.gitignore

@@ -26,3 +26,15 @@
 /openjdk-21.0.5+9-ea.tar.xz
 /openjdk-21.0.5+10.tar.xz
 /openjdk-21.0.5+11.tar.xz
+/openjdk-21.0.6+6-ea.tar.xz
+/openjdk-21.0.6+7.tar.xz
+/openjdk-21.0.7+1-ea.tar.xz
+/openjdk-21.0.7+2-ea.tar.xz
+/openjdk-21.0.7+3-ea.tar.xz
+/openjdk-21.0.7+4-ea.tar.xz
+/openjdk-21.0.7+5-ea.tar.xz
+/openjdk-21.0.7+6.tar.xz
+/openjdk-21.0.8+1-ea.tar.xz
+/openjdk-21.0.8+2-ea.tar.xz
+/openjdk-21.0.8+8-ea.tar.xz
+/openjdk-21.0.8+9.tar.xz

0001-Allow-devkit-to-work-with-RHEL.patch

@@ -0,0 +1,54 @@
+From 7733d625ebdea5a6f323a0c5944fb8ab728d1b2b Mon Sep 17 00:00:00 2001
+From: Andrew Hughes <gnu.andrew@redhat.com>
+Date: Sat, 25 Nov 2023 17:29:36 +0000
+Subject: [PATCH] Allow devkit to work with RHEL
+
+---
+ make/devkit/Makefile  |  2 +-
+ make/devkit/Tools.gmk | 10 +++++++++-
+ 2 files changed, 10 insertions(+), 2 deletions(-)
+
+diff --git a/make/devkit/Makefile b/make/devkit/Makefile
+index c85a7c21d29..8f69d23c325 100644
+--- a/make/devkit/Makefile
++++ b/make/devkit/Makefile
+@@ -58,7 +58,7 @@
+ COMMA := ,
+ 
+ os := $(shell uname -o)
+-cpu := $(shell uname -p)
++cpu := $(shell uname -m)
+ 
+ # Figure out what platform this is building on.
+ me := $(cpu)-$(if $(findstring Linux,$(os)),linux-gnu)
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index 187320ca26e..001f4b1870c 100644
+--- a/make/devkit/Tools.gmk
++++ b/make/devkit/Tools.gmk
+@@ -62,6 +62,14 @@ ifeq ($(BASE_OS), OL)
+     BASE_URL := http://yum.oracle.com/repo/OracleLinux/OL6/4/base/$(ARCH)/
+     LINUX_VERSION := OL6.4
+   endif
++else ifeq ($(BASE_OS), RHEL)
++  ifeq ($(ARCH), aarch64)
++    BASE_URL := https://download.eng.brq.redhat.com/rhel-7/rel-eng/RHEL-7/latest-RHEL-ALT-7/compose/Server/$(ARCH)/os/Packages/
++    LINUX_VERSION := RHEL7.6
++  else
++    BASE_URL := https://download.eng.brq.redhat.com/rhel-7/rel-eng/RHEL-7/latest-RHEL-7/compose/Server/$(ARCH)/os/Packages/
++    LINUX_VERSION := RHEL7.9
++  endif
+ else ifeq ($(BASE_OS), Fedora)
+   ifeq ($(ARCH), riscv64)
+     DEFAULT_OS_VERSION := rawhide/68692
+@@ -246,7 +254,7 @@ download-rpms:
+         # Only run this if rpm dir is empty.
+         ifeq ($(wildcard $(DOWNLOAD_RPMS)/*.rpm), )
+ 	  cd $(DOWNLOAD_RPMS) && \
+-	      wget -r -np -nd $(patsubst %, -A "*%*.rpm", $(RPM_LIST)) $(BASE_URL)
++	      wget -r -e robots=off -np -nd $(patsubst %, -A "*%*.rpm", $(RPM_LIST)) $(BASE_URL)
+         endif
+ 
+ ##########################################################################################
+-- 
+2.45.2
+

0002-Disable-multilib-on-x86_64.patch

@@ -0,0 +1,50 @@
+From e55afc691c0105623e04a6e76369cf1438afb874 Mon Sep 17 00:00:00 2001
+From: Andrew Hughes <gnu.andrew@redhat.com>
+Date: Fri, 8 Dec 2023 21:22:02 +0000
+Subject: [PATCH] Disable multilib on x86_64
+
+---
+ make/devkit/Tools.gmk | 13 +++----------
+ 1 file changed, 3 insertions(+), 10 deletions(-)
+
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index 001f4b1870c..9ede781413d 100644
+--- a/make/devkit/Tools.gmk
++++ b/make/devkit/Tools.gmk
+@@ -225,13 +225,7 @@ RPM_LIST := \
+ ##########################################################################################
+ # Define common directories and files
+ 
+-# Ensure we have 32-bit libs also for x64. We enable mixed-mode.
+-ifeq (x86_64,$(ARCH))
+-  LIBDIRS := lib64 lib
+-  CFLAGS_lib := -m32
+-else
+-  LIBDIRS := lib
+-endif
++LIBDIRS := lib
+ 
+ # Define directories
+ BUILDDIR := $(OUTPUT_ROOT)/$(HOST)/$(TARGET)
+@@ -289,8 +283,7 @@ $(foreach p,GCC BINUTILS CCACHE MPFR GMP MPC GDB,$(eval $(call Download,$(p))))
+ 
+ RPM_ARCHS := $(ARCH) noarch
+ ifeq ($(ARCH),x86_64)
+-  # Enable mixed mode.
+-  RPM_ARCHS += i386 i686
++  RPM_ARCHS += i686
+ else ifeq ($(ARCH),i686)
+   RPM_ARCHS += i386
+ else ifeq ($(ARCH), armhfp)
+@@ -526,7 +519,7 @@ ifeq ($(ARCH), armhfp)
+   $(BUILDDIR)/$(gcc_ver)/Makefile : CONFIG +=  --with-float=hard
+ endif
+ 
+-ifneq ($(filter riscv64 ppc64 ppc64le s390x, $(ARCH)), )
++ifneq ($(filter riscv64 ppc64 ppc64le s390x x86_64, $(ARCH)), )
+   # We only support 64-bit on these platforms anyway
+   CONFIG += --disable-multilib
+ endif
+-- 
+2.45.2
+

0003-Log-devkit-build-to-stdout.patch

@@ -0,0 +1,92 @@
+From fbc27183b35df7778cf106450b144474f8e2a35c Mon Sep 17 00:00:00 2001
+From: Andrew Hughes <gnu.andrew@redhat.com>
+Date: Wed, 30 Oct 2024 00:42:06 +0000
+Subject: [PATCH] Log devkit build to stdout
+
+Resolves: OPENJDK-3071
+---
+ make/devkit/Tools.gmk | 18 +++++++++---------
+ 1 file changed, 9 insertions(+), 9 deletions(-)
+
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index 9ede781413d..b6f895f5a25 100644
+--- a/make/devkit/Tools.gmk
++++ b/make/devkit/Tools.gmk
+@@ -458,7 +458,7 @@ $(BUILDDIR)/$(binutils_ver)/Makefile \
+ 	      --enable-multilib \
+ 	      --enable-threads \
+ 	      --enable-plugins \
+-	) > $(@D)/log.config 2>&1
++	) 2>&1 | tee $(@D)/log.config 
+ 	@echo 'done'
+ 
+ $(BUILDDIR)/$(mpfr_ver)/Makefile \
+@@ -473,7 +473,7 @@ $(BUILDDIR)/$(mpfr_ver)/Makefile \
+ 	      --program-prefix=$(TARGET)- \
+ 	      --enable-shared=no \
+ 	      --with-gmp=$(PREFIX) \
+-	) > $(@D)/log.config 2>&1
++	) 2>&1 | tee $(@D)/log.config
+ 	@echo 'done'
+ 
+ $(BUILDDIR)/$(gmp_ver)/Makefile \
+@@ -490,7 +490,7 @@ $(BUILDDIR)/$(gmp_ver)/Makefile \
+ 	      --program-prefix=$(TARGET)- \
+ 	      --enable-shared=no \
+ 	      --with-mpfr=$(PREFIX) \
+-	) > $(@D)/log.config 2>&1
++	) 2>&1 | tee $(@D)/log.config
+ 	@echo 'done'
+ 
+ $(BUILDDIR)/$(mpc_ver)/Makefile \
+@@ -506,7 +506,7 @@ $(BUILDDIR)/$(mpc_ver)/Makefile \
+ 	      --enable-shared=no \
+ 	      --with-mpfr=$(PREFIX) \
+ 	      --with-gmp=$(PREFIX) \
+-	) > $(@D)/log.config 2>&1
++	) 2>&1 | tee $(@D)/log.config
+ 	@echo 'done'
+ 
+ # Only valid if glibc target -> linux
+@@ -549,7 +549,7 @@ $(BUILDDIR)/$(gcc_ver)/Makefile \
+ 	      --with-mpfr=$(PREFIX) \
+ 	      --with-gmp=$(PREFIX) \
+ 	      --with-mpc=$(PREFIX) \
+-	) > $(@D)/log.config 2>&1
++	) 2>&1 | tee $(@D)/log.config
+ 	@echo 'done'
+ 
+ # need binutils for gcc
+@@ -571,7 +571,7 @@ ifeq ($(HOST), $(TARGET))
+ 	  $(PATHPRE) $(ENVS) CFLAGS="$(CFLAGS)" $(GDB_CFG) \
+ 	      $(CONFIG) \
+ 	      --with-sysroot=$(SYSROOT) \
+-	) > $(@D)/log.config 2>&1
++	) 2>&1 | tee $(@D)/log.config
+ 	@echo 'done'
+ 
+   $(gdb): $(gcc)
+@@ -593,7 +593,7 @@ $(BUILDDIR)/$(ccache_ver)/Makefile \
+ 	  cd $(@D) ; \
+ 	  $(PATHPRE) $(ENVS) $(CCACHE_CFG) \
+ 	      $(CONFIG) \
+-	) > $(@D)/log.config 2>&1
++	) 2>&1 | tee $(@D)/log.config
+ 	@echo 'done'
+ 
+ gccpatch = $(TARGETDIR)/gcc-patched
+@@ -641,9 +641,9 @@ endif
+ # Always need to build cross tools for build host self.
+ $(TARGETDIR)/%.done : $(BUILDDIR)/%/Makefile
+ 	$(info Building $(basename $@). Log in $(<D)/log.build)
+-	$(PATHPRE) $(ENVS) $(MAKE) $(BUILDPAR) -f $< -C $(<D) $(MAKECMD) $(MAKECMD.$(notdir $@)) > $(<D)/log.build 2>&1
++	$(PATHPRE) $(ENVS) $(MAKE) $(BUILDPAR) -f $< -C $(<D) $(MAKECMD) $(MAKECMD.$(notdir $@)) 2>&1 | tee $(<D)/log.build
+ 	@echo -n 'installing...'
+-	$(PATHPRE) $(MAKE) $(INSTALLPAR) -f $< -C $(<D) $(INSTALLCMD) $(MAKECMD.$(notdir $@)) > $(<D)/log.install 2>&1
++	$(PATHPRE) $(MAKE) $(INSTALLPAR) -f $< -C $(<D) $(INSTALLCMD) $(MAKECMD.$(notdir $@)) 2>&1 | tee $(<D)/log.install
+ 	@mkdir -p $(@D)
+ 	@touch $@
+ 	@echo 'done'
+-- 
+2.45.2
+

0004-devkit-Remove-.comment-sections-from-sysroot-objects.patch

@@ -0,0 +1,41 @@
+From 3d81d23118aab95214e24ccc81eff61ac245a1ac Mon Sep 17 00:00:00 2001
+From: Thomas Fitzsimmons <fitzsim@redhat.com>
+Date: Wed, 20 Mar 2024 13:01:47 -0400
+Subject: [PATCH] devkit: Remove .comment sections from sysroot objects
+
+Otherwise the comment sections of C runtime objects, including those
+in static libraries like libc_nonshared.a, contribute RPM package
+version strings to the .comment section in devkit-produced binaries
+and libraries.  These RPM package strings change frequently, even
+across minor toolchain updates.  Their presence interferes when
+comparing binaries built with devkits that use different sysroot RPM
+package sets.
+---
+ make/devkit/Tools.gmk | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index b6f895f5a25..37ea1a6a287 100644
+--- a/make/devkit/Tools.gmk
++++ b/make/devkit/Tools.gmk
+@@ -324,6 +324,9 @@ $(foreach p,$(RPM_FILE_LIST),$(eval $(call unrpm,$(p))))
+ # have it anyway, but just to make sure...
+ # Patch libc.so and libpthread.so to force linking against libraries in sysroot
+ # and not the ones installed on the build machine.
++# Remove comment sections from static libraries and C runtime objects
++# to prevent leaking RHEL-specific package versions into
++# devkit-produced binaries.
+ $(libs) : $(rpms)
+ 	@echo Patching libc and pthreads
+ 	@(for f in `find $(SYSROOT) -name libc.so -o -name libpthread.so`; do \
+@@ -333,6 +336,7 @@ $(libs) : $(rpms)
+ 	      -e 's|/lib/||g' ) > $$f.tmp ; \
+ 	  mv $$f.tmp $$f ; \
+ 	done)
++	@find $(SYSROOT) -name '*.[ao]' -exec objcopy --remove-section .comment '{}' ';'
+ 	@mkdir -p $(SYSROOT)/usr/lib
+ 	@touch $@
+ 
+-- 
+2.45.2
+

0005-Tools.gmk-Configure-binutils-with-enable-determinist.patch

@@ -0,0 +1,35 @@
+From c370e1194c707f3f6c470e147ec497cc4e76957e Mon Sep 17 00:00:00 2001
+From: Thomas Fitzsimmons <fitzsim@redhat.com>
+Date: Fri, 22 Mar 2024 16:03:17 -0400
+Subject: [PATCH] Tools.gmk: Configure binutils with
+ --enable-deterministic-archives
+
+---
+ make/devkit/Tools.gmk | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index 37ea1a6a287..22c6007000b 100644
+--- a/make/devkit/Tools.gmk
++++ b/make/devkit/Tools.gmk
+@@ -445,6 +445,9 @@ endif
+ 
+ # Makefile creation. Simply run configure in build dir.
+ # Setting CFLAGS to -O2 generates a much faster ld.
++# Use --enable-deterministic-archives so that make targets that
++# generate "ar" archives, such as "static-libs-image", produce
++# deterministic .a files.
+ $(bfdmakes) \
+ $(BUILDDIR)/$(binutils_ver)/Makefile \
+     : $(BINUTILS_CFG)
+@@ -459,6 +462,7 @@ $(BUILDDIR)/$(binutils_ver)/Makefile \
+ 	      --with-sysroot=$(SYSROOT) \
+ 	      --disable-nls \
+ 	      --program-prefix=$(TARGET)- \
++	      --enable-deterministic-archives \
+ 	      --enable-multilib \
+ 	      --enable-threads \
+ 	      --enable-plugins \
+-- 
+2.45.2
+

0006-Tools.gmk-Add-enable-linker-build-id-to-gcc-build.patch

@@ -0,0 +1,35 @@
+From 5958274571b957617d0572101a92217fd5b2f312 Mon Sep 17 00:00:00 2001
+From: Andrew Hughes <gnu.andrew@redhat.com>
+Date: Wed, 27 Nov 2024 17:04:19 +0000
+Subject: [PATCH] Tools.gmk: Add --enable-linker-build-id to gcc build
+
+This causes --build-id to be passed to the linker, and the
+.note.gnu.build-id section is added (OPENJDK-3068)
+---
+ make/devkit/Tools.gmk | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index 22c6007000b..57d48ec5114 100644
+--- a/make/devkit/Tools.gmk
++++ b/make/devkit/Tools.gmk
+@@ -539,6 +539,8 @@ endif
+ # skip native language.
+ # and link and assemble with the binutils we created
+ # earlier, so --with-gnu*
++# Add --enable-linker-build-id so the .note.gnu.build-id
++# section is added by the linker (OPENJDK-3068)
+ $(BUILDDIR)/$(gcc_ver)/Makefile \
+     : $(GCC_CFG)
+ 	$(info Configuring $@. Log in $(@D)/log.config)
+@@ -557,6 +559,7 @@ $(BUILDDIR)/$(gcc_ver)/Makefile \
+ 	      --with-mpfr=$(PREFIX) \
+ 	      --with-gmp=$(PREFIX) \
+ 	      --with-mpc=$(PREFIX) \
++	      --enable-linker-build-id \
+ 	) 2>&1 | tee $(@D)/log.config
+ 	@echo 'done'
+ 
+-- 
+2.45.2
+

0007-Tools.gmk-Exclude-systemtap-sdt-devel-on-s390x-ppc64.patch

@@ -0,0 +1,38 @@
+From 2617c050a909265444b32063b2d271eca42dcaa6 Mon Sep 17 00:00:00 2001
+From: Andrew Hughes <gnu.andrew@redhat.com>
+Date: Fri, 17 Jan 2025 21:11:01 +0000
+Subject: [PATCH] Tools.gmk: Exclude systemtap-sdt-devel on s390x & ppc64*
+
+There is no DTrace support on s390x (JDK-8305174) and ppc64
+(JDK-8304867) so we don't need the RPMs. They also cause issues with
+static linkage of libstdc++.a on s390x. It fails with 'error:
+relocation refers to local symbol "" [9], which is defined in a
+discarded section'.
+
+Resolves: OPENJDK-3070
+---
+ make/devkit/Tools.gmk | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index 57d48ec5114..07928f69ceb 100644
+--- a/make/devkit/Tools.gmk
++++ b/make/devkit/Tools.gmk
+@@ -219,9 +219,13 @@ RPM_LIST := \
+     zlib zlib-devel \
+     libffi libffi-devel \
+     fontconfig fontconfig-devel \
+-    systemtap-sdt-devel \
+     #
+ 
++# Only include SystemTap on supported architectures
++ifeq ($(filter ppc64 ppc64le s390x, $(ARCH)), )
++  RPM_LIST += systemtap-sdt-devel
++endif
++
+ ##########################################################################################
+ # Define common directories and files
+ 
+-- 
+2.45.2
+

0008-Tools.gmk-Use-update-repository-on-RHEL-rather-than-.patch

@@ -0,0 +1,33 @@
+From 9766818f55726cea630b432f09cce8f9c17c014d Mon Sep 17 00:00:00 2001
+From: Andrew Hughes <gnu.andrew@redhat.com>
+Date: Fri, 17 Jan 2025 21:27:58 +0000
+Subject: [PATCH] Tools.gmk: Use update repository on RHEL rather than GA
+
+It looks like we were using 7.6 & 7.9 GA repositories rather than
+the latest updates.
+
+Resolves: OPENJDK-3589
+---
+ make/devkit/Tools.gmk | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/make/devkit/Tools.gmk b/make/devkit/Tools.gmk
+index 07928f69ceb..5b39560ab11 100644
+--- a/make/devkit/Tools.gmk
++++ b/make/devkit/Tools.gmk
+@@ -64,10 +64,10 @@ ifeq ($(BASE_OS), OL)
+   endif
+ else ifeq ($(BASE_OS), RHEL)
+   ifeq ($(ARCH), aarch64)
+-    BASE_URL := https://download.eng.brq.redhat.com/rhel-7/rel-eng/RHEL-7/latest-RHEL-ALT-7/compose/Server/$(ARCH)/os/Packages/
++    BASE_URL := https://download.eng.brq.redhat.com/rhel-7/rel-eng/updates/RHEL-ALT-7/latest-RHEL-ALT-7/compose/Server/$(ARCH)/os/Packages/
+     LINUX_VERSION := RHEL7.6
+   else
+-    BASE_URL := https://download.eng.brq.redhat.com/rhel-7/rel-eng/RHEL-7/latest-RHEL-7/compose/Server/$(ARCH)/os/Packages/
++    BASE_URL := https://download.eng.brq.redhat.com/rhel-7/rel-eng/updates/RHEL-7/latest-RHEL-7/compose/Server/$(ARCH)/os/Packages/
+     LINUX_VERSION := RHEL7.9
+   endif
+ else ifeq ($(BASE_OS), Fedora)
+-- 
+2.45.2
+

README.md

@@ -37,3 +37,10 @@ need to be modified if the version or rpmrelease values are changed in
 To reduce the number of RPMs involved, the `fastdebug` and `slowdebug`
 builds may be disabled using `--without fastdebug` and `--without
 slowdebug`.
+
+By default, the portable build on RHEL also uses a "devkit" (a
+toolchain and system libraries) to build.  This aids reproducibility
+by removing build differences caused by differing system toolchains
+and libraries.  This dependency can be dropped by defining 'centos' to
+a non-zero value (e.g. --define='centos 1') or a devkit can be built
+using the `openjdk-devkit.specfile` and associated patches.

fips-21u-9203d50836c.patch

@@ -1979,7 +1979,7 @@ index 539ef1e8ee8..435f57e3ff2 100644
                  "sun.security.rsa.PSSParameters", null);
      }
 diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security
-index 5149edba0e5..8227d650a03 100644
+index f8b01a4ea1e..b325bf7e9fc 100644
 --- a/src/java.base/share/conf/security/java.security
 +++ b/src/java.base/share/conf/security/java.security
 @@ -85,6 +85,17 @@ security.provider.tbd=Apple
@@ -2959,7 +2959,7 @@ index 00000000000..f8d505ca815
 +}
 \ No newline at end of file
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
-index c3b412885a6..0e7ce73b158 100644
+index 01fc06ae283..e3ca000d309 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
 @@ -37,6 +37,8 @@ import javax.crypto.*;
@@ -2981,7 +2981,7 @@ index c3b412885a6..0e7ce73b158 100644
      private static final String PUBLIC = "public";
      private static final String PRIVATE = "private";
      private static final String SECRET = "secret";
-@@ -401,9 +406,10 @@ abstract class P11Key implements Key, Length {
+@@ -414,9 +419,10 @@ abstract class P11Key implements Key, Length {
                      new CK_ATTRIBUTE(CKA_EXTRACTABLE),
          });
  
@@ -2995,7 +2995,7 @@ index c3b412885a6..0e7ce73b158 100644
  
          return switch (algorithm) {
              case "RSA" -> P11RSAPrivateKeyInternal.of(session, keyID, algorithm,
-@@ -455,7 +461,8 @@ abstract class P11Key implements Key, Length {
+@@ -468,7 +474,8 @@ abstract class P11Key implements Key, Length {
  
          public String getFormat() {
              token.ensureValid();
@@ -3005,13 +3005,13 @@ index c3b412885a6..0e7ce73b158 100644
                  return null;
              } else {
                  return "RAW";
-@@ -1625,4 +1632,3 @@ final class SessionKeyRef extends PhantomReference<P11Key> {
+@@ -1638,4 +1645,3 @@ final class SessionKeyRef extends PhantomReference<P11Key> {
          this.clear();
      }
  }
 -
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
-index 5cd6828d293..bae49c4e8a9 100644
+index 0a62021633f..0723b69c2bc 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
 @@ -26,6 +26,9 @@
@@ -3022,7 +3022,7 @@ index 5cd6828d293..bae49c4e8a9 100644
 +import java.lang.invoke.MethodHandles;
 +import java.lang.invoke.MethodType;
  import java.util.*;
- 
+ import java.util.stream.Collectors;
  import java.security.*;
 @@ -42,10 +45,12 @@ import javax.security.auth.callback.PasswordCallback;
  
@@ -3141,7 +3141,7 @@ index 5cd6828d293..bae49c4e8a9 100644
              }
              p11 = tmpPKCS11;
  
-@@ -1389,11 +1461,52 @@ public final class SunPKCS11 extends AuthProvider {
+@@ -1388,11 +1460,52 @@ public final class SunPKCS11 extends AuthProvider {
          }
  
          @Override
@@ -3194,7 +3194,7 @@ index 5cd6828d293..bae49c4e8a9 100644
              try {
                  return newInstance0(param);
              } catch (PKCS11Exception e) {
-@@ -1750,6 +1863,9 @@ public final class SunPKCS11 extends AuthProvider {
+@@ -1749,6 +1862,9 @@ public final class SunPKCS11 extends AuthProvider {
          try {
              session = token.getOpSession();
              p11.C_Logout(session.id());
@@ -3252,7 +3252,7 @@ index a6f5f0a8764..9a07c96ca4e 100644
      }
  
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
-index 4b06daaf264..55e14945469 100644
+index 0fd13fd6fa6..3c959c942a1 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
 @@ -49,6 +49,9 @@ package sun.security.pkcs11.wrapper;
@@ -3312,7 +3312,7 @@ index 4b06daaf264..55e14945469 100644
              }
              if (omitInitialize == false) {
                  try {
-@@ -1976,4 +2004,194 @@ static class SynchronizedPKCS11 extends PKCS11 {
+@@ -2012,4 +2040,194 @@ static class SynchronizedPKCS11 extends PKCS11 {
          super.C_GenerateRandom(hSession, randomData);
      }
  }

gating.yaml

@@ -1,7 +1,7 @@
 # recipients: java-qa
 --- !Policy
 product_versions:
-  - rhel-10
+  - rhel-9
 decision_context: osci_compose_gate
 rules:
   - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

openjdk-devkit.specfile

@@ -0,0 +1,230 @@
+# Spec file for building a devkit for OpenJDK builds
+
+# We do not want debug packages
+%global debug_package %{nil}
+# Arch definitions from java-*-openjdk RPM
+%global aarch64         aarch64 arm64 armv8
+# x86 is not supported by OpenJDK 17
+ExcludeArch: %{ix86}
+
+# New Version-String scheme-style defines
+%global featurever 21
+%global interimver 0
+%global updatever 5
+%global patchver 0
+%global buildver 11
+# Define JDK versions
+%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
+%global javaver         %{featurever}
+# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames
+%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn})
+# The tag used to create the OpenJDK tarball
+%global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}
+
+# Define milestone (EA for pre-releases, GA for releases)
+# Release will be (where N is usually a number starting at 1):
+# - 0.N%%{?extraver}%%{?dist} for EA releases,
+# - N%%{?extraver}{?dist} for GA releases
+%global is_ga           1
+%if %{is_ga}
+%global build_type GA
+%global ea_designator ""
+%global ea_designator_zip %{nil}
+%global extraver %{nil}
+%global eaprefix %{nil}
+%else
+%global build_type EA
+%global ea_designator ea
+%global ea_designator_zip -%{ea_designator}
+%global extraver .%{ea_designator}
+%global eaprefix 0.
+%endif
+
+# Date devkit RPMs were download
+%global rpm_download_date 20250117
+
+Name: openjdk-devkit
+Version: 1.0
+Release: 9%{?dist}
+License: GPLv2
+URL: http://openjdk.java.net/
+Summary: OpenJDK Devkit
+
+# The source tarball, generated using generate_source_tarball.sh
+Source0: https://openjdk-sources.osci.io/openjdk%{featurever}/open%{vcstag}%{ea_designator_zip}.tar.xz
+# The buildroot RPMs for each architecture
+Source1: devkit-rpms-aarch64-%{rpm_download_date}.tar.xz
+Source2: devkit-rpms-ppc64le-%{rpm_download_date}.tar.xz
+Source3: devkit-rpms-s390x-%{rpm_download_date}.tar.xz
+Source4: devkit-rpms-x86_64-%{rpm_download_date}.tar.xz
+# Toolchain sources
+Source5: binutils-2.39.tar.gz
+Source6: gcc-11.3.0.tar.xz
+Source7: gmp-6.2.1.tar.bz2
+Source8: mpc-1.2.1.tar.gz
+Source9: mpfr-4.1.1.tar.bz2
+Source10: gdb-11.2.tar.xz
+
+# Devkit patches; see https://github.com/rh-openjdk/jdk/tree/devkit
+# To regenerate, use git format-patch -N jdk21u/master
+# Add RHEL RPM URLs and turn off robots
+Patch0: 0001-Allow-devkit-to-work-with-RHEL.patch
+# Turn off multilib on x86_64
+Patch1: 0002-Disable-multilib-on-x86_64.patch
+# Improve build logging (OPENJDK-3071)
+Patch2: 0003-Log-devkit-build-to-stdout.patch
+# Remove .comment sections from sysroot objects
+Patch3: 0004-devkit-Remove-.comment-sections-from-sysroot-objects.patch
+# Configure binutils with --enable-deterministic-archives
+Patch4: 0005-Tools.gmk-Configure-binutils-with-enable-determinist.patch
+# Configure gcc with --enable-linker-build-id (OPENJDK-3068)
+Patch5: 0006-Tools.gmk-Add-enable-linker-build-id-to-gcc-build.patch
+# Exclude systemtap-sdt-devel on s390x & ppc64* (OPENJDK-3070)
+Patch6: 0007-Tools.gmk-Exclude-systemtap-sdt-devel-on-s390x-ppc64.patch
+# Use update repository on RHEL rather than GA (OPENJDK-3589)
+Patch7: 0008-Tools.gmk-Use-update-repository-on-RHEL-rather-than-.patch
+
+BuildRequires: make autoconf automake libtool gcc gcc-c++ wget glibc-devel texinfo tar bison
+
+# Setup variables to reference correct sources
+%ifarch %{aarch64}
+%global rpmtarball %{SOURCE1}
+%endif
+%ifarch ppc64le
+%global rpmtarball %{SOURCE2}
+%endif
+%ifarch s390x
+%global rpmtarball %{SOURCE3}
+%endif
+%ifarch x86_64
+%global rpmtarball %{SOURCE4}
+%endif
+
+%description
+OpenJDK Devkit
+
+%prep
+
+# Unpack OpenJDK sources only in build directory
+%setup -q -T -c -a 0
+
+# This syntax is deprecated:
+#    %patchN [...]
+# and should be replaced with:
+#    %patch -PN [...]
+# For example:
+#    %patch1001 -p1
+# becomes:
+#    %patch -P1001 -p1
+# The replacement format suggested by recent (circa Fedora 38) RPM
+# deprecation messages:
+#    %patch N [...]
+# is not backward-compatible with prior (circa RHEL-8) versions of
+# rpmbuild.
+pushd jdk-*
+%patch -P0 -p1
+%patch -P1 -p1
+%patch -P2 -p1
+%patch -P3 -p1
+%patch -P4 -p1
+%patch -P5 -p1
+%patch -P6 -p1
+%patch -P7 -p1
+popd
+
+mkdir -p devkit/download
+pushd devkit/download
+tar -xJf %{rpmtarball}
+ln -s %{SOURCE5}
+ln -s %{SOURCE6}
+ln -s %{SOURCE7}
+ln -s %{SOURCE8}
+ln -s %{SOURCE9}
+ln -s %{SOURCE10}
+
+%build
+
+devkit_dir=$(pwd)/devkit
+today=$(date +%Y%m%d)
+arch=%{_target_cpu}
+result_name=${arch}-linux-gnu-to-${arch}-linux-gnu
+result_path=result/${result_name}
+
+pushd jdk-*/make/devkit
+
+# Build devkit first using the native toolchain,
+# than again using itself
+for variant in bootstrap product ; do
+    if [ -e ${devkit_dir}-bootstrap/${result_path}/bin/gcc ] ; then
+        ROOTDIR=${devkit_dir}-bootstrap/${result_path};
+        BINDIR=${ROOTDIR}/bin;
+        TOOLS="CC=${BINDIR}/gcc CXX=${BINDIR}/g++ LD=${BINDIR}/ld \
+               AR=${BINDIR}/ar AS=${BINDIR}/as RANLIB=${BINDIR}/ranlib \
+               OBJDUMP=${BINDIR}/objdump"
+        LIBPATH="${ROOTDIR}/lib64:${ROOTDIR}/lib"
+    else
+        TOOLS="CC=$(which gcc) CXX=$(which g++) LD=$(which ld) \
+               AR=$(which ar) AS=$(which as) RANLIB=$(which ranlib) \
+               OBJDUMP=$(which objdump)"
+    fi
+    mkdir -p ${devkit_dir}-${variant}
+    ln -s ${devkit_dir}/download ${devkit_dir}-${variant}
+    LD_LIBRARY_PATH="${LIBPATH}" \
+        make -f Tools.gmk all ${TOOLS} \
+        HOST=${arch}-linux-gnu \
+        BUILD=${arch}-linux-gnu \
+        RESULT=${devkit_dir}-${variant}/result \
+        OUTPUT_ROOT=${devkit_dir}-${variant} \
+        TARGET=${arch}-linux-gnu \
+        PREFIX=${devkit_dir}-${variant}/${result_path} \
+        BASE_OS=RHEL
+done
+
+make -r -f Tars.gmk \
+     SRC_DIR=${devkit_dir}-product/${result_path} \
+     TAR_FILE=${devkit_dir}-product/result/sdk-${result_name}-${today}.tar.gz
+popd
+
+%install
+mkdir -p %{buildroot}%{_datadir}/%{name}
+cp -p devkit-product/result/*.tar.gz %{buildroot}%{_datadir}/%{name}/
+
+%files
+%{_datadir}/%{name}
+
+%changelog
+* Fri Jan 17 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-9
+- Update devkit RPMs to latest updates
+- Exclude SystemTap RPMs from s390x and ppc64le
+- Add a date stamp to the RPM bundles
+- Resolves: OPENJDK-3070
+= Resolves: OPENJDK-3589
+
+* Wed Nov 27 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-8
+- Add --enable-linker-build-id to gcc build
+- Resolves: OPENJDK-3068
+
+* Wed Oct 30 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-7
+- Improve build logging by also writing to stdout
+- Cleanup patches and rebase on jdk-21.0.5-ga
+- Drop JDK-8323671 patch which is upstream as of 21.0.3+3
+- Resolves: OPENJDK-3071
+
+* Tue Jun 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-6
+- Fix typo where 'as' binary is accidentally capitalised in AS=<path>/as
+
+* Wed May 01 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-5
+- Bootstrap the devkit, building it again with itself
+
+* Mon Apr 08 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-4
+- Include Thomas' patches to drop .comment sections and build binutils with deterministic archives
+- Use backward-compatible patch syntax
+
+* Tue Feb 06 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-3
+- Include JDK-8323671 patch so the binaries don't contain the full source path
+
+* Fri Dec 08 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-2
+- Try to turn off multlib on x86_64 as we don't have the dependencies for it
+
+* Tue Dec 05 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1.0-1
+- Create RHEL 7 based devkit for building OpenJDK

scripts/get_bundle_versions.sh

@@ -0,0 +1,172 @@
+#!/usr/bin/env sh
+
+# Copyright (C) 2025 Red Hat, Inc.
+# Original written by Antonio Vieiro <avieirov@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+if [ $# -ne 1 ]; then
+    echo "Usage: $0 openjdk-root-directory"
+    exit 1
+fi
+
+JDKROOT=$1
+
+if [ ! -d "${JDKROOT}" ] ; then
+    echo "${JDKROOT} is not a directory.";
+    exit 2
+fi
+
+# Work out the OpenJDK version
+# OpenJDK >= 10 has its version in the build machinery
+# OpenJDK >= 17 stores it in a new location (JDK-8258246)
+VERSION_FILE="${JDKROOT}"/make/conf/version-numbers.conf
+printf "Checking for %s..." "${VERSION_FILE}";
+if [ ! -f "${VERSION_FILE}" ] ; then
+    VERSION_FILE="${JDKROOT}"/make/autoconf/version-numbers
+    echo "Not found; using old version file ${VERSION_FILE}";
+else
+    echo "found.";
+fi
+if [ -e "${VERSION_FILE}" ] ; then
+    openjdk_version=$(grep '^DEFAULT_VERSION_FEATURE' "${VERSION_FILE}" | cut -d '=' -f 2)
+elif [ -e "${JDKROOT}"/jdk/src/java.base/share/classes/java/lang/Object.java ] ; then
+    openjdk_version=9;
+elif [ -e "${JDKROOT}"/common/autoconf ] ; then
+    openjdk_version=8;
+else
+    openjdk_version=7;
+fi
+echo "OpenJDK version: ${openjdk_version}";
+
+#
+# Freetype
+#
+if [ "${openjdk_version}" -gt 8 ] ; then
+    FREETYPE=src/java.desktop/share/native/libfreetype/include/freetype/freetype.h
+    ABS_FREETYPE="${JDKROOT}"/"${FREETYPE}"
+    if [ ! -f "${ABS_FREETYPE}" ]; then
+        echo "Freetype header not found!"
+        exit 2
+    fi
+    FREETYPE_VERSION=$(awk '/#define FREETYPE_MAJOR/ {MAJOR=$3} /#define FREETYPE_MINOR/ {MINOR=$3} /#define FREETYPE_PATCH/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_FREETYPE}")
+else
+    echo "No bundled FreeType on ${openjdk_version}";
+fi
+
+# giflib
+if [ "${openjdk_version}" -gt 8 ] ; then
+    GIFLIB=src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
+else
+    GIFLIB=jdk/src/share/native/sun/awt/giflib/gif_lib.h
+fi
+ABS_GIFLIB="${JDKROOT}"/"${GIFLIB}"
+if [ ! -f "${ABS_GIFLIB}" ]; then
+    echo "giflib header not found!"
+    exit 3
+fi
+GIFLIB_VERSION=$(awk '/#define GIFLIB_MAJOR/ {MAJOR=$3} /#define GIFLIB_MINOR/ {MINOR=$3} /#define GIFLIB_RELEASE/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_GIFLIB}")
+
+# harfbuzz
+if [ "${openjdk_version}" -gt 8 ] ; then
+    HARFBUZZ=src/java.desktop/share/native/libharfbuzz/hb-version.h
+    ABS_HARFBUZZ="${JDKROOT}/${HARFBUZZ}"
+    if [ ! -f "${ABS_HARFBUZZ}" ]; then
+        echo "HarfBuzz header not found!"
+        exit 4
+    fi
+    HARFBUZZ_VERSION=$(awk '/#define HB_VERSION_MAJOR/ {MAJOR=$3} /#define HB_VERSION_MINOR/ {MINOR=$3} /#define HB_VERSION_MICRO/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_HARFBUZZ}")
+else
+    echo "No HarfBuzz on ${openjdk_version}";
+fi
+
+# lcms
+if [ "${openjdk_version}" -gt 8 ] ; then
+    LCMS=src/java.desktop/share/native/liblcms/lcms2.h
+else
+    LCMS=jdk/src/share/native/sun/java2d/cmm/lcms/lcms2.h
+fi
+ABS_LCMS="${JDKROOT}"/"${LCMS}"
+if [ ! -f "${ABS_LCMS}" ]; then
+    echo "lcms header not found!"
+    exit 5
+fi
+LCMS_VERSION=$(awk '/#define LCMS_VERSION/ { MAJOR=int($3 / 1000); REST=$3 % 1000; MINOR=int(REST / 10); PATCH=REST % 10; } END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_LCMS}")
+
+# jpeg
+if [ "${openjdk_version}" -gt 8 ] ; then
+    JPEG=src/java.desktop/share/native/libjavajpeg/jpeglib.h
+else
+    JPEG=jdk/src/share/native/sun/awt/image/jpeg/jpeglib.h
+fi
+ABS_JPEG="${JDKROOT}"/"${JPEG}"
+if [ ! -f "${ABS_JPEG}" ]; then
+    echo "jpeg header not found!"
+    exit 6
+fi
+JPEG_VERSION=$(awk '/#define JPEG_LIB_VERSION/ { VERSION=$3; MAJOR=int(VERSION / 10); MINOR=VERSION%10; } END {printf "%s%c", MAJOR, (MINOR+96)}' "${ABS_JPEG}")
+
+# png
+if [ "${openjdk_version}" -gt 8 ] ; then
+    PNG=src/java.desktop/share/native/libsplashscreen/libpng/png.h
+else
+    PNG=jdk/src/share/native/sun/awt/libpng/png.h
+fi
+ABS_PNG="${JDKROOT}"/"${PNG}"
+if [ ! -f "${ABS_PNG}" ]; then
+    echo "png header not found!"
+    exit 7
+fi
+PNG_VERSION=$(awk '/#define PNG_LIBPNG_VER_STRING/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_PNG}")
+
+# zlib
+if [ "${openjdk_version}" -gt 8 ] ; then
+    ZLIB=src/java.base/share/native/libzip/zlib/zlib.h
+else
+    ZLIB=jdk/src/share/native/java/util/zip/zlib/zlib.h
+fi
+ABS_ZLIB="${JDKROOT}"/"${ZLIB}"
+if [ ! -f "${ABS_ZLIB}" ]; then
+    echo "zlib header not found!"
+    exit 8
+fi
+ZLIB_VERSION=$(awk '/#define ZLIB_VERSION/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_ZLIB}")
+
+# Print output
+printf "\nRPM definitions:\n"
+if [ "${openjdk_version}" -gt 8 ] ; then
+    echo "# Version in ${FREETYPE}"
+    echo "Provides: bundled(freetype) = ${FREETYPE_VERSION}"
+fi
+echo "# Version in ${GIFLIB}"
+echo "Provides: bundled(giflib) = ${GIFLIB_VERSION}"
+if [ "${openjdk_version}" -gt 8 ] ; then
+    echo "# Version in ${HARFBUZZ}"
+    echo "Provides: bundled(harfbuzz) = ${HARFBUZZ_VERSION}"
+fi
+echo "# Version in ${LCMS}"
+echo "Provides: bundled(lcms2) = ${LCMS_VERSION}"
+echo "# Version in ${JPEG}"
+echo "Provides: bundled(libjpeg) = ${JPEG_VERSION}"
+echo "# Version in ${PNG}"
+echo "Provides: bundled(libpng) = ${PNG_VERSION}"
+echo "# Version in ${ZLIB}"
+echo "Provides: bundled(zlib) = ${ZLIB_VERSION}"
+
+# Local Variables:
+# compile-command: "shellcheck get_bundle_versions.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/openjdk_news.sh

@@ -69,12 +69,43 @@ do
     fi
 done
 
-sort "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" | uniq > "${TMPDIR}/fixes"
+sort "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" > "${TMPDIR}/fixes4"
+uniq "${TMPDIR}/fixes4" > "${TMPDIR}/fixes"
 rm -f "${TMPDIR}/fixes2" "${TMPDIR}/fixes3"
 
+if ! [ -s "${TMPDIR}/fixes" ] ; then
+    echo "Failed to obtain fixes.";
+    exit 3;
+fi
+
 echo "In ${TMPDIR}/fixes:"
 cat "${TMPDIR}/fixes"
 
+printf "\nChecking for duplicates...";
+if uniq -d "${TMPDIR}/fixes4" | grep 'JDK' > "${TMPDIR}/dupes"; then
+    printf "found.\nWARNING: Review the following duplicates:\n";
+    cat "${TMPDIR}/dupes";
+else
+    echo "No apparent duplicates.";
+fi
+rm -f "${TMPDIR}/fixes4";
+
+printf "\nChecking for backouts...";
+if grep -i 'backout' "${TMPDIR}/fixes" > "${TMPDIR}/backouts"; then
+    printf "found.\nWARNING: Review the following backouts:\n"
+    cat "${TMPDIR}/backouts";
+else
+    echo "No apparent backouts.";
+fi
+printf "\nChecking for bundled library updates...";
+if grep -iE ':( \(tz\))? update.*(freetype|gif|harfbuzz|lcms|jpeg|png|timezone|zlib)' "${TMPDIR}/fixes" > "${TMPDIR}/bundles"; then
+    printf "found.\nWARNING: Review the following with respect to bundled provides:\n";
+    cat "${TMPDIR}/bundles";
+    echo "Compare the output of $(dirname "${0}")/get_bundle_versions.sh with the RPM using the JDK source tree"
+else
+    echo "No apparent library updates.";
+fi
+
 # Local Variables:
 # compile-command: "shellcheck openjdk_news.sh"
 # fill-column: 80

sources

@@ -1,2 +1,2 @@
 SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
-SHA512 (openjdk-21.0.5+11.tar.xz) = f416e746593589cc7d37dbde55098038412939947c41c05baf2da31e44c42d0242cb8f6a4a5659d3d7b9a27e775d9ef375f754acda5e143ada5987e288dbe87a
+SHA512 (openjdk-21.0.8+9.tar.xz) = 81be6d151fdca910fbee9ea1a93b20af037d2dbafeb12fa368a6091096a22dcf997cf419bebe0261f016ce0fe1e74acd4fca54ca0840a3d69ad76ae7a1336e4c