Fix bad ChangeLog date

Related: RHEL-102677

.gitignore

@@ -1,2 +1,40 @@
-SOURCES/openjdk-21.0.6+7.tar.xz
-SOURCES/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz
+/openjdk-jdk17u-jdk-17.0.7+7.tar.xz
+/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz
+/openjdk-jdk18u-jdk-18.0.1+0.tar.xz
+/openjdk-jdk18u-jdk-18.0.1+10.tar.xz
+/openjdk-jdk18u-jdk-18.0.1.1+2.tar.xz
+/openjdk-jdk18u-jdk-18.0.2+9.tar.xz
+/openjdk-jdk19u-jdk-19+36.tar.xz
+/openjdk-jdk19u-jdk-19.0.1+10.tar.xz
+/openjdk-jdk19u-jdk-19.0.2+7.tar.xz
+/openjdk-jdk20u-jdk-20+36.tar.xz
+/openjdk-jdk20u-jdk-20.0.1+9.tar.xz
+/openjdk-jdk20u-jdk-20.0.2+9.tar.xz
+/openjdk-jdk21u-jdk-21+35.tar.xz
+/openjdk-21.0.1+12.tar.xz
+/openjdk-21.0.2+11.tar.xz
+/openjdk-21.0.2+12.tar.xz
+/openjdk-21.0.2+13.tar.xz
+/openjdk-21.0.3+1-ea.tar.xz
+/openjdk-21.0.3+7-ea.tar.xz
+/openjdk-21.0.3+9.tar.xz
+/openjdk-21.0.4+1-ea.tar.xz
+/openjdk-21.0.4+5-ea.tar.xz
+/openjdk-21.0.4+7.tar.xz
+/openjdk-21.0.5+1-ea.tar.xz
+/openjdk-21.0.5+5-ea.tar.xz
+/openjdk-21.0.5+9-ea.tar.xz
+/openjdk-21.0.5+10.tar.xz
+/openjdk-21.0.5+11.tar.xz
+/openjdk-21.0.6+6-ea.tar.xz
+/openjdk-21.0.6+7.tar.xz
+/openjdk-21.0.7+1-ea.tar.xz
+/openjdk-21.0.7+2-ea.tar.xz
+/openjdk-21.0.7+3-ea.tar.xz
+/openjdk-21.0.7+4-ea.tar.xz
+/openjdk-21.0.7+5-ea.tar.xz
+/openjdk-21.0.7+6.tar.xz
+/openjdk-21.0.8+1-ea.tar.xz
+/openjdk-21.0.8+2-ea.tar.xz
+/openjdk-21.0.8+8-ea.tar.xz
+/openjdk-21.0.8+9.tar.xz

.java-21-openjdk.metadata

@@ -1,2 +0,0 @@
-fad71f19631dab375285056d10d08374e869bb35 SOURCES/openjdk-21.0.6+7.tar.xz
-c8281ee37b77d535c9c1af86609a531958ff7b34 SOURCES/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz

NEWS

@@ -3,6 +3,891 @@ Key:
 JDK-X  - https://bugs.openjdk.java.net/browse/JDK-X
 CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
 
+New in release OpenJDK 21.0.8 (2025-07-15):
+===========================================
+Live versions of these release notes can be found at:
+  * https://bit.ly/openjdk2108
+
+* CVEs
+  - CVE-2025-30749
+  - CVE-2025-30754
+  - CVE-2025-50059
+  - CVE-2025-50106
+* Changes
+  - JDK-6956385: URLConnection.getLastModified() leaks file handles for jar:file and file: URLs
+  - JDK-8051591: Test javax/swing/JTabbedPane/8007563/Test8007563.java fails
+  - JDK-8136895: Writer not closed with disk full error, file resource leaked
+  - JDK-8180450: secondary_super_cache does not scale well
+  - JDK-8183348: Better cleanup for jdk/test/sun/security/pkcs12/P12SecretKey.java
+  - JDK-8200566: DistributionPointFetcher fails to fetch CRLs if the DistributionPoints field contains more than one DistributionPoint and the first one fails
+  - JDK-8202100: Merge vm/share/InMemoryJavaCompiler w/ jdk/test/lib/compiler/InMemoryJavaCompiler
+  - JDK-8210471: GZIPInputStream constructor could leak an un-end()ed Inflater
+  - JDK-8211400: nsk.share.gc.Memory::getArrayLength returns wrong value
+  - JDK-8220213: com/sun/jndi/dns/ConfigTests/Timeout.java failed intermittent
+  - JDK-8249831: Test sun/security/mscapi/nonUniqueAliases/NonUniqueAliases.java is marked with @ignore
+  - JDK-8253440: serviceability/sa/TestJhsdbJstackLineNumbers.java failed with "Didn't find enough line numbers"
+  - JDK-8256211: assert fired in java/net/httpclient/DependentPromiseActionsTest (infrequent)
+  - JDK-8258483: [TESTBUG] gtest CollectorPolicy.young_scaled_initial_ergo_vm fails if heap is too small
+  - JDK-8267174: Many test files have the wrong Copyright header
+  - JDK-8270269: Desktop.browse method fails if earlier CoInitialize call as COINIT_MULTITHREADED
+  - JDK-8276995: Bug in jdk.jfr.event.gc.collection.TestSystemGC
+  - JDK-8279016: JFR Leak Profiler is broken with Shenandoah
+  - JDK-8280991: [XWayland] No displayChanged event after setDisplayMode call
+  - JDK-8281511: java/net/ipv6tests/UdpTest.java fails with checkTime failed
+  - JDK-8282726: java/net/vthread/BlockingSocketOps.java timeout/hang intermittently on Windows
+  - JDK-8286204: [Accessibility,macOS,VoiceOver] VoiceOver reads the spinner value 10 as 1 when user iterates to 10 for the first time on macOS
+  - JDK-8286789: Test forceEarlyReturn002.java timed out
+  - JDK-8286875: ProgrammableUpcallHandler::on_entry/on_exit access thread fields from native
+  - JDK-8294155: Exception thrown before awaitAndCheck hangs PassFailJFrame
+  - JDK-8295804: javax/swing/JFileChooser/JFileChooserSetLocationTest.java failed with "setLocation() is not working properly"
+  - JDK-8297692: Avoid sending per-region GCPhaseParallel JFR events in G1ScanCollectionSetRegionClosure
+  - JDK-8303770: Remove Baltimore root certificate expiring in May 2025
+  - JDK-8305010: Test vmTestbase/nsk/jvmti/scenarios/sampling/SP05/sp05t003/TestDescription.java timed out: thread not suspended
+  - JDK-8307318: Test serviceability/sa/ClhsdbCDSJstackPrintAll.java failed: ArrayIndexOutOfBoundsException
+  - JDK-8307824: Clean up Finalizable.java and finalize terminology in vmTestbase/nsk/share
+  - JDK-8308033: The jcmd thread dump related tests should test virtual threads
+  - JDK-8308966: Add intrinsic for float/double modulo for x86 AVX2 and AVX512
+  - JDK-8309667: TLS handshake fails because of ConcurrentModificationException in PKCS12KeyStore.engineGetEntry
+  - JDK-8309841: Jarsigner should print a warning if an entry is removed
+  - JDK-8309978: [x64] Fix useless padding
+  - JDK-8310066: Improve test coverage for JVMTI GetThreadState on carrier and mounted vthread
+  - JDK-8310525: DynamicLauncher for JDP test needs to try harder to find a free port
+  - JDK-8310643: Misformatted copyright messages in FFM
+  - JDK-8312246: NPE when HSDB visits bad oop
+  - JDK-8312475: org.jline.util.PumpReader signed byte problem
+  - JDK-8313290: Misleading exception message from STS.Subtask::get when task forked after shutdown
+  - JDK-8313430: [JVMCI] fatal error: Never compilable: in JVMCI shutdown
+  - JDK-8313654: Test WaitNotifySuspendedVThreadTest.java timed out
+  - JDK-8314056: Remove runtime platform check from frem/drem
+  - JDK-8314136: Test java/net/httpclient/CancelRequestTest.java failed: WARNING: tracker for HttpClientImpl(42) has outstanding operations
+  - JDK-8314236: Overflow in Collections.rotate
+  - JDK-8314319: LogCompilation doesn't reset lateInlining when it encounters a failure.
+  - JDK-8314840: 3 gc/epsilon tests ignore external vm options
+  - JDK-8314842: zgc/genzgc tests ignore vm flags
+  - JDK-8315128: jdk/jfr/event/runtime/TestResidentSetSizeEvent.java fails with "The size should be less than or equal to peak"
+  - JDK-8315484: java/awt/dnd/RejectDragDropActionTest.java timed out
+  - JDK-8315669: Open source several Swing PopupMenu related tests
+  - JDK-8315742: Open source several Swing Scroll related tests
+  - JDK-8315827: Kitchensink.java and RenaissanceStressTest.java  time out with jvmti module errors
+  - JDK-8315871: Opensource five more Swing regression tests
+  - JDK-8315876: Open source several Swing CSS related tests
+  - JDK-8315951: Open source several Swing HTMLEditorKit related tests
+  - JDK-8315981: Opensource five more random Swing tests
+  - JDK-8316061: Open source several Swing RootPane and Slider related tests
+  - JDK-8316324: Opensource five miscellaneous Swing tests
+  - JDK-8316388: Opensource five Swing component related regression tests
+  - JDK-8316452: java/lang/instrument/modules/AppendToClassPathModuleTest.java ignores VM flags
+  - JDK-8316497: ColorConvertOp - typo for non-ICC conversions needs one-line fix
+  - JDK-8316580: HttpClient with StructuredTaskScope does not close when a task fails
+  - JDK-8316629: j.text.DateFormatSymbols setZoneStrings() exception is unhelpful
+  - JDK-8317264: Pattern.Bound has `static` fields that should be `static final`.
+  - JDK-8318509: x86 count_positives intrinsic broken for -XX:AVX3Threshold=0
+  - JDK-8318636: Add jcmd to print annotated process memory map
+  - JDK-8318700: MacOS Zero cannot run gtests due to wrong JVM path
+  - JDK-8318811: Compiler directives parser swallows a character after line comments
+  - JDK-8318915: Enhance checks in BigDecimal.toPlainString()
+  - JDK-8319439: Move BufferNode from PtrQueue files to new files
+  - JDK-8319572: Test jdk/incubator/vector/LoadJsvmlTest.java ignores VM flags
+  - JDK-8319690: [AArch64] C2 compilation hits offset_ok_for_immed: assert "c2 compiler bug"
+  - JDK-8320687: sun.jvmstat.monitor.MonitoredHost.getMonitoredHost() throws unexpected exceptions when invoked concurrently
+  - JDK-8320948: NPE due to unreported compiler error
+  - JDK-8321204: C2: assert(false) failed: node should be in igvn hash table
+  - JDK-8321479: java -D-D crashes
+  - JDK-8321931: memory_swap_current_in_bytes reports 0 as "unlimited"
+  - JDK-8322141: SequenceInputStream.transferTo should not return as soon as Long.MAX_VALUE bytes have been transferred
+  - JDK-8322475: Extend printing for System.map
+  - JDK-8323795: jcmd Compiler.codecache should print total size of code cache
+  - JDK-8324345: Stack overflow during C2 compilation when splitting memory phi
+  - JDK-8324678: Replace NULL with nullptr in HotSpot gtests
+  - JDK-8324681: Replace NULL with nullptr in HotSpot jtreg test native code files
+  - JDK-8324799: Use correct extension for C++ test headers
+  - JDK-8324880: Rename get_stack_trace.h
+  - JDK-8325055: Rename Injector.h
+  - JDK-8325180: Rename jvmti_FollowRefObjects.h
+  - JDK-8325347: Rename native_thread.h
+  - JDK-8325367: Rename nsk_list.h
+  - JDK-8325435: [macos] Menu or JPopupMenu not closed when main window is resized
+  - JDK-8325456: Rename nsk_mutex.h
+  - JDK-8325458: Rename mlvmJvmtiUtils.h
+  - JDK-8325680: Uninitialised memory in deleteGSSCB of GSSLibStub.c:179
+  - JDK-8325682: Rename nsk_strace.h
+  - JDK-8325910: Rename jnihelper.h
+  - JDK-8326090: Rename jvmti_aod.h
+  - JDK-8326389: [test] improve assertEquals failure output
+  - JDK-8326524: Rename agent_common.h
+  - JDK-8326586: Improve Speed of System.map
+  - JDK-8327071: [Testbug] g-tests for cgroup leave files in /tmp on linux
+  - JDK-8327169: serviceability/dcmd/vm/SystemMapTest.java and SystemDumpMapTest.java may fail after JDK-8326586
+  - JDK-8327370: (ch) sun.nio.ch.Poller.register throws AssertionError
+  - JDK-8327461: KeyStore getEntry is not thread-safe
+  - JDK-8328107: Shenandoah/C2: TestVerifyLoopOptimizations test failure
+  - JDK-8328301: Convert Applet test ManualHTMLDataFlavorTest.java to main program
+  - JDK-8328482: Convert and Open source few manual applet test to main based
+  - JDK-8328484: Convert and Opensource few JFileChooser applet test to main
+  - JDK-8328648: Remove applet usage from JFileChooser tests bug4150029
+  - JDK-8328670: Automate and open source few closed manual applet test
+  - JDK-8328673: Convert closed text/html/CSS manual applet test to main
+  - JDK-8328864: NullPointerException in sun.security.jca.ProviderList.getService()
+  - JDK-8329261: G1: interpreter post-barrier x86 code asserts index size of wrong buffer
+  - JDK-8329729: java/util/Properties/StoreReproducibilityTest.java times out
+  - JDK-8330106: C2: VectorInsertNode::make() shouldn't call ConINode::make() directly
+  - JDK-8330158: C2: Loop strip mining uses ABS with min int
+  - JDK-8330534: Update nsk/jdwp tests to use driver instead of othervm
+  - JDK-8330598: java/net/httpclient/Http1ChunkedTest.java fails with java.util.MissingFormatArgumentException: Format specifier '%s'
+  - JDK-8330936: [ubsan] exclude function BilinearInterp and ShapeSINextSpan in libawt java2d from ubsan checks
+  - JDK-8331088: Incorrect TraceLoopPredicate output
+  - JDK-8331735: UpcallLinker::on_exit races with GC when copying frame anchor
+  - JDK-8332252: Clean up vmTestbase/vm/share
+  - JDK-8332506: SIGFPE In ObjectSynchronizer::is_async_deflation_needed()
+  - JDK-8332631: Update nsk.share.jpda.BindServer to don't use finalization
+  - JDK-8332641: Update nsk.share.jpda.Jdb to don't use finalization
+  - JDK-8332880: JFR GCHelper class recognizes "Archive" regions as valid
+  - JDK-8332921: Ctrl+C does not call shutdown hooks after JLine upgrade
+  - JDK-8333013: Update vmTestbase/nsk/share/LocalProcess.java to don't use finalization
+  - JDK-8333117: Remove support of remote and manual debuggee launchers
+  - JDK-8333680: com/sun/tools/attach/BasicTests.java fails with "SocketException: Permission denied: connect"
+  - JDK-8333805: Replaying compilation with null static final fields results in a crash
+  - JDK-8333890: Fatal error in auto-vectorizer with float16 kernel.
+  - JDK-8334644: Automate javax/print/attribute/PageRangesException.java
+  - JDK-8334780: Crash: assert(h_array_list.not_null()) failed: invariant
+  - JDK-8334895: OpenJDK fails to configure on linux aarch64 when CDS is disabled after JDK-8331942
+  - JDK-8335181: Incorrect handling of HTTP/2 GOAWAY frames in HttpClient
+  - JDK-8335643: serviceability/dcmd/vm tests fail for ZGC after JDK-8322475
+  - JDK-8335662: [AArch64] C1: guarantee(val < (1ULL << nbits)) failed: Field too big for insn
+  - JDK-8335684: Test ThreadCpuTime.java should pause like ThreadCpuTimeArray.java
+  - JDK-8335710: serviceability/dcmd/vm/SystemDumpMapTest.java and SystemMapTest.java fail on Linux Alpine after 8322475
+  - JDK-8335836: serviceability/jvmti/StartPhase/AllowedFunctions/AllowedFunctions.java fails with unexpected exit code: 112
+  - JDK-8335860: compiler/vectorization/TestFloat16VectorConvChain.java fails with non-standard AVX/SSE settings
+  - JDK-8336042: Caller/callee param size mismatch in deoptimization causes crash
+  - JDK-8336499: Failure when creating non-CRT RSA private keys in SunPKCS11
+  - JDK-8336587: failure_handler lldb command times out on macosx-aarch64 core file
+  - JDK-8336827: compiler/vectorization/TestFloat16VectorConvChain.java  timeouts on ppc64 platforms after JDK-8335860
+  - JDK-8337221: CompileFramework: test library to conveniently compile java and jasm sources for fuzzing
+  - JDK-8337299: vmTestbase/nsk/jdb/stop_at/stop_at002/stop_at002.java failure goes undetected
+  - JDK-8337681: PNGImageWriter uses much more memory than necessary
+  - JDK-8337795: Type annotation attached to incorrect type during class reading
+  - JDK-8337958: Out-of-bounds array access in secondary_super_cache
+  - JDK-8337981: ShenandoahHeap::is_in should check for alive regions
+  - JDK-8337998: CompletionFailure in getEnclosingType attaching type annotations
+  - JDK-8338010: WB_IsFrameDeoptimized miss ResourceMark
+  - JDK-8338064: Give better error for ConcurrentHashTable corruption
+  - JDK-8338136: Hotspot should support multiple large page sizes on Windows
+  - JDK-8338154: Fix -Wzero-as-null-pointer-constant warnings in gtest framework
+  - JDK-8338202: Shenandoah: Improve handshake closure labels
+  - JDK-8338314: JFR: Split JFRCheckpoint VM operation
+  - JDK-8339148: Make os::Linux::active_processor_count() public
+  - JDK-8339288: Improve diagnostic logging runtime/cds/DeterministicDump.java
+  - JDK-8339300: CollectorPolicy.young_scaled_initial_ergo_vm gtest fails on ppc64 based platforms
+  - JDK-8339538: Wrong timeout computations in DnsClient
+  - JDK-8339639: Opensource few AWT PopupMenu tests
+  - JDK-8339678: Update runtime/condy tests to be executed with VM flags
+  - JDK-8339727: Open source several AWT focus tests - series 1
+  - JDK-8339769: Incorrect error message during startup if working directory does not exist
+  - JDK-8339794: Open source closed choice tests #1
+  - JDK-8339810: Clean up the code in sun.tools.jar.Main to properly close resources and use ZipFile during extract
+  - JDK-8339836: Open source several AWT Mouse tests - Batch 1
+  - JDK-8339842: Open source several AWT focus tests - series 2
+  - JDK-8339895: Open source several AWT focus tests - series 3
+  - JDK-8339906: Open source several AWT focus tests - series 4
+  - JDK-8339935: Open source several AWT focus tests - series 5
+  - JDK-8339982: Open source several AWT Mouse tests - Batch 2
+  - JDK-8339984: Open source AWT MenuItem related tests
+  - JDK-8339995: Open source several AWT focus tests - series 6
+  - JDK-8340024: In ClassReader, extract a constant for the superclass supertype_index
+  - JDK-8340077: Open source few Checkbox tests - Set2
+  - JDK-8340084: Open source AWT Frame related tests
+  - JDK-8340143: Open source several Java2D rendering loop tests.
+  - JDK-8340146: ZGC: TestAllocateHeapAt.java should not run with UseLargePages
+  - JDK-8340164: Open source few Component tests - Set1
+  - JDK-8340173: Open source some Component/Panel/EventQueue tests - Set2
+  - JDK-8340176: Replace usage of -noclassgc with -Xnoclassgc in test/jdk/java/lang/management/MemoryMXBean/LowMemoryTest2.java
+  - JDK-8340193: Open source several AWT Dialog tests - Batch 1
+  - JDK-8340228: Open source couple more miscellaneous AWT tests
+  - JDK-8340271: Open source several AWT Robot tests
+  - JDK-8340279: Open source several AWT Dialog tests - Batch 2
+  - JDK-8340332: Open source mixed AWT tests - Set3
+  - JDK-8340366: Open source several AWT Dialog tests - Batch 3
+  - JDK-8340367: Opensource few AWT image tests
+  - JDK-8340393: Open source closed choice tests #2
+  - JDK-8340407: Open source a few more Component related tests
+  - JDK-8340417: Open source some MenuBar tests - Set1
+  - JDK-8340432: Open source some MenuBar tests - Set2
+  - JDK-8340433: Open source closed choice tests #3
+  - JDK-8340437: Open source few more AWT Frame related tests
+  - JDK-8340458: Open source additional Component tests (part 2)
+  - JDK-8340555: Open source DnD tests - Set4
+  - JDK-8340560: Open Source several AWT/2D font and rendering tests
+  - JDK-8340605: Open source several AWT PopupMenu tests
+  - JDK-8340621: Open source several AWT List tests
+  - JDK-8340625: Open source additional Component tests (part 3)
+  - JDK-8340639: Open source few more AWT List tests
+  - JDK-8340713: Open source DnD tests - Set5
+  - JDK-8340784: Remove PassFailJFrame constructor with screenshots
+  - JDK-8340790: Open source several AWT Dialog tests - Batch 4
+  - JDK-8340809: Open source few more AWT PopupMenu tests
+  - JDK-8340874: Open source some of the AWT Geometry/Button tests
+  - JDK-8340907: Open source closed frame tests # 2
+  - JDK-8340966: Open source few Checkbox and Cursor tests - Set1
+  - JDK-8340967: Open source few Cursor tests - Set2
+  - JDK-8340978: Open source few DnD tests - Set6
+  - JDK-8340985: Open source some Desktop related tests
+  - JDK-8341000: Open source some of the AWT Window tests
+  - JDK-8341004: Open source AWT FileDialog related tests
+  - JDK-8341072: Open source several AWT Canvas and Rectangle related tests
+  - JDK-8341128: open source some 2d graphics tests
+  - JDK-8341148: Open source several Choice related tests
+  - JDK-8341162: Open source some of the AWT window test
+  - JDK-8341170: Open source several Choice related tests (part 2)
+  - JDK-8341177: Opensource few List and a Window test
+  - JDK-8341191: Open source few more AWT FileDialog tests
+  - JDK-8341239: Open source closed frame tests # 3
+  - JDK-8341257: Open source few DND tests - Set1
+  - JDK-8341258: Open source few various AWT tests - Set1
+  - JDK-8341278: Open source few TrayIcon tests - Set7
+  - JDK-8341298: Open source more AWT window tests
+  - JDK-8341373: Open source closed frame tests # 4
+  - JDK-8341378: Open source few TrayIcon tests - Set8
+  - JDK-8341447: Open source closed frame tests # 5
+  - JDK-8341535: sun/awt/font/TestDevTransform.java fails with RuntimeException: Different rendering
+  - JDK-8341637: java/net/Socket/UdpSocket.java fails with "java.net.BindException: Address already in use" (macos-aarch64)
+  - JDK-8341779: [REDO BACKPORT] type annotations are not visible to javac plugins across compilation boundaries (JDK-8225377)
+  - JDK-8341972: java/awt/dnd/DnDRemoveFocusOwnerCrashTest.java timed out after JDK-8341257
+  - JDK-8342075: HttpClient: improve HTTP/2 flow control checks
+  - JDK-8342376: More reliable OOM handling in ExceptionDuringDumpAtObjectsInitPhase test
+  - JDK-8342524: Use latch in AbstractButton/bug6298940.java instead of delay
+  - JDK-8342633: javax/management/security/HashedPasswordFileTest.java creates tmp file in src dir
+  - JDK-8342958: Use jvmArgs consistently in microbenchmarks
+  - JDK-8343019: Primitive caches must use boxed instances from the archive
+  - JDK-8343037: Missing @since tag on JColorChooser.showDialog overload
+  - JDK-8343103: Enable debug logging for vmTestbase/nsk/jvmti/scenarios/sampling/SP05/sp05t003/TestDescription.java
+  - JDK-8343124: Tests fails with java.lang.IllegalAccessException: class com.sun.javatest.regtest.agent.MainWrapper$MainTask cannot access
+  - JDK-8343144: UpcallLinker::on_entry racingly clears pending exception with GC safepoints
+  - JDK-8343170: java/awt/Cursor/JPanelCursorTest/JPanelCursorTest.java does not show the default cursor
+  - JDK-8343224: print/Dialog/PaperSizeError.java fails with MediaSizeName is not A4: A4
+  - JDK-8343342: java/io/File/GetXSpace.java fails on Windows with CD-ROM drive
+  - JDK-8343345: Use -jvmArgsPrepend when running microbenchmarks in RunTests.gmk
+  - JDK-8343529: serviceability/sa/ClhsdbWhere.java fails AssertionFailure: Corrupted constant pool
+  - JDK-8343754: Problemlist jdk/jfr/event/oldobject/TestShenandoah.java after JDK-8279016
+  - JDK-8343855: HTTP/2 ConnectionWindowUpdateSender may miss some unprocessed DataFrames from closed streams
+  - JDK-8343891: Test javax/swing/JTabbedPane/TestJTabbedPaneBackgroundColor.java failed
+  - JDK-8343936: Adjust timeout in test javax/management/monitor/DerivedGaugeMonitorTest.java
+  - JDK-8344316: security/auth/callback/TextCallbackHandler/Password.java make runnable with JTReg and add the UI
+  - JDK-8344346: java/net/httpclient/ShutdownNow.java fails with java.lang.AssertionError: client was still running, but exited after further delay: timeout should be adjusted
+  - JDK-8344361: Restore null return for invalid services from legacy providers
+  - JDK-8344414: ZGC: Another division by zero in rule_major_allocation_rate
+  - JDK-8344925: translet-name ignored when package-name is also set
+  - JDK-8345133: Test sun/security/tools/jarsigner/TsacertOptionTest.java failed: Warning found in stdout
+  - JDK-8345134: Test sun/security/tools/jarsigner/ConciseJarsigner.java failed: unable to find valid certification path to requested target
+  - JDK-8345146: [PPC64] Make intrinsic conversions between bit representations of half precision values and floats
+  - JDK-8345341: Fix incorrect log message in JDI stop002t test
+  - JDK-8345357: test/jdk/javax/swing/JRadioButton/8033699/bug8033699.java fails in ubuntu22.04
+  - JDK-8345447: test/jdk/javax/swing/JToolBar/4529206/bug4529206.java fails in ubuntu22.04
+  - JDK-8345547: test/jdk/javax/swing/text/DefaultEditorKit/4278839/bug4278839.java fails in ubuntu22.04
+  - JDK-8345598: Upgrade NSS binaries for interop tests
+  - JDK-8345625: Better HTTP connections
+  - JDK-8345728: [Accessibility,macOS,Screen Magnifier]: JCheckbox unchecked state does not magnify but works for checked state
+  - JDK-8345838: Remove the appcds/javaldr/AnonVmClassesDuringDump.java test
+  - JDK-8346049: jdk/test/lib/security/timestamp/TsaServer.java warnings
+  - JDK-8346082: Output JVMTI agent information in hserr files
+  - JDK-8346264: "Total compile time" counter should include time spent in failing/bailout compiles
+  - JDK-8346581: JRadioButton/ButtonGroupFocusTest.java fails in CI on Linux
+  - JDK-8346888: [ubsan] block.cpp:1617:30: runtime error: 9.97582e+36 is outside the range of representable values of type 'int'
+  - JDK-8347000: Bug in com/sun/net/httpserver/bugs/B6361557.java test
+  - JDK-8347019: Test javax/swing/JRadioButton/8033699/bug8033699.java  still fails:  Focus is not on Radio Button Single as Expected
+  - JDK-8347083: Incomplete logging in nsk/jvmti/ResourceExhausted/resexhausted00* tests
+  - JDK-8347126: gc/stress/TestStressG1Uncommit.java gets OOM-killed
+  - JDK-8347173: java/net/DatagramSocket/InterruptibleDatagramSocket.java fails with virtual thread factory
+  - JDK-8347286: (fs) Remove some extensions from java/nio/file/Files/probeContentType/Basic.java
+  - JDK-8347296: WinInstallerUiTest fails in local test runs if the path to test work directory is longer that regular
+  - JDK-8347373: HTTP/2 flow control checks may count unprocessed data twice
+  - JDK-8347506: Compatible OCSP readtimeout property with OCSP timeout
+  - JDK-8347596: Update HSS/LMS public key encoding
+  - JDK-8347629: Test FailOverDirectExecutionControlTest.java fails with -Xcomp
+  - JDK-8347995: Race condition in jdk/java/net/httpclient/offline/FixedResponseHttpClient.java
+  - JDK-8348107: test/jdk/java/net/httpclient/HttpsTunnelAuthTest.java fails intermittently
+  - JDK-8348110: Update LCMS to 2.17
+  - JDK-8348299: Update List/ItemEventTest/ItemEventTest.java
+  - JDK-8348323: Corrupted timezone string in JVM crash log
+  - JDK-8348596: Update FreeType to 2.13.3
+  - JDK-8348597: Update HarfBuzz to 10.4.0
+  - JDK-8348598: Update Libpng to 1.6.47
+  - JDK-8348600: Update PipeWire to 1.3.81
+  - JDK-8348865: JButton/bug4796987.java never runs because Windows XP is unavailable
+  - JDK-8348936: [Accessibility,macOS,VoiceOver] VoiceOver doesn't announce untick on toggling the checkbox with "space" key on macOS
+  - JDK-8348989: Better Glyph drawing
+  - JDK-8349111: Enhance Swing supports
+  - JDK-8349200: [JMH] time.format.ZonedDateTimeFormatterBenchmark fails
+  - JDK-8349348: Refactor ClassLoaderDeadlock.sh and Deadlock.sh to run fully in java
+  - JDK-8349358: [JMH] Cannot access class jdk.internal.vm.ContinuationScope
+  - JDK-8349492: Update sun/security/pkcs12/KeytoolOpensslInteropTest.java to use a recent Openssl version
+  - JDK-8349501: Relocate supporting classes in security/testlibrary to test/lib/jdk tree
+  - JDK-8349594: Enhance TLS protocol support
+  - JDK-8349623: [ASAN] Gtest os_linux.glibc_mallinfo_wrapper_vm fails
+  - JDK-8349637: Integer.numberOfLeadingZeros outputs incorrectly in certain cases
+  - JDK-8349751: AIX build failure after upgrade pipewire to 1.3.81
+  - JDK-8350201: Out of bounds access on Linux aarch64 in os::print_register_info
+  - JDK-8350211: CTW: Attempt to preload all classes in constant pool
+  - JDK-8350224: Test javax/swing/JComboBox/TestComboBoxComponentRendering.java fails in ubuntu 23.x and later
+  - JDK-8350260: Improve HTML instruction formatting in PassFailJFrame
+  - JDK-8350313: Include timings for leaving safepoint in safepoint logging
+  - JDK-8350383: Test: add more test case for string compare (UL case)
+  - JDK-8350386: Test TestCodeCacheFull.java fails with option -XX:-UseCodeCacheFlushing
+  - JDK-8350412: [21u] AArch64: Ambiguous frame layout leads to incorrect traces in JFR
+  - JDK-8350483: AArch64: turn on signum intrinsics by default on Ampere CPUs
+  - JDK-8350498: Remove two Camerfirma root CA certificates
+  - JDK-8350546: Several java/net/InetAddress tests fails UnknownHostException
+  - JDK-8350616: Skip ValidateHazardPtrsClosure in non-debug builds
+  - JDK-8350650: Bump update version for OpenJDK: jdk-21.0.8
+  - JDK-8350682: [JMH] vector.IndexInRangeBenchmark failed with IndexOutOfBoundsException for size=1024
+  - JDK-8350786: Some java/lang jtreg tests miss requires vm.hasJFR
+  - JDK-8350924: javax/swing/JMenu/4213634/bug4213634.java fails
+  - JDK-8350991: Improve HTTP client header handling
+  - JDK-8351086: (fc) Make java/nio/channels/FileChannel/BlockDeviceSize.java test manual
+  - JDK-8351500: G1: NUMA migrations cause crashes in region allocation
+  - JDK-8351665: Remove unused UseNUMA in os_aix.cpp
+  - JDK-8351933: Inaccurate masking of TC subfield decrement in ForkJoinPool
+  - JDK-8352076: [21u] Problem list tests that fail in 21 and would be fixed by 8309622
+  - JDK-8352109: java/awt/Desktop/MailTest.java fails in platforms where Action.MAIL is not supported
+  - JDK-8352302: Test sun/security/tools/jarsigner/TimestampCheck.java is failing
+  - JDK-8352512: TestVectorZeroCount: counter not reset between iterations
+  - JDK-8352676: Opensource JMenu tests - series1
+  - JDK-8352680: Opensource few misc swing tests
+  - JDK-8352684: Opensource JInternalFrame tests - series1
+  - JDK-8352706: httpclient HeadTest does not run on HTTP2
+  - JDK-8352716: (tz) Update Timezone Data to 2025b
+  - JDK-8352908: Open source several swing tests batch1
+  - JDK-8352942: jdk/jfr/startupargs/TestMemoryOptions.java fails with 32-bit build
+  - JDK-8353070: Clean up and open source couple AWT Graphics related tests (Part 1)
+  - JDK-8353138: Screen capture for test TaskbarPositionTest.java, failure case
+  - JDK-8353190: Use "/native" Run Option for TestAvailableProcessors Execution
+  - JDK-8353237: [AArch64] Incorrect result of VectorizedHashCode intrinsic on Cortex-A53
+  - JDK-8353320: Open source more Swing text tests
+  - JDK-8353446: Open source several AWT Menu tests - Batch 2
+  - JDK-8353475: Open source two Swing DefaultCaret tests
+  - JDK-8353685: Open some JComboBox bugs 4
+  - JDK-8353709: Debug symbols bundle should contain full debug files when building --with-external-symbols-in-bundles=public
+  - JDK-8353787: Increased number of SHA-384-Digest java.util.jar.Attributes$Name instances leading to higher memory footprint
+  - JDK-8353942: Open source Swing Tests - Set 5
+  - JDK-8354255: [jittester] Remove TempDir debug output
+  - JDK-8354530: AIX: sporadic unexpected errno when calling setsockopt in Net.joinOrDrop
+  - JDK-8354554: Open source several clipboard tests batch1
+  - JDK-8354802: MAX_SECS definition is unused in os_linux
+  - JDK-8354893: [REDO BACKPORT] javac crashes while adding type annotations to the return type of a constructor (JDK-8320001)
+  - JDK-8355498: [AIX] Adapt code for C++ VLA rule
+  - JDK-8356053: Test java/awt/Toolkit/Headless/HeadlessToolkit.java fails by timeout
+  - JDK-8356096: ISO 4217 Amendment 179 Update
+  - JDK-8356571: Re-enable -Wtype-limits for GCC in LCMS
+  - JDK-8357105: C2: compilation fails with "assert(false) failed: empty program detected during loop optimization"
+  - JDK-8357193: [VS 2022 17.14] Warning C5287 in debugInit.c: enum type mismatch during build
+  - JDK-8359170: Add 2 TLS and 2 CS Sectigo roots
+  - JDK-8360147: Better Glyph drawing redux
+  - JDK-8360406: [21u] Disable logic for attaching type annotations to class files until 8359336 is fixed
+  - JDK-8361672: [21u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 21.0.8
+
+Notes on individual issues:
+===========================
+
+tools/javac:
+
+JDK-8341779: [REDO BACKPORT] type annotations are not visible to javac plugins across compilation boundaries (JDK-8225377)
+==========================================================================================================================
+The compiler in previous releases of OpenJDK 21 would only provide
+access to type annotations on types loaded from source code files.  If
+the type was instead loaded from bytecode, then any type annotations
+would be absent.
+
+With this release, `TypeMirror` now provides access to annotations for
+types loaded from bytecode.  These type annotations can be obtained
+using `AnnotationMirror#getAnnotationMirrors` and will be included in
+the output of `AnnotationMirror#toString`.
+
+Programs that rely on type annotations being absent from elements
+loaded from bytecode will need to be updated accordingly. Due to
+ongoing issues with this new feature (see JDK-8360406), it is not
+enabled by default and the option `-XDaddTypeAnnotationsToSymbol=true`
+must be specified in order for bytecode type annotations to be
+included.
+
+core-libs/java.net:
+
+JDK-8342075: HttpClient: improve HTTP/2 flow control checks
+===========================================================
+This release of OpenJDK 21 enhances the HTTP/2 client implementation
+in `java.net.http.HttpClient` to report flow control errors back to
+the server. While this should be transparent in most cases, it may
+lead to streams being reset or connections being closed if connecting
+to a HTTP/2 server that does not correctly handle these errors.
+
+Flow control limits can be adjusted using the following existing
+properties:
+
+* `jdk.httpclient.connectionWindowSize`
+  - Specifies the HTTP/2 client connection window size in bytes.
+  - Default value: `2^26`
+  - Range: `2^16-1` to `2^31-1`.
+
+* `jdk.httpclient.windowSize`
+  - Specifies the HTTP/2 client stream window size in bytes.
+  - Default value: `16777216` (16MB)
+  - Range: `2^14` to `2^31-1`
+
+Specifying an invalid value leads to the default value being used.
+The implementation guarantees that the actual value used for the
+connection window size will be no smaller than the stream window size.
+
+hotspot/runtime:
+
+JDK-8318636: Add jcmd to print annotated process memory map
+===========================================================
+Two new diagnostic commands have been added to `jcmd`, which print the
+virtual memory map of the JVM either to standard output or a file.  If
+Native Memory Tracking (NMT) is enabled, NMT information about the
+virtual memory segments will be included.
+
+The new commands are:
+
+* `jcmd <pid> System.map` -- prints the virtual memory map of the JVM
+identified by `<pid>` to the standard output.
+
+* `jcmd <pid> System.dump_map` -- prints the virtual memory map of the
+JVM identified by `<pid>` to a file `vm_memory_map_<pid>.txt` in the
+current directory.
+
+security-libs/java.security:
+
+JDK-8303770: Remove Baltimore root certificate expiring in May 2025
+===================================================================
+The following root certificate from Baltimore has been removed from
+the `cacerts` keystore:
+
+Alias Name: baltimorecybertrustca [jdk]
+Distinguished Name: CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE
+
+JDK-8347506: Compatible OCSP readtimeout property with OCSP timeout
+===================================================================
+The initial release of OpenJDK 21 introduced the
+`com.sun.security.ocsp.readtimeout` property, which was paired with
+the existing `com.sun.security.ocsp.timeout` to give greater control
+over the timeouts for OCSP connections and certificate retrieval. The
+existence of two separate properties allows the timeout for reading
+data to be set separately from the timeout for the transport layer.
+
+When `com.sun.security.ocsp.readtimeout` was backported to OpenJDK
+17.0.15, the default value of `com.sun.security.ocsp.readtimeout` was
+changed from 15 seconds to the value of
+`com.sun.security.ocsp.timeout`, which itself has a default of 15
+seconds.  This change is brought forward to OpenJDK 21 with this
+release.
+
+If neither property is set, both will default to 15 seconds as in
+previous OpenJDK 21 releases.  If only `com.sun.security.ocsp.timeout`
+is set, `com.sun.security.ocsp.readtimeout` will use the same value
+which retains the behaviour from before the
+`com.sun.security.ocsp.readtimeout` property was introduced.
+
+JDK-8347596: Update HSS/LMS public key encoding
+===============================================
+The X.509 encoding format for HSS/LMS public keys has been updated to
+align with the latest standard outlined in RFC 9708 [0].  Notably, the
+OCTET_STRING wrapping around the public key value has been removed.
+For compatibility, the JDK will still detect the presence of DER
+encoding when reading keys encoded by earlier releases.
+
+[0] https://www.rfc-editor.org/rfc/rfc9708.html#name-hss-lms-public-key-identifi
+
+JDK-8350498: Remove two Camerfirma root CA certificates
+=======================================================
+The following expired root certificates from Camerfirma have been
+removed from the `cacerts` keystore:
+
+Alias name: camerfirmachamberscommerceca [jdk]
+CN=Chambers of Commerce Root
+OU=http://www.chambersign.org
+O=AC Camerfirma SA CIF A82743287
+C=EU
+SHA256: 0C:25:8A:12:A5:67:4A:EF:25:F2:8B:A7:DC:FA:EC:EE:A3:48:E5:41:E6:F5:CC:4E:E6:3B:71:B3:61:60:6A:C3
+
+Alias name: camerfirmachambersignca [jdk]
+CN=Global Chambersign Root - 2008
+O=AC Camerfirma S.A.
+SERIALNUMBER=A82743287
+L=Madrid (see current address at www.camerfirma.com/address)
+C=EU
+SHA256: 13:63:35:43:93:34:A7:69:80:16:A0:D3:24:DE:72:28:4E:07:9D:7B:52:20:BB:8F:BD:74:78:16:EE:BE:BA:CA
+
+JDK-8359170: Add 2 TLS and 2 CS Sectigo roots
+=============================================
+The following root certificates have been added to the cacerts
+truststore:
+
+Name: Sectigo Limited
+Alias Name: sectigocodesignroote46
+Distinguished Name: CN=Sectigo Public Code Signing Root E46, O=Sectigo Limited, C=GB
+
+Name: Sectigo Limited
+Alias Name: sectigocodesignrootr46
+Distinguished Name: CN=Sectigo Public Code Signing Root R46, O=Sectigo Limited, C=GB
+
+Name: Sectigo Limited
+Alias Name: sectigotlsroote46
+Distinguished Name: Sectigo Public Server Authentication Root E46, O=Sectigo Limited, C=GB
+
+Name: Sectigo Limited
+Alias Name: sectigotlsrootr46
+Distinguished Name: Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB
+
+New in release OpenJDK 21.0.7 (2025-04-15):
+===========================================
+Live versions of these release notes can be found at:
+  * https://bit.ly/openjdk2107
+
+* CVEs
+  - CVE-2025-21587
+  - CVE-2025-30691
+  - CVE-2025-30698
+* Changes
+  - JDK-8198237: [macos] Test java/awt/Frame/ExceptionOnSetExtendedStateTest/ExceptionOnSetExtendedStateTest.java fails
+  - JDK-8211851: (ch) java/nio/channels/AsynchronousSocketChannel/StressLoopback.java times out (aix)
+  - JDK-8226933: [TEST_BUG]GTK L&F: There is no swatches or RGB tab in JColorChooser
+  - JDK-8226938: [TEST_BUG]GTK L&F: There is no Details button in FileChooser Dialog
+  - JDK-8227529: With malformed --app-image the error messages are awful
+  - JDK-8277240: java/awt/Graphics2D/ScaledTransform/ScaledTransform.java dialog does not get disposed
+  - JDK-8283664: Remove jtreg tag manual=yesno for java/awt/print/PrinterJob/PrintTextTest.java
+  - JDK-8286875: ProgrammableUpcallHandler::on_entry/on_exit access thread fields from native
+  - JDK-8293345: SunPKCS11 provider checks on PKCS11 Mechanism are problematic
+  - JDK-8294316: SA core file support is broken on macosx-x64 starting with macOS 12.x
+  - JDK-8295159: DSO created with -ffast-math breaks Java floating-point arithmetic
+  - JDK-8302111: Serialization considerations
+  - JDK-8304701: Request with timeout aborts later in-flight request on HTTP/1.1 cxn
+  - JDK-8309841: Jarsigner should print a warning if an entry is removed
+  - JDK-8311546: Certificate name constraints improperly validated with leading period
+  - JDK-8312570: [TESTBUG] Jtreg compiler/loopopts/superword/TestDependencyOffsets.java fails on 512-bit SVE
+  - JDK-8313633: [macOS] java/awt/dnd/NextDropActionTest/NextDropActionTest.java fails with java.lang.RuntimeException: wrong next drop action!
+  - JDK-8313905: Checked_cast assert in CDS compare_by_loader
+  - JDK-8314752: Use google test string comparison macros
+  - JDK-8314909: tools/jpackage/windows/Win8282351Test.java fails with java.lang.AssertionError: Expected [0]. Actual [1618]:
+  - JDK-8315486: vmTestbase/nsk/jdwp/ThreadReference/ForceEarlyReturn/forceEarlyReturn002/forceEarlyReturn002.java timed out
+  - JDK-8315825: Open some swing tests
+  - JDK-8315882: Open some swing tests 2
+  - JDK-8315883: Open source several Swing JToolbar tests
+  - JDK-8315952: Open source several Swing JToolbar JTooltip JTree tests
+  - JDK-8316056: Open source several Swing JTree tests
+  - JDK-8316146: Open some swing tests 4
+  - JDK-8316149: Open source several Swing JTree JViewport KeyboardManager tests
+  - JDK-8316218: Open some swing tests 5
+  - JDK-8316371: Open some swing tests 6
+  - JDK-8316627: JViewport Test headless failure
+  - JDK-8316885: jcmd: Compiler.CodeHeap_Analytics cmd does not inform about missing aggregate
+  - JDK-8317283: jpackage tests run osx-specific checks on windows and linux
+  - JDK-8317636: Improve heap walking API tests to verify correctness of field indexes
+  - JDK-8317808: HTTP/2 stream cancelImpl may leave subscriber registered
+  - JDK-8317919: pthread_attr_init handle return value and destroy pthread_attr_t object
+  - JDK-8319233: AArch64: Build failure with clang due to -Wformat-nonliteral warning
+  - JDK-8320372: test/jdk/sun/security/x509/DNSName/LeadingPeriod.java validity check failed
+  - JDK-8320676: Manual printer tests have no Pass/Fail buttons, instructions close set 1
+  - JDK-8320691: Timeout handler on Windows takes 2 hours to complete
+  - JDK-8320706: RuntimePackageTest.testUsrInstallDir test fails on Linux
+  - JDK-8320916: jdk/jfr/event/gc/stacktrace/TestParallelMarkSweepAllocationPendingStackTrace.java failed with "OutOfMemoryError: GC overhead limit exceeded"
+  - JDK-8321818: vmTestbase/nsk/stress/strace/strace015.java failed with 'Cannot read the array length because "<local4>" is null'
+  - JDK-8322983: Virtual Threads: exclude 2 tests
+  - JDK-8324672: Update jdk/java/time/tck/java/time/TCKInstant.java now() to be more robust
+  - JDK-8324807: Manual printer tests have no Pass/Fail buttons, instructions close set 2
+  - JDK-8324838: test_nmt_locationprinting.cpp broken in the gcc windows build
+  - JDK-8325042: Remove unused JVMDITools test files
+  - JDK-8325529: Remove unused imports from `ModuleGenerator` test file
+  - JDK-8325659: Normalize Random usage by incubator vector tests
+  - JDK-8325937: runtime/handshake/HandshakeDirectTest.java causes "monitor end should be strictly below the frame pointer" assertion failure on AArch64
+  - JDK-8326421: Add jtreg test for large arrayCopy disjoint case.
+  - JDK-8326525: com/sun/tools/attach/BasicTests.java does not verify AgentLoadException case
+  - JDK-8327098: GTest needs larger combination limit
+  - JDK-8327390: JitTester: Implement temporary folder functionality
+  - JDK-8327460: Compile tests with the same visibility rules as product code
+  - JDK-8327476: Upgrade JLine to 3.26.1
+  - JDK-8327505: Test com/sun/jmx/remote/NotificationMarshalVersions/TestSerializationMismatch.java fails
+  - JDK-8327857: Remove applet usage from JColorChooser tests Test4222508
+  - JDK-8327859: Remove applet usage from JColorChooser tests Test4319113
+  - JDK-8327986: ASAN reports use-after-free in DirectivesParserTest.empty_object_vm
+  - JDK-8327994: Update code gen in CallGeneratorHelper
+  - JDK-8328005: Convert java/awt/im/JTextFieldTest.java applet test to main
+  - JDK-8328085: C2: Use after free in PhaseChaitin::Register_Allocate()
+  - JDK-8328121: Remove applet usage from JColorChooser tests Test4759306
+  - JDK-8328130: Remove applet usage from JColorChooser tests Test4759934
+  - JDK-8328185: Convert java/awt/image/MemoryLeakTest/MemoryLeakTest.java applet test to main
+  - JDK-8328227: Remove applet usage from JColorChooser tests Test4887836
+  - JDK-8328368: Convert java/awt/image/multiresolution/MultiDisplayTest/MultiDisplayTest.java applet test to main
+  - JDK-8328370: Convert java/awt/print/Dialog/PrintApplet.java applet test to main
+  - JDK-8328380: Remove applet usage from JColorChooser tests Test6348456
+  - JDK-8328387: Convert java/awt/Frame/FrameStateTest/FrameStateTest.html applet test to main
+  - JDK-8328403: Remove applet usage from JColorChooser tests Test6977726
+  - JDK-8328553: Get rid of JApplet in test/jdk/sanity/client/lib/SwingSet2/src/DemoModule.java
+  - JDK-8328558: Convert javax/swing/JCheckBox/8032667/bug8032667.java applet test to main
+  - JDK-8328717: Convert javax/swing/JColorChooser/8065098/bug8065098.java applet test to main
+  - JDK-8328719: Convert java/awt/print/PageFormat/SetOrient.html applet test to main
+  - JDK-8328730: Convert java/awt/print/bug8023392/bug8023392.html applet test to main
+  - JDK-8328753: Open source few Undecorated Frame tests
+  - JDK-8328819: Remove applet usage from JFileChooser tests bug6698013
+  - JDK-8328827: Convert java/awt/print/PrinterJob/PrinterDialogsModalityTest/PrinterDialogsModalityTest.html applet test to main
+  - JDK-8329210: Delete Redundant Printer Dialog Modality Test
+  - JDK-8329320: Simplify awt/print/PageFormat/NullPaper.java test
+  - JDK-8329322: Convert PageFormat/Orient.java to use PassFailJFrame
+  - JDK-8329692: Add more details to FrameStateTest.java test instructions
+  - JDK-8330647: Two CDS tests fail with -UseCompressedOops and UseSerialGC/UseParallelGC
+  - JDK-8330702: Update failure handler to don't generate Error message if cores actions are empty
+  - JDK-8331735: UpcallLinker::on_exit races with GC when copying frame anchor
+  - JDK-8331959: Update PKCS#11 Cryptographic Token Interface to v3.1
+  - JDK-8331977: Crash: SIGSEGV in dlerror()
+  - JDK-8331993: Add counting leading/trailing zero tests for Integer
+  - JDK-8332158: [XWayland] test/jdk/java/awt/Mouse/EnterExitEvents/ResizingFrameTest.java
+  - JDK-8332494: java/util/zip/EntryCount64k.java failing with java.lang.RuntimeException: '\\A\\Z' missing from stderr
+  - JDK-8332917: failure_handler should execute gdb "info threads" command on linux
+  - JDK-8333116: test/jdk/tools/jpackage/share/ServiceTest.java test fails
+  - JDK-8333360: PrintNullString.java doesn't use float arguments
+  - JDK-8333391: Test com/sun/jdi/InterruptHangTest.java failed: Thread was never interrupted during sleep
+  - JDK-8333403: Write a test to check various components events are triggered properly
+  - JDK-8333647: C2 SuperWord: some additional PopulateIndex tests
+  - JDK-8334305: Remove all code for  nsk.share.Log verbose mode
+  - JDK-8334371: [AIX] Beginning with AIX 7.3 TL1 mmap() supports 64K memory pages
+  - JDK-8334490: Normalize string with locale invariant `toLowerCase()`
+  - JDK-8334777: Test javax/management/remote/mandatory/notif/NotifReconnectDeadlockTest.java failed with NullPointerException
+  - JDK-8335288: SunPKCS11 initialization will call C_GetMechanismInfo on unsupported mechanisms
+  - JDK-8335468: [XWayland] JavaFX hangs when calling java.awt.Robot.getPixelColor
+  - JDK-8335789: [TESTBUG] XparColor.java test fails with Error. Parse Exception: Invalid or unrecognized bugid: @
+  - JDK-8336012: Fix usages of jtreg-reserved properties
+  - JDK-8336498: [macos] [build]: install-file macro may run into permission denied error
+  - JDK-8336692: Redo fix for JDK-8284620
+  - JDK-8336942: Improve test coverage for class loading elements with annotations of different retentions
+  - JDK-8337222: gc/TestDisableExplicitGC.java fails due to unexpected CodeCache GC
+  - JDK-8337494: Clarify JarInputStream behavior
+  - JDK-8337660: C2: basic blocks with only BoxLock nodes are wrongly treated as empty
+  - JDK-8337692: Better TLS connection support
+  - JDK-8337886: java/awt/Frame/MaximizeUndecoratedTest.java fails in OEL due to a slight color difference
+  - JDK-8337951: Test sun/security/validator/samedn.sh CertificateNotYetValidException: NotBefore validation
+  - JDK-8337994: [REDO] Native memory leak when not recording any events
+  - JDK-8338100: C2: assert(!n_loop->is_member(get_loop(lca))) failed: control must not be back in the loop
+  - JDK-8338303: Linux ppc64le with toolchain clang - detection failure in early JVM startup
+  - JDK-8338426: Test java/nio/channels/Selector/WakeupNow.java failed
+  - JDK-8338430: Improve compiler transformations
+  - JDK-8338571: [TestBug] DefaultCloseOperation.java test not working as expected wrt instruction after JDK-8325851 fix
+  - JDK-8338595: Add more linesize for MIME decoder in macro bench test Base64Decode
+  - JDK-8338668: Test javax/swing/JFileChooser/8080628/bug8080628.java doesn't test for GTK L&F
+  - JDK-8339154: Cleanups and JUnit conversion of test/jdk/java/util/zip/Available.java
+  - JDK-8339261: Logs truncated in test javax/net/ssl/DTLS/DTLSRehandshakeTest.java
+  - JDK-8339356: Test javax/net/ssl/SSLSocket/Tls13PacketSize.java failed with java.net.SocketException: An established connection was aborted by the software in your host machine
+  - JDK-8339475: Clean up return code handling for pthread calls in library coding
+  - JDK-8339524: Clean up a few ExtendedRobot tests
+  - JDK-8339542: compiler/codecache/CheckSegmentedCodeCache.java fails
+  - JDK-8339687: Rearrange reachabilityFence()s in jdk.test.lib.util.ForceGC
+  - JDK-8339728: [Accessibility,Windows,JAWS] Bug in the getKeyChar method of the AccessBridge class
+  - JDK-8339810: Clean up the code in sun.tools.jar.Main to properly close resources and use ZipFile during extract
+  - JDK-8339834: Replace usages of -mx and -ms in some tests
+  - JDK-8339883: Open source several AWT/2D related tests
+  - JDK-8339902: Open source couple TextField related tests
+  - JDK-8339943: Frame not disposed in java/awt/dnd/DropActionChangeTest.java
+  - JDK-8340078: Open source several 2D tests
+  - JDK-8340116: test/jdk/sun/security/tools/jarsigner/PreserveRawManifestEntryAndDigest.java can fail due to regex
+  - JDK-8340313: Crash due to invalid oop in nmethod after C1 patching
+  - JDK-8340411: open source several 2D imaging tests
+  - JDK-8340480: Bad copyright notices in changes from JDK-8339902
+  - JDK-8340687: Open source closed frame tests #1
+  - JDK-8340719: Open source AWT List tests
+  - JDK-8340824: C2: Memory for TypeInterfaces not reclaimed by hashcons()
+  - JDK-8340969: jdk/jfr/startupargs/TestStartDuration.java should be marked as flagless
+  - JDK-8341037: Use standard layouts in DefaultFrameIconTest.java and MenuCrash.java
+  - JDK-8341111: open source several AWT tests including menu shortcut tests
+  - JDK-8341135: Incorrect format string after JDK-8339475
+  - JDK-8341194: [REDO] Implement C2 VectorizedHashCode on AArch64
+  - JDK-8341316: [macos] javax/swing/ProgressMonitor/ProgressMonitorEscapeKeyPress.java fails sometimes in macos
+  - JDK-8341412: Various test failures after JDK-8334305
+  - JDK-8341424: GHA: Collect hs_errs from build time failures
+  - JDK-8341453: java/awt/a11y/AccessibleJTableTest.java fails in some cases where the test tables are not visible
+  - JDK-8341715: PPC64: ObjectMonitor::_owner should be reset unconditionally in nmethod unlocking
+  - JDK-8341820: Check return value of hcreate_r
+  - JDK-8341862: PPC64: C1 unwind_handler fails to unlock synchronized methods with LM_MONITOR
+  - JDK-8341881: [REDO] java/nio/file/attribute/BasicFileAttributeView/CreationTime.java#tmp fails on alinux3
+  - JDK-8341978: Improve JButton/bug4490179.java
+  - JDK-8341982: Simplify JButton/bug4323121.java
+  - JDK-8342098: Write a test to compare the images
+  - JDK-8342145: File libCreationTimeHelper.c compile fails on Alpine
+  - JDK-8342270: Test sun/security/pkcs11/Provider/RequiredMechCheck.java needs write access to src tree
+  - JDK-8342498: Add test for Allocation elimination after use as alignment reference by SuperWord
+  - JDK-8342508: Use latch in BasicMenuUI/bug4983388.java instead of delay
+  - JDK-8342541: Exclude List/KeyEventsTest/KeyEventsTest.java from running on macOS
+  - JDK-8342562: Enhance Deflater operations
+  - JDK-8342602: Remove JButton/PressedButtonRightClickTest test
+  - JDK-8342609: jpackage test helper function incorrectly removes a directory instead of its contents only
+  - JDK-8342634: javax/imageio/plugins/wbmp/WBMPStreamTruncateTest.java creates temp file in src dir
+  - JDK-8342635: javax/swing/JFileChooser/FileSystemView/WindowsDefaultIconSizeTest.java creates tmp file in src dir
+  - JDK-8342704: GHA: Report truncation is broken after JDK-8341424
+  - JDK-8342811: java/net/httpclient/PlainProxyConnectionTest.java failed: Unexpected connection count: 5
+  - JDK-8342858: Make target mac-jdk-bundle fails on chmod command
+  - JDK-8342988: GHA: Build JTReg in single step
+  - JDK-8343007: Enhance Buffered Image handling
+  - JDK-8343100: Consolidate EmptyFolderTest and EmptyFolderPackageTest jpackage tests into single java file
+  - JDK-8343101: Rework BasicTest.testTemp test cases
+  - JDK-8343102: Remove `--compress` from jlink command lines from jpackage tests
+  - JDK-8343118: [TESTBUG] java/awt/PrintJob/PrintCheckboxTest/PrintCheckboxManualTest.java fails with rror. Can't find HTML file PrintCheckboxManualTest.html
+  - JDK-8343128: PassFailJFrame.java test result: Error. Bad action for script: build}
+  - JDK-8343129: Disable unstable check of ThreadsListHandle.sanity_vm ThreadList values
+  - JDK-8343144: UpcallLinker::on_entry racingly clears pending exception with GC safepoints
+  - JDK-8343149: Cleanup os::print_tos_pc on AIX
+  - JDK-8343178: Test BasicTest.java javac compile fails cannot find symbol
+  - JDK-8343205: CompileBroker::possibly_add_compiler_threads excessively polls available memory
+  - JDK-8343314: Move common properties from jpackage jtreg test declarations to TEST.properties file
+  - JDK-8343343: Misc crash dump improvements on more platforms after JDK-8294160
+  - JDK-8343378: Exceptions in javax/management DeadLockTest.java do not cause test failure
+  - JDK-8343396: Use OperatingSystem, Architecture, and OSVersion in jpackage tests
+  - JDK-8343491: javax/management/remote/mandatory/connection/DeadLockTest.java failing with NoSuchObjectException: no such object in table
+  - JDK-8343599: Kmem limit and max values swapped when printing container information
+  - JDK-8343882: BasicAnnoTests doesn't handle multiple annotations at the same position
+  - JDK-8344275: tools/jpackage/windows/Win8301247Test.java fails on localized Windows platform
+  - JDK-8344326: Move jpackage tests from "jdk.jpackage.tests" package to the default package
+  - JDK-8344581: [TESTBUG] java/awt/Robot/ScreenCaptureRobotTest.java failing on macOS
+  - JDK-8344589: Update IANA Language Subtag Registry to Version 2024-11-19
+  - JDK-8344646: The libjsig deprecation warning should go to stderr not stdout
+  - JDK-8345296: AArch64: VM crashes with SIGILL when prctl is disallowed
+  - JDK-8345368: java/io/File/createTempFile/SpecialTempFile.java fails on Windows Server 2025
+  - JDK-8345370: Bump update version for OpenJDK: jdk-21.0.7
+  - JDK-8345375: Improve debuggability of test/jdk/java/net/Socket/CloseAvailable.java
+  - JDK-8345414: Google CAInterop test failures
+  - JDK-8345468: test/jdk/javax/swing/JScrollBar/4865918/bug4865918.java fails in ubuntu22.04
+  - JDK-8345569: [ubsan] adjustments to filemap.cpp and virtualspace.cpp for macOS aarch64
+  - JDK-8345614: Improve AnnotationFormatError message for duplicate annotation interfaces
+  - JDK-8345676: [ubsan] ProcessImpl_md.c:561:40: runtime error: applying zero offset to null pointer on macOS aarch64
+  - JDK-8345684: OperatingSystemMXBean.getSystemCpuLoad() throws NPE
+  - JDK-8345750: Shenandoah: Test TestJcmdHeapDump.java#aggressive intermittent assert(gc_cause() == GCCause::_no_gc) failed: Over-writing cause
+  - JDK-8346055: javax/swing/text/StyledEditorKit/4506788/bug4506788.java fails in ubuntu22.04
+  - JDK-8346108: [21u][BACKOUT] 8337994: [REDO] Native memory leak when not recording any events
+  - JDK-8346324: javax/swing/JScrollBar/4865918/bug4865918.java fails in CI
+  - JDK-8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs
+  - JDK-8346671: java/nio/file/Files/probeContentType/Basic.java fails on Windows 2025
+  - JDK-8346713: [testsuite] NeverActAsServerClassMachine breaks TestPLABAdaptToMinTLABSize.java TestPinnedHumongousFragmentation.java TestPinnedObjectContents.java
+  - JDK-8346828: javax/swing/JScrollBar/4865918/bug4865918.java still fails in CI
+  - JDK-8346847: [s390x] minimal build failure
+  - JDK-8346880: [aix] java/lang/ProcessHandle/InfoTest.java still fails: "reported cputime less than expected"
+  - JDK-8346881: [ubsan] logSelection.cpp:154:24  / logSelectionList.cpp:72:94 : runtime error: applying non-zero offset 1 to null pointer
+  - JDK-8346887: DrawFocusRect() may cause an assertion failure
+  - JDK-8346972: Test java/nio/channels/FileChannel/LoopingTruncate.java fails sometimes with IOException: There is not enough space on the disk
+  - JDK-8347038: [JMH] jdk.incubator.vector.SpiltReplicate fails NoClassDefFoundError
+  - JDK-8347129: cpuset cgroups controller is required for no good reason
+  - JDK-8347171: (dc) java/nio/channels/DatagramChannel/InterruptibleOrNot.java fails with virtual thread factory
+  - JDK-8347256: Epsilon: Demote heap size and AlwaysPreTouch warnings to info level
+  - JDK-8347267: [macOS]: UnixOperatingSystem.c:67:40: runtime error: division by zero
+  - JDK-8347268: [ubsan] logOutput.cpp:357:21: runtime error: applying non-zero offset 1 to null pointer
+  - JDK-8347424: Fix and rewrite sun/security/x509/DNSName/LeadingPeriod.java test
+  - JDK-8347427: JTabbedPane/8134116/Bug8134116.java has no license header
+  - JDK-8347576: Error output in libjsound has non matching format strings
+  - JDK-8347740: java/io/File/createTempFile/SpecialTempFile.java failing
+  - JDK-8347847: Enhance jar file support
+  - JDK-8347911: Limit the length of inflated text chunks
+  - JDK-8347965: (tz) Update Timezone Data to 2025a
+  - JDK-8348562: ZGC: segmentation fault due to missing node type check in barrier elision analysis
+  - JDK-8348625: [21u, 17u] Revert JDK-8185862 to restore old java.awt.headless behavior on Windows
+  - JDK-8348675: TrayIcon tests fail in Ubuntu 24.10 Wayland
+  - JDK-8349039: Adjust exception No type named <ThreadType> in database
+  - JDK-8349603: [21u, 17u, 11u] Update GHA JDKs after Jan/25 updates
+  - JDK-8349729: [21u] AIX jtreg tests fail to compile with qvisibility=hidden
+  - JDK-8352097: (tz) zone.tab update missed in 2025a backport
+  - JDK-8353904: [21u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 21.0.7
+
+Notes on individual issues:
+===========================
+
+security-libs/java.security:
+
+JDK-8309841: Jarsigner should print a warning if an entry is removed
+====================================================================
+In previous OpenJDK releases, the jarsigner tool did not detect the
+case where a file was removed from a signed JAR file but its signature
+was still present. With this release, `jarsigner -verify` checks that
+every signature has a matching file entry and prints a warning if this
+is not the case. The `-verbose` option can also be added to the
+command to see the names of the mismatched entries.
+
+security-libs/javax.net.ssl:
+
+JDK-8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs
+=============================================================================
+In accordance with similar plans recently announced by Google,
+Mozilla, Apple and Microsoft, the JDK will not trust Transport Layer
+Security (TLS) certificates issued after the 15th of April 2025 which
+are anchored by Camerfirma root certificates.
+
+Certificates issued on or before April 15th, 2025 will continue to
+be trusted until they expire.
+
+If a server's certificate chain is anchored by an affected
+certificate, attempts to negotiate a TLS session will fail with an
+Exception that indicates the trust anchor is not trusted. For example,
+
+"TLS server certificate issued after 2025-04-15 and anchored by a
+distrusted legacy Camerfirma root CA: CN=Chambers of Commerce Root -
+2008, O=AC Camerfirma S.A., SERIALNUMBER=A82743287, L=Madrid (see
+current address at www.camerfirma.com/address), C=EU"
+
+To check whether a certificate in a JDK keystore is affected by this
+change, you can the `keytool` utility:
+
+keytool -v -list -alias <your_server_alias> -keystore <your_keystore_filename>
+
+If any of the certificates in the chain are affected by this change,
+then you will need to update the certificate or contact the
+organisation responsible for managing the certificate.
+
+These restrictions apply to the following Camerfirma root certificates
+included in the JDK:
+
+Alias name: camerfirmachamberscommerceca [jdk]
+CN=Chambers of Commerce Root
+OU=http://www.chambersign.org
+O=AC Camerfirma SA CIF A82743287
+C=EU
+SHA256: 0C:25:8A:12:A5:67:4A:EF:25:F2:8B:A7:DC:FA:EC:EE:A3:48:E5:41:E6:F5:CC:4E:E6:3B:71:B3:61:60:6A:C3
+
+Alias name: camerfirmachambersca [jdk]
+CN=Chambers of Commerce Root - 2008
+O=AC Camerfirma S.A.
+SERIALNUMBER=A82743287
+L=Madrid (see current address at www.camerfirma.com/address)
+C=EU
+SHA256: 06:3E:4A:FA:C4:91:DF:D3:32:F3:08:9B:85:42:E9:46:17:D8:93:D7:FE:94:4E:10:A7:93:7E:E2:9D:96:93:C0
+
+Alias name: camerfirmachambersignca [jdk]
+CN=Global Chambersign Root - 2008
+O=AC Camerfirma S.A.
+SERIALNUMBER=A82743287
+L=Madrid (see current address at www.camerfirma.com/address)
+C=EU
+SHA256: 13:63:35:43:93:34:A7:69:80:16:A0:D3:24:DE:72:28:4E:07:9D:7B:52:20:BB:8F:BD:74:78:16:EE:BE:BA:CA
+
+Users can, *at their own risk*, remove this restriction by modifying
+the `java.security` configuration file (or override it by using the
+`java.security.properties` system property) so "CAMERFIRMA_TLS" is no
+longer listed in the `jdk.security.caDistrustPolicies` security
+property.
+
+security-libs/javax.crypto:pkcs11:
+
+JDK-8293345: SunPKCS11 provider checks on PKCS11 Mechanism are problematic
+==========================================================================
+In OpenJDK 14, the notion of legacy mechanisms was introduced into the
+SunPKCS11 provider.  If a mechanism was found to be using a weak
+algorithm, it was determined to be legacy and disabled.
+
+However, this approach has proved inflexible. There was no way for the
+user to override the legacy determination and enable the mechanism
+anyway.  Also, a mechanism being used for signing would be declared
+legacy and disabled if it had a weak encryption algorithm, even though
+encryption was not being used. Similarly, a weak signing algorithm
+would prevent the mechanism's use as a cipher for encryption or
+decryption.
+
+This OpenJDK release resolves these issues. It introduces the PKCS11
+provider configuration attribute "allowLegacy" which can be set to
+`true` if the user wishes to override the legacy determination. By
+default, it is set to `false`. The legacy determination now also
+considers the service type and will only check encryption algorithms
+for Ciphers and only signature algorithms for Signatures.
+
 New in release OpenJDK 21.0.6 (2025-01-21):
 ===========================================
 Live versions of these release notes can be found at:

fips-21u-9203d50836c.patch

@@ -1979,7 +1979,7 @@ index 539ef1e8ee8..435f57e3ff2 100644
                  "sun.security.rsa.PSSParameters", null);
      }
 diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security
-index 5149edba0e5..8227d650a03 100644
+index f8b01a4ea1e..b325bf7e9fc 100644
 --- a/src/java.base/share/conf/security/java.security
 +++ b/src/java.base/share/conf/security/java.security
 @@ -85,6 +85,17 @@ security.provider.tbd=Apple
@@ -2959,7 +2959,7 @@ index 00000000000..f8d505ca815
 +}
 \ No newline at end of file
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
-index c3b412885a6..0e7ce73b158 100644
+index 01fc06ae283..e3ca000d309 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
 @@ -37,6 +37,8 @@ import javax.crypto.*;
@@ -2981,7 +2981,7 @@ index c3b412885a6..0e7ce73b158 100644
      private static final String PUBLIC = "public";
      private static final String PRIVATE = "private";
      private static final String SECRET = "secret";
-@@ -401,9 +406,10 @@ abstract class P11Key implements Key, Length {
+@@ -414,9 +419,10 @@ abstract class P11Key implements Key, Length {
                      new CK_ATTRIBUTE(CKA_EXTRACTABLE),
          });
  
@@ -2995,7 +2995,7 @@ index c3b412885a6..0e7ce73b158 100644
  
          return switch (algorithm) {
              case "RSA" -> P11RSAPrivateKeyInternal.of(session, keyID, algorithm,
-@@ -455,7 +461,8 @@ abstract class P11Key implements Key, Length {
+@@ -468,7 +474,8 @@ abstract class P11Key implements Key, Length {
  
          public String getFormat() {
              token.ensureValid();
@@ -3005,13 +3005,13 @@ index c3b412885a6..0e7ce73b158 100644
                  return null;
              } else {
                  return "RAW";
-@@ -1625,4 +1632,3 @@ final class SessionKeyRef extends PhantomReference<P11Key> {
+@@ -1638,4 +1645,3 @@ final class SessionKeyRef extends PhantomReference<P11Key> {
          this.clear();
      }
  }
 -
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
-index 5cd6828d293..bae49c4e8a9 100644
+index 0a62021633f..0723b69c2bc 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
 @@ -26,6 +26,9 @@
@@ -3022,7 +3022,7 @@ index 5cd6828d293..bae49c4e8a9 100644
 +import java.lang.invoke.MethodHandles;
 +import java.lang.invoke.MethodType;
  import java.util.*;
- 
+ import java.util.stream.Collectors;
  import java.security.*;
 @@ -42,10 +45,12 @@ import javax.security.auth.callback.PasswordCallback;
  
@@ -3141,7 +3141,7 @@ index 5cd6828d293..bae49c4e8a9 100644
              }
              p11 = tmpPKCS11;
  
-@@ -1389,11 +1461,52 @@ public final class SunPKCS11 extends AuthProvider {
+@@ -1388,11 +1460,52 @@ public final class SunPKCS11 extends AuthProvider {
          }
  
          @Override
@@ -3194,7 +3194,7 @@ index 5cd6828d293..bae49c4e8a9 100644
              try {
                  return newInstance0(param);
              } catch (PKCS11Exception e) {
-@@ -1750,6 +1863,9 @@ public final class SunPKCS11 extends AuthProvider {
+@@ -1749,6 +1862,9 @@ public final class SunPKCS11 extends AuthProvider {
          try {
              session = token.getOpSession();
              p11.C_Logout(session.id());
@@ -3252,7 +3252,7 @@ index a6f5f0a8764..9a07c96ca4e 100644
      }
  
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
-index 4b06daaf264..55e14945469 100644
+index 0fd13fd6fa6..3c959c942a1 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
 @@ -49,6 +49,9 @@ package sun.security.pkcs11.wrapper;
@@ -3312,7 +3312,7 @@ index 4b06daaf264..55e14945469 100644
              }
              if (omitInitialize == false) {
                  try {
-@@ -1976,4 +2004,194 @@ static class SynchronizedPKCS11 extends PKCS11 {
+@@ -2012,4 +2040,194 @@ static class SynchronizedPKCS11 extends PKCS11 {
          super.C_GenerateRandom(hSession, randomData);
      }
  }

gating.yaml

@@ -0,0 +1,7 @@
+# recipients: java-qa
+--- !Policy
+product_versions:
+  - rhel-9
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}

java-21-openjdk-portable.specfile

@@ -126,7 +126,7 @@
 # Set of architectures for which we build fastdebug builds
 %global fastdebug_arches x86_64 ppc64le aarch64
 # Set of architectures with a Just-In-Time (JIT) compiler
-%global jit_arches      %{arm} %{aarch64} %{ix86} %{power64} s390x sparcv9 sparc64 x86_64
+%global jit_arches      %{arm} %{aarch64} %{ix86} %{power64} s390x sparcv9 sparc64 x86_64 riscv64
 # Set of architectures which use the Zero assembler port (!jit_arches)
 %global zero_arches ppc s390
 # Set of architectures which run a full bootstrap cycle
@@ -136,15 +136,15 @@
 # Set of architectures with a Ahead-Of-Time (AOT) compiler
 %global aot_arches      x86_64 %{aarch64}
 # Set of architectures which support the serviceability agent
-%global sa_arches       %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} %{arm}
+%global sa_arches       %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} %{arm} riscv64
 # Set of architectures which support class data sharing
 # As of JDK-8005165 in OpenJDK 10, class sharing is not arch-specific
 # However, it does segfault on the Zero assembler port, so currently JIT only
 %global share_arches    %{jit_arches}
 # Set of architectures for which we build the Shenandoah garbage collector
-%global shenandoah_arches x86_64 %{aarch64}
+%global shenandoah_arches x86_64 %{aarch64} riscv64
 # Set of architectures for which we build the Z garbage collector
-%global zgc_arches x86_64
+%global zgc_arches x86_64 riscv64
 # Set of architectures for which alt-java has SSB mitigation
 %global ssbd_arches x86_64
 # Set of architectures for which java has short vector math library (libjsvml.so)
@@ -161,7 +161,7 @@
 # Set of architectures for which we have a devkit
 # Only used on RHEL
 %if 0%{?centos} == 0
-%global devkit_arches %{aarch64} %{ppc64le} s390x x86_64
+%global devkit_arches %{aarch64} %{ppc64le} riscv64 s390x x86_64
 %endif
 
 # By default, we build a slowdebug build during main build on JIT architectures
@@ -300,6 +300,10 @@
 %global archinstall aarch64
 %global stapinstall arm64
 %endif
+%ifarch riscv64
+%global archinstall riscv64
+%global stapinstall %{_target_cpu}
+%endif
 # 32 bit sparc, optimized for v9
 %ifarch sparcv9
 %global archinstall sparc
@@ -325,7 +329,7 @@
 # New Version-String scheme-style defines
 %global featurever 21
 %global interimver 0
-%global updatever 6
+%global updatever 8
 %global patchver 0
 # buildjdkver is usually same as %%{featurever},
 # but in time of bootstrap of next jdk, it is featurever-1,
@@ -375,7 +379,7 @@
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      6.0.0pre00-c848b93a8598
 # Define current Git revision for the FIPS support patches
-%global fipsver 0a42e29b391
+%global fipsver 9203d50836c
 # Define JDK versions
 %global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
 %global javaver         %{featurever}
@@ -389,7 +393,7 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{vcstag}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        7
+%global buildver        9
 %global rpmrelease      1
 #%%global tagsuffix     %%{nil}
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
@@ -540,7 +544,7 @@
 %if 0%{?centos} == 0
 ExclusiveArch: %{devkit_arches}
 %else
-ExclusiveArch: %{aarch64} %{ppc64le} s390x x86_64
+ExclusiveArch: %{aarch64} %{ppc64le} riscv64 s390x x86_64
 %endif
 
 Name:    java-%{javaver}-%{origin}-portable%{?pkgos:-%{pkgos}}
@@ -756,17 +760,17 @@ BuildRequires: libpng-devel
 BuildRequires: zlib-devel
 %else
 # Version in src/java.desktop/share/legal/freetype.md
-Provides: bundled(freetype) = 2.13.2
+Provides: bundled(freetype) = 2.13.3
 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
 Provides: bundled(giflib) = 5.2.2
 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h
-Provides: bundled(harfbuzz) = 8.2.2
+Provides: bundled(harfbuzz) = 10.4.0
 # Version in src/java.desktop/share/native/liblcms/lcms2.h
-Provides: bundled(lcms2) = 2.16.0
+Provides: bundled(lcms2) = 2.17.0
 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h
 Provides: bundled(libjpeg) = 6b
 # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h
-Provides: bundled(libpng) = 1.6.43
+Provides: bundled(libpng) = 1.6.47
 # Version in src/java.base/share/native/libzip/zlib/zlib.h
 Provides: bundled(zlib) = 1.3.1
 # We link statically against libstdc++ to increase portability
@@ -1935,6 +1939,74 @@ done
 %endif
 
 %changelog
+* Thu Jul 10 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.9-1.1
+- Update to jdk-21.0.8+9 (GA)
+- Update release notes to 21.0.8+9
+- Switch to GA mode
+- ** This tarball is embargoed until 2025-07-15 @ 1pm PT. **
+
+* Thu Jul 10 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.8-0.1.ea
+- Update to jdk-21.0.8+8 (EA)
+- Update release notes to 21.0.8+8
+
+* Wed Jul 09 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.2-0.1.ea
+- Update to jdk-21.0.8+2 (EA)
+- Update release notes to 21.0.8+2
+- Add timezone data update check to openjdk_news.sh
+- Add duplicate check to openjdk_news.sh
+- Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh
+- Related: OPENJDK-3949
+
+* Tue Jul 08 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.1-0.1.ea
+- Update get_bundle_versions.sh to match other scripts
+- * get_bundle_versions.sh: Add license
+- * get_bundle_versions.sh: Set compile-command in Emacs
+- * get_bundle_versions.sh: Use different error codes for different failures
+- * get_bundle_versions.sh: Remove unneeded '.' in JPEG version
+- * get_bundle_versions.sh: shellcheck: Double-quote variable references (SC2086)
+- * get_bundle_versions.sh: shellcheck: Drop use of cat and pass file to awk directly (SC2002)
+- Add OpenJDK 8u support to get_bundle_versions.sh
+- Print bundle updates and backouts at end of openjdk_news.sh output
+- Refer user to get_bundle_versions.sh when bundle updates are found by openjdk_news.sh
+- Resolves: OPENJDK-3949
+
+* Tue Jul 08 2025 Antonio Vieiro <avieirov@redhat.com> - 1:21.0.8.0.1-0.1.ea
+- Add script to obtain bundled library versions from OpenJDK sources
+- Related: OPENJDK-3949
+
+* Tue Jul 08 2025 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.8.0.1-0.1.ea
+- Warn about bundled provide version bumps and backouts in openjdk_news.sh
+- Related: OPENJDK-3949
+
+* Tue Jul 08 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.1-0.1.ea
+- Update to jdk-21.0.8+1 (EA)
+- Update release notes to 21.0.8+1
+- Bump freetype version to 2.13.3 following JDK-8348596
+- Bump harfbuzz version to 10.4.0 following JDK-8348597
+- Bump lcms2 version to 2.17.0 following JDK-8348110
+- Bump libpng version to 1.6.47 following JDK-8348598
+- Switch to EA mode
+- Drop JDK-8351500 local patch which is now available in 21.0.8+1 upstream
+
+* Fri Jul 04 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.7.0.6-3
+- Move riscv64 addition to ExclusiveArch to devkit_arches on RHEL
+- Related: OPENJDK-3850
+
+* Tue May 20 2025 Kashyap Chamarthy <kchamart@redhat.com> - 1:21.0.7.0.6-3
+- Enable riscv64 arch; thanks: Songsong Zhang <U2FsdGVkX1@gmail.com>
+- Resolves: OPENJDK-3850
+
+* Thu May 08 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.7.0.6-2
+- Add local version of JDK-8351500 for early interim release before 21.0.8
+- Resolves: OPENJDK-3679
+
+* Fri Apr 11 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.7.0.6-1
+- Update to jdk-21.0.7+6 (GA)
+- Update release notes to 21.0.7+6
+- Rebase FIPS support against 21.0.7+5
+- ** This tarball is embargoed until 2025-04-15 @ 1pm PT. **
+- Resolves: OPENJDK-3789
+
 * Sat Jan 11 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.6.0.7-1
 - Update to jdk-21.0.6+7 (GA)
 - Update release notes to 21.0.6+7

java-21-openjdk.spec

@@ -308,7 +308,7 @@
 # New Version-String scheme-style defines
 %global featurever 21
 %global interimver 0
-%global updatever 6
+%global updatever 8
 %global patchver 0
 # We don't add any LTS designator for STS packages (Fedora and EPEL).
 # We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined.
@@ -344,7 +344,7 @@
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      6.0.0pre00-c848b93a8598
 # Define current Git revision for the FIPS support patches
-%global fipsver 0a42e29b391
+%global fipsver 9203d50836c
 # Define JDK versions
 %global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
 %global javaver         %{featurever}
@@ -365,7 +365,7 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{vcstag}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        7
+%global buildver        9
 %global rpmrelease      1
 # Settings used by the portable build
 %global portablerelease 1
@@ -1138,6 +1138,10 @@ OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release
 %if 0%{?rhel} >= 8 || 0%{?fedora} > 0
 Recommends: gtk3%{?_isa}
 %endif
+# Recommend PipeWire for screenshots under Wayland.
+%if 0%{?rhel} >= 9 || 0%{?fedora} > 0
+Recommends: pipewire%{?_isa}
+%endif
 
 Provides: java-%{javaver}-%{origin}%{?1} = %{epoch}:%{version}-%{release}
 
@@ -1159,8 +1163,8 @@ Requires: ca-certificates
 # Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros
 Requires: javapackages-filesystem
 # Require zone-info data provided by tzdata-java sub-package
-# 2024a required as of JDK-8325150
-Requires: tzdata-java >= 2024a
+# 2025a required as of JDK-8347965
+Requires: tzdata-java >= 2025a
 # for support of kernel stream control
 # libsctp.so.1 is being `dlopen`ed on demand
 Requires: lksctp-tools%{?_isa}
@@ -1450,6 +1454,8 @@ Patch1001: fips-%{featurever}u-%{fipsver}.patch
 #
 #############################################
 
+# Currently empty
+
 #############################################
 #
 # Portable build specific patches
@@ -1507,8 +1513,8 @@ BuildRequires: %{pkgnameroot}-misc = %{epoch}:%{version}-%{prelease}.%{portables
 %ifarch %{zero_arches}
 BuildRequires: libffi-devel
 %endif
-# 2024a required as of JDK-8325150
-BuildRequires: tzdata-java >= 2024a
+# 2025a required as of JDK-8347965
+BuildRequires: tzdata-java >= 2025a
 # Earlier versions have a bug in tree vectorization on PPC
 BuildRequires: gcc >= 4.8.3-8
 
@@ -1527,17 +1533,17 @@ BuildRequires: libpng-devel
 BuildRequires: zlib-devel
 %else
 # Version in src/java.desktop/share/legal/freetype.md
-Provides: bundled(freetype) = 2.13.2
+Provides: bundled(freetype) = 2.13.3
 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
 Provides: bundled(giflib) = 5.2.2
 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h
-Provides: bundled(harfbuzz) = 8.2.2
+Provides: bundled(harfbuzz) = 10.4.0
 # Version in src/java.desktop/share/native/liblcms/lcms2.h
-Provides: bundled(lcms2) = 2.16.0
+Provides: bundled(lcms2) = 2.17.0
 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h
 Provides: bundled(libjpeg) = 6b
 # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h
-Provides: bundled(libpng) = 1.6.43
+Provides: bundled(libpng) = 1.6.47
 # Version in src/java.base/share/native/libzip/zlib/zlib.h
 Provides: bundled(zlib) = 1.3.1
 %endif
@@ -2561,6 +2567,86 @@ cjc.mainProgram(args)
 %endif
 
 %changelog
+* Thu Jul 10 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.9-1.1
+- Update to jdk-21.0.8+9 (GA)
+- Update release notes to 21.0.8+9
+- Switch to GA mode
+- Sync the copy of the portable specfile with the latest update
+- ** This tarball is embargoed until 2025-07-15 @ 1pm PT. **
+- Resolves: RHEL-102289
+
+* Thu Jul 10 2025 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.7.0.6-3
+- Recommend PipeWire on RHEL 9 and later for java.awt.Robot screenshots under Wayland
+- Resolves: RHEL-102677
+
+* Thu Jul 10 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.8-0.1.ea
+- Update to jdk-21.0.8+8 (EA)
+- Update release notes to 21.0.8+8
+- Sync the copy of the portable specfile with the latest update
+- Resolves: RHEL-101798
+
+* Wed Jul 09 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.2-0.1.ea
+- Update to jdk-21.0.8+2 (EA)
+- Update release notes to 21.0.8+2
+- Sync the copy of the portable specfile with the latest update
+- Add timezone data update check to openjdk_news.sh
+- Add duplicate check to openjdk_news.sh
+- Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh
+- Related: RHEL-101798
+- Resolves: RHEL-103209
+
+* Wed Jul 09 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.1-0.1.ea
+- Update get_bundle_versions.sh to match other scripts
+- * get_bundle_versions.sh: Add license
+- * get_bundle_versions.sh: Set compile-command in Emacs
+- * get_bundle_versions.sh: Use different error codes for different failures
+- * get_bundle_versions.sh: Remove unneeded '.' in JPEG version
+- * get_bundle_versions.sh: shellcheck: Double-quote variable references (SC2086)
+- * get_bundle_versions.sh: shellcheck: Drop use of cat and pass file to awk directly (SC2002)
+- Add OpenJDK 8u support to get_bundle_versions.sh
+- Print bundle updates and backouts at end of openjdk_news.sh output
+- Refer user to get_bundle_versions.sh when bundle updates are found by openjdk_news.sh
+- Related: RHEL-103209
+
+* Wed Jul 09 2025 Antonio Vieiro <avieirov@redhat.com> - 1:21.0.8.0.1-0.1.ea
+- Add script to obtain bundled library versions from OpenJDK sources
+- Related: RHEL-103209
+
+* Wed Jul 09 2025 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.8.0.1-0.1.ea
+- Warn about bundled provide version bumps and backouts in openjdk_news.sh
+- Related: RHEL-103209
+
+* Wed Jul 09 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.1-0.1.ea
+- Update to jdk-21.0.8+1 (EA)
+- Update release notes to 21.0.8+1
+- Bump freetype version to 2.13.3 following JDK-8348596
+- Bump harfbuzz version to 10.4.0 following JDK-8348597
+- Bump lcms2 version to 2.17.0 following JDK-8348110
+- Bump libpng version to 1.6.47 following JDK-8348598
+- Switch to EA mode
+- Drop JDK-8351500 local patch which is now available in 21.0.8+1 upstream
+- Sync the copy of the portable specfile with the latest update
+- Related: RHEL-101798
+
+* Thu May 08 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.7.0.6-2
+- Add local version of JDK-8351500 for early interim release before 21.0.8
+- Sync the copy of the portable specfile with the latest update
+- Resolves: RHEL-90309
+
+* Fri Apr 11 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.7.0.6-1
+- Update to jdk-21.0.7+6 (GA)
+- Update release notes to 21.0.7+6
+- Rebase FIPS support against 21.0.7+5
+- Require tzdata 2025a due to upstream inclusion of JDK-8347965
+- Sync the copy of the portable specfile with the latest update
+- ** This tarball is embargoed until 2025-04-15 @ 1pm PT. **
+- Resolves: RHEL-86984
+- Resolves: RHEL-86635
+
+* Thu Feb 06 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.6.0.7-2
+- Bump tzdata requirement to 2024b for JDK-8339637
+- Resolves: RHEL-74001
+
 * Sat Jan 18 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.6.0.7-1
 - Update to jdk-21.0.6+7 (GA)
 - Update release notes to 21.0.6+7

rpminspect.yaml

@@ -0,0 +1,3 @@
+---
+inspections:
+    javabytecode: off

scripts/builds/build_centos.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds the RPM on CentOS 9 or 10
+
+centpkg -v build
+
+# Local Variables:
+# compile-command: "shellcheck build_centos.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/build_centos_portable_build.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds the portable on CentOS
+
+centpkg -v build --target java-openjdk-portable-build --rhel-target none
+
+# Local Variables:
+# compile-command: "shellcheck build_centos_portable_build.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/build_rhel_10.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds the RPM on RHEL 10
+
+NVR=${1}
+USER=${2}
+
+if test "${NVR}" = ""; then
+    echo "${0} <NVR> <USER>";
+    exit 1;
+fi
+
+if test "${USER}" = ""; then
+    echo "${0} <NVR> <USER>";
+    exit 2;
+fi
+
+METADATA="{\"osci\": {\"upstream_nvr\": \"${NVR}\", \"upstream_owner_name\": \"${USER}\"}, \"rhel-target\": \"latest\"}"
+rhpkg -v build --target=java-openjdk-rhel-10-build --custom-user-metadata "${METADATA}"
+
+# Local Variables:
+# compile-command: "shellcheck build_rhel_10.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/build_rhel_7_portable_build.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds the portable on RHEL 7
+
+rhpkg -v build --target=java-openjdk-rhel-7-build --skip-nvr-check
+
+# Local Variables:
+# compile-command: "shellcheck build_rhel_7_portable_build.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/build_rhel_8.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds the RPM on RHEL 8
+
+NVR=${1}
+USER=${2}
+
+if test "${NVR}" = ""; then
+    echo "${0} <NVR> <USER>";
+    exit 1;
+fi
+
+if test "${USER}" = ""; then
+    echo "${0} <NVR> <USER>";
+    exit 2;
+fi
+
+METADATA="{\"osci\": {\"upstream_nvr\": \"${NVR}\", \"upstream_owner_name\": \"${USER}\"}, \"rhel-target\": \"latest\"}"
+rhpkg -v build --target=java-openjdk-rhel-8-build --custom-user-metadata "${METADATA}"
+
+# Local Variables:
+# compile-command: "shellcheck build_rhel_8.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/build_rhel_9.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds the RPM on RHEL 9
+
+NVR=${1}
+USER=${2}
+
+if test "${NVR}" = ""; then
+    echo "${0} <NVR> <USER>";
+    exit 1;
+fi
+
+if test "${USER}" = ""; then
+    echo "${0} <NVR> <USER>";
+    exit 2;
+fi
+
+METADATA="{\"osci\": {\"upstream_nvr\": \"${NVR}\", \"upstream_owner_name\": \"${USER}\"}, \"rhel-target\": \"latest\"}"
+rhpkg -v build --target=java-openjdk-rhel-9-build --custom-user-metadata "${METADATA}"
+
+# Local Variables:
+# compile-command: "shellcheck build_rhel_9.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/build_rhel_portable_build.sh

@@ -0,0 +1,29 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds the portable on RHEL 8
+
+rhpkg -v build --target=java-openjdk-rhel-8-build --skip-nvr-check
+
+# Local Variables:
+# compile-command: "shellcheck build_rhel_portable_build.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/build_vanilla.sh

@@ -0,0 +1,43 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds a scratch build of vanilla OpenJDK with no local patches
+
+SEPARATE_ARCHES=${1}
+CMD="--target java-openjdk-rhel-8-build --skip-nvr-check --nowait";
+SUPPORTED_ARCHES="aarch64 ppc64le s390x x86_64";
+
+if [ "x${SEPARATE_ARCHES}" = "x" ] ; then
+    SEPARATE_ARCHES=0;
+fi
+
+if [ ${SEPARATE_ARCHES} -eq 1 ] ; then
+	for arch in ${SUPPORTED_ARCHES}; do \
+	    rhpkg -v build --arches ${arch} --scratch ${CMD} ; \
+	done && brew watch-task --mine
+else
+    rhpkg -v build ${CMD} && brew watch-task --mine
+fi
+
+# Local Variables:
+# compile-command: "shellcheck build_vanilla.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/discover_trees.sh

@@ -0,0 +1,61 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by Andrew John Hughes <gnu.andrew@redhat.com>.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+TREE=${1}
+
+if test "${TREE}" = ""; then
+    TREE=${PWD}
+fi
+
+if [ -e "${TREE}"/nashorn/.hg ] || [ -e "${TREE}"/nashorn/merge.changeset ] ; then
+    NASHORN="nashorn" ;
+fi
+
+if [ -e "${TREE}"/corba/.hg ] || [ -e "${TREE}"/corba/merge.changeset ] ; then
+    CORBA="corba";
+fi
+
+if [ -e "${TREE}"/jaxp/.hg ] || [ -e "${TREE}"/jaxp/merge.changeset ] ; then
+    JAXP="jaxp";
+fi
+
+if [ -e "${TREE}"/jaxws/.hg ] || [ -e "${TREE}"/jaxws/merge.changeset ] ; then
+    JAXWS="jaxws";
+fi
+
+if [ -e "${TREE}"/langtools/.hg ] || [ -e "${TREE}"/langtools/merge.changeset ] ; then
+    LANGTOOLS="langtools";
+fi
+
+if [ -e "${TREE}"/jdk/.hg ] || [ -e "${TREE}"/jdk/merge.changeset ] ; then
+    JDK="jdk";
+fi
+
+if [ -e "${TREE}"/hotspot/.hg ] || [ -e "${TREE}"/hotspot/merge.changeset ] ; then
+    HOTSPOT="hotspot";
+fi
+
+SUBTREES="${CORBA} ${JAXP} ${JAXWS} ${LANGTOOLS} ${NASHORN} ${JDK} ${HOTSPOT}";
+echo "${SUBTREES}"
+
+# Local Variables:
+# compile-command: "shellcheck discover_trees.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/generate_source_tarball.sh

@@ -0,0 +1,294 @@
+#!/bin/bash
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#     Thomas Fitzsimmons <fitzsim@redhat.com>
+#     Jiri Vanek <jvanek@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Generates the source tarball for OpenJDK projects.
+#
+# There are multiple ways to specify the source code location and version:
+#
+# 1. Specify the version (VERSION), the location of the Git repository
+#    (REPO_ROOT) and the root of the output tarball name (FILE_NAME_ROOT)
+# 2. Specify the version (VERSION) along with an upstream project name
+#    (PROJECT_NAME) and repository name (REPO_NAME) that can be used
+#    to construct the URL of the upstream OpenJDK repository.
+# 3. Specify OPENJDK_LATEST=1 and allow the script to obtain the JDK
+#    feature version from the spec file, which is then used to
+#    obtain the latest build promotion from the upstream repository.
+#
+# An appropriate bootstrap JDK is also required for when ./configure
+# is run within the checked out repository to generate the .src-rev.
+# file. This can be specified by setting BOOT_JDK.
+#
+# Example 1:
+# This will check out the specified version from the specified
+# repository and construct a tarball called openjdk-17.0.3+5.tar.xz:
+#
+# $ VERSION=jdk-17.0.3+5 FILE_NAME_ROOT=open${VERSION} \
+#   REPO_ROOT=$HOME/projects/openjdk/upstream/17u \
+#   BOOT_JDK=/usr/lib/jvm/java-17-openjdk ./generate_source_tarball.sh
+#
+# Example 2:
+# This will check out the same version as example 1, but from the
+# upstream repository:
+#
+# $ VERSION=jdk-17.0.3+5 PROJECT_NAME=openjdk REPO_NAME=jdk17u \
+#   BOOT_JDK=/usr/lib/jvm/java-17-openjdk ./generate_source_tarball.sh
+#
+# Example 3:
+# This will read the OpenJDK feature version from the spec file, then create a
+# tarball from the most recent tag for that version in the upstream Git
+# repository.
+#
+# $ OPENJDK_LATEST=1 \
+#   BOOT_JDK=/usr/lib/jvm/java-17-openjdk ./generate_source_tarball.sh
+#
+
+set -e
+
+OPENJDK_URL_DEFAULT=https://github.com
+COMPRESSION_DEFAULT=xz
+
+if [ "$1" = "help" ] ; then
+    echo "Behaviour may be specified by setting the following variables:"
+    echo
+    echo "VERSION        - the version of the specified OpenJDK project"
+    echo "                 (required unless OPENJDK_LATEST is set)"
+    echo "PROJECT_NAME   - the name of the OpenJDK project being archived"
+    echo "                 (needed to compute REPO_ROOT and/or"
+    echo "                  FILE_NAME_ROOT automatically;"
+    echo "                  optional if they are set explicitly)"
+    echo "REPO_NAME      - the name of the OpenJDK repository"
+    echo "                 (needed to compute REPO_ROOT automatically;"
+    echo "                  optional if REPO_ROOT is set explicitly)"
+    echo "OPENJDK_URL    - the URL to retrieve code from"
+    echo "                 (defaults to ${OPENJDK_URL_DEFAULT})"
+    echo "COMPRESSION    - the compression type to use"
+    echo "                 (defaults to ${COMPRESSION_DEFAULT})"
+    echo "FILE_NAME_ROOT - name of the archive, minus extensions"
+    echo "                 (defaults to PROJECT_NAME-VERSION)"
+    echo "REPO_ROOT      - the location of the Git repository to archive"
+    echo "                 (defaults to OPENJDK_URL/PROJECT_NAME/REPO_NAME.git)"
+    echo "TO_COMPRESS    - what part of clone to pack"
+    echo "                 (defaults to ${VERSION})"
+    echo "BOOT_JDK       - the bootstrap JDK to satisfy the configure run"
+    echo "                 (defaults to packaged JDK version)"
+    echo "WITH_TEMP      - run in a temporary directory"
+    echo "                 (defaults to disabled)"
+    echo "OPENJDK_LATEST - deduce VERSION from most recent upstream tag"
+    echo "                 (implies WITH_TEMP, computes everything else"
+    echo "                  automatically; Note: accesses network to read"
+    echo "                  tag list from remote Git repository)"
+    exit 1;
+fi
+
+if [ "$OPENJDK_LATEST" != "" ] ; then
+    FEATURE_VERSION=$(echo '%featurever' \
+                          | rpmspec --shell ./*.spec 2>/dev/null \
+                          | grep --after-context 1 featurever \
+                          | tail --lines 1)
+    PROJECT_NAME=openjdk
+    REPO_NAME=jdk"${FEATURE_VERSION}"u
+    # Skip -ga tags since those are the same as the most recent non-ga tag, and
+    # the non-ga tag is the one that is used to generated the official source
+    # tarball.  For example:
+    # ca760c86642aa2e0d9b571aaabac054c0239fbdc  refs/tags/jdk-17.0.10-ga^{}
+    # 25a2e6c20c9a96853714284cabc6b456eb095070  refs/tags/jdk-17.0.10-ga
+    # ca760c86642aa2e0d9b571aaabac054c0239fbdc  refs/tags/jdk-17.0.10+7^{}
+    # e49c5749b10f3e90274b72e9279f794fdd191d27  refs/tags/jdk-17.0.10+7
+    VERSION=$(git ls-remote --tags --refs --sort=-version:refname \
+                  "${OPENJDK_URL_DEFAULT}/${PROJECT_NAME}/${REPO_NAME}.git" \
+                  "jdk-${FEATURE_VERSION}*" \
+                  | grep --invert-match '\-ga$' \
+                  | head --lines 1 | cut --characters 52-)
+    FILE_NAME_ROOT=open${VERSION}
+    WITH_TEMP=1
+fi
+
+if [ "$WITH_TEMP" != "" ] ; then
+    pushd "$(mktemp --directory --tmpdir temp-generated-source-tarball-XXX)"
+fi
+
+if [ "$VERSION" = "" ] ; then
+    echo "No VERSION specified"
+    exit 2
+fi
+echo "Version: ${VERSION}"
+
+NUM_VER=${VERSION##jdk-}
+RELEASE_VER=${NUM_VER%%+*}
+BUILD_VER=${NUM_VER##*+}
+MAJOR_VER=${RELEASE_VER%%.*}
+echo "Major version is ${MAJOR_VER}, release ${RELEASE_VER}, build ${BUILD_VER}"
+
+if [ "$BOOT_JDK" = "" ] ; then
+    echo "No boot JDK specified".
+    BOOT_JDK=/usr/lib/jvm/java-${MAJOR_VER}-openjdk;
+    echo -n "Checking for ${BOOT_JDK}...";
+    if [ -d "${BOOT_JDK}" ] && [ -x "${BOOT_JDK}"/bin/java ] ; then
+        echo "Boot JDK found at ${BOOT_JDK}";
+    else
+        echo "Not found";
+        PREV_VER=$((MAJOR_VER - 1));
+        BOOT_JDK=/usr/lib/jvm/java-${PREV_VER}-openjdk;
+        echo -n "Checking for ${BOOT_JDK}...";
+        if [ -d ${BOOT_JDK} ] && [ -x ${BOOT_JDK}/bin/java ] ; then
+            echo "Boot JDK found at ${BOOT_JDK}";
+        else
+            echo "Not found";
+            exit 4;
+        fi
+    fi
+else
+    echo "Boot JDK: ${BOOT_JDK}";
+fi
+
+if [ "$OPENJDK_URL" = "" ] ; then
+    OPENJDK_URL=${OPENJDK_URL_DEFAULT}
+    echo "No OpenJDK URL specified; defaulting to ${OPENJDK_URL}"
+else
+    echo "OpenJDK URL: ${OPENJDK_URL}"
+fi
+
+if [ "$COMPRESSION" = "" ] ; then
+    # rhel 5 needs tar.gz
+    COMPRESSION=${COMPRESSION_DEFAULT}
+fi
+echo "Creating a tar.${COMPRESSION} archive"
+
+if [ "$FILE_NAME_ROOT" = "" ] ; then
+    if [ "$PROJECT_NAME" = "" ] ; then
+        echo "No PROJECT_NAME specified, needed by FILE_NAME_ROOT"
+        exit 1
+    fi
+    FILE_NAME_ROOT=${PROJECT_NAME}-${VERSION}
+    echo "No file name root specified; default to ${FILE_NAME_ROOT}"
+fi
+if [ "$REPO_ROOT" = "" ] ; then
+    if [ "$PROJECT_NAME" = "" ] ; then
+        echo "No PROJECT_NAME specified, needed by REPO_ROOT"
+        exit 1
+    fi
+    if [ "$REPO_NAME" = "" ] ; then
+        echo "No REPO_NAME specified, needed by REPO_ROOT"
+        exit 3
+    fi
+    REPO_ROOT="${OPENJDK_URL}/${PROJECT_NAME}/${REPO_NAME}.git"
+    echo "No repository root specified; default to ${REPO_ROOT}"
+fi;
+
+if [ "$TO_COMPRESS" = "" ] ; then
+    TO_COMPRESS="${VERSION}"
+    echo "No targets to be compressed specified ; default to ${TO_COMPRESS}"
+fi;
+
+echo -e "Settings:"
+echo -e "\tVERSION: ${VERSION}"
+echo -e "\tPROJECT_NAME: ${PROJECT_NAME}"
+echo -e "\tREPO_NAME: ${REPO_NAME}"
+echo -e "\tOPENJDK_URL: ${OPENJDK_URL}"
+echo -e "\tCOMPRESSION: ${COMPRESSION}"
+echo -e "\tFILE_NAME_ROOT: ${FILE_NAME_ROOT}"
+echo -e "\tREPO_ROOT: ${REPO_ROOT}"
+echo -e "\tTO_COMPRESS: ${TO_COMPRESS}"
+echo -e "\tBOOT_JDK: ${BOOT_JDK}"
+echo -e "\tWITH_TEMP: ${WITH_TEMP}"
+echo -e "\tOPENJDK_LATEST: ${OPENJDK_LATEST}"
+
+if [ -d "${FILE_NAME_ROOT}" ] ; then
+    echo "Reusing existing ${FILE_NAME_ROOT}"
+    STAT_TIME="$(stat --format=%Y "${FILE_NAME_ROOT}")"
+    TAR_TIME="$(date --date=@"${STAT_TIME}" --iso-8601=seconds)"
+else
+    mkdir "${FILE_NAME_ROOT}"
+    pushd "${FILE_NAME_ROOT}"
+        echo "Cloning ${VERSION} root repository from ${REPO_ROOT}"
+        if realpath -q "${REPO_ROOT}"; then
+            echo "Local path detected; not adding depth argument";
+            DEPTH="--";
+        else
+            DEPTH="--depth=1";
+            echo "Remote repository detected; adding ${DEPTH}";
+        fi
+        git clone -b "${VERSION}" "${DEPTH}" "${REPO_ROOT}" "${VERSION}"
+        pushd "${VERSION}"
+            TAR_TIME="$(git log --max-count 1 --format=%cI)"
+        popd
+    popd
+fi
+pushd "${FILE_NAME_ROOT}"
+    # Generate .src-rev so build has knowledge of the revision the tarball was
+    # created from
+    mkdir build
+    pushd build
+        sh "${PWD}"/../"${VERSION}"/configure --with-boot-jdk="${BOOT_JDK}"
+        make store-source-revision
+    popd
+    rm -rf build
+
+    # Remove commit checks
+    echo "Removing $(find "${VERSION}" -name '.jcheck' -print)"
+    find "${VERSION}" -name '.jcheck' -print0 | xargs -0 rm -r
+
+    # Remove history and GHA
+    echo "find ${VERSION} -name '.hgtags'"
+    find "${VERSION}" -name '.hgtags' -exec rm -v '{}' '+'
+    echo "find ${VERSION} -name '.hgignore'"
+    find "${VERSION}" -name '.hgignore' -exec rm -v '{}' '+'
+    echo "find ${VERSION} -name '.gitattributes'"
+    find "${VERSION}" -name '.gitattributes' -exec rm -v '{}' '+'
+    echo "find ${VERSION} -name '.gitignore'"
+    find "${VERSION}" -name '.gitignore' -exec rm -v '{}' '+'
+    # Work around some Git objects not having write permissions.
+    echo "chmod --recursive u+w ${VERSION}/.git"
+    chmod --recursive u+w "${VERSION}"/.git
+    echo "find ${VERSION} -name '.git'"
+    find "${VERSION}" -name '.git' -exec rm -rv '{}' '+'
+    echo "find ${VERSION} -name '.github'"
+    find "${VERSION}" -name '.github' -exec rm -rv '{}' '+'
+
+    echo "Compressing remaining forest"
+    if [ "$COMPRESSION" = "xz" ] ; then
+        SWITCH=cJf
+    else
+        SWITCH=czf
+    fi
+    EA_PART="$(awk -F= \
+               '/^DEFAULT_PROMOTED_VERSION_PRE/ { if ($2) print "-"$2 }' \
+               "${VERSION}"/make/conf/version-numbers.conf)"
+    TARBALL_NAME=${FILE_NAME_ROOT}${EA_PART}.tar.${COMPRESSION}
+    XZ_OPT=${XZ_OPT-"-T0"} \
+          tar --mtime="${TAR_TIME}" --owner=root --group=root --sort=name \
+          --exclude-vcs -$SWITCH "${TARBALL_NAME}" "${TO_COMPRESS}"
+    mv "${TARBALL_NAME}" ..
+popd
+if [ "$WITH_TEMP" != "" ] ; then
+    echo "Tarball is: $(realpath .)/${TARBALL_NAME}"
+    popd
+else
+    echo -n "Done. You may want to remove the uncompressed version"
+    echo " - $FILE_NAME_ROOT"
+fi
+
+# Local Variables:
+# compile-command: "shellcheck generate_source_tarball.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/get_bundle_versions.sh

@@ -0,0 +1,172 @@
+#!/usr/bin/env sh
+
+# Copyright (C) 2025 Red Hat, Inc.
+# Original written by Antonio Vieiro <avieirov@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+if [ $# -ne 1 ]; then
+    echo "Usage: $0 openjdk-root-directory"
+    exit 1
+fi
+
+JDKROOT=$1
+
+if [ ! -d "${JDKROOT}" ] ; then
+    echo "${JDKROOT} is not a directory.";
+    exit 2
+fi
+
+# Work out the OpenJDK version
+# OpenJDK >= 10 has its version in the build machinery
+# OpenJDK >= 17 stores it in a new location (JDK-8258246)
+VERSION_FILE="${JDKROOT}"/make/conf/version-numbers.conf
+printf "Checking for %s..." "${VERSION_FILE}";
+if [ ! -f "${VERSION_FILE}" ] ; then
+    VERSION_FILE="${JDKROOT}"/make/autoconf/version-numbers
+    echo "Not found; using old version file ${VERSION_FILE}";
+else
+    echo "found.";
+fi
+if [ -e "${VERSION_FILE}" ] ; then
+    openjdk_version=$(grep '^DEFAULT_VERSION_FEATURE' "${VERSION_FILE}" | cut -d '=' -f 2)
+elif [ -e "${JDKROOT}"/jdk/src/java.base/share/classes/java/lang/Object.java ] ; then
+    openjdk_version=9;
+elif [ -e "${JDKROOT}"/common/autoconf ] ; then
+    openjdk_version=8;
+else
+    openjdk_version=7;
+fi
+echo "OpenJDK version: ${openjdk_version}";
+
+#
+# Freetype
+#
+if [ "${openjdk_version}" -gt 8 ] ; then
+    FREETYPE=src/java.desktop/share/native/libfreetype/include/freetype/freetype.h
+    ABS_FREETYPE="${JDKROOT}"/"${FREETYPE}"
+    if [ ! -f "${ABS_FREETYPE}" ]; then
+        echo "Freetype header not found!"
+        exit 2
+    fi
+    FREETYPE_VERSION=$(awk '/#define FREETYPE_MAJOR/ {MAJOR=$3} /#define FREETYPE_MINOR/ {MINOR=$3} /#define FREETYPE_PATCH/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_FREETYPE}")
+else
+    echo "No bundled FreeType on ${openjdk_version}";
+fi
+
+# giflib
+if [ "${openjdk_version}" -gt 8 ] ; then
+    GIFLIB=src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
+else
+    GIFLIB=jdk/src/share/native/sun/awt/giflib/gif_lib.h
+fi
+ABS_GIFLIB="${JDKROOT}"/"${GIFLIB}"
+if [ ! -f "${ABS_GIFLIB}" ]; then
+    echo "giflib header not found!"
+    exit 3
+fi
+GIFLIB_VERSION=$(awk '/#define GIFLIB_MAJOR/ {MAJOR=$3} /#define GIFLIB_MINOR/ {MINOR=$3} /#define GIFLIB_RELEASE/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_GIFLIB}")
+
+# harfbuzz
+if [ "${openjdk_version}" -gt 8 ] ; then
+    HARFBUZZ=src/java.desktop/share/native/libharfbuzz/hb-version.h
+    ABS_HARFBUZZ="${JDKROOT}/${HARFBUZZ}"
+    if [ ! -f "${ABS_HARFBUZZ}" ]; then
+        echo "HarfBuzz header not found!"
+        exit 4
+    fi
+    HARFBUZZ_VERSION=$(awk '/#define HB_VERSION_MAJOR/ {MAJOR=$3} /#define HB_VERSION_MINOR/ {MINOR=$3} /#define HB_VERSION_MICRO/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_HARFBUZZ}")
+else
+    echo "No HarfBuzz on ${openjdk_version}";
+fi
+
+# lcms
+if [ "${openjdk_version}" -gt 8 ] ; then
+    LCMS=src/java.desktop/share/native/liblcms/lcms2.h
+else
+    LCMS=jdk/src/share/native/sun/java2d/cmm/lcms/lcms2.h
+fi
+ABS_LCMS="${JDKROOT}"/"${LCMS}"
+if [ ! -f "${ABS_LCMS}" ]; then
+    echo "lcms header not found!"
+    exit 5
+fi
+LCMS_VERSION=$(awk '/#define LCMS_VERSION/ { MAJOR=int($3 / 1000); REST=$3 % 1000; MINOR=int(REST / 10); PATCH=REST % 10; } END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_LCMS}")
+
+# jpeg
+if [ "${openjdk_version}" -gt 8 ] ; then
+    JPEG=src/java.desktop/share/native/libjavajpeg/jpeglib.h
+else
+    JPEG=jdk/src/share/native/sun/awt/image/jpeg/jpeglib.h
+fi
+ABS_JPEG="${JDKROOT}"/"${JPEG}"
+if [ ! -f "${ABS_JPEG}" ]; then
+    echo "jpeg header not found!"
+    exit 6
+fi
+JPEG_VERSION=$(awk '/#define JPEG_LIB_VERSION/ { VERSION=$3; MAJOR=int(VERSION / 10); MINOR=VERSION%10; } END {printf "%s%c", MAJOR, (MINOR+96)}' "${ABS_JPEG}")
+
+# png
+if [ "${openjdk_version}" -gt 8 ] ; then
+    PNG=src/java.desktop/share/native/libsplashscreen/libpng/png.h
+else
+    PNG=jdk/src/share/native/sun/awt/libpng/png.h
+fi
+ABS_PNG="${JDKROOT}"/"${PNG}"
+if [ ! -f "${ABS_PNG}" ]; then
+    echo "png header not found!"
+    exit 7
+fi
+PNG_VERSION=$(awk '/#define PNG_LIBPNG_VER_STRING/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_PNG}")
+
+# zlib
+if [ "${openjdk_version}" -gt 8 ] ; then
+    ZLIB=src/java.base/share/native/libzip/zlib/zlib.h
+else
+    ZLIB=jdk/src/share/native/java/util/zip/zlib/zlib.h
+fi
+ABS_ZLIB="${JDKROOT}"/"${ZLIB}"
+if [ ! -f "${ABS_ZLIB}" ]; then
+    echo "zlib header not found!"
+    exit 8
+fi
+ZLIB_VERSION=$(awk '/#define ZLIB_VERSION/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_ZLIB}")
+
+# Print output
+printf "\nRPM definitions:\n"
+if [ "${openjdk_version}" -gt 8 ] ; then
+    echo "# Version in ${FREETYPE}"
+    echo "Provides: bundled(freetype) = ${FREETYPE_VERSION}"
+fi
+echo "# Version in ${GIFLIB}"
+echo "Provides: bundled(giflib) = ${GIFLIB_VERSION}"
+if [ "${openjdk_version}" -gt 8 ] ; then
+    echo "# Version in ${HARFBUZZ}"
+    echo "Provides: bundled(harfbuzz) = ${HARFBUZZ_VERSION}"
+fi
+echo "# Version in ${LCMS}"
+echo "Provides: bundled(lcms2) = ${LCMS_VERSION}"
+echo "# Version in ${JPEG}"
+echo "Provides: bundled(libjpeg) = ${JPEG_VERSION}"
+echo "# Version in ${PNG}"
+echo "Provides: bundled(libpng) = ${PNG_VERSION}"
+echo "# Version in ${ZLIB}"
+echo "Provides: bundled(zlib) = ${ZLIB_VERSION}"
+
+# Local Variables:
+# compile-command: "shellcheck get_bundle_versions.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/icedtea_sync.sh

@@ -0,0 +1,198 @@
+#!/bin/bash
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by Andrew John Hughes <gnu.andrew@redhat.com>.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+ICEDTEA_USE_VCS=true
+
+ICEDTEA_VERSION=3.15.0
+ICEDTEA_URL=https://icedtea.classpath.org/download/source
+ICEDTEA_SIGNING_KEY=CFDA0F9B35964222
+
+ICEDTEA_HG_URL=https://icedtea.classpath.org/hg/icedtea11
+set -e
+
+RPM_DIR=${PWD}
+if [ ! -f "${RPM_DIR}/jconsole.desktop.in" ] ; then
+    echo "Not in RPM source tree.";
+    exit 1;
+fi
+
+if test "${TMPDIR}" = ""; then
+    TMPDIR=/tmp;
+fi
+WORKDIR=${TMPDIR}/it.sync
+
+echo "Using working directory ${WORKDIR}"
+mkdir "${WORKDIR}"
+pushd "${WORKDIR}"
+
+if test "${WGET}" = ""; then
+    WGET=$(which wget);
+    if test "${WGET}" = ""; then
+	echo "wget not found";
+	exit 1;
+    fi
+fi
+
+if test "${TAR}" = ""; then
+    TAR=$(which tar)
+    if test "${TAR}" = ""; then
+	echo "tar not found";
+	exit 2;
+    fi
+fi
+
+echo "Dependencies:";
+echo -e "\tWGET: ${WGET}";
+echo -e "\tTAR: ${TAR}\n";
+
+if test "${ICEDTEA_USE_VCS}" = "true"; then
+    echo "Mode: Using VCS";
+
+    if test "${GREP}" = ""; then
+	GREP=$(which grep);
+	if test "${GREP}" = ""; then
+	    echo "grep not found";
+	    exit 3;
+	fi
+    fi
+
+    if test "${CUT}" = ""; then
+	CUT=$(which cut);
+	if test "${CUT}" = ""; then
+	    echo "cut not found";
+	    exit 4;
+	fi
+    fi
+
+    if test "${TR}" = ""; then
+	TR=$(which tr);
+	if test "${TR}" = ""; then
+	    echo "tr not found";
+	    exit 5;
+	fi
+    fi
+
+    if test "${HG}" = ""; then
+	HG=$(which hg);
+	if test "${HG}" = ""; then
+	    echo "hg not found";
+	    exit 6;
+	fi
+    fi
+
+    echo "Dependencies:";
+    echo -e "\tGREP: ${GREP}";
+    echo -e "\tCUT: ${CUT}";
+    echo -e "\tTR: ${TR}";
+    echo -e "\tHG: ${HG}";
+
+    echo "Checking out repository from VCS...";
+    ${HG} clone ${ICEDTEA_HG_URL} icedtea
+
+    echo "Obtaining version from configure.ac...";
+    ROOT_VER=$(${GREP} '^AC_INIT' icedtea/configure.ac|${CUT} -d ',' -f 2|${TR} -d '[][:space:]')
+    echo "Root version from configure: ${ROOT_VER}";
+
+    VCS_REV=$(${HG} log -R icedtea --template '{node|short}' -r tip)
+    echo "VCS revision: ${VCS_REV}";
+
+    ICEDTEA_VERSION="${ROOT_VER}-${VCS_REV}"
+    echo "Creating icedtea-${ICEDTEA_VERSION}";
+    mkdir "icedtea-${ICEDTEA_VERSION}"
+    echo "Copying required files from checkout to icedtea-${ICEDTEA_VERSION}";
+    # Commented out for now as IcedTea 6's jconsole.desktop.in is outdated
+    #cp -a icedtea/jconsole.desktop.in ../icedtea-${ICEDTEA_VERSION}
+    cp -a "${RPM_DIR}/jconsole.desktop.in" "icedtea-${ICEDTEA_VERSION}"
+    cp -a icedtea/tapset "icedtea-${ICEDTEA_VERSION}"
+
+    rm -rf icedtea
+else
+    echo "Mode: Using tarball";
+
+    if test "${ICEDTEA_VERSION}" = ""; then
+	echo "No IcedTea version specified for tarball download.";
+	exit 3;
+    fi
+
+    if test "${CHECKSUM}" = ""; then
+	CHECKSUM=$(which sha256sum)
+	if test "${CHECKSUM}" = ""; then
+	    echo "sha256sum not found";
+	    exit 4;
+	fi
+    fi
+
+    if test "${PGP}" = ""; then
+	PGP=$(which gpg)
+	if test "${PGP}" = ""; then
+	    echo "gpg not found";
+	    exit 5;
+	fi
+    fi
+
+    echo "Dependencies:";
+    echo -e "\tCHECKSUM: ${CHECKSUM}";
+    echo -e "\tPGP: ${PGP}\n";
+
+    echo "Checking for IcedTea signing key ${ICEDTEA_SIGNING_KEY}...";
+    if ! gpg --list-keys ${ICEDTEA_SIGNING_KEY}; then
+	echo "IcedTea signing key ${ICEDTEA_SIGNING_KEY} not installed.";
+	exit 6;
+    fi
+
+    echo "Downloading IcedTea release tarball...";
+    ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz
+    echo "Downloading IcedTea tarball signature...";
+    ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz.sig
+    echo "Downloading IcedTea tarball checksums...";
+    ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.sha256
+
+    echo "Verifying checksums...";
+    ${CHECKSUM} --check --ignore-missing icedtea-${ICEDTEA_VERSION}.sha256
+
+    echo "Checking signature...";
+    ${PGP} --verify icedtea-${ICEDTEA_VERSION}.tar.xz.sig
+
+    echo "Extracting files...";
+    ${TAR} xJf icedtea-${ICEDTEA_VERSION}.tar.xz \
+       icedtea-${ICEDTEA_VERSION}/tapset \
+       icedtea-${ICEDTEA_VERSION}/jconsole.desktop.in
+
+    rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz
+    rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz.sig
+    rm -vf icedtea-${ICEDTEA_VERSION}.sha256
+fi
+
+echo "Replacing desktop files...";
+mv -v "icedtea-${ICEDTEA_VERSION}/jconsole.desktop.in" "${RPM_DIR}"
+
+echo "Creating new tapset tarball...";
+mv -v "icedtea-${ICEDTEA_VERSION}" openjdk
+${TAR} cJf "${RPM_DIR}/tapsets-icedtea-${ICEDTEA_VERSION}.tar.xz" openjdk
+
+rm -rvf openjdk
+
+popd
+rm -rf "${WORKDIR}"
+
+# Local Variables:
+# compile-command: "shellcheck icedtea_sync.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/openjdk_news.sh

@@ -0,0 +1,114 @@
+#!/bin/bash
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by Andrew John Hughes <gnu.andrew@redhat.com>, 2012-2022
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+OLD_RELEASE=$1
+NEW_RELEASE=$2
+REPO=$3
+SUBDIR=$4
+SCRIPT_DIR=$(dirname "${0}")
+
+if test "${SUBDIR}" = ""; then
+    echo "No subdirectory specified; using .";
+    SUBDIR=".";
+fi
+
+if test "$REPO" = ""; then
+    echo "No repository specified; using ${PWD}"
+    REPO=${PWD}
+fi
+
+if test "${TMPDIR}" = ""; then
+    TMPDIR=/tmp;
+fi
+
+echo "Repository: ${REPO}"
+
+if [ -e "${REPO}/.git" ] ; then
+    TYPE=git;
+elif [ -e "${REPO}/.hg" ] ; then
+    TYPE=hg;
+else
+    echo "No Mercurial or Git repository detected.";
+    exit 1;
+fi
+
+if test "$OLD_RELEASE" = "" || test "$NEW_RELEASE" = ""; then
+    echo "ERROR: Need to specify old and new release";
+    exit 2;
+fi
+
+echo "Listing fixes between $OLD_RELEASE and $NEW_RELEASE in $REPO"
+rm -f "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" "${TMPDIR}/fixes"
+for repos in . $("${SCRIPT_DIR}/discover_trees.sh" "${REPO}");
+do
+    if test "$TYPE" = "hg"; then
+	hg log -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R "$REPO/$repos" -G -M "${REPO}/${SUBDIR}" | \
+	    grep -E '^[o:| ]*summary'|grep -v 'Added tag'|sed -r 's#^[o:| ]*summary:\W*([0-9])#  - JDK-\1#'| \
+	    sed 's#^[o:| ]*summary:\W*#  - #' >> "${TMPDIR}/fixes2";
+	hg log -v -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R "$REPO/$repos" -G -M "${REPO}/${SUBDIR}" | \
+	    grep -E '^[o:| ]*[0-9]{7}'|sed -r 's#^[o:| ]*([0-9]{7})#  - JDK-\1#' >> "${TMPDIR}/fixes3";
+    else
+	git -C "${REPO}" log --no-merges --pretty=format:%B "${NEW_RELEASE}...${OLD_RELEASE}" -- "${SUBDIR}" |grep -E '^[0-9]{7}' | \
+	    sed -r 's#^([0-9])#  - JDK-\1#' >> "${TMPDIR}/fixes2";
+	touch "${TMPDIR}/fixes3" ; # unused
+    fi
+done
+
+sort "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" > "${TMPDIR}/fixes4"
+uniq "${TMPDIR}/fixes4" > "${TMPDIR}/fixes"
+rm -f "${TMPDIR}/fixes2" "${TMPDIR}/fixes3"
+
+if ! [ -s "${TMPDIR}/fixes" ] ; then
+    echo "Failed to obtain fixes.";
+    exit 3;
+fi
+
+echo "In ${TMPDIR}/fixes:"
+cat "${TMPDIR}/fixes"
+
+printf "\nChecking for duplicates...";
+if uniq -d "${TMPDIR}/fixes4" | grep 'JDK' > "${TMPDIR}/dupes"; then
+    printf "found.\nWARNING: Review the following duplicates:\n";
+    cat "${TMPDIR}/dupes";
+else
+    echo "No apparent duplicates.";
+fi
+rm -f "${TMPDIR}/fixes4";
+
+printf "\nChecking for backouts...";
+if grep -i 'backout' "${TMPDIR}/fixes" > "${TMPDIR}/backouts"; then
+    printf "found.\nWARNING: Review the following backouts:\n"
+    cat "${TMPDIR}/backouts";
+else
+    echo "No apparent backouts.";
+fi
+printf "\nChecking for bundled library updates...";
+if grep -iE ':( \(tz\))? update.*(freetype|gif|harfbuzz|lcms|jpeg|png|timezone|zlib)' "${TMPDIR}/fixes" > "${TMPDIR}/bundles"; then
+    printf "found.\nWARNING: Review the following with respect to bundled provides:\n";
+    cat "${TMPDIR}/bundles";
+    echo "Compare the output of $(dirname "${0}")/get_bundle_versions.sh with the RPM using the JDK source tree"
+else
+    echo "No apparent library updates.";
+fi
+
+# Local Variables:
+# compile-command: "shellcheck openjdk_news.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

sources

@@ -0,0 +1,2 @@
+SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
+SHA512 (openjdk-21.0.8+9.tar.xz) = 81be6d151fdca910fbee9ea1a93b20af037d2dbafeb12fa368a6091096a22dcf997cf419bebe0261f016ce0fe1e74acd4fca54ca0840a3d69ad76ae7a1336e4c

tests/tests.yml

@@ -0,0 +1,21 @@
+---
+- hosts: localhost
+  roles:
+  - role: standard-test-source
+    tags:
+    - always
+  - role: standard-test-basic
+    tags:
+    - classic
+    - atomic
+    required_packages:
+    - java-21-openjdk-devel
+    tests:
+      - javaVersion1:
+          dir: ~
+          run: set -ex; useradd franta1;  su franta1 -c 'java -version';
+          run: set -ex; useradd franta4;  su franta4 -c 'javac -version';
+          run: ls -l /usr/lib/jvm;
+      - javaVersion2:
+          dir: ~
+          run: set -ex; useradd franta2;  su franta2 -c 'java --version'