Update to jdk-20.0.2+9

Update release notes to 20.0.2+9
Update system crypto policy & FIPS patch from new fips-20u tree
Update generate_tarball.sh ICEDTEA_VERSION
Update CLDR reference data following update to 42 (Rocky Mountain-Normalzeit => Rocky-Mountain-Normalzeit)
Dropped JDK-8295447, JDK-8296239 & JDK-8299439 patches now upstream
Adapted rh1750419-redhat_alt_java.patch

Related: RHEL-12998

.gitignore

@@ -1,2 +1,12 @@
-SOURCES/openjdk-21.0.3+9.tar.xz
-SOURCES/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz
+/openjdk-jdk17u-jdk-17.0.7+7.tar.xz
+/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz
+/openjdk-jdk18u-jdk-18.0.1+0.tar.xz
+/openjdk-jdk18u-jdk-18.0.1+10.tar.xz
+/openjdk-jdk18u-jdk-18.0.1.1+2.tar.xz
+/openjdk-jdk18u-jdk-18.0.2+9.tar.xz
+/openjdk-jdk19u-jdk-19+36.tar.xz
+/openjdk-jdk19u-jdk-19.0.1+10.tar.xz
+/openjdk-jdk19u-jdk-19.0.2+7.tar.xz
+/openjdk-jdk20u-jdk-20+36.tar.xz
+/openjdk-jdk20u-jdk-20.0.1+9.tar.xz
+/openjdk-jdk20u-jdk-20.0.2+9.tar.xz

.java-21-openjdk.metadata

@@ -1,2 +0,0 @@
-d5e32198171cbeca75d165678f273fcc309581a9 SOURCES/openjdk-21.0.3+9.tar.xz
-c8281ee37b77d535c9c1af86609a531958ff7b34 SOURCES/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz

README.md

@@ -1,12 +1,14 @@
-OpenJDK 21 is the latest Long-Term Support (LTS) release of the Java platform.
+OpenJDK 17 is the latest Long-Term Support (LTS) release of the Java platform.
 
-For a list of major changes from OpenJDK 17 (java-17-openjdk), see the upstream
-release page for OpenJDK 21 and the preceding interim releases:
+For a list of major changes from OpenJDK 11 (java-11-openjdk), see the upstream
+release page for OpenJDK 17 and the preceding interim releases:
 
-* 18: https://openjdk.java.net/projects/jdk/18/
-* 19: https://openjdk.java.net/projects/jdk/19/
-* 20: https://openjdk.java.net/projects/jdk/20/
-* 21: https://openjdk.java.net/projects/jdk/21/
+* 12: https://openjdk.java.net/projects/jdk/12/
+* 13: https://openjdk.java.net/projects/jdk/13/
+* 14: https://openjdk.java.net/projects/jdk/14/
+* 15: https://openjdk.java.net/projects/jdk/15/
+* 16: https://openjdk.java.net/projects/jdk/16/
+* 17: https://openjdk.java.net/projects/jdk/17/
 
 # Rebuilding the OpenJDK package
 
@@ -18,21 +20,21 @@ multiple builds which only differ by the platform they were built on.
 
 This does make rebuilding the package slightly more complicated than a
 normal package. Modifications should be made to the
-`java-21-openjdk-portable.specfile` file, which can be found with this
+`java-17-openjdk-portable.specfile` file, which can be found with this
 README file in the source RPM or installed in the documentation tree
-by the `java-21-openjdk-headless` RPM.
+by the `java-17-openjdk-headless` RPM.
 
-Once the modified `java-21-openjdk-portable` RPMs are built, they
+Once the modified `java-17-openjdk-portable` RPMs are built, they
 should be installed and will produce a number of tarballs in the
-`/usr/lib/jvm` directory. The `java-21-openjdk` RPMs can then be
+`/usr/lib/jvm` directory. The `java-17-openjdk` RPMs can then be
 built, which will use these tarballs to create the usual RPMs found in
-RHEL. The `java-21-openjdk-portable` RPMs can be uninstalled once the
+RHEL. The `java-17-openjdk-portable` RPMs can be uninstalled once the
 desired final RPMs are produced.
 
-Note that the `java-21-openjdk.spec` file has a hard requirement on
-the exact version of java-21-openjdk-portable to use, so this will
+Note that the `java-17-openjdk.spec` file has a hard requirement on
+the exact version of java-17-openjdk-portable to use, so this will
 need to be modified if the version or rpmrelease values are changed in
-`java-21-openjdk-portable.specfile`.
+`java-17-openjdk-portable.specfile`.
 
 To reduce the number of RPMs involved, the `fastdebug` and `slowdebug`
 builds may be disabled using `--without fastdebug` and `--without

SOURCES/alt-java.c

@@ -1,100 +0,0 @@
-/*
- * Copyright (C) 2023 Red Hat, Inc.
- * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
- *
- * This code is free software; you can redistribute it and/or modify it
- * under the terms of the GNU General Public License version 2 only, as
- * published by the Free Software Foundation.  Red Hat designates this
- * particular file as subject to the "Classpath" exception as provided
- * by Red Hat in the LICENSE file that accompanied this code.
- *
- * This code is distributed in the hope that it will be useful, but WITHOUT
- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
- * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
- * version 2 for more details (a copy is included in the LICENSE file that
- * accompanied this code).
- *
- * You should have received a copy of the GNU General Public License version
- * 2 along with this work; if not, write to the Free Software Foundation,
- * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
- *
- */
-
-#include <errno.h>
-#include <libgen.h>
-#include <linux/limits.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string.h>
-#include <sys/prctl.h>
-#include <unistd.h>
-
-/* Per task speculation control */
-#ifndef PR_GET_SPECULATION_CTRL
-# define PR_GET_SPECULATION_CTRL    52
-#endif
-#ifndef PR_SET_SPECULATION_CTRL
-# define PR_SET_SPECULATION_CTRL    53
-#endif
-/* Speculation control variants */
-#ifndef PR_SPEC_STORE_BYPASS
-# define PR_SPEC_STORE_BYPASS          0
-#endif
-/* Return and control values for PR_SET/GET_SPECULATION_CTRL */
-
-#ifndef PR_SPEC_NOT_AFFECTED
-# define PR_SPEC_NOT_AFFECTED          0
-#endif
-#ifndef PR_SPEC_PRCTL
-# define PR_SPEC_PRCTL                 (1UL << 0)
-#endif
-#ifndef PR_SPEC_ENABLE
-# define PR_SPEC_ENABLE                (1UL << 1)
-#endif
-#ifndef PR_SPEC_DISABLE
-# define PR_SPEC_DISABLE               (1UL << 2)
-#endif
-#ifndef PR_SPEC_FORCE_DISABLE
-# define PR_SPEC_FORCE_DISABLE         (1UL << 3)
-#endif
-#ifndef PR_SPEC_DISABLE_NOEXEC
-# define PR_SPEC_DISABLE_NOEXEC        (1UL << 4)
-#endif
-
-static void set_speculation() {
-#if defined(__linux__) && defined(__x86_64__)
-  // PR_SPEC_DISABLE_NOEXEC doesn't survive execve, so we can't use it
-  //  if ( prctl(PR_SET_SPECULATION_CTRL,
-  //           PR_SPEC_STORE_BYPASS,
-  //           PR_SPEC_DISABLE_NOEXEC, 0, 0) == 0 ) {
-  //  return;
-  // }
-  prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0);
-#else
-#warning alt-java requested but SSB mitigation not available on this platform.
-#endif
-}
-
-int main(int argc, char **argv) {
-  set_speculation();
-
-  char our_name[PATH_MAX], java_name[PATH_MAX];
-  ssize_t len = readlink("/proc/self/exe", our_name, PATH_MAX - 1);
-  if (len < 0) {
-    perror("I can't find myself");
-    exit(2);
-  }
-
-  our_name[len] = '\0'; // readlink(2) doesn't append a null byte
-  char *path = dirname(our_name);
-  strncpy(java_name, path, PATH_MAX - 1);
-
-  size_t remaining_bytes = PATH_MAX - strlen(path) - 1;
-  strncat(java_name, "/java", remaining_bytes);
-
-  execv(java_name, argv);
-  fprintf(stderr, "%s failed to launch: %s\n", java_name, strerror(errno));
-
-  exit(1);
-}
-

discover_trees.sh

@@ -0,0 +1,54 @@
+#!/bin/sh
+
+# Copyright (C) 2020 Red Hat, Inc.
+# Written by Andrew John Hughes <gnu.andrew@redhat.com>.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+TREE=${1}
+
+if test "x${TREE}" = "x"; then
+    TREE=${PWD}
+fi
+
+if [ -e ${TREE}/nashorn/.hg -o -e ${TREE}/nashorn/merge.changeset ] ; then
+    NASHORN="nashorn" ;
+fi
+
+if [ -e ${TREE}/corba/.hg -o -e ${TREE}/corba/merge.changeset ] ; then
+    CORBA="corba";
+fi
+
+if [ -e ${TREE}/jaxp/.hg -o -e ${TREE}/jaxp/merge.changeset ] ; then
+    JAXP="jaxp";
+fi
+
+if [ -e ${TREE}/jaxws/.hg -o -e ${TREE}/jaxws/merge.changeset ] ; then
+    JAXWS="jaxws";
+fi
+
+if [ -e ${TREE}/langtools/.hg -o -e ${TREE}/langtools/merge.changeset ] ; then
+    LANGTOOLS="langtools";
+fi
+
+if [ -e ${TREE}/jdk/.hg -o -e ${TREE}/jdk/merge.changeset ] ; then
+    JDK="jdk";
+fi
+
+if [ -e ${TREE}/hotspot/.hg -o -e ${TREE}/hotspot/merge.changeset ] ; then
+    HOTSPOT="hotspot";
+fi
+
+SUBTREES="${CORBA} ${JAXP} ${JAXWS} ${LANGTOOLS} ${NASHORN} ${JDK} ${HOTSPOT}";
+echo ${SUBTREES}

gating.yaml

@@ -0,0 +1,7 @@
+# recipients: java-qa
+--- !Policy
+product_versions:
+  - rhel-9
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

generate_source_tarball.sh

@@ -0,0 +1,210 @@
+#!/bin/bash
+# Generates the 'source tarball' for JDK projects.
+#
+# Example:
+# When used from local repo set REPO_ROOT pointing to file:// with your repo
+# If your local repo follows upstream forests conventions, it may be enough to set OPENJDK_URL
+# If you want to use a local copy of patch PR3788, set the path to it in the PR3788 variable
+#
+# In any case you have to set PROJECT_NAME REPO_NAME and VERSION. eg:
+# PROJECT_NAME=openjdk
+# REPO_NAME=jdk17u
+# VERSION=jdk-17.0.3+5
+# or to eg prepare systemtap:
+# icedtea7's jstack and other tapsets
+# VERSION=6327cf1cea9e
+# REPO_NAME=icedtea7-2.6
+# PROJECT_NAME=release
+# OPENJDK_URL=http://icedtea.classpath.org/hg/
+# TO_COMPRESS="*/tapset"
+#
+# They are used to create correct name and are used in construction of sources url (unless REPO_ROOT is set)
+
+# This script creates a single source tarball out of the repository
+# based on the given tag and removes code not allowed in fedora/rhel. For
+# consistency, the source tarball will always contain 'openjdk' as the top
+# level folder, name is created, based on parameter
+#
+
+if [ ! "x$PR3823" = "x" ] ; then
+  if [ ! -f "$PR3823" ] ; then
+    echo "You have specified PR3823 as $PR3823 but it does not exist. Exiting"
+    exit 1
+  fi
+fi
+
+set -e
+
+OPENJDK_URL_DEFAULT=https://github.com
+COMPRESSION_DEFAULT=xz
+# Corresponding IcedTea version
+ICEDTEA_VERSION=15.0
+
+if [ "x$1" = "xhelp" ] ; then
+    echo -e "Behaviour may be specified by setting the following variables:\n"
+    echo "VERSION - the version of the specified OpenJDK project"
+    echo "PROJECT_NAME -- the name of the OpenJDK project being archived (optional; only needed by defaults)"
+    echo "REPO_NAME - the name of the OpenJDK repository (optional; only needed by defaults)"
+    echo "OPENJDK_URL - the URL to retrieve code from (optional; defaults to ${OPENJDK_URL_DEFAULT})"
+    echo "COMPRESSION - the compression type to use (optional; defaults to ${COMPRESSION_DEFAULT})"
+    echo "FILE_NAME_ROOT - name of the archive, minus extensions (optional; defaults to PROJECT_NAME-REPO_NAME-VERSION)"
+    echo "TO_COMPRESS - what part of clone to pack (default is openjdk)"
+    echo "PR3823 - the path to the PR3823 patch to apply (optional; downloaded if unavailable)"
+    echo "BOOT_JDK - the bootstrap JDK to satisfy the configure run"
+    exit 1;
+fi
+
+
+if [ "x$VERSION" = "x" ] ; then
+    echo "No VERSION specified"
+    exit 2
+fi
+echo "Version: ${VERSION}"
+
+NUM_VER=${VERSION##jdk-}
+RELEASE_VER=${NUM_VER%%+*}
+BUILD_VER=${NUM_VER##*+}
+MAJOR_VER=${RELEASE_VER%%.*}
+echo "Major version is ${MAJOR_VER}, release ${RELEASE_VER}, build ${BUILD_VER}"
+
+if [ "x$BOOT_JDK" = "x" ] ; then
+    echo "No boot JDK specified".
+    BOOT_JDK=/usr/lib/jvm/java-${MAJOR_VER}-openjdk;
+    echo -n "Checking for ${BOOT_JDK}...";
+    if [ -d ${BOOT_JDK} -a -x ${BOOT_JDK}/bin/java ] ; then
+        echo "Boot JDK found at ${BOOT_JDK}";
+    else
+        echo "Not found";
+        PREV_VER=$((${MAJOR_VER} - 1));
+        BOOT_JDK=/usr/lib/jvm/java-${PREV_VER}-openjdk;
+        echo -n "Checking for ${BOOT_JDK}...";
+        if [ -d ${BOOT_JDK} -a -x ${BOOT_JDK}/bin/java ] ; then
+            echo "Boot JDK found at ${BOOT_JDK}";
+        else
+            echo "Not found";
+            exit 4;
+        fi
+    fi
+else
+    echo "Boot JDK: ${BOOT_JDK}";
+fi
+
+# REPO_NAME is only needed when we default on REPO_ROOT and FILE_NAME_ROOT
+if [ "x$FILE_NAME_ROOT" = "x" -o "x$REPO_ROOT" = "x" ] ; then
+  if [ "x$PROJECT_NAME" = "x" ] ; then
+    echo "No PROJECT_NAME specified"
+    exit 1
+  fi
+  echo "Project name: ${PROJECT_NAME}"
+  if [ "x$REPO_NAME" = "x" ] ; then
+    echo "No REPO_NAME specified"
+    exit 3
+  fi
+  echo "Repository name: ${REPO_NAME}"
+fi
+
+if [ "x$OPENJDK_URL" = "x" ] ; then
+    OPENJDK_URL=${OPENJDK_URL_DEFAULT}
+    echo "No OpenJDK URL specified; defaulting to ${OPENJDK_URL}"
+else
+    echo "OpenJDK URL: ${OPENJDK_URL}"
+fi
+
+if [ "x$COMPRESSION" = "x" ] ; then
+    # rhel 5 needs tar.gz
+    COMPRESSION=${COMPRESSION_DEFAULT}
+fi
+echo "Creating a tar.${COMPRESSION} archive"
+
+if [ "x$FILE_NAME_ROOT" = "x" ] ; then
+    FILE_NAME_ROOT=${PROJECT_NAME}-${REPO_NAME}-${VERSION}
+    echo "No file name root specified; default to ${FILE_NAME_ROOT}"
+fi
+if [ "x$REPO_ROOT" = "x" ] ; then
+    REPO_ROOT="${OPENJDK_URL}/${PROJECT_NAME}/${REPO_NAME}.git"
+    echo "No repository root specified; default to ${REPO_ROOT}"
+fi;
+
+if [ "x$TO_COMPRESS" = "x" ] ; then
+    TO_COMPRESS="openjdk"
+    echo "No targets to be compressed specified, ; default to ${TO_COMPRESS}"
+fi;
+
+if [ -d ${FILE_NAME_ROOT} ] ; then
+  echo "exists exists exists exists exists exists exists "
+  echo "reusing reusing reusing reusing reusing reusing "
+  echo ${FILE_NAME_ROOT}
+else
+  mkdir "${FILE_NAME_ROOT}"
+  pushd "${FILE_NAME_ROOT}"
+    echo "Cloning ${VERSION} root repository from ${REPO_ROOT}"
+    git clone -b ${VERSION} ${REPO_ROOT} openjdk
+  popd
+fi
+pushd "${FILE_NAME_ROOT}"
+    if [ -d openjdk/src ]; then
+        pushd openjdk
+            echo "Removing EC source code we don't build"
+            CRYPTO_PATH=src/jdk.crypto.ec/share/native/libsunec/impl
+            rm -vf ${CRYPTO_PATH}/ec2.h
+            rm -vf ${CRYPTO_PATH}/ec2_163.c
+            rm -vf ${CRYPTO_PATH}/ec2_193.c
+            rm -vf ${CRYPTO_PATH}/ec2_233.c
+            rm -vf ${CRYPTO_PATH}/ec2_aff.c
+            rm -vf ${CRYPTO_PATH}/ec2_mont.c
+            rm -vf ${CRYPTO_PATH}/ecp_192.c
+            rm -vf ${CRYPTO_PATH}/ecp_224.c
+
+            echo "Syncing EC list with NSS"
+            if [ "x$PR3823" = "x" ] ; then
+                # get PR3823.patch (from https://github.com/icedtea-git/icedtea) in the ${ICEDTEA_VERSION} branch
+                # Do not push it or publish it
+                echo "PR3823 not found. Downloading..."
+                wget -v https://github.com/icedtea-git/icedtea/raw/${ICEDTEA_VERSION}/patches/pr3823.patch
+                echo "Applying ${PWD}/pr3823.patch"
+                patch -Np1 < pr3823.patch
+                rm pr3823.patch
+            else
+                echo "Applying ${PR3823}"
+                patch -Np1 < $PR3823
+            fi;
+            find . -name '*.orig' -exec rm -vf '{}' ';'
+        popd
+    fi
+
+    # Generate .src-rev so build has knowledge of the revision the tarball was created from
+    mkdir build
+    pushd build
+    sh ${PWD}/../openjdk/configure --with-boot-jdk=${BOOT_JDK}
+    make store-source-revision
+    popd
+    rm -rf build
+
+    # Remove commit checks
+    echo "Removing $(find openjdk -name '.jcheck' -print)"
+    find openjdk -name '.jcheck' -print0 | xargs -0 rm -r
+
+    # Remove history and GHA
+    echo "find openjdk -name '.hgtags'"
+    find openjdk -name '.hgtags' -exec rm -v '{}' '+'
+    echo "find openjdk -name '.hgignore'"
+    find openjdk -name '.hgignore' -exec rm -v '{}' '+'
+    echo "find openjdk -name '.gitattributes'"
+    find openjdk -name '.gitattributes' -exec rm -v '{}' '+'
+    echo "find openjdk -name '.gitignore'"
+    find openjdk -name '.gitignore' -exec rm -v '{}' '+'
+    echo "find openjdk -name '.git'"
+    find openjdk -name '.git' -exec rm -rv '{}' '+'
+    echo "find openjdk -name '.github'"
+    find openjdk -name '.github' -exec rm -rv '{}' '+'
+
+    echo "Compressing remaining forest"
+    if [ "X$COMPRESSION" = "Xxz" ] ; then
+        SWITCH=cJf
+    else
+        SWITCH=czf
+    fi
+    tar --exclude-vcs -$SWITCH ${FILE_NAME_ROOT}.tar.${COMPRESSION} $TO_COMPRESS
+    mv ${FILE_NAME_ROOT}.tar.${COMPRESSION}  ..
+popd
+echo "Done. You may want to remove the uncompressed version - $FILE_NAME_ROOT."

icedtea_sync.sh

@@ -0,0 +1,191 @@
+#!/bin/bash
+
+# Copyright (C) 2019 Red Hat, Inc.
+# Written by Andrew John Hughes <gnu.andrew@redhat.com>.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+ICEDTEA_USE_VCS=true
+
+ICEDTEA_VERSION=3.15.0
+ICEDTEA_URL=https://icedtea.classpath.org/download/source
+ICEDTEA_SIGNING_KEY=CFDA0F9B35964222
+
+ICEDTEA_HG_URL=https://icedtea.classpath.org/hg/icedtea11
+set -e
+
+RPM_DIR=${PWD}
+if [ ! -f ${RPM_DIR}/jconsole.desktop.in ] ; then
+    echo "Not in RPM source tree.";
+    exit 1;
+fi
+
+if test "x${TMPDIR}" = "x"; then
+    TMPDIR=/tmp;
+fi
+WORKDIR=${TMPDIR}/it.sync
+
+echo "Using working directory ${WORKDIR}"
+mkdir ${WORKDIR}
+pushd ${WORKDIR}
+
+if test "x${WGET}" = "x"; then
+    WGET=$(which wget);
+    if test "x${WGET}" = "x"; then
+	echo "wget not found";
+	exit 1;
+    fi
+fi
+
+if test "x${TAR}" = "x"; then
+    TAR=$(which tar)
+    if test "x${TAR}" = "x"; then
+	echo "tar not found";
+	exit 2;
+    fi
+fi
+
+echo "Dependencies:";
+echo -e "\tWGET: ${WGET}";
+echo -e "\tTAR: ${TAR}\n";
+
+if test "x${ICEDTEA_USE_VCS}" = "xtrue"; then
+    echo "Mode: Using VCS";
+
+    if test "x${GREP}" = "x"; then
+	GREP=$(which grep);
+	if test "x${GREP}" = "x"; then
+	    echo "grep not found";
+	    exit 3;
+	fi
+    fi
+
+    if test "x${CUT}" = "x"; then
+	CUT=$(which cut);
+	if test "x${CUT}" = "x"; then
+	    echo "cut not found";
+	    exit 4;
+	fi
+    fi
+
+    if test "x${TR}" = "x"; then
+	TR=$(which tr);
+	if test "x${TR}" = "x"; then
+	    echo "tr not found";
+	    exit 5;
+	fi
+    fi
+
+    if test "x${HG}" = "x"; then
+	HG=$(which hg);
+	if test "x${HG}" = "x"; then
+	    echo "hg not found";
+	    exit 6;
+	fi
+    fi
+
+    echo "Dependencies:";
+    echo -e "\tGREP: ${GREP}";
+    echo -e "\tCUT: ${CUT}";
+    echo -e "\tTR: ${TR}";
+    echo -e "\tHG: ${HG}";
+
+    echo "Checking out repository from VCS...";
+    ${HG} clone ${ICEDTEA_HG_URL} icedtea
+
+    echo "Obtaining version from configure.ac...";
+    ROOT_VER=$(${GREP} '^AC_INIT' icedtea/configure.ac|${CUT} -d ',' -f 2|${TR} -d '[][:space:]')
+    echo "Root version from configure: ${ROOT_VER}";
+
+    VCS_REV=$(${HG} log -R icedtea --template '{node|short}' -r tip)
+    echo "VCS revision: ${VCS_REV}";
+
+    ICEDTEA_VERSION="${ROOT_VER}-${VCS_REV}"
+    echo "Creating icedtea-${ICEDTEA_VERSION}";
+    mkdir icedtea-${ICEDTEA_VERSION}
+    echo "Copying required files from checkout to icedtea-${ICEDTEA_VERSION}";
+    # Commented out for now as IcedTea 6's jconsole.desktop.in is outdated
+    #cp -a icedtea/jconsole.desktop.in ../icedtea-${ICEDTEA_VERSION}
+    cp -a ${RPM_DIR}/jconsole.desktop.in icedtea-${ICEDTEA_VERSION}
+    cp -a icedtea/tapset icedtea-${ICEDTEA_VERSION}
+
+    rm -rf icedtea
+else
+    echo "Mode: Using tarball";
+
+    if test "x${ICEDTEA_VERSION}" = "x"; then
+	echo "No IcedTea version specified for tarball download.";
+	exit 3;
+    fi
+
+    if test "x${CHECKSUM}" = "x"; then
+	CHECKSUM=$(which sha256sum)
+	if test "x${CHECKSUM}" = "x"; then
+	    echo "sha256sum not found";
+	    exit 4;
+	fi
+    fi
+
+    if test "x${PGP}" = "x"; then
+	PGP=$(which gpg)
+	if test "x${PGP}" = "x"; then
+	    echo "gpg not found";
+	    exit 5;
+	fi
+    fi
+
+    echo "Dependencies:";
+    echo -e "\tCHECKSUM: ${CHECKSUM}";
+    echo -e "\tPGP: ${PGP}\n";
+
+    echo "Checking for IcedTea signing key ${ICEDTEA_SIGNING_KEY}...";
+    if ! gpg --list-keys ${ICEDTEA_SIGNING_KEY}; then
+	echo "IcedTea signing key ${ICEDTEA_SIGNING_KEY} not installed.";
+	exit 6;
+    fi
+
+    echo "Downloading IcedTea release tarball...";
+    ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz
+    echo "Downloading IcedTea tarball signature...";
+    ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz.sig
+    echo "Downloading IcedTea tarball checksums...";
+    ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.sha256
+
+    echo "Verifying checksums...";
+    ${CHECKSUM} --check --ignore-missing icedtea-${ICEDTEA_VERSION}.sha256
+
+    echo "Checking signature...";
+    ${PGP} --verify icedtea-${ICEDTEA_VERSION}.tar.xz.sig
+
+    echo "Extracting files...";
+    ${TAR} xJf icedtea-${ICEDTEA_VERSION}.tar.xz \
+       icedtea-${ICEDTEA_VERSION}/tapset \
+       icedtea-${ICEDTEA_VERSION}/jconsole.desktop.in
+
+    rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz
+    rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz.sig
+    rm -vf icedtea-${ICEDTEA_VERSION}.sha256
+fi
+
+echo "Replacing desktop files...";
+mv -v icedtea-${ICEDTEA_VERSION}/jconsole.desktop.in ${RPM_DIR}
+
+echo "Creating new tapset tarball...";
+mv -v icedtea-${ICEDTEA_VERSION} openjdk
+${TAR} cJf ${RPM_DIR}/tapsets-icedtea-${ICEDTEA_VERSION}.tar.xz openjdk
+
+rm -rvf openjdk
+
+popd
+rm -rf ${WORKDIR}

java-21-openjdk.spec

@@ -1,8 +1,3 @@
-# To rebuild this RPM, you must first rebuild the portable
-# RPM using the java-21-openjdk-portable.specfile, install
-# it and then adjust portablerelease and portablesuffix
-# to match the new portable.
-
 # RPM conditionals so as to be able to dynamically produce
 # slowdebug/release builds. See:
 # http://rpm.org/user_doc/conditional_builds.html
@@ -129,9 +124,9 @@
 # Set of architectures which support the serviceability agent
 %global sa_arches       %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} %{arm}
 # Set of architectures which support class data sharing
-# As of JDK-8005165 in OpenJDK 10, class sharing is not arch-specific
-# However, it does segfault on the Zero assembler port, so currently JIT only
-%global share_arches    %{jit_arches}
+# See https://bugzilla.redhat.com/show_bug.cgi?id=513605
+# MetaspaceShared::generate_vtable_methods is not implemented for the PPC JIT
+%global share_arches    %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{arm} s390x
 # Set of architectures for which we build the Shenandoah garbage collector
 %global shenandoah_arches x86_64 %{aarch64}
 # Set of architectures for which we build the Z garbage collector
@@ -143,11 +138,6 @@
 # Set of architectures where we verify backtraces with gdb
 %global gdb_arches %{jit_arches} %{zero_arches}
 
-# Define the OS the portable JDK is built on
-# This is undefined for openjdk-portable-rhel-8 builds and
-# equals 'rhel7' for openjdk-portable-rhel-7 builds
-%global pkgos rhel7
-
 # By default, we build a debug build during main build on JIT architectures
 %if %{with slowdebug}
 %ifarch %{debug_arches}
@@ -236,6 +226,12 @@
 %global ourcppflags %(echo %ourflags | sed -e 's|-fexceptions||')
 %global ourldflags %{__global_ldflags}
 
+# With disabled nss is NSS deactivated, so NSS_LIBDIR can contain the wrong path
+# the initialization must be here. Later the pkg-config have buggy behavior
+# looks like openjdk RPM specific bug
+# Always set this so the nss.cfg file is not broken
+%global NSS_LIBDIR %(pkg-config --variable=libdir nss)
+
 # In some cases, the arch used by the JDK does
 # not match _arch.
 # Also, in some cases, the machine name used by SystemTap
@@ -303,9 +299,10 @@
 %endif
 
 # New Version-String scheme-style defines
-%global featurever 21
+%global featurever 20
+%global fakefeaturever 21
 %global interimver 0
-%global updatever 3
+%global updatever 2
 %global patchver 0
 # We don't add any LTS designator for STS packages (Fedora and EPEL).
 # We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined.
@@ -313,8 +310,8 @@
   %global lts_designator "LTS"
   %global lts_designator_zip -%{lts_designator}
 %else
-  %global lts_designator ""
-  %global lts_designator_zip ""
+ %global lts_designator ""
+ %global lts_designator_zip ""
 %endif
 
 # Define vendor information used by OpenJDK
@@ -330,7 +327,7 @@
 %global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=%{name}&version=%{fedora}
 %else
 %if 0%{?rhel}
-%global oj_vendor_bug_url https://access.redhat.com/support/cases/
+%global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi?product=Red%20Hat%20Enterprise%20Linux%20%{rhel}&component=%{name}
 %else
 %global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi
 %endif
@@ -341,25 +338,18 @@
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      6.0.0pre00-c848b93a8598
 # Define current Git revision for the FIPS support patches
-%global fipsver 0a42e29b391
-# Define JDK versions
-%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
-%global javaver         %{featurever}
-# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames
-%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn})
-# The tag used to create the OpenJDK tarball
-%global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}
+%global fipsver fd3de3d95b5
 
 # Standard JPackage naming and versioning defines
 %global origin          openjdk
 %global origin_nice     OpenJDK
-%global top_level_dir_name   %{vcstag}
+%global top_level_dir_name   %{origin}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
 %global buildver        9
 %global rpmrelease      1
 # Settings used by the portable build
 %global portablerelease 1
-%global portablesuffix %{?pkgos:el7_9}%{!?pkgos:el8}
+%global portablesuffix el9
 %global portablebuilddir /builddir/build/BUILD
 
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
@@ -374,6 +364,15 @@
 # for techpreview, using 1, so slowdebugs can have 0
 %global priority %( printf '%08d' 1 )
 %endif
+%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
+# Force 21 until we are actually ready to build that JDK version
+%global javaver         %{fakefeaturever}
+
+# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames
+%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn})
+
+# The tag used to create the OpenJDK tarball
+%global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}
 
 # Define milestone (EA for pre-releases, GA for releases)
 # Release will be (where N is usually a number starting at 1):
@@ -383,7 +382,7 @@
 %if %{is_ga}
 %global build_type GA
 %global ea_designator ""
-%global ea_designator_zip %{nil}
+%global ea_designator_zip ""
 %global extraver %{nil}
 %global eaprefix %{nil}
 %else
@@ -395,13 +394,13 @@
 %endif
 
 # parametrized macros are order-sensitive
-%global compatiblename  java-%{featurever}-%{origin}
+%global compatiblename  java-%{fakefeaturever}-%{origin}
 %global fullversion     %{compatiblename}-%{version}-%{release}
 # images directories from upstream build
 %global jdkimage                jdk
 %global static_libs_image       static-libs
 # output dir stub
-%define installoutputdir() %{expand:install/jdk%{featurever}.install%{?1}}
+%define installoutputdir() %{expand:install/jdk%{fakefeaturever}.install%{?1}}
 # we can copy the javadoc to not arched dir, or make it not noarch
 %define uniquejavadocdir()    %{expand:%{fullversion}.%{_arch}%{?1}}
 # main id and dir of this jdk
@@ -411,7 +410,7 @@
 # fix for https://bugzilla.redhat.com/show_bug.cgi?id=1111349
 #         https://bugzilla.redhat.com/show_bug.cgi?id=1590796#c14
 #         https://bugzilla.redhat.com/show_bug.cgi?id=1655938
-%global _privatelibs libsplashscreen[.]so.*|libawt_xawt[.]so.*|libjli[.]so.*|libattach[.]so.*|libawt[.]so.*|libextnet[.]so.*|libawt_headless[.]so.*|libdt_socket[.]so.*|libfontmanager[.]so.*|libinstrument[.]so.*|libj2gss[.]so.*|libj2pcsc[.]so.*|libj2pkcs11[.]so.*|libjaas[.]so.*|libjavajpeg[.]so.*|libjdwp[.]so.*|libjimage[.]so.*|libjsound[.]so.*|liblcms[.]so.*|lible[.]so.*|libmanagement[.]so.*|libmanagement_agent[.]so.*|libmanagement_ext[.]so.*|libmlib_image[.]so.*|libnet[.]so.*|libnio[.]so.*|libprefs[.]so.*|librmi[.]so.*|libsaproc[.]so.*|libsctp[.]so.*|libsystemconf[.]so.*|libzip[.]so.*%{freetype_lib}
+%global _privatelibs libsplashscreen[.]so.*|libawt_xawt[.]so.*|libjli[.]so.*|libattach[.]so.*|libawt[.]so.*|libextnet[.]so.*|libawt_headless[.]so.*|libdt_socket[.]so.*|libfontmanager[.]so.*|libinstrument[.]so.*|libj2gss[.]so.*|libj2pcsc[.]so.*|libj2pkcs11[.]so.*|libjaas[.]so.*|libjavajpeg[.]so.*|libjdwp[.]so.*|libjimage[.]so.*|libjsound[.]so.*|liblcms[.]so.*|libmanagement[.]so.*|libmanagement_agent[.]so.*|libmanagement_ext[.]so.*|libmlib_image[.]so.*|libnet[.]so.*|libnio[.]so.*|libprefs[.]so.*|librmi[.]so.*|libsaproc[.]so.*|libsctp[.]so.*|libsystemconf[.]so.*|libzip[.]so.*%{freetype_lib}
 %global _publiclibs libjawt[.]so.*|libjava[.]so.*|libjvm[.]so.*|libverify[.]so.*|libjsig[.]so.*
 %if %is_system_jdk
 %global __provides_exclude ^(%{_privatelibs})$
@@ -541,15 +540,12 @@ alternatives \\
   --install %{_bindir}/java $key %{jrebindir -- %{?1}}/java $PRIORITY  --family %{family} \\
   --slave %{_jvmdir}/jre jre %{_jvmdir}/%{sdkdir -- %{?1}} \\
   --slave %{_bindir}/%{alt_java_name} %{alt_java_name} %{jrebindir -- %{?1}}/%{alt_java_name} \\
-  --slave %{_bindir}/jcmd jcmd %{sdkbindir -- %{?1}}/jcmd \\
   --slave %{_bindir}/keytool keytool %{jrebindir -- %{?1}}/keytool \\
   --slave %{_bindir}/rmiregistry rmiregistry %{jrebindir -- %{?1}}/rmiregistry \\
   --slave %{_mandir}/man1/java.1$ext java.1$ext \\
   %{_mandir}/man1/java-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/%{alt_java_name}.1$ext %{alt_java_name}.1$ext \\
   %{_mandir}/man1/%{alt_java_name}-%{uniquesuffix -- %{?1}}.1$ext \\
-  --slave %{_mandir}/man1/jcmd.1$ext jcmd.1$ext \\
-  %{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/keytool.1$ext keytool.1$ext \\
   %{_mandir}/man1/keytool-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/rmiregistry.1$ext rmiregistry.1$ext \\
@@ -569,6 +565,10 @@ alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} $key %{_jvmdir}/%{jre
 }
 
 %define post_headless() %{expand:
+%ifarch %{share_arches}
+%{jrebindir -- %{?1}}/java -Xshare:dump >/dev/null 2>/dev/null
+%endif
+
 update-desktop-database %{_datadir}/applications &> /dev/null || :
 /bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || :
 
@@ -634,6 +634,7 @@ alternatives \\
   --slave %{_bindir}/jarsigner jarsigner %{sdkbindir -- %{?1}}/jarsigner \\
   --slave %{_bindir}/javadoc javadoc %{sdkbindir -- %{?1}}/javadoc \\
   --slave %{_bindir}/javap javap %{sdkbindir -- %{?1}}/javap \\
+  --slave %{_bindir}/jcmd jcmd %{sdkbindir -- %{?1}}/jcmd \\
   --slave %{_bindir}/jconsole jconsole %{sdkbindir -- %{?1}}/jconsole \\
   --slave %{_bindir}/jdb jdb %{sdkbindir -- %{?1}}/jdb \\
   --slave %{_bindir}/jdeps jdeps %{sdkbindir -- %{?1}}/jdeps \\
@@ -661,6 +662,8 @@ alternatives \\
   %{_mandir}/man1/javadoc-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/javap.1$ext javap.1$ext \\
   %{_mandir}/man1/javap-%{uniquesuffix -- %{?1}}.1$ext \\
+  --slave %{_mandir}/man1/jcmd.1$ext jcmd.1$ext \\
+  %{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/jconsole.1$ext jconsole.1$ext \\
   %{_mandir}/man1/jconsole-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/jdb.1$ext jdb.1$ext \\
@@ -817,7 +820,7 @@ exit 0
 %license %{_jvmdir}/%{sdkdir -- %{?1}}/legal
 %doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/NEWS
 %doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/README.md
-%doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/java-%{featurever}-openjdk-portable.specfile
+%doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/java-%{fakefeaturever}-openjdk-portable.specfile
 %dir %{_sysconfdir}/.java/.systemPrefs
 %dir %{_sysconfdir}/.java
 %dir %{_jvmdir}/%{sdkdir -- %{?1}}
@@ -826,7 +829,6 @@ exit 0
 %dir %{_jvmdir}/%{sdkdir -- %{?1}}/bin
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/java
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/%{alt_java_name}
-%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jcmd
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/keytool
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/rmiregistry
 %dir %{_jvmdir}/%{sdkdir -- %{?1}}/lib
@@ -863,7 +865,6 @@ exit 0
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjimage.so
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjsound.so
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/liblcms.so
-%{_jvmdir}/%{sdkdir -- %{?1}}/lib/lible.so
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/libmanagement.so
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/libmanagement_agent.so
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/libmanagement_ext.so
@@ -891,15 +892,11 @@ exit 0
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/jfr/profile.jfc
 %{_mandir}/man1/java-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/%{alt_java_name}-%{uniquesuffix -- %{?1}}.1*
-%{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/keytool-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/rmiregistry-%{uniquesuffix -- %{?1}}.1*
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/%{vm_variant}/
 %ifarch %{share_arches}
-%attr(444, root, root) %{_jvmdir}/%{sdkdir -- %{?1}}/lib/%{vm_variant}/classes.jsa
-%ifnarch %{ix86} %{arm32}
-%attr(444, root, root) %{_jvmdir}/%{sdkdir -- %{?1}}/lib/%{vm_variant}/classes_nocoops.jsa
-%endif
+%attr(444, root, root) %ghost %{_jvmdir}/%{sdkdir -- %{?1}}/lib/%{vm_variant}/classes.jsa
 %endif
 %dir %{etcjavasubdir}
 %dir %{etcjavadir -- %{?1}}
@@ -924,14 +921,14 @@ exit 0
  %{etcjavadir -- %{?1}}/conf/security/policy/README.txt
 %config(noreplace) %{etcjavadir -- %{?1}}/conf/security/java.policy
 %config(noreplace) %{etcjavadir -- %{?1}}/conf/security/java.security
+%config(noreplace) %{etcjavadir -- %{?1}}/conf/logging.properties
+%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/nss.cfg
 %config(noreplace) %{etcjavadir -- %{?1}}/conf/security/nss.fips.cfg
 %config(noreplace) %{etcjavadir -- %{?1}}/conf/management/jmxremote.access
 # This is a config template, thus not config-noreplace
 %config  %{etcjavadir -- %{?1}}/conf/management/jmxremote.password.template
 %config  %{etcjavadir -- %{?1}}/conf/sdp/sdp.conf.template
 %config(noreplace) %{etcjavadir -- %{?1}}/conf/management/management.properties
-%config(noreplace) %{etcjavadir -- %{?1}}/conf/jaxp.properties
-%config(noreplace) %{etcjavadir -- %{?1}}/conf/logging.properties
 %config(noreplace) %{etcjavadir -- %{?1}}/conf/net.properties
 %config(noreplace) %{etcjavadir -- %{?1}}/conf/sound.properties
 %{_jvmdir}/%{sdkdir -- %{?1}}/conf
@@ -939,11 +936,13 @@ exit 0
 %if %is_system_jdk
 %if %{is_release_build -- %{?1}}
 %ghost %{_bindir}/java
-%ghost %{_jvmdir}/jre
 %ghost %{_bindir}/%{alt_java_name}
-%ghost %{_bindir}/jcmd
+%ghost %{_jvmdir}/jre
 %ghost %{_bindir}/keytool
+%ghost %{_bindir}/pack200
+%ghost %{_bindir}/rmid
 %ghost %{_bindir}/rmiregistry
+%ghost %{_bindir}/unpack200
 %ghost %{_jvmdir}/jre-%{origin}
 %ghost %{_jvmdir}/jre-%{javaver}
 %ghost %{_jvmdir}/jre-%{javaver}-%{origin}
@@ -963,6 +962,7 @@ exit 0
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/javadoc
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/javap
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jconsole
+%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jcmd
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jdb
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jdeps
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jdeprscan
@@ -1000,6 +1000,7 @@ exit 0
 %{_mandir}/man1/javadoc-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/javap-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jconsole-%{uniquesuffix -- %{?1}}.1*
+%{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jdb-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jdeprscan-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jdeps-%{uniquesuffix -- %{?1}}.1*
@@ -1028,6 +1029,7 @@ exit 0
 %if %{is_release_build -- %{?1}}
 %ghost %{_bindir}/javac
 %ghost %{_jvmdir}/java
+%ghost %{_jvmdir}/%{alt_java_name}
 %ghost %{_bindir}/jlink
 %ghost %{_bindir}/jmod
 %ghost %{_bindir}/jhsdb
@@ -1035,22 +1037,20 @@ exit 0
 %ghost %{_bindir}/jarsigner
 %ghost %{_bindir}/javadoc
 %ghost %{_bindir}/javap
+%ghost %{_bindir}/jcmd
 %ghost %{_bindir}/jconsole
 %ghost %{_bindir}/jdb
 %ghost %{_bindir}/jdeps
 %ghost %{_bindir}/jdeprscan
-%ghost %{_bindir}/jfr
 %ghost %{_bindir}/jimage
 %ghost %{_bindir}/jinfo
 %ghost %{_bindir}/jmap
 %ghost %{_bindir}/jps
-%ghost %{_bindir}/jpackage
 %ghost %{_bindir}/jrunscript
 %ghost %{_bindir}/jshell
 %ghost %{_bindir}/jstack
 %ghost %{_bindir}/jstat
 %ghost %{_bindir}/jstatd
-%ghost %{_bindir}/jwebserver
 %ghost %{_bindir}/serialver
 %ghost %{_jvmdir}/java-%{origin}
 %ghost %{_jvmdir}/java-%{javaver}
@@ -1145,9 +1145,8 @@ Requires: ca-certificates
 # Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros
 Requires: javapackages-filesystem
 # Require zone-info data provided by tzdata-java sub-package
-# 2024a required as of JDK-8325150
-# Use 2023d until 2024a is in the buildroot
-Requires: tzdata-java >= 2023d
+# 2022g required as of JDK-8297804
+Requires: tzdata-java >= 2022g
 # for support of kernel stream control
 # libsctp.so.1 is being `dlopen`ed on demand
 Requires: lksctp-tools%{?_isa}
@@ -1268,14 +1267,10 @@ Provides: java-%{origin}-src%{?1} = %{epoch}:%{version}-%{release}
 
 # Prevent brp-java-repack-jars from being run
 %global __jar_repack 0
-# Define the root name of the portable packages
-%global pkgnameroot java-%{featurever}-%{origin}-portable%{?pkgos:-%{pkgos}}
 
 Name:    java-%{javaver}-%{origin}
 Version: %{newjavaver}.%{buildver}
 Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
-# Equivalent for the portable build
-%global prelease %{?eaprefix}%{portablerelease}%{?extraver}
 # java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons
 # and this change was brought into RHEL-4. java-1.5.0-ibm packages
 # also included the epoch in their virtual provides. This created a
@@ -1310,8 +1305,9 @@ Group:   Development/Languages
 License:  ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA
 URL:      http://openjdk.java.net/
 
+
 # The source tarball, generated using generate_source_tarball.sh
-Source0: https://openjdk-sources.osci.io/openjdk%{featurever}/open%{vcstag}%{ea_designator_zip}.tar.xz
+Source0: openjdk-jdk%{featurever}u-%{vcstag}.tar.xz
 
 # Use 'icedtea_sync.sh' to update the following
 # They are based on code contained in the IcedTea project (6.x).
@@ -1321,8 +1317,8 @@ Source8: tapsets-icedtea-%{icedteaver}.tar.xz
 # Desktop files. Adapted from IcedTea
 Source9: jconsole.desktop.in
 
-# Source code for alt-java
-Source11: alt-java.c
+# nss configuration file
+Source11: nss.cfg.in
 
 # Removed libraries that we link instead
 Source12: remove-intree-libraries.sh
@@ -1344,17 +1340,17 @@ Source18: TestTranslations.java
 
 # Include portable spec and instructions on how to rebuild
 Source19: README.md
-Source20: java-%{featurever}-openjdk-portable.specfile
+Source20: java-%{fakefeaturever}-openjdk-portable.specfile
 
 # Setup variables to reference correct sources
-%global releasezip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.unstripped.jdk.%{_arch}.tar.xz
-%global staticlibzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.static-libs.%{_arch}.tar.xz
-%global docszip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.docs.%{_arch}.tar.xz
-%global misczip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.misc.%{_arch}.tar.xz
-%global slowdebugzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.slowdebug.jdk.%{_arch}.tar.xz
-%global slowdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.slowdebug.static-libs.%{_arch}.tar.xz
-%global fastdebugzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.fastdebug.jdk.%{_arch}.tar.xz
-%global fastdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.fastdebug.static-libs.%{_arch}.tar.xz
+%global releasezip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.unstripped.jdk.%{_arch}.tar.xz
+%global staticlibzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.static-libs.%{_arch}.tar.xz
+%global docszip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.docs.%{_arch}.tar.xz
+%global misczip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.misc.%{_arch}.tar.xz
+%global slowdebugzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.slowdebug.jdk.%{_arch}.tar.xz
+%global slowdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.slowdebug.static-libs.%{_arch}.tar.xz
+%global fastdebugzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.fastdebug.jdk.%{_arch}.tar.xz
+%global fastdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.fastdebug.static-libs.%{_arch}.tar.xz
 
 ############################################
 #
@@ -1362,9 +1358,23 @@ Source20: java-%{featurever}-openjdk-portable.specfile
 #
 ############################################
 
+# NSS via SunPKCS11 Provider (disabled comment
+# due to memory leak).
+Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
+# RH1750419: enable build of speculative store bypass hardened alt-java (CVE-2018-3639)
+Patch600: rh1750419-redhat_alt_java.patch
+
+# Ignore AWTError when assistive technologies are loaded
+Patch1:    rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
+# Restrict access to java-atk-wrapper classes
+Patch2:    rh1648644-java_access_bridge_privileged_security.patch
+Patch3:    rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
+# Depend on pcsc-lite-libs instead of pcsc-lite-devel as this is only in optional repo
+Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
+
 # Crypto policy and FIPS support patches
-# Patch is generated from the fips-21u tree at https://github.com/rh-openjdk/jdk/tree/fips-21u
-# as follows: git diff %%{vcstag} src make test > fips-21u-$(git show -s --format=%h HEAD).patch
+# Patch is generated from the fips-20u tree at https://github.com/rh-openjdk/jdk/tree/fips-20u
+# as follows: git diff %%{vcstag} src make test > fips-20u-$(git show -s --format=%h HEAD).patch
 # Diff is limited to src and make subdirectories to exclude .github changes
 # Fixes currently included:
 # PR3183, RH1340845: Follow system wide crypto policy
@@ -1388,7 +1398,7 @@ Source20: java-%{featurever}-openjdk-portable.specfile
 # RH2104724: Avoid import/export of DH private keys
 # RH2092507: P11Key.getEncoded does not work for DH keys in FIPS mode
 # Build the systemconf library on all platforms
-# RH2048582: Support PKCS#12 keystores [now part of JDK-8301553 upstream]
+# RH2048582: Support PKCS#12 keystores
 # RH2020290: Support TLS 1.3 in FIPS mode
 # Add nss.fips.cfg support to OpenJDK tree
 # RH2117972: Extend the support for NSS DBs (PKCS11) in FIPS mode
@@ -1397,8 +1407,8 @@ Source20: java-%{featurever}-openjdk-portable.specfile
 # RH2134669: Add missing attributes when registering services in FIPS mode.
 # test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
 # RH1940064: Enable XML Signature provider in FIPS mode
-# RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized [now part of JDK-8301553 upstream]
-Patch1001: fips-%{featurever}u-%{fipsver}.patch
+# RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized
+Patch1001: fips-20u-%{fipsver}.patch
 
 #############################################
 #
@@ -1414,6 +1424,8 @@ Patch1001: fips-%{featurever}u-%{fipsver}.patch
 #
 #############################################
 
+# Currently empty
+
 #############################################
 #
 # Portable build specific patches
@@ -1441,7 +1453,7 @@ BuildRequires: libXrandr-devel
 BuildRequires: libXrender-devel
 BuildRequires: libXt-devel
 BuildRequires: libXtst-devel
-# Requirement for setting up nss.fips.cfg
+# Requirement for setting up nss.cfg and nss.fips.cfg
 BuildRequires: nss-devel
 # Requirement for system security property test
 BuildRequires: crypto-policies
@@ -1450,26 +1462,25 @@ BuildRequires: xorg-x11-proto-devel
 BuildRequires: zip
 BuildRequires: javapackages-filesystem
 %if %{include_normal_build}
-BuildRequires: %{pkgnameroot}-unstripped = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
-BuildRequires: %{pkgnameroot}-static-libs = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
+BuildRequires: java-%{fakefeaturever}-openjdk-portable-unstripped = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: java-%{fakefeaturever}-openjdk-portable-static-libs = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
 %endif
 %if %{include_fastdebug_build}
-BuildRequires: %{pkgnameroot}-devel-fastdebug = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
-BuildRequires: %{pkgnameroot}-static-libs-fastdebug = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
+BuildRequires: java-%{fakefeaturever}-openjdk-portable-devel-fastdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: java-%{fakefeaturever}-openjdk-portable-static-libs-fastdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
 %endif
 %if %{include_debug_build}
-BuildRequires: %{pkgnameroot}-devel-slowdebug = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
-BuildRequires: %{pkgnameroot}-static-libs-slowdebug = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
+BuildRequires: java-%{fakefeaturever}-openjdk-portable-devel-slowdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: java-%{fakefeaturever}-openjdk-portable-static-libs-slowdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
 %endif
-BuildRequires: %{pkgnameroot}-docs = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
-BuildRequires: %{pkgnameroot}-misc = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
+BuildRequires: java-%{fakefeaturever}-openjdk-portable-docs = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: java-%{fakefeaturever}-openjdk-portable-misc = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
 # Zero-assembler build requirement
 %ifarch %{zero_arches}
 BuildRequires: libffi-devel
 %endif
-# 2024a required as of JDK-8325150
-# Use 2023d until 2024a is in the buildroot
-BuildRequires: tzdata-java >= 2023d
+# 2023c required as of JDK-8305113
+BuildRequires: tzdata-java >= 2023c
 # Earlier versions have a bug in tree vectorization on PPC
 BuildRequires: gcc >= 4.8.3-8
 
@@ -1486,18 +1497,18 @@ BuildRequires: lcms2-devel
 BuildRequires: libjpeg-devel
 BuildRequires: libpng-devel
 %else
-# Version in src/java.desktop/share/legal/freetype.md
-Provides: bundled(freetype) = 2.13.2
+# Version in src/java.desktop/share/native/libfreetype/include/freetype/freetype.h
+Provides: bundled(freetype) = 2.12.1
 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
 Provides: bundled(giflib) = 5.2.1
 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h
-Provides: bundled(harfbuzz) = 8.2.2
+Provides: bundled(harfbuzz) = 4.4.1
 # Version in src/java.desktop/share/native/liblcms/lcms2.h
-Provides: bundled(lcms2) = 2.15.0
+Provides: bundled(lcms2) = 2.12.0
 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h
 Provides: bundled(libjpeg) = 6b
 # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h
-Provides: bundled(libpng) = 1.6.40
+Provides: bundled(libpng) = 1.6.37
 %endif
 
 # this is always built, also during debug-only build
@@ -1841,7 +1852,6 @@ if [ %{include_debug_build} -eq 0 -a  %{include_normal_build} -eq 0 -a  %{includ
   exit 14
 fi
 
-export XZ_OPT="-T0"
 %setup -q -c -n %{uniquesuffix ""} -T -a 0
 # https://bugzilla.redhat.com/show_bug.cgi?id=1189084
 prioritylength=`expr length %{priority}`
@@ -1858,24 +1868,18 @@ sh %{SOURCE12} %{top_level_dir_name}
 %endif
 
 # Patch the JDK
-# This syntax is deprecated:
-#    %patchN [...]
-# and should be replaced with:
-#    %patch -PN [...]
-# For example:
-#    %patch1001 -p1
-# becomes:
-#    %patch -P1001 -p1
-# The replacement format suggested by recent (circa Fedora 38) RPM
-# deprecation messages:
-#    %patch N [...]
-# is not backward-compatible with prior (circa RHEL-8) versions of
-# rpmbuild.
 pushd %{top_level_dir_name}
+%patch1 -p1
+%patch2 -p1
+%patch3 -p1
+%patch6 -p1
 # Add crypto policy and FIPS support
-%patch -P1001 -p1
+%patch1001 -p1
+# nss.cfg PKCS11 support; must come last as it also alters java.security
+%patch1000 -p1
 popd # openjdk
 
+%patch600
 
 # The OpenJDK version file includes the current
 # upstream version information. For some reason,
@@ -1897,6 +1901,35 @@ if [ "x${UPSTREAM_EA_DESIGNATOR}" != "x%{ea_designator}" ] ; then
     exit 17
 fi
 
+# Extract systemtap tapsets
+%if %{with_systemtap}
+tar --strip-components=1 -x -I xz -f %{SOURCE8}
+%if %{include_debug_build}
+cp -r tapset tapset%{debug_suffix}
+%endif
+%if %{include_fastdebug_build}
+cp -r tapset tapset%{fastdebug_suffix}
+%endif
+
+for suffix in %{build_loop} ; do
+  for file in "tapset"$suffix/*.in; do
+    OUTPUT_FILE=`echo $file | sed -e "s:\.stp\.in$:-%{version}-%{release}.%{_arch}.stp:g"`
+    sed -e "s:@ABS_SERVER_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/%{vm_variant}/libjvm.so:g" $file > $file.1
+    sed -e "s:@JAVA_SPEC_VER@:%{javaver}:g" $file.1 > $file.2
+# TODO find out which architectures other than i686 have a client vm
+%ifarch %{ix86}
+    sed -e "s:@ABS_CLIENT_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/client/libjvm.so:g" $file.2 > $OUTPUT_FILE
+%else
+    sed -e "/@ABS_CLIENT_LIBJVM_SO@/d" $file.2 > $OUTPUT_FILE
+%endif
+    sed -i -e "s:@ABS_JAVA_HOME_DIR@:%{_jvmdir}/%{sdkdir -- $suffix}:g" $OUTPUT_FILE
+    sed -i -e "s:@INSTALL_ARCH_DIR@:%{archinstall}:g" $OUTPUT_FILE
+    sed -i -e "s:@prefix@:%{_jvmdir}/%{sdkdir -- $suffix}/:g" $OUTPUT_FILE
+  done
+done
+# systemtap tapsets ends
+%endif
+
 # Prepare desktop files
 # The _X_ syntax indicates variables that are replaced by make upstream
 # The @X@ syntax indicates variables that are replaced by configure upstream
@@ -1914,6 +1947,9 @@ for file in %{SOURCE9}; do
 done
 done
 
+# Setup nss.cfg
+sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE11} > nss.cfg
+
 %build
 
 function customisejdk() {
@@ -1927,21 +1963,15 @@ function customisejdk() {
         # Use system-wide tzdata
         rm ${imagepath}/lib/tzdb.dat
         ln -s %{_datadir}/javazi-1.8/tzdb.dat ${imagepath}/lib/tzdb.dat
+
+	# Add temporary empty nss.fips.cfg until full FIPS patches are restored
+%if %{fakefeaturever} > %{featurever}
+        touch ${imagepath}/conf/security/nss.fips.cfg
+%endif
+
     fi
 }
 
-export XZ_OPT="-T0"
-
-mkdir -p $(dirname %{installoutputdir})
-
-docdir=%{installoutputdir -- "-docs"}
-tar -xJf %{docszip}
-mv java-%{featurever}-openjdk*.docs.* ${docdir}
-
-miscdir=%{installoutputdir -- "-misc"}
-tar -xJf %{misczip}
-mv java-%{featurever}-openjdk*.misc.* ${miscdir}
-
 for suffix in %{build_loop} ; do
 
   if [ "x$suffix" = "x" ] ; then
@@ -1960,32 +1990,17 @@ for suffix in %{build_loop} ; do
   # TODO: should verify checksums when using packages from buildroot
   tar -xJf ${jdkzip}
   tar -xJf ${staticlibzip}
-  mv java-%{featurever}-openjdk* ${installdir}
+  mkdir -p $(dirname ${installdir})
+  mv java-%{fakefeaturever}-openjdk* ${installdir}
 
   # Fix build paths in ELF files so it looks like we built them
-  portablenvr="%{name}-%{VERSION}-%{prelease}.%{portablesuffix}.%{_arch}"
+  portablenvr="%{name}-%{VERSION}-%{portablerelease}.%{portablesuffix}.%{_arch}"
   for file in $(find ${installdir} -type f) ; do
       if file ${file} | grep -q 'ELF'; then
-          %{debugedit} -b %{portablebuilddir}/${portablenvr} -d $(pwd) -n ${file}
+	  %{debugedit} -b %{portablebuilddir}/${portablenvr} -d $(pwd) -n ${file}
       fi
   done
 
-  # Set tapset variables to match this build
-%if %{with_systemtap}
-  for file in ${miscdir}/tapset${suffix}/*.in; do
-    OUTPUT_FILE=`echo $file | sed -e "s:\.stp\.in$:-%{version}-%{release}.%{_arch}.stp:g"`
-    sed -e "s:@ABS_SERVER_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/%{vm_variant}/libjvm.so:g" $file > ${OUTPUT_FILE}
-# TODO find out which architectures other than i686 have a client vm
-%ifarch %{ix86}
-    sed -i -e "s:@ABS_CLIENT_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/client/libjvm.so:g" ${OUTPUT_FILE}
-%else
-    sed -i -e "/@ABS_CLIENT_LIBJVM_SO@/d" ${OUTPUT_FILE}
-%endif
-    sed -i -e "s:@ABS_JAVA_HOME_DIR@:%{_jvmdir}/%{sdkdir -- $suffix}:g" $OUTPUT_FILE
-    sed -i -e "s:@prefix@:%{_jvmdir}/%{sdkdir -- $suffix}/:g" $OUTPUT_FILE
-  done
-%endif
-
   # Final setup on the main image
   customisejdk ${installdir}
 
@@ -1995,6 +2010,14 @@ for suffix in %{build_loop} ; do
 # build cycles
 done # end of release / debug cycle loop
 
+docdir=%{installoutputdir -- "-docs"}
+tar -xJf %{docszip}
+mv java-%{fakefeaturever}-openjdk*.docs.* ${docdir}
+
+miscdir=%{installoutputdir -- "-misc"}
+tar -xJf %{misczip}
+mv java-%{fakefeaturever}-openjdk*.misc.* ${miscdir}
+
 %check
 
 # We test debug first as it will give better diagnostics on a crash
@@ -2030,12 +2053,10 @@ $JAVA_HOME/bin/java ${SEC_DEBUG} -Djava.security.disableSystemPropertiesFile=tru
 if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi
 
 # Check alt-java launcher has SSB mitigation on supported architectures
-# set_speculation function exists in both cases, so check for prctl call
-alt_java_binary=$RPM_BUILD_ROOT%{jrebindir -- $suffix}/%{alt_java_name}
 %ifarch %{ssbd_arches}
-nm ${alt_java_binary} | grep prctl
+nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation
 %else
-if ! nm ${alt_java_binary} | grep prctl ; then true ; else false; fi
+if ! nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation ; then true ; else false; fi
 %endif
 
 %if ! 0%{?flatpak}
@@ -2043,16 +2064,18 @@ if ! nm ${alt_java_binary} | grep prctl ; then true ; else false; fi
 # tzdb.dat used by this test is not where the test expects it, so this is
 # disabled for flatpak builds)
 # Disable test until we are on the latest JDK
+%if %{fakefeaturever} == %{featurever}
 $JAVA_HOME/bin/javac -d . %{SOURCE18}
 $JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE
 $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR
 %endif
+%endif
 
 %if %{include_staticlibs}
 # Check debug symbols in static libraries (smoke test)
 export STATIC_LIBS_HOME=${JAVA_HOME}/lib/static/linux-%{archinstall}/glibc
-readelf --debug-dump $STATIC_LIBS_HOME/libnet.a | grep Inet4AddressImpl.c
-readelf --debug-dump $STATIC_LIBS_HOME/libnet.a | grep Inet6AddressImpl.c
+readelf --debug-dump $STATIC_LIBS_HOME/libfdlibm.a | grep w_remainder.c
+readelf --debug-dump $STATIC_LIBS_HOME/libfdlibm.a | grep e_remainder.c
 %endif
 
 so_suffix="so"
@@ -2146,7 +2169,7 @@ for suffix in %{build_loop} ; do
 jdk_image=$(pwd)/%{installoutputdir -- ${suffix}}
 # Should match same definitions in build section
 docdir=$(pwd)/%{installoutputdir -- "-docs"}
-miscdir=$(pwd)/%{installoutputdir -- "-misc"}
+miscdir=%{installoutputdir -- "-misc"}
 
 # Install release notes and rebuild instructions
 commondocdir=${RPM_BUILD_ROOT}%{_defaultdocdir}/%{uniquejavadocdir -- $suffix}
@@ -2157,13 +2180,14 @@ cp -a %{SOURCE19} %{SOURCE20} ${commondocdir}
 # Install the jdk
 mkdir -p $RPM_BUILD_ROOT%{_jvmdir}
 cp -a ${jdk_image} $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}
-# Install %{alt_java_name} binary
-install -D -p -m 755 ${miscdir}/%{alt_java_name} $RPM_BUILD_ROOT%{jrebindir -- $suffix}
+
+pushd ${jdk_image}
 
 %if %{with_systemtap}
   # Install systemtap support files
   install -dm 755 $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset
-  cp -a ${miscdir}/tapset$suffix/*.stp $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset/
+  # note, that uniquesuffix  is in BUILD dir in this case
+  cp -a $RPM_BUILD_DIR/%{uniquesuffix ""}/tapset$suffix/*.stp $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset/
   pushd  $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset/
    tapsetFiles=`ls *.stp`
   popd
@@ -2186,11 +2210,8 @@ install -D -p -m 755 ${miscdir}/%{alt_java_name} $RPM_BUILD_ROOT%{jrebindir -- $
     ln -sf %{sdkdir -- $suffix} %{jrelnk -- $suffix}
   popd
 
-  # Copy alt-java man page into image so it gets installed with the others
-  cp -a ${miscdir}/%{alt_java_name}.1 ${jdk_image}/man/man1
   # Install man pages
   install -d -m 755 $RPM_BUILD_ROOT%{_mandir}/man1
-  pushd ${jdk_image}
   for manpage in man/man1/*
   do
     # Convert man pages to UTF8 encoding
@@ -2201,7 +2222,8 @@ install -D -p -m 755 ${miscdir}/%{alt_java_name} $RPM_BUILD_ROOT%{jrebindir -- $
   done
   # Remove man pages from jdk image
   rm -rf $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/man
-  popd
+
+popd
 
 if ! echo $suffix | grep -q "debug" ; then
     # Install Javadoc documentation
@@ -2497,184 +2519,18 @@ cjc.mainProgram(args)
 %endif
 
 %changelog
-* Sun Apr 14 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.9-1
-- Update to jdk-21.0.3+9 (GA)
-- Update release notes to 21.0.3+9
-- Switch to GA mode.
-- Sync the copy of the portable specfile with the latest update
-- ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
-- Resolves: RHEL-32423
-
-* Sun Apr 14 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.7-0.1.ea
-- Update to jdk-21.0.3+7 (EA)
-- Update release notes to 21.0.3+7
-- Require tzdata 2024a due to upstream inclusion of JDK-8322725
-- Only require tzdata 2023d for now as 2024a is unavailable in buildroot
-- Drop JDK-8009550 which is now available upstream
-- Re-generate FIPS patch against 21.0.3+7 following backport of JDK-8325254
-- Resolves: RHEL-30945
-
-* Sun Apr 14 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.1-0.2.ea
-- Invoke xz in multi-threaded mode
-- generate_source_tarball.sh: Add WITH_TEMP environment variable
-- generate_source_tarball.sh: Multithread xz on all available cores
-- generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
-- generate_source_tarball.sh: Update comment about tarball naming
-- generate_source_tarball.sh: Reformat comment header
-- generate_source_tarball.sh: Reformat and update help output
-- generate_source_tarball.sh: Do a shallow clone, for speed
-- generate_source_tarball.sh: Append -ea designator when required
-- generate_source_tarball.sh: Eliminate some removal prompting
-- generate_source_tarball.sh: Make tarball reproducible
-- generate_source_tarball.sh: Prefix temporary directory with temp-
-- generate_source_tarball.sh: Remove temporary directory exit conditions
-- generate_source_tarball.sh: Fix -ea logic to add dash
-- generate_source_tarball.sh: Set compile-command in Emacs
-- generate_source_tarball.sh: Remove REPO_NAME from FILE_NAME_ROOT
-- generate_source_tarball.sh: Move PROJECT_NAME and REPO_NAME checks
-- generate_source_tarball.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
-- generate_source_tarball.sh: shellcheck: Double-quote variable references (SC2086)
-- generate_source_tarball.sh: shellcheck: Do not use -a (SC2166)
-- generate_source_tarball.sh: shellcheck: Do not use $ on arithmetic variables (SC2004)
-- Use backward-compatible patch syntax
-- generate_source_tarball.sh: Ignore -ga tags with OPENJDK_LATEST
-- generate_source_tarball.sh: Fix whitespace
-- generate_source_tarball.sh: Remove trailing period in echo
-- generate_source_tarball.sh: Use long-style argument to grep
-- generate_source_tarball.sh: Add license
-- generate_source_tarball.sh: Add indentation instructions for Emacs
-- Related: RHEL-30945
-
-* Sun Apr 14 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.2.ea
-- Install alt-java man page from the misc tarball as it is no longer in the JDK image
-- generate_source_tarball.sh: Update examples in header for clarity
-- generate_source_tarball.sh: Cleanup message issued when checkout already exists
-- generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
-- generate_source_tarball.sh: Only add --depth=1 on non-local repositories
-- Move maintenance scripts to a scripts subdirectory
-- discover_trees.sh: Set compile-command and indentation instructions for Emacs
-- discover_trees.sh: shellcheck: Do not use -o (SC2166)
-- discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
-- discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
-- generate_source_tarball.sh: Add authorship
-- icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
-- icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
-- icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
-- openjdk_news.sh: Set compile-command and indentation instructions for Emacs
-- openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
-- openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
-- openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
-- generate_source_tarball.sh: Output values of new options WITH_TEMP and OPENJDK_LATEST
-- generate_source_tarball.sh: Double-quote DEPTH reference (SC2086)
-- generate_source_tarball.sh: Avoid empty DEPTH reference while still appeasing shellcheck
-- Related: RHEL-30945
-
-* Sun Apr 14 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.1.ea
-- Update to jdk-21.0.3+1 (EA)
-- Update release notes to 21.0.3+1
-- Switch to EA mode
-- Require tzdata 2023d due to upstream inclusion of JDK-8322725
-- Bump FreeType version to 2.13.2 following JDK-8316028
-- Related: RHEL-30945
-
-* Fri Apr 12 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-2
-- Define portablesuffix according to whether pkgos is defined or not
-- Related: RHEL-30945
-
-* Tue Jan 09 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-1
-- Update to jdk-21.0.2+13 (GA)
-- Sync the copy of the portable specfile with the latest update
-- Bump libpng version to 1.6.40 following JDK-8316030
-- Bump HarfBuzz version to 8.2.2 following JDK-8313643
-- Drop local JDK-8311630 patch which is now upstream
-- ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
-- Resolves: RHEL-20998
-
-* Mon Nov 06 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-3
-- Include JDK-8311630 patch to implement Foreign Function & Memory preview API on s390x
-- Sync the copy of the portable specfile with the latest update
-- Resolves: RHEL-16386
-
-* Mon Oct 30 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-2
-- Switch to using portable binaries built on RHEL 7
-- Sync the copy of the portable specfile with the RHEL 7 version
-- Related: RHEL-12997
-
-* Fri Oct 27 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-1
-- Update to jdk-21.0.1.0+12 (GA)
-- Update release notes to 21.0.1.0+12
-- Sync the copy of the portable specfile with the latest update
-- Update openjdk_news script to specify subdirectory last
-- Add missing discover_trees script required by openjdk_news
-- Synchronise bundled versions with 21u sources (FreeType, LCMS, HarfBuzz, libpng)
-- Sync generate_tarball.sh with 11u & 17u version
-- Update bug URL for RHEL to point to the Red Hat customer portal
-- Fix upstream release URL for OpenJDK source
-- Following JDK-8005165, class data sharing can be enabled on all JIT architectures
-- Use tapsets from the misc tarball
-- Introduce 'prelease' for the portable release versioning, to handle EA builds
-- Make sure root installation directory is created first
-- Use in-place substitution for all but the first of the tapset changes
-- Synchronise runtime and buildtime tzdata requirements
-- Remove ghosts for binaries not in java-21-openjdk (pack200, rmid, unpack200)
-- Add missing jfr, jpackage and jwebserver alternative ghosts
-- Move jcmd to the headless package
-- Revert alt-java binary location to being within the JDK tree
-- Resolves: RHEL-12997
-- Resolves: RHEL-14954
-- Resolves: RHEL-14962
-- Resolves: RHEL-14958
-- Related: RHEL-14946
-- Resolves: RHEL-14959
-- Resolves: RHEL-14948
-
-* Fri Oct 27 2023 Jiri Vanek <jvanek@redhat.com> - 1:21.0.1.0.12-1
-- Exclude classes_nocoops.jsa on i686 and arm32
-- Related: RHEL-14946
-
-* Fri Oct 27 2023 Severin Gehwolf <sgehwolf@redhat.com> - 1:21.0.1.0.12-1
-- Fix packaging of CDS archives
-- Resolves: RHEL-14946
-
-* Thu Aug 24 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-2
-- Update documentation (README.md)
-- Replace alt-java patch with a binary separate from the JDK
-- Drop stale patches that are of little use any more:
-- * nss.cfg has been disabled since early PKCS11 work and long superseded by FIPS work
-- * No accessibility subpackage to warrant RH1648242 & RH1648644 patches any more
-- * No use of system libjpeg turbo to warrant RH649512 patch any more
-- Replace RH1684077 pcsc-lite-libs patch with better JDK-8009550 fix being upstreamed
-- Adapt alt-java test to new binary where there is always a set_speculation function
-- Related: RHEL-12997
-
-* Mon Aug 21 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-1
-- Update to jdk-21.0.0+35
-- Update system crypto policy & FIPS patch from new fips-21u tree
-- Update generate_tarball.sh to sync with upstream vanilla script inc. no more ECC removal
-- Drop fakefeaturever now it is no longer needed
-- Change top_level_dir_name to use the VCS tag, matching new upstream release style tarball
-- Use upstream release URL for OpenJDK source
-- Re-enable tzdata tests now we are on the latest JDK and things are back in sync
-- Install jaxp.properties introduced by JDK-8303530
-- Install lible.so introduced by JDK-8306983
-- Related: RHEL-12997
-
-* Mon Aug 21 2023 Petra Alice Mikova <pmikova@redhat.com> - 1:21.0.0.0.35-1
-- Replace smoke test files used in the staticlibs test, as fdlibm was removed by JDK-8303798
-- Related: RHEL-12997
-
 * Wed Aug 16 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:20.0.0.0.36-1
 - Update to jdk-20.0.2+9
 - Update release notes to 20.0.2+9
 - Update system crypto policy & FIPS patch from new fips-20u tree
 - Update generate_tarball.sh ICEDTEA_VERSION
 - Update CLDR reference data following update to 42 (Rocky Mountain-Normalzeit => Rocky-Mountain-Normalzeit)
-- Related: RHEL-12997
+- Related: RHEL-12998
 
 * Wed Aug 16 2023 Jiri Vanek <jvanek@redhat.com> - 1:20.0.0.0.36-1
 - Dropped JDK-8295447, JDK-8296239 & JDK-8299439 patches now upstream
 - Adapted rh1750419-redhat_alt_java.patch
-- Related: RHEL-12997
+- Related: RHEL-12998
 
 * Tue Aug 15 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:19.0.1.0.10-1
 - Update to jdk-19.0.2 release
@@ -2683,7 +2539,7 @@ cjc.mainProgram(args)
 - Remove references to sample directory removed by JDK-8284999
 - Add local patch JDK-8295447 (javac NPE) which was accepted into 19u upstream but not in the GA tag
 - Add local patches for JDK-8296239 & JDK-8299439 (Croatia Euro update) which are present in 8u, 11u & 17u releases
-- Related: RHEL-12997
+- Related: RHEL-12998
 
 * Thu Aug 10 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:18.0.2.0.9-1
 - Update to jdk-18.0.2 release
@@ -2694,17 +2550,21 @@ cjc.mainProgram(args)
 - Drop tzdata patches added for 17.0.7 which will eventually appear in the upstream tarball when we reach OpenJDK 21
 - Disable tzdata tests until we are on the latest JDK and things are back in sync
 - Use empty nss.fips.cfg until it is again available via the FIPS patch
-- Related: RHEL-12997
+- Related: RHEL-12998
 
 * Thu Aug 10 2023 Petra Alice Mikova <pmikova@redhat.com> - 1:18.0.2.0.9-1
 - Update to ea version of jdk18
 - Add new slave jwebserver and corresponding manpage
 - Adjust rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
-- Related: RHEL-12997
+- Related: RHEL-12998
 
 * Thu Aug 10 2023 FeRD (Frank Dana) <ferdnyc@gmail.com> - 1:18.0.2.0.9-1
 - Add javaver- and origin-specific javadoc and javadoczip alternatives.
-- Related: RHEL-12997
+- Related: RHEL-12998
+
+* Tue Aug 08 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-4
+- Set portablerelease and portablerhel to use the CentOS 9 build
+- Related: RHEL-12998
 
 * Tue Aug 08 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-4
 - Add files missed by centpkg import.

nss.cfg.in

@@ -0,0 +1,5 @@
+name = NSS
+nssLibraryDirectory = @NSS_LIBDIR@
+nssDbMode = noDb
+attributes = compatibility
+handleStartupErrors = ignoreMultipleInitialisation

openjdk_news.sh

@@ -0,0 +1,76 @@
+#!/bin/bash
+
+# Copyright (C) 2022 Red Hat, Inc.
+# Written by Andrew John Hughes <gnu.andrew@redhat.com>, 2012-2022
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+OLD_RELEASE=$1
+NEW_RELEASE=$2
+SUBDIR=$3
+REPO=$4
+SCRIPT_DIR=$(dirname ${0})
+
+if test "x${SUBDIR}" = "x"; then
+    echo "No subdirectory specified; using .";
+    SUBDIR=".";
+fi
+
+if test "x$REPO" = "x"; then
+    echo "No repository specified; using ${PWD}"
+    REPO=${PWD}
+fi
+
+if test x${TMPDIR} = x; then
+    TMPDIR=/tmp;
+fi
+
+echo "Repository: ${REPO}"
+
+if [ -e ${REPO}/.git ] ; then
+    TYPE=git;
+elif [ -e ${REPO}/.hg ] ; then
+    TYPE=hg;
+else
+    echo "No Mercurial or Git repository detected.";
+    exit 1;
+fi
+
+if test "x$OLD_RELEASE" = "x" || test "x$NEW_RELEASE" = "x"; then
+    echo "ERROR: Need to specify old and new release";
+    exit 2;
+fi
+
+echo "Listing fixes between $OLD_RELEASE and $NEW_RELEASE in $REPO"
+rm -f ${TMPDIR}/fixes2 ${TMPDIR}/fixes3 ${TMPDIR}/fixes
+for repos in . $(${SCRIPT_DIR}/discover_trees.sh ${REPO});
+do
+    if test "x$TYPE" = "xhg"; then
+	hg log -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R $REPO/$repos -G -M ${REPO}/${SUBDIR} | \
+	    egrep '^[o:| ]*summary'|grep -v 'Added tag'|sed -r 's#^[o:| ]*summary:\W*([0-9])#  - JDK-\1#'| \
+	    sed 's#^[o:| ]*summary:\W*#  - #' >> ${TMPDIR}/fixes2;
+	hg log -v -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R $REPO/$repos -G -M ${REPO}/${SUBDIR} | \
+	    egrep '^[o:| ]*[0-9]{7}'|sed -r 's#^[o:| ]*([0-9]{7})#  - JDK-\1#' >> ${TMPDIR}/fixes3;
+    else
+	git -C ${REPO} log --no-merges --pretty=format:%B ${NEW_RELEASE}...${OLD_RELEASE} -- ${SUBDIR} |egrep '^[0-9]{7}' | \
+	    sed -r 's#^([0-9])#  - JDK-\1#' >> ${TMPDIR}/fixes2;
+	touch ${TMPDIR}/fixes3 ; # unused
+    fi
+done
+
+sort ${TMPDIR}/fixes2 ${TMPDIR}/fixes3 | uniq > ${TMPDIR}/fixes
+rm -f ${TMPDIR}/fixes2 ${TMPDIR}/fixes3
+
+echo "In ${TMPDIR}/fixes:"
+cat ${TMPDIR}/fixes

rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch

@@ -0,0 +1,16 @@
+diff -r 618ad1237e73 src/java.desktop/share/classes/java/awt/Toolkit.java
+--- a/src/java.desktop/share/classes/java/awt/Toolkit.java	Thu Jun 13 19:37:49 2019 +0200
++++ b/src/java.desktop/share/classes/java/awt/Toolkit.java	Thu Jul 04 10:35:42 2019 +0200
+@@ -595,7 +595,11 @@
+                 toolkit = new HeadlessToolkit(toolkit);
+             }
+             if (!GraphicsEnvironment.isHeadless()) {
+-                loadAssistiveTechnologies();
++                try {
++                    loadAssistiveTechnologies();
++                } catch (AWTError error) {
++                    // ignore silently
++                }
+             }
+         }
+         return toolkit;

rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch

@@ -0,0 +1,12 @@
+diff --git openjdk.orig/src/java.base/share/conf/security/java.security openjdk/src/java.base/share/conf/security/java.security
+index 68a9c1a2d08..7aa25eb2cb7 100644
+--- openjdk.orig/src/java.base/share/conf/security/java.security
++++ openjdk/src/java.base/share/conf/security/java.security
+@@ -78,6 +78,7 @@ security.provider.tbd=SunMSCAPI
+ security.provider.tbd=Apple
+ #endif
+ security.provider.tbd=SunPKCS11
++#security.provider.tbd=SunPKCS11 ${java.home}/lib/security/nss.cfg
+ 
+ #
+ # Security providers used when FIPS mode support is active

rh1648644-java_access_bridge_privileged_security.patch

@@ -0,0 +1,20 @@
+--- openjdk/src/java.base/share/conf/security/java.security
++++ openjdk/src/java.base/share/conf/security/java.security
+@@ -304,6 +304,8 @@
+ #
+ package.access=sun.misc.,\
+                sun.reflect.,\
++               org.GNOME.Accessibility.,\
++               org.GNOME.Bonobo.,\
+ 
+ #
+ # List of comma-separated packages that start with or equal this string
+@@ -316,6 +318,8 @@
+ #
+ package.definition=sun.misc.,\
+                    sun.reflect.,\
++                   org.GNOME.Accessibility.,\
++                   org.GNOME.Bonobo.,\
+ 
+ #
+ # Determines whether this properties file can be appended to

rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch

@@ -0,0 +1,15 @@
+diff --git a/openjdk/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java b/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java
+index bacff32efbc..ff7b3dcc81c 100644
+--- openjdk/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java
++++ openjdk/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java
+@@ -46,8 +46,8 @@ class PlatformPCSC {
+ 
+     private static final String PROP_NAME = "sun.security.smartcardio.library";
+ 
+-    private static final String LIB1 = "/usr/$LIBISA/libpcsclite.so";
+-    private static final String LIB2 = "/usr/local/$LIBISA/libpcsclite.so";
++    private static final String LIB1 = "/usr/$LIBISA/libpcsclite.so.1";
++    private static final String LIB2 = "/usr/local/$LIBISA/libpcsclite.so.1";
+     private static final String PCSC_FRAMEWORK = "/System/Library/Frameworks/PCSC.framework/Versions/Current/PCSC";
+ 
+     PlatformPCSC() {

rh1750419-redhat_alt_java.patch

@@ -0,0 +1,117 @@
+diff --git openjdk.orig/make/modules/java.base/Launcher.gmk openjdk/make/modules/java.base/Launcher.gmk
+index 700ddefda49..2882de68eb2 100644
+--- openjdk.orig/make/modules/java.base/Launcher.gmk
++++ openjdk/make/modules/java.base/Launcher.gmk
+@@ -41,6 +41,14 @@ $(eval $(call SetupBuildLauncher, java, \
+     OPTIMIZATION := HIGH, \
+ ))
+ 
++#Wno-error=cpp is present to allow commented warning in ifdef part of main.c
++$(eval $(call SetupBuildLauncher, alt-java, \
++    CFLAGS := -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES -DREDHAT_ALT_JAVA -Wno-error=cpp, \
++    EXTRA_RCFLAGS := $(JAVA_RCFLAGS), \
++    VERSION_INFO_RESOURCE := $(JAVA_VERSION_INFO_RESOURCE), \
++    OPTIMIZATION := HIGH, \
++))
++
+ ifeq ($(call isTargetOs, windows), true)
+   $(eval $(call SetupBuildLauncher, javaw, \
+       CFLAGS := -DJAVAW -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES, \
+diff --git openjdk.orig/src/java.base/share/native/launcher/alt_main.h openjdk/src/java.base/share/native/launcher/alt_main.h
+new file mode 100644
+index 00000000000..697df2898ac
+--- /dev/null
++++ openjdk/src/java.base/share/native/launcher/alt_main.h
+@@ -0,0 +1,73 @@
++/*
++ * Copyright (c) 2019, Red Hat, Inc. All rights reserved.
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation.  Oracle designates this
++ * particular file as subject to the "Classpath" exception as provided
++ * by Oracle in the LICENSE file that accompanied this code.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++#ifdef REDHAT_ALT_JAVA
++
++#include <sys/prctl.h>
++
++
++/* Per task speculation control */
++#ifndef PR_GET_SPECULATION_CTRL
++# define PR_GET_SPECULATION_CTRL    52
++#endif
++#ifndef PR_SET_SPECULATION_CTRL
++# define PR_SET_SPECULATION_CTRL    53
++#endif
++/* Speculation control variants */
++#ifndef PR_SPEC_STORE_BYPASS
++# define PR_SPEC_STORE_BYPASS          0
++#endif
++/* Return and control values for PR_SET/GET_SPECULATION_CTRL */
++
++#ifndef PR_SPEC_NOT_AFFECTED
++# define PR_SPEC_NOT_AFFECTED          0
++#endif
++#ifndef PR_SPEC_PRCTL
++# define PR_SPEC_PRCTL                 (1UL << 0)
++#endif
++#ifndef PR_SPEC_ENABLE
++# define PR_SPEC_ENABLE                (1UL << 1)
++#endif
++#ifndef PR_SPEC_DISABLE
++# define PR_SPEC_DISABLE               (1UL << 2)
++#endif
++#ifndef PR_SPEC_FORCE_DISABLE
++# define PR_SPEC_FORCE_DISABLE         (1UL << 3)
++#endif
++#ifndef PR_SPEC_DISABLE_NOEXEC
++# define PR_SPEC_DISABLE_NOEXEC        (1UL << 4)
++#endif
++
++static void set_speculation() __attribute__((constructor));
++static void set_speculation() {
++  if ( prctl(PR_SET_SPECULATION_CTRL,
++             PR_SPEC_STORE_BYPASS,
++             PR_SPEC_DISABLE_NOEXEC, 0, 0) == 0 ) {
++    return;
++  }
++  prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0);
++}
++
++#endif // REDHAT_ALT_JAVA
+diff --git openjdk.orig/src/java.base/share/native/launcher/main.c openjdk/src/java.base/share/native/launcher/main.c
+index b734fe2ba78..79dc8307650 100644
+--- openjdk.orig/src/java.base/share/native/launcher/main.c
++++ openjdk/src/java.base/share/native/launcher/main.c
+@@ -34,6 +34,14 @@
+ #include "jli_util.h"
+ #include "jni.h"
+ 
++#ifdef REDHAT_ALT_JAVA
++#if defined(__linux__) && defined(__x86_64__)
++#include "alt_main.h"
++#else
++#warning alt-java requested but SSB mitigation not available on this platform.
++#endif
++#endif
++
+ /*
+  * Entry point.
+  */

rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch

@@ -0,0 +1,19 @@
+Remove uses of FAR in jpeg code
+
+Upstream libjpeg-trubo removed the (empty) FAR macro:
+http://sourceforge.net/p/libjpeg-turbo/code/1312/
+
+Adjust our code to not use the undefined FAR macro anymore.
+
+diff --git a/jdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c b/jdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c
+--- openjdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c
++++ openjdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c
+@@ -1385,7 +1385,7 @@
+     /* and fill it in */
+     dst_ptr = icc_data;
+     for (seq_no = first; seq_no < last; seq_no++) {
+-        JOCTET FAR *src_ptr = icc_markers[seq_no]->data + ICC_OVERHEAD_LEN;
++        JOCTET *src_ptr = icc_markers[seq_no]->data + ICC_OVERHEAD_LEN;
+         unsigned int length =
+             icc_markers[seq_no]->data_length - ICC_OVERHEAD_LEN;
+ 

rpminspect.yaml

@@ -0,0 +1,3 @@
+---
+inspections:
+    javabytecode: off

sources

@@ -0,0 +1,2 @@
+SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
+SHA512 (openjdk-jdk20u-jdk-20.0.2+9.tar.xz) = 1513a9f43613401055f2638d75cb6338c25c5c068c66e03c5943f47a0a7d41279013a3f455738b92947712e99bb279daa50c488a086354f4e74c6e0c50e2e3c5

tests/tests.yml

@@ -0,0 +1,21 @@
+---
+- hosts: localhost
+  roles:
+  - role: standard-test-source
+    tags:
+    - always
+  - role: standard-test-basic
+    tags:
+    - classic
+    - atomic
+    required_packages:
+    - java-21-openjdk-devel
+    tests:
+      - javaVersion1:
+          dir: ~
+          run: set -ex; useradd franta1;  su franta1 -c 'java -version';
+          run: set -ex; useradd franta4;  su franta4 -c 'javac -version';
+          run: ls -l /usr/lib/jvm;
+      - javaVersion2:
+          dir: ~
+          run: set -ex; useradd franta2;  su franta2 -c 'java --version'