diff --git a/.gitignore b/.gitignore index 1f1fc8c..882a87e 100644 --- a/.gitignore +++ b/.gitignore @@ -33,29 +33,3 @@ /openjdk-jdk19u-jdk-19.0.2+7.tar.xz /openjdk-jdk20u-jdk-20+36.tar.xz /openjdk-jdk20u-jdk-20.0.1+9.tar.xz -/openjdk-jdk20u-jdk-20.0.2+9.tar.xz -/openjdk-jdk21u-jdk-21+34.tar.xz -/openjdk-jdk21u-jdk-21+35.tar.xz -/openjdk-21+35.tar.xz -/openjdk-21.0.1+12.tar.xz -/openjdk-21.0.2+11.tar.xz -/openjdk-21.0.2+12.tar.xz -/openjdk-21.0.2+13.tar.xz -/openjdk-22+32-ea.tar.xz -/openjdk-jdk-22+36-ea.tar.xz -/openjdk-jdk-22.0.1+8.tar.xz -/openjdk-jdk-22.0.2+9.tar.xz -/openjdk-jdk-23+37.tar.xz -/openjdk-jdk-23.0.1+11.tar.xz -/openjdk-23.0.2+7.tar.xz -/openjdk-24+34-ea.tar.xz -/openjdk-24+36.tar.xz -/openjdk-24.0.1+9.tar.xz -/openjdk-24.0.2+12.tar.xz -/openjdk-25+13-ea.tar.xz -/openjdk-25+26-ea.tar.xz -/openjdk-25+32-ea.tar.xz -/openjdk-jdk-25+36.tar.xz -/openjdk-25+36.tar.xz -/openjdk-25.0.1+8.tar.xz -/openjdk-26+29-ea.tar.xz diff --git a/JDK-8373246-8351842_broke_native_debugging_on_Linux.patch b/JDK-8373246-8351842_broke_native_debugging_on_Linux.patch deleted file mode 100644 index 1f6ca4d..0000000 --- a/JDK-8373246-8351842_broke_native_debugging_on_Linux.patch +++ /dev/null @@ -1,154 +0,0 @@ -diff --git a/make/Bundles.gmk b/make/Bundles.gmk -index 8161b3b036254..0b324e7e3f3fc 100644 ---- a/make/Bundles.gmk -+++ b/make/Bundles.gmk -@@ -185,77 +185,30 @@ endif - - ifneq ($(filter product-bundles% legacy-bundles, $(MAKECMDGOALS)), ) - -- SYMBOLS_EXCLUDE_PATTERN := %.debuginfo %.diz %.map -- -- # There may be files with spaces in the names, so use ShellFindFiles -- # explicitly. -+ # There may be files with spaces in the names, so use ShellFindFiles explicitly. - ALL_JDK_FILES := $(call ShellFindFiles, $(JDK_IMAGE_DIR)) -- ifneq ($(JDK_IMAGE_DIR), $(JDK_SYMBOLS_IMAGE_DIR)) -- ALL_JDK_SYMBOLS_FILES := $(call ShellFindFiles, $(JDK_SYMBOLS_IMAGE_DIR)) -- else -- ALL_JDK_SYMBOLS_FILES := $(ALL_JDK_FILES) -- endif - ifneq ($(JDK_IMAGE_DIR), $(JDK_DEMOS_IMAGE_DIR)) - ALL_JDK_DEMOS_FILES := $(call ShellFindFiles, $(JDK_DEMOS_IMAGE_DIR)) - else - ALL_JDK_DEMOS_FILES := $(ALL_JDK_FILES) - endif - -- # Create special filter rules when dealing with unzipped .dSYM directories on -- # macosx -- ifeq ($(call isTargetOs, macosx), true) -- ifeq ($(ZIP_EXTERNAL_DEBUG_SYMBOLS), false) -- JDK_SYMBOLS_EXCLUDE_PATTERN := $(addprefix %, \ -- $(call containing, .dSYM/, $(patsubst $(JDK_IMAGE_DIR)/%, %, \ -- $(ALL_JDK_SYMBOLS_FILES)))) -- endif -- endif -- -- # Create special filter rules when dealing with debug symbols on windows -- ifeq ($(call isTargetOs, windows), true) -- ifeq ($(SHIP_DEBUG_SYMBOLS), ) -- JDK_SYMBOLS_EXCLUDE_PATTERN := %.pdb -- endif -- endif -- - JDK_BUNDLE_FILES := \ - $(filter-out \ -- $(JDK_SYMBOLS_EXCLUDE_PATTERN) \ - $(JDK_EXTRA_EXCLUDES) \ -- $(SYMBOLS_EXCLUDE_PATTERN) \ - $(JDK_IMAGE_HOMEDIR)/demo/% \ - , \ - $(ALL_JDK_FILES) \ - ) - -- JDK_SYMBOLS_BUNDLE_FILES := \ -- $(call FindFiles, $(SYMBOLS_IMAGE_DIR)) -+ JDK_SYMBOLS_BUNDLE_FILES := $(call FindFiles, $(SYMBOLS_IMAGE_DIR)) - - TEST_DEMOS_BUNDLE_FILES := $(filter $(JDK_DEMOS_IMAGE_HOMEDIR)/demo/%, \ - $(ALL_JDK_DEMOS_FILES)) - - ALL_JRE_FILES := $(call ShellFindFiles, $(JRE_IMAGE_DIR)) - -- # Create special filter rules when dealing with unzipped .dSYM directories on -- # macosx -- ifeq ($(OPENJDK_TARGET_OS), macosx) -- ifeq ($(ZIP_EXTERNAL_DEBUG_SYMBOLS), false) -- JRE_SYMBOLS_EXCLUDE_PATTERN := $(addprefix %, \ -- $(call containing, .dSYM/, $(patsubst $(JRE_IMAGE_DIR)/%, %, $(ALL_JRE_FILES)))) -- endif -- endif -- -- # Create special filter rules when dealing with debug symbols on windows -- ifeq ($(call isTargetOs, windows), true) -- ifeq ($(SHIP_DEBUG_SYMBOLS), ) -- JRE_SYMBOLS_EXCLUDE_PATTERN := %.pdb -- endif -- endif -- -- JRE_BUNDLE_FILES := $(filter-out \ -- $(JRE_SYMBOLS_EXCLUDE_PATTERN) \ -- $(SYMBOLS_EXCLUDE_PATTERN), \ -- $(ALL_JRE_FILES)) -+ JRE_BUNDLE_FILES := $(ALL_JRE_FILES) - - ifeq ($(MACOSX_CODESIGN_MODE), hardened) - # Macosx release build and code signing available. -diff --git a/make/CreateJmods.gmk b/make/CreateJmods.gmk -index 3280b24924a34..32f107b6bb6a0 100644 ---- a/make/CreateJmods.gmk -+++ b/make/CreateJmods.gmk -@@ -218,10 +218,14 @@ ifeq ($(call isTargetOs, windows), true) - ifeq ($(SHIP_DEBUG_SYMBOLS), ) - JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.pdb,*.map}' - else -- JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.map}' -+ JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.map}' - endif - else -- JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.debuginfo,*.dSYM/**,*.dSYM}' -+ ifeq ($(SHIP_DEBUG_SYMBOLS), ) -+ JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.debuginfo,*.dSYM/**,*.dSYM}' -+ else -+ JMOD_FLAGS += --exclude '**{_the.*,_*.marker*}' -+ endif - endif - - # Unless we are creating a very large module, use the small tool JVM options -diff --git a/make/autoconf/jdk-options.m4 b/make/autoconf/jdk-options.m4 -index bb18877800192..87d147d4f074b 100644 ---- a/make/autoconf/jdk-options.m4 -+++ b/make/autoconf/jdk-options.m4 -@@ -316,23 +316,36 @@ AC_DEFUN_ONCE([JDKOPT_SETUP_DEBUG_SYMBOLS], - AC_MSG_CHECKING([if we should add external native debug symbols to the shipped bundles]) - AC_ARG_WITH([external-symbols-in-bundles], - [AS_HELP_STRING([--with-external-symbols-in-bundles], -- [which type of external native debug symbol information shall be shipped in product bundles (none, public, full) -- (e.g. ship full/stripped pdbs on Windows) @<:@none@:>@])]) -+ [which type of external native debug symbol information shall be shipped with bundles/images (none, public, full). -+ @<:@none in release builds, full otherwise. --with-native-debug-symbols=external/zipped is a prerequisite. public is only supported on Windows@:>@])], -+ [], -+ [with_external_symbols_in_bundles=default]) - - if test "x$with_external_symbols_in_bundles" = x || test "x$with_external_symbols_in_bundles" = xnone ; then - AC_MSG_RESULT([no]) - elif test "x$with_external_symbols_in_bundles" = xfull || test "x$with_external_symbols_in_bundles" = xpublic ; then -- if test "x$OPENJDK_TARGET_OS" != xwindows ; then -- AC_MSG_ERROR([--with-external-symbols-in-bundles currently only works on windows!]) -- elif test "x$COPY_DEBUG_SYMBOLS" != xtrue ; then -- AC_MSG_ERROR([--with-external-symbols-in-bundles only works when --with-native-debug-symbols=external is used!]) -- elif test "x$with_external_symbols_in_bundles" = xfull ; then -+ if test "x$COPY_DEBUG_SYMBOLS" != xtrue ; then -+ AC_MSG_ERROR([--with-external-symbols-in-bundles only works when --with-native-debug-symbols=external/zipped is used!]) -+ elif test "x$with_external_symbols_in_bundles" = xpublic && test "x$OPENJDK_TARGET_OS" != xwindows ; then -+ AC_MSG_ERROR([--with-external-symbols-in-bundles=public is only supported on Windows!]) -+ fi -+ -+ if test "x$with_external_symbols_in_bundles" = xfull ; then - AC_MSG_RESULT([full]) - SHIP_DEBUG_SYMBOLS=full - else - AC_MSG_RESULT([public]) - SHIP_DEBUG_SYMBOLS=public - fi -+ elif test "x$with_external_symbols_in_bundles" = xdefault ; then -+ if test "x$DEBUG_LEVEL" = xrelease ; then -+ AC_MSG_RESULT([no (default)]) -+ elif test "x$COPY_DEBUG_SYMBOLS" = xtrue ; then -+ AC_MSG_RESULT([full (default)]) -+ SHIP_DEBUG_SYMBOLS=full -+ else -+ AC_MSG_RESULT([no (default, native debug symbols are not external/zipped)]) -+ fi - else - AC_MSG_ERROR([$with_external_symbols_in_bundles is an unknown value for --with-external-symbols-in-bundles]) - fi diff --git a/NEWS b/NEWS index 0a4a628..3eb277e 100644 --- a/NEWS +++ b/NEWS @@ -3,100 +3,51 @@ Key: JDK-X - https://bugs.openjdk.java.net/browse/JDK-X CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY -New in release OpenJDK 25.0.1 (2025-10-21): +New in release OpenJDK 20.0.1 (2023-04-18): =========================================== * CVEs - - CVE-2025-53057 - - CVE-2025-53066 - - CVE-2025-61748 -* Changes - - JDK-8315131: Clarify VarHandle set/get access on 32-bit platforms - - JDK-8352637: Enhance bytecode verification - - JDK-8356294: Enhance Path Factories - - JDK-8356587: Missing object ID X in pool jdk.types.Method - - JDK-8357826: Avoid running some jtreg tests when asan is configured - - JDK-8358452: JNI exception pending in Java_sun_awt_screencast_ScreencastHelper_remoteDesktopKeyImpl of screencast_pipewire.c:1214 (ID: 51119) - - JDK-8358577: Test serviceability/jvmti/thread/GetCurrentContendedMonitor/contmon01/contmon01.java failed: unexpexcted monitor object - - JDK-8358819: The first year is not displayed correctly in Japanese Calendar - - JDK-8359059: Bump version numbers for 25.0.1 - - JDK-8359218: RISC-V: Only enable CRC32 intrinsic when AvoidUnalignedAccess == false - - JDK-8359270: C2: alignment check should consider base offset when emitting arraycopy runtime call - - JDK-8359454: Enhance String handling - - JDK-8359596: Behavior change when both -Xlint:options and -Xlint:-options flags are given - - JDK-8360179: RISC-V: Only enable BigInteger intrinsics when AvoidUnalignedAccess == false - - JDK-8360533: ContainerRuntimeVersionTestUtils fromVersionString fails with some docker versions - - JDK-8360647: [XWayland] [OL10] NumPad keys are not triggered - - JDK-8360679: Shenandoah: AOT saved adapter calls into broken GC barrier stub - - JDK-8360937: Enhance certificate handling - - JDK-8361212: Remove AffirmTrust root CAs - - JDK-8361532: RISC-V: Several vector tests fail after JDK-8354383 - - JDK-8361829: [TESTBUG] RISC-V: compiler/vectorization/runner/BasicIntOpTest.java fails with RVV but not Zvbb - - JDK-8362109: Change milestone to fcs for all releases - - JDK-8362882: Update SubmissionPublisher() specification to reflect use of ForkJoinPool.asyncCommonPool() - - JDK-8366223: ZGC: ZPageAllocator::cleanup_failed_commit_multi_partition is broken - - JDK-8367031: [backout] Change java.time month/day field types to 'byte' - - JDK-8368308: ISO 4217 Amendment 180 Update + - CVE-2023-21930 + - CVE-2023-21937 + - CVE-2023-21938 + - CVE-2023-21939 + - CVE-2023-21967 + - CVE-2023-21968 +* Security fixes + - JDK-8287404: Improve ping times + - JDK-8288436: Improve Xalan supports + - JDK-8294474: Better AES support + - JDK-8295304: Runtime support improvements + - JDK-8296676, JDK-8296622: Improve String platform support + - JDK-8296684: Improve String platform support + - JDK-8296692: Improve String platform support + - JDK-8296832: Improve Swing platform support + - JDK-8297371: Improve UTF8 representation redux + - JDK-8298310: Enhance TLS session negotiation + - JDK-8298667: Improved path handling + - JDK-8299129: Enhance NameService lookups +* Other changes + - JDK-8208077: File.listRoots performance degradation + - JDK-8245654: Add Certigna Root CA + - JDK-8278965: crash in SymbolTable::do_lookup + - JDK-8295951: intermittent cmp_baseline task failures with CDS files + - JDK-8299194: CustomTzIDCheckDST.java may fail at future date + - JDK-8299843: Bump version numbers for 20.0.1 + - JDK-8299947: Change milestone to fcs for all releases + - JDK-8301123: Enable Symbol refcounting underflow checks in PRODUCT + - JDK-8301858: Verification error when compiling switch with record patterns + - JDK-8301876: Crash in DumpTimeClassInfo::add_verification_constraint + - JDK-8302202: Incorrect desugaring of null-allowed nested patterns + - JDK-8302879: doc/building.md update link to jtreg builds + - JDK-8303412: Update linux_x64-to-linux_aarch64 cross compilation devkit at Oracle -Notes on individual issues: -=========================== - -core-libs/java.io:serialization: - -JDK-8367031: [backout] Change java.time month/day field types to 'byte' -======================================================================= -In the initial release of OpenJDK 25, attempting to read serialised -Class objects created by earlier versions of OpenJDK for several of -the `java.time` classes would fail with a -`InvalidClassException`. Similarly, `java.time` Class objects -serialised with OpenJDK 25 could not be read by older OpenJDK -versions. This was due to the type of the day and month fields in -these classes being changed to `byte`. This change has now been -reverted and compatibility between OpenJDK 25 and older versions -restored. - -Note that this incompatibility occurred with the `Class` object and -not an instance of the object i.e. `writeObject(LocalDate.class)` -would produce incompatible serialised data, but -`writeObject(LocalDate.now())` would not. - -security-libs/java.security: - -JDK-8361212: Remove AffirmTrust root CAs -======================================== -The following root certificates from AffirmTrust, which were -deactivated in the 21.0.5 release of October 2024, have been removed -from the `cacerts` keystore: - -Alias name: affirmtrustcommercialca [jdk] -CN=AffirmTrust Commercial -O=AffirmTrust -C=US -SHA256: 03:76:AB:1D:54:C5:F9:80:3C:E4:B2:E2:01:A0:EE:7E:EF:7B:57:B6:36:E8:A9:3C:9B:8D:48:60:C9:6F:5F:A7 - -Alias name: affirmtrustnetworkingca [jdk] -CN=AffirmTrust Networking -O=AffirmTrust -C=US -SHA256: 0A:81:EC:5A:92:97:77:F1:45:90:4A:F3:8D:5D:50:9F:66:B5:E2:C5:8F:CD:B5:31:05:8B:0E:17:F3:F0B4:1B - -Alias name: affirmtrustpremiumca [jdk] -CN=AffirmTrust Premium -O=AffirmTrust -C=US -SHA256: 70:A7:3F:7F:37:6B:60:07:42:48:90:45:34:B1:14:82:D5:BF:0E:69:8E:CC:49:8D:F5:25:77:EB:F2:E9:3B:9A - -Alias name: affirmtrustpremiumeccca [jdk] -CN=AffirmTrust Premium ECC -O=AffirmTrust -C=US -SHA256: BD:71:FD:F6:DA:97:E4:CF:62:D1:64:7A:DD:25:81:B0:7D:79:AD:F8:39:7E:B4:EC:BA:9C:5E:84:88:82:14:23 - -New in release OpenJDK 25.0.0 (2025-09-16): +New in release OpenJDK 20.0.0 (2023-03-21): =========================================== Major changes are listed below. Some changes may have been backported -to earlier releases following their first appearance in OpenJDK 22 -through to 25. +to earlier releases following their first appearance in OpenJDK 20. + +The full list of changes in 20u can be found at: +- * https://builds.shipilev.net/backports-monitor/release-notes-20.txt NEW FEATURES ============ @@ -104,124 +55,52 @@ NEW FEATURES Language Features ================= -Flexible Constructor Bodies -============================ -https://openjdk.org/jeps/447 -https://openjdk.org/jeps/482 -https://openjdk.org/jeps/492 -https://openjdk.org/jeps/513 +Pattern Matching for switch +=========================== +https://openjdk.org/jeps/406 +https://openjdk.org/jeps/420 +https://openjdk.org/jeps/427 +https://openjdk.org/jeps/433 -In constructors in the Java programming language, allow statements to -appear before an explicit constructor invocation, i.e., super(..) or -this(..). The statements cannot reference the instance under -construction, but they can initialize its fields. Initializing fields -before invoking another constructor makes a class more reliable when -methods are overridden. +Enhance the Java programming language with pattern matching for +`switch` expressions and statements, along with extensions to the +language of patterns. Extending pattern matching to `switch` allows an +expression to be tested against a number of patterns, each with a +specific action, so that complex data-oriented queries can be +expressed concisely and safely. -This language feature is now finalised (JEP 513). It was first -introduced as a preview language feature -(http://openjdk.java.net/jeps/12) in OpenJDK 22 (JEP 447) under the -name "Statements before super(...)". It reached a second preview in -OpenJDK 23 (JEP 482) with the addition of allowing fields to be -initialized before invoking another constructor. It reached a third -preview in OpenJDK 24 (JEP 492). +This is a preview feature (http://openjdk.java.net/jeps/12) introduced +in OpenJDK 17 (JEP 406), which saw a second preview in OpenJDK 18 (JEP +420) and a third in OpenJDK 19 (JEP 427). It reaches its fourth +preview (JEP 427) in OpenJDK 20. -Unnamed Patterns and Variables -============================== -https://openjdk.org/jeps/443 -https://openjdk.org/jeps/456 +Record Patterns +=============== +https://openjdk.org/jeps/405 +https://openjdk.org/jeps/432 -Enhance the Java language with unnamed patterns, which match a record -component without stating the component's name or type, and unnamed -variables, which can be initialized but not used. Both are denoted by -an underscore character, _. +Enhance the Java programming language with record patterns to +deconstruct record values. Record patterns and type patterns can be +nested to enable a powerful, declarative, and composable form of data +navigation and processing. -This feature is now finalised (JEP 456). It was a preview feature -(http://openjdk.java.net/jeps/12) in OpenJDK 21 (JEP 443). - -Primitive Types in Patterns, instanceof, and switch -=================================================== -https://openjdk.org/jeps/455 -https://openjdk.org/jeps/488 -https://openjdk.org/jeps/507 - -Enhance pattern matching by allowing primitive type patterns in all -pattern contexts, and extend instanceof and switch to work with all -primitive types. - -This is a preview language feature (http://openjdk.java.net/jeps/12) -introduced in OpenJDK 23 (JEP 455) with a second preview in OpenJDK 24 -(JEP 488) and reaching a third in OpenJDK 25 (JEP 507). - -Module Import Declarations -========================== -https://openjdk.org/jeps/476 -https://openjdk.org/jeps/494 -https://openjdk.org/jeps/511 - -Enhance the Java programming language with the ability to succinctly -import all of the packages exported by a module. This simplifies the -reuse of modular libraries, but does not require the importing code to -be in a module itself. - -This language feature is now finalised (JEP 511). It was introduced as -a preview language feature (http://openjdk.java.net/jeps/12) in -OpenJDK 23 (JEP 476) and had a second preview in OpenJDK 24 (JEP 494). +This is a preview feature (http://openjdk.java.net/jeps/12) introduced +in OpenJDK 19 (JEP 405). It reaches its second preview (JEP 432) in +OpenJDK 20. Library Features ================ -Foreign Function & Memory API -============================= -https://openjdk.org/jeps/412 -https://openjdk.org/jeps/419 -https://openjdk.org/jeps/424 -https://openjdk.org/jeps/434 -https://openjdk.org/jeps/442 -https://openjdk.org/jeps/454 +Scoped Values +============= +https://openjdk.org/jeps/429 -Introduce an API by which Java programs can interoperate with code and -data outside of the Java runtime. By efficiently invoking foreign -functions (i.e., code outside the JVM), and by safely accessing -foreign memory (i.e., memory not managed by the JVM), the API enables -Java programs to call native libraries and process native data without -the brittleness and danger of JNI. +Introduce scoped values, which enable the sharing of immutable data +within and across threads. They are preferred to thread-local +variables, especially when using large numbers of virtual threads. -This API is now finalised (JEP 454). It was first introduced in -incubation (https://openjdk.java.net/jeps/11) in OpenJDK 17 (JEP 412), -and is an evolution of the Foreign Memory Access API (OpenJDK 14 -through 16) and Foreign Linker API (OpenJDK 16) (see release notes for -java-17-openjdk). OpenJDK 18 saw a second round of incubation (JEP -419) before its inclusion as a preview feature -(http://openjdk.java.net/jeps/12) in OpenJDK 19 (JEP 424). A second -preview took place in OpenJDK 20 (JEP 434) and a third and final -preview in OpenJDK 21 (JEP 442). - -Prepare to Restrict the Use of JNI -================================== -https://openjdk.org/jeps/472 - -Issue warnings about uses of the Java Native Interface (JNI) and -adjust the Foreign Function & Memory (FFM) API to issue warnings in a -consistent manner. All such warnings aim to prepare developers for a -future release that ensures integrity by default by uniformly -restricting JNI and the FFM API. Application developers can avoid both -current warnings and future restrictions by selectively enabling these -interfaces where essential using the --enable-native-access -command-line option. - -Class-File API -============== -https://openjdk.org/jeps/457 -https://openjdk.org/jeps/466 -https://openjdk.org/jeps/484 - -Provide a standard API for parsing, generating, and transforming Java -class files. - -This API is now finalised (JEP 484). It was introduced as a preview -library feature (http://openjdk.java.net/jeps/12) in OpenJDK 22 (JEP -457) with a second preview in OpenJDK 23 (JEP 466). +This is an incubation feature (https://openjdk.java.net/jeps/11) +introduced in OpenJDK 20 (JEP 429). Vector API ========== @@ -230,11 +109,6 @@ https://openjdk.org/jeps/414 https://openjdk.org/jeps/417 https://openjdk.org/jeps/426 https://openjdk.org/jeps/438 -https://openjdk.org/jeps/448 -https://openjdk.org/jeps/460 -https://openjdk.org/jeps/469 -https://openjdk.org/jeps/489 -https://openjdk.org/jeps/508 Introduce an API to express vector computations that reliably compile at runtime to optimal vector hardware instructions on supported CPU @@ -244,34 +118,48 @@ scalar computations. This is an incubation feature (https://openjdk.java.net/jeps/11) introduced in OpenJDK 16 (JEP 338). A second round of incubation took place in OpenJDK 17 (JEP 414), OpenJDK 18 (JEP 417) saw a third, -OpenJDK 19 a fourth (JEP 426), OpenJDK 20 (JEP 438) a fifth, OpenJDK -21 a sixth (JEP 448), OpenJDK 22 a seventh (JEP 460), OpenJDK 23 an -eighth (JEP 469), OpenJDK 24 a ninth (JEP 489) and it reaches its -tenth in OpenJDK 25 (JEP 508). +OpenJDK 19 a fourth (JEP 426) and OpenJDK 20 (JEP 438) sees its fifth. -Stream Gatherers -================ -https://openjdk.org/jeps/461 -https://openjdk.org/jeps/473 -https://openjdk.org/jeps/485 +Foreign Function & Memory API +============================= +https://openjdk.org/jeps/412 +https://openjdk.org/jeps/419 +https://openjdk.org/jeps/424 +https://openjdk.org/jeps/434 -Enhance the Stream API to support custom intermediate operations. This -will allow stream pipelines to transform data in ways that are not -easily achievable with the existing built-in intermediate operations. +Introduce an API by which Java programs can interoperate with code and +data outside of the Java runtime. By efficiently invoking foreign +functions (i.e., code outside the JVM), and by safely accessing +foreign memory (i.e., memory not managed by the JVM), the API enables +Java programs to call native libraries and process native data without +the brittleness and danger of JNI. -This API is now finalised (JEP 485). It was introduced as a preview -library feature (http://openjdk.java.net/jeps/12) in OpenJDK 22 (JEP -461) with a second preview in OpenJDK 23 (JEP 473). +This API is now a preview feature (http://openjdk.java.net/jeps/12). +It was first introduced in incubation +(https://openjdk.java.net/jeps/11) in OpenJDK 17 (JEP 412), and is an +evolution of the Foreign Memory Access API (OpenJDK 14 through 16) and +Foreign Linker API (OpenJDK 16) (see release notes for +java-17-openjdk). OpenJDK 18 saw a second round of incubation (JEP +419) before its inclusion as a preview in OpenJDK 19 (JEP 424). It +reaches a second preview in OpenJDK 20 (JEP 434). + +Virtual Threads +=============== +https://openjdk.org/jeps/425 +https://openjdk.org/jeps/436 + +Introduce virtual threads to the Java Platform. Virtual threads are +lightweight threads that dramatically reduce the effort of writing, +maintaining, and observing high-throughput concurrent applications. + +This is a preview feature (http://openjdk.java.net/jeps/12) introduced +in OpenJDK 19 (JEP 425) and reaching its second preview in OpenJDK 20 +(JEP 436). Structured Concurrency ====================== https://openjdk.org/jeps/428 https://openjdk.org/jeps/437 -https://openjdk.org/jeps/453 -https://openjdk.org/jeps/462 -https://openjdk.org/jeps/480 -https://openjdk.org/jeps/499 -https://openjdk.org/jeps/505 Simplify multithreaded programming by introducing an API for structured concurrency. Structured concurrency treats multiple tasks @@ -279,392 +167,6 @@ running in different threads as a single unit of work, thereby streamlining error handling and cancellation, improving reliability, and enhancing observability. -This API was first introduced in incubation -(https://openjdk.java.net/jeps/11) in OpenJDK 19 (JEP 428) and had a -second round of incubation in OpenJDK 20 (JEP 437). It became a -preview feature (http://openjdk.java.net/jeps/12) in OpenJDK 21 (JEP -453), reached its second preview in OpenJDK 22 (JEP 462), had a third -preview in OpenJDK 23 (JEP 480), a fourth in OpenJDK 24 (JEP 499) and -reaches its fifth in OpenJDK 25 (JEP 505). - -Compact Source Files and Instance Main Methods -============================================== -https://openjdk.org/jeps/445 -https://openjdk.org/jeps/463 -https://openjdk.org/jeps/477 -https://openjdk.org/jeps/495 -https://openjdk.org/jeps/512 - -Evolve the Java programming language so that beginners can write their -first programs without needing to understand language features -designed for large programs. Far from using a separate dialect of the -language, beginners can write streamlined declarations for -single-class programs and then seamlessly expand their programs to use -more advanced features as their skills grow. Experienced developers -can likewise enjoy writing small programs succinctly, without the need -for constructs intended for programming in the large. - -This library feature is now finalised (JEP 512) with some minor -changes from the last release. It was first introduced as a preview -(http://openjdk.java.net/jeps/12) in OpenJDK 21 (JEP 445) under the -name "Unnamed Classes and Instance Main Methods". It reached a second -preview in OpenJDK 22 (JEP 463) and a third in OpenJDK 23 (JEP 477) -under the new name, "Implicitly Declared Classes and Instance Main -Methods", due to the move away from unnamed classes to an implicitly -declared name chosen by the host system. It had a fourth preview in -OpenJDK 24 (JEP 495) with new terminology and a revised title ("Simple -Source Files and Instance Main Methods"), but otherwise unchanged. - -Scoped Values -============= -https://openjdk.org/jeps/429 -https://openjdk.org/jeps/446 -https://openjdk.org/jeps/464 -https://openjdk.org/jeps/481 -https://openjdk.org/jeps/487 -https://openjdk.org/jeps/506 - -Introduce scoped values, which enable the sharing of immutable data -within and across threads. They are preferred to thread-local -variables, especially when using large numbers of virtual threads. - -This API is now finalised (JEP 506). This API was first introduced in -incubation (https://openjdk.java.net/jeps/11) in OpenJDK 20 (JEP -429). It became a preview feature (http://openjdk.java.net/jeps/12) in -OpenJDK 21 (JEP 446), had a second preview in OpenJDK 22 (JEP 464), a -third in OpenJDK 23 (JEP 481) and a fourth in OpenJDK 24 (JEP 487). - -Key Derivation Function API -=========================== -https://openjdk.org/jeps/478 -https://openjdk.org/jeps/510 - -Introduce an API for Key Derivation Functions (KDFs), which are -cryptographic algorithms for deriving additional keys from a secret -key and other data. - -This API is now finalised (JEP 510). It was first introduced as a -preview library feature (http://openjdk.java.net/jeps/12) in OpenJDK -24 (JEP 478). - -Quantum-Resistant Module-Lattice-Based Key Encapsulation Mechanism -================================================================== -https://openjdk.org/jeps/496 - -Enhance the security of Java applications by providing an -implementation of the quantum-resistant Module-Lattice-Based -Key-Encapsulation Mechanism (ML-KEM). Key encapsulation mechanisms -(KEMs) are used to secure symmetric keys over insecure communication -channels using public key cryptography. ML-KEM is designed to be -secure against future quantum computing attacks. It has been -standardized by the United States National Institute of Standards and -Technology (NIST) in FIPS 203 [0]. - -[0] https://csrc.nist.gov/pubs/fips/203/final - -Quantum-Resistant Module-Lattice-Based Digital Signature Algorithm -================================================================== -https://openjdk.org/jeps/497 - -Enhance the security of Java applications by providing an -implementation of the quantum-resistant Module-Lattice-Based Digital -Signature Algorithm (ML-DSA). Digital signatures are used to detect -unauthorized modifications to data and to authenticate the identity of -signatories. ML-DSA is designed to be secure against future quantum -computing attacks. It has been standardized by the United States -National Institute of Standards and Technology (NIST) in FIPS 204 [0]. - -[0] https://csrc.nist.gov/pubs/fips/204/final - -PEM Encodings of Cryptographic Objects -====================================== -https://openjdk.org/jeps/470 - -Introduce an API for encoding objects that represent cryptographic -keys, certificates, and certificate revocation lists into the -widely-used Privacy-Enhanced Mail (PEM) transport format, and for -decoding from that format back into objects. - -This is a preview library feature (http://openjdk.java.net/jeps/12) -introduced in OpenJDK 25 (JEP 470). - -Stable Values -============= -https://openjdk.org/jeps/502 - -Introduce an API for stable values, which are objects that hold -immutable data. Stable values are treated as constants by the JVM, -enabling the same performance optimizations that are enabled by -declaring a field final. Compared to final fields, however, stable -values offer greater flexibility as to the timing of their -initialization. - -This is a preview library feature (http://openjdk.java.net/jeps/12) -introduced in OpenJDK 25 (JEP 502). - -Virtual Machine Enhancements -============================ - -Region Pinning for G1 -===================== -https://openjdk.org/jeps/423 - -Reduce latency by implementing region pinning in G1, so that garbage -collection need not be disabled during Java Native Interface (JNI) -critical regions. - -ZGC: Generational Mode by Default -================================= -https://openjdk.org/jeps/439 -https://openjdk.org/jeps/474 - -Switch the default mode of the Z Garbage Collector (ZGC) to the -generational mode. Deprecate the non-generational mode, with the -intent to remove it in a future release. - -Late Barrier Expansion for G1 -============================= -https://openjdk.org/jeps/475 - -Simplify the implementation of the G1 garbage collector's barriers, -which record information about application memory accesses, by -shifting their expansion from early in the C2 JIT's compilation -pipeline to later. - -Ahead-of-Time Class Loading & Linking -===================================== -https://openjdk.org/jeps/483 -https://openjdk.org/jeps/514 - -Improve startup time by making the classes of an application instantly -available, in a loaded and linked state, when the HotSpot Java Virtual -Machine starts. Achieve this by monitoring the application during one -run and storing the loaded and linked forms of all classes in a cache -for use in subsequent runs. Lay a foundation for future improvements -to both startup and warmup time. - -Using this feature requires a two stage process: - -1. Create the Ahead-of-Time cache from a training run of the -application using the option `--XX:AOTCacheOutput=` where -`` is the cache reference to use in later runs. - -2. When running the application in testing or production, use the -option `-XX:AOTCache=` to run the application with the -cache generated in #2. - -Previously, in OpenJDK 24 (JEP 483), the training run and cache -creation were handled by two separate steps: - -1. Populate the Ahead-of-Time configuration data with a training run -of the application using the options `-XX:AOTMode=record --XX:AOTConfiguration=` where `` is the -configuration reference to use in #2. - -2. Create the Ahead-of-Time cache using the options -`-XX:AOTMode=create -XX:AOTConfiguration= --XX:AOTCache=` where `` is the configuration -reference from #1 and `` is the cache reference to use in -later runs. - -JEP 514 ("Ahead-of-Time Command-Line Ergonomics") in OpenJDK 25 adds -the option `--XX:AOTCacheOutput` which performs both the above steps -from a single command-line invocation using a temporary configuration -file. A new environment variable, `JDK_AOT_VM_OPTIONS`, can be used -to pass options to the cache creation step without affecting the -training run step. - -Ahead-of-Time Method Profiling -============================== -https://openjdk.org/jeps/515 - -Improve warmup time by making method-execution profiles from a -previous run of an application instantly available, when the HotSpot -Java Virtual Machine starts. This will enable the JIT compiler to -generate native code immediately upon application startup, rather than -having to wait for profiles to be collected. - -Synchronize Virtual Threads without Pinning -=========================================== -https://openjdk.org/jeps/491 - -Improve the scalability of Java code that uses synchronized methods -and statements by arranging for virtual threads that block in such -constructs to release their underlying platform threads for use by -other virtual threads. This will eliminate nearly all cases of virtual -threads being pinned to platform threads, which severely restricts the -number of virtual threads available to handle an application's -workload. - -Compact Object Headers -====================== -https://openjdk.org/jeps/450 -https://openjdk.org/jeps/519 - -Reduce the size of object headers in the HotSpot JVM from between 96 -and 128 bits down to 64 bits on 64-bit architectures. This will reduce -heap size, improve deployment density, and increase data locality. - -This is now a production feature in OpenJDK 25 (JEP 519) enabled using -`-XX:+UseCompactObjectHeaders`. It was first introduced as an -experimental feature (JEP 450) that also required the use of -`-XX:+UnlockExperimentalVMOptions`. - -Generational Shenandoah -======================= -https://openjdk.org/jeps/404 -https://openjdk.org/jeps/521 - -Enhance the Shenandoah garbage collector with experimental -generational collection capabilities to improve sustainable -throughput, load-spike resilience, and memory utilization. - -This is now a production feature in OpenJDK 25 (JEP 521) enabled using -`-XX:ShenandoahGCMode=generational`. It was first introduced as an -experimental feature (JEP 404) that also required the use of -`-XX:+UnlockExperimentalVMOptions`. - -JFR Cooperative Sampling -======================== -https://openjdk.org/jeps/518 - -Improve the stability of the JDK Flight Recorder (JFR) when it -asynchronously samples Java thread stacks. Achieve this by walking -call stacks only at safepoints, while minimizing safepoint bias. - -JFR Method Timing & Tracing -=========================== -https://openjdk.org/jeps/520 - -Extend the JDK Flight Recorder (JFR) with facilities for method timing -and tracing via bytecode instrumentation. - -JFR CPU-Time Profiling -====================== -https://openjdk.org/jeps/509 - -Enhance the JDK Flight Recorder (JFR) to capture more accurate -CPU-time profiling information on Linux. - -This is an experimental feature so its JFR events are tagged with the -`@Experimental` annotation. Unlike other experimental virtual machine -features, it does not need to be explicitly enabled with -`-XX:+UnlockExperimentalVMOptions`. - -Tools -===== - -Launch Multi-File Source-Code Programs -====================================== -https://openjdk.org/jeps/458 - -Enhance the java application launcher to be able to run a program -supplied as multiple files of Java source code. This will make the -transition from small programs to larger ones more gradual, enabling -developers to choose whether and when to go to the trouble of -configuring a build tool. - -Markdown Documentation Comments -=============================== -https://openjdk.org/jeps/467 - -Enable JavaDoc documentation comments to be written in Markdown rather -than solely in a mixture of HTML and JavaDoc @-tags. - -Linking Run-Time Images without JMODs -===================================== -https://openjdk.org/jeps/493 - -Reduce the size of the JDK by approximately 25% by enabling the jlink -tool to create custom run-time images without using the JDK's JMOD -files. - -This feature must be enabled when the JDK is built using the ---enable-linkable-runtime option. It will not be enabled by default, -and some JDK vendors may choose not to enable it. - -DEPRECATIONS -============ - -Deprecate the Memory-Access Methods in sun.misc.Unsafe for Removal -================================================================== -https://openjdk.org/jeps/471 - -Deprecate the memory-access methods in sun.misc.Unsafe for removal in -a future release. These unsupported methods have been superseded by -standard APIs, namely the VarHandle API (JEP 193, OpenJDK 9) and the -Foreign Function & Memory API (JEP 454, OpenJDK 22). We strongly -encourage library developers to migrate from sun.misc.Unsafe to -supported replacements, so that applications can migrate smoothly to -modern JDK releases. - -Warn upon Use of Memory-Access Methods in sun.misc.Unsafe -========================================================= -https://openjdk.org/jeps/498 - -Issue a warning at run time on the first occasion that any -memory-access method in sun.misc.Unsafe is invoked. All of these -unsupported methods were terminally deprecated in JDK 23 (see JEP 471 -above). They have been superseded by standard APIs, namely the -VarHandle API (JEP 193, OpenJDK 9) and the Foreign Function & Memory -API (JEP 454, OpenJDK 22). We strongly encourage library developers to -migrate from sun.misc.Unsafe to supported replacements, so that -applications can migrate smoothly to modern JDK releases. - -Permanently Disable the Security Manager -======================================== -https://openjdk.org/jeps/486 - -The Security Manager has not been the primary means of securing -client-side Java code for many years, it has rarely been used to -secure server-side code, and it is costly to maintain. We therefore -deprecated it for removal in OpenJDK 17 via JEP 411 (2021). As the -next step toward removing the Security Manager, we will revise the -Java Platform specification so that developers cannot enable it and -other Platform classes do not refer to it. This change will have no -impact on the vast majority of applications, libraries, and tools. We -will remove the Security Manager API in a future release. - -REMOVALS -======== - -String Templates -================ -https://openjdk.org/jeps/430 -https://openjdk.org/jeps/459 -https://openjdk.org/jeps/465 - -This was a preview feature (http://openjdk.java.net/jeps/12) -introduced in OpenJDK 21 (JEP 430) with a second preview in OpenJDK 22 -(JEP 459). A third preview was proposed but ultimately withdrawn for -OpenJDK 23 (JEP 465) and the feature is no longer present. See [0] -for further explanation. - -[0] https://mail.openjdk.org/pipermail/amber-spec-experts/2024-April/004106.html - -Remove the Windows & Linux 32-bit x86 Ports -=========================================== -https://openjdk.org/jeps/449 -https://openjdk.org/jeps/479 -https://openjdk.org/jeps/501 -https://openjdk.org/jeps/503 - -Remove the source code and build support for the Windows (JEP 479) & -Linux (JEP 503) 32-bit x86 ports. The Windows port was deprecated for -removal in JDK 21 by JEP 449 and the Linux port was deprecated for -removal in JDK 24 by JEP 501. Both deprecations took place with the -express intent to remove the ports in a future release. - -Following this removal of these 32-bit x86 ports, the -architecture-agnostic Zero port is the only way to run Java programs -on 32-bit x86 processors. - -ZGC: Remove the Non-Generational Mode -===================================== -https://openjdk.org/jeps/439 -https://openjdk.org/jeps/474 -https://openjdk.org/jeps/490 - -Remove the non-generational mode of the Z Garbage Collector (ZGC), -keeping the generational mode as the default for ZGC (see JEP 439 & -474). +This is an incubation feature (https://openjdk.java.net/jeps/11) +introduced in OpenJDK 19 (JEP 428). A second round of incubation takes +place in OpenJDK 20 (JEP 437). diff --git a/README.md b/README.md index 9a97482..32ed900 100644 --- a/README.md +++ b/README.md @@ -1,16 +1,16 @@ # java-latest-openjdk-portable -This package contains the latest rolling release of OpenJDK. OpenJDK -has a release cadence of six months, with a new release in March and -September each year. +The java-latest-openjdk-portable package +======= +Rolling release of (usually) STSs OpenJDK +OpenJDK has release cadence of 6 months, but 3/4 of them are Short Term Supported for 6 months only. This package is designed to harbor them. Currently it is build of OpenJDK 12. LTSs will go also as separate packages. -The current release is OpenJDK 25. For a list of major changes from -OpenJDK 21, see the NEWS file included in this package and the -upstream release page: +JDK12 is current release of Java platform. It is bringing many cool improvements - https://openjdk.java.net/projects/jdk/12/ and is landing to your Fedora. Where it will be maintained for f28 and newer. Unluckily, this package is STS (short term support) version. Between individual LTS there will be always several STS. Again, please see announcement: http://mail.openjdk.java.net/pipermail/discuss/2017-September/004281.html and See java SIG plans: https://jvanek.fedorapeople.org/devconf/2018/changesInjavaReleaseProcess.pdf . So this is rolling release of all STSs to come. Its fate during the release of fresh LTS is yet to be decided. You will always be allowed to install LTS in fedora build root, alongside with latest STS via alternatives. -https://openjdk.org/projects/jdk/25/ -This package is intended for those who want to follow the latest -OpenJDK releases. Long term support versions of OpenJDK are available -in the java-1.8.0-openjdk, java-11-openjdk, java-17-openjdk and java-21-openjdk -packages. +See announcement: http://mail.openjdk.java.net/pipermail/discuss/2017-September/004281.html +See java SIG plans: https://jvanek.fedorapeople.org/devconf/2018/changesInjavaReleaseProcess.pdf + +https://bugzilla.redhat.com/show_bug.cgi?id=1557371#c0 +https://fedoraproject.org/wiki/Changes/java-openjdk-10 +https://fedoraproject.org/wiki/Changes/java-11-openjdk-TechPreview diff --git a/TestTranslations.java b/TestTranslations.java index 1b02c06..f6a4fe2 100644 --- a/TestTranslations.java +++ b/TestTranslations.java @@ -50,11 +50,11 @@ public class TestTranslations { "Mountain Daylight Time", "MDT", "MDT", "Mountain Time", "MT", "MT"}); map.put(Locale.FRANCE, new String[] { "heure normale des Rocheuses", "UTC\u221207:00", "MST", - "heure d\u2019\u00e9t\u00e9 des Rocheuses", "UTC\u221206:00", "MST", - "heure des Rocheuses", "UTC\u221207:00", "MST"}); - map.put(Locale.GERMANY, new String[] { "Rocky-Mountains-Normalzeit", "GMT-07:00", "MST", - "Rocky-Mountains-Sommerzeit", "GMT-06:00", "MST", - "Rocky-Mountains-Zeit", "GMT-07:00", "MST"}); + "heure d\u2019\u00e9t\u00e9 des Rocheuses", "UTC\u221206:00", "MDT", + "heure des Rocheuses", "UTC\u221207:00", "MT"}); + map.put(Locale.GERMANY, new String[] { "Rocky-Mountain-Normalzeit", "GMT-07:00", "MST", + "Rocky-Mountain-Sommerzeit", "GMT-06:00", "MDT", + "Rocky-Mountain-Zeit", "GMT-07:00", "MT"}); CIUDAD_JUAREZ = Collections.unmodifiableMap(map); } @@ -97,10 +97,14 @@ public class TestTranslations { System.out.printf("Checking locale %s for %s...\n", l, id); - if ("JRE".equals(localeProvider) || "CLDR".equals(localeProvider)) { + if ("JRE".equals(localeProvider)) { expectedShortStd = expected[2]; expectedShortDST = expected[5]; expectedShortGen = expected[8]; + } else if ("CLDR".equals(localeProvider)) { + expectedShortStd = expected[1]; + expectedShortDST = expected[4]; + expectedShortGen = expected[7]; } else { System.err.printf("Invalid locale provider %s\n", localeProvider); System.exit(3); diff --git a/alt-java.c b/alt-java.c deleted file mode 100644 index 644d002..0000000 --- a/alt-java.c +++ /dev/null @@ -1,100 +0,0 @@ -/* - * Copyright (C) 2023 Red Hat, Inc. - * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. - * - * This code is free software; you can redistribute it and/or modify it - * under the terms of the GNU General Public License version 2 only, as - * published by the Free Software Foundation. Red Hat designates this - * particular file as subject to the "Classpath" exception as provided - * by Red Hat in the LICENSE file that accompanied this code. - * - * This code is distributed in the hope that it will be useful, but WITHOUT - * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or - * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License - * version 2 for more details (a copy is included in the LICENSE file that - * accompanied this code). - * - * You should have received a copy of the GNU General Public License version - * 2 along with this work; if not, write to the Free Software Foundation, - * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. - * - */ - -#include -#include -#include -#include -#include -#include -#include -#include - -/* Per task speculation control */ -#ifndef PR_GET_SPECULATION_CTRL -# define PR_GET_SPECULATION_CTRL 52 -#endif -#ifndef PR_SET_SPECULATION_CTRL -# define PR_SET_SPECULATION_CTRL 53 -#endif -/* Speculation control variants */ -#ifndef PR_SPEC_STORE_BYPASS -# define PR_SPEC_STORE_BYPASS 0 -#endif -/* Return and control values for PR_SET/GET_SPECULATION_CTRL */ - -#ifndef PR_SPEC_NOT_AFFECTED -# define PR_SPEC_NOT_AFFECTED 0 -#endif -#ifndef PR_SPEC_PRCTL -# define PR_SPEC_PRCTL (1UL << 0) -#endif -#ifndef PR_SPEC_ENABLE -# define PR_SPEC_ENABLE (1UL << 1) -#endif -#ifndef PR_SPEC_DISABLE -# define PR_SPEC_DISABLE (1UL << 2) -#endif -#ifndef PR_SPEC_FORCE_DISABLE -# define PR_SPEC_FORCE_DISABLE (1UL << 3) -#endif -#ifndef PR_SPEC_DISABLE_NOEXEC -# define PR_SPEC_DISABLE_NOEXEC (1UL << 4) -#endif - -static void set_speculation() { -#if defined(__linux__) && defined(__x86_64__) - // PR_SPEC_DISABLE_NOEXEC doesn't survive execve, so we can't use it - // if ( prctl(PR_SET_SPECULATION_CTRL, - // PR_SPEC_STORE_BYPASS, - // PR_SPEC_DISABLE_NOEXEC, 0, 0) == 0 ) { - // return; - // } - prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0); -#else -#warning alt-java requested but SSB mitigation not available on this platform. -#endif -} - -int main(int argc, char **argv) { - set_speculation(); - - char our_name[PATH_MAX], java_name[PATH_MAX]; - ssize_t len = readlink("/proc/self/exe", our_name, PATH_MAX - 1); - if (len < 0) { - perror("I can't find myself"); - exit(2); - } - - our_name[len] = '\0'; // readlink(2) doesn't append a null byte - char *path = dirname(our_name); - strncpy(java_name, path, PATH_MAX - 1); - - size_t remaining_bytes = PATH_MAX - strlen(path) - 1; - strncat(java_name, "/java", remaining_bytes); - - execv(java_name, argv); - fprintf(stderr, "%s failed to launch: %s\n", java_name, strerror(errno)); - - exit(1); -} - diff --git a/fips-20u-fd3de3d95b5.patch b/fips-20u-fd3de3d95b5.patch new file mode 100644 index 0000000..c36a5b6 --- /dev/null +++ b/fips-20u-fd3de3d95b5.patch @@ -0,0 +1,3478 @@ +diff --git a/make/autoconf/lib-sysconf.m4 b/make/autoconf/lib-sysconf.m4 +new file mode 100644 +index 00000000000..b2b1c1787da +--- /dev/null ++++ b/make/autoconf/lib-sysconf.m4 +@@ -0,0 +1,84 @@ ++# ++# Copyright (c) 2021, Red Hat, Inc. ++# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++# ++# This code is free software; you can redistribute it and/or modify it ++# under the terms of the GNU General Public License version 2 only, as ++# published by the Free Software Foundation. Oracle designates this ++# particular file as subject to the "Classpath" exception as provided ++# by Oracle in the LICENSE file that accompanied this code. ++# ++# This code is distributed in the hope that it will be useful, but WITHOUT ++# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++# version 2 for more details (a copy is included in the LICENSE file that ++# accompanied this code). ++# ++# You should have received a copy of the GNU General Public License version ++# 2 along with this work; if not, write to the Free Software Foundation, ++# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++# ++# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++# or visit www.oracle.com if you need additional information or have any ++# questions. ++# ++ ++################################################################################ ++# Setup system configuration libraries ++################################################################################ ++AC_DEFUN_ONCE([LIB_SETUP_SYSCONF_LIBS], ++[ ++ ############################################################################### ++ # ++ # Check for the NSS library ++ # ++ ++ AC_MSG_CHECKING([whether to use the system NSS library with the System Configurator (libsysconf)]) ++ ++ # default is not available ++ DEFAULT_SYSCONF_NSS=no ++ ++ AC_ARG_ENABLE([sysconf-nss], [AS_HELP_STRING([--enable-sysconf-nss], ++ [build the System Configurator (libsysconf) using the system NSS library if available @<:@disabled@:>@])], ++ [ ++ case "${enableval}" in ++ yes) ++ sysconf_nss=yes ++ ;; ++ *) ++ sysconf_nss=no ++ ;; ++ esac ++ ], ++ [ ++ sysconf_nss=${DEFAULT_SYSCONF_NSS} ++ ]) ++ AC_MSG_RESULT([$sysconf_nss]) ++ ++ USE_SYSCONF_NSS=false ++ if test "x${sysconf_nss}" = "xyes"; then ++ PKG_CHECK_MODULES(NSS, nss >= 3.53, [NSS_FOUND=yes], [NSS_FOUND=no]) ++ if test "x${NSS_FOUND}" = "xyes"; then ++ AC_MSG_CHECKING([for system FIPS support in NSS]) ++ saved_libs="${LIBS}" ++ saved_cflags="${CFLAGS}" ++ CFLAGS="${CFLAGS} ${NSS_CFLAGS}" ++ LIBS="${LIBS} ${NSS_LIBS}" ++ AC_LANG_PUSH([C]) ++ AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include ]], ++ [[SECMOD_GetSystemFIPSEnabled()]])], ++ [AC_MSG_RESULT([yes])], ++ [AC_MSG_RESULT([no]) ++ AC_MSG_ERROR([System NSS FIPS detection unavailable])]) ++ AC_LANG_POP([C]) ++ CFLAGS="${saved_cflags}" ++ LIBS="${saved_libs}" ++ USE_SYSCONF_NSS=true ++ else ++ dnl NSS 3.53 is the one that introduces the SECMOD_GetSystemFIPSEnabled API ++ dnl in nss3/pk11pub.h. ++ AC_MSG_ERROR([--enable-sysconf-nss specified, but NSS 3.53 or above not found.]) ++ fi ++ fi ++ AC_SUBST(USE_SYSCONF_NSS) ++]) +diff --git a/make/autoconf/libraries.m4 b/make/autoconf/libraries.m4 +index 7a1d8d80bb2..1807cb71073 100644 +--- a/make/autoconf/libraries.m4 ++++ b/make/autoconf/libraries.m4 +@@ -35,6 +35,7 @@ m4_include([lib-std.m4]) + m4_include([lib-x11.m4]) + + m4_include([lib-tests.m4]) ++m4_include([lib-sysconf.m4]) + + ################################################################################ + # Determine which libraries are needed for this configuration +@@ -107,6 +108,7 @@ AC_DEFUN_ONCE([LIB_SETUP_LIBRARIES], + LIB_SETUP_X11 + + LIB_TESTS_SETUP_GTEST ++ LIB_SETUP_SYSCONF_LIBS + + BASIC_JDKLIB_LIBS="" + if test "x$TOOLCHAIN_TYPE" != xmicrosoft; then +diff --git a/make/autoconf/spec.gmk.in b/make/autoconf/spec.gmk.in +index 9448cb9b7e8..8d3d931e951 100644 +--- a/make/autoconf/spec.gmk.in ++++ b/make/autoconf/spec.gmk.in +@@ -859,6 +859,10 @@ INSTALL_SYSCONFDIR=@sysconfdir@ + # Libraries + # + ++USE_SYSCONF_NSS:=@USE_SYSCONF_NSS@ ++NSS_LIBS:=@NSS_LIBS@ ++NSS_CFLAGS:=@NSS_CFLAGS@ ++ + USE_EXTERNAL_LCMS:=@USE_EXTERNAL_LCMS@ + LCMS_CFLAGS:=@LCMS_CFLAGS@ + LCMS_LIBS:=@LCMS_LIBS@ +diff --git a/make/modules/java.base/Lib.gmk b/make/modules/java.base/Lib.gmk +index 3b782577258..f515b0ba241 100644 +--- a/make/modules/java.base/Lib.gmk ++++ b/make/modules/java.base/Lib.gmk +@@ -163,6 +163,29 @@ ifeq ($(call isTargetOsType, unix), true) + endif + endif + ++################################################################################ ++# Create the systemconf library ++ ++LIBSYSTEMCONF_CFLAGS := ++LIBSYSTEMCONF_CXXFLAGS := ++ ++ifeq ($(USE_SYSCONF_NSS), true) ++ LIBSYSTEMCONF_CFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS ++ LIBSYSTEMCONF_CXXFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS ++endif ++ ++$(eval $(call SetupJdkLibrary, BUILD_LIBSYSTEMCONF, \ ++ NAME := systemconf, \ ++ OPTIMIZATION := LOW, \ ++ CFLAGS := $(CFLAGS_JDKLIB) $(LIBSYSTEMCONF_CFLAGS), \ ++ CXXFLAGS := $(CXXFLAGS_JDKLIB) $(LIBSYSTEMCONF_CXXFLAGS), \ ++ LDFLAGS := $(LDFLAGS_JDKLIB) \ ++ $(call SET_SHARED_LIBRARY_ORIGIN), \ ++ LIBS_unix := $(LIBDL) $(NSS_LIBS), \ ++)) ++ ++TARGETS += $(BUILD_LIBSYSTEMCONF) ++ + ################################################################################ + # Create the symbols file for static builds. + +diff --git a/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java b/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java +index 38836d2701e..d967010b848 100644 +--- a/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java ++++ b/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java +@@ -31,6 +31,7 @@ import java.security.SecureRandom; + import java.security.PrivilegedAction; + import java.util.HashMap; + import java.util.List; ++import jdk.internal.access.SharedSecrets; + import static sun.security.util.SecurityConstants.PROVIDER_VER; + import static sun.security.util.SecurityProviderConstants.*; + +@@ -78,6 +79,10 @@ import static sun.security.util.SecurityProviderConstants.*; + + public final class SunJCE extends Provider { + ++ private static final boolean systemFipsEnabled = ++ SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ .isSystemFipsEnabled(); ++ + @java.io.Serial + private static final long serialVersionUID = 6812507587804302833L; + +@@ -143,285 +148,287 @@ public final class SunJCE extends Provider { + void putEntries() { + // reuse attribute map and reset before each reuse + HashMap attrs = new HashMap<>(3); +- attrs.put("SupportedModes", "ECB"); +- attrs.put("SupportedPaddings", "NOPADDING|PKCS1PADDING|OAEPPADDING" +- + "|OAEPWITHMD5ANDMGF1PADDING" +- + "|OAEPWITHSHA1ANDMGF1PADDING" +- + "|OAEPWITHSHA-1ANDMGF1PADDING" +- + "|OAEPWITHSHA-224ANDMGF1PADDING" +- + "|OAEPWITHSHA-256ANDMGF1PADDING" +- + "|OAEPWITHSHA-384ANDMGF1PADDING" +- + "|OAEPWITHSHA-512ANDMGF1PADDING" +- + "|OAEPWITHSHA-512/224ANDMGF1PADDING" +- + "|OAEPWITHSHA-512/256ANDMGF1PADDING"); +- attrs.put("SupportedKeyClasses", +- "java.security.interfaces.RSAPublicKey" + +- "|java.security.interfaces.RSAPrivateKey"); +- ps("Cipher", "RSA", +- "com.sun.crypto.provider.RSACipher", null, attrs); +- +- // common block cipher modes, pads +- final String BLOCK_MODES = "ECB|CBC|PCBC|CTR|CTS|CFB|OFB" + +- "|CFB8|CFB16|CFB24|CFB32|CFB40|CFB48|CFB56|CFB64" + +- "|OFB8|OFB16|OFB24|OFB32|OFB40|OFB48|OFB56|OFB64"; +- final String BLOCK_MODES128 = BLOCK_MODES + +- "|CFB72|CFB80|CFB88|CFB96|CFB104|CFB112|CFB120|CFB128" + +- "|OFB72|OFB80|OFB88|OFB96|OFB104|OFB112|OFB120|OFB128"; +- final String BLOCK_PADS = "NOPADDING|PKCS5PADDING|ISO10126PADDING"; +- +- attrs.clear(); +- attrs.put("SupportedModes", BLOCK_MODES); +- attrs.put("SupportedPaddings", BLOCK_PADS); +- attrs.put("SupportedKeyFormats", "RAW"); +- ps("Cipher", "DES", +- "com.sun.crypto.provider.DESCipher", null, attrs); +- psA("Cipher", "DESede", "com.sun.crypto.provider.DESedeCipher", +- attrs); +- ps("Cipher", "Blowfish", +- "com.sun.crypto.provider.BlowfishCipher", null, attrs); +- +- ps("Cipher", "RC2", +- "com.sun.crypto.provider.RC2Cipher", null, attrs); +- +- attrs.clear(); +- attrs.put("SupportedModes", BLOCK_MODES128); +- attrs.put("SupportedPaddings", BLOCK_PADS); +- attrs.put("SupportedKeyFormats", "RAW"); +- psA("Cipher", "AES", +- "com.sun.crypto.provider.AESCipher$General", attrs); +- +- attrs.clear(); +- attrs.put("SupportedKeyFormats", "RAW"); +- psA("Cipher", "AES/KW/NoPadding", +- "com.sun.crypto.provider.KeyWrapCipher$AES_KW_NoPadding", +- attrs); +- ps("Cipher", "AES/KW/PKCS5Padding", +- "com.sun.crypto.provider.KeyWrapCipher$AES_KW_PKCS5Padding", +- null, attrs); +- psA("Cipher", "AES/KWP/NoPadding", +- "com.sun.crypto.provider.KeyWrapCipher$AES_KWP_NoPadding", +- attrs); +- +- psA("Cipher", "AES_128/ECB/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES128_ECB_NoPadding", +- attrs); +- psA("Cipher", "AES_128/CBC/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES128_CBC_NoPadding", +- attrs); +- psA("Cipher", "AES_128/OFB/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES128_OFB_NoPadding", +- attrs); +- psA("Cipher", "AES_128/CFB/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES128_CFB_NoPadding", +- attrs); +- psA("Cipher", "AES_128/KW/NoPadding", +- "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_NoPadding", +- attrs); +- ps("Cipher", "AES_128/KW/PKCS5Padding", +- "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_PKCS5Padding", +- null, attrs); +- psA("Cipher", "AES_128/KWP/NoPadding", +- "com.sun.crypto.provider.KeyWrapCipher$AES128_KWP_NoPadding", +- attrs); +- +- psA("Cipher", "AES_192/ECB/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES192_ECB_NoPadding", +- attrs); +- psA("Cipher", "AES_192/CBC/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES192_CBC_NoPadding", +- attrs); +- psA("Cipher", "AES_192/OFB/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES192_OFB_NoPadding", +- attrs); +- psA("Cipher", "AES_192/CFB/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES192_CFB_NoPadding", +- attrs); +- psA("Cipher", "AES_192/KW/NoPadding", +- "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_NoPadding", +- attrs); +- ps("Cipher", "AES_192/KW/PKCS5Padding", +- "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_PKCS5Padding", +- null, attrs); +- psA("Cipher", "AES_192/KWP/NoPadding", +- "com.sun.crypto.provider.KeyWrapCipher$AES192_KWP_NoPadding", +- attrs); +- +- psA("Cipher", "AES_256/ECB/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES256_ECB_NoPadding", +- attrs); +- psA("Cipher", "AES_256/CBC/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES256_CBC_NoPadding", +- attrs); +- psA("Cipher", "AES_256/OFB/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES256_OFB_NoPadding", +- attrs); +- psA("Cipher", "AES_256/CFB/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES256_CFB_NoPadding", +- attrs); +- psA("Cipher", "AES_256/KW/NoPadding", +- "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_NoPadding", +- attrs); +- ps("Cipher", "AES_256/KW/PKCS5Padding", +- "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_PKCS5Padding", +- null, attrs); +- psA("Cipher", "AES_256/KWP/NoPadding", +- "com.sun.crypto.provider.KeyWrapCipher$AES256_KWP_NoPadding", +- attrs); +- +- attrs.clear(); +- attrs.put("SupportedModes", "GCM"); +- attrs.put("SupportedKeyFormats", "RAW"); +- +- ps("Cipher", "AES/GCM/NoPadding", +- "com.sun.crypto.provider.GaloisCounterMode$AESGCM", null, +- attrs); +- psA("Cipher", "AES_128/GCM/NoPadding", +- "com.sun.crypto.provider.GaloisCounterMode$AES128", +- attrs); +- psA("Cipher", "AES_192/GCM/NoPadding", +- "com.sun.crypto.provider.GaloisCounterMode$AES192", +- attrs); +- psA("Cipher", "AES_256/GCM/NoPadding", +- "com.sun.crypto.provider.GaloisCounterMode$AES256", +- attrs); +- +- attrs.clear(); +- attrs.put("SupportedModes", "CBC"); +- attrs.put("SupportedPaddings", "NOPADDING"); +- attrs.put("SupportedKeyFormats", "RAW"); +- ps("Cipher", "DESedeWrap", +- "com.sun.crypto.provider.DESedeWrapCipher", null, attrs); +- +- attrs.clear(); +- attrs.put("SupportedModes", "ECB"); +- attrs.put("SupportedPaddings", "NOPADDING"); +- attrs.put("SupportedKeyFormats", "RAW"); +- psA("Cipher", "ARCFOUR", +- "com.sun.crypto.provider.ARCFOURCipher", attrs); +- +- attrs.clear(); +- attrs.put("SupportedKeyFormats", "RAW"); +- ps("Cipher", "ChaCha20", +- "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Only", +- null, attrs); +- psA("Cipher", "ChaCha20-Poly1305", +- "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Poly1305", +- attrs); +- +- // PBES1 +- psA("Cipher", "PBEWithMD5AndDES", +- "com.sun.crypto.provider.PBEWithMD5AndDESCipher", +- null); +- ps("Cipher", "PBEWithMD5AndTripleDES", +- "com.sun.crypto.provider.PBEWithMD5AndTripleDESCipher"); +- psA("Cipher", "PBEWithSHA1AndDESede", +- "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndDESede", +- null); +- psA("Cipher", "PBEWithSHA1AndRC2_40", +- "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_40", +- null); +- psA("Cipher", "PBEWithSHA1AndRC2_128", +- "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_128", +- null); +- psA("Cipher", "PBEWithSHA1AndRC4_40", +- "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_40", +- null); +- +- psA("Cipher", "PBEWithSHA1AndRC4_128", +- "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_128", +- null); +- +- // PBES2 +- ps("Cipher", "PBEWithHmacSHA1AndAES_128", +- "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_128"); +- +- ps("Cipher", "PBEWithHmacSHA224AndAES_128", +- "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_128"); +- +- ps("Cipher", "PBEWithHmacSHA256AndAES_128", +- "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_128"); +- +- ps("Cipher", "PBEWithHmacSHA384AndAES_128", +- "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_128"); +- +- ps("Cipher", "PBEWithHmacSHA512AndAES_128", +- "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_128"); +- +- ps("Cipher", "PBEWithHmacSHA1AndAES_256", +- "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_256"); +- +- ps("Cipher", "PBEWithHmacSHA224AndAES_256", +- "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_256"); +- +- ps("Cipher", "PBEWithHmacSHA256AndAES_256", +- "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_256"); +- +- ps("Cipher", "PBEWithHmacSHA384AndAES_256", +- "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_256"); +- +- ps("Cipher", "PBEWithHmacSHA512AndAES_256", +- "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_256"); +- +- /* +- * Key(pair) Generator engines +- */ +- ps("KeyGenerator", "DES", +- "com.sun.crypto.provider.DESKeyGenerator"); +- psA("KeyGenerator", "DESede", +- "com.sun.crypto.provider.DESedeKeyGenerator", +- null); +- ps("KeyGenerator", "Blowfish", +- "com.sun.crypto.provider.BlowfishKeyGenerator"); +- psA("KeyGenerator", "AES", +- "com.sun.crypto.provider.AESKeyGenerator", +- null); +- ps("KeyGenerator", "RC2", +- "com.sun.crypto.provider.KeyGeneratorCore$RC2KeyGenerator"); +- psA("KeyGenerator", "ARCFOUR", +- "com.sun.crypto.provider.KeyGeneratorCore$ARCFOURKeyGenerator", +- null); +- ps("KeyGenerator", "ChaCha20", +- "com.sun.crypto.provider.KeyGeneratorCore$ChaCha20KeyGenerator"); +- ps("KeyGenerator", "HmacMD5", +- "com.sun.crypto.provider.HmacMD5KeyGenerator"); +- +- psA("KeyGenerator", "HmacSHA1", +- "com.sun.crypto.provider.HmacSHA1KeyGenerator", null); +- psA("KeyGenerator", "HmacSHA224", +- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA224", +- null); +- psA("KeyGenerator", "HmacSHA256", +- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA256", +- null); +- psA("KeyGenerator", "HmacSHA384", +- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA384", +- null); +- psA("KeyGenerator", "HmacSHA512", +- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512", +- null); +- psA("KeyGenerator", "HmacSHA512/224", +- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_224", +- null); +- psA("KeyGenerator", "HmacSHA512/256", +- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_256", +- null); +- +- psA("KeyGenerator", "HmacSHA3-224", +- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_224", +- null); +- psA("KeyGenerator", "HmacSHA3-256", +- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_256", +- null); +- psA("KeyGenerator", "HmacSHA3-384", +- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_384", +- null); +- psA("KeyGenerator", "HmacSHA3-512", +- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_512", +- null); +- +- psA("KeyPairGenerator", "DiffieHellman", +- "com.sun.crypto.provider.DHKeyPairGenerator", +- null); ++ if (!systemFipsEnabled) { ++ attrs.put("SupportedModes", "ECB"); ++ attrs.put("SupportedPaddings", "NOPADDING|PKCS1PADDING|OAEPPADDING" ++ + "|OAEPWITHMD5ANDMGF1PADDING" ++ + "|OAEPWITHSHA1ANDMGF1PADDING" ++ + "|OAEPWITHSHA-1ANDMGF1PADDING" ++ + "|OAEPWITHSHA-224ANDMGF1PADDING" ++ + "|OAEPWITHSHA-256ANDMGF1PADDING" ++ + "|OAEPWITHSHA-384ANDMGF1PADDING" ++ + "|OAEPWITHSHA-512ANDMGF1PADDING" ++ + "|OAEPWITHSHA-512/224ANDMGF1PADDING" ++ + "|OAEPWITHSHA-512/256ANDMGF1PADDING"); ++ attrs.put("SupportedKeyClasses", ++ "java.security.interfaces.RSAPublicKey" + ++ "|java.security.interfaces.RSAPrivateKey"); ++ ps("Cipher", "RSA", ++ "com.sun.crypto.provider.RSACipher", null, attrs); ++ ++ // common block cipher modes, pads ++ final String BLOCK_MODES = "ECB|CBC|PCBC|CTR|CTS|CFB|OFB" + ++ "|CFB8|CFB16|CFB24|CFB32|CFB40|CFB48|CFB56|CFB64" + ++ "|OFB8|OFB16|OFB24|OFB32|OFB40|OFB48|OFB56|OFB64"; ++ final String BLOCK_MODES128 = BLOCK_MODES + ++ "|CFB72|CFB80|CFB88|CFB96|CFB104|CFB112|CFB120|CFB128" + ++ "|OFB72|OFB80|OFB88|OFB96|OFB104|OFB112|OFB120|OFB128"; ++ final String BLOCK_PADS = "NOPADDING|PKCS5PADDING|ISO10126PADDING"; ++ ++ attrs.clear(); ++ attrs.put("SupportedModes", BLOCK_MODES); ++ attrs.put("SupportedPaddings", BLOCK_PADS); ++ attrs.put("SupportedKeyFormats", "RAW"); ++ ps("Cipher", "DES", ++ "com.sun.crypto.provider.DESCipher", null, attrs); ++ psA("Cipher", "DESede", "com.sun.crypto.provider.DESedeCipher", ++ attrs); ++ ps("Cipher", "Blowfish", ++ "com.sun.crypto.provider.BlowfishCipher", null, attrs); ++ ++ ps("Cipher", "RC2", ++ "com.sun.crypto.provider.RC2Cipher", null, attrs); ++ ++ attrs.clear(); ++ attrs.put("SupportedModes", BLOCK_MODES128); ++ attrs.put("SupportedPaddings", BLOCK_PADS); ++ attrs.put("SupportedKeyFormats", "RAW"); ++ psA("Cipher", "AES", ++ "com.sun.crypto.provider.AESCipher$General", attrs); ++ ++ attrs.clear(); ++ attrs.put("SupportedKeyFormats", "RAW"); ++ psA("Cipher", "AES/KW/NoPadding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES_KW_NoPadding", ++ attrs); ++ ps("Cipher", "AES/KW/PKCS5Padding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES_KW_PKCS5Padding", ++ null, attrs); ++ psA("Cipher", "AES/KWP/NoPadding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES_KWP_NoPadding", ++ attrs); ++ ++ psA("Cipher", "AES_128/ECB/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES128_ECB_NoPadding", ++ attrs); ++ psA("Cipher", "AES_128/CBC/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES128_CBC_NoPadding", ++ attrs); ++ psA("Cipher", "AES_128/OFB/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES128_OFB_NoPadding", ++ attrs); ++ psA("Cipher", "AES_128/CFB/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES128_CFB_NoPadding", ++ attrs); ++ psA("Cipher", "AES_128/KW/NoPadding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_NoPadding", ++ attrs); ++ ps("Cipher", "AES_128/KW/PKCS5Padding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_PKCS5Padding", ++ null, attrs); ++ psA("Cipher", "AES_128/KWP/NoPadding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES128_KWP_NoPadding", ++ attrs); ++ ++ psA("Cipher", "AES_192/ECB/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES192_ECB_NoPadding", ++ attrs); ++ psA("Cipher", "AES_192/CBC/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES192_CBC_NoPadding", ++ attrs); ++ psA("Cipher", "AES_192/OFB/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES192_OFB_NoPadding", ++ attrs); ++ psA("Cipher", "AES_192/CFB/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES192_CFB_NoPadding", ++ attrs); ++ psA("Cipher", "AES_192/KW/NoPadding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_NoPadding", ++ attrs); ++ ps("Cipher", "AES_192/KW/PKCS5Padding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_PKCS5Padding", ++ null, attrs); ++ psA("Cipher", "AES_192/KWP/NoPadding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES192_KWP_NoPadding", ++ attrs); ++ ++ psA("Cipher", "AES_256/ECB/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES256_ECB_NoPadding", ++ attrs); ++ psA("Cipher", "AES_256/CBC/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES256_CBC_NoPadding", ++ attrs); ++ psA("Cipher", "AES_256/OFB/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES256_OFB_NoPadding", ++ attrs); ++ psA("Cipher", "AES_256/CFB/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES256_CFB_NoPadding", ++ attrs); ++ psA("Cipher", "AES_256/KW/NoPadding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_NoPadding", ++ attrs); ++ ps("Cipher", "AES_256/KW/PKCS5Padding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_PKCS5Padding", ++ null, attrs); ++ psA("Cipher", "AES_256/KWP/NoPadding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES256_KWP_NoPadding", ++ attrs); ++ ++ attrs.clear(); ++ attrs.put("SupportedModes", "GCM"); ++ attrs.put("SupportedKeyFormats", "RAW"); ++ ++ ps("Cipher", "AES/GCM/NoPadding", ++ "com.sun.crypto.provider.GaloisCounterMode$AESGCM", null, ++ attrs); ++ psA("Cipher", "AES_128/GCM/NoPadding", ++ "com.sun.crypto.provider.GaloisCounterMode$AES128", ++ attrs); ++ psA("Cipher", "AES_192/GCM/NoPadding", ++ "com.sun.crypto.provider.GaloisCounterMode$AES192", ++ attrs); ++ psA("Cipher", "AES_256/GCM/NoPadding", ++ "com.sun.crypto.provider.GaloisCounterMode$AES256", ++ attrs); ++ ++ attrs.clear(); ++ attrs.put("SupportedModes", "CBC"); ++ attrs.put("SupportedPaddings", "NOPADDING"); ++ attrs.put("SupportedKeyFormats", "RAW"); ++ ps("Cipher", "DESedeWrap", ++ "com.sun.crypto.provider.DESedeWrapCipher", null, attrs); ++ ++ attrs.clear(); ++ attrs.put("SupportedModes", "ECB"); ++ attrs.put("SupportedPaddings", "NOPADDING"); ++ attrs.put("SupportedKeyFormats", "RAW"); ++ psA("Cipher", "ARCFOUR", ++ "com.sun.crypto.provider.ARCFOURCipher", attrs); ++ ++ attrs.clear(); ++ attrs.put("SupportedKeyFormats", "RAW"); ++ ps("Cipher", "ChaCha20", ++ "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Only", ++ null, attrs); ++ psA("Cipher", "ChaCha20-Poly1305", ++ "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Poly1305", ++ attrs); ++ ++ // PBES1 ++ psA("Cipher", "PBEWithMD5AndDES", ++ "com.sun.crypto.provider.PBEWithMD5AndDESCipher", ++ null); ++ ps("Cipher", "PBEWithMD5AndTripleDES", ++ "com.sun.crypto.provider.PBEWithMD5AndTripleDESCipher"); ++ psA("Cipher", "PBEWithSHA1AndDESede", ++ "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndDESede", ++ null); ++ psA("Cipher", "PBEWithSHA1AndRC2_40", ++ "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_40", ++ null); ++ psA("Cipher", "PBEWithSHA1AndRC2_128", ++ "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_128", ++ null); ++ psA("Cipher", "PBEWithSHA1AndRC4_40", ++ "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_40", ++ null); ++ ++ psA("Cipher", "PBEWithSHA1AndRC4_128", ++ "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_128", ++ null); ++ ++ // PBES2 ++ ps("Cipher", "PBEWithHmacSHA1AndAES_128", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_128"); ++ ++ ps("Cipher", "PBEWithHmacSHA224AndAES_128", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_128"); ++ ++ ps("Cipher", "PBEWithHmacSHA256AndAES_128", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_128"); ++ ++ ps("Cipher", "PBEWithHmacSHA384AndAES_128", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_128"); ++ ++ ps("Cipher", "PBEWithHmacSHA512AndAES_128", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_128"); ++ ++ ps("Cipher", "PBEWithHmacSHA1AndAES_256", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_256"); ++ ++ ps("Cipher", "PBEWithHmacSHA224AndAES_256", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_256"); ++ ++ ps("Cipher", "PBEWithHmacSHA256AndAES_256", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_256"); ++ ++ ps("Cipher", "PBEWithHmacSHA384AndAES_256", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_256"); ++ ++ ps("Cipher", "PBEWithHmacSHA512AndAES_256", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_256"); ++ ++ /* ++ * Key(pair) Generator engines ++ */ ++ ps("KeyGenerator", "DES", ++ "com.sun.crypto.provider.DESKeyGenerator"); ++ psA("KeyGenerator", "DESede", ++ "com.sun.crypto.provider.DESedeKeyGenerator", ++ null); ++ ps("KeyGenerator", "Blowfish", ++ "com.sun.crypto.provider.BlowfishKeyGenerator"); ++ psA("KeyGenerator", "AES", ++ "com.sun.crypto.provider.AESKeyGenerator", ++ null); ++ ps("KeyGenerator", "RC2", ++ "com.sun.crypto.provider.KeyGeneratorCore$RC2KeyGenerator"); ++ psA("KeyGenerator", "ARCFOUR", ++ "com.sun.crypto.provider.KeyGeneratorCore$ARCFOURKeyGenerator", ++ null); ++ ps("KeyGenerator", "ChaCha20", ++ "com.sun.crypto.provider.KeyGeneratorCore$ChaCha20KeyGenerator"); ++ ps("KeyGenerator", "HmacMD5", ++ "com.sun.crypto.provider.HmacMD5KeyGenerator"); ++ ++ psA("KeyGenerator", "HmacSHA1", ++ "com.sun.crypto.provider.HmacSHA1KeyGenerator", null); ++ psA("KeyGenerator", "HmacSHA224", ++ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA224", ++ null); ++ psA("KeyGenerator", "HmacSHA256", ++ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA256", ++ null); ++ psA("KeyGenerator", "HmacSHA384", ++ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA384", ++ null); ++ psA("KeyGenerator", "HmacSHA512", ++ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512", ++ null); ++ psA("KeyGenerator", "HmacSHA512/224", ++ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_224", ++ null); ++ psA("KeyGenerator", "HmacSHA512/256", ++ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_256", ++ null); ++ ++ psA("KeyGenerator", "HmacSHA3-224", ++ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_224", ++ null); ++ psA("KeyGenerator", "HmacSHA3-256", ++ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_256", ++ null); ++ psA("KeyGenerator", "HmacSHA3-384", ++ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_384", ++ null); ++ psA("KeyGenerator", "HmacSHA3-512", ++ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_512", ++ null); ++ ++ psA("KeyPairGenerator", "DiffieHellman", ++ "com.sun.crypto.provider.DHKeyPairGenerator", ++ null); ++ } + + /* + * Algorithm parameter generation engines +@@ -430,15 +437,17 @@ public final class SunJCE extends Provider { + "DiffieHellman", "com.sun.crypto.provider.DHParameterGenerator", + null); + +- /* +- * Key Agreement engines +- */ +- attrs.clear(); +- attrs.put("SupportedKeyClasses", "javax.crypto.interfaces.DHPublicKey" + +- "|javax.crypto.interfaces.DHPrivateKey"); +- psA("KeyAgreement", "DiffieHellman", +- "com.sun.crypto.provider.DHKeyAgreement", +- attrs); ++ if (!systemFipsEnabled) { ++ /* ++ * Key Agreement engines ++ */ ++ attrs.clear(); ++ attrs.put("SupportedKeyClasses", "javax.crypto.interfaces.DHPublicKey" + ++ "|javax.crypto.interfaces.DHPrivateKey"); ++ psA("KeyAgreement", "DiffieHellman", ++ "com.sun.crypto.provider.DHKeyAgreement", ++ attrs); ++ } + + /* + * Algorithm Parameter engines +@@ -610,118 +619,120 @@ public final class SunJCE extends Provider { + ps("SecretKeyFactory", "PBEWithHmacSHA512AndAES_256", + "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512AndAES_256"); + +- // PBKDF2 +- psA("SecretKeyFactory", "PBKDF2WithHmacSHA1", +- "com.sun.crypto.provider.PBKDF2Core$HmacSHA1", +- null); +- ps("SecretKeyFactory", "PBKDF2WithHmacSHA224", +- "com.sun.crypto.provider.PBKDF2Core$HmacSHA224"); +- ps("SecretKeyFactory", "PBKDF2WithHmacSHA256", +- "com.sun.crypto.provider.PBKDF2Core$HmacSHA256"); +- ps("SecretKeyFactory", "PBKDF2WithHmacSHA384", +- "com.sun.crypto.provider.PBKDF2Core$HmacSHA384"); +- ps("SecretKeyFactory", "PBKDF2WithHmacSHA512", +- "com.sun.crypto.provider.PBKDF2Core$HmacSHA512"); +- +- /* +- * MAC +- */ +- attrs.clear(); +- attrs.put("SupportedKeyFormats", "RAW"); +- ps("Mac", "HmacMD5", "com.sun.crypto.provider.HmacMD5", null, attrs); +- psA("Mac", "HmacSHA1", "com.sun.crypto.provider.HmacSHA1", +- attrs); +- psA("Mac", "HmacSHA224", +- "com.sun.crypto.provider.HmacCore$HmacSHA224", attrs); +- psA("Mac", "HmacSHA256", +- "com.sun.crypto.provider.HmacCore$HmacSHA256", attrs); +- psA("Mac", "HmacSHA384", +- "com.sun.crypto.provider.HmacCore$HmacSHA384", attrs); +- psA("Mac", "HmacSHA512", +- "com.sun.crypto.provider.HmacCore$HmacSHA512", attrs); +- psA("Mac", "HmacSHA512/224", +- "com.sun.crypto.provider.HmacCore$HmacSHA512_224", attrs); +- psA("Mac", "HmacSHA512/256", +- "com.sun.crypto.provider.HmacCore$HmacSHA512_256", attrs); +- psA("Mac", "HmacSHA3-224", +- "com.sun.crypto.provider.HmacCore$HmacSHA3_224", attrs); +- psA("Mac", "HmacSHA3-256", +- "com.sun.crypto.provider.HmacCore$HmacSHA3_256", attrs); +- psA("Mac", "HmacSHA3-384", +- "com.sun.crypto.provider.HmacCore$HmacSHA3_384", attrs); +- psA("Mac", "HmacSHA3-512", +- "com.sun.crypto.provider.HmacCore$HmacSHA3_512", attrs); +- +- ps("Mac", "HmacPBESHA1", +- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA1", +- null, attrs); +- ps("Mac", "HmacPBESHA224", +- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA224", +- null, attrs); +- ps("Mac", "HmacPBESHA256", +- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA256", +- null, attrs); +- ps("Mac", "HmacPBESHA384", +- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA384", +- null, attrs); +- ps("Mac", "HmacPBESHA512", +- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512", +- null, attrs); +- ps("Mac", "HmacPBESHA512/224", +- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512_224", +- null, attrs); +- ps("Mac", "HmacPBESHA512/256", +- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512_256", +- null, attrs); +- +- +- // PBMAC1 +- ps("Mac", "PBEWithHmacSHA1", +- "com.sun.crypto.provider.PBMAC1Core$HmacSHA1", null, attrs); +- ps("Mac", "PBEWithHmacSHA224", +- "com.sun.crypto.provider.PBMAC1Core$HmacSHA224", null, attrs); +- ps("Mac", "PBEWithHmacSHA256", +- "com.sun.crypto.provider.PBMAC1Core$HmacSHA256", null, attrs); +- ps("Mac", "PBEWithHmacSHA384", +- "com.sun.crypto.provider.PBMAC1Core$HmacSHA384", null, attrs); +- ps("Mac", "PBEWithHmacSHA512", +- "com.sun.crypto.provider.PBMAC1Core$HmacSHA512", null, attrs); +- ps("Mac", "SslMacMD5", +- "com.sun.crypto.provider.SslMacCore$SslMacMD5", null, attrs); +- ps("Mac", "SslMacSHA1", +- "com.sun.crypto.provider.SslMacCore$SslMacSHA1", null, attrs); +- +- /* +- * KeyStore +- */ +- ps("KeyStore", "JCEKS", +- "com.sun.crypto.provider.JceKeyStore"); +- +- /* +- * SSL/TLS mechanisms +- * +- * These are strictly internal implementations and may +- * be changed at any time. These names were chosen +- * because PKCS11/SunPKCS11 does not yet have TLS1.2 +- * mechanisms, and it will cause calls to come here. +- */ +- ps("KeyGenerator", "SunTlsPrf", +- "com.sun.crypto.provider.TlsPrfGenerator$V10"); +- ps("KeyGenerator", "SunTls12Prf", +- "com.sun.crypto.provider.TlsPrfGenerator$V12"); +- +- ps("KeyGenerator", "SunTlsMasterSecret", +- "com.sun.crypto.provider.TlsMasterSecretGenerator", +- List.of("SunTls12MasterSecret", "SunTlsExtendedMasterSecret"), +- null); +- +- ps("KeyGenerator", "SunTlsKeyMaterial", +- "com.sun.crypto.provider.TlsKeyMaterialGenerator", +- List.of("SunTls12KeyMaterial"), null); +- +- ps("KeyGenerator", "SunTlsRsaPremasterSecret", +- "com.sun.crypto.provider.TlsRsaPremasterSecretGenerator", +- List.of("SunTls12RsaPremasterSecret"), null); ++ if (!systemFipsEnabled) { ++ // PBKDF2 ++ psA("SecretKeyFactory", "PBKDF2WithHmacSHA1", ++ "com.sun.crypto.provider.PBKDF2Core$HmacSHA1", ++ null); ++ ps("SecretKeyFactory", "PBKDF2WithHmacSHA224", ++ "com.sun.crypto.provider.PBKDF2Core$HmacSHA224"); ++ ps("SecretKeyFactory", "PBKDF2WithHmacSHA256", ++ "com.sun.crypto.provider.PBKDF2Core$HmacSHA256"); ++ ps("SecretKeyFactory", "PBKDF2WithHmacSHA384", ++ "com.sun.crypto.provider.PBKDF2Core$HmacSHA384"); ++ ps("SecretKeyFactory", "PBKDF2WithHmacSHA512", ++ "com.sun.crypto.provider.PBKDF2Core$HmacSHA512"); ++ ++ /* ++ * MAC ++ */ ++ attrs.clear(); ++ attrs.put("SupportedKeyFormats", "RAW"); ++ ps("Mac", "HmacMD5", "com.sun.crypto.provider.HmacMD5", null, attrs); ++ psA("Mac", "HmacSHA1", "com.sun.crypto.provider.HmacSHA1", ++ attrs); ++ psA("Mac", "HmacSHA224", ++ "com.sun.crypto.provider.HmacCore$HmacSHA224", attrs); ++ psA("Mac", "HmacSHA256", ++ "com.sun.crypto.provider.HmacCore$HmacSHA256", attrs); ++ psA("Mac", "HmacSHA384", ++ "com.sun.crypto.provider.HmacCore$HmacSHA384", attrs); ++ psA("Mac", "HmacSHA512", ++ "com.sun.crypto.provider.HmacCore$HmacSHA512", attrs); ++ psA("Mac", "HmacSHA512/224", ++ "com.sun.crypto.provider.HmacCore$HmacSHA512_224", attrs); ++ psA("Mac", "HmacSHA512/256", ++ "com.sun.crypto.provider.HmacCore$HmacSHA512_256", attrs); ++ psA("Mac", "HmacSHA3-224", ++ "com.sun.crypto.provider.HmacCore$HmacSHA3_224", attrs); ++ psA("Mac", "HmacSHA3-256", ++ "com.sun.crypto.provider.HmacCore$HmacSHA3_256", attrs); ++ psA("Mac", "HmacSHA3-384", ++ "com.sun.crypto.provider.HmacCore$HmacSHA3_384", attrs); ++ psA("Mac", "HmacSHA3-512", ++ "com.sun.crypto.provider.HmacCore$HmacSHA3_512", attrs); ++ ++ ps("Mac", "HmacPBESHA1", ++ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA1", ++ null, attrs); ++ ps("Mac", "HmacPBESHA224", ++ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA224", ++ null, attrs); ++ ps("Mac", "HmacPBESHA256", ++ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA256", ++ null, attrs); ++ ps("Mac", "HmacPBESHA384", ++ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA384", ++ null, attrs); ++ ps("Mac", "HmacPBESHA512", ++ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512", ++ null, attrs); ++ ps("Mac", "HmacPBESHA512/224", ++ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512_224", ++ null, attrs); ++ ps("Mac", "HmacPBESHA512/256", ++ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512_256", ++ null, attrs); ++ ++ ++ // PBMAC1 ++ ps("Mac", "PBEWithHmacSHA1", ++ "com.sun.crypto.provider.PBMAC1Core$HmacSHA1", null, attrs); ++ ps("Mac", "PBEWithHmacSHA224", ++ "com.sun.crypto.provider.PBMAC1Core$HmacSHA224", null, attrs); ++ ps("Mac", "PBEWithHmacSHA256", ++ "com.sun.crypto.provider.PBMAC1Core$HmacSHA256", null, attrs); ++ ps("Mac", "PBEWithHmacSHA384", ++ "com.sun.crypto.provider.PBMAC1Core$HmacSHA384", null, attrs); ++ ps("Mac", "PBEWithHmacSHA512", ++ "com.sun.crypto.provider.PBMAC1Core$HmacSHA512", null, attrs); ++ ps("Mac", "SslMacMD5", ++ "com.sun.crypto.provider.SslMacCore$SslMacMD5", null, attrs); ++ ps("Mac", "SslMacSHA1", ++ "com.sun.crypto.provider.SslMacCore$SslMacSHA1", null, attrs); ++ ++ /* ++ * KeyStore ++ */ ++ ps("KeyStore", "JCEKS", ++ "com.sun.crypto.provider.JceKeyStore"); ++ ++ /* ++ * SSL/TLS mechanisms ++ * ++ * These are strictly internal implementations and may ++ * be changed at any time. These names were chosen ++ * because PKCS11/SunPKCS11 does not yet have TLS1.2 ++ * mechanisms, and it will cause calls to come here. ++ */ ++ ps("KeyGenerator", "SunTlsPrf", ++ "com.sun.crypto.provider.TlsPrfGenerator$V10"); ++ ps("KeyGenerator", "SunTls12Prf", ++ "com.sun.crypto.provider.TlsPrfGenerator$V12"); ++ ++ ps("KeyGenerator", "SunTlsMasterSecret", ++ "com.sun.crypto.provider.TlsMasterSecretGenerator", ++ List.of("SunTls12MasterSecret", "SunTlsExtendedMasterSecret"), ++ null); ++ ++ ps("KeyGenerator", "SunTlsKeyMaterial", ++ "com.sun.crypto.provider.TlsKeyMaterialGenerator", ++ List.of("SunTls12KeyMaterial"), null); ++ ++ ps("KeyGenerator", "SunTlsRsaPremasterSecret", ++ "com.sun.crypto.provider.TlsRsaPremasterSecretGenerator", ++ List.of("SunTls12RsaPremasterSecret"), null); ++ } + } + + // Return the instance of this class or create one if needed. +diff --git a/src/java.base/share/classes/java/security/Security.java b/src/java.base/share/classes/java/security/Security.java +index 257dc172ee2..35cea6c54e7 100644 +--- a/src/java.base/share/classes/java/security/Security.java ++++ b/src/java.base/share/classes/java/security/Security.java +@@ -34,6 +34,7 @@ import java.net.URL; + import jdk.internal.access.JavaSecurityPropertiesAccess; + import jdk.internal.event.EventHelper; + import jdk.internal.event.SecurityPropertyModificationEvent; ++import jdk.internal.access.JavaSecuritySystemConfiguratorAccess; + import jdk.internal.access.SharedSecrets; + import jdk.internal.util.StaticProperty; + import sun.security.util.Debug; +@@ -58,6 +59,11 @@ import sun.security.jca.*; + + public final class Security { + ++ private static final String SYS_PROP_SWITCH = ++ "java.security.disableSystemPropertiesFile"; ++ private static final String SEC_PROP_SWITCH = ++ "security.useSystemPropertiesFile"; ++ + /* Are we debugging? -- for developers */ + private static final Debug sdebug = + Debug.getInstance("properties"); +@@ -75,6 +81,19 @@ public final class Security { + } + + static { ++ // Initialise here as used by code with system properties disabled ++ SharedSecrets.setJavaSecuritySystemConfiguratorAccess( ++ new JavaSecuritySystemConfiguratorAccess() { ++ @Override ++ public boolean isSystemFipsEnabled() { ++ return SystemConfigurator.isSystemFipsEnabled(); ++ } ++ @Override ++ public boolean isPlainKeySupportEnabled() { ++ return SystemConfigurator.isPlainKeySupportEnabled(); ++ } ++ }); ++ + // doPrivileged here because there are multiple + // things in initialize that might require privs. + // (the FileInputStream call and the File.exists call, +@@ -96,6 +115,7 @@ public final class Security { + private static void initialize() { + props = new Properties(); + boolean overrideAll = false; ++ boolean systemSecPropsEnabled = false; + + // first load the system properties file + // to determine the value of security.overridePropertiesFile +@@ -116,6 +136,61 @@ public final class Security { + } + loadProps(null, extraPropFile, overrideAll); + } ++ ++ boolean sysUseProps = Boolean.valueOf(System.getProperty(SYS_PROP_SWITCH, "false")); ++ boolean secUseProps = Boolean.valueOf(props.getProperty(SEC_PROP_SWITCH)); ++ if (sdebug != null) { ++ sdebug.println(SYS_PROP_SWITCH + "=" + sysUseProps); ++ sdebug.println(SEC_PROP_SWITCH + "=" + secUseProps); ++ } ++ if (!sysUseProps && secUseProps) { ++ systemSecPropsEnabled = SystemConfigurator.configureSysProps(props); ++ if (!systemSecPropsEnabled) { ++ if (sdebug != null) { ++ sdebug.println("WARNING: System security properties could not be loaded."); ++ } ++ } ++ } else { ++ if (sdebug != null) { ++ sdebug.println("System security property support disabled by user."); ++ } ++ } ++ ++ if (systemSecPropsEnabled) { ++ boolean shouldEnable; ++ String sysProp = System.getProperty("com.redhat.fips"); ++ if (sysProp == null) { ++ shouldEnable = true; ++ if (sdebug != null) { ++ sdebug.println("com.redhat.fips unset, using default value of true"); ++ } ++ } else { ++ shouldEnable = Boolean.valueOf(sysProp); ++ if (sdebug != null) { ++ sdebug.println("com.redhat.fips set, using its value " + shouldEnable); ++ } ++ } ++ if (shouldEnable) { ++ boolean fipsEnabled = SystemConfigurator.configureFIPS(props); ++ if (sdebug != null) { ++ if (fipsEnabled) { ++ sdebug.println("FIPS mode support configured and enabled."); ++ } else { ++ sdebug.println("FIPS mode support disabled."); ++ } ++ } ++ } else { ++ if (sdebug != null ) { ++ sdebug.println("FIPS mode support disabled by user."); ++ } ++ } ++ } else { ++ if (sdebug != null) { ++ sdebug.println("WARNING: FIPS mode support can not be enabled without " + ++ "system security properties being enabled."); ++ } ++ } ++ + initialSecurityProperties = (Properties) props.clone(); + if (sdebug != null) { + for (String key : props.stringPropertyNames()) { +@@ -126,7 +201,7 @@ public final class Security { + + } + +- private static boolean loadProps(File masterFile, String extraPropFile, boolean overrideAll) { ++ static boolean loadProps(File masterFile, String extraPropFile, boolean overrideAll) { + InputStream is = null; + try { + if (masterFile != null && masterFile.exists()) { +diff --git a/src/java.base/share/classes/java/security/SystemConfigurator.java b/src/java.base/share/classes/java/security/SystemConfigurator.java +new file mode 100644 +index 00000000000..9d26a54f5d4 +--- /dev/null ++++ b/src/java.base/share/classes/java/security/SystemConfigurator.java +@@ -0,0 +1,232 @@ ++/* ++ * Copyright (c) 2019, 2021, Red Hat, Inc. ++ * ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. Oracle designates this ++ * particular file as subject to the "Classpath" exception as provided ++ * by Oracle in the LICENSE file that accompanied this code. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++package java.security; ++ ++import java.io.BufferedInputStream; ++import java.io.FileInputStream; ++import java.io.IOException; ++ ++import java.util.Iterator; ++import java.util.Map.Entry; ++import java.util.Properties; ++ ++import sun.security.util.Debug; ++ ++/** ++ * Internal class to align OpenJDK with global crypto-policies. ++ * Called from java.security.Security class initialization, ++ * during startup. ++ * ++ */ ++ ++final class SystemConfigurator { ++ ++ private static final Debug sdebug = ++ Debug.getInstance("properties"); ++ ++ private static final String CRYPTO_POLICIES_BASE_DIR = ++ "/etc/crypto-policies"; ++ ++ private static final String CRYPTO_POLICIES_JAVA_CONFIG = ++ CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config"; ++ ++ private static boolean systemFipsEnabled = false; ++ private static boolean plainKeySupportEnabled = false; ++ ++ private static final String SYSTEMCONF_NATIVE_LIB = "systemconf"; ++ ++ private static native boolean getSystemFIPSEnabled() ++ throws IOException; ++ ++ static { ++ @SuppressWarnings("removal") ++ var dummy = AccessController.doPrivileged(new PrivilegedAction() { ++ public Void run() { ++ System.loadLibrary(SYSTEMCONF_NATIVE_LIB); ++ return null; ++ } ++ }); ++ } ++ ++ /* ++ * Invoked when java.security.Security class is initialized, if ++ * java.security.disableSystemPropertiesFile property is not set and ++ * security.useSystemPropertiesFile is true. ++ */ ++ static boolean configureSysProps(Properties props) { ++ // now load the system file, if it exists, so its values ++ // will win if they conflict with the earlier values ++ return Security.loadProps(null, CRYPTO_POLICIES_JAVA_CONFIG, false); ++ } ++ ++ /* ++ * Invoked at the end of java.security.Security initialisation ++ * if java.security properties have been loaded ++ */ ++ static boolean configureFIPS(Properties props) { ++ boolean loadedProps = false; ++ ++ try { ++ if (enableFips()) { ++ if (sdebug != null) { sdebug.println("FIPS mode detected"); } ++ // Remove all security providers ++ Iterator> i = props.entrySet().iterator(); ++ while (i.hasNext()) { ++ Entry e = i.next(); ++ if (((String) e.getKey()).startsWith("security.provider")) { ++ if (sdebug != null) { sdebug.println("Removing provider: " + e); } ++ i.remove(); ++ } ++ } ++ // Add FIPS security providers ++ String fipsProviderValue = null; ++ for (int n = 1; ++ (fipsProviderValue = (String) props.get("fips.provider." + n)) != null; n++) { ++ String fipsProviderKey = "security.provider." + n; ++ if (sdebug != null) { ++ sdebug.println("Adding provider " + n + ": " + ++ fipsProviderKey + "=" + fipsProviderValue); ++ } ++ props.put(fipsProviderKey, fipsProviderValue); ++ } ++ // Add other security properties ++ String keystoreTypeValue = (String) props.get("fips.keystore.type"); ++ if (keystoreTypeValue != null) { ++ String nonFipsKeystoreType = props.getProperty("keystore.type"); ++ props.put("keystore.type", keystoreTypeValue); ++ if (keystoreTypeValue.equals("PKCS11")) { ++ // If keystore.type is PKCS11, javax.net.ssl.keyStore ++ // must be "NONE". See JDK-8238264. ++ System.setProperty("javax.net.ssl.keyStore", "NONE"); ++ } ++ if (System.getProperty("javax.net.ssl.trustStoreType") == null) { ++ // If no trustStoreType has been set, use the ++ // previous keystore.type under FIPS mode. In ++ // a default configuration, the Trust Store will ++ // be 'cacerts' (JKS type). ++ System.setProperty("javax.net.ssl.trustStoreType", ++ nonFipsKeystoreType); ++ } ++ if (sdebug != null) { ++ sdebug.println("FIPS mode default keystore.type = " + ++ keystoreTypeValue); ++ sdebug.println("FIPS mode javax.net.ssl.keyStore = " + ++ System.getProperty("javax.net.ssl.keyStore", "")); ++ sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " + ++ System.getProperty("javax.net.ssl.trustStoreType", "")); ++ } ++ } ++ loadedProps = true; ++ systemFipsEnabled = true; ++ String plainKeySupport = System.getProperty("com.redhat.fips.plainKeySupport", ++ "true"); ++ plainKeySupportEnabled = !"false".equals(plainKeySupport); ++ if (sdebug != null) { ++ if (plainKeySupportEnabled) { ++ sdebug.println("FIPS support enabled with plain key support"); ++ } else { ++ sdebug.println("FIPS support enabled without plain key support"); ++ } ++ } ++ } else { ++ if (sdebug != null) { sdebug.println("FIPS mode not detected"); } ++ } ++ } catch (Exception e) { ++ if (sdebug != null) { ++ sdebug.println("unable to load FIPS configuration"); ++ e.printStackTrace(); ++ } ++ } ++ return loadedProps; ++ } ++ ++ /** ++ * Returns whether or not global system FIPS alignment is enabled. ++ * ++ * Value is always 'false' before java.security.Security class is ++ * initialized. ++ * ++ * Call from out of this package through SharedSecrets: ++ * SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ * .isSystemFipsEnabled(); ++ * ++ * @return a boolean value indicating whether or not global ++ * system FIPS alignment is enabled. ++ */ ++ static boolean isSystemFipsEnabled() { ++ return systemFipsEnabled; ++ } ++ ++ /** ++ * Returns {@code true} if system FIPS alignment is enabled ++ * and plain key support is allowed. Plain key support is ++ * enabled by default but can be disabled with ++ * {@code -Dcom.redhat.fips.plainKeySupport=false}. ++ * ++ * @return a boolean indicating whether plain key support ++ * should be enabled. ++ */ ++ static boolean isPlainKeySupportEnabled() { ++ return plainKeySupportEnabled; ++ } ++ ++ /** ++ * Determines whether FIPS mode should be enabled. ++ * ++ * OpenJDK FIPS mode will be enabled only if the system is in ++ * FIPS mode. ++ * ++ * Calls to this method only occur if the system property ++ * com.redhat.fips is not set to false. ++ * ++ * There are 2 possible ways in which OpenJDK detects that the system ++ * is in FIPS mode: 1) if the NSS SECMOD_GetSystemFIPSEnabled API is ++ * available at OpenJDK's built-time, it is called; 2) otherwise, the ++ * /proc/sys/crypto/fips_enabled file is read. ++ * ++ * @return true if the system is in FIPS mode ++ */ ++ private static boolean enableFips() throws Exception { ++ if (sdebug != null) { ++ sdebug.println("Calling getSystemFIPSEnabled (libsystemconf)..."); ++ } ++ try { ++ boolean fipsEnabled = getSystemFIPSEnabled(); ++ if (sdebug != null) { ++ sdebug.println("Call to getSystemFIPSEnabled (libsystemconf) returned: " ++ + fipsEnabled); ++ } ++ return fipsEnabled; ++ } catch (IOException e) { ++ if (sdebug != null) { ++ sdebug.println("Call to getSystemFIPSEnabled (libsystemconf) failed:"); ++ sdebug.println(e.getMessage()); ++ } ++ throw e; ++ } ++ } ++} +diff --git a/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java b/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java +new file mode 100644 +index 00000000000..3f3caac64dc +--- /dev/null ++++ b/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java +@@ -0,0 +1,31 @@ ++/* ++ * Copyright (c) 2020, Red Hat, Inc. ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. Oracle designates this ++ * particular file as subject to the "Classpath" exception as provided ++ * by Oracle in the LICENSE file that accompanied this code. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++package jdk.internal.access; ++ ++public interface JavaSecuritySystemConfiguratorAccess { ++ boolean isSystemFipsEnabled(); ++ boolean isPlainKeySupportEnabled(); ++} +diff --git a/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java b/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java +index cf76aa9ff94..9ecb14db126 100644 +--- a/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java ++++ b/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java +@@ -43,6 +43,7 @@ import java.io.PrintStream; + import java.io.PrintWriter; + import java.io.RandomAccessFile; + import java.security.ProtectionDomain; ++import java.security.Security; + import java.security.Signature; + + /** A repository of "shared secrets", which are a mechanism for +@@ -89,6 +90,7 @@ public class SharedSecrets { + private static JavaSecuritySpecAccess javaSecuritySpecAccess; + private static JavaxCryptoSealedObjectAccess javaxCryptoSealedObjectAccess; + private static JavaxCryptoSpecAccess javaxCryptoSpecAccess; ++ private static JavaSecuritySystemConfiguratorAccess javaSecuritySystemConfiguratorAccess; + + public static void setJavaUtilCollectionAccess(JavaUtilCollectionAccess juca) { + javaUtilCollectionAccess = juca; +@@ -521,4 +523,15 @@ public class SharedSecrets { + MethodHandles.lookup().ensureInitialized(c); + } catch (IllegalAccessException e) {} + } ++ ++ public static void setJavaSecuritySystemConfiguratorAccess(JavaSecuritySystemConfiguratorAccess jssca) { ++ javaSecuritySystemConfiguratorAccess = jssca; ++ } ++ ++ public static JavaSecuritySystemConfiguratorAccess getJavaSecuritySystemConfiguratorAccess() { ++ if (javaSecuritySystemConfiguratorAccess == null) { ++ ensureClassInitialized(Security.class); ++ } ++ return javaSecuritySystemConfiguratorAccess; ++ } + } +diff --git a/src/java.base/share/classes/module-info.java b/src/java.base/share/classes/module-info.java +index d985dec174f..a5b9cbf7fbc 100644 +--- a/src/java.base/share/classes/module-info.java ++++ b/src/java.base/share/classes/module-info.java +@@ -163,6 +163,7 @@ module java.base { + java.naming, + java.rmi, + jdk.charsets, ++ jdk.crypto.ec, + jdk.jartool, + jdk.jlink, + jdk.jfr, +diff --git a/src/java.base/share/classes/sun/security/provider/SunEntries.java b/src/java.base/share/classes/sun/security/provider/SunEntries.java +index 0d4ae1019e1..e839866a28c 100644 +--- a/src/java.base/share/classes/sun/security/provider/SunEntries.java ++++ b/src/java.base/share/classes/sun/security/provider/SunEntries.java +@@ -38,6 +38,7 @@ import java.util.HashMap; + import java.util.Iterator; + import java.util.LinkedHashSet; + ++import jdk.internal.access.SharedSecrets; + import jdk.internal.util.StaticProperty; + import sun.security.action.GetBooleanAction; + +@@ -91,6 +92,10 @@ import static sun.security.util.SecurityProviderConstants.getAliases; + + public final class SunEntries { + ++ private static final boolean systemFipsEnabled = ++ SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ .isSystemFipsEnabled(); ++ + // the default algo used by SecureRandom class for new SecureRandom() calls + public static final String DEF_SECURE_RANDOM_ALGO; + +@@ -102,99 +107,101 @@ public final class SunEntries { + // common attribute map + HashMap attrs = new HashMap<>(3); + +- /* +- * SecureRandom engines +- */ +- attrs.put("ThreadSafe", "true"); +- if (NativePRNG.isAvailable()) { +- add(p, "SecureRandom", "NativePRNG", +- "sun.security.provider.NativePRNG", attrs); +- } +- if (NativePRNG.Blocking.isAvailable()) { +- add(p, "SecureRandom", "NativePRNGBlocking", +- "sun.security.provider.NativePRNG$Blocking", attrs); +- } +- if (NativePRNG.NonBlocking.isAvailable()) { +- add(p, "SecureRandom", "NativePRNGNonBlocking", +- "sun.security.provider.NativePRNG$NonBlocking", attrs); +- } +- attrs.put("ImplementedIn", "Software"); +- add(p, "SecureRandom", "DRBG", "sun.security.provider.DRBG", attrs); +- add(p, "SecureRandom", "SHA1PRNG", +- "sun.security.provider.SecureRandom", attrs); +- +- /* +- * Signature engines +- */ +- attrs.clear(); +- String dsaKeyClasses = "java.security.interfaces.DSAPublicKey" + +- "|java.security.interfaces.DSAPrivateKey"; +- attrs.put("SupportedKeyClasses", dsaKeyClasses); +- attrs.put("ImplementedIn", "Software"); +- +- attrs.put("KeySize", "1024"); // for NONE and SHA1 DSA signatures +- +- addWithAlias(p, "Signature", "SHA1withDSA", +- "sun.security.provider.DSA$SHA1withDSA", attrs); +- addWithAlias(p, "Signature", "NONEwithDSA", +- "sun.security.provider.DSA$RawDSA", attrs); +- +- // for DSA signatures with 224/256-bit digests +- attrs.put("KeySize", "2048"); +- +- addWithAlias(p, "Signature", "SHA224withDSA", +- "sun.security.provider.DSA$SHA224withDSA", attrs); +- addWithAlias(p, "Signature", "SHA256withDSA", +- "sun.security.provider.DSA$SHA256withDSA", attrs); +- +- addWithAlias(p, "Signature", "SHA3-224withDSA", +- "sun.security.provider.DSA$SHA3_224withDSA", attrs); +- addWithAlias(p, "Signature", "SHA3-256withDSA", +- "sun.security.provider.DSA$SHA3_256withDSA", attrs); +- +- attrs.put("KeySize", "3072"); // for DSA sig using 384/512-bit digests +- +- addWithAlias(p, "Signature", "SHA384withDSA", +- "sun.security.provider.DSA$SHA384withDSA", attrs); +- addWithAlias(p, "Signature", "SHA512withDSA", +- "sun.security.provider.DSA$SHA512withDSA", attrs); +- addWithAlias(p, "Signature", "SHA3-384withDSA", +- "sun.security.provider.DSA$SHA3_384withDSA", attrs); +- addWithAlias(p, "Signature", "SHA3-512withDSA", +- "sun.security.provider.DSA$SHA3_512withDSA", attrs); +- +- attrs.remove("KeySize"); ++ if (!systemFipsEnabled) { ++ /* ++ * SecureRandom engines ++ */ ++ attrs.put("ThreadSafe", "true"); ++ if (NativePRNG.isAvailable()) { ++ add(p, "SecureRandom", "NativePRNG", ++ "sun.security.provider.NativePRNG", attrs); ++ } ++ if (NativePRNG.Blocking.isAvailable()) { ++ add(p, "SecureRandom", "NativePRNGBlocking", ++ "sun.security.provider.NativePRNG$Blocking", attrs); ++ } ++ if (NativePRNG.NonBlocking.isAvailable()) { ++ add(p, "SecureRandom", "NativePRNGNonBlocking", ++ "sun.security.provider.NativePRNG$NonBlocking", attrs); ++ } ++ attrs.put("ImplementedIn", "Software"); ++ add(p, "SecureRandom", "DRBG", "sun.security.provider.DRBG", attrs); ++ add(p, "SecureRandom", "SHA1PRNG", ++ "sun.security.provider.SecureRandom", attrs); + +- add(p, "Signature", "SHA1withDSAinP1363Format", +- "sun.security.provider.DSA$SHA1withDSAinP1363Format"); +- add(p, "Signature", "NONEwithDSAinP1363Format", +- "sun.security.provider.DSA$RawDSAinP1363Format"); +- add(p, "Signature", "SHA224withDSAinP1363Format", +- "sun.security.provider.DSA$SHA224withDSAinP1363Format"); +- add(p, "Signature", "SHA256withDSAinP1363Format", +- "sun.security.provider.DSA$SHA256withDSAinP1363Format"); +- add(p, "Signature", "SHA384withDSAinP1363Format", +- "sun.security.provider.DSA$SHA384withDSAinP1363Format"); +- add(p, "Signature", "SHA512withDSAinP1363Format", +- "sun.security.provider.DSA$SHA512withDSAinP1363Format"); +- add(p, "Signature", "SHA3-224withDSAinP1363Format", +- "sun.security.provider.DSA$SHA3_224withDSAinP1363Format"); +- add(p, "Signature", "SHA3-256withDSAinP1363Format", +- "sun.security.provider.DSA$SHA3_256withDSAinP1363Format"); +- add(p, "Signature", "SHA3-384withDSAinP1363Format", +- "sun.security.provider.DSA$SHA3_384withDSAinP1363Format"); +- add(p, "Signature", "SHA3-512withDSAinP1363Format", +- "sun.security.provider.DSA$SHA3_512withDSAinP1363Format"); +- /* +- * Key Pair Generator engines +- */ +- attrs.clear(); +- attrs.put("ImplementedIn", "Software"); +- attrs.put("KeySize", "2048"); // for DSA KPG and APG only ++ /* ++ * Signature engines ++ */ ++ attrs.clear(); ++ String dsaKeyClasses = "java.security.interfaces.DSAPublicKey" + ++ "|java.security.interfaces.DSAPrivateKey"; ++ attrs.put("SupportedKeyClasses", dsaKeyClasses); ++ attrs.put("ImplementedIn", "Software"); ++ ++ attrs.put("KeySize", "1024"); // for NONE and SHA1 DSA signatures ++ ++ addWithAlias(p, "Signature", "SHA1withDSA", ++ "sun.security.provider.DSA$SHA1withDSA", attrs); ++ addWithAlias(p, "Signature", "NONEwithDSA", ++ "sun.security.provider.DSA$RawDSA", attrs); ++ ++ // for DSA signatures with 224/256-bit digests ++ attrs.put("KeySize", "2048"); ++ ++ addWithAlias(p, "Signature", "SHA224withDSA", ++ "sun.security.provider.DSA$SHA224withDSA", attrs); ++ addWithAlias(p, "Signature", "SHA256withDSA", ++ "sun.security.provider.DSA$SHA256withDSA", attrs); ++ ++ addWithAlias(p, "Signature", "SHA3-224withDSA", ++ "sun.security.provider.DSA$SHA3_224withDSA", attrs); ++ addWithAlias(p, "Signature", "SHA3-256withDSA", ++ "sun.security.provider.DSA$SHA3_256withDSA", attrs); ++ ++ attrs.put("KeySize", "3072"); // for DSA sig using 384/512-bit digests ++ ++ addWithAlias(p, "Signature", "SHA384withDSA", ++ "sun.security.provider.DSA$SHA384withDSA", attrs); ++ addWithAlias(p, "Signature", "SHA512withDSA", ++ "sun.security.provider.DSA$SHA512withDSA", attrs); ++ addWithAlias(p, "Signature", "SHA3-384withDSA", ++ "sun.security.provider.DSA$SHA3_384withDSA", attrs); ++ addWithAlias(p, "Signature", "SHA3-512withDSA", ++ "sun.security.provider.DSA$SHA3_512withDSA", attrs); ++ ++ attrs.remove("KeySize"); ++ ++ add(p, "Signature", "SHA1withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA1withDSAinP1363Format"); ++ add(p, "Signature", "NONEwithDSAinP1363Format", ++ "sun.security.provider.DSA$RawDSAinP1363Format"); ++ add(p, "Signature", "SHA224withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA224withDSAinP1363Format"); ++ add(p, "Signature", "SHA256withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA256withDSAinP1363Format"); ++ add(p, "Signature", "SHA384withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA384withDSAinP1363Format"); ++ add(p, "Signature", "SHA512withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA512withDSAinP1363Format"); ++ add(p, "Signature", "SHA3-224withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA3_224withDSAinP1363Format"); ++ add(p, "Signature", "SHA3-256withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA3_256withDSAinP1363Format"); ++ add(p, "Signature", "SHA3-384withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA3_384withDSAinP1363Format"); ++ add(p, "Signature", "SHA3-512withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA3_512withDSAinP1363Format"); ++ /* ++ * Key Pair Generator engines ++ */ ++ attrs.clear(); ++ attrs.put("ImplementedIn", "Software"); ++ attrs.put("KeySize", "2048"); // for DSA KPG and APG only + +- String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$"; +- dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current"); +- addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs); ++ String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$"; ++ dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current"); ++ addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs); ++ } + + /* + * Algorithm Parameter Generator engines +@@ -209,42 +216,44 @@ public final class SunEntries { + addWithAlias(p, "AlgorithmParameters", "DSA", + "sun.security.provider.DSAParameters", attrs); + +- /* +- * Key factories +- */ +- addWithAlias(p, "KeyFactory", "DSA", +- "sun.security.provider.DSAKeyFactory", attrs); +- +- /* +- * Digest engines +- */ +- addWithAlias(p, "MessageDigest", "MD2", "sun.security.provider.MD2", +- attrs); +- addWithAlias(p, "MessageDigest", "MD5", "sun.security.provider.MD5", +- attrs); +- addWithAlias(p, "MessageDigest", "SHA-1", "sun.security.provider.SHA", +- attrs); ++ if (!systemFipsEnabled) { ++ /* ++ * Key factories ++ */ ++ addWithAlias(p, "KeyFactory", "DSA", ++ "sun.security.provider.DSAKeyFactory", attrs); + +- addWithAlias(p, "MessageDigest", "SHA-224", +- "sun.security.provider.SHA2$SHA224", attrs); +- addWithAlias(p, "MessageDigest", "SHA-256", +- "sun.security.provider.SHA2$SHA256", attrs); +- addWithAlias(p, "MessageDigest", "SHA-384", +- "sun.security.provider.SHA5$SHA384", attrs); +- addWithAlias(p, "MessageDigest", "SHA-512", +- "sun.security.provider.SHA5$SHA512", attrs); +- addWithAlias(p, "MessageDigest", "SHA-512/224", +- "sun.security.provider.SHA5$SHA512_224", attrs); +- addWithAlias(p, "MessageDigest", "SHA-512/256", +- "sun.security.provider.SHA5$SHA512_256", attrs); +- addWithAlias(p, "MessageDigest", "SHA3-224", +- "sun.security.provider.SHA3$SHA224", attrs); +- addWithAlias(p, "MessageDigest", "SHA3-256", +- "sun.security.provider.SHA3$SHA256", attrs); +- addWithAlias(p, "MessageDigest", "SHA3-384", +- "sun.security.provider.SHA3$SHA384", attrs); +- addWithAlias(p, "MessageDigest", "SHA3-512", +- "sun.security.provider.SHA3$SHA512", attrs); ++ /* ++ * Digest engines ++ */ ++ addWithAlias(p, "MessageDigest", "MD2", "sun.security.provider.MD2", ++ attrs); ++ addWithAlias(p, "MessageDigest", "MD5", "sun.security.provider.MD5", ++ attrs); ++ addWithAlias(p, "MessageDigest", "SHA-1", "sun.security.provider.SHA", ++ attrs); ++ ++ addWithAlias(p, "MessageDigest", "SHA-224", ++ "sun.security.provider.SHA2$SHA224", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-256", ++ "sun.security.provider.SHA2$SHA256", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-384", ++ "sun.security.provider.SHA5$SHA384", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-512", ++ "sun.security.provider.SHA5$SHA512", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-512/224", ++ "sun.security.provider.SHA5$SHA512_224", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-512/256", ++ "sun.security.provider.SHA5$SHA512_256", attrs); ++ addWithAlias(p, "MessageDigest", "SHA3-224", ++ "sun.security.provider.SHA3$SHA224", attrs); ++ addWithAlias(p, "MessageDigest", "SHA3-256", ++ "sun.security.provider.SHA3$SHA256", attrs); ++ addWithAlias(p, "MessageDigest", "SHA3-384", ++ "sun.security.provider.SHA3$SHA384", attrs); ++ addWithAlias(p, "MessageDigest", "SHA3-512", ++ "sun.security.provider.SHA3$SHA512", attrs); ++ } + + /* + * Certificates +diff --git a/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java b/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java +index 539ef1e8ee8..7662684797e 100644 +--- a/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java ++++ b/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java +@@ -27,6 +27,7 @@ package sun.security.rsa; + + import java.util.*; + import java.security.Provider; ++import jdk.internal.access.SharedSecrets; + import static sun.security.util.SecurityProviderConstants.getAliases; + + /** +@@ -36,6 +37,10 @@ import static sun.security.util.SecurityProviderConstants.getAliases; + */ + public final class SunRsaSignEntries { + ++ private static final boolean systemFipsEnabled = ++ SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ .isSystemFipsEnabled(); ++ + private void add(Provider p, String type, String algo, String cn, + List aliases, HashMap attrs) { + services.add(new Provider.Service(p, type, algo, cn, +@@ -56,49 +61,58 @@ public final class SunRsaSignEntries { + // start populating content using the specified provider + // common attribute map + HashMap attrs = new HashMap<>(3); +- attrs.put("SupportedKeyClasses", +- "java.security.interfaces.RSAPublicKey" + +- "|java.security.interfaces.RSAPrivateKey"); ++ if (!systemFipsEnabled) { ++ attrs.put("SupportedKeyClasses", ++ "java.security.interfaces.RSAPublicKey" + ++ "|java.security.interfaces.RSAPrivateKey"); ++ } + + add(p, "KeyFactory", "RSA", + "sun.security.rsa.RSAKeyFactory$Legacy", + getAliases("PKCS1"), null); +- add(p, "KeyPairGenerator", "RSA", +- "sun.security.rsa.RSAKeyPairGenerator$Legacy", +- getAliases("PKCS1"), null); +- addA(p, "Signature", "MD2withRSA", +- "sun.security.rsa.RSASignature$MD2withRSA", attrs); +- addA(p, "Signature", "MD5withRSA", +- "sun.security.rsa.RSASignature$MD5withRSA", attrs); +- addA(p, "Signature", "SHA1withRSA", +- "sun.security.rsa.RSASignature$SHA1withRSA", attrs); +- addA(p, "Signature", "SHA224withRSA", +- "sun.security.rsa.RSASignature$SHA224withRSA", attrs); +- addA(p, "Signature", "SHA256withRSA", +- "sun.security.rsa.RSASignature$SHA256withRSA", attrs); +- addA(p, "Signature", "SHA384withRSA", +- "sun.security.rsa.RSASignature$SHA384withRSA", attrs); +- addA(p, "Signature", "SHA512withRSA", +- "sun.security.rsa.RSASignature$SHA512withRSA", attrs); +- addA(p, "Signature", "SHA512/224withRSA", +- "sun.security.rsa.RSASignature$SHA512_224withRSA", attrs); +- addA(p, "Signature", "SHA512/256withRSA", +- "sun.security.rsa.RSASignature$SHA512_256withRSA", attrs); +- addA(p, "Signature", "SHA3-224withRSA", +- "sun.security.rsa.RSASignature$SHA3_224withRSA", attrs); +- addA(p, "Signature", "SHA3-256withRSA", +- "sun.security.rsa.RSASignature$SHA3_256withRSA", attrs); +- addA(p, "Signature", "SHA3-384withRSA", +- "sun.security.rsa.RSASignature$SHA3_384withRSA", attrs); +- addA(p, "Signature", "SHA3-512withRSA", +- "sun.security.rsa.RSASignature$SHA3_512withRSA", attrs); ++ ++ if (!systemFipsEnabled) { ++ add(p, "KeyPairGenerator", "RSA", ++ "sun.security.rsa.RSAKeyPairGenerator$Legacy", ++ getAliases("PKCS1"), null); ++ addA(p, "Signature", "MD2withRSA", ++ "sun.security.rsa.RSASignature$MD2withRSA", attrs); ++ addA(p, "Signature", "MD5withRSA", ++ "sun.security.rsa.RSASignature$MD5withRSA", attrs); ++ addA(p, "Signature", "SHA1withRSA", ++ "sun.security.rsa.RSASignature$SHA1withRSA", attrs); ++ addA(p, "Signature", "SHA224withRSA", ++ "sun.security.rsa.RSASignature$SHA224withRSA", attrs); ++ addA(p, "Signature", "SHA256withRSA", ++ "sun.security.rsa.RSASignature$SHA256withRSA", attrs); ++ addA(p, "Signature", "SHA384withRSA", ++ "sun.security.rsa.RSASignature$SHA384withRSA", attrs); ++ addA(p, "Signature", "SHA512withRSA", ++ "sun.security.rsa.RSASignature$SHA512withRSA", attrs); ++ addA(p, "Signature", "SHA512/224withRSA", ++ "sun.security.rsa.RSASignature$SHA512_224withRSA", attrs); ++ addA(p, "Signature", "SHA512/256withRSA", ++ "sun.security.rsa.RSASignature$SHA512_256withRSA", attrs); ++ addA(p, "Signature", "SHA3-224withRSA", ++ "sun.security.rsa.RSASignature$SHA3_224withRSA", attrs); ++ addA(p, "Signature", "SHA3-256withRSA", ++ "sun.security.rsa.RSASignature$SHA3_256withRSA", attrs); ++ addA(p, "Signature", "SHA3-384withRSA", ++ "sun.security.rsa.RSASignature$SHA3_384withRSA", attrs); ++ addA(p, "Signature", "SHA3-512withRSA", ++ "sun.security.rsa.RSASignature$SHA3_512withRSA", attrs); ++ } + + addA(p, "KeyFactory", "RSASSA-PSS", + "sun.security.rsa.RSAKeyFactory$PSS", attrs); +- addA(p, "KeyPairGenerator", "RSASSA-PSS", +- "sun.security.rsa.RSAKeyPairGenerator$PSS", attrs); +- addA(p, "Signature", "RSASSA-PSS", +- "sun.security.rsa.RSAPSSSignature", attrs); ++ ++ if (!systemFipsEnabled) { ++ addA(p, "KeyPairGenerator", "RSASSA-PSS", ++ "sun.security.rsa.RSAKeyPairGenerator$PSS", attrs); ++ addA(p, "Signature", "RSASSA-PSS", ++ "sun.security.rsa.RSAPSSSignature", attrs); ++ } ++ + addA(p, "AlgorithmParameters", "RSASSA-PSS", + "sun.security.rsa.PSSParameters", null); + } +diff --git a/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java b/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java +index a9f97c76cb9..3571778367f 100644 +--- a/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java ++++ b/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java +@@ -32,6 +32,7 @@ import java.security.cert.*; + import java.util.*; + import java.util.concurrent.locks.ReentrantLock; + import javax.net.ssl.*; ++import jdk.internal.access.SharedSecrets; + import sun.security.action.GetPropertyAction; + import sun.security.provider.certpath.AlgorithmChecker; + import sun.security.validator.Validator; +@@ -530,22 +531,40 @@ public abstract class SSLContextImpl extends SSLContextSpi { + private static final List serverDefaultCipherSuites; + + static { +- supportedProtocols = Arrays.asList( +- ProtocolVersion.TLS13, +- ProtocolVersion.TLS12, +- ProtocolVersion.TLS11, +- ProtocolVersion.TLS10, +- ProtocolVersion.SSL30, +- ProtocolVersion.SSL20Hello +- ); +- +- serverDefaultProtocols = getAvailableProtocols( +- new ProtocolVersion[] { +- ProtocolVersion.TLS13, +- ProtocolVersion.TLS12, +- ProtocolVersion.TLS11, +- ProtocolVersion.TLS10 +- }); ++ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ .isSystemFipsEnabled()) { ++ // RH1860986: TLSv1.3 key derivation not supported with ++ // the Security Providers available in system FIPS mode. ++ supportedProtocols = Arrays.asList( ++ ProtocolVersion.TLS12, ++ ProtocolVersion.TLS11, ++ ProtocolVersion.TLS10 ++ ); ++ ++ serverDefaultProtocols = getAvailableProtocols( ++ new ProtocolVersion[] { ++ ProtocolVersion.TLS12, ++ ProtocolVersion.TLS11, ++ ProtocolVersion.TLS10 ++ }); ++ } else { ++ supportedProtocols = Arrays.asList( ++ ProtocolVersion.TLS13, ++ ProtocolVersion.TLS12, ++ ProtocolVersion.TLS11, ++ ProtocolVersion.TLS10, ++ ProtocolVersion.SSL30, ++ ProtocolVersion.SSL20Hello ++ ); ++ ++ serverDefaultProtocols = getAvailableProtocols( ++ new ProtocolVersion[] { ++ ProtocolVersion.TLS13, ++ ProtocolVersion.TLS12, ++ ProtocolVersion.TLS11, ++ ProtocolVersion.TLS10 ++ }); ++ } + + supportedCipherSuites = getApplicableSupportedCipherSuites( + supportedProtocols); +@@ -836,12 +855,23 @@ public abstract class SSLContextImpl extends SSLContextSpi { + ProtocolVersion[] candidates; + if (refactored.isEmpty()) { + // Client and server use the same default protocols. +- candidates = new ProtocolVersion[] { +- ProtocolVersion.TLS13, +- ProtocolVersion.TLS12, +- ProtocolVersion.TLS11, +- ProtocolVersion.TLS10 +- }; ++ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ .isSystemFipsEnabled()) { ++ // RH1860986: TLSv1.3 key derivation not supported with ++ // the Security Providers available in system FIPS mode. ++ candidates = new ProtocolVersion[] { ++ ProtocolVersion.TLS12, ++ ProtocolVersion.TLS11, ++ ProtocolVersion.TLS10 ++ }; ++ } else { ++ candidates = new ProtocolVersion[] { ++ ProtocolVersion.TLS13, ++ ProtocolVersion.TLS12, ++ ProtocolVersion.TLS11, ++ ProtocolVersion.TLS10 ++ }; ++ } + } else { + // Use the customized TLS protocols. + candidates = +diff --git a/src/java.base/share/classes/sun/security/ssl/SunJSSE.java b/src/java.base/share/classes/sun/security/ssl/SunJSSE.java +index 894e26dfad8..8b16378b96b 100644 +--- a/src/java.base/share/classes/sun/security/ssl/SunJSSE.java ++++ b/src/java.base/share/classes/sun/security/ssl/SunJSSE.java +@@ -27,6 +27,8 @@ package sun.security.ssl; + + import java.security.*; + import java.util.*; ++ ++import jdk.internal.access.SharedSecrets; + import static sun.security.util.SecurityConstants.PROVIDER_VER; + + /** +@@ -102,8 +104,13 @@ public class SunJSSE extends java.security.Provider { + "sun.security.ssl.SSLContextImpl$TLS11Context", null, null); + ps("SSLContext", "TLSv1.2", + "sun.security.ssl.SSLContextImpl$TLS12Context", null, null); +- ps("SSLContext", "TLSv1.3", +- "sun.security.ssl.SSLContextImpl$TLS13Context", null, null); ++ if (!SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ .isSystemFipsEnabled()) { ++ // RH1860986: TLSv1.3 key derivation not supported with ++ // the Security Providers available in system FIPS mode. ++ ps("SSLContext", "TLSv1.3", ++ "sun.security.ssl.SSLContextImpl$TLS13Context", null, null); ++ } + ps("SSLContext", "TLS", + "sun.security.ssl.SSLContextImpl$TLSContext", + List.of("SSL"), null); +diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security +index 8156eea7e11..6a7f6eeafcc 100644 +--- a/src/java.base/share/conf/security/java.security ++++ b/src/java.base/share/conf/security/java.security +@@ -85,6 +85,16 @@ security.provider.tbd=Apple + #endif + security.provider.tbd=SunPKCS11 + ++# ++# Security providers used when FIPS mode support is active ++# ++fips.provider.1=SunPKCS11 ${java.home}/conf/security/nss.fips.cfg ++fips.provider.2=SUN ++fips.provider.3=SunEC ++fips.provider.4=SunJSSE ++fips.provider.5=SunJCE ++fips.provider.6=SunRsaSign ++ + # + # A list of preferred providers for specific algorithms. These providers will + # be searched for matching algorithms before the list of registered providers. +@@ -295,6 +305,11 @@ policy.ignoreIdentityScope=false + # + keystore.type=pkcs12 + ++# ++# Default keystore type used when global crypto-policies are set to FIPS. ++# ++fips.keystore.type=PKCS11 ++ + # + # Controls compatibility mode for JKS and PKCS12 keystore types. + # +@@ -332,6 +347,13 @@ package.definition=sun.misc.,\ + # + security.overridePropertiesFile=true + ++# ++# Determines whether this properties file will be appended to ++# using the system properties file stored at ++# /etc/crypto-policies/back-ends/java.config ++# ++security.useSystemPropertiesFile=false ++ + # + # Determines the default key and trust manager factory algorithms for + # the javax.net.ssl package. +diff --git a/src/java.base/share/lib/security/default.policy b/src/java.base/share/lib/security/default.policy +index 2a01c06250a..aea4620b1ab 100644 +--- a/src/java.base/share/lib/security/default.policy ++++ b/src/java.base/share/lib/security/default.policy +@@ -124,6 +124,7 @@ grant codeBase "jrt:/jdk.charsets" { + grant codeBase "jrt:/jdk.crypto.ec" { + permission java.lang.RuntimePermission + "accessClassInPackage.sun.security.*"; ++ permission java.lang.RuntimePermission "accessClassInPackage.jdk.internal.access"; + permission java.lang.RuntimePermission "loadLibrary.sunec"; + permission java.security.SecurityPermission "putProviderProperty.SunEC"; + permission java.security.SecurityPermission "clearProviderProperties.SunEC"; +diff --git a/src/java.base/share/native/libsystemconf/systemconf.c b/src/java.base/share/native/libsystemconf/systemconf.c +new file mode 100644 +index 00000000000..ddf9befe5bc +--- /dev/null ++++ b/src/java.base/share/native/libsystemconf/systemconf.c +@@ -0,0 +1,236 @@ ++/* ++ * Copyright (c) 2021, Red Hat, Inc. ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. Oracle designates this ++ * particular file as subject to the "Classpath" exception as provided ++ * by Oracle in the LICENSE file that accompanied this code. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++#include ++#include ++#include "jvm_md.h" ++#include ++ ++#ifdef LINUX ++ ++#ifdef SYSCONF_NSS ++#include ++#else ++#include ++#endif //SYSCONF_NSS ++ ++#include "java_security_SystemConfigurator.h" ++ ++#define MSG_MAX_SIZE 256 ++#define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled" ++ ++typedef int (SECMOD_GET_SYSTEM_FIPS_ENABLED_TYPE)(void); ++ ++static SECMOD_GET_SYSTEM_FIPS_ENABLED_TYPE *getSystemFIPSEnabled; ++static jmethodID debugPrintlnMethodID = NULL; ++static jobject debugObj = NULL; ++ ++static void dbgPrint(JNIEnv *env, const char* msg) ++{ ++ jstring jMsg; ++ if (debugObj != NULL) { ++ jMsg = (*env)->NewStringUTF(env, msg); ++ CHECK_NULL(jMsg); ++ (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg); ++ } ++} ++ ++static void throwIOException(JNIEnv *env, const char *msg) ++{ ++ jclass cls = (*env)->FindClass(env, "java/io/IOException"); ++ if (cls != 0) ++ (*env)->ThrowNew(env, cls, msg); ++} ++ ++static void handle_msg(JNIEnv *env, const char* msg, int msg_bytes) ++{ ++ if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) { ++ dbgPrint(env, msg); ++ } else { ++ dbgPrint(env, "systemconf: cannot render message"); ++ } ++} ++ ++// Only used when NSS is not linked at build time ++#ifndef SYSCONF_NSS ++ ++static void *nss_handle; ++ ++static jboolean loadNSS(JNIEnv *env) ++{ ++ char msg[MSG_MAX_SIZE]; ++ int msg_bytes; ++ const char* errmsg; ++ ++ nss_handle = dlopen(JNI_LIB_NAME("nss3"), RTLD_LAZY); ++ if (nss_handle == NULL) { ++ errmsg = dlerror(); ++ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "loadNSS: dlopen: %s\n", ++ errmsg); ++ handle_msg(env, msg, msg_bytes); ++ return JNI_FALSE; ++ } ++ dlerror(); /* Clear errors */ ++ getSystemFIPSEnabled = (SECMOD_GET_SYSTEM_FIPS_ENABLED_TYPE*)dlsym(nss_handle, "SECMOD_GetSystemFIPSEnabled"); ++ if ((errmsg = dlerror()) != NULL) { ++ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "loadNSS: dlsym: %s\n", ++ errmsg); ++ handle_msg(env, msg, msg_bytes); ++ return JNI_FALSE; ++ } ++ return JNI_TRUE; ++} ++ ++static void closeNSS(JNIEnv *env) ++{ ++ char msg[MSG_MAX_SIZE]; ++ int msg_bytes; ++ const char* errmsg; ++ ++ if (dlclose(nss_handle) != 0) { ++ errmsg = dlerror(); ++ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "closeNSS: dlclose: %s\n", ++ errmsg); ++ handle_msg(env, msg, msg_bytes); ++ } ++} ++ ++#endif ++ ++/* ++ * Class: java_security_SystemConfigurator ++ * Method: JNI_OnLoad ++ */ ++JNIEXPORT jint JNICALL DEF_JNI_OnLoad(JavaVM *vm, void *reserved) ++{ ++ JNIEnv *env; ++ jclass sysConfCls, debugCls; ++ jfieldID sdebugFld; ++ ++ if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) { ++ return JNI_EVERSION; /* JNI version not supported */ ++ } ++ ++ sysConfCls = (*env)->FindClass(env,"java/security/SystemConfigurator"); ++ if (sysConfCls == NULL) { ++ printf("libsystemconf: SystemConfigurator class not found\n"); ++ return JNI_ERR; ++ } ++ sdebugFld = (*env)->GetStaticFieldID(env, sysConfCls, ++ "sdebug", "Lsun/security/util/Debug;"); ++ if (sdebugFld == NULL) { ++ printf("libsystemconf: SystemConfigurator::sdebug field not found\n"); ++ return JNI_ERR; ++ } ++ debugObj = (*env)->GetStaticObjectField(env, sysConfCls, sdebugFld); ++ if (debugObj != NULL) { ++ debugCls = (*env)->FindClass(env,"sun/security/util/Debug"); ++ if (debugCls == NULL) { ++ printf("libsystemconf: Debug class not found\n"); ++ return JNI_ERR; ++ } ++ debugPrintlnMethodID = (*env)->GetMethodID(env, debugCls, ++ "println", "(Ljava/lang/String;)V"); ++ if (debugPrintlnMethodID == NULL) { ++ printf("libsystemconf: Debug::println(String) method not found\n"); ++ return JNI_ERR; ++ } ++ debugObj = (*env)->NewGlobalRef(env, debugObj); ++ } ++ ++#ifdef SYSCONF_NSS ++ getSystemFIPSEnabled = *SECMOD_GetSystemFIPSEnabled; ++#else ++ if (loadNSS(env) == JNI_FALSE) { ++ dbgPrint(env, "libsystemconf: Failed to load NSS library."); ++ } ++#endif ++ ++ return (*env)->GetVersion(env); ++} ++ ++/* ++ * Class: java_security_SystemConfigurator ++ * Method: JNI_OnUnload ++ */ ++JNIEXPORT void JNICALL DEF_JNI_OnUnload(JavaVM *vm, void *reserved) ++{ ++ JNIEnv *env; ++ ++ if (debugObj != NULL) { ++ if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) { ++ return; /* Should not happen */ ++ } ++#ifndef SYSCONF_NSS ++ closeNSS(env); ++#endif ++ (*env)->DeleteGlobalRef(env, debugObj); ++ } ++} ++ ++JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEnabled ++ (JNIEnv *env, jclass cls) ++{ ++ int fips_enabled; ++ char msg[MSG_MAX_SIZE]; ++ int msg_bytes; ++ ++ if (getSystemFIPSEnabled != NULL) { ++ dbgPrint(env, "getSystemFIPSEnabled: calling SECMOD_GetSystemFIPSEnabled"); ++ fips_enabled = (*getSystemFIPSEnabled)(); ++ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \ ++ " SECMOD_GetSystemFIPSEnabled returned 0x%x", fips_enabled); ++ handle_msg(env, msg, msg_bytes); ++ return (fips_enabled == 1 ? JNI_TRUE : JNI_FALSE); ++ } else { ++ FILE *fe; ++ ++ dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH); ++ if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) { ++ throwIOException(env, "Cannot open " FIPS_ENABLED_PATH); ++ return JNI_FALSE; ++ } ++ fips_enabled = fgetc(fe); ++ fclose(fe); ++ if (fips_enabled == EOF) { ++ throwIOException(env, "Cannot read " FIPS_ENABLED_PATH); ++ return JNI_FALSE; ++ } ++ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \ ++ " read character is '%c'", fips_enabled); ++ handle_msg(env, msg, msg_bytes); ++ return (fips_enabled == '1' ? JNI_TRUE : JNI_FALSE); ++ } ++} ++ ++#else // !LINUX ++ ++JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEnabled ++ (JNIEnv *env, jclass cls) ++{ ++ return JNI_FALSE; ++} ++ ++#endif +diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java +new file mode 100644 +index 00000000000..52a403107c3 +--- /dev/null ++++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java +@@ -0,0 +1,461 @@ ++/* ++ * Copyright (c) 2021, Red Hat, Inc. ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. Oracle designates this ++ * particular file as subject to the "Classpath" exception as provided ++ * by Oracle in the LICENSE file that accompanied this code. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++package sun.security.pkcs11; ++ ++import java.math.BigInteger; ++import java.security.KeyFactory; ++import java.security.Provider; ++import java.security.Security; ++import java.security.interfaces.RSAPrivateCrtKey; ++import java.security.interfaces.RSAPrivateKey; ++import java.util.HashMap; ++import java.util.Map; ++import java.util.concurrent.locks.ReentrantLock; ++ ++import javax.crypto.Cipher; ++import javax.crypto.SecretKeyFactory; ++import javax.crypto.spec.SecretKeySpec; ++import javax.crypto.spec.IvParameterSpec; ++ ++import sun.security.jca.JCAUtil; ++import sun.security.pkcs11.TemplateManager; ++import sun.security.pkcs11.wrapper.CK_ATTRIBUTE; ++import sun.security.pkcs11.wrapper.CK_MECHANISM; ++import static sun.security.pkcs11.wrapper.PKCS11Constants.*; ++import static sun.security.pkcs11.wrapper.PKCS11Exception.RV.*; ++import sun.security.pkcs11.wrapper.PKCS11Exception; ++import sun.security.rsa.RSAPrivateCrtKeyImpl; ++import sun.security.rsa.RSAUtil; ++import sun.security.rsa.RSAUtil.KeyType; ++import sun.security.util.Debug; ++import sun.security.util.ECUtil; ++ ++final class FIPSKeyImporter { ++ ++ private static final Debug debug = ++ Debug.getInstance("sunpkcs11"); ++ ++ private static volatile P11Key importerKey = null; ++ private static SecretKeySpec exporterKey = null; ++ private static volatile P11Key exporterKeyP11 = null; ++ private static final ReentrantLock importerKeyLock = new ReentrantLock(); ++ // Do not take the exporterKeyLock with the importerKeyLock held. ++ private static final ReentrantLock exporterKeyLock = new ReentrantLock(); ++ private static volatile CK_MECHANISM importerKeyMechanism = null; ++ private static volatile CK_MECHANISM exporterKeyMechanism = null; ++ private static Cipher importerCipher = null; ++ private static Cipher exporterCipher = null; ++ ++ private static volatile Provider sunECProvider = null; ++ private static final ReentrantLock sunECProviderLock = new ReentrantLock(); ++ ++ private static volatile KeyFactory DHKF = null; ++ private static final ReentrantLock DHKFLock = new ReentrantLock(); ++ ++ static Long importKey(SunPKCS11 sunPKCS11, long hSession, CK_ATTRIBUTE[] attributes) ++ throws PKCS11Exception { ++ long keyID = -1; ++ Token token = sunPKCS11.getToken(); ++ if (debug != null) { ++ debug.println("Private or Secret key will be imported in" + ++ " system FIPS mode."); ++ } ++ if (importerKey == null) { ++ importerKeyLock.lock(); ++ try { ++ if (importerKey == null) { ++ if (importerKeyMechanism == null) { ++ // Importer Key creation has not been tried yet. Try it. ++ createImporterKey(token); ++ } ++ if (importerKey == null || importerCipher == null) { ++ if (debug != null) { ++ debug.println("Importer Key could not be" + ++ " generated."); ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ " fips key importer"); ++ } ++ if (debug != null) { ++ debug.println("Importer Key successfully" + ++ " generated."); ++ } ++ } ++ } finally { ++ importerKeyLock.unlock(); ++ } ++ } ++ long importerKeyID = importerKey.getKeyID(); ++ try { ++ byte[] keyBytes = null; ++ byte[] encKeyBytes = null; ++ long keyClass = 0L; ++ long keyType = 0L; ++ Map attrsMap = new HashMap<>(); ++ for (CK_ATTRIBUTE attr : attributes) { ++ if (attr.type == CKA_CLASS) { ++ keyClass = attr.getLong(); ++ } else if (attr.type == CKA_KEY_TYPE) { ++ keyType = attr.getLong(); ++ } ++ attrsMap.put(attr.type, attr); ++ } ++ BigInteger v = null; ++ if (keyClass == CKO_PRIVATE_KEY) { ++ if (keyType == CKK_RSA) { ++ if (debug != null) { ++ debug.println("Importing an RSA private key..."); ++ } ++ keyBytes = sun.security.rsa.RSAPrivateCrtKeyImpl.newKey( ++ KeyType.RSA, ++ null, ++ ((v = attrsMap.get(CKA_MODULUS).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PUBLIC_EXPONENT).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PRIVATE_EXPONENT).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PRIME_1).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PRIME_2).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_EXPONENT_1).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_EXPONENT_2).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_COEFFICIENT).getBigInteger()) != null) ++ ? v : BigInteger.ZERO ++ ).getEncoded(); ++ } else if (keyType == CKK_DSA) { ++ if (debug != null) { ++ debug.println("Importing a DSA private key..."); ++ } ++ keyBytes = new sun.security.provider.DSAPrivateKey( ++ ((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PRIME).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_SUBPRIME).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_BASE).getBigInteger()) != null) ++ ? v : BigInteger.ZERO ++ ).getEncoded(); ++ if (token.config.getNssNetscapeDbWorkaround() && ++ attrsMap.get(CKA_NETSCAPE_DB) == null) { ++ attrsMap.put(CKA_NETSCAPE_DB, ++ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO)); ++ } ++ } else if (keyType == CKK_EC) { ++ if (debug != null) { ++ debug.println("Importing an EC private key..."); ++ } ++ if (sunECProvider == null) { ++ sunECProviderLock.lock(); ++ try { ++ if (sunECProvider == null) { ++ sunECProvider = Security.getProvider("SunEC"); ++ } ++ } finally { ++ sunECProviderLock.unlock(); ++ } ++ } ++ keyBytes = ECUtil.generateECPrivateKey( ++ ((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ECUtil.getECParameterSpec(sunECProvider, ++ attrsMap.get(CKA_EC_PARAMS).getByteArray())) ++ .getEncoded(); ++ if (token.config.getNssNetscapeDbWorkaround() && ++ attrsMap.get(CKA_NETSCAPE_DB) == null) { ++ attrsMap.put(CKA_NETSCAPE_DB, ++ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO)); ++ } ++ } else { ++ if (debug != null) { ++ debug.println("Unrecognized private key type."); ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ " fips key importer"); ++ } ++ } else if (keyClass == CKO_SECRET_KEY) { ++ if (debug != null) { ++ debug.println("Importing a secret key..."); ++ } ++ keyBytes = attrsMap.get(CKA_VALUE).getByteArray(); ++ } ++ if (keyBytes == null || keyBytes.length == 0) { ++ if (debug != null) { ++ debug.println("Private or secret key plain bytes could" + ++ " not be obtained. Import failed."); ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ " fips key importer"); ++ } ++ attributes = new CK_ATTRIBUTE[attrsMap.size()]; ++ attrsMap.values().toArray(attributes); ++ importerKeyLock.lock(); ++ try { ++ // No need to reset the cipher object because no multi-part ++ // operations are performed. ++ encKeyBytes = importerCipher.doFinal(keyBytes); ++ } finally { ++ importerKeyLock.unlock(); ++ } ++ attributes = token.getAttributes(TemplateManager.O_IMPORT, ++ keyClass, keyType, attributes); ++ keyID = token.p11.C_UnwrapKey(hSession, ++ importerKeyMechanism, importerKeyID, encKeyBytes, attributes); ++ if (debug != null) { ++ debug.println("Imported key ID: " + keyID); ++ } ++ } catch (Throwable t) { ++ if (t instanceof PKCS11Exception) { ++ throw (PKCS11Exception)t; ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ t.getMessage()); ++ } finally { ++ importerKey.releaseKeyID(); ++ } ++ return Long.valueOf(keyID); ++ } ++ ++ static void exportKey(SunPKCS11 sunPKCS11, long hSession, long hObject, ++ long keyClass, long keyType, Map sensitiveAttrs) ++ throws PKCS11Exception { ++ Token token = sunPKCS11.getToken(); ++ if (debug != null) { ++ debug.println("Private or Secret key will be exported in" + ++ " system FIPS mode."); ++ } ++ if (exporterKeyP11 == null) { ++ try { ++ exporterKeyLock.lock(); ++ if (exporterKeyP11 == null) { ++ if (exporterKeyMechanism == null) { ++ // Exporter Key creation has not been tried yet. Try it. ++ createExporterKey(token); ++ } ++ if (exporterKeyP11 == null || exporterCipher == null) { ++ if (debug != null) { ++ debug.println("Exporter Key could not be" + ++ " generated."); ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ " fips key exporter"); ++ } ++ if (debug != null) { ++ debug.println("Exporter Key successfully" + ++ " generated."); ++ } ++ } ++ } finally { ++ exporterKeyLock.unlock(); ++ } ++ } ++ long exporterKeyID = exporterKeyP11.getKeyID(); ++ try { ++ byte[] wrappedKeyBytes = token.p11.C_WrapKey(hSession, ++ exporterKeyMechanism, exporterKeyID, hObject); ++ byte[] plainExportedKey = null; ++ exporterKeyLock.lock(); ++ try { ++ // No need to reset the cipher object because no multi-part ++ // operations are performed. ++ plainExportedKey = exporterCipher.doFinal(wrappedKeyBytes); ++ } finally { ++ exporterKeyLock.unlock(); ++ } ++ if (keyClass == CKO_PRIVATE_KEY) { ++ exportPrivateKey(sensitiveAttrs, keyType, plainExportedKey); ++ } else if (keyClass == CKO_SECRET_KEY) { ++ checkAttrs(sensitiveAttrs, "CKO_SECRET_KEY", CKA_VALUE); ++ // CKA_VALUE is guaranteed to be present, since sensitiveAttrs' ++ // size is greater than 0 and no invalid attributes exist ++ sensitiveAttrs.get(CKA_VALUE).pValue = plainExportedKey; ++ } else { ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ " fips key exporter"); ++ } ++ } catch (Throwable t) { ++ if (t instanceof PKCS11Exception) { ++ throw (PKCS11Exception)t; ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ t.getMessage()); ++ } finally { ++ exporterKeyP11.releaseKeyID(); ++ } ++ } ++ ++ private static void exportPrivateKey( ++ Map sensitiveAttrs, long keyType, ++ byte[] plainExportedKey) throws Throwable { ++ if (keyType == CKK_RSA) { ++ checkAttrs(sensitiveAttrs, "CKO_PRIVATE_KEY CKK_RSA", ++ CKA_PRIVATE_EXPONENT, CKA_PRIME_1, CKA_PRIME_2, ++ CKA_EXPONENT_1, CKA_EXPONENT_2, CKA_COEFFICIENT); ++ RSAPrivateKey rsaPKey = RSAPrivateCrtKeyImpl.newKey( ++ RSAUtil.KeyType.RSA, "PKCS#8", plainExportedKey ++ ); ++ CK_ATTRIBUTE attr; ++ if ((attr = sensitiveAttrs.get(CKA_PRIVATE_EXPONENT)) != null) { ++ attr.pValue = rsaPKey.getPrivateExponent().toByteArray(); ++ } ++ if (rsaPKey instanceof RSAPrivateCrtKey) { ++ RSAPrivateCrtKey rsaPCrtKey = (RSAPrivateCrtKey) rsaPKey; ++ if ((attr = sensitiveAttrs.get(CKA_PRIME_1)) != null) { ++ attr.pValue = rsaPCrtKey.getPrimeP().toByteArray(); ++ } ++ if ((attr = sensitiveAttrs.get(CKA_PRIME_2)) != null) { ++ attr.pValue = rsaPCrtKey.getPrimeQ().toByteArray(); ++ } ++ if ((attr = sensitiveAttrs.get(CKA_EXPONENT_1)) != null) { ++ attr.pValue = rsaPCrtKey.getPrimeExponentP().toByteArray(); ++ } ++ if ((attr = sensitiveAttrs.get(CKA_EXPONENT_2)) != null) { ++ attr.pValue = rsaPCrtKey.getPrimeExponentQ().toByteArray(); ++ } ++ if ((attr = sensitiveAttrs.get(CKA_COEFFICIENT)) != null) { ++ attr.pValue = rsaPCrtKey.getCrtCoefficient().toByteArray(); ++ } ++ } else { ++ checkAttrs(sensitiveAttrs, "CKO_PRIVATE_KEY CKK_RSA", ++ CKA_PRIVATE_EXPONENT); ++ } ++ } else if (keyType == CKK_DSA) { ++ checkAttrs(sensitiveAttrs, "CKO_PRIVATE_KEY CKK_DSA", CKA_VALUE); ++ // CKA_VALUE is guaranteed to be present, since sensitiveAttrs' ++ // size is greater than 0 and no invalid attributes exist ++ sensitiveAttrs.get(CKA_VALUE).pValue = ++ new sun.security.provider.DSAPrivateKey(plainExportedKey) ++ .getX().toByteArray(); ++ } else if (keyType == CKK_EC) { ++ checkAttrs(sensitiveAttrs, "CKO_PRIVATE_KEY CKK_EC", CKA_VALUE); ++ // CKA_VALUE is guaranteed to be present, since sensitiveAttrs' ++ // size is greater than 0 and no invalid attributes exist ++ sensitiveAttrs.get(CKA_VALUE).pValue = ++ ECUtil.decodePKCS8ECPrivateKey(plainExportedKey) ++ .getS().toByteArray(); ++ } else { ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ " unsupported CKO_PRIVATE_KEY key type: " + keyType); ++ } ++ } ++ ++ private static void checkAttrs(Map sensitiveAttrs, ++ String keyName, long... validAttrs) ++ throws PKCS11Exception { ++ int sensitiveAttrsCount = sensitiveAttrs.size(); ++ if (sensitiveAttrsCount <= validAttrs.length) { ++ int validAttrsCount = 0; ++ for (long validAttr : validAttrs) { ++ if (sensitiveAttrs.containsKey(validAttr)) validAttrsCount++; ++ } ++ if (validAttrsCount == sensitiveAttrsCount) return; ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ " invalid attribute types for a " + keyName + " key object"); ++ } ++ ++ private static void createImporterKey(Token token) { ++ if (debug != null) { ++ debug.println("Generating Importer Key..."); ++ } ++ byte[] iv = new byte[16]; ++ JCAUtil.getSecureRandom().nextBytes(iv); ++ importerKeyMechanism = new CK_MECHANISM(CKM_AES_CBC_PAD, iv); ++ try { ++ CK_ATTRIBUTE[] attributes = token.getAttributes(TemplateManager.O_GENERATE, ++ CKO_SECRET_KEY, CKK_AES, new CK_ATTRIBUTE[] { ++ new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY), ++ new CK_ATTRIBUTE(CKA_VALUE_LEN, 256 >> 3)}); ++ Session s = null; ++ try { ++ s = token.getObjSession(); ++ long keyID = token.p11.C_GenerateKey( ++ s.id(), new CK_MECHANISM(CKM_AES_KEY_GEN), ++ attributes); ++ if (debug != null) { ++ debug.println("Importer Key ID: " + keyID); ++ } ++ importerKey = (P11Key)P11Key.secretKey(s, keyID, "AES", ++ 256 >> 3, null); ++ } catch (PKCS11Exception e) { ++ // best effort ++ } finally { ++ token.releaseSession(s); ++ } ++ if (importerKey != null) { ++ importerCipher = Cipher.getInstance("AES/CBC/PKCS5Padding"); ++ importerCipher.init(Cipher.ENCRYPT_MODE, importerKey, ++ new IvParameterSpec( ++ (byte[])importerKeyMechanism.pParameter), null); ++ } ++ } catch (Throwable t) { ++ // best effort ++ importerKey = null; ++ importerCipher = null; ++ // importerKeyMechanism value is kept initialized to indicate that ++ // Importer Key creation has been tried and failed. ++ if (debug != null) { ++ debug.println("Error generating the Importer Key"); ++ } ++ } ++ } ++ ++ private static void createExporterKey(Token token) { ++ if (debug != null) { ++ debug.println("Generating Exporter Key..."); ++ } ++ byte[] iv = new byte[16]; ++ JCAUtil.getSecureRandom().nextBytes(iv); ++ exporterKeyMechanism = new CK_MECHANISM(CKM_AES_CBC_PAD, iv); ++ byte[] exporterKeyRaw = new byte[32]; ++ JCAUtil.getSecureRandom().nextBytes(exporterKeyRaw); ++ exporterKey = new SecretKeySpec(exporterKeyRaw, "AES"); ++ try { ++ SecretKeyFactory skf = SecretKeyFactory.getInstance("AES"); ++ exporterKeyP11 = (P11Key)(skf.translateKey(exporterKey)); ++ if (exporterKeyP11 != null) { ++ exporterCipher = Cipher.getInstance("AES/CBC/PKCS5Padding"); ++ exporterCipher.init(Cipher.DECRYPT_MODE, exporterKey, ++ new IvParameterSpec( ++ (byte[])exporterKeyMechanism.pParameter), null); ++ } ++ } catch (Throwable t) { ++ // best effort ++ exporterKey = null; ++ exporterKeyP11 = null; ++ exporterCipher = null; ++ // exporterKeyMechanism value is kept initialized to indicate that ++ // Exporter Key creation has been tried and failed. ++ if (debug != null) { ++ debug.println("Error generating the Exporter Key"); ++ } ++ } ++ } ++} +diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java +index af6fbeba48a..a20278cb683 100644 +--- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java ++++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java +@@ -37,6 +37,8 @@ import javax.crypto.*; + import javax.crypto.interfaces.*; + import javax.crypto.spec.*; + ++import jdk.internal.access.SharedSecrets; ++ + import sun.security.rsa.RSAUtil.KeyType; + import sun.security.rsa.RSAPublicKeyImpl; + import sun.security.rsa.RSAPrivateCrtKeyImpl; +@@ -72,6 +74,9 @@ abstract class P11Key implements Key, Length { + @Serial + private static final long serialVersionUID = -2575874101938349339L; + ++ private static final boolean plainKeySupportEnabled = SharedSecrets ++ .getJavaSecuritySystemConfiguratorAccess().isPlainKeySupportEnabled(); ++ + private static final String PUBLIC = "public"; + private static final String PRIVATE = "private"; + private static final String SECRET = "secret"; +@@ -391,8 +396,10 @@ abstract class P11Key implements Key, Length { + new CK_ATTRIBUTE(CKA_EXTRACTABLE), + }); + +- boolean keySensitive = (attrs[0].getBoolean() || +- attrs[1].getBoolean() || !attrs[2].getBoolean()); ++ boolean exportable = plainKeySupportEnabled && !algorithm.equals("DH"); ++ boolean keySensitive = (!exportable && ++ (attrs[0].getBoolean() || ++ attrs[1].getBoolean() || !attrs[2].getBoolean())); + + return switch (algorithm) { + case "RSA" -> P11RSAPrivateKeyInternal.of(session, keyID, algorithm, +@@ -444,7 +451,8 @@ abstract class P11Key implements Key, Length { + + public String getFormat() { + token.ensureValid(); +- if (sensitive || !extractable || (isNSS && tokenObject)) { ++ if (!plainKeySupportEnabled && ++ (sensitive || !extractable || (isNSS && tokenObject))) { + return null; + } else { + return "RAW"; +@@ -1575,4 +1583,3 @@ final class SessionKeyRef extends PhantomReference { + this.clear(); + } + } +- +diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java +index 04a1a70ed23..a5c9b5fddf4 100644 +--- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java ++++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java +@@ -26,6 +26,9 @@ + package sun.security.pkcs11; + + import java.io.*; ++import java.lang.invoke.MethodHandle; ++import java.lang.invoke.MethodHandles; ++import java.lang.invoke.MethodType; + import java.util.*; + + import java.security.*; +@@ -42,6 +45,7 @@ import javax.security.auth.callback.PasswordCallback; + + import com.sun.crypto.provider.ChaCha20Poly1305Parameters; + ++import jdk.internal.access.SharedSecrets; + import jdk.internal.misc.InnocuousThread; + import sun.security.util.Debug; + import sun.security.util.ResourcesMgr; +@@ -65,6 +69,37 @@ public final class SunPKCS11 extends AuthProvider { + @Serial + private static final long serialVersionUID = -1354835039035306505L; + ++ private static final boolean systemFipsEnabled = SharedSecrets ++ .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled(); ++ ++ private static final boolean plainKeySupportEnabled = SharedSecrets ++ .getJavaSecuritySystemConfiguratorAccess().isPlainKeySupportEnabled(); ++ ++ private static final MethodHandle fipsImportKey; ++ private static final MethodHandle fipsExportKey; ++ static { ++ MethodHandle fipsImportKeyTmp = null; ++ MethodHandle fipsExportKeyTmp = null; ++ if (plainKeySupportEnabled) { ++ try { ++ fipsImportKeyTmp = MethodHandles.lookup().findStatic( ++ FIPSKeyImporter.class, "importKey", ++ MethodType.methodType(Long.class, SunPKCS11.class, ++ long.class, CK_ATTRIBUTE[].class)); ++ fipsExportKeyTmp = MethodHandles.lookup().findStatic( ++ FIPSKeyImporter.class, "exportKey", ++ MethodType.methodType(void.class, SunPKCS11.class, ++ long.class, long.class, ++ long.class, long.class, Map.class)); ++ } catch (Throwable t) { ++ throw new SecurityException("FIPS key importer-exporter" + ++ " initialization failed", t); ++ } ++ } ++ fipsImportKey = fipsImportKeyTmp; ++ fipsExportKey = fipsExportKeyTmp; ++ } ++ + static final Debug debug = Debug.getInstance("sunpkcs11"); + // the PKCS11 object through which we make the native calls + @SuppressWarnings("serial") // Type of field is not Serializable; +@@ -325,9 +360,19 @@ public final class SunPKCS11 extends AuthProvider { + // request multithreaded access first + initArgs.flags = CKF_OS_LOCKING_OK; + PKCS11 tmpPKCS11; ++ MethodHandle fipsKeyImporter = null; ++ MethodHandle fipsKeyExporter = null; ++ if (plainKeySupportEnabled) { ++ fipsKeyImporter = MethodHandles.insertArguments( ++ fipsImportKey, 0, this); ++ fipsKeyExporter = MethodHandles.insertArguments( ++ fipsExportKey, 0, this); ++ } + try { +- tmpPKCS11 = PKCS11.getInstance(library, functionList, initArgs, +- config.getOmitInitialize()); ++ tmpPKCS11 = PKCS11.getInstance( ++ library, functionList, initArgs, ++ config.getOmitInitialize(), fipsKeyImporter, ++ fipsKeyExporter); + } catch (PKCS11Exception e) { + if (debug != null) { + debug.println("Multi-threaded initialization failed: " + e); +@@ -342,8 +387,9 @@ public final class SunPKCS11 extends AuthProvider { + } else { + initArgs.flags = 0; + } +- tmpPKCS11 = PKCS11.getInstance(library, functionList, initArgs, +- config.getOmitInitialize()); ++ tmpPKCS11 = PKCS11.getInstance(library, ++ functionList, initArgs, config.getOmitInitialize(), fipsKeyImporter, ++ fipsKeyExporter); + } + p11 = tmpPKCS11; + +@@ -383,6 +429,24 @@ public final class SunPKCS11 extends AuthProvider { + if (nssModule != null) { + nssModule.setProvider(this); + } ++ if (systemFipsEnabled) { ++ // The NSS Software Token in FIPS 140-2 mode requires a user ++ // login for most operations. See sftk_fipsCheck. The NSS DB ++ // (/etc/pki/nssdb) PIN is empty. ++ Session session = null; ++ try { ++ session = token.getOpSession(); ++ p11.C_Login(session.id(), CKU_USER, new char[] {}); ++ } catch (PKCS11Exception p11e) { ++ if (debug != null) { ++ debug.println("Error during token login: " + ++ p11e.getMessage()); ++ } ++ throw p11e; ++ } finally { ++ token.releaseSession(session); ++ } ++ } + } catch (Exception e) { + if (config.getHandleStartupErrors() == Config.ERR_IGNORE_ALL) { + throw new UnsupportedOperationException +diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java +index 4b06daaf264..55e14945469 100644 +--- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java ++++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java +@@ -49,6 +49,9 @@ package sun.security.pkcs11.wrapper; + + import java.io.File; + import java.io.IOException; ++import java.lang.invoke.MethodHandle; ++import java.lang.invoke.MethodHandles; ++import java.lang.invoke.MethodType; + import java.util.*; + + import java.security.AccessController; +@@ -174,18 +177,43 @@ public class PKCS11 { + return version; + } + ++ /* ++ * Compatibility wrapper to allow this method to work as before ++ * when FIPS mode support is not active. ++ */ ++ public static synchronized PKCS11 getInstance(String pkcs11ModulePath, ++ String functionList, CK_C_INITIALIZE_ARGS pInitArgs, ++ boolean omitInitialize) throws IOException, PKCS11Exception { ++ return getInstance(pkcs11ModulePath, functionList, ++ pInitArgs, omitInitialize, null, null); ++ } ++ + public static synchronized PKCS11 getInstance(String pkcs11ModulePath, + String functionList, CK_C_INITIALIZE_ARGS pInitArgs, +- boolean omitInitialize) throws IOException, PKCS11Exception { ++ boolean omitInitialize, MethodHandle fipsKeyImporter, ++ MethodHandle fipsKeyExporter) ++ throws IOException, PKCS11Exception { + // we may only call C_Initialize once per native .so/.dll + // so keep a cache using the (non-canonicalized!) path + PKCS11 pkcs11 = moduleMap.get(pkcs11ModulePath); + if (pkcs11 == null) { ++ boolean nssFipsMode = fipsKeyImporter != null && ++ fipsKeyExporter != null; + if ((pInitArgs != null) + && ((pInitArgs.flags & CKF_OS_LOCKING_OK) != 0)) { +- pkcs11 = new PKCS11(pkcs11ModulePath, functionList); ++ if (nssFipsMode) { ++ pkcs11 = new FIPSPKCS11(pkcs11ModulePath, functionList, ++ fipsKeyImporter, fipsKeyExporter); ++ } else { ++ pkcs11 = new PKCS11(pkcs11ModulePath, functionList); ++ } + } else { +- pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList); ++ if (nssFipsMode) { ++ pkcs11 = new SynchronizedFIPSPKCS11(pkcs11ModulePath, ++ functionList, fipsKeyImporter, fipsKeyExporter); ++ } else { ++ pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList); ++ } + } + if (omitInitialize == false) { + try { +@@ -1976,4 +2004,194 @@ static class SynchronizedPKCS11 extends PKCS11 { + super.C_GenerateRandom(hSession, randomData); + } + } ++ ++// PKCS11 subclass that allows using plain private or secret keys in ++// FIPS-configured NSS Software Tokens. Only used when System FIPS ++// is enabled. ++static class FIPSPKCS11 extends PKCS11 { ++ private MethodHandle fipsKeyImporter; ++ private MethodHandle fipsKeyExporter; ++ private MethodHandle hC_GetAttributeValue; ++ FIPSPKCS11(String pkcs11ModulePath, String functionListName, ++ MethodHandle fipsKeyImporter, MethodHandle fipsKeyExporter) ++ throws IOException { ++ super(pkcs11ModulePath, functionListName); ++ this.fipsKeyImporter = fipsKeyImporter; ++ this.fipsKeyExporter = fipsKeyExporter; ++ try { ++ hC_GetAttributeValue = MethodHandles.insertArguments( ++ MethodHandles.lookup().findSpecial(PKCS11.class, ++ "C_GetAttributeValue", MethodType.methodType( ++ void.class, long.class, long.class, ++ CK_ATTRIBUTE[].class), ++ FIPSPKCS11.class), 0, this); ++ } catch (Throwable t) { ++ throw new RuntimeException( ++ "sun.security.pkcs11.wrapper.PKCS11" + ++ "::C_GetAttributeValue method not found.", t); ++ } ++ } ++ ++ public long C_CreateObject(long hSession, ++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception { ++ // Creating sensitive key objects from plain key material in a ++ // FIPS-configured NSS Software Token is not allowed. We apply ++ // a key-unwrapping scheme to achieve so. ++ if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) { ++ try { ++ return ((Long)fipsKeyImporter.invoke(hSession, pTemplate)) ++ .longValue(); ++ } catch (Throwable t) { ++ if (t instanceof PKCS11Exception) { ++ throw (PKCS11Exception)t; ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ t.getMessage()); ++ } ++ } ++ return super.C_CreateObject(hSession, pTemplate); ++ } ++ ++ public void C_GetAttributeValue(long hSession, long hObject, ++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception { ++ FIPSPKCS11Helper.C_GetAttributeValue(hC_GetAttributeValue, ++ fipsKeyExporter, hSession, hObject, pTemplate); ++ } ++} ++ ++// FIPSPKCS11 synchronized counterpart. ++static class SynchronizedFIPSPKCS11 extends SynchronizedPKCS11 { ++ private MethodHandle fipsKeyImporter; ++ private MethodHandle fipsKeyExporter; ++ private MethodHandle hC_GetAttributeValue; ++ SynchronizedFIPSPKCS11(String pkcs11ModulePath, String functionListName, ++ MethodHandle fipsKeyImporter, MethodHandle fipsKeyExporter) ++ throws IOException { ++ super(pkcs11ModulePath, functionListName); ++ this.fipsKeyImporter = fipsKeyImporter; ++ this.fipsKeyExporter = fipsKeyExporter; ++ try { ++ hC_GetAttributeValue = MethodHandles.insertArguments( ++ MethodHandles.lookup().findSpecial(SynchronizedPKCS11.class, ++ "C_GetAttributeValue", MethodType.methodType( ++ void.class, long.class, long.class, ++ CK_ATTRIBUTE[].class), ++ SynchronizedFIPSPKCS11.class), 0, this); ++ } catch (Throwable t) { ++ throw new RuntimeException( ++ "sun.security.pkcs11.wrapper.SynchronizedPKCS11" + ++ "::C_GetAttributeValue method not found.", t); ++ } ++ } ++ ++ public synchronized long C_CreateObject(long hSession, ++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception { ++ // See FIPSPKCS11::C_CreateObject. ++ if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) { ++ try { ++ return ((Long)fipsKeyImporter.invoke(hSession, pTemplate)) ++ .longValue(); ++ } catch (Throwable t) { ++ if (t instanceof PKCS11Exception) { ++ throw (PKCS11Exception)t; ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ t.getMessage()); ++ } ++ } ++ return super.C_CreateObject(hSession, pTemplate); ++ } ++ ++ public synchronized void C_GetAttributeValue(long hSession, long hObject, ++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception { ++ FIPSPKCS11Helper.C_GetAttributeValue(hC_GetAttributeValue, ++ fipsKeyExporter, hSession, hObject, pTemplate); ++ } ++} ++ ++private static class FIPSPKCS11Helper { ++ static boolean isSensitiveObject(CK_ATTRIBUTE[] pTemplate) { ++ for (CK_ATTRIBUTE attr : pTemplate) { ++ if (attr.type == CKA_CLASS && ++ (attr.getLong() == CKO_PRIVATE_KEY || ++ attr.getLong() == CKO_SECRET_KEY)) { ++ return true; ++ } ++ } ++ return false; ++ } ++ static void C_GetAttributeValue(MethodHandle hC_GetAttributeValue, ++ MethodHandle fipsKeyExporter, long hSession, long hObject, ++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception { ++ Map sensitiveAttrs = new HashMap<>(); ++ List nonSensitiveAttrs = new LinkedList<>(); ++ FIPSPKCS11Helper.getAttributesBySensitivity(pTemplate, ++ sensitiveAttrs, nonSensitiveAttrs); ++ try { ++ if (sensitiveAttrs.size() > 0) { ++ long keyClass = -1L; ++ long keyType = -1L; ++ try { ++ // Secret and private keys have both class and type ++ // attributes, so we can query them at once. ++ CK_ATTRIBUTE[] queryAttrs = new CK_ATTRIBUTE[]{ ++ new CK_ATTRIBUTE(CKA_CLASS), ++ new CK_ATTRIBUTE(CKA_KEY_TYPE), ++ }; ++ hC_GetAttributeValue.invoke(hSession, hObject, queryAttrs); ++ keyClass = queryAttrs[0].getLong(); ++ keyType = queryAttrs[1].getLong(); ++ } catch (PKCS11Exception e) { ++ // If the query fails, the object is neither a secret nor a ++ // private key. As this case won't be handled with the FIPS ++ // Key Exporter, we keep keyClass initialized to -1L. ++ } ++ if (keyClass == CKO_SECRET_KEY || keyClass == CKO_PRIVATE_KEY) { ++ fipsKeyExporter.invoke(hSession, hObject, keyClass, keyType, ++ sensitiveAttrs); ++ if (nonSensitiveAttrs.size() > 0) { ++ CK_ATTRIBUTE[] pNonSensitiveAttrs = ++ new CK_ATTRIBUTE[nonSensitiveAttrs.size()]; ++ int i = 0; ++ for (CK_ATTRIBUTE nonSensAttr : nonSensitiveAttrs) { ++ pNonSensitiveAttrs[i++] = nonSensAttr; ++ } ++ hC_GetAttributeValue.invoke(hSession, hObject, ++ pNonSensitiveAttrs); ++ // libj2pkcs11 allocates new CK_ATTRIBUTE objects, so we ++ // update the reference on the previous CK_ATTRIBUTEs ++ i = 0; ++ for (CK_ATTRIBUTE nonSensAttr : nonSensitiveAttrs) { ++ nonSensAttr.pValue = pNonSensitiveAttrs[i++].pValue; ++ } ++ } ++ return; ++ } ++ } ++ hC_GetAttributeValue.invoke(hSession, hObject, pTemplate); ++ } catch (Throwable t) { ++ if (t instanceof PKCS11Exception) { ++ throw (PKCS11Exception)t; ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ t.getMessage()); ++ } ++ } ++ private static void getAttributesBySensitivity(CK_ATTRIBUTE[] pTemplate, ++ Map sensitiveAttrs, ++ List nonSensitiveAttrs) { ++ for (CK_ATTRIBUTE attr : pTemplate) { ++ long type = attr.type; ++ // Aligned with NSS' sftk_isSensitive in lib/softoken/pkcs11u.c ++ if (type == CKA_VALUE || type == CKA_PRIVATE_EXPONENT || ++ type == CKA_PRIME_1 || type == CKA_PRIME_2 || ++ type == CKA_EXPONENT_1 || type == CKA_EXPONENT_2 || ++ type == CKA_COEFFICIENT) { ++ sensitiveAttrs.put(type, attr); ++ } else { ++ nonSensitiveAttrs.add(attr); ++ } ++ } ++ } ++} + } +diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java +index 920422376f8..6aa308fa5f8 100644 +--- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java ++++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java +@@ -215,6 +215,14 @@ public class PKCS11Exception extends Exception { + return res; + } + ++ /** ++ * Constructor taking the error code from the RV enum and ++ * extra info for error message. ++ */ ++ public PKCS11Exception(RV errorEnum, String extraInfo) { ++ this(errorEnum.value, extraInfo); ++ } ++ + /** + * Constructor taking the error code (the CKR_* constants in PKCS#11) and + * extra info for error message. +diff --git a/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java b/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java +index 3cfb74c8115..0e333d8ba74 100644 +--- a/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java ++++ b/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java +@@ -34,6 +34,7 @@ import java.security.ProviderException; + import java.util.HashMap; + import java.util.List; + ++import jdk.internal.access.SharedSecrets; + import sun.security.ec.ed.EdDSAKeyFactory; + import sun.security.ec.ed.EdDSAKeyPairGenerator; + import sun.security.ec.ed.EdDSASignature; +@@ -50,6 +51,10 @@ public final class SunEC extends Provider { + + private static final long serialVersionUID = -2279741672933606418L; + ++ private static final boolean systemFipsEnabled = ++ SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ .isSystemFipsEnabled(); ++ + private static class ProviderServiceA extends ProviderService { + ProviderServiceA(Provider p, String type, String algo, String cn, + HashMap attrs) { +@@ -243,83 +248,85 @@ public final class SunEC extends Provider { + putXDHEntries(); + putEdDSAEntries(); + +- /* +- * Signature engines +- */ +- putService(new ProviderService(this, "Signature", +- "NONEwithECDSA", "sun.security.ec.ECDSASignature$Raw", +- null, ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA1withECDSA", "sun.security.ec.ECDSASignature$SHA1", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA224withECDSA", "sun.security.ec.ECDSASignature$SHA224", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA256withECDSA", "sun.security.ec.ECDSASignature$SHA256", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA384withECDSA", "sun.security.ec.ECDSASignature$SHA384", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA512withECDSA", "sun.security.ec.ECDSASignature$SHA512", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA3-224withECDSA", "sun.security.ec.ECDSASignature$SHA3_224", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA3-256withECDSA", "sun.security.ec.ECDSASignature$SHA3_256", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA3-384withECDSA", "sun.security.ec.ECDSASignature$SHA3_384", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA3-512withECDSA", "sun.security.ec.ECDSASignature$SHA3_512", +- ATTRS)); +- +- putService(new ProviderService(this, "Signature", +- "NONEwithECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$RawinP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA1withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA1inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA224withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA224inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA256withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA256inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA384withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA384inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA512withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA512inP1363Format")); +- +- putService(new ProviderService(this, "Signature", +- "SHA3-224withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA3_224inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA3-256withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA3_256inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA3-384withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA3_384inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA3-512withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA3_512inP1363Format")); +- +- /* +- * Key Pair Generator engine +- */ +- putService(new ProviderServiceA(this, "KeyPairGenerator", +- "EC", "sun.security.ec.ECKeyPairGenerator", ATTRS)); +- +- /* +- * Key Agreement engine +- */ +- putService(new ProviderService(this, "KeyAgreement", +- "ECDH", "sun.security.ec.ECDHKeyAgreement", null, ATTRS)); ++ if (!systemFipsEnabled) { ++ /* ++ * Signature engines ++ */ ++ putService(new ProviderService(this, "Signature", ++ "NONEwithECDSA", "sun.security.ec.ECDSASignature$Raw", ++ null, ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA1withECDSA", "sun.security.ec.ECDSASignature$SHA1", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA224withECDSA", "sun.security.ec.ECDSASignature$SHA224", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA256withECDSA", "sun.security.ec.ECDSASignature$SHA256", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA384withECDSA", "sun.security.ec.ECDSASignature$SHA384", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA512withECDSA", "sun.security.ec.ECDSASignature$SHA512", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA3-224withECDSA", "sun.security.ec.ECDSASignature$SHA3_224", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA3-256withECDSA", "sun.security.ec.ECDSASignature$SHA3_256", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA3-384withECDSA", "sun.security.ec.ECDSASignature$SHA3_384", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA3-512withECDSA", "sun.security.ec.ECDSASignature$SHA3_512", ++ ATTRS)); ++ ++ putService(new ProviderService(this, "Signature", ++ "NONEwithECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$RawinP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA1withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA1inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA224withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA224inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA256withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA256inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA384withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA384inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA512withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA512inP1363Format")); ++ ++ putService(new ProviderService(this, "Signature", ++ "SHA3-224withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA3_224inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA3-256withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA3_256inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA3-384withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA3_384inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA3-512withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA3_512inP1363Format")); ++ ++ /* ++ * Key Pair Generator engine ++ */ ++ putService(new ProviderServiceA(this, "KeyPairGenerator", ++ "EC", "sun.security.ec.ECKeyPairGenerator", ATTRS)); ++ ++ /* ++ * Key Agreement engine ++ */ ++ putService(new ProviderService(this, "KeyAgreement", ++ "ECDH", "sun.security.ec.ECDHKeyAgreement", null, ATTRS)); ++ } + } + + private void putXDHEntries() { +@@ -336,23 +343,25 @@ public final class SunEC extends Provider { + "X448", "sun.security.ec.XDHKeyFactory.X448", + ATTRS)); + +- putService(new ProviderService(this, "KeyPairGenerator", +- "XDH", "sun.security.ec.XDHKeyPairGenerator", null, ATTRS)); +- putService(new ProviderServiceA(this, "KeyPairGenerator", +- "X25519", "sun.security.ec.XDHKeyPairGenerator.X25519", +- ATTRS)); +- putService(new ProviderServiceA(this, "KeyPairGenerator", +- "X448", "sun.security.ec.XDHKeyPairGenerator.X448", +- ATTRS)); +- +- putService(new ProviderService(this, "KeyAgreement", +- "XDH", "sun.security.ec.XDHKeyAgreement", null, ATTRS)); +- putService(new ProviderServiceA(this, "KeyAgreement", +- "X25519", "sun.security.ec.XDHKeyAgreement.X25519", +- ATTRS)); +- putService(new ProviderServiceA(this, "KeyAgreement", +- "X448", "sun.security.ec.XDHKeyAgreement.X448", +- ATTRS)); ++ if (!systemFipsEnabled) { ++ putService(new ProviderService(this, "KeyPairGenerator", ++ "XDH", "sun.security.ec.XDHKeyPairGenerator", null, ATTRS)); ++ putService(new ProviderServiceA(this, "KeyPairGenerator", ++ "X25519", "sun.security.ec.XDHKeyPairGenerator.X25519", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "KeyPairGenerator", ++ "X448", "sun.security.ec.XDHKeyPairGenerator.X448", ++ ATTRS)); ++ ++ putService(new ProviderService(this, "KeyAgreement", ++ "XDH", "sun.security.ec.XDHKeyAgreement", null, ATTRS)); ++ putService(new ProviderServiceA(this, "KeyAgreement", ++ "X25519", "sun.security.ec.XDHKeyAgreement.X25519", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "KeyAgreement", ++ "X448", "sun.security.ec.XDHKeyAgreement.X448", ++ ATTRS)); ++ } + } + + private void putEdDSAEntries() { +@@ -367,21 +376,23 @@ public final class SunEC extends Provider { + putService(new ProviderServiceA(this, "KeyFactory", + "Ed448", "sun.security.ec.ed.EdDSAKeyFactory.Ed448", ATTRS)); + +- putService(new ProviderService(this, "KeyPairGenerator", +- "EdDSA", "sun.security.ec.ed.EdDSAKeyPairGenerator", null, ATTRS)); +- putService(new ProviderServiceA(this, "KeyPairGenerator", +- "Ed25519", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed25519", +- ATTRS)); +- putService(new ProviderServiceA(this, "KeyPairGenerator", +- "Ed448", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed448", +- ATTRS)); +- +- putService(new ProviderService(this, "Signature", +- "EdDSA", "sun.security.ec.ed.EdDSASignature", null, ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "Ed25519", "sun.security.ec.ed.EdDSASignature.Ed25519", ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "Ed448", "sun.security.ec.ed.EdDSASignature.Ed448", ATTRS)); ++ if (!systemFipsEnabled) { ++ putService(new ProviderService(this, "KeyPairGenerator", ++ "EdDSA", "sun.security.ec.ed.EdDSAKeyPairGenerator", null, ATTRS)); ++ putService(new ProviderServiceA(this, "KeyPairGenerator", ++ "Ed25519", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed25519", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "KeyPairGenerator", ++ "Ed448", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed448", ++ ATTRS)); ++ ++ putService(new ProviderService(this, "Signature", ++ "EdDSA", "sun.security.ec.ed.EdDSASignature", null, ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "Ed25519", "sun.security.ec.ed.EdDSASignature.Ed25519", ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "Ed448", "sun.security.ec.ed.EdDSASignature.Ed448", ATTRS)); ++ } + + } + } diff --git a/fips-25u-df044414ef4.patch b/fips-25u-df044414ef4.patch deleted file mode 100644 index 8b210e6..0000000 --- a/fips-25u-df044414ef4.patch +++ /dev/null @@ -1,92 +0,0 @@ -diff --git a/src/java.base/share/classes/java/security/Provider.java b/src/java.base/share/classes/java/security/Provider.java -index de2845fb550..b1e416b90f4 100644 ---- a/src/java.base/share/classes/java/security/Provider.java -+++ b/src/java.base/share/classes/java/security/Provider.java -@@ -1203,6 +1203,39 @@ public Set getServices() { - return serviceSet; - } - -+ /* vvvvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvvvv */ -+ private static final class RedHatFIPSFilter { -+ static final boolean IS_ON = Boolean.parseBoolean( -+ Security.getProperty("__redhat_fips_filter__")); -+ private static final Set ANY_SERVICE_TYPE = Set.of(); -+ private static final Map> ALLOW_LIST = Map.of( -+ "SunPKCS11-FIPS", ANY_SERVICE_TYPE, -+ "SUN", Set.of( -+ "AlgorithmParameterGenerator", -+ "AlgorithmParameters", "CertificateFactory", -+ "CertPathBuilder", "CertPathValidator", "CertStore", -+ "Configuration", "KeyStore"), -+ "SunEC", Set.of( -+ "AlgorithmParameters", "KeyFactory"), -+ "SunJSSE", ANY_SERVICE_TYPE, -+ "SunJCE", Set.of( -+ "AlgorithmParameters", -+ "AlgorithmParameterGenerator", "KeyFactory", -+ "SecretKeyFactory"), -+ "SunRsaSign", Set.of( -+ "KeyFactory", "AlgorithmParameters"), -+ "XMLDSig", ANY_SERVICE_TYPE -+ ); -+ -+ static boolean isAllowed(String provName, String serviceType) { -+ Set allowedServiceTypes = ALLOW_LIST.get(provName); -+ return allowedServiceTypes != null && -+ (allowedServiceTypes == ANY_SERVICE_TYPE || -+ allowedServiceTypes.contains(serviceType)); -+ } -+ } -+ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ */ -+ - /** - * Add a service. If a service of the same type with the same algorithm - * name exists, and it was added using {@link #putService putService()}, -@@ -1231,6 +1264,15 @@ protected void putService(Service s) { - ("service.getProvider() must match this Provider object"); - } - String type = s.getType(); -+ /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */ -+ if (RedHatFIPSFilter.IS_ON && !RedHatFIPSFilter.isAllowed(name, type)) { -+ if (debug != null) { -+ debug.println("The previous " + name + ".putService() call " + -+ "was skipped by " + RedHatFIPSFilter.class.getName()); -+ } -+ return; -+ } -+ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */ - String algorithm = s.getAlgorithm(); - ServiceKey key = new ServiceKey(type, algorithm, true); - implRemoveService(serviceMap.get(key)); -diff --git a/src/java.base/share/classes/java/security/Security.java b/src/java.base/share/classes/java/security/Security.java -index 6969fe8a8e1..4501d5971c4 100644 ---- a/src/java.base/share/classes/java/security/Security.java -+++ b/src/java.base/share/classes/java/security/Security.java -@@ -323,7 +323,27 @@ public Properties getInitialProperties() { - } - - private static void initialize() { -+ /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */ -+ /* This 'include'-directives-only magic property is an internal */ -+ /* implementation detail that could (and probably will!) change. */ -+ /* Red Hat customers should NOT rely on this for their own use. */ -+ String fipsKernelFlag = "/proc/sys/crypto/fips_enabled"; -+ boolean fipsModeOn; -+ try (InputStream is = new java.io.FileInputStream(fipsKernelFlag)) { -+ fipsModeOn = is.read() == '1'; -+ } catch (IOException ioe) { -+ fipsModeOn = false; -+ if (sdebug != null) { -+ sdebug.println("Failed to read FIPS kernel file: " + ioe); -+ } -+ } -+ String fipsMagicPropName = "__redhat_fips__"; -+ System.setProperty(fipsMagicPropName, "" + fipsModeOn); -+ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */ - SecPropLoader.loadAll(); -+ /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */ -+ System.clearProperty(fipsMagicPropName); -+ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */ - initialSecurityProperties = (Properties) props.clone(); - if (sdebug != null) { - for (String key : props.stringPropertyNames()) { diff --git a/generate_source_tarball.sh b/generate_source_tarball.sh new file mode 100755 index 0000000..c5bb0e8 --- /dev/null +++ b/generate_source_tarball.sh @@ -0,0 +1,183 @@ +#!/bin/bash +# Generates the 'source tarball' for JDK projects. +# +# Example: +# When used from local repo set REPO_ROOT pointing to file:// with your repo +# If your local repo follows upstream forests conventions, it may be enough to set OPENJDK_URL +# +# In any case you have to set PROJECT_NAME REPO_NAME and VERSION. eg: +# PROJECT_NAME=openjdk +# REPO_NAME=jdk18u +# VERSION=jdk-18.0.1+10 +# or to eg prepare systemtap: +# icedtea7's jstack and other tapsets +# VERSION=6327cf1cea9e +# REPO_NAME=icedtea7-2.6 +# PROJECT_NAME=release +# OPENJDK_URL=http://icedtea.classpath.org/hg/ +# TO_COMPRESS="*/tapset" +# +# They are used to create correct name and are used in construction of sources url (unless REPO_ROOT is set) + +# This script creates a single source tarball out of the repository +# based on the given tag and removes code not allowed in fedora/rhel. For +# consistency, the source tarball will always contain 'openjdk' as the top +# level folder, name is created, based on parameter +# + +set -e + +OPENJDK_URL_DEFAULT=https://github.com +COMPRESSION_DEFAULT=xz +# Corresponding IcedTea version +ICEDTEA_VERSION=15.0 + +if [ "x$1" = "xhelp" ] ; then + echo -e "Behaviour may be specified by setting the following variables:\n" + echo "VERSION - the version of the specified OpenJDK project" + echo "PROJECT_NAME -- the name of the OpenJDK project being archived (optional; only needed by defaults)" + echo "REPO_NAME - the name of the OpenJDK repository (optional; only needed by defaults)" + echo "OPENJDK_URL - the URL to retrieve code from (optional; defaults to ${OPENJDK_URL_DEFAULT})" + echo "COMPRESSION - the compression type to use (optional; defaults to ${COMPRESSION_DEFAULT})" + echo "FILE_NAME_ROOT - name of the archive, minus extensions (optional; defaults to PROJECT_NAME-REPO_NAME-VERSION)" + echo "REPO_ROOT - the location of the Git repository to archive (optional; defaults to OPENJDK_URL/PROJECT_NAME/REPO_NAME)" + echo "TO_COMPRESS - what part of clone to pack (default is openjdk)" + echo "BOOT_JDK - the bootstrap JDK to satisfy the configure run" + exit 1; +fi + + +if [ "x$VERSION" = "x" ] ; then + echo "No VERSION specified" + exit 2 +fi +echo "Version: ${VERSION}" +NUM_VER=${VERSION##jdk-} +RELEASE_VER=${NUM_VER%%+*} +BUILD_VER=${NUM_VER##*+} +MAJOR_VER=${RELEASE_VER%%.*} +echo "Major version is ${MAJOR_VER}, release ${RELEASE_VER}, build ${BUILD_VER}" + +if [ "x$BOOT_JDK" = "x" ] ; then + echo "No boot JDK specified". + BOOT_JDK=/usr/lib/jvm/java-${MAJOR_VER}-openjdk; + echo -n "Checking for ${BOOT_JDK}..."; + if [ -d ${BOOT_JDK} -a -x ${BOOT_JDK}/bin/java ] ; then + echo "Boot JDK found at ${BOOT_JDK}"; + else + echo "Not found"; + PREV_VER=$((${MAJOR_VER} - 1)); + BOOT_JDK=/usr/lib/jvm/java-${PREV_VER}-openjdk; + echo -n "Checking for ${BOOT_JDK}..."; + if [ -d ${BOOT_JDK} -a -x ${BOOT_JDK}/bin/java ] ; then + echo "Boot JDK found at ${BOOT_JDK}"; + else + echo "Not found"; + exit 4; + fi + fi +else + echo "Boot JDK: ${BOOT_JDK}"; +fi + +# REPO_NAME is only needed when we default on REPO_ROOT and FILE_NAME_ROOT +if [ "x$FILE_NAME_ROOT" = "x" -o "x$REPO_ROOT" = "x" ] ; then + if [ "x$PROJECT_NAME" = "x" ] ; then + echo "No PROJECT_NAME specified" + exit 1 + fi + echo "Project name: ${PROJECT_NAME}" + if [ "x$REPO_NAME" = "x" ] ; then + echo "No REPO_NAME specified" + exit 3 + fi + echo "Repository name: ${REPO_NAME}" +fi + +if [ "x$OPENJDK_URL" = "x" ] ; then + OPENJDK_URL=${OPENJDK_URL_DEFAULT} + echo "No OpenJDK URL specified; defaulting to ${OPENJDK_URL}" +else + echo "OpenJDK URL: ${OPENJDK_URL}" +fi + +if [ "x$COMPRESSION" = "x" ] ; then + # rhel 5 needs tar.gz + COMPRESSION=${COMPRESSION_DEFAULT} +fi +echo "Creating a tar.${COMPRESSION} archive" + +if [ "x$FILE_NAME_ROOT" = "x" ] ; then + FILE_NAME_ROOT=${PROJECT_NAME}-${REPO_NAME}-${VERSION} + echo "No file name root specified; default to ${FILE_NAME_ROOT}" +fi +if [ "x$REPO_ROOT" = "x" ] ; then + REPO_ROOT="${OPENJDK_URL}/${PROJECT_NAME}/${REPO_NAME}.git" + echo "No repository root specified; default to ${REPO_ROOT}" +fi; + +if [ "x$TO_COMPRESS" = "x" ] ; then + TO_COMPRESS="openjdk" + echo "No targets to be compressed specified, ; default to ${TO_COMPRESS}" +fi; + +echo -e "Settings:" +echo -e "\tVERSION: ${VERSION}" +echo -e "\tPROJECT_NAME: ${PROJECT_NAME}" +echo -e "\tREPO_NAME: ${REPO_NAME}" +echo -e "\tOPENJDK_URL: ${OPENJDK_URL}" +echo -e "\tCOMPRESSION: ${COMPRESSION}" +echo -e "\tFILE_NAME_ROOT: ${FILE_NAME_ROOT}" +echo -e "\tREPO_ROOT: ${REPO_ROOT}" +echo -e "\tTO_COMPRESS: ${TO_COMPRESS}" +echo -e "\tBOOT_JDK: ${BOOT_JDK}" + +if [ -d ${FILE_NAME_ROOT} ] ; then + echo "exists exists exists exists exists exists exists " + echo "reusing reusing reusing reusing reusing reusing " + echo ${FILE_NAME_ROOT} +else + mkdir "${FILE_NAME_ROOT}" + pushd "${FILE_NAME_ROOT}" + echo "Cloning ${VERSION} root repository from ${REPO_ROOT}" + git clone -b ${VERSION} ${REPO_ROOT} openjdk + popd +fi +pushd "${FILE_NAME_ROOT}" + # Generate .src-rev so build has knowledge of the revision the tarball was created from + mkdir build + pushd build + sh ${PWD}/../openjdk/configure --with-boot-jdk=${BOOT_JDK} + make store-source-revision + popd + rm -rf build + + # Remove commit checks + echo "Removing $(find openjdk -name '.jcheck' -print)" + find openjdk -name '.jcheck' -print0 | xargs -0 rm -rf + + # Remove history and GHA + echo "find openjdk -name '.hgtags'" + find openjdk -name '.hgtags' -exec rm -fv '{}' '+' + echo "find openjdk -name '.hgignore'" + find openjdk -name '.hgignore' -exec rm -fv '{}' '+' + echo "find openjdk -name '.gitattributes'" + find openjdk -name '.gitattributes' -exec rm -fv '{}' '+' + echo "find openjdk -name '.gitignore'" + find openjdk -name '.gitignore' -exec rm -fv '{}' '+' + echo "find openjdk -name '.git'" + find openjdk -name '.git' -exec rm -rfv '{}' '+' + echo "find openjdk -name '.github'" + find openjdk -name '.github' -exec rm -rfv '{}' '+' + + echo "Compressing remaining forest" + if [ "X$COMPRESSION" = "Xxz" ] ; then + SWITCH=cJf + else + SWITCH=czf + fi + TARBALL_NAME=${FILE_NAME_ROOT}.tar.${COMPRESSION} + tar --exclude-vcs -$SWITCH ${TARBALL_NAME} $TO_COMPRESS + mv ${TARBALL_NAME} .. +popd +echo "Done. You may want to remove the uncompressed version - $FILE_NAME_ROOT." diff --git a/icedtea_sync.sh b/icedtea_sync.sh new file mode 100755 index 0000000..e5c54f3 --- /dev/null +++ b/icedtea_sync.sh @@ -0,0 +1,192 @@ +#!/bin/bash + +# Copyright (C) 2019 Red Hat, Inc. +# Written by Andrew John Hughes . +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +ICEDTEA_USE_VCS=true + +ICEDTEA_VERSION=3.15.0 +ICEDTEA_URL=https://icedtea.classpath.org/download/source +ICEDTEA_SIGNING_KEY=CFDA0F9B35964222 + +ICEDTEA_HG_URL=https://icedtea.classpath.org/hg/icedtea11 + +set -e + +RPM_DIR=${PWD} +if [ ! -f ${RPM_DIR}/jconsole.desktop.in ] ; then + echo "Not in RPM source tree."; + exit 1; +fi + +if test "x${TMPDIR}" = "x"; then + TMPDIR=/tmp; +fi +WORKDIR=${TMPDIR}/it.sync + +echo "Using working directory ${WORKDIR}" +mkdir ${WORKDIR} +pushd ${WORKDIR} + +if test "x${WGET}" = "x"; then + WGET=$(which wget); + if test "x${WGET}" = "x"; then + echo "wget not found"; + exit 1; + fi +fi + +if test "x${TAR}" = "x"; then + TAR=$(which tar) + if test "x${TAR}" = "x"; then + echo "tar not found"; + exit 2; + fi +fi + +echo "Dependencies:"; +echo -e "\tWGET: ${WGET}"; +echo -e "\tTAR: ${TAR}\n"; + +if test "x${ICEDTEA_USE_VCS}" = "xtrue"; then + echo "Mode: Using VCS"; + + if test "x${GREP}" = "x"; then + GREP=$(which grep); + if test "x${GREP}" = "x"; then + echo "grep not found"; + exit 3; + fi + fi + + if test "x${CUT}" = "x"; then + CUT=$(which cut); + if test "x${CUT}" = "x"; then + echo "cut not found"; + exit 4; + fi + fi + + if test "x${TR}" = "x"; then + TR=$(which tr); + if test "x${TR}" = "x"; then + echo "tr not found"; + exit 5; + fi + fi + + if test "x${HG}" = "x"; then + HG=$(which hg); + if test "x${HG}" = "x"; then + echo "hg not found"; + exit 6; + fi + fi + + echo "Dependencies:"; + echo -e "\tGREP: ${GREP}"; + echo -e "\tCUT: ${CUT}"; + echo -e "\tTR: ${TR}"; + echo -e "\tHG: ${HG}"; + + echo "Checking out repository from VCS..."; + ${HG} clone ${ICEDTEA_HG_URL} icedtea + + echo "Obtaining version from configure.ac..."; + ROOT_VER=$(${GREP} '^AC_INIT' icedtea/configure.ac|${CUT} -d ',' -f 2|${TR} -d '[][:space:]') + echo "Root version from configure: ${ROOT_VER}"; + + VCS_REV=$(${HG} log -R icedtea --template '{node|short}' -r tip) + echo "VCS revision: ${VCS_REV}"; + + ICEDTEA_VERSION="${ROOT_VER}-${VCS_REV}" + echo "Creating icedtea-${ICEDTEA_VERSION}"; + mkdir icedtea-${ICEDTEA_VERSION} + echo "Copying required files from checkout to icedtea-${ICEDTEA_VERSION}"; + # Commented out for now as IcedTea 6's jconsole.desktop.in is outdated + #cp -a icedtea/jconsole.desktop.in ../icedtea-${ICEDTEA_VERSION} + cp -a ${RPM_DIR}/jconsole.desktop.in icedtea-${ICEDTEA_VERSION} + cp -a icedtea/tapset icedtea-${ICEDTEA_VERSION} + + rm -rf icedtea +else + echo "Mode: Using tarball"; + + if test "x${ICEDTEA_VERSION}" = "x"; then + echo "No IcedTea version specified for tarball download."; + exit 3; + fi + + if test "x${CHECKSUM}" = "x"; then + CHECKSUM=$(which sha256sum) + if test "x${CHECKSUM}" = "x"; then + echo "sha256sum not found"; + exit 4; + fi + fi + + if test "x${PGP}" = "x"; then + PGP=$(which gpg) + if test "x${PGP}" = "x"; then + echo "gpg not found"; + exit 5; + fi + fi + + echo "Dependencies:"; + echo -e "\tCHECKSUM: ${CHECKSUM}"; + echo -e "\tPGP: ${PGP}\n"; + + echo "Checking for IcedTea signing key ${ICEDTEA_SIGNING_KEY}..."; + if ! gpg --list-keys ${ICEDTEA_SIGNING_KEY}; then + echo "IcedTea signing key ${ICEDTEA_SIGNING_KEY} not installed."; + exit 6; + fi + + echo "Downloading IcedTea release tarball..."; + ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz + echo "Downloading IcedTea tarball signature..."; + ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz.sig + echo "Downloading IcedTea tarball checksums..."; + ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.sha256 + + echo "Verifying checksums..."; + ${CHECKSUM} --check --ignore-missing icedtea-${ICEDTEA_VERSION}.sha256 + + echo "Checking signature..."; + ${PGP} --verify icedtea-${ICEDTEA_VERSION}.tar.xz.sig + + echo "Extracting files..."; + ${TAR} xJf icedtea-${ICEDTEA_VERSION}.tar.xz \ + icedtea-${ICEDTEA_VERSION}/tapset \ + icedtea-${ICEDTEA_VERSION}/jconsole.desktop.in + + rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz + rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz.sig + rm -vf icedtea-${ICEDTEA_VERSION}.sha256 +fi + +echo "Replacing desktop files..."; +mv -v icedtea-${ICEDTEA_VERSION}/jconsole.desktop.in ${RPM_DIR} + +echo "Creating new tapset tarball..."; +mv -v icedtea-${ICEDTEA_VERSION} openjdk +${TAR} cJf ${RPM_DIR}/tapsets-icedtea-${ICEDTEA_VERSION}.tar.xz openjdk + +rm -rvf openjdk + +popd +rm -rf ${WORKDIR} diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index 16bb5eb..a1153c8 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -1,5 +1,10 @@ +%if (0%{?rhel} > 0 && 0%{?rhel} < 8) +# portable jdk 17 specific bug, _jvmdir being missing +%define _jvmdir /usr/lib/jvm +%endif + # debug_package %%{nil} is portable-jdks specific -%define debug_package %{nil} +%define debug_package %{nil} # RPM conditionals so as to be able to dynamically produce # slowdebug/release builds. See: @@ -24,19 +29,20 @@ %bcond_without release # Enable static library builds by default. %bcond_without staticlibs -# Remove build artifacts by default -%bcond_with artifacts # Build a fresh libjvm.so for use in a copy of the bootstrap JDK %bcond_without fresh_libjvm # Build with system libraries %bcond_with system_libs + +%if (0%{?rhel} > 0 && 0%{?rhel} < 8) # This is RHEL 7 specific as it doesn't seem to have the # __brp_strip_static_archive macro. -%if 0%{?rhel} == 7 %define __os_install_post %{nil} %endif +%global unpacked_licenses %{_datarootdir}/licenses + # Workaround for stripping of debug symbols from static libraries %if %{with staticlibs} %define __brp_strip_static_archive %{nil} @@ -60,8 +66,8 @@ # See: https://bugzilla.redhat.com/show_bug.cgi?id=1520879 %global _find_debuginfo_opts -g -# Disable LTO as this causes build failures at the moment. -# See RHBZ#1861401 +# With LTO flags enabled, debuginfo checks fail for some reason. Disable +# LTO for a passing build. This really needs to be looked at. %define _lto_cflags %{nil} # note: parametrized macros are order-sensitive (unlike not-parametrized) even with normal macros @@ -129,7 +135,7 @@ # Set of architectures for which we build fastdebug builds %global fastdebug_arches x86_64 ppc64le aarch64 # Set of architectures with a Just-In-Time (JIT) compiler -%global jit_arches %{arm} %{aarch64} %{ix86} %{power64} s390x sparcv9 sparc64 x86_64 riscv64 +%global jit_arches %{arm} %{aarch64} %{ix86} %{power64} s390x sparcv9 sparc64 x86_64 # Set of architectures which use the Zero assembler port (!jit_arches) %global zero_arches ppc s390 # Set of architectures which run a full bootstrap cycle @@ -139,18 +145,18 @@ # Set of architectures with a Ahead-Of-Time (AOT) compiler %global aot_arches x86_64 %{aarch64} # Set of architectures which support the serviceability agent -%global sa_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} %{arm} riscv64 +%global sa_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} %{arm} # Set of architectures which support class data sharing -# As of JDK-8005165 in OpenJDK 10, class sharing is not arch-specific -# However, it does segfault on the Zero assembler port, so currently JIT only -%global share_arches %{jit_arches} +# See https://bugzilla.redhat.com/show_bug.cgi?id=513605 +# MetaspaceShared::generate_vtable_methods is not implemented for the PPC JIT +%global share_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{arm} s390x # Set of architectures for which we build the Shenandoah garbage collector -%global shenandoah_arches x86_64 %{aarch64} riscv64 +%global shenandoah_arches x86_64 %{aarch64} # Set of architectures for which we build the Z garbage collector -%global zgc_arches x86_64 riscv64 +%global zgc_arches x86_64 # Set of architectures for which alt-java has SSB mitigation %global ssbd_arches x86_64 -# Set of architectures for which java has short vector math library (libjsvml.so) +# Set of architectures for which java has short vector math library (libsvml.so) %global svml_arches x86_64 # Set of architectures where we verify backtraces with gdb # s390x fails on RHEL 7 so we exclude it there @@ -159,10 +165,8 @@ %else %global gdb_arches %{jit_arches} %{zero_arches} %endif -# Architecture on which we run Java only tests -%global jdk_test_arch x86_64 -# By default, we build a slowdebug build during main build on JIT architectures +# By default, we build a debug build during main build on JIT architectures %if %{with slowdebug} %ifarch %{debug_arches} %global include_debug_build 1 @@ -228,100 +232,22 @@ # other targets since this target is configured to use in-tree # AWT dependencies: lcms, libjpeg, libpng, libharfbuzz, giflib # and possibly others -%global static_libs_target static-libs-graal-image +%global static_libs_target static-libs-image %else %global static_libs_target %{nil} %endif -# The static libraries are produced under the same configuration as the main -# build for portables, as we expect in-tree libraries to be used throughout. -# If system libraries are enabled, the static libraries will also use them -# which may cause issues. -%global bootstrap_targets images %{static_libs_target} legacy-jre-image -%global release_targets images docs-zip %{static_libs_target} legacy-jre-image +# RPM JDK builds keep the debug symbols internal, to be later stripped by RPM +%global debug_symbols internal + +# unlike portables,the rpms have to use static_libs_target very dynamically +%global bootstrap_targets images legacy-jre-image +%global release_targets images docs-zip legacy-jre-image # No docs nor bootcycle for debug builds -%global debug_targets images %{static_libs_target} legacy-jre-image +%global debug_targets images legacy-jre-image # Target to use to just build HotSpot %global hotspot_target hotspot - -# Individual build frameworks this specfile supports -# if elif ... elif ... elif ... else is unluckily buggy -# On rhel7 we need software collection -%if (0%{?rhel} == 7) -%global is_dtstoolchain collection -%global dtsversion 10 -%global dtsname devtoolset-%{dtsversion} -%global dts_command scl enable %{dtsname} -- -%global exclusive_arches %{nil} -%define dts_brs # Brs for collection\ -BuildRequires: %{dtsname}-gcc \ -BuildRequires: %{dtsname}-gcc-c++ -%else -# On rhel8 we have self built custom devkit -%if ((0%{?rhel} == 8) && (0%{?epel} == 0)) -%global is_dtstoolchain devkit -%global dtsversion 1.0-9 -%global dtsname %{origin}-devkit -%global dts_command %{nil} -%if 0%{?centos} == 0 -# centos had originally smaller set of devkit arches -%global exclusive_arches %{aarch64} %{ppc64le} s390x x86_64 riscv64 -%else -%global exclusive_arches %{aarch64} %{ppc64le} s390x x86_64 riscv64 -%endif -%define dts_brs # Brs for devkit\ -BuildRequires: %{dtsname} >= %{dtsversion} -%else -# On newest systems we use system gcc and friens -%if ((0%{?fedora} > 0) || (0%{?rhel} >= 9) || (0%{?epel} >= 9)) -%global is_dtstoolchain system -%global dtsversion %{nil} -%global dtsname %{nil} -%global exclusive_arches %{java_arches} -%define dts_brs # Brs for system\ -BuildRequires: gcc >= 4.8.3-8 \ -BuildRequires: gcc-c++ \ -# We link statically against libstdc++ to increase portability \ -BuildRequires: libstdc++-static -# When building on epel8, we need system, legacy toolchain of explicit version -%else -%if ((0%{?epel}) > 0 && (0%{?epel} <= 8)) -%global is_dtstoolchain toolset -%global dtsversion 14 -%global dtsname gcc-toolset-%{dtsversion} -%global exclusive_arches %{java_arches} -%define dts_brs # Brs for toolset\ -BuildRequires: %{dtsname}-gcc \ -BuildRequires: %{dtsname}-gcc-c++ \ -BuildRequires: %{dtsname}-annobin-annocheck \ -BuildRequires: %{dtsname}-annobin-plugin-gcc \ -BuildRequires: %{dtsname}-binutils \ -BuildRequires: %{dtsname}-gcc-plugin-annobin \ -# We link statically against libstdc++ to increase portability \ -BuildRequires: libstdc++-static -# no go -%else -"Unsupported system: fedora=0%{?fedora} rhel=0%{?rhel} epel=0%{?epel} centos=0%{?centos}" -exit 1 -%endif -%endif -%endif -%endif - -%if ((0%{?epel}) > 0 || (0%{?fedora} > 8)) -%global use_portable_bootjdk 0 -%else -%global use_portable_bootjdk 1 -%endif - -# Check if pandoc is available to generate docs (including man pages) -%if 0%{?rhel} == 8 || 0%{?epel} > 0 || 0%{?fedora} > 0 -%global pandoc_available 1 -%else -%global pandoc_available 0 -%endif - # Filter out flags from the optflags macro that cause problems with the OpenJDK build # We filter out -O flags so that the optimization of HotSpot is not lowered from O3 to O2 # We filter out -Wall which will otherwise cause HotSpot to produce hundreds of thousands of warnings (100+mb logs) @@ -331,6 +257,12 @@ exit 1 %global ourcppflags %(echo %ourflags | sed -e 's|-fexceptions||') %global ourldflags %{__global_ldflags} +# With disabled nss is NSS deactivated, so NSS_LIBDIR can contain the wrong path +# the initialization must be here. Later the pkg-config have buggy behavior +# looks like openjdk RPM specific bug +# Always set this so the nss.cfg file is not broken +%global NSS_LIBDIR %(pkg-config --variable=libdir nss) + # In some cases, the arch used by the JDK does # not match _arch. # Also, in some cases, the machine name used by SystemTap @@ -375,10 +307,6 @@ exit 1 %global archinstall aarch64 %global stapinstall arm64 %endif -%ifarch riscv64 -%global archinstall riscv64 -%global stapinstall %{_target_cpu} -%endif # 32 bit sparc, optimized for v9 %ifarch sparcv9 %global archinstall sparc @@ -395,8 +323,7 @@ exit 1 %global stapinstall %{nil} %endif -# on fedora and epel, we build systemtap in repacking to rpms -# thus having it disabled, and keeping the lines just for sync reasons +# always off for portable builds %ifarch %{systemtap_arches} %global with_systemtap 0 %else @@ -404,22 +331,32 @@ exit 1 %endif # New Version-String scheme-style defines -%global featurever 26 +%global featurever 20 %global interimver 0 -%global updatever 0 +%global updatever 1 %global patchver 0 # buildjdkver is usually same as %%{featurever}, # but in time of bootstrap of next jdk, it is featurever-1, # and this it is better to change it here, on single place -%global buildjdkver 25 +%global buildjdkver %{featurever} # We don't add any LTS designator for STS packages (Fedora and EPEL). # We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined. %if 0%{?rhel} && !0%{?epel} %global lts_designator "LTS" %global lts_designator_zip -%{lts_designator} %else - %global lts_designator "" - %global lts_designator_zip "" + %global lts_designator "" + %global lts_designator_zip "" +%endif +# JDK to use for bootstrapping +%global bootjdk /usr/lib/jvm/java-%{buildjdkver}-openjdk +# Define whether to use the bootstrap JDK directly or with a fresh libjvm.so +# This will only work where the bootstrap JDK is the same major version +# as the JDK being built +%if %{with fresh_libjvm} && %{buildjdkver} == %{featurever} +%global build_hotspot_first 1 +%else +%global build_hotspot_first 0 %endif # Define vendor information used by OpenJDK @@ -428,41 +365,33 @@ exit 1 # Define what url should JVM offer in case of a crash report # order may be important, epel may have rhel declared %if 0%{?epel} -%global oj_vendor_bug_url https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora%20EPEL&component=%{component}&version=epel%{epel} +%global oj_vendor_bug_url https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora%20EPEL&component=%{name}&version=epel%{epel} %else %if 0%{?fedora} # Does not work for rawhide, keeps the version field empty -%global oj_vendor_bug_url https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=%{component}&version=%{fedora} +%global oj_vendor_bug_url https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=%{name}&version=%{fedora} %else %if 0%{?rhel} -%global oj_vendor_bug_url https://access.redhat.com/support/cases/ +%global oj_vendor_bug_url https://bugzilla.redhat.com/enter_bug.cgi?product=Red%20Hat%20Enterprise%20Linux%20%{rhel}&component=%{name} %else %global oj_vendor_bug_url https://bugzilla.redhat.com/enter_bug.cgi %endif %endif %endif -%global oj_vendor_version (Red_Hat-%{version}-%{rpmrelease}) +%global oj_vendor_version (Red_Hat-%{version}-%{release}) # Define IcedTea version used for SystemTap tapsets and desktop file %global icedteaver 6.0.0pre00-c848b93a8598 # Define current Git revision for the FIPS support patches -%global fipsver df044414ef4 -# Define JDK versions -%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver} -%global javaver %{featurever} -# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames -%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn}) -# The tag used to create the OpenJDK tarball -%global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}} +%global fipsver fd3de3d95b5 # Standard JPackage naming and versioning defines %global origin openjdk %global origin_nice OpenJDK -%global top_level_dir_name %{vcstag} +%global top_level_dir_name %{origin} %global top_level_dir_name_backup %{top_level_dir_name}-backup -%global buildver 29 -%global rpmrelease 1 -#%%global tagsuffix %%{nil} +%global buildver 9 +%global rpmrelease 3 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit %if %is_system_jdk # Using 10 digits may overflow the int used for priority, so we combine the patch and build versions @@ -475,16 +404,24 @@ exit 1 # for techpreview, using 1, so slowdebugs can have 0 %global priority %( printf '%08d' 1 ) %endif +%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver} +%global javaver %{featurever} + +# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames +%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn}) + +# The tag used to create the OpenJDK tarball +%global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}} # Define milestone (EA for pre-releases, GA for releases) # Release will be (where N is usually a number starting at 1): # - 0.N%%{?extraver}%%{?dist} for EA releases, # - N%%{?extraver}{?dist} for GA releases -%global is_ga 0 +%global is_ga 1 %if %{is_ga} %global build_type GA %global ea_designator "" -%global ea_designator_zip %{nil} +%global ea_designator_zip "" %global extraver %{nil} %global eaprefix %{nil} %else @@ -500,75 +437,40 @@ exit 1 %global fullversion %{compatiblename}-%{version}-%{release} # images directories from upstream build %global jdkimage jdk -%global static_libs_image static-libs-graal +%global static_libs_image static-libs +# installation directory for static libraries +%global static_libs_root lib/static +%global static_libs_arch_dir %{static_libs_root}/linux-%{archinstall} +%global static_libs_install_dir %{static_libs_arch_dir}/glibc # output dir stub %define buildoutputdir() %{expand:build/jdk%{featurever}.build%{?1}} -%define installoutputdir() %{expand:install/jdk%{featurever}.install%{?1}} -%global miscinstalloutputdir install -%global altjavaoutputdir %{miscinstalloutputdir}/altjava.install -%define packageoutputdir() %{expand:packages/jdk%{featurever}.packages%{?1}} # we can copy the javadoc to not arched dir, or make it not noarch %define uniquejavadocdir() %{expand:%{fullversion}.%{_arch}%{?1}} # main id and dir of this jdk %define uniquesuffix() %{expand:%{fullversion}.%{_arch}%{?1}} # portable only declarations %global jreimage jre -%if ((0%{?fedora} > 0) || (0%{?epel} > 0)) -%define regexBase %{version}-%{release} +%if (0%{?rhel} > 0 && 0%{?rhel} < 8) +%define jreportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;el7\\(_[0-9]\\)*;portable%{1}.jre.;g" | sed "s;openjdkportable;el;g") +%define jdkportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;el7\\(_[0-9]\\)*;portable%{1}.jdk.;g" | sed "s;openjdkportable;el;g") +%define jdkportablesourcesnameimpl() %(echo %{uniquesuffix ""} | sed "s;el7\\(_[0-9]\\)*;portable%{1}.sources.;g" | sed "s;openjdkportable;el;g" | sed "s;.%{_arch};.noarch;g") +%define staticlibsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;el7\\(_[0-9]\\)*;portable%{1}.static-libs.;g" | sed "s;openjdkportable;el;g") %else -%define regexBase el%{rhel}\\(_[0-9]\\)* +%define jreportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;fc\\([0-9]\\)*;\\0.portable%{1}.jre;g" | sed "s;openjdkportable;el;g") +%define jdkportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;fc\\([0-9]\\)*;\\0.portable%{1}.jdk;g" | sed "s;openjdkportable;el;g") +%define jdkportablesourcesnameimpl() %(echo %{uniquesuffix ""} | sed "s;fc\\([0-9]\\)*;\\0.portable%{1}.sources;g" | sed "s;openjdkportable;el;g" | sed "s;.%{_arch};.noarch;g") +%define staticlibsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;fc\\([0-9]\\)*;\\0.portable%{1}.static-libs;g" | sed "s;openjdkportable;el;g") %endif -%define jreportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.jre;g" | sed "s;openjdkportable;el;g") -%define jdkportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.jdk;g" | sed "s;openjdkportable;el;g") -%define jdkportablesourcesnameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.sources;g" | sed "s;openjdkportable;el;g" | sed "s;.%{_arch};.noarch;g") -%define staticlibsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.static-libs;g" | sed "s;openjdkportable;el;g") -%define jmodsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.jmods;g" | sed "s;openjdkportable;el;g") %define jreportablearchive() %{expand:%{jreportablenameimpl -- %%{1}}.tar.xz} %define jdkportablearchive() %{expand:%{jdkportablenameimpl -- %%{1}}.tar.xz} %define jdkportablesourcesarchive() %{expand:%{jdkportablesourcesnameimpl -- %%{1}}.tar.xz} %define staticlibsportablearchive() %{expand:%{staticlibsportablenameimpl -- %%{1}}.tar.xz} -%define jmodsportablearchive() %{expand:%{jmodsportablenameimpl -- %%{1}}.tar.xz} %define jreportablename() %{expand:%{jreportablenameimpl -- %%{1}}} %define jdkportablename() %{expand:%{jdkportablenameimpl -- %%{1}}} %define jdkportablesourcesname() %{expand:%{jdkportablesourcesnameimpl -- %%{1}}} # Intentionally use jdkportablenameimpl here since we want to have static-libs files overlayed on # top of the JDK archive %define staticlibsportablename() %{expand:%{jdkportablenameimpl -- %%{1}}} -%define docportablename() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable.docs;g" | sed "s;openjdkportable;el;g") -%define docportablearchive() %{docportablename}.tar.xz -%define miscportablename() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable.misc;g" | sed "s;openjdkportable;el;g") -%define miscportablearchive() %{miscportablename}.tar.xz - -# RPM 4.19 no longer accept our double percentaged %%{nil} passed to %%{1} -# so we have to pass in "" but evaluate it, otherwise files record will include it -%define jreportablearchiveForFiles() %(echo %{jreportablearchive -- ""}) -%define jdkportablearchiveForFiles() %(echo %{jdkportablearchive -- ""}) -%define jdkportablesourcesarchiveForFiles() %(echo %{jdkportablesourcesarchive -- ""}) -%define staticlibsportablearchiveForFiles() %(echo %{staticlibsportablearchive -- ""}) -%define jmodsportablearchiveForFiles() %(echo %{jmodsportablearchive -- ""}) - -# JDK to use for bootstrapping -%ifarch %{fastdebug_arches} -%global bootdebugpkg fastdebug -%endif -%if %{use_portable_bootjdk} -%global bootjdkpkg_name java-%{featurever}-%{origin} -%global bootjdkpkg %{bootjdkpkg_name}-portable-devel%{?bootdebugpkg:-%{bootdebugpkg}} >= %{buildjdkver} -%global bootjdkzip %{_jvmdir}/%{bootjdkpkg_name}-*.portable%{?bootdebugpkg:.%{bootdebugpkg}}.jdk.%{_arch}.tar.xz -%global bootjdk %{_builddir}/%{uniquesuffix -- ""}/%{bootjdkpkg_name}.boot -%else -%global bootjdkpkg_name java-latest-openjdk -%global bootjdkpkg %{bootjdkpkg_name}-devel%{?bootdebugpkg:-%{bootdebugpkg}} -%global bootjdk /usr/lib/jvm/%{bootjdkpkg_name}%{?bootdebugpkg:-%{bootdebugpkg}} -%endif -# Define whether to use the bootstrap JDK directly or with a fresh libjvm.so -# This will only work where the bootstrap JDK is the same major version -# as the JDK being built -%if %{with fresh_libjvm} && %{buildjdkver} == %{featurever} -%global build_hotspot_first 1 -%else -%global build_hotspot_first 0 -%endif ################################################################# # fix for https://bugzilla.redhat.com/show_bug.cgi?id=1111349 @@ -590,12 +492,6 @@ exit 1 %global __requires_exclude ^(%{_privatelibs}|%{_publiclibs})$ %endif -# VM variant being built -%ifarch %{zero_arches} -%global vm_variant zero -%else -%global vm_variant server -%endif %global etcjavasubdir %{_sysconfdir}/java/java-%{javaver}-%{origin} %define etcjavadir() %{expand:%{etcjavasubdir}/%{uniquesuffix -- %{?1}}} @@ -607,7 +503,6 @@ exit 1 %define jrebindir() %{expand:%{_jvmdir}/%{sdkdir -- %{?1}}/bin} %global alt_java_name alt-java -%global generated_sources_name generated_sources %global rpm_state_dir %{_localstatedir}/lib/rpm-state/ @@ -619,8 +514,29 @@ exit 1 %global alternatives_requires %{_sbindir}/alternatives %endif -# Portables have no repo (requires/provides), but these are awesome for orientation in spec -# Also scriptlets are happily missing and files are handled old fashion +%if %{with_systemtap} +# Where to install systemtap tapset (links) +# We would like these to be in a package specific sub-dir, +# but currently systemtap doesn't support that, so we have to +# use the root tapset dir for now. To distinguish between 64 +# and 32 bit architectures we place the tapsets under the arch +# specific dir (note that systemtap will only pickup the tapset +# for the primary arch for now). Systemtap uses the machine name +# aka target_cpu as architecture specific directory name. +%global tapsetroot /usr/share/systemtap +%global tapsetdirttapset %{tapsetroot}/tapset/ +%global tapsetdir %{tapsetdirttapset}/%{stapinstall} +%endif + +# x86 is no longer supported +%if 0%{?java_arches:1} +ExclusiveArch: %{java_arches} +%else +ExcludeArch: %{ix86} +%endif + +# Portables have no rpo (requires/provides), but thsoe are awesome for orientation in spec +# also scriptlets are hapily missing and files are handled old fashion # not-duplicated requires/provides/obsoletes for normal/debug packages %define java_rpo() %{expand: } @@ -631,29 +547,15 @@ exit 1 %define java_static_libs_rpo() %{expand: } -%define java_docs_rpo() %{expand: -} - -%define java_misc_rpo() %{expand: -} # Prevent brp-java-repack-jars from being run %global __jar_repack 0 # portables have grown out of its component, moving back to java-x-vendor # this expression, when declared as global, filled component with java-x-vendor portable -%define component %(echo %{name} | sed "s;-portable%{?pkgos:-%{pkgos}};;g") +%define component %(echo %{name} | sed "s;-portable;;g") -# Define the architectures on which we build -# On RHEL, this should be the architectures with a devkit -%if "%{?exclusive_arches}" == "%{nil}" -# x86 is no longer supported -ExcludeArch: %{ix86} -%else -ExclusiveArch: %{exclusive_arches} -%endif - -Name: java-latest-%{origin}-portable%{?pkgos:-%{pkgos}} +Name: java-latest-%{origin}-portable Version: %{newjavaver}.%{buildver} # This package needs `.rolling` as part of Release so as to not conflict on install with # java-X-openjdk. I.e. when latest rolling release is also an LTS release packaged as @@ -690,12 +592,12 @@ Group: Development/Languages # The test code includes copies of NSS under the Mozilla Public License v2.0 # The PCSClite headers are under a BSD with advertising license # The elliptic curve cryptography (ECC) source code is licensed under the LGPLv2.1 or any later version -# Automatically converted from old format: ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA - review is highly recommended. -License: Apache-1.1 AND Apache-2.0 AND LicenseRef-Callaway-BSD AND LicenseRef-Callaway-BSD-with-advertising AND GPL-1.0-or-later AND GPL-2.0-only AND LicenseRef-Callaway-GPLv2-with-exceptions AND IJG AND LicenseRef-Callaway-LGPLv2+ AND LicenseRef-Callaway-MIT AND MPL-2.0 AND LicenseRef-Callaway-Public-Domain AND W3C AND Zlib AND ISC AND FTL AND LicenseRef-RSA +License: ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA URL: http://openjdk.java.net/ + # The source tarball, generated using generate_source_tarball.sh -Source0: https://openjdk-sources.osci.io/openjdk%{featurever}/open%{vcstag}%{ea_designator_zip}.tar.xz +Source0: openjdk-jdk%{featurever}u-%{vcstag}.tar.xz # Use 'icedtea_sync.sh' to update the following # They are based on code contained in the IcedTea project (6.x). @@ -710,11 +612,12 @@ Source0: https://openjdk-sources.osci.io/openjdk%{featurever}/open%{vcstag}%{ea_ # Release notes Source10: NEWS -# Source code for alt-java -Source11: alt-java.c +# nss configuration file +Source11: nss.cfg.in # Removed libraries that we link instead -Source12: remove-intree-libraries.sh +# Disabled in portables +#Source12: remove-intree-libraries.sh # Ensure we aren't using the limited crypto policy Source13: TestCryptoLevel.java @@ -728,20 +631,44 @@ Source15: TestSecurityProperties.java # Ensure vendor settings are correct Source16: CheckVendor.java +# nss fips configuration file +Source17: nss.fips.cfg.in + # Ensure translations are available for new timezones Source18: TestTranslations.java +%if (0%{?rhel} > 0 && 0%{?rhel} < 8) +# boot jdk for portable build root on +Source1001: ojdk17-aarch64-17.35.tar.gz +Source1002: ojdk17-ppc64le-17.35.tar.gz +Source1003: ojdk17-x86_64-17.35.tar.gz +Source1004: ojdk17-s390x-17.35.tar.gz +%endif + ############################################ # # RPM/distribution specific patches # ############################################ + +# NSS via SunPKCS11 Provider (disabled comment +# due to memory leak). +Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch +# RH1750419: enable build of speculative store bypass hardened alt-java (CVE-2018-3639) +Patch600: rh1750419-redhat_alt_java.patch + +# Ignore AWTError when assistive technologies are loaded +Patch1: rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch +# Restrict access to java-atk-wrapper classes +Patch2: rh1648644-java_access_bridge_privileged_security.patch +Patch3: rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch +# Depend on pcsc-lite-libs instead of pcsc-lite-devel as this is only in optional repo +Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch + # Crypto policy and FIPS support patches -# Patch is generated from the fips-25u tree at https://github.com/rh-openjdk/jdk/tree/fips-25u -# as follows: git diff %%{vcstag} src make test > fips-25u-$(git show -s --format=%h HEAD).patch +# Patch is generated from the fips-20u tree at https://github.com/rh-openjdk/jdk/tree/fips-20u +# as follows: git diff %%{vcstag} src make > fips-20u-$(git show -s --format=%h HEAD).patch # Diff is limited to src and make subdirectories to exclude .github changes -# The following list is generated by: -# git log %%{vcstag}.. --no-merges --format=%s --reverse: # Fixes currently included: # PR3183, RH1340845: Follow system wide crypto policy # PR3695: Allow use of system crypto policy to be disabled by the user @@ -764,18 +691,7 @@ Source18: TestTranslations.java # RH2104724: Avoid import/export of DH private keys # RH2092507: P11Key.getEncoded does not work for DH keys in FIPS mode # Build the systemconf library on all platforms -# RH2048582: Support PKCS#12 keystores [now part of JDK-8301553 upstream] -# RH2020290: Support TLS 1.3 in FIPS mode -# Add nss.fips.cfg support to OpenJDK tree -# RH2117972: Extend the support for NSS DBs (PKCS11) in FIPS mode -# Remove forgotten dead code from RH2020290 and RH2104724 -# OJ1357: Fix issue on FIPS with a SecurityManager in place -# RH2134669: Add missing attributes when registering services in FIPS mode. -# test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class -# RH1940064: Enable XML Signature provider in FIPS mode -# RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized [now part of JDK-8301553 upstream] -# usage in jdk >25 is experimental and may disapear -Patch1001: fips-25u-%{fipsver}.patch +Patch1001: fips-20u-%{fipsver}.patch ############################################# # @@ -783,23 +699,12 @@ Patch1001: fips-25u-%{fipsver}.patch # ############################################# -# Currently empty - ############################################# # # OpenJDK patches which missed last update # ############################################# - -Patch1: JDK-8373246-8351842_broke_native_debugging_on_Linux.patch - -############################################# -# -# Portable build specific patches -# -############################################# - -# Currently empty +#empty now BuildRequires: autoconf BuildRequires: automake @@ -809,10 +714,22 @@ BuildRequires: cups-devel BuildRequires: desktop-file-utils # elfutils only are OK for build without AOT BuildRequires: elfutils-devel -BuildRequires: file BuildRequires: fontconfig-devel -%{dts_brs} +BuildRequires: freetype-devel +%if (0%{?rhel} > 0 && 0%{?rhel} < 8) +BuildRequires: devtoolset-8-gcc +BuildRequires: devtoolset-8-gcc-c++ +%else +BuildRequires: gcc +# gcc-c++ is already needed +BuildRequires: java-%{buildjdkver}-openjdk-devel +%endif +BuildRequires: gcc-c++ BuildRequires: gdb +%if (0%{?rhel} > 0 && 0%{?rhel} < 8) +# rhel7 only, portables only. Rhel8 have gtk3, rpms have runtime recommends of gtk +BuildRequires: gtk2-devel +%endif BuildRequires: libxslt BuildRequires: libX11-devel BuildRequires: libXi-devel @@ -821,31 +738,35 @@ BuildRequires: libXrandr-devel BuildRequires: libXrender-devel BuildRequires: libXt-devel BuildRequires: libXtst-devel -# Requirement for setting up nss.fips.cfg +# Requirement for setting up nss.cfg and nss.fips.cfg BuildRequires: nss-devel # Requirement for system security property test -# N/A for portable as we don't enable support for them -#BuildRequires: crypto-policies +%if (0%{?rhel} > 0 && 0%{?rhel} < 8) +BuildRequires: crypto-policies +%endif BuildRequires: pkgconfig BuildRequires: xorg-x11-proto-devel BuildRequires: zip # to pack portable tarballs BuildRequires: tar BuildRequires: unzip +%if (0%{?rhel} > 0 && 0%{?rhel} < 8) +# No javapackages-filesystem on el7,nor is needed for portables +%else BuildRequires: javapackages-filesystem -BuildRequires: %{bootjdkpkg} +BuildRequires: java-latest-openjdk-devel +%endif # Zero-assembler build requirement %ifarch %{zero_arches} BuildRequires: libffi-devel %endif -# Full documentation build requirements -# pandoc is only available on RHEL/CentOS 8, epels, and fedoras -%if %{pandoc_available} -BuildRequires: graphviz -BuildRequires: pandoc -%endif +# 2022g required as of JDK-8297804 +BuildRequires: tzdata-java >= 2022g + # cacerts build requirement in portable mode BuildRequires: ca-certificates +# Earlier versions have a bug in tree vectorization on PPC +BuildRequires: gcc >= 4.8.3-8 %if %{with_systemtap} BuildRequires: systemtap-sdt-devel @@ -859,22 +780,21 @@ BuildRequires: harfbuzz-devel BuildRequires: lcms2-devel BuildRequires: libjpeg-devel BuildRequires: libpng-devel -BuildRequires: zlib-devel %else -# Version in src/java.desktop/share/legal/freetype.md -Provides: bundled(freetype) = 2.13.3 +# Version in src/java.desktop/share/native/libfreetype/include/freetype/freetype.h +Provides: bundled(freetype) = 2.12.1 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h -Provides: bundled(giflib) = 5.2.2 +Provides: bundled(giflib) = 5.2.1 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h -Provides: bundled(harfbuzz) = 10.4.0 +Provides: bundled(harfbuzz) = 4.4.1 # Version in src/java.desktop/share/native/liblcms/lcms2.h -Provides: bundled(lcms2) = 2.17.0 +Provides: bundled(lcms2) = 2.12.0 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h Provides: bundled(libjpeg) = 6b # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h -Provides: bundled(libpng) = 1.6.47 -# Version in src/java.base/share/native/libzip/zlib/zlib.h -Provides: bundled(zlib) = 1.3.1 +Provides: bundled(libpng) = 1.6.37 +# We link statically against libstdc++ to increase portability +BuildRequires: libstdc++-static %endif # this is always built, also during debug-only build @@ -947,7 +867,7 @@ Group: Development/Tools %{java_devel_rpo -- %{fastdebug_suffix_unquoted}} %description devel-fastdebug -The %{origin_nice} %{featurever} runtime environment and development tools - portable edition +The %{origin_nice} %{featurever} development tools - portable edition. %{fastdebug_warning} %endif @@ -955,7 +875,7 @@ The %{origin_nice} %{featurever} runtime environment and development tools - por %if %{include_normal_build} %package static-libs -Summary: %{origin_nice} %{featurever} libraries for static linking - portable edition +Summary: %{origin_nice} %{featurever} libraries for static linking - portable edition. %{java_static_libs_rpo %{nil}} @@ -970,7 +890,7 @@ Summary: %{origin_nice} %{featurever} libraries for static linking - portable ed %{java_static_libs_rpo -- %{debug_suffix_unquoted}} %description static-libs-slowdebug -The %{origin_nice} %{featurever} libraries for static linking - portable edition +The %{origin_nice} %{featurever} libraries for static linking - portable edition. %{debug_warning} %endif @@ -981,31 +901,13 @@ Summary: %{origin_nice} %{featurever} libraries for static linking - portable ed %{java_static_libs_rpo -- %{fastdebug_suffix_unquoted}} %description static-libs-fastdebug -The %{origin_nice} %{featurever} libraries for static linking - portable edition +The %{origin_nice} %{featurever} libraries for static linking - portable edition. %{fastdebug_warning} %endif # staticlibs %endif -%if %{include_normal_build} -%package docs -Summary: %{origin_nice} %{featurever} API documentation - -%{java_docs_rpo %{nil}} - -%description docs -The %{origin_nice} %{featurever} API documentation. - -%package misc -Summary: %{origin_nice} %{featurever} miscellany - -%{java_misc_rpo %{nil}} - -%description misc -The %{origin_nice} %{featurever} miscellany. -%endif - %package sources Summary: %{origin_nice} %{featurever} full patched sources of portable JDK @@ -1014,13 +916,11 @@ The %{origin_nice} %{featurever} full patched sources of portable JDK to build, %prep -# Using the echo macro breaks rpmdev-bumpspec, as it parses the first line of stdout :-( echo "Preparing %{oj_vendor_version}" -echo "System is RHEL=%{?rhel}%{!?rhel:0}, CentOS=%{?centos}%{!?centos:0}, EPEL=%{?epel}%{!?epel:0}, Fedora=%{?fedora}%{!?fedora:0}" -echo "Build JDK version is %{buildjdkver}, bootstrap JDK package is %{bootjdkpkg}" -%if 0%{?_build_cpu:1} - echo "CPU: %{_target_cpu}, arch install directory: %{archinstall}, SystemTap install directory: %{_build_cpu}" +# Using the echo macro breaks rpmdev-bumpspec, as it parses the first line of stdout :-( +%if 0%{?stapinstall:1} + echo "CPU: %{_target_cpu}, arch install directory: %{archinstall}, SystemTap install directory: %{stapinstall}" %else %{error:Unrecognised architecture %{_target_cpu}} %endif @@ -1043,17 +943,17 @@ else echo "include_fastdebug_build is %{include_fastdebug_build}, that is invalid. Use 1 for yes or 0 for no" exit 13 fi + if [ %{include_debug_build} -eq 0 -a %{include_normal_build} -eq 0 -a %{include_fastdebug_build} -eq 0 ] ; then echo "You have disabled all builds (normal,fastdebug,slowdebug). That is a no go." exit 14 fi %if %{with fresh_libjvm} && ! %{build_hotspot_first} -%{warn: The build of a fresh libjvm has been disabled due to a JDK version mismatch} -%{warn: Build JDK version is %{buildjdkver}, feature JDK version is %{featurever}} +echo "WARNING: The build of a fresh libjvm has been disabled due to a JDK version mismatch" +echo "Build JDK version is %{buildjdkver}, feature JDK version is %{featurever}" %endif -export XZ_OPT="-T0" %setup -q -c -n %{uniquesuffix ""} -T -a 0 # https://bugzilla.redhat.com/show_bug.cgi?id=1189084 prioritylength=`expr length %{priority}` @@ -1063,38 +963,25 @@ if [ $prioritylength -ne 8 ] ; then fi # OpenJDK patches + %if %{system_libs} # Remove libraries that are linked by both static and dynamic builds sh %{SOURCE12} %{top_level_dir_name} %endif # Patch the JDK -# This syntax is deprecated: -# %%patchN [...] -# and should be replaced with: -# %%patch -PN [...] -# For example: -# %%patch1001 -p1 -# becomes: -# %%patch -P1001 -p1 -# The replacement format suggested by recent (circa Fedora 38) RPM -# deprecation messages: -# %%patch N [...] -# is not backward-compatible with prior (circa RHEL-8) versions of -# rpmbuild. pushd %{top_level_dir_name} +%patch1 -p1 +%patch2 -p1 +%patch3 -p1 +%patch6 -p1 # Add crypto policy and FIPS support -# usage in jdk >25 is experimental and may disapear -%patch -P1001 -p1 -%patch -P1 -p1 +%patch1001 -p1 +# nss.cfg PKCS11 support; must come last as it also alters java.security +%patch1000 -p1 popd # openjdk -echo "Generating %{alt_java_name} man page" -altjavamanpage=%{top_level_dir_name}/src/java.base/share/man/%{alt_java_name}.md -altjavatext="Hardened java binary recommended for launching untrusted code from the Web e.g. javaws" -sed -r -e 's|([^/.])java([^./])|\1alt-java\2|g' %{top_level_dir_name}/src/java.base/share/man/java.md | \ - sed -e 's|JAVA(|ALT-JAVA(|' | \ - sed -e "s|java - launch a Java application|alt-java - ${altjavatext}|" >> ${altjavamanpage} +%patch600 # The OpenJDK version file includes the current # upstream version information. For some reason, @@ -1116,41 +1003,66 @@ if [ "x${UPSTREAM_EA_DESIGNATOR}" != "x%{ea_designator}" ] ; then exit 17 fi -# Systemtap is processed in rpms on fedoras and epels +# Extract systemtap tapsets +%if %{with_systemtap} +tar --strip-components=1 -x -I xz -f %{SOURCE8} +%if %{include_debug_build} +cp -r tapset tapset%{debug_suffix} +%endif +%if %{include_fastdebug_build} +cp -r tapset tapset%{fastdebug_suffix} +%endif + +for suffix in %{build_loop} ; do + for file in "tapset"$suffix/*.in; do + OUTPUT_FILE=`echo $file | sed -e "s:\.stp\.in$:-%{version}-%{release}.%{_arch}.stp:g"` + sed -e "s:@ABS_SERVER_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/server/libjvm.so:g" $file > $file.1 + sed -e "s:@JAVA_SPEC_VER@:%{javaver}:g" $file.1 > $file.2 +# TODO find out which architectures other than i686 have a client vm +%ifarch %{ix86} + sed -e "s:@ABS_CLIENT_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/client/libjvm.so:g" $file.2 > $OUTPUT_FILE +%else + sed -e "/@ABS_CLIENT_LIBJVM_SO@/d" $file.2 > $OUTPUT_FILE +%endif + sed -i -e "s:@ABS_JAVA_HOME_DIR@:%{_jvmdir}/%{sdkdir -- $suffix}:g" $OUTPUT_FILE + sed -i -e "s:@INSTALL_ARCH_DIR@:%{archinstall}:g" $OUTPUT_FILE + sed -i -e "s:@prefix@:%{_jvmdir}/%{sdkdir -- $suffix}/:g" $OUTPUT_FILE + done +done +# systemtap tapsets ends +%endif # Prepare desktop files # Portables do not have desktop integration -# Extract devkit -%if "%{is_dtstoolchain}" == "devkit" - devkittarball=%{_datadir}/%{dtsname}/sdk-%{_target_cpu}-%{_target_os}-gnu*.tar.gz - echo "Extracting devkit ${devkittarball}"; - mkdir devkit; - tar -C devkit --strip-components=1 -xzf ${devkittarball} - DEVKIT_ROOT=$(pwd)/devkit - source ${DEVKIT_ROOT}/devkit.info - echo "Installed ${DEVKIT_NAME} devkit" -%else -%if 0%{?centos} > 0 - echo "No devkit for CentOS %{?centos}" -%else - echo "No devkit for %{_target_cpu} on RHEL %{?rhel}"; -%endif -%endif +# Setup nss.cfg +sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE11} > nss.cfg -%if %{use_portable_bootjdk} - # Extract build JDK - pushd %{_jvmdir} - sha256sum --check %{bootjdkzip}.sha256sum - popd - tar -xJf %{bootjdkzip} - mv java-%{featurever}-openjdk-%{buildjdkver}* %{bootjdk} - # Print release information - echo "Installed boot JDK:" - cat %{bootjdk}/release -%endif +# Setup nss.fips.cfg +sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE17} > nss.fips.cfg %build +%if (0%{?rhel} > 0 && 0%{?rhel} < 8) +mkdir bootjdk +pushd bootjdk +%ifarch %{aarch64} +tar --strip-components=1 -xf %{SOURCE1001} +%endif +%ifarch %{ppc64le} +tar --strip-components=1 -xf %{SOURCE1002} +%endif +%ifarch x86_64 +tar --strip-components=1 -xf %{SOURCE1003} +%endif +%ifarch s390x +tar --strip-components=1 -xf %{SOURCE1004} +%endif +BOOT_JDK=$PWD +popd +%else +BOOT_JDK=%{bootjdk} +%endif + # How many CPU's do we have? export NUM_PROC=%(/usr/bin/getconf _NPROCESSORS_ONLN 2> /dev/null || :) export NUM_PROC=${NUM_PROC:-1} @@ -1158,9 +1070,8 @@ export NUM_PROC=${NUM_PROC:-1} # Honor %%_smp_ncpus_max [ ${NUM_PROC} -gt %{?_smp_ncpus_max} ] && export NUM_PROC=%{?_smp_ncpus_max} %endif -export XZ_OPT="-T0" -%ifarch s390x sparc64 alpha %{power64} %{aarch64} riscv64 +%ifarch s390x sparc64 alpha %{power64} %{aarch64} export ARCH_DATA_MODEL=64 %endif %ifarch alpha @@ -1182,70 +1093,14 @@ EXTRA_CFLAGS="$EXTRA_CFLAGS -fno-strict-aliasing" EXTRA_CFLAGS="$(echo ${EXTRA_CFLAGS} | sed -e 's|-mstackrealign|-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4|')" EXTRA_CPP_FLAGS="$(echo ${EXTRA_CPP_FLAGS} | sed -e 's|-mstackrealign|-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4|')" %endif -%if "%{is_dtstoolchain}" == "devkit" -# Remove annobin plugin reference which isn't available in the devkit -EXTRA_CFLAGS="$(echo ${EXTRA_CFLAGS} | sed -e 's|-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1||')" -EXTRA_CPP_FLAGS="$(echo ${EXTRA_CPP_FLAGS} | sed -e 's|-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1||')" -# Force DWARF 4 for compatibility -EXTRA_CFLAGS="${EXTRA_CFLAGS} -gdwarf-4" -EXTRA_CPP_FLAGS="${EXTRA_CPP_FLAGS} -gdwarf-4" -%endif - export EXTRA_CFLAGS EXTRA_CPP_FLAGS -# Set modification times (mtimes) of files within JAR files generated -# by the OpenJDK build to a timestamp that is constant across RPM -# rebuilds. OpenJDK provides the --with-source-date configure option -# for this purpose. Potential arguments in the RPM build context are: -# -# A) --with-source-date="${SOURCE_DATE_EPOCH}" -# B) --with-source-date=version -# C) --with-source-date="${OPENJDK_UPSTREAM_TAG_EPOCH}" -# -# Consider Option A. Fedora 38 (rpm-4.18.2) and RHEL-8 (rpm-4.14.3) -# have different support for SOURCE_DATE_EPOCH. To keep -# SOURCE_DATE_EPOCH constant across RPM rebuilds, one could set the -# source_date_epoch_from_changelog macro to 1 on both Fedora 38 and -# RHEL-8. However, on RHEL-8, this results in the RPM build times -# being set to the timestamp of the most recent changelog. This is -# bad for tracing when RPMs were actually built. Fedora 38 supports a -# better behaviour via the introduction of the -# use_source_date_epoch_as_buildtime macro, set to 0 by default. -# There is no way to make this work on RHEL-8 as well though, so -# option A is suboptimal. -# -# Option B uses the value of the DEFAULT_VERSION_DATE field from -# make/conf/version-numbers.conf. DEFAULT_VERSION_DATE represents the -# aspirational eventual JDK general availability (GA) release date. -# When the RPM build occurs prior to GA, generated JAR files will have -# payload mtimes in the future relative to the RPM build time. -# Whereas for tarballs some tools will issue warnings about future -# mtimes, per OPENJDK-2583 apparently this is no problem for Java and -# JAR files. -# -# Option C uses the modification timestamp of files in the source -# tarball. The reproducibility logic in generate_source_tarball.sh -# sets them all to the commit time of the release-tagged OpenJDK -# commit, as archived in the tarball. This timestamp is deterministic -# across RPM rebuilds and is reliably in the past. Any file's mtime -# will do, so use version-numbers.conf's. -# -# Use option B for JAR files, based on the discussion in OPENJDK-2583. -# -# For portable tarballs, use option C (OPENJDK_UPSTREAM_TAG_EPOCH) for -# the modification times of all files in the portable tarballs. Doing -# so eliminates one source of variability across RPM rebuilds. -VERSION_FILE="$(pwd)"/"%{top_level_dir_name}"/make/conf/version-numbers.conf -OPENJDK_UPSTREAM_TAG_EPOCH="$(stat --format=%Y "${VERSION_FILE}")" - function buildjdk() { local outputdir=${1} local buildjdk=${2} local maketargets="${3}" local debuglevel=${4} local link_opt=${5} - local debug_symbols=${6} - local devkit=${7} local top_dir_abs_src_path=$(pwd)/%{top_level_dir_name} local top_dir_abs_build_path=$(pwd)/${outputdir} @@ -1264,23 +1119,8 @@ function buildjdk() { echo "Using make targets: ${maketargets}" echo "Using debuglevel: ${debuglevel}" echo "Using link_opt: ${link_opt}" - echo "Using debug_symbols: ${debug_symbols}" echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}" -%if "%{is_dtstoolchain}" == "devkit" - LIBPATH="${devkit}/lib:${devkit}/lib64" - echo "Setting library path to ${LIBPATH}" -%else -%if "%{is_dtstoolchain}" == "toolset" - toolset=/opt/rh/%{dtsname}/root/ - LIBPATH="${toolset}/lib:${toolset}/lib64" - echo "Setting library path to ${LIBPATH}" -%else - LIBPATH=${LD_LIBRARY_PATH} - echo "Keeping library path as ${LIBPATH}" -%endif -%endif - mkdir -p ${outputdir} pushd ${outputdir} @@ -1288,21 +1128,20 @@ function buildjdk() { # rather than ${link_opt} as the system versions # are always used in a system_libs build, even # for the static library build - LD_LIBRARY_PATH=${LIBPATH} \ - %{?dts_command} bash ${top_dir_abs_src_path}/configure \ +%if (0%{?rhel} > 0 && 0%{?rhel} < 8) + scl enable devtoolset-8 -- bash ${top_dir_abs_src_path}/configure \ +%else + bash ${top_dir_abs_src_path}/configure \ +%endif %ifarch %{zero_arches} --with-jvm-variants=zero \ %endif -%if "%{is_dtstoolchain}" == "devkit" - --with-devkit=${devkit} \ -%endif -%if "%{is_dtstoolchain}" == "toolset" - --with-extra-path="/opt/rh/%{dtsname}/root/bin:/opt/rh/%{dtsname}/root/usr/bin" \ - --with-toolchain-path="/opt/rh/%{dtsname}/root/bin:/opt/rh/%{dtsname}/root/usr/bin" \ +%ifarch %{ppc64le} + --with-jobs=1 \ %endif --with-version-build=%{buildver} \ --with-version-pre="%{ea_designator}" \ - --with-version-opt="%{lts_designator}" \ + --with-version-opt=%{lts_designator} \ --with-vendor-version-string="%{oj_vendor_version}" \ --with-vendor-name="%{oj_vendor}" \ --with-vendor-url="%{oj_vendor_url}" \ @@ -1310,11 +1149,9 @@ function buildjdk() { --with-vendor-vm-bug-url="%{oj_vendor_bug_url}" \ --with-boot-jdk=${buildjdk} \ --with-debug-level=${debuglevel} \ - --with-native-debug-symbols="${debug_symbols}" \ - --disable-absolute-paths-in-output \ + --with-native-debug-symbols="%{debug_symbols}" \ + --disable-sysconf-nss \ --enable-unlimited-crypto \ - --enable-linkable-runtime \ - --enable-keep-packaged-modules \ --with-zlib=%{link_type} \ --with-freetype=%{link_type} \ --with-libjpeg=${link_opt} \ @@ -1327,494 +1164,117 @@ function buildjdk() { --with-extra-cflags="$EXTRA_CFLAGS" \ --with-extra-ldflags="%{ourldflags}" \ --with-num-cores="$NUM_PROC" \ - --with-source-date="version" \ + --with-source-date="${SOURCE_DATE_EPOCH}" \ --disable-javac-server \ %ifarch %{zgc_arches} --with-jvm-features=zgc \ %endif - --disable-warnings-as-errors \ - || ( pwd; cat $(find | grep config.log) && false ) + --disable-warnings-as-errors cat spec.gmk - LD_LIBRARY_PATH=${LIBPATH} \ - %{?dts_command} make LOG=trace \ +%if (0%{?rhel} > 0 && 0%{?rhel} < 8) + scl enable devtoolset-8 -- make \ +%else + make \ +%endif + LOG=trace \ WARNINGS_ARE_ERRORS="-Wno-error" \ - CFLAGS_WARNINGS_ARE_ERRORS="-Wno-error" $maketargets ||\ - ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name \"hs_err_pid*.log\" | xargs cat && false ) + CFLAGS_WARNINGS_ARE_ERRORS="-Wno-error" \ + $maketargets || ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name "hs_err_pid*.log" | xargs cat && false ) + popd } function installjdk() { - local outputdir=${1} - local installdir=${2} - local jdkimagepath=${installdir}/images/%{jdkimage} - local jreimagepath=${installdir}/images/%{jreimage} + local imagepath=${1} - echo "Installing build from ${outputdir} to ${installdir}..." - mkdir -p ${installdir} - echo "Installing images..." - mv ${outputdir}/images ${installdir} - if [ -d ${outputdir}/bundles ] ; then - echo "Installing bundles..."; - mv ${outputdir}/bundles ${installdir} ; + if [ -d ${imagepath} ] ; then + # the build (erroneously) removes read permissions from some jars + # this is a regression in OpenJDK 7 (our compiler): + # http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=1437 + find ${imagepath} -iname '*.jar' -exec chmod ugo+r {} \; + + # Build screws up permissions on binaries + # https://bugs.openjdk.java.net/browse/JDK-8173610 + find ${imagepath} -iname '*.so' -exec chmod +x {} \; + find ${imagepath}/bin/ -exec chmod +x {} \; + + # Install nss.cfg right away as we will be using the JRE above + install -m 644 nss.cfg ${imagepath}/conf/security/ + + # Install nss.fips.cfg: NSS configuration for global FIPS mode (crypto-policies) + install -m 644 nss.fips.cfg ${imagepath}/conf/security/ + + # Create fake alt-java as a placeholder for future alt-java + if [ -d man/man1 ] ; then + pushd ${imagepath} + # add alt-java man page + echo "Hardened java binary recommended for launching untrusted code from the Web e.g. javaws" > man/man1/%{alt_java_name}.1 + cat man/man1/java.1 >> man/man1/%{alt_java_name}.1 + popd + fi fi - -%if !%{with artifacts} - echo "Removing output directory..."; - rm -rf ${outputdir} -%endif - - # legacy-jre-image target does not install any man pages for the JRE - # We copy the jdk man directory and then remove pages for binaries that - # don't exist in the JRE -%if %{pandoc_available} - cp -a ${jdkimagepath}/man ${jreimagepath} - for manpage in $(find ${jreimagepath}/man -name '*.1'); do - filename=$(basename ${manpage}); - binary=${filename/.1/}; - if [ ! -f ${jreimagepath}/bin/${binary} ] ; then - echo "Removing ${manpage} from JRE for which no binary ${binary} exists"; - rm -f ${manpage}; - fi; - done -%endif - - for imagepath in ${jdkimagepath} ${jreimagepath}; do - - if [ -d ${imagepath} ] ; then - # the build (erroneously) removes read permissions from some jars - # this is a regression in OpenJDK 7 (our compiler): - # http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=1437 - find ${imagepath} -iname '*.jar' -exec chmod ugo+r {} \; - - # Build screws up permissions on binaries - # https://bugs.openjdk.java.net/browse/JDK-8173610 - find ${imagepath} -iname '*.so' -exec chmod +x {} \; - find ${imagepath}/bin/ -exec chmod +x {} \; - - # Install local files which are distributed with the JDK - install -m 644 %{SOURCE10} ${imagepath} - - # Print release information - cat ${imagepath}/release - fi - done } -function genchecksum() { - local checkedfile=${1} +# Checks on debuginfo must be performed before the files are stripped +# by the RPM installation stage +function debugcheckjdk() { + local imagepath=${1} - checkdir=$(dirname ${1}) - checkfile=$(basename ${1}) + if [ -d ${imagepath} ] ; then - echo "Generating checksum for ${checkfile} in ${checkdir}..." - pushd ${checkdir} - sha256sum ${checkfile} > ${checkfile}.sha256sum - sha256sum --check ${checkfile}.sha256sum - popd -} + so_suffix="so" + # Check debug symbols are present and can identify code + find "${imagepath}" -iname "*.$so_suffix" -print0 | while read -d $'\0' lib + do + if [ -f "$lib" ] ; then + echo "Testing $lib for debug symbols" + # All these tests rely on RPM failing the build if the exit code of any set + # of piped commands is non-zero. -function packFullPatchedSources() { - srcpackagesdir=`pwd` - createtar ${srcpackagesdir}/%{jdkportablesourcesarchive -- ""} --transform "s|^|%{jdkportablesourcesname -- ""}/|" %{top_level_dir_name} - genchecksum ${srcpackagesdir}/%{jdkportablesourcesarchive -- ""} -} + # Test for .debug_* sections in the shared object. This is the main test + # Stripped objects will not contain these + eu-readelf -S "$lib" | grep "] .debug_" + test $(eu-readelf -S "$lib" | grep -E "\]\ .debug_(info|abbrev)" | wc --lines) == 2 -function findgeneratedsources() { - local targetDir=${1} - local targetDirParent=$(dirname ${targetDir}) - local builtJdk=${2} - local builtJdkName=$(basename ${builtJdk}) - local sources=${3} - local sourcesName=$(basename ${sources}) - local sourcesParent=$(dirname ${sources}) - local target=${sourcesParent}/${targetDirParent}/%{generated_sources_name} - local suffixes="cpp\|hpp\|h\|hh\|rl" - suffixes=".*\.\($suffixes\)$" - mkdir -p $target - pushd ${builtJdk} - mkdir -p ${target}/${builtJdkName} - cp --parents $(find . | grep -e "$suffixes" -e "NONE$") ${target}/${builtJdkName} - popd - pushd ${sources} - mkdir -p ${target}/${sourcesName} - cp --parents $(find make | grep -e ".$suffixes" -e "NONE$") ${target}/${sourcesName} - popd -} + # Test FILE symbols. These will most likely be removed by anything that + # manipulates symbol tables because it's generally useless. So a nice test + # that nothing has messed with symbols + old_IFS="$IFS" + IFS=$'\n' + for line in $(eu-readelf -s "$lib" | grep "00000000 0 FILE LOCAL DEFAULT") + do + # We expect to see .cpp and .S files, except for architectures like aarch64 and + # s390 where we expect .o and .oS files + echo "$line" | grep -E "ABS ((.*/)?[-_a-zA-Z0-9]+\.(c|cc|cpp|cxx|o|S|oS))?$" + done + IFS="$old_IFS" -# Create a reproducible tarball in an appropriate way for -# the version of tar in use -function createtar() { - #FIXME, not finished - tar -cJf "$@" -} + # If this is the JVM, look for javaCalls.(cpp|o) in FILEs, for extra sanity checking + if [ "`basename $lib`" = "libjvm.so" ]; then + eu-readelf -s "$lib" | \ + grep -E "00000000 0 FILE LOCAL DEFAULT ABS javaCalls.(cpp|o)$" + fi -function packagejdk() { - local imagesdir=$(pwd)/${1}/images - local docdir=$(pwd)/${1}/images/docs - local bundledir=$(pwd)/${1}/bundles - local packagesdir=$(pwd)/${2} - local srcdir=$(pwd)/%{top_level_dir_name} - local tapsetdir=$(pwd)/tapset - local altjavadir=$(pwd)/${3} - local gensources=$(pwd)/%{miscinstalloutputdir}/%{generated_sources_name} - - echo "Packaging build from ${imagesdir} to ${packagesdir}..." - mkdir -p ${packagesdir} - pushd ${imagesdir} - - if [ "x$suffix" = "x" ] ; then - nameSuffix="" - else - nameSuffix=`echo "$suffix"| sed s/-/./` - fi - - jdkname=%{jdkportablename -- "$nameSuffix"} - jdkarchive=${packagesdir}/%{jdkportablearchive -- "$nameSuffix"} - jmodsarchive=${packagesdir}/%{jmodsportablearchive -- "$nameSuffix"} - jrename=%{jreportablename -- "$nameSuffix"} - jrearchive=${packagesdir}/%{jreportablearchive -- "$nameSuffix"} - staticname=%{staticlibsportablename -- "$nameSuffix"} - staticarchive=${packagesdir}/%{staticlibsportablearchive -- "$nameSuffix"} - debugarchive=${packagesdir}/%{jdkportablearchive -- "${nameSuffix}.debuginfo"} - if [ "x$suffix" = "x" ] ; then - docname=%{docportablename} - docarchive=${packagesdir}/%{docportablearchive} - built_doc_archive=jdk-%{filever}%{ea_designator_zip}+%{buildver}%{lts_designator_zip}-docs.zip - fi - # These are from the source tree so no debug variants - miscname=%{miscportablename} - miscarchive=${packagesdir}/%{miscportablearchive} - - # Rename directories for packaging - mv %{jdkimage} ${jdkname} - mv %{jreimage} ${jrename} - - # Release images have external debug symbols - if [ "x$suffix" = "x" ] ; then - # jdk26 is putting debugsymbols out of main image, - # we later reconstruct debuginfo subpakckages manually, so putting them back - cp -r symbols/* ${jdkname}/ - createtar ${debugarchive} $(find ${jdkname} -name \*.debuginfo) - genchecksum ${debugarchive} - - mkdir ${docname} - mv ${docdir} ${docname} - mv ${bundledir}/${built_doc_archive} ${docname} - createtar ${docarchive} ${docname} - genchecksum ${docarchive} - - mkdir ${miscname} - for s in 16 24 32 48 ; do - cp -av ${srcdir}/src/java.desktop/unix/classes/sun/awt/X11/java-icon${s}.png ${miscname} + # Test that there are no .gnu_debuglink sections pointing to another + # debuginfo file. There shouldn't be any debuginfo files, so the link makes + # no sense either + eu-readelf -S "$lib" | grep 'gnu' + if eu-readelf -S "$lib" | grep "\] .gnu_debuglink" | grep PROGBITS; then + echo "bad .gnu_debuglink section." + eu-readelf -x .gnu_debuglink "$lib" + false + fi + fi done -%if %{with_systemtap} - cp -a ${tapsetdir}* ${miscname} -%endif - cp -av ${altjavadir}/%{alt_java_name} ${miscname} - cp -avr ${gensources} ${miscname} - createtar ${miscarchive} ${miscname} - genchecksum ${miscarchive} - fi - createtar ${jmodsarchive} --exclude='**.debuginfo' ${jdkname}/jmods - genchecksum ${jmodsarchive} - rm -rv ${jdkname}/jmods - - createtar ${jdkarchive} --exclude='**.debuginfo' ${jdkname} - genchecksum ${jdkarchive} - - createtar ${jrearchive} --exclude='**.debuginfo' ${jrename} - genchecksum ${jrearchive} - -%if %{include_staticlibs} - # Static libraries (needed for building graal vm with native image) - # Tar as overlay. Transform to the JDK name, since we just want to "add" - # static libraries to that folder - createtar ${staticarchive} \ - --transform "s|^%{static_libs_image}/lib/*|${staticname}/lib/static/linux-%{archinstall}/glibc/|" "%{static_libs_image}/lib" - genchecksum ${staticarchive} -%endif - - # Revert directory renaming so testing will run - # TODO: testing should run on the packaged JDK - mv ${jdkname} %{jdkimage} - mv ${jrename} %{jreimage} - - popd #images - -} - -packFullPatchedSources - -%if "%{is_dtstoolchain}" == "devkit" - DEVKIT_ROOT=$(pwd)/devkit - source ${DEVKIT_ROOT}/devkit.info - GCC="${DEVKIT_TOOLCHAIN_PATH}/gcc --sysroot=${DEVKIT_SYSROOT}" - LIBPATH="${DEVKIT_ROOT}/lib:${DEVKIT_ROOT}/lib64" -%else -%if "%{is_dtstoolchain}" == "toolset" - toolset=/opt/rh/%{dtsname}/root/ - GCC="${toolset}/usr/bin/gcc" - LIBPATH="${toolset}/lib:${toolset}/lib64" -%else - GCC=$(which gcc) -%endif -%endif - -echo "Building %{SOURCE11}" -mkdir %{miscinstalloutputdir} -mkdir %{altjavaoutputdir} -LD_LIBRARY_PATH="${LIBPATH}" ${GCC} ${EXTRA_CFLAGS} -o %{altjavaoutputdir}/%{alt_java_name} %{SOURCE11} - -echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}" - -%if %{build_hotspot_first} - # Build a fresh libjvm.so first and use it to bootstrap - echo "Building HotSpot only for the latest libjvm.so" - cp -LR --preserve=mode,timestamps %{bootjdk} newboot - systemjdk=$(pwd)/newboot - buildjdk build/newboot ${systemjdk} %{hotspot_target} "release" "bundled" "internal" ${DEVKIT_ROOT} - mv build/newboot/jdk/lib/%{vm_variant}/libjvm.so newboot/lib/%{vm_variant} -%else - systemjdk=%{bootjdk} -%endif - -for suffix in %{build_loop} ; do - if [ "x$suffix" = "x" ] ; then - debugbuild=release - else - # change --something to something - debugbuild=`echo $suffix | sed "s/-//g"` - fi - # We build with 'external' debug symbols for the - # release build and build with 'internal' for - # slowdebug/fastdebug variants - if [ "x$suffix" = "x" ] ; then - debug_symbols=external - else - debug_symbols=internal - fi - - builddir=%{buildoutputdir -- ${suffix}} - bootbuilddir=boot${builddir} - installdir=%{installoutputdir -- ${suffix}} - bootinstalldir=boot${installdir} - packagesdir=%{packageoutputdir -- ${suffix}} - - link_opt="%{link_type}" -%if %{system_libs} - # Copy the source tree so we can remove all in-tree libraries - cp -a %{top_level_dir_name} %{top_level_dir_name_backup} - # Remove all libraries that are linked - sh %{SOURCE12} %{top_level_dir_name} full -%endif - # Debug builds don't need same targets as release for - # build speed-up. We also avoid bootstrapping these - # slower builds. - if echo $debugbuild | grep -q "debug" ; then - maketargets="%{debug_targets}" - run_bootstrap=false - else - maketargets="%{release_targets}" - run_bootstrap=%{bootstrap_build} - fi - if ${run_bootstrap} ; then - buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild} ${link_opt} ${debug_symbols} ${DEVKIT_ROOT} - installjdk ${bootbuilddir} ${bootinstalldir} - buildjdk ${builddir} $(pwd)/${bootinstalldir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} ${DEVKIT_ROOT} - findgeneratedsources ${installdir} ${builddir} $(pwd)/%{top_level_dir_name} - installjdk ${builddir} ${installdir} - %{!?with_artifacts:rm -rf ${bootinstalldir}} - else - buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} ${DEVKIT_ROOT} - findgeneratedsources ${installdir} ${builddir} $(pwd)/%{top_level_dir_name} - installjdk ${builddir} ${installdir} - fi - packagejdk ${installdir} ${packagesdir} %{altjavaoutputdir} - -%if %{system_libs} - # Restore original source tree we modified by removing full in-tree sources - rm -rf %{top_level_dir_name} - mv %{top_level_dir_name_backup} %{top_level_dir_name} -%endif - -# build cycles -done # end of release / debug cycle loop - -%check - -# We test debug first as it will give better diagnostics on a crash -for suffix in %{build_loop} ; do - -# portable builds have static_libs embedded, thus top_dir_abs_main_build_path is same as top_dir_abs_staticlibs_build_path -top_dir_abs_main_build_path=$(pwd)/%{installoutputdir -- ${suffix}} -%if %{include_staticlibs} -top_dir_abs_staticlibs_build_path=${top_dir_abs_main_build_path} -%endif - -export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage} - -# Pre-test setup - -# System security properties are disabled by default on portable. -# Turn on system security properties -#sed -i -e "s:^security.useSystemPropertiesFile=.*:security.useSystemPropertiesFile=true:" \ -#${JAVA_HOME}/conf/security/java.security - -# Set up tools -%if "%{is_dtstoolchain}" == "devkit" - DEVKIT_ROOT=$(pwd)/devkit - source ${DEVKIT_ROOT}/devkit.info - NM="${DEVKIT_TOOLCHAIN_PATH}/nm" -%else - NM=$(which nm) -%endif -# elfutils readelf supports more binaries than binutils version on RHEL 8 -# and debug symbols tests below were designed around this version -READELF=$(which eu-readelf) -# Only native gdb seems to work -# The devkit gdb needs the devkit stdc++ library but then the JVM -# segfaults when this is on the LD_LIBRARY_PATH -GDB=$(which gdb) - -# Check Shenandoah is enabled -%if %{use_shenandoah_hotspot} -$JAVA_HOME/bin/java -XX:+UseShenandoahGC -version -%endif - -# Only test on one architecture (the fastest) for Java only tests -%ifarch %{jdk_test_arch} - - # Check unlimited policy has been used - $JAVA_HOME/bin/javac -d . %{SOURCE13} - $JAVA_HOME/bin/java --add-opens java.base/javax.crypto=ALL-UNNAMED TestCryptoLevel - - # Check ECC is working - $JAVA_HOME/bin/javac -d . %{SOURCE14} - $JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||") - - # Check system crypto (policy) is deactive and can not be enabled - # Test takes a single argument - true or false - to state whether system - # security properties are enabled or not. - $JAVA_HOME/bin/javac -d . %{SOURCE15} - export PROG=$(echo $(basename %{SOURCE15})|sed "s|\.java||") - export SEC_DEBUG="-Djava.security.debug=properties" - # Specific to portable:System security properties to be off by default - $JAVA_HOME/bin/java ${SEC_DEBUG} ${PROG} false - $JAVA_HOME/bin/java ${SEC_DEBUG} -Djava.security.disableSystemPropertiesFile=false ${PROG} false - - # Check correct vendor values have been set - $JAVA_HOME/bin/javac -d . %{SOURCE16} - $JAVA_HOME/bin/java $(echo $(basename %{SOURCE16})|sed "s|\.java||") "%{oj_vendor}" "%{oj_vendor_url}" "%{oj_vendor_bug_url}" "%{oj_vendor_version}" - -%if ! 0%{?flatpak} - # Check translations are available for new timezones (during flatpak builds, the - # tzdb.dat used by this test is not where the test expects it, so this is - # disabled for flatpak builds) - # Disable test until we are on the latest JDK - $JAVA_HOME/bin/javac -d . %{SOURCE18} - $JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE || echo "Fedora is often ahead in timezones, ignoring" - $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR || echo "Fedora is often ahead in timezones, ignoring" -%endif - - # Check src.zip has all sources. See RHBZ#1130490 - unzip -l $JAVA_HOME/lib/src.zip | grep 'sun.misc.Unsafe' - - # Check class files include useful debugging information - $JAVA_HOME/bin/javap -c -l java.lang.Object | grep "Compiled from" - $JAVA_HOME/bin/javap -c -l java.lang.Object | grep LineNumberTable - $JAVA_HOME/bin/javap -c -l java.lang.Object | grep LocalVariableTable - - # Check generated class files include useful debugging information - $JAVA_HOME/bin/javap -c -l java.nio.ByteBuffer | grep "Compiled from" - $JAVA_HOME/bin/javap -c -l java.nio.ByteBuffer | grep LineNumberTable - $JAVA_HOME/bin/javap -c -l java.nio.ByteBuffer | grep LocalVariableTable - -%else - - # Just run a basic java -version test on other architectures - $JAVA_HOME/bin/java -version - -%endif - -# Check java launcher has no SSB mitigation -if ! ${NM} $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi - -# Check alt-java launcher has SSB mitigation on supported architectures -# set_speculation function exists in both cases, so check for prctl call -%ifarch %{ssbd_arches} -${NM} %{altjavaoutputdir}/%{alt_java_name} | grep prctl -%else -if ! ${NM} %{altjavaoutputdir}/%{alt_java_name} | grep prctl ; then true ; else false; fi -%endif - -%if %{include_staticlibs} -# Check debug symbols in static libraries (smoke test) -export STATIC_LIBS_HOME=${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image} -ls -l $STATIC_LIBS_HOME -ls -l $STATIC_LIBS_HOME/lib -${READELF} --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet4AddressImpl.c -${READELF} --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet6AddressImpl.c -%endif - -# Release builds strip the debug symbols into external .debuginfo files -if [ "x$suffix" = "x" ] ; then - so_suffix="debuginfo" -else - so_suffix="so" -fi -# Check debug symbols are present and can identify code -find "$JAVA_HOME" -iname "*.$so_suffix" -print0 | while read -d $'\0' lib -do - if [ -f "$lib" ] ; then - echo "Testing $lib for debug symbols" - # All these tests rely on RPM failing the build if the exit code of any set - # of piped commands is non-zero. - - # Test for .debug_* sections in the shared object. This is the main test - # Stripped objects will not contain these - ${READELF} -S "$lib" | grep "] .debug_" - test $(${READELF} -S "$lib" | grep -E "\]\ .debug_(info|abbrev)" | wc --lines) == 2 - - # Test FILE symbols. These will most likely be removed by anything that - # manipulates symbol tables because it's generally useless. So a nice test - # that nothing has messed with symbols - old_IFS="$IFS" - IFS=$'\n' - for line in $(${READELF} -s "$lib" | grep "00000000 0 FILE LOCAL DEFAULT") - do - # We expect to see .cpp and .S files, except for architectures like aarch64 and - # s390 where we expect .o and .oS files - echo "$line" | grep -E "ABS ((.*/)?[-_a-zA-Z0-9]+\.(c|cc|cpp|cxx|o|S|oS))?$" - done - IFS="$old_IFS" - - # If this is the JVM, look for javaCalls.(cpp|o) in FILEs, for extra sanity checking - if [ "`basename $lib`" = "libjvm.so" ]; then - ${READELF} -s "$lib" | \ - grep -E "00000000 0 FILE LOCAL DEFAULT ABS javaCalls.(cpp|o)$" - fi - - # Test that there are no .gnu_debuglink sections pointing to another - # debuginfo file. There shouldn't be any debuginfo files, so the link makes - # no sense either - ${READELF} -S "$lib" | grep 'gnu' - if ${READELF} -S "$lib" | grep '] .gnu_debuglink' | grep PROGBITS; then - echo "bad .gnu_debuglink section." - ${READELF} -x .gnu_debuglink "$lib" - false - fi - fi -done - -# Make sure gdb can do a backtrace based on line numbers on libjvm.so -# javaCalls.cpp:58 should map to: -# http://hg.openjdk.java.net/jdk8u/jdk8u/hotspot/file/ff3b27e6bcc2/src/share/vm/runtime/javaCalls.cpp#l58 -# Using line number 1 might cause build problems. See: -# https://bugzilla.redhat.com/show_bug.cgi?id=1539664 -# https://bugzilla.redhat.com/show_bug.cgi?id=1538767 -${GDB} -q "$JAVA_HOME/bin/java" < ../%{jdkportablesourcesarchive -- ""}.sha256sum - mkdir -p $RPM_BUILD_ROOT%{_jvmdir} - mv %{jdkportablesourcesarchive -- ""} $RPM_BUILD_ROOT%{_jvmdir}/ - mv %{jdkportablesourcesarchive -- ""}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/ +%if %{build_hotspot_first} + # Build a fresh libjvm.so first and use it to bootstrap + cp -LR --preserve=mode,timestamps %{bootjdk} newboot + systemjdk=$(pwd)/newboot + buildjdk build/newboot ${systemjdk} %{hotspot_target} "release" "bundled" + mv build/newboot/jdk/lib/server/libjvm.so newboot/lib/server +%else + systemjdk=%{bootjdk} +%endif for suffix in %{build_loop} ; do - - packagesdir=%{packageoutputdir -- ${suffix}} - - if [ "x$suffix" == "x" ] ; then - nameSuffix="" + if [ "x$suffix" = "x" ] ; then + debugbuild=release + else + # change --something to something + debugbuild=`echo $suffix | sed "s/-//g"` + fi + for loop in %{main_suffix} %{staticlibs_loop} ; do + builddir=%{buildoutputdir -- ${suffix}${loop}} + bootbuilddir=boot${builddir} + if test "x${loop}" = "x%{main_suffix}" ; then + link_opt="%{link_type}" +%if %{system_libs} + # Copy the source tree so we can remove all in-tree libraries + cp -a %{top_level_dir_name} %{top_level_dir_name_backup} + # Remove all libraries that are linked + sh %{SOURCE12} %{top_level_dir_name} full +%endif + # Debug builds don't need same targets as release for + # build speed-up. We also avoid bootstrapping these + # slower builds. + if echo $debugbuild | grep -q "debug" ; then + maketargets="%{debug_targets}" + run_bootstrap=false + else + maketargets="%{release_targets}" + run_bootstrap=%{bootstrap_build} + fi + if ${run_bootstrap} ; then + buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild} ${link_opt} + buildjdk ${builddir} $(pwd)/${bootbuilddir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt} + rm -rf ${bootbuilddir} + else + buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} + fi +%if %{system_libs} + # Restore original source tree we modified by removing full in-tree sources + rm -rf %{top_level_dir_name} + mv %{top_level_dir_name_backup} %{top_level_dir_name} +%endif else - nameSuffix=`echo "$suffix"| sed s/-/./` + # Use bundled libraries for building statically + link_opt="bundled" + # Static library cycle only builds the static libraries + maketargets="%{static_libs_target}" + # Always just do the one build for the static libraries + buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} fi - # These definitions should match those in packagejdk - jdkarchive=${packagesdir}/%{jdkportablearchive -- "$nameSuffix"} - jmodsarchive=${packagesdir}/%{jmodsportablearchive -- "$nameSuffix"} - jrearchive=${packagesdir}/%{jreportablearchive -- "$nameSuffix"} - staticarchive=${packagesdir}/%{staticlibsportablearchive -- "$nameSuffix"} - debugarchive=${packagesdir}/%{jdkportablearchive -- "${nameSuffix}.debuginfo"} + done # end of main / staticlibs loop - mv ${jdkarchive} $RPM_BUILD_ROOT%{_jvmdir}/ - mv ${jdkarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/ - mv ${jmodsarchive} $RPM_BUILD_ROOT%{_jvmdir}/ - mv ${jmodsarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/ - mv ${jrearchive} $RPM_BUILD_ROOT%{_jvmdir}/ - mv ${jrearchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/ + # Final setup on the main image + top_dir_abs_main_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{main_suffix}} + for image in %{jdkimage} %{jreimage} ; do + imagePath=${top_dir_abs_main_build_path}/images/${image} + installjdk ${imagePath} + done + # Check debug symbols were built into the dynamic libraries; todo, why it passes in JDK only? + debugcheckjdk ${top_dir_abs_main_build_path}/images/%{jdkimage} + # Print release information + cat ${top_dir_abs_main_build_path}/images/%{jdkimage}/release + +################################################################################ + pushd ${top_dir_abs_main_build_path}/images + if [ "x$suffix" == "x" ] ; then + nameSuffix="" + else + nameSuffix=`echo "$suffix"| sed s/-/./` + fi + # additional steps needed for fluent repack; most of them done twice, as images are already populated + # maybe most of them should be done in upstream build? + for imagedir in %{jdkimage} %{jreimage} ; do + pushd $imagedir + # Convert man pages to UTF8 encoding + if [ -d man/man1 ] ; then # jre do not have man pages... + for manpage in man/man1/* ; do + iconv -f ISO_8859-1 -t UTF8 $manpage -o $manpage.tmp + mv -f $manpage.tmp $manpage + done + fi + # Install release notes + cp -a %{SOURCE10} `pwd` + cp -a %{SOURCE10} `pwd`/legal + # stabilize permissions; aprtially duplicated in instalojdk + find `pwd` -name "*.so" -exec chmod 755 {} \; -exec echo "set 755 to so {}" \; ; + find `pwd` -type d -exec chmod 755 {} \; -exec echo "set 755 to dir {}" \; ; + find `pwd`/legal -type f -exec chmod 644 {} \; -exec echo "set 644 to licences {}" \; ; + popd # jdkimage/jreimage + done # jre/sdk work in loop + # javadoc is done only for release sdkimage + if ! echo $suffix | grep -q "debug" ; then + # Install Javadoc documentation + #cp -a docs %{jdkimage} # not sure if the plaintext javadoc is for some use + built_doc_archive=jdk-%{filever}%{ea_designator_zip}+%{buildver}%{lts_designator_zip}-docs.zip + cp -a `pwd`/../bundles/${built_doc_archive} `pwd`/%{jdkimage}/javadocs.zip || ls -l `pwd`/../bundles + fi + # end of additional steps + + mv %{jdkimage} %{jdkportablename -- "$nameSuffix"} + mv %{jreimage} %{jreportablename -- "$nameSuffix"} + tar -cJf ../../../../%{jdkportablearchive -- "$nameSuffix"} --exclude='**.debuginfo' %{jdkportablename -- "$nameSuffix"} + sha256sum ../../../../%{jdkportablearchive -- "$nameSuffix"} > ../../../../%{jdkportablearchive -- "$nameSuffix"}.sha256sum + tar -cJf ../../../../%{jreportablearchive -- "$nameSuffix"} --exclude='**.debuginfo' %{jreportablename -- "$nameSuffix"} + sha256sum ../../../../%{jreportablearchive -- "$nameSuffix"} > ../../../../%{jreportablearchive -- "$nameSuffix"}.sha256sum + # copy licenses so they are avialable out of tarball + cp -rf %{jdkportablename -- "$nameSuffix"}/legal ../../../../%{jdkportablearchive -- "%{normal_suffix}"}-legal + mv %{jdkportablename -- "$nameSuffix"} %{jdkimage} + mv %{jreportablename -- "$nameSuffix"} %{jreimage} + popd #images %if %{include_staticlibs} - mv ${staticarchive} $RPM_BUILD_ROOT%{_jvmdir}/ - mv ${staticarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/ + top_dir_abs_staticlibs_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{staticlibs_suffix}} + pushd ${top_dir_abs_staticlibs_build_path}/images + # Static libraries (needed for building graal vm with native image) + # Tar as overlay. Transform to the JDK name, since we just want to "add" + # static libraries to that folder + portableJDKname=%{staticlibsportablename -- "$nameSuffix"} + tar -cJf ../../../../%{staticlibsportablearchive -- "$nameSuffix"} --transform "s|^%{static_libs_image}/lib/*|$portableJDKname/lib/static/linux-%{archinstall}/glibc/|" "%{static_libs_image}/lib" + sha256sum ../../../../%{staticlibsportablearchive -- "$nameSuffix"} > ../../../../%{staticlibsportablearchive -- "$nameSuffix"}.sha256sum + popd #staticlibs-images +%endif +################################################################################ +# note, currently no debuginfo, consult portbale spec for external (zipped) debuginfo, being tarred alone +################################################################################ + +# build cycles +done # end of release / debug cycle loop + +%install +mkdir -p $RPM_BUILD_ROOT%{_jvmdir} +mv ../%{jdkportablesourcesarchive -- ""} $RPM_BUILD_ROOT%{_jvmdir}/ +mv ../%{jdkportablesourcesarchive -- ""}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/ + +for suffix in %{build_loop} ; do +top_dir_abs_main_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{main_suffix}} + +################################################################################ + if [ "x$suffix" == "x" ] ; then + nameSuffix="" + else + nameSuffix=`echo "$suffix"| sed s/-/./` + fi + mv ../%{jdkportablearchive -- "$nameSuffix"} $RPM_BUILD_ROOT%{_jvmdir}/ + mv ../%{jdkportablearchive -- "$nameSuffix"}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/ + mv ../%{jreportablearchive -- "$nameSuffix"} $RPM_BUILD_ROOT%{_jvmdir}/ + mv ../%{jreportablearchive -- "$nameSuffix"}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/ +%if %{include_staticlibs} + mv ../%{staticlibsportablearchive -- "$nameSuffix"} $RPM_BUILD_ROOT%{_jvmdir}/ + mv ../%{staticlibsportablearchive -- "$nameSuffix"}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/ +%endif + if [ "x$suffix" == "x" ] ; then + dnameSuffix="$nameSuffix".debuginfo +# todo handle debuginfo, see note at build (we will need to pack one stripped and one unstripped release build) +# mv ../%{jdkportablearchive -- "$dnameSuffix"} $RPM_BUILD_ROOT%{_jvmdir}/ +# mv ../%{jdkportablearchive -- "$dnameSuffix"}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/ + fi +################################################################################ +# end, dual install +done +################################################################################ +# the licenses are packed onloy once and shared +mkdir -p $RPM_BUILD_ROOT%{unpacked_licenses} +mv ../%{jdkportablearchive -- "%{normal_suffix}"}-legal $RPM_BUILD_ROOT%{unpacked_licenses}/%{jdkportablesourcesarchive -- "%{normal_suffix}"} +# To show sha in the build log +for file in `ls $RPM_BUILD_ROOT%{_jvmdir}/*.sha256sum` ; do ls -l $file ; cat $file ; done +################################################################################ + +%check + +# We test debug first as it will give better diagnostics on a crash +for suffix in %{build_loop} ; do + +# Tests in the check stage are performed on the installed image +# rpmbuild operates as follows: build -> install -> test +# however in portbales, we test built image instead of installed one +top_dir_abs_main_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{main_suffix}} +export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage} + +#check Shenandoah is enabled +%if %{use_shenandoah_hotspot} +$JAVA_HOME/bin/java -XX:+UnlockExperimentalVMOptions -XX:+UseShenandoahGC -version %endif - if [ "x$suffix" = "x" ] ; then - mv ${debugarchive} $RPM_BUILD_ROOT%{_jvmdir}/ - mv ${debugarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/ - fi -done +# Check unlimited policy has been used +$JAVA_HOME/bin/javac -d . %{SOURCE13} +$JAVA_HOME/bin/java --add-opens java.base/javax.crypto=ALL-UNNAMED TestCryptoLevel - if [ "x$suffix" = "x" ] ; then - # These definitions should match those in installjdk - # Install outside the loop as there are no debug variants - docarchive=${packagesdir}/%{docportablearchive} - miscarchive=${packagesdir}/%{miscportablearchive} - mv ${docarchive} $RPM_BUILD_ROOT%{_jvmdir}/ - mv ${docarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/ - mv ${miscarchive} $RPM_BUILD_ROOT%{_jvmdir}/ - mv ${miscarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/ - fi +# Check ECC is working +$JAVA_HOME/bin/javac -d . %{SOURCE14} +$JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||") -# To show sha in the build log -for file in `ls $RPM_BUILD_ROOT%{_jvmdir}/*.sha256sum` ; do - ls -l $file ; - cat $file ; +# Check system crypto (policy) is deactive and can not be enabled +# Test takes a single argument - true or false - to state whether system +# security properties are enabled or not. +$JAVA_HOME/bin/javac -d . %{SOURCE15} +export PROG=$(echo $(basename %{SOURCE15})|sed "s|\.java||") +export SEC_DEBUG="-Djava.security.debug=properties" +$JAVA_HOME/bin/java ${SEC_DEBUG} ${PROG} false +$JAVA_HOME/bin/java ${SEC_DEBUG} -Djava.security.disableSystemPropertiesFile=false ${PROG} false + +# Check java launcher has no SSB mitigation +if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi + +# Check alt-java launcher has SSB mitigation on supported architectures +%ifarch %{ssbd_arches} +nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation +%else +if ! nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation ; then true ; else false; fi +%endif + +# Check correct vendor values have been set +$JAVA_HOME/bin/javac -d . %{SOURCE16} +$JAVA_HOME/bin/java $(echo $(basename %{SOURCE16})|sed "s|\.java||") "%{oj_vendor}" "%{oj_vendor_url}" "%{oj_vendor_bug_url}" "%{oj_vendor_version}" + +%if ! 0%{?flatpak} +# Check translations are available for new timezones (during flatpak builds, the +# tzdb.dat used by this test is not where the test expects it, so this is +# disabled for flatpak builds) +$JAVA_HOME/bin/javac -d . %{SOURCE18} +$JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE +$JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR +%endif + +%if %{include_staticlibs} +# Check debug symbols in static libraries (smoke test) +export STATIC_LIBS_HOME=${top_dir_abs_main_build_path}/../../%{buildoutputdir -- ${suffix}%{staticlibs_suffix}}/images/static-libs/lib/ +readelf --debug-dump $STATIC_LIBS_HOME/libfdlibm.a | grep w_remainder.c +readelf --debug-dump $STATIC_LIBS_HOME/libfdlibm.a | grep e_remainder.c +%endif + +# Check src.zip has all sources. See RHBZ#1130490 +$JAVA_HOME/bin/jar -tf $JAVA_HOME/lib/src.zip | grep 'sun.misc.Unsafe' + +# Check class files include useful debugging information +$JAVA_HOME/bin/javap -l java.lang.Object | grep "Compiled from" +$JAVA_HOME/bin/javap -l java.lang.Object | grep LineNumberTable +$JAVA_HOME/bin/javap -l java.lang.Object | grep LocalVariableTable + +# Check generated class files include useful debugging information +$JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep "Compiled from" +$JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep LineNumberTable +$JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep LocalVariableTable + +# build cycles check done %if %{include_normal_build} %files # main package builds always -%{_jvmdir}/%{jreportablearchiveForFiles} -%{_jvmdir}/%{jreportablearchiveForFiles}.sha256sum +%{_jvmdir}/%{jreportablearchive -- %%{nil}} +%{_jvmdir}/%{jreportablearchive -- %%{nil}}.sha256sum +%license %{unpacked_licenses}/%{jdkportablesourcesarchive -- %%{nil}} %else %files # placeholder @@ -1902,19 +1566,19 @@ done %if %{include_normal_build} %files devel -%{_jvmdir}/%{jdkportablearchiveForFiles} -%{_jvmdir}/%{jdkportablearchive -- .debuginfo} -%{_jvmdir}/%{jdkportablearchiveForFiles}.sha256sum -%{_jvmdir}/%{jdkportablearchive -- .debuginfo}.sha256sum -%{_jvmdir}/%{jmodsportablearchiveForFiles} -%{_jvmdir}/%{jmodsportablearchiveForFiles}.sha256sum +%{_jvmdir}/%{jdkportablearchive -- %%{nil}} +#%{_jvmdir}/%{jdkportablearchive -- .debuginfo} +%{_jvmdir}/%{jdkportablearchive -- %%{nil}}.sha256sum +#%{_jvmdir}/%{jdkportablearchive -- .debuginfo}.sha256sum +%license %{unpacked_licenses}/%{jdkportablesourcesarchive -- %%{nil}} %endif %if %{include_normal_build} %if %{include_staticlibs} %files static-libs -%{_jvmdir}/%{staticlibsportablearchiveForFiles} -%{_jvmdir}/%{staticlibsportablearchiveForFiles}.sha256sum +%{_jvmdir}/%{staticlibsportablearchive -- %%{nil}} +%{_jvmdir}/%{staticlibsportablearchive -- %%{nil}}.sha256sum +%license %{unpacked_licenses}/%{jdkportablesourcesarchive -- %%{nil}} %endif %endif @@ -1922,17 +1586,18 @@ done %files slowdebug %{_jvmdir}/%{jreportablearchive -- .slowdebug} %{_jvmdir}/%{jreportablearchive -- .slowdebug}.sha256sum +%license %{unpacked_licenses}/%{jdkportablesourcesarchive -- %%{nil}} %files devel-slowdebug %{_jvmdir}/%{jdkportablearchive -- .slowdebug} %{_jvmdir}/%{jdkportablearchive -- .slowdebug}.sha256sum -%{_jvmdir}/%{jmodsportablearchive -- .slowdebug} -%{_jvmdir}/%{jmodsportablearchive -- .slowdebug}.sha256sum +%license %{unpacked_licenses}/%{jdkportablesourcesarchive -- %%{nil}} %if %{include_staticlibs} %files static-libs-slowdebug %{_jvmdir}/%{staticlibsportablearchive -- .slowdebug} %{_jvmdir}/%{staticlibsportablearchive -- .slowdebug}.sha256sum +%license %{unpacked_licenses}/%{jdkportablesourcesarchive -- %%{nil}} %endif %endif @@ -1940,32 +1605,108 @@ done %files fastdebug %{_jvmdir}/%{jreportablearchive -- .fastdebug} %{_jvmdir}/%{jreportablearchive -- .fastdebug}.sha256sum +%license %{unpacked_licenses}/%{jdkportablesourcesarchive -- %%{nil}} %files devel-fastdebug %{_jvmdir}/%{jdkportablearchive -- .fastdebug} %{_jvmdir}/%{jdkportablearchive -- .fastdebug}.sha256sum -%{_jvmdir}/%{jmodsportablearchive -- .fastdebug} -%{_jvmdir}/%{jmodsportablearchive -- .fastdebug}.sha256sum +%license %{unpacked_licenses}/%{jdkportablesourcesarchive -- %%{nil}} %if %{include_staticlibs} %files static-libs-fastdebug %{_jvmdir}/%{staticlibsportablearchive -- .fastdebug} %{_jvmdir}/%{staticlibsportablearchive -- .fastdebug}.sha256sum +%license %{unpacked_licenses}/%{jdkportablesourcesarchive -- %%{nil}} %endif %endif %files sources -%{_jvmdir}/%{jdkportablesourcesarchiveForFiles} -%{_jvmdir}/%{jdkportablesourcesarchiveForFiles}.sha256sum +%{_jvmdir}/%{jdkportablesourcesarchive -- %%{nil}} +%{_jvmdir}/%{jdkportablesourcesarchive -- %%{nil}}.sha256sum +%license %{unpacked_licenses}/%{jdkportablesourcesarchive -- %%{nil}} -%if %{include_normal_build} -%files docs -%{_jvmdir}/%{docportablearchive} -%{_jvmdir}/%{docportablearchive}.sha256sum +%changelog +* Mon May 15 2023 Jiri Vanek - 1:20.0.1.0.9-3.rolling +- no longer using system cacerts during build +- they are already mv-ed as .upstream in rpms -%files misc -%{_jvmdir}/%{miscportablearchive} -%{_jvmdir}/%{miscportablearchive}.sha256sum -%endif +* Wed May 10 2023 Jiri Vanek - 1:20.0.1.0.9-2.rolling +- enabled all crypto + +* Wed Apr 26 2023 Andrew Hughes - 1:20.0.1.0.9-1.rolling +- Update to jdk-20.0.1+9 +- Update release notes to 20.0.1+9 + +* Fri Apr 14 2023 Jiri Vanek - 1:20.0.0.0.36-3.rolling +- introduced archfull src archive +- replaced nasty handling of icons. +- needed for icons and src reference for rpms (debuginfo, src subpkg) +- licences moved to proper sharable noarch + +* Mon Apr 10 2023 Andrew Hughes - 1:20.0.0.0.36-2.rolling +- Complete update to OpenJDK 20 +- Update NEWS +- Update system crypto policy & FIPS patch from new fips-20u tree +- * RH2104724: Avoid import/export of DH private keys +- * RH2092507: P11Key.getEncoded does not work for DH keys in FIPS mode +- * Build the systemconf library on all platforms +- Update generate_tarball.sh ICEDTEA_VERSION and add support for passing a boot JDK to the configure run +- Revert changes to generate_tarball.sh which break error handling +- Add POSIX-friendly error codes to generate_tarball.sh and fix whitespace +- Remove .jcheck and GitHub support when generating tarballs, as done in upstream release tarballs +- Revert changes to patch macro which break on older versions of rpm (4.16) +- Revert changes to configure run +- Revert RH1648429 patch changes +- Update CLDR reference data following update to 42 (Rocky Mountain-Normalzeit => Rocky-Mountain-Normalzeit) +- Re-enable disabled translation test +- Automatically turn off building a fresh HotSpot first, if the bootstrap JDK is not the same major version as that being built + +* Tue Mar 28 2023 Jiri Vanek - 1:20.0.0.0.36-1.rolling +- moved to jdk20 +- remvoed already upstreamed patches patch2006,2007,2008,2009 +- commented out not yet adapted patch1001 - fips support +- removed --disable-sysconf-nss due to missing patch 1001 from configure +-- todo return both patch1001 and disable-sysconf-nss! +- adapted rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch and rh1750419-redhat_alt_java.patch patches +- inverted fresh_libjvm behavior to be disabled by default. fails: +-- See: https://koji.fedoraproject.org/koji/taskinfo?taskID=99242677 +- commented out tzdata tests +- moved from deprecated patchN to patch N + +* Tue Feb 07 2023 Jiri Vanel - 1:19.0.2.0.7-2.rolling +- added png icons from x11 source package, so they can be reused by rpms + + * Thu Jan 26 2023 Andrew Hughes - 1:19.0.2.0.7-1.rolling +- Update to jdk-19.0.2 release +- Update release notes to 19.0.2 +- Drop JDK-8293834 (CLDR update for Kyiv) which is now upstream +- Drop JDK-8294357 (tzdata2022d), JDK-8295173 (tzdata2022e) & JDK-8296108 (tzdata2022f) local patches which are now upstream +- Drop JDK-8296715 (CLDR update for 2022f) which is now upstream +- Add local patch JDK-8295447 (javac NPE) which was accepted into 19u upstream but not in the GA tag +- Add local patches for JDK-8296239 & JDK-8299439 (Croatia Euro update) which are present in 8u, 11u & 17u releases + +* Thu Jan 19 2023 Andrew Hughes - 1:19.0.1.0.10-3.rolling + - Update in-tree tzdata & CLDR to 2022g with JDK-8296108, JDK-8296715 & JDK-8297804 + - Update TestTranslations.java to test the new America/Ciudad_Juarez zone + +* Thu Jan 19 2023 Stephan Bergmann - 1:19.0.1.0.10-3.rolling + - Fix flatpak builds by disabling TestTranslations test due to missing tzdb.dat + +* Thu Jan 19 2023 Fedora Release Engineering - 1:19.0.1.0.10-3.rolling.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Thu Jan 12 2023 Jiri Vanel - 1:19.0.1.0.10-3.rolling +- keep system crypto policy honoring disabled (test adapted) +- keep upstream cacerts +- call installjdk also for jreimage. +- add alt-java man page conditionaly (se install openjdk for jre above) +- convert man pages to utf8 (conditionally, man pages are not in jre) +- stabilised permissions as was in rpms +- use NEWS both in tarball and outside +- for release sdk use javadoc archive. +- remove STRIP_KEEP_SYMTAB=libjvm* and all todo as it is going to continue in rpms only + (hopefully) + +* Thu Dec 01 2022 Petra Alice Mikova - 1:19.0.1.0.10-2.rolling +- initial import -%autochangelog diff --git a/jconsole.desktop.in b/jconsole.desktop.in new file mode 100644 index 0000000..8a3b04d --- /dev/null +++ b/jconsole.desktop.in @@ -0,0 +1,10 @@ +[Desktop Entry] +Name=OpenJDK @JAVA_VER@ for @target_cpu@ Monitoring & Management Console (@OPENJDK_VER@) +Comment=Monitor and manage OpenJDK applications +Exec=_SDKBINDIR_/jconsole +Icon=java-@JAVA_VER@-@JAVA_VENDOR@ +Terminal=false +Type=Application +StartupWMClass=sun-tools-jconsole-JConsole +Categories=Development;Profiling;Java; +Version=1.0 diff --git a/jdk8296108-tzdata2022f.patch b/jdk8296108-tzdata2022f.patch new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/jdk8296108-tzdata2022f.patch @@ -0,0 +1 @@ + diff --git a/jdk8296715-cldr2022f.patch b/jdk8296715-cldr2022f.patch new file mode 100644 index 0000000..8b13789 --- /dev/null +++ b/jdk8296715-cldr2022f.patch @@ -0,0 +1 @@ + diff --git a/nss.cfg.in b/nss.cfg.in new file mode 100644 index 0000000..377a39c --- /dev/null +++ b/nss.cfg.in @@ -0,0 +1,5 @@ +name = NSS +nssLibraryDirectory = @NSS_LIBDIR@ +nssDbMode = noDb +attributes = compatibility +handleStartupErrors = ignoreMultipleInitialisation diff --git a/nss.fips.cfg.in b/nss.fips.cfg.in new file mode 100644 index 0000000..2d9ec35 --- /dev/null +++ b/nss.fips.cfg.in @@ -0,0 +1,8 @@ +name = NSS-FIPS +nssLibraryDirectory = @NSS_LIBDIR@ +nssSecmodDirectory = sql:/etc/pki/nssdb +nssDbMode = readOnly +nssModule = fips + +attributes(*,CKO_SECRET_KEY,CKK_GENERIC_SECRET)={ CKA_SIGN=true } + diff --git a/openjdk_news.sh b/openjdk_news.sh new file mode 100755 index 0000000..560b356 --- /dev/null +++ b/openjdk_news.sh @@ -0,0 +1,76 @@ +#!/bin/bash + +# Copyright (C) 2022 Red Hat, Inc. +# Written by Andrew John Hughes , 2012-2022 +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +OLD_RELEASE=$1 +NEW_RELEASE=$2 +SUBDIR=$3 +REPO=$4 +SCRIPT_DIR=$(dirname ${0}) + +if test "x${SUBDIR}" = "x"; then + echo "No subdirectory specified; using ."; + SUBDIR="."; +fi + +if test "x$REPO" = "x"; then + echo "No repository specified; using ${PWD}" + REPO=${PWD} +fi + +if test x${TMPDIR} = x; then + TMPDIR=/tmp; +fi + +echo "Repository: ${REPO}" + +if [ -e ${REPO}/.git ] ; then + TYPE=git; +elif [ -e ${REPO}/.hg ] ; then + TYPE=hg; +else + echo "No Mercurial or Git repository detected."; + exit 1; +fi + +if test "x$OLD_RELEASE" = "x" || test "x$NEW_RELEASE" = "x"; then + echo "ERROR: Need to specify old and new release"; + exit 2; +fi + +echo "Listing fixes between $OLD_RELEASE and $NEW_RELEASE in $REPO" +rm -f ${TMPDIR}/fixes2 ${TMPDIR}/fixes3 ${TMPDIR}/fixes +for repos in . $(${SCRIPT_DIR}/discover_trees.sh ${REPO}); +do + if test "x$TYPE" = "xhg"; then + hg log -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R $REPO/$repos -G -M ${REPO}/${SUBDIR} | \ + egrep '^[o:| ]*summary'|grep -v 'Added tag'|sed -r 's#^[o:| ]*summary:\W*([0-9])# - JDK-\1#'| \ + sed 's#^[o:| ]*summary:\W*# - #' >> ${TMPDIR}/fixes2; + hg log -v -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R $REPO/$repos -G -M ${REPO}/${SUBDIR} | \ + egrep '^[o:| ]*[0-9]{7}'|sed -r 's#^[o:| ]*([0-9]{7})# - JDK-\1#' >> ${TMPDIR}/fixes3; + else + git -C ${REPO} log --no-merges --pretty=format:%B ${NEW_RELEASE}...${OLD_RELEASE} -- ${SUBDIR} |egrep '^[0-9]{7}' | \ + sed -r 's#^([0-9])# - JDK-\1#' >> ${TMPDIR}/fixes2; + touch ${TMPDIR}/fixes3 ; # unused + fi +done + +sort ${TMPDIR}/fixes2 ${TMPDIR}/fixes3 | uniq > ${TMPDIR}/fixes +rm -f ${TMPDIR}/fixes2 ${TMPDIR}/fixes3 + +echo "In ${TMPDIR}/fixes:" +cat ${TMPDIR}/fixes diff --git a/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch b/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch new file mode 100644 index 0000000..3042186 --- /dev/null +++ b/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch @@ -0,0 +1,16 @@ +diff -r 618ad1237e73 src/java.desktop/share/classes/java/awt/Toolkit.java +--- a/src/java.desktop/share/classes/java/awt/Toolkit.java Thu Jun 13 19:37:49 2019 +0200 ++++ b/src/java.desktop/share/classes/java/awt/Toolkit.java Thu Jul 04 10:35:42 2019 +0200 +@@ -595,7 +595,11 @@ + toolkit = new HeadlessToolkit(toolkit); + } + if (!GraphicsEnvironment.isHeadless()) { +- loadAssistiveTechnologies(); ++ try { ++ loadAssistiveTechnologies(); ++ } catch (AWTError error) { ++ // ignore silently ++ } + } + } + return toolkit; diff --git a/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch b/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch new file mode 100644 index 0000000..c178077 --- /dev/null +++ b/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch @@ -0,0 +1,12 @@ +diff --git openjdk.orig/src/java.base/share/conf/security/java.security openjdk/src/java.base/share/conf/security/java.security +index 68a9c1a2d08..7aa25eb2cb7 100644 +--- openjdk.orig/src/java.base/share/conf/security/java.security ++++ openjdk/src/java.base/share/conf/security/java.security +@@ -78,6 +78,7 @@ security.provider.tbd=SunMSCAPI + security.provider.tbd=Apple + #endif + security.provider.tbd=SunPKCS11 ++#security.provider.tbd=SunPKCS11 ${java.home}/lib/security/nss.cfg + + # + # Security providers used when FIPS mode support is active diff --git a/rh1648644-java_access_bridge_privileged_security.patch b/rh1648644-java_access_bridge_privileged_security.patch new file mode 100644 index 0000000..53026ad --- /dev/null +++ b/rh1648644-java_access_bridge_privileged_security.patch @@ -0,0 +1,20 @@ +--- openjdk/src/java.base/share/conf/security/java.security ++++ openjdk/src/java.base/share/conf/security/java.security +@@ -304,6 +304,8 @@ + # + package.access=sun.misc.,\ + sun.reflect.,\ ++ org.GNOME.Accessibility.,\ ++ org.GNOME.Bonobo.,\ + + # + # List of comma-separated packages that start with or equal this string +@@ -316,6 +318,8 @@ + # + package.definition=sun.misc.,\ + sun.reflect.,\ ++ org.GNOME.Accessibility.,\ ++ org.GNOME.Bonobo.,\ + + # + # Determines whether this properties file can be appended to diff --git a/rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch b/rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch new file mode 100644 index 0000000..4c1476f --- /dev/null +++ b/rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch @@ -0,0 +1,15 @@ +diff --git a/openjdk/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java b/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java +index bacff32efbc..ff7b3dcc81c 100644 +--- openjdk/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java ++++ openjdk/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java +@@ -46,8 +46,8 @@ class PlatformPCSC { + + private static final String PROP_NAME = "sun.security.smartcardio.library"; + +- private static final String LIB1 = "/usr/$LIBISA/libpcsclite.so"; +- private static final String LIB2 = "/usr/local/$LIBISA/libpcsclite.so"; ++ private static final String LIB1 = "/usr/$LIBISA/libpcsclite.so.1"; ++ private static final String LIB2 = "/usr/local/$LIBISA/libpcsclite.so.1"; + private static final String PCSC_FRAMEWORK = "/System/Library/Frameworks/PCSC.framework/Versions/Current/PCSC"; + + PlatformPCSC() { diff --git a/rh1750419-redhat_alt_java.patch b/rh1750419-redhat_alt_java.patch new file mode 100644 index 0000000..d877ca8 --- /dev/null +++ b/rh1750419-redhat_alt_java.patch @@ -0,0 +1,117 @@ +diff --git openjdk.orig/make/modules/java.base/Launcher.gmk openjdk/make/modules/java.base/Launcher.gmk +index 700ddefda49..2882de68eb2 100644 +--- openjdk.orig/make/modules/java.base/Launcher.gmk ++++ openjdk/make/modules/java.base/Launcher.gmk +@@ -41,6 +41,14 @@ $(eval $(call SetupBuildLauncher, java, \ + OPTIMIZATION := HIGH, \ + )) + ++#Wno-error=cpp is present to allow commented warning in ifdef part of main.c ++$(eval $(call SetupBuildLauncher, alt-java, \ ++ CFLAGS := -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES -DREDHAT_ALT_JAVA -Wno-error=cpp, \ ++ EXTRA_RCFLAGS := $(JAVA_RCFLAGS), \ ++ VERSION_INFO_RESOURCE := $(JAVA_VERSION_INFO_RESOURCE), \ ++ OPTIMIZATION := HIGH, \ ++)) ++ + ifeq ($(call isTargetOs, windows), true) + $(eval $(call SetupBuildLauncher, javaw, \ + CFLAGS := -DJAVAW -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES, \ +diff --git openjdk.orig/src/java.base/share/native/launcher/alt_main.h openjdk/src/java.base/share/native/launcher/alt_main.h +new file mode 100644 +index 00000000000..697df2898ac +--- /dev/null ++++ openjdk/src/java.base/share/native/launcher/alt_main.h +@@ -0,0 +1,73 @@ ++/* ++ * Copyright (c) 2019, Red Hat, Inc. All rights reserved. ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. Oracle designates this ++ * particular file as subject to the "Classpath" exception as provided ++ * by Oracle in the LICENSE file that accompanied this code. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++#ifdef REDHAT_ALT_JAVA ++ ++#include ++ ++ ++/* Per task speculation control */ ++#ifndef PR_GET_SPECULATION_CTRL ++# define PR_GET_SPECULATION_CTRL 52 ++#endif ++#ifndef PR_SET_SPECULATION_CTRL ++# define PR_SET_SPECULATION_CTRL 53 ++#endif ++/* Speculation control variants */ ++#ifndef PR_SPEC_STORE_BYPASS ++# define PR_SPEC_STORE_BYPASS 0 ++#endif ++/* Return and control values for PR_SET/GET_SPECULATION_CTRL */ ++ ++#ifndef PR_SPEC_NOT_AFFECTED ++# define PR_SPEC_NOT_AFFECTED 0 ++#endif ++#ifndef PR_SPEC_PRCTL ++# define PR_SPEC_PRCTL (1UL << 0) ++#endif ++#ifndef PR_SPEC_ENABLE ++# define PR_SPEC_ENABLE (1UL << 1) ++#endif ++#ifndef PR_SPEC_DISABLE ++# define PR_SPEC_DISABLE (1UL << 2) ++#endif ++#ifndef PR_SPEC_FORCE_DISABLE ++# define PR_SPEC_FORCE_DISABLE (1UL << 3) ++#endif ++#ifndef PR_SPEC_DISABLE_NOEXEC ++# define PR_SPEC_DISABLE_NOEXEC (1UL << 4) ++#endif ++ ++static void set_speculation() __attribute__((constructor)); ++static void set_speculation() { ++ if ( prctl(PR_SET_SPECULATION_CTRL, ++ PR_SPEC_STORE_BYPASS, ++ PR_SPEC_DISABLE_NOEXEC, 0, 0) == 0 ) { ++ return; ++ } ++ prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0); ++} ++ ++#endif // REDHAT_ALT_JAVA +diff --git openjdk.orig/src/java.base/share/native/launcher/main.c openjdk/src/java.base/share/native/launcher/main.c +index b734fe2ba78..79dc8307650 100644 +--- openjdk.orig/src/java.base/share/native/launcher/main.c ++++ openjdk/src/java.base/share/native/launcher/main.c +@@ -34,6 +34,14 @@ + #include "jli_util.h" + #include "jni.h" + ++#ifdef REDHAT_ALT_JAVA ++#if defined(__linux__) && defined(__x86_64__) ++#include "alt_main.h" ++#else ++#warning alt-java requested but SSB mitigation not available on this platform. ++#endif ++#endif ++ + /* + * Entry point. + */ diff --git a/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch b/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch new file mode 100644 index 0000000..1b706a1 --- /dev/null +++ b/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch @@ -0,0 +1,19 @@ +Remove uses of FAR in jpeg code + +Upstream libjpeg-trubo removed the (empty) FAR macro: +http://sourceforge.net/p/libjpeg-turbo/code/1312/ + +Adjust our code to not use the undefined FAR macro anymore. + +diff --git a/jdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c b/jdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c +--- openjdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c ++++ openjdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c +@@ -1385,7 +1385,7 @@ + /* and fill it in */ + dst_ptr = icc_data; + for (seq_no = first; seq_no < last; seq_no++) { +- JOCTET FAR *src_ptr = icc_markers[seq_no]->data + ICC_OVERHEAD_LEN; ++ JOCTET *src_ptr = icc_markers[seq_no]->data + ICC_OVERHEAD_LEN; + unsigned int length = + icc_markers[seq_no]->data_length - ICC_OVERHEAD_LEN; + diff --git a/scripts/discover_trees.sh b/scripts/discover_trees.sh deleted file mode 100755 index 7a0b800..0000000 --- a/scripts/discover_trees.sh +++ /dev/null @@ -1,61 +0,0 @@ -#!/bin/sh - -# Copyright (C) 2024 Red Hat, Inc. -# Written by Andrew John Hughes . -# -# This program is free software: you can redistribute it and/or modify -# it under the terms of the GNU Affero General Public License as -# published by the Free Software Foundation, either version 3 of the -# License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Affero General Public License for more details. -# -# You should have received a copy of the GNU Affero General Public License -# along with this program. If not, see . - -TREE=${1} - -if test "${TREE}" = ""; then - TREE=${PWD} -fi - -if [ -e "${TREE}"/nashorn/.hg ] || [ -e "${TREE}"/nashorn/merge.changeset ] ; then - NASHORN="nashorn" ; -fi - -if [ -e "${TREE}"/corba/.hg ] || [ -e "${TREE}"/corba/merge.changeset ] ; then - CORBA="corba"; -fi - -if [ -e "${TREE}"/jaxp/.hg ] || [ -e "${TREE}"/jaxp/merge.changeset ] ; then - JAXP="jaxp"; -fi - -if [ -e "${TREE}"/jaxws/.hg ] || [ -e "${TREE}"/jaxws/merge.changeset ] ; then - JAXWS="jaxws"; -fi - -if [ -e "${TREE}"/langtools/.hg ] || [ -e "${TREE}"/langtools/merge.changeset ] ; then - LANGTOOLS="langtools"; -fi - -if [ -e "${TREE}"/jdk/.hg ] || [ -e "${TREE}"/jdk/merge.changeset ] ; then - JDK="jdk"; -fi - -if [ -e "${TREE}"/hotspot/.hg ] || [ -e "${TREE}"/hotspot/merge.changeset ] ; then - HOTSPOT="hotspot"; -fi - -SUBTREES="${CORBA} ${JAXP} ${JAXWS} ${LANGTOOLS} ${NASHORN} ${JDK} ${HOTSPOT}"; -echo "${SUBTREES}" - -# Local Variables: -# compile-command: "shellcheck discover_trees.sh" -# fill-column: 80 -# indent-tabs-mode: nil -# sh-basic-offset: 4 -# End: diff --git a/scripts/generate_source_tarball.sh b/scripts/generate_source_tarball.sh deleted file mode 100755 index e01043d..0000000 --- a/scripts/generate_source_tarball.sh +++ /dev/null @@ -1,294 +0,0 @@ -#!/bin/bash - -# Copyright (C) 2024 Red Hat, Inc. -# Written by: -# Andrew John Hughes -# Thomas Fitzsimmons -# Jiri Vanek -# -# This program is free software: you can redistribute it and/or modify -# it under the terms of the GNU Affero General Public License as -# published by the Free Software Foundation, either version 3 of the -# License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Affero General Public License for more details. -# -# You should have received a copy of the GNU Affero General Public License -# along with this program. If not, see . - -# Generates the source tarball for OpenJDK projects. -# -# There are multiple ways to specify the source code location and version: -# -# 1. Specify the version (VERSION), the location of the Git repository -# (REPO_ROOT) and the root of the output tarball name (FILE_NAME_ROOT) -# 2. Specify the version (VERSION) along with an upstream project name -# (PROJECT_NAME) and repository name (REPO_NAME) that can be used -# to construct the URL of the upstream OpenJDK repository. -# 3. Specify OPENJDK_LATEST=1 and allow the script to obtain the JDK -# feature version from the spec file, which is then used to -# obtain the latest build promotion from the upstream repository. -# -# An appropriate bootstrap JDK is also required for when ./configure -# is run within the checked out repository to generate the .src-rev. -# file. This can be specified by setting BOOT_JDK. -# -# Example 1: -# This will check out the specified version from the specified -# repository and construct a tarball called openjdk-17.0.3+5.tar.xz: -# -# $ VERSION=jdk-17.0.3+5 FILE_NAME_ROOT=open${VERSION} \ -# REPO_ROOT=$HOME/projects/openjdk/upstream/17u \ -# BOOT_JDK=/usr/lib/jvm/java-17-openjdk ./generate_source_tarball.sh -# -# Example 2: -# This will check out the same version as example 1, but from the -# upstream repository: -# -# $ VERSION=jdk-25+36 PROJECT_NAME=openjdk REPO_NAME=jdk25u \ -# BOOT_JDK=/usr/lib/jvm/java-17-openjdk sh scripts/generate_source_tarball.sh -# -# Example 3: -# This will read the OpenJDK feature version from the spec file, then create a -# tarball from the most recent tag for that version in the upstream Git -# repository. -# -# $ OPENJDK_LATEST=1 \ -# BOOT_JDK=/usr/lib/jvm/java-17-openjdk ./generate_source_tarball.sh -# - -set -e - -OPENJDK_URL_DEFAULT=https://github.com -COMPRESSION_DEFAULT=xz - -if [ "$1" = "help" ] ; then - echo "Behaviour may be specified by setting the following variables:" - echo - echo "VERSION - the version of the specified OpenJDK project" - echo " (required unless OPENJDK_LATEST is set)" - echo "PROJECT_NAME - the name of the OpenJDK project being archived" - echo " (needed to compute REPO_ROOT and/or" - echo " FILE_NAME_ROOT automatically;" - echo " optional if they are set explicitly)" - echo "REPO_NAME - the name of the OpenJDK repository" - echo " (needed to compute REPO_ROOT automatically;" - echo " optional if REPO_ROOT is set explicitly)" - echo "OPENJDK_URL - the URL to retrieve code from" - echo " (defaults to ${OPENJDK_URL_DEFAULT})" - echo "COMPRESSION - the compression type to use" - echo " (defaults to ${COMPRESSION_DEFAULT})" - echo "FILE_NAME_ROOT - name of the archive, minus extensions" - echo " (defaults to PROJECT_NAME-VERSION)" - echo "REPO_ROOT - the location of the Git repository to archive" - echo " (defaults to OPENJDK_URL/PROJECT_NAME/REPO_NAME.git)" - echo "TO_COMPRESS - what part of clone to pack" - echo " (defaults to ${VERSION})" - echo "BOOT_JDK - the bootstrap JDK to satisfy the configure run" - echo " (defaults to packaged JDK version)" - echo "WITH_TEMP - run in a temporary directory" - echo " (defaults to disabled)" - echo "OPENJDK_LATEST - deduce VERSION from most recent upstream tag" - echo " (implies WITH_TEMP, computes everything else" - echo " automatically; Note: accesses network to read" - echo " tag list from remote Git repository)" - exit 1; -fi - -if [ "$OPENJDK_LATEST" != "" ] ; then - FEATURE_VERSION=$(echo '%featurever' \ - | rpmspec --shell ./*.spec 2>/dev/null \ - | grep --after-context 1 featurever \ - | tail --lines 1) - PROJECT_NAME=openjdk - REPO_NAME=jdk"${FEATURE_VERSION}"u - # Skip -ga tags since those are the same as the most recent non-ga tag, and - # the non-ga tag is the one that is used to generated the official source - # tarball. For example: - # ca760c86642aa2e0d9b571aaabac054c0239fbdc refs/tags/jdk-17.0.10-ga^{} - # 25a2e6c20c9a96853714284cabc6b456eb095070 refs/tags/jdk-17.0.10-ga - # ca760c86642aa2e0d9b571aaabac054c0239fbdc refs/tags/jdk-17.0.10+7^{} - # e49c5749b10f3e90274b72e9279f794fdd191d27 refs/tags/jdk-17.0.10+7 - VERSION=$(git ls-remote --tags --refs --sort=-version:refname \ - "${OPENJDK_URL_DEFAULT}/${PROJECT_NAME}/${REPO_NAME}.git" \ - "jdk-${FEATURE_VERSION}*" \ - | grep --invert-match '\-ga$' \ - | head --lines 1 | cut --characters 52-) - FILE_NAME_ROOT=open${VERSION} - WITH_TEMP=1 -fi - -if [ "$WITH_TEMP" != "" ] ; then - pushd "$(mktemp --directory --tmpdir temp-generated-source-tarball-XXX)" -fi - -if [ "$VERSION" = "" ] ; then - echo "No VERSION specified" - exit 2 -fi -echo "Version: ${VERSION}" - -NUM_VER=${VERSION##jdk-} -RELEASE_VER=${NUM_VER%%+*} -BUILD_VER=${NUM_VER##*+} -MAJOR_VER=${RELEASE_VER%%.*} -echo "Major version is ${MAJOR_VER}, release ${RELEASE_VER}, build ${BUILD_VER}" - -if [ "$BOOT_JDK" = "" ] ; then - echo "No boot JDK specified". - BOOT_JDK=/usr/lib/jvm/java-${MAJOR_VER}-openjdk; - echo -n "Checking for ${BOOT_JDK}..."; - if [ -d "${BOOT_JDK}" ] && [ -x "${BOOT_JDK}"/bin/java ] ; then - echo "Boot JDK found at ${BOOT_JDK}"; - else - echo "Not found"; - PREV_VER=$((MAJOR_VER - 1)); - BOOT_JDK=/usr/lib/jvm/java-${PREV_VER}-openjdk; - echo -n "Checking for ${BOOT_JDK}..."; - if [ -d ${BOOT_JDK} ] && [ -x ${BOOT_JDK}/bin/java ] ; then - echo "Boot JDK found at ${BOOT_JDK}"; - else - echo "Not found"; - exit 4; - fi - fi -else - echo "Boot JDK: ${BOOT_JDK}"; -fi - -if [ "$OPENJDK_URL" = "" ] ; then - OPENJDK_URL=${OPENJDK_URL_DEFAULT} - echo "No OpenJDK URL specified; defaulting to ${OPENJDK_URL}" -else - echo "OpenJDK URL: ${OPENJDK_URL}" -fi - -if [ "$COMPRESSION" = "" ] ; then - # rhel 5 needs tar.gz - COMPRESSION=${COMPRESSION_DEFAULT} -fi -echo "Creating a tar.${COMPRESSION} archive" - -if [ "$FILE_NAME_ROOT" = "" ] ; then - if [ "$PROJECT_NAME" = "" ] ; then - echo "No PROJECT_NAME specified, needed by FILE_NAME_ROOT" - exit 1 - fi - FILE_NAME_ROOT=${PROJECT_NAME}-${VERSION} - echo "No file name root specified; default to ${FILE_NAME_ROOT}" -fi -if [ "$REPO_ROOT" = "" ] ; then - if [ "$PROJECT_NAME" = "" ] ; then - echo "No PROJECT_NAME specified, needed by REPO_ROOT" - exit 1 - fi - if [ "$REPO_NAME" = "" ] ; then - echo "No REPO_NAME specified, needed by REPO_ROOT" - exit 3 - fi - REPO_ROOT="${OPENJDK_URL}/${PROJECT_NAME}/${REPO_NAME}.git" - echo "No repository root specified; default to ${REPO_ROOT}" -fi; - -if [ "$TO_COMPRESS" = "" ] ; then - TO_COMPRESS="${VERSION}" - echo "No targets to be compressed specified ; default to ${TO_COMPRESS}" -fi; - -echo -e "Settings:" -echo -e "\tVERSION: ${VERSION}" -echo -e "\tPROJECT_NAME: ${PROJECT_NAME}" -echo -e "\tREPO_NAME: ${REPO_NAME}" -echo -e "\tOPENJDK_URL: ${OPENJDK_URL}" -echo -e "\tCOMPRESSION: ${COMPRESSION}" -echo -e "\tFILE_NAME_ROOT: ${FILE_NAME_ROOT}" -echo -e "\tREPO_ROOT: ${REPO_ROOT}" -echo -e "\tTO_COMPRESS: ${TO_COMPRESS}" -echo -e "\tBOOT_JDK: ${BOOT_JDK}" -echo -e "\tWITH_TEMP: ${WITH_TEMP}" -echo -e "\tOPENJDK_LATEST: ${OPENJDK_LATEST}" - -if [ -d "${FILE_NAME_ROOT}" ] ; then - echo "Reusing existing ${FILE_NAME_ROOT}" - STAT_TIME="$(stat --format=%Y "${FILE_NAME_ROOT}")" - TAR_TIME="$(date --date=@"${STAT_TIME}" --iso-8601=seconds)" -else - mkdir "${FILE_NAME_ROOT}" - pushd "${FILE_NAME_ROOT}" - echo "Cloning ${VERSION} root repository from ${REPO_ROOT}" - if realpath -q "${REPO_ROOT}"; then - echo "Local path detected; not adding depth argument"; - DEPTH="--"; - else - DEPTH="--depth=1"; - echo "Remote repository detected; adding ${DEPTH}"; - fi - git clone -b "${VERSION}" "${DEPTH}" "${REPO_ROOT}" "${VERSION}" - pushd "${VERSION}" - TAR_TIME="$(git log --max-count 1 --format=%cI)" - popd - popd -fi -pushd "${FILE_NAME_ROOT}" - # Generate .src-rev so build has knowledge of the revision the tarball was - # created from - mkdir build - pushd build - sh "${PWD}"/../"${VERSION}"/configure --with-boot-jdk="${BOOT_JDK}" - make store-source-revision - popd - rm -rf build - - # Remove commit checks - echo "Removing $(find "${VERSION}" -name '.jcheck' -print)" - find "${VERSION}" -name '.jcheck' -print0 | xargs -0 rm -r - - # Remove history and GHA - echo "find ${VERSION} -name '.hgtags'" - find "${VERSION}" -name '.hgtags' -exec rm -v '{}' '+' - echo "find ${VERSION} -name '.hgignore'" - find "${VERSION}" -name '.hgignore' -exec rm -v '{}' '+' - echo "find ${VERSION} -name '.gitattributes'" - find "${VERSION}" -name '.gitattributes' -exec rm -v '{}' '+' - echo "find ${VERSION} -name '.gitignore'" - find "${VERSION}" -name '.gitignore' -exec rm -v '{}' '+' - # Work around some Git objects not having write permissions. - echo "chmod --recursive u+w ${VERSION}/.git" - chmod --recursive u+w "${VERSION}"/.git - echo "find ${VERSION} -name '.git'" - find "${VERSION}" -name '.git' -exec rm -rv '{}' '+' - echo "find ${VERSION} -name '.github'" - find "${VERSION}" -name '.github' -exec rm -rv '{}' '+' - - echo "Compressing remaining forest" - if [ "$COMPRESSION" = "xz" ] ; then - SWITCH=cJf - else - SWITCH=czf - fi - EA_PART="$(awk -F= \ - '/^DEFAULT_PROMOTED_VERSION_PRE/ { if ($2) print "-"$2 }' \ - "${VERSION}"/make/conf/version-numbers.conf)" - TARBALL_NAME=${FILE_NAME_ROOT}${EA_PART}.tar.${COMPRESSION} - XZ_OPT=${XZ_OPT-"-T0"} \ - tar --mtime="${TAR_TIME}" --owner=root --group=root --sort=name \ - --exclude-vcs -$SWITCH "${TARBALL_NAME}" "${TO_COMPRESS}" - mv "${TARBALL_NAME}" .. -popd -if [ "$WITH_TEMP" != "" ] ; then - echo "Tarball is: $(realpath .)/${TARBALL_NAME}" - popd -else - echo -n "Done. You may want to remove the uncompressed version" - echo " - $FILE_NAME_ROOT" -fi - -# Local Variables: -# compile-command: "shellcheck generate_source_tarball.sh" -# fill-column: 80 -# indent-tabs-mode: nil -# sh-basic-offset: 4 -# End: diff --git a/scripts/get_bundle_versions.sh b/scripts/get_bundle_versions.sh deleted file mode 100755 index dddbee4..0000000 --- a/scripts/get_bundle_versions.sh +++ /dev/null @@ -1,172 +0,0 @@ -#!/usr/bin/env sh - -# Copyright (C) 2025 Red Hat, Inc. -# Original written by Antonio Vieiro -# -# This program is free software: you can redistribute it and/or modify -# it under the terms of the GNU Affero General Public License as -# published by the Free Software Foundation, either version 3 of the -# License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Affero General Public License for more details. -# -# You should have received a copy of the GNU Affero General Public License -# along with this program. If not, see . - -if [ $# -ne 1 ]; then - echo "Usage: $0 openjdk-root-directory" - exit 1 -fi - -JDKROOT=$1 - -if [ ! -d "${JDKROOT}" ] ; then - echo "${JDKROOT} is not a directory."; - exit 2 -fi - -# Work out the OpenJDK version -# OpenJDK >= 10 has its version in the build machinery -# OpenJDK >= 17 stores it in a new location (JDK-8258246) -VERSION_FILE="${JDKROOT}"/make/conf/version-numbers.conf -printf "Checking for %s..." "${VERSION_FILE}"; -if [ ! -f "${VERSION_FILE}" ] ; then - VERSION_FILE="${JDKROOT}"/make/autoconf/version-numbers - echo "Not found; using old version file ${VERSION_FILE}"; -else - echo "found."; -fi -if [ -e "${VERSION_FILE}" ] ; then - openjdk_version=$(grep '^DEFAULT_VERSION_FEATURE' "${VERSION_FILE}" | cut -d '=' -f 2) -elif [ -e "${JDKROOT}"/jdk/src/java.base/share/classes/java/lang/Object.java ] ; then - openjdk_version=9; -elif [ -e "${JDKROOT}"/common/autoconf ] ; then - openjdk_version=8; -else - openjdk_version=7; -fi -echo "OpenJDK version: ${openjdk_version}"; - -# -# Freetype -# -if [ "${openjdk_version}" -gt 8 ] ; then - FREETYPE=src/java.desktop/share/native/libfreetype/include/freetype/freetype.h - ABS_FREETYPE="${JDKROOT}"/"${FREETYPE}" - if [ ! -f "${ABS_FREETYPE}" ]; then - echo "Freetype header not found!" - exit 2 - fi - FREETYPE_VERSION=$(awk '/#define FREETYPE_MAJOR/ {MAJOR=$3} /#define FREETYPE_MINOR/ {MINOR=$3} /#define FREETYPE_PATCH/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_FREETYPE}") -else - echo "No bundled FreeType on ${openjdk_version}"; -fi - -# giflib -if [ "${openjdk_version}" -gt 8 ] ; then - GIFLIB=src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h -else - GIFLIB=jdk/src/share/native/sun/awt/giflib/gif_lib.h -fi -ABS_GIFLIB="${JDKROOT}"/"${GIFLIB}" -if [ ! -f "${ABS_GIFLIB}" ]; then - echo "giflib header not found!" - exit 3 -fi -GIFLIB_VERSION=$(awk '/#define GIFLIB_MAJOR/ {MAJOR=$3} /#define GIFLIB_MINOR/ {MINOR=$3} /#define GIFLIB_RELEASE/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_GIFLIB}") - -# harfbuzz -if [ "${openjdk_version}" -gt 8 ] ; then - HARFBUZZ=src/java.desktop/share/native/libharfbuzz/hb-version.h - ABS_HARFBUZZ="${JDKROOT}/${HARFBUZZ}" - if [ ! -f "${ABS_HARFBUZZ}" ]; then - echo "HarfBuzz header not found!" - exit 4 - fi - HARFBUZZ_VERSION=$(awk '/#define HB_VERSION_MAJOR/ {MAJOR=$3} /#define HB_VERSION_MINOR/ {MINOR=$3} /#define HB_VERSION_MICRO/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_HARFBUZZ}") -else - echo "No HarfBuzz on ${openjdk_version}"; -fi - -# lcms -if [ "${openjdk_version}" -gt 8 ] ; then - LCMS=src/java.desktop/share/native/liblcms/lcms2.h -else - LCMS=jdk/src/share/native/sun/java2d/cmm/lcms/lcms2.h -fi -ABS_LCMS="${JDKROOT}"/"${LCMS}" -if [ ! -f "${ABS_LCMS}" ]; then - echo "lcms header not found!" - exit 5 -fi -LCMS_VERSION=$(awk '/#define LCMS_VERSION/ { MAJOR=int($3 / 1000); REST=$3 % 1000; MINOR=int(REST / 10); PATCH=REST % 10; } END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_LCMS}") - -# jpeg -if [ "${openjdk_version}" -gt 8 ] ; then - JPEG=src/java.desktop/share/native/libjavajpeg/jpeglib.h -else - JPEG=jdk/src/share/native/sun/awt/image/jpeg/jpeglib.h -fi -ABS_JPEG="${JDKROOT}"/"${JPEG}" -if [ ! -f "${ABS_JPEG}" ]; then - echo "jpeg header not found!" - exit 6 -fi -JPEG_VERSION=$(awk '/#define JPEG_LIB_VERSION/ { VERSION=$3; MAJOR=int(VERSION / 10); MINOR=VERSION%10; } END {printf "%s%c", MAJOR, (MINOR+96)}' "${ABS_JPEG}") - -# png -if [ "${openjdk_version}" -gt 8 ] ; then - PNG=src/java.desktop/share/native/libsplashscreen/libpng/png.h -else - PNG=jdk/src/share/native/sun/awt/libpng/png.h -fi -ABS_PNG="${JDKROOT}"/"${PNG}" -if [ ! -f "${ABS_PNG}" ]; then - echo "png header not found!" - exit 7 -fi -PNG_VERSION=$(awk '/#define PNG_LIBPNG_VER_STRING/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_PNG}") - -# zlib -if [ "${openjdk_version}" -gt 8 ] ; then - ZLIB=src/java.base/share/native/libzip/zlib/zlib.h -else - ZLIB=jdk/src/share/native/java/util/zip/zlib/zlib.h -fi -ABS_ZLIB="${JDKROOT}"/"${ZLIB}" -if [ ! -f "${ABS_ZLIB}" ]; then - echo "zlib header not found!" - exit 8 -fi -ZLIB_VERSION=$(awk '/#define ZLIB_VERSION/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_ZLIB}") - -# Print output -printf "\nRPM definitions:\n" -if [ "${openjdk_version}" -gt 8 ] ; then - echo "# Version in ${FREETYPE}" - echo "Provides: bundled(freetype) = ${FREETYPE_VERSION}" -fi -echo "# Version in ${GIFLIB}" -echo "Provides: bundled(giflib) = ${GIFLIB_VERSION}" -if [ "${openjdk_version}" -gt 8 ] ; then - echo "# Version in ${HARFBUZZ}" - echo "Provides: bundled(harfbuzz) = ${HARFBUZZ_VERSION}" -fi -echo "# Version in ${LCMS}" -echo "Provides: bundled(lcms2) = ${LCMS_VERSION}" -echo "# Version in ${JPEG}" -echo "Provides: bundled(libjpeg) = ${JPEG_VERSION}" -echo "# Version in ${PNG}" -echo "Provides: bundled(libpng) = ${PNG_VERSION}" -echo "# Version in ${ZLIB}" -echo "Provides: bundled(zlib) = ${ZLIB_VERSION}" - -# Local Variables: -# compile-command: "shellcheck get_bundle_versions.sh" -# fill-column: 80 -# indent-tabs-mode: nil -# sh-basic-offset: 4 -# End: diff --git a/scripts/icedtea_sync.sh b/scripts/icedtea_sync.sh deleted file mode 100755 index c1b8f6a..0000000 --- a/scripts/icedtea_sync.sh +++ /dev/null @@ -1 +0,0 @@ -# this file is intentionally not here, as portable builds do not have desktop integration diff --git a/scripts/openjdk_news.sh b/scripts/openjdk_news.sh deleted file mode 100755 index 9574915..0000000 --- a/scripts/openjdk_news.sh +++ /dev/null @@ -1,114 +0,0 @@ -#!/bin/bash - -# Copyright (C) 2024 Red Hat, Inc. -# Written by Andrew John Hughes , 2012-2022 -# -# This program is free software: you can redistribute it and/or modify -# it under the terms of the GNU Affero General Public License as -# published by the Free Software Foundation, either version 3 of the -# License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Affero General Public License for more details. -# -# You should have received a copy of the GNU Affero General Public License -# along with this program. If not, see . - -OLD_RELEASE=$1 -NEW_RELEASE=$2 -REPO=$3 -SUBDIR=$4 -SCRIPT_DIR=$(dirname "${0}") - -if test "${SUBDIR}" = ""; then - echo "No subdirectory specified; using ."; - SUBDIR="."; -fi - -if test "$REPO" = ""; then - echo "No repository specified; using ${PWD}" - REPO=${PWD} -fi - -if test "${TMPDIR}" = ""; then - TMPDIR=/tmp; -fi - -echo "Repository: ${REPO}" - -if [ -e "${REPO}/.git" ] ; then - TYPE=git; -elif [ -e "${REPO}/.hg" ] ; then - TYPE=hg; -else - echo "No Mercurial or Git repository detected."; - exit 1; -fi - -if test "$OLD_RELEASE" = "" || test "$NEW_RELEASE" = ""; then - echo "ERROR: Need to specify old and new release"; - exit 2; -fi - -echo "Listing fixes between $OLD_RELEASE and $NEW_RELEASE in $REPO" -rm -f "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" "${TMPDIR}/fixes" -for repos in . $("${SCRIPT_DIR}/discover_trees.sh" "${REPO}"); -do - if test "$TYPE" = "hg"; then - hg log -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R "$REPO/$repos" -G -M "${REPO}/${SUBDIR}" | \ - grep -E '^[o:| ]*summary'|grep -v 'Added tag'|sed -r 's#^[o:| ]*summary:\W*([0-9])# - JDK-\1#'| \ - sed 's#^[o:| ]*summary:\W*# - #' >> "${TMPDIR}/fixes2"; - hg log -v -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R "$REPO/$repos" -G -M "${REPO}/${SUBDIR}" | \ - grep -E '^[o:| ]*[0-9]{7}'|sed -r 's#^[o:| ]*([0-9]{7})# - JDK-\1#' >> "${TMPDIR}/fixes3"; - else - git -C "${REPO}" log --no-merges --pretty=format:%B "${NEW_RELEASE}...${OLD_RELEASE}" -- "${SUBDIR}" |grep -E '^[0-9]{7}' | \ - sed -r 's#^([0-9])# - JDK-\1#' >> "${TMPDIR}/fixes2"; - touch "${TMPDIR}/fixes3" ; # unused - fi -done - -sort "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" > "${TMPDIR}/fixes4" -uniq "${TMPDIR}/fixes4" > "${TMPDIR}/fixes" -rm -f "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" - -if ! [ -s "${TMPDIR}/fixes" ] ; then - echo "Failed to obtain fixes."; - exit 3; -fi - -echo "In ${TMPDIR}/fixes:" -cat "${TMPDIR}/fixes" - -printf "\nChecking for duplicates..."; -if uniq -d "${TMPDIR}/fixes4" | grep 'JDK' > "${TMPDIR}/dupes"; then - printf "found.\nWARNING: Review the following duplicates:\n"; - cat "${TMPDIR}/dupes"; -else - echo "No apparent duplicates."; -fi -rm -f "${TMPDIR}/fixes4"; - -printf "\nChecking for backouts..."; -if grep -i 'backout' "${TMPDIR}/fixes" > "${TMPDIR}/backouts"; then - printf "found.\nWARNING: Review the following backouts:\n" - cat "${TMPDIR}/backouts"; -else - echo "No apparent backouts."; -fi -printf "\nChecking for bundled library updates..."; -if grep -iE ':( \(tz\))? update.*(freetype|gif|harfbuzz|lcms|jpeg|png|timezone|zlib)' "${TMPDIR}/fixes" > "${TMPDIR}/bundles"; then - printf "found.\nWARNING: Review the following with respect to bundled provides:\n"; - cat "${TMPDIR}/bundles"; - echo "Compare the output of $(dirname "${0}")/get_bundle_versions.sh with the RPM using the JDK source tree" -else - echo "No apparent library updates."; -fi - -# Local Variables: -# compile-command: "shellcheck openjdk_news.sh" -# fill-column: 80 -# indent-tabs-mode: nil -# sh-basic-offset: 4 -# End: diff --git a/sources b/sources index 404d038..d90c787 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (openjdk-26+29-ea.tar.xz) = 4e80882e0de26eff7d46d762e255911d42544473cc5f12ab0af1997969a14cc697e1164cb3c90d894359b58cc42dbd2b233f00fa807dbfad41583da278e26666 +SHA512 (openjdk-jdk20u-jdk-20.0.1+9.tar.xz) = 41585ff383497464e5d6c278b39bed9eeddc80add72b65bd2ab8c95867ce5bc8bfb0ea860fcaf7c4cc5d41122fd62cf3348fa6c788a1978bdc7f20c3d0289b9b