34597
- Resolves: RHEL-51617
+* Sun Apr 14 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.1.ea
+- Update to jdk-21.0.3+1 (EA)
+- Update release notes to 21.0.3+1
+- Switch to EA mode
+- Require tzdata 2023d due to upstream inclusion of JDK-8322725
+- Bump FreeType version to 2.13.2 following JDK-8316028
+- Related: RHEL-30946

 * Fri Apr 12 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-2
 - Define portablesuffix according to whether pkgos is defined or not
- Handle debugedit being a separate package installed in /usr on RHEL/CentOS 10
- Related: RHEL-45217
+- Related: RHEL-30946

 * Tue Jan 09 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-1
 - Update to jdk-21.0.2+13 (GA)
@ -2703,16 +2762,16 @@ cjc.mainProgram(args)
 - Bump HarfBuzz version to 8.2.2 following JDK-8313643
 - Drop local JDK-8311630 patch which is now upstream
 - ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
- Resolves: RHEL-45217
+- Resolves: RHEL-20999

 * Mon Nov 06 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-3
 - Include JDK-8311630 patch to implement Foreign Function & Memory preview API on s390x
 - Sync the copy of the portable specfile with the latest update
- Related: RHEL-45217
+- Resolves: RHEL-16290

 * Mon Oct 30 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-2
 - Define pkgnameroot to simplify build requirements and allow '-rhel7' suffix on RHEL
- Related: RHEL-45217
+- Related: RHEL-12998

 * Fri Oct 27 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-1
 - Update to jdk-21.0.1.0+12 (GA)
@ -2734,15 +2793,21 @@ cjc.mainProgram(args)
 - Add missing jfr, jpackage and jwebserver alternative ghosts
 - Move jcmd to the headless package
 - Revert alt-java binary location to being within the JDK tree
- Related: RHEL-45217
+- Resolves: RHEL-12998
+- Resolves: RHEL-14953
+- Resolves: RHEL-13925
+- Resolves: RHEL-14957
+- Related: RHEL-14945
+- Resolves: RHEL-11321
+- Resolves: RHEL-14947

 * Fri Oct 27 2023 Jiri Vanek <jvanek@redhat.com> - 1:21.0.1.0.12-1
 - Exclude classes_nocoops.jsa on i686 and arm32
- Related: RHEL-45217
+- Related: RHEL-14945

 * Fri Oct 27 2023 Severin Gehwolf <sgehwolf@redhat.com> - 1:21.0.1.0.12-1
 - Fix packaging of CDS archives
- Resolves: RHEL-45217
+- Resolves: RHEL-14945

 * Thu Aug 24 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-2
 - Update documentation (README.md)
@ -2753,7 +2818,7 @@ cjc.mainProgram(args)
 - * No use of system libjpeg turbo to warrant RH649512 patch any more
 - Replace RH1684077 pcsc-lite-libs patch with better JDK-8009550 fix being upstreamed
 - Adapt alt-java test to new binary where there is always a set_speculation function
- Related: RHEL-45217
+- Related: RHEL-12998

 * Mon Aug 21 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-1
 - Update to jdk-21.0.0+35
@ -2765,11 +2830,12 @@ cjc.mainProgram(args)
 - Re-enable tzdata tests now we are on the latest JDK and things are back in sync
 - Install jaxp.properties introduced by JDK-8303530
 - Install lible.so introduced by JDK-8306983
- Related: RHEL-45217
+- Related: RHEL-12998
+- Resolves: RHEL-41087

 * Mon Aug 21 2023 Petra Alice Mikova <pmikova@redhat.com> - 1:21.0.0.0.35-1
 - Replace smoke test files used in the staticlibs test, as fdlibm was removed by JDK-8303798
- Related: RHEL-45217
+- Related: RHEL-12998

 * Wed Aug 16 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:20.0.0.0.36-1
 - Update to jdk-20.0.2+9
@ -2777,12 +2843,12 @@ cjc.mainProgram(args)
 - Update system crypto policy & FIPS patch from new fips-20u tree
 - Update generate_tarball.sh ICEDTEA_VERSION
 - Update CLDR reference data following update to 42 (Rocky Mountain-Normalzeit => Rocky-Mountain-Normalzeit)
- Related: RHEL-45217
+- Related: RHEL-12998

 * Wed Aug 16 2023 Jiri Vanek <jvanek@redhat.com> - 1:20.0.0.0.36-1
 - Dropped JDK-8295447, JDK-8296239 & JDK-8299439 patches now upstream
 - Adapted rh1750419-redhat_alt_java.patch
- Related: RHEL-45217
+- Related: RHEL-12998

 * Tue Aug 15 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:19.0.1.0.10-1
 - Update to jdk-19.0.2 release
@ -2791,7 +2857,7 @@ cjc.mainProgram(args)
 - Remove references to sample directory removed by JDK-8284999
 - Add local patch JDK-8295447 (javac NPE) which was accepted into 19u upstream but not in the GA tag
 - Add local patches for JDK-8296239 & JDK-8299439 (Croatia Euro update) which are present in 8u, 11u & 17u releases
- Related: RHEL-45217
+- Related: RHEL-12998

 * Thu Aug 10 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:18.0.2.0.9-1
 - Update to jdk-18.0.2 release
@ -2802,26 +2868,26 @@ cjc.mainProgram(args)
 - Drop tzdata patches added for 17.0.7 which will eventually appear in the upstream tarball when we reach OpenJDK 21
 - Disable tzdata tests until we are on the latest JDK and things are back in sync
 - Use empty nss.fips.cfg until it is again available via the FIPS patch
- Related: RHEL-45217
+- Related: RHEL-12998

 * Thu Aug 10 2023 Petra Alice Mikova <pmikova@redhat.com> - 1:18.0.2.0.9-1
 - Update to ea version of jdk18
 - Add new slave jwebserver and corresponding manpage
 - Adjust rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
- Related: RHEL-45217
+- Related: RHEL-12998

 * Thu Aug 10 2023 FeRD (Frank Dana) <ferdnyc@gmail.com> - 1:18.0.2.0.9-1
 - Add javaver- and origin-specific javadoc and javadoczip alternatives.
- Related: RHEL-45217
+- Related: RHEL-12998

 * Tue Aug 08 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-4
 - Set portablerelease and portablerhel to use the CentOS 9 build
- Related: RHEL-45217
+- Related: RHEL-12998

 * Tue Aug 08 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-4
 - Add files missed by centpkg import.
- Related: RHEL-45217
+- Related: rhbz#2192748

 * Fri Aug 04 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-3
 - Create java-21-openjdk package based on java-17-openjdk
- Related: RHEL-45217
+- Related: rhbz#2192748
--- a/jdk8351500-numa_migration_crashes.patch
+++ b/jdk8351500-numa_migration_crashes.patch
@ -0,0 +1,274 @@
+commit c5c0ac6140ec5241d949bc66f54469bfa516c60c
+Author: Thomas Stuefe <stuefe@openjdk.org>
+Date:   Thu Mar 27 17:37:44 2025 +0000
+
+    8351500: G1: NUMA migrations cause crashes in region allocation
+    
+    Reviewed-by: sjohanss
+    Backport-of: 37ec796255ae857588a5c7e0d572407dd81cbec9
+
+diff --git a/src/hotspot/share/gc/g1/g1Allocator.cpp b/src/hotspot/share/gc/g1/g1Allocator.cpp
+index 5b33e24de75..23c7ee839d8 100644
+--- a/src/hotspot/share/gc/g1/g1Allocator.cpp
+++ b/src/hotspot/share/gc/g1/g1Allocator.cpp
+@@ -212,10 +212,10 @@ size_t G1Allocator::used_in_alloc_regions() {
+ 
+ 
+ HeapWord* G1Allocator::par_allocate_during_gc(G1HeapRegionAttr dest,
+-                                              size_t word_size,
+-                                              uint node_index) {
+                                              uint node_index,
+                                              size_t word_size) {
+   size_t temp = 0;
+-  HeapWord* result = par_allocate_during_gc(dest, word_size, word_size, &temp, node_index);
+  HeapWord* result = par_allocate_during_gc(dest, node_index, word_size, word_size, &temp);
+   assert(result == nullptr || temp == word_size,
+          "Requested " SIZE_FORMAT " words, but got " SIZE_FORMAT " at " PTR_FORMAT,
+          word_size, temp, p2i(result));
+@@ -223,13 +223,13 @@ HeapWord* G1Allocator::par_allocate_during_gc(G1HeapRegionAttr dest,
+ }
+ 
+ HeapWord* G1Allocator::par_allocate_during_gc(G1HeapRegionAttr dest,
+                                              uint node_index,
+                                               size_t min_word_size,
+                                               size_t desired_word_size,
+-                                              size_t* actual_word_size,
+-                                              uint node_index) {
+                                              size_t* actual_word_size) {
+   switch (dest.type()) {
+     case G1HeapRegionAttr::Young:
+-      return survivor_attempt_allocation(min_word_size, desired_word_size, actual_word_size, node_index);
+      return survivor_attempt_allocation(node_index, min_word_size, desired_word_size, actual_word_size);
+     case G1HeapRegionAttr::Old:
+       return old_attempt_allocation(min_word_size, desired_word_size, actual_word_size);
+     default:
+@@ -238,10 +238,10 @@ HeapWord* G1Allocator::par_allocate_during_gc(G1HeapRegionAttr dest,
+   }
+ }
+ 
+-HeapWord* G1Allocator::survivor_attempt_allocation(size_t min_word_size,
+HeapWord* G1Allocator::survivor_attempt_allocation(uint node_index,
+                                                   size_t min_word_size,
+                                                    size_t desired_word_size,
+-                                                   size_t* actual_word_size,
+-                                                   uint node_index) {
+                                                   size_t* actual_word_size) {
+   assert(!_g1h->is_humongous(desired_word_size),
+          "we should not be seeing humongous-size allocations in this path");
+ 
+@@ -396,10 +396,10 @@ HeapWord* G1PLABAllocator::allocate_direct_or_new_plab(G1HeapRegionAttr dest,
+ 
+     size_t actual_plab_size = 0;
+     HeapWord* buf = _allocator->par_allocate_during_gc(dest,
+                                                       node_index,
+                                                        required_in_plab,
+                                                        plab_word_size,
+-                                                       &actual_plab_size,
+-                                                       node_index);
+                                                       &actual_plab_size);
+ 
+     assert(buf == nullptr || ((actual_plab_size >= required_in_plab) && (actual_plab_size <= plab_word_size)),
+            "Requested at minimum %zu, desired %zu words, but got %zu at " PTR_FORMAT,
+@@ -418,7 +418,7 @@ HeapWord* G1PLABAllocator::allocate_direct_or_new_plab(G1HeapRegionAttr dest,
+     *plab_refill_failed = true;
+   }
+   // Try direct allocation.
+-  HeapWord* result = _allocator->par_allocate_during_gc(dest, word_sz, node_index);
+  HeapWord* result = _allocator->par_allocate_during_gc(dest, node_index, word_sz);
+   if (result != nullptr) {
+     plab_data->_direct_allocated += word_sz;
+     plab_data->_num_direct_allocations++;
+diff --git a/src/hotspot/share/gc/g1/g1Allocator.hpp b/src/hotspot/share/gc/g1/g1Allocator.hpp
+index 32f37778a18..b2828d64d87 100644
+--- a/src/hotspot/share/gc/g1/g1Allocator.hpp
+++ b/src/hotspot/share/gc/g1/g1Allocator.hpp
+@@ -78,19 +78,16 @@ class G1Allocator : public CHeapObj<mtGC> {
+   inline OldGCAllocRegion* old_gc_alloc_region();
+ 
+   // Allocation attempt during GC for a survivor object / PLAB.
+-  HeapWord* survivor_attempt_allocation(size_t min_word_size,
+  HeapWord* survivor_attempt_allocation(uint node_index,
+                                        size_t min_word_size,
+                                         size_t desired_word_size,
+-                                        size_t* actual_word_size,
+-                                        uint node_index);
+                                        size_t* actual_word_size);
+ 
+   // Allocation attempt during GC for an old object / PLAB.
+   HeapWord* old_attempt_allocation(size_t min_word_size,
+                                    size_t desired_word_size,
+                                    size_t* actual_word_size);
+ 
+-  // Node index of current thread.
+-  inline uint current_node_index() const;
+-
+ public:
+   G1Allocator(G1CollectedHeap* heap);
+   ~G1Allocator();
+@@ -110,18 +107,22 @@ class G1Allocator : public CHeapObj<mtGC> {
+   void abandon_gc_alloc_regions();
+   bool is_retained_old_region(HeapRegion* hr);
+ 
+  // Node index of current thread.
+  inline uint current_node_index() const;
+
+   // Allocate blocks of memory during mutator time.
+ 
+   // Attempt allocation in the current alloc region.
+-  inline HeapWord* attempt_allocation(size_t min_word_size,
+  inline HeapWord* attempt_allocation(uint node_index,
+                                      size_t min_word_size,
+                                       size_t desired_word_size,
+                                       size_t* actual_word_size);
+ 
+   // This is to be called when holding an appropriate lock. It first tries in the
+   // current allocation region, and then attempts an allocation using a new region.
+-  inline HeapWord* attempt_allocation_locked(size_t word_size);
+  inline HeapWord* attempt_allocation_locked(uint node_index, size_t word_size);
+ 
+-  inline HeapWord* attempt_allocation_force(size_t word_size);
+  inline HeapWord* attempt_allocation_force(uint node_index, size_t word_size);
+ 
+   size_t unsafe_max_tlab_alloc();
+   size_t used_in_alloc_regions();
+@@ -131,14 +132,15 @@ class G1Allocator : public CHeapObj<mtGC> {
+   // heap, and then allocate a block of the given size. The block
+   // may not be a humongous - it must fit into a single heap region.
+   HeapWord* par_allocate_during_gc(G1HeapRegionAttr dest,
+-                                   size_t word_size,
+-                                   uint node_index);
+                                   uint node_index,
+                                   size_t word_size
+                                   );
+ 
+   HeapWord* par_allocate_during_gc(G1HeapRegionAttr dest,
+                                   uint node_index,
+                                    size_t min_word_size,
+                                    size_t desired_word_size,
+-                                   size_t* actual_word_size,
+-                                   uint node_index);
+                                   size_t* actual_word_size);
+ };
+ 
+ // Manages the PLABs used during garbage collection. Interface for allocation from PLABs.
+diff --git a/src/hotspot/share/gc/g1/g1Allocator.inline.hpp b/src/hotspot/share/gc/g1/g1Allocator.inline.hpp
+index 13ae9b9bbbd..7e516b48faa 100644
+--- a/src/hotspot/share/gc/g1/g1Allocator.inline.hpp
+++ b/src/hotspot/share/gc/g1/g1Allocator.inline.hpp
+@@ -49,11 +49,10 @@ inline OldGCAllocRegion* G1Allocator::old_gc_alloc_region() {
+   return &_old_gc_alloc_region;
+ }
+ 
+-inline HeapWord* G1Allocator::attempt_allocation(size_t min_word_size,
+inline HeapWord* G1Allocator::attempt_allocation(uint node_index,
+                                                 size_t min_word_size,
+                                                  size_t desired_word_size,
+                                                  size_t* actual_word_size) {
+-  uint node_index = current_node_index();
+-
+   HeapWord* result = mutator_alloc_region(node_index)->attempt_retained_allocation(min_word_size, desired_word_size, actual_word_size);
+   if (result != nullptr) {
+     return result;
+@@ -62,8 +61,7 @@ inline HeapWord* G1Allocator::attempt_allocation(size_t min_word_size,
+   return mutator_alloc_region(node_index)->attempt_allocation(min_word_size, desired_word_size, actual_word_size);
+ }
+ 
+-inline HeapWord* G1Allocator::attempt_allocation_locked(size_t word_size) {
+-  uint node_index = current_node_index();
+inline HeapWord* G1Allocator::attempt_allocation_locked(uint node_index, size_t word_size) {
+   HeapWord* result = mutator_alloc_region(node_index)->attempt_allocation_locked(word_size);
+ 
+   assert(result != nullptr || mutator_alloc_region(node_index)->get() == nullptr,
+@@ -71,8 +69,7 @@ inline HeapWord* G1Allocator::attempt_allocation_locked(size_t word_size) {
+   return result;
+ }
+ 
+-inline HeapWord* G1Allocator::attempt_allocation_force(size_t word_size) {
+-  uint node_index = current_node_index();
+inline HeapWord* G1Allocator::attempt_allocation_force(uint node_index, size_t word_size) {
+   return mutator_alloc_region(node_index)->attempt_allocation_force(word_size);
+ }
+ 
+diff --git a/src/hotspot/share/gc/g1/g1CollectedHeap.cpp b/src/hotspot/share/gc/g1/g1CollectedHeap.cpp
+index 9b6b22a29e7..a43e45c4afa 100644
+--- a/src/hotspot/share/gc/g1/g1CollectedHeap.cpp
+++ b/src/hotspot/share/gc/g1/g1CollectedHeap.cpp
+@@ -401,7 +401,7 @@ G1CollectedHeap::mem_allocate(size_t word_size,
+   return attempt_allocation(word_size, word_size, &dummy);
+ }
+ 
+-HeapWord* G1CollectedHeap::attempt_allocation_slow(size_t word_size) {
+HeapWord* G1CollectedHeap::attempt_allocation_slow(uint node_index, size_t word_size) {
+   ResourceMark rm; // For retrieving the thread names in log messages.
+ 
+   // Make sure you read the note in attempt_allocation_humongous().
+@@ -427,7 +427,7 @@ HeapWord* G1CollectedHeap::attempt_allocation_slow(size_t word_size) {
+ 
+       // Now that we have the lock, we first retry the allocation in case another
+       // thread changed the region while we were waiting to acquire the lock.
+-      result = _allocator->attempt_allocation_locked(word_size);
+      result = _allocator->attempt_allocation_locked(node_index, word_size);
+       if (result != nullptr) {
+         return result;
+       }
+@@ -438,7 +438,7 @@ HeapWord* G1CollectedHeap::attempt_allocation_slow(size_t word_size) {
+       if (GCLocker::is_active_and_needs_gc() && policy()->can_expand_young_list()) {
+         // No need for an ergo message here, can_expand_young_list() does this when
+         // it returns true.
+-        result = _allocator->attempt_allocation_force(word_size);
+        result = _allocator->attempt_allocation_force(node_index, word_size);
+         if (result != nullptr) {
+           return result;
+         }
+@@ -495,7 +495,7 @@ HeapWord* G1CollectedHeap::attempt_allocation_slow(size_t word_size) {
+     // follow-on attempt will be at the start of the next loop
+     // iteration (after taking the Heap_lock).
+     size_t dummy = 0;
+-    result = _allocator->attempt_allocation(word_size, word_size, &dummy);
+    result = _allocator->attempt_allocation(node_index, word_size, word_size, &dummy);
+     if (result != nullptr) {
+       return result;
+     }
+@@ -636,11 +636,14 @@ inline HeapWord* G1CollectedHeap::attempt_allocation(size_t min_word_size,
+   assert(!is_humongous(desired_word_size), "attempt_allocation() should not "
+          "be called for humongous allocation requests");
+ 
+-  HeapWord* result = _allocator->attempt_allocation(min_word_size, desired_word_size, actual_word_size);
+  // Fix NUMA node association for the duration of this allocation
+  const uint node_index = _allocator->current_node_index();
+
+  HeapWord* result = _allocator->attempt_allocation(node_index, min_word_size, desired_word_size, actual_word_size);
+ 
+   if (result == nullptr) {
+     *actual_word_size = desired_word_size;
+-    result = attempt_allocation_slow(desired_word_size);
+    result = attempt_allocation_slow(node_index, desired_word_size);
+   }
+ 
+   assert_heap_not_locked();
+@@ -778,8 +781,11 @@ HeapWord* G1CollectedHeap::attempt_allocation_at_safepoint(size_t word_size,
+   assert(!_allocator->has_mutator_alloc_region() || !expect_null_mutator_alloc_region,
+          "the current alloc region was unexpectedly found to be non-null");
+ 
+  // Fix NUMA node association for the duration of this allocation
+  const uint node_index = _allocator->current_node_index();
+
+   if (!is_humongous(word_size)) {
+-    return _allocator->attempt_allocation_locked(word_size);
+    return _allocator->attempt_allocation_locked(node_index, word_size);
+   } else {
+     HeapWord* result = humongous_obj_allocate(word_size);
+     if (result != nullptr && policy()->need_to_start_conc_mark("STW humongous allocation")) {
+diff --git a/src/hotspot/share/gc/g1/g1CollectedHeap.hpp b/src/hotspot/share/gc/g1/g1CollectedHeap.hpp
+index 88f4f680800..6afaeb6e6d4 100644
+--- a/src/hotspot/share/gc/g1/g1CollectedHeap.hpp
+++ b/src/hotspot/share/gc/g1/g1CollectedHeap.hpp
+@@ -453,7 +453,7 @@ class G1CollectedHeap : public CollectedHeap {
+   // Second-level mutator allocation attempt: take the Heap_lock and
+   // retry the allocation attempt, potentially scheduling a GC
+   // pause. This should only be used for non-humongous allocations.
+-  HeapWord* attempt_allocation_slow(size_t word_size);
+  HeapWord* attempt_allocation_slow(uint node_index, size_t word_size);
+ 
+   // Takes the Heap_lock and attempts a humongous allocation. It can
+   // potentially schedule a GC pause.
--- a/openjdk-devkit.specfile
+++ b/openjdk-devkit.specfile
@ -0,0 +1,230 @@
+# Spec file for building a devkit for OpenJDK builds
+
+# We do not want debug packages
+%global debug_package %{nil}
+# Arch definitions from java-*-openjdk RPM
+%global aarch64         aarch64 arm64 armv8
+# x86 is not supported by OpenJDK 17
+ExcludeArch: %{ix86}
+
+# New Version-String scheme-style defines
+%global featurever 21
+%global interimver 0
+%global updatever 5
+%global patchver 0
+%global buildver 11
+# Define JDK versions
+%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
+%global javaver         %{featurever}
+# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames
+%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn})
+# The tag used to create the OpenJDK tarball
+%global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}
+
+# Define milestone (EA for pre-releases, GA for releases)
+# Release will be (where N is usually a number starting at 1):
+# - 0.N%%{?extraver}%%{?dist} for EA releases,
+# - N%%{?extraver}{?dist} for GA releases
+%global is_ga           1
+%if %{is_ga}
+%global build_type GA
+%global ea_designator ""
+%global ea_designator_zip %{nil}
+%global extraver %{nil}
+%global eaprefix %{nil}
+%else
+%global build_type EA
+%global ea_designator ea
+%global ea_designator_zip -%{ea_designator}
+%global extraver .%{ea_designator}
+%global eaprefix 0.
+%endif
+
+# Date devkit RPMs were download
+%global rpm_download_date 20250117
+
+Name: openjdk-devkit
+Version: 1.0
+Release: 9%{?dist}
+License: GPLv2
+URL: http://openjdk.java.net/
+Summary: OpenJDK Devkit
+
+# The source tarball, generated using generate_source_tarball.sh
+Source0: https://openjdk-sources.osci.io/openjdk%{featurever}/open%{vcstag}%{ea_designator_zip}.tar.xz
+# The buildroot RPMs for each architecture
+Source1: devkit-rpms-aarch64-%{rpm_download_date}.tar.xz
+Source2: devkit-rpms-ppc64le-%{rpm_download_date}.tar.xz
+Source3: devkit-rpms-s390x-%{rpm_download_date}.tar.xz
+Source4: devkit-rpms-x86_64-%{rpm_download_date}.tar.xz
+# Toolchain sources
+Source5: binutils-2.39.tar.gz
+Source6: gcc-11.3.0.tar.xz
+Source7: gmp-6.2.1.tar.bz2
+Source8: mpc-1.2.1.tar.gz
+Source9: mpfr-4.1.1.tar.bz2
+Source10: gdb-11.2.tar.xz
+
+# Devkit patches; see https://github.com/rh-openjdk/jdk/tree/devkit
+# To regenerate, use git format-patch -N jdk21u/master
+# Add RHEL RPM URLs and turn off robots
+Patch0: 0001-Allow-devkit-to-work-with-RHEL.patch
+# Turn off multilib on x86_64
+Patch1: 0002-Disable-multilib-on-x86_64.patch
+# Improve build logging (OPENJDK-3071)
+Patch2: 0003-Log-devkit-build-to-stdout.patch
+# Remove .comment sections from sysroot objects
+Patch3: 0004-devkit-Remove-.comment-sections-from-sysroot-objects.patch
+# Configure binutils with --enable-deterministic-archives
+Patch4: 0005-Tools.gmk-Configure-binutils-with-enable-determinist.patch
+# Configure gcc with --enable-linker-build-id (OPENJDK-3068)
+Patch5: 0006-Tools.gmk-Add-enable-linker-build-id-to-gcc-build.patch
+# Exclude systemtap-sdt-devel on s390x & ppc64* (OPENJDK-3070)
+Patch6: 0007-Tools.gmk-Exclude-systemtap-sdt-devel-on-s390x-ppc64.patch
+# Use update repository on RHEL rather than GA (OPENJDK-3589)
+Patch7: 0008-Tools.gmk-Use-update-repository-on-RHEL-rather-than-.patch
+
+BuildRequires: make autoconf automake libtool gcc gcc-c++ wget glibc-devel texinfo tar bison
+
+# Setup variables to reference correct sources
+%ifarch %{aarch64}
+%global rpmtarball %{SOURCE1}
+%endif
+%ifarch ppc64le
+%global rpmtarball %{SOURCE2}
+%endif
+%ifarch s390x
+%global rpmtarball %{SOURCE3}
+%endif
+%ifarch x86_64
+%global rpmtarball %{SOURCE4}
+%endif
+
+%description
+OpenJDK Devkit
+
+%prep
+
+# Unpack OpenJDK sources only in build directory
+%setup -q -T -c -a 0
+
+# This syntax is deprecated:
+#    %patchN [...]
+# and should be replaced with:
+#    %patch -PN [...]
+# For example:
+#    %patch1001 -p1
+# becomes:
+#    %patch -P1001 -p1
+# The replacement format suggested by recent (circa Fedora 38) RPM
+# deprecation messages:
+#    %patch N [...]
+# is not backward-compatible with prior (circa RHEL-8) versions of
+# rpmbuild.
+pushd jdk-*
+%patch -P0 -p1
+%patch -P1 -p1
+%patch -P2 -p1
+%patch -P3 -p1
+%patch -P4 -p1
+%patch -P5 -p1
+%patch -P6 -p1
+%patch -P7 -p1
+popd
+
+mkdir -p devkit/download
+pushd devkit/download
+tar -xJf %{rpmtarball}
+ln -s %{SOURCE5}
+ln -s %{SOURCE6}
+ln -s %{SOURCE7}
+ln -s %{SOURCE8}
+ln -s %{SOURCE9}
+ln -s %{SOURCE10}
+
+%build
+
+devkit_dir=$(pwd)/devkit
+today=$(date +%Y%m%d)
+arch=%{_target_cpu}
+result_name=${arch}-linux-gnu-to-${arch}-linux-gnu
+result_path=result/${result_name}
+
+pushd jdk-*/make/devkit
+
+# Build devkit first using the native toolchain,
+# than again using itself
+for variant in bootstrap product ; do
+    if [ -e ${devkit_dir}-bootstrap/${result_path}/bin/gcc ] ; then
+        ROOTDIR=${devkit_dir}-bootstrap/${result_path};
+        BINDIR=${ROOTDIR}/bin;
+        TOOLS="CC=${BINDIR}/gcc CXX=${BINDIR}/g++ LD=${BINDIR}/ld \
+               AR=${BINDIR}/ar AS=${BINDIR}/as RANLIB=${BINDIR}/ranlib \
+               OBJDUMP=${BINDIR}/objdump"
+        LIBPATH="${ROOTDIR}/lib64:${ROOTDIR}/lib"
+    else
+        TOOLS="CC=$(which gcc) CXX=$(which g++) LD=$(which ld) \
+               AR=$(which ar) AS=$(which as) RANLIB=$(which ranlib) \
+               OBJDUMP=$(which objdump)"
+    fi
+    mkdir -p ${devkit_dir}-${variant}
+    ln -s ${devkit_dir}/download ${devkit_dir}-${variant}
+    LD_LIBRARY_PATH="${LIBPATH}" \
+        make -f Tools.gmk all ${TOOLS} \
+        HOST=${arch}-linux-gnu \
+        BUILD=${arch}-linux-gnu \
+        RESULT=${devkit_dir}-${variant}/result \
+        OUTPUT_ROOT=${devkit_dir}-${variant} \
+        TARGET=${arch}-linux-gnu \
+        PREFIX=${devkit_dir}-${variant}/${result_path} \
+        BASE_OS=RHEL
+done
+
+make -r -f Tars.gmk \
+     SRC_DIR=${devkit_dir}-product/${result_path} \
+     TAR_FILE=${devkit_dir}-product/result/sdk-${result_name}-${today}.tar.gz
+popd
+
+%install
+mkdir -p %{buildroot}%{_datadir}/%{name}
+cp -p devkit-product/result/*.tar.gz %{buildroot}%{_datadir}/%{name}/
+
+%files
+%{_datadir}/%{name}
+
+%changelog
+* Fri Jan 17 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-9
+- Update devkit RPMs to latest updates
+- Exclude SystemTap RPMs from s390x and ppc64le
+- Add a date stamp to the RPM bundles
+- Resolves: OPENJDK-3070
+= Resolves: OPENJDK-3589
+
+* Wed Nov 27 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-8
+- Add --enable-linker-build-id to gcc build
+- Resolves: OPENJDK-3068
+
+* Wed Oct 30 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-7
+- Improve build logging by also writing to stdout
+- Cleanup patches and rebase on jdk-21.0.5-ga
+- Drop JDK-8323671 patch which is upstream as of 21.0.3+3
+- Resolves: OPENJDK-3071
+
+* Tue Jun 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-6
+- Fix typo where 'as' binary is accidentally capitalised in AS=<path>/as
+
+* Wed May 01 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-5
+- Bootstrap the devkit, building it again with itself
+
+* Mon Apr 08 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-4
+- Include Thomas' patches to drop .comment sections and build binutils with deterministic archives
+- Use backward-compatible patch syntax
+
+* Tue Feb 06 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-3
+- Include JDK-8323671 patch so the binaries don't contain the full source path
+
+* Fri Dec 08 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-2
+- Try to turn off multlib on x86_64 as we don't have the dependencies for it
+
+* Tue Dec 05 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-1
+- Create RHEL 7 based devkit for building OpenJDK
--- a/2
+++ b/2
@ -1,2 +1,2 @@
 SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
-SHA512 (openjdk-21.0.5+11.tar.xz) = f416e746593589cc7d37dbde55098038412939947c41c05baf2da31e44c42d0242cb8f6a4a5659d3d7b9a27e775d9ef375f754acda5e143ada5987e288dbe87a
+SHA512 (openjdk-21.0.7+6.tar.xz) = 4ccbad22a7284fc8a38f78585dbc9e2b632c634f0a496d0f41bc5a0ec35ef1f2ca75b2aad135c299e9ebb04c8bd73b905f6c57ae041bd39d4474ecbda3656c97