Portable build

Fix portable archive macros for RPM 4.19

.gitignore

@@ -44,3 +44,5 @@
 /openjdk-25+36.tar.xz
 /openjdk-25.0.1+8.tar.xz
 /nssadapter-0.1.0.tar.xz
+/openjdk-25.0.2+10.tar.xz
+/nssadapter-0.1.1.tar.xz

NEWS

@@ -3,6 +3,387 @@ Key:
 JDK-X  - https://bugs.openjdk.java.net/browse/JDK-X
 CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
 
+New in release OpenJDK 25.0.2 (2026-01-20):
+===========================================
+
+* CVEs
+  - CVE-2026-21925
+  - CVE-2026-21932
+  - CVE-2026-21933
+  - CVE-2026-21945
+* Changes
+  - JDK-8023263: [TESTBUG] Test closed/java/awt/Focus/InactiveWindowTest/InactiveFocusRace fails due to not enough time to initialize graphic components
+  - JDK-8162380: [TEST_BUG] MouseEvent/.../AltGraphModifierTest.java has only "Fail" button
+  - JDK-8201778: Speed up test javax/net/ssl/DTLS/PacketLossRetransmission.java
+  - JDK-8265429: Improve GCM encryption
+  - JDK-8277444: Data race between JvmtiClassFileReconstituter::copy_bytecodes and class linking
+  - JDK-8279005: sun/tools/jstat tests do not check for test case exit codes after JDK-8245129
+  - JDK-8304811: vmTestbase/vm/mlvm/indy/func/jvmti/stepBreakPopReturn/INDIFY_Test.java fails with JVMTI_ERROR_TYPE_MISMATCH
+  - JDK-8305567: serviceability/tmtools/jstat/GcTest01.java failed  utils.JstatGcResults.assertConsistency
+  - JDK-8317801: java/net/Socket/asyncClose/Race.java fails intermittently (aix)
+  - JDK-8320836: jtreg gtest runs should limit heap size
+  - JDK-8325766: Extend CertificateBuilder to create trust and end entity certificates programmatically
+  - JDK-8333526: Restructure java/nio/channels/DatagramChannel/StressNativeSignal.java to a fail fast exception handling policy
+  - JDK-8333783: java/nio/channels/FileChannel/directio/DirectIOTest.java is unstable with AV software
+  - JDK-8334238: Enhance AddLShortcutTest jpackage test
+  - JDK-8335986: Test javax/swing/JCheckBox/4449413/bug4449413.java fails on Windows 11 x64 because RBMenuItem's and CBMenuItem's checkmark on the left side are not visible
+  - JDK-8341496: Improve JMX connections
+  - JDK-8343218: Add option to disable allocating interface and abstract classes in non-class metaspace
+  - JDK-8343546: GHA: Cache required dependencies in master-branch workflow
+  - JDK-8345810: Custom launchers must be linked with pthread to avoid dynamic linker issues
+  - JDK-8346753: Test javax/swing/JMenuItem/RightLeftOrientation/RightLeftOrientation.java fails on Windows Server 2025 x64 because the icons of RBMenuItem and CBMenuItem are not visible in Nimbus LookAndFeel
+  - JDK-8346839: [TESTBUG] "java/awt/textfield/setechochartest4/setechochartest4.java" failed because the test frame disappears on clicking "Click Several Times" button
+  - JDK-8346884: Add since checker test to jdk.editpad
+  - JDK-8346952: GetGraphicsStressTest.java fails: Native resources unavailable
+  - JDK-8347277: java/awt/Focus/ComponentLostFocusTest.java fails intermittently
+  - JDK-8349188: LineBorder does not scale correctly
+  - JDK-8350621: Code cache stops scheduling GC
+  - JDK-8351487: [ubsan] jvmti.h runtime error: load of value which is not a valid value
+  - JDK-8352016: Improve java/lang/RuntimeTests/RuntimeExitLogTest.java
+  - JDK-8354348: Enable Extended EVEX to REX2/REX demotion for commutative operations with same dst and src2
+  - JDK-8354415: [Ubuntu25.04] api/java_awt/GraphicsDevice/indexTGF.html#SetDisplayMode - setDisplayMode_REFRESH_RATE_UNKNOWN fails: Height is different on vnc
+  - JDK-8354447: Missing test for retroactive @SuppressWarnings("dangling-doc-comments") behavior
+  - JDK-8354646: java.awt.TextField allows to identify the spaces in a password when double clicked at the starting and end of the text
+  - JDK-8355478: DoubleActionESC.java fails intermittently
+  - JDK-8356324: JVM crash (SIGSEGV at ClassListParser::resolve_indy_impl) during -Xshare:dump starting from 21.0.5
+  - JDK-8356897: Update NSS library to 3.111
+  - JDK-8357064: cds/appcds/ArchiveRelocationTest.java failed with missing expected output
+  - JDK-8357141: Update to use jtreg 7.5.2
+  - JDK-8357382: runtime/cds/appcds/aotClassLinking/BulkLoaderTest.java#aot fails with Xcomp and C1
+  - JDK-8357396: Refactor nmethod::make_not_entrant to use Enum instead of "const char*"
+  - JDK-8357691: File blocked.certs contains bad content when boot jdk 25 is used, sun/security/lib/CheckBlockedCerts.java failing
+  - JDK-8357694: RISC-V: Several IR verification tests fail when vlen=128
+  - JDK-8357799: Improve instructions for JFileChooser/HTMLFileName.java
+  - JDK-8357816: Add test from JDK-8350576
+  - JDK-8357822: C2: Multiple string optimization tests are no longer testing string concatenation optimizations
+  - JDK-8357959: (bf) ByteBuffer.allocateDirect initialization can result in large TTSP spikes
+  - JDK-8358048: java/net/httpclient/HttpsTunnelAuthTest.java incorrectly calls Thread::stop
+  - JDK-8358340: Support CDS heap archive with Generational Shenandoah
+  - JDK-8358532: JFileChooser in GTK L&F still displays HTML filename
+  - JDK-8358535: Changes in ClassValue (JDK-8351996) caused a 1-9% regression in Renaissance-PageRank
+  - JDK-8358556: Assert when running with -XX:-UseLibmIntrinsic
+  - JDK-8358685: [TEST] AOTLoggingTag.java failed with missing log message
+  - JDK-8358697: TextLayout/MyanmarTextTest.java passes if no Myanmar font is found
+  - JDK-8358723: jpackage signing issues: the main launcher doesn't have entitlements
+  - JDK-8358748: Large page size initialization fails with assert "page_size must be a power of 2"
+  - JDK-8358751: C2: Recursive inlining check for compiled lambda forms is broken
+  - JDK-8358813: JPasswordField identifies spaces in password via delete shortcuts
+  - JDK-8359061: Update and ProblemList manual test java/awt/Cursor/CursorDragTest/ListDragCursor.java
+  - JDK-8359104: gc/TestAlwaysPreTouchBehavior.java#<gcname> fails on Linux
+  - JDK-8359105: RISC-V: No need for acquire fence in safepoint poll during JNI calls
+  - JDK-8359127: Amend java/nio/channels/DatagramChannel/PromiscuousIPv6.java to use @requires for OS platform selection
+  - JDK-8359167: Remove unused test/hotspot/jtreg/vmTestbase/nsk/share/jpda/BindServer.java
+  - JDK-8359207: Remove runtime/signal/TestSigusr2.java since it is always skipped
+  - JDK-8359423: Improve error message in case of missing jsa shared archive
+  - JDK-8359428: Test 'javax/swing/JTabbedPane/bug4499556.java' failed because after selecting one of L&F items, the test case automatically failed when clicking on L&F Menu button again
+  - JDK-8359449: [TEST] open/test/jdk/java/io/File/SymLinks.java Refactor extract method for Windows specific test
+  - JDK-8359477: com/sun/net/httpserver/Test12.java appears to have a temp file race
+  - JDK-8359501: Enhance Handling of URIs
+  - JDK-8359687: Use PassFailJFrame for java/awt/print/Dialog/DialogType.java
+  - JDK-8359690: New test TestCPUTimeSampleThrottling still fails intermittently
+  - JDK-8359735: [Ubuntu 25.10] java/lang/ProcessBuilder/Basic.java, java/lang/ProcessHandle/InfoTest.java fail due to rust-coreutils
+  - JDK-8359827: Test runtime/Thread/ThreadCountLimit.java need loop increasing the limit
+  - JDK-8360022: ClassRefDupInConstantPoolTest.java fails when running in repeat
+  - JDK-8360090: [TEST] RISC-V: disable some cds tests on qemu
+  - JDK-8360178: TestArguments.atojulong gtest has incorrect format string
+  - JDK-8360219: [AIX] assert(locals_base >= l2) failed: bad placement
+  - JDK-8360255: runtime/jni/checked/TestLargeUTF8Length.java fails with -XX:-CompactStrings
+  - JDK-8360408: [TEST] Use @requires tag instead of exiting based on "os.name" property value for sun/net/www/protocol/file/FileURLTest.java
+  - JDK-8360411: [TEST] open/test/jdk/java/io/File/MaxPathLength.java Refactor extract method to encapsulate Windows specific test logic
+  - JDK-8360518: Docker tests do not work when asan is configured
+  - JDK-8360520: RISC-V: C1: Fix primitive array clone intrinsic regression after JDK-8333154
+  - JDK-8360664: Null pointer dereference in src/hotspot/share/prims/jvmtiTagMap.cpp in IterateOverHeapObjectClosure::do_object()
+  - JDK-8360783: CTW: Skip deoptimization between tiers
+  - JDK-8360791: [ubsan] Adjust signal handling
+  - JDK-8360867: CTW: Disable inline cache verification
+  - JDK-8360981: Remove use of Thread.stop in test/jdk/java/net/Socket/DeadlockTest.java
+  - JDK-8361112: Use exact float -> Float16 conversion method in Float16 tests
+  - JDK-8361180: Disable CompiledDirectCall verification with -VerifyInlineCaches
+  - JDK-8361198: [AIX] fix misleading error output in thread_cpu_time_unchecked
+  - JDK-8361211: C2: Final graph reshaping generates unencodeable klass constants
+  - JDK-8361215: Add AOT test case: verification constraint classes are excluded
+  - JDK-8361253: CommandLineOptionTest library should report observed values on failure
+  - JDK-8361255: CTW: Tolerate more NCDFE problems
+  - JDK-8361298: SwingUtilities/bug4967768.java fails where character P is not underline
+  - JDK-8361314: Test serviceability/jvmti/VMEvent/MyPackage/VMEventRecursionTest.java FATAL ERROR in native method: Failed during the GetClassSignature call
+  - JDK-8361367: AOT ExcludedClasses.java test failed with missing constant pool logs
+  - JDK-8361423: Add IPSupport::printPlatformSupport to java/net/NetworkInterface/IPv4Only.java
+  - JDK-8361449: RISC-V: Code cleanup for native call
+  - JDK-8361478: GHA: Use MSYS2 from GHA runners
+  - JDK-8361494: [IR Framework] Escape too much in replacement of placeholder
+  - JDK-8361497: Scoped Values: orElse and orElseThrow do not access the cache
+  - JDK-8361504: RISC-V: Make C1 clone intrinsic platform guard more specific
+  - JDK-8361520: Stabilize SystemGC benchmarks
+  - JDK-8361599: [PPC64] enable missing tests via jtreg requires
+  - JDK-8361711: Add library name configurability to PKCS11Test.java
+  - JDK-8361748: Enforce limits on the size of an XBM image
+  - JDK-8361839: Problemlist BogusFocusableWindowState due to failures in the CI pipeline
+  - JDK-8361868: [GCC static analyzer] complains about missing calloc - NULL checks in p11_util.c
+  - JDK-8361871: [GCC static analyzer] complains about use of uninitialized value ckpObject in p11_util.c
+  - JDK-8361888: [GCC static analyzer] ProcessImpl_md.c Java_java_lang_ProcessImpl_forkAndExec error: use of uninitialized value '*(ChildStuff *)p.mode
+  - JDK-8361892: AArch64: Incorrect matching rule leading to improper oop instruction encoding
+  - JDK-8361897: gc/z/TestUncommit.java fails with Uncommitted too slow
+  - JDK-8361948: Shenandoah: region free capacity unit mismatch
+  - JDK-8361950: Update to use jtreg 8
+  - JDK-8361959: [GCC static analyzer] java_props_md.c  leak of 'temp'  variable is reported
+  - JDK-8362107: Update the Jan CPU26_01 release date in master branch after forking Oct CPU25_10
+  - JDK-8362123: ClassLoader Leak via Executors.newSingleThreadExecutor(...)
+  - JDK-8362169: Pointer passed to upcall may get wrong scope
+  - JDK-8362204: test/jdk/sun/awt/font/TestDevTransform.java fails on Ubuntu 24.04
+  - JDK-8362207: Add more test cases for possible double-rounding in fma
+  - JDK-8362282: runtime/logging/StressAsyncUL.java failed with exitValue = 134
+  - JDK-8362308: Enhance Bitmap operations
+  - JDK-8362379: Test serviceability/HeapDump/UnmountedVThreadNativeMethodAtTop.java should mark as /native
+  - JDK-8362390: AIX make fails in awt_GraphicsEnv.c
+  - JDK-8362482: [TESTBUG] serviceability/HeapDump/UnmountedVThreadNativeMethodAtTop.java: System.gc() does not provide full GC
+  - JDK-8362501: Update test/hotspot/jtreg/applications/jcstress/README
+  - JDK-8362515: RISC-V: cleanup NativeFarCall
+  - JDK-8362516: Support of GCC static analyzer (-fanalyzer)
+  - JDK-8362530: VM crash with -XX:+PrintTieredEvents when collecting AOT profiling
+  - JDK-8362532: Test gc/g1/plab/* duplicate command-line options
+  - JDK-8362533: Tests sun/management/jmxremote/bootstrap/* duplicate VM flags
+  - JDK-8362581: Timeouts in java/nio/channels/SocketChannel/OpenLeak.java on UNIX
+  - JDK-8362582: GHA: Increase bundle retention time to deal with infra overload better
+  - JDK-8362596: RISC-V: Improve _vectorizedHashCode intrinsic
+  - JDK-8362602: Add test.timeout.factor to CompileFactory to avoid test timeouts
+  - JDK-8362632: Improve HttpServer Request handling
+  - JDK-8362834: Several runtime/Thread tests should mark as /native
+  - JDK-8362836: JFR: Broken pipe in jdk/jfr/event/io/TestIOTopFrame.java
+  - JDK-8362838: RISC-V: Incorrect matching rule leading to improper oop instruction encoding
+  - JDK-8362855: Test java/net/ipv6tests/TcpTest.java should report SkippedException when there no ia4addr  or ia6addr
+  - JDK-8362889: [GCC static analyzer] leak in libstringPlatformChars.c
+  - JDK-8362972: C2 fails with unexpected node in SuperWord truncation: IsFiniteF, IsFiniteD
+  - JDK-8363676: [GCC static analyzer] missing return value check of malloc in OGLContext_SetTransform
+  - JDK-8363696: Update the release version and date for OpenJDK 25u
+  - JDK-8363720: Follow up to JDK-8360411 with post review comments
+  - JDK-8363895: Minimal build fails with slowdebug builds after JDK-8354887
+  - JDK-8363898: RISC-V: TestRangeCheckHoistingScaledIV.java fails after JDK-8355293 when running without RVV
+  - JDK-8363910: Avoid tuning for Power10 CPUs on Linux ppc64le when gcc < 10 is used
+  - JDK-8363928: Specifying AOTCacheOutput with a blank path causes the JVM to crash
+  - JDK-8363965: GHA: Switch cross-compiling sysroots to Debian bookworm
+  - JDK-8363966: GHA: Switch cross-compiling sysroots to Debian trixie
+  - JDK-8364090: Dump JFR recording on CrashOnOutOfMemoryError
+  - JDK-8364111: InstanceMirrorKlass iterators should handle CDS and hidden classes consistently
+  - JDK-8364114: Test TestHugePageDecisionsAtVMStartup.java#LP_enabled fails when no free hugepage
+  - JDK-8364120: RISC-V: unify the usage of MacroAssembler::instruction_size
+  - JDK-8364150: RISC-V: Leftover for JDK-8343430 removing old trampoline call
+  - JDK-8364177: JDK fails to build due to undefined symbol in libpng on LoongArch64
+  - JDK-8364184: [REDO] AArch64: [VectorAPI] sve vector math operations are not supported after JDK-8353217
+  - JDK-8364190: JFR: RemoteRecordingStream withers don't work
+  - JDK-8364198: NMT should have a better corruption message
+  - JDK-8364199: Enhance list of environment variables printed in hserr/hsinfo file
+  - JDK-8364212: Shenandoah: Rework archived objects loading
+  - JDK-8364214: Enhance polygon data support
+  - JDK-8364235: Fix for JDK-8361447 breaks the alignment requirements for GuardedMemory
+  - JDK-8364257: JFR: User-defined events and settings with a one-letter name cannot be configured
+  - JDK-8364263: HttpClient: Improve encapsulation of ProxyServer
+  - JDK-8364296: Set IntelJccErratumMitigation flag ergonomically
+  - JDK-8364352: Some tests fail when using a limited number of pregenerated .jsa CDS archives
+  - JDK-8364454: ProblemList runtime/cds/DeterministicDump.java on macos for JDK-8363986
+  - JDK-8364503: gc/g1/TestCodeCacheUnloadDuringConcCycle.java fails because of race printing to stdout
+  - JDK-8364514: [asan] runtime/jni/checked/TestCharArrayReleasing.java heap-buffer-overflow
+  - JDK-8364556: JFR:  Disable SymbolTableStatistics and StringTableStatistics in default.jfc
+  - JDK-8364597: Replace THL A29 Limited with Tencent
+  - JDK-8364611: (process) Child process SIGPIPE signal disposition should be default
+  - JDK-8364660: ClassVerifier::ends_in_athrow() should be removed
+  - JDK-8364764: java/nio/channels/vthread/BlockingChannelOps.java subtests timed out
+  - JDK-8364786: Test java/net/vthread/HttpALot.java intermittently fails - 24999 handled, expected 25000
+  - JDK-8364984: Many jpackage tests are failing on Linux after JDK-8334238
+  - JDK-8364993: JFR: Disable jdk.ModuleExport in default.jfc
+  - JDK-8364996: java/awt/font/FontNames/LocaleFamilyNames.java times out on Windows
+  - JDK-8365058: Enhance CopyOnWriteArraySet
+  - JDK-8365071: ARM32: JFR intrinsic jvm_commit triggers C2 regalloc assert
+  - JDK-8365086: CookieStore.getURIs() and get(URI) should return an immutable List
+  - JDK-8365165: Zap C-heap memory at delete/free
+  - JDK-8365166: ARM32: missing os::fetch_bcp_from_context implementation
+  - JDK-8365168: Use 64-bit aligned addresses for CK_ULONG access in PKCS11 native key code
+  - JDK-8365200: RISC-V: compiler/loopopts/superword/TestGeneralizedReductions.java fails with Zvbb and vlen=128
+  - JDK-8365206: RISC-V: compiler/c2/irTests/TestFloat16ScalarOperations.java is failing on riscv64
+  - JDK-8365240: [asan] exclude some tests when using asan enabled binaries
+  - JDK-8365260: Problemlist 1 test due to failures in the CI pipeline
+  - JDK-8365265: x86 short forward jump exceeds 8-bit offset in methodHandles_x86.cpp when using Intel APX
+  - JDK-8365271: Improve Swing supports
+  - JDK-8365280: Enhance JOptionPane
+  - JDK-8365302: RISC-V: compiler/loopopts/superword/TestAlignVector.java fails when vlen=128
+  - JDK-8365307: AIX make fails after JDK-8364611
+  - JDK-8365312: GCC 12 cannot compile SVE on aarch64 with auto-var-init pattern
+  - JDK-8365389: Remove static color fields from SwingUtilities3 and WindowsMenuItemUI
+  - JDK-8365425: [macos26] javax/swing/JInternalFrame/8160248/JInternalFrameDraggingTest.java fails on macOS 26
+  - JDK-8365442: [asan] runtime/ErrorHandling/CreateCoredumpOnCrash.java fails
+  - JDK-8365468: EagerJVMCI should only apply to the CompilerBroker JVMCI runtime
+  - JDK-8365487: [asan] some oops (mode) related tests fail
+  - JDK-8365543: UnixNativeDispatcher.init should lookup open64at and stat64at on AIX
+  - JDK-8365571: GenShen: PLAB promotions may remain disabled for evacuation threads
+  - JDK-8365615: Improve JMenuBar/RightLeftOrientation.java
+  - JDK-8365638: JFR: Add --exact for debugging out-of-order events
+  - JDK-8365660: test/jdk/sun/security/pkcs11/KeyAgreement/ tests skipped without SkipExceprion
+  - JDK-8365700: Jar --validate without any --file option leaves around a temporary file /tmp/tmpJar<number>.jar
+  - JDK-8365726: Test crashed with assert in C1 thread: Possible safepoint reached by thread that does not allow it
+  - JDK-8365772: RISC-V: correctly prereserve NaN payload when converting from float to float16 in vector way
+  - JDK-8365790: Shutdown hook for application image does not work on Windows
+  - JDK-8365811: test/jdk/java/net/CookieHandler/B6644726.java failure - "Should have 5 cookies. Got only 4, expires probably didn't parse correctly"
+  - JDK-8365823: Revert storing abstract and interface Klasses to non-class metaspace
+  - JDK-8365834: Mark java/net/httpclient/ManyRequests.java  as intermittent
+  - JDK-8365841: RISC-V: Several IR verification tests fail after JDK-8350960 without Zvfh
+  - JDK-8365844: RISC-V: TestBadFormat.java fails when running without RVV
+  - JDK-8365863: /test/jdk/sun/security/pkcs11/Cipher tests skip without SkippedException
+  - JDK-8365913: Support latest MSC_VER in abstract_vm_version.cpp
+  - JDK-8365919: Replace currentTimeMillis with nanoTime in Stresser.java
+  - JDK-8365926: RISC-V: Performance regression in renaissance (chi-square)
+  - JDK-8365956: GenShen: Adaptive tenuring threshold algorithm may raise threshold prematurely
+  - JDK-8365983: Tests should throw SkippedException when SCTP not supported
+  - JDK-8366028: MethodType::fromMethodDescriptorString should not throw UnsupportedOperationException for invalid descriptors
+  - JDK-8366029: Do not add -XX:VerifyArchivedFields by default to CDS tests
+  - JDK-8366031: Mark com/sun/nio/sctp/SctpChannel/CloseDescriptors.java as intermittent
+  - JDK-8366075: Problemlist 2 tests due to failures in the CI pipeline
+  - JDK-8366092: [GCC static analyzer] UnixOperatingSystem.c warning: use of uninitialized value 'systemTicks'
+  - JDK-8366147: ZGC: ZPageAllocator::cleanup_failed_commit_single_partition may leak memory
+  - JDK-8366159: SkippedException is treated as a pass for pkcs11/KeyStore, pkcs11/SecretKeyFactory and pkcs11/SecureRandom
+  - JDK-8366208: Unexpected exception in sun.java2d.cmm.lcms.LCMSImageLayout
+  - JDK-8366229: runtime/Thread/TooSmallStackSize.java runs with all collectors
+  - JDK-8366250: Problemlist 3 tests due to failures in the CI pipeline
+  - JDK-8366340: Problemlist 1 test due to failures in the CI pipeline
+  - JDK-8366342: Key generator and key pair generator tests skipping, but showing as passed
+  - JDK-8366359: Test should throw SkippedException when there is no lpstat
+  - JDK-8366365: [test] test/lib-test/jdk/test/whitebox/CPUInfoTest.java should be updated
+  - JDK-8366434: THP not working properly with G1 after JDK-8345655
+  - JDK-8366446: Test java/awt/geom/ConcurrentDrawPolygonTest.java fails intermittently
+  - JDK-8366537: Test "java/util/TimeZone/DefaultTimeZoneTest.java" is not updating the zone ID as expected
+  - JDK-8366558: Gtests leave /tmp/cgroups-test* files
+  - JDK-8366694: Test JdbStopInNotificationThreadTest.java timed out after 60 second
+  - JDK-8366750: Remove test 'java/awt/Choice/ChoiceMouseWheelTest/ChoiceMouseWheelTest.java' from problemlist
+  - JDK-8366764: Deproblemlist java/awt/ScrollPane/ScrollPositionTest.java
+  - JDK-8366800: Problemlist 1 test due to failures in the CI pipeline
+  - JDK-8366844: Update and automate MouseDraggedOriginatedByScrollBarTest.java
+  - JDK-8366850: Test com/sun/jdi/JdbStopInNotificationThreadTest.java failed
+  - JDK-8366893: java/lang/Thread/virtual/stress/GetStackTraceALotWhenPinned.java timed out on macos-aarch64
+  - JDK-8366948: AOT cache creation crashes when iterating training data
+  - JDK-8366980: TestTransparentHugePagesHeap.java fails when run with -UseCompressedOops
+  - JDK-8367017: Remove legacy checks from WrappedToolkitTest and convert from bash
+  - JDK-8367021: Regression in LocaleDataTest refactoring
+  - JDK-8367048: RISC-V: Correct pipeline descriptions of the architecture
+  - JDK-8367066: RISC-V: refine register selection in MacroAssembler:: decode_klass_not_null
+  - JDK-8367098: RISC-V: sync CPU features with related JVM flags for dependant ones
+  - JDK-8367131: Test com/sun/jdi/ThreadMemoryLeakTest.java fails on 32 bits
+  - JDK-8367133: DTLS: fragmentation of Finished message results in handshake failure
+  - JDK-8367137: RISC-V: Detect Zicboz block size via hwprobe
+  - JDK-8367237: Thread-Safety Usage Warning for java.text.Collator Classes
+  - JDK-8367277: Fix copyright header in JMXInterfaceBindingTest.java
+  - JDK-8367313: CTW: Execute in AWT headless mode
+  - JDK-8367333: C2: Vector math operation intrinsification failure
+  - JDK-8367348: Enhance PassFailJFrame to support links in HTML
+  - JDK-8367378: GenShen: Missing timing stats when old mark buffers are flushed during final update refs
+  - JDK-8367384: The ICC_Profile class may throw exceptions during serialization
+  - JDK-8367598: Switch to CRC32C for SEED calculation in jdk.test.lib.Utils
+  - JDK-8367616: RISC-V: Auto-enable Zicboz extension for debug builds
+  - JDK-8367689: Revert removal of several compilation-related vmStructs fields
+  - JDK-8367692: RISC-V: Align post call nop
+  - JDK-8367694: Fix jtreg test failure when Intel APX is enabled for KNL platforms
+  - JDK-8367780: Enable UseAPX on Intel CPUs only when both APX_F and APX_NCI_NDD_NF cpuid features are present
+  - JDK-8367782: VerifyJarEntryName.java: Fix modifyJarEntryName to operate on bytes and re-introduce verifySignatureEntryName
+  - JDK-8367869: Test java/io/FileDescriptor/Sync.java timed out
+  - JDK-8367904: Test java/net/InetAddress/ptr/Lookup.java should throw SkippedException
+  - JDK-8367948: JFR: MethodTrace threshold setting has no effect
+  - JDK-8367953: JFR sampler threads does not appear in thread dump
+  - JDK-8367969: C2: compiler/vectorapi/TestVectorMathLib.java fails without UnlockDiagnosticVMOptions
+  - JDK-8367988: NewFileSystemTests.readOnlyZipFileFailure fails when run by root user
+  - JDK-8368032: Enhance Certificate Checking
+  - JDK-8368071: Compilation throughput regressed 2X-8X after JDK-8355003
+  - JDK-8368152: Shenandoah: Incorrect behavior at end of degenerated cycle
+  - JDK-8368192: Test java/lang/ProcessBuilder/Basic.java#id0 fails with Exception: Stack trace
+  - JDK-8368366: RISC-V: AlignVector is mistakenly set to AvoidUnalignedAccesses
+  - JDK-8368367: Test jdk/jfr/event/gc/detailed/TestGCHeapMemoryUsageEvent.java fails  jdk.GCHeapMemoryUsage "expected 0 > 0"
+  - JDK-8368565: Adjust comment regarding dependency of libjvm.so to librt
+  - JDK-8368606: Printer lookup returns empty on AIX platform due to uninitialized results list
+  - JDK-8368668: Several vmTestbase/vm/gc/compact tests timed out on large memory machine
+  - JDK-8368670: Deadlock in JFR on event register + class load
+  - JDK-8368698: runtime/cds/appcds/aotCache/OldClassSupport.java assert(can_add()) failed: Cannot add TrainingData objects
+  - JDK-8368732: RISC-V: Detect support for misaligned vector access via hwprobe
+  - JDK-8368890: open/test/jdk/tools/jpackage/macosx/NameWithSpaceTest.java fails randomly
+  - JDK-8368893: RISC-V: crash after JDK-8352673 on fastdebug version
+  - JDK-8368960: Adjust java UL logging in the build
+  - JDK-8368982: Test sun/security/tools/jarsigner/EC.java completed and timed out
+  - JDK-8369078: Fix faulty test conversion in IllegalCharsetName.java
+  - JDK-8369184: SimpleTimeZone equals() Returns True for Unequal Instances with Different hashCode Values
+  - JDK-8369190: JavaFrameAnchor on AArch64 has unnecessary barriers and wrong store order in MacroAssembler
+  - JDK-8369226: GHA: Switch to MacOS 15
+  - JDK-8369319: java/net/httpclient/CancelRequestTest.java fails intermittently
+  - JDK-8369450: [Ubuntu 25.10] openjdk fails to build due to rust-coreutils date
+  - JDK-8369487: Revert EA option for build promotion
+  - JDK-8369506: Bytecode rewriting causes Java heap corruption on AArch64
+  - JDK-8369560: Slowdebug build without CDS fails
+  - JDK-8369563: Gtest dll_address_to_function_and_library_name has issues with stripped pdb files
+  - JDK-8369616: JavaFrameAnchor on RISC-V has unnecessary barriers and wrong store order in MacroAssembler
+  - JDK-8369656: Calling CompletableFuture.join() could execute task in common pool
+  - JDK-8369657: [AIX] TOC overflow in static-launcher build when building slowdebug after JDK-8352064
+  - JDK-8369853: jpackage signing tests fail after JDK-8358723
+  - JDK-8369868: Compilation error in Win8365790Test.java with JDK-8358723 fix resulting in CI tier3 failure
+  - JDK-8369946: Bytecode rewriting causes Java heap corruption on PPC
+  - JDK-8369947: Bytecode rewriting causes Java heap corruption on RISC-V
+  - JDK-8369979: Flag UsePopCountInstruction was accidentally disabled on PPC64
+  - JDK-8370048: Shenandoah: Deprecated ShenandoahPacing option
+  - JDK-8370049: [s390x] G1 barrier compareAndExchange does not return old value when compareExchange fails
+  - JDK-8370318: AES-GCM vector intrinsic may read out of bounds (x86_64, AVX-512)
+  - JDK-8370331: Problemlist 2 tests due to failures in the CI pipeline
+  - JDK-8370428: Change milestone to fcs for all releases
+  - JDK-8370465: Right to Left Orientation Issues with MenuItem Component
+  - JDK-8371094: --mac-signing-key-user-name no longer works
+  - JDK-8371425: Include folder names in vscode workspace virtual folders
+  - JDK-8371697: test/jdk/java/nio/file/FileStore/Basic.java fails after 8360887 on linux
+  - JDK-8372753: jpackage ignores --file-associations option with predefined app image
+
+Notes on individual issues:
+===========================
+
+core-libs/java.lang.invoke:
+
+JDK-8358535: Changes in ClassValue (JDK-8351996) caused a 1-9% regression in Renaissance-PageRank
+=================================================================================================
+Behavioural changes in ClassValue in the original release of OpenJDK
+25 (JDK-8351996) caused a noticeable performance regression after use
+of ClassValue::remove.  The cause of this regression was found to be
+the accidental removal of a cache update in ClassValue::readAccess,
+leading to ClassValue::get calls taking the slow path rather than
+using the cache.  In this update, the cache update is restored.
+
+core-svc/javax.management:
+
+JDK-8341496: Improve JMX connections
+====================================
+With this release of OpenJDK, SSL connections created by
+javax.rmi.ssl.SslRMIClientSocketFactory now enable HTTPS-based
+endpoint identification by default.  This can be disabled by setting
+the new system property
+jdk.rmi.ssl.client.enableEndpointIdentification to false.
+
+hotspot/gc:
+
+JDK-8366434: THP not working properly with G1 after JDK-8345655
+===============================================================
+Refactoring of the memory reservation code in the original release of
+OpenJDK 25 (JDK-8345655) caused a set page size provided by
+`os::vm_page_size()` to always be used rather than a value passed in
+by the calling method.  As the page size is used by the G1 garbage
+collector to determine the alignment of the reservation, this lead to
+reservations being ineligible for Transparent Huge Pages (THP).  In
+this update, the caller specified page size is restored.
+
+security-libs/java.security:
+
+JDK-8368032: Enhance Certificate Checking
+=========================================
+OpenJDK supports the authorityInfoAccess extension in X.509
+certificates when the `com.sun.security.enableAIAcaIssuers` system
+property is set to `true`.  With this release of OpenJDK, a security
+and system property `com.sun.security.allowedAIALocations` is
+introduced which acts as a filter on the URIs specified in the
+extension.  By default, the property is empty, which will cause all
+URIs to be denied when the extension is enabled.  A value of `any` may
+be used to allow all URIs or a whitespace-separated list of filters
+may be used for more fine-grained control.  The syntax of the filters
+is specified in the `java.security` file.  A non-empty value for the
+system property takes precedence over the security property.
+
 New in release OpenJDK 25.0.1 (2025-10-21):
 ===========================================
 

create-redhat-properties-files.bash

@@ -23,28 +23,30 @@
 #
 # Usage:
 #
-# bash create-redhat-properties-files.bash <target directory>
+# bash create-redhat-properties-files.bash <target directory> <nssadapter path>
 #
 # Example usage in spec file:
 #
-# bash -x create-redhat-properties-files.bash ${imagepath}/conf/security
+# bash -x create-redhat-properties-files.bash ${installdir}/conf/security \
+#     %{_libdir}/%{sdkdir -- ${suffix}}/libnssadapter.so
 #
 # When you make changes to the file set here, also update the %files
 # section in the spec file, and the JDK_PROPS_FILES_JDK_25 variables
 # in TestSecurityProperties.java.
 
-[[ $# == 1 ]] || exit 1
+[[ $# == 2 ]] || exit 1
 
 SECURITY="${1}"
+NSSADAPTER="${2}"
 VENDOR="${SECURITY}"/redhat
 install --directory --mode=755 "${VENDOR}"
 install --directory --mode=755 "${VENDOR}"/true
 install --directory --mode=755 "${VENDOR}"/false
 
 # /usr/lib/jvm/java-25-openjdk/conf/security/redhat/SunPKCS11-FIPS.cfg
-install --mode 644 /dev/stdin "${VENDOR}"/SunPKCS11-FIPS.cfg <<'EOF'
+install --mode 644 /dev/stdin "${VENDOR}"/SunPKCS11-FIPS.cfg <<EOF
 name = FIPS
-library = ${java.home}/lib/libnssadapter.so
+library = ${NSSADAPTER}
 slot = 3
 nssUseSecmod = false
 attributes(*,CKO_SECRET_KEY,*)={ CKA_SIGN=true CKA_ENCRYPT=true }
@@ -107,16 +109,8 @@ security.provider.8=
 keystore.type=pkcs12
 EOF
 
-# /usr/lib/jvm/java-25-openjdk/conf/security/redhat/fips.properties
-# For now, this prevents an include cycle on JDKs that do not support
-# ${__redhat_fips__}.  In the future the goal is for it be overwritten
-# (based on /proc/sys/crypto/fips_enabled) at FIPS configuration time
-# (by fips-mode-setup or by grubby), at RPM install time by a
-# post-install hook, and/or during boot by a systemd oneshot service.
-install --mode 644 /dev/stdin "${VENDOR}"/fips.properties <<'EOF'
-include false/fips.properties
-EOF
-
+# Make sure java.security exists before appending
+test -e "${SECURITY}"/java.security || ( echo "${SECURITY}/java.security not found" && false )
 cat >> "${SECURITY}"/java.security <<'EOF'
 
 #

fips-25u-e55ada9353e.patch

@@ -0,0 +1,87 @@
+diff --git a/src/java.base/share/classes/java/security/Provider.java b/src/java.base/share/classes/java/security/Provider.java
+index de2845fb550..60eeab678ca 100644
+--- a/src/java.base/share/classes/java/security/Provider.java
++++ b/src/java.base/share/classes/java/security/Provider.java
+@@ -1203,6 +1203,34 @@ public Service getService(String type, String algorithm) {
+         return serviceSet;
+     }
+ 
++    /* vvvvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvvvv */
++    private static final class RedHatFIPSFilter {
++        static final boolean IS_ON = Boolean.parseBoolean(
++                Security.getProperty("__redhat_fips_filter__"));
++        private static final Map<String, Set<String>> ALLOW_LIST = Map.of(
++                "SUN", Set.of(
++                        "AlgorithmParameterGenerator",
++                        "AlgorithmParameters", "CertificateFactory",
++                        "CertPathBuilder", "CertPathValidator", "CertStore",
++                        "Configuration", "KeyStore"),
++                "SunEC", Set.of(
++                        "AlgorithmParameters", "KeyFactory"),
++                "SunJCE", Set.of(
++                        "AlgorithmParameters",
++                        "AlgorithmParameterGenerator", "KeyFactory",
++                        "SecretKeyFactory"),
++                "SunRsaSign", Set.of(
++                        "KeyFactory", "AlgorithmParameters")
++        );
++
++        static boolean isAllowed(String provName, String serviceType) {
++            Set<String> allowedServiceTypes = ALLOW_LIST.get(provName);
++            return allowedServiceTypes == null ||
++                    allowedServiceTypes.contains(serviceType);
++        }
++    }
++    /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
++
+     /**
+      * Add a service. If a service of the same type with the same algorithm
+      * name exists, and it was added using {@link #putService putService()},
+@@ -1231,6 +1259,15 @@ protected void putService(Service s) {
+                     ("service.getProvider() must match this Provider object");
+         }
+         String type = s.getType();
++        /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */
++        if (RedHatFIPSFilter.IS_ON && !RedHatFIPSFilter.isAllowed(name, type)) {
++            if (debug != null) {
++                debug.println("The previous " + name + ".putService() call " +
++                        "was skipped by " + RedHatFIPSFilter.class.getName());
++            }
++            return;
++        }
++        /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
+         String algorithm = s.getAlgorithm();
+         ServiceKey key = new ServiceKey(type, algorithm, true);
+         implRemoveService(serviceMap.get(key));
+diff --git a/src/java.base/share/classes/java/security/Security.java b/src/java.base/share/classes/java/security/Security.java
+index 6969fe8a8e1..4501d5971c4 100644
+--- a/src/java.base/share/classes/java/security/Security.java
++++ b/src/java.base/share/classes/java/security/Security.java
+@@ -323,7 +323,27 @@ public Properties getInitialProperties() {
+     }
+ 
+     private static void initialize() {
++        /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */
++        /*   This 'include'-directives-only magic property is an internal     */
++        /*   implementation detail that could (and probably will!) change.    */
++        /*   Red Hat customers should NOT rely on this for their own use.     */
++        String fipsKernelFlag = "/proc/sys/crypto/fips_enabled";
++        boolean fipsModeOn;
++        try (InputStream is = new java.io.FileInputStream(fipsKernelFlag)) {
++            fipsModeOn = is.read() == '1';
++        } catch (IOException ioe) {
++            fipsModeOn = false;
++            if (sdebug != null) {
++                sdebug.println("Failed to read FIPS kernel file: " + ioe);
++            }
++        }
++        String fipsMagicPropName = "__redhat_fips__";
++        System.setProperty(fipsMagicPropName, "" + fipsModeOn);
++        /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
+         SecPropLoader.loadAll();
++        /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */
++        System.clearProperty(fipsMagicPropName);
++        /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
+         initialSecurityProperties = (Properties) props.clone();
+         if (sdebug != null) {
+             for (String key : props.stringPropertyNames()) {

java-25-openjdk-portable.specfile

@@ -226,7 +226,7 @@
 # other targets since this target is configured to use in-tree
 # AWT dependencies: lcms, libjpeg, libpng, libharfbuzz, giflib
 # and possibly others
-%global static_libs_target static-libs-image
+%global static_libs_target static-libs-graal-image
 %else
 %global static_libs_target %{nil}
 %endif
@@ -336,7 +336,7 @@
 # New Version-String scheme-style defines
 %global featurever 25
 %global interimver 0
-%global updatever 1
+%global updatever 2
 %global patchver 0
 # buildjdkver is usually same as %%{featurever},
 # but in time of bootstrap of next jdk, it is featurever-1,
@@ -376,7 +376,7 @@
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      6.0.0pre00-c848b93a8598
 # Define current Git revision for the FIPS support patches
-%global fipsver 9203d50836c
+%global fipsver e55ada9353e
 # Define JDK versions
 %global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
 %global javaver         %{featurever}
@@ -390,8 +390,8 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{vcstag}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        8
-%global rpmrelease      1
+%global buildver        10
+%global rpmrelease      3
 #%%global tagsuffix     %%{nil}
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
@@ -430,7 +430,7 @@
 %global fullversion     %{compatiblename}-%{version}-%{release}
 # images directories from upstream build
 %global jdkimage                jdk
-%global static_libs_image       static-libs
+%global static_libs_image       static-libs-graal
 # output dir stub
 %define buildoutputdir() %{expand:build/jdk%{featurever}.build%{?1}}
 %define installoutputdir() %{expand:install/jdk%{featurever}.install%{?1}}
@@ -448,6 +448,11 @@
 %define jreportablearchive()  %{expand:%{jreportablenameimpl -- %%{1}}.tar.xz}
 %define jdkportablearchive()  %{expand:%{jdkportablenameimpl -- %%{1}}.tar.xz}
 %define staticlibsportablearchive()  %{expand:%{staticlibsportablenameimpl -- %%{1}}.tar.xz}
+# RPM 4.19 no longer accept our double percentaged %%{nil} passed to %%{1}
+# so we have to pass in "" but evaluate it, otherwise files record will include it
+%define jreportablearchiveForFiles()  %(echo %{jreportablearchive -- ""})
+%define jdkportablearchiveForFiles()  %(echo %{jdkportablearchive -- ""})
+%define staticlibsportablearchiveForFiles()  %(echo %{staticlibsportablearchive -- ""})
 %define jreportablename()     %{expand:%{jreportablenameimpl -- %%{1}}}
 %define jdkportablename()     %{expand:%{jdkportablenameimpl -- %%{1}}}
 # Intentionally use jdkportablenameimpl here since we want to have static-libs files overlayed on
@@ -640,41 +645,13 @@ Source18: TestTranslations.java
 ############################################
 # Crypto policy and FIPS support patches
 # Patch is generated from the fips-25u tree at https://github.com/rh-openjdk/jdk/tree/fips-25u
-# as follows: git diff %%{vcstag} src make test > fips-21u-$(git show -s --format=%h HEAD).patch
+# as follows: git diff %%{vcstag} src make test > fips-25u-$(git show -s --format=%h HEAD).patch
 # Diff is limited to src and make subdirectories to exclude .github changes
 # Fixes currently included:
-# PR3183, RH1340845: Follow system wide crypto policy
-# PR3695: Allow use of system crypto policy to be disabled by the user
-# RH1655466: Support RHEL FIPS mode using SunPKCS11 provider
-# RH1818909: No ciphersuites availale for SSLSocket in FIPS mode
-# RH1860986: Disable TLSv1.3 with the NSS-FIPS provider until PKCS#11 v3.0 support is available
-# RH1915071: Always initialise JavaSecuritySystemConfiguratorAccess
-# RH1929465: Improve system FIPS detection
-# RH1995150: Disable non-FIPS crypto in SUN and SunEC security providers
-# RH1996182: Login to the NSS software token in FIPS mode
-# RH1991003: Allow plain key import unless com.redhat.fips.plainKeySupport is set to false
-# RH2021263: Resolve outstanding FIPS issues
-# RH2052819: Fix FIPS reliance on crypto policies
-# RH2052829: Detect NSS at Runtime for FIPS detection
-# RH2052070: Enable AlgorithmParameters and AlgorithmParameterGenerator services in FIPS mode
-# RH2023467: Enable FIPS keys export
-# RH2094027: SunEC runtime permission for FIPS
-# RH2036462: sun.security.pkcs11.wrapper.PKCS11.getInstance breakage
-# RH2090378: Revert to disabling system security properties and FIPS mode support together
-# RH2104724: Avoid import/export of DH private keys
-# RH2092507: P11Key.getEncoded does not work for DH keys in FIPS mode
-# Build the systemconf library on all platforms
-# RH2048582: Support PKCS#12 keystores [now part of JDK-8301553 upstream]
-# RH2020290: Support TLS 1.3 in FIPS mode
-# Add nss.fips.cfg support to OpenJDK tree
-# RH2117972: Extend the support for NSS DBs (PKCS11) in FIPS mode
-# Remove forgotten dead code from RH2020290 and RH2104724
-# OJ1357: Fix issue on FIPS with a SecurityManager in place
-# RH2134669: Add missing attributes when registering services in FIPS mode.
-# test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
-# RH1940064: Enable XML Signature provider in FIPS mode
-# RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized [now part of JDK-8301553 upstream]
-# Disabled until 25: Patch1001: fips-%{featurever}u-%{fipsver}.patch
+# OPENJDK-2108: Internal __redhat_fips__ property
+# OPENJDK-2123: Algorithms lockdown
+# OPENJDK-4559: Red Hat Build of OpenJDK 25 should not restrict all the providers in FIPS
+Patch1001: fips-%{featurever}u-%{fipsver}.patch
 
 #############################################
 #
@@ -689,8 +666,18 @@ Source18: TestTranslations.java
 # OpenJDK patches which missed last update
 #
 #############################################
-
-# Currently empty
+# JDK-8372534: Update Libpng to 1.6.51
+# Integrated in 25.0.3
+Patch2001: jdk8372534-libpng-1.6.51.patch
+# JDK-8375063: Update Libpng to 1.6.54
+# Integrated in 25.0.3
+Patch2002: jdk8375063-libpng-1.6.54.patch
+# JDK-8375057: Update HarfBuzz to 12.3.2
+# Integrated in 25.0.3
+Patch2003: jdk8375057-harfbuzz-12.3.2.patch
+# JDK-8377526: Update Libpng to 1.6.55
+# Integrated in 25.0.3
+Patch2004: jdk8377526-libpng-1.6.55.patch
 
 #############################################
 #
@@ -777,13 +764,13 @@ Provides: bundled(freetype) = 2.13.3
 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
 Provides: bundled(giflib) = 5.2.2
 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h
-Provides: bundled(harfbuzz) = 10.4.0
+Provides: bundled(harfbuzz) = 12.3.2
 # Version in src/java.desktop/share/native/liblcms/lcms2.h
 Provides: bundled(lcms2) = 2.17.0
 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h
 Provides: bundled(libjpeg) = 6b
 # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h
-Provides: bundled(libpng) = 1.6.47
+Provides: bundled(libpng) = 1.6.55
 # Version in src/java.base/share/native/libzip/zlib/zlib.h
 Provides: bundled(zlib) = 1.3.1
 # We link statically against libstdc++ to increase portability
@@ -1003,8 +990,12 @@ sh %{SOURCE12} %{top_level_dir_name}
 # rpmbuild.
 pushd %{top_level_dir_name}
 # Add crypto policy and FIPS support
-# Disabled until 25
-#%patch -P1001 -p1
+%patch -P1001 -p1
+# Add libpng & harfbuzz updates ahead of 25.0.3
+%patch -P2001 -p1
+%patch -P2002 -p1
+%patch -P2003 -p1
+%patch -P2004 -p1
 popd # openjdk
 
 echo "Generating %{alt_java_name} man page"
@@ -1724,6 +1715,11 @@ $JAVA_HOME/bin/java -XX:+UnlockExperimentalVMOptions -XX:+UseShenandoahGC -versi
   $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR
 %endif
 
+  # Check blocked.certs is valid (OPENJDK-4362)
+  jtreg_test=$(pwd)/%{top_level_dir_name}/test/jdk/sun/security/lib/CheckBlockedCerts.java
+  jtreg_dir=$(dirname ${jtreg_test})
+  $JAVA_HOME/bin/java --add-exports java.base/sun.security.util=ALL-UNNAMED -Dtest.src=${jtreg_dir} ${jtreg_test}
+
   # Check src.zip has all sources. See RHBZ#1130490
   unzip -l $JAVA_HOME/lib/src.zip | grep 'sun.misc.Unsafe'
 
@@ -1895,8 +1891,8 @@ done
 
 %files
 # main package builds always
-%{_jvmdir}/%{jreportablearchive -- %%{nil}}
-%{_jvmdir}/%{jreportablearchive -- %%{nil}}.sha256sum
+%{_jvmdir}/%{jreportablearchiveForFiles}
+%{_jvmdir}/%{jreportablearchiveForFiles}.sha256sum
 %else
 %files
 # placeholder
@@ -1905,15 +1901,15 @@ done
 %if %{include_normal_build}
 
 %files devel
-%{_jvmdir}/%{jdkportablearchive -- %%{nil}}
+%{_jvmdir}/%{jdkportablearchiveForFiles}
 %{_jvmdir}/%{jdkportablearchive -- .debuginfo}
-%{_jvmdir}/%{jdkportablearchive -- %%{nil}}.sha256sum
+%{_jvmdir}/%{jdkportablearchiveForFiles}.sha256sum
 %{_jvmdir}/%{jdkportablearchive -- .debuginfo}.sha256sum
 
 %if %{include_staticlibs}
 %files static-libs
-%{_jvmdir}/%{staticlibsportablearchive -- %%{nil}}
-%{_jvmdir}/%{staticlibsportablearchive -- %%{nil}}.sha256sum
+%{_jvmdir}/%{staticlibsportablearchiveForFiles}
+%{_jvmdir}/%{staticlibsportablearchiveForFiles}.sha256sum
 %endif
 
 %files unstripped
@@ -1967,6 +1963,47 @@ done
 %endif
 
 %changelog
+* Sun Mar 15 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 1:25.0.2.0.10-3
+- Portable build
+- Fix portable archive macros for RPM 4.19
+
+* Tue Mar 03 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.2.0.10-3
+- Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown
+- Fix FIPS issue list to represent the new 25u version
+- Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3
+- Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3
+- Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3
+- Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526
+- Bump harfbuzz version to 12.3.2 following JDK-8375057
+- Resolves: OPENJDK-4570
+- Resolves: OPENJDK-4304
+- Resolves: OPENJDK-4524
+- Resolves: OPENJDK-4544
+- Resolves: OPENJDK-4553
+
+* Mon Jan 12 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.2.0.10-2
+- Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3
+- Bump libpng version to 1.6.51 following JDK-8372534
+- Add CVEs for 25.0.2 to NEWS
+- Correct version and date for this upcoming release in NEWS
+- Related: OPENJDK-4359
+
+* Mon Jan 12 2026 Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.2.0.10-1
+- Update to jdk-25.0.2+10 (GA)
+- Update release notes to 25.0.2+10
+- Add test to ensure blocked.certs is valid (OPENJDK-4362)
+- ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **
+- Resolves: OPENJDK-4359
+- Resolves: OPENJDK-4362
+
+* Tue Dec 02 2025 Severin Gehwolf <sgehwolf@redhat.com> - 1:25.0.1.0.8-2
+- Switch from static-libs-image to static-libs-graal-image to avoid large unneeded libjvm.a
+- Resolves: OPENJDK-4197
+
+* Tue Dec 02 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.1.0.8-2
+- Incorporate new FIPS patch for 25u
+- Resolves: OPENJDK-4184
+
 * Mon Nov 10 2025 Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.1.0.8-1
 - Update to jdk-25.0.1+8 (GA)
 - Update release notes to 25.0.1+8

java-25-openjdk.spec

@@ -0,0 +1 @@
+java-25-openjdk-portable.specfile

jdk8377526-libpng-1.6.55.patch

@@ -0,0 +1,248 @@
+commit b64f9e043d63b113682ea395e5bd8df2a26327ef
+Author:     Sergey Bylokhov <serb@openjdk.org>
+AuthorDate: Mon Mar 2 18:56:22 2026 +0000
+Commit:     Sergey Bylokhov <serb@openjdk.org>
+CommitDate: Mon Mar 2 18:56:22 2026 +0000
+
+    8377526: Update Libpng to 1.6.55
+    
+    Backport-of: fd74232d5dc4c6bfbcddb82e1b2621289aa2f65a
+
+diff --git a/src/java.desktop/share/legal/libpng.md b/src/java.desktop/share/legal/libpng.md
+index 80d12248ec4..a2ffcca1974 100644
+--- a/src/java.desktop/share/legal/libpng.md
++++ b/src/java.desktop/share/legal/libpng.md
+@@ -1,4 +1,4 @@
+-## libpng v1.6.54
++## libpng v1.6.55
+ 
+ ### libpng License
+ <pre>
+@@ -170,6 +170,7 @@ ### AUTHORS File Information
+  * Guy Eric Schalnat
+  * James Yu
+  * John Bowler
++ * Joshua Inscoe
+  * Kevin Bracey
+  * Lucas Chollet
+  * Magnus Holmgren
+diff --git a/src/java.desktop/share/native/libsplashscreen/libpng/CHANGES b/src/java.desktop/share/native/libsplashscreen/libpng/CHANGES
+index 3bb1baecd23..af9fcff6eb3 100644
+--- a/src/java.desktop/share/native/libsplashscreen/libpng/CHANGES
++++ b/src/java.desktop/share/native/libsplashscreen/libpng/CHANGES
+@@ -5988,7 +5988,7 @@ Version 1.6.32rc01 [August 18, 2017]
+ 
+ Version 1.6.32rc02 [August 22, 2017]
+   Added contrib/oss-fuzz directory which contains files used by the oss-fuzz
+-    project (https://github.com/google/oss-fuzz/tree/master/projects/libpng).
++    project <https://github.com/google/oss-fuzz/tree/master/projects/libpng>.
+ 
+ Version 1.6.32 [August 24, 2017]
+   No changes.
+@@ -6323,15 +6323,21 @@ Version 1.6.53 [December 5, 2025]
+ 
+ Version 1.6.54 [January 12, 2026]
+   Fixed CVE-2026-22695 (medium severity):
+-    Heap buffer over-read in `png_image_read_direct_scaled.
++    Heap buffer over-read in `png_image_read_direct_scaled`.
+     (Reported and fixed by Petr Simecek.)
+   Fixed CVE-2026-22801 (medium severity):
+     Integer truncation causing heap buffer over-read in `png_image_write_*`.
+   Implemented various improvements in oss-fuzz.
+     (Contributed by Philippe Antoine.)
+ 
++Version 1.6.55 [February 9, 2026]
++  Fixed CVE-2026-25646 (high severity):
++    Heap buffer overflow in `png_set_quantize`.
++    (Reported and fixed by Joshua Inscoe.)
++  Resolved an oss-fuzz build issue involving nalloc.
++    (Contributed by Philippe Antoine.)
+ 
+ Send comments/corrections/commendations to png-mng-implement at lists.sf.net.
+ Subscription is required; visit
+-https://lists.sourceforge.net/lists/listinfo/png-mng-implement
++<https://lists.sourceforge.net/lists/listinfo/png-mng-implement>
+ to subscribe.
+diff --git a/src/java.desktop/share/native/libsplashscreen/libpng/README b/src/java.desktop/share/native/libsplashscreen/libpng/README
+index 63d1376edf7..6e0d1e33137 100644
+--- a/src/java.desktop/share/native/libsplashscreen/libpng/README
++++ b/src/java.desktop/share/native/libsplashscreen/libpng/README
+@@ -1,4 +1,4 @@
+-README for libpng version 1.6.54
++README for libpng version 1.6.55
+ ================================
+ 
+ See the note about version numbers near the top of `png.h`.
+@@ -24,14 +24,14 @@ for more things than just PNG files.  You can use zlib as a drop-in
+ replacement for `fread()` and `fwrite()`, if you are so inclined.
+ 
+ zlib should be available at the same place that libpng is, or at
+-https://zlib.net .
++<https://zlib.net>.
+ 
+ You may also want a copy of the PNG specification.  It is available
+ as an RFC, a W3C Recommendation, and an ISO/IEC Standard.  You can find
+-these at http://www.libpng.org/pub/png/pngdocs.html .
++these at <http://www.libpng.org/pub/png/pngdocs.html>.
+ 
+-This code is currently being archived at https://libpng.sourceforge.io
+-in the download area, and at http://libpng.download/src .
++This code is currently being archived at <https://libpng.sourceforge.io>
++in the download area, and at <http://libpng.download/src>.
+ 
+ This release, based in a large way on Glenn's, Guy's and Andreas'
+ earlier work, was created and will be supported by myself and the PNG
+@@ -39,12 +39,12 @@ development group.
+ 
+ Send comments, corrections and commendations to `png-mng-implement`
+ at `lists.sourceforge.net`.  (Subscription is required; visit
+-https://lists.sourceforge.net/lists/listinfo/png-mng-implement
++<https://lists.sourceforge.net/lists/listinfo/png-mng-implement>
+ to subscribe.)
+ 
+ Send general questions about the PNG specification to `png-mng-misc`
+ at `lists.sourceforge.net`.  (Subscription is required; visit
+-https://lists.sourceforge.net/lists/listinfo/png-mng-misc
++<https://lists.sourceforge.net/lists/listinfo/png-mng-misc>
+ to subscribe.)
+ 
+ Historical notes
+diff --git a/src/java.desktop/share/native/libsplashscreen/libpng/png.c b/src/java.desktop/share/native/libsplashscreen/libpng/png.c
+index 5636b4a754e..955fda8dd7e 100644
+--- a/src/java.desktop/share/native/libsplashscreen/libpng/png.c
++++ b/src/java.desktop/share/native/libsplashscreen/libpng/png.c
+@@ -42,7 +42,7 @@
+ #include "pngpriv.h"
+ 
+ /* Generate a compiler error if there is an old png.h in the search path. */
+-typedef png_libpng_version_1_6_54 Your_png_h_is_not_version_1_6_54;
++typedef png_libpng_version_1_6_55 Your_png_h_is_not_version_1_6_55;
+ 
+ /* Sanity check the chunks definitions - PNG_KNOWN_CHUNKS from pngpriv.h and the
+  * corresponding macro definitions.  This causes a compile time failure if
+@@ -849,7 +849,7 @@ png_get_copyright(png_const_structrp png_ptr)
+    return PNG_STRING_COPYRIGHT
+ #else
+    return PNG_STRING_NEWLINE \
+-      "libpng version 1.6.54" PNG_STRING_NEWLINE \
++      "libpng version 1.6.55" PNG_STRING_NEWLINE \
+       "Copyright (c) 2018-2026 Cosmin Truta" PNG_STRING_NEWLINE \
+       "Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson" \
+       PNG_STRING_NEWLINE \
+diff --git a/src/java.desktop/share/native/libsplashscreen/libpng/png.h b/src/java.desktop/share/native/libsplashscreen/libpng/png.h
+index ab8876a9626..e95c0444399 100644
+--- a/src/java.desktop/share/native/libsplashscreen/libpng/png.h
++++ b/src/java.desktop/share/native/libsplashscreen/libpng/png.h
+@@ -29,7 +29,7 @@
+  * However, the following notice accompanied the original version of this
+  * file and, per its terms, should not be removed:
+  *
+- * libpng version 1.6.54
++ * libpng version 1.6.55
+  *
+  * Copyright (c) 2018-2026 Cosmin Truta
+  * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
+@@ -43,7 +43,7 @@
+  *   libpng versions 0.89, June 1996, through 0.96, May 1997: Andreas Dilger
+  *   libpng versions 0.97, January 1998, through 1.6.35, July 2018:
+  *     Glenn Randers-Pehrson
+- *   libpng versions 1.6.36, December 2018, through 1.6.54, January 2026:
++ *   libpng versions 1.6.36, December 2018, through 1.6.55, February 2026:
+  *     Cosmin Truta
+  *   See also "Contributing Authors", below.
+  */
+@@ -267,7 +267,7 @@
+  *    ...
+  *    1.5.30                  15    10530  15.so.15.30[.0]
+  *    ...
+- *    1.6.54                  16    10654  16.so.16.54[.0]
++ *    1.6.55                  16    10655  16.so.16.55[.0]
+  *
+  *    Henceforth the source version will match the shared-library major and
+  *    minor numbers; the shared-library major version number will be used for
+@@ -303,7 +303,7 @@
+  */
+ 
+ /* Version information for png.h - this should match the version in png.c */
+-#define PNG_LIBPNG_VER_STRING "1.6.54"
++#define PNG_LIBPNG_VER_STRING "1.6.55"
+ #define PNG_HEADER_VERSION_STRING " libpng version " PNG_LIBPNG_VER_STRING "\n"
+ 
+ /* The versions of shared library builds should stay in sync, going forward */
+@@ -314,7 +314,7 @@
+ /* These should match the first 3 components of PNG_LIBPNG_VER_STRING: */
+ #define PNG_LIBPNG_VER_MAJOR   1
+ #define PNG_LIBPNG_VER_MINOR   6
+-#define PNG_LIBPNG_VER_RELEASE 54
++#define PNG_LIBPNG_VER_RELEASE 55
+ 
+ /* This should be zero for a public release, or non-zero for a
+  * development version.
+@@ -345,7 +345,7 @@
+  * From version 1.0.1 it is:
+  * XXYYZZ, where XX=major, YY=minor, ZZ=release
+  */
+-#define PNG_LIBPNG_VER 10654 /* 1.6.54 */
++#define PNG_LIBPNG_VER 10655 /* 1.6.55 */
+ 
+ /* Library configuration: these options cannot be changed after
+  * the library has been built.
+@@ -455,7 +455,7 @@ extern "C" {
+ /* This triggers a compiler error in png.c, if png.c and png.h
+  * do not agree upon the version number.
+  */
+-typedef char *png_libpng_version_1_6_54;
++typedef char *png_libpng_version_1_6_55;
+ 
+ /* Basic control structions.  Read libpng-manual.txt or libpng.3 for more info.
+  *
+diff --git a/src/java.desktop/share/native/libsplashscreen/libpng/pngconf.h b/src/java.desktop/share/native/libsplashscreen/libpng/pngconf.h
+index 959c604edbc..b957f8b5061 100644
+--- a/src/java.desktop/share/native/libsplashscreen/libpng/pngconf.h
++++ b/src/java.desktop/share/native/libsplashscreen/libpng/pngconf.h
+@@ -29,7 +29,7 @@
+  * However, the following notice accompanied the original version of this
+  * file and, per its terms, should not be removed:
+  *
+- * libpng version 1.6.54
++ * libpng version 1.6.55
+  *
+  * Copyright (c) 2018-2026 Cosmin Truta
+  * Copyright (c) 1998-2002,2004,2006-2016,2018 Glenn Randers-Pehrson
+diff --git a/src/java.desktop/share/native/libsplashscreen/libpng/pnglibconf.h b/src/java.desktop/share/native/libsplashscreen/libpng/pnglibconf.h
+index b413b510acf..ae1ab462072 100644
+--- a/src/java.desktop/share/native/libsplashscreen/libpng/pnglibconf.h
++++ b/src/java.desktop/share/native/libsplashscreen/libpng/pnglibconf.h
+@@ -31,7 +31,7 @@
+  * However, the following notice accompanied the original version of this
+  * file and, per its terms, should not be removed:
+  */
+-/* libpng version 1.6.54 */
++/* libpng version 1.6.55 */
+ 
+ /* Copyright (c) 2018-2026 Cosmin Truta */
+ /* Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson */
+diff --git a/src/java.desktop/share/native/libsplashscreen/libpng/pngrtran.c b/src/java.desktop/share/native/libsplashscreen/libpng/pngrtran.c
+index 7680fe64828..fcce80da1cb 100644
+--- a/src/java.desktop/share/native/libsplashscreen/libpng/pngrtran.c
++++ b/src/java.desktop/share/native/libsplashscreen/libpng/pngrtran.c
+@@ -29,7 +29,7 @@
+  * However, the following notice accompanied the original version of this
+  * file and, per its terms, should not be removed:
+  *
+- * Copyright (c) 2018-2025 Cosmin Truta
++ * Copyright (c) 2018-2026 Cosmin Truta
+  * Copyright (c) 1998-2002,2004,2006-2018 Glenn Randers-Pehrson
+  * Copyright (c) 1996-1997 Andreas Dilger
+  * Copyright (c) 1995-1996 Guy Eric Schalnat, Group 42, Inc.
+@@ -737,8 +737,8 @@ png_set_quantize(png_structrp png_ptr, png_colorp palette,
+                          break;
+ 
+                      t->next = hash[d];
+-                     t->left = (png_byte)i;
+-                     t->right = (png_byte)j;
++                     t->left = png_ptr->palette_to_index[i];
++                     t->right = png_ptr->palette_to_index[j];
+                      hash[d] = t;
+                   }
+                }

rpminspect.yaml

@@ -1,3 +1,4 @@
 ---
 inspections:
     javabytecode: off
+    abidiff: off

scripts/builds/check_signatures.sh

@@ -0,0 +1,77 @@
+#!/bin/sh
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Check the signatures (if any) in RHEL RPM buildinfo
+# This is intended to be run from the tagging scripts
+
+# Return codes:
+# - 1 - Buildinfo file not specified
+# - 2 = Missing buildinfo file
+# - 3 = No signatures
+# - 4 = Multiple signature types found
+# - 5 = PQC signature found
+# - 6 = Old signature (fd431d51) found
+# - 7 = Unknown signature found
+
+BUILDINFO=${1}
+NEW_SIGNATURE="release4";
+OLD_SIGNATURE="fd431d51";
+
+if test "${BUILDINFO}" = ""; then
+    echo "${0} <BUILDINFO>";
+    exit 1;
+fi
+
+if ! test -e "${BUILDINFO}" ; then
+    echo "${BUILDINFO} not found.";
+    exit 2;
+fi
+
+if cat ${BUILDINFO} | grep -q Signatures ; then
+    signature=$(cat ${BUILDINFO} | grep Signatures|cut -d ' ' -f 2-|uniq -c);
+    uniq_count=$(echo ${signature} | wc -l);
+    if test ${uniq_count} -gt 1; then
+        echo "Multiple signature types found:";
+        echo "${signature}";
+        exit 4;
+    fi
+    sig_count=$(echo ${signature} | cut -d ' ' -f 1);
+    sig_type=$(echo ${signature} | cut -d ' ' -f 2);
+    echo "${sig_count} signatures of type ${sig_type} found";
+    if echo "${sig_type}" | grep -q "${NEW_SIGNATURE}" ; then
+        echo "PQC signature found.";
+        exit 5;
+    elif echo "${sig_type}" | grep -q "${OLD_SIGNATURE}"; then
+        echo "Old pre-PQC signature found.";
+        exit 6;
+    else
+        echo "Unknown signature found.";
+        exit 7;
+    fi
+else
+    echo "Build has no signatures.";
+    exit 3;
+fi
+
+# Local Variables:
+# compile-command: "shellcheck check_signatures.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/get_gating_results.sh

@@ -0,0 +1,63 @@
+#!/bin/bash
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Retrieve the results of a gating test using the ID from the JSON
+# retrieved by query_build_gating.sh
+
+RESULT_ID=${1}
+
+if test "${RESULT_ID}" = ""; then
+    echo "No ID specified.";
+    echo "${0} <RESULT_ID>";
+    exit 1;
+fi
+
+CURL=$(command -v curl)
+JSON_TOOL=$(command -v jq)
+
+if test "${CURL}" = ""; then
+    echo "curl not found";
+    exit 2;
+fi
+
+if test "${JSON_TOOL}" = ""; then
+    echo "jq not found";
+    exit 3;
+fi
+
+URL="https://resultsdb-api.engineering.redhat.com/api/v2.0/results/${RESULT_ID}"
+JSON_OUT=$(mktemp --tmpdir out.XXXXXX.json)
+
+CMD=("${CURL}" --silent --show-error "${URL}")
+
+echo "${CMD[@]}"
+
+if command "${CMD[@]}" > "${JSON_OUT}" ; then
+    "${JSON_TOOL}" < "${JSON_OUT}"
+else
+    echo "Failed to obtain JSON";
+    exit 4;
+fi
+
+# Local Variables:
+# compile-command: "shellcheck get_gating_results.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/query_build_gating.sh

@@ -0,0 +1,94 @@
+#!/bin/bash
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Retrieve the status of a build's progress through gating
+
+RHEL_VER=${1}
+NVR=${2}
+
+if test "${RHEL_VER}" = ""; then
+    echo "No RHEL version specified.";
+    echo "${0} <RHEL_VER> <NVR>";
+    exit 1;
+fi
+
+if test "${NVR}" = ""; then
+    echo "No NVR specified.";
+    echo "${0} <RHEL_VER> <NVR>";
+    exit 2;
+fi
+
+CURL=$(command -v curl)
+JSON_TOOL=$(command -v jq)
+JSON_FILE=$(mktemp --tmpdir query.XXXXXX.json)
+JSON_OUT=$(mktemp --tmpdir out.XXXXXX.json)
+URL="https://greenwave.engineering.redhat.com/api/v1.0/decision"
+
+if test "${CURL}" = ""; then
+    echo "curl not found";
+    exit 3;
+fi
+
+if test "${JSON_TOOL}" = ""; then
+    echo "jq not found";
+    exit 4;
+fi
+
+{
+    echo "{";
+    printf "\t\"decision_context\":\"osci_compose_gate\",\n";
+    printf "\t\"product_version\":\"rhel-%d\",\n" "${RHEL_VER}";
+    printf "\t\"subject_type\":\"koji_build\",\n";
+    printf "\t\"subject_identifier\":\"%s\",\n" "${NVR}";
+    printf "\t\"verbose\":false\n";
+    echo "}";
+} > "${JSON_FILE}"
+
+echo "Sending the following JSON...";
+cat "${JSON_FILE}"
+
+CMD=("${CURL}" --silent --show-error -X POST)
+
+JSON_COMMAND="--json";
+# Check --json is available
+${CURL} ${JSON_COMMAND} 2> /dev/null
+if [ $? -eq 2 ] ; then
+    echo "--json unsupported; falling back on --data-ascii";
+    CMD=("${CMD[@]}" --header Content-Type:application/json --data-ascii);
+else
+    CMD=("${CMD[@]}" "${JSON_COMMAND}");
+fi
+
+CMD=("${CMD[@]}" "@${JSON_FILE}" "${URL}")
+
+echo "${CMD[@]}"
+
+if command "${CMD[@]}" > "${JSON_OUT}" ; then
+    "${JSON_TOOL}" < "${JSON_OUT}"
+else
+    echo "Failed to obtain JSON";
+    exit 5;
+fi
+
+# Local Variables:
+# compile-command: "shellcheck query_build_gating.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/tag_rhel.sh

@@ -0,0 +1,87 @@
+#!/bin/sh
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Tag public RHEL RPMs into gating for all supported streams
+# This is intended to be run from tag_rhel_<ver>_(public|embargoed).sh
+
+BUILD="${1}"
+BUILDLOG="${2}"
+SUFFIX="${3}"
+shift 3;
+SUPPORTED_VERS="$*"
+
+CMD_SYNTAX="${0} <BUILD> <BUILDLOG> <SUFFIX> <SUPPORTED_VERS>";
+GATE_SUFFIX="gate"
+
+if test "${BUILD}" = ""; then
+    echo "${CMD_SYNTAX}";
+    exit 1;
+fi
+
+if test "${BUILDLOG}" = ""; then
+    echo "${CMD_SYNTAX}";
+    exit 2;
+fi
+
+if test "${SUPPORTED_VERS}" = ""; then
+    echo "${CMD_SYNTAX}";
+    exit 3;
+fi
+
+buildtags=$(grep "^Tag" "${BUILDLOG}" | cut -d : -f 2-)
+echo "Build has tags ${buildtags}";
+
+if [ "${SUFFIX}" = "${GATE_SUFFIX}" ] ; then
+    echo "Gating system can only handle one tag at a time."
+    echo "Script will need to be re-run for subsequent tags once previous tag has moved to -candidate."
+    if echo "${buildtags}" | grep -q "${GATE_SUFFIX}"; then
+        echo "Tag with \"-${GATE_SUFFIX}\" found. Please complete gating before re-running.";
+        exit 1;
+    fi
+fi
+
+done=0;
+for ver in ${SUPPORTED_VERS}; do
+    vertag="rhel-${ver}";
+    proposedtag="${vertag}-${SUFFIX}";
+    echo "Checking if ${BUILD} has been added to ${vertag}...";
+    if echo "${buildtags}" | grep -q "${vertag}" ; then
+        echo "${BUILD} has been tagged into ${proposedtag}";
+    else
+        if [ "${SUFFIX}" = "${GATE_SUFFIX}" ] && [ "${done}" -eq 1 ]; then
+            echo "Already added a tag. Need to tag ${proposedtag} in a future run.";
+        else
+            echo "Tagging ${BUILD} into ${proposedtag}";
+            brew tag-build --nowait "${proposedtag}" "${BUILD}";
+            done=1;
+        fi
+    fi
+done
+if [ "${done}" -eq 1 ]; then
+    brew watch-task --mine;
+else
+    echo "Nothing to do.";
+fi
+
+# Local Variables:
+# compile-command: "shellcheck tag_rhel.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/tag_rhel_10_embargoed_pqc.sh

@@ -0,0 +1,67 @@
+#!/bin/sh
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Tag newer PQC embargoed RHEL 10 RPMs into supported z-streams
+
+BUILD=${1}
+
+if test "${BUILD}" = ""; then
+    echo "${0} <BUILD>";
+    exit 1;
+fi
+
+BUILDLOG=$(mktemp --tmpdir "temp-${BUILD}-buildinfo-XXX")
+SUPPORTED_VERS="10.2-z 10.1-z"
+WORKING_DIR=$(dirname "${0}")
+EMBARGOED_SUFFIX="nocompose-candidate"
+
+echo "Obtaining buildinfo for ${BUILD}...";
+brew buildinfo "${BUILD}" 2>&1 | tee "${BUILDLOG}" > /dev/null
+
+echo "Checking signatures for ${BUILD}...";
+"${WORKING_DIR}"/check_signatures.sh "${BUILDLOG}"
+
+# Return codes:
+# - 1 - Buildinfo file not specified
+# - 2 = Missing buildinfo file
+# - 3 = No signatures
+# - 4 = Multiple signature types found
+# - 5 = PQC signature found
+# - 6 = Old signature (fd431d51) found
+# - 7 = Unknown signature found
+ret=$?;
+if [ "${ret}" -eq 6 ] ; then
+    echo "Build has old signatures which should not be the case for OpenJDK 25";
+    exit 2;
+elif ! { [ "${ret}" -eq 6 ] || [ "${ret}" -eq 3 ] ; } ; then
+    echo "Signature check failed.";
+    exit 3;
+fi
+
+echo "Tagging embargoed build for ${SUPPORTED_VERS}...";
+"${WORKING_DIR}"/tag_rhel.sh "${BUILD}" "${BUILDLOG}" "${EMBARGOED_SUFFIX}" "${SUPPORTED_VERS}"
+
+rm -f "${BUILDLOG}"
+
+# Local Variables:
+# compile-command: "shellcheck tag_rhel_10_embargoed_pqc.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/tag_rhel_10_public_pqc.sh

@@ -0,0 +1,67 @@
+#!/bin/sh
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Tag newer PQC public RHEL 10 RPMs into gating for all supported streams
+
+BUILD=${1}
+
+if test "${BUILD}" = ""; then
+    echo "${0} <BUILD>";
+    exit 1;
+fi
+
+BUILDLOG=$(mktemp --tmpdir "temp-${BUILD}-buildinfo-XXX")
+SUPPORTED_VERS="10.3 10.2-z 10.1-z"
+WORKING_DIR=$(dirname "${0}")
+GATE_SUFFIX="gate"
+
+echo "Obtaining buildinfo for ${BUILD}...";
+brew buildinfo "${BUILD}" 2>&1 | tee "${BUILDLOG}" > /dev/null
+
+echo "Checking signatures for ${BUILD}...";
+"${WORKING_DIR}"/check_signatures.sh "${BUILDLOG}"
+
+# Return codes:
+# - 1 - Buildinfo file not specified
+# - 2 = Missing buildinfo file
+# - 3 = No signatures
+# - 4 = Multiple signature types found
+# - 5 = PQC signature found
+# - 6 = Old signature (fd431d51) found
+# - 7 = Unknown signature found
+ret=$?;
+if [ "${ret}" -eq 6 ] ; then
+    echo "Build has old signatures which should not be the case for OpenJDK 25";
+    exit 2;
+elif ! { [ "${ret}" -eq 5 ] || [ "${ret}" -eq 3 ] ; } ; then
+    echo "Signature check failed.";
+    exit 3;
+fi
+
+echo "Tagging build into gating for ${SUPPORTED_VERS}...";
+"${WORKING_DIR}"/tag_rhel.sh "${BUILD}" "${BUILDLOG}" "${GATE_SUFFIX}" "${SUPPORTED_VERS}"
+
+rm -f "${BUILDLOG}"
+
+# Local Variables:
+# compile-command: "shellcheck tag_rhel_10_public_pqc.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/tag_rhel_9_embargoed_pqc.sh

@@ -0,0 +1,67 @@
+#!/bin/sh
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Tag newer PQC embargoed RHEL 9 RPMs into supported z-streams
+
+BUILD=${1}
+
+if test "${BUILD}" = ""; then
+    echo "${0} <BUILD>";
+    exit 1;
+fi
+
+BUILDLOG=$(mktemp --tmpdir "temp-${BUILD}-buildinfo-XXX")
+SUPPORTED_VERS="9.8.0-z 9.7.0-z"
+WORKING_DIR=$(dirname "${0}")
+EMBARGOED_SUFFIX="nocompose-candidate"
+
+echo "Obtaining buildinfo for ${BUILD}...";
+brew buildinfo "${BUILD}" 2>&1 | tee "${BUILDLOG}" > /dev/null
+
+echo "Checking signatures for ${BUILD}...";
+"${WORKING_DIR}"/check_signatures.sh "${BUILDLOG}"
+
+# Return codes:
+# - 1 - Buildinfo file not specified
+# - 2 = Missing buildinfo file
+# - 3 = No signatures
+# - 4 = Multiple signature types found
+# - 5 = PQC signature found
+# - 6 = Old signature (fd431d51) found
+# - 7 = Unknown signature found
+ret=$?;
+if [ "${ret}" -eq 6 ] ; then
+    echo "Build has old signatures which should not be the case for OpenJDK 25";
+    exit 2;
+elif ! { [ "${ret}" -eq 6 ] || [ "${ret}" -eq 3 ] ; } ; then
+    echo "Signature check failed.";
+    exit 3;
+fi
+
+echo "Tagging embargoed build for ${SUPPORTED_VERS}...";
+"${WORKING_DIR}"/tag_rhel.sh "${BUILD}" "${BUILDLOG}" "${EMBARGOED_SUFFIX}" "${SUPPORTED_VERS}"
+
+rm -f "${BUILDLOG}"
+
+# Local Variables:
+# compile-command: "shellcheck tag_rhel_9_embargoed_pqc.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/tag_rhel_9_public_pqc.sh

@@ -0,0 +1,67 @@
+#!/bin/sh
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Tag newer PQC public RHEL 9 RPMs into gating for all supported streams
+
+BUILD=${1}
+
+if test "${BUILD}" = ""; then
+    echo "${0} <BUILD>";
+    exit 1;
+fi
+
+BUILDLOG=$(mktemp --tmpdir "temp-${BUILD}-buildinfo-XXX")
+SUPPORTED_VERS="9.9.0 9.8.0-z 9.7.0-z"
+WORKING_DIR=$(dirname "${0}")
+GATE_SUFFIX="gate"
+
+echo "Obtaining buildinfo for ${BUILD}...";
+brew buildinfo "${BUILD}" 2>&1 | tee "${BUILDLOG}" > /dev/null
+
+echo "Checking signatures for ${BUILD}...";
+"${WORKING_DIR}"/check_signatures.sh "${BUILDLOG}"
+
+# Return codes:
+# - 1 - Buildinfo file not specified
+# - 2 = Missing buildinfo file
+# - 3 = No signatures
+# - 4 = Multiple signature types found
+# - 5 = PQC signature found
+# - 6 = Old signature (fd431d51) found
+# - 7 = Unknown signature found
+ret=$?;
+if [ "${ret}" -eq 6 ] ; then
+    echo "Build has old signatures which should not be the case for OpenJDK 25";
+    exit 2;
+elif ! { [ "${ret}" -eq 5 ] || [ "${ret}" -eq 3 ] ; } ; then
+    echo "Signature check failed.";
+    exit 3;
+fi
+
+echo "Tagging build into gating for ${SUPPORTED_VERS}...";
+"${WORKING_DIR}"/tag_rhel.sh "${BUILD}" "${BUILDLOG}" "${GATE_SUFFIX}" "${SUPPORTED_VERS}"
+
+rm -f "${BUILDLOG}"
+
+# Local Variables:
+# compile-command: "shellcheck tag_rhel_9_public_pqc.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/waive_issue.sh

@@ -0,0 +1,132 @@
+#!/bin/bash
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Waive a gating issue
+
+RHEL_VER=${1}
+NVR=${2}
+TESTCASE=${3}
+COMMENT=${4}
+
+CURL=$(command -v curl)
+JSON_TOOL=$(command -v json_verify)
+JSON_FORMAT=$(command -v jq)
+JSON_FILE=$(mktemp --tmpdir waive.XXXXXX.json)
+HEADER_FILE=$(mktemp --tmpdir waive.XXXXXX.headers)
+JSON_OUT=$(mktemp --tmpdir out.XXXXXX.json)
+
+CACERT=/etc/ssl/certs/2022-IT-Root-CA.pem
+CACERT_DIR=$(dirname ${CACERT})
+URL="https://waiverdb.engineering.redhat.com/api/v1.0/waivers/"
+
+if test -z "${JSON_TOOL}" -o ! -x "${JSON_TOOL}" ; then
+    echo "JSON verifier not found. Skipping verification.";
+    SKIP_JSON=1;
+else
+    SKIP_JSON=0;
+fi
+
+if test "x${RHEL_VER}" = "x"; then
+    echo "No RHEL version specified.";
+    echo "${0} <RHEL_VER> <NVR> <TESTCASE> <COMMENT>";
+    exit 1;
+fi
+
+if test "x${NVR}" = "x"; then
+    echo "No NVR specified.";
+    echo "${0} <RHEL_VER> <NVR> <TESTCASE> <COMMENT>";
+    exit 2;
+fi
+
+if test "x${TESTCASE}" = "x"; then
+    echo "No testcase specified.";
+    echo "${0} <RHEL_VER> <NVR> <TESTCASE> <COMMENT>";
+    exit 3;
+fi
+
+if test "x${COMMENT}" = "x"; then
+    COMMENT="Gating broken";
+    echo "Setting COMMENT to default of '${COMMENT}'"
+fi
+
+if test "${CURL}" = ""; then
+    echo "curl not found";
+    exit 4;
+fi
+
+if test "${JSON_FORMAT}" = ""; then
+    echo "jq not found";
+    exit 5;
+fi
+
+{
+    echo "{";
+    printf "\t\"subject_type\":\"brew-build\",\n";
+    printf "\t\"subject_identifier\":\"%s\",\n" "${NVR}";
+    printf "\t\"testcase\":\"%s\",\n" "${TESTCASE}";
+    printf "\t\"waived\":true,\n";
+    printf "\t\"product_version\":\"rhel-%d\",\n" "${RHEL_VER}"
+    printf "\t\"comment\":\"%s\"\n" "${COMMENT}";
+    echo "}"
+} > "${JSON_FILE}"
+
+if [ "${SKIP_JSON}" -eq 0 ] ; then
+   "${JSON_TOOL}" < "${JSON_FILE}" || exit 6;
+fi
+
+CMD=("${CURL}" --silent --show-error --capath "${CACERT_DIR}" --negotiate -u :)
+
+JSON_COMMAND="--json";
+# Check --json is available
+${CURL} ${JSON_COMMAND} 2> /dev/null
+if [ $? -eq 2 ] ; then
+    echo "--json unsupported; falling back on --data-binary";
+    {
+        echo "Content-Type: application/json";
+        echo "Accept: application/json";
+    } > "${HEADER_FILE}"
+    echo "Header file:";
+    cat "${HEADER_FILE}"
+    CMD=("${CMD[@]}" --header "@${HEADER_FILE}" --data-binary);
+else
+    CMD=("${CMD[@]}" "${JSON_COMMAND}");
+fi
+CMD=("${CMD[@]}" "@${JSON_FILE}" "${URL}")
+
+echo "Sending the following JSON...";
+cat "${JSON_FILE}"
+
+echo "${CMD[@]}"
+
+if command "${CMD[@]}" > "${JSON_OUT}" ; then
+    "${JSON_FORMAT}" < "${JSON_OUT}"
+else
+    echo "Failed to file waiver";
+    exit 7;
+fi
+
+rm -v "${JSON_FILE}"
+rm -v "${HEADER_FILE}"
+
+# Local Variables:
+# compile-command: "shellcheck waive_issue.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/waive_leapp_issue.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 
-# Copyright (C) 2024 Red Hat, Inc.
+# Copyright (C) 2026 Red Hat, Inc.
 # Written by:
 #     Andrew John Hughes <gnu.andrew@redhat.com>
 #
@@ -17,26 +17,29 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-# Builds the RPM on RHEL 8
+# Waive the leapp gating test which never seems to work
 
-NVR=${1}
-USER=${2}
+RHEL_VER=${1}
+NVR=${2}
 
-if test "${NVR}" = ""; then
-    echo "${0} <NVR> <USER>";
+WORKING_DIR=$(dirname "${0}")
+
+if test "x${RHEL_VER}" = "x"; then
+    echo "No RHEL version specified.";
+    echo "${0} <RHEL_VER> <NVR>";
     exit 1;
 fi
 
-if test "${USER}" = ""; then
-    echo "${0} <NVR> <USER>";
+if test "x${NVR}" = "x"; then
+    echo "No NVR specified.";
+    echo "${0} <RHEL_VER> <NVR>";
     exit 2;
 fi
 
-METADATA="{\"osci\": {\"upstream_nvr\": \"${NVR}\", \"upstream_owner_name\": \"${USER}\"}, \"rhel-target\": \"latest\"}"
-rhpkg -v build --target=java-openjdk-rhel-8-build --custom-user-metadata "${METADATA}"
+"${WORKING_DIR}"/waive_issue.sh "${RHEL_VER}" "${NVR}" leapp.brew-build.upgrade.distro "AWOL"
 
 # Local Variables:
-# compile-command: "shellcheck build_rhel_8.sh"
+# compile-command: "shellcheck waive_leapp_issue.sh"
 # fill-column: 80
 # indent-tabs-mode: nil
 # sh-basic-offset: 4

scripts/builds/waive_rpminspect.sh

@@ -0,0 +1,53 @@
+#!/bin/sh
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Waive a rpminspect gating issue
+
+RHEL_VER=${1}
+NVR=${2}
+COMMENT=${3}
+
+WORKING_DIR=$(dirname "${0}")
+
+if test "x${RHEL_VER}" = "x"; then
+    echo "No RHEL version specified.";
+    echo "${0} <RHEL_VER> <NVR> <COMMENT>";
+    exit 1;
+fi
+
+if test "x${NVR}" = "x"; then
+    echo "No NVR specified.";
+    echo "${0} <RHEL_VER> <NVR> <COMMENT>";
+    exit 2;
+fi
+
+if test "${COMMENT}" = ""; then
+    echo "No comment specified.";
+    echo "${0} <RHEL_VER> <NVR> <COMMENT>";
+    exit 3;
+fi
+
+"${WORKING_DIR}"/waive_issue.sh "${RHEL_VER}" "${NVR}" osci.brew-build.rpminspect.static-analysis "${COMMENT}"
+
+# Local Variables:
+# compile-command: "shellcheck waive_rpminspect.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/waive_usual_rpminspect.sh

@@ -0,0 +1,46 @@
+#!/bin/sh
+
+# Copyright (C) 2026 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+# Waive the recurring rpminspect gating issues
+# Should be resolved by RHELPLAN-102267
+
+RHEL_VER=${1}
+NVR=${2}
+
+if test "x${RHEL_VER}" = "x"; then
+    echo "No RHEL version specified.";
+    echo "${0} <RHEL_VER> <NVR>";
+    exit 1;
+fi
+
+if test "x${NVR}" = "x"; then
+    echo "No NVR specified.";
+    echo "${0} <RHEL_VER> <NVR>";
+    exit 2;
+fi
+
+"${WORKING_DIR}"/waive_rpminspect.sh "${RHEL_VER}" "${NVR}" \
+		"Usual failures we waived through rpmdiff; slowdebug unoptimised, RPATH and IPv4 functions"
+
+# Local Variables:
+# compile-command: "shellcheck waive_usual_rpminspect.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:

scripts/builds/waive_usual_tier0.sh

@@ -1,6 +1,6 @@
 #!/bin/sh
 
-# Copyright (C) 2024 Red Hat, Inc.
+# Copyright (C) 2026 Red Hat, Inc.
 # Written by:
 #     Andrew John Hughes <gnu.andrew@redhat.com>
 #
@@ -17,12 +17,30 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-# Builds the portable on RHEL 7
+# Waive the usual tier0 gating issue
+# Should be resolved by OPENJDK-4517
 
-rhpkg -v build --target=java-openjdk-rhel-7-build --skip-nvr-check
+RHEL_VER=${1}
+NVR=${2}
+
+WORKING_DIR=$(dirname "${0}")
+
+if test "x${RHEL_VER}" = "x"; then
+    echo "No RHEL version specified.";
+    echo "${0} <RHEL_VER> <NVR>";
+    exit 1;
+fi
+
+if test "x${NVR}" = "x"; then
+    echo "No NVR specified.";
+    echo "${0} <RHEL_VER> <NVR>";
+    exit 2;
+fi
+
+"${WORKING_DIR}"/waive_issue.sh "${RHEL_VER}" "${NVR}" osci.brew-build.tier0.functional "Test unable to parse spec file"
 
 # Local Variables:
-# compile-command: "shellcheck build_rhel_7_portable_build.sh"
+# compile-command: "shellcheck waive_usual_tier0.sh"
 # fill-column: 80
 # indent-tabs-mode: nil
 # sh-basic-offset: 4

scripts/openjdk_news.sh

@@ -98,7 +98,7 @@ else
     echo "No apparent backouts.";
 fi
 printf "\nChecking for bundled library updates...";
-if grep -iE ':( \(tz\))? update.*(freetype|gif|harfbuzz|lcms|jpeg|png|timezone|zlib)' "${TMPDIR}/fixes" > "${TMPDIR}/bundles"; then
+if grep -iE ':( \(tz\))? (update|upgrade).*(freetype|gif|harfbuzz|lcms|jpeg|png|timezone|zlib)' "${TMPDIR}/fixes" > "${TMPDIR}/bundles"; then
     printf "found.\nWARNING: Review the following with respect to bundled provides:\n";
     cat "${TMPDIR}/bundles";
     echo "Compare the output of $(dirname "${0}")/get_bundle_versions.sh with the RPM using the JDK source tree"

sources

@@ -1,3 +1,3 @@
 SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30
-SHA512 (openjdk-25.0.1+8.tar.xz) = eb84d876f81ca02803283e8294c89b6acbed3753426811c3bcc228615c9618deefc85da4aa702800cac2feb103e628ee8b92292b316e9d7e12a58b6de69c5085
-SHA512 (nssadapter-0.1.0.tar.xz) = 581f49d1a27550e3a2fa0a9d407f43c507627a8439827904d14daaf24e071d9f73884a2abe4cb3d36d26f1af09ef7d20724b2d40c9bac202e0316fac6c1a636b
+SHA512 (openjdk-25.0.2+10.tar.xz) = 238580373693cb0221f8678df1b1c838b9ae6fc8311c2ece496908444bee640315cba8a3e439866b647021f471b96f011aad35eb3e7ae2369a19d9489c6ddb2d
+SHA512 (nssadapter-0.1.1.tar.xz) = 2b4675cfbfa2ccb6c9a4870a4b58ae555267f5b8c9bdb0cf37b075483e6e9ea929561c05070453cf0d67b0b029de5408274555bf2ff50e9533219e898b2717f9