From c340f9e97d55be47dd952644ec2af038197764e6 Mon Sep 17 00:00:00 2001
From: "Endi S. Dewata" <edewata@redhat.com>
Date: Fri, 21 Jun 2024 01:41:41 +0000
Subject: [PATCH] Rebase to PKI 11.5.1

Resolves: RHEL-40749, RHEL-32462
---
 .gitignore    |  1 +
 pki-core.spec | 42 ++++++++++++++++++++++++++++++++++++++----
 sources       |  2 +-
 3 files changed, 40 insertions(+), 5 deletions(-)

diff --git a/.gitignore b/.gitignore
index b265682..ae241ec 100644
--- a/.gitignore
+++ b/.gitignore
@@ -100,3 +100,4 @@
 /pki-11.5.0-alpha7.tar.gz
 /pki-11.5.0-alpha8.tar.gz
 /pki-11.5.0.tar.gz
+/pki-11.5.1.tar.gz
diff --git a/pki-core.spec b/pki-core.spec
index 4456b28..89ce2bb 100644
--- a/pki-core.spec
+++ b/pki-core.spec
@@ -9,7 +9,7 @@ Name:             pki-core
 # Upstream version number:
 %global           major_version 11
 %global           minor_version 5
-%global           update_version 0
+%global           update_version 1
 
 # Downstream release number:
 # - development/stabilization (unsupported): 0.<n> where n >= 1
@@ -63,9 +63,27 @@ ExcludeArch: i686
 # Java
 ################################################################################
 
-%global java_devel java-17-openjdk-devel
-%global java_headless java-17-openjdk-headless
-%global java_home %{_jvmdir}/jre-17-openjdk
+%if 0%{?rhel}
+
+%define java_devel java-17-openjdk-devel
+%define java_headless java-17-openjdk-headless
+%define java_home %{_jvmdir}/jre-17-openjdk
+
+%else
+
+# Use Java 21 on Fedora 40+, otherwise use Java 17.
+%global java_devel java-devel >= 1:17
+%global java_headless java-headless >= 1:17
+
+# Don't use find since it might not work well with local builds.
+#   find {_jvmdir} -maxdepth 1 | grep "jre-[0-9]\+$"
+%global java_home %(
+   source /usr/share/java-utils/java-functions;
+   _prefer_jre=true;
+   set_jvm;
+   echo $JAVA_HOME)
+
+%endif
 
 ################################################################################
 # Application Server
@@ -1011,6 +1029,7 @@ popd
 
 # Remove all symbol table and relocation information from the executable.
 C_FLAGS="-s"
+CXX_FLAGS="$CXX_FLAGS -g -fPIE -pie"
 
 %if 0%{?fedora}
 # https://sourceware.org/annobin/annobin.html/Test-gaps.html
@@ -1021,12 +1040,23 @@ C_FLAGS="$C_FLAGS -fcf-protection=full"
 
 # https://sourceware.org/annobin/annobin.html/Test-optimization.html
 C_FLAGS="$C_FLAGS -O2"
+CXX_FLAGS="$CXX_FLAGS -O2"
 
 # https://sourceware.org/annobin/annobin.html/Test-glibcxx-assertions.html
 C_FLAGS="$C_FLAGS -D_GLIBCXX_ASSERTIONS"
+CXX_FLAGS="$CXX_FLAGS -D_GLIBCXX_ASSERTIONS"
 
 # https://sourceware.org/annobin/annobin.html/Test-lto.html
 C_FLAGS="$C_FLAGS -fno-lto"
+
+# https://sourceware.org/annobin/annobin.html/Test-fortify.html
+C_FLAGS="$C_FLAGS -D_FORTIFY_SOURCE=3"
+CXX_FLAGS="$CXX_FLAGS -D_FORTIFY_SOURCE=3"
+
+# https://sourceware.org/annobin/annobin.html/Test-stack-clash.html
+C_FLAGS="$C_FLAGS -fstack-clash-protection"
+CXX_FLAGS="$CXX_FLAGS -fstack-clash-protection"
+
 %endif
 
 pkgs=base\
@@ -1060,6 +1090,7 @@ pkgs=base\
     --share-dir=%{_datadir} \
     --cmake=%{__cmake} \
     --c-flags="$C_FLAGS" \
+    --cxx-flags="$CXX_FLAGS" \
     --java-home=%{java_home} \
     --jni-dir=%{_jnidir} \
     --unit-dir=%{_unitdir} \
@@ -1501,6 +1532,9 @@ fi
 
 ################################################################################
 %changelog
+* Fri Jun 21 2024 Red Hat PKI Team <rhcs-maint@redhat.com> - 11.5.1-1
+- Rebase to PKI 11.5.1
+
 * Wed Feb 21 2024 Red Hat PKI Team <rhcs-maint@redhat.com> - 11.5.0-1
 - Rebase to PKI 11.5.0
 
diff --git a/sources b/sources
index e4e8cf5..53b9114 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (pki-11.5.0.tar.gz) = 28b4099abd59b6fb5c510fff39fe7b2258f663f3fc21c973243a9615f5f601a18b763722ee6ea033afe76a094464d4fdce5cd0af45f9126566badf89e3a69923
+SHA512 (pki-11.5.1.tar.gz) = 7e65dc91398463790484cdf58e38b5747bfe18ff1235bb9a5bbd79a9bdf0d22c9f4c5feda40aa3927feef0162fd3d124d46be71c5c2f93ab9440289e126b2614