From 78fdbbb4a5331ed6e27d88f7b88d6c3d8c018647 Mon Sep 17 00:00:00 2001 From: Andrew Hughes Date: Fri, 7 Aug 2026 23:41:37 +0100 Subject: [PATCH 1/3] Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1 - Report pkgos value during build ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** Resolves: RHEL-235627 --- .gitignore | 1 + NEWS | 18 ++++++++++++++++++ java-25-openjdk.spec | 14 +++++++++++--- sources | 2 +- 4 files changed, 31 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 55afd28..a26c89e 100644 --- a/.gitignore +++ b/.gitignore @@ -48,3 +48,4 @@ /nssadapter-0.1.1.tar.xz /openjdk-25.0.3+9.tar.xz /openjdk-25.0.4+7.tar.xz +/openjdk-25.0.4.1+1.tar.xz diff --git a/NEWS b/NEWS index 6f683a4..819ef2c 100644 --- a/NEWS +++ b/NEWS @@ -3,6 +3,24 @@ Key: JDK-X - https://bugs.openjdk.java.net/browse/JDK-X CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY +New in release OpenJDK 25.0.4.1 (2026-08-18): +============================================= +Live versions of these release notes can be found at: + * https://bit.ly/openjdk25041 + +* CVEs + - CVE-2026-60589 + - CVE-2026-61308 + - CVE-2026-70906 + - CVE-2026-70907 +* Changes + - JDK-8382471: Improve Resource Resolving + - JDK-8384708: Enhance HTTP Connections + - JDK-8386205: Enhance TLS server + - JDK-8386298: Improve font loading + - JDK-8388788: Bump update version for OpenJDK: jdk-25.0.4.1 + - JDK-8389945: [25u] Remove designator DEFAULT_PROMOTED_VERSION_PRE=ea for release 25.0.4.1 + New in release OpenJDK 25.0.4 (2026-07-21): =========================================== Live versions of these release notes can be found at: diff --git a/java-25-openjdk.spec b/java-25-openjdk.spec index e16112c..5ba02ef 100644 --- a/java-25-openjdk.spec +++ b/java-25-openjdk.spec @@ -7,9 +7,9 @@ %global featurever 25 %global interimver 0 %global updatever 4 -%global patchver 0 -%global buildver 7 -%global portablerelease 2 +%global patchver 1 +%global buildver 1 +%global portablerelease 1 %global rpmrelease 1 # Define IcedTea version used for SystemTap tapsets and desktop file @@ -1867,6 +1867,7 @@ The %{origin_nice} %{featurever} cryptography adapter library. echo "Preparing %{oj_vendor_version}" echo "System is RHEL=%{?rhel}%{!?rhel:0}, CentOS=%{?centos}%{!?centos:0}, EPEL=%{?epel}%{!?epel:0}, Fedora=%{?fedora}%{!?fedora:0}" +echo "Portable suffix is %{?pkgos}%{!?pkgos:unset}" # Using the echo macro breaks rpmdev-bumpspec, as it parses the first line of stdout :-( %if 0%{?stapinstall:1} @@ -2595,6 +2596,13 @@ exit 0 %endif %changelog +* Fri Aug 07 2026 Andrew Hughes - 1:25.0.4.1.1-1.1 +- Update to jdk-25.0.4.1+1 (GA) +- Update release notes to 25.0.4.1+1 +- Report pkgos value during build +- ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** +- Resolves: RHEL-235627 + * Thu Jul 23 2026 Andrew Hughes - 1:25.0.4.0.7-2.1 - Add CVEs to NEWS file - Update to tarball with final changeset ID diff --git a/sources b/sources index 33c44a9..bdecbd3 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30 SHA512 (nssadapter-0.1.1.tar.xz) = 2b4675cfbfa2ccb6c9a4870a4b58ae555267f5b8c9bdb0cf37b075483e6e9ea929561c05070453cf0d67b0b029de5408274555bf2ff50e9533219e898b2717f9 -SHA512 (openjdk-25.0.4+7.tar.xz) = 736949ba57d6e36df1b4f85418b2a27d3e0aec7e4b492ef5d9c006355ede63db3f5f9e0e0ea2d63bea119d9baaa9cf5a92e14dad19e69e9351072ef0955ea2cf +SHA512 (openjdk-25.0.4.1+1.tar.xz) = e5f0aeec7d52671869ed46fda5c59f041d321c0ad989861a2eb2eb70b513bba9e297e09aa70256f26af6c3ac0269c8aaacc134fe49cbba99b9035e158b90fca0 From a36c6aeb52c719ad0f753eff5c010bfb8b292f5b Mon Sep 17 00:00:00 2001 From: Andrew Hughes Date: Wed, 12 Aug 2026 23:38:40 +0100 Subject: [PATCH 2/3] Sync the copy of the portable specfile with the latest update Related: RHEL-235627 --- java-25-openjdk-portable.specfile | 40 ++++++++++++++++++++++++++----- java-25-openjdk.spec | 1 + 2 files changed, 35 insertions(+), 6 deletions(-) diff --git a/java-25-openjdk-portable.specfile b/java-25-openjdk-portable.specfile index a27545c..431ccb4 100644 --- a/java-25-openjdk-portable.specfile +++ b/java-25-openjdk-portable.specfile @@ -2,9 +2,9 @@ %global featurever 25 %global interimver 0 %global updatever 4 -%global patchver 0 -%global buildver 7 -%global portablerelease 2 +%global patchver 1 +%global buildver 1 +%global portablerelease 1 %global rpmrelease 0 # Define IcedTea version used for SystemTap tapsets and desktop file @@ -25,8 +25,16 @@ %global top_level_dir_name %{vcstag} %global top_level_dir_name_backup %{top_level_dir_name}-backup # Define an optional suffix for the OS this package is built on -%if 0%{?rhel} == 7 -%global pkgos rhel7 +# The portable package is intended to be built on either RHEL 8 +# or CentOS Stream 9; any other OS will automatically get an +# appropriate suffix +%global rhel_buildos 8 +%global centos_buildos 9 +%if 0%{?centos} == 0 && 0%{?rhel} != 0%{rhel_buildos} +%global pkgos rhel%{?rhel} +%endif +%if 0%{?centos} != 0 && 0%{?centos} != 0%{centos_buildos} +%global pkgos rhel%{?centos} %endif # Define milestone (EA for pre-releases, GA for releases) @@ -235,7 +243,7 @@ URL: http://openjdk.java.net/ # Set of architectures for which we have a devkit # Only used on RHEL %if 0%{?centos} == 0 -%global devkit_arches %{aarch64} %{ppc64le} riscv64 s390x x86_64 +%global devkit_arches %{aarch64} %{ppc64le} s390x x86_64 %endif # By default, we build a slowdebug build during main build on JIT architectures @@ -539,8 +547,14 @@ URL: http://openjdk.java.net/ # Define the architectures on which we build # On RHEL, this should be the architectures with a devkit +# The exception is riscv64, which was introduced too recently +# for a devkit to exist. In that case, we build without devkit %if 0%{?centos} == 0 +%if 0%{?rhel} >= 10 +ExclusiveArch: %{devkit_arches} riscv64 +%else ExclusiveArch: %{devkit_arches} +%endif %else ExclusiveArch: %{aarch64} %{ppc64le} s390x x86_64 riscv64 %endif @@ -861,6 +875,7 @@ The %{origin_nice} %{featurever} miscellany. # Using the echo macro breaks rpmdev-bumpspec, as it parses the first line of stdout :-( echo "Preparing %{oj_vendor_version}" echo "System is RHEL=%{?rhel}%{!?rhel:0}, CentOS=%{?centos}%{!?centos:0}, EPEL=%{?epel}%{!?epel:0}, Fedora=%{?fedora}%{!?fedora:0}" +echo "Portable suffix is %{?pkgos}%{!?pkgos:unset}" echo "Build JDK version is %{buildjdkver}, bootstrap JDK package is %{bootjdkpkg}" %if 0%{?stapinstall:1} @@ -1879,6 +1894,19 @@ done %endif %changelog +* Fri Aug 07 2026 Andrew Hughes - 1:25.0.4.1.1-1.0 +- Update to jdk-25.0.4.1+1 (GA) +- Update release notes to 25.0.4.1+1 +- Make rhel usage in pkgos optional as it may be undefined +- Simplify pkgos conditional to work on RHEL 8 +- ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** + +* Fri Aug 07 2026 Andrea Bolognani - 1:25.0.4.0.7-3.0 +- Automatically set pkgos when necessary +- Don't attempt to use devkit on riscv64 +- Resolves: OPENJDK-5030 +- Resolves: OPENJDK-5031 + * Thu Jul 23 2026 Andrew Hughes - 1:25.0.4.0.7-2.0 - Add CVEs to NEWS file - Update to tarball with final changeset ID diff --git a/java-25-openjdk.spec b/java-25-openjdk.spec index 5ba02ef..fc68a39 100644 --- a/java-25-openjdk.spec +++ b/java-25-openjdk.spec @@ -2600,6 +2600,7 @@ exit 0 - Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1 - Report pkgos value during build +- Sync the copy of the portable specfile with the latest update - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** - Resolves: RHEL-235627 From 34f6172404fa50398bbfaf33c222a86f5c9e41af Mon Sep 17 00:00:00 2001 From: Andrew Hughes Date: Sun, 23 Aug 2026 13:50:31 +0100 Subject: [PATCH 3/3] Sync the copy of the portable specfile with the latest update Related: RHEL-235627 --- java-25-openjdk-portable.specfile | 7 ++++++- java-25-openjdk.spec | 6 +++++- 2 files changed, 11 insertions(+), 2 deletions(-) diff --git a/java-25-openjdk-portable.specfile b/java-25-openjdk-portable.specfile index 431ccb4..245ed26 100644 --- a/java-25-openjdk-portable.specfile +++ b/java-25-openjdk-portable.specfile @@ -4,7 +4,7 @@ %global updatever 4 %global patchver 1 %global buildver 1 -%global portablerelease 1 +%global portablerelease 2 %global rpmrelease 0 # Define IcedTea version used for SystemTap tapsets and desktop file @@ -1894,12 +1894,17 @@ done %endif %changelog +* Thu Aug 20 2026 Andrew Hughes - 1:25.0.4.1.1-2.0 +- Add CVEs for August 2026 release +- Related: OPENJDK-5043 + * Fri Aug 07 2026 Andrew Hughes - 1:25.0.4.1.1-1.0 - Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1 - Make rhel usage in pkgos optional as it may be undefined - Simplify pkgos conditional to work on RHEL 8 - ** This tarball is embargoed until 2026-08-18 @ 1pm PT. ** +- Resolves: OPENJDK-5043 * Fri Aug 07 2026 Andrea Bolognani - 1:25.0.4.0.7-3.0 - Automatically set pkgos when necessary diff --git a/java-25-openjdk.spec b/java-25-openjdk.spec index fc68a39..0996614 100644 --- a/java-25-openjdk.spec +++ b/java-25-openjdk.spec @@ -9,7 +9,7 @@ %global updatever 4 %global patchver 1 %global buildver 1 -%global portablerelease 1 +%global portablerelease 2 %global rpmrelease 1 # Define IcedTea version used for SystemTap tapsets and desktop file @@ -2596,6 +2596,10 @@ exit 0 %endif %changelog +* Sun Aug 23 2026 Andrew Hughes - 1:25.0.4.1.1-2.1 +- Sync the copy of the portable specfile with the latest update +- Related: RHEL-235627 + * Fri Aug 07 2026 Andrew Hughes - 1:25.0.4.1.1-1.1 - Update to jdk-25.0.4.1+1 (GA) - Update release notes to 25.0.4.1+1