diff --git a/.gitignore b/.gitignore index 2a74071..0e4f3a3 100644 --- a/.gitignore +++ b/.gitignore @@ -42,3 +42,4 @@ /openjdk-23.0.2+7.tar.xz /openjdk-24.0.2+12.tar.xz /openjdk-25+36.tar.xz +/openjdk-25.0.1+8.tar.xz diff --git a/NEWS b/NEWS index 5c1733e..0a4a628 100644 --- a/NEWS +++ b/NEWS @@ -3,6 +3,95 @@ Key: JDK-X - https://bugs.openjdk.java.net/browse/JDK-X CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY +New in release OpenJDK 25.0.1 (2025-10-21): +=========================================== + +* CVEs + - CVE-2025-53057 + - CVE-2025-53066 + - CVE-2025-61748 +* Changes + - JDK-8315131: Clarify VarHandle set/get access on 32-bit platforms + - JDK-8352637: Enhance bytecode verification + - JDK-8356294: Enhance Path Factories + - JDK-8356587: Missing object ID X in pool jdk.types.Method + - JDK-8357826: Avoid running some jtreg tests when asan is configured + - JDK-8358452: JNI exception pending in Java_sun_awt_screencast_ScreencastHelper_remoteDesktopKeyImpl of screencast_pipewire.c:1214 (ID: 51119) + - JDK-8358577: Test serviceability/jvmti/thread/GetCurrentContendedMonitor/contmon01/contmon01.java failed: unexpexcted monitor object + - JDK-8358819: The first year is not displayed correctly in Japanese Calendar + - JDK-8359059: Bump version numbers for 25.0.1 + - JDK-8359218: RISC-V: Only enable CRC32 intrinsic when AvoidUnalignedAccess == false + - JDK-8359270: C2: alignment check should consider base offset when emitting arraycopy runtime call + - JDK-8359454: Enhance String handling + - JDK-8359596: Behavior change when both -Xlint:options and -Xlint:-options flags are given + - JDK-8360179: RISC-V: Only enable BigInteger intrinsics when AvoidUnalignedAccess == false + - JDK-8360533: ContainerRuntimeVersionTestUtils fromVersionString fails with some docker versions + - JDK-8360647: [XWayland] [OL10] NumPad keys are not triggered + - JDK-8360679: Shenandoah: AOT saved adapter calls into broken GC barrier stub + - JDK-8360937: Enhance certificate handling + - JDK-8361212: Remove AffirmTrust root CAs + - JDK-8361532: RISC-V: Several vector tests fail after JDK-8354383 + - JDK-8361829: [TESTBUG] RISC-V: compiler/vectorization/runner/BasicIntOpTest.java fails with RVV but not Zvbb + - JDK-8362109: Change milestone to fcs for all releases + - JDK-8362882: Update SubmissionPublisher() specification to reflect use of ForkJoinPool.asyncCommonPool() + - JDK-8366223: ZGC: ZPageAllocator::cleanup_failed_commit_multi_partition is broken + - JDK-8367031: [backout] Change java.time month/day field types to 'byte' + - JDK-8368308: ISO 4217 Amendment 180 Update + +Notes on individual issues: +=========================== + +core-libs/java.io:serialization: + +JDK-8367031: [backout] Change java.time month/day field types to 'byte' +======================================================================= +In the initial release of OpenJDK 25, attempting to read serialised +Class objects created by earlier versions of OpenJDK for several of +the `java.time` classes would fail with a +`InvalidClassException`. Similarly, `java.time` Class objects +serialised with OpenJDK 25 could not be read by older OpenJDK +versions. This was due to the type of the day and month fields in +these classes being changed to `byte`. This change has now been +reverted and compatibility between OpenJDK 25 and older versions +restored. + +Note that this incompatibility occurred with the `Class` object and +not an instance of the object i.e. `writeObject(LocalDate.class)` +would produce incompatible serialised data, but +`writeObject(LocalDate.now())` would not. + +security-libs/java.security: + +JDK-8361212: Remove AffirmTrust root CAs +======================================== +The following root certificates from AffirmTrust, which were +deactivated in the 21.0.5 release of October 2024, have been removed +from the `cacerts` keystore: + +Alias name: affirmtrustcommercialca [jdk] +CN=AffirmTrust Commercial +O=AffirmTrust +C=US +SHA256: 03:76:AB:1D:54:C5:F9:80:3C:E4:B2:E2:01:A0:EE:7E:EF:7B:57:B6:36:E8:A9:3C:9B:8D:48:60:C9:6F:5F:A7 + +Alias name: affirmtrustnetworkingca [jdk] +CN=AffirmTrust Networking +O=AffirmTrust +C=US +SHA256: 0A:81:EC:5A:92:97:77:F1:45:90:4A:F3:8D:5D:50:9F:66:B5:E2:C5:8F:CD:B5:31:05:8B:0E:17:F3:F0B4:1B + +Alias name: affirmtrustpremiumca [jdk] +CN=AffirmTrust Premium +O=AffirmTrust +C=US +SHA256: 70:A7:3F:7F:37:6B:60:07:42:48:90:45:34:B1:14:82:D5:BF:0E:69:8E:CC:49:8D:F5:25:77:EB:F2:E9:3B:9A + +Alias name: affirmtrustpremiumeccca [jdk] +CN=AffirmTrust Premium ECC +O=AffirmTrust +C=US +SHA256: BD:71:FD:F6:DA:97:E4:CF:62:D1:64:7A:DD:25:81:B0:7D:79:AD:F8:39:7E:B4:EC:BA:9C:5E:84:88:82:14:23 + New in release OpenJDK 25.0.0 (2025-09-16): =========================================== Major changes are listed below. Some changes may have been backported diff --git a/java-25-openjdk-portable.specfile b/java-25-openjdk-portable.specfile index 3a562c3..0b18950 100644 --- a/java-25-openjdk-portable.specfile +++ b/java-25-openjdk-portable.specfile @@ -334,15 +334,14 @@ %endif # New Version-String scheme-style defines -%global featurever 24 -%global fakefeaturever 25 +%global featurever 25 %global interimver 0 -%global updatever 2 +%global updatever 1 %global patchver 0 # buildjdkver is usually same as %%{featurever}, # but in time of bootstrap of next jdk, it is featurever-1, # and this it is better to change it here, on single place -%global buildjdkver %(expr %{featurever} - 1) +%global buildjdkver %{featurever} # We don't add any LTS designator for STS packages (Fedora and EPEL). # We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined. %if 0%{?rhel} && !0%{?epel} @@ -380,8 +379,7 @@ %global fipsver 9203d50836c # Define JDK versions %global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver} -# Force 25 until we are actually ready to build that JDK version -%global javaver %{fakefeaturever} +%global javaver %{featurever} # Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames %global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn}) # The tag used to create the OpenJDK tarball @@ -392,7 +390,7 @@ %global origin_nice OpenJDK %global top_level_dir_name %{vcstag} %global top_level_dir_name_backup %{top_level_dir_name}-backup -%global buildver 12 +%global buildver 8 %global rpmrelease 1 #%%global tagsuffix %%{nil} # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit @@ -428,16 +426,16 @@ %endif # parametrized macros are order-sensitive -%global compatiblename java-%{fakefeaturever}-%{origin} +%global compatiblename java-%{featurever}-%{origin} %global fullversion %{compatiblename}-%{version}-%{release} # images directories from upstream build %global jdkimage jdk %global static_libs_image static-libs # output dir stub -%define buildoutputdir() %{expand:build/jdk%{fakefeaturever}.build%{?1}} -%define installoutputdir() %{expand:install/jdk%{fakefeaturever}.install%{?1}} +%define buildoutputdir() %{expand:build/jdk%{featurever}.build%{?1}} +%define installoutputdir() %{expand:install/jdk%{featurever}.install%{?1}} %global altjavaoutputdir install/altjava.install -%define packageoutputdir() %{expand:packages/jdk%{fakefeaturever}.packages%{?1}} +%define packageoutputdir() %{expand:packages/jdk%{featurever}.packages%{?1}} # we can copy the javadoc to not arched dir, or make it not noarch %define uniquejavadocdir() %{expand:%{fullversion}.%{_arch}%{?1}} # main id and dir of this jdk @@ -461,7 +459,7 @@ %define miscportablearchive() %{miscportablename}.tar.xz # JDK to use for bootstrapping -%global bootjdkpkg java-%{fakefeaturever}-openjdk +%global bootjdkpkg java-%{featurever}-%{origin} %ifarch %{fastdebug_arches} %global bootdebugpkg fastdebug %endif @@ -746,7 +744,7 @@ BuildRequires: zip BuildRequires: tar BuildRequires: unzip BuildRequires: javapackages-filesystem -BuildRequires: %{bootjdkpkg}-portable-devel%{?bootdebugpkg:-%{bootdebugpkg}} +BuildRequires: %{bootjdkpkg}-portable-devel%{?bootdebugpkg:-%{bootdebugpkg}} >= %{buildjdkver} # Zero-assembler build requirement %ifarch %{zero_arches} BuildRequires: libffi-devel @@ -1080,7 +1078,7 @@ pushd %{_jvmdir} sha256sum --check %{bootjdkzip}.sha256sum popd tar -xJf %{bootjdkzip} -mv java-%{fakefeaturever}-openjdk-%{buildjdkver}* %{bootjdk} +mv java-%{featurever}-openjdk-%{buildjdkver}* %{bootjdk} # Print release information echo "Installed boot JDK:" cat %{bootjdk}/release @@ -1969,6 +1967,21 @@ done %endif %changelog +* Mon Nov 10 2025 Andrew Hughes - 1:25.0.1.0.8-1 +- Update to jdk-25.0.1+8 (GA) +- Update release notes to 25.0.1+8 +- Related: RHELBU-3203 + +* Mon Nov 10 2025 Andrew Hughes - 1:25.0.0.0.36-2 +- Drop fakefeaturever and rebuild with ourselves now we have reached OpenJDK 25 +- Related: RHELBU-3203 + +* Sun Nov 09 2025 Andrew Hughes - 1:25.0.0.0.36-1 +- Update to jdk-25.0.0+36 (GA) +- Update release notes with features of JDK 25 +- Mention finalisation JEP for features finalised in JDK 22, 23 & 24 +- Resolves: RHELBU-3203 + * Wed Nov 05 2025 Andrew Hughes - 1:24.0.2.0.12-1 - Update to jdk-24.0.2+12 (GA) - Update release notes with features of JDK 24 diff --git a/sources b/sources index c58df78..81afaec 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30 -SHA512 (openjdk-25+36.tar.xz) = 062f55acdcccb32dd62377dce9573a70b0535312f2f69cb660be1d321b52ad3e24ef9c333055434b19e6fedb94dd5a1408addfb7e5f47d36664587ab1c12a22b +SHA512 (openjdk-25.0.1+8.tar.xz) = eb84d876f81ca02803283e8294c89b6acbed3753426811c3bcc228615c9618deefc85da4aa702800cac2feb103e628ee8b92292b316e9d7e12a58b6de69c5085