diff --git a/.gitignore b/.gitignore
index 2bac8a5..55afd28 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,50 @@
-nssadapter-0.1.1.tar.xz
-openjdk-25.0.4+7.tar.xz
-tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz
+/openjdk-jdk17u-jdk-17.0.7+7.tar.xz
+/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz
+/openjdk-jdk18u-jdk-18.0.1+0.tar.xz
+/openjdk-jdk18u-jdk-18.0.1+10.tar.xz
+/openjdk-jdk18u-jdk-18.0.1.1+2.tar.xz
+/openjdk-jdk18u-jdk-18.0.2+9.tar.xz
+/openjdk-jdk19u-jdk-19+36.tar.xz
+/openjdk-jdk19u-jdk-19.0.1+10.tar.xz
+/openjdk-jdk19u-jdk-19.0.2+7.tar.xz
+/openjdk-jdk20u-jdk-20+36.tar.xz
+/openjdk-jdk20u-jdk-20.0.1+9.tar.xz
+/openjdk-jdk20u-jdk-20.0.2+9.tar.xz
+/openjdk-jdk21u-jdk-21+35.tar.xz
+/openjdk-21.0.1+12.tar.xz
+/openjdk-21.0.2+11.tar.xz
+/openjdk-21.0.2+12.tar.xz
+/openjdk-21.0.2+13.tar.xz
+/openjdk-21.0.3+1-ea.tar.xz
+/openjdk-21.0.3+7-ea.tar.xz
+/openjdk-21.0.3+9.tar.xz
+/openjdk-21.0.4+1-ea.tar.xz
+/openjdk-21.0.4+5-ea.tar.xz
+/openjdk-21.0.4+7.tar.xz
+/openjdk-21.0.5+1-ea.tar.xz
+/openjdk-21.0.5+5-ea.tar.xz
+/openjdk-21.0.5+9-ea.tar.xz
+/openjdk-21.0.5+10.tar.xz
+/openjdk-21.0.5+11.tar.xz
+/openjdk-21.0.6+6-ea.tar.xz
+/openjdk-21.0.6+7.tar.xz
+/openjdk-21.0.7+1-ea.tar.xz
+/openjdk-21.0.7+2-ea.tar.xz
+/openjdk-21.0.7+3-ea.tar.xz
+/openjdk-21.0.7+4-ea.tar.xz
+/openjdk-21.0.7+5-ea.tar.xz
+/openjdk-21.0.7+6.tar.xz
+/openjdk-21.0.8+1-ea.tar.xz
+/openjdk-21.0.8+2-ea.tar.xz
+/openjdk-21.0.8+8-ea.tar.xz
+/openjdk-21.0.8+9.tar.xz
+/openjdk-22.0.2+9.tar.xz
+/openjdk-23.0.2+7.tar.xz
+/openjdk-24.0.2+12.tar.xz
+/openjdk-25+36.tar.xz
+/openjdk-25.0.1+8.tar.xz
+/nssadapter-0.1.0.tar.xz
+/openjdk-25.0.2+10.tar.xz
+/nssadapter-0.1.1.tar.xz
+/openjdk-25.0.3+9.tar.xz
+/openjdk-25.0.4+7.tar.xz
diff --git a/NEWS b/NEWS
index 66eba57..6f683a4 100644
--- a/NEWS
+++ b/NEWS
@@ -9,6 +9,15 @@ Live versions of these release notes can be found at:
   * https://bit.ly/openjdk2504
 
 * CVEs
+  - CVE-2026-46968
+  - CVE-2026-46917
+  - CVE-2026-47010
+  - CVE-2026-47021
+  - CVE-2026-47027
+  - CVE-2026-60147
+  - CVE-2026-47059
+  - CVE-2026-47063
+  - CVE-2026-41254
 * Changes
   - JDK-7184899: Test sun/java2d/X11SurfaceData/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fail
   - JDK-8015444: java/awt/Focus/KeyStrokeTest.java sometimes fails
@@ -273,7 +282,6 @@ security-libs/javax.crypto:
 
 JDK-8347938: Add Support for the Latest ML-KEM and ML-DSA Private Key Encodings
 ===============================================================================
-
 This release of OpenJDK adds support for encoding ML-KEM and ML-DSA
 keys to PKCS#8 format using the DER-encoded ASN.1 CHOICE formats
 defined in Section 6, "Private Key Format" of RFC 9935 [0] and RFC
diff --git a/gating.yaml b/gating.yaml
new file mode 100644
index 0000000..8b4e87d
--- /dev/null
+++ b/gating.yaml
@@ -0,0 +1,7 @@
+# recipients: java-qa
+--- !Policy
+product_versions:
+  - rhel-10
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: osci.brew-build.tier0.functional}
diff --git a/java-25-openjdk-portable.specfile b/java-25-openjdk-portable.specfile
index 63e4fe6..9a21239 100644
--- a/java-25-openjdk-portable.specfile
+++ b/java-25-openjdk-portable.specfile
@@ -4,7 +4,7 @@
 %global updatever 4
 %global patchver 0
 %global buildver 7
-%global portablerelease 1
+%global portablerelease 2
 %global rpmrelease 0
 
 # Define IcedTea version used for SystemTap tapsets and desktop file
@@ -1879,9 +1879,14 @@ done
 %endif
 
 %changelog
-* Thu Jul 23 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 1:25.0.4.0.7-1.0
+* Thu Jul 30 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 1:25.0.4.0.7-2.0
 - Portable build
 
+* Thu Jul 23 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.4.0.7-2.0
+- Add CVEs to NEWS file
+- Update to tarball with final changeset ID
+- Related: OPENJDK-4865
+
 * Thu Jul 16 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.4.0.7-1.0
 - Update to jdk-25.0.4+7 (GA)
 - Update release notes to 25.0.4+7
diff --git a/rpminspect.yaml b/rpminspect.yaml
new file mode 100644
index 0000000..901c0fb
--- /dev/null
+++ b/rpminspect.yaml
@@ -0,0 +1,4 @@
+---
+inspections:
+    javabytecode: off
+    abidiff: off
diff --git a/scripts/builds/build_centos.sh b/scripts/builds/build_centos.sh
new file mode 100755
index 0000000..5625b93
--- /dev/null
+++ b/scripts/builds/build_centos.sh
@@ -0,0 +1,29 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds the RPM on CentOS 9 or 10
+
+centpkg -v build
+
+# Local Variables:
+# compile-command: "shellcheck build_centos.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/builds/build_centos_portable_build.sh b/scripts/builds/build_centos_portable_build.sh
new file mode 100755
index 0000000..41eb62f
--- /dev/null
+++ b/scripts/builds/build_centos_portable_build.sh
@@ -0,0 +1,29 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds the portable on CentOS
+
+centpkg -v build --target java-openjdk-portable-build --rhel-target none
+
+# Local Variables:
+# compile-command: "shellcheck build_centos_portable_build.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/builds/build_rhel_10.sh b/scripts/builds/build_rhel_10.sh
new file mode 100755
index 0000000..2e52c28
--- /dev/null
+++ b/scripts/builds/build_rhel_10.sh
@@ -0,0 +1,43 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds the RPM on RHEL 10
+
+NVR=${1}
+USER=${2}
+
+if test "${NVR}" = ""; then
+    echo "${0} <NVR> <USER>";
+    exit 1;
+fi
+
+if test "${USER}" = ""; then
+    echo "${0} <NVR> <USER>";
+    exit 2;
+fi
+
+METADATA="{\"osci\": {\"upstream_nvr\": \"${NVR}\", \"upstream_owner_name\": \"${USER}\"}, \"rhel-target\": \"latest\"}"
+rhpkg -v build --target=java-openjdk-rhel-10-build --custom-user-metadata "${METADATA}"
+
+# Local Variables:
+# compile-command: "shellcheck build_rhel_10.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/builds/build_rhel_9.sh b/scripts/builds/build_rhel_9.sh
new file mode 100755
index 0000000..a39e35f
--- /dev/null
+++ b/scripts/builds/build_rhel_9.sh
@@ -0,0 +1,43 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds the RPM on RHEL 9
+
+NVR=${1}
+USER=${2}
+
+if test "${NVR}" = ""; then
+    echo "${0} <NVR> <USER>";
+    exit 1;
+fi
+
+if test "${USER}" = ""; then
+    echo "${0} <NVR> <USER>";
+    exit 2;
+fi
+
+METADATA="{\"osci\": {\"upstream_nvr\": \"${NVR}\", \"upstream_owner_name\": \"${USER}\"}, \"rhel-target\": \"latest\"}"
+rhpkg -v build --target=java-openjdk-rhel-9-build --custom-user-metadata "${METADATA}"
+
+# Local Variables:
+# compile-command: "shellcheck build_rhel_9.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/builds/build_rhel_portable_build.sh b/scripts/builds/build_rhel_portable_build.sh
new file mode 100755
index 0000000..3fd6a22
--- /dev/null
+++ b/scripts/builds/build_rhel_portable_build.sh
@@ -0,0 +1,29 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds the portable on RHEL 8
+
+rhpkg -v build --target=java-openjdk-rhel-8-build --skip-nvr-check
+
+# Local Variables:
+# compile-command: "shellcheck build_rhel_portable_build.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/builds/build_vanilla.sh b/scripts/builds/build_vanilla.sh
new file mode 100755
index 0000000..933f8c8
--- /dev/null
+++ b/scripts/builds/build_vanilla.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Builds a scratch build of vanilla OpenJDK with no local patches
+
+SEPARATE_ARCHES=${1}
+CMD=(rhpkg -v build --target java-openjdk-rhel-8-build --skip-nvr-check --nowait);
+SUPPORTED_ARCHES="aarch64 ppc64le s390x x86_64";
+
+if [ "${SEPARATE_ARCHES}" = "" ] ; then
+    SEPARATE_ARCHES=0;
+fi
+
+if [ "${SEPARATE_ARCHES}" -eq 1 ] ; then
+    for arch in ${SUPPORTED_ARCHES}; do \
+        ARCH_CMD=("${CMD[@]}" --arches "${arch}" --scratch) ;
+        echo "Executing ${ARCH_CMD[*]}";
+        command "${ARCH_CMD[@]}";
+    done
+else
+    echo "Executing ${CMD[*]}";
+    command "${CMD[@]}";
+fi
+brew watch-task --mine
+
+# Local Variables:
+# compile-command: "shellcheck build_vanilla.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/builds/check_signatures.sh b/scripts/builds/check_signatures.sh
new file mode 100755
index 0000000..c6d30a3
--- /dev/null
+++ b/scripts/builds/check_signatures.sh
@@ -0,0 +1,77 @@
+#!/bin/sh
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Check the signatures (if any) in RHEL RPM buildinfo
+# This is intended to be run from the tagging scripts
+
+# Return codes:
+# - 1 - Buildinfo file not specified
+# - 2 = Missing buildinfo file
+# - 3 = No signatures
+# - 4 = Multiple signature types found
+# - 5 = PQC signature found
+# - 6 = Old signature (fd431d51) found
+# - 7 = Unknown signature found
+
+BUILDINFO=${1}
+NEW_SIGNATURE="release4";
+OLD_SIGNATURE="fd431d51";
+
+if test "${BUILDINFO}" = ""; then
+    echo "${0} <BUILDINFO>";
+    exit 1;
+fi
+
+if ! test -e "${BUILDINFO}" ; then
+    echo "${BUILDINFO} not found.";
+    exit 2;
+fi
+
+if grep -q "Signatures" < "${BUILDINFO}" ; then
+    signature=$(grep "Signatures" < "${BUILDINFO}" | cut -d ' ' -f 2- | uniq -c | sed 's#^\W*##');
+    uniq_count=$(echo "${signature}" | wc -l);
+    if test "${uniq_count}" -gt 1; then
+        echo "Multiple signature types found:";
+        echo "${signature}";
+        exit 4;
+    fi
+    sig_count=$(echo "${signature}" | cut -d ' ' -f 1);
+    sig_type=$(echo "${signature}" | cut -d ' ' -f 2);
+    echo "${sig_count} signatures of type ${sig_type} found";
+    if echo "${sig_type}" | grep -q "${NEW_SIGNATURE}" ; then
+        echo "PQC signature found.";
+        exit 5;
+    elif echo "${sig_type}" | grep -q "${OLD_SIGNATURE}"; then
+        echo "Old pre-PQC signature found.";
+        exit 6;
+    else
+        echo "Unknown signature found.";
+        exit 7;
+    fi
+else
+    echo "Build has no signatures.";
+    exit 3;
+fi
+
+# Local Variables:
+# compile-command: "shellcheck check_signatures.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/builds/get_gating_results.sh b/scripts/builds/get_gating_results.sh
new file mode 100755
index 0000000..82458d6
--- /dev/null
+++ b/scripts/builds/get_gating_results.sh
@@ -0,0 +1,63 @@
+#!/bin/bash
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Retrieve the results of a gating test using the ID from the JSON
+# retrieved by query_build_gating.sh
+
+RESULT_ID=${1}
+
+if test "${RESULT_ID}" = ""; then
+    echo "No ID specified.";
+    echo "${0} <RESULT_ID>";
+    exit 1;
+fi
+
+CURL=$(command -v curl)
+JSON_TOOL=$(command -v jq)
+
+if test "${CURL}" = ""; then
+    echo "curl not found";
+    exit 2;
+fi
+
+if test "${JSON_TOOL}" = ""; then
+    echo "jq not found";
+    exit 3;
+fi
+
+URL="https://resultsdb-api.engineering.redhat.com/api/v2.0/results/${RESULT_ID}"
+JSON_OUT=$(mktemp --tmpdir out.XXXXXX.json)
+
+CMD=("${CURL}" --silent --show-error "${URL}")
+
+echo "${CMD[@]}"
+
+if command "${CMD[@]}" > "${JSON_OUT}" ; then
+    "${JSON_TOOL}" < "${JSON_OUT}"
+else
+    echo "Failed to obtain JSON";
+    exit 4;
+fi
+
+# Local Variables:
+# compile-command: "shellcheck get_gating_results.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/builds/query_build_gating.sh b/scripts/builds/query_build_gating.sh
new file mode 100755
index 0000000..f83f849
--- /dev/null
+++ b/scripts/builds/query_build_gating.sh
@@ -0,0 +1,94 @@
+#!/bin/bash
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Retrieve the status of a build's progress through gating
+
+RHEL_VER=${1}
+NVR=${2}
+
+if test "${RHEL_VER}" = ""; then
+    echo "No RHEL version specified.";
+    echo "${0} <RHEL_VER> <NVR>";
+    exit 1;
+fi
+
+if test "${NVR}" = ""; then
+    echo "No NVR specified.";
+    echo "${0} <RHEL_VER> <NVR>";
+    exit 2;
+fi
+
+CURL=$(command -v curl)
+JSON_TOOL=$(command -v jq)
+JSON_FILE=$(mktemp --tmpdir query.XXXXXX.json)
+JSON_OUT=$(mktemp --tmpdir out.XXXXXX.json)
+URL="https://greenwave.engineering.redhat.com/api/v1.0/decision"
+
+if test "${CURL}" = ""; then
+    echo "curl not found";
+    exit 3;
+fi
+
+if test "${JSON_TOOL}" = ""; then
+    echo "jq not found";
+    exit 4;
+fi
+
+{
+    echo "{";
+    printf "\t\"decision_context\":\"osci_compose_gate\",\n";
+    printf "\t\"product_version\":\"rhel-%d\",\n" "${RHEL_VER}";
+    printf "\t\"subject_type\":\"koji_build\",\n";
+    printf "\t\"subject_identifier\":\"%s\",\n" "${NVR}";
+    printf "\t\"verbose\":false\n";
+    echo "}";
+} > "${JSON_FILE}"
+
+echo "Sending the following JSON...";
+cat "${JSON_FILE}"
+
+CMD=("${CURL}" --silent --show-error -X POST)
+
+JSON_COMMAND="--json";
+# Check --json is available
+${CURL} ${JSON_COMMAND} 2> /dev/null
+if [ $? -eq 2 ] ; then
+    echo "--json unsupported; falling back on --data-ascii";
+    CMD=("${CMD[@]}" --header Content-Type:application/json --data-ascii);
+else
+    CMD=("${CMD[@]}" "${JSON_COMMAND}");
+fi
+
+CMD=("${CMD[@]}" "@${JSON_FILE}" "${URL}")
+
+echo "${CMD[@]}"
+
+if command "${CMD[@]}" > "${JSON_OUT}" ; then
+    "${JSON_TOOL}" < "${JSON_OUT}"
+else
+    echo "Failed to obtain JSON";
+    exit 5;
+fi
+
+# Local Variables:
+# compile-command: "shellcheck query_build_gating.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/builds/tag_rhel.sh b/scripts/builds/tag_rhel.sh
new file mode 100755
index 0000000..7b733d8
--- /dev/null
+++ b/scripts/builds/tag_rhel.sh
@@ -0,0 +1,87 @@
+#!/bin/sh
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Tag public RHEL RPMs into gating for all supported streams
+# This is intended to be run from tag_rhel_<ver>_(public|embargoed).sh
+
+BUILD="${1}"
+BUILDLOG="${2}"
+SUFFIX="${3}"
+shift 3;
+SUPPORTED_VERS="$*"
+
+CMD_SYNTAX="${0} <BUILD> <BUILDLOG> <SUFFIX> <SUPPORTED_VERS>";
+GATE_SUFFIX="gate"
+
+if test "${BUILD}" = ""; then
+    echo "${CMD_SYNTAX}";
+    exit 1;
+fi
+
+if test "${BUILDLOG}" = ""; then
+    echo "${CMD_SYNTAX}";
+    exit 2;
+fi
+
+if test "${SUPPORTED_VERS}" = ""; then
+    echo "${CMD_SYNTAX}";
+    exit 3;
+fi
+
+buildtags=$(grep "^Tag" "${BUILDLOG}" | cut -d : -f 2-)
+echo "Build has tags ${buildtags}";
+
+if [ "${SUFFIX}" = "${GATE_SUFFIX}" ] ; then
+    echo "Gating system can only handle one tag at a time."
+    echo "Script will need to be re-run for subsequent tags once previous tag has moved to -candidate."
+    if echo "${buildtags}" | grep -q "${GATE_SUFFIX}"; then
+        echo "Tag with \"-${GATE_SUFFIX}\" found. Please complete gating before re-running.";
+        exit 1;
+    fi
+fi
+
+done=0;
+for ver in ${SUPPORTED_VERS}; do
+    vertag="rhel-${ver}";
+    proposedtag="${vertag}-${SUFFIX}";
+    echo "Checking if ${BUILD} has been added to ${vertag}...";
+    if echo "${buildtags}" | grep -q "${vertag}" ; then
+        echo "${BUILD} has been tagged into ${proposedtag}";
+    else
+        if [ "${SUFFIX}" = "${GATE_SUFFIX}" ] && [ "${done}" -eq 1 ]; then
+            echo "Already added a tag. Need to tag ${proposedtag} in a future run.";
+        else
+            echo "Tagging ${BUILD} into ${proposedtag}";
+            brew tag-build --nowait "${proposedtag}" "${BUILD}";
+            done=1;
+        fi
+    fi
+done
+if [ "${done}" -eq 1 ]; then
+    brew watch-task --mine;
+else
+    echo "Nothing to do.";
+fi
+
+# Local Variables:
+# compile-command: "shellcheck tag_rhel.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/builds/tag_rhel_10_embargoed_pqc.sh b/scripts/builds/tag_rhel_10_embargoed_pqc.sh
new file mode 100755
index 0000000..e617b43
--- /dev/null
+++ b/scripts/builds/tag_rhel_10_embargoed_pqc.sh
@@ -0,0 +1,67 @@
+#!/bin/sh
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Tag newer PQC embargoed RHEL 10 RPMs into supported z-streams
+
+BUILD=${1}
+
+if test "${BUILD}" = ""; then
+    echo "${0} <BUILD>";
+    exit 1;
+fi
+
+BUILDLOG=$(mktemp --tmpdir "temp-${BUILD}-buildinfo-XXX")
+SUPPORTED_VERS="10.2-z"
+WORKING_DIR=$(dirname "${0}")
+EMBARGOED_SUFFIX="nocompose-candidate"
+
+echo "Obtaining buildinfo for ${BUILD}...";
+brew buildinfo "${BUILD}" 2>&1 | tee "${BUILDLOG}" > /dev/null
+
+echo "Checking signatures for ${BUILD}...";
+"${WORKING_DIR}"/check_signatures.sh "${BUILDLOG}"
+
+# Return codes:
+# - 1 - Buildinfo file not specified
+# - 2 = Missing buildinfo file
+# - 3 = No signatures
+# - 4 = Multiple signature types found
+# - 5 = PQC signature found
+# - 6 = Old signature (fd431d51) found
+# - 7 = Unknown signature found
+ret=$?;
+if [ "${ret}" -eq 6 ] ; then
+    echo "Build has old signatures which should not be the case for OpenJDK 25";
+    exit 2;
+elif ! { [ "${ret}" -eq 6 ] || [ "${ret}" -eq 3 ] ; } ; then
+    echo "Signature check failed.";
+    exit 3;
+fi
+
+echo "Tagging embargoed build for ${SUPPORTED_VERS}...";
+"${WORKING_DIR}"/tag_rhel.sh "${BUILD}" "${BUILDLOG}" "${EMBARGOED_SUFFIX}" "${SUPPORTED_VERS}"
+
+rm -f "${BUILDLOG}"
+
+# Local Variables:
+# compile-command: "shellcheck tag_rhel_10_embargoed_pqc.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/builds/tag_rhel_10_public_pqc.sh b/scripts/builds/tag_rhel_10_public_pqc.sh
new file mode 100755
index 0000000..764643a
--- /dev/null
+++ b/scripts/builds/tag_rhel_10_public_pqc.sh
@@ -0,0 +1,67 @@
+#!/bin/sh
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Tag newer PQC public RHEL 10 RPMs into gating for all supported streams
+
+BUILD=${1}
+
+if test "${BUILD}" = ""; then
+    echo "${0} <BUILD>";
+    exit 1;
+fi
+
+BUILDLOG=$(mktemp --tmpdir "temp-${BUILD}-buildinfo-XXX")
+SUPPORTED_VERS="10.3 10.2-z"
+WORKING_DIR=$(dirname "${0}")
+GATE_SUFFIX="gate"
+
+echo "Obtaining buildinfo for ${BUILD}...";
+brew buildinfo "${BUILD}" 2>&1 | tee "${BUILDLOG}" > /dev/null
+
+echo "Checking signatures for ${BUILD}...";
+"${WORKING_DIR}"/check_signatures.sh "${BUILDLOG}"
+
+# Return codes:
+# - 1 - Buildinfo file not specified
+# - 2 = Missing buildinfo file
+# - 3 = No signatures
+# - 4 = Multiple signature types found
+# - 5 = PQC signature found
+# - 6 = Old signature (fd431d51) found
+# - 7 = Unknown signature found
+ret=$?;
+if [ "${ret}" -eq 6 ] ; then
+    echo "Build has old signatures which should not be the case for OpenJDK 25";
+    exit 2;
+elif ! { [ "${ret}" -eq 5 ] || [ "${ret}" -eq 3 ] ; } ; then
+    echo "Signature check failed.";
+    exit 3;
+fi
+
+echo "Tagging build into gating for ${SUPPORTED_VERS}...";
+"${WORKING_DIR}"/tag_rhel.sh "${BUILD}" "${BUILDLOG}" "${GATE_SUFFIX}" "${SUPPORTED_VERS}"
+
+rm -f "${BUILDLOG}"
+
+# Local Variables:
+# compile-command: "shellcheck tag_rhel_10_public_pqc.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/builds/tag_rhel_9_embargoed_pqc.sh b/scripts/builds/tag_rhel_9_embargoed_pqc.sh
new file mode 100755
index 0000000..4f8c12d
--- /dev/null
+++ b/scripts/builds/tag_rhel_9_embargoed_pqc.sh
@@ -0,0 +1,67 @@
+#!/bin/sh
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Tag newer PQC embargoed RHEL 9 RPMs into supported z-streams
+
+BUILD=${1}
+
+if test "${BUILD}" = ""; then
+    echo "${0} <BUILD>";
+    exit 1;
+fi
+
+BUILDLOG=$(mktemp --tmpdir "temp-${BUILD}-buildinfo-XXX")
+SUPPORTED_VERS="9.8.0-z"
+WORKING_DIR=$(dirname "${0}")
+EMBARGOED_SUFFIX="nocompose-candidate"
+
+echo "Obtaining buildinfo for ${BUILD}...";
+brew buildinfo "${BUILD}" 2>&1 | tee "${BUILDLOG}" > /dev/null
+
+echo "Checking signatures for ${BUILD}...";
+"${WORKING_DIR}"/check_signatures.sh "${BUILDLOG}"
+
+# Return codes:
+# - 1 - Buildinfo file not specified
+# - 2 = Missing buildinfo file
+# - 3 = No signatures
+# - 4 = Multiple signature types found
+# - 5 = PQC signature found
+# - 6 = Old signature (fd431d51) found
+# - 7 = Unknown signature found
+ret=$?;
+if [ "${ret}" -eq 6 ] ; then
+    echo "Build has old signatures which should not be the case for OpenJDK 25";
+    exit 2;
+elif ! { [ "${ret}" -eq 6 ] || [ "${ret}" -eq 3 ] ; } ; then
+    echo "Signature check failed.";
+    exit 3;
+fi
+
+echo "Tagging embargoed build for ${SUPPORTED_VERS}...";
+"${WORKING_DIR}"/tag_rhel.sh "${BUILD}" "${BUILDLOG}" "${EMBARGOED_SUFFIX}" "${SUPPORTED_VERS}"
+
+rm -f "${BUILDLOG}"
+
+# Local Variables:
+# compile-command: "shellcheck tag_rhel_9_embargoed_pqc.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/builds/tag_rhel_9_public_pqc.sh b/scripts/builds/tag_rhel_9_public_pqc.sh
new file mode 100755
index 0000000..d420331
--- /dev/null
+++ b/scripts/builds/tag_rhel_9_public_pqc.sh
@@ -0,0 +1,67 @@
+#!/bin/sh
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Tag newer PQC public RHEL 9 RPMs into gating for all supported streams
+
+BUILD=${1}
+
+if test "${BUILD}" = ""; then
+    echo "${0} <BUILD>";
+    exit 1;
+fi
+
+BUILDLOG=$(mktemp --tmpdir "temp-${BUILD}-buildinfo-XXX")
+SUPPORTED_VERS="9.9.0 9.8.0-z"
+WORKING_DIR=$(dirname "${0}")
+GATE_SUFFIX="gate"
+
+echo "Obtaining buildinfo for ${BUILD}...";
+brew buildinfo "${BUILD}" 2>&1 | tee "${BUILDLOG}" > /dev/null
+
+echo "Checking signatures for ${BUILD}...";
+"${WORKING_DIR}"/check_signatures.sh "${BUILDLOG}"
+
+# Return codes:
+# - 1 - Buildinfo file not specified
+# - 2 = Missing buildinfo file
+# - 3 = No signatures
+# - 4 = Multiple signature types found
+# - 5 = PQC signature found
+# - 6 = Old signature (fd431d51) found
+# - 7 = Unknown signature found
+ret=$?;
+if [ "${ret}" -eq 6 ] ; then
+    echo "Build has old signatures which should not be the case for OpenJDK 25";
+    exit 2;
+elif ! { [ "${ret}" -eq 5 ] || [ "${ret}" -eq 3 ] ; } ; then
+    echo "Signature check failed.";
+    exit 3;
+fi
+
+echo "Tagging build into gating for ${SUPPORTED_VERS}...";
+"${WORKING_DIR}"/tag_rhel.sh "${BUILD}" "${BUILDLOG}" "${GATE_SUFFIX}" "${SUPPORTED_VERS}"
+
+rm -f "${BUILDLOG}"
+
+# Local Variables:
+# compile-command: "shellcheck tag_rhel_9_public_pqc.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/builds/waive_issue.sh b/scripts/builds/waive_issue.sh
new file mode 100755
index 0000000..88b0f51
--- /dev/null
+++ b/scripts/builds/waive_issue.sh
@@ -0,0 +1,132 @@
+#!/bin/bash
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Waive a gating issue
+
+RHEL_VER=${1}
+NVR=${2}
+TESTCASE=${3}
+COMMENT=${4}
+
+CURL=$(command -v curl)
+JSON_TOOL=$(command -v json_verify)
+JSON_FORMAT=$(command -v jq)
+JSON_FILE=$(mktemp --tmpdir waive.XXXXXX.json)
+HEADER_FILE=$(mktemp --tmpdir waive.XXXXXX.headers)
+JSON_OUT=$(mktemp --tmpdir out.XXXXXX.json)
+
+CACERT=/etc/ssl/certs/2022-IT-Root-CA.pem
+CACERT_DIR=$(dirname ${CACERT})
+URL="https://waiverdb.engineering.redhat.com/api/v1.0/waivers/"
+
+if test -z "${JSON_TOOL}" -o ! -x "${JSON_TOOL}" ; then
+    echo "JSON verifier not found. Skipping verification.";
+    SKIP_JSON=1;
+else
+    SKIP_JSON=0;
+fi
+
+if test "${RHEL_VER}" = ""; then
+    echo "No RHEL version specified.";
+    echo "${0} <RHEL_VER> <NVR> <TESTCASE> <COMMENT>";
+    exit 1;
+fi
+
+if test "${NVR}" = ""; then
+    echo "No NVR specified.";
+    echo "${0} <RHEL_VER> <NVR> <TESTCASE> <COMMENT>";
+    exit 2;
+fi
+
+if test "${TESTCASE}" = ""; then
+    echo "No testcase specified.";
+    echo "${0} <RHEL_VER> <NVR> <TESTCASE> <COMMENT>";
+    exit 3;
+fi
+
+if test "${COMMENT}" = ""; then
+    COMMENT="Gating broken";
+    echo "Setting COMMENT to default of '${COMMENT}'"
+fi
+
+if test "${CURL}" = ""; then
+    echo "curl not found";
+    exit 4;
+fi
+
+if test "${JSON_FORMAT}" = ""; then
+    echo "jq not found";
+    exit 5;
+fi
+
+{
+    echo "{";
+    printf "\t\"subject_type\":\"brew-build\",\n";
+    printf "\t\"subject_identifier\":\"%s\",\n" "${NVR}";
+    printf "\t\"testcase\":\"%s\",\n" "${TESTCASE}";
+    printf "\t\"waived\":true,\n";
+    printf "\t\"product_version\":\"rhel-%d\",\n" "${RHEL_VER}"
+    printf "\t\"comment\":\"%s\"\n" "${COMMENT}";
+    echo "}"
+} > "${JSON_FILE}"
+
+if [ "${SKIP_JSON}" -eq 0 ] ; then
+   "${JSON_TOOL}" < "${JSON_FILE}" || exit 6;
+fi
+
+CMD=("${CURL}" --silent --show-error --capath "${CACERT_DIR}" --negotiate -u :)
+
+JSON_COMMAND="--json";
+# Check --json is available
+${CURL} ${JSON_COMMAND} 2> /dev/null
+if [ $? -eq 2 ] ; then
+    echo "--json unsupported; falling back on --data-binary";
+    {
+        echo "Content-Type: application/json";
+        echo "Accept: application/json";
+    } > "${HEADER_FILE}"
+    echo "Header file:";
+    cat "${HEADER_FILE}"
+    CMD=("${CMD[@]}" --header "@${HEADER_FILE}" --data-binary);
+else
+    CMD=("${CMD[@]}" "${JSON_COMMAND}");
+fi
+CMD=("${CMD[@]}" "@${JSON_FILE}" "${URL}")
+
+echo "Sending the following JSON...";
+cat "${JSON_FILE}"
+
+echo "${CMD[@]}"
+
+if command "${CMD[@]}" > "${JSON_OUT}" ; then
+    "${JSON_FORMAT}" < "${JSON_OUT}"
+else
+    echo "Failed to file waiver";
+    exit 7;
+fi
+
+rm -v "${JSON_FILE}"
+rm -v "${HEADER_FILE}"
+
+# Local Variables:
+# compile-command: "shellcheck waive_issue.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/builds/waive_leapp_issue.sh b/scripts/builds/waive_leapp_issue.sh
new file mode 100755
index 0000000..a556070
--- /dev/null
+++ b/scripts/builds/waive_leapp_issue.sh
@@ -0,0 +1,46 @@
+#!/bin/sh
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Waive the leapp gating test which never seems to work
+
+RHEL_VER=${1}
+NVR=${2}
+
+WORKING_DIR=$(dirname "${0}")
+
+if test "${RHEL_VER}" = ""; then
+    echo "No RHEL version specified.";
+    echo "${0} <RHEL_VER> <NVR>";
+    exit 1;
+fi
+
+if test "${NVR}" = ""; then
+    echo "No NVR specified.";
+    echo "${0} <RHEL_VER> <NVR>";
+    exit 2;
+fi
+
+"${WORKING_DIR}"/waive_issue.sh "${RHEL_VER}" "${NVR}" leapp.brew-build.upgrade.distro "AWOL"
+
+# Local Variables:
+# compile-command: "shellcheck waive_leapp_issue.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/builds/waive_rpminspect.sh b/scripts/builds/waive_rpminspect.sh
new file mode 100755
index 0000000..7912b94
--- /dev/null
+++ b/scripts/builds/waive_rpminspect.sh
@@ -0,0 +1,53 @@
+#!/bin/sh
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Waive a rpminspect gating issue
+
+RHEL_VER=${1}
+NVR=${2}
+COMMENT=${3}
+
+WORKING_DIR=$(dirname "${0}")
+
+if test "${RHEL_VER}" = ""; then
+    echo "No RHEL version specified.";
+    echo "${0} <RHEL_VER> <NVR> <COMMENT>";
+    exit 1;
+fi
+
+if test "${NVR}" = ""; then
+    echo "No NVR specified.";
+    echo "${0} <RHEL_VER> <NVR> <COMMENT>";
+    exit 2;
+fi
+
+if test "${COMMENT}" = ""; then
+    echo "No comment specified.";
+    echo "${0} <RHEL_VER> <NVR> <COMMENT>";
+    exit 3;
+fi
+
+"${WORKING_DIR}"/waive_issue.sh "${RHEL_VER}" "${NVR}" osci.brew-build.rpminspect.static-analysis "${COMMENT}"
+
+# Local Variables:
+# compile-command: "shellcheck waive_rpminspect.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/builds/waive_usual_rpminspect.sh b/scripts/builds/waive_usual_rpminspect.sh
new file mode 100755
index 0000000..49ec4f8
--- /dev/null
+++ b/scripts/builds/waive_usual_rpminspect.sh
@@ -0,0 +1,48 @@
+#!/bin/sh
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Waive the recurring rpminspect gating issues
+# Should be resolved by RHELPLAN-102267
+
+WORKING_DIR=$(dirname "${0}")
+
+RHEL_VER=${1}
+NVR=${2}
+
+if test "${RHEL_VER}" = ""; then
+    echo "No RHEL version specified.";
+    echo "${0} <RHEL_VER> <NVR>";
+    exit 1;
+fi
+
+if test "${NVR}" = ""; then
+    echo "No NVR specified.";
+    echo "${0} <RHEL_VER> <NVR>";
+    exit 2;
+fi
+
+"${WORKING_DIR}"/waive_rpminspect.sh "${RHEL_VER}" "${NVR}" \
+		"Usual failures we waived through rpmdiff; slowdebug unoptimised, RPATH and IPv4 functions"
+
+# Local Variables:
+# compile-command: "shellcheck waive_usual_rpminspect.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/builds/waive_usual_tier0.sh b/scripts/builds/waive_usual_tier0.sh
new file mode 100755
index 0000000..94227a6
--- /dev/null
+++ b/scripts/builds/waive_usual_tier0.sh
@@ -0,0 +1,47 @@
+#!/bin/sh
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Waive the usual tier0 gating issue
+# Should be resolved by OPENJDK-4517
+
+RHEL_VER=${1}
+NVR=${2}
+
+WORKING_DIR=$(dirname "${0}")
+
+if test "${RHEL_VER}" = ""; then
+    echo "No RHEL version specified.";
+    echo "${0} <RHEL_VER> <NVR>";
+    exit 1;
+fi
+
+if test "${NVR}" = ""; then
+    echo "No NVR specified.";
+    echo "${0} <RHEL_VER> <NVR>";
+    exit 2;
+fi
+
+"${WORKING_DIR}"/waive_issue.sh "${RHEL_VER}" "${NVR}" osci.brew-build.tier0.functional "Test unable to parse spec file"
+
+# Local Variables:
+# compile-command: "shellcheck waive_usual_tier0.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/discover_trees.sh b/scripts/discover_trees.sh
new file mode 100755
index 0000000..7a0b800
--- /dev/null
+++ b/scripts/discover_trees.sh
@@ -0,0 +1,61 @@
+#!/bin/sh
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by Andrew John Hughes <gnu.andrew@redhat.com>.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+TREE=${1}
+
+if test "${TREE}" = ""; then
+    TREE=${PWD}
+fi
+
+if [ -e "${TREE}"/nashorn/.hg ] || [ -e "${TREE}"/nashorn/merge.changeset ] ; then
+    NASHORN="nashorn" ;
+fi
+
+if [ -e "${TREE}"/corba/.hg ] || [ -e "${TREE}"/corba/merge.changeset ] ; then
+    CORBA="corba";
+fi
+
+if [ -e "${TREE}"/jaxp/.hg ] || [ -e "${TREE}"/jaxp/merge.changeset ] ; then
+    JAXP="jaxp";
+fi
+
+if [ -e "${TREE}"/jaxws/.hg ] || [ -e "${TREE}"/jaxws/merge.changeset ] ; then
+    JAXWS="jaxws";
+fi
+
+if [ -e "${TREE}"/langtools/.hg ] || [ -e "${TREE}"/langtools/merge.changeset ] ; then
+    LANGTOOLS="langtools";
+fi
+
+if [ -e "${TREE}"/jdk/.hg ] || [ -e "${TREE}"/jdk/merge.changeset ] ; then
+    JDK="jdk";
+fi
+
+if [ -e "${TREE}"/hotspot/.hg ] || [ -e "${TREE}"/hotspot/merge.changeset ] ; then
+    HOTSPOT="hotspot";
+fi
+
+SUBTREES="${CORBA} ${JAXP} ${JAXWS} ${LANGTOOLS} ${NASHORN} ${JDK} ${HOTSPOT}";
+echo "${SUBTREES}"
+
+# Local Variables:
+# compile-command: "shellcheck discover_trees.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/generate_source_tarball.sh b/scripts/generate_source_tarball.sh
new file mode 100755
index 0000000..ad163f3
--- /dev/null
+++ b/scripts/generate_source_tarball.sh
@@ -0,0 +1,294 @@
+#!/bin/bash
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#     Thomas Fitzsimmons <fitzsim@redhat.com>
+#     Jiri Vanek <jvanek@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Generates the source tarball for OpenJDK projects.
+#
+# There are multiple ways to specify the source code location and version:
+#
+# 1. Specify the version (VERSION), the location of the Git repository
+#    (REPO_ROOT) and the root of the output tarball name (FILE_NAME_ROOT)
+# 2. Specify the version (VERSION) along with an upstream project name
+#    (PROJECT_NAME) and repository name (REPO_NAME) that can be used
+#    to construct the URL of the upstream OpenJDK repository.
+# 3. Specify OPENJDK_LATEST=1 and allow the script to obtain the JDK
+#    feature version from the spec file, which is then used to
+#    obtain the latest build promotion from the upstream repository.
+#
+# An appropriate bootstrap JDK is also required for when ./configure
+# is run within the checked out repository to generate the .src-rev.
+# file. This can be specified by setting BOOT_JDK.
+#
+# Example 1:
+# This will check out the specified version from the specified
+# repository and construct a tarball called openjdk-17.0.3+5.tar.xz:
+#
+# $ VERSION=jdk-17.0.3+5 FILE_NAME_ROOT=open${VERSION} \
+#   REPO_ROOT=$HOME/projects/openjdk/upstream/17u \
+#   BOOT_JDK=/usr/lib/jvm/java-17-openjdk ./generate_source_tarball.sh
+#
+# Example 2:
+# This will check out the same version as example 1, but from the
+# upstream repository:
+#
+# $ VERSION=jdk-17.0.3+5 PROJECT_NAME=openjdk REPO_NAME=jdk17u \
+#   BOOT_JDK=/usr/lib/jvm/java-17-openjdk ./generate_source_tarball.sh
+#
+# Example 3:
+# This will read the OpenJDK feature version from the spec file, then create a
+# tarball from the most recent tag for that version in the upstream Git
+# repository.
+#
+# $ OPENJDK_LATEST=1 \
+#   BOOT_JDK=/usr/lib/jvm/java-17-openjdk ./generate_source_tarball.sh
+#
+
+set -e
+
+OPENJDK_URL_DEFAULT=https://github.com
+COMPRESSION_DEFAULT=xz
+
+if [ "$1" = "help" ] ; then
+    echo "Behaviour may be specified by setting the following variables:"
+    echo
+    echo "VERSION        - the version of the specified OpenJDK project"
+    echo "                 (required unless OPENJDK_LATEST is set)"
+    echo "PROJECT_NAME   - the name of the OpenJDK project being archived"
+    echo "                 (needed to compute REPO_ROOT and/or"
+    echo "                  FILE_NAME_ROOT automatically;"
+    echo "                  optional if they are set explicitly)"
+    echo "REPO_NAME      - the name of the OpenJDK repository"
+    echo "                 (needed to compute REPO_ROOT automatically;"
+    echo "                  optional if REPO_ROOT is set explicitly)"
+    echo "OPENJDK_URL    - the URL to retrieve code from"
+    echo "                 (defaults to ${OPENJDK_URL_DEFAULT})"
+    echo "COMPRESSION    - the compression type to use"
+    echo "                 (defaults to ${COMPRESSION_DEFAULT})"
+    echo "FILE_NAME_ROOT - name of the archive, minus extensions"
+    echo "                 (defaults to PROJECT_NAME-VERSION)"
+    echo "REPO_ROOT      - the location of the Git repository to archive"
+    echo "                 (defaults to OPENJDK_URL/PROJECT_NAME/REPO_NAME.git)"
+    echo "TO_COMPRESS    - what part of clone to pack"
+    echo "                 (defaults to ${VERSION})"
+    echo "BOOT_JDK       - the bootstrap JDK to satisfy the configure run"
+    echo "                 (defaults to packaged JDK version)"
+    echo "WITH_TEMP      - run in a temporary directory"
+    echo "                 (defaults to disabled)"
+    echo "OPENJDK_LATEST - deduce VERSION from most recent upstream tag"
+    echo "                 (implies WITH_TEMP, computes everything else"
+    echo "                  automatically; Note: accesses network to read"
+    echo "                  tag list from remote Git repository)"
+    exit 1;
+fi
+
+if [ "$OPENJDK_LATEST" != "" ] ; then
+    FEATURE_VERSION=$(echo '%featurever' \
+                          | rpmspec --shell ./*.spec 2>/dev/null \
+                          | grep --after-context 1 featurever \
+                          | tail --lines 1)
+    PROJECT_NAME=openjdk
+    REPO_NAME=jdk"${FEATURE_VERSION}"u
+    # Skip -ga tags since those are the same as the most recent non-ga tag, and
+    # the non-ga tag is the one that is used to generated the official source
+    # tarball.  For example:
+    # ca760c86642aa2e0d9b571aaabac054c0239fbdc  refs/tags/jdk-17.0.10-ga^{}
+    # 25a2e6c20c9a96853714284cabc6b456eb095070  refs/tags/jdk-17.0.10-ga
+    # ca760c86642aa2e0d9b571aaabac054c0239fbdc  refs/tags/jdk-17.0.10+7^{}
+    # e49c5749b10f3e90274b72e9279f794fdd191d27  refs/tags/jdk-17.0.10+7
+    VERSION=$(git ls-remote --tags --refs --sort=-version:refname \
+                  "${OPENJDK_URL_DEFAULT}/${PROJECT_NAME}/${REPO_NAME}.git" \
+                  "jdk-${FEATURE_VERSION}*" \
+                  | grep --invert-match '\-ga$' \
+                  | head --lines 1 | cut --characters 52-)
+    FILE_NAME_ROOT=open${VERSION}
+    WITH_TEMP=1
+fi
+
+if [ "$WITH_TEMP" != "" ] ; then
+    pushd "$(mktemp --directory --tmpdir temp-generated-source-tarball-XXX)"
+fi
+
+if [ "$VERSION" = "" ] ; then
+    echo "No VERSION specified"
+    exit 2
+fi
+echo "Version: ${VERSION}"
+
+NUM_VER=${VERSION##jdk-}
+RELEASE_VER=${NUM_VER%%+*}
+BUILD_VER=${NUM_VER##*+}
+MAJOR_VER=${RELEASE_VER%%.*}
+echo "Major version is ${MAJOR_VER}, release ${RELEASE_VER}, build ${BUILD_VER}"
+
+if [ "$BOOT_JDK" = "" ] ; then
+    echo "No boot JDK specified".
+    BOOT_JDK=/usr/lib/jvm/java-${MAJOR_VER}-openjdk;
+    echo -n "Checking for ${BOOT_JDK}...";
+    if [ -d "${BOOT_JDK}" ] && [ -x "${BOOT_JDK}"/bin/java ] ; then
+        echo "Boot JDK found at ${BOOT_JDK}";
+    else
+        echo "Not found";
+        PREV_VER=$((MAJOR_VER - 1));
+        BOOT_JDK=/usr/lib/jvm/java-${PREV_VER}-openjdk;
+        echo -n "Checking for ${BOOT_JDK}...";
+        if [ -d ${BOOT_JDK} ] && [ -x ${BOOT_JDK}/bin/java ] ; then
+            echo "Boot JDK found at ${BOOT_JDK}";
+        else
+            echo "Not found";
+            exit 4;
+        fi
+    fi
+else
+    echo "Boot JDK: ${BOOT_JDK}";
+fi
+
+if [ "$OPENJDK_URL" = "" ] ; then
+    OPENJDK_URL=${OPENJDK_URL_DEFAULT}
+    echo "No OpenJDK URL specified; defaulting to ${OPENJDK_URL}"
+else
+    echo "OpenJDK URL: ${OPENJDK_URL}"
+fi
+
+if [ "$COMPRESSION" = "" ] ; then
+    # rhel 5 needs tar.gz
+    COMPRESSION=${COMPRESSION_DEFAULT}
+fi
+echo "Creating a tar.${COMPRESSION} archive"
+
+if [ "$FILE_NAME_ROOT" = "" ] ; then
+    if [ "$PROJECT_NAME" = "" ] ; then
+        echo "No PROJECT_NAME specified, needed by FILE_NAME_ROOT"
+        exit 1
+    fi
+    FILE_NAME_ROOT=${PROJECT_NAME}-${VERSION}
+    echo "No file name root specified; default to ${FILE_NAME_ROOT}"
+fi
+if [ "$REPO_ROOT" = "" ] ; then
+    if [ "$PROJECT_NAME" = "" ] ; then
+        echo "No PROJECT_NAME specified, needed by REPO_ROOT"
+        exit 1
+    fi
+    if [ "$REPO_NAME" = "" ] ; then
+        echo "No REPO_NAME specified, needed by REPO_ROOT"
+        exit 3
+    fi
+    REPO_ROOT="${OPENJDK_URL}/${PROJECT_NAME}/${REPO_NAME}.git"
+    echo "No repository root specified; default to ${REPO_ROOT}"
+fi;
+
+if [ "$TO_COMPRESS" = "" ] ; then
+    TO_COMPRESS="${VERSION}"
+    echo "No targets to be compressed specified ; default to ${TO_COMPRESS}"
+fi;
+
+echo -e "Settings:"
+echo -e "\tVERSION: ${VERSION}"
+echo -e "\tPROJECT_NAME: ${PROJECT_NAME}"
+echo -e "\tREPO_NAME: ${REPO_NAME}"
+echo -e "\tOPENJDK_URL: ${OPENJDK_URL}"
+echo -e "\tCOMPRESSION: ${COMPRESSION}"
+echo -e "\tFILE_NAME_ROOT: ${FILE_NAME_ROOT}"
+echo -e "\tREPO_ROOT: ${REPO_ROOT}"
+echo -e "\tTO_COMPRESS: ${TO_COMPRESS}"
+echo -e "\tBOOT_JDK: ${BOOT_JDK}"
+echo -e "\tWITH_TEMP: ${WITH_TEMP}"
+echo -e "\tOPENJDK_LATEST: ${OPENJDK_LATEST}"
+
+if [ -d "${FILE_NAME_ROOT}" ] ; then
+    echo "Reusing existing ${FILE_NAME_ROOT}"
+    STAT_TIME="$(stat --format=%Y "${FILE_NAME_ROOT}")"
+    TAR_TIME="$(date --date=@"${STAT_TIME}" --iso-8601=seconds)"
+else
+    mkdir "${FILE_NAME_ROOT}"
+    pushd "${FILE_NAME_ROOT}"
+        echo "Cloning ${VERSION} root repository from ${REPO_ROOT}"
+        if realpath -q "${REPO_ROOT}"; then
+            echo "Local path detected; not adding depth argument";
+            DEPTH="--";
+        else
+            DEPTH="--depth=1";
+            echo "Remote repository detected; adding ${DEPTH}";
+        fi
+        git clone -b "${VERSION}" "${DEPTH}" "${REPO_ROOT}" "${VERSION}"
+        pushd "${VERSION}"
+            TAR_TIME="$(git log --max-count 1 --format=%cI)"
+        popd
+    popd
+fi
+pushd "${FILE_NAME_ROOT}"
+    # Generate .src-rev so build has knowledge of the revision the tarball was
+    # created from
+    mkdir build
+    pushd build
+        sh "${PWD}"/../"${VERSION}"/configure --with-boot-jdk="${BOOT_JDK}"
+        make store-source-revision
+    popd
+    rm -rf build
+
+    # Remove commit checks
+    echo "Removing $(find "${VERSION}" -name '.jcheck' -print)"
+    find "${VERSION}" -name '.jcheck' -print0 | xargs -0 rm -r
+
+    # Remove history and GHA
+    echo "find ${VERSION} -name '.hgtags'"
+    find "${VERSION}" -name '.hgtags' -exec rm -v '{}' '+'
+    echo "find ${VERSION} -name '.hgignore'"
+    find "${VERSION}" -name '.hgignore' -exec rm -v '{}' '+'
+    echo "find ${VERSION} -name '.gitattributes'"
+    find "${VERSION}" -name '.gitattributes' -exec rm -v '{}' '+'
+    echo "find ${VERSION} -name '.gitignore'"
+    find "${VERSION}" -name '.gitignore' -exec rm -v '{}' '+'
+    # Work around some Git objects not having write permissions.
+    echo "chmod --recursive u+w ${VERSION}/.git"
+    chmod --recursive u+w "${VERSION}"/.git
+    echo "find ${VERSION} -name '.git'"
+    find "${VERSION}" -name '.git' -exec rm -rv '{}' '+'
+    echo "find ${VERSION} -name '.github'"
+    find "${VERSION}" -name '.github' -exec rm -rv '{}' '+'
+
+    echo "Compressing remaining forest"
+    if [ "$COMPRESSION" = "xz" ] ; then
+        SWITCH=cJf
+    else
+        SWITCH=czf
+    fi
+    EA_PART="$(awk -F= \
+               '/^DEFAULT_PROMOTED_VERSION_PRE/ { if ($2) print "-"$2 }' \
+               "${VERSION}"/make/conf/version-numbers.conf)"
+    TARBALL_NAME=${FILE_NAME_ROOT}${EA_PART}.tar.${COMPRESSION}
+    XZ_OPT=${XZ_OPT-"-T0"} \
+          tar --mtime="${TAR_TIME}" --owner=root --group=root --sort=name \
+          --exclude-vcs -$SWITCH "${TARBALL_NAME}" "${TO_COMPRESS}"
+    mv "${TARBALL_NAME}" ..
+popd
+if [ "$WITH_TEMP" != "" ] ; then
+    echo "Tarball is: $(realpath .)/${TARBALL_NAME}"
+    popd
+else
+    echo -n "Done. You may want to remove the uncompressed version"
+    echo " - $FILE_NAME_ROOT"
+fi
+
+# Local Variables:
+# compile-command: "shellcheck generate_source_tarball.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/get_bundle_versions.sh b/scripts/get_bundle_versions.sh
new file mode 100755
index 0000000..dddbee4
--- /dev/null
+++ b/scripts/get_bundle_versions.sh
@@ -0,0 +1,172 @@
+#!/usr/bin/env sh
+
+# Copyright (C) 2025 Red Hat, Inc.
+# Original written by Antonio Vieiro <avieirov@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+if [ $# -ne 1 ]; then
+    echo "Usage: $0 openjdk-root-directory"
+    exit 1
+fi
+
+JDKROOT=$1
+
+if [ ! -d "${JDKROOT}" ] ; then
+    echo "${JDKROOT} is not a directory.";
+    exit 2
+fi
+
+# Work out the OpenJDK version
+# OpenJDK >= 10 has its version in the build machinery
+# OpenJDK >= 17 stores it in a new location (JDK-8258246)
+VERSION_FILE="${JDKROOT}"/make/conf/version-numbers.conf
+printf "Checking for %s..." "${VERSION_FILE}";
+if [ ! -f "${VERSION_FILE}" ] ; then
+    VERSION_FILE="${JDKROOT}"/make/autoconf/version-numbers
+    echo "Not found; using old version file ${VERSION_FILE}";
+else
+    echo "found.";
+fi
+if [ -e "${VERSION_FILE}" ] ; then
+    openjdk_version=$(grep '^DEFAULT_VERSION_FEATURE' "${VERSION_FILE}" | cut -d '=' -f 2)
+elif [ -e "${JDKROOT}"/jdk/src/java.base/share/classes/java/lang/Object.java ] ; then
+    openjdk_version=9;
+elif [ -e "${JDKROOT}"/common/autoconf ] ; then
+    openjdk_version=8;
+else
+    openjdk_version=7;
+fi
+echo "OpenJDK version: ${openjdk_version}";
+
+#
+# Freetype
+#
+if [ "${openjdk_version}" -gt 8 ] ; then
+    FREETYPE=src/java.desktop/share/native/libfreetype/include/freetype/freetype.h
+    ABS_FREETYPE="${JDKROOT}"/"${FREETYPE}"
+    if [ ! -f "${ABS_FREETYPE}" ]; then
+        echo "Freetype header not found!"
+        exit 2
+    fi
+    FREETYPE_VERSION=$(awk '/#define FREETYPE_MAJOR/ {MAJOR=$3} /#define FREETYPE_MINOR/ {MINOR=$3} /#define FREETYPE_PATCH/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_FREETYPE}")
+else
+    echo "No bundled FreeType on ${openjdk_version}";
+fi
+
+# giflib
+if [ "${openjdk_version}" -gt 8 ] ; then
+    GIFLIB=src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
+else
+    GIFLIB=jdk/src/share/native/sun/awt/giflib/gif_lib.h
+fi
+ABS_GIFLIB="${JDKROOT}"/"${GIFLIB}"
+if [ ! -f "${ABS_GIFLIB}" ]; then
+    echo "giflib header not found!"
+    exit 3
+fi
+GIFLIB_VERSION=$(awk '/#define GIFLIB_MAJOR/ {MAJOR=$3} /#define GIFLIB_MINOR/ {MINOR=$3} /#define GIFLIB_RELEASE/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_GIFLIB}")
+
+# harfbuzz
+if [ "${openjdk_version}" -gt 8 ] ; then
+    HARFBUZZ=src/java.desktop/share/native/libharfbuzz/hb-version.h
+    ABS_HARFBUZZ="${JDKROOT}/${HARFBUZZ}"
+    if [ ! -f "${ABS_HARFBUZZ}" ]; then
+        echo "HarfBuzz header not found!"
+        exit 4
+    fi
+    HARFBUZZ_VERSION=$(awk '/#define HB_VERSION_MAJOR/ {MAJOR=$3} /#define HB_VERSION_MINOR/ {MINOR=$3} /#define HB_VERSION_MICRO/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_HARFBUZZ}")
+else
+    echo "No HarfBuzz on ${openjdk_version}";
+fi
+
+# lcms
+if [ "${openjdk_version}" -gt 8 ] ; then
+    LCMS=src/java.desktop/share/native/liblcms/lcms2.h
+else
+    LCMS=jdk/src/share/native/sun/java2d/cmm/lcms/lcms2.h
+fi
+ABS_LCMS="${JDKROOT}"/"${LCMS}"
+if [ ! -f "${ABS_LCMS}" ]; then
+    echo "lcms header not found!"
+    exit 5
+fi
+LCMS_VERSION=$(awk '/#define LCMS_VERSION/ { MAJOR=int($3 / 1000); REST=$3 % 1000; MINOR=int(REST / 10); PATCH=REST % 10; } END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_LCMS}")
+
+# jpeg
+if [ "${openjdk_version}" -gt 8 ] ; then
+    JPEG=src/java.desktop/share/native/libjavajpeg/jpeglib.h
+else
+    JPEG=jdk/src/share/native/sun/awt/image/jpeg/jpeglib.h
+fi
+ABS_JPEG="${JDKROOT}"/"${JPEG}"
+if [ ! -f "${ABS_JPEG}" ]; then
+    echo "jpeg header not found!"
+    exit 6
+fi
+JPEG_VERSION=$(awk '/#define JPEG_LIB_VERSION/ { VERSION=$3; MAJOR=int(VERSION / 10); MINOR=VERSION%10; } END {printf "%s%c", MAJOR, (MINOR+96)}' "${ABS_JPEG}")
+
+# png
+if [ "${openjdk_version}" -gt 8 ] ; then
+    PNG=src/java.desktop/share/native/libsplashscreen/libpng/png.h
+else
+    PNG=jdk/src/share/native/sun/awt/libpng/png.h
+fi
+ABS_PNG="${JDKROOT}"/"${PNG}"
+if [ ! -f "${ABS_PNG}" ]; then
+    echo "png header not found!"
+    exit 7
+fi
+PNG_VERSION=$(awk '/#define PNG_LIBPNG_VER_STRING/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_PNG}")
+
+# zlib
+if [ "${openjdk_version}" -gt 8 ] ; then
+    ZLIB=src/java.base/share/native/libzip/zlib/zlib.h
+else
+    ZLIB=jdk/src/share/native/java/util/zip/zlib/zlib.h
+fi
+ABS_ZLIB="${JDKROOT}"/"${ZLIB}"
+if [ ! -f "${ABS_ZLIB}" ]; then
+    echo "zlib header not found!"
+    exit 8
+fi
+ZLIB_VERSION=$(awk '/#define ZLIB_VERSION/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_ZLIB}")
+
+# Print output
+printf "\nRPM definitions:\n"
+if [ "${openjdk_version}" -gt 8 ] ; then
+    echo "# Version in ${FREETYPE}"
+    echo "Provides: bundled(freetype) = ${FREETYPE_VERSION}"
+fi
+echo "# Version in ${GIFLIB}"
+echo "Provides: bundled(giflib) = ${GIFLIB_VERSION}"
+if [ "${openjdk_version}" -gt 8 ] ; then
+    echo "# Version in ${HARFBUZZ}"
+    echo "Provides: bundled(harfbuzz) = ${HARFBUZZ_VERSION}"
+fi
+echo "# Version in ${LCMS}"
+echo "Provides: bundled(lcms2) = ${LCMS_VERSION}"
+echo "# Version in ${JPEG}"
+echo "Provides: bundled(libjpeg) = ${JPEG_VERSION}"
+echo "# Version in ${PNG}"
+echo "Provides: bundled(libpng) = ${PNG_VERSION}"
+echo "# Version in ${ZLIB}"
+echo "Provides: bundled(zlib) = ${ZLIB_VERSION}"
+
+# Local Variables:
+# compile-command: "shellcheck get_bundle_versions.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/icedtea_sync.sh b/scripts/icedtea_sync.sh
new file mode 100755
index 0000000..3f5cb82
--- /dev/null
+++ b/scripts/icedtea_sync.sh
@@ -0,0 +1,198 @@
+#!/bin/bash
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by Andrew John Hughes <gnu.andrew@redhat.com>.
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+ICEDTEA_USE_VCS=true
+
+ICEDTEA_VERSION=3.15.0
+ICEDTEA_URL=https://icedtea.classpath.org/download/source
+ICEDTEA_SIGNING_KEY=CFDA0F9B35964222
+
+ICEDTEA_HG_URL=https://icedtea.classpath.org/hg/icedtea11
+set -e
+
+RPM_DIR=${PWD}
+if [ ! -f "${RPM_DIR}/jconsole.desktop.in" ] ; then
+    echo "Not in RPM source tree.";
+    exit 1;
+fi
+
+if test "${TMPDIR}" = ""; then
+    TMPDIR=/tmp;
+fi
+WORKDIR=${TMPDIR}/it.sync
+
+echo "Using working directory ${WORKDIR}"
+mkdir "${WORKDIR}"
+pushd "${WORKDIR}"
+
+if test "${WGET}" = ""; then
+    WGET=$(which wget);
+    if test "${WGET}" = ""; then
+	echo "wget not found";
+	exit 1;
+    fi
+fi
+
+if test "${TAR}" = ""; then
+    TAR=$(which tar)
+    if test "${TAR}" = ""; then
+	echo "tar not found";
+	exit 2;
+    fi
+fi
+
+echo "Dependencies:";
+echo -e "\tWGET: ${WGET}";
+echo -e "\tTAR: ${TAR}\n";
+
+if test "${ICEDTEA_USE_VCS}" = "true"; then
+    echo "Mode: Using VCS";
+
+    if test "${GREP}" = ""; then
+	GREP=$(which grep);
+	if test "${GREP}" = ""; then
+	    echo "grep not found";
+	    exit 3;
+	fi
+    fi
+
+    if test "${CUT}" = ""; then
+	CUT=$(which cut);
+	if test "${CUT}" = ""; then
+	    echo "cut not found";
+	    exit 4;
+	fi
+    fi
+
+    if test "${TR}" = ""; then
+	TR=$(which tr);
+	if test "${TR}" = ""; then
+	    echo "tr not found";
+	    exit 5;
+	fi
+    fi
+
+    if test "${HG}" = ""; then
+	HG=$(which hg);
+	if test "${HG}" = ""; then
+	    echo "hg not found";
+	    exit 6;
+	fi
+    fi
+
+    echo "Dependencies:";
+    echo -e "\tGREP: ${GREP}";
+    echo -e "\tCUT: ${CUT}";
+    echo -e "\tTR: ${TR}";
+    echo -e "\tHG: ${HG}";
+
+    echo "Checking out repository from VCS...";
+    ${HG} clone ${ICEDTEA_HG_URL} icedtea
+
+    echo "Obtaining version from configure.ac...";
+    ROOT_VER=$(${GREP} '^AC_INIT' icedtea/configure.ac|${CUT} -d ',' -f 2|${TR} -d '[][:space:]')
+    echo "Root version from configure: ${ROOT_VER}";
+
+    VCS_REV=$(${HG} log -R icedtea --template '{node|short}' -r tip)
+    echo "VCS revision: ${VCS_REV}";
+
+    ICEDTEA_VERSION="${ROOT_VER}-${VCS_REV}"
+    echo "Creating icedtea-${ICEDTEA_VERSION}";
+    mkdir "icedtea-${ICEDTEA_VERSION}"
+    echo "Copying required files from checkout to icedtea-${ICEDTEA_VERSION}";
+    # Commented out for now as IcedTea 6's jconsole.desktop.in is outdated
+    #cp -a icedtea/jconsole.desktop.in ../icedtea-${ICEDTEA_VERSION}
+    cp -a "${RPM_DIR}/jconsole.desktop.in" "icedtea-${ICEDTEA_VERSION}"
+    cp -a icedtea/tapset "icedtea-${ICEDTEA_VERSION}"
+
+    rm -rf icedtea
+else
+    echo "Mode: Using tarball";
+
+    if test "${ICEDTEA_VERSION}" = ""; then
+	echo "No IcedTea version specified for tarball download.";
+	exit 3;
+    fi
+
+    if test "${CHECKSUM}" = ""; then
+	CHECKSUM=$(which sha256sum)
+	if test "${CHECKSUM}" = ""; then
+	    echo "sha256sum not found";
+	    exit 4;
+	fi
+    fi
+
+    if test "${PGP}" = ""; then
+	PGP=$(which gpg)
+	if test "${PGP}" = ""; then
+	    echo "gpg not found";
+	    exit 5;
+	fi
+    fi
+
+    echo "Dependencies:";
+    echo -e "\tCHECKSUM: ${CHECKSUM}";
+    echo -e "\tPGP: ${PGP}\n";
+
+    echo "Checking for IcedTea signing key ${ICEDTEA_SIGNING_KEY}...";
+    if ! gpg --list-keys ${ICEDTEA_SIGNING_KEY}; then
+	echo "IcedTea signing key ${ICEDTEA_SIGNING_KEY} not installed.";
+	exit 6;
+    fi
+
+    echo "Downloading IcedTea release tarball...";
+    ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz
+    echo "Downloading IcedTea tarball signature...";
+    ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz.sig
+    echo "Downloading IcedTea tarball checksums...";
+    ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.sha256
+
+    echo "Verifying checksums...";
+    ${CHECKSUM} --check --ignore-missing icedtea-${ICEDTEA_VERSION}.sha256
+
+    echo "Checking signature...";
+    ${PGP} --verify icedtea-${ICEDTEA_VERSION}.tar.xz.sig
+
+    echo "Extracting files...";
+    ${TAR} xJf icedtea-${ICEDTEA_VERSION}.tar.xz \
+       icedtea-${ICEDTEA_VERSION}/tapset \
+       icedtea-${ICEDTEA_VERSION}/jconsole.desktop.in
+
+    rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz
+    rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz.sig
+    rm -vf icedtea-${ICEDTEA_VERSION}.sha256
+fi
+
+echo "Replacing desktop files...";
+mv -v "icedtea-${ICEDTEA_VERSION}/jconsole.desktop.in" "${RPM_DIR}"
+
+echo "Creating new tapset tarball...";
+mv -v "icedtea-${ICEDTEA_VERSION}" openjdk
+${TAR} cJf "${RPM_DIR}/tapsets-icedtea-${ICEDTEA_VERSION}.tar.xz" openjdk
+
+rm -rvf openjdk
+
+popd
+rm -rf "${WORKDIR}"
+
+# Local Variables:
+# compile-command: "shellcheck icedtea_sync.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/scripts/openjdk_news.sh b/scripts/openjdk_news.sh
new file mode 100755
index 0000000..dd3ff66
--- /dev/null
+++ b/scripts/openjdk_news.sh
@@ -0,0 +1,114 @@
+#!/bin/bash
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by Andrew John Hughes <gnu.andrew@redhat.com>, 2012-2022
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+OLD_RELEASE=$1
+NEW_RELEASE=$2
+REPO=$3
+SUBDIR=$4
+SCRIPT_DIR=$(dirname "${0}")
+
+if test "${SUBDIR}" = ""; then
+    echo "No subdirectory specified; using .";
+    SUBDIR=".";
+fi
+
+if test "$REPO" = ""; then
+    echo "No repository specified; using ${PWD}"
+    REPO=${PWD}
+fi
+
+if test "${TMPDIR}" = ""; then
+    TMPDIR=/tmp;
+fi
+
+echo "Repository: ${REPO}"
+
+if [ -e "${REPO}/.git" ] ; then
+    TYPE=git;
+elif [ -e "${REPO}/.hg" ] ; then
+    TYPE=hg;
+else
+    echo "No Mercurial or Git repository detected.";
+    exit 1;
+fi
+
+if test "$OLD_RELEASE" = "" || test "$NEW_RELEASE" = ""; then
+    echo "ERROR: Need to specify old and new release";
+    exit 2;
+fi
+
+echo "Listing fixes between $OLD_RELEASE and $NEW_RELEASE in $REPO"
+rm -f "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" "${TMPDIR}/fixes"
+for repos in . $("${SCRIPT_DIR}/discover_trees.sh" "${REPO}");
+do
+    if test "$TYPE" = "hg"; then
+	hg log -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R "$REPO/$repos" -G -M "${REPO}/${SUBDIR}" | \
+	    grep -E '^[o:| ]*summary'|grep -v 'Added tag'|sed -r 's#^[o:| ]*summary:\W*([0-9])#  - JDK-\1#'| \
+	    sed 's#^[o:| ]*summary:\W*#  - #' >> "${TMPDIR}/fixes2";
+	hg log -v -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R "$REPO/$repos" -G -M "${REPO}/${SUBDIR}" | \
+	    grep -E '^[o:| ]*[0-9]{7}'|sed -r 's#^[o:| ]*([0-9]{7})#  - JDK-\1#' >> "${TMPDIR}/fixes3";
+    else
+	git -C "${REPO}" log --no-merges --pretty=format:%B "${NEW_RELEASE}...${OLD_RELEASE}" -- "${SUBDIR}" |grep -E '^[0-9]{7}' | \
+	    sed -r 's#^([0-9])#  - JDK-\1#' >> "${TMPDIR}/fixes2";
+	touch "${TMPDIR}/fixes3" ; # unused
+    fi
+done
+
+sort "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" > "${TMPDIR}/fixes4"
+uniq "${TMPDIR}/fixes4" > "${TMPDIR}/fixes"
+rm -f "${TMPDIR}/fixes2" "${TMPDIR}/fixes3"
+
+if ! [ -s "${TMPDIR}/fixes" ] ; then
+    echo "Failed to obtain fixes.";
+    exit 3;
+fi
+
+echo "In ${TMPDIR}/fixes:"
+cat "${TMPDIR}/fixes"
+
+printf "\nChecking for duplicates...";
+if uniq -d "${TMPDIR}/fixes4" | grep 'JDK' > "${TMPDIR}/dupes"; then
+    printf "found.\nWARNING: Review the following duplicates:\n";
+    cat "${TMPDIR}/dupes";
+else
+    echo "No apparent duplicates.";
+fi
+rm -f "${TMPDIR}/fixes4";
+
+printf "\nChecking for backouts...";
+if grep -i 'backout' "${TMPDIR}/fixes" > "${TMPDIR}/backouts"; then
+    printf "found.\nWARNING: Review the following backouts:\n"
+    cat "${TMPDIR}/backouts";
+else
+    echo "No apparent backouts.";
+fi
+printf "\nChecking for bundled library updates...";
+if grep -iE ':( \(tz\))? (update|upgrade).*(freetype|gif|harfbuzz|lcms|jpeg|png|timezone|zlib)' "${TMPDIR}/fixes" > "${TMPDIR}/bundles"; then
+    printf "found.\nWARNING: Review the following with respect to bundled provides:\n";
+    cat "${TMPDIR}/bundles";
+    echo "Compare the output of $(dirname "${0}")/get_bundle_versions.sh with the RPM using the JDK source tree"
+else
+    echo "No apparent library updates.";
+fi
+
+# Local Variables:
+# compile-command: "shellcheck openjdk_news.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/sources b/sources
index c4a7c33..33c44a9 100644
--- a/sources
+++ b/sources
@@ -1,3 +1,3 @@
-SHA512 (nssadapter-0.1.1.tar.xz) = 2b4675cfbfa2ccb6c9a4870a4b58ae555267f5b8c9bdb0cf37b075483e6e9ea929561c05070453cf0d67b0b029de5408274555bf2ff50e9533219e898b2717f9
-SHA512 (openjdk-25.0.4+7.tar.xz) = bd2c336ba2f0196e361bc8fd81a39cd9907682c0fac3a2b24a703a2abcede0fc75247fc54767329fc45d2f562f2728e3691db864363e9ab326c8218280831494
 SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
+SHA512 (nssadapter-0.1.1.tar.xz) = 2b4675cfbfa2ccb6c9a4870a4b58ae555267f5b8c9bdb0cf37b075483e6e9ea929561c05070453cf0d67b0b029de5408274555bf2ff50e9533219e898b2717f9
+SHA512 (openjdk-25.0.4+7.tar.xz) = 736949ba57d6e36df1b4f85418b2a27d3e0aec7e4b492ef5d9c006355ede63db3f5f9e0e0ea2d63bea119d9baaa9cf5a92e14dad19e69e9351072ef0955ea2cf
diff --git a/tests/tests.yml b/tests/tests.yml
new file mode 100644
index 0000000..c912769
--- /dev/null
+++ b/tests/tests.yml
@@ -0,0 +1,21 @@
+---
+- hosts: localhost
+  roles:
+  - role: standard-test-source
+    tags:
+    - always
+  - role: standard-test-basic
+    tags:
+    - classic
+    - atomic
+    required_packages:
+    - java-21-openjdk-devel
+    tests:
+      - javaVersion1:
+          dir: ~
+          run: set -ex; useradd franta1;  su franta1 -c 'java -version';
+          run: set -ex; useradd franta4;  su franta4 -c 'javac -version';
+          run: ls -l /usr/lib/jvm;
+      - javaVersion2:
+          dir: ~
+          run: set -ex; useradd franta2;  su franta2 -c 'java --version'