diff --git a/.gitignore b/.gitignore index 1f1fc8c..b56c1ea 100644 --- a/.gitignore +++ b/.gitignore @@ -51,11 +51,3 @@ /openjdk-24+34-ea.tar.xz /openjdk-24+36.tar.xz /openjdk-24.0.1+9.tar.xz -/openjdk-24.0.2+12.tar.xz -/openjdk-25+13-ea.tar.xz -/openjdk-25+26-ea.tar.xz -/openjdk-25+32-ea.tar.xz -/openjdk-jdk-25+36.tar.xz -/openjdk-25+36.tar.xz -/openjdk-25.0.1+8.tar.xz -/openjdk-26+29-ea.tar.xz diff --git a/0001-8352692-Add-support-for-extra-jlink-options.patch b/0001-8352692-Add-support-for-extra-jlink-options.patch new file mode 100644 index 0000000..6b20564 --- /dev/null +++ b/0001-8352692-Add-support-for-extra-jlink-options.patch @@ -0,0 +1,65 @@ +From bc0ebeddc31949a5d84a9494e8adccc2bade357e Mon Sep 17 00:00:00 2001 +From: Severin Gehwolf +Date: Wed, 26 Mar 2025 10:53:07 +0000 +Subject: [PATCH 1/2] 8352692: Add support for extra jlink options + +Reviewed-by: ihse, erikj +--- + make/Images.gmk | 4 ++++ + make/autoconf/jdk-options.m4 | 12 ++++++++++++ + make/autoconf/spec.gmk.template | 1 + + 3 files changed, 17 insertions(+) + +diff --git a/make/Images.gmk b/make/Images.gmk +index c5d0ef11b5d..cbaf85f7942 100644 +--- a/make/Images.gmk ++++ b/make/Images.gmk +@@ -101,6 +101,10 @@ ifeq ($(JLINK_PRODUCE_LINKABLE_RUNTIME), true) + JLINK_JDK_EXTRA_OPTS += --generate-linkable-runtime + endif + ++ifneq ($(JLINK_USER_EXTRA_FLAGS), ) ++ JLINK_JDK_EXTRA_OPTS += $(JLINK_USER_EXTRA_FLAGS) ++endif ++ + $(eval $(call SetupExecute, jlink_jdk, \ + WARN := Creating jdk image, \ + DEPS := $(JDK_JMODS) $(BASE_RELEASE_FILE) \ +diff --git a/make/autoconf/jdk-options.m4 b/make/autoconf/jdk-options.m4 +index 61638ce5a2c..b6fce9cc323 100644 +--- a/make/autoconf/jdk-options.m4 ++++ b/make/autoconf/jdk-options.m4 +@@ -628,6 +628,18 @@ AC_DEFUN_ONCE([JDKOPT_SETUP_JLINK_OPTIONS], + DEFAULT_DESC: [enabled by default unless --enable-linkable-runtime is set], + CHECKING_MSG: [if packaged modules are kept]) + AC_SUBST(JLINK_KEEP_PACKAGED_MODULES) ++ ++ ################################################################################ ++ # ++ # Extra jlink options to be (optionally) passed to the JDK build ++ # ++ UTIL_ARG_WITH(NAME: extra-jlink-flags, TYPE: string, ++ DEFAULT: [], ++ DESC: [extra flags to be passed to jlink during the build], ++ OPTIONAL: true) ++ ++ JLINK_USER_EXTRA_FLAGS="$EXTRA_JLINK_FLAGS" ++ AC_SUBST(JLINK_USER_EXTRA_FLAGS) + ]) + + ################################################################################ +diff --git a/make/autoconf/spec.gmk.template b/make/autoconf/spec.gmk.template +index 18770c6d360..63d5ce05147 100644 +--- a/make/autoconf/spec.gmk.template ++++ b/make/autoconf/spec.gmk.template +@@ -710,6 +710,7 @@ NEW_JAVADOC = $(INTERIM_LANGTOOLS_ARGS) $(JAVADOC_MAIN_CLASS) + JMOD_COMPRESS := @JMOD_COMPRESS@ + JLINK_KEEP_PACKAGED_MODULES := @JLINK_KEEP_PACKAGED_MODULES@ + JLINK_PRODUCE_LINKABLE_RUNTIME := @JLINK_PRODUCE_LINKABLE_RUNTIME@ ++JLINK_USER_EXTRA_FLAGS := @JLINK_USER_EXTRA_FLAGS@ + + RCFLAGS := @RCFLAGS@ + +-- +2.49.0 + diff --git a/0002-8352689-Allow-for-hash-sum-overrides-when-linking-fr.patch b/0002-8352689-Allow-for-hash-sum-overrides-when-linking-fr.patch new file mode 100644 index 0000000..0cc63db --- /dev/null +++ b/0002-8352689-Allow-for-hash-sum-overrides-when-linking-fr.patch @@ -0,0 +1,830 @@ +From 2a5c9b874aa86b244dec041bed05ca3d1f66ccaa Mon Sep 17 00:00:00 2001 +From: Severin Gehwolf +Date: Thu, 27 Mar 2025 14:50:54 +0100 +Subject: [PATCH 2/2] 8352689: Allow for hash sum overrides when linking from + the run-time image + +--- + .../jdk/tools/jlink/internal/JRTArchive.java | 34 +++++- + .../jdk/tools/jlink/internal/Jlink.java | 12 +- + .../jdk/tools/jlink/internal/JlinkTask.java | 72 +++++++++++- + .../jlink/internal/LinkableRuntimeImage.java | 17 ++- + .../tools/jlink/resources/jlink.properties | 6 + + test/jdk/tools/jlink/IntegrationTest.java | 4 +- + .../jlink/runtimeImage/AddOptionsTest.java | 1 - + .../BasicJlinkMissingJavaBase.java | 1 - + .../jlink/runtimeImage/BasicJlinkTest.java | 1 - + .../runtimeImage/CustomModuleJlinkTest.java | 1 - + .../runtimeImage/GenerateJLIClassesTest.java | 1 - + .../runtimeImage/JavaSEReproducibleTest.java | 1 - + .../KeepPackagedModulesFailTest.java | 1 - + .../runtimeImage/ModifiedFilesExitTest.java | 1 - + .../ModifiedFilesWarningTest.java | 1 - + .../ModifiedFilesWithShaOverrideBase.java | 111 ++++++++++++++++++ + .../ModifiedFilesWithShaOverrideFileTest.java | 77 ++++++++++++ + .../ModifiedFilesWithShaOverrideTest.java | 65 ++++++++++ + .../jlink/runtimeImage/MultiHopTest.java | 1 - + ...PackagedModulesVsRuntimeImageLinkTest.java | 1 - + .../PatchedJDKModuleJlinkTest.java | 1 - + .../jlink/runtimeImage/SystemModulesTest.java | 1 - + .../runtimeImage/SystemModulesTest2.java | 1 - + 23 files changed, 376 insertions(+), 36 deletions(-) + create mode 100644 test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideBase.java + create mode 100644 test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideFileTest.java + create mode 100644 test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideTest.java + +diff --git a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JRTArchive.java b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JRTArchive.java +index df7d35ac777..823d03c50fe 100644 +--- a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JRTArchive.java ++++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JRTArchive.java +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2024, Red Hat, Inc. ++ * Copyright (c) 2024, 2025, Red Hat, Inc. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -41,10 +41,12 @@ + import java.util.ArrayList; + import java.util.Arrays; + import java.util.Collections; ++import java.util.HashSet; + import java.util.HexFormat; + import java.util.List; + import java.util.Map; + import java.util.Objects; ++import java.util.Set; + import java.util.function.Function; + import java.util.function.Predicate; + import java.util.stream.Collectors; +@@ -74,6 +76,7 @@ public class JRTArchive implements Archive { + // Maps a module resource path to the corresponding diff to packaged + // modules for that resource (if any) + private final Map resDiff; ++ private final Map> altHashSums; + private final boolean errorOnModifiedFile; + private final TaskHelper taskHelper; + +@@ -86,11 +89,15 @@ public class JRTArchive implements Archive { + * install aborts the link. + * @param perModDiff The lib/modules (a.k.a jimage) diff for this module, + * possibly an empty list if there are no differences. ++ * @param altHashSums A map of alternative hash sums for files in ++ * a module, possibly empty. ++ * @param taskHelper The task helper reference. + */ + JRTArchive(String module, + Path path, + boolean errorOnModifiedFile, + List perModDiff, ++ Map> altHashSums, + TaskHelper taskHelper) { + this.module = module; + this.path = path; +@@ -105,6 +112,7 @@ public class JRTArchive implements Archive { + this.resDiff = Objects.requireNonNull(perModDiff).stream() + .collect(Collectors.toMap(ResourceDiff::getName, Function.identity())); + this.taskHelper = taskHelper; ++ this.altHashSums = altHashSums; + } + + @Override +@@ -217,7 +225,21 @@ private void addNonClassResources() { + + // Read from the base JDK image. + Path path = BASE.resolve(m.resPath); +- if (shaSumMismatch(path, m.hashOrTarget, m.symlink)) { ++ // Allow for additional hash sums so as to support ++ // file modifications done after jlink has run at build ++ // time. For example for Windows builds done with ++ // --with-external-symbols-in-bundles=public or ++ // distribution builds, where some post-processing happens ++ // on produced binaries and libraries invalidating the ++ // hash sum included in the jdk.jlink module for those ++ // files at jlink-time ++ Set shaSums = new HashSet<>(); ++ shaSums.add(m.hashOrTarget); ++ Set extra = altHashSums.get(m.resPath); ++ if (extra != null) { ++ shaSums.addAll(extra); ++ } ++ if (shaSumMismatch(path, shaSums, m.symlink)) { + if (errorOnModifiedFile) { + String msg = taskHelper.getMessage("err.runtime.link.modified.file", path.toString()); + IOException cause = new IOException(msg); +@@ -239,14 +261,12 @@ private void addNonClassResources() { + } + } + +- static boolean shaSumMismatch(Path res, String expectedSha, boolean isSymlink) { ++ static boolean shaSumMismatch(Path res, Set expectedShas, boolean isSymlink) { + if (isSymlink) { + return false; + } + // handle non-symlink resources + try { +- HexFormat format = HexFormat.of(); +- byte[] expected = format.parseHex(expectedSha); + MessageDigest digest = MessageDigest.getInstance("SHA-512"); + try (InputStream is = Files.newInputStream(res)) { + byte[] buf = new byte[1024]; +@@ -256,7 +276,9 @@ static boolean shaSumMismatch(Path res, String expectedSha, boolean isSymlink) { + } + } + byte[] actual = digest.digest(); +- return !MessageDigest.isEqual(expected, actual); ++ // Convert actual to string ++ String strActual = HexFormat.of().formatHex(actual); ++ return !expectedShas.contains(strActual); + } catch (Exception e) { + throw new AssertionError("SHA-512 sum check failed!", e); + } +diff --git a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/Jlink.java b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/Jlink.java +index 99029651bfb..12e26bd4aef 100644 +--- a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/Jlink.java ++++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/Jlink.java +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2015, 2024, Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 2015, 2025, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -148,7 +148,7 @@ public static final class JlinkConfiguration { + private final Set modules; + private final ModuleFinder finder; + private final boolean linkFromRuntimeImage; +- private final boolean ignoreModifiedRuntime; ++ private final LinkableRuntimeImage.Config runtimeImageConfig; + private final boolean generateRuntimeImage; + + /** +@@ -162,13 +162,13 @@ public JlinkConfiguration(Path output, + Set modules, + ModuleFinder finder, + boolean linkFromRuntimeImage, +- boolean ignoreModifiedRuntime, ++ LinkableRuntimeImage.Config runtimeImageConfig, + boolean generateRuntimeImage) { + this.output = output; + this.modules = Objects.requireNonNull(modules); + this.finder = finder; + this.linkFromRuntimeImage = linkFromRuntimeImage; +- this.ignoreModifiedRuntime = ignoreModifiedRuntime; ++ this.runtimeImageConfig = runtimeImageConfig; + this.generateRuntimeImage = generateRuntimeImage; + } + +@@ -198,8 +198,8 @@ public boolean linkFromRuntimeImage() { + return linkFromRuntimeImage; + } + +- public boolean ignoreModifiedRuntime() { +- return ignoreModifiedRuntime; ++ public LinkableRuntimeImage.Config runtimeImageConfig() { ++ return runtimeImageConfig; + } + + public boolean isGenerateRuntimeImage() { +diff --git a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JlinkTask.java b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JlinkTask.java +index 928b9a47934..bf63f7e6795 100644 +--- a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JlinkTask.java ++++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JlinkTask.java +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2015, 2024, Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 2015, 2025, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -191,7 +191,43 @@ public class JlinkTask { + // be used for linking from the run-time image. + new Option(false, (task, opt, arg) -> { + task.options.generateLinkableRuntime = true; +- }, true, "--generate-linkable-runtime") ++ }, true, "--generate-linkable-runtime"), ++ new Option(true, (task, opt, arg) -> { ++ if (arg.startsWith("@")) { ++ // Read overrides from file ++ if (!task.options.shaOverrides.isEmpty()) { ++ // Only allow a single @file value ++ throw taskHelper.newBadArgs("err.sha.overrides.multiple"); ++ } ++ // Ignore non-existing sha overrides file. ++ // ++ // This is to allow for custom builds needing to optionally ++ // support run-time image links on (possibly) modified ++ // binaries/debuginfo files done after the JDK build ++ // ++ // Allow for JAVA_HOME relative paths for the file, by replacing ++ // the ${java.home} token in the file name ++ String fileName = arg.substring(1); ++ if (fileName.startsWith("${java.home}")) { ++ String javaHome = System.getProperty("java.home"); ++ fileName = javaHome + fileName.substring(12 /* ${java.home}.length() */); ++ } ++ Path file = Paths.get(fileName); ++ if (Files.exists(file)) { ++ try { ++ Files.readAllLines(file).stream() ++ .forEach(task.options.shaOverrides::add); ++ } catch (IOException e) { ++ throw taskHelper.newBadArgs("err.sha.overrides.freaderr", file.toString()); ++ } ++ } ++ } else { ++ // Allow multiple values, separated by comma in addition to ++ // multiple times the same option. ++ Arrays.asList(arg.split(",")).stream() ++ .forEach(task.options.shaOverrides::add); ++ } ++ }, true, "--sha-overrides"), + }; + + +@@ -235,6 +271,7 @@ static class OptionsValues { + boolean suggestProviders = false; + boolean ignoreModifiedRuntime = false; + boolean generateLinkableRuntime = false; ++ final Set shaOverrides = new HashSet<>(); + } + + public static final String OPTIONS_RESOURCE = "jdk/tools/jlink/internal/options"; +@@ -459,14 +496,41 @@ private JlinkConfiguration initJlinkConfig() throws BadArgs { + throw taskHelper.newBadArgs("err.runtime.link.packaged.mods"); + } + ++ LinkableRuntimeImage.Config linkableRuntimeConfig = new LinkableRuntimeImage.Config( ++ options.ignoreModifiedRuntime, ++ isLinkFromRuntime ? buildShaSumMap(taskHelper, options.shaOverrides) : null); + return new JlinkConfiguration(options.output, + roots, + finder, + isLinkFromRuntime, +- options.ignoreModifiedRuntime, ++ linkableRuntimeConfig, + options.generateLinkableRuntime); + } + ++ private Map>> buildShaSumMap(TaskHelper taskHelper, ++ Set shaOverrides) throws BadArgs { ++ Map>> moduleToFiles = new HashMap<>(); ++ for (String t: shaOverrides) { ++ String trimmed = t.trim(); ++ if (trimmed.startsWith("#")) { ++ // skip comment lines ++ continue; ++ } ++ String[] tokens = trimmed.split("\\|"); ++ if (tokens.length != 3) { ++ throw taskHelper.newBadArgs("err.sha.overrides.bad.format", t); ++ } ++ // t is a '|'-separated item of (in that order): ++ // ++ // ++ // ++ Map> perModuleMap = moduleToFiles.computeIfAbsent(tokens[0], k -> new HashMap<>()); ++ Set shaSumsPerFile = perModuleMap.computeIfAbsent(tokens[1], k -> new HashSet<>()); ++ shaSumsPerFile.add(tokens[2]); ++ } ++ return moduleToFiles; ++ } ++ + /* + * Creates a ModuleFinder for the given module paths. + */ +@@ -788,7 +852,7 @@ private static Archive newArchive(String module, + taskHelper.getMessage("err.not.a.module.directory", path)); + } + } else if (config.linkFromRuntimeImage()) { +- return LinkableRuntimeImage.newArchive(module, path, config.ignoreModifiedRuntime(), taskHelper); ++ return LinkableRuntimeImage.newArchive(module, path, config.runtimeImageConfig(), taskHelper); + } else { + throw new IllegalArgumentException( + taskHelper.getMessage("err.not.modular.format", module, path)); +diff --git a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java +index 935af4585ad..a9b146d55a2 100644 +--- a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java ++++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2024, Red Hat, Inc. ++ * Copyright (c) 2024, 2025, Red Hat, Inc. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -29,6 +29,8 @@ + import java.io.InputStream; + import java.nio.file.Path; + import java.util.List; ++import java.util.Map; ++import java.util.Set; + + import jdk.tools.jlink.internal.runtimelink.ResourceDiff; + +@@ -67,7 +69,7 @@ private static InputStream getDiffInputStream(String module) throws IOException + + public static Archive newArchive(String module, + Path path, +- boolean ignoreModifiedRuntime, ++ Config config, + TaskHelper taskHelper) { + assert isLinkableRuntime(); + // Here we retrieve the per module difference file, which is +@@ -81,8 +83,15 @@ public static Archive newArchive(String module, + throw new AssertionError("Failure to retrieve resource diff for " + + "module " + module, e); + } +- return new JRTArchive(module, path, !ignoreModifiedRuntime, perModuleDiff, taskHelper); ++ return new JRTArchive(module, ++ path, ++ !config.ignoreModifiedRuntime, ++ perModuleDiff, ++ // Empty map if no alternative sha sums ++ config.altHashSums.computeIfAbsent(module, k -> Map.of()), ++ taskHelper); + } + +- ++ static record Config(boolean ignoreModifiedRuntime, ++ Map>> altHashSums) {} + } +diff --git a/src/jdk.jlink/share/classes/jdk/tools/jlink/resources/jlink.properties b/src/jdk.jlink/share/classes/jdk/tools/jlink/resources/jlink.properties +index a491b758ea0..59f5860d131 100644 +--- a/src/jdk.jlink/share/classes/jdk/tools/jlink/resources/jlink.properties ++++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/resources/jlink.properties +@@ -127,6 +127,12 @@ err.runtime.link.packaged.mods=This JDK has no packaged modules.\ + err.runtime.link.modified.file={0} has been modified + err.runtime.link.patched.module=jlink does not support linking from the run-time image\ + \ when running on a patched runtime with --patch-module ++ ++# Linking from the run-time image, SHA sum handling ++err.sha.overrides.multiple=option --sha-overrides does not allow @file and non-file combinations ++err.sha.overrides.freaderr=Error reading file ''{0}'' passed with option --sha-overrides ++err.sha.overrides.bad.format=Bad format in --sha-overrides. Token was {0}. Expected || ++ + err.no.module.path=--module-path option must be specified with --add-modules ALL-MODULE-PATH + err.empty.module.path=No module found in module path ''{0}'' with --add-modules ALL-MODULE-PATH + err.limit.modules=--limit-modules not allowed with --add-modules ALL-MODULE-PATH +diff --git a/test/jdk/tools/jlink/IntegrationTest.java b/test/jdk/tools/jlink/IntegrationTest.java +index 5a8d0bce15a..818c31b9eef 100644 +--- a/test/jdk/tools/jlink/IntegrationTest.java ++++ b/test/jdk/tools/jlink/IntegrationTest.java +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2015, 2024, Oracle and/or its affiliates. All rights reserved. ++ * Copyright (c) 2015, 2025, Oracle and/or its affiliates. All rights reserved. + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it +@@ -159,7 +159,7 @@ private static void test() throws Exception { + mods, + JlinkTask.limitFinder(JlinkTask.newModuleFinder(modulePaths), limits, mods), + linkFromRuntime, +- false /* ignore modified runtime */, ++ null /* run-time image link config */, + false /* generate run-time image */); + + List lst = new ArrayList<>(); +diff --git a/test/jdk/tools/jlink/runtimeImage/AddOptionsTest.java b/test/jdk/tools/jlink/runtimeImage/AddOptionsTest.java +index 827f7da624d..4f25bc3ee66 100644 +--- a/test/jdk/tools/jlink/runtimeImage/AddOptionsTest.java ++++ b/test/jdk/tools/jlink/runtimeImage/AddOptionsTest.java +@@ -33,7 +33,6 @@ + * @summary Test --add-options jlink plugin when linking from the run-time image + * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) + * @library ../../lib /test/lib +- * @enablePreview + * @modules java.base/jdk.internal.jimage + * jdk.jlink/jdk.tools.jlink.internal + * jdk.jlink/jdk.tools.jlink.plugin +diff --git a/test/jdk/tools/jlink/runtimeImage/BasicJlinkMissingJavaBase.java b/test/jdk/tools/jlink/runtimeImage/BasicJlinkMissingJavaBase.java +index ebf5b060665..cb28f6f2b86 100644 +--- a/test/jdk/tools/jlink/runtimeImage/BasicJlinkMissingJavaBase.java ++++ b/test/jdk/tools/jlink/runtimeImage/BasicJlinkMissingJavaBase.java +@@ -34,7 +34,6 @@ + * but java.xml.jmod present. It should link from the run-time image without errors. + * @requires (jlink.packagedModules & vm.compMode != "Xcomp" & os.maxMemory >= 2g) + * @library ../../lib /test/lib +- * @enablePreview + * @modules java.base/jdk.internal.jimage + * jdk.jlink/jdk.tools.jlink.internal + * jdk.jlink/jdk.tools.jlink.plugin +diff --git a/test/jdk/tools/jlink/runtimeImage/BasicJlinkTest.java b/test/jdk/tools/jlink/runtimeImage/BasicJlinkTest.java +index 8cbd74e5ed1..f82c16c036d 100644 +--- a/test/jdk/tools/jlink/runtimeImage/BasicJlinkTest.java ++++ b/test/jdk/tools/jlink/runtimeImage/BasicJlinkTest.java +@@ -32,7 +32,6 @@ + * @summary Test basic linking from the run-time image + * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) + * @library ../../lib /test/lib +- * @enablePreview + * @modules java.base/jdk.internal.jimage + * jdk.jlink/jdk.tools.jlink.internal + * jdk.jlink/jdk.tools.jlink.plugin +diff --git a/test/jdk/tools/jlink/runtimeImage/CustomModuleJlinkTest.java b/test/jdk/tools/jlink/runtimeImage/CustomModuleJlinkTest.java +index d6c237a173b..15cd88ae9fc 100644 +--- a/test/jdk/tools/jlink/runtimeImage/CustomModuleJlinkTest.java ++++ b/test/jdk/tools/jlink/runtimeImage/CustomModuleJlinkTest.java +@@ -32,7 +32,6 @@ + * @summary Test jmod-less jlink with a custom module + * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) + * @library ../../lib /test/lib +- * @enablePreview + * @modules java.base/jdk.internal.jimage + * jdk.jlink/jdk.tools.jlink.internal + * jdk.jlink/jdk.tools.jlink.plugin +diff --git a/test/jdk/tools/jlink/runtimeImage/GenerateJLIClassesTest.java b/test/jdk/tools/jlink/runtimeImage/GenerateJLIClassesTest.java +index e59d18bd6f0..2a45d920f2d 100644 +--- a/test/jdk/tools/jlink/runtimeImage/GenerateJLIClassesTest.java ++++ b/test/jdk/tools/jlink/runtimeImage/GenerateJLIClassesTest.java +@@ -32,7 +32,6 @@ + * @summary Verify JLI class generation in run-time image link mode + * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) + * @library ../../lib /test/lib +- * @enablePreview + * @modules java.base/jdk.internal.jimage + * jdk.jlink/jdk.tools.jlink.internal + * jdk.jlink/jdk.tools.jlink.plugin +diff --git a/test/jdk/tools/jlink/runtimeImage/JavaSEReproducibleTest.java b/test/jdk/tools/jlink/runtimeImage/JavaSEReproducibleTest.java +index a376d075ecd..b2137b7b94d 100644 +--- a/test/jdk/tools/jlink/runtimeImage/JavaSEReproducibleTest.java ++++ b/test/jdk/tools/jlink/runtimeImage/JavaSEReproducibleTest.java +@@ -33,7 +33,6 @@ + * image. + * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) + * @library ../../lib /test/lib +- * @enablePreview + * @modules java.base/jdk.internal.jimage + * jdk.jlink/jdk.tools.jlink.internal + * jdk.jlink/jdk.tools.jlink.plugin +diff --git a/test/jdk/tools/jlink/runtimeImage/KeepPackagedModulesFailTest.java b/test/jdk/tools/jlink/runtimeImage/KeepPackagedModulesFailTest.java +index 6fdaf5a9824..2b13043b1db 100644 +--- a/test/jdk/tools/jlink/runtimeImage/KeepPackagedModulesFailTest.java ++++ b/test/jdk/tools/jlink/runtimeImage/KeepPackagedModulesFailTest.java +@@ -34,7 +34,6 @@ + * --keep-packaged-modules fails as expected. + * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) + * @library ../../lib /test/lib +- * @enablePreview + * @modules java.base/jdk.internal.jimage + * jdk.jlink/jdk.tools.jlink.internal + * jdk.jlink/jdk.tools.jlink.plugin +diff --git a/test/jdk/tools/jlink/runtimeImage/ModifiedFilesExitTest.java b/test/jdk/tools/jlink/runtimeImage/ModifiedFilesExitTest.java +index 777ce302ce7..b318418de16 100644 +--- a/test/jdk/tools/jlink/runtimeImage/ModifiedFilesExitTest.java ++++ b/test/jdk/tools/jlink/runtimeImage/ModifiedFilesExitTest.java +@@ -33,7 +33,6 @@ + * and files have been modified + * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) + * @library ../../lib /test/lib +- * @enablePreview + * @modules java.base/jdk.internal.jimage + * jdk.jlink/jdk.tools.jlink.internal + * jdk.jlink/jdk.tools.jlink.plugin +diff --git a/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWarningTest.java b/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWarningTest.java +index c871024f37c..a309f5cbbc5 100644 +--- a/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWarningTest.java ++++ b/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWarningTest.java +@@ -32,7 +32,6 @@ + * image and files have been modified + * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) + * @library ../../lib /test/lib +- * @enablePreview + * @modules java.base/jdk.internal.jimage + * jdk.jlink/jdk.tools.jlink.internal + * jdk.jlink/jdk.tools.jlink.plugin +diff --git a/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideBase.java b/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideBase.java +new file mode 100644 +index 00000000000..529fbda2ef9 +--- /dev/null ++++ b/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideBase.java +@@ -0,0 +1,111 @@ ++/* ++ * Copyright (c) 2025, Red Hat, Inc. ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++import java.io.IOException; ++import java.io.InputStream; ++import java.nio.file.Files; ++import java.nio.file.Path; ++import java.security.MessageDigest; ++import java.util.ArrayList; ++import java.util.HexFormat; ++import java.util.List; ++ ++import jdk.test.lib.process.OutputAnalyzer; ++import jtreg.SkippedException; ++import tests.Helper; ++ ++/* ++ * Base class for sha overrides tests ++ */ ++public abstract class ModifiedFilesWithShaOverrideBase extends ModifiedFilesTest { ++ ++ protected static final String SHA_OVERRIDE_FLAG = "--sha-overrides"; ++ ++ @Override ++ protected Path modifyFileInImage(Path jmodLessImg) { ++ try { ++ Path libJVM = jmodLessImg.resolve("lib").resolve("server").resolve(System.mapLibraryName("jvm")); ++ String shaBefore = buildSHA512(libJVM); ++ List objcopy = new ArrayList<>(); ++ objcopy.add("objcopy"); ++ // The OpenJDK build doesn't strip all symbols by default. In order ++ // to get a different libjvm.so file, we strip everything. The ++ // expectation is for the sha to be different before and after the ++ // stripping of the file. ++ objcopy.add("--strip-all"); ++ objcopy.add(libJVM.toString()); ++ ProcessBuilder builder = new ProcessBuilder(objcopy); ++ Process p = builder.start(); ++ int returnVal = p.waitFor(); ++ if (returnVal != 0) { ++ throw new SkippedException("Stripping of libjvm failed. Is objcopy installed?"); ++ } ++ String shaAfter = buildSHA512(libJVM); ++ if (shaBefore.equals(shaAfter)) { ++ throw new SkippedException("Binary file would be the same before after - test skipped"); ++ } ++ return libJVM; ++ } catch (IOException | InterruptedException e) { ++ throw new SkippedException("Stripping of libjvm failed: " + e.getMessage()); ++ } ++ } ++ ++ @Override ++ void testAndAssert(Path modifiedFile, Helper helper, Path initialImage) throws Exception { ++ String extraJlinkOption = getShaOverrideOption(modifiedFile, initialImage); ++ CapturingHandler handler = new CapturingHandler(); ++ jlinkUsingImage(new JlinkSpecBuilder() ++ .helper(helper) ++ .imagePath(initialImage) ++ .name(getTargetName()) ++ .addModule("java.base") ++ .validatingModule("java.base") ++ .extraJlinkOpt(extraJlinkOption) // allow for the modified sha ++ .build(), handler); ++ OutputAnalyzer out = handler.analyzer(); ++ // verify we don't get a warning message for the modified file ++ out.stdoutShouldNotMatch(".* has been modified"); ++ out.stdoutShouldNotContain("java.lang.IllegalArgumentException"); ++ out.stdoutShouldNotContain("IOException"); ++ } ++ ++ public abstract String getTargetName(); ++ public abstract String getShaOverrideOption(Path modifiedFile, Path initialImage); ++ ++ protected String buildSHA512(Path modifiedFile) { ++ try { ++ MessageDigest digest = MessageDigest.getInstance("SHA-512"); ++ try (InputStream is = Files.newInputStream(modifiedFile)) { ++ byte[] buf = new byte[1024]; ++ int readBytes = -1; ++ while ((readBytes = is.read(buf)) != -1) { ++ digest.update(buf, 0, readBytes); ++ } ++ } ++ byte[] actual = digest.digest(); ++ return HexFormat.of().formatHex(actual); ++ } catch (Exception e) { ++ throw new AssertionError("SHA-512 sum generation failed"); ++ } ++ } ++} +diff --git a/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideFileTest.java b/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideFileTest.java +new file mode 100644 +index 00000000000..d20eecd40e7 +--- /dev/null ++++ b/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideFileTest.java +@@ -0,0 +1,77 @@ ++/* ++ * Copyright (c) 2025, Red Hat, Inc. ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++import java.io.File; ++import java.io.FileWriter; ++import java.io.IOException; ++import java.io.PrintWriter; ++import java.nio.file.Path; ++ ++/* ++ * @test ++ * @summary Verify no warnings are being produced on a modified file which ++ * gets the SHA override from a file ++ * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g & os.family == "linux") ++ * @library ../../lib /test/lib ++ * @modules java.base/jdk.internal.jimage ++ * jdk.jlink/jdk.tools.jlink.internal ++ * jdk.jlink/jdk.tools.jlink.plugin ++ * jdk.jlink/jdk.tools.jimage ++ * @build tests.* jdk.test.lib.process.OutputAnalyzer ++ * jdk.test.lib.process.ProcessTools ++ * @run main/othervm -Xmx1g ModifiedFilesWithShaOverrideFileTest ++ */ ++public class ModifiedFilesWithShaOverrideFileTest extends ModifiedFilesWithShaOverrideBase { ++ ++ public static void main(String[] args) throws Exception { ++ ModifiedFilesWithShaOverrideFileTest test = new ModifiedFilesWithShaOverrideFileTest(); ++ test.run(); ++ } ++ ++ @Override ++ String initialImageName() { ++ return "java-base-jlink-with-sha-override-file"; ++ } ++ ++ @Override ++ public String getTargetName() { ++ return "java-base-jlink-with-sha-override-file-target"; ++ } ++ ++ @Override ++ public String getShaOverrideOption(Path modifiedFile, Path initialImage) { ++ String strippedSha = buildSHA512(modifiedFile); ++ Path relativePath = initialImage.relativize(modifiedFile); ++ // Modified file is libjvm.so, which is in java.base ++ String overrideVal = String.format("%s|%s|%s", "java.base", relativePath.toString(), strippedSha); ++ // Write a file in JAVA_HOME of the linkable runtime with the sha ++ // override. ++ File overrideFile = initialImage.resolve("test_sha_override.txt").toFile(); ++ try (PrintWriter pw = new PrintWriter(new FileWriter(overrideFile))) { ++ pw.println(overrideVal); ++ } catch (IOException e) { ++ throw new AssertionError("Test failed unexpectedly: ", e); ++ } ++ return SHA_OVERRIDE_FLAG + "=@${java.home}/test_sha_override.txt"; ++ } ++} +diff --git a/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideTest.java b/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideTest.java +new file mode 100644 +index 00000000000..ef0e541655d +--- /dev/null ++++ b/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideTest.java +@@ -0,0 +1,65 @@ ++/* ++ * Copyright (c) 2025, Red Hat, Inc. ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++import java.nio.file.Path; ++ ++/* ++ * @test ++ * @summary Verify no warnings are being produced on a modified file which ++ * gets the SHA override from command line ++ * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g & os.family == "linux") ++ * @library ../../lib /test/lib ++ * @modules java.base/jdk.internal.jimage ++ * jdk.jlink/jdk.tools.jlink.internal ++ * jdk.jlink/jdk.tools.jlink.plugin ++ * jdk.jlink/jdk.tools.jimage ++ * @build tests.* jdk.test.lib.process.OutputAnalyzer ++ * jdk.test.lib.process.ProcessTools ++ * @run main/othervm -Xmx1g ModifiedFilesWithShaOverrideTest ++ */ ++public class ModifiedFilesWithShaOverrideTest extends ModifiedFilesWithShaOverrideBase { ++ ++ public static void main(String[] args) throws Exception { ++ ModifiedFilesWithShaOverrideTest test = new ModifiedFilesWithShaOverrideTest(); ++ test.run(); ++ } ++ ++ @Override ++ String initialImageName() { ++ return "java-base-jlink-with-sha-override"; ++ } ++ ++ @Override ++ public String getTargetName() { ++ return "java-base-jlink-with-sha-override-target"; ++ } ++ ++ @Override ++ public String getShaOverrideOption(Path modifiedFile, Path initialImage) { ++ String strippedSha = buildSHA512(modifiedFile); ++ Path relativePath = initialImage.relativize(modifiedFile); ++ // Modified file is libjvm.so, which is in java.base ++ String overrideVal = String.format("%s|%s|%s", "java.base", relativePath.toString(), strippedSha); ++ return SHA_OVERRIDE_FLAG + "=" + overrideVal; ++ } ++} +diff --git a/test/jdk/tools/jlink/runtimeImage/MultiHopTest.java b/test/jdk/tools/jlink/runtimeImage/MultiHopTest.java +index 0e2cabe7425..dfb7c9eb180 100644 +--- a/test/jdk/tools/jlink/runtimeImage/MultiHopTest.java ++++ b/test/jdk/tools/jlink/runtimeImage/MultiHopTest.java +@@ -33,7 +33,6 @@ + * @summary Verify that a jlink using the run-time image cannot include jdk.jlink + * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) + * @library ../../lib /test/lib +- * @enablePreview + * @modules java.base/jdk.internal.jimage + * jdk.jlink/jdk.tools.jlink.internal + * jdk.jlink/jdk.tools.jlink.plugin +diff --git a/test/jdk/tools/jlink/runtimeImage/PackagedModulesVsRuntimeImageLinkTest.java b/test/jdk/tools/jlink/runtimeImage/PackagedModulesVsRuntimeImageLinkTest.java +index d276e80702b..a49bac80dc0 100644 +--- a/test/jdk/tools/jlink/runtimeImage/PackagedModulesVsRuntimeImageLinkTest.java ++++ b/test/jdk/tools/jlink/runtimeImage/PackagedModulesVsRuntimeImageLinkTest.java +@@ -42,7 +42,6 @@ + * produce the same result + * @requires (jlink.packagedModules & vm.compMode != "Xcomp" & os.maxMemory >= 2g) + * @library ../../lib /test/lib +- * @enablePreview + * @modules java.base/jdk.internal.jimage + * jdk.jlink/jdk.tools.jlink.internal + * jdk.jlink/jdk.tools.jlink.plugin +diff --git a/test/jdk/tools/jlink/runtimeImage/PatchedJDKModuleJlinkTest.java b/test/jdk/tools/jlink/runtimeImage/PatchedJDKModuleJlinkTest.java +index d4654ec98bd..494b830a145 100644 +--- a/test/jdk/tools/jlink/runtimeImage/PatchedJDKModuleJlinkTest.java ++++ b/test/jdk/tools/jlink/runtimeImage/PatchedJDKModuleJlinkTest.java +@@ -35,7 +35,6 @@ + * @summary Test run-time link with --patch-module. Expect failure. + * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) + * @library ../../lib /test/lib +- * @enablePreview + * @modules java.base/jdk.internal.jimage + * jdk.jlink/jdk.tools.jlink.internal + * jdk.jlink/jdk.tools.jlink.plugin +diff --git a/test/jdk/tools/jlink/runtimeImage/SystemModulesTest.java b/test/jdk/tools/jlink/runtimeImage/SystemModulesTest.java +index d0a6234eec0..f9256068a40 100644 +--- a/test/jdk/tools/jlink/runtimeImage/SystemModulesTest.java ++++ b/test/jdk/tools/jlink/runtimeImage/SystemModulesTest.java +@@ -34,7 +34,6 @@ + * @summary Test appropriate handling of generated SystemModules* classes in run-time image link mode + * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) + * @library ../../lib /test/lib +- * @enablePreview + * @modules java.base/jdk.internal.jimage + * jdk.jlink/jdk.tools.jlink.internal + * jdk.jlink/jdk.tools.jlink.plugin +diff --git a/test/jdk/tools/jlink/runtimeImage/SystemModulesTest2.java b/test/jdk/tools/jlink/runtimeImage/SystemModulesTest2.java +index ee22a55f3a7..b77c5a760f9 100644 +--- a/test/jdk/tools/jlink/runtimeImage/SystemModulesTest2.java ++++ b/test/jdk/tools/jlink/runtimeImage/SystemModulesTest2.java +@@ -35,7 +35,6 @@ + * generated classes to not be there. + * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) + * @library ../../lib /test/lib +- * @enablePreview + * @modules java.base/jdk.internal.jimage + * jdk.jlink/jdk.tools.jlink.internal + * jdk.jlink/jdk.tools.jlink.plugin +-- +2.49.0 + diff --git a/BuildShaSumFile.java b/BuildShaSumFile.java new file mode 100644 index 0000000..8d5390c --- /dev/null +++ b/BuildShaSumFile.java @@ -0,0 +1,144 @@ +import java.io.FileWriter; +import java.io.IOException; +import java.io.InputStream; +import java.io.PrintWriter; +import java.io.UncheckedIOException; +import java.lang.module.ModuleDescriptor; +import java.lang.module.ModuleFinder; +import java.lang.module.ModuleReference; +import java.nio.file.Files; +import java.nio.file.Path; +import java.security.MessageDigest; +import java.util.ArrayList; +import java.util.Arrays; +import java.util.HexFormat; +import java.util.List; +import java.util.Map; +import java.util.Scanner; +import java.util.Set; +import java.util.function.Function; +import java.util.spi.ToolProvider; +import java.util.stream.Collectors; + +public class BuildShaSumFile { + + // Mirrored from ResourcePoolEntry.Type: + private enum Type { + CLASS_OR_RESOURCE(0), + CONFIG(1), + HEADER_FILE(2), + LEGAL_NOTICE(3), + MAN_PAGE(4), + NATIVE_CMD(5), + NATIVE_LIB(6), + TOP(7); + + int intVal; + + Type(int val) { + this.intVal = val; + } + + Integer getOrdinal() { + return intVal; + } + } + + private static final String RESOURCE_FILE_FORMAT = "jdk/tools/jlink/internal/runtimelink/fs_%s_files"; + private static final Map TYPE_MAP = Arrays.stream(Type.values()) + .collect(Collectors.toMap(Type::getOrdinal, Function.identity())); + private static final Module JLINK_MODULE = ToolProvider.findFirst("jlink").orElseThrow().getClass().getModule(); + private static final Set BINARIES_LIBS = Set.of(Type.NATIVE_CMD, Type.NATIVE_LIB); + + private final String outPutFile; + + public BuildShaSumFile(String output) { + this.outPutFile = output; + } + + /* + * Use the fs__files resource part of jdk.jlink to + * figure out the files part of a module from the JDK image. + * + * Note that the file is of the following format: + * ||| + * + * Example: + * 5|0|428e61a697dc05f585333888f0d9baaef7dad088c279f052e189e401471d0c94e99711f567c5d1e5d2e08259c3b320b9d239cbb610f7c347b2eff4eec8ce712c|bin/jmod + */ + private List getModuleFiles(String module, Set includeTypes) { + List moduleFiles = new ArrayList<>(); + String resourceFile = String.format(RESOURCE_FILE_FORMAT, module); + try (InputStream in = JLINK_MODULE.getResourceAsStream(resourceFile); + Scanner scanner = new Scanner(in)) { + while (scanner.hasNextLine()) { + String[] tokens = scanner.nextLine().split("\\|", 4); + Integer typeInt = Integer.valueOf(tokens[0]); + Type type = TYPE_MAP.get(typeInt); + boolean isSymlink = Integer.valueOf(tokens[1]) == 1; + if (includeTypes.contains(type) && !isSymlink) { + moduleFiles.add(tokens[3]); + } + } + } catch (IOException e) { + throw new UncheckedIOException(e); + } + return moduleFiles; + } + + private String sha512Sum(String file) { + try { + MessageDigest digest = MessageDigest.getInstance("SHA-512"); + try (InputStream is = Files.newInputStream(Path.of(System.getProperty("java.home")).resolve(Path.of(file)))) { + byte[] buf = new byte[1024]; + int readBytes = -1; + while ((readBytes = is.read(buf)) != -1) { + digest.update(buf, 0, readBytes); + } + } + byte[] hashSum = digest.digest(); + return HexFormat.of().formatHex(hashSum); + } catch (Exception e) { + throw new RuntimeException("Failed to generate hash sum"); + } + } + + public void produceHashSumFile() { + // Sanity check JEP 493 enabled builds: + String resourceFile = String.format(RESOURCE_FILE_FORMAT, "java.base"); + try (InputStream in = JLINK_MODULE.getResourceAsStream(resourceFile)) { + if (in == null) { + System.out.println("Not a JEP 493 enabled build. Aborting!"); + return; + } + } catch (IOException e) { + throw new UncheckedIOException(e); + } + try (PrintWriter pw = new PrintWriter(new FileWriter(Path.of(outPutFile).toFile()))) { + ModuleFinder.ofSystem().findAll().stream() + .map(ModuleReference::descriptor) + .map(ModuleDescriptor::name).forEach(m -> { + List moduleFiles = getModuleFiles(m, BINARIES_LIBS); + for (String file: moduleFiles) { + String shaSum = sha512Sum(file); + pw.println(String.format("%s|%s|%s", m, file, shaSum)); + } + }); + + } catch (IOException e) { + throw new UncheckedIOException(e); + } + System.out.println("File " + outPutFile + " written. " + + "You can feed that now to 'jlink's --sha-overrides option."); + } + + public static void main(String[] args) { + if (args.length != 1) { + System.err.println("Usage: " + BuildShaSumFile.class.getSimpleName() + " "); + System.exit(1); + } + BuildShaSumFile b = new BuildShaSumFile(args[0]); + b.produceHashSumFile(); + } + +} diff --git a/JDK-8373246-8351842_broke_native_debugging_on_Linux.patch b/JDK-8373246-8351842_broke_native_debugging_on_Linux.patch deleted file mode 100644 index 1f6ca4d..0000000 --- a/JDK-8373246-8351842_broke_native_debugging_on_Linux.patch +++ /dev/null @@ -1,154 +0,0 @@ -diff --git a/make/Bundles.gmk b/make/Bundles.gmk -index 8161b3b036254..0b324e7e3f3fc 100644 ---- a/make/Bundles.gmk -+++ b/make/Bundles.gmk -@@ -185,77 +185,30 @@ endif - - ifneq ($(filter product-bundles% legacy-bundles, $(MAKECMDGOALS)), ) - -- SYMBOLS_EXCLUDE_PATTERN := %.debuginfo %.diz %.map -- -- # There may be files with spaces in the names, so use ShellFindFiles -- # explicitly. -+ # There may be files with spaces in the names, so use ShellFindFiles explicitly. - ALL_JDK_FILES := $(call ShellFindFiles, $(JDK_IMAGE_DIR)) -- ifneq ($(JDK_IMAGE_DIR), $(JDK_SYMBOLS_IMAGE_DIR)) -- ALL_JDK_SYMBOLS_FILES := $(call ShellFindFiles, $(JDK_SYMBOLS_IMAGE_DIR)) -- else -- ALL_JDK_SYMBOLS_FILES := $(ALL_JDK_FILES) -- endif - ifneq ($(JDK_IMAGE_DIR), $(JDK_DEMOS_IMAGE_DIR)) - ALL_JDK_DEMOS_FILES := $(call ShellFindFiles, $(JDK_DEMOS_IMAGE_DIR)) - else - ALL_JDK_DEMOS_FILES := $(ALL_JDK_FILES) - endif - -- # Create special filter rules when dealing with unzipped .dSYM directories on -- # macosx -- ifeq ($(call isTargetOs, macosx), true) -- ifeq ($(ZIP_EXTERNAL_DEBUG_SYMBOLS), false) -- JDK_SYMBOLS_EXCLUDE_PATTERN := $(addprefix %, \ -- $(call containing, .dSYM/, $(patsubst $(JDK_IMAGE_DIR)/%, %, \ -- $(ALL_JDK_SYMBOLS_FILES)))) -- endif -- endif -- -- # Create special filter rules when dealing with debug symbols on windows -- ifeq ($(call isTargetOs, windows), true) -- ifeq ($(SHIP_DEBUG_SYMBOLS), ) -- JDK_SYMBOLS_EXCLUDE_PATTERN := %.pdb -- endif -- endif -- - JDK_BUNDLE_FILES := \ - $(filter-out \ -- $(JDK_SYMBOLS_EXCLUDE_PATTERN) \ - $(JDK_EXTRA_EXCLUDES) \ -- $(SYMBOLS_EXCLUDE_PATTERN) \ - $(JDK_IMAGE_HOMEDIR)/demo/% \ - , \ - $(ALL_JDK_FILES) \ - ) - -- JDK_SYMBOLS_BUNDLE_FILES := \ -- $(call FindFiles, $(SYMBOLS_IMAGE_DIR)) -+ JDK_SYMBOLS_BUNDLE_FILES := $(call FindFiles, $(SYMBOLS_IMAGE_DIR)) - - TEST_DEMOS_BUNDLE_FILES := $(filter $(JDK_DEMOS_IMAGE_HOMEDIR)/demo/%, \ - $(ALL_JDK_DEMOS_FILES)) - - ALL_JRE_FILES := $(call ShellFindFiles, $(JRE_IMAGE_DIR)) - -- # Create special filter rules when dealing with unzipped .dSYM directories on -- # macosx -- ifeq ($(OPENJDK_TARGET_OS), macosx) -- ifeq ($(ZIP_EXTERNAL_DEBUG_SYMBOLS), false) -- JRE_SYMBOLS_EXCLUDE_PATTERN := $(addprefix %, \ -- $(call containing, .dSYM/, $(patsubst $(JRE_IMAGE_DIR)/%, %, $(ALL_JRE_FILES)))) -- endif -- endif -- -- # Create special filter rules when dealing with debug symbols on windows -- ifeq ($(call isTargetOs, windows), true) -- ifeq ($(SHIP_DEBUG_SYMBOLS), ) -- JRE_SYMBOLS_EXCLUDE_PATTERN := %.pdb -- endif -- endif -- -- JRE_BUNDLE_FILES := $(filter-out \ -- $(JRE_SYMBOLS_EXCLUDE_PATTERN) \ -- $(SYMBOLS_EXCLUDE_PATTERN), \ -- $(ALL_JRE_FILES)) -+ JRE_BUNDLE_FILES := $(ALL_JRE_FILES) - - ifeq ($(MACOSX_CODESIGN_MODE), hardened) - # Macosx release build and code signing available. -diff --git a/make/CreateJmods.gmk b/make/CreateJmods.gmk -index 3280b24924a34..32f107b6bb6a0 100644 ---- a/make/CreateJmods.gmk -+++ b/make/CreateJmods.gmk -@@ -218,10 +218,14 @@ ifeq ($(call isTargetOs, windows), true) - ifeq ($(SHIP_DEBUG_SYMBOLS), ) - JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.pdb,*.map}' - else -- JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.map}' -+ JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.map}' - endif - else -- JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.debuginfo,*.dSYM/**,*.dSYM}' -+ ifeq ($(SHIP_DEBUG_SYMBOLS), ) -+ JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.debuginfo,*.dSYM/**,*.dSYM}' -+ else -+ JMOD_FLAGS += --exclude '**{_the.*,_*.marker*}' -+ endif - endif - - # Unless we are creating a very large module, use the small tool JVM options -diff --git a/make/autoconf/jdk-options.m4 b/make/autoconf/jdk-options.m4 -index bb18877800192..87d147d4f074b 100644 ---- a/make/autoconf/jdk-options.m4 -+++ b/make/autoconf/jdk-options.m4 -@@ -316,23 +316,36 @@ AC_DEFUN_ONCE([JDKOPT_SETUP_DEBUG_SYMBOLS], - AC_MSG_CHECKING([if we should add external native debug symbols to the shipped bundles]) - AC_ARG_WITH([external-symbols-in-bundles], - [AS_HELP_STRING([--with-external-symbols-in-bundles], -- [which type of external native debug symbol information shall be shipped in product bundles (none, public, full) -- (e.g. ship full/stripped pdbs on Windows) @<:@none@:>@])]) -+ [which type of external native debug symbol information shall be shipped with bundles/images (none, public, full). -+ @<:@none in release builds, full otherwise. --with-native-debug-symbols=external/zipped is a prerequisite. public is only supported on Windows@:>@])], -+ [], -+ [with_external_symbols_in_bundles=default]) - - if test "x$with_external_symbols_in_bundles" = x || test "x$with_external_symbols_in_bundles" = xnone ; then - AC_MSG_RESULT([no]) - elif test "x$with_external_symbols_in_bundles" = xfull || test "x$with_external_symbols_in_bundles" = xpublic ; then -- if test "x$OPENJDK_TARGET_OS" != xwindows ; then -- AC_MSG_ERROR([--with-external-symbols-in-bundles currently only works on windows!]) -- elif test "x$COPY_DEBUG_SYMBOLS" != xtrue ; then -- AC_MSG_ERROR([--with-external-symbols-in-bundles only works when --with-native-debug-symbols=external is used!]) -- elif test "x$with_external_symbols_in_bundles" = xfull ; then -+ if test "x$COPY_DEBUG_SYMBOLS" != xtrue ; then -+ AC_MSG_ERROR([--with-external-symbols-in-bundles only works when --with-native-debug-symbols=external/zipped is used!]) -+ elif test "x$with_external_symbols_in_bundles" = xpublic && test "x$OPENJDK_TARGET_OS" != xwindows ; then -+ AC_MSG_ERROR([--with-external-symbols-in-bundles=public is only supported on Windows!]) -+ fi -+ -+ if test "x$with_external_symbols_in_bundles" = xfull ; then - AC_MSG_RESULT([full]) - SHIP_DEBUG_SYMBOLS=full - else - AC_MSG_RESULT([public]) - SHIP_DEBUG_SYMBOLS=public - fi -+ elif test "x$with_external_symbols_in_bundles" = xdefault ; then -+ if test "x$DEBUG_LEVEL" = xrelease ; then -+ AC_MSG_RESULT([no (default)]) -+ elif test "x$COPY_DEBUG_SYMBOLS" = xtrue ; then -+ AC_MSG_RESULT([full (default)]) -+ SHIP_DEBUG_SYMBOLS=full -+ else -+ AC_MSG_RESULT([no (default, native debug symbols are not external/zipped)]) -+ fi - else - AC_MSG_ERROR([$with_external_symbols_in_bundles is an unknown value for --with-external-symbols-in-bundles]) - fi diff --git a/NEWS b/NEWS index 0a4a628..5cd16bd 100644 --- a/NEWS +++ b/NEWS @@ -2,669 +2,77 @@ Key: JDK-X - https://bugs.openjdk.java.net/browse/JDK-X CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY +JEP-XYZ: https://openjdk.org/jeps/XYZ -New in release OpenJDK 25.0.1 (2025-10-21): +New in release OpenJDK 24.0.1+9 (2025-4-16): =========================================== + - JDK-8211851: (ch) java/nio/channels/AsynchronousSocketChannel/StressLoopback.java times out (aix) + - JDK-8290043: serviceability/attach/ConcAttachTest.java failed "guarantee(!CheckJNICalls) failed: Attached JNI thread exited without being detached" + - JDK-8337494: Clarify JarInputStream behavior + - JDK-8337692: Better TLS connection support + - JDK-8338430: Improve compiler transformations + - JDK-8339356: Test javax/net/ssl/SSLSocket/Tls13PacketSize.java failed with java.net.SocketException: An established connection was aborted by the software in your host machine + - JDK-8342562: Enhance Deflater operations + - JDK-8343007: Enhance Buffered Image handling + - JDK-8344361: Restore null return for invalid services from legacy providers + - JDK-8345276: Remove EA from the JDK 24 version string with first RC promotion + - JDK-8345614: Improve AnnotationFormatError message for duplicate annotation interfaces + - JDK-8345684: OperatingSystemMXBean.getSystemCpuLoad() throws NPE + - JDK-8345959: Make JVM_IsStaticallyLinked JVM_LEAF + - JDK-8346014: Bump version numbers for 24.0.1 + - JDK-8346082: Output JVMTI agent information in hserr files + - JDK-8346239: Improve memory efficiency of JimageDiffGenerator + - JDK-8346324: javax/swing/JScrollBar/4865918/bug4865918.java fails in CI + - JDK-8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs + - JDK-8346688: GenShen: Missing metadata trigger log message + - JDK-8346690: Shenandoah: Fix log message for end of GC usage report + - JDK-8346712: Remove com/sun/net/httpserver/TcpNoDelayNotRequired.java test + - JDK-8346713: [testsuite] NeverActAsServerClassMachine breaks TestPLABAdaptToMinTLABSize.java TestPinnedHumongousFragmentation.java TestPinnedObjectContents.java + - JDK-8346868: RISC-V: compiler/sharedstubs tests fail after JDK-8332689 + - JDK-8346887: DrawFocusRect() may cause an assertion failure + - JDK-8347124: Clean tests with --enable-linkable-runtime + - JDK-8347129: cpuset cgroups controller is required for no good reason + - JDK-8347256: Epsilon: Demote heap size and AlwaysPreTouch warnings to info level + - JDK-8347299: Add annotations to test cases in LicenseTest + - JDK-8347334: JimageDiffGenerator code clean-ups + - JDK-8347424: Fix and rewrite sun/security/x509/DNSName/LeadingPeriod.java test + - JDK-8347496: Test jdk/jfr/jvm/TestModularImage.java fails after JDK-8347124: No javac + - JDK-8347506: Compatible OCSP readtimeout property with OCSP timeout + - JDK-8347564: ZGC: Crash in DependencyContext::clean_unloading_dependents + - JDK-8347847: Enhance jar file support + - JDK-8347911: Limit the length of inflated text chunks + - JDK-8347965: (tz) Update Timezone Data to 2025a + - JDK-8348562: ZGC: segmentation fault due to missing node type check in barrier elision analysis + - JDK-8349058: 'internal proprietary API' warnings make javac warnings unusable + - JDK-8349084: Update vectors used in several PQC benchmarks + - JDK-8349183: [BACKOUT] Optimization for StringBuilder append boolean & null + - JDK-8349239: [BACKOUT] Reuse StringLatin1::putCharsAt and StringUTF16::putCharsAt + - JDK-8349828: Redo - Change milestone to fcs for newly created jdk24.0.1 branch + - JDK-8350820: OperatingSystemMXBean CpuLoad() methods return -1.0 on Windows -* CVEs - - CVE-2025-53057 - - CVE-2025-53066 - - CVE-2025-61748 -* Changes - - JDK-8315131: Clarify VarHandle set/get access on 32-bit platforms - - JDK-8352637: Enhance bytecode verification - - JDK-8356294: Enhance Path Factories - - JDK-8356587: Missing object ID X in pool jdk.types.Method - - JDK-8357826: Avoid running some jtreg tests when asan is configured - - JDK-8358452: JNI exception pending in Java_sun_awt_screencast_ScreencastHelper_remoteDesktopKeyImpl of screencast_pipewire.c:1214 (ID: 51119) - - JDK-8358577: Test serviceability/jvmti/thread/GetCurrentContendedMonitor/contmon01/contmon01.java failed: unexpexcted monitor object - - JDK-8358819: The first year is not displayed correctly in Japanese Calendar - - JDK-8359059: Bump version numbers for 25.0.1 - - JDK-8359218: RISC-V: Only enable CRC32 intrinsic when AvoidUnalignedAccess == false - - JDK-8359270: C2: alignment check should consider base offset when emitting arraycopy runtime call - - JDK-8359454: Enhance String handling - - JDK-8359596: Behavior change when both -Xlint:options and -Xlint:-options flags are given - - JDK-8360179: RISC-V: Only enable BigInteger intrinsics when AvoidUnalignedAccess == false - - JDK-8360533: ContainerRuntimeVersionTestUtils fromVersionString fails with some docker versions - - JDK-8360647: [XWayland] [OL10] NumPad keys are not triggered - - JDK-8360679: Shenandoah: AOT saved adapter calls into broken GC barrier stub - - JDK-8360937: Enhance certificate handling - - JDK-8361212: Remove AffirmTrust root CAs - - JDK-8361532: RISC-V: Several vector tests fail after JDK-8354383 - - JDK-8361829: [TESTBUG] RISC-V: compiler/vectorization/runner/BasicIntOpTest.java fails with RVV but not Zvbb - - JDK-8362109: Change milestone to fcs for all releases - - JDK-8362882: Update SubmissionPublisher() specification to reflect use of ForkJoinPool.asyncCommonPool() - - JDK-8366223: ZGC: ZPageAllocator::cleanup_failed_commit_multi_partition is broken - - JDK-8367031: [backout] Change java.time month/day field types to 'byte' - - JDK-8368308: ISO 4217 Amendment 180 Update - -Notes on individual issues: -=========================== - -core-libs/java.io:serialization: - -JDK-8367031: [backout] Change java.time month/day field types to 'byte' -======================================================================= -In the initial release of OpenJDK 25, attempting to read serialised -Class objects created by earlier versions of OpenJDK for several of -the `java.time` classes would fail with a -`InvalidClassException`. Similarly, `java.time` Class objects -serialised with OpenJDK 25 could not be read by older OpenJDK -versions. This was due to the type of the day and month fields in -these classes being changed to `byte`. This change has now been -reverted and compatibility between OpenJDK 25 and older versions -restored. - -Note that this incompatibility occurred with the `Class` object and -not an instance of the object i.e. `writeObject(LocalDate.class)` -would produce incompatible serialised data, but -`writeObject(LocalDate.now())` would not. - -security-libs/java.security: - -JDK-8361212: Remove AffirmTrust root CAs -======================================== -The following root certificates from AffirmTrust, which were -deactivated in the 21.0.5 release of October 2024, have been removed -from the `cacerts` keystore: - -Alias name: affirmtrustcommercialca [jdk] -CN=AffirmTrust Commercial -O=AffirmTrust -C=US -SHA256: 03:76:AB:1D:54:C5:F9:80:3C:E4:B2:E2:01:A0:EE:7E:EF:7B:57:B6:36:E8:A9:3C:9B:8D:48:60:C9:6F:5F:A7 - -Alias name: affirmtrustnetworkingca [jdk] -CN=AffirmTrust Networking -O=AffirmTrust -C=US -SHA256: 0A:81:EC:5A:92:97:77:F1:45:90:4A:F3:8D:5D:50:9F:66:B5:E2:C5:8F:CD:B5:31:05:8B:0E:17:F3:F0B4:1B - -Alias name: affirmtrustpremiumca [jdk] -CN=AffirmTrust Premium -O=AffirmTrust -C=US -SHA256: 70:A7:3F:7F:37:6B:60:07:42:48:90:45:34:B1:14:82:D5:BF:0E:69:8E:CC:49:8D:F5:25:77:EB:F2:E9:3B:9A - -Alias name: affirmtrustpremiumeccca [jdk] -CN=AffirmTrust Premium ECC -O=AffirmTrust -C=US -SHA256: BD:71:FD:F6:DA:97:E4:CF:62:D1:64:7A:DD:25:81:B0:7D:79:AD:F8:39:7E:B4:EC:BA:9C:5E:84:88:82:14:23 - -New in release OpenJDK 25.0.0 (2025-09-16): +New in release OpenJDK 24.0.0+34 (2025-03-18): =========================================== -Major changes are listed below. Some changes may have been backported -to earlier releases following their first appearance in OpenJDK 22 -through to 25. - -NEW FEATURES -============ - -Language Features -================= - -Flexible Constructor Bodies -============================ -https://openjdk.org/jeps/447 -https://openjdk.org/jeps/482 -https://openjdk.org/jeps/492 -https://openjdk.org/jeps/513 - -In constructors in the Java programming language, allow statements to -appear before an explicit constructor invocation, i.e., super(..) or -this(..). The statements cannot reference the instance under -construction, but they can initialize its fields. Initializing fields -before invoking another constructor makes a class more reliable when -methods are overridden. - -This language feature is now finalised (JEP 513). It was first -introduced as a preview language feature -(http://openjdk.java.net/jeps/12) in OpenJDK 22 (JEP 447) under the -name "Statements before super(...)". It reached a second preview in -OpenJDK 23 (JEP 482) with the addition of allowing fields to be -initialized before invoking another constructor. It reached a third -preview in OpenJDK 24 (JEP 492). - -Unnamed Patterns and Variables -============================== -https://openjdk.org/jeps/443 -https://openjdk.org/jeps/456 - -Enhance the Java language with unnamed patterns, which match a record -component without stating the component's name or type, and unnamed -variables, which can be initialized but not used. Both are denoted by -an underscore character, _. - -This feature is now finalised (JEP 456). It was a preview feature -(http://openjdk.java.net/jeps/12) in OpenJDK 21 (JEP 443). - -Primitive Types in Patterns, instanceof, and switch -=================================================== -https://openjdk.org/jeps/455 -https://openjdk.org/jeps/488 -https://openjdk.org/jeps/507 - -Enhance pattern matching by allowing primitive type patterns in all -pattern contexts, and extend instanceof and switch to work with all -primitive types. - -This is a preview language feature (http://openjdk.java.net/jeps/12) -introduced in OpenJDK 23 (JEP 455) with a second preview in OpenJDK 24 -(JEP 488) and reaching a third in OpenJDK 25 (JEP 507). - -Module Import Declarations -========================== -https://openjdk.org/jeps/476 -https://openjdk.org/jeps/494 -https://openjdk.org/jeps/511 - -Enhance the Java programming language with the ability to succinctly -import all of the packages exported by a module. This simplifies the -reuse of modular libraries, but does not require the importing code to -be in a module itself. - -This language feature is now finalised (JEP 511). It was introduced as -a preview language feature (http://openjdk.java.net/jeps/12) in -OpenJDK 23 (JEP 476) and had a second preview in OpenJDK 24 (JEP 494). - -Library Features -================ - -Foreign Function & Memory API -============================= -https://openjdk.org/jeps/412 -https://openjdk.org/jeps/419 -https://openjdk.org/jeps/424 -https://openjdk.org/jeps/434 -https://openjdk.org/jeps/442 -https://openjdk.org/jeps/454 - -Introduce an API by which Java programs can interoperate with code and -data outside of the Java runtime. By efficiently invoking foreign -functions (i.e., code outside the JVM), and by safely accessing -foreign memory (i.e., memory not managed by the JVM), the API enables -Java programs to call native libraries and process native data without -the brittleness and danger of JNI. - -This API is now finalised (JEP 454). It was first introduced in -incubation (https://openjdk.java.net/jeps/11) in OpenJDK 17 (JEP 412), -and is an evolution of the Foreign Memory Access API (OpenJDK 14 -through 16) and Foreign Linker API (OpenJDK 16) (see release notes for -java-17-openjdk). OpenJDK 18 saw a second round of incubation (JEP -419) before its inclusion as a preview feature -(http://openjdk.java.net/jeps/12) in OpenJDK 19 (JEP 424). A second -preview took place in OpenJDK 20 (JEP 434) and a third and final -preview in OpenJDK 21 (JEP 442). - -Prepare to Restrict the Use of JNI -================================== -https://openjdk.org/jeps/472 - -Issue warnings about uses of the Java Native Interface (JNI) and -adjust the Foreign Function & Memory (FFM) API to issue warnings in a -consistent manner. All such warnings aim to prepare developers for a -future release that ensures integrity by default by uniformly -restricting JNI and the FFM API. Application developers can avoid both -current warnings and future restrictions by selectively enabling these -interfaces where essential using the --enable-native-access -command-line option. - -Class-File API -============== -https://openjdk.org/jeps/457 -https://openjdk.org/jeps/466 -https://openjdk.org/jeps/484 - -Provide a standard API for parsing, generating, and transforming Java -class files. - -This API is now finalised (JEP 484). It was introduced as a preview -library feature (http://openjdk.java.net/jeps/12) in OpenJDK 22 (JEP -457) with a second preview in OpenJDK 23 (JEP 466). - -Vector API -========== -https://openjdk.org/jeps/338 -https://openjdk.org/jeps/414 -https://openjdk.org/jeps/417 -https://openjdk.org/jeps/426 -https://openjdk.org/jeps/438 -https://openjdk.org/jeps/448 -https://openjdk.org/jeps/460 -https://openjdk.org/jeps/469 -https://openjdk.org/jeps/489 -https://openjdk.org/jeps/508 - -Introduce an API to express vector computations that reliably compile -at runtime to optimal vector hardware instructions on supported CPU -architectures and thus achieve superior performance to equivalent -scalar computations. - -This is an incubation feature (https://openjdk.java.net/jeps/11) -introduced in OpenJDK 16 (JEP 338). A second round of incubation took -place in OpenJDK 17 (JEP 414), OpenJDK 18 (JEP 417) saw a third, -OpenJDK 19 a fourth (JEP 426), OpenJDK 20 (JEP 438) a fifth, OpenJDK -21 a sixth (JEP 448), OpenJDK 22 a seventh (JEP 460), OpenJDK 23 an -eighth (JEP 469), OpenJDK 24 a ninth (JEP 489) and it reaches its -tenth in OpenJDK 25 (JEP 508). - -Stream Gatherers -================ -https://openjdk.org/jeps/461 -https://openjdk.org/jeps/473 -https://openjdk.org/jeps/485 - -Enhance the Stream API to support custom intermediate operations. This -will allow stream pipelines to transform data in ways that are not -easily achievable with the existing built-in intermediate operations. - -This API is now finalised (JEP 485). It was introduced as a preview -library feature (http://openjdk.java.net/jeps/12) in OpenJDK 22 (JEP -461) with a second preview in OpenJDK 23 (JEP 473). - -Structured Concurrency -====================== -https://openjdk.org/jeps/428 -https://openjdk.org/jeps/437 -https://openjdk.org/jeps/453 -https://openjdk.org/jeps/462 -https://openjdk.org/jeps/480 -https://openjdk.org/jeps/499 -https://openjdk.org/jeps/505 - -Simplify multithreaded programming by introducing an API for -structured concurrency. Structured concurrency treats multiple tasks -running in different threads as a single unit of work, thereby -streamlining error handling and cancellation, improving reliability, -and enhancing observability. - -This API was first introduced in incubation -(https://openjdk.java.net/jeps/11) in OpenJDK 19 (JEP 428) and had a -second round of incubation in OpenJDK 20 (JEP 437). It became a -preview feature (http://openjdk.java.net/jeps/12) in OpenJDK 21 (JEP -453), reached its second preview in OpenJDK 22 (JEP 462), had a third -preview in OpenJDK 23 (JEP 480), a fourth in OpenJDK 24 (JEP 499) and -reaches its fifth in OpenJDK 25 (JEP 505). - -Compact Source Files and Instance Main Methods -============================================== -https://openjdk.org/jeps/445 -https://openjdk.org/jeps/463 -https://openjdk.org/jeps/477 -https://openjdk.org/jeps/495 -https://openjdk.org/jeps/512 - -Evolve the Java programming language so that beginners can write their -first programs without needing to understand language features -designed for large programs. Far from using a separate dialect of the -language, beginners can write streamlined declarations for -single-class programs and then seamlessly expand their programs to use -more advanced features as their skills grow. Experienced developers -can likewise enjoy writing small programs succinctly, without the need -for constructs intended for programming in the large. - -This library feature is now finalised (JEP 512) with some minor -changes from the last release. It was first introduced as a preview -(http://openjdk.java.net/jeps/12) in OpenJDK 21 (JEP 445) under the -name "Unnamed Classes and Instance Main Methods". It reached a second -preview in OpenJDK 22 (JEP 463) and a third in OpenJDK 23 (JEP 477) -under the new name, "Implicitly Declared Classes and Instance Main -Methods", due to the move away from unnamed classes to an implicitly -declared name chosen by the host system. It had a fourth preview in -OpenJDK 24 (JEP 495) with new terminology and a revised title ("Simple -Source Files and Instance Main Methods"), but otherwise unchanged. - -Scoped Values -============= -https://openjdk.org/jeps/429 -https://openjdk.org/jeps/446 -https://openjdk.org/jeps/464 -https://openjdk.org/jeps/481 -https://openjdk.org/jeps/487 -https://openjdk.org/jeps/506 - -Introduce scoped values, which enable the sharing of immutable data -within and across threads. They are preferred to thread-local -variables, especially when using large numbers of virtual threads. - -This API is now finalised (JEP 506). This API was first introduced in -incubation (https://openjdk.java.net/jeps/11) in OpenJDK 20 (JEP -429). It became a preview feature (http://openjdk.java.net/jeps/12) in -OpenJDK 21 (JEP 446), had a second preview in OpenJDK 22 (JEP 464), a -third in OpenJDK 23 (JEP 481) and a fourth in OpenJDK 24 (JEP 487). - -Key Derivation Function API -=========================== -https://openjdk.org/jeps/478 -https://openjdk.org/jeps/510 - -Introduce an API for Key Derivation Functions (KDFs), which are -cryptographic algorithms for deriving additional keys from a secret -key and other data. - -This API is now finalised (JEP 510). It was first introduced as a -preview library feature (http://openjdk.java.net/jeps/12) in OpenJDK -24 (JEP 478). - -Quantum-Resistant Module-Lattice-Based Key Encapsulation Mechanism -================================================================== -https://openjdk.org/jeps/496 - -Enhance the security of Java applications by providing an -implementation of the quantum-resistant Module-Lattice-Based -Key-Encapsulation Mechanism (ML-KEM). Key encapsulation mechanisms -(KEMs) are used to secure symmetric keys over insecure communication -channels using public key cryptography. ML-KEM is designed to be -secure against future quantum computing attacks. It has been -standardized by the United States National Institute of Standards and -Technology (NIST) in FIPS 203 [0]. - -[0] https://csrc.nist.gov/pubs/fips/203/final - -Quantum-Resistant Module-Lattice-Based Digital Signature Algorithm -================================================================== -https://openjdk.org/jeps/497 - -Enhance the security of Java applications by providing an -implementation of the quantum-resistant Module-Lattice-Based Digital -Signature Algorithm (ML-DSA). Digital signatures are used to detect -unauthorized modifications to data and to authenticate the identity of -signatories. ML-DSA is designed to be secure against future quantum -computing attacks. It has been standardized by the United States -National Institute of Standards and Technology (NIST) in FIPS 204 [0]. - -[0] https://csrc.nist.gov/pubs/fips/204/final - -PEM Encodings of Cryptographic Objects -====================================== -https://openjdk.org/jeps/470 - -Introduce an API for encoding objects that represent cryptographic -keys, certificates, and certificate revocation lists into the -widely-used Privacy-Enhanced Mail (PEM) transport format, and for -decoding from that format back into objects. - -This is a preview library feature (http://openjdk.java.net/jeps/12) -introduced in OpenJDK 25 (JEP 470). - -Stable Values -============= -https://openjdk.org/jeps/502 - -Introduce an API for stable values, which are objects that hold -immutable data. Stable values are treated as constants by the JVM, -enabling the same performance optimizations that are enabled by -declaring a field final. Compared to final fields, however, stable -values offer greater flexibility as to the timing of their -initialization. - -This is a preview library feature (http://openjdk.java.net/jeps/12) -introduced in OpenJDK 25 (JEP 502). - -Virtual Machine Enhancements -============================ - -Region Pinning for G1 -===================== -https://openjdk.org/jeps/423 - -Reduce latency by implementing region pinning in G1, so that garbage -collection need not be disabled during Java Native Interface (JNI) -critical regions. - -ZGC: Generational Mode by Default -================================= -https://openjdk.org/jeps/439 -https://openjdk.org/jeps/474 - -Switch the default mode of the Z Garbage Collector (ZGC) to the -generational mode. Deprecate the non-generational mode, with the -intent to remove it in a future release. - -Late Barrier Expansion for G1 -============================= -https://openjdk.org/jeps/475 - -Simplify the implementation of the G1 garbage collector's barriers, -which record information about application memory accesses, by -shifting their expansion from early in the C2 JIT's compilation -pipeline to later. - -Ahead-of-Time Class Loading & Linking -===================================== -https://openjdk.org/jeps/483 -https://openjdk.org/jeps/514 - -Improve startup time by making the classes of an application instantly -available, in a loaded and linked state, when the HotSpot Java Virtual -Machine starts. Achieve this by monitoring the application during one -run and storing the loaded and linked forms of all classes in a cache -for use in subsequent runs. Lay a foundation for future improvements -to both startup and warmup time. - -Using this feature requires a two stage process: - -1. Create the Ahead-of-Time cache from a training run of the -application using the option `--XX:AOTCacheOutput=` where -`` is the cache reference to use in later runs. - -2. When running the application in testing or production, use the -option `-XX:AOTCache=` to run the application with the -cache generated in #2. - -Previously, in OpenJDK 24 (JEP 483), the training run and cache -creation were handled by two separate steps: - -1. Populate the Ahead-of-Time configuration data with a training run -of the application using the options `-XX:AOTMode=record --XX:AOTConfiguration=` where `` is the -configuration reference to use in #2. - -2. Create the Ahead-of-Time cache using the options -`-XX:AOTMode=create -XX:AOTConfiguration= --XX:AOTCache=` where `` is the configuration -reference from #1 and `` is the cache reference to use in -later runs. - -JEP 514 ("Ahead-of-Time Command-Line Ergonomics") in OpenJDK 25 adds -the option `--XX:AOTCacheOutput` which performs both the above steps -from a single command-line invocation using a temporary configuration -file. A new environment variable, `JDK_AOT_VM_OPTIONS`, can be used -to pass options to the cache creation step without affecting the -training run step. - -Ahead-of-Time Method Profiling -============================== -https://openjdk.org/jeps/515 - -Improve warmup time by making method-execution profiles from a -previous run of an application instantly available, when the HotSpot -Java Virtual Machine starts. This will enable the JIT compiler to -generate native code immediately upon application startup, rather than -having to wait for profiles to be collected. - -Synchronize Virtual Threads without Pinning -=========================================== -https://openjdk.org/jeps/491 - -Improve the scalability of Java code that uses synchronized methods -and statements by arranging for virtual threads that block in such -constructs to release their underlying platform threads for use by -other virtual threads. This will eliminate nearly all cases of virtual -threads being pinned to platform threads, which severely restricts the -number of virtual threads available to handle an application's -workload. - -Compact Object Headers -====================== -https://openjdk.org/jeps/450 -https://openjdk.org/jeps/519 - -Reduce the size of object headers in the HotSpot JVM from between 96 -and 128 bits down to 64 bits on 64-bit architectures. This will reduce -heap size, improve deployment density, and increase data locality. - -This is now a production feature in OpenJDK 25 (JEP 519) enabled using -`-XX:+UseCompactObjectHeaders`. It was first introduced as an -experimental feature (JEP 450) that also required the use of -`-XX:+UnlockExperimentalVMOptions`. - -Generational Shenandoah -======================= -https://openjdk.org/jeps/404 -https://openjdk.org/jeps/521 - -Enhance the Shenandoah garbage collector with experimental -generational collection capabilities to improve sustainable -throughput, load-spike resilience, and memory utilization. - -This is now a production feature in OpenJDK 25 (JEP 521) enabled using -`-XX:ShenandoahGCMode=generational`. It was first introduced as an -experimental feature (JEP 404) that also required the use of -`-XX:+UnlockExperimentalVMOptions`. - -JFR Cooperative Sampling -======================== -https://openjdk.org/jeps/518 - -Improve the stability of the JDK Flight Recorder (JFR) when it -asynchronously samples Java thread stacks. Achieve this by walking -call stacks only at safepoints, while minimizing safepoint bias. - -JFR Method Timing & Tracing -=========================== -https://openjdk.org/jeps/520 - -Extend the JDK Flight Recorder (JFR) with facilities for method timing -and tracing via bytecode instrumentation. - -JFR CPU-Time Profiling -====================== -https://openjdk.org/jeps/509 - -Enhance the JDK Flight Recorder (JFR) to capture more accurate -CPU-time profiling information on Linux. - -This is an experimental feature so its JFR events are tagged with the -`@Experimental` annotation. Unlike other experimental virtual machine -features, it does not need to be explicitly enabled with -`-XX:+UnlockExperimentalVMOptions`. - -Tools -===== - -Launch Multi-File Source-Code Programs -====================================== -https://openjdk.org/jeps/458 - -Enhance the java application launcher to be able to run a program -supplied as multiple files of Java source code. This will make the -transition from small programs to larger ones more gradual, enabling -developers to choose whether and when to go to the trouble of -configuring a build tool. - -Markdown Documentation Comments -=============================== -https://openjdk.org/jeps/467 - -Enable JavaDoc documentation comments to be written in Markdown rather -than solely in a mixture of HTML and JavaDoc @-tags. - -Linking Run-Time Images without JMODs -===================================== -https://openjdk.org/jeps/493 - -Reduce the size of the JDK by approximately 25% by enabling the jlink -tool to create custom run-time images without using the JDK's JMOD -files. - -This feature must be enabled when the JDK is built using the ---enable-linkable-runtime option. It will not be enabled by default, -and some JDK vendors may choose not to enable it. - -DEPRECATIONS -============ - -Deprecate the Memory-Access Methods in sun.misc.Unsafe for Removal -================================================================== -https://openjdk.org/jeps/471 - -Deprecate the memory-access methods in sun.misc.Unsafe for removal in -a future release. These unsupported methods have been superseded by -standard APIs, namely the VarHandle API (JEP 193, OpenJDK 9) and the -Foreign Function & Memory API (JEP 454, OpenJDK 22). We strongly -encourage library developers to migrate from sun.misc.Unsafe to -supported replacements, so that applications can migrate smoothly to -modern JDK releases. - -Warn upon Use of Memory-Access Methods in sun.misc.Unsafe -========================================================= -https://openjdk.org/jeps/498 - -Issue a warning at run time on the first occasion that any -memory-access method in sun.misc.Unsafe is invoked. All of these -unsupported methods were terminally deprecated in JDK 23 (see JEP 471 -above). They have been superseded by standard APIs, namely the -VarHandle API (JEP 193, OpenJDK 9) and the Foreign Function & Memory -API (JEP 454, OpenJDK 22). We strongly encourage library developers to -migrate from sun.misc.Unsafe to supported replacements, so that -applications can migrate smoothly to modern JDK releases. - -Permanently Disable the Security Manager -======================================== -https://openjdk.org/jeps/486 - -The Security Manager has not been the primary means of securing -client-side Java code for many years, it has rarely been used to -secure server-side code, and it is costly to maintain. We therefore -deprecated it for removal in OpenJDK 17 via JEP 411 (2021). As the -next step toward removing the Security Manager, we will revise the -Java Platform specification so that developers cannot enable it and -other Platform classes do not refer to it. This change will have no -impact on the vast majority of applications, libraries, and tools. We -will remove the Security Manager API in a future release. - -REMOVALS -======== - -String Templates -================ -https://openjdk.org/jeps/430 -https://openjdk.org/jeps/459 -https://openjdk.org/jeps/465 - -This was a preview feature (http://openjdk.java.net/jeps/12) -introduced in OpenJDK 21 (JEP 430) with a second preview in OpenJDK 22 -(JEP 459). A third preview was proposed but ultimately withdrawn for -OpenJDK 23 (JEP 465) and the feature is no longer present. See [0] -for further explanation. - -[0] https://mail.openjdk.org/pipermail/amber-spec-experts/2024-April/004106.html - -Remove the Windows & Linux 32-bit x86 Ports -=========================================== -https://openjdk.org/jeps/449 -https://openjdk.org/jeps/479 -https://openjdk.org/jeps/501 -https://openjdk.org/jeps/503 - -Remove the source code and build support for the Windows (JEP 479) & -Linux (JEP 503) 32-bit x86 ports. The Windows port was deprecated for -removal in JDK 21 by JEP 449 and the Linux port was deprecated for -removal in JDK 24 by JEP 501. Both deprecations took place with the -express intent to remove the ports in a future release. - -Following this removal of these 32-bit x86 ports, the -architecture-agnostic Zero port is the only way to run Java programs -on 32-bit x86 processors. - -ZGC: Remove the Non-Generational Mode -===================================== -https://openjdk.org/jeps/439 -https://openjdk.org/jeps/474 -https://openjdk.org/jeps/490 - -Remove the non-generational mode of the Z Garbage Collector (ZGC), -keeping the generational mode as the default for ZGC (see JEP 439 & -474). + - 404: Generational Shenandoah (Experimental) + - 450: Compact Object Headers (Experimental) + - 472: Prepare to Restrict the Use of JNI + - 475: Late Barrier Expansion for G1 + - 478: Key Derivation Function API (Preview) + - 479: Remove the Windows 32-bit x86 Port + - 483: Ahead-of-Time Class Loading & Linking + - 484: Class-File API + - 485: Stream Gatherers + - 486: Permanently Disable the Security Manager + - 487: Scoped Values (Fourth Preview) + - 488: Primitive Types in Patterns, instanceof, and switch (Second Preview) + - 489: Vector API (Ninth Incubator) + - 490: ZGC: Remove the Non-Generational Mode + - 491: Synchronize Virtual Threads without Pinning + - 492: Flexible Constructor Bodies (Third Preview) + - 493: Linking Run-Time Images without JMODs + - 494: Module Import Declarations (Second Preview) + - 495: Simple Source Files and Instance Main Methods (Fourth Preview) + - 496: Quantum-Resistant Module-Lattice-Based Key Encapsulation Mechanism + - 497: Quantum-Resistant Module-Lattice-Based Digital Signature Algorithm + - 498: Warn upon Use of Memory-Access Methods in sun.misc.Unsafe + - 499: Structured Concurrency (Fourth Preview) + - 501: Deprecate the 32-bit x86 Port for Removal diff --git a/README.md b/README.md index 9a97482..34d9d78 100644 --- a/README.md +++ b/README.md @@ -4,11 +4,11 @@ This package contains the latest rolling release of OpenJDK. OpenJDK has a release cadence of six months, with a new release in March and September each year. -The current release is OpenJDK 25. For a list of major changes from +The current release is OpenJDK 23. For a list of major changes from OpenJDK 21, see the NEWS file included in this package and the upstream release page: -https://openjdk.org/projects/jdk/25/ +https://openjdk.org/projects/jdk/23/ This package is intended for those who want to follow the latest OpenJDK releases. Long term support versions of OpenJDK are available diff --git a/TestTranslations.java b/TestTranslations.java index 1b02c06..f6a4fe2 100644 --- a/TestTranslations.java +++ b/TestTranslations.java @@ -50,11 +50,11 @@ public class TestTranslations { "Mountain Daylight Time", "MDT", "MDT", "Mountain Time", "MT", "MT"}); map.put(Locale.FRANCE, new String[] { "heure normale des Rocheuses", "UTC\u221207:00", "MST", - "heure d\u2019\u00e9t\u00e9 des Rocheuses", "UTC\u221206:00", "MST", - "heure des Rocheuses", "UTC\u221207:00", "MST"}); - map.put(Locale.GERMANY, new String[] { "Rocky-Mountains-Normalzeit", "GMT-07:00", "MST", - "Rocky-Mountains-Sommerzeit", "GMT-06:00", "MST", - "Rocky-Mountains-Zeit", "GMT-07:00", "MST"}); + "heure d\u2019\u00e9t\u00e9 des Rocheuses", "UTC\u221206:00", "MDT", + "heure des Rocheuses", "UTC\u221207:00", "MT"}); + map.put(Locale.GERMANY, new String[] { "Rocky-Mountain-Normalzeit", "GMT-07:00", "MST", + "Rocky-Mountain-Sommerzeit", "GMT-06:00", "MDT", + "Rocky-Mountain-Zeit", "GMT-07:00", "MT"}); CIUDAD_JUAREZ = Collections.unmodifiableMap(map); } @@ -97,10 +97,14 @@ public class TestTranslations { System.out.printf("Checking locale %s for %s...\n", l, id); - if ("JRE".equals(localeProvider) || "CLDR".equals(localeProvider)) { + if ("JRE".equals(localeProvider)) { expectedShortStd = expected[2]; expectedShortDST = expected[5]; expectedShortGen = expected[8]; + } else if ("CLDR".equals(localeProvider)) { + expectedShortStd = expected[1]; + expectedShortDST = expected[4]; + expectedShortGen = expected[7]; } else { System.err.printf("Invalid locale provider %s\n", localeProvider); System.exit(3); diff --git a/scripts/discover_trees.sh b/discover_trees.sh similarity index 57% rename from scripts/discover_trees.sh rename to discover_trees.sh index 7a0b800..8c31278 100755 --- a/scripts/discover_trees.sh +++ b/discover_trees.sh @@ -1,6 +1,6 @@ #!/bin/sh -# Copyright (C) 2024 Red Hat, Inc. +# Copyright (C) 2020 Red Hat, Inc. # Written by Andrew John Hughes . # # This program is free software: you can redistribute it and/or modify @@ -18,44 +18,37 @@ TREE=${1} -if test "${TREE}" = ""; then +if test "x${TREE}" = "x"; then TREE=${PWD} fi -if [ -e "${TREE}"/nashorn/.hg ] || [ -e "${TREE}"/nashorn/merge.changeset ] ; then +if [ -e ${TREE}/nashorn/.hg -o -e ${TREE}/nashorn/merge.changeset ] ; then NASHORN="nashorn" ; fi -if [ -e "${TREE}"/corba/.hg ] || [ -e "${TREE}"/corba/merge.changeset ] ; then +if [ -e ${TREE}/corba/.hg -o -e ${TREE}/corba/merge.changeset ] ; then CORBA="corba"; fi -if [ -e "${TREE}"/jaxp/.hg ] || [ -e "${TREE}"/jaxp/merge.changeset ] ; then +if [ -e ${TREE}/jaxp/.hg -o -e ${TREE}/jaxp/merge.changeset ] ; then JAXP="jaxp"; fi -if [ -e "${TREE}"/jaxws/.hg ] || [ -e "${TREE}"/jaxws/merge.changeset ] ; then +if [ -e ${TREE}/jaxws/.hg -o -e ${TREE}/jaxws/merge.changeset ] ; then JAXWS="jaxws"; fi -if [ -e "${TREE}"/langtools/.hg ] || [ -e "${TREE}"/langtools/merge.changeset ] ; then +if [ -e ${TREE}/langtools/.hg -o -e ${TREE}/langtools/merge.changeset ] ; then LANGTOOLS="langtools"; fi -if [ -e "${TREE}"/jdk/.hg ] || [ -e "${TREE}"/jdk/merge.changeset ] ; then +if [ -e ${TREE}/jdk/.hg -o -e ${TREE}/jdk/merge.changeset ] ; then JDK="jdk"; fi -if [ -e "${TREE}"/hotspot/.hg ] || [ -e "${TREE}"/hotspot/merge.changeset ] ; then +if [ -e ${TREE}/hotspot/.hg -o -e ${TREE}/hotspot/merge.changeset ] ; then HOTSPOT="hotspot"; fi SUBTREES="${CORBA} ${JAXP} ${JAXWS} ${LANGTOOLS} ${NASHORN} ${JDK} ${HOTSPOT}"; -echo "${SUBTREES}" - -# Local Variables: -# compile-command: "shellcheck discover_trees.sh" -# fill-column: 80 -# indent-tabs-mode: nil -# sh-basic-offset: 4 -# End: +echo ${SUBTREES} diff --git a/fips-21u-75ffdc48eda.patch b/fips-21u-75ffdc48eda.patch new file mode 100644 index 0000000..8413fe1 --- /dev/null +++ b/fips-21u-75ffdc48eda.patch @@ -0,0 +1,4233 @@ +diff --git a/make/autoconf/build-aux/pkg.m4 b/make/autoconf/build-aux/pkg.m4 +index 5f4b22bb27f..1ca9f5b8ffe 100644 +--- a/make/autoconf/build-aux/pkg.m4 ++++ b/make/autoconf/build-aux/pkg.m4 +@@ -179,3 +179,19 @@ else + ifelse([$3], , :, [$3]) + fi[]dnl + ])# PKG_CHECK_MODULES ++ ++dnl PKG_CHECK_VAR(VARIABLE, MODULE, CONFIG-VARIABLE, ++dnl [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND]) ++dnl ------------------------------------------- ++dnl Since: 0.28 ++dnl ++dnl Retrieves the value of the pkg-config variable for the given module. ++AC_DEFUN([PKG_CHECK_VAR], ++[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl ++AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])dnl ++ ++_PKG_CONFIG([$1], [variable="][$3]["], [$2]) ++AS_VAR_COPY([$1], [pkg_cv_][$1]) ++ ++AS_VAR_IF([$1], [""], [$5], [$4])dnl ++])dnl PKG_CHECK_VAR +diff --git a/make/autoconf/lib-sysconf.m4 b/make/autoconf/lib-sysconf.m4 +new file mode 100644 +index 00000000000..f48fc7f7e80 +--- /dev/null ++++ b/make/autoconf/lib-sysconf.m4 +@@ -0,0 +1,87 @@ ++# ++# Copyright (c) 2021, Red Hat, Inc. ++# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++# ++# This code is free software; you can redistribute it and/or modify it ++# under the terms of the GNU General Public License version 2 only, as ++# published by the Free Software Foundation. Oracle designates this ++# particular file as subject to the "Classpath" exception as provided ++# by Oracle in the LICENSE file that accompanied this code. ++# ++# This code is distributed in the hope that it will be useful, but WITHOUT ++# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++# version 2 for more details (a copy is included in the LICENSE file that ++# accompanied this code). ++# ++# You should have received a copy of the GNU General Public License version ++# 2 along with this work; if not, write to the Free Software Foundation, ++# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++# ++# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++# or visit www.oracle.com if you need additional information or have any ++# questions. ++# ++ ++################################################################################ ++# Setup system configuration libraries ++################################################################################ ++AC_DEFUN_ONCE([LIB_SETUP_SYSCONF_LIBS], ++[ ++ ############################################################################### ++ # ++ # Check for the NSS library ++ # ++ AC_MSG_CHECKING([for NSS library directory]) ++ PKG_CHECK_VAR(NSS_LIBDIR, nss, libdir, [AC_MSG_RESULT([$NSS_LIBDIR])], [AC_MSG_RESULT([not found])]) ++ ++ AC_MSG_CHECKING([whether to link the system NSS library with the System Configurator (libsysconf)]) ++ ++ # default is not available ++ DEFAULT_SYSCONF_NSS=no ++ ++ AC_ARG_ENABLE([sysconf-nss], [AS_HELP_STRING([--enable-sysconf-nss], ++ [build the System Configurator (libsysconf) using the system NSS library if available @<:@disabled@:>@])], ++ [ ++ case "${enableval}" in ++ yes) ++ sysconf_nss=yes ++ ;; ++ *) ++ sysconf_nss=no ++ ;; ++ esac ++ ], ++ [ ++ sysconf_nss=${DEFAULT_SYSCONF_NSS} ++ ]) ++ AC_MSG_RESULT([$sysconf_nss]) ++ ++ USE_SYSCONF_NSS=false ++ if test "x${sysconf_nss}" = "xyes"; then ++ PKG_CHECK_MODULES(NSS, nss >= 3.53, [NSS_FOUND=yes], [NSS_FOUND=no]) ++ if test "x${NSS_FOUND}" = "xyes"; then ++ AC_MSG_CHECKING([for system FIPS support in NSS]) ++ saved_libs="${LIBS}" ++ saved_cflags="${CFLAGS}" ++ CFLAGS="${CFLAGS} ${NSS_CFLAGS}" ++ LIBS="${LIBS} ${NSS_LIBS}" ++ AC_LANG_PUSH([C]) ++ AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include ]], ++ [[SECMOD_GetSystemFIPSEnabled()]])], ++ [AC_MSG_RESULT([yes])], ++ [AC_MSG_RESULT([no]) ++ AC_MSG_ERROR([System NSS FIPS detection unavailable])]) ++ AC_LANG_POP([C]) ++ CFLAGS="${saved_cflags}" ++ LIBS="${saved_libs}" ++ USE_SYSCONF_NSS=true ++ else ++ dnl NSS 3.53 is the one that introduces the SECMOD_GetSystemFIPSEnabled API ++ dnl in nss3/pk11pub.h. ++ AC_MSG_ERROR([--enable-sysconf-nss specified, but NSS 3.53 or above not found.]) ++ fi ++ fi ++ AC_SUBST(USE_SYSCONF_NSS) ++ AC_SUBST(NSS_LIBDIR) ++]) +diff --git a/make/autoconf/libraries.m4 b/make/autoconf/libraries.m4 +index a1fc81564b1..ebad69d9dcf 100644 +--- a/make/autoconf/libraries.m4 ++++ b/make/autoconf/libraries.m4 +@@ -35,6 +35,7 @@ m4_include([lib-std.m4]) + m4_include([lib-x11.m4]) + + m4_include([lib-tests.m4]) ++m4_include([lib-sysconf.m4]) + + ################################################################################ + # Determine which libraries are needed for this configuration +@@ -134,6 +135,7 @@ AC_DEFUN_ONCE([LIB_SETUP_LIBRARIES], + LIB_SETUP_X11 + + LIB_TESTS_SETUP_GTEST ++ LIB_SETUP_SYSCONF_LIBS + + BASIC_JDKLIB_LIBS="" + BASIC_JDKLIB_LIBS_TARGET="" +diff --git a/make/autoconf/spec.gmk.in b/make/autoconf/spec.gmk.in +index 0f85917814e..9419562b654 100644 +--- a/make/autoconf/spec.gmk.in ++++ b/make/autoconf/spec.gmk.in +@@ -867,6 +867,11 @@ INSTALL_SYSCONFDIR=@sysconfdir@ + # Libraries + # + ++USE_SYSCONF_NSS:=@USE_SYSCONF_NSS@ ++NSS_LIBS:=@NSS_LIBS@ ++NSS_CFLAGS:=@NSS_CFLAGS@ ++NSS_LIBDIR:=@NSS_LIBDIR@ ++ + USE_EXTERNAL_LCMS:=@USE_EXTERNAL_LCMS@ + LCMS_CFLAGS:=@LCMS_CFLAGS@ + LCMS_LIBS:=@LCMS_LIBS@ +diff --git a/make/modules/java.base/Gendata.gmk b/make/modules/java.base/Gendata.gmk +index 9e5cfe2d0fc..434ade8e182 100644 +--- a/make/modules/java.base/Gendata.gmk ++++ b/make/modules/java.base/Gendata.gmk +@@ -98,3 +98,17 @@ $(GENDATA_JAVA_SECURITY): $(BUILD_TOOLS_JDK) $(GENDATA_JAVA_SECURITY_SRC) $(REST + TARGETS += $(GENDATA_JAVA_SECURITY) + + ################################################################################ ++ ++GENDATA_NSS_FIPS_CFG_SRC := $(TOPDIR)/src/java.base/share/conf/security/nss.fips.cfg.in ++GENDATA_NSS_FIPS_CFG := $(SUPPORT_OUTPUTDIR)/modules_conf/java.base/security/nss.fips.cfg ++ ++$(GENDATA_NSS_FIPS_CFG): $(GENDATA_NSS_FIPS_CFG_SRC) ++ $(call LogInfo, Generating nss.fips.cfg) ++ $(call MakeTargetDir) ++ $(call ExecuteWithLog, $(SUPPORT_OUTPUTDIR)/gensrc/java.base/_$(@F), \ ++ ( $(SED) -e 's:@NSS_LIBDIR@:$(NSS_LIBDIR):g' $< ) > $@ \ ++ ) ++ ++TARGETS += $(GENDATA_NSS_FIPS_CFG) ++ ++################################################################################ +diff --git a/make/modules/java.base/Lib.gmk b/make/modules/java.base/Lib.gmk +index 1e0f66726d0..59fe923f2c5 100644 +--- a/make/modules/java.base/Lib.gmk ++++ b/make/modules/java.base/Lib.gmk +@@ -163,6 +163,29 @@ ifeq ($(call isTargetOsType, unix), true) + endif + endif + ++################################################################################ ++# Create the systemconf library ++ ++LIBSYSTEMCONF_CFLAGS := ++LIBSYSTEMCONF_CXXFLAGS := ++ ++ifeq ($(USE_SYSCONF_NSS), true) ++ LIBSYSTEMCONF_CFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS ++ LIBSYSTEMCONF_CXXFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS ++endif ++ ++$(eval $(call SetupJdkLibrary, BUILD_LIBSYSTEMCONF, \ ++ NAME := systemconf, \ ++ OPTIMIZATION := LOW, \ ++ CFLAGS := $(CFLAGS_JDKLIB) $(LIBSYSTEMCONF_CFLAGS), \ ++ CXXFLAGS := $(CXXFLAGS_JDKLIB) $(LIBSYSTEMCONF_CXXFLAGS), \ ++ LDFLAGS := $(LDFLAGS_JDKLIB) \ ++ $(call SET_SHARED_LIBRARY_ORIGIN), \ ++ LIBS_unix := $(LIBDL) $(NSS_LIBS), \ ++)) ++ ++TARGETS += $(BUILD_LIBSYSTEMCONF) ++ + ################################################################################ + # Create the symbols file for static builds. + +diff --git a/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java b/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java +index 10093137151..b023c63ae58 100644 +--- a/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java ++++ b/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java +@@ -31,6 +31,7 @@ import java.security.SecureRandom; + import java.security.PrivilegedAction; + import java.util.HashMap; + import java.util.List; ++import jdk.internal.access.SharedSecrets; + import static sun.security.util.SecurityConstants.PROVIDER_VER; + import static sun.security.util.SecurityProviderConstants.*; + +@@ -82,6 +83,10 @@ import static sun.security.util.SecurityProviderConstants.*; + + public final class SunJCE extends Provider { + ++ private static final boolean systemFipsEnabled = ++ SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ .isSystemFipsEnabled(); ++ + @java.io.Serial + private static final long serialVersionUID = 6812507587804302833L; + +@@ -147,298 +152,299 @@ public final class SunJCE extends Provider { + void putEntries() { + // reuse attribute map and reset before each reuse + HashMap attrs = new HashMap<>(3); +- attrs.put("SupportedModes", "ECB"); +- attrs.put("SupportedPaddings", "NOPADDING|PKCS1PADDING|OAEPPADDING" +- + "|OAEPWITHMD5ANDMGF1PADDING" +- + "|OAEPWITHSHA1ANDMGF1PADDING" +- + "|OAEPWITHSHA-1ANDMGF1PADDING" +- + "|OAEPWITHSHA-224ANDMGF1PADDING" +- + "|OAEPWITHSHA-256ANDMGF1PADDING" +- + "|OAEPWITHSHA-384ANDMGF1PADDING" +- + "|OAEPWITHSHA-512ANDMGF1PADDING" +- + "|OAEPWITHSHA-512/224ANDMGF1PADDING" +- + "|OAEPWITHSHA-512/256ANDMGF1PADDING"); +- attrs.put("SupportedKeyClasses", +- "java.security.interfaces.RSAPublicKey" + +- "|java.security.interfaces.RSAPrivateKey"); +- ps("Cipher", "RSA", +- "com.sun.crypto.provider.RSACipher", null, attrs); +- +- // common block cipher modes, pads +- final String BLOCK_MODES = "ECB|CBC|PCBC|CTR|CTS|CFB|OFB" + +- "|CFB8|CFB16|CFB24|CFB32|CFB40|CFB48|CFB56|CFB64" + +- "|OFB8|OFB16|OFB24|OFB32|OFB40|OFB48|OFB56|OFB64"; +- final String BLOCK_MODES128 = BLOCK_MODES + +- "|CFB72|CFB80|CFB88|CFB96|CFB104|CFB112|CFB120|CFB128" + +- "|OFB72|OFB80|OFB88|OFB96|OFB104|OFB112|OFB120|OFB128"; +- final String BLOCK_PADS = "NOPADDING|PKCS5PADDING|ISO10126PADDING"; +- +- attrs.clear(); +- attrs.put("SupportedModes", BLOCK_MODES); +- attrs.put("SupportedPaddings", BLOCK_PADS); +- attrs.put("SupportedKeyFormats", "RAW"); +- ps("Cipher", "DES", +- "com.sun.crypto.provider.DESCipher", null, attrs); +- psA("Cipher", "DESede", "com.sun.crypto.provider.DESedeCipher", +- attrs); +- ps("Cipher", "Blowfish", +- "com.sun.crypto.provider.BlowfishCipher", null, attrs); +- +- ps("Cipher", "RC2", +- "com.sun.crypto.provider.RC2Cipher", null, attrs); +- +- attrs.clear(); +- attrs.put("SupportedModes", BLOCK_MODES128); +- attrs.put("SupportedPaddings", BLOCK_PADS); +- attrs.put("SupportedKeyFormats", "RAW"); +- psA("Cipher", "AES", +- "com.sun.crypto.provider.AESCipher$General", attrs); +- +- attrs.clear(); +- attrs.put("SupportedKeyFormats", "RAW"); +- psA("Cipher", "AES/KW/NoPadding", +- "com.sun.crypto.provider.KeyWrapCipher$AES_KW_NoPadding", +- attrs); +- ps("Cipher", "AES/KW/PKCS5Padding", +- "com.sun.crypto.provider.KeyWrapCipher$AES_KW_PKCS5Padding", +- null, attrs); +- psA("Cipher", "AES/KWP/NoPadding", +- "com.sun.crypto.provider.KeyWrapCipher$AES_KWP_NoPadding", +- attrs); +- +- psA("Cipher", "AES_128/ECB/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES128_ECB_NoPadding", +- attrs); +- psA("Cipher", "AES_128/CBC/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES128_CBC_NoPadding", +- attrs); +- psA("Cipher", "AES_128/OFB/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES128_OFB_NoPadding", +- attrs); +- psA("Cipher", "AES_128/CFB/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES128_CFB_NoPadding", +- attrs); +- psA("Cipher", "AES_128/KW/NoPadding", +- "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_NoPadding", +- attrs); +- ps("Cipher", "AES_128/KW/PKCS5Padding", +- "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_PKCS5Padding", +- null, attrs); +- psA("Cipher", "AES_128/KWP/NoPadding", +- "com.sun.crypto.provider.KeyWrapCipher$AES128_KWP_NoPadding", +- attrs); +- +- psA("Cipher", "AES_192/ECB/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES192_ECB_NoPadding", +- attrs); +- psA("Cipher", "AES_192/CBC/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES192_CBC_NoPadding", +- attrs); +- psA("Cipher", "AES_192/OFB/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES192_OFB_NoPadding", +- attrs); +- psA("Cipher", "AES_192/CFB/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES192_CFB_NoPadding", +- attrs); +- psA("Cipher", "AES_192/KW/NoPadding", +- "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_NoPadding", +- attrs); +- ps("Cipher", "AES_192/KW/PKCS5Padding", +- "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_PKCS5Padding", +- null, attrs); +- psA("Cipher", "AES_192/KWP/NoPadding", +- "com.sun.crypto.provider.KeyWrapCipher$AES192_KWP_NoPadding", +- attrs); +- +- psA("Cipher", "AES_256/ECB/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES256_ECB_NoPadding", +- attrs); +- psA("Cipher", "AES_256/CBC/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES256_CBC_NoPadding", +- attrs); +- psA("Cipher", "AES_256/OFB/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES256_OFB_NoPadding", +- attrs); +- psA("Cipher", "AES_256/CFB/NoPadding", +- "com.sun.crypto.provider.AESCipher$AES256_CFB_NoPadding", +- attrs); +- psA("Cipher", "AES_256/KW/NoPadding", +- "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_NoPadding", +- attrs); +- ps("Cipher", "AES_256/KW/PKCS5Padding", +- "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_PKCS5Padding", +- null, attrs); +- psA("Cipher", "AES_256/KWP/NoPadding", +- "com.sun.crypto.provider.KeyWrapCipher$AES256_KWP_NoPadding", +- attrs); +- +- attrs.clear(); +- attrs.put("SupportedModes", "GCM"); +- attrs.put("SupportedKeyFormats", "RAW"); +- +- ps("Cipher", "AES/GCM/NoPadding", +- "com.sun.crypto.provider.GaloisCounterMode$AESGCM", null, +- attrs); +- psA("Cipher", "AES_128/GCM/NoPadding", +- "com.sun.crypto.provider.GaloisCounterMode$AES128", +- attrs); +- psA("Cipher", "AES_192/GCM/NoPadding", +- "com.sun.crypto.provider.GaloisCounterMode$AES192", +- attrs); +- psA("Cipher", "AES_256/GCM/NoPadding", +- "com.sun.crypto.provider.GaloisCounterMode$AES256", +- attrs); +- +- attrs.clear(); +- attrs.put("SupportedModes", "CBC"); +- attrs.put("SupportedPaddings", "NOPADDING"); +- attrs.put("SupportedKeyFormats", "RAW"); +- ps("Cipher", "DESedeWrap", +- "com.sun.crypto.provider.DESedeWrapCipher", null, attrs); +- +- attrs.clear(); +- attrs.put("SupportedModes", "ECB"); +- attrs.put("SupportedPaddings", "NOPADDING"); +- attrs.put("SupportedKeyFormats", "RAW"); +- psA("Cipher", "ARCFOUR", +- "com.sun.crypto.provider.ARCFOURCipher", attrs); +- +- attrs.clear(); +- attrs.put("SupportedKeyFormats", "RAW"); +- ps("Cipher", "ChaCha20", +- "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Only", +- null, attrs); +- psA("Cipher", "ChaCha20-Poly1305", +- "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Poly1305", +- attrs); +- +- // PBES1 +- psA("Cipher", "PBEWithMD5AndDES", +- "com.sun.crypto.provider.PBEWithMD5AndDESCipher", +- null); +- ps("Cipher", "PBEWithMD5AndTripleDES", +- "com.sun.crypto.provider.PBEWithMD5AndTripleDESCipher"); +- psA("Cipher", "PBEWithSHA1AndDESede", +- "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndDESede", +- null); +- psA("Cipher", "PBEWithSHA1AndRC2_40", +- "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_40", +- null); +- psA("Cipher", "PBEWithSHA1AndRC2_128", +- "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_128", +- null); +- psA("Cipher", "PBEWithSHA1AndRC4_40", +- "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_40", +- null); +- +- psA("Cipher", "PBEWithSHA1AndRC4_128", +- "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_128", +- null); +- +- // PBES2 +- ps("Cipher", "PBEWithHmacSHA1AndAES_128", +- "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_128"); +- +- ps("Cipher", "PBEWithHmacSHA224AndAES_128", +- "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_128"); +- +- ps("Cipher", "PBEWithHmacSHA256AndAES_128", +- "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_128"); +- +- ps("Cipher", "PBEWithHmacSHA384AndAES_128", +- "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_128"); +- +- ps("Cipher", "PBEWithHmacSHA512AndAES_128", +- "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_128"); +- +- ps("Cipher", "PBEWithHmacSHA512/224AndAES_128", +- "com.sun.crypto.provider.PBES2Core$HmacSHA512_224AndAES_128"); +- +- ps("Cipher", "PBEWithHmacSHA512/256AndAES_128", +- "com.sun.crypto.provider.PBES2Core$HmacSHA512_256AndAES_128"); +- +- +- ps("Cipher", "PBEWithHmacSHA1AndAES_256", +- "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_256"); +- +- ps("Cipher", "PBEWithHmacSHA224AndAES_256", +- "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_256"); +- +- ps("Cipher", "PBEWithHmacSHA256AndAES_256", +- "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_256"); +- +- ps("Cipher", "PBEWithHmacSHA384AndAES_256", +- "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_256"); +- +- ps("Cipher", "PBEWithHmacSHA512AndAES_256", +- "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_256"); +- +- ps("Cipher", "PBEWithHmacSHA512/224AndAES_256", +- "com.sun.crypto.provider.PBES2Core$HmacSHA512_224AndAES_256"); +- +- ps("Cipher", "PBEWithHmacSHA512/256AndAES_256", +- "com.sun.crypto.provider.PBES2Core$HmacSHA512_256AndAES_256"); +- +- /* +- * Key(pair) Generator engines +- */ +- ps("KeyGenerator", "DES", +- "com.sun.crypto.provider.DESKeyGenerator"); +- psA("KeyGenerator", "DESede", +- "com.sun.crypto.provider.DESedeKeyGenerator", +- null); +- ps("KeyGenerator", "Blowfish", +- "com.sun.crypto.provider.BlowfishKeyGenerator"); +- psA("KeyGenerator", "AES", +- "com.sun.crypto.provider.AESKeyGenerator", +- null); +- ps("KeyGenerator", "RC2", +- "com.sun.crypto.provider.KeyGeneratorCore$RC2KeyGenerator"); +- psA("KeyGenerator", "ARCFOUR", +- "com.sun.crypto.provider.KeyGeneratorCore$ARCFOURKeyGenerator", +- null); +- ps("KeyGenerator", "ChaCha20", +- "com.sun.crypto.provider.KeyGeneratorCore$ChaCha20KeyGenerator"); +- ps("KeyGenerator", "HmacMD5", +- "com.sun.crypto.provider.HmacMD5KeyGenerator"); +- +- psA("KeyGenerator", "HmacSHA1", +- "com.sun.crypto.provider.HmacSHA1KeyGenerator", null); +- psA("KeyGenerator", "HmacSHA224", +- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA224", +- null); +- psA("KeyGenerator", "HmacSHA256", +- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA256", +- null); +- psA("KeyGenerator", "HmacSHA384", +- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA384", +- null); +- psA("KeyGenerator", "HmacSHA512", +- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512", +- null); +- psA("KeyGenerator", "HmacSHA512/224", +- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_224", +- null); +- psA("KeyGenerator", "HmacSHA512/256", +- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_256", +- null); +- +- psA("KeyGenerator", "HmacSHA3-224", +- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_224", +- null); +- psA("KeyGenerator", "HmacSHA3-256", +- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_256", +- null); +- psA("KeyGenerator", "HmacSHA3-384", +- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_384", +- null); +- psA("KeyGenerator", "HmacSHA3-512", +- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_512", +- null); +- +- psA("KeyPairGenerator", "DiffieHellman", +- "com.sun.crypto.provider.DHKeyPairGenerator", +- null); ++ if (!systemFipsEnabled) { ++ attrs.put("SupportedModes", "ECB"); ++ attrs.put("SupportedPaddings", "NOPADDING|PKCS1PADDING|OAEPPADDING" ++ + "|OAEPWITHMD5ANDMGF1PADDING" ++ + "|OAEPWITHSHA1ANDMGF1PADDING" ++ + "|OAEPWITHSHA-1ANDMGF1PADDING" ++ + "|OAEPWITHSHA-224ANDMGF1PADDING" ++ + "|OAEPWITHSHA-256ANDMGF1PADDING" ++ + "|OAEPWITHSHA-384ANDMGF1PADDING" ++ + "|OAEPWITHSHA-512ANDMGF1PADDING" ++ + "|OAEPWITHSHA-512/224ANDMGF1PADDING" ++ + "|OAEPWITHSHA-512/256ANDMGF1PADDING"); ++ attrs.put("SupportedKeyClasses", ++ "java.security.interfaces.RSAPublicKey" + ++ "|java.security.interfaces.RSAPrivateKey"); ++ ps("Cipher", "RSA", ++ "com.sun.crypto.provider.RSACipher", null, attrs); ++ ++ // common block cipher modes, pads ++ final String BLOCK_MODES = "ECB|CBC|PCBC|CTR|CTS|CFB|OFB" + ++ "|CFB8|CFB16|CFB24|CFB32|CFB40|CFB48|CFB56|CFB64" + ++ "|OFB8|OFB16|OFB24|OFB32|OFB40|OFB48|OFB56|OFB64"; ++ final String BLOCK_MODES128 = BLOCK_MODES + ++ "|CFB72|CFB80|CFB88|CFB96|CFB104|CFB112|CFB120|CFB128" + ++ "|OFB72|OFB80|OFB88|OFB96|OFB104|OFB112|OFB120|OFB128"; ++ final String BLOCK_PADS = "NOPADDING|PKCS5PADDING|ISO10126PADDING"; ++ ++ attrs.clear(); ++ attrs.put("SupportedModes", BLOCK_MODES); ++ attrs.put("SupportedPaddings", BLOCK_PADS); ++ attrs.put("SupportedKeyFormats", "RAW"); ++ ps("Cipher", "DES", ++ "com.sun.crypto.provider.DESCipher", null, attrs); ++ psA("Cipher", "DESede", "com.sun.crypto.provider.DESedeCipher", ++ attrs); ++ ps("Cipher", "Blowfish", ++ "com.sun.crypto.provider.BlowfishCipher", null, attrs); ++ ++ ps("Cipher", "RC2", ++ "com.sun.crypto.provider.RC2Cipher", null, attrs); ++ ++ attrs.clear(); ++ attrs.put("SupportedModes", BLOCK_MODES128); ++ attrs.put("SupportedPaddings", BLOCK_PADS); ++ attrs.put("SupportedKeyFormats", "RAW"); ++ psA("Cipher", "AES", ++ "com.sun.crypto.provider.AESCipher$General", attrs); ++ ++ attrs.clear(); ++ attrs.put("SupportedKeyFormats", "RAW"); ++ psA("Cipher", "AES/KW/NoPadding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES_KW_NoPadding", ++ attrs); ++ ps("Cipher", "AES/KW/PKCS5Padding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES_KW_PKCS5Padding", ++ null, attrs); ++ psA("Cipher", "AES/KWP/NoPadding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES_KWP_NoPadding", ++ attrs); ++ ++ psA("Cipher", "AES_128/ECB/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES128_ECB_NoPadding", ++ attrs); ++ psA("Cipher", "AES_128/CBC/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES128_CBC_NoPadding", ++ attrs); ++ psA("Cipher", "AES_128/OFB/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES128_OFB_NoPadding", ++ attrs); ++ psA("Cipher", "AES_128/CFB/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES128_CFB_NoPadding", ++ attrs); ++ psA("Cipher", "AES_128/KW/NoPadding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_NoPadding", ++ attrs); ++ ps("Cipher", "AES_128/KW/PKCS5Padding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_PKCS5Padding", ++ null, attrs); ++ psA("Cipher", "AES_128/KWP/NoPadding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES128_KWP_NoPadding", ++ attrs); ++ ++ psA("Cipher", "AES_192/ECB/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES192_ECB_NoPadding", ++ attrs); ++ psA("Cipher", "AES_192/CBC/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES192_CBC_NoPadding", ++ attrs); ++ psA("Cipher", "AES_192/OFB/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES192_OFB_NoPadding", ++ attrs); ++ psA("Cipher", "AES_192/CFB/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES192_CFB_NoPadding", ++ attrs); ++ psA("Cipher", "AES_192/KW/NoPadding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_NoPadding", ++ attrs); ++ ps("Cipher", "AES_192/KW/PKCS5Padding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_PKCS5Padding", ++ null, attrs); ++ psA("Cipher", "AES_192/KWP/NoPadding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES192_KWP_NoPadding", ++ attrs); ++ ++ psA("Cipher", "AES_256/ECB/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES256_ECB_NoPadding", ++ attrs); ++ psA("Cipher", "AES_256/CBC/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES256_CBC_NoPadding", ++ attrs); ++ psA("Cipher", "AES_256/OFB/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES256_OFB_NoPadding", ++ attrs); ++ psA("Cipher", "AES_256/CFB/NoPadding", ++ "com.sun.crypto.provider.AESCipher$AES256_CFB_NoPadding", ++ attrs); ++ psA("Cipher", "AES_256/KW/NoPadding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_NoPadding", ++ attrs); ++ ps("Cipher", "AES_256/KW/PKCS5Padding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_PKCS5Padding", ++ null, attrs); ++ psA("Cipher", "AES_256/KWP/NoPadding", ++ "com.sun.crypto.provider.KeyWrapCipher$AES256_KWP_NoPadding", ++ attrs); ++ ++ attrs.clear(); ++ attrs.put("SupportedModes", "GCM"); ++ attrs.put("SupportedKeyFormats", "RAW"); ++ ++ ps("Cipher", "AES/GCM/NoPadding", ++ "com.sun.crypto.provider.GaloisCounterMode$AESGCM", null, ++ attrs); ++ psA("Cipher", "AES_128/GCM/NoPadding", ++ "com.sun.crypto.provider.GaloisCounterMode$AES128", ++ attrs); ++ psA("Cipher", "AES_192/GCM/NoPadding", ++ "com.sun.crypto.provider.GaloisCounterMode$AES192", ++ attrs); ++ psA("Cipher", "AES_256/GCM/NoPadding", ++ "com.sun.crypto.provider.GaloisCounterMode$AES256", ++ attrs); ++ ++ attrs.clear(); ++ attrs.put("SupportedModes", "CBC"); ++ attrs.put("SupportedPaddings", "NOPADDING"); ++ attrs.put("SupportedKeyFormats", "RAW"); ++ ps("Cipher", "DESedeWrap", ++ "com.sun.crypto.provider.DESedeWrapCipher", null, attrs); ++ ++ attrs.clear(); ++ attrs.put("SupportedModes", "ECB"); ++ attrs.put("SupportedPaddings", "NOPADDING"); ++ attrs.put("SupportedKeyFormats", "RAW"); ++ psA("Cipher", "ARCFOUR", ++ "com.sun.crypto.provider.ARCFOURCipher", attrs); ++ ++ attrs.clear(); ++ attrs.put("SupportedKeyFormats", "RAW"); ++ ps("Cipher", "ChaCha20", ++ "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Only", ++ null, attrs); ++ psA("Cipher", "ChaCha20-Poly1305", ++ "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Poly1305", ++ attrs); ++ ++ // PBES1 ++ psA("Cipher", "PBEWithMD5AndDES", ++ "com.sun.crypto.provider.PBEWithMD5AndDESCipher", ++ null); ++ ps("Cipher", "PBEWithMD5AndTripleDES", ++ "com.sun.crypto.provider.PBEWithMD5AndTripleDESCipher"); ++ psA("Cipher", "PBEWithSHA1AndDESede", ++ "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndDESede", ++ null); ++ psA("Cipher", "PBEWithSHA1AndRC2_40", ++ "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_40", ++ null); ++ psA("Cipher", "PBEWithSHA1AndRC2_128", ++ "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_128", ++ null); ++ psA("Cipher", "PBEWithSHA1AndRC4_40", ++ "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_40", ++ null); ++ ++ psA("Cipher", "PBEWithSHA1AndRC4_128", ++ "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_128", ++ null); ++ ++ // PBES2 ++ ps("Cipher", "PBEWithHmacSHA1AndAES_128", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_128"); ++ ++ ps("Cipher", "PBEWithHmacSHA224AndAES_128", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_128"); ++ ++ ps("Cipher", "PBEWithHmacSHA256AndAES_128", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_128"); ++ ++ ps("Cipher", "PBEWithHmacSHA384AndAES_128", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_128"); ++ ++ ps("Cipher", "PBEWithHmacSHA512AndAES_128", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_128"); ++ ++ ps("Cipher", "PBEWithHmacSHA512/224AndAES_128", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA512_224AndAES_128"); ++ ++ ps("Cipher", "PBEWithHmacSHA512/256AndAES_128", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA512_256AndAES_128"); ++ ++ ps("Cipher", "PBEWithHmacSHA1AndAES_256", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_256"); ++ ++ ps("Cipher", "PBEWithHmacSHA224AndAES_256", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_256"); ++ ++ ps("Cipher", "PBEWithHmacSHA256AndAES_256", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_256"); ++ ++ ps("Cipher", "PBEWithHmacSHA384AndAES_256", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_256"); ++ ++ ps("Cipher", "PBEWithHmacSHA512AndAES_256", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_256"); ++ ++ ps("Cipher", "PBEWithHmacSHA512/224AndAES_256", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA512_224AndAES_256"); ++ ++ ps("Cipher", "PBEWithHmacSHA512/256AndAES_256", ++ "com.sun.crypto.provider.PBES2Core$HmacSHA512_256AndAES_256"); ++ ++ /* ++ * Key(pair) Generator engines ++ */ ++ ps("KeyGenerator", "DES", ++ "com.sun.crypto.provider.DESKeyGenerator"); ++ psA("KeyGenerator", "DESede", ++ "com.sun.crypto.provider.DESedeKeyGenerator", ++ null); ++ ps("KeyGenerator", "Blowfish", ++ "com.sun.crypto.provider.BlowfishKeyGenerator"); ++ psA("KeyGenerator", "AES", ++ "com.sun.crypto.provider.AESKeyGenerator", ++ null); ++ ps("KeyGenerator", "RC2", ++ "com.sun.crypto.provider.KeyGeneratorCore$RC2KeyGenerator"); ++ psA("KeyGenerator", "ARCFOUR", ++ "com.sun.crypto.provider.KeyGeneratorCore$ARCFOURKeyGenerator", ++ null); ++ ps("KeyGenerator", "ChaCha20", ++ "com.sun.crypto.provider.KeyGeneratorCore$ChaCha20KeyGenerator"); ++ ps("KeyGenerator", "HmacMD5", ++ "com.sun.crypto.provider.HmacMD5KeyGenerator"); ++ ++ psA("KeyGenerator", "HmacSHA1", ++ "com.sun.crypto.provider.HmacSHA1KeyGenerator", null); ++ psA("KeyGenerator", "HmacSHA224", ++ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA224", ++ null); ++ psA("KeyGenerator", "HmacSHA256", ++ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA256", ++ null); ++ psA("KeyGenerator", "HmacSHA384", ++ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA384", ++ null); ++ psA("KeyGenerator", "HmacSHA512", ++ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512", ++ null); ++ psA("KeyGenerator", "HmacSHA512/224", ++ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_224", ++ null); ++ psA("KeyGenerator", "HmacSHA512/256", ++ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_256", ++ null); ++ ++ psA("KeyGenerator", "HmacSHA3-224", ++ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_224", ++ null); ++ psA("KeyGenerator", "HmacSHA3-256", ++ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_256", ++ null); ++ psA("KeyGenerator", "HmacSHA3-384", ++ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_384", ++ null); ++ psA("KeyGenerator", "HmacSHA3-512", ++ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_512", ++ null); ++ ++ psA("KeyPairGenerator", "DiffieHellman", ++ "com.sun.crypto.provider.DHKeyPairGenerator", ++ null); ++ } + + /* + * Algorithm parameter generation engines +@@ -447,15 +453,17 @@ public final class SunJCE extends Provider { + "DiffieHellman", "com.sun.crypto.provider.DHParameterGenerator", + null); + +- /* +- * Key Agreement engines +- */ +- attrs.clear(); +- attrs.put("SupportedKeyClasses", "javax.crypto.interfaces.DHPublicKey" + +- "|javax.crypto.interfaces.DHPrivateKey"); +- psA("KeyAgreement", "DiffieHellman", +- "com.sun.crypto.provider.DHKeyAgreement", +- attrs); ++ if (!systemFipsEnabled) { ++ /* ++ * Key Agreement engines ++ */ ++ attrs.clear(); ++ attrs.put("SupportedKeyClasses", "javax.crypto.interfaces.DHPublicKey" + ++ "|javax.crypto.interfaces.DHPrivateKey"); ++ psA("KeyAgreement", "DiffieHellman", ++ "com.sun.crypto.provider.DHKeyAgreement", ++ attrs); ++ } + + /* + * Algorithm Parameter engines +@@ -625,10 +633,10 @@ public final class SunJCE extends Provider { + "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512AndAES_128"); + + ps("SecretKeyFactory", "PBEWithHmacSHA512/224AndAES_128", +- "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_224AndAES_128"); ++ "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_224AndAES_128"); + + ps("SecretKeyFactory", "PBEWithHmacSHA512/256AndAES_128", +- "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_256AndAES_128"); ++ "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_256AndAES_128"); + + ps("SecretKeyFactory", "PBEWithHmacSHA1AndAES_256", + "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA1AndAES_256"); +@@ -651,136 +659,137 @@ public final class SunJCE extends Provider { + ps("SecretKeyFactory", "PBEWithHmacSHA512/256AndAES_256", + "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_256AndAES_256"); + +- // PBKDF2 +- psA("SecretKeyFactory", "PBKDF2WithHmacSHA1", +- "com.sun.crypto.provider.PBKDF2Core$HmacSHA1", +- null); +- ps("SecretKeyFactory", "PBKDF2WithHmacSHA224", +- "com.sun.crypto.provider.PBKDF2Core$HmacSHA224"); +- ps("SecretKeyFactory", "PBKDF2WithHmacSHA256", +- "com.sun.crypto.provider.PBKDF2Core$HmacSHA256"); +- ps("SecretKeyFactory", "PBKDF2WithHmacSHA384", +- "com.sun.crypto.provider.PBKDF2Core$HmacSHA384"); +- ps("SecretKeyFactory", "PBKDF2WithHmacSHA512", +- "com.sun.crypto.provider.PBKDF2Core$HmacSHA512"); +- ps("SecretKeyFactory", "PBKDF2WithHmacSHA512/224", +- "com.sun.crypto.provider.PBKDF2Core$HmacSHA512_224"); +- ps("SecretKeyFactory", "PBKDF2WithHmacSHA512/256", +- "com.sun.crypto.provider.PBKDF2Core$HmacSHA512_256"); +- +- /* +- * MAC +- */ +- attrs.clear(); +- attrs.put("SupportedKeyFormats", "RAW"); +- ps("Mac", "HmacMD5", "com.sun.crypto.provider.HmacMD5", null, attrs); +- psA("Mac", "HmacSHA1", "com.sun.crypto.provider.HmacSHA1", +- attrs); +- psA("Mac", "HmacSHA224", +- "com.sun.crypto.provider.HmacCore$HmacSHA224", attrs); +- psA("Mac", "HmacSHA256", +- "com.sun.crypto.provider.HmacCore$HmacSHA256", attrs); +- psA("Mac", "HmacSHA384", +- "com.sun.crypto.provider.HmacCore$HmacSHA384", attrs); +- psA("Mac", "HmacSHA512", +- "com.sun.crypto.provider.HmacCore$HmacSHA512", attrs); +- psA("Mac", "HmacSHA512/224", +- "com.sun.crypto.provider.HmacCore$HmacSHA512_224", attrs); +- psA("Mac", "HmacSHA512/256", +- "com.sun.crypto.provider.HmacCore$HmacSHA512_256", attrs); +- psA("Mac", "HmacSHA3-224", +- "com.sun.crypto.provider.HmacCore$HmacSHA3_224", attrs); +- psA("Mac", "HmacSHA3-256", +- "com.sun.crypto.provider.HmacCore$HmacSHA3_256", attrs); +- psA("Mac", "HmacSHA3-384", +- "com.sun.crypto.provider.HmacCore$HmacSHA3_384", attrs); +- psA("Mac", "HmacSHA3-512", +- "com.sun.crypto.provider.HmacCore$HmacSHA3_512", attrs); +- +- ps("Mac", "HmacPBESHA1", +- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA1", +- null, attrs); +- ps("Mac", "HmacPBESHA224", +- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA224", +- null, attrs); +- ps("Mac", "HmacPBESHA256", +- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA256", +- null, attrs); +- ps("Mac", "HmacPBESHA384", +- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA384", +- null, attrs); +- ps("Mac", "HmacPBESHA512", +- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512", +- null, attrs); +- ps("Mac", "HmacPBESHA512/224", +- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512_224", +- null, attrs); +- ps("Mac", "HmacPBESHA512/256", +- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512_256", +- null, attrs); +- +- +- // PBMAC1 +- ps("Mac", "PBEWithHmacSHA1", +- "com.sun.crypto.provider.PBMAC1Core$HmacSHA1", null, attrs); +- ps("Mac", "PBEWithHmacSHA224", +- "com.sun.crypto.provider.PBMAC1Core$HmacSHA224", null, attrs); +- ps("Mac", "PBEWithHmacSHA256", +- "com.sun.crypto.provider.PBMAC1Core$HmacSHA256", null, attrs); +- ps("Mac", "PBEWithHmacSHA384", +- "com.sun.crypto.provider.PBMAC1Core$HmacSHA384", null, attrs); +- ps("Mac", "PBEWithHmacSHA512", +- "com.sun.crypto.provider.PBMAC1Core$HmacSHA512", null, attrs); +- ps("Mac", "PBEWithHmacSHA512/224", +- "com.sun.crypto.provider.PBMAC1Core$HmacSHA512_224", null, attrs); +- ps("Mac", "PBEWithHmacSHA512/256", +- "com.sun.crypto.provider.PBMAC1Core$HmacSHA512_256", null, attrs); +- +- ps("Mac", "SslMacMD5", +- "com.sun.crypto.provider.SslMacCore$SslMacMD5", null, attrs); +- ps("Mac", "SslMacSHA1", +- "com.sun.crypto.provider.SslMacCore$SslMacSHA1", null, attrs); +- +- /* +- * KeyStore +- */ +- ps("KeyStore", "JCEKS", +- "com.sun.crypto.provider.JceKeyStore"); +- +- /* +- * KEMs +- */ +- attrs.clear(); +- attrs.put("ImplementedIn", "Software"); +- attrs.put("SupportedKeyClasses", "java.security.interfaces.ECKey" + +- "|java.security.interfaces.XECKey"); +- ps("KEM", "DHKEM", "com.sun.crypto.provider.DHKEM", null, attrs); +- +- /* +- * SSL/TLS mechanisms +- * +- * These are strictly internal implementations and may +- * be changed at any time. These names were chosen +- * because PKCS11/SunPKCS11 does not yet have TLS1.2 +- * mechanisms, and it will cause calls to come here. +- */ +- ps("KeyGenerator", "SunTlsPrf", +- "com.sun.crypto.provider.TlsPrfGenerator$V10"); +- ps("KeyGenerator", "SunTls12Prf", +- "com.sun.crypto.provider.TlsPrfGenerator$V12"); +- +- ps("KeyGenerator", "SunTlsMasterSecret", +- "com.sun.crypto.provider.TlsMasterSecretGenerator", +- List.of("SunTls12MasterSecret", "SunTlsExtendedMasterSecret"), +- null); +- +- ps("KeyGenerator", "SunTlsKeyMaterial", +- "com.sun.crypto.provider.TlsKeyMaterialGenerator", +- List.of("SunTls12KeyMaterial"), null); +- +- ps("KeyGenerator", "SunTlsRsaPremasterSecret", +- "com.sun.crypto.provider.TlsRsaPremasterSecretGenerator", +- List.of("SunTls12RsaPremasterSecret"), null); ++ if (!systemFipsEnabled) { ++ // PBKDF2 ++ psA("SecretKeyFactory", "PBKDF2WithHmacSHA1", ++ "com.sun.crypto.provider.PBKDF2Core$HmacSHA1", ++ null); ++ ps("SecretKeyFactory", "PBKDF2WithHmacSHA224", ++ "com.sun.crypto.provider.PBKDF2Core$HmacSHA224"); ++ ps("SecretKeyFactory", "PBKDF2WithHmacSHA256", ++ "com.sun.crypto.provider.PBKDF2Core$HmacSHA256"); ++ ps("SecretKeyFactory", "PBKDF2WithHmacSHA384", ++ "com.sun.crypto.provider.PBKDF2Core$HmacSHA384"); ++ ps("SecretKeyFactory", "PBKDF2WithHmacSHA512", ++ "com.sun.crypto.provider.PBKDF2Core$HmacSHA512"); ++ ps("SecretKeyFactory", "PBKDF2WithHmacSHA512/224", ++ "com.sun.crypto.provider.PBKDF2Core$HmacSHA512_224"); ++ ps("SecretKeyFactory", "PBKDF2WithHmacSHA512/256", ++ "com.sun.crypto.provider.PBKDF2Core$HmacSHA512_256"); ++ ++ /* ++ * MAC ++ */ ++ attrs.clear(); ++ attrs.put("SupportedKeyFormats", "RAW"); ++ ps("Mac", "HmacMD5", "com.sun.crypto.provider.HmacMD5", null, attrs); ++ psA("Mac", "HmacSHA1", "com.sun.crypto.provider.HmacSHA1", ++ attrs); ++ psA("Mac", "HmacSHA224", ++ "com.sun.crypto.provider.HmacCore$HmacSHA224", attrs); ++ psA("Mac", "HmacSHA256", ++ "com.sun.crypto.provider.HmacCore$HmacSHA256", attrs); ++ psA("Mac", "HmacSHA384", ++ "com.sun.crypto.provider.HmacCore$HmacSHA384", attrs); ++ psA("Mac", "HmacSHA512", ++ "com.sun.crypto.provider.HmacCore$HmacSHA512", attrs); ++ psA("Mac", "HmacSHA512/224", ++ "com.sun.crypto.provider.HmacCore$HmacSHA512_224", attrs); ++ psA("Mac", "HmacSHA512/256", ++ "com.sun.crypto.provider.HmacCore$HmacSHA512_256", attrs); ++ psA("Mac", "HmacSHA3-224", ++ "com.sun.crypto.provider.HmacCore$HmacSHA3_224", attrs); ++ psA("Mac", "HmacSHA3-256", ++ "com.sun.crypto.provider.HmacCore$HmacSHA3_256", attrs); ++ psA("Mac", "HmacSHA3-384", ++ "com.sun.crypto.provider.HmacCore$HmacSHA3_384", attrs); ++ psA("Mac", "HmacSHA3-512", ++ "com.sun.crypto.provider.HmacCore$HmacSHA3_512", attrs); ++ ++ ps("Mac", "HmacPBESHA1", ++ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA1", ++ null, attrs); ++ ps("Mac", "HmacPBESHA224", ++ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA224", ++ null, attrs); ++ ps("Mac", "HmacPBESHA256", ++ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA256", ++ null, attrs); ++ ps("Mac", "HmacPBESHA384", ++ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA384", ++ null, attrs); ++ ps("Mac", "HmacPBESHA512", ++ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512", ++ null, attrs); ++ ps("Mac", "HmacPBESHA512/224", ++ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512_224", ++ null, attrs); ++ ps("Mac", "HmacPBESHA512/256", ++ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512_256", ++ null, attrs); ++ ++ // PBMAC1 ++ ps("Mac", "PBEWithHmacSHA1", ++ "com.sun.crypto.provider.PBMAC1Core$HmacSHA1", null, attrs); ++ ps("Mac", "PBEWithHmacSHA224", ++ "com.sun.crypto.provider.PBMAC1Core$HmacSHA224", null, attrs); ++ ps("Mac", "PBEWithHmacSHA256", ++ "com.sun.crypto.provider.PBMAC1Core$HmacSHA256", null, attrs); ++ ps("Mac", "PBEWithHmacSHA384", ++ "com.sun.crypto.provider.PBMAC1Core$HmacSHA384", null, attrs); ++ ps("Mac", "PBEWithHmacSHA512", ++ "com.sun.crypto.provider.PBMAC1Core$HmacSHA512", null, attrs); ++ ps("Mac", "PBEWithHmacSHA512/224", ++ "com.sun.crypto.provider.PBMAC1Core$HmacSHA512_224", null, attrs); ++ ps("Mac", "PBEWithHmacSHA512/256", ++ "com.sun.crypto.provider.PBMAC1Core$HmacSHA512_256", null, attrs); ++ ++ ps("Mac", "SslMacMD5", ++ "com.sun.crypto.provider.SslMacCore$SslMacMD5", null, attrs); ++ ps("Mac", "SslMacSHA1", ++ "com.sun.crypto.provider.SslMacCore$SslMacSHA1", null, attrs); ++ ++ /* ++ * KeyStore ++ */ ++ ps("KeyStore", "JCEKS", ++ "com.sun.crypto.provider.JceKeyStore"); ++ ++ /* ++ * KEMs ++ */ ++ attrs.clear(); ++ attrs.put("ImplementedIn", "Software"); ++ attrs.put("SupportedKeyClasses", "java.security.interfaces.ECKey" + ++ "|java.security.interfaces.XECKey"); ++ ps("KEM", "DHKEM", "com.sun.crypto.provider.DHKEM", null, attrs); ++ ++ /* ++ * SSL/TLS mechanisms ++ * ++ * These are strictly internal implementations and may ++ * be changed at any time. These names were chosen ++ * because PKCS11/SunPKCS11 does not yet have TLS1.2 ++ * mechanisms, and it will cause calls to come here. ++ */ ++ ps("KeyGenerator", "SunTlsPrf", ++ "com.sun.crypto.provider.TlsPrfGenerator$V10"); ++ ps("KeyGenerator", "SunTls12Prf", ++ "com.sun.crypto.provider.TlsPrfGenerator$V12"); ++ ++ ps("KeyGenerator", "SunTlsMasterSecret", ++ "com.sun.crypto.provider.TlsMasterSecretGenerator", ++ List.of("SunTls12MasterSecret", "SunTlsExtendedMasterSecret"), ++ null); ++ ++ ps("KeyGenerator", "SunTlsKeyMaterial", ++ "com.sun.crypto.provider.TlsKeyMaterialGenerator", ++ List.of("SunTls12KeyMaterial"), null); ++ ++ ps("KeyGenerator", "SunTlsRsaPremasterSecret", ++ "com.sun.crypto.provider.TlsRsaPremasterSecretGenerator", ++ List.of("SunTls12RsaPremasterSecret"), null); ++ } + } + + // Return the instance of this class or create one if needed. +diff --git a/src/java.base/share/classes/java/security/Security.java b/src/java.base/share/classes/java/security/Security.java +index 671529f71a1..af632936921 100644 +--- a/src/java.base/share/classes/java/security/Security.java ++++ b/src/java.base/share/classes/java/security/Security.java +@@ -34,6 +34,7 @@ import java.net.URL; + import jdk.internal.access.JavaSecurityPropertiesAccess; + import jdk.internal.event.EventHelper; + import jdk.internal.event.SecurityPropertyModificationEvent; ++import jdk.internal.access.JavaSecuritySystemConfiguratorAccess; + import jdk.internal.access.SharedSecrets; + import jdk.internal.util.StaticProperty; + import sun.security.util.Debug; +@@ -58,6 +59,11 @@ import sun.security.jca.*; + + public final class Security { + ++ private static final String SYS_PROP_SWITCH = ++ "java.security.disableSystemPropertiesFile"; ++ private static final String SEC_PROP_SWITCH = ++ "security.useSystemPropertiesFile"; ++ + /* Are we debugging? -- for developers */ + private static final Debug sdebug = + Debug.getInstance("properties"); +@@ -75,6 +81,19 @@ public final class Security { + } + + static { ++ // Initialise here as used by code with system properties disabled ++ SharedSecrets.setJavaSecuritySystemConfiguratorAccess( ++ new JavaSecuritySystemConfiguratorAccess() { ++ @Override ++ public boolean isSystemFipsEnabled() { ++ return SystemConfigurator.isSystemFipsEnabled(); ++ } ++ @Override ++ public boolean isPlainKeySupportEnabled() { ++ return SystemConfigurator.isPlainKeySupportEnabled(); ++ } ++ }); ++ + // doPrivileged here because there are multiple + // things in initialize that might require privs. + // (the FileInputStream call and the File.exists call, +@@ -96,6 +115,7 @@ public final class Security { + private static void initialize() { + props = new Properties(); + boolean overrideAll = false; ++ boolean systemSecPropsEnabled = false; + + // first load the system properties file + // to determine the value of security.overridePropertiesFile +@@ -116,6 +136,61 @@ public final class Security { + } + loadProps(null, extraPropFile, overrideAll); + } ++ ++ boolean sysUseProps = Boolean.valueOf(System.getProperty(SYS_PROP_SWITCH, "false")); ++ boolean secUseProps = Boolean.valueOf(props.getProperty(SEC_PROP_SWITCH)); ++ if (sdebug != null) { ++ sdebug.println(SYS_PROP_SWITCH + "=" + sysUseProps); ++ sdebug.println(SEC_PROP_SWITCH + "=" + secUseProps); ++ } ++ if (!sysUseProps && secUseProps) { ++ systemSecPropsEnabled = SystemConfigurator.configureSysProps(props); ++ if (!systemSecPropsEnabled) { ++ if (sdebug != null) { ++ sdebug.println("WARNING: System security properties could not be loaded."); ++ } ++ } ++ } else { ++ if (sdebug != null) { ++ sdebug.println("System security property support disabled by user."); ++ } ++ } ++ ++ if (systemSecPropsEnabled) { ++ boolean shouldEnable; ++ String sysProp = System.getProperty("com.redhat.fips"); ++ if (sysProp == null) { ++ shouldEnable = true; ++ if (sdebug != null) { ++ sdebug.println("com.redhat.fips unset, using default value of true"); ++ } ++ } else { ++ shouldEnable = Boolean.valueOf(sysProp); ++ if (sdebug != null) { ++ sdebug.println("com.redhat.fips set, using its value " + shouldEnable); ++ } ++ } ++ if (shouldEnable) { ++ boolean fipsEnabled = SystemConfigurator.configureFIPS(props); ++ if (sdebug != null) { ++ if (fipsEnabled) { ++ sdebug.println("FIPS mode support configured and enabled."); ++ } else { ++ sdebug.println("FIPS mode support disabled."); ++ } ++ } ++ } else { ++ if (sdebug != null ) { ++ sdebug.println("FIPS mode support disabled by user."); ++ } ++ } ++ } else { ++ if (sdebug != null) { ++ sdebug.println("WARNING: FIPS mode support can not be enabled without " + ++ "system security properties being enabled."); ++ } ++ } ++ + initialSecurityProperties = (Properties) props.clone(); + if (sdebug != null) { + for (String key : props.stringPropertyNames()) { +@@ -126,7 +201,7 @@ public final class Security { + + } + +- private static boolean loadProps(File masterFile, String extraPropFile, boolean overrideAll) { ++ static boolean loadProps(File masterFile, String extraPropFile, boolean overrideAll) { + InputStream is = null; + try { + if (masterFile != null && masterFile.exists()) { +diff --git a/src/java.base/share/classes/java/security/SystemConfigurator.java b/src/java.base/share/classes/java/security/SystemConfigurator.java +new file mode 100644 +index 00000000000..9d26a54f5d4 +--- /dev/null ++++ b/src/java.base/share/classes/java/security/SystemConfigurator.java +@@ -0,0 +1,232 @@ ++/* ++ * Copyright (c) 2019, 2021, Red Hat, Inc. ++ * ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. Oracle designates this ++ * particular file as subject to the "Classpath" exception as provided ++ * by Oracle in the LICENSE file that accompanied this code. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++package java.security; ++ ++import java.io.BufferedInputStream; ++import java.io.FileInputStream; ++import java.io.IOException; ++ ++import java.util.Iterator; ++import java.util.Map.Entry; ++import java.util.Properties; ++ ++import sun.security.util.Debug; ++ ++/** ++ * Internal class to align OpenJDK with global crypto-policies. ++ * Called from java.security.Security class initialization, ++ * during startup. ++ * ++ */ ++ ++final class SystemConfigurator { ++ ++ private static final Debug sdebug = ++ Debug.getInstance("properties"); ++ ++ private static final String CRYPTO_POLICIES_BASE_DIR = ++ "/etc/crypto-policies"; ++ ++ private static final String CRYPTO_POLICIES_JAVA_CONFIG = ++ CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config"; ++ ++ private static boolean systemFipsEnabled = false; ++ private static boolean plainKeySupportEnabled = false; ++ ++ private static final String SYSTEMCONF_NATIVE_LIB = "systemconf"; ++ ++ private static native boolean getSystemFIPSEnabled() ++ throws IOException; ++ ++ static { ++ @SuppressWarnings("removal") ++ var dummy = AccessController.doPrivileged(new PrivilegedAction() { ++ public Void run() { ++ System.loadLibrary(SYSTEMCONF_NATIVE_LIB); ++ return null; ++ } ++ }); ++ } ++ ++ /* ++ * Invoked when java.security.Security class is initialized, if ++ * java.security.disableSystemPropertiesFile property is not set and ++ * security.useSystemPropertiesFile is true. ++ */ ++ static boolean configureSysProps(Properties props) { ++ // now load the system file, if it exists, so its values ++ // will win if they conflict with the earlier values ++ return Security.loadProps(null, CRYPTO_POLICIES_JAVA_CONFIG, false); ++ } ++ ++ /* ++ * Invoked at the end of java.security.Security initialisation ++ * if java.security properties have been loaded ++ */ ++ static boolean configureFIPS(Properties props) { ++ boolean loadedProps = false; ++ ++ try { ++ if (enableFips()) { ++ if (sdebug != null) { sdebug.println("FIPS mode detected"); } ++ // Remove all security providers ++ Iterator> i = props.entrySet().iterator(); ++ while (i.hasNext()) { ++ Entry e = i.next(); ++ if (((String) e.getKey()).startsWith("security.provider")) { ++ if (sdebug != null) { sdebug.println("Removing provider: " + e); } ++ i.remove(); ++ } ++ } ++ // Add FIPS security providers ++ String fipsProviderValue = null; ++ for (int n = 1; ++ (fipsProviderValue = (String) props.get("fips.provider." + n)) != null; n++) { ++ String fipsProviderKey = "security.provider." + n; ++ if (sdebug != null) { ++ sdebug.println("Adding provider " + n + ": " + ++ fipsProviderKey + "=" + fipsProviderValue); ++ } ++ props.put(fipsProviderKey, fipsProviderValue); ++ } ++ // Add other security properties ++ String keystoreTypeValue = (String) props.get("fips.keystore.type"); ++ if (keystoreTypeValue != null) { ++ String nonFipsKeystoreType = props.getProperty("keystore.type"); ++ props.put("keystore.type", keystoreTypeValue); ++ if (keystoreTypeValue.equals("PKCS11")) { ++ // If keystore.type is PKCS11, javax.net.ssl.keyStore ++ // must be "NONE". See JDK-8238264. ++ System.setProperty("javax.net.ssl.keyStore", "NONE"); ++ } ++ if (System.getProperty("javax.net.ssl.trustStoreType") == null) { ++ // If no trustStoreType has been set, use the ++ // previous keystore.type under FIPS mode. In ++ // a default configuration, the Trust Store will ++ // be 'cacerts' (JKS type). ++ System.setProperty("javax.net.ssl.trustStoreType", ++ nonFipsKeystoreType); ++ } ++ if (sdebug != null) { ++ sdebug.println("FIPS mode default keystore.type = " + ++ keystoreTypeValue); ++ sdebug.println("FIPS mode javax.net.ssl.keyStore = " + ++ System.getProperty("javax.net.ssl.keyStore", "")); ++ sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " + ++ System.getProperty("javax.net.ssl.trustStoreType", "")); ++ } ++ } ++ loadedProps = true; ++ systemFipsEnabled = true; ++ String plainKeySupport = System.getProperty("com.redhat.fips.plainKeySupport", ++ "true"); ++ plainKeySupportEnabled = !"false".equals(plainKeySupport); ++ if (sdebug != null) { ++ if (plainKeySupportEnabled) { ++ sdebug.println("FIPS support enabled with plain key support"); ++ } else { ++ sdebug.println("FIPS support enabled without plain key support"); ++ } ++ } ++ } else { ++ if (sdebug != null) { sdebug.println("FIPS mode not detected"); } ++ } ++ } catch (Exception e) { ++ if (sdebug != null) { ++ sdebug.println("unable to load FIPS configuration"); ++ e.printStackTrace(); ++ } ++ } ++ return loadedProps; ++ } ++ ++ /** ++ * Returns whether or not global system FIPS alignment is enabled. ++ * ++ * Value is always 'false' before java.security.Security class is ++ * initialized. ++ * ++ * Call from out of this package through SharedSecrets: ++ * SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ * .isSystemFipsEnabled(); ++ * ++ * @return a boolean value indicating whether or not global ++ * system FIPS alignment is enabled. ++ */ ++ static boolean isSystemFipsEnabled() { ++ return systemFipsEnabled; ++ } ++ ++ /** ++ * Returns {@code true} if system FIPS alignment is enabled ++ * and plain key support is allowed. Plain key support is ++ * enabled by default but can be disabled with ++ * {@code -Dcom.redhat.fips.plainKeySupport=false}. ++ * ++ * @return a boolean indicating whether plain key support ++ * should be enabled. ++ */ ++ static boolean isPlainKeySupportEnabled() { ++ return plainKeySupportEnabled; ++ } ++ ++ /** ++ * Determines whether FIPS mode should be enabled. ++ * ++ * OpenJDK FIPS mode will be enabled only if the system is in ++ * FIPS mode. ++ * ++ * Calls to this method only occur if the system property ++ * com.redhat.fips is not set to false. ++ * ++ * There are 2 possible ways in which OpenJDK detects that the system ++ * is in FIPS mode: 1) if the NSS SECMOD_GetSystemFIPSEnabled API is ++ * available at OpenJDK's built-time, it is called; 2) otherwise, the ++ * /proc/sys/crypto/fips_enabled file is read. ++ * ++ * @return true if the system is in FIPS mode ++ */ ++ private static boolean enableFips() throws Exception { ++ if (sdebug != null) { ++ sdebug.println("Calling getSystemFIPSEnabled (libsystemconf)..."); ++ } ++ try { ++ boolean fipsEnabled = getSystemFIPSEnabled(); ++ if (sdebug != null) { ++ sdebug.println("Call to getSystemFIPSEnabled (libsystemconf) returned: " ++ + fipsEnabled); ++ } ++ return fipsEnabled; ++ } catch (IOException e) { ++ if (sdebug != null) { ++ sdebug.println("Call to getSystemFIPSEnabled (libsystemconf) failed:"); ++ sdebug.println(e.getMessage()); ++ } ++ throw e; ++ } ++ } ++} +diff --git a/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java b/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java +new file mode 100644 +index 00000000000..3f3caac64dc +--- /dev/null ++++ b/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java +@@ -0,0 +1,31 @@ ++/* ++ * Copyright (c) 2020, Red Hat, Inc. ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. Oracle designates this ++ * particular file as subject to the "Classpath" exception as provided ++ * by Oracle in the LICENSE file that accompanied this code. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++package jdk.internal.access; ++ ++public interface JavaSecuritySystemConfiguratorAccess { ++ boolean isSystemFipsEnabled(); ++ boolean isPlainKeySupportEnabled(); ++} +diff --git a/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java b/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java +index 919d758a6e3..b1e5fbaf84a 100644 +--- a/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java ++++ b/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java +@@ -43,6 +43,7 @@ import java.io.PrintStream; + import java.io.PrintWriter; + import java.io.RandomAccessFile; + import java.security.ProtectionDomain; ++import java.security.Security; + import java.security.Signature; + + /** A repository of "shared secrets", which are a mechanism for +@@ -90,6 +91,7 @@ public class SharedSecrets { + private static JavaxCryptoSealedObjectAccess javaxCryptoSealedObjectAccess; + private static JavaxCryptoSpecAccess javaxCryptoSpecAccess; + private static JavaTemplateAccess javaTemplateAccess; ++ private static JavaSecuritySystemConfiguratorAccess javaSecuritySystemConfiguratorAccess; + + public static void setJavaUtilCollectionAccess(JavaUtilCollectionAccess juca) { + javaUtilCollectionAccess = juca; +@@ -537,4 +539,15 @@ public class SharedSecrets { + MethodHandles.lookup().ensureInitialized(c); + } catch (IllegalAccessException e) {} + } ++ ++ public static void setJavaSecuritySystemConfiguratorAccess(JavaSecuritySystemConfiguratorAccess jssca) { ++ javaSecuritySystemConfiguratorAccess = jssca; ++ } ++ ++ public static JavaSecuritySystemConfiguratorAccess getJavaSecuritySystemConfiguratorAccess() { ++ if (javaSecuritySystemConfiguratorAccess == null) { ++ ensureClassInitialized(Security.class); ++ } ++ return javaSecuritySystemConfiguratorAccess; ++ } + } +diff --git a/src/java.base/share/classes/module-info.java b/src/java.base/share/classes/module-info.java +index 06b141dcf22..e8cbf7f15d7 100644 +--- a/src/java.base/share/classes/module-info.java ++++ b/src/java.base/share/classes/module-info.java +@@ -158,6 +158,7 @@ module java.base { + java.naming, + java.rmi, + jdk.charsets, ++ jdk.crypto.ec, + jdk.jartool, + jdk.jlink, + jdk.jfr, +diff --git a/src/java.base/share/classes/sun/security/provider/SunEntries.java b/src/java.base/share/classes/sun/security/provider/SunEntries.java +index f036a411f1d..1e9de933bd9 100644 +--- a/src/java.base/share/classes/sun/security/provider/SunEntries.java ++++ b/src/java.base/share/classes/sun/security/provider/SunEntries.java +@@ -38,6 +38,7 @@ import java.util.HashMap; + import java.util.Iterator; + import java.util.LinkedHashSet; + ++import jdk.internal.access.SharedSecrets; + import jdk.internal.util.StaticProperty; + import sun.security.action.GetBooleanAction; + +@@ -91,6 +92,10 @@ import static sun.security.util.SecurityProviderConstants.getAliases; + + public final class SunEntries { + ++ private static final boolean systemFipsEnabled = ++ SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ .isSystemFipsEnabled(); ++ + // the default algo used by SecureRandom class for new SecureRandom() calls + public static final String DEF_SECURE_RANDOM_ALGO; + +@@ -102,89 +107,92 @@ public final class SunEntries { + // common attribute map + HashMap attrs = new HashMap<>(3); + +- /* +- * SecureRandom engines +- */ +- attrs.put("ThreadSafe", "true"); +- if (NativePRNG.isAvailable()) { +- add(p, "SecureRandom", "NativePRNG", +- "sun.security.provider.NativePRNG", attrs); +- } +- if (NativePRNG.Blocking.isAvailable()) { +- add(p, "SecureRandom", "NativePRNGBlocking", +- "sun.security.provider.NativePRNG$Blocking", attrs); +- } +- if (NativePRNG.NonBlocking.isAvailable()) { +- add(p, "SecureRandom", "NativePRNGNonBlocking", +- "sun.security.provider.NativePRNG$NonBlocking", attrs); +- } +- attrs.put("ImplementedIn", "Software"); +- add(p, "SecureRandom", "DRBG", "sun.security.provider.DRBG", attrs); +- add(p, "SecureRandom", "SHA1PRNG", +- "sun.security.provider.SecureRandom", attrs); +- +- /* +- * Signature engines +- */ +- attrs.clear(); +- String dsaKeyClasses = "java.security.interfaces.DSAPublicKey" + +- "|java.security.interfaces.DSAPrivateKey"; +- attrs.put("SupportedKeyClasses", dsaKeyClasses); +- attrs.put("ImplementedIn", "Software"); +- +- attrs.put("KeySize", "1024"); // for NONE and SHA1 DSA signatures +- +- addWithAlias(p, "Signature", "SHA1withDSA", +- "sun.security.provider.DSA$SHA1withDSA", attrs); +- addWithAlias(p, "Signature", "NONEwithDSA", +- "sun.security.provider.DSA$RawDSA", attrs); +- +- // for DSA signatures with 224/256-bit digests +- attrs.put("KeySize", "2048"); +- +- addWithAlias(p, "Signature", "SHA224withDSA", +- "sun.security.provider.DSA$SHA224withDSA", attrs); +- addWithAlias(p, "Signature", "SHA256withDSA", +- "sun.security.provider.DSA$SHA256withDSA", attrs); +- +- addWithAlias(p, "Signature", "SHA3-224withDSA", +- "sun.security.provider.DSA$SHA3_224withDSA", attrs); +- addWithAlias(p, "Signature", "SHA3-256withDSA", +- "sun.security.provider.DSA$SHA3_256withDSA", attrs); +- +- attrs.put("KeySize", "3072"); // for DSA sig using 384/512-bit digests +- +- addWithAlias(p, "Signature", "SHA384withDSA", +- "sun.security.provider.DSA$SHA384withDSA", attrs); +- addWithAlias(p, "Signature", "SHA512withDSA", +- "sun.security.provider.DSA$SHA512withDSA", attrs); +- addWithAlias(p, "Signature", "SHA3-384withDSA", +- "sun.security.provider.DSA$SHA3_384withDSA", attrs); +- addWithAlias(p, "Signature", "SHA3-512withDSA", +- "sun.security.provider.DSA$SHA3_512withDSA", attrs); ++ if (!systemFipsEnabled) { ++ /* ++ * SecureRandom engines ++ */ ++ attrs.put("ThreadSafe", "true"); ++ if (NativePRNG.isAvailable()) { ++ add(p, "SecureRandom", "NativePRNG", ++ "sun.security.provider.NativePRNG", attrs); ++ } ++ if (NativePRNG.Blocking.isAvailable()) { ++ add(p, "SecureRandom", "NativePRNGBlocking", ++ "sun.security.provider.NativePRNG$Blocking", attrs); ++ } ++ if (NativePRNG.NonBlocking.isAvailable()) { ++ add(p, "SecureRandom", "NativePRNGNonBlocking", ++ "sun.security.provider.NativePRNG$NonBlocking", attrs); ++ } ++ attrs.put("ImplementedIn", "Software"); ++ add(p, "SecureRandom", "DRBG", "sun.security.provider.DRBG", attrs); ++ add(p, "SecureRandom", "SHA1PRNG", ++ "sun.security.provider.SecureRandom", attrs); + +- attrs.remove("KeySize"); ++ /* ++ * Signature engines ++ */ ++ attrs.clear(); ++ String dsaKeyClasses = "java.security.interfaces.DSAPublicKey" + ++ "|java.security.interfaces.DSAPrivateKey"; ++ attrs.put("SupportedKeyClasses", dsaKeyClasses); ++ attrs.put("ImplementedIn", "Software"); ++ ++ attrs.put("KeySize", "1024"); // for NONE and SHA1 DSA signatures ++ ++ addWithAlias(p, "Signature", "SHA1withDSA", ++ "sun.security.provider.DSA$SHA1withDSA", attrs); ++ addWithAlias(p, "Signature", "NONEwithDSA", ++ "sun.security.provider.DSA$RawDSA", attrs); ++ ++ // for DSA signatures with 224/256-bit digests ++ attrs.put("KeySize", "2048"); ++ ++ addWithAlias(p, "Signature", "SHA224withDSA", ++ "sun.security.provider.DSA$SHA224withDSA", attrs); ++ addWithAlias(p, "Signature", "SHA256withDSA", ++ "sun.security.provider.DSA$SHA256withDSA", attrs); ++ ++ addWithAlias(p, "Signature", "SHA3-224withDSA", ++ "sun.security.provider.DSA$SHA3_224withDSA", attrs); ++ addWithAlias(p, "Signature", "SHA3-256withDSA", ++ "sun.security.provider.DSA$SHA3_256withDSA", attrs); ++ ++ attrs.put("KeySize", "3072"); // for DSA sig using 384/512-bit digests ++ ++ addWithAlias(p, "Signature", "SHA384withDSA", ++ "sun.security.provider.DSA$SHA384withDSA", attrs); ++ addWithAlias(p, "Signature", "SHA512withDSA", ++ "sun.security.provider.DSA$SHA512withDSA", attrs); ++ addWithAlias(p, "Signature", "SHA3-384withDSA", ++ "sun.security.provider.DSA$SHA3_384withDSA", attrs); ++ addWithAlias(p, "Signature", "SHA3-512withDSA", ++ "sun.security.provider.DSA$SHA3_512withDSA", attrs); ++ ++ attrs.remove("KeySize"); ++ ++ add(p, "Signature", "SHA1withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA1withDSAinP1363Format"); ++ add(p, "Signature", "NONEwithDSAinP1363Format", ++ "sun.security.provider.DSA$RawDSAinP1363Format"); ++ add(p, "Signature", "SHA224withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA224withDSAinP1363Format"); ++ add(p, "Signature", "SHA256withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA256withDSAinP1363Format"); ++ add(p, "Signature", "SHA384withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA384withDSAinP1363Format"); ++ add(p, "Signature", "SHA512withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA512withDSAinP1363Format"); ++ add(p, "Signature", "SHA3-224withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA3_224withDSAinP1363Format"); ++ add(p, "Signature", "SHA3-256withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA3_256withDSAinP1363Format"); ++ add(p, "Signature", "SHA3-384withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA3_384withDSAinP1363Format"); ++ add(p, "Signature", "SHA3-512withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA3_512withDSAinP1363Format"); + +- add(p, "Signature", "SHA1withDSAinP1363Format", +- "sun.security.provider.DSA$SHA1withDSAinP1363Format"); +- add(p, "Signature", "NONEwithDSAinP1363Format", +- "sun.security.provider.DSA$RawDSAinP1363Format"); +- add(p, "Signature", "SHA224withDSAinP1363Format", +- "sun.security.provider.DSA$SHA224withDSAinP1363Format"); +- add(p, "Signature", "SHA256withDSAinP1363Format", +- "sun.security.provider.DSA$SHA256withDSAinP1363Format"); +- add(p, "Signature", "SHA384withDSAinP1363Format", +- "sun.security.provider.DSA$SHA384withDSAinP1363Format"); +- add(p, "Signature", "SHA512withDSAinP1363Format", +- "sun.security.provider.DSA$SHA512withDSAinP1363Format"); +- add(p, "Signature", "SHA3-224withDSAinP1363Format", +- "sun.security.provider.DSA$SHA3_224withDSAinP1363Format"); +- add(p, "Signature", "SHA3-256withDSAinP1363Format", +- "sun.security.provider.DSA$SHA3_256withDSAinP1363Format"); +- add(p, "Signature", "SHA3-384withDSAinP1363Format", +- "sun.security.provider.DSA$SHA3_384withDSAinP1363Format"); +- add(p, "Signature", "SHA3-512withDSAinP1363Format", +- "sun.security.provider.DSA$SHA3_512withDSAinP1363Format"); ++ } + + attrs.clear(); + attrs.put("ImplementedIn", "Software"); +@@ -196,9 +204,11 @@ public final class SunEntries { + attrs.put("ImplementedIn", "Software"); + attrs.put("KeySize", "2048"); // for DSA KPG and APG only + +- String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$"; +- dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current"); +- addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs); ++ if (!systemFipsEnabled) { ++ String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$"; ++ dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current"); ++ addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs); ++ } + + /* + * Algorithm Parameter Generator engines +@@ -213,44 +223,46 @@ public final class SunEntries { + addWithAlias(p, "AlgorithmParameters", "DSA", + "sun.security.provider.DSAParameters", attrs); + +- /* +- * Key factories +- */ +- addWithAlias(p, "KeyFactory", "DSA", +- "sun.security.provider.DSAKeyFactory", attrs); +- addWithAlias(p, "KeyFactory", "HSS/LMS", +- "sun.security.provider.HSS$KeyFactoryImpl", attrs); +- +- /* +- * Digest engines +- */ +- addWithAlias(p, "MessageDigest", "MD2", "sun.security.provider.MD2", +- attrs); +- addWithAlias(p, "MessageDigest", "MD5", "sun.security.provider.MD5", +- attrs); +- addWithAlias(p, "MessageDigest", "SHA-1", "sun.security.provider.SHA", +- attrs); ++ if (!systemFipsEnabled) { ++ /* ++ * Key factories ++ */ ++ addWithAlias(p, "KeyFactory", "DSA", ++ "sun.security.provider.DSAKeyFactory", attrs); ++ addWithAlias(p, "KeyFactory", "HSS/LMS", ++ "sun.security.provider.HSS$KeyFactoryImpl", attrs); + +- addWithAlias(p, "MessageDigest", "SHA-224", +- "sun.security.provider.SHA2$SHA224", attrs); +- addWithAlias(p, "MessageDigest", "SHA-256", +- "sun.security.provider.SHA2$SHA256", attrs); +- addWithAlias(p, "MessageDigest", "SHA-384", +- "sun.security.provider.SHA5$SHA384", attrs); +- addWithAlias(p, "MessageDigest", "SHA-512", +- "sun.security.provider.SHA5$SHA512", attrs); +- addWithAlias(p, "MessageDigest", "SHA-512/224", +- "sun.security.provider.SHA5$SHA512_224", attrs); +- addWithAlias(p, "MessageDigest", "SHA-512/256", +- "sun.security.provider.SHA5$SHA512_256", attrs); +- addWithAlias(p, "MessageDigest", "SHA3-224", +- "sun.security.provider.SHA3$SHA224", attrs); +- addWithAlias(p, "MessageDigest", "SHA3-256", +- "sun.security.provider.SHA3$SHA256", attrs); +- addWithAlias(p, "MessageDigest", "SHA3-384", +- "sun.security.provider.SHA3$SHA384", attrs); +- addWithAlias(p, "MessageDigest", "SHA3-512", +- "sun.security.provider.SHA3$SHA512", attrs); ++ /* ++ * Digest engines ++ */ ++ addWithAlias(p, "MessageDigest", "MD2", "sun.security.provider.MD2", ++ attrs); ++ addWithAlias(p, "MessageDigest", "MD5", "sun.security.provider.MD5", ++ attrs); ++ addWithAlias(p, "MessageDigest", "SHA-1", "sun.security.provider.SHA", ++ attrs); ++ ++ addWithAlias(p, "MessageDigest", "SHA-224", ++ "sun.security.provider.SHA2$SHA224", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-256", ++ "sun.security.provider.SHA2$SHA256", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-384", ++ "sun.security.provider.SHA5$SHA384", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-512", ++ "sun.security.provider.SHA5$SHA512", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-512/224", ++ "sun.security.provider.SHA5$SHA512_224", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-512/256", ++ "sun.security.provider.SHA5$SHA512_256", attrs); ++ addWithAlias(p, "MessageDigest", "SHA3-224", ++ "sun.security.provider.SHA3$SHA224", attrs); ++ addWithAlias(p, "MessageDigest", "SHA3-256", ++ "sun.security.provider.SHA3$SHA256", attrs); ++ addWithAlias(p, "MessageDigest", "SHA3-384", ++ "sun.security.provider.SHA3$SHA384", attrs); ++ addWithAlias(p, "MessageDigest", "SHA3-512", ++ "sun.security.provider.SHA3$SHA512", attrs); ++ } + + /* + * Certificates +diff --git a/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java b/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java +index 539ef1e8ee8..435f57e3ff2 100644 +--- a/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java ++++ b/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java +@@ -27,6 +27,7 @@ package sun.security.rsa; + + import java.util.*; + import java.security.Provider; ++import jdk.internal.access.SharedSecrets; + import static sun.security.util.SecurityProviderConstants.getAliases; + + /** +@@ -36,6 +37,10 @@ import static sun.security.util.SecurityProviderConstants.getAliases; + */ + public final class SunRsaSignEntries { + ++ private static final boolean systemFipsEnabled = ++ SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ .isSystemFipsEnabled(); ++ + private void add(Provider p, String type, String algo, String cn, + List aliases, HashMap attrs) { + services.add(new Provider.Service(p, type, algo, cn, +@@ -63,42 +68,49 @@ public final class SunRsaSignEntries { + add(p, "KeyFactory", "RSA", + "sun.security.rsa.RSAKeyFactory$Legacy", + getAliases("PKCS1"), null); +- add(p, "KeyPairGenerator", "RSA", +- "sun.security.rsa.RSAKeyPairGenerator$Legacy", +- getAliases("PKCS1"), null); +- addA(p, "Signature", "MD2withRSA", +- "sun.security.rsa.RSASignature$MD2withRSA", attrs); +- addA(p, "Signature", "MD5withRSA", +- "sun.security.rsa.RSASignature$MD5withRSA", attrs); +- addA(p, "Signature", "SHA1withRSA", +- "sun.security.rsa.RSASignature$SHA1withRSA", attrs); +- addA(p, "Signature", "SHA224withRSA", +- "sun.security.rsa.RSASignature$SHA224withRSA", attrs); +- addA(p, "Signature", "SHA256withRSA", +- "sun.security.rsa.RSASignature$SHA256withRSA", attrs); +- addA(p, "Signature", "SHA384withRSA", +- "sun.security.rsa.RSASignature$SHA384withRSA", attrs); +- addA(p, "Signature", "SHA512withRSA", +- "sun.security.rsa.RSASignature$SHA512withRSA", attrs); +- addA(p, "Signature", "SHA512/224withRSA", +- "sun.security.rsa.RSASignature$SHA512_224withRSA", attrs); +- addA(p, "Signature", "SHA512/256withRSA", +- "sun.security.rsa.RSASignature$SHA512_256withRSA", attrs); +- addA(p, "Signature", "SHA3-224withRSA", +- "sun.security.rsa.RSASignature$SHA3_224withRSA", attrs); +- addA(p, "Signature", "SHA3-256withRSA", +- "sun.security.rsa.RSASignature$SHA3_256withRSA", attrs); +- addA(p, "Signature", "SHA3-384withRSA", +- "sun.security.rsa.RSASignature$SHA3_384withRSA", attrs); +- addA(p, "Signature", "SHA3-512withRSA", +- "sun.security.rsa.RSASignature$SHA3_512withRSA", attrs); ++ ++ if (!systemFipsEnabled) { ++ add(p, "KeyPairGenerator", "RSA", ++ "sun.security.rsa.RSAKeyPairGenerator$Legacy", ++ getAliases("PKCS1"), null); ++ addA(p, "Signature", "MD2withRSA", ++ "sun.security.rsa.RSASignature$MD2withRSA", attrs); ++ addA(p, "Signature", "MD5withRSA", ++ "sun.security.rsa.RSASignature$MD5withRSA", attrs); ++ addA(p, "Signature", "SHA1withRSA", ++ "sun.security.rsa.RSASignature$SHA1withRSA", attrs); ++ addA(p, "Signature", "SHA224withRSA", ++ "sun.security.rsa.RSASignature$SHA224withRSA", attrs); ++ addA(p, "Signature", "SHA256withRSA", ++ "sun.security.rsa.RSASignature$SHA256withRSA", attrs); ++ addA(p, "Signature", "SHA384withRSA", ++ "sun.security.rsa.RSASignature$SHA384withRSA", attrs); ++ addA(p, "Signature", "SHA512withRSA", ++ "sun.security.rsa.RSASignature$SHA512withRSA", attrs); ++ addA(p, "Signature", "SHA512/224withRSA", ++ "sun.security.rsa.RSASignature$SHA512_224withRSA", attrs); ++ addA(p, "Signature", "SHA512/256withRSA", ++ "sun.security.rsa.RSASignature$SHA512_256withRSA", attrs); ++ addA(p, "Signature", "SHA3-224withRSA", ++ "sun.security.rsa.RSASignature$SHA3_224withRSA", attrs); ++ addA(p, "Signature", "SHA3-256withRSA", ++ "sun.security.rsa.RSASignature$SHA3_256withRSA", attrs); ++ addA(p, "Signature", "SHA3-384withRSA", ++ "sun.security.rsa.RSASignature$SHA3_384withRSA", attrs); ++ addA(p, "Signature", "SHA3-512withRSA", ++ "sun.security.rsa.RSASignature$SHA3_512withRSA", attrs); ++ } + + addA(p, "KeyFactory", "RSASSA-PSS", + "sun.security.rsa.RSAKeyFactory$PSS", attrs); +- addA(p, "KeyPairGenerator", "RSASSA-PSS", +- "sun.security.rsa.RSAKeyPairGenerator$PSS", attrs); +- addA(p, "Signature", "RSASSA-PSS", +- "sun.security.rsa.RSAPSSSignature", attrs); ++ ++ if (!systemFipsEnabled) { ++ addA(p, "KeyPairGenerator", "RSASSA-PSS", ++ "sun.security.rsa.RSAKeyPairGenerator$PSS", attrs); ++ addA(p, "Signature", "RSASSA-PSS", ++ "sun.security.rsa.RSAPSSSignature", attrs); ++ } ++ + addA(p, "AlgorithmParameters", "RSASSA-PSS", + "sun.security.rsa.PSSParameters", null); + } +diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security +index 5149edba0e5..8227d650a03 100644 +--- a/src/java.base/share/conf/security/java.security ++++ b/src/java.base/share/conf/security/java.security +@@ -85,6 +85,17 @@ security.provider.tbd=Apple + #endif + security.provider.tbd=SunPKCS11 + ++# ++# Security providers used when FIPS mode support is active ++# ++fips.provider.1=SunPKCS11 ${java.home}/conf/security/nss.fips.cfg ++fips.provider.2=SUN ++fips.provider.3=SunEC ++fips.provider.4=SunJSSE ++fips.provider.5=SunJCE ++fips.provider.6=SunRsaSign ++fips.provider.7=XMLDSig ++ + # + # A list of preferred providers for specific algorithms. These providers will + # be searched for matching algorithms before the list of registered providers. +@@ -295,6 +306,47 @@ policy.ignoreIdentityScope=false + # + keystore.type=pkcs12 + ++# ++# Default keystore type used when global crypto-policies are set to FIPS. ++# ++fips.keystore.type=pkcs12 ++ ++# ++# Location of the NSS DB keystore (PKCS11) in FIPS mode. ++# ++# The syntax for this property is identical to the 'nssSecmodDirectory' ++# attribute available in the SunPKCS11 NSS configuration file. Use the ++# 'sql:' prefix to refer to an SQLite DB. ++# ++# If the system property fips.nssdb.path is also specified, it supersedes ++# the security property value defined here. ++# ++# Note: the default value for this property points to an NSS DB that might be ++# readable by multiple operating system users and unsuitable to store keys. ++# ++fips.nssdb.path=sql:/etc/pki/nssdb ++ ++# ++# PIN for the NSS DB keystore (PKCS11) in FIPS mode. ++# ++# Values must take any of the following forms: ++# 1) pin: ++# Value: clear text PIN value. ++# 2) env: ++# Value: environment variable containing the PIN value. ++# 3) file: ++# Value: path to a file containing the PIN value in its first ++# line. ++# ++# If the system property fips.nssdb.pin is also specified, it supersedes ++# the security property value defined here. ++# ++# When used as a system property, UTF-8 encoded values are valid. When ++# used as a security property (such as in this file), encode non-Basic ++# Latin Unicode characters with \uXXXX. ++# ++fips.nssdb.pin=pin: ++ + # + # Controls compatibility mode for JKS and PKCS12 keystore types. + # +@@ -332,6 +384,13 @@ package.definition=sun.misc.,\ + # + security.overridePropertiesFile=true + ++# ++# Determines whether this properties file will be appended to ++# using the system properties file stored at ++# /etc/crypto-policies/back-ends/java.config ++# ++security.useSystemPropertiesFile=false ++ + # + # Determines the default key and trust manager factory algorithms for + # the javax.net.ssl package. +diff --git a/src/java.base/share/conf/security/nss.fips.cfg.in b/src/java.base/share/conf/security/nss.fips.cfg.in +new file mode 100644 +index 00000000000..55bbba98b7a +--- /dev/null ++++ b/src/java.base/share/conf/security/nss.fips.cfg.in +@@ -0,0 +1,8 @@ ++name = NSS-FIPS ++nssLibraryDirectory = @NSS_LIBDIR@ ++nssSecmodDirectory = ${fips.nssdb.path} ++nssDbMode = readWrite ++nssModule = fips ++ ++attributes(*,CKO_SECRET_KEY,CKK_GENERIC_SECRET)={ CKA_SIGN=true } ++ +diff --git a/src/java.base/share/lib/security/default.policy b/src/java.base/share/lib/security/default.policy +index 86d45147709..22fd8675503 100644 +--- a/src/java.base/share/lib/security/default.policy ++++ b/src/java.base/share/lib/security/default.policy +@@ -130,6 +130,7 @@ grant codeBase "jrt:/jdk.charsets" { + grant codeBase "jrt:/jdk.crypto.ec" { + permission java.lang.RuntimePermission + "accessClassInPackage.sun.security.*"; ++ permission java.lang.RuntimePermission "accessClassInPackage.jdk.internal.access"; + permission java.lang.RuntimePermission "loadLibrary.sunec"; + permission java.security.SecurityPermission "putProviderProperty.SunEC"; + permission java.security.SecurityPermission "clearProviderProperties.SunEC"; +@@ -150,6 +151,8 @@ grant codeBase "jrt:/jdk.crypto.cryptoki" { + permission java.util.PropertyPermission "os.name", "read"; + permission java.util.PropertyPermission "os.arch", "read"; + permission java.util.PropertyPermission "jdk.crypto.KeyAgreement.legacyKDF", "read"; ++ permission java.util.PropertyPermission "fips.nssdb.path", "read,write"; ++ permission java.util.PropertyPermission "fips.nssdb.pin", "read"; + permission java.security.SecurityPermission "putProviderProperty.*"; + permission java.security.SecurityPermission "clearProviderProperties.*"; + permission java.security.SecurityPermission "removeProviderProperty.*"; +diff --git a/src/java.base/share/native/libsystemconf/systemconf.c b/src/java.base/share/native/libsystemconf/systemconf.c +new file mode 100644 +index 00000000000..ddf9befe5bc +--- /dev/null ++++ b/src/java.base/share/native/libsystemconf/systemconf.c +@@ -0,0 +1,236 @@ ++/* ++ * Copyright (c) 2021, Red Hat, Inc. ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. Oracle designates this ++ * particular file as subject to the "Classpath" exception as provided ++ * by Oracle in the LICENSE file that accompanied this code. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++#include ++#include ++#include "jvm_md.h" ++#include ++ ++#ifdef LINUX ++ ++#ifdef SYSCONF_NSS ++#include ++#else ++#include ++#endif //SYSCONF_NSS ++ ++#include "java_security_SystemConfigurator.h" ++ ++#define MSG_MAX_SIZE 256 ++#define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled" ++ ++typedef int (SECMOD_GET_SYSTEM_FIPS_ENABLED_TYPE)(void); ++ ++static SECMOD_GET_SYSTEM_FIPS_ENABLED_TYPE *getSystemFIPSEnabled; ++static jmethodID debugPrintlnMethodID = NULL; ++static jobject debugObj = NULL; ++ ++static void dbgPrint(JNIEnv *env, const char* msg) ++{ ++ jstring jMsg; ++ if (debugObj != NULL) { ++ jMsg = (*env)->NewStringUTF(env, msg); ++ CHECK_NULL(jMsg); ++ (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg); ++ } ++} ++ ++static void throwIOException(JNIEnv *env, const char *msg) ++{ ++ jclass cls = (*env)->FindClass(env, "java/io/IOException"); ++ if (cls != 0) ++ (*env)->ThrowNew(env, cls, msg); ++} ++ ++static void handle_msg(JNIEnv *env, const char* msg, int msg_bytes) ++{ ++ if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) { ++ dbgPrint(env, msg); ++ } else { ++ dbgPrint(env, "systemconf: cannot render message"); ++ } ++} ++ ++// Only used when NSS is not linked at build time ++#ifndef SYSCONF_NSS ++ ++static void *nss_handle; ++ ++static jboolean loadNSS(JNIEnv *env) ++{ ++ char msg[MSG_MAX_SIZE]; ++ int msg_bytes; ++ const char* errmsg; ++ ++ nss_handle = dlopen(JNI_LIB_NAME("nss3"), RTLD_LAZY); ++ if (nss_handle == NULL) { ++ errmsg = dlerror(); ++ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "loadNSS: dlopen: %s\n", ++ errmsg); ++ handle_msg(env, msg, msg_bytes); ++ return JNI_FALSE; ++ } ++ dlerror(); /* Clear errors */ ++ getSystemFIPSEnabled = (SECMOD_GET_SYSTEM_FIPS_ENABLED_TYPE*)dlsym(nss_handle, "SECMOD_GetSystemFIPSEnabled"); ++ if ((errmsg = dlerror()) != NULL) { ++ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "loadNSS: dlsym: %s\n", ++ errmsg); ++ handle_msg(env, msg, msg_bytes); ++ return JNI_FALSE; ++ } ++ return JNI_TRUE; ++} ++ ++static void closeNSS(JNIEnv *env) ++{ ++ char msg[MSG_MAX_SIZE]; ++ int msg_bytes; ++ const char* errmsg; ++ ++ if (dlclose(nss_handle) != 0) { ++ errmsg = dlerror(); ++ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "closeNSS: dlclose: %s\n", ++ errmsg); ++ handle_msg(env, msg, msg_bytes); ++ } ++} ++ ++#endif ++ ++/* ++ * Class: java_security_SystemConfigurator ++ * Method: JNI_OnLoad ++ */ ++JNIEXPORT jint JNICALL DEF_JNI_OnLoad(JavaVM *vm, void *reserved) ++{ ++ JNIEnv *env; ++ jclass sysConfCls, debugCls; ++ jfieldID sdebugFld; ++ ++ if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) { ++ return JNI_EVERSION; /* JNI version not supported */ ++ } ++ ++ sysConfCls = (*env)->FindClass(env,"java/security/SystemConfigurator"); ++ if (sysConfCls == NULL) { ++ printf("libsystemconf: SystemConfigurator class not found\n"); ++ return JNI_ERR; ++ } ++ sdebugFld = (*env)->GetStaticFieldID(env, sysConfCls, ++ "sdebug", "Lsun/security/util/Debug;"); ++ if (sdebugFld == NULL) { ++ printf("libsystemconf: SystemConfigurator::sdebug field not found\n"); ++ return JNI_ERR; ++ } ++ debugObj = (*env)->GetStaticObjectField(env, sysConfCls, sdebugFld); ++ if (debugObj != NULL) { ++ debugCls = (*env)->FindClass(env,"sun/security/util/Debug"); ++ if (debugCls == NULL) { ++ printf("libsystemconf: Debug class not found\n"); ++ return JNI_ERR; ++ } ++ debugPrintlnMethodID = (*env)->GetMethodID(env, debugCls, ++ "println", "(Ljava/lang/String;)V"); ++ if (debugPrintlnMethodID == NULL) { ++ printf("libsystemconf: Debug::println(String) method not found\n"); ++ return JNI_ERR; ++ } ++ debugObj = (*env)->NewGlobalRef(env, debugObj); ++ } ++ ++#ifdef SYSCONF_NSS ++ getSystemFIPSEnabled = *SECMOD_GetSystemFIPSEnabled; ++#else ++ if (loadNSS(env) == JNI_FALSE) { ++ dbgPrint(env, "libsystemconf: Failed to load NSS library."); ++ } ++#endif ++ ++ return (*env)->GetVersion(env); ++} ++ ++/* ++ * Class: java_security_SystemConfigurator ++ * Method: JNI_OnUnload ++ */ ++JNIEXPORT void JNICALL DEF_JNI_OnUnload(JavaVM *vm, void *reserved) ++{ ++ JNIEnv *env; ++ ++ if (debugObj != NULL) { ++ if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) { ++ return; /* Should not happen */ ++ } ++#ifndef SYSCONF_NSS ++ closeNSS(env); ++#endif ++ (*env)->DeleteGlobalRef(env, debugObj); ++ } ++} ++ ++JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEnabled ++ (JNIEnv *env, jclass cls) ++{ ++ int fips_enabled; ++ char msg[MSG_MAX_SIZE]; ++ int msg_bytes; ++ ++ if (getSystemFIPSEnabled != NULL) { ++ dbgPrint(env, "getSystemFIPSEnabled: calling SECMOD_GetSystemFIPSEnabled"); ++ fips_enabled = (*getSystemFIPSEnabled)(); ++ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \ ++ " SECMOD_GetSystemFIPSEnabled returned 0x%x", fips_enabled); ++ handle_msg(env, msg, msg_bytes); ++ return (fips_enabled == 1 ? JNI_TRUE : JNI_FALSE); ++ } else { ++ FILE *fe; ++ ++ dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH); ++ if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) { ++ throwIOException(env, "Cannot open " FIPS_ENABLED_PATH); ++ return JNI_FALSE; ++ } ++ fips_enabled = fgetc(fe); ++ fclose(fe); ++ if (fips_enabled == EOF) { ++ throwIOException(env, "Cannot read " FIPS_ENABLED_PATH); ++ return JNI_FALSE; ++ } ++ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \ ++ " read character is '%c'", fips_enabled); ++ handle_msg(env, msg, msg_bytes); ++ return (fips_enabled == '1' ? JNI_TRUE : JNI_FALSE); ++ } ++} ++ ++#else // !LINUX ++ ++JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEnabled ++ (JNIEnv *env, jclass cls) ++{ ++ return JNI_FALSE; ++} ++ ++#endif +diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java +new file mode 100644 +index 00000000000..48d6d656a28 +--- /dev/null ++++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java +@@ -0,0 +1,457 @@ ++/* ++ * Copyright (c) 2021, Red Hat, Inc. ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. Oracle designates this ++ * particular file as subject to the "Classpath" exception as provided ++ * by Oracle in the LICENSE file that accompanied this code. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++package sun.security.pkcs11; ++ ++import java.math.BigInteger; ++import java.security.KeyFactory; ++import java.security.Provider; ++import java.security.Security; ++import java.security.interfaces.RSAPrivateCrtKey; ++import java.security.interfaces.RSAPrivateKey; ++import java.util.HashMap; ++import java.util.Map; ++import java.util.concurrent.locks.ReentrantLock; ++ ++import javax.crypto.Cipher; ++import javax.crypto.SecretKeyFactory; ++import javax.crypto.spec.SecretKeySpec; ++import javax.crypto.spec.IvParameterSpec; ++ ++import sun.security.jca.JCAUtil; ++import sun.security.pkcs11.TemplateManager; ++import sun.security.pkcs11.wrapper.CK_ATTRIBUTE; ++import sun.security.pkcs11.wrapper.CK_MECHANISM; ++import static sun.security.pkcs11.wrapper.PKCS11Constants.*; ++import static sun.security.pkcs11.wrapper.PKCS11Exception.RV.*; ++import sun.security.pkcs11.wrapper.PKCS11Exception; ++import sun.security.rsa.RSAPrivateCrtKeyImpl; ++import sun.security.rsa.RSAUtil; ++import sun.security.rsa.RSAUtil.KeyType; ++import sun.security.util.Debug; ++import sun.security.util.ECUtil; ++ ++final class FIPSKeyImporter { ++ ++ private static final Debug debug = ++ Debug.getInstance("sunpkcs11"); ++ ++ private static volatile P11Key importerKey = null; ++ private static SecretKeySpec exporterKey = null; ++ private static volatile P11Key exporterKeyP11 = null; ++ private static final ReentrantLock importerKeyLock = new ReentrantLock(); ++ // Do not take the exporterKeyLock with the importerKeyLock held. ++ private static final ReentrantLock exporterKeyLock = new ReentrantLock(); ++ private static volatile CK_MECHANISM importerKeyMechanism = null; ++ private static volatile CK_MECHANISM exporterKeyMechanism = null; ++ private static Cipher importerCipher = null; ++ private static Cipher exporterCipher = null; ++ ++ private static volatile Provider sunECProvider = null; ++ private static final ReentrantLock sunECProviderLock = new ReentrantLock(); ++ ++ static Long importKey(SunPKCS11 sunPKCS11, long hSession, CK_ATTRIBUTE[] attributes) ++ throws PKCS11Exception { ++ long keyID = -1; ++ Token token = sunPKCS11.getToken(); ++ if (debug != null) { ++ debug.println("Private or Secret key will be imported in" + ++ " system FIPS mode."); ++ } ++ if (importerKey == null) { ++ importerKeyLock.lock(); ++ try { ++ if (importerKey == null) { ++ if (importerKeyMechanism == null) { ++ // Importer Key creation has not been tried yet. Try it. ++ createImporterKey(token); ++ } ++ if (importerKey == null || importerCipher == null) { ++ if (debug != null) { ++ debug.println("Importer Key could not be" + ++ " generated."); ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ " fips key importer"); ++ } ++ if (debug != null) { ++ debug.println("Importer Key successfully" + ++ " generated."); ++ } ++ } ++ } finally { ++ importerKeyLock.unlock(); ++ } ++ } ++ long importerKeyID = importerKey.getKeyID(); ++ try { ++ byte[] keyBytes = null; ++ byte[] encKeyBytes = null; ++ long keyClass = 0L; ++ long keyType = 0L; ++ Map attrsMap = new HashMap<>(); ++ for (CK_ATTRIBUTE attr : attributes) { ++ if (attr.type == CKA_CLASS) { ++ keyClass = attr.getLong(); ++ } else if (attr.type == CKA_KEY_TYPE) { ++ keyType = attr.getLong(); ++ } ++ attrsMap.put(attr.type, attr); ++ } ++ BigInteger v = null; ++ if (keyClass == CKO_PRIVATE_KEY) { ++ if (keyType == CKK_RSA) { ++ if (debug != null) { ++ debug.println("Importing an RSA private key..."); ++ } ++ keyBytes = sun.security.rsa.RSAPrivateCrtKeyImpl.newKey( ++ KeyType.RSA, ++ null, ++ ((v = attrsMap.get(CKA_MODULUS).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PUBLIC_EXPONENT).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PRIVATE_EXPONENT).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PRIME_1).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PRIME_2).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_EXPONENT_1).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_EXPONENT_2).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_COEFFICIENT).getBigInteger()) != null) ++ ? v : BigInteger.ZERO ++ ).getEncoded(); ++ } else if (keyType == CKK_DSA) { ++ if (debug != null) { ++ debug.println("Importing a DSA private key..."); ++ } ++ keyBytes = new sun.security.provider.DSAPrivateKey( ++ ((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PRIME).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_SUBPRIME).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_BASE).getBigInteger()) != null) ++ ? v : BigInteger.ZERO ++ ).getEncoded(); ++ if (token.config.getNssNetscapeDbWorkaround() && ++ attrsMap.get(CKA_NETSCAPE_DB) == null) { ++ attrsMap.put(CKA_NETSCAPE_DB, ++ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO)); ++ } ++ } else if (keyType == CKK_EC) { ++ if (debug != null) { ++ debug.println("Importing an EC private key..."); ++ } ++ if (sunECProvider == null) { ++ sunECProviderLock.lock(); ++ try { ++ if (sunECProvider == null) { ++ sunECProvider = Security.getProvider("SunEC"); ++ } ++ } finally { ++ sunECProviderLock.unlock(); ++ } ++ } ++ keyBytes = ECUtil.generateECPrivateKey( ++ ((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ECUtil.getECParameterSpec(sunECProvider, ++ attrsMap.get(CKA_EC_PARAMS).getByteArray())) ++ .getEncoded(); ++ if (token.config.getNssNetscapeDbWorkaround() && ++ attrsMap.get(CKA_NETSCAPE_DB) == null) { ++ attrsMap.put(CKA_NETSCAPE_DB, ++ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO)); ++ } ++ } else { ++ if (debug != null) { ++ debug.println("Unrecognized private key type."); ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ " fips key importer"); ++ } ++ } else if (keyClass == CKO_SECRET_KEY) { ++ if (debug != null) { ++ debug.println("Importing a secret key..."); ++ } ++ keyBytes = attrsMap.get(CKA_VALUE).getByteArray(); ++ } ++ if (keyBytes == null || keyBytes.length == 0) { ++ if (debug != null) { ++ debug.println("Private or secret key plain bytes could" + ++ " not be obtained. Import failed."); ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ " fips key importer"); ++ } ++ attributes = new CK_ATTRIBUTE[attrsMap.size()]; ++ attrsMap.values().toArray(attributes); ++ importerKeyLock.lock(); ++ try { ++ // No need to reset the cipher object because no multi-part ++ // operations are performed. ++ encKeyBytes = importerCipher.doFinal(keyBytes); ++ } finally { ++ importerKeyLock.unlock(); ++ } ++ attributes = token.getAttributes(TemplateManager.O_IMPORT, ++ keyClass, keyType, attributes); ++ keyID = token.p11.C_UnwrapKey(hSession, ++ importerKeyMechanism, importerKeyID, encKeyBytes, attributes); ++ if (debug != null) { ++ debug.println("Imported key ID: " + keyID); ++ } ++ } catch (Throwable t) { ++ if (t instanceof PKCS11Exception) { ++ throw (PKCS11Exception)t; ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ t.getMessage()); ++ } finally { ++ importerKey.releaseKeyID(); ++ } ++ return Long.valueOf(keyID); ++ } ++ ++ static void exportKey(SunPKCS11 sunPKCS11, long hSession, long hObject, ++ long keyClass, long keyType, Map sensitiveAttrs) ++ throws PKCS11Exception { ++ Token token = sunPKCS11.getToken(); ++ if (debug != null) { ++ debug.println("Private or Secret key will be exported in" + ++ " system FIPS mode."); ++ } ++ if (exporterKeyP11 == null) { ++ try { ++ exporterKeyLock.lock(); ++ if (exporterKeyP11 == null) { ++ if (exporterKeyMechanism == null) { ++ // Exporter Key creation has not been tried yet. Try it. ++ createExporterKey(token); ++ } ++ if (exporterKeyP11 == null || exporterCipher == null) { ++ if (debug != null) { ++ debug.println("Exporter Key could not be" + ++ " generated."); ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ " fips key exporter"); ++ } ++ if (debug != null) { ++ debug.println("Exporter Key successfully" + ++ " generated."); ++ } ++ } ++ } finally { ++ exporterKeyLock.unlock(); ++ } ++ } ++ long exporterKeyID = exporterKeyP11.getKeyID(); ++ try { ++ byte[] wrappedKeyBytes = token.p11.C_WrapKey(hSession, ++ exporterKeyMechanism, exporterKeyID, hObject); ++ byte[] plainExportedKey = null; ++ exporterKeyLock.lock(); ++ try { ++ // No need to reset the cipher object because no multi-part ++ // operations are performed. ++ plainExportedKey = exporterCipher.doFinal(wrappedKeyBytes); ++ } finally { ++ exporterKeyLock.unlock(); ++ } ++ if (keyClass == CKO_PRIVATE_KEY) { ++ exportPrivateKey(sensitiveAttrs, keyType, plainExportedKey); ++ } else if (keyClass == CKO_SECRET_KEY) { ++ checkAttrs(sensitiveAttrs, "CKO_SECRET_KEY", CKA_VALUE); ++ // CKA_VALUE is guaranteed to be present, since sensitiveAttrs' ++ // size is greater than 0 and no invalid attributes exist ++ sensitiveAttrs.get(CKA_VALUE).pValue = plainExportedKey; ++ } else { ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ " fips key exporter"); ++ } ++ } catch (Throwable t) { ++ if (t instanceof PKCS11Exception) { ++ throw (PKCS11Exception)t; ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ t.getMessage()); ++ } finally { ++ exporterKeyP11.releaseKeyID(); ++ } ++ } ++ ++ private static void exportPrivateKey( ++ Map sensitiveAttrs, long keyType, ++ byte[] plainExportedKey) throws Throwable { ++ if (keyType == CKK_RSA) { ++ checkAttrs(sensitiveAttrs, "CKO_PRIVATE_KEY CKK_RSA", ++ CKA_PRIVATE_EXPONENT, CKA_PRIME_1, CKA_PRIME_2, ++ CKA_EXPONENT_1, CKA_EXPONENT_2, CKA_COEFFICIENT); ++ RSAPrivateKey rsaPKey = RSAPrivateCrtKeyImpl.newKey( ++ RSAUtil.KeyType.RSA, "PKCS#8", plainExportedKey); ++ CK_ATTRIBUTE attr; ++ if ((attr = sensitiveAttrs.get(CKA_PRIVATE_EXPONENT)) != null) { ++ attr.pValue = rsaPKey.getPrivateExponent().toByteArray(); ++ } ++ if (rsaPKey instanceof RSAPrivateCrtKey) { ++ RSAPrivateCrtKey rsaPCrtKey = (RSAPrivateCrtKey) rsaPKey; ++ if ((attr = sensitiveAttrs.get(CKA_PRIME_1)) != null) { ++ attr.pValue = rsaPCrtKey.getPrimeP().toByteArray(); ++ } ++ if ((attr = sensitiveAttrs.get(CKA_PRIME_2)) != null) { ++ attr.pValue = rsaPCrtKey.getPrimeQ().toByteArray(); ++ } ++ if ((attr = sensitiveAttrs.get(CKA_EXPONENT_1)) != null) { ++ attr.pValue = rsaPCrtKey.getPrimeExponentP().toByteArray(); ++ } ++ if ((attr = sensitiveAttrs.get(CKA_EXPONENT_2)) != null) { ++ attr.pValue = rsaPCrtKey.getPrimeExponentQ().toByteArray(); ++ } ++ if ((attr = sensitiveAttrs.get(CKA_COEFFICIENT)) != null) { ++ attr.pValue = rsaPCrtKey.getCrtCoefficient().toByteArray(); ++ } ++ } else { ++ checkAttrs(sensitiveAttrs, "CKO_PRIVATE_KEY CKK_RSA", ++ CKA_PRIVATE_EXPONENT); ++ } ++ } else if (keyType == CKK_DSA) { ++ checkAttrs(sensitiveAttrs, "CKO_PRIVATE_KEY CKK_DSA", CKA_VALUE); ++ // CKA_VALUE is guaranteed to be present, since sensitiveAttrs' ++ // size is greater than 0 and no invalid attributes exist ++ sensitiveAttrs.get(CKA_VALUE).pValue = ++ new sun.security.provider.DSAPrivateKey(plainExportedKey) ++ .getX().toByteArray(); ++ } else if (keyType == CKK_EC) { ++ checkAttrs(sensitiveAttrs, "CKO_PRIVATE_KEY CKK_EC", CKA_VALUE); ++ // CKA_VALUE is guaranteed to be present, since sensitiveAttrs' ++ // size is greater than 0 and no invalid attributes exist ++ sensitiveAttrs.get(CKA_VALUE).pValue = ++ ECUtil.decodePKCS8ECPrivateKey(plainExportedKey) ++ .getS().toByteArray(); ++ } else { ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ " unsupported CKO_PRIVATE_KEY key type: " + keyType); ++ } ++ } ++ ++ private static void checkAttrs(Map sensitiveAttrs, ++ String keyName, long... validAttrs) ++ throws PKCS11Exception { ++ int sensitiveAttrsCount = sensitiveAttrs.size(); ++ if (sensitiveAttrsCount <= validAttrs.length) { ++ int validAttrsCount = 0; ++ for (long validAttr : validAttrs) { ++ if (sensitiveAttrs.containsKey(validAttr)) validAttrsCount++; ++ } ++ if (validAttrsCount == sensitiveAttrsCount) return; ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ " invalid attribute types for a " + keyName + " key object"); ++ } ++ ++ private static void createImporterKey(Token token) { ++ if (debug != null) { ++ debug.println("Generating Importer Key..."); ++ } ++ byte[] iv = new byte[16]; ++ JCAUtil.getSecureRandom().nextBytes(iv); ++ importerKeyMechanism = new CK_MECHANISM(CKM_AES_CBC_PAD, iv); ++ try { ++ CK_ATTRIBUTE[] attributes = token.getAttributes(TemplateManager.O_GENERATE, ++ CKO_SECRET_KEY, CKK_AES, new CK_ATTRIBUTE[] { ++ new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY), ++ new CK_ATTRIBUTE(CKA_VALUE_LEN, 256 >> 3)}); ++ Session s = null; ++ try { ++ s = token.getObjSession(); ++ long keyID = token.p11.C_GenerateKey( ++ s.id(), new CK_MECHANISM(CKM_AES_KEY_GEN), ++ attributes); ++ if (debug != null) { ++ debug.println("Importer Key ID: " + keyID); ++ } ++ importerKey = (P11Key)P11Key.secretKey(s, keyID, "AES", ++ 256 >> 3, null); ++ } catch (PKCS11Exception e) { ++ // best effort ++ } finally { ++ token.releaseSession(s); ++ } ++ if (importerKey != null) { ++ importerCipher = Cipher.getInstance("AES/CBC/PKCS5Padding"); ++ importerCipher.init(Cipher.ENCRYPT_MODE, importerKey, ++ new IvParameterSpec( ++ (byte[])importerKeyMechanism.pParameter), null); ++ } ++ } catch (Throwable t) { ++ // best effort ++ importerKey = null; ++ importerCipher = null; ++ // importerKeyMechanism value is kept initialized to indicate that ++ // Importer Key creation has been tried and failed. ++ if (debug != null) { ++ debug.println("Error generating the Importer Key"); ++ } ++ } ++ } ++ ++ private static void createExporterKey(Token token) { ++ if (debug != null) { ++ debug.println("Generating Exporter Key..."); ++ } ++ byte[] iv = new byte[16]; ++ JCAUtil.getSecureRandom().nextBytes(iv); ++ exporterKeyMechanism = new CK_MECHANISM(CKM_AES_CBC_PAD, iv); ++ byte[] exporterKeyRaw = new byte[32]; ++ JCAUtil.getSecureRandom().nextBytes(exporterKeyRaw); ++ exporterKey = new SecretKeySpec(exporterKeyRaw, "AES"); ++ try { ++ SecretKeyFactory skf = SecretKeyFactory.getInstance("AES"); ++ exporterKeyP11 = (P11Key)(skf.translateKey(exporterKey)); ++ if (exporterKeyP11 != null) { ++ exporterCipher = Cipher.getInstance("AES/CBC/PKCS5Padding"); ++ exporterCipher.init(Cipher.DECRYPT_MODE, exporterKey, ++ new IvParameterSpec( ++ (byte[])exporterKeyMechanism.pParameter), null); ++ } ++ } catch (Throwable t) { ++ // best effort ++ exporterKey = null; ++ exporterKeyP11 = null; ++ exporterCipher = null; ++ // exporterKeyMechanism value is kept initialized to indicate that ++ // Exporter Key creation has been tried and failed. ++ if (debug != null) { ++ debug.println("Error generating the Exporter Key"); ++ } ++ } ++ } ++} +diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSTokenLoginHandler.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSTokenLoginHandler.java +new file mode 100644 +index 00000000000..f8d505ca815 +--- /dev/null ++++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSTokenLoginHandler.java +@@ -0,0 +1,149 @@ ++/* ++ * Copyright (c) 2022, Red Hat, Inc. ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. Oracle designates this ++ * particular file as subject to the "Classpath" exception as provided ++ * by Oracle in the LICENSE file that accompanied this code. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++package sun.security.pkcs11; ++ ++import java.io.BufferedReader; ++import java.io.ByteArrayInputStream; ++import java.io.InputStream; ++import java.io.InputStreamReader; ++import java.io.IOException; ++import java.nio.charset.StandardCharsets; ++import java.nio.file.Files; ++import java.nio.file.Path; ++import java.nio.file.Paths; ++import java.nio.file.StandardOpenOption; ++import java.security.ProviderException; ++ ++import javax.security.auth.callback.Callback; ++import javax.security.auth.callback.CallbackHandler; ++import javax.security.auth.callback.PasswordCallback; ++import javax.security.auth.callback.UnsupportedCallbackException; ++ ++import sun.security.util.Debug; ++import sun.security.util.SecurityProperties; ++ ++final class FIPSTokenLoginHandler implements CallbackHandler { ++ ++ private static final String FIPS_NSSDB_PIN_PROP = "fips.nssdb.pin"; ++ ++ private static final Debug debug = Debug.getInstance("sunpkcs11"); ++ ++ public void handle(Callback[] callbacks) ++ throws IOException, UnsupportedCallbackException { ++ if (!(callbacks[0] instanceof PasswordCallback)) { ++ throw new UnsupportedCallbackException(callbacks[0]); ++ } ++ PasswordCallback pc = (PasswordCallback)callbacks[0]; ++ pc.setPassword(getFipsNssdbPin()); ++ } ++ ++ private static char[] getFipsNssdbPin() throws ProviderException { ++ if (debug != null) { ++ debug.println("FIPS: Reading NSS DB PIN for token..."); ++ } ++ String pinProp = SecurityProperties ++ .privilegedGetOverridable(FIPS_NSSDB_PIN_PROP); ++ if (pinProp != null && !pinProp.isEmpty()) { ++ String[] pinPropParts = pinProp.split(":", 2); ++ if (pinPropParts.length < 2) { ++ throw new ProviderException("Invalid " + FIPS_NSSDB_PIN_PROP + ++ " property value."); ++ } ++ String prefix = pinPropParts[0].toLowerCase(); ++ String value = pinPropParts[1]; ++ String pin = null; ++ if (prefix.equals("env")) { ++ if (debug != null) { ++ debug.println("FIPS: PIN value from the '" + value + ++ "' environment variable."); ++ } ++ pin = System.getenv(value); ++ } else if (prefix.equals("file")) { ++ if (debug != null) { ++ debug.println("FIPS: PIN value from the '" + value + ++ "' file."); ++ } ++ pin = getPinFromFile(Paths.get(value)); ++ } else if (prefix.equals("pin")) { ++ if (debug != null) { ++ debug.println("FIPS: PIN value from the " + ++ FIPS_NSSDB_PIN_PROP + " property."); ++ } ++ pin = value; ++ } else { ++ throw new ProviderException("Unsupported prefix for " + ++ FIPS_NSSDB_PIN_PROP + "."); ++ } ++ if (pin != null && !pin.isEmpty()) { ++ if (debug != null) { ++ debug.println("FIPS: non-empty PIN."); ++ } ++ /* ++ * C_Login in libj2pkcs11 receives the PIN in a char[] and ++ * discards the upper byte of each char, before passing ++ * the value to the NSS Software Token. However, the ++ * NSS Software Token accepts any UTF-8 PIN value. Thus, ++ * expand the PIN here to account for later truncation. ++ */ ++ byte[] pinUtf8 = pin.getBytes(StandardCharsets.UTF_8); ++ char[] pinChar = new char[pinUtf8.length]; ++ for (int i = 0; i < pinChar.length; i++) { ++ pinChar[i] = (char)(pinUtf8[i] & 0xFF); ++ } ++ return pinChar; ++ } ++ } ++ if (debug != null) { ++ debug.println("FIPS: empty PIN."); ++ } ++ return null; ++ } ++ ++ /* ++ * This method extracts the token PIN from the first line of a password ++ * file in the same way as NSS modutil. See for example the -newpwfile ++ * argument used to change the password for an NSS DB. ++ */ ++ private static String getPinFromFile(Path f) throws ProviderException { ++ try (InputStream is = ++ Files.newInputStream(f, StandardOpenOption.READ)) { ++ /* ++ * SECU_FilePasswd in NSS (nss/cmd/lib/secutil.c), used by modutil, ++ * reads up to 4096 bytes. In addition, the NSS Software Token ++ * does not accept PINs longer than 500 bytes (see SFTK_MAX_PIN ++ * in nss/lib/softoken/pkcs11i.h). ++ */ ++ BufferedReader in = ++ new BufferedReader(new InputStreamReader( ++ new ByteArrayInputStream(is.readNBytes(4096)), ++ StandardCharsets.UTF_8)); ++ return in.readLine(); ++ } catch (IOException ioe) { ++ throw new ProviderException("Error reading " + FIPS_NSSDB_PIN_PROP + ++ " from the '" + f + "' file.", ioe); ++ } ++ } ++} +\ No newline at end of file +diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java +index 6b26297b1b4..7ee5e07756c 100644 +--- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java ++++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java +@@ -37,6 +37,8 @@ import javax.crypto.*; + import javax.crypto.interfaces.*; + import javax.crypto.spec.*; + ++import jdk.internal.access.SharedSecrets; ++ + import sun.security.rsa.RSAUtil.KeyType; + import sun.security.rsa.RSAPublicKeyImpl; + import sun.security.rsa.RSAPrivateCrtKeyImpl; +@@ -72,6 +74,9 @@ abstract class P11Key implements Key, Length { + @Serial + private static final long serialVersionUID = -2575874101938349339L; + ++ private static final boolean plainKeySupportEnabled = SharedSecrets ++ .getJavaSecuritySystemConfiguratorAccess().isPlainKeySupportEnabled(); ++ + private static final String PUBLIC = "public"; + private static final String PRIVATE = "private"; + private static final String SECRET = "secret"; +@@ -401,8 +406,10 @@ abstract class P11Key implements Key, Length { + new CK_ATTRIBUTE(CKA_EXTRACTABLE), + }); + +- boolean keySensitive = (attrs[0].getBoolean() || +- attrs[1].getBoolean() || !attrs[2].getBoolean()); ++ boolean exportable = plainKeySupportEnabled && !algorithm.equals("DH"); ++ boolean keySensitive = (!exportable && ++ (attrs[0].getBoolean() || ++ attrs[1].getBoolean() || !attrs[2].getBoolean())); + + return switch (algorithm) { + case "RSA" -> P11RSAPrivateKeyInternal.of(session, keyID, algorithm, +@@ -454,7 +461,8 @@ abstract class P11Key implements Key, Length { + + public String getFormat() { + token.ensureValid(); +- if (sensitive || !extractable || (isNSS && tokenObject)) { ++ if (!plainKeySupportEnabled && ++ (sensitive || !extractable || (isNSS && tokenObject))) { + return null; + } else { + return "RAW"; +@@ -1624,4 +1632,3 @@ final class SessionKeyRef extends PhantomReference { + this.clear(); + } + } +- +diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java +index 5cd6828d293..bae49c4e8a9 100644 +--- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java ++++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java +@@ -26,6 +26,9 @@ + package sun.security.pkcs11; + + import java.io.*; ++import java.lang.invoke.MethodHandle; ++import java.lang.invoke.MethodHandles; ++import java.lang.invoke.MethodType; + import java.util.*; + + import java.security.*; +@@ -42,10 +45,12 @@ import javax.security.auth.callback.PasswordCallback; + + import com.sun.crypto.provider.ChaCha20Poly1305Parameters; + ++import jdk.internal.access.SharedSecrets; + import jdk.internal.misc.InnocuousThread; + import sun.security.util.Debug; + import sun.security.util.ResourcesMgr; + import static sun.security.util.SecurityConstants.PROVIDER_VER; ++import sun.security.util.SecurityProperties; + import static sun.security.util.SecurityProviderConstants.getAliases; + + import sun.security.pkcs11.Secmod.*; +@@ -65,6 +70,39 @@ public final class SunPKCS11 extends AuthProvider { + @Serial + private static final long serialVersionUID = -1354835039035306505L; + ++ private static final boolean systemFipsEnabled = SharedSecrets ++ .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled(); ++ ++ private static final boolean plainKeySupportEnabled = SharedSecrets ++ .getJavaSecuritySystemConfiguratorAccess().isPlainKeySupportEnabled(); ++ ++ private static final MethodHandle fipsImportKey; ++ private static final MethodHandle fipsExportKey; ++ static { ++ MethodHandle fipsImportKeyTmp = null; ++ MethodHandle fipsExportKeyTmp = null; ++ if (plainKeySupportEnabled) { ++ try { ++ fipsImportKeyTmp = MethodHandles.lookup().findStatic( ++ FIPSKeyImporter.class, "importKey", ++ MethodType.methodType(Long.class, SunPKCS11.class, ++ long.class, CK_ATTRIBUTE[].class)); ++ fipsExportKeyTmp = MethodHandles.lookup().findStatic( ++ FIPSKeyImporter.class, "exportKey", ++ MethodType.methodType(void.class, SunPKCS11.class, ++ long.class, long.class, ++ long.class, long.class, Map.class)); ++ } catch (Throwable t) { ++ throw new SecurityException("FIPS key importer-exporter" + ++ " initialization failed", t); ++ } ++ } ++ fipsImportKey = fipsImportKeyTmp; ++ fipsExportKey = fipsExportKeyTmp; ++ } ++ ++ private static final String FIPS_NSSDB_PATH_PROP = "fips.nssdb.path"; ++ + static final Debug debug = Debug.getInstance("sunpkcs11"); + // the PKCS11 object through which we make the native calls + @SuppressWarnings("serial") // Type of field is not Serializable; +@@ -123,6 +161,29 @@ public final class SunPKCS11 extends AuthProvider { + return AccessController.doPrivileged(new PrivilegedExceptionAction<>() { + @Override + public SunPKCS11 run() throws Exception { ++ if (systemFipsEnabled) { ++ /* ++ * The nssSecmodDirectory attribute in the SunPKCS11 ++ * NSS configuration file takes the value of the ++ * fips.nssdb.path System property after expansion. ++ * Security properties expansion is unsupported. ++ */ ++ String nssdbPath = ++ SecurityProperties.privilegedGetOverridable( ++ FIPS_NSSDB_PATH_PROP); ++ if (System.getSecurityManager() != null) { ++ AccessController.doPrivileged( ++ (PrivilegedAction) () -> { ++ System.setProperty( ++ FIPS_NSSDB_PATH_PROP, ++ nssdbPath); ++ return null; ++ }); ++ } else { ++ System.setProperty( ++ FIPS_NSSDB_PATH_PROP, nssdbPath); ++ } ++ } + return new SunPKCS11(new Config(newConfigName)); + } + }); +@@ -325,9 +386,19 @@ public final class SunPKCS11 extends AuthProvider { + // request multithreaded access first + initArgs.flags = CKF_OS_LOCKING_OK; + PKCS11 tmpPKCS11; ++ MethodHandle fipsKeyImporter = null; ++ MethodHandle fipsKeyExporter = null; ++ if (plainKeySupportEnabled) { ++ fipsKeyImporter = MethodHandles.insertArguments( ++ fipsImportKey, 0, this); ++ fipsKeyExporter = MethodHandles.insertArguments( ++ fipsExportKey, 0, this); ++ } + try { +- tmpPKCS11 = PKCS11.getInstance(library, functionList, initArgs, +- config.getOmitInitialize()); ++ tmpPKCS11 = PKCS11.getInstance( ++ library, functionList, initArgs, ++ config.getOmitInitialize(), fipsKeyImporter, ++ fipsKeyExporter); + } catch (PKCS11Exception e) { + if (debug != null) { + debug.println("Multi-threaded initialization failed: " + e); +@@ -342,8 +413,9 @@ public final class SunPKCS11 extends AuthProvider { + } else { + initArgs.flags = 0; + } +- tmpPKCS11 = PKCS11.getInstance(library, functionList, initArgs, +- config.getOmitInitialize()); ++ tmpPKCS11 = PKCS11.getInstance(library, ++ functionList, initArgs, config.getOmitInitialize(), fipsKeyImporter, ++ fipsKeyExporter); + } + p11 = tmpPKCS11; + +@@ -1389,11 +1461,52 @@ public final class SunPKCS11 extends AuthProvider { + } + + @Override ++ @SuppressWarnings("removal") + public Object newInstance(Object param) + throws NoSuchAlgorithmException { + if (!token.isValid()) { + throw new NoSuchAlgorithmException("Token has been removed"); + } ++ if (systemFipsEnabled && !token.fipsLoggedIn && ++ !getType().equals("KeyStore")) { ++ /* ++ * The NSS Software Token in FIPS 140-2 mode requires a ++ * user login for most operations. See sftk_fipsCheck ++ * (nss/lib/softoken/fipstokn.c). In case of a KeyStore ++ * service, let the caller perform the login with ++ * KeyStore::load. Keytool, for example, does this to pass a ++ * PIN from either the -srcstorepass or -deststorepass ++ * argument. In case of a non-KeyStore service, perform the ++ * login now with the PIN available in the fips.nssdb.pin ++ * property. ++ */ ++ try { ++ if (System.getSecurityManager() != null) { ++ try { ++ AccessController.doPrivileged( ++ (PrivilegedExceptionAction) () -> { ++ token.ensureLoggedIn(null); ++ return null; ++ }); ++ } catch (PrivilegedActionException pae) { ++ Exception e = pae.getException(); ++ if (e instanceof LoginException le) { ++ throw le; ++ } else if (e instanceof PKCS11Exception p11e) { ++ throw p11e; ++ } else { ++ throw new RuntimeException(e); ++ } ++ } ++ } else { ++ token.ensureLoggedIn(null); ++ } ++ } catch (PKCS11Exception | LoginException e) { ++ throw new ProviderException("FIPS: error during the Token" + ++ " login required for the " + getType() + ++ " service.", e); ++ } ++ } + try { + return newInstance0(param); + } catch (PKCS11Exception e) { +@@ -1750,6 +1863,9 @@ public final class SunPKCS11 extends AuthProvider { + try { + session = token.getOpSession(); + p11.C_Logout(session.id()); ++ if (systemFipsEnabled) { ++ token.fipsLoggedIn = false; ++ } + if (debug != null) { + debug.println("logout succeeded"); + } +diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java +index 3378409ca1c..7602a92a252 100644 +--- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java ++++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java +@@ -33,6 +33,7 @@ import java.lang.ref.*; + import java.security.*; + import javax.security.auth.login.LoginException; + ++import jdk.internal.access.SharedSecrets; + import sun.security.jca.JCAUtil; + + import sun.security.pkcs11.wrapper.*; +@@ -48,6 +49,9 @@ import static sun.security.pkcs11.wrapper.PKCS11Exception.RV.*; + */ + final class Token implements Serializable { + ++ private static final boolean systemFipsEnabled = SharedSecrets ++ .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled(); ++ + // need to be serializable to allow SecureRandom to be serialized + @Serial + private static final long serialVersionUID = 2541527649100571747L; +@@ -125,6 +129,10 @@ final class Token implements Serializable { + // flag indicating whether we are logged in + private volatile boolean loggedIn; + ++ // Flag indicating the login status for the NSS Software Token in FIPS mode. ++ // This Token is never asynchronously removed. Used from SunPKCS11. ++ volatile boolean fipsLoggedIn; ++ + // time we last checked login status + private long lastLoginCheck; + +@@ -242,7 +250,12 @@ final class Token implements Serializable { + // call provider.login() if not + void ensureLoggedIn(Session session) throws PKCS11Exception, LoginException { + if (!isLoggedIn(session)) { +- provider.login(null, null); ++ if (systemFipsEnabled) { ++ provider.login(null, new FIPSTokenLoginHandler()); ++ fipsLoggedIn = true; ++ } else { ++ provider.login(null, null); ++ } + } + } + +diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java +index 4b06daaf264..55e14945469 100644 +--- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java ++++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java +@@ -49,6 +49,9 @@ package sun.security.pkcs11.wrapper; + + import java.io.File; + import java.io.IOException; ++import java.lang.invoke.MethodHandle; ++import java.lang.invoke.MethodHandles; ++import java.lang.invoke.MethodType; + import java.util.*; + + import java.security.AccessController; +@@ -174,18 +177,43 @@ public class PKCS11 { + return version; + } + ++ /* ++ * Compatibility wrapper to allow this method to work as before ++ * when FIPS mode support is not active. ++ */ ++ public static synchronized PKCS11 getInstance(String pkcs11ModulePath, ++ String functionList, CK_C_INITIALIZE_ARGS pInitArgs, ++ boolean omitInitialize) throws IOException, PKCS11Exception { ++ return getInstance(pkcs11ModulePath, functionList, ++ pInitArgs, omitInitialize, null, null); ++ } ++ + public static synchronized PKCS11 getInstance(String pkcs11ModulePath, + String functionList, CK_C_INITIALIZE_ARGS pInitArgs, +- boolean omitInitialize) throws IOException, PKCS11Exception { ++ boolean omitInitialize, MethodHandle fipsKeyImporter, ++ MethodHandle fipsKeyExporter) ++ throws IOException, PKCS11Exception { + // we may only call C_Initialize once per native .so/.dll + // so keep a cache using the (non-canonicalized!) path + PKCS11 pkcs11 = moduleMap.get(pkcs11ModulePath); + if (pkcs11 == null) { ++ boolean nssFipsMode = fipsKeyImporter != null && ++ fipsKeyExporter != null; + if ((pInitArgs != null) + && ((pInitArgs.flags & CKF_OS_LOCKING_OK) != 0)) { +- pkcs11 = new PKCS11(pkcs11ModulePath, functionList); ++ if (nssFipsMode) { ++ pkcs11 = new FIPSPKCS11(pkcs11ModulePath, functionList, ++ fipsKeyImporter, fipsKeyExporter); ++ } else { ++ pkcs11 = new PKCS11(pkcs11ModulePath, functionList); ++ } + } else { +- pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList); ++ if (nssFipsMode) { ++ pkcs11 = new SynchronizedFIPSPKCS11(pkcs11ModulePath, ++ functionList, fipsKeyImporter, fipsKeyExporter); ++ } else { ++ pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList); ++ } + } + if (omitInitialize == false) { + try { +@@ -1976,4 +2004,194 @@ static class SynchronizedPKCS11 extends PKCS11 { + super.C_GenerateRandom(hSession, randomData); + } + } ++ ++// PKCS11 subclass that allows using plain private or secret keys in ++// FIPS-configured NSS Software Tokens. Only used when System FIPS ++// is enabled. ++static class FIPSPKCS11 extends PKCS11 { ++ private MethodHandle fipsKeyImporter; ++ private MethodHandle fipsKeyExporter; ++ private MethodHandle hC_GetAttributeValue; ++ FIPSPKCS11(String pkcs11ModulePath, String functionListName, ++ MethodHandle fipsKeyImporter, MethodHandle fipsKeyExporter) ++ throws IOException { ++ super(pkcs11ModulePath, functionListName); ++ this.fipsKeyImporter = fipsKeyImporter; ++ this.fipsKeyExporter = fipsKeyExporter; ++ try { ++ hC_GetAttributeValue = MethodHandles.insertArguments( ++ MethodHandles.lookup().findSpecial(PKCS11.class, ++ "C_GetAttributeValue", MethodType.methodType( ++ void.class, long.class, long.class, ++ CK_ATTRIBUTE[].class), ++ FIPSPKCS11.class), 0, this); ++ } catch (Throwable t) { ++ throw new RuntimeException( ++ "sun.security.pkcs11.wrapper.PKCS11" + ++ "::C_GetAttributeValue method not found.", t); ++ } ++ } ++ ++ public long C_CreateObject(long hSession, ++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception { ++ // Creating sensitive key objects from plain key material in a ++ // FIPS-configured NSS Software Token is not allowed. We apply ++ // a key-unwrapping scheme to achieve so. ++ if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) { ++ try { ++ return ((Long)fipsKeyImporter.invoke(hSession, pTemplate)) ++ .longValue(); ++ } catch (Throwable t) { ++ if (t instanceof PKCS11Exception) { ++ throw (PKCS11Exception)t; ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ t.getMessage()); ++ } ++ } ++ return super.C_CreateObject(hSession, pTemplate); ++ } ++ ++ public void C_GetAttributeValue(long hSession, long hObject, ++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception { ++ FIPSPKCS11Helper.C_GetAttributeValue(hC_GetAttributeValue, ++ fipsKeyExporter, hSession, hObject, pTemplate); ++ } ++} ++ ++// FIPSPKCS11 synchronized counterpart. ++static class SynchronizedFIPSPKCS11 extends SynchronizedPKCS11 { ++ private MethodHandle fipsKeyImporter; ++ private MethodHandle fipsKeyExporter; ++ private MethodHandle hC_GetAttributeValue; ++ SynchronizedFIPSPKCS11(String pkcs11ModulePath, String functionListName, ++ MethodHandle fipsKeyImporter, MethodHandle fipsKeyExporter) ++ throws IOException { ++ super(pkcs11ModulePath, functionListName); ++ this.fipsKeyImporter = fipsKeyImporter; ++ this.fipsKeyExporter = fipsKeyExporter; ++ try { ++ hC_GetAttributeValue = MethodHandles.insertArguments( ++ MethodHandles.lookup().findSpecial(SynchronizedPKCS11.class, ++ "C_GetAttributeValue", MethodType.methodType( ++ void.class, long.class, long.class, ++ CK_ATTRIBUTE[].class), ++ SynchronizedFIPSPKCS11.class), 0, this); ++ } catch (Throwable t) { ++ throw new RuntimeException( ++ "sun.security.pkcs11.wrapper.SynchronizedPKCS11" + ++ "::C_GetAttributeValue method not found.", t); ++ } ++ } ++ ++ public synchronized long C_CreateObject(long hSession, ++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception { ++ // See FIPSPKCS11::C_CreateObject. ++ if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) { ++ try { ++ return ((Long)fipsKeyImporter.invoke(hSession, pTemplate)) ++ .longValue(); ++ } catch (Throwable t) { ++ if (t instanceof PKCS11Exception) { ++ throw (PKCS11Exception)t; ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ t.getMessage()); ++ } ++ } ++ return super.C_CreateObject(hSession, pTemplate); ++ } ++ ++ public synchronized void C_GetAttributeValue(long hSession, long hObject, ++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception { ++ FIPSPKCS11Helper.C_GetAttributeValue(hC_GetAttributeValue, ++ fipsKeyExporter, hSession, hObject, pTemplate); ++ } ++} ++ ++private static class FIPSPKCS11Helper { ++ static boolean isSensitiveObject(CK_ATTRIBUTE[] pTemplate) { ++ for (CK_ATTRIBUTE attr : pTemplate) { ++ if (attr.type == CKA_CLASS && ++ (attr.getLong() == CKO_PRIVATE_KEY || ++ attr.getLong() == CKO_SECRET_KEY)) { ++ return true; ++ } ++ } ++ return false; ++ } ++ static void C_GetAttributeValue(MethodHandle hC_GetAttributeValue, ++ MethodHandle fipsKeyExporter, long hSession, long hObject, ++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception { ++ Map sensitiveAttrs = new HashMap<>(); ++ List nonSensitiveAttrs = new LinkedList<>(); ++ FIPSPKCS11Helper.getAttributesBySensitivity(pTemplate, ++ sensitiveAttrs, nonSensitiveAttrs); ++ try { ++ if (sensitiveAttrs.size() > 0) { ++ long keyClass = -1L; ++ long keyType = -1L; ++ try { ++ // Secret and private keys have both class and type ++ // attributes, so we can query them at once. ++ CK_ATTRIBUTE[] queryAttrs = new CK_ATTRIBUTE[]{ ++ new CK_ATTRIBUTE(CKA_CLASS), ++ new CK_ATTRIBUTE(CKA_KEY_TYPE), ++ }; ++ hC_GetAttributeValue.invoke(hSession, hObject, queryAttrs); ++ keyClass = queryAttrs[0].getLong(); ++ keyType = queryAttrs[1].getLong(); ++ } catch (PKCS11Exception e) { ++ // If the query fails, the object is neither a secret nor a ++ // private key. As this case won't be handled with the FIPS ++ // Key Exporter, we keep keyClass initialized to -1L. ++ } ++ if (keyClass == CKO_SECRET_KEY || keyClass == CKO_PRIVATE_KEY) { ++ fipsKeyExporter.invoke(hSession, hObject, keyClass, keyType, ++ sensitiveAttrs); ++ if (nonSensitiveAttrs.size() > 0) { ++ CK_ATTRIBUTE[] pNonSensitiveAttrs = ++ new CK_ATTRIBUTE[nonSensitiveAttrs.size()]; ++ int i = 0; ++ for (CK_ATTRIBUTE nonSensAttr : nonSensitiveAttrs) { ++ pNonSensitiveAttrs[i++] = nonSensAttr; ++ } ++ hC_GetAttributeValue.invoke(hSession, hObject, ++ pNonSensitiveAttrs); ++ // libj2pkcs11 allocates new CK_ATTRIBUTE objects, so we ++ // update the reference on the previous CK_ATTRIBUTEs ++ i = 0; ++ for (CK_ATTRIBUTE nonSensAttr : nonSensitiveAttrs) { ++ nonSensAttr.pValue = pNonSensitiveAttrs[i++].pValue; ++ } ++ } ++ return; ++ } ++ } ++ hC_GetAttributeValue.invoke(hSession, hObject, pTemplate); ++ } catch (Throwable t) { ++ if (t instanceof PKCS11Exception) { ++ throw (PKCS11Exception)t; ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR, ++ t.getMessage()); ++ } ++ } ++ private static void getAttributesBySensitivity(CK_ATTRIBUTE[] pTemplate, ++ Map sensitiveAttrs, ++ List nonSensitiveAttrs) { ++ for (CK_ATTRIBUTE attr : pTemplate) { ++ long type = attr.type; ++ // Aligned with NSS' sftk_isSensitive in lib/softoken/pkcs11u.c ++ if (type == CKA_VALUE || type == CKA_PRIVATE_EXPONENT || ++ type == CKA_PRIME_1 || type == CKA_PRIME_2 || ++ type == CKA_EXPONENT_1 || type == CKA_EXPONENT_2 || ++ type == CKA_COEFFICIENT) { ++ sensitiveAttrs.put(type, attr); ++ } else { ++ nonSensitiveAttrs.add(attr); ++ } ++ } ++ } ++} + } +diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java +index 920422376f8..6aa308fa5f8 100644 +--- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java ++++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java +@@ -215,6 +215,14 @@ public class PKCS11Exception extends Exception { + return res; + } + ++ /** ++ * Constructor taking the error code from the RV enum and ++ * extra info for error message. ++ */ ++ public PKCS11Exception(RV errorEnum, String extraInfo) { ++ this(errorEnum.value, extraInfo); ++ } ++ + /** + * Constructor taking the error code (the CKR_* constants in PKCS#11) and + * extra info for error message. +diff --git a/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java b/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java +index 7f8c4dba002..e65b11fc3ee 100644 +--- a/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java ++++ b/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java +@@ -34,6 +34,7 @@ import java.security.ProviderException; + import java.util.HashMap; + import java.util.List; + ++import jdk.internal.access.SharedSecrets; + import sun.security.ec.ed.EdDSAKeyFactory; + import sun.security.ec.ed.EdDSAKeyPairGenerator; + import sun.security.ec.ed.EdDSASignature; +@@ -50,6 +51,10 @@ public final class SunEC extends Provider { + + private static final long serialVersionUID = -2279741672933606418L; + ++ private static final boolean systemFipsEnabled = ++ SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ .isSystemFipsEnabled(); ++ + private static class ProviderServiceA extends ProviderService { + ProviderServiceA(Provider p, String type, String algo, String cn, + HashMap attrs) { +@@ -240,83 +245,85 @@ public final class SunEC extends Provider { + putXDHEntries(); + putEdDSAEntries(); + +- /* +- * Signature engines +- */ +- putService(new ProviderService(this, "Signature", +- "NONEwithECDSA", "sun.security.ec.ECDSASignature$Raw", +- null, ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA1withECDSA", "sun.security.ec.ECDSASignature$SHA1", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA224withECDSA", "sun.security.ec.ECDSASignature$SHA224", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA256withECDSA", "sun.security.ec.ECDSASignature$SHA256", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA384withECDSA", "sun.security.ec.ECDSASignature$SHA384", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA512withECDSA", "sun.security.ec.ECDSASignature$SHA512", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA3-224withECDSA", "sun.security.ec.ECDSASignature$SHA3_224", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA3-256withECDSA", "sun.security.ec.ECDSASignature$SHA3_256", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA3-384withECDSA", "sun.security.ec.ECDSASignature$SHA3_384", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA3-512withECDSA", "sun.security.ec.ECDSASignature$SHA3_512", +- ATTRS)); +- +- putService(new ProviderService(this, "Signature", +- "NONEwithECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$RawinP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA1withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA1inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA224withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA224inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA256withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA256inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA384withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA384inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA512withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA512inP1363Format")); +- +- putService(new ProviderService(this, "Signature", +- "SHA3-224withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA3_224inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA3-256withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA3_256inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA3-384withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA3_384inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA3-512withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA3_512inP1363Format")); +- +- /* +- * Key Pair Generator engine +- */ +- putService(new ProviderServiceA(this, "KeyPairGenerator", +- "EC", "sun.security.ec.ECKeyPairGenerator", ATTRS)); +- +- /* +- * Key Agreement engine +- */ +- putService(new ProviderService(this, "KeyAgreement", +- "ECDH", "sun.security.ec.ECDHKeyAgreement", null, ATTRS)); ++ if (!systemFipsEnabled) { ++ /* ++ * Signature engines ++ */ ++ putService(new ProviderService(this, "Signature", ++ "NONEwithECDSA", "sun.security.ec.ECDSASignature$Raw", ++ null, ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA1withECDSA", "sun.security.ec.ECDSASignature$SHA1", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA224withECDSA", "sun.security.ec.ECDSASignature$SHA224", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA256withECDSA", "sun.security.ec.ECDSASignature$SHA256", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA384withECDSA", "sun.security.ec.ECDSASignature$SHA384", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA512withECDSA", "sun.security.ec.ECDSASignature$SHA512", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA3-224withECDSA", "sun.security.ec.ECDSASignature$SHA3_224", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA3-256withECDSA", "sun.security.ec.ECDSASignature$SHA3_256", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA3-384withECDSA", "sun.security.ec.ECDSASignature$SHA3_384", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA3-512withECDSA", "sun.security.ec.ECDSASignature$SHA3_512", ++ ATTRS)); ++ ++ putService(new ProviderService(this, "Signature", ++ "NONEwithECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$RawinP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA1withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA1inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA224withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA224inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA256withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA256inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA384withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA384inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA512withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA512inP1363Format")); ++ ++ putService(new ProviderService(this, "Signature", ++ "SHA3-224withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA3_224inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA3-256withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA3_256inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA3-384withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA3_384inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA3-512withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA3_512inP1363Format")); ++ ++ /* ++ * Key Pair Generator engine ++ */ ++ putService(new ProviderServiceA(this, "KeyPairGenerator", ++ "EC", "sun.security.ec.ECKeyPairGenerator", ATTRS)); ++ ++ /* ++ * Key Agreement engine ++ */ ++ putService(new ProviderService(this, "KeyAgreement", ++ "ECDH", "sun.security.ec.ECDHKeyAgreement", null, ATTRS)); ++ } + } + + private void putXDHEntries() { +@@ -333,23 +340,25 @@ public final class SunEC extends Provider { + "X448", "sun.security.ec.XDHKeyFactory.X448", + ATTRS)); + +- putService(new ProviderService(this, "KeyPairGenerator", +- "XDH", "sun.security.ec.XDHKeyPairGenerator", null, ATTRS)); +- putService(new ProviderServiceA(this, "KeyPairGenerator", +- "X25519", "sun.security.ec.XDHKeyPairGenerator.X25519", +- ATTRS)); +- putService(new ProviderServiceA(this, "KeyPairGenerator", +- "X448", "sun.security.ec.XDHKeyPairGenerator.X448", +- ATTRS)); +- +- putService(new ProviderService(this, "KeyAgreement", +- "XDH", "sun.security.ec.XDHKeyAgreement", null, ATTRS)); +- putService(new ProviderServiceA(this, "KeyAgreement", +- "X25519", "sun.security.ec.XDHKeyAgreement.X25519", +- ATTRS)); +- putService(new ProviderServiceA(this, "KeyAgreement", +- "X448", "sun.security.ec.XDHKeyAgreement.X448", +- ATTRS)); ++ if (!systemFipsEnabled) { ++ putService(new ProviderService(this, "KeyPairGenerator", ++ "XDH", "sun.security.ec.XDHKeyPairGenerator", null, ATTRS)); ++ putService(new ProviderServiceA(this, "KeyPairGenerator", ++ "X25519", "sun.security.ec.XDHKeyPairGenerator.X25519", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "KeyPairGenerator", ++ "X448", "sun.security.ec.XDHKeyPairGenerator.X448", ++ ATTRS)); ++ ++ putService(new ProviderService(this, "KeyAgreement", ++ "XDH", "sun.security.ec.XDHKeyAgreement", null, ATTRS)); ++ putService(new ProviderServiceA(this, "KeyAgreement", ++ "X25519", "sun.security.ec.XDHKeyAgreement.X25519", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "KeyAgreement", ++ "X448", "sun.security.ec.XDHKeyAgreement.X448", ++ ATTRS)); ++ } + } + + private void putEdDSAEntries() { +@@ -364,21 +373,23 @@ public final class SunEC extends Provider { + putService(new ProviderServiceA(this, "KeyFactory", + "Ed448", "sun.security.ec.ed.EdDSAKeyFactory.Ed448", ATTRS)); + +- putService(new ProviderService(this, "KeyPairGenerator", +- "EdDSA", "sun.security.ec.ed.EdDSAKeyPairGenerator", null, ATTRS)); +- putService(new ProviderServiceA(this, "KeyPairGenerator", +- "Ed25519", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed25519", +- ATTRS)); +- putService(new ProviderServiceA(this, "KeyPairGenerator", +- "Ed448", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed448", +- ATTRS)); +- +- putService(new ProviderService(this, "Signature", +- "EdDSA", "sun.security.ec.ed.EdDSASignature", null, ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "Ed25519", "sun.security.ec.ed.EdDSASignature.Ed25519", ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "Ed448", "sun.security.ec.ed.EdDSASignature.Ed448", ATTRS)); ++ if (!systemFipsEnabled) { ++ putService(new ProviderService(this, "KeyPairGenerator", ++ "EdDSA", "sun.security.ec.ed.EdDSAKeyPairGenerator", null, ATTRS)); ++ putService(new ProviderServiceA(this, "KeyPairGenerator", ++ "Ed25519", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed25519", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "KeyPairGenerator", ++ "Ed448", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed448", ++ ATTRS)); ++ ++ putService(new ProviderService(this, "Signature", ++ "EdDSA", "sun.security.ec.ed.EdDSASignature", null, ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "Ed25519", "sun.security.ec.ed.EdDSASignature.Ed25519", ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "Ed448", "sun.security.ec.ed.EdDSASignature.Ed448", ATTRS)); ++ } + + } + } +diff --git a/test/jdk/sun/security/pkcs11/fips/NssdbPin.java b/test/jdk/sun/security/pkcs11/fips/NssdbPin.java +new file mode 100644 +index 00000000000..ce01c655eb8 +--- /dev/null ++++ b/test/jdk/sun/security/pkcs11/fips/NssdbPin.java +@@ -0,0 +1,349 @@ ++/* ++ * Copyright (c) 2022, Red Hat, Inc. ++ * ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++import java.lang.reflect.Method; ++import java.nio.charset.StandardCharsets; ++import java.nio.file.Files; ++import java.nio.file.Path; ++import java.security.KeyStore; ++import java.security.Provider; ++import java.security.Security; ++import java.util.Arrays; ++import java.util.function.Consumer; ++import java.util.List; ++import javax.crypto.Cipher; ++import javax.crypto.spec.SecretKeySpec; ++ ++import jdk.test.lib.process.Proc; ++import jdk.test.lib.util.FileUtils; ++ ++/* ++ * @test ++ * @bug 9999999 ++ * @summary ++ * Test that the fips.nssdb.path and fips.nssdb.pin properties can be used ++ * for a successful login into an NSS DB. Some additional unitary testing ++ * is then performed. This test depends on NSS modutil and must be run in ++ * FIPS mode (the SunPKCS11-NSS-FIPS security provider has to be available). ++ * @modules jdk.crypto.cryptoki/sun.security.pkcs11:+open ++ * @library /test/lib ++ * @requires (jdk.version.major >= 8) ++ * @run main/othervm/timeout=600 NssdbPin ++ * @author Martin Balao (mbalao@redhat.com) ++ */ ++ ++public final class NssdbPin { ++ ++ // Public properties and names ++ private static final String FIPS_NSSDB_PATH_PROP = "fips.nssdb.path"; ++ private static final String FIPS_NSSDB_PIN_PROP = "fips.nssdb.pin"; ++ private static final String FIPS_PROVIDER_NAME = "SunPKCS11-NSS-FIPS"; ++ private static final String NSSDB_TOKEN_NAME = ++ "NSS FIPS 140-2 Certificate DB"; ++ ++ // Data to be tested ++ private static final String[] PINS_TO_TEST = ++ new String[] { ++ "", ++ "1234567890abcdef1234567890ABCDEF\uA4F7" ++ }; ++ private static enum PropType { SYSTEM, SECURITY } ++ private static enum LoginType { IMPLICIT, EXPLICIT } ++ ++ // Internal test fields ++ private static final boolean DEBUG = true; ++ private static class TestContext { ++ String pin; ++ PropType propType; ++ Path workspace; ++ String nssdbPath; ++ Path nssdbPinFile; ++ LoginType loginType; ++ TestContext(String pin, Path workspace) { ++ this.pin = pin; ++ this.workspace = workspace; ++ this.nssdbPath = "sql:" + workspace; ++ this.loginType = LoginType.IMPLICIT; ++ } ++ } ++ ++ public static void main(String[] args) throws Throwable { ++ if (args.length == 3) { ++ // Executed by a child process. ++ mainChild(args[0], args[1], LoginType.valueOf(args[2])); ++ } else if (args.length == 0) { ++ // Executed by the parent process. ++ mainLauncher(); ++ // Test defaults ++ mainChild("sql:/etc/pki/nssdb", "", LoginType.IMPLICIT); ++ System.out.println("TEST PASS - OK"); ++ } else { ++ throw new Exception("Unexpected number of arguments."); ++ } ++ } ++ ++ private static void mainChild(String expectedPath, String expectedPin, ++ LoginType loginType) throws Throwable { ++ if (DEBUG) { ++ for (String prop : Arrays.asList(FIPS_NSSDB_PATH_PROP, ++ FIPS_NSSDB_PIN_PROP)) { ++ System.out.println(prop + " (System): " + ++ System.getProperty(prop)); ++ System.out.println(prop + " (Security): " + ++ Security.getProperty(prop)); ++ } ++ } ++ ++ /* ++ * Functional cross-test against an NSS DB generated by modutil ++ * with the same PIN. Check that we can perform a crypto operation ++ * that requires a login. The login might be explicit or implicit. ++ */ ++ Provider p = Security.getProvider(FIPS_PROVIDER_NAME); ++ if (DEBUG) { ++ System.out.println(FIPS_PROVIDER_NAME + ": " + p); ++ } ++ if (p == null) { ++ throw new Exception(FIPS_PROVIDER_NAME + " initialization failed."); ++ } ++ if (DEBUG) { ++ System.out.println("Login type: " + loginType); ++ } ++ if (loginType == LoginType.EXPLICIT) { ++ // Do the expansion to account for truncation, so C_Login in ++ // the NSS Software Token gets a UTF-8 encoded PIN. ++ byte[] pinUtf8 = expectedPin.getBytes(StandardCharsets.UTF_8); ++ char[] pinChar = new char[pinUtf8.length]; ++ for (int i = 0; i < pinChar.length; i++) { ++ pinChar[i] = (char)(pinUtf8[i] & 0xFF); ++ } ++ KeyStore.getInstance("PKCS11", p).load(null, pinChar); ++ if (DEBUG) { ++ System.out.println("Explicit login succeeded."); ++ } ++ } ++ if (DEBUG) { ++ System.out.println("Trying a crypto operation..."); ++ } ++ final int blockSize = 16; ++ Cipher cipher = Cipher.getInstance("AES/ECB/NoPadding", p); ++ cipher.init(Cipher.ENCRYPT_MODE, ++ new SecretKeySpec(new byte[blockSize], "AES")); ++ if (cipher.doFinal(new byte[blockSize]).length != blockSize) { ++ throw new Exception("Could not perform a crypto operation."); ++ } ++ if (DEBUG) { ++ if (loginType == LoginType.IMPLICIT) { ++ System.out.println("Implicit login succeeded."); ++ } ++ System.out.println("Crypto operation after login succeeded."); ++ } ++ ++ if (loginType == LoginType.IMPLICIT) { ++ /* ++ * Additional unitary testing. Expected to succeed at this point. ++ */ ++ if (DEBUG) { ++ System.out.println("Trying unitary test..."); ++ } ++ String sysPathProp = System.getProperty(FIPS_NSSDB_PATH_PROP); ++ if (DEBUG) { ++ System.out.println("Path value (as a System property): " + ++ sysPathProp); ++ } ++ if (!expectedPath.equals(sysPathProp)) { ++ throw new Exception("Path is different than expected: " + ++ sysPathProp + " (actual) vs " + expectedPath + ++ " (expected)."); ++ } ++ Class c = Class ++ .forName("sun.security.pkcs11.FIPSTokenLoginHandler"); ++ Method m = c.getDeclaredMethod("getFipsNssdbPin"); ++ m.setAccessible(true); ++ String pin = null; ++ char[] pinChar = (char[]) m.invoke(c); ++ if (pinChar != null) { ++ byte[] pinUtf8 = new byte[pinChar.length]; ++ for (int i = 0; i < pinUtf8.length; i++) { ++ pinUtf8[i] = (byte) pinChar[i]; ++ } ++ pin = new String(pinUtf8, StandardCharsets.UTF_8); ++ } ++ if (!expectedPin.isEmpty() && !expectedPin.equals(pin) || ++ expectedPin.isEmpty() && pin != null) { ++ throw new Exception("PIN is different than expected: '" + pin + ++ "' (actual) vs '" + expectedPin + "' (expected)."); ++ } ++ if (DEBUG) { ++ System.out.println("PIN value: " + pin); ++ System.out.println("Unitary test succeeded."); ++ } ++ } ++ } ++ ++ private static void mainLauncher() throws Throwable { ++ for (String pin : PINS_TO_TEST) { ++ Path workspace = Files.createTempDirectory(null); ++ try { ++ TestContext ctx = new TestContext(pin, workspace); ++ createNSSDB(ctx); ++ { ++ ctx.loginType = LoginType.IMPLICIT; ++ for (PropType propType : PropType.values()) { ++ ctx.propType = propType; ++ pinLauncher(ctx); ++ envLauncher(ctx); ++ fileLauncher(ctx); ++ } ++ } ++ explicitLoginLauncher(ctx); ++ } finally { ++ FileUtils.deleteFileTreeWithRetry(workspace); ++ } ++ } ++ } ++ ++ private static void pinLauncher(TestContext ctx) throws Throwable { ++ launchTest(p -> {}, "pin:" + ctx.pin, ctx); ++ } ++ ++ private static void envLauncher(TestContext ctx) throws Throwable { ++ final String NSSDB_PIN_ENV_VAR = "NSSDB_PIN_ENV_VAR"; ++ launchTest(p -> p.env(NSSDB_PIN_ENV_VAR, ctx.pin), ++ "env:" + NSSDB_PIN_ENV_VAR, ctx); ++ } ++ ++ private static void fileLauncher(TestContext ctx) throws Throwable { ++ // The file containing the PIN (ctx.nssdbPinFile) was created by the ++ // generatePinFile method, called from createNSSDB. ++ launchTest(p -> {}, "file:" + ctx.nssdbPinFile, ctx); ++ } ++ ++ private static void explicitLoginLauncher(TestContext ctx) ++ throws Throwable { ++ ctx.loginType = LoginType.EXPLICIT; ++ ctx.propType = PropType.SYSTEM; ++ launchTest(p -> {}, "Invalid PIN, must be ignored", ctx); ++ } ++ ++ private static void launchTest(Consumer procCb, String pinPropVal, ++ TestContext ctx) throws Throwable { ++ if (DEBUG) { ++ System.out.println("Launching JVM with " + FIPS_NSSDB_PATH_PROP + ++ "=" + ctx.nssdbPath + " and " + FIPS_NSSDB_PIN_PROP + ++ "=" + pinPropVal); ++ } ++ Proc p = Proc.create(NssdbPin.class.getName()) ++ .args(ctx.nssdbPath, ctx.pin, ctx.loginType.name()); ++ if (ctx.propType == PropType.SYSTEM) { ++ p.prop(FIPS_NSSDB_PATH_PROP, ctx.nssdbPath); ++ p.prop(FIPS_NSSDB_PIN_PROP, pinPropVal); ++ // Make sure that Security properties defaults are not used. ++ p.secprop(FIPS_NSSDB_PATH_PROP, ""); ++ p.secprop(FIPS_NSSDB_PIN_PROP, ""); ++ } else if (ctx.propType == PropType.SECURITY) { ++ p.secprop(FIPS_NSSDB_PATH_PROP, ctx.nssdbPath); ++ pinPropVal = escapeForPropsFile(pinPropVal); ++ p.secprop(FIPS_NSSDB_PIN_PROP, pinPropVal); ++ } else { ++ throw new Exception("Unsupported property type."); ++ } ++ if (DEBUG) { ++ p.inheritIO(); ++ p.prop("java.security.debug", "sunpkcs11"); ++ p.debug(NssdbPin.class.getName()); ++ ++ // Need the launched process to connect to a debugger? ++ //System.setProperty("test.vm.opts", "-Xdebug -Xrunjdwp:" + ++ // "transport=dt_socket,address=localhost:8000,suspend=y"); ++ } else { ++ p.nodump(); ++ } ++ procCb.accept(p); ++ p.start().waitFor(0); ++ } ++ ++ private static String escapeForPropsFile(String str) throws Throwable { ++ StringBuffer sb = new StringBuffer(); ++ for (int i = 0; i < str.length(); i++) { ++ int cp = str.codePointAt(i); ++ if (Character.UnicodeBlock.of(cp) ++ == Character.UnicodeBlock.BASIC_LATIN) { ++ sb.append(Character.toChars(cp)); ++ } else { ++ sb.append("\\u").append(String.format("%04X", cp)); ++ } ++ } ++ return sb.toString(); ++ } ++ ++ private static void createNSSDB(TestContext ctx) throws Throwable { ++ ProcessBuilder pb = getModutilPB(ctx, "-create"); ++ if (DEBUG) { ++ System.out.println("Creating an NSS DB in " + ctx.workspace + ++ "..."); ++ System.out.println("cmd: " + String.join(" ", pb.command())); ++ } ++ if (pb.start().waitFor() != 0) { ++ throw new Exception("NSS DB creation failed."); ++ } ++ generatePinFile(ctx); ++ pb = getModutilPB(ctx, "-changepw", NSSDB_TOKEN_NAME, ++ "-newpwfile", ctx.nssdbPinFile.toString()); ++ if (DEBUG) { ++ System.out.println("NSS DB created."); ++ System.out.println("Changing NSS DB PIN..."); ++ System.out.println("cmd: " + String.join(" ", pb.command())); ++ } ++ if (pb.start().waitFor() != 0) { ++ throw new Exception("NSS DB PIN change failed."); ++ } ++ if (DEBUG) { ++ System.out.println("NSS DB PIN changed."); ++ } ++ } ++ ++ private static ProcessBuilder getModutilPB(TestContext ctx, String... args) ++ throws Throwable { ++ ProcessBuilder pb = new ProcessBuilder("modutil", "-force"); ++ List pbCommand = pb.command(); ++ if (args != null) { ++ pbCommand.addAll(Arrays.asList(args)); ++ } ++ pbCommand.add("-dbdir"); ++ pbCommand.add(ctx.nssdbPath); ++ if (DEBUG) { ++ pb.inheritIO(); ++ } else { ++ pb.redirectError(ProcessBuilder.Redirect.INHERIT); ++ } ++ return pb; ++ } ++ ++ private static void generatePinFile(TestContext ctx) throws Throwable { ++ ctx.nssdbPinFile = Files.createTempFile(ctx.workspace, null, null); ++ Files.writeString(ctx.nssdbPinFile, ctx.pin + System.lineSeparator() + ++ "2nd line with garbage"); ++ } ++} +diff --git a/test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java b/test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java +new file mode 100644 +index 00000000000..87f1ad04505 +--- /dev/null ++++ b/test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java +@@ -0,0 +1,77 @@ ++/* ++ * Copyright (c) 2022, Red Hat, Inc. ++ * ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++import java.security.Provider; ++import java.security.Security; ++ ++/* ++ * @test ++ * @bug 9999999 ++ * @requires (jdk.version.major >= 8) ++ * @run main/othervm/timeout=30 VerifyMissingAttributes ++ * @author Martin Balao (mbalao@redhat.com) ++ */ ++ ++public final class VerifyMissingAttributes { ++ ++ private static final String[] svcAlgImplementedIn = { ++ "AlgorithmParameterGenerator.DSA", ++ "AlgorithmParameters.DSA", ++ "CertificateFactory.X.509", ++ "KeyStore.JKS", ++ "KeyStore.CaseExactJKS", ++ "KeyStore.DKS", ++ "CertStore.Collection", ++ "CertStore.com.sun.security.IndexedCollection" ++ }; ++ ++ public static void main(String[] args) throws Throwable { ++ Provider sunProvider = Security.getProvider("SUN"); ++ for (String svcAlg : svcAlgImplementedIn) { ++ String filter = svcAlg + " ImplementedIn:Software"; ++ doQuery(sunProvider, filter); ++ } ++ if (Double.parseDouble( ++ System.getProperty("java.specification.version")) >= 17) { ++ String filter = "KeyFactory.RSASSA-PSS SupportedKeyClasses:" + ++ "java.security.interfaces.RSAPublicKey" + ++ "|java.security.interfaces.RSAPrivateKey"; ++ doQuery(Security.getProvider("SunRsaSign"), filter); ++ } ++ System.out.println("TEST PASS - OK"); ++ } ++ ++ private static void doQuery(Provider expectedProvider, String filter) ++ throws Exception { ++ if (expectedProvider == null) { ++ throw new Exception("Provider not found."); ++ } ++ Provider[] providers = Security.getProviders(filter); ++ if (providers == null || providers.length != 1 || ++ providers[0] != expectedProvider) { ++ throw new Exception("Failure retrieving the provider with this" + ++ " query: " + filter); ++ } ++ } ++} diff --git a/fips-25u-df044414ef4.patch b/fips-25u-df044414ef4.patch deleted file mode 100644 index 8b210e6..0000000 --- a/fips-25u-df044414ef4.patch +++ /dev/null @@ -1,92 +0,0 @@ -diff --git a/src/java.base/share/classes/java/security/Provider.java b/src/java.base/share/classes/java/security/Provider.java -index de2845fb550..b1e416b90f4 100644 ---- a/src/java.base/share/classes/java/security/Provider.java -+++ b/src/java.base/share/classes/java/security/Provider.java -@@ -1203,6 +1203,39 @@ public Set getServices() { - return serviceSet; - } - -+ /* vvvvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvvvv */ -+ private static final class RedHatFIPSFilter { -+ static final boolean IS_ON = Boolean.parseBoolean( -+ Security.getProperty("__redhat_fips_filter__")); -+ private static final Set ANY_SERVICE_TYPE = Set.of(); -+ private static final Map> ALLOW_LIST = Map.of( -+ "SunPKCS11-FIPS", ANY_SERVICE_TYPE, -+ "SUN", Set.of( -+ "AlgorithmParameterGenerator", -+ "AlgorithmParameters", "CertificateFactory", -+ "CertPathBuilder", "CertPathValidator", "CertStore", -+ "Configuration", "KeyStore"), -+ "SunEC", Set.of( -+ "AlgorithmParameters", "KeyFactory"), -+ "SunJSSE", ANY_SERVICE_TYPE, -+ "SunJCE", Set.of( -+ "AlgorithmParameters", -+ "AlgorithmParameterGenerator", "KeyFactory", -+ "SecretKeyFactory"), -+ "SunRsaSign", Set.of( -+ "KeyFactory", "AlgorithmParameters"), -+ "XMLDSig", ANY_SERVICE_TYPE -+ ); -+ -+ static boolean isAllowed(String provName, String serviceType) { -+ Set allowedServiceTypes = ALLOW_LIST.get(provName); -+ return allowedServiceTypes != null && -+ (allowedServiceTypes == ANY_SERVICE_TYPE || -+ allowedServiceTypes.contains(serviceType)); -+ } -+ } -+ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ */ -+ - /** - * Add a service. If a service of the same type with the same algorithm - * name exists, and it was added using {@link #putService putService()}, -@@ -1231,6 +1264,15 @@ protected void putService(Service s) { - ("service.getProvider() must match this Provider object"); - } - String type = s.getType(); -+ /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */ -+ if (RedHatFIPSFilter.IS_ON && !RedHatFIPSFilter.isAllowed(name, type)) { -+ if (debug != null) { -+ debug.println("The previous " + name + ".putService() call " + -+ "was skipped by " + RedHatFIPSFilter.class.getName()); -+ } -+ return; -+ } -+ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */ - String algorithm = s.getAlgorithm(); - ServiceKey key = new ServiceKey(type, algorithm, true); - implRemoveService(serviceMap.get(key)); -diff --git a/src/java.base/share/classes/java/security/Security.java b/src/java.base/share/classes/java/security/Security.java -index 6969fe8a8e1..4501d5971c4 100644 ---- a/src/java.base/share/classes/java/security/Security.java -+++ b/src/java.base/share/classes/java/security/Security.java -@@ -323,7 +323,27 @@ public Properties getInitialProperties() { - } - - private static void initialize() { -+ /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */ -+ /* This 'include'-directives-only magic property is an internal */ -+ /* implementation detail that could (and probably will!) change. */ -+ /* Red Hat customers should NOT rely on this for their own use. */ -+ String fipsKernelFlag = "/proc/sys/crypto/fips_enabled"; -+ boolean fipsModeOn; -+ try (InputStream is = new java.io.FileInputStream(fipsKernelFlag)) { -+ fipsModeOn = is.read() == '1'; -+ } catch (IOException ioe) { -+ fipsModeOn = false; -+ if (sdebug != null) { -+ sdebug.println("Failed to read FIPS kernel file: " + ioe); -+ } -+ } -+ String fipsMagicPropName = "__redhat_fips__"; -+ System.setProperty(fipsMagicPropName, "" + fipsModeOn); -+ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */ - SecPropLoader.loadAll(); -+ /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */ -+ System.clearProperty(fipsMagicPropName); -+ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */ - initialSecurityProperties = (Properties) props.clone(); - if (sdebug != null) { - for (String key : props.stringPropertyNames()) { diff --git a/scripts/generate_source_tarball.sh b/generate_source_tarball.sh similarity index 70% rename from scripts/generate_source_tarball.sh rename to generate_source_tarball.sh index e01043d..9a0e233 100755 --- a/scripts/generate_source_tarball.sh +++ b/generate_source_tarball.sh @@ -1,10 +1,6 @@ #!/bin/bash # Copyright (C) 2024 Red Hat, Inc. -# Written by: -# Andrew John Hughes -# Thomas Fitzsimmons -# Jiri Vanek # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU Affero General Public License as @@ -19,46 +15,42 @@ # You should have received a copy of the GNU Affero General Public License # along with this program. If not, see . -# Generates the source tarball for OpenJDK projects. -# -# There are multiple ways to specify the source code location and version: -# -# 1. Specify the version (VERSION), the location of the Git repository -# (REPO_ROOT) and the root of the output tarball name (FILE_NAME_ROOT) -# 2. Specify the version (VERSION) along with an upstream project name -# (PROJECT_NAME) and repository name (REPO_NAME) that can be used -# to construct the URL of the upstream OpenJDK repository. -# 3. Specify OPENJDK_LATEST=1 and allow the script to obtain the JDK -# feature version from the spec file, which is then used to -# obtain the latest build promotion from the upstream repository. -# -# An appropriate bootstrap JDK is also required for when ./configure -# is run within the checked out repository to generate the .src-rev. -# file. This can be specified by setting BOOT_JDK. +# Generates the 'source tarball' for JDK projects. # # Example 1: -# This will check out the specified version from the specified -# repository and construct a tarball called openjdk-17.0.3+5.tar.xz: -# -# $ VERSION=jdk-17.0.3+5 FILE_NAME_ROOT=open${VERSION} \ -# REPO_ROOT=$HOME/projects/openjdk/upstream/17u \ -# BOOT_JDK=/usr/lib/jvm/java-17-openjdk ./generate_source_tarball.sh +# When used from local repo set REPO_ROOT pointing to file:// with your repo. +# If your local repo follows upstream forests conventions, it may be enough to +# set OPENJDK_URL. # # Example 2: -# This will check out the same version as example 1, but from the -# upstream repository: -# -# $ VERSION=jdk-25+36 PROJECT_NAME=openjdk REPO_NAME=jdk25u \ -# BOOT_JDK=/usr/lib/jvm/java-17-openjdk sh scripts/generate_source_tarball.sh -# -# Example 3: # This will read the OpenJDK feature version from the spec file, then create a # tarball from the most recent tag for that version in the upstream Git # repository. # -# $ OPENJDK_LATEST=1 \ -# BOOT_JDK=/usr/lib/jvm/java-17-openjdk ./generate_source_tarball.sh +# $ OPENJDK_LATEST=1 ./generate_source_tarball.sh +# [...] +# Tarball is: temp-generated-source-tarball-ujD/openjdk-17.0.10+6-ea.tar.xz # +# Unless you use OPENJDK_LATEST, you have to set PROJECT_NAME, REPO_NAME and +# VERSION, e.g.: +# +# PROJECT_NAME=openjdk +# REPO_NAME=jdk24u +# VERSION=jdk-24.0.1+9 +# +# or to e.g., prepare systemtap, icedtea7's jstack and other tapsets: +# +# VERSION=6327cf1cea9e +# REPO_NAME=icedtea7-2.6 +# PROJECT_NAME=release +# OPENJDK_URL=http://icedtea.classpath.org/hg/ +# TO_COMPRESS="*/tapset" +# +# They are used to create correct name and are used in construction of sources +# URL (unless REPO_ROOT is set). +# +# This script creates a single source tarball out of the repository based on the +# given tag and removes code not allowed in Fedora/RHEL. set -e @@ -122,7 +114,7 @@ if [ "$OPENJDK_LATEST" != "" ] ; then fi if [ "$WITH_TEMP" != "" ] ; then - pushd "$(mktemp --directory --tmpdir temp-generated-source-tarball-XXX)" + pushd "$(mktemp --directory temp-generated-source-tarball-XXX)" fi if [ "$VERSION" = "" ] ; then @@ -208,25 +200,18 @@ echo -e "\tFILE_NAME_ROOT: ${FILE_NAME_ROOT}" echo -e "\tREPO_ROOT: ${REPO_ROOT}" echo -e "\tTO_COMPRESS: ${TO_COMPRESS}" echo -e "\tBOOT_JDK: ${BOOT_JDK}" -echo -e "\tWITH_TEMP: ${WITH_TEMP}" -echo -e "\tOPENJDK_LATEST: ${OPENJDK_LATEST}" if [ -d "${FILE_NAME_ROOT}" ] ; then - echo "Reusing existing ${FILE_NAME_ROOT}" + echo "exists exists exists exists exists exists exists " + echo "reusing reusing reusing reusing reusing reusing " + echo "${FILE_NAME_ROOT}" STAT_TIME="$(stat --format=%Y "${FILE_NAME_ROOT}")" TAR_TIME="$(date --date=@"${STAT_TIME}" --iso-8601=seconds)" else mkdir "${FILE_NAME_ROOT}" pushd "${FILE_NAME_ROOT}" echo "Cloning ${VERSION} root repository from ${REPO_ROOT}" - if realpath -q "${REPO_ROOT}"; then - echo "Local path detected; not adding depth argument"; - DEPTH="--"; - else - DEPTH="--depth=1"; - echo "Remote repository detected; adding ${DEPTH}"; - fi - git clone -b "${VERSION}" "${DEPTH}" "${REPO_ROOT}" "${VERSION}" + git clone --depth=1 -b "${VERSION}" "${REPO_ROOT}" "${VERSION}" pushd "${VERSION}" TAR_TIME="$(git log --max-count 1 --format=%cI)" popd @@ -242,44 +227,39 @@ pushd "${FILE_NAME_ROOT}" popd rm -rf build - # Remove commit checks - echo "Removing $(find "${VERSION}" -name '.jcheck' -print)" - find "${VERSION}" -name '.jcheck' -print0 | xargs -0 rm -r - - # Remove history and GHA - echo "find ${VERSION} -name '.hgtags'" - find "${VERSION}" -name '.hgtags' -exec rm -v '{}' '+' - echo "find ${VERSION} -name '.hgignore'" - find "${VERSION}" -name '.hgignore' -exec rm -v '{}' '+' - echo "find ${VERSION} -name '.gitattributes'" - find "${VERSION}" -name '.gitattributes' -exec rm -v '{}' '+' - echo "find ${VERSION} -name '.gitignore'" - find "${VERSION}" -name '.gitignore' -exec rm -v '{}' '+' - # Work around some Git objects not having write permissions. - echo "chmod --recursive u+w ${VERSION}/.git" - chmod --recursive u+w "${VERSION}"/.git - echo "find ${VERSION} -name '.git'" - find "${VERSION}" -name '.git' -exec rm -rv '{}' '+' - echo "find ${VERSION} -name '.github'" - find "${VERSION}" -name '.github' -exec rm -rv '{}' '+' - + EA_PART="$(awk -F= \ + '/^DEFAULT_PROMOTED_VERSION_PRE/ { if ($2) print "-"$2 }' \ + "${VERSION}"/make/conf/version-numbers.conf)" + TARBALL_BASE=${FILE_NAME_ROOT}${EA_PART}.tar + pushd "${VERSION}" + # Omit commit checks, history, and GHA from archive. + for skip in .jcheck .hgtags .hgignore .gitattributes .gitignore .github + do + echo "${skip}"" export-ignore" >> .git/info/attributes + done + # Do not bother with --mtime here; specify it to tar below. + # Unforunately, git-archive sorts added files like .src-rev at the end; + # retar below to use GNU tar --sort=name ordering which sorts .src-rev + # at the start. + git archive --output "${TARBALL_BASE}" --prefix="${VERSION}"/ \ + --add-file=.src-rev --format=tar "${VERSION}" + popd + mv "${VERSION}" "${VERSION}".git + tar xf "${VERSION}".git/"${TARBALL_BASE}" echo "Compressing remaining forest" if [ "$COMPRESSION" = "xz" ] ; then SWITCH=cJf else SWITCH=czf fi - EA_PART="$(awk -F= \ - '/^DEFAULT_PROMOTED_VERSION_PRE/ { if ($2) print "-"$2 }' \ - "${VERSION}"/make/conf/version-numbers.conf)" - TARBALL_NAME=${FILE_NAME_ROOT}${EA_PART}.tar.${COMPRESSION} + TARBALL_NAME=`echo ${TARBALL_BASE}.${COMPRESSION} | sed "s/-jdk-/-/g"` XZ_OPT=${XZ_OPT-"-T0"} \ tar --mtime="${TAR_TIME}" --owner=root --group=root --sort=name \ - --exclude-vcs -$SWITCH "${TARBALL_NAME}" "${TO_COMPRESS}" + -$SWITCH "${TARBALL_NAME}" "${TO_COMPRESS}" mv "${TARBALL_NAME}" .. popd if [ "$WITH_TEMP" != "" ] ; then - echo "Tarball is: $(realpath .)/${TARBALL_NAME}" + echo "Tarball is: $(realpath --relative-to=.. .)/${TARBALL_NAME}" popd else echo -n "Done. You may want to remove the uncompressed version" diff --git a/scripts/icedtea_sync.sh b/icedtea_sync.sh similarity index 100% rename from scripts/icedtea_sync.sh rename to icedtea_sync.sh diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index 16bb5eb..c7ee334 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -1,5 +1,10 @@ +%if (0%{?rhel} > 0 && 0%{?rhel} < 8) +# portable jdk 17 specific bug, _jvmdir being missing +%define _jvmdir /usr/lib/jvm +%endif + # debug_package %%{nil} is portable-jdks specific -%define debug_package %{nil} +%define debug_package %{nil} # RPM conditionals so as to be able to dynamically produce # slowdebug/release builds. See: @@ -31,9 +36,10 @@ # Build with system libraries %bcond_with system_libs + +%if (0%{?rhel} > 0 && 0%{?rhel} < 8) # This is RHEL 7 specific as it doesn't seem to have the # __brp_strip_static_archive macro. -%if 0%{?rhel} == 7 %define __os_install_post %{nil} %endif @@ -60,10 +66,6 @@ # See: https://bugzilla.redhat.com/show_bug.cgi?id=1520879 %global _find_debuginfo_opts -g -# Disable LTO as this causes build failures at the moment. -# See RHBZ#1861401 -%define _lto_cflags %{nil} - # note: parametrized macros are order-sensitive (unlike not-parametrized) even with normal macros # also necessary when passing it as parameter to other macros. If not macro, then it is considered a switch # see the difference between global and define: @@ -145,7 +147,7 @@ # However, it does segfault on the Zero assembler port, so currently JIT only %global share_arches %{jit_arches} # Set of architectures for which we build the Shenandoah garbage collector -%global shenandoah_arches x86_64 %{aarch64} riscv64 +%global shenandoah_arches x86_64 %{aarch64} # Set of architectures for which we build the Z garbage collector %global zgc_arches x86_64 riscv64 # Set of architectures for which alt-java has SSB mitigation @@ -159,8 +161,6 @@ %else %global gdb_arches %{jit_arches} %{zero_arches} %endif -# Architecture on which we run Java only tests -%global jdk_test_arch x86_64 # By default, we build a slowdebug build during main build on JIT architectures %if %{with slowdebug} @@ -228,7 +228,7 @@ # other targets since this target is configured to use in-tree # AWT dependencies: lcms, libjpeg, libpng, libharfbuzz, giflib # and possibly others -%global static_libs_target static-libs-graal-image +%global static_libs_target static-libs-image %else %global static_libs_target %{nil} %endif @@ -244,83 +244,12 @@ # Target to use to just build HotSpot %global hotspot_target hotspot +# DTS toolset to use to provide gcc & binutils +%global dtsversion 10 -# Individual build frameworks this specfile supports -# if elif ... elif ... elif ... else is unluckily buggy -# On rhel7 we need software collection -%if (0%{?rhel} == 7) -%global is_dtstoolchain collection -%global dtsversion 10 -%global dtsname devtoolset-%{dtsversion} -%global dts_command scl enable %{dtsname} -- -%global exclusive_arches %{nil} -%define dts_brs # Brs for collection\ -BuildRequires: %{dtsname}-gcc \ -BuildRequires: %{dtsname}-gcc-c++ -%else -# On rhel8 we have self built custom devkit -%if ((0%{?rhel} == 8) && (0%{?epel} == 0)) -%global is_dtstoolchain devkit -%global dtsversion 1.0-9 -%global dtsname %{origin}-devkit -%global dts_command %{nil} -%if 0%{?centos} == 0 -# centos had originally smaller set of devkit arches -%global exclusive_arches %{aarch64} %{ppc64le} s390x x86_64 riscv64 -%else -%global exclusive_arches %{aarch64} %{ppc64le} s390x x86_64 riscv64 -%endif -%define dts_brs # Brs for devkit\ -BuildRequires: %{dtsname} >= %{dtsversion} -%else -# On newest systems we use system gcc and friens -%if ((0%{?fedora} > 0) || (0%{?rhel} >= 9) || (0%{?epel} >= 9)) -%global is_dtstoolchain system -%global dtsversion %{nil} -%global dtsname %{nil} -%global exclusive_arches %{java_arches} -%define dts_brs # Brs for system\ -BuildRequires: gcc >= 4.8.3-8 \ -BuildRequires: gcc-c++ \ -# We link statically against libstdc++ to increase portability \ -BuildRequires: libstdc++-static -# When building on epel8, we need system, legacy toolchain of explicit version -%else -%if ((0%{?epel}) > 0 && (0%{?epel} <= 8)) -%global is_dtstoolchain toolset -%global dtsversion 14 -%global dtsname gcc-toolset-%{dtsversion} -%global exclusive_arches %{java_arches} -%define dts_brs # Brs for toolset\ -BuildRequires: %{dtsname}-gcc \ -BuildRequires: %{dtsname}-gcc-c++ \ -BuildRequires: %{dtsname}-annobin-annocheck \ -BuildRequires: %{dtsname}-annobin-plugin-gcc \ -BuildRequires: %{dtsname}-binutils \ -BuildRequires: %{dtsname}-gcc-plugin-annobin \ -# We link statically against libstdc++ to increase portability \ -BuildRequires: libstdc++-static -# no go -%else -"Unsupported system: fedora=0%{?fedora} rhel=0%{?rhel} epel=0%{?epel} centos=0%{?centos}" -exit 1 -%endif -%endif -%endif -%endif - -%if ((0%{?epel}) > 0 || (0%{?fedora} > 8)) -%global use_portable_bootjdk 0 -%else -%global use_portable_bootjdk 1 -%endif - -# Check if pandoc is available to generate docs (including man pages) -%if 0%{?rhel} == 8 || 0%{?epel} > 0 || 0%{?fedora} > 0 -%global pandoc_available 1 -%else -%global pandoc_available 0 -%endif +# Disable LTO as this causes build failures at the moment. +# See RHBZ#1861401 +%define _lto_cflags %{nil} # Filter out flags from the optflags macro that cause problems with the OpenJDK build # We filter out -O flags so that the optimization of HotSpot is not lowered from O3 to O2 @@ -395,23 +324,25 @@ exit 1 %global stapinstall %{nil} %endif -# on fedora and epel, we build systemtap in repacking to rpms -# thus having it disabled, and keeping the lines just for sync reasons %ifarch %{systemtap_arches} +%if (0%{?rhel} > 0 && !0%{?epel}) +%global with_systemtap 1 +%else %global with_systemtap 0 +%endif %else %global with_systemtap 0 %endif # New Version-String scheme-style defines -%global featurever 26 +%global featurever 24 %global interimver 0 -%global updatever 0 +%global updatever 1 %global patchver 0 # buildjdkver is usually same as %%{featurever}, # but in time of bootstrap of next jdk, it is featurever-1, # and this it is better to change it here, on single place -%global buildjdkver 25 +%global buildjdkver 24 # We don't add any LTS designator for STS packages (Fedora and EPEL). # We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined. %if 0%{?rhel} && !0%{?epel} @@ -421,6 +352,16 @@ exit 1 %global lts_designator "" %global lts_designator_zip "" %endif +# JDK to use for bootstrapping +%global bootjdk /usr/lib/jvm/java-%{buildjdkver}-openjdk +# Define whether to use the bootstrap JDK directly or with a fresh libjvm.so +# This will only work where the bootstrap JDK is the same major version +# as the JDK being built +%if %{with fresh_libjvm} && %{buildjdkver} == %{featurever} +%global build_hotspot_first 1 +%else +%global build_hotspot_first 0 +%endif # Define vendor information used by OpenJDK %global oj_vendor Red Hat, Inc. @@ -446,7 +387,7 @@ exit 1 # Define IcedTea version used for SystemTap tapsets and desktop file %global icedteaver 6.0.0pre00-c848b93a8598 # Define current Git revision for the FIPS support patches -%global fipsver df044414ef4 +%global fipsver 75ffdc48eda # Define JDK versions %global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver} %global javaver %{featurever} @@ -460,7 +401,7 @@ exit 1 %global origin_nice OpenJDK %global top_level_dir_name %{vcstag} %global top_level_dir_name_backup %{top_level_dir_name}-backup -%global buildver 29 +%global buildver 9 %global rpmrelease 1 #%%global tagsuffix %%{nil} # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit @@ -480,7 +421,7 @@ exit 1 # Release will be (where N is usually a number starting at 1): # - 0.N%%{?extraver}%%{?dist} for EA releases, # - N%%{?extraver}{?dist} for GA releases -%global is_ga 0 +%global is_ga 1 %if %{is_ga} %global build_type GA %global ea_designator "" @@ -500,7 +441,7 @@ exit 1 %global fullversion %{compatiblename}-%{version}-%{release} # images directories from upstream build %global jdkimage jdk -%global static_libs_image static-libs-graal +%global static_libs_image static-libs # output dir stub %define buildoutputdir() %{expand:build/jdk%{featurever}.build%{?1}} %define installoutputdir() %{expand:install/jdk%{featurever}.install%{?1}} @@ -513,16 +454,11 @@ exit 1 %define uniquesuffix() %{expand:%{fullversion}.%{_arch}%{?1}} # portable only declarations %global jreimage jre -%if ((0%{?fedora} > 0) || (0%{?epel} > 0)) -%define regexBase %{version}-%{release} -%else -%define regexBase el%{rhel}\\(_[0-9]\\)* -%endif -%define jreportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.jre;g" | sed "s;openjdkportable;el;g") -%define jdkportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.jdk;g" | sed "s;openjdkportable;el;g") -%define jdkportablesourcesnameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.sources;g" | sed "s;openjdkportable;el;g" | sed "s;.%{_arch};.noarch;g") -%define staticlibsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.static-libs;g" | sed "s;openjdkportable;el;g") -%define jmodsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.jmods;g" | sed "s;openjdkportable;el;g") +%define jreportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable%{1}.jre;g" | sed "s;openjdkportable;el;g") +%define jdkportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable%{1}.jdk;g" | sed "s;openjdkportable;el;g") +%define jdkportablesourcesnameimpl() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable%{1}.sources;g" | sed "s;openjdkportable;el;g" | sed "s;.%{_arch};.noarch;g") +%define staticlibsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable%{1}.static-libs;g" | sed "s;openjdkportable;el;g") +%define jmodsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable%{1}.jmods;g" | sed "s;openjdkportable;el;g") %define jreportablearchive() %{expand:%{jreportablenameimpl -- %%{1}}.tar.xz} %define jdkportablearchive() %{expand:%{jdkportablenameimpl -- %%{1}}.tar.xz} %define jdkportablesourcesarchive() %{expand:%{jdkportablesourcesnameimpl -- %%{1}}.tar.xz} @@ -534,9 +470,9 @@ exit 1 # Intentionally use jdkportablenameimpl here since we want to have static-libs files overlayed on # top of the JDK archive %define staticlibsportablename() %{expand:%{jdkportablenameimpl -- %%{1}}} -%define docportablename() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable.docs;g" | sed "s;openjdkportable;el;g") +%define docportablename() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable.docs;g" | sed "s;openjdkportable;el;g") %define docportablearchive() %{docportablename}.tar.xz -%define miscportablename() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable.misc;g" | sed "s;openjdkportable;el;g") +%define miscportablename() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable.misc;g" | sed "s;openjdkportable;el;g") %define miscportablearchive() %{miscportablename}.tar.xz # RPM 4.19 no longer accept our double percentaged %%{nil} passed to %%{1} @@ -547,29 +483,6 @@ exit 1 %define staticlibsportablearchiveForFiles() %(echo %{staticlibsportablearchive -- ""}) %define jmodsportablearchiveForFiles() %(echo %{jmodsportablearchive -- ""}) -# JDK to use for bootstrapping -%ifarch %{fastdebug_arches} -%global bootdebugpkg fastdebug -%endif -%if %{use_portable_bootjdk} -%global bootjdkpkg_name java-%{featurever}-%{origin} -%global bootjdkpkg %{bootjdkpkg_name}-portable-devel%{?bootdebugpkg:-%{bootdebugpkg}} >= %{buildjdkver} -%global bootjdkzip %{_jvmdir}/%{bootjdkpkg_name}-*.portable%{?bootdebugpkg:.%{bootdebugpkg}}.jdk.%{_arch}.tar.xz -%global bootjdk %{_builddir}/%{uniquesuffix -- ""}/%{bootjdkpkg_name}.boot -%else -%global bootjdkpkg_name java-latest-openjdk -%global bootjdkpkg %{bootjdkpkg_name}-devel%{?bootdebugpkg:-%{bootdebugpkg}} -%global bootjdk /usr/lib/jvm/%{bootjdkpkg_name}%{?bootdebugpkg:-%{bootdebugpkg}} -%endif -# Define whether to use the bootstrap JDK directly or with a fresh libjvm.so -# This will only work where the bootstrap JDK is the same major version -# as the JDK being built -%if %{with fresh_libjvm} && %{buildjdkver} == %{featurever} -%global build_hotspot_first 1 -%else -%global build_hotspot_first 0 -%endif - ################################################################# # fix for https://bugzilla.redhat.com/show_bug.cgi?id=1111349 # https://bugzilla.redhat.com/show_bug.cgi?id=1590796#c14 @@ -619,6 +532,13 @@ exit 1 %global alternatives_requires %{_sbindir}/alternatives %endif +# x86 is no longer supported +%if 0%{?java_arches:1} +ExclusiveArch: %{java_arches} +%else +ExcludeArch: %{ix86} +%endif + # Portables have no repo (requires/provides), but these are awesome for orientation in spec # Also scriptlets are happily missing and files are handled old fashion # not-duplicated requires/provides/obsoletes for normal/debug packages @@ -631,6 +551,9 @@ exit 1 %define java_static_libs_rpo() %{expand: } +%define java_unstripped_rpo() %{expand: +} + %define java_docs_rpo() %{expand: } @@ -644,15 +567,6 @@ exit 1 # this expression, when declared as global, filled component with java-x-vendor portable %define component %(echo %{name} | sed "s;-portable%{?pkgos:-%{pkgos}};;g") -# Define the architectures on which we build -# On RHEL, this should be the architectures with a devkit -%if "%{?exclusive_arches}" == "%{nil}" -# x86 is no longer supported -ExcludeArch: %{ix86} -%else -ExclusiveArch: %{exclusive_arches} -%endif - Name: java-latest-%{origin}-portable%{?pkgos:-%{pkgos}} Version: %{newjavaver}.%{buildver} # This package needs `.rolling` as part of Release so as to not conflict on install with @@ -731,14 +645,19 @@ Source16: CheckVendor.java # Ensure translations are available for new timezones Source18: TestTranslations.java +# Regenerate jmod-less jlink hashsums after the build do all evil things +# The stripped debuginfo may fail this operation, but that is currently broken anyway +Source19: BuildShaSumFile.java + ############################################ # # RPM/distribution specific patches # ############################################ + # Crypto policy and FIPS support patches -# Patch is generated from the fips-25u tree at https://github.com/rh-openjdk/jdk/tree/fips-25u -# as follows: git diff %%{vcstag} src make test > fips-25u-$(git show -s --format=%h HEAD).patch +# Patch is generated from the fips-21u tree at https://github.com/rh-openjdk/jdk/tree/fips-21u +# as follows: git diff %%{vcstag} src make test > fips-21u-$(git show -s --format=%h HEAD).patch # Diff is limited to src and make subdirectories to exclude .github changes # The following list is generated by: # git log %%{vcstag}.. --no-merges --format=%s --reverse: @@ -774,8 +693,7 @@ Source18: TestTranslations.java # test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class # RH1940064: Enable XML Signature provider in FIPS mode # RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized [now part of JDK-8301553 upstream] -# usage in jdk >25 is experimental and may disapear -Patch1001: fips-25u-%{fipsver}.patch +#Patch1001: fips-%{featurever}u-%{fipsver}.patch ############################################# # @@ -790,8 +708,10 @@ Patch1001: fips-25u-%{fipsver}.patch # OpenJDK patches which missed last update # ############################################# - -Patch1: JDK-8373246-8351842_broke_native_debugging_on_Linux.patch +# 8352692: Add support for extra jlink options +Patch2000: 0001-8352692-Add-support-for-extra-jlink-options.patch +# 8352689: Allow for hash sum overrides when linking from the run-time image +Patch2001: 0002-8352689-Allow-for-hash-sum-overrides-when-linking-fr.patch ############################################# # @@ -811,8 +731,19 @@ BuildRequires: desktop-file-utils BuildRequires: elfutils-devel BuildRequires: file BuildRequires: fontconfig-devel -%{dts_brs} +%if (0%{?rhel} > 0 && 0%{?rhel} < 8) +BuildRequires: devtoolset-%{dtsversion}-gcc +BuildRequires: devtoolset-%{dtsversion}-gcc-c++ +%else +BuildRequires: gcc +# gcc-c++ is already needed +%endif +BuildRequires: gcc-c++ BuildRequires: gdb +%if (0%{?rhel} > 0 && 0%{?rhel} < 8) +# rhel7 only, portables only. Rhel8 have gtk3, rpms have runtime recommends of gtk +BuildRequires: gtk2-devel +%endif BuildRequires: libxslt BuildRequires: libX11-devel BuildRequires: libXi-devel @@ -824,7 +755,7 @@ BuildRequires: libXtst-devel # Requirement for setting up nss.fips.cfg BuildRequires: nss-devel # Requirement for system security property test -# N/A for portable as we don't enable support for them +# N/A for portable. RHEL7 doesn't provide them #BuildRequires: crypto-policies BuildRequires: pkgconfig BuildRequires: xorg-x11-proto-devel @@ -832,20 +763,26 @@ BuildRequires: zip # to pack portable tarballs BuildRequires: tar BuildRequires: unzip +%if (0%{?rhel} > 0 && 0%{?rhel} < 8) +BuildRequires: javapackages-tools +BuildRequires: java-%{buildjdkver}-%{origin}%{?pkgos:-%{pkgos}}-devel +%else BuildRequires: javapackages-filesystem -BuildRequires: %{bootjdkpkg} +BuildRequires: java-latest-openjdk-devel +%endif # Zero-assembler build requirement %ifarch %{zero_arches} BuildRequires: libffi-devel %endif # Full documentation build requirements -# pandoc is only available on RHEL/CentOS 8, epels, and fedoras -%if %{pandoc_available} BuildRequires: graphviz BuildRequires: pandoc -%endif +# 2023c required as of JDK-8305113 +BuildRequires: tzdata-java >= 2023c # cacerts build requirement in portable mode BuildRequires: ca-certificates +# Earlier versions have a bug in tree vectorization on PPC +BuildRequires: gcc >= 4.8.3-8 %if %{with_systemtap} BuildRequires: systemtap-sdt-devel @@ -859,22 +796,21 @@ BuildRequires: harfbuzz-devel BuildRequires: lcms2-devel BuildRequires: libjpeg-devel BuildRequires: libpng-devel -BuildRequires: zlib-devel %else # Version in src/java.desktop/share/legal/freetype.md -Provides: bundled(freetype) = 2.13.3 +Provides: bundled(freetype) = 2.13.0 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h -Provides: bundled(giflib) = 5.2.2 +Provides: bundled(giflib) = 5.2.1 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h -Provides: bundled(harfbuzz) = 10.4.0 +Provides: bundled(harfbuzz) = 8.2.2 # Version in src/java.desktop/share/native/liblcms/lcms2.h -Provides: bundled(lcms2) = 2.17.0 +Provides: bundled(lcms2) = 2.15.0 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h Provides: bundled(libjpeg) = 6b # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h -Provides: bundled(libpng) = 1.6.47 -# Version in src/java.base/share/native/libzip/zlib/zlib.h -Provides: bundled(zlib) = 1.3.1 +Provides: bundled(libpng) = 1.6.40 +# We link statically against libstdc++ to increase portability +BuildRequires: libstdc++-static %endif # this is always built, also during debug-only build @@ -988,6 +924,17 @@ The %{origin_nice} %{featurever} libraries for static linking - portable edition # staticlibs %endif +%if %{include_normal_build} +%package unstripped +Summary: The %{origin_nice} %{featurever} runtime environment. + +%{java_unstripped_rpo %{nil}} + +%description unstripped +The %{origin_nice} %{featurever} runtime environment. + +%endif + %if %{include_normal_build} %package docs Summary: %{origin_nice} %{featurever} API documentation @@ -1014,15 +961,13 @@ The %{origin_nice} %{featurever} full patched sources of portable JDK to build, %prep -# Using the echo macro breaks rpmdev-bumpspec, as it parses the first line of stdout :-( echo "Preparing %{oj_vendor_version}" -echo "System is RHEL=%{?rhel}%{!?rhel:0}, CentOS=%{?centos}%{!?centos:0}, EPEL=%{?epel}%{!?epel:0}, Fedora=%{?fedora}%{!?fedora:0}" -echo "Build JDK version is %{buildjdkver}, bootstrap JDK package is %{bootjdkpkg}" +# Using the echo macro breaks rpmdev-bumpspec, as it parses the first line of stdout :-( %if 0%{?_build_cpu:1} echo "CPU: %{_target_cpu}, arch install directory: %{archinstall}, SystemTap install directory: %{_build_cpu}" %else - %{error:Unrecognised architecture %{_target_cpu}} + %{error:Unrecognised architecture %{_build_cpu}} %endif if [ %{include_normal_build} -eq 0 -o %{include_normal_build} -eq 1 ] ; then @@ -1049,11 +994,10 @@ if [ %{include_debug_build} -eq 0 -a %{include_normal_build} -eq 0 -a %{includ fi %if %{with fresh_libjvm} && ! %{build_hotspot_first} -%{warn: The build of a fresh libjvm has been disabled due to a JDK version mismatch} -%{warn: Build JDK version is %{buildjdkver}, feature JDK version is %{featurever}} +echo "WARNING: The build of a fresh libjvm has been disabled due to a JDK version mismatch" +echo "Build JDK version is %{buildjdkver}, feature JDK version is %{featurever}" %endif -export XZ_OPT="-T0" %setup -q -c -n %{uniquesuffix ""} -T -a 0 # https://bugzilla.redhat.com/show_bug.cgi?id=1189084 prioritylength=`expr length %{priority}` @@ -1069,32 +1013,15 @@ sh %{SOURCE12} %{top_level_dir_name} %endif # Patch the JDK -# This syntax is deprecated: -# %%patchN [...] -# and should be replaced with: -# %%patch -PN [...] -# For example: -# %%patch1001 -p1 -# becomes: -# %%patch -P1001 -p1 -# The replacement format suggested by recent (circa Fedora 38) RPM -# deprecation messages: -# %%patch N [...] -# is not backward-compatible with prior (circa RHEL-8) versions of -# rpmbuild. pushd %{top_level_dir_name} # Add crypto policy and FIPS support -# usage in jdk >25 is experimental and may disapear -%patch -P1001 -p1 -%patch -P1 -p1 +# Skipping fips patch whil eit is not ready for jdk22 %%patch -P1001 -p1 +# Patches in need of upstreaming +# Patches which missed the 24+36 GA release +%patch -P2000 -p1 +%patch -P2001 -p1 popd # openjdk -echo "Generating %{alt_java_name} man page" -altjavamanpage=%{top_level_dir_name}/src/java.base/share/man/%{alt_java_name}.md -altjavatext="Hardened java binary recommended for launching untrusted code from the Web e.g. javaws" -sed -r -e 's|([^/.])java([^./])|\1alt-java\2|g' %{top_level_dir_name}/src/java.base/share/man/java.md | \ - sed -e 's|JAVA(|ALT-JAVA(|' | \ - sed -e "s|java - launch a Java application|alt-java - ${altjavatext}|" >> ${altjavamanpage} # The OpenJDK version file includes the current # upstream version information. For some reason, @@ -1113,44 +1040,16 @@ if [ "x${UPSTREAM_EA_DESIGNATOR}" != "x%{ea_designator}" ] ; then echo "WARNING: Designator mismatch"; echo "Spec file is configured for a %{build_type} build with designator '%{ea_designator}'" echo "Upstream version-pre setting is '${UPSTREAM_EA_DESIGNATOR}'"; - exit 17 + #exit 17 fi -# Systemtap is processed in rpms on fedoras and epels +# Systemtap is processed in rpms # Prepare desktop files # Portables do not have desktop integration -# Extract devkit -%if "%{is_dtstoolchain}" == "devkit" - devkittarball=%{_datadir}/%{dtsname}/sdk-%{_target_cpu}-%{_target_os}-gnu*.tar.gz - echo "Extracting devkit ${devkittarball}"; - mkdir devkit; - tar -C devkit --strip-components=1 -xzf ${devkittarball} - DEVKIT_ROOT=$(pwd)/devkit - source ${DEVKIT_ROOT}/devkit.info - echo "Installed ${DEVKIT_NAME} devkit" -%else -%if 0%{?centos} > 0 - echo "No devkit for CentOS %{?centos}" -%else - echo "No devkit for %{_target_cpu} on RHEL %{?rhel}"; -%endif -%endif - -%if %{use_portable_bootjdk} - # Extract build JDK - pushd %{_jvmdir} - sha256sum --check %{bootjdkzip}.sha256sum - popd - tar -xJf %{bootjdkzip} - mv java-%{featurever}-openjdk-%{buildjdkver}* %{bootjdk} - # Print release information - echo "Installed boot JDK:" - cat %{bootjdk}/release -%endif - %build + # How many CPU's do we have? export NUM_PROC=%(/usr/bin/getconf _NPROCESSORS_ONLN 2> /dev/null || :) export NUM_PROC=${NUM_PROC:-1} @@ -1158,7 +1057,6 @@ export NUM_PROC=${NUM_PROC:-1} # Honor %%_smp_ncpus_max [ ${NUM_PROC} -gt %{?_smp_ncpus_max} ] && export NUM_PROC=%{?_smp_ncpus_max} %endif -export XZ_OPT="-T0" %ifarch s390x sparc64 alpha %{power64} %{aarch64} riscv64 export ARCH_DATA_MODEL=64 @@ -1182,61 +1080,22 @@ EXTRA_CFLAGS="$EXTRA_CFLAGS -fno-strict-aliasing" EXTRA_CFLAGS="$(echo ${EXTRA_CFLAGS} | sed -e 's|-mstackrealign|-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4|')" EXTRA_CPP_FLAGS="$(echo ${EXTRA_CPP_FLAGS} | sed -e 's|-mstackrealign|-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4|')" %endif -%if "%{is_dtstoolchain}" == "devkit" -# Remove annobin plugin reference which isn't available in the devkit -EXTRA_CFLAGS="$(echo ${EXTRA_CFLAGS} | sed -e 's|-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1||')" -EXTRA_CPP_FLAGS="$(echo ${EXTRA_CPP_FLAGS} | sed -e 's|-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1||')" -# Force DWARF 4 for compatibility -EXTRA_CFLAGS="${EXTRA_CFLAGS} -gdwarf-4" -EXTRA_CPP_FLAGS="${EXTRA_CPP_FLAGS} -gdwarf-4" -%endif - export EXTRA_CFLAGS EXTRA_CPP_FLAGS -# Set modification times (mtimes) of files within JAR files generated -# by the OpenJDK build to a timestamp that is constant across RPM -# rebuilds. OpenJDK provides the --with-source-date configure option -# for this purpose. Potential arguments in the RPM build context are: -# -# A) --with-source-date="${SOURCE_DATE_EPOCH}" -# B) --with-source-date=version -# C) --with-source-date="${OPENJDK_UPSTREAM_TAG_EPOCH}" -# -# Consider Option A. Fedora 38 (rpm-4.18.2) and RHEL-8 (rpm-4.14.3) -# have different support for SOURCE_DATE_EPOCH. To keep -# SOURCE_DATE_EPOCH constant across RPM rebuilds, one could set the -# source_date_epoch_from_changelog macro to 1 on both Fedora 38 and -# RHEL-8. However, on RHEL-8, this results in the RPM build times -# being set to the timestamp of the most recent changelog. This is -# bad for tracing when RPMs were actually built. Fedora 38 supports a -# better behaviour via the introduction of the -# use_source_date_epoch_as_buildtime macro, set to 0 by default. -# There is no way to make this work on RHEL-8 as well though, so -# option A is suboptimal. -# -# Option B uses the value of the DEFAULT_VERSION_DATE field from -# make/conf/version-numbers.conf. DEFAULT_VERSION_DATE represents the -# aspirational eventual JDK general availability (GA) release date. -# When the RPM build occurs prior to GA, generated JAR files will have -# payload mtimes in the future relative to the RPM build time. -# Whereas for tarballs some tools will issue warnings about future -# mtimes, per OPENJDK-2583 apparently this is no problem for Java and -# JAR files. -# -# Option C uses the modification timestamp of files in the source -# tarball. The reproducibility logic in generate_source_tarball.sh -# sets them all to the commit time of the release-tagged OpenJDK -# commit, as archived in the tarball. This timestamp is deterministic -# across RPM rebuilds and is reliably in the past. Any file's mtime -# will do, so use version-numbers.conf's. -# -# Use option B for JAR files, based on the discussion in OPENJDK-2583. -# -# For portable tarballs, use option C (OPENJDK_UPSTREAM_TAG_EPOCH) for -# the modification times of all files in the portable tarballs. Doing -# so eliminates one source of variability across RPM rebuilds. -VERSION_FILE="$(pwd)"/"%{top_level_dir_name}"/make/conf/version-numbers.conf -OPENJDK_UPSTREAM_TAG_EPOCH="$(stat --format=%Y "${VERSION_FILE}")" +echo "Building %{SOURCE11}" +mkdir %{miscinstalloutputdir} +mkdir %{altjavaoutputdir} +gcc ${EXTRA_CFLAGS} -o %{altjavaoutputdir}/%{alt_java_name} %{SOURCE11} + +echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}" + +function create_jlink_argfile() { + local argfile=${1} + + # Ensure parent directory exists + mkdir -p $(dirname ${argfile}) + echo "--sha-overrides=@\${java.home}/conf/runtimelink-sha-overrides.conf" > ${argfile} +} function buildjdk() { local outputdir=${1} @@ -1245,10 +1104,11 @@ function buildjdk() { local debuglevel=${4} local link_opt=${5} local debug_symbols=${6} - local devkit=${7} local top_dir_abs_src_path=$(pwd)/%{top_level_dir_name} local top_dir_abs_build_path=$(pwd)/${outputdir} + # Only used for "internal" debug symbols builds + local jlink_args_file=$top_dir_abs_build_path/jlink-args-file # This must be set using the global, so that the # static libraries still use a dynamic stdc++lib @@ -1258,6 +1118,9 @@ function buildjdk() { libc_link_opt="dynamic"; fi + jlink_flags="--save-jlink-argfiles=${jlink_args_file}" + create_jlink_argfile ${jlink_args_file} + echo "Using output directory: ${outputdir}"; echo "Checking build JDK ${buildjdk} is operational..." ${buildjdk}/bin/java -version @@ -1265,22 +1128,11 @@ function buildjdk() { echo "Using debuglevel: ${debuglevel}" echo "Using link_opt: ${link_opt}" echo "Using debug_symbols: ${debug_symbols}" + if [ -n "${jlink_flags}" ]; then + echo "Using extra jlink flags: '${jlink_flags}'" + fi echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}" -%if "%{is_dtstoolchain}" == "devkit" - LIBPATH="${devkit}/lib:${devkit}/lib64" - echo "Setting library path to ${LIBPATH}" -%else -%if "%{is_dtstoolchain}" == "toolset" - toolset=/opt/rh/%{dtsname}/root/ - LIBPATH="${toolset}/lib:${toolset}/lib64" - echo "Setting library path to ${LIBPATH}" -%else - LIBPATH=${LD_LIBRARY_PATH} - echo "Keeping library path as ${LIBPATH}" -%endif -%endif - mkdir -p ${outputdir} pushd ${outputdir} @@ -1288,17 +1140,16 @@ function buildjdk() { # rather than ${link_opt} as the system versions # are always used in a system_libs build, even # for the static library build - LD_LIBRARY_PATH=${LIBPATH} \ - %{?dts_command} bash ${top_dir_abs_src_path}/configure \ +%if (0%{?rhel} > 0 && 0%{?rhel} < 8) + scl enable devtoolset-%{dtsversion} -- bash ${top_dir_abs_src_path}/configure \ +%else + bash ${top_dir_abs_src_path}/configure \ +%endif %ifarch %{zero_arches} --with-jvm-variants=zero \ %endif -%if "%{is_dtstoolchain}" == "devkit" - --with-devkit=${devkit} \ -%endif -%if "%{is_dtstoolchain}" == "toolset" - --with-extra-path="/opt/rh/%{dtsname}/root/bin:/opt/rh/%{dtsname}/root/usr/bin" \ - --with-toolchain-path="/opt/rh/%{dtsname}/root/bin:/opt/rh/%{dtsname}/root/usr/bin" \ +%ifarch %{ppc64le} + --with-jobs=1 \ %endif --with-version-build=%{buildver} \ --with-version-pre="%{ea_designator}" \ @@ -1311,10 +1162,10 @@ function buildjdk() { --with-boot-jdk=${buildjdk} \ --with-debug-level=${debuglevel} \ --with-native-debug-symbols="${debug_symbols}" \ - --disable-absolute-paths-in-output \ --enable-unlimited-crypto \ --enable-linkable-runtime \ --enable-keep-packaged-modules \ + --with-extra-jlink-flags="${jlink_flags}" \ --with-zlib=%{link_type} \ --with-freetype=%{link_type} \ --with-libjpeg=${link_opt} \ @@ -1327,28 +1178,79 @@ function buildjdk() { --with-extra-cflags="$EXTRA_CFLAGS" \ --with-extra-ldflags="%{ourldflags}" \ --with-num-cores="$NUM_PROC" \ - --with-source-date="version" \ + --with-source-date="${SOURCE_DATE_EPOCH}" \ --disable-javac-server \ %ifarch %{zgc_arches} --with-jvm-features=zgc \ %endif - --disable-warnings-as-errors \ - || ( pwd; cat $(find | grep config.log) && false ) + --disable-warnings-as-errors cat spec.gmk - LD_LIBRARY_PATH=${LIBPATH} \ - %{?dts_command} make LOG=trace \ +%if (0%{?rhel} > 0 && 0%{?rhel} < 8) + scl enable devtoolset-%{dtsversion} -- make \ +%else + make \ +%endif + LOG=trace \ WARNINGS_ARE_ERRORS="-Wno-error" \ - CFLAGS_WARNINGS_ARE_ERRORS="-Wno-error" $maketargets ||\ - ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name \"hs_err_pid*.log\" | xargs cat && false ) + CFLAGS_WARNINGS_ARE_ERRORS="-Wno-error" \ + $maketargets || ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name "hs_err_pid*.log" | xargs cat && false ) popd } +function stripjdk() { + local outputdir=${1} + local jdkimagepath=${outputdir}/images/%{jdkimage} + local jreimagepath=${outputdir}/images/%{jreimage} + local jmodimagepath=${outputdir}/images/jmods + local supportdir=${outputdir}/support + + if [ "x$suffix" = "x" ] ; then + # Keep the unstripped version for consumption by RHEL RPMs + cp -a ${jdkimagepath}{,.unstripped} + + # Strip the files + for file in $(find ${jdkimagepath} ${jreimagepath} ${supportdir} -type f) ; do + if file ${file} | grep -q 'ELF'; then + noextfile=${file/.so/}; + objcopy --only-keep-debug ${file} ${noextfile}.debuginfo; + objcopy --add-gnu-debuglink=${noextfile}.debuginfo ${file}; + strip -g ${file}; + fi + done + + # Rebuild jmod files against the stripped binaries + if [ ! -d ${supportdir} ] ; then + echo "Support directory missing."; + exit 15 + fi + for cmd in $(find ${supportdir} -name '*.jmod_exec.cmdline') ; do + pre=${cmd/_exec/_pre}; + post=${cmd/_exec/_post}; + jmod=$(echo ${cmd}|sed 's#.*_create_##'|sed 's#_exec.cmdline##') + echo "Rebuilding ${jmod} against stripped binaries..."; + if [ -e ${pre} ] ; then + echo "Executing ${pre}..."; + cat ${pre} | sh -s ; + fi + echo "Executing ${cmd}..."; + cat ${cmd} | sh -s ; + if [ -e ${post} ] ; then + echo "Executing ${post}..."; + cat ${post} | sh -s ; + fi + done + rm -rf ${jdkimagepath}/jmods + cp -a ${jmodimagepath} ${jdkimagepath} + fi +} + function installjdk() { local outputdir=${1} local installdir=${2} local jdkimagepath=${installdir}/images/%{jdkimage} local jreimagepath=${installdir}/images/%{jreimage} + local unstripped=${jdkimagepath}.unstripped echo "Installing build from ${outputdir} to ${installdir}..." mkdir -p ${installdir} @@ -1367,7 +1269,6 @@ function installjdk() { # legacy-jre-image target does not install any man pages for the JRE # We copy the jdk man directory and then remove pages for binaries that # don't exist in the JRE -%if %{pandoc_available} cp -a ${jdkimagepath}/man ${jreimagepath} for manpage in $(find ${jreimagepath}/man -name '*.1'); do filename=$(basename ${manpage}); @@ -1377,9 +1278,8 @@ function installjdk() { rm -f ${manpage}; fi; done -%endif - for imagepath in ${jdkimagepath} ${jreimagepath}; do + for imagepath in ${jdkimagepath} ${jreimagepath} ${unstripped}; do if [ -d ${imagepath} ] ; then # the build (erroneously) removes read permissions from some jars @@ -1395,6 +1295,13 @@ function installjdk() { # Install local files which are distributed with the JDK install -m 644 %{SOURCE10} ${imagepath} + # Create fake alt-java as a placeholder for future alt-java + pushd ${imagepath} + # add alt-java man page + echo "Hardened java binary recommended for launching untrusted code from the Web e.g. javaws" > man/man1/%{alt_java_name}.1 + cat man/man1/java.1 >> man/man1/%{alt_java_name}.1 + popd + # Print release information cat ${imagepath}/release fi @@ -1416,7 +1323,7 @@ function genchecksum() { function packFullPatchedSources() { srcpackagesdir=`pwd` - createtar ${srcpackagesdir}/%{jdkportablesourcesarchive -- ""} --transform "s|^|%{jdkportablesourcesname -- ""}/|" %{top_level_dir_name} + tar -cJf ${srcpackagesdir}/%{jdkportablesourcesarchive -- ""} --transform "s|^|%{jdkportablesourcesname -- ""}/|" %{top_level_dir_name} genchecksum ${srcpackagesdir}/%{jdkportablesourcesarchive -- ""} } @@ -1442,13 +1349,6 @@ function findgeneratedsources() { popd } -# Create a reproducible tarball in an appropriate way for -# the version of tar in use -function createtar() { - #FIXME, not finished - tar -cJf "$@" -} - function packagejdk() { local imagesdir=$(pwd)/${1}/images local docdir=$(pwd)/${1}/images/docs @@ -1477,6 +1377,7 @@ function packagejdk() { staticname=%{staticlibsportablename -- "$nameSuffix"} staticarchive=${packagesdir}/%{staticlibsportablearchive -- "$nameSuffix"} debugarchive=${packagesdir}/%{jdkportablearchive -- "${nameSuffix}.debuginfo"} + unstrippedarchive=${packagesdir}/%{jdkportablearchive -- "${nameSuffix}.unstripped"} if [ "x$suffix" = "x" ] ; then docname=%{docportablename} docarchive=${packagesdir}/%{docportablearchive} @@ -1486,22 +1387,27 @@ function packagejdk() { miscname=%{miscportablename} miscarchive=${packagesdir}/%{miscportablearchive} + if [ "x$suffix" = "x" ] ; then + # Keep the unstripped version for consumption by RHEL RPMs + mv %{jdkimage}.unstripped ${jdkname} + tar -cJf ${unstrippedarchive} ${jdkname} + genchecksum ${unstrippedarchive} + mv ${jdkname} %{jdkimage}.unstripped + fi + # Rename directories for packaging mv %{jdkimage} ${jdkname} mv %{jreimage} ${jrename} # Release images have external debug symbols if [ "x$suffix" = "x" ] ; then - # jdk26 is putting debugsymbols out of main image, - # we later reconstruct debuginfo subpakckages manually, so putting them back - cp -r symbols/* ${jdkname}/ - createtar ${debugarchive} $(find ${jdkname} -name \*.debuginfo) + tar -cJf ${debugarchive} $(find ${jdkname} -name \*.debuginfo) genchecksum ${debugarchive} mkdir ${docname} mv ${docdir} ${docname} mv ${bundledir}/${built_doc_archive} ${docname} - createtar ${docarchive} ${docname} + tar -cJf ${docarchive} ${docname} genchecksum ${docarchive} mkdir ${miscname} @@ -1513,25 +1419,26 @@ function packagejdk() { %endif cp -av ${altjavadir}/%{alt_java_name} ${miscname} cp -avr ${gensources} ${miscname} - createtar ${miscarchive} ${miscname} + tar -cJf ${miscarchive} ${miscname} genchecksum ${miscarchive} fi - createtar ${jmodsarchive} --exclude='**.debuginfo' ${jdkname}/jmods + tar -cJf ${jmodsarchive} --exclude='**.debuginfo' ${jdkname}/jmods genchecksum ${jmodsarchive} + rm -rv ${jdkname}/jmods - createtar ${jdkarchive} --exclude='**.debuginfo' ${jdkname} + tar -cJf ${jdkarchive} --exclude='**.debuginfo' ${jdkname} genchecksum ${jdkarchive} - createtar ${jrearchive} --exclude='**.debuginfo' ${jrename} + tar -cJf ${jrearchive} --exclude='**.debuginfo' ${jrename} genchecksum ${jrearchive} %if %{include_staticlibs} # Static libraries (needed for building graal vm with native image) # Tar as overlay. Transform to the JDK name, since we just want to "add" # static libraries to that folder - createtar ${staticarchive} \ + tar -cJf ${staticarchive} \ --transform "s|^%{static_libs_image}/lib/*|${staticname}/lib/static/linux-%{archinstall}/glibc/|" "%{static_libs_image}/lib" genchecksum ${staticarchive} %endif @@ -1547,34 +1454,11 @@ function packagejdk() { packFullPatchedSources -%if "%{is_dtstoolchain}" == "devkit" - DEVKIT_ROOT=$(pwd)/devkit - source ${DEVKIT_ROOT}/devkit.info - GCC="${DEVKIT_TOOLCHAIN_PATH}/gcc --sysroot=${DEVKIT_SYSROOT}" - LIBPATH="${DEVKIT_ROOT}/lib:${DEVKIT_ROOT}/lib64" -%else -%if "%{is_dtstoolchain}" == "toolset" - toolset=/opt/rh/%{dtsname}/root/ - GCC="${toolset}/usr/bin/gcc" - LIBPATH="${toolset}/lib:${toolset}/lib64" -%else - GCC=$(which gcc) -%endif -%endif - -echo "Building %{SOURCE11}" -mkdir %{miscinstalloutputdir} -mkdir %{altjavaoutputdir} -LD_LIBRARY_PATH="${LIBPATH}" ${GCC} ${EXTRA_CFLAGS} -o %{altjavaoutputdir}/%{alt_java_name} %{SOURCE11} - -echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}" - %if %{build_hotspot_first} # Build a fresh libjvm.so first and use it to bootstrap - echo "Building HotSpot only for the latest libjvm.so" cp -LR --preserve=mode,timestamps %{bootjdk} newboot systemjdk=$(pwd)/newboot - buildjdk build/newboot ${systemjdk} %{hotspot_target} "release" "bundled" "internal" ${DEVKIT_ROOT} + buildjdk build/newboot ${systemjdk} %{hotspot_target} "release" "bundled" "internal" mv build/newboot/jdk/lib/%{vm_variant}/libjvm.so newboot/lib/%{vm_variant} %else systemjdk=%{bootjdk} @@ -1587,14 +1471,10 @@ for suffix in %{build_loop} ; do # change --something to something debugbuild=`echo $suffix | sed "s/-//g"` fi - # We build with 'external' debug symbols for the - # release build and build with 'internal' for - # slowdebug/fastdebug variants - if [ "x$suffix" = "x" ] ; then - debug_symbols=external - else - debug_symbols=internal - fi + # We build with internal debug symbols and do + # our own stripping for one version of the + # release build + debug_symbols=internal builddir=%{buildoutputdir -- ${suffix}} bootbuilddir=boot${builddir} @@ -1620,17 +1500,23 @@ for suffix in %{build_loop} ; do run_bootstrap=%{bootstrap_build} fi if ${run_bootstrap} ; then - buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild} ${link_opt} ${debug_symbols} ${DEVKIT_ROOT} + buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild} ${link_opt} ${debug_symbols} installjdk ${bootbuilddir} ${bootinstalldir} - buildjdk ${builddir} $(pwd)/${bootinstalldir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} ${DEVKIT_ROOT} + buildjdk ${builddir} $(pwd)/${bootinstalldir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} findgeneratedsources ${installdir} ${builddir} $(pwd)/%{top_level_dir_name} + stripjdk ${builddir} installjdk ${builddir} ${installdir} %{!?with_artifacts:rm -rf ${bootinstalldir}} else - buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} ${DEVKIT_ROOT} + buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} findgeneratedsources ${installdir} ${builddir} $(pwd)/%{top_level_dir_name} + stripjdk ${builddir} installjdk ${builddir} ${installdir} fi + + pushd ${installdir}/images/jdk/ + ./bin/java --add-opens=jdk.jlink/jdk.tools.jlink.internal.runtimelink=ALL-UNNAMED %{SOURCE19} ./conf/runtimelink-sha-overrides.conf + popd packagejdk ${installdir} ${packagesdir} %{altjavaoutputdir} %if %{system_libs} @@ -1647,7 +1533,7 @@ done # end of release / debug cycle loop # We test debug first as it will give better diagnostics on a crash for suffix in %{build_loop} ; do -# portable builds have static_libs embedded, thus top_dir_abs_main_build_path is same as top_dir_abs_staticlibs_build_path +# portable builds have static_libs embedded, thus top_dir_abs_main_build_path is same as top_dir_abs_staticlibs_build_path top_dir_abs_main_build_path=$(pwd)/%{installoutputdir -- ${suffix}} %if %{include_staticlibs} top_dir_abs_staticlibs_build_path=${top_dir_abs_main_build_path} @@ -1662,91 +1548,51 @@ export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage} #sed -i -e "s:^security.useSystemPropertiesFile=.*:security.useSystemPropertiesFile=true:" \ #${JAVA_HOME}/conf/security/java.security -# Set up tools -%if "%{is_dtstoolchain}" == "devkit" - DEVKIT_ROOT=$(pwd)/devkit - source ${DEVKIT_ROOT}/devkit.info - NM="${DEVKIT_TOOLCHAIN_PATH}/nm" -%else - NM=$(which nm) -%endif -# elfutils readelf supports more binaries than binutils version on RHEL 8 -# and debug symbols tests below were designed around this version -READELF=$(which eu-readelf) -# Only native gdb seems to work -# The devkit gdb needs the devkit stdc++ library but then the JVM -# segfaults when this is on the LD_LIBRARY_PATH -GDB=$(which gdb) - # Check Shenandoah is enabled %if %{use_shenandoah_hotspot} $JAVA_HOME/bin/java -XX:+UseShenandoahGC -version %endif -# Only test on one architecture (the fastest) for Java only tests -%ifarch %{jdk_test_arch} +# Check unlimited policy has been used +$JAVA_HOME/bin/javac -d . %{SOURCE13} +$JAVA_HOME/bin/java --add-opens java.base/javax.crypto=ALL-UNNAMED TestCryptoLevel - # Check unlimited policy has been used - $JAVA_HOME/bin/javac -d . %{SOURCE13} - $JAVA_HOME/bin/java --add-opens java.base/javax.crypto=ALL-UNNAMED TestCryptoLevel +# Check ECC is working +$JAVA_HOME/bin/javac -d . %{SOURCE14} +$JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||") - # Check ECC is working - $JAVA_HOME/bin/javac -d . %{SOURCE14} - $JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||") +# Check system crypto (policy) is deactive and can not be enabled +# Test takes a single argument - true or false - to state whether system +# security properties are enabled or not. +$JAVA_HOME/bin/javac -d . %{SOURCE15} +export PROG=$(echo $(basename %{SOURCE15})|sed "s|\.java||") +export SEC_DEBUG="-Djava.security.debug=properties" +# Specific to portable:System security properties to be off by default +$JAVA_HOME/bin/java ${SEC_DEBUG} ${PROG} false +$JAVA_HOME/bin/java ${SEC_DEBUG} -Djava.security.disableSystemPropertiesFile=false ${PROG} false - # Check system crypto (policy) is deactive and can not be enabled - # Test takes a single argument - true or false - to state whether system - # security properties are enabled or not. - $JAVA_HOME/bin/javac -d . %{SOURCE15} - export PROG=$(echo $(basename %{SOURCE15})|sed "s|\.java||") - export SEC_DEBUG="-Djava.security.debug=properties" - # Specific to portable:System security properties to be off by default - $JAVA_HOME/bin/java ${SEC_DEBUG} ${PROG} false - $JAVA_HOME/bin/java ${SEC_DEBUG} -Djava.security.disableSystemPropertiesFile=false ${PROG} false - - # Check correct vendor values have been set - $JAVA_HOME/bin/javac -d . %{SOURCE16} - $JAVA_HOME/bin/java $(echo $(basename %{SOURCE16})|sed "s|\.java||") "%{oj_vendor}" "%{oj_vendor_url}" "%{oj_vendor_bug_url}" "%{oj_vendor_version}" - -%if ! 0%{?flatpak} - # Check translations are available for new timezones (during flatpak builds, the - # tzdb.dat used by this test is not where the test expects it, so this is - # disabled for flatpak builds) - # Disable test until we are on the latest JDK - $JAVA_HOME/bin/javac -d . %{SOURCE18} - $JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE || echo "Fedora is often ahead in timezones, ignoring" - $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR || echo "Fedora is often ahead in timezones, ignoring" -%endif - - # Check src.zip has all sources. See RHBZ#1130490 - unzip -l $JAVA_HOME/lib/src.zip | grep 'sun.misc.Unsafe' - - # Check class files include useful debugging information - $JAVA_HOME/bin/javap -c -l java.lang.Object | grep "Compiled from" - $JAVA_HOME/bin/javap -c -l java.lang.Object | grep LineNumberTable - $JAVA_HOME/bin/javap -c -l java.lang.Object | grep LocalVariableTable - - # Check generated class files include useful debugging information - $JAVA_HOME/bin/javap -c -l java.nio.ByteBuffer | grep "Compiled from" - $JAVA_HOME/bin/javap -c -l java.nio.ByteBuffer | grep LineNumberTable - $JAVA_HOME/bin/javap -c -l java.nio.ByteBuffer | grep LocalVariableTable - -%else - - # Just run a basic java -version test on other architectures - $JAVA_HOME/bin/java -version - -%endif +# Check correct vendor values have been set +$JAVA_HOME/bin/javac -d . %{SOURCE16} +$JAVA_HOME/bin/java $(echo $(basename %{SOURCE16})|sed "s|\.java||") "%{oj_vendor}" "%{oj_vendor_url}" "%{oj_vendor_bug_url}" "%{oj_vendor_version}" # Check java launcher has no SSB mitigation -if ! ${NM} $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi +if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi # Check alt-java launcher has SSB mitigation on supported architectures # set_speculation function exists in both cases, so check for prctl call %ifarch %{ssbd_arches} -${NM} %{altjavaoutputdir}/%{alt_java_name} | grep prctl +nm %{altjavaoutputdir}/%{alt_java_name} | grep prctl %else -if ! ${NM} %{altjavaoutputdir}/%{alt_java_name} | grep prctl ; then true ; else false; fi +if ! nm %{altjavaoutputdir}/%{alt_java_name} | grep prctl ; then true ; else false; fi +%endif + +%if ! 0%{?flatpak} +# Check translations are available for new timezones (during flatpak builds, the +# tzdb.dat used by this test is not where the test expects it, so this is +# disabled for flatpak builds) +$JAVA_HOME/bin/javac -d . %{SOURCE18} +$JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE || echo "FIXME before release!" +$JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR || echo "FIXME before release!" %endif %if %{include_staticlibs} @@ -1754,8 +1600,8 @@ if ! ${NM} %{altjavaoutputdir}/%{alt_java_name} | grep prctl ; then true ; else export STATIC_LIBS_HOME=${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image} ls -l $STATIC_LIBS_HOME ls -l $STATIC_LIBS_HOME/lib -${READELF} --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet4AddressImpl.c -${READELF} --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet6AddressImpl.c +readelf --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet4AddressImpl.c +readelf --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet6AddressImpl.c %endif # Release builds strip the debug symbols into external .debuginfo files @@ -1774,15 +1620,15 @@ do # Test for .debug_* sections in the shared object. This is the main test # Stripped objects will not contain these - ${READELF} -S "$lib" | grep "] .debug_" - test $(${READELF} -S "$lib" | grep -E "\]\ .debug_(info|abbrev)" | wc --lines) == 2 + eu-readelf -S "$lib" | grep "] .debug_" + test $(eu-readelf -S "$lib" | grep -E "\]\ .debug_(info|abbrev)" | wc --lines) == 2 # Test FILE symbols. These will most likely be removed by anything that # manipulates symbol tables because it's generally useless. So a nice test # that nothing has messed with symbols old_IFS="$IFS" IFS=$'\n' - for line in $(${READELF} -s "$lib" | grep "00000000 0 FILE LOCAL DEFAULT") + for line in $(eu-readelf -s "$lib" | grep "00000000 0 FILE LOCAL DEFAULT") do # We expect to see .cpp and .S files, except for architectures like aarch64 and # s390 where we expect .o and .oS files @@ -1792,17 +1638,17 @@ do # If this is the JVM, look for javaCalls.(cpp|o) in FILEs, for extra sanity checking if [ "`basename $lib`" = "libjvm.so" ]; then - ${READELF} -s "$lib" | \ + eu-readelf -s "$lib" | \ grep -E "00000000 0 FILE LOCAL DEFAULT ABS javaCalls.(cpp|o)$" fi # Test that there are no .gnu_debuglink sections pointing to another # debuginfo file. There shouldn't be any debuginfo files, so the link makes # no sense either - ${READELF} -S "$lib" | grep 'gnu' - if ${READELF} -S "$lib" | grep '] .gnu_debuglink' | grep PROGBITS; then + eu-readelf -S "$lib" | grep 'gnu' + if eu-readelf -S "$lib" | grep '] .gnu_debuglink' | grep PROGBITS; then echo "bad .gnu_debuglink section." - ${READELF} -x .gnu_debuglink "$lib" + eu-readelf -x .gnu_debuglink "$lib" false fi fi @@ -1814,7 +1660,7 @@ done # Using line number 1 might cause build problems. See: # https://bugzilla.redhat.com/show_bug.cgi?id=1539664 # https://bugzilla.redhat.com/show_bug.cgi?id=1538767 -${GDB} -q "$JAVA_HOME/bin/java" <, 2012-2022 +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +OLD_RELEASE=$1 +NEW_RELEASE=$2 +REPO=$3 +SUBDIR=$4 +SCRIPT_DIR=$(dirname ${0}) + +if test "x${SUBDIR}" = "x"; then + echo "No subdirectory specified; using ."; + SUBDIR="."; +fi + +if test "x$REPO" = "x"; then + echo "No repository specified; using ${PWD}" + REPO=${PWD} +fi + +if test x${TMPDIR} = x; then + TMPDIR=/tmp; +fi + +echo "Repository: ${REPO}" + +if [ -e ${REPO}/.git ] ; then + TYPE=git; +elif [ -e ${REPO}/.hg ] ; then + TYPE=hg; +else + echo "No Mercurial or Git repository detected."; + exit 1; +fi + +if test "x$OLD_RELEASE" = "x" || test "x$NEW_RELEASE" = "x"; then + echo "ERROR: Need to specify old and new release"; + exit 2; +fi + +echo "Listing fixes between $OLD_RELEASE and $NEW_RELEASE in $REPO" +rm -f ${TMPDIR}/fixes2 ${TMPDIR}/fixes3 ${TMPDIR}/fixes +for repos in . $(${SCRIPT_DIR}/discover_trees.sh ${REPO}); +do + if test "x$TYPE" = "xhg"; then + hg log -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R $REPO/$repos -G -M ${REPO}/${SUBDIR} | \ + grep -E '^[o:| ]*summary'|grep -v 'Added tag'|sed -r 's#^[o:| ]*summary:\W*([0-9])# - JDK-\1#'| \ + sed 's#^[o:| ]*summary:\W*# - #' >> ${TMPDIR}/fixes2; + hg log -v -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R $REPO/$repos -G -M ${REPO}/${SUBDIR} | \ + grep -E '^[o:| ]*[0-9]{7}'|sed -r 's#^[o:| ]*([0-9]{7})# - JDK-\1#' >> ${TMPDIR}/fixes3; + else + git -C ${REPO} log --no-merges --pretty=format:%B ${NEW_RELEASE}...${OLD_RELEASE} -- ${SUBDIR} |grep -E '^[0-9]{7}' | \ + sed -r 's#^([0-9])# - JDK-\1#' >> ${TMPDIR}/fixes2; + touch ${TMPDIR}/fixes3 ; # unused + fi +done + +sort ${TMPDIR}/fixes2 ${TMPDIR}/fixes3 | uniq > ${TMPDIR}/fixes +rm -f ${TMPDIR}/fixes2 ${TMPDIR}/fixes3 + +echo "In ${TMPDIR}/fixes:" +cat ${TMPDIR}/fixes diff --git a/scripts/get_bundle_versions.sh b/scripts/get_bundle_versions.sh deleted file mode 100755 index dddbee4..0000000 --- a/scripts/get_bundle_versions.sh +++ /dev/null @@ -1,172 +0,0 @@ -#!/usr/bin/env sh - -# Copyright (C) 2025 Red Hat, Inc. -# Original written by Antonio Vieiro -# -# This program is free software: you can redistribute it and/or modify -# it under the terms of the GNU Affero General Public License as -# published by the Free Software Foundation, either version 3 of the -# License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Affero General Public License for more details. -# -# You should have received a copy of the GNU Affero General Public License -# along with this program. If not, see . - -if [ $# -ne 1 ]; then - echo "Usage: $0 openjdk-root-directory" - exit 1 -fi - -JDKROOT=$1 - -if [ ! -d "${JDKROOT}" ] ; then - echo "${JDKROOT} is not a directory."; - exit 2 -fi - -# Work out the OpenJDK version -# OpenJDK >= 10 has its version in the build machinery -# OpenJDK >= 17 stores it in a new location (JDK-8258246) -VERSION_FILE="${JDKROOT}"/make/conf/version-numbers.conf -printf "Checking for %s..." "${VERSION_FILE}"; -if [ ! -f "${VERSION_FILE}" ] ; then - VERSION_FILE="${JDKROOT}"/make/autoconf/version-numbers - echo "Not found; using old version file ${VERSION_FILE}"; -else - echo "found."; -fi -if [ -e "${VERSION_FILE}" ] ; then - openjdk_version=$(grep '^DEFAULT_VERSION_FEATURE' "${VERSION_FILE}" | cut -d '=' -f 2) -elif [ -e "${JDKROOT}"/jdk/src/java.base/share/classes/java/lang/Object.java ] ; then - openjdk_version=9; -elif [ -e "${JDKROOT}"/common/autoconf ] ; then - openjdk_version=8; -else - openjdk_version=7; -fi -echo "OpenJDK version: ${openjdk_version}"; - -# -# Freetype -# -if [ "${openjdk_version}" -gt 8 ] ; then - FREETYPE=src/java.desktop/share/native/libfreetype/include/freetype/freetype.h - ABS_FREETYPE="${JDKROOT}"/"${FREETYPE}" - if [ ! -f "${ABS_FREETYPE}" ]; then - echo "Freetype header not found!" - exit 2 - fi - FREETYPE_VERSION=$(awk '/#define FREETYPE_MAJOR/ {MAJOR=$3} /#define FREETYPE_MINOR/ {MINOR=$3} /#define FREETYPE_PATCH/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_FREETYPE}") -else - echo "No bundled FreeType on ${openjdk_version}"; -fi - -# giflib -if [ "${openjdk_version}" -gt 8 ] ; then - GIFLIB=src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h -else - GIFLIB=jdk/src/share/native/sun/awt/giflib/gif_lib.h -fi -ABS_GIFLIB="${JDKROOT}"/"${GIFLIB}" -if [ ! -f "${ABS_GIFLIB}" ]; then - echo "giflib header not found!" - exit 3 -fi -GIFLIB_VERSION=$(awk '/#define GIFLIB_MAJOR/ {MAJOR=$3} /#define GIFLIB_MINOR/ {MINOR=$3} /#define GIFLIB_RELEASE/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_GIFLIB}") - -# harfbuzz -if [ "${openjdk_version}" -gt 8 ] ; then - HARFBUZZ=src/java.desktop/share/native/libharfbuzz/hb-version.h - ABS_HARFBUZZ="${JDKROOT}/${HARFBUZZ}" - if [ ! -f "${ABS_HARFBUZZ}" ]; then - echo "HarfBuzz header not found!" - exit 4 - fi - HARFBUZZ_VERSION=$(awk '/#define HB_VERSION_MAJOR/ {MAJOR=$3} /#define HB_VERSION_MINOR/ {MINOR=$3} /#define HB_VERSION_MICRO/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_HARFBUZZ}") -else - echo "No HarfBuzz on ${openjdk_version}"; -fi - -# lcms -if [ "${openjdk_version}" -gt 8 ] ; then - LCMS=src/java.desktop/share/native/liblcms/lcms2.h -else - LCMS=jdk/src/share/native/sun/java2d/cmm/lcms/lcms2.h -fi -ABS_LCMS="${JDKROOT}"/"${LCMS}" -if [ ! -f "${ABS_LCMS}" ]; then - echo "lcms header not found!" - exit 5 -fi -LCMS_VERSION=$(awk '/#define LCMS_VERSION/ { MAJOR=int($3 / 1000); REST=$3 % 1000; MINOR=int(REST / 10); PATCH=REST % 10; } END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_LCMS}") - -# jpeg -if [ "${openjdk_version}" -gt 8 ] ; then - JPEG=src/java.desktop/share/native/libjavajpeg/jpeglib.h -else - JPEG=jdk/src/share/native/sun/awt/image/jpeg/jpeglib.h -fi -ABS_JPEG="${JDKROOT}"/"${JPEG}" -if [ ! -f "${ABS_JPEG}" ]; then - echo "jpeg header not found!" - exit 6 -fi -JPEG_VERSION=$(awk '/#define JPEG_LIB_VERSION/ { VERSION=$3; MAJOR=int(VERSION / 10); MINOR=VERSION%10; } END {printf "%s%c", MAJOR, (MINOR+96)}' "${ABS_JPEG}") - -# png -if [ "${openjdk_version}" -gt 8 ] ; then - PNG=src/java.desktop/share/native/libsplashscreen/libpng/png.h -else - PNG=jdk/src/share/native/sun/awt/libpng/png.h -fi -ABS_PNG="${JDKROOT}"/"${PNG}" -if [ ! -f "${ABS_PNG}" ]; then - echo "png header not found!" - exit 7 -fi -PNG_VERSION=$(awk '/#define PNG_LIBPNG_VER_STRING/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_PNG}") - -# zlib -if [ "${openjdk_version}" -gt 8 ] ; then - ZLIB=src/java.base/share/native/libzip/zlib/zlib.h -else - ZLIB=jdk/src/share/native/java/util/zip/zlib/zlib.h -fi -ABS_ZLIB="${JDKROOT}"/"${ZLIB}" -if [ ! -f "${ABS_ZLIB}" ]; then - echo "zlib header not found!" - exit 8 -fi -ZLIB_VERSION=$(awk '/#define ZLIB_VERSION/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_ZLIB}") - -# Print output -printf "\nRPM definitions:\n" -if [ "${openjdk_version}" -gt 8 ] ; then - echo "# Version in ${FREETYPE}" - echo "Provides: bundled(freetype) = ${FREETYPE_VERSION}" -fi -echo "# Version in ${GIFLIB}" -echo "Provides: bundled(giflib) = ${GIFLIB_VERSION}" -if [ "${openjdk_version}" -gt 8 ] ; then - echo "# Version in ${HARFBUZZ}" - echo "Provides: bundled(harfbuzz) = ${HARFBUZZ_VERSION}" -fi -echo "# Version in ${LCMS}" -echo "Provides: bundled(lcms2) = ${LCMS_VERSION}" -echo "# Version in ${JPEG}" -echo "Provides: bundled(libjpeg) = ${JPEG_VERSION}" -echo "# Version in ${PNG}" -echo "Provides: bundled(libpng) = ${PNG_VERSION}" -echo "# Version in ${ZLIB}" -echo "Provides: bundled(zlib) = ${ZLIB_VERSION}" - -# Local Variables: -# compile-command: "shellcheck get_bundle_versions.sh" -# fill-column: 80 -# indent-tabs-mode: nil -# sh-basic-offset: 4 -# End: diff --git a/scripts/openjdk_news.sh b/scripts/openjdk_news.sh deleted file mode 100755 index 9574915..0000000 --- a/scripts/openjdk_news.sh +++ /dev/null @@ -1,114 +0,0 @@ -#!/bin/bash - -# Copyright (C) 2024 Red Hat, Inc. -# Written by Andrew John Hughes , 2012-2022 -# -# This program is free software: you can redistribute it and/or modify -# it under the terms of the GNU Affero General Public License as -# published by the Free Software Foundation, either version 3 of the -# License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Affero General Public License for more details. -# -# You should have received a copy of the GNU Affero General Public License -# along with this program. If not, see . - -OLD_RELEASE=$1 -NEW_RELEASE=$2 -REPO=$3 -SUBDIR=$4 -SCRIPT_DIR=$(dirname "${0}") - -if test "${SUBDIR}" = ""; then - echo "No subdirectory specified; using ."; - SUBDIR="."; -fi - -if test "$REPO" = ""; then - echo "No repository specified; using ${PWD}" - REPO=${PWD} -fi - -if test "${TMPDIR}" = ""; then - TMPDIR=/tmp; -fi - -echo "Repository: ${REPO}" - -if [ -e "${REPO}/.git" ] ; then - TYPE=git; -elif [ -e "${REPO}/.hg" ] ; then - TYPE=hg; -else - echo "No Mercurial or Git repository detected."; - exit 1; -fi - -if test "$OLD_RELEASE" = "" || test "$NEW_RELEASE" = ""; then - echo "ERROR: Need to specify old and new release"; - exit 2; -fi - -echo "Listing fixes between $OLD_RELEASE and $NEW_RELEASE in $REPO" -rm -f "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" "${TMPDIR}/fixes" -for repos in . $("${SCRIPT_DIR}/discover_trees.sh" "${REPO}"); -do - if test "$TYPE" = "hg"; then - hg log -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R "$REPO/$repos" -G -M "${REPO}/${SUBDIR}" | \ - grep -E '^[o:| ]*summary'|grep -v 'Added tag'|sed -r 's#^[o:| ]*summary:\W*([0-9])# - JDK-\1#'| \ - sed 's#^[o:| ]*summary:\W*# - #' >> "${TMPDIR}/fixes2"; - hg log -v -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R "$REPO/$repos" -G -M "${REPO}/${SUBDIR}" | \ - grep -E '^[o:| ]*[0-9]{7}'|sed -r 's#^[o:| ]*([0-9]{7})# - JDK-\1#' >> "${TMPDIR}/fixes3"; - else - git -C "${REPO}" log --no-merges --pretty=format:%B "${NEW_RELEASE}...${OLD_RELEASE}" -- "${SUBDIR}" |grep -E '^[0-9]{7}' | \ - sed -r 's#^([0-9])# - JDK-\1#' >> "${TMPDIR}/fixes2"; - touch "${TMPDIR}/fixes3" ; # unused - fi -done - -sort "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" > "${TMPDIR}/fixes4" -uniq "${TMPDIR}/fixes4" > "${TMPDIR}/fixes" -rm -f "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" - -if ! [ -s "${TMPDIR}/fixes" ] ; then - echo "Failed to obtain fixes."; - exit 3; -fi - -echo "In ${TMPDIR}/fixes:" -cat "${TMPDIR}/fixes" - -printf "\nChecking for duplicates..."; -if uniq -d "${TMPDIR}/fixes4" | grep 'JDK' > "${TMPDIR}/dupes"; then - printf "found.\nWARNING: Review the following duplicates:\n"; - cat "${TMPDIR}/dupes"; -else - echo "No apparent duplicates."; -fi -rm -f "${TMPDIR}/fixes4"; - -printf "\nChecking for backouts..."; -if grep -i 'backout' "${TMPDIR}/fixes" > "${TMPDIR}/backouts"; then - printf "found.\nWARNING: Review the following backouts:\n" - cat "${TMPDIR}/backouts"; -else - echo "No apparent backouts."; -fi -printf "\nChecking for bundled library updates..."; -if grep -iE ':( \(tz\))? update.*(freetype|gif|harfbuzz|lcms|jpeg|png|timezone|zlib)' "${TMPDIR}/fixes" > "${TMPDIR}/bundles"; then - printf "found.\nWARNING: Review the following with respect to bundled provides:\n"; - cat "${TMPDIR}/bundles"; - echo "Compare the output of $(dirname "${0}")/get_bundle_versions.sh with the RPM using the JDK source tree" -else - echo "No apparent library updates."; -fi - -# Local Variables: -# compile-command: "shellcheck openjdk_news.sh" -# fill-column: 80 -# indent-tabs-mode: nil -# sh-basic-offset: 4 -# End: diff --git a/sources b/sources index 404d038..d00eba7 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (openjdk-26+29-ea.tar.xz) = 4e80882e0de26eff7d46d762e255911d42544473cc5f12ab0af1997969a14cc697e1164cb3c90d894359b58cc42dbd2b233f00fa807dbfad41583da278e26666 +SHA512 (openjdk-24.0.1+9.tar.xz) = 44bd46f4478d6c466850c39bfefd575bf05f349f58512ecb4ec441eebc7282e27b8dc521a3e7b9d086ada0b43f7399f2258a4237b635a891727144b67911a185