From dcabb97227ad047a3aa331c7e0c9fe519beb2304 Mon Sep 17 00:00:00 2001 From: Severin Gehwolf Date: Thu, 17 Apr 2025 12:30:34 +0200 Subject: [PATCH 01/23] Fix FTBFS in rawhide with GCC 15 --- 0001-Fix-name-class-of-uabs-with-GCC-15.patch | 198 ++++++++++++++++++ java-latest-openjdk-portable.spec | 5 +- 2 files changed, 201 insertions(+), 2 deletions(-) create mode 100644 0001-Fix-name-class-of-uabs-with-GCC-15.patch diff --git a/0001-Fix-name-class-of-uabs-with-GCC-15.patch b/0001-Fix-name-class-of-uabs-with-GCC-15.patch new file mode 100644 index 0000000..0825c72 --- /dev/null +++ b/0001-Fix-name-class-of-uabs-with-GCC-15.patch @@ -0,0 +1,198 @@ +From 0fd5cab226219eda13b8d3864797bea034ed3f70 Mon Sep 17 00:00:00 2001 +From: Severin Gehwolf +Date: Thu, 17 Apr 2025 11:48:31 +0200 +Subject: [PATCH] Fix name class of uabs with GCC 15 + +--- + src/hotspot/cpu/aarch64/assembler_aarch64.cpp | 2 +- + src/hotspot/cpu/aarch64/assembler_aarch64.hpp | 2 +- + src/hotspot/cpu/aarch64/macroAssembler_aarch64.cpp | 2 +- + src/hotspot/cpu/aarch64/stubGenerator_aarch64.cpp | 4 ++-- + src/hotspot/cpu/riscv/assembler_riscv.hpp | 2 +- + src/hotspot/cpu/riscv/stubGenerator_riscv.cpp | 4 ++-- + src/hotspot/share/opto/mulnode.cpp | 4 ++-- + src/hotspot/share/opto/subnode.cpp | 4 ++-- + src/hotspot/share/utilities/globalDefinitions.hpp | 12 ++++++++---- + 9 files changed, 20 insertions(+), 16 deletions(-) + +diff --git a/src/hotspot/cpu/aarch64/assembler_aarch64.cpp b/src/hotspot/cpu/aarch64/assembler_aarch64.cpp +index 76f88764416..946bf1c4406 100644 +--- a/src/hotspot/cpu/aarch64/assembler_aarch64.cpp ++++ b/src/hotspot/cpu/aarch64/assembler_aarch64.cpp +@@ -457,7 +457,7 @@ void Assembler::bang_stack_with_offset(int offset) { Unimplemented(); } + + bool asm_util::operand_valid_for_immediate_bits(int64_t imm, unsigned nbits) { + guarantee(nbits == 8 || nbits == 12, "invalid nbits value"); +- uint64_t uimm = (uint64_t)uabs((jlong)imm); ++ uint64_t uimm = (uint64_t)UABS((jlong)imm); + if (uimm < (UCONST64(1) << nbits)) + return true; + if (uimm < (UCONST64(1) << (2 * nbits)) +diff --git a/src/hotspot/cpu/aarch64/assembler_aarch64.hpp b/src/hotspot/cpu/aarch64/assembler_aarch64.hpp +index a5e0e2665af..639af579d9f 100644 +--- a/src/hotspot/cpu/aarch64/assembler_aarch64.hpp ++++ b/src/hotspot/cpu/aarch64/assembler_aarch64.hpp +@@ -932,7 +932,7 @@ class Assembler : public AbstractAssembler { + static const uint64_t branch_range = NOT_DEBUG(128 * M) DEBUG_ONLY(2 * M); + + static bool reachable_from_branch_at(address branch, address target) { +- return uabs(target - branch) < branch_range; ++ return UABS(target - branch) < branch_range; + } + + // Unconditional branch (immediate) +diff --git a/src/hotspot/cpu/aarch64/macroAssembler_aarch64.cpp b/src/hotspot/cpu/aarch64/macroAssembler_aarch64.cpp +index d561fb912a3..3a7d2b96ecf 100644 +--- a/src/hotspot/cpu/aarch64/macroAssembler_aarch64.cpp ++++ b/src/hotspot/cpu/aarch64/macroAssembler_aarch64.cpp +@@ -3271,7 +3271,7 @@ void MacroAssembler::wrap_add_sub_imm_insn(Register Rd, Register Rn, uint64_t im + if (fits) { + (this->*insn1)(Rd, Rn, imm); + } else { +- if (uabs(imm) < (1 << 24)) { ++ if (UABS(imm) < (1 << 24)) { + (this->*insn1)(Rd, Rn, imm & -(1 << 12)); + (this->*insn1)(Rd, Rd, imm & ((1 << 12)-1)); + } else { +diff --git a/src/hotspot/cpu/aarch64/stubGenerator_aarch64.cpp b/src/hotspot/cpu/aarch64/stubGenerator_aarch64.cpp +index de5df5c1af1..0acac529a20 100644 +--- a/src/hotspot/cpu/aarch64/stubGenerator_aarch64.cpp ++++ b/src/hotspot/cpu/aarch64/stubGenerator_aarch64.cpp +@@ -1133,7 +1133,7 @@ class StubGenerator: public StubCodeGenerator { + + void copy_memory_small(DecoratorSet decorators, BasicType type, Register s, Register d, Register count, int step) { + bool is_backwards = step < 0; +- size_t granularity = uabs(step); ++ size_t granularity = UABS(step); + int direction = is_backwards ? -1 : 1; + + Label Lword, Lint, Lshort, Lbyte; +@@ -1192,7 +1192,7 @@ class StubGenerator: public StubCodeGenerator { + Register s, Register d, Register count, int step) { + copy_direction direction = step < 0 ? copy_backwards : copy_forwards; + bool is_backwards = step < 0; +- unsigned int granularity = uabs(step); ++ unsigned int granularity = UABS(step); + const Register t0 = r3, t1 = r4; + + // <= 80 (or 96 for SIMD) bytes do inline. Direction doesn't matter because we always +diff --git a/src/hotspot/cpu/riscv/assembler_riscv.hpp b/src/hotspot/cpu/riscv/assembler_riscv.hpp +index 31713d7362a..e193cf9fbb7 100644 +--- a/src/hotspot/cpu/riscv/assembler_riscv.hpp ++++ b/src/hotspot/cpu/riscv/assembler_riscv.hpp +@@ -3393,7 +3393,7 @@ enum Nf { + static const unsigned long branch_range = 1 * M; + + static bool reachable_from_branch_at(address branch, address target) { +- return uabs(target - branch) < branch_range; ++ return UABS(target - branch) < branch_range; + } + + // Decode the given instruction, checking if it's a 16-bit compressed +diff --git a/src/hotspot/cpu/riscv/stubGenerator_riscv.cpp b/src/hotspot/cpu/riscv/stubGenerator_riscv.cpp +index 7e6fe50e8f8..35192700673 100644 +--- a/src/hotspot/cpu/riscv/stubGenerator_riscv.cpp ++++ b/src/hotspot/cpu/riscv/stubGenerator_riscv.cpp +@@ -874,7 +874,7 @@ class StubGenerator: public StubCodeGenerator { + + void copy_memory_v(Register s, Register d, Register count, int step) { + bool is_backward = step < 0; +- int granularity = uabs(step); ++ int granularity = UABS(step); + + const Register src = x30, dst = x31, vl = x14, cnt = x15, tmp1 = x16, tmp2 = x17; + assert_different_registers(s, d, cnt, vl, tmp1, tmp2); +@@ -936,7 +936,7 @@ class StubGenerator: public StubCodeGenerator { + } + + bool is_backwards = step < 0; +- int granularity = uabs(step); ++ int granularity = UABS(step); + + const Register src = x30, dst = x31, cnt = x15, tmp3 = x16, tmp4 = x17, tmp5 = x14, tmp6 = x13; + const Register gct1 = x28, gct2 = x29, gct3 = t2; +diff --git a/src/hotspot/share/opto/mulnode.cpp b/src/hotspot/share/opto/mulnode.cpp +index ad98fda025f..a51024eb578 100644 +--- a/src/hotspot/share/opto/mulnode.cpp ++++ b/src/hotspot/share/opto/mulnode.cpp +@@ -245,7 +245,7 @@ Node *MulINode::Ideal(PhaseGVN *phase, bool can_reshape) { + // Check for negative constant; if so negate the final result + bool sign_flip = false; + +- unsigned int abs_con = uabs(con); ++ unsigned int abs_con = UABS(con); + if (abs_con != (unsigned int)con) { + sign_flip = true; + } +@@ -480,7 +480,7 @@ Node *MulLNode::Ideal(PhaseGVN *phase, bool can_reshape) { + + // Check for negative constant; if so negate the final result + bool sign_flip = false; +- julong abs_con = uabs(con); ++ julong abs_con = UABS(con); + if (abs_con != (julong)con) { + sign_flip = true; + } +diff --git a/src/hotspot/share/opto/subnode.cpp b/src/hotspot/share/opto/subnode.cpp +index f1eca4682bd..a79c1c86e96 100644 +--- a/src/hotspot/share/opto/subnode.cpp ++++ b/src/hotspot/share/opto/subnode.cpp +@@ -1923,14 +1923,14 @@ const Type* AbsNode::Value(PhaseGVN* phase) const { + case Type::Int: { + const TypeInt* ti = t1->is_int(); + if (ti->is_con()) { +- return TypeInt::make(uabs(ti->get_con())); ++ return TypeInt::make(UABS(ti->get_con())); + } + break; + } + case Type::Long: { + const TypeLong* tl = t1->is_long(); + if (tl->is_con()) { +- return TypeLong::make(uabs(tl->get_con())); ++ return TypeLong::make(UABS(tl->get_con())); + } + break; + } +diff --git a/src/hotspot/share/utilities/globalDefinitions.hpp b/src/hotspot/share/utilities/globalDefinitions.hpp +index ccd3106b471..274c0591411 100644 +--- a/src/hotspot/share/utilities/globalDefinitions.hpp ++++ b/src/hotspot/share/utilities/globalDefinitions.hpp +@@ -1142,9 +1142,13 @@ inline T clamp(T value, T min, T max) { + inline bool is_odd (intx x) { return x & 1; } + inline bool is_even(intx x) { return !is_odd(x); } + ++// Some compilers define uabs() in a conflicting way (e.g. GCC 15), ++// use a macro to work-around that name clash by calling it custom_uabs ++#define UABS(x) custom_uabs(x) ++ + // abs methods which cannot overflow and so are well-defined across + // the entire domain of integer types. +-static inline unsigned int uabs(unsigned int n) { ++static inline unsigned int custom_uabs(unsigned int n) { + union { + unsigned int result; + int value; +@@ -1153,7 +1157,7 @@ static inline unsigned int uabs(unsigned int n) { + if (value < 0) result = 0-result; + return result; + } +-static inline julong uabs(julong n) { ++static inline julong custom_uabs(julong n) { + union { + julong result; + jlong value; +@@ -1162,8 +1166,8 @@ static inline julong uabs(julong n) { + if (value < 0) result = 0-result; + return result; + } +-static inline julong uabs(jlong n) { return uabs((julong)n); } +-static inline unsigned int uabs(int n) { return uabs((unsigned int)n); } ++static inline julong custom_uabs(jlong n) { return custom_uabs((julong)n); } ++static inline unsigned int custom_uabs(int n) { return custom_uabs((unsigned int)n); } + + // "to" should be greater than "from." + inline size_t byte_size(void* from, void* to) { +-- +2.49.0 + diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index c7ee334..18ff103 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -700,8 +700,8 @@ Source19: BuildShaSumFile.java # OpenJDK patches in need of upstreaming # ############################################# - -# Currently empty +# Fix rawhide build failure with GCC 15 +Patch1100: 0001-Fix-name-class-of-uabs-with-GCC-15.patch ############################################# # @@ -1017,6 +1017,7 @@ pushd %{top_level_dir_name} # Add crypto policy and FIPS support # Skipping fips patch whil eit is not ready for jdk22 %%patch -P1001 -p1 # Patches in need of upstreaming +%patch -P1100 -p1 # Patches which missed the 24+36 GA release %patch -P2000 -p1 %patch -P2001 -p1 From 2f7e59623f1590319c486a9028abed9bb2d4276d Mon Sep 17 00:00:00 2001 From: Severin Gehwolf Date: Tue, 22 Apr 2025 18:22:01 +0200 Subject: [PATCH 02/23] Revert hash sum calculation patches --- ...-Add-support-for-extra-jlink-options.patch | 65 -- ...r-hash-sum-overrides-when-linking-fr.patch | 830 ------------------ java-latest-openjdk-portable.spec | 7 - 3 files changed, 902 deletions(-) delete mode 100644 0001-8352692-Add-support-for-extra-jlink-options.patch delete mode 100644 0002-8352689-Allow-for-hash-sum-overrides-when-linking-fr.patch diff --git a/0001-8352692-Add-support-for-extra-jlink-options.patch b/0001-8352692-Add-support-for-extra-jlink-options.patch deleted file mode 100644 index 6b20564..0000000 --- a/0001-8352692-Add-support-for-extra-jlink-options.patch +++ /dev/null @@ -1,65 +0,0 @@ -From bc0ebeddc31949a5d84a9494e8adccc2bade357e Mon Sep 17 00:00:00 2001 -From: Severin Gehwolf -Date: Wed, 26 Mar 2025 10:53:07 +0000 -Subject: [PATCH 1/2] 8352692: Add support for extra jlink options - -Reviewed-by: ihse, erikj ---- - make/Images.gmk | 4 ++++ - make/autoconf/jdk-options.m4 | 12 ++++++++++++ - make/autoconf/spec.gmk.template | 1 + - 3 files changed, 17 insertions(+) - -diff --git a/make/Images.gmk b/make/Images.gmk -index c5d0ef11b5d..cbaf85f7942 100644 ---- a/make/Images.gmk -+++ b/make/Images.gmk -@@ -101,6 +101,10 @@ ifeq ($(JLINK_PRODUCE_LINKABLE_RUNTIME), true) - JLINK_JDK_EXTRA_OPTS += --generate-linkable-runtime - endif - -+ifneq ($(JLINK_USER_EXTRA_FLAGS), ) -+ JLINK_JDK_EXTRA_OPTS += $(JLINK_USER_EXTRA_FLAGS) -+endif -+ - $(eval $(call SetupExecute, jlink_jdk, \ - WARN := Creating jdk image, \ - DEPS := $(JDK_JMODS) $(BASE_RELEASE_FILE) \ -diff --git a/make/autoconf/jdk-options.m4 b/make/autoconf/jdk-options.m4 -index 61638ce5a2c..b6fce9cc323 100644 ---- a/make/autoconf/jdk-options.m4 -+++ b/make/autoconf/jdk-options.m4 -@@ -628,6 +628,18 @@ AC_DEFUN_ONCE([JDKOPT_SETUP_JLINK_OPTIONS], - DEFAULT_DESC: [enabled by default unless --enable-linkable-runtime is set], - CHECKING_MSG: [if packaged modules are kept]) - AC_SUBST(JLINK_KEEP_PACKAGED_MODULES) -+ -+ ################################################################################ -+ # -+ # Extra jlink options to be (optionally) passed to the JDK build -+ # -+ UTIL_ARG_WITH(NAME: extra-jlink-flags, TYPE: string, -+ DEFAULT: [], -+ DESC: [extra flags to be passed to jlink during the build], -+ OPTIONAL: true) -+ -+ JLINK_USER_EXTRA_FLAGS="$EXTRA_JLINK_FLAGS" -+ AC_SUBST(JLINK_USER_EXTRA_FLAGS) - ]) - - ################################################################################ -diff --git a/make/autoconf/spec.gmk.template b/make/autoconf/spec.gmk.template -index 18770c6d360..63d5ce05147 100644 ---- a/make/autoconf/spec.gmk.template -+++ b/make/autoconf/spec.gmk.template -@@ -710,6 +710,7 @@ NEW_JAVADOC = $(INTERIM_LANGTOOLS_ARGS) $(JAVADOC_MAIN_CLASS) - JMOD_COMPRESS := @JMOD_COMPRESS@ - JLINK_KEEP_PACKAGED_MODULES := @JLINK_KEEP_PACKAGED_MODULES@ - JLINK_PRODUCE_LINKABLE_RUNTIME := @JLINK_PRODUCE_LINKABLE_RUNTIME@ -+JLINK_USER_EXTRA_FLAGS := @JLINK_USER_EXTRA_FLAGS@ - - RCFLAGS := @RCFLAGS@ - --- -2.49.0 - diff --git a/0002-8352689-Allow-for-hash-sum-overrides-when-linking-fr.patch b/0002-8352689-Allow-for-hash-sum-overrides-when-linking-fr.patch deleted file mode 100644 index 0cc63db..0000000 --- a/0002-8352689-Allow-for-hash-sum-overrides-when-linking-fr.patch +++ /dev/null @@ -1,830 +0,0 @@ -From 2a5c9b874aa86b244dec041bed05ca3d1f66ccaa Mon Sep 17 00:00:00 2001 -From: Severin Gehwolf -Date: Thu, 27 Mar 2025 14:50:54 +0100 -Subject: [PATCH 2/2] 8352689: Allow for hash sum overrides when linking from - the run-time image - ---- - .../jdk/tools/jlink/internal/JRTArchive.java | 34 +++++- - .../jdk/tools/jlink/internal/Jlink.java | 12 +- - .../jdk/tools/jlink/internal/JlinkTask.java | 72 +++++++++++- - .../jlink/internal/LinkableRuntimeImage.java | 17 ++- - .../tools/jlink/resources/jlink.properties | 6 + - test/jdk/tools/jlink/IntegrationTest.java | 4 +- - .../jlink/runtimeImage/AddOptionsTest.java | 1 - - .../BasicJlinkMissingJavaBase.java | 1 - - .../jlink/runtimeImage/BasicJlinkTest.java | 1 - - .../runtimeImage/CustomModuleJlinkTest.java | 1 - - .../runtimeImage/GenerateJLIClassesTest.java | 1 - - .../runtimeImage/JavaSEReproducibleTest.java | 1 - - .../KeepPackagedModulesFailTest.java | 1 - - .../runtimeImage/ModifiedFilesExitTest.java | 1 - - .../ModifiedFilesWarningTest.java | 1 - - .../ModifiedFilesWithShaOverrideBase.java | 111 ++++++++++++++++++ - .../ModifiedFilesWithShaOverrideFileTest.java | 77 ++++++++++++ - .../ModifiedFilesWithShaOverrideTest.java | 65 ++++++++++ - .../jlink/runtimeImage/MultiHopTest.java | 1 - - ...PackagedModulesVsRuntimeImageLinkTest.java | 1 - - .../PatchedJDKModuleJlinkTest.java | 1 - - .../jlink/runtimeImage/SystemModulesTest.java | 1 - - .../runtimeImage/SystemModulesTest2.java | 1 - - 23 files changed, 376 insertions(+), 36 deletions(-) - create mode 100644 test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideBase.java - create mode 100644 test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideFileTest.java - create mode 100644 test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideTest.java - -diff --git a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JRTArchive.java b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JRTArchive.java -index df7d35ac777..823d03c50fe 100644 ---- a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JRTArchive.java -+++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JRTArchive.java -@@ -1,5 +1,5 @@ - /* -- * Copyright (c) 2024, Red Hat, Inc. -+ * Copyright (c) 2024, 2025, Red Hat, Inc. - * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. - * - * This code is free software; you can redistribute it and/or modify it -@@ -41,10 +41,12 @@ - import java.util.ArrayList; - import java.util.Arrays; - import java.util.Collections; -+import java.util.HashSet; - import java.util.HexFormat; - import java.util.List; - import java.util.Map; - import java.util.Objects; -+import java.util.Set; - import java.util.function.Function; - import java.util.function.Predicate; - import java.util.stream.Collectors; -@@ -74,6 +76,7 @@ public class JRTArchive implements Archive { - // Maps a module resource path to the corresponding diff to packaged - // modules for that resource (if any) - private final Map resDiff; -+ private final Map> altHashSums; - private final boolean errorOnModifiedFile; - private final TaskHelper taskHelper; - -@@ -86,11 +89,15 @@ public class JRTArchive implements Archive { - * install aborts the link. - * @param perModDiff The lib/modules (a.k.a jimage) diff for this module, - * possibly an empty list if there are no differences. -+ * @param altHashSums A map of alternative hash sums for files in -+ * a module, possibly empty. -+ * @param taskHelper The task helper reference. - */ - JRTArchive(String module, - Path path, - boolean errorOnModifiedFile, - List perModDiff, -+ Map> altHashSums, - TaskHelper taskHelper) { - this.module = module; - this.path = path; -@@ -105,6 +112,7 @@ public class JRTArchive implements Archive { - this.resDiff = Objects.requireNonNull(perModDiff).stream() - .collect(Collectors.toMap(ResourceDiff::getName, Function.identity())); - this.taskHelper = taskHelper; -+ this.altHashSums = altHashSums; - } - - @Override -@@ -217,7 +225,21 @@ private void addNonClassResources() { - - // Read from the base JDK image. - Path path = BASE.resolve(m.resPath); -- if (shaSumMismatch(path, m.hashOrTarget, m.symlink)) { -+ // Allow for additional hash sums so as to support -+ // file modifications done after jlink has run at build -+ // time. For example for Windows builds done with -+ // --with-external-symbols-in-bundles=public or -+ // distribution builds, where some post-processing happens -+ // on produced binaries and libraries invalidating the -+ // hash sum included in the jdk.jlink module for those -+ // files at jlink-time -+ Set shaSums = new HashSet<>(); -+ shaSums.add(m.hashOrTarget); -+ Set extra = altHashSums.get(m.resPath); -+ if (extra != null) { -+ shaSums.addAll(extra); -+ } -+ if (shaSumMismatch(path, shaSums, m.symlink)) { - if (errorOnModifiedFile) { - String msg = taskHelper.getMessage("err.runtime.link.modified.file", path.toString()); - IOException cause = new IOException(msg); -@@ -239,14 +261,12 @@ private void addNonClassResources() { - } - } - -- static boolean shaSumMismatch(Path res, String expectedSha, boolean isSymlink) { -+ static boolean shaSumMismatch(Path res, Set expectedShas, boolean isSymlink) { - if (isSymlink) { - return false; - } - // handle non-symlink resources - try { -- HexFormat format = HexFormat.of(); -- byte[] expected = format.parseHex(expectedSha); - MessageDigest digest = MessageDigest.getInstance("SHA-512"); - try (InputStream is = Files.newInputStream(res)) { - byte[] buf = new byte[1024]; -@@ -256,7 +276,9 @@ static boolean shaSumMismatch(Path res, String expectedSha, boolean isSymlink) { - } - } - byte[] actual = digest.digest(); -- return !MessageDigest.isEqual(expected, actual); -+ // Convert actual to string -+ String strActual = HexFormat.of().formatHex(actual); -+ return !expectedShas.contains(strActual); - } catch (Exception e) { - throw new AssertionError("SHA-512 sum check failed!", e); - } -diff --git a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/Jlink.java b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/Jlink.java -index 99029651bfb..12e26bd4aef 100644 ---- a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/Jlink.java -+++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/Jlink.java -@@ -1,5 +1,5 @@ - /* -- * Copyright (c) 2015, 2024, Oracle and/or its affiliates. All rights reserved. -+ * Copyright (c) 2015, 2025, Oracle and/or its affiliates. All rights reserved. - * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. - * - * This code is free software; you can redistribute it and/or modify it -@@ -148,7 +148,7 @@ public static final class JlinkConfiguration { - private final Set modules; - private final ModuleFinder finder; - private final boolean linkFromRuntimeImage; -- private final boolean ignoreModifiedRuntime; -+ private final LinkableRuntimeImage.Config runtimeImageConfig; - private final boolean generateRuntimeImage; - - /** -@@ -162,13 +162,13 @@ public JlinkConfiguration(Path output, - Set modules, - ModuleFinder finder, - boolean linkFromRuntimeImage, -- boolean ignoreModifiedRuntime, -+ LinkableRuntimeImage.Config runtimeImageConfig, - boolean generateRuntimeImage) { - this.output = output; - this.modules = Objects.requireNonNull(modules); - this.finder = finder; - this.linkFromRuntimeImage = linkFromRuntimeImage; -- this.ignoreModifiedRuntime = ignoreModifiedRuntime; -+ this.runtimeImageConfig = runtimeImageConfig; - this.generateRuntimeImage = generateRuntimeImage; - } - -@@ -198,8 +198,8 @@ public boolean linkFromRuntimeImage() { - return linkFromRuntimeImage; - } - -- public boolean ignoreModifiedRuntime() { -- return ignoreModifiedRuntime; -+ public LinkableRuntimeImage.Config runtimeImageConfig() { -+ return runtimeImageConfig; - } - - public boolean isGenerateRuntimeImage() { -diff --git a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JlinkTask.java b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JlinkTask.java -index 928b9a47934..bf63f7e6795 100644 ---- a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JlinkTask.java -+++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JlinkTask.java -@@ -1,5 +1,5 @@ - /* -- * Copyright (c) 2015, 2024, Oracle and/or its affiliates. All rights reserved. -+ * Copyright (c) 2015, 2025, Oracle and/or its affiliates. All rights reserved. - * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. - * - * This code is free software; you can redistribute it and/or modify it -@@ -191,7 +191,43 @@ public class JlinkTask { - // be used for linking from the run-time image. - new Option(false, (task, opt, arg) -> { - task.options.generateLinkableRuntime = true; -- }, true, "--generate-linkable-runtime") -+ }, true, "--generate-linkable-runtime"), -+ new Option(true, (task, opt, arg) -> { -+ if (arg.startsWith("@")) { -+ // Read overrides from file -+ if (!task.options.shaOverrides.isEmpty()) { -+ // Only allow a single @file value -+ throw taskHelper.newBadArgs("err.sha.overrides.multiple"); -+ } -+ // Ignore non-existing sha overrides file. -+ // -+ // This is to allow for custom builds needing to optionally -+ // support run-time image links on (possibly) modified -+ // binaries/debuginfo files done after the JDK build -+ // -+ // Allow for JAVA_HOME relative paths for the file, by replacing -+ // the ${java.home} token in the file name -+ String fileName = arg.substring(1); -+ if (fileName.startsWith("${java.home}")) { -+ String javaHome = System.getProperty("java.home"); -+ fileName = javaHome + fileName.substring(12 /* ${java.home}.length() */); -+ } -+ Path file = Paths.get(fileName); -+ if (Files.exists(file)) { -+ try { -+ Files.readAllLines(file).stream() -+ .forEach(task.options.shaOverrides::add); -+ } catch (IOException e) { -+ throw taskHelper.newBadArgs("err.sha.overrides.freaderr", file.toString()); -+ } -+ } -+ } else { -+ // Allow multiple values, separated by comma in addition to -+ // multiple times the same option. -+ Arrays.asList(arg.split(",")).stream() -+ .forEach(task.options.shaOverrides::add); -+ } -+ }, true, "--sha-overrides"), - }; - - -@@ -235,6 +271,7 @@ static class OptionsValues { - boolean suggestProviders = false; - boolean ignoreModifiedRuntime = false; - boolean generateLinkableRuntime = false; -+ final Set shaOverrides = new HashSet<>(); - } - - public static final String OPTIONS_RESOURCE = "jdk/tools/jlink/internal/options"; -@@ -459,14 +496,41 @@ private JlinkConfiguration initJlinkConfig() throws BadArgs { - throw taskHelper.newBadArgs("err.runtime.link.packaged.mods"); - } - -+ LinkableRuntimeImage.Config linkableRuntimeConfig = new LinkableRuntimeImage.Config( -+ options.ignoreModifiedRuntime, -+ isLinkFromRuntime ? buildShaSumMap(taskHelper, options.shaOverrides) : null); - return new JlinkConfiguration(options.output, - roots, - finder, - isLinkFromRuntime, -- options.ignoreModifiedRuntime, -+ linkableRuntimeConfig, - options.generateLinkableRuntime); - } - -+ private Map>> buildShaSumMap(TaskHelper taskHelper, -+ Set shaOverrides) throws BadArgs { -+ Map>> moduleToFiles = new HashMap<>(); -+ for (String t: shaOverrides) { -+ String trimmed = t.trim(); -+ if (trimmed.startsWith("#")) { -+ // skip comment lines -+ continue; -+ } -+ String[] tokens = trimmed.split("\\|"); -+ if (tokens.length != 3) { -+ throw taskHelper.newBadArgs("err.sha.overrides.bad.format", t); -+ } -+ // t is a '|'-separated item of (in that order): -+ // -+ // -+ // -+ Map> perModuleMap = moduleToFiles.computeIfAbsent(tokens[0], k -> new HashMap<>()); -+ Set shaSumsPerFile = perModuleMap.computeIfAbsent(tokens[1], k -> new HashSet<>()); -+ shaSumsPerFile.add(tokens[2]); -+ } -+ return moduleToFiles; -+ } -+ - /* - * Creates a ModuleFinder for the given module paths. - */ -@@ -788,7 +852,7 @@ private static Archive newArchive(String module, - taskHelper.getMessage("err.not.a.module.directory", path)); - } - } else if (config.linkFromRuntimeImage()) { -- return LinkableRuntimeImage.newArchive(module, path, config.ignoreModifiedRuntime(), taskHelper); -+ return LinkableRuntimeImage.newArchive(module, path, config.runtimeImageConfig(), taskHelper); - } else { - throw new IllegalArgumentException( - taskHelper.getMessage("err.not.modular.format", module, path)); -diff --git a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java -index 935af4585ad..a9b146d55a2 100644 ---- a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java -+++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java -@@ -1,5 +1,5 @@ - /* -- * Copyright (c) 2024, Red Hat, Inc. -+ * Copyright (c) 2024, 2025, Red Hat, Inc. - * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. - * - * This code is free software; you can redistribute it and/or modify it -@@ -29,6 +29,8 @@ - import java.io.InputStream; - import java.nio.file.Path; - import java.util.List; -+import java.util.Map; -+import java.util.Set; - - import jdk.tools.jlink.internal.runtimelink.ResourceDiff; - -@@ -67,7 +69,7 @@ private static InputStream getDiffInputStream(String module) throws IOException - - public static Archive newArchive(String module, - Path path, -- boolean ignoreModifiedRuntime, -+ Config config, - TaskHelper taskHelper) { - assert isLinkableRuntime(); - // Here we retrieve the per module difference file, which is -@@ -81,8 +83,15 @@ public static Archive newArchive(String module, - throw new AssertionError("Failure to retrieve resource diff for " + - "module " + module, e); - } -- return new JRTArchive(module, path, !ignoreModifiedRuntime, perModuleDiff, taskHelper); -+ return new JRTArchive(module, -+ path, -+ !config.ignoreModifiedRuntime, -+ perModuleDiff, -+ // Empty map if no alternative sha sums -+ config.altHashSums.computeIfAbsent(module, k -> Map.of()), -+ taskHelper); - } - -- -+ static record Config(boolean ignoreModifiedRuntime, -+ Map>> altHashSums) {} - } -diff --git a/src/jdk.jlink/share/classes/jdk/tools/jlink/resources/jlink.properties b/src/jdk.jlink/share/classes/jdk/tools/jlink/resources/jlink.properties -index a491b758ea0..59f5860d131 100644 ---- a/src/jdk.jlink/share/classes/jdk/tools/jlink/resources/jlink.properties -+++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/resources/jlink.properties -@@ -127,6 +127,12 @@ err.runtime.link.packaged.mods=This JDK has no packaged modules.\ - err.runtime.link.modified.file={0} has been modified - err.runtime.link.patched.module=jlink does not support linking from the run-time image\ - \ when running on a patched runtime with --patch-module -+ -+# Linking from the run-time image, SHA sum handling -+err.sha.overrides.multiple=option --sha-overrides does not allow @file and non-file combinations -+err.sha.overrides.freaderr=Error reading file ''{0}'' passed with option --sha-overrides -+err.sha.overrides.bad.format=Bad format in --sha-overrides. Token was {0}. Expected || -+ - err.no.module.path=--module-path option must be specified with --add-modules ALL-MODULE-PATH - err.empty.module.path=No module found in module path ''{0}'' with --add-modules ALL-MODULE-PATH - err.limit.modules=--limit-modules not allowed with --add-modules ALL-MODULE-PATH -diff --git a/test/jdk/tools/jlink/IntegrationTest.java b/test/jdk/tools/jlink/IntegrationTest.java -index 5a8d0bce15a..818c31b9eef 100644 ---- a/test/jdk/tools/jlink/IntegrationTest.java -+++ b/test/jdk/tools/jlink/IntegrationTest.java -@@ -1,5 +1,5 @@ - /* -- * Copyright (c) 2015, 2024, Oracle and/or its affiliates. All rights reserved. -+ * Copyright (c) 2015, 2025, Oracle and/or its affiliates. All rights reserved. - * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. - * - * This code is free software; you can redistribute it and/or modify it -@@ -159,7 +159,7 @@ private static void test() throws Exception { - mods, - JlinkTask.limitFinder(JlinkTask.newModuleFinder(modulePaths), limits, mods), - linkFromRuntime, -- false /* ignore modified runtime */, -+ null /* run-time image link config */, - false /* generate run-time image */); - - List lst = new ArrayList<>(); -diff --git a/test/jdk/tools/jlink/runtimeImage/AddOptionsTest.java b/test/jdk/tools/jlink/runtimeImage/AddOptionsTest.java -index 827f7da624d..4f25bc3ee66 100644 ---- a/test/jdk/tools/jlink/runtimeImage/AddOptionsTest.java -+++ b/test/jdk/tools/jlink/runtimeImage/AddOptionsTest.java -@@ -33,7 +33,6 @@ - * @summary Test --add-options jlink plugin when linking from the run-time image - * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) - * @library ../../lib /test/lib -- * @enablePreview - * @modules java.base/jdk.internal.jimage - * jdk.jlink/jdk.tools.jlink.internal - * jdk.jlink/jdk.tools.jlink.plugin -diff --git a/test/jdk/tools/jlink/runtimeImage/BasicJlinkMissingJavaBase.java b/test/jdk/tools/jlink/runtimeImage/BasicJlinkMissingJavaBase.java -index ebf5b060665..cb28f6f2b86 100644 ---- a/test/jdk/tools/jlink/runtimeImage/BasicJlinkMissingJavaBase.java -+++ b/test/jdk/tools/jlink/runtimeImage/BasicJlinkMissingJavaBase.java -@@ -34,7 +34,6 @@ - * but java.xml.jmod present. It should link from the run-time image without errors. - * @requires (jlink.packagedModules & vm.compMode != "Xcomp" & os.maxMemory >= 2g) - * @library ../../lib /test/lib -- * @enablePreview - * @modules java.base/jdk.internal.jimage - * jdk.jlink/jdk.tools.jlink.internal - * jdk.jlink/jdk.tools.jlink.plugin -diff --git a/test/jdk/tools/jlink/runtimeImage/BasicJlinkTest.java b/test/jdk/tools/jlink/runtimeImage/BasicJlinkTest.java -index 8cbd74e5ed1..f82c16c036d 100644 ---- a/test/jdk/tools/jlink/runtimeImage/BasicJlinkTest.java -+++ b/test/jdk/tools/jlink/runtimeImage/BasicJlinkTest.java -@@ -32,7 +32,6 @@ - * @summary Test basic linking from the run-time image - * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) - * @library ../../lib /test/lib -- * @enablePreview - * @modules java.base/jdk.internal.jimage - * jdk.jlink/jdk.tools.jlink.internal - * jdk.jlink/jdk.tools.jlink.plugin -diff --git a/test/jdk/tools/jlink/runtimeImage/CustomModuleJlinkTest.java b/test/jdk/tools/jlink/runtimeImage/CustomModuleJlinkTest.java -index d6c237a173b..15cd88ae9fc 100644 ---- a/test/jdk/tools/jlink/runtimeImage/CustomModuleJlinkTest.java -+++ b/test/jdk/tools/jlink/runtimeImage/CustomModuleJlinkTest.java -@@ -32,7 +32,6 @@ - * @summary Test jmod-less jlink with a custom module - * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) - * @library ../../lib /test/lib -- * @enablePreview - * @modules java.base/jdk.internal.jimage - * jdk.jlink/jdk.tools.jlink.internal - * jdk.jlink/jdk.tools.jlink.plugin -diff --git a/test/jdk/tools/jlink/runtimeImage/GenerateJLIClassesTest.java b/test/jdk/tools/jlink/runtimeImage/GenerateJLIClassesTest.java -index e59d18bd6f0..2a45d920f2d 100644 ---- a/test/jdk/tools/jlink/runtimeImage/GenerateJLIClassesTest.java -+++ b/test/jdk/tools/jlink/runtimeImage/GenerateJLIClassesTest.java -@@ -32,7 +32,6 @@ - * @summary Verify JLI class generation in run-time image link mode - * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) - * @library ../../lib /test/lib -- * @enablePreview - * @modules java.base/jdk.internal.jimage - * jdk.jlink/jdk.tools.jlink.internal - * jdk.jlink/jdk.tools.jlink.plugin -diff --git a/test/jdk/tools/jlink/runtimeImage/JavaSEReproducibleTest.java b/test/jdk/tools/jlink/runtimeImage/JavaSEReproducibleTest.java -index a376d075ecd..b2137b7b94d 100644 ---- a/test/jdk/tools/jlink/runtimeImage/JavaSEReproducibleTest.java -+++ b/test/jdk/tools/jlink/runtimeImage/JavaSEReproducibleTest.java -@@ -33,7 +33,6 @@ - * image. - * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) - * @library ../../lib /test/lib -- * @enablePreview - * @modules java.base/jdk.internal.jimage - * jdk.jlink/jdk.tools.jlink.internal - * jdk.jlink/jdk.tools.jlink.plugin -diff --git a/test/jdk/tools/jlink/runtimeImage/KeepPackagedModulesFailTest.java b/test/jdk/tools/jlink/runtimeImage/KeepPackagedModulesFailTest.java -index 6fdaf5a9824..2b13043b1db 100644 ---- a/test/jdk/tools/jlink/runtimeImage/KeepPackagedModulesFailTest.java -+++ b/test/jdk/tools/jlink/runtimeImage/KeepPackagedModulesFailTest.java -@@ -34,7 +34,6 @@ - * --keep-packaged-modules fails as expected. - * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) - * @library ../../lib /test/lib -- * @enablePreview - * @modules java.base/jdk.internal.jimage - * jdk.jlink/jdk.tools.jlink.internal - * jdk.jlink/jdk.tools.jlink.plugin -diff --git a/test/jdk/tools/jlink/runtimeImage/ModifiedFilesExitTest.java b/test/jdk/tools/jlink/runtimeImage/ModifiedFilesExitTest.java -index 777ce302ce7..b318418de16 100644 ---- a/test/jdk/tools/jlink/runtimeImage/ModifiedFilesExitTest.java -+++ b/test/jdk/tools/jlink/runtimeImage/ModifiedFilesExitTest.java -@@ -33,7 +33,6 @@ - * and files have been modified - * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) - * @library ../../lib /test/lib -- * @enablePreview - * @modules java.base/jdk.internal.jimage - * jdk.jlink/jdk.tools.jlink.internal - * jdk.jlink/jdk.tools.jlink.plugin -diff --git a/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWarningTest.java b/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWarningTest.java -index c871024f37c..a309f5cbbc5 100644 ---- a/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWarningTest.java -+++ b/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWarningTest.java -@@ -32,7 +32,6 @@ - * image and files have been modified - * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) - * @library ../../lib /test/lib -- * @enablePreview - * @modules java.base/jdk.internal.jimage - * jdk.jlink/jdk.tools.jlink.internal - * jdk.jlink/jdk.tools.jlink.plugin -diff --git a/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideBase.java b/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideBase.java -new file mode 100644 -index 00000000000..529fbda2ef9 ---- /dev/null -+++ b/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideBase.java -@@ -0,0 +1,111 @@ -+/* -+ * Copyright (c) 2025, Red Hat, Inc. -+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. -+ * -+ * This code is free software; you can redistribute it and/or modify it -+ * under the terms of the GNU General Public License version 2 only, as -+ * published by the Free Software Foundation. -+ * -+ * This code is distributed in the hope that it will be useful, but WITHOUT -+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -+ * version 2 for more details (a copy is included in the LICENSE file that -+ * accompanied this code). -+ * -+ * You should have received a copy of the GNU General Public License version -+ * 2 along with this work; if not, write to the Free Software Foundation, -+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. -+ * -+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA -+ * or visit www.oracle.com if you need additional information or have any -+ * questions. -+ */ -+ -+import java.io.IOException; -+import java.io.InputStream; -+import java.nio.file.Files; -+import java.nio.file.Path; -+import java.security.MessageDigest; -+import java.util.ArrayList; -+import java.util.HexFormat; -+import java.util.List; -+ -+import jdk.test.lib.process.OutputAnalyzer; -+import jtreg.SkippedException; -+import tests.Helper; -+ -+/* -+ * Base class for sha overrides tests -+ */ -+public abstract class ModifiedFilesWithShaOverrideBase extends ModifiedFilesTest { -+ -+ protected static final String SHA_OVERRIDE_FLAG = "--sha-overrides"; -+ -+ @Override -+ protected Path modifyFileInImage(Path jmodLessImg) { -+ try { -+ Path libJVM = jmodLessImg.resolve("lib").resolve("server").resolve(System.mapLibraryName("jvm")); -+ String shaBefore = buildSHA512(libJVM); -+ List objcopy = new ArrayList<>(); -+ objcopy.add("objcopy"); -+ // The OpenJDK build doesn't strip all symbols by default. In order -+ // to get a different libjvm.so file, we strip everything. The -+ // expectation is for the sha to be different before and after the -+ // stripping of the file. -+ objcopy.add("--strip-all"); -+ objcopy.add(libJVM.toString()); -+ ProcessBuilder builder = new ProcessBuilder(objcopy); -+ Process p = builder.start(); -+ int returnVal = p.waitFor(); -+ if (returnVal != 0) { -+ throw new SkippedException("Stripping of libjvm failed. Is objcopy installed?"); -+ } -+ String shaAfter = buildSHA512(libJVM); -+ if (shaBefore.equals(shaAfter)) { -+ throw new SkippedException("Binary file would be the same before after - test skipped"); -+ } -+ return libJVM; -+ } catch (IOException | InterruptedException e) { -+ throw new SkippedException("Stripping of libjvm failed: " + e.getMessage()); -+ } -+ } -+ -+ @Override -+ void testAndAssert(Path modifiedFile, Helper helper, Path initialImage) throws Exception { -+ String extraJlinkOption = getShaOverrideOption(modifiedFile, initialImage); -+ CapturingHandler handler = new CapturingHandler(); -+ jlinkUsingImage(new JlinkSpecBuilder() -+ .helper(helper) -+ .imagePath(initialImage) -+ .name(getTargetName()) -+ .addModule("java.base") -+ .validatingModule("java.base") -+ .extraJlinkOpt(extraJlinkOption) // allow for the modified sha -+ .build(), handler); -+ OutputAnalyzer out = handler.analyzer(); -+ // verify we don't get a warning message for the modified file -+ out.stdoutShouldNotMatch(".* has been modified"); -+ out.stdoutShouldNotContain("java.lang.IllegalArgumentException"); -+ out.stdoutShouldNotContain("IOException"); -+ } -+ -+ public abstract String getTargetName(); -+ public abstract String getShaOverrideOption(Path modifiedFile, Path initialImage); -+ -+ protected String buildSHA512(Path modifiedFile) { -+ try { -+ MessageDigest digest = MessageDigest.getInstance("SHA-512"); -+ try (InputStream is = Files.newInputStream(modifiedFile)) { -+ byte[] buf = new byte[1024]; -+ int readBytes = -1; -+ while ((readBytes = is.read(buf)) != -1) { -+ digest.update(buf, 0, readBytes); -+ } -+ } -+ byte[] actual = digest.digest(); -+ return HexFormat.of().formatHex(actual); -+ } catch (Exception e) { -+ throw new AssertionError("SHA-512 sum generation failed"); -+ } -+ } -+} -diff --git a/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideFileTest.java b/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideFileTest.java -new file mode 100644 -index 00000000000..d20eecd40e7 ---- /dev/null -+++ b/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideFileTest.java -@@ -0,0 +1,77 @@ -+/* -+ * Copyright (c) 2025, Red Hat, Inc. -+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. -+ * -+ * This code is free software; you can redistribute it and/or modify it -+ * under the terms of the GNU General Public License version 2 only, as -+ * published by the Free Software Foundation. -+ * -+ * This code is distributed in the hope that it will be useful, but WITHOUT -+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -+ * version 2 for more details (a copy is included in the LICENSE file that -+ * accompanied this code). -+ * -+ * You should have received a copy of the GNU General Public License version -+ * 2 along with this work; if not, write to the Free Software Foundation, -+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. -+ * -+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA -+ * or visit www.oracle.com if you need additional information or have any -+ * questions. -+ */ -+ -+import java.io.File; -+import java.io.FileWriter; -+import java.io.IOException; -+import java.io.PrintWriter; -+import java.nio.file.Path; -+ -+/* -+ * @test -+ * @summary Verify no warnings are being produced on a modified file which -+ * gets the SHA override from a file -+ * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g & os.family == "linux") -+ * @library ../../lib /test/lib -+ * @modules java.base/jdk.internal.jimage -+ * jdk.jlink/jdk.tools.jlink.internal -+ * jdk.jlink/jdk.tools.jlink.plugin -+ * jdk.jlink/jdk.tools.jimage -+ * @build tests.* jdk.test.lib.process.OutputAnalyzer -+ * jdk.test.lib.process.ProcessTools -+ * @run main/othervm -Xmx1g ModifiedFilesWithShaOverrideFileTest -+ */ -+public class ModifiedFilesWithShaOverrideFileTest extends ModifiedFilesWithShaOverrideBase { -+ -+ public static void main(String[] args) throws Exception { -+ ModifiedFilesWithShaOverrideFileTest test = new ModifiedFilesWithShaOverrideFileTest(); -+ test.run(); -+ } -+ -+ @Override -+ String initialImageName() { -+ return "java-base-jlink-with-sha-override-file"; -+ } -+ -+ @Override -+ public String getTargetName() { -+ return "java-base-jlink-with-sha-override-file-target"; -+ } -+ -+ @Override -+ public String getShaOverrideOption(Path modifiedFile, Path initialImage) { -+ String strippedSha = buildSHA512(modifiedFile); -+ Path relativePath = initialImage.relativize(modifiedFile); -+ // Modified file is libjvm.so, which is in java.base -+ String overrideVal = String.format("%s|%s|%s", "java.base", relativePath.toString(), strippedSha); -+ // Write a file in JAVA_HOME of the linkable runtime with the sha -+ // override. -+ File overrideFile = initialImage.resolve("test_sha_override.txt").toFile(); -+ try (PrintWriter pw = new PrintWriter(new FileWriter(overrideFile))) { -+ pw.println(overrideVal); -+ } catch (IOException e) { -+ throw new AssertionError("Test failed unexpectedly: ", e); -+ } -+ return SHA_OVERRIDE_FLAG + "=@${java.home}/test_sha_override.txt"; -+ } -+} -diff --git a/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideTest.java b/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideTest.java -new file mode 100644 -index 00000000000..ef0e541655d ---- /dev/null -+++ b/test/jdk/tools/jlink/runtimeImage/ModifiedFilesWithShaOverrideTest.java -@@ -0,0 +1,65 @@ -+/* -+ * Copyright (c) 2025, Red Hat, Inc. -+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. -+ * -+ * This code is free software; you can redistribute it and/or modify it -+ * under the terms of the GNU General Public License version 2 only, as -+ * published by the Free Software Foundation. -+ * -+ * This code is distributed in the hope that it will be useful, but WITHOUT -+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -+ * version 2 for more details (a copy is included in the LICENSE file that -+ * accompanied this code). -+ * -+ * You should have received a copy of the GNU General Public License version -+ * 2 along with this work; if not, write to the Free Software Foundation, -+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. -+ * -+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA -+ * or visit www.oracle.com if you need additional information or have any -+ * questions. -+ */ -+ -+import java.nio.file.Path; -+ -+/* -+ * @test -+ * @summary Verify no warnings are being produced on a modified file which -+ * gets the SHA override from command line -+ * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g & os.family == "linux") -+ * @library ../../lib /test/lib -+ * @modules java.base/jdk.internal.jimage -+ * jdk.jlink/jdk.tools.jlink.internal -+ * jdk.jlink/jdk.tools.jlink.plugin -+ * jdk.jlink/jdk.tools.jimage -+ * @build tests.* jdk.test.lib.process.OutputAnalyzer -+ * jdk.test.lib.process.ProcessTools -+ * @run main/othervm -Xmx1g ModifiedFilesWithShaOverrideTest -+ */ -+public class ModifiedFilesWithShaOverrideTest extends ModifiedFilesWithShaOverrideBase { -+ -+ public static void main(String[] args) throws Exception { -+ ModifiedFilesWithShaOverrideTest test = new ModifiedFilesWithShaOverrideTest(); -+ test.run(); -+ } -+ -+ @Override -+ String initialImageName() { -+ return "java-base-jlink-with-sha-override"; -+ } -+ -+ @Override -+ public String getTargetName() { -+ return "java-base-jlink-with-sha-override-target"; -+ } -+ -+ @Override -+ public String getShaOverrideOption(Path modifiedFile, Path initialImage) { -+ String strippedSha = buildSHA512(modifiedFile); -+ Path relativePath = initialImage.relativize(modifiedFile); -+ // Modified file is libjvm.so, which is in java.base -+ String overrideVal = String.format("%s|%s|%s", "java.base", relativePath.toString(), strippedSha); -+ return SHA_OVERRIDE_FLAG + "=" + overrideVal; -+ } -+} -diff --git a/test/jdk/tools/jlink/runtimeImage/MultiHopTest.java b/test/jdk/tools/jlink/runtimeImage/MultiHopTest.java -index 0e2cabe7425..dfb7c9eb180 100644 ---- a/test/jdk/tools/jlink/runtimeImage/MultiHopTest.java -+++ b/test/jdk/tools/jlink/runtimeImage/MultiHopTest.java -@@ -33,7 +33,6 @@ - * @summary Verify that a jlink using the run-time image cannot include jdk.jlink - * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) - * @library ../../lib /test/lib -- * @enablePreview - * @modules java.base/jdk.internal.jimage - * jdk.jlink/jdk.tools.jlink.internal - * jdk.jlink/jdk.tools.jlink.plugin -diff --git a/test/jdk/tools/jlink/runtimeImage/PackagedModulesVsRuntimeImageLinkTest.java b/test/jdk/tools/jlink/runtimeImage/PackagedModulesVsRuntimeImageLinkTest.java -index d276e80702b..a49bac80dc0 100644 ---- a/test/jdk/tools/jlink/runtimeImage/PackagedModulesVsRuntimeImageLinkTest.java -+++ b/test/jdk/tools/jlink/runtimeImage/PackagedModulesVsRuntimeImageLinkTest.java -@@ -42,7 +42,6 @@ - * produce the same result - * @requires (jlink.packagedModules & vm.compMode != "Xcomp" & os.maxMemory >= 2g) - * @library ../../lib /test/lib -- * @enablePreview - * @modules java.base/jdk.internal.jimage - * jdk.jlink/jdk.tools.jlink.internal - * jdk.jlink/jdk.tools.jlink.plugin -diff --git a/test/jdk/tools/jlink/runtimeImage/PatchedJDKModuleJlinkTest.java b/test/jdk/tools/jlink/runtimeImage/PatchedJDKModuleJlinkTest.java -index d4654ec98bd..494b830a145 100644 ---- a/test/jdk/tools/jlink/runtimeImage/PatchedJDKModuleJlinkTest.java -+++ b/test/jdk/tools/jlink/runtimeImage/PatchedJDKModuleJlinkTest.java -@@ -35,7 +35,6 @@ - * @summary Test run-time link with --patch-module. Expect failure. - * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) - * @library ../../lib /test/lib -- * @enablePreview - * @modules java.base/jdk.internal.jimage - * jdk.jlink/jdk.tools.jlink.internal - * jdk.jlink/jdk.tools.jlink.plugin -diff --git a/test/jdk/tools/jlink/runtimeImage/SystemModulesTest.java b/test/jdk/tools/jlink/runtimeImage/SystemModulesTest.java -index d0a6234eec0..f9256068a40 100644 ---- a/test/jdk/tools/jlink/runtimeImage/SystemModulesTest.java -+++ b/test/jdk/tools/jlink/runtimeImage/SystemModulesTest.java -@@ -34,7 +34,6 @@ - * @summary Test appropriate handling of generated SystemModules* classes in run-time image link mode - * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) - * @library ../../lib /test/lib -- * @enablePreview - * @modules java.base/jdk.internal.jimage - * jdk.jlink/jdk.tools.jlink.internal - * jdk.jlink/jdk.tools.jlink.plugin -diff --git a/test/jdk/tools/jlink/runtimeImage/SystemModulesTest2.java b/test/jdk/tools/jlink/runtimeImage/SystemModulesTest2.java -index ee22a55f3a7..b77c5a760f9 100644 ---- a/test/jdk/tools/jlink/runtimeImage/SystemModulesTest2.java -+++ b/test/jdk/tools/jlink/runtimeImage/SystemModulesTest2.java -@@ -35,7 +35,6 @@ - * generated classes to not be there. - * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) - * @library ../../lib /test/lib -- * @enablePreview - * @modules java.base/jdk.internal.jimage - * jdk.jlink/jdk.tools.jlink.internal - * jdk.jlink/jdk.tools.jlink.plugin --- -2.49.0 - diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index 18ff103..218d036 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -708,10 +708,6 @@ Patch1100: 0001-Fix-name-class-of-uabs-with-GCC-15.patch # OpenJDK patches which missed last update # ############################################# -# 8352692: Add support for extra jlink options -Patch2000: 0001-8352692-Add-support-for-extra-jlink-options.patch -# 8352689: Allow for hash sum overrides when linking from the run-time image -Patch2001: 0002-8352689-Allow-for-hash-sum-overrides-when-linking-fr.patch ############################################# # @@ -1018,9 +1014,6 @@ pushd %{top_level_dir_name} # Skipping fips patch whil eit is not ready for jdk22 %%patch -P1001 -p1 # Patches in need of upstreaming %patch -P1100 -p1 -# Patches which missed the 24+36 GA release -%patch -P2000 -p1 -%patch -P2001 -p1 popd # openjdk From 4fa1f27deabf81a11fd8d9860b5267e0fc619b02 Mon Sep 17 00:00:00 2001 From: Severin Gehwolf Date: Tue, 22 Apr 2025 18:42:18 +0200 Subject: [PATCH 03/23] Don't do custom debuginfo stripping Use the --with-native-debug-symbols=external approach instead. --- BuildShaSumFile.java | 144 ------------------------------ java-latest-openjdk-portable.spec | 133 ++------------------------- 2 files changed, 9 insertions(+), 268 deletions(-) delete mode 100644 BuildShaSumFile.java diff --git a/BuildShaSumFile.java b/BuildShaSumFile.java deleted file mode 100644 index 8d5390c..0000000 --- a/BuildShaSumFile.java +++ /dev/null @@ -1,144 +0,0 @@ -import java.io.FileWriter; -import java.io.IOException; -import java.io.InputStream; -import java.io.PrintWriter; -import java.io.UncheckedIOException; -import java.lang.module.ModuleDescriptor; -import java.lang.module.ModuleFinder; -import java.lang.module.ModuleReference; -import java.nio.file.Files; -import java.nio.file.Path; -import java.security.MessageDigest; -import java.util.ArrayList; -import java.util.Arrays; -import java.util.HexFormat; -import java.util.List; -import java.util.Map; -import java.util.Scanner; -import java.util.Set; -import java.util.function.Function; -import java.util.spi.ToolProvider; -import java.util.stream.Collectors; - -public class BuildShaSumFile { - - // Mirrored from ResourcePoolEntry.Type: - private enum Type { - CLASS_OR_RESOURCE(0), - CONFIG(1), - HEADER_FILE(2), - LEGAL_NOTICE(3), - MAN_PAGE(4), - NATIVE_CMD(5), - NATIVE_LIB(6), - TOP(7); - - int intVal; - - Type(int val) { - this.intVal = val; - } - - Integer getOrdinal() { - return intVal; - } - } - - private static final String RESOURCE_FILE_FORMAT = "jdk/tools/jlink/internal/runtimelink/fs_%s_files"; - private static final Map TYPE_MAP = Arrays.stream(Type.values()) - .collect(Collectors.toMap(Type::getOrdinal, Function.identity())); - private static final Module JLINK_MODULE = ToolProvider.findFirst("jlink").orElseThrow().getClass().getModule(); - private static final Set BINARIES_LIBS = Set.of(Type.NATIVE_CMD, Type.NATIVE_LIB); - - private final String outPutFile; - - public BuildShaSumFile(String output) { - this.outPutFile = output; - } - - /* - * Use the fs__files resource part of jdk.jlink to - * figure out the files part of a module from the JDK image. - * - * Note that the file is of the following format: - * ||| - * - * Example: - * 5|0|428e61a697dc05f585333888f0d9baaef7dad088c279f052e189e401471d0c94e99711f567c5d1e5d2e08259c3b320b9d239cbb610f7c347b2eff4eec8ce712c|bin/jmod - */ - private List getModuleFiles(String module, Set includeTypes) { - List moduleFiles = new ArrayList<>(); - String resourceFile = String.format(RESOURCE_FILE_FORMAT, module); - try (InputStream in = JLINK_MODULE.getResourceAsStream(resourceFile); - Scanner scanner = new Scanner(in)) { - while (scanner.hasNextLine()) { - String[] tokens = scanner.nextLine().split("\\|", 4); - Integer typeInt = Integer.valueOf(tokens[0]); - Type type = TYPE_MAP.get(typeInt); - boolean isSymlink = Integer.valueOf(tokens[1]) == 1; - if (includeTypes.contains(type) && !isSymlink) { - moduleFiles.add(tokens[3]); - } - } - } catch (IOException e) { - throw new UncheckedIOException(e); - } - return moduleFiles; - } - - private String sha512Sum(String file) { - try { - MessageDigest digest = MessageDigest.getInstance("SHA-512"); - try (InputStream is = Files.newInputStream(Path.of(System.getProperty("java.home")).resolve(Path.of(file)))) { - byte[] buf = new byte[1024]; - int readBytes = -1; - while ((readBytes = is.read(buf)) != -1) { - digest.update(buf, 0, readBytes); - } - } - byte[] hashSum = digest.digest(); - return HexFormat.of().formatHex(hashSum); - } catch (Exception e) { - throw new RuntimeException("Failed to generate hash sum"); - } - } - - public void produceHashSumFile() { - // Sanity check JEP 493 enabled builds: - String resourceFile = String.format(RESOURCE_FILE_FORMAT, "java.base"); - try (InputStream in = JLINK_MODULE.getResourceAsStream(resourceFile)) { - if (in == null) { - System.out.println("Not a JEP 493 enabled build. Aborting!"); - return; - } - } catch (IOException e) { - throw new UncheckedIOException(e); - } - try (PrintWriter pw = new PrintWriter(new FileWriter(Path.of(outPutFile).toFile()))) { - ModuleFinder.ofSystem().findAll().stream() - .map(ModuleReference::descriptor) - .map(ModuleDescriptor::name).forEach(m -> { - List moduleFiles = getModuleFiles(m, BINARIES_LIBS); - for (String file: moduleFiles) { - String shaSum = sha512Sum(file); - pw.println(String.format("%s|%s|%s", m, file, shaSum)); - } - }); - - } catch (IOException e) { - throw new UncheckedIOException(e); - } - System.out.println("File " + outPutFile + " written. " + - "You can feed that now to 'jlink's --sha-overrides option."); - } - - public static void main(String[] args) { - if (args.length != 1) { - System.err.println("Usage: " + BuildShaSumFile.class.getSimpleName() + " "); - System.exit(1); - } - BuildShaSumFile b = new BuildShaSumFile(args[0]); - b.produceHashSumFile(); - } - -} diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index 218d036..1375e1a 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -551,9 +551,6 @@ ExcludeArch: %{ix86} %define java_static_libs_rpo() %{expand: } -%define java_unstripped_rpo() %{expand: -} - %define java_docs_rpo() %{expand: } @@ -645,10 +642,6 @@ Source16: CheckVendor.java # Ensure translations are available for new timezones Source18: TestTranslations.java -# Regenerate jmod-less jlink hashsums after the build do all evil things -# The stripped debuginfo may fail this operation, but that is currently broken anyway -Source19: BuildShaSumFile.java - ############################################ # # RPM/distribution specific patches @@ -920,17 +913,6 @@ The %{origin_nice} %{featurever} libraries for static linking - portable edition # staticlibs %endif -%if %{include_normal_build} -%package unstripped -Summary: The %{origin_nice} %{featurever} runtime environment. - -%{java_unstripped_rpo %{nil}} - -%description unstripped -The %{origin_nice} %{featurever} runtime environment. - -%endif - %if %{include_normal_build} %package docs Summary: %{origin_nice} %{featurever} API documentation @@ -1083,14 +1065,6 @@ gcc ${EXTRA_CFLAGS} -o %{altjavaoutputdir}/%{alt_java_name} %{SOURCE11} echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}" -function create_jlink_argfile() { - local argfile=${1} - - # Ensure parent directory exists - mkdir -p $(dirname ${argfile}) - echo "--sha-overrides=@\${java.home}/conf/runtimelink-sha-overrides.conf" > ${argfile} -} - function buildjdk() { local outputdir=${1} local buildjdk=${2} @@ -1101,8 +1075,6 @@ function buildjdk() { local top_dir_abs_src_path=$(pwd)/%{top_level_dir_name} local top_dir_abs_build_path=$(pwd)/${outputdir} - # Only used for "internal" debug symbols builds - local jlink_args_file=$top_dir_abs_build_path/jlink-args-file # This must be set using the global, so that the # static libraries still use a dynamic stdc++lib @@ -1112,9 +1084,6 @@ function buildjdk() { libc_link_opt="dynamic"; fi - jlink_flags="--save-jlink-argfiles=${jlink_args_file}" - create_jlink_argfile ${jlink_args_file} - echo "Using output directory: ${outputdir}"; echo "Checking build JDK ${buildjdk} is operational..." ${buildjdk}/bin/java -version @@ -1122,9 +1091,6 @@ function buildjdk() { echo "Using debuglevel: ${debuglevel}" echo "Using link_opt: ${link_opt}" echo "Using debug_symbols: ${debug_symbols}" - if [ -n "${jlink_flags}" ]; then - echo "Using extra jlink flags: '${jlink_flags}'" - fi echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}" mkdir -p ${outputdir} @@ -1159,7 +1125,6 @@ function buildjdk() { --enable-unlimited-crypto \ --enable-linkable-runtime \ --enable-keep-packaged-modules \ - --with-extra-jlink-flags="${jlink_flags}" \ --with-zlib=%{link_type} \ --with-freetype=%{link_type} \ --with-libjpeg=${link_opt} \ @@ -1192,59 +1157,11 @@ function buildjdk() { popd } -function stripjdk() { - local outputdir=${1} - local jdkimagepath=${outputdir}/images/%{jdkimage} - local jreimagepath=${outputdir}/images/%{jreimage} - local jmodimagepath=${outputdir}/images/jmods - local supportdir=${outputdir}/support - - if [ "x$suffix" = "x" ] ; then - # Keep the unstripped version for consumption by RHEL RPMs - cp -a ${jdkimagepath}{,.unstripped} - - # Strip the files - for file in $(find ${jdkimagepath} ${jreimagepath} ${supportdir} -type f) ; do - if file ${file} | grep -q 'ELF'; then - noextfile=${file/.so/}; - objcopy --only-keep-debug ${file} ${noextfile}.debuginfo; - objcopy --add-gnu-debuglink=${noextfile}.debuginfo ${file}; - strip -g ${file}; - fi - done - - # Rebuild jmod files against the stripped binaries - if [ ! -d ${supportdir} ] ; then - echo "Support directory missing."; - exit 15 - fi - for cmd in $(find ${supportdir} -name '*.jmod_exec.cmdline') ; do - pre=${cmd/_exec/_pre}; - post=${cmd/_exec/_post}; - jmod=$(echo ${cmd}|sed 's#.*_create_##'|sed 's#_exec.cmdline##') - echo "Rebuilding ${jmod} against stripped binaries..."; - if [ -e ${pre} ] ; then - echo "Executing ${pre}..."; - cat ${pre} | sh -s ; - fi - echo "Executing ${cmd}..."; - cat ${cmd} | sh -s ; - if [ -e ${post} ] ; then - echo "Executing ${post}..."; - cat ${post} | sh -s ; - fi - done - rm -rf ${jdkimagepath}/jmods - cp -a ${jmodimagepath} ${jdkimagepath} - fi -} - function installjdk() { local outputdir=${1} local installdir=${2} local jdkimagepath=${installdir}/images/%{jdkimage} local jreimagepath=${installdir}/images/%{jreimage} - local unstripped=${jdkimagepath}.unstripped echo "Installing build from ${outputdir} to ${installdir}..." mkdir -p ${installdir} @@ -1273,7 +1190,7 @@ function installjdk() { fi; done - for imagepath in ${jdkimagepath} ${jreimagepath} ${unstripped}; do + for imagepath in ${jdkimagepath} ${jreimagepath}; do if [ -d ${imagepath} ] ; then # the build (erroneously) removes read permissions from some jars @@ -1365,13 +1282,11 @@ function packagejdk() { jdkname=%{jdkportablename -- "$nameSuffix"} jdkarchive=${packagesdir}/%{jdkportablearchive -- "$nameSuffix"} - jmodsarchive=${packagesdir}/%{jmodsportablearchive -- "$nameSuffix"} jrename=%{jreportablename -- "$nameSuffix"} jrearchive=${packagesdir}/%{jreportablearchive -- "$nameSuffix"} staticname=%{staticlibsportablename -- "$nameSuffix"} staticarchive=${packagesdir}/%{staticlibsportablearchive -- "$nameSuffix"} debugarchive=${packagesdir}/%{jdkportablearchive -- "${nameSuffix}.debuginfo"} - unstrippedarchive=${packagesdir}/%{jdkportablearchive -- "${nameSuffix}.unstripped"} if [ "x$suffix" = "x" ] ; then docname=%{docportablename} docarchive=${packagesdir}/%{docportablearchive} @@ -1381,14 +1296,6 @@ function packagejdk() { miscname=%{miscportablename} miscarchive=${packagesdir}/%{miscportablearchive} - if [ "x$suffix" = "x" ] ; then - # Keep the unstripped version for consumption by RHEL RPMs - mv %{jdkimage}.unstripped ${jdkname} - tar -cJf ${unstrippedarchive} ${jdkname} - genchecksum ${unstrippedarchive} - mv ${jdkname} %{jdkimage}.unstripped - fi - # Rename directories for packaging mv %{jdkimage} ${jdkname} mv %{jreimage} ${jrename} @@ -1417,11 +1324,6 @@ function packagejdk() { genchecksum ${miscarchive} fi - tar -cJf ${jmodsarchive} --exclude='**.debuginfo' ${jdkname}/jmods - genchecksum ${jmodsarchive} - - rm -rv ${jdkname}/jmods - tar -cJf ${jdkarchive} --exclude='**.debuginfo' ${jdkname} genchecksum ${jdkarchive} @@ -1465,10 +1367,14 @@ for suffix in %{build_loop} ; do # change --something to something debugbuild=`echo $suffix | sed "s/-//g"` fi - # We build with internal debug symbols and do - # our own stripping for one version of the - # release build - debug_symbols=internal + # We build with 'external' debug symbols for the + # release build and build with 'internal' for + # slowdebug/fastdebug variants + if [ "x$suffix" = "x" ] ; then + debug_symbols=external + else + debug_symbols=internal + fi builddir=%{buildoutputdir -- ${suffix}} bootbuilddir=boot${builddir} @@ -1498,19 +1404,14 @@ for suffix in %{build_loop} ; do installjdk ${bootbuilddir} ${bootinstalldir} buildjdk ${builddir} $(pwd)/${bootinstalldir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} findgeneratedsources ${installdir} ${builddir} $(pwd)/%{top_level_dir_name} - stripjdk ${builddir} installjdk ${builddir} ${installdir} %{!?with_artifacts:rm -rf ${bootinstalldir}} else buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} findgeneratedsources ${installdir} ${builddir} $(pwd)/%{top_level_dir_name} - stripjdk ${builddir} installjdk ${builddir} ${installdir} fi - pushd ${installdir}/images/jdk/ - ./bin/java --add-opens=jdk.jlink/jdk.tools.jlink.internal.runtimelink=ALL-UNNAMED %{SOURCE19} ./conf/runtimelink-sha-overrides.conf - popd packagejdk ${installdir} ${packagesdir} %{altjavaoutputdir} %if %{system_libs} @@ -1703,16 +1604,12 @@ for suffix in %{build_loop} ; do # These definitions should match those in installjdk jdkarchive=${packagesdir}/%{jdkportablearchive -- "$nameSuffix"} - jmodsarchive=${packagesdir}/%{jmodsportablearchive -- "$nameSuffix"} jrearchive=${packagesdir}/%{jreportablearchive -- "$nameSuffix"} staticarchive=${packagesdir}/%{staticlibsportablearchive -- "$nameSuffix"} debugarchive=${packagesdir}/%{jdkportablearchive -- "${nameSuffix}.debuginfo"} - unstrippedarchive=${packagesdir}/%{jdkportablearchive -- "${nameSuffix}.unstripped"} mv ${jdkarchive} $RPM_BUILD_ROOT%{_jvmdir}/ mv ${jdkarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/ - mv ${jmodsarchive} $RPM_BUILD_ROOT%{_jvmdir}/ - mv ${jmodsarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/ mv ${jrearchive} $RPM_BUILD_ROOT%{_jvmdir}/ mv ${jrearchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/ @@ -1724,8 +1621,6 @@ for suffix in %{build_loop} ; do if [ "x$suffix" = "x" ] ; then mv ${debugarchive} $RPM_BUILD_ROOT%{_jvmdir}/ mv ${debugarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/ - mv ${unstrippedarchive} $RPM_BUILD_ROOT%{_jvmdir}/ - mv ${unstrippedarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/ fi done @@ -1762,8 +1657,6 @@ done %{_jvmdir}/%{jdkportablearchive -- .debuginfo} %{_jvmdir}/%{jdkportablearchiveForFiles}.sha256sum %{_jvmdir}/%{jdkportablearchive -- .debuginfo}.sha256sum -%{_jvmdir}/%{jmodsportablearchiveForFiles} -%{_jvmdir}/%{jmodsportablearchiveForFiles}.sha256sum %endif %if %{include_normal_build} @@ -1772,10 +1665,6 @@ done %{_jvmdir}/%{staticlibsportablearchiveForFiles} %{_jvmdir}/%{staticlibsportablearchiveForFiles}.sha256sum %endif - -%files unstripped -%{_jvmdir}/%{jdkportablearchive -- .unstripped} -%{_jvmdir}/%{jdkportablearchive -- .unstripped}.sha256sum %endif %if %{include_debug_build} @@ -1786,8 +1675,6 @@ done %files devel-slowdebug %{_jvmdir}/%{jdkportablearchive -- .slowdebug} %{_jvmdir}/%{jdkportablearchive -- .slowdebug}.sha256sum -%{_jvmdir}/%{jmodsportablearchive -- .slowdebug} -%{_jvmdir}/%{jmodsportablearchive -- .slowdebug}.sha256sum %if %{include_staticlibs} %files static-libs-slowdebug @@ -1804,8 +1691,6 @@ done %files devel-fastdebug %{_jvmdir}/%{jdkportablearchive -- .fastdebug} %{_jvmdir}/%{jdkportablearchive -- .fastdebug}.sha256sum -%{_jvmdir}/%{jmodsportablearchive -- .fastdebug} -%{_jvmdir}/%{jmodsportablearchive -- .fastdebug}.sha256sum %if %{include_staticlibs} %files static-libs-fastdebug From 73e20c5c38bc1f050ec9c617582b87c9e3dd9c80 Mon Sep 17 00:00:00 2001 From: Severin Gehwolf Date: Thu, 24 Apr 2025 15:08:54 +0200 Subject: [PATCH 04/23] Add patches for JDK-8353185 and JDK-8350137 Those are in the July CPU update (24.0.2). Add them ahead of time. --- ...K-8348975-Linux-builds-contain-man-p.patch | 55 +++ ...e-the-concept-of-upgradeable-files-i.patch | 381 ++++++++++++++++++ java-latest-openjdk-portable.spec | 8 + 3 files changed, 444 insertions(+) create mode 100644 0001-8350137-After-JDK-8348975-Linux-builds-contain-man-p.patch create mode 100644 0001-8353185-Introduce-the-concept-of-upgradeable-files-i.patch diff --git a/0001-8350137-After-JDK-8348975-Linux-builds-contain-man-p.patch b/0001-8350137-After-JDK-8348975-Linux-builds-contain-man-p.patch new file mode 100644 index 0000000..c5a9c5c --- /dev/null +++ b/0001-8350137-After-JDK-8348975-Linux-builds-contain-man-p.patch @@ -0,0 +1,55 @@ +From ef35e66937108b56742e4f1b9faddf7379aed805 Mon Sep 17 00:00:00 2001 +From: Nizar Benalla +Date: Wed, 26 Feb 2025 17:16:16 +0000 +Subject: [PATCH] 8350137: After JDK-8348975, Linux builds contain man pages + for windows only tools + +Backport-of: 53db57648a09c4c380064eea11fcdb680011d741 +--- + make/Docs.gmk | 2 +- + make/common/Modules.gmk | 9 ++++++++- + 2 files changed, 9 insertions(+), 2 deletions(-) + +diff --git a/make/Docs.gmk b/make/Docs.gmk +index fb2726e6dad..a75d8c74b7c 100644 +--- a/make/Docs.gmk ++++ b/make/Docs.gmk +@@ -680,7 +680,7 @@ ifeq ($(ENABLE_PANDOC), true) + + $(foreach m, $(ALL_MODULES), \ + $(eval MAN_$m := $(call ApplySpecFilter, $(filter %.md, $(call FindFiles, \ +- $(call FindModuleManDirs, $m))))) \ ++ $(call FindModuleManDirsForDocs, $m))))) \ + $(if $(MAN_$m), \ + $(eval $(call SetupProcessMarkdown, MAN_TO_HTML_$m, \ + FILES := $(MAN_$m), \ +diff --git a/make/common/Modules.gmk b/make/common/Modules.gmk +index c8c78ed8041..f87e240ad62 100644 +--- a/make/common/Modules.gmk ++++ b/make/common/Modules.gmk +@@ -92,7 +92,10 @@ SRC_SUBDIRS += share/classes + + SPEC_SUBDIRS += share/specs + +-MAN_SUBDIRS += share/man windows/man ++MAN_SUBDIRS += share/man $(TARGET_OS)/man ++ ++# The docs should include the sum of all man pages for all platforms ++MAN_DOCS_SUBDIRS += share/man windows/man + + # Find all module-info.java files for the current build target platform and + # configuration. +@@ -158,6 +161,10 @@ FindModuleManDirs = \ + $(strip $(wildcard \ + $(foreach sub, $(MAN_SUBDIRS), $(addsuffix /$(strip $1)/$(sub), $(TOP_SRC_DIRS))))) + ++FindModuleManDirsForDocs = \ ++ $(strip $(wildcard \ ++ $(foreach sub, $(MAN_DOCS_SUBDIRS), $(addsuffix /$(strip $1)/$(sub), $(TOP_SRC_DIRS))))) ++ + # Construct the complete module source path + GetModuleSrcPath = \ + $(call PathList, \ +-- +2.49.0 + diff --git a/0001-8353185-Introduce-the-concept-of-upgradeable-files-i.patch b/0001-8353185-Introduce-the-concept-of-upgradeable-files-i.patch new file mode 100644 index 0000000..829dc76 --- /dev/null +++ b/0001-8353185-Introduce-the-concept-of-upgradeable-files-i.patch @@ -0,0 +1,381 @@ +From 2c314dcb723d9c5df255761c3016b25fd8fb501e Mon Sep 17 00:00:00 2001 +From: Severin Gehwolf +Date: Thu, 17 Apr 2025 11:44:15 +0000 +Subject: [PATCH] 8353185: Introduce the concept of upgradeable files in + context of JEP 493 + +Backport-of: 4e24dc003c2304041b342371adf430b120a9fec8 +--- + make/modules/jdk.jlink/Java.gmk | 32 ++++ + .../jdk/tools/jlink/internal/JRTArchive.java | 22 ++- + .../jlink/internal/LinkableRuntimeImage.java | 47 +++++- + .../runtimelink/upgrade_files_java.base.conf | 4 + + .../UpgradeableFileCacertsTest.java | 153 ++++++++++++++++++ + 5 files changed, 254 insertions(+), 4 deletions(-) + create mode 100644 make/modules/jdk.jlink/Java.gmk + create mode 100644 src/jdk.jlink/share/classes/jdk/tools/jlink/internal/runtimelink/upgrade_files_java.base.conf + create mode 100644 test/jdk/tools/jlink/runtimeImage/UpgradeableFileCacertsTest.java + +diff --git a/make/modules/jdk.jlink/Java.gmk b/make/modules/jdk.jlink/Java.gmk +new file mode 100644 +index 00000000000..4ddd1eab03d +--- /dev/null ++++ b/make/modules/jdk.jlink/Java.gmk +@@ -0,0 +1,32 @@ ++# ++# Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved. ++# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++# ++# This code is free software; you can redistribute it and/or modify it ++# under the terms of the GNU General Public License version 2 only, as ++# published by the Free Software Foundation. Oracle designates this ++# particular file as subject to the "Classpath" exception as provided ++# by Oracle in the LICENSE file that accompanied this code. ++# ++# This code is distributed in the hope that it will be useful, but WITHOUT ++# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++# version 2 for more details (a copy is included in the LICENSE file that ++# accompanied this code). ++# ++# You should have received a copy of the GNU General Public License version ++# 2 along with this work; if not, write to the Free Software Foundation, ++# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++# ++# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++# or visit www.oracle.com if you need additional information or have any ++# questions. ++# ++ ++################################################################################ ++ ++# Instruct SetupJavaCompilation for the jdk.jlink module to include ++# upgrade_files_.conf files ++COPY += .conf ++ ++################################################################################ +diff --git a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JRTArchive.java b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JRTArchive.java +index df7d35ac777..aac220e5b94 100644 +--- a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JRTArchive.java ++++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JRTArchive.java +@@ -45,6 +45,7 @@ + import java.util.List; + import java.util.Map; + import java.util.Objects; ++import java.util.Set; + import java.util.function.Function; + import java.util.function.Predicate; + import java.util.stream.Collectors; +@@ -76,6 +77,7 @@ public class JRTArchive implements Archive { + private final Map resDiff; + private final boolean errorOnModifiedFile; + private final TaskHelper taskHelper; ++ private final Set upgradeableFiles; + + /** + * JRTArchive constructor +@@ -86,12 +88,15 @@ public class JRTArchive implements Archive { + * install aborts the link. + * @param perModDiff The lib/modules (a.k.a jimage) diff for this module, + * possibly an empty list if there are no differences. ++ * @param taskHelper The task helper instance. ++ * @param upgradeableFiles The set of files that are allowed for upgrades. + */ + JRTArchive(String module, + Path path, + boolean errorOnModifiedFile, + List perModDiff, +- TaskHelper taskHelper) { ++ TaskHelper taskHelper, ++ Set upgradeableFiles) { + this.module = module; + this.path = path; + this.ref = ModuleFinder.ofSystem() +@@ -105,6 +110,7 @@ public class JRTArchive implements Archive { + this.resDiff = Objects.requireNonNull(perModDiff).stream() + .collect(Collectors.toMap(ResourceDiff::getName, Function.identity())); + this.taskHelper = taskHelper; ++ this.upgradeableFiles = upgradeableFiles; + } + + @Override +@@ -217,7 +223,8 @@ private void addNonClassResources() { + + // Read from the base JDK image. + Path path = BASE.resolve(m.resPath); +- if (shaSumMismatch(path, m.hashOrTarget, m.symlink)) { ++ if (!isUpgradeableFile(m.resPath) && ++ shaSumMismatch(path, m.hashOrTarget, m.symlink)) { + if (errorOnModifiedFile) { + String msg = taskHelper.getMessage("err.runtime.link.modified.file", path.toString()); + IOException cause = new IOException(msg); +@@ -239,6 +246,17 @@ private void addNonClassResources() { + } + } + ++ /** ++ * Certain files in a module are considered upgradeable. That is, ++ * their hash sums aren't checked. ++ * ++ * @param resPath The resource path of the file to check for upgradeability. ++ * @return {@code true} if the file is upgradeable. {@code false} otherwise. ++ */ ++ private boolean isUpgradeableFile(String resPath) { ++ return upgradeableFiles.contains(resPath); ++ } ++ + static boolean shaSumMismatch(Path res, String expectedSha, boolean isSymlink) { + if (isSymlink) { + return false; +diff --git a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java +index 935af4585ad..d564ed0bad8 100644 +--- a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java ++++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java +@@ -28,7 +28,10 @@ + import java.io.IOException; + import java.io.InputStream; + import java.nio.file.Path; ++import java.util.HashSet; + import java.util.List; ++import java.util.Scanner; ++import java.util.Set; + + import jdk.tools.jlink.internal.runtimelink.ResourceDiff; + +@@ -42,6 +45,9 @@ public class LinkableRuntimeImage { + public static final String RESPATH_PATTERN = "jdk/tools/jlink/internal/runtimelink/fs_%s_files"; + // The diff files per module for supporting linking from the run-time image + public static final String DIFF_PATTERN = "jdk/tools/jlink/internal/runtimelink/diff_%s"; ++ // meta data for upgradable files ++ private static final String UPGRADEABLE_FILES_PATTERN = "jdk/tools/jlink/internal/runtimelink/upgrade_files_%s.conf"; ++ private static final Module JDK_JLINK_MOD = LinkableRuntimeImage.class.getModule(); + + /** + * In order to be able to show whether or not a runtime is capable of +@@ -62,7 +68,38 @@ public static boolean isLinkableRuntime() { + + private static InputStream getDiffInputStream(String module) throws IOException { + String resourceName = String.format(DIFF_PATTERN, module); +- return LinkableRuntimeImage.class.getModule().getResourceAsStream(resourceName); ++ return JDK_JLINK_MOD.getResourceAsStream(resourceName); ++ } ++ ++ private static Set upgradeableFiles(String module) { ++ String resourceName = String.format(UPGRADEABLE_FILES_PATTERN, module); ++ InputStream filesIn = null; ++ try { ++ filesIn = JDK_JLINK_MOD.getResourceAsStream(resourceName); ++ } catch (IOException e) { ++ throw new AssertionError("Unexpected IO error getting res stream"); ++ } ++ if (filesIn == null) { ++ // no upgradeable files ++ return Set.of(); ++ } ++ Set upgradeableFiles = new HashSet<>(); ++ final InputStream in = filesIn; ++ try (in; ++ Scanner scanner = new Scanner(filesIn)) { ++ while (scanner.hasNextLine()) { ++ String line = scanner.nextLine(); ++ if (line.trim().startsWith("#")) { ++ // Skip comments ++ continue; ++ } ++ upgradeableFiles.add(scanner.nextLine()); ++ } ++ } catch (IOException e) { ++ throw new AssertionError("Failure to retrieve upgradeable files for " + ++ "module " + module, e); ++ } ++ return upgradeableFiles; + } + + public static Archive newArchive(String module, +@@ -81,7 +118,13 @@ public static Archive newArchive(String module, + throw new AssertionError("Failure to retrieve resource diff for " + + "module " + module, e); + } +- return new JRTArchive(module, path, !ignoreModifiedRuntime, perModuleDiff, taskHelper); ++ Set upgradeableFiles = upgradeableFiles(module); ++ return new JRTArchive(module, ++ path, ++ !ignoreModifiedRuntime, ++ perModuleDiff, ++ taskHelper, ++ upgradeableFiles); + } + + +diff --git a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/runtimelink/upgrade_files_java.base.conf b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/runtimelink/upgrade_files_java.base.conf +new file mode 100644 +index 00000000000..df2ca809f08 +--- /dev/null ++++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/runtimelink/upgrade_files_java.base.conf +@@ -0,0 +1,4 @@ ++# Configuration for resource paths of files allowed to be ++# upgraded (in java.base) ++lib/tzdb.dat ++lib/security/cacerts +diff --git a/test/jdk/tools/jlink/runtimeImage/UpgradeableFileCacertsTest.java b/test/jdk/tools/jlink/runtimeImage/UpgradeableFileCacertsTest.java +new file mode 100644 +index 00000000000..86e0f8cefd5 +--- /dev/null ++++ b/test/jdk/tools/jlink/runtimeImage/UpgradeableFileCacertsTest.java +@@ -0,0 +1,153 @@ ++/* ++ * Copyright (c) 2025, Red Hat, Inc. ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++import java.io.ByteArrayInputStream; ++import java.io.ByteArrayOutputStream; ++import java.io.FileInputStream; ++import java.io.FileOutputStream; ++import java.io.IOException; ++import java.io.InputStream; ++import java.nio.file.Path; ++import java.security.KeyStore; ++import java.security.cert.Certificate; ++import java.security.cert.CertificateException; ++import java.security.cert.CertificateFactory; ++import java.security.cert.X509Certificate; ++ ++import jdk.test.lib.process.OutputAnalyzer; ++import tests.Helper; ++ ++/* ++ * @test ++ * @summary Verify that no errors are reported for files that have been ++ * upgraded when linking from the run-time image ++ * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) ++ * @library ../../lib /test/lib ++ * @modules java.base/jdk.internal.jimage ++ * jdk.jlink/jdk.tools.jlink.internal ++ * jdk.jlink/jdk.tools.jlink.plugin ++ * jdk.jlink/jdk.tools.jimage ++ * @build tests.* jdk.test.lib.process.OutputAnalyzer ++ * jdk.test.lib.process.ProcessTools ++ * @run main/othervm -Xmx1g UpgradeableFileCacertsTest ++ */ ++public class UpgradeableFileCacertsTest extends ModifiedFilesTest { ++ ++ /* ++ * Generated with: ++ * $ rm -f server.keystore && keytool -genkey -alias jlink-upgrade-test \ ++ * -keyalg RSA -dname CN=jlink-upgrade-test \ ++ * -storepass changeit -keysize 3072 -sigalg SHA512withRSA \ ++ * -validity 7300 -keystore server.keystore ++ * $ keytool -export -alias jlink-upgrade-test -storepass changeit \ ++ * -keystore server.keystore -rfc ++ */ ++ private static final String CERT = """ ++ -----BEGIN CERTIFICATE----- ++ MIID3jCCAkagAwIBAgIJALiT/+HXBkSIMA0GCSqGSIb3DQEBDQUAMB0xGzAZBgNV ++ BAMTEmpsaW5rLXVwZ3JhZGUtdGVzdDAeFw0yNTA0MDQxMjA3MjJaFw00NTAzMzAx ++ MjA3MjJaMB0xGzAZBgNVBAMTEmpsaW5rLXVwZ3JhZGUtdGVzdDCCAaIwDQYJKoZI ++ hvcNAQEBBQADggGPADCCAYoCggGBANmrnCDKqSXEJRIiSi4yHWN97ILls3RqYjED ++ la3AZTeXnZrrEIgSjVFUMxCztYqbWoVzKa2lov42Vue2BXVYffcQ8TKc2EJDNO+2 ++ uRKQZpsN7RI4QoVBR2Rq8emrO8CrdOQT7Hh4agxkN9AOvGKMFdt+fXeCIPIuflKP ++ f+RfvhLfC2A70Y+Uu74C5uWgLloA/HF0SsVxf9KmqS9fZBQaiTYhKyoDghCRlWpa ++ nPIHB1XVaRdw8aSpCuzIOQzSCTTlLcammJkBjbFwMZdQG7eglTWzIYryZwe/cyY2 ++ xctLVW3xhUHvnMFG+MajeFny2mxNu163Rxf/rBu4e7jRC/LGSU784nJGapq5K170 ++ WbaeceKp+YORJBviFFORrmkPIwIgE+iGCD6PD6Xwu8vcpeuTVDgsSWMlfgCL3NoI ++ GXmdGiI2Xc/hQX7uzu3UBF6IcPDMTcYr2JKYbgu3v2/vDlJu3qO2ycUeePo5jhuG ++ X2WgcHkb6uOU4W5qdbCA+wFPVZBuwQIDAQABoyEwHzAdBgNVHQ4EFgQUtMJM0+ct ++ ssKqryRckk4YEWdYAZkwDQYJKoZIhvcNAQENBQADggGBAI8A6gJQ8wDx12sy2ZI4 ++ 1q9b+WG6w3LcFEF6Fko5NBizhtfmVycQv4mBa/NJgx4DZmd+5d60gJcTp/hJXGY0 ++ LZyFilm/AgxsLNUUQLbHAV6TWqd3ODWwswAuew9sFU6izl286a9W65tbMWL5r1EA ++ t34ZYVWZYbCS9+czU98WomH4uarRAOlzcEUui3ZX6ZcQxWbz/R2wtKcUPUAYnsqH ++ JPivpE25G5xW2Dp/yeQTrlffq9OLgZWVz0jtOguBUMnsUsgCcpQZtqZX08//wtpz ++ ohLHFGvpXTPbRumRasWWtnRR/QqGRT66tYDqybXXz37UtKZ8VKW0sv2ypVbmAEs5 ++ pLkA/3XiXlstJuCD6cW0Gfbpb5rrPPD46O3FDVlmqlTH3b/MsiQREdydqGzqY7uG ++ AA2GFVaKFASA5ls01CfHLAcrKxSVixditXvsjeIqhddB7Pnbsx20RdzPQoeo9/hF ++ WeIrh4zePDPZChuLR8ZyxeVJhLB71nTrTDDjwXarVez9Xw== ++ -----END CERTIFICATE----- ++ """; ++ ++ private static final String CERT_ALIAS = "jlink-upgrade-test"; ++ ++ public static void main(String[] args) throws Exception { ++ UpgradeableFileCacertsTest test = new UpgradeableFileCacertsTest(); ++ test.run(); ++ } ++ ++ @Override ++ String initialImageName() { ++ return "java-base-jlink-upgrade-cacerts"; ++ } ++ ++ @Override ++ void testAndAssert(Path modifiedFile, Helper helper, Path initialImage) throws Exception { ++ CapturingHandler handler = new CapturingHandler(); ++ jlinkUsingImage(new JlinkSpecBuilder() ++ .helper(helper) ++ .imagePath(initialImage) ++ .name("java-base-jlink-upgrade-cacerts-target") ++ .addModule("java.base") ++ .validatingModule("java.base") ++ .build(), handler); ++ OutputAnalyzer analyzer = handler.analyzer(); ++ // verify we don't get any modified warning ++ analyzer.stdoutShouldNotContain(modifiedFile.toString() + " has been modified"); ++ analyzer.stdoutShouldNotContain("java.lang.IllegalArgumentException"); ++ analyzer.stdoutShouldNotContain("IOException"); ++ } ++ ++ // Add an extra certificate in the cacerts file so that it no longer matches ++ // the recorded hash sum at build time. ++ protected Path modifyFileInImage(Path jmodLessImg) ++ throws IOException, AssertionError { ++ Path cacerts = jmodLessImg.resolve(Path.of("lib", "security", "cacerts")); ++ try (FileInputStream fin = new FileInputStream(cacerts.toFile())) { ++ KeyStore certStore = KeyStore.getInstance(cacerts.toFile(), ++ (char[])null); ++ certStore.load(fin, (char[])null); ++ X509Certificate cert; ++ try (ByteArrayInputStream bin = new ByteArrayInputStream(CERT.getBytes())) { ++ cert = (X509Certificate)generateCertificate(bin); ++ } catch (ClassCastException | CertificateException ce) { ++ throw new AssertionError("Test failed unexpectedly", ce); ++ } ++ certStore.setCertificateEntry(CERT_ALIAS, cert); ++ ByteArrayOutputStream bout = new ByteArrayOutputStream(); ++ certStore.store(bout, (char[])null); ++ try (FileOutputStream fout = new FileOutputStream(cacerts.toFile())) { ++ fout.write(bout.toByteArray()); ++ } ++ } catch (Exception e) { ++ throw new AssertionError("Test failed unexpectedly: ", e); ++ } ++ return cacerts; ++ } ++ ++ private Certificate generateCertificate(InputStream in) ++ throws CertificateException, IOException { ++ byte[] data = in.readAllBytes(); ++ return CertificateFactory.getInstance("X.509") ++ .generateCertificate(new ByteArrayInputStream(data)); ++ } ++} +-- +2.49.0 + diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index 1375e1a..dd942ea 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -701,6 +701,10 @@ Patch1100: 0001-Fix-name-class-of-uabs-with-GCC-15.patch # OpenJDK patches which missed last update # ############################################# +# JDK-8350137: After JDK-8348975, Linux builds contain man pages for windows only tools +Patch2000: 0001-8350137-After-JDK-8348975-Linux-builds-contain-man-p.patch +# JDK-8353185: Introduce the concept of upgradeable files in context of JEP 493 +Patch2001: 0001-8353185-Introduce-the-concept-of-upgradeable-files-i.patch ############################################# # @@ -996,6 +1000,10 @@ pushd %{top_level_dir_name} # Skipping fips patch whil eit is not ready for jdk22 %%patch -P1001 -p1 # Patches in need of upstreaming %patch -P1100 -p1 + +# Patches not yet in 24.0.1 +%patch -P2000 -p1 +%patch -P2001 -p1 popd # openjdk From f3a237805c6c7b6d9af0673abcda2e1f2d22ada5 Mon Sep 17 00:00:00 2001 From: Severin Gehwolf Date: Fri, 25 Apr 2025 10:44:59 +0200 Subject: [PATCH 05/23] Add patch for JDK-8355524, fixing a bug in JDK-8353185 There was a bug in the patch of JDK-8353185 which made the tzdb.dat upgrade to not work. --- ...ry-second-line-in-upgradeable-files-.patch | 38 +++++++++++++++++++ java-latest-openjdk-portable.spec | 3 ++ 2 files changed, 41 insertions(+) create mode 100644 0001-8355524-Only-every-second-line-in-upgradeable-files-.patch diff --git a/0001-8355524-Only-every-second-line-in-upgradeable-files-.patch b/0001-8355524-Only-every-second-line-in-upgradeable-files-.patch new file mode 100644 index 0000000..6c1c4e9 --- /dev/null +++ b/0001-8355524-Only-every-second-line-in-upgradeable-files-.patch @@ -0,0 +1,38 @@ +From 89f9268ed7c2cb86891f23a10482cd459454bd32 Mon Sep 17 00:00:00 2001 +From: Severin Gehwolf +Date: Fri, 25 Apr 2025 08:20:51 +0000 +Subject: [PATCH] 8355524: Only every second line in upgradeable files is being + used + +Reviewed-by: shade, alanb +--- + .../classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java | 2 +- + .../jlink/internal/runtimelink/upgrade_files_java.base.conf | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java +index d564ed0bad8..30c37961829 100644 +--- a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java ++++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java +@@ -93,7 +93,7 @@ private static Set upgradeableFiles(String module) { + // Skip comments + continue; + } +- upgradeableFiles.add(scanner.nextLine()); ++ upgradeableFiles.add(line); + } + } catch (IOException e) { + throw new AssertionError("Failure to retrieve upgradeable files for " + +diff --git a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/runtimelink/upgrade_files_java.base.conf b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/runtimelink/upgrade_files_java.base.conf +index df2ca809f08..fc5e7b4f328 100644 +--- a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/runtimelink/upgrade_files_java.base.conf ++++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/runtimelink/upgrade_files_java.base.conf +@@ -1,4 +1,4 @@ + # Configuration for resource paths of files allowed to be + # upgraded (in java.base) +-lib/tzdb.dat + lib/security/cacerts ++lib/tzdb.dat +-- +2.49.0 + diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index dd942ea..ae8b5aa 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -705,6 +705,8 @@ Patch1100: 0001-Fix-name-class-of-uabs-with-GCC-15.patch Patch2000: 0001-8350137-After-JDK-8348975-Linux-builds-contain-man-p.patch # JDK-8353185: Introduce the concept of upgradeable files in context of JEP 493 Patch2001: 0001-8353185-Introduce-the-concept-of-upgradeable-files-i.patch +# JDK-8355524: Only every second line in upgradeable files is being used +Patch2002: 0001-8355524-Only-every-second-line-in-upgradeable-files-.patch ############################################# # @@ -1004,6 +1006,7 @@ pushd %{top_level_dir_name} # Patches not yet in 24.0.1 %patch -P2000 -p1 %patch -P2001 -p1 +%patch -P2002 -p1 popd # openjdk From fa56012985d6102e58684fde46ef4abf1d920e19 Mon Sep 17 00:00:00 2001 From: Severin Gehwolf Date: Mon, 28 Apr 2025 16:49:07 +0200 Subject: [PATCH 06/23] Add --disable-absolute-paths-in-output to not need debugedit The non-portable version of the build uses debugedit to modify built in paths to source files in debuginfo files. By setting --disable-absolute-paths-in-output we enable features added by JDK-8323667 and JDK-8284437. This feature was already implicitly used by the release build. Align release and fastdebug/slowdebug builds. --- java-latest-openjdk-portable.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index ae8b5aa..846b52f 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -1133,6 +1133,7 @@ function buildjdk() { --with-boot-jdk=${buildjdk} \ --with-debug-level=${debuglevel} \ --with-native-debug-symbols="${debug_symbols}" \ + --disable-absolute-paths-in-output \ --enable-unlimited-crypto \ --enable-linkable-runtime \ --enable-keep-packaged-modules \ From 2681c6e177dfa790b5c993cb33ecb4ae1916a60f Mon Sep 17 00:00:00 2001 From: Severin Gehwolf Date: Mon, 12 May 2025 16:33:29 +0200 Subject: [PATCH 07/23] Re-introduce JMODs archive tarball --- java-latest-openjdk-portable.spec | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index 846b52f..e04275e 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -1294,6 +1294,7 @@ function packagejdk() { jdkname=%{jdkportablename -- "$nameSuffix"} jdkarchive=${packagesdir}/%{jdkportablearchive -- "$nameSuffix"} + jmodsarchive=${packagesdir}/%{jmodsportablearchive -- "$nameSuffix"} jrename=%{jreportablename -- "$nameSuffix"} jrearchive=${packagesdir}/%{jreportablearchive -- "$nameSuffix"} staticname=%{staticlibsportablename -- "$nameSuffix"} @@ -1336,6 +1337,10 @@ function packagejdk() { genchecksum ${miscarchive} fi + tar -cJf ${jmodsarchive} --exclude='**.debuginfo' ${jdkname}/jmods + genchecksum ${jmodsarchive} + rm -rv ${jdkname}/jmods + tar -cJf ${jdkarchive} --exclude='**.debuginfo' ${jdkname} genchecksum ${jdkarchive} @@ -1616,12 +1621,15 @@ for suffix in %{build_loop} ; do # These definitions should match those in installjdk jdkarchive=${packagesdir}/%{jdkportablearchive -- "$nameSuffix"} + jmodsarchive=${packagesdir}/%{jmodsportablearchive -- "$nameSuffix"} jrearchive=${packagesdir}/%{jreportablearchive -- "$nameSuffix"} staticarchive=${packagesdir}/%{staticlibsportablearchive -- "$nameSuffix"} debugarchive=${packagesdir}/%{jdkportablearchive -- "${nameSuffix}.debuginfo"} mv ${jdkarchive} $RPM_BUILD_ROOT%{_jvmdir}/ mv ${jdkarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/ + mv ${jmodsarchive} $RPM_BUILD_ROOT%{_jvmdir}/ + mv ${jmodsarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/ mv ${jrearchive} $RPM_BUILD_ROOT%{_jvmdir}/ mv ${jrearchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/ @@ -1669,6 +1677,8 @@ done %{_jvmdir}/%{jdkportablearchive -- .debuginfo} %{_jvmdir}/%{jdkportablearchiveForFiles}.sha256sum %{_jvmdir}/%{jdkportablearchive -- .debuginfo}.sha256sum +%{_jvmdir}/%{jmodsportablearchiveForFiles} +%{_jvmdir}/%{jmodsportablearchiveForFiles}.sha256sum %endif %if %{include_normal_build} @@ -1687,6 +1697,8 @@ done %files devel-slowdebug %{_jvmdir}/%{jdkportablearchive -- .slowdebug} %{_jvmdir}/%{jdkportablearchive -- .slowdebug}.sha256sum +%{_jvmdir}/%{jmodsportablearchive -- .slowdebug} +%{_jvmdir}/%{jmodsportablearchive -- .slowdebug}.sha256sum %if %{include_staticlibs} %files static-libs-slowdebug @@ -1703,6 +1715,8 @@ done %files devel-fastdebug %{_jvmdir}/%{jdkportablearchive -- .fastdebug} %{_jvmdir}/%{jdkportablearchive -- .fastdebug}.sha256sum +%{_jvmdir}/%{jmodsportablearchive -- .fastdebug} +%{_jvmdir}/%{jmodsportablearchive -- .fastdebug}.sha256sum %if %{include_staticlibs} %files static-libs-fastdebug From 87c794a095ad8f5cdf191408eddf60d8156b2a7c Mon Sep 17 00:00:00 2001 From: Severin Gehwolf Date: Tue, 29 Apr 2025 12:59:48 +0200 Subject: [PATCH 08/23] Update to upstream patch for glibc 2.42 build failure --- 0001-Fix-name-class-of-uabs-with-GCC-15.patch | 102 +++++++----------- 1 file changed, 38 insertions(+), 64 deletions(-) diff --git a/0001-Fix-name-class-of-uabs-with-GCC-15.patch b/0001-Fix-name-class-of-uabs-with-GCC-15.patch index 0825c72..a5031f9 100644 --- a/0001-Fix-name-class-of-uabs-with-GCC-15.patch +++ b/0001-Fix-name-class-of-uabs-with-GCC-15.patch @@ -1,35 +1,18 @@ -From 0fd5cab226219eda13b8d3864797bea034ed3f70 Mon Sep 17 00:00:00 2001 -From: Severin Gehwolf -Date: Thu, 17 Apr 2025 11:48:31 +0200 -Subject: [PATCH] Fix name class of uabs with GCC 15 - ---- - src/hotspot/cpu/aarch64/assembler_aarch64.cpp | 2 +- - src/hotspot/cpu/aarch64/assembler_aarch64.hpp | 2 +- - src/hotspot/cpu/aarch64/macroAssembler_aarch64.cpp | 2 +- - src/hotspot/cpu/aarch64/stubGenerator_aarch64.cpp | 4 ++-- - src/hotspot/cpu/riscv/assembler_riscv.hpp | 2 +- - src/hotspot/cpu/riscv/stubGenerator_riscv.cpp | 4 ++-- - src/hotspot/share/opto/mulnode.cpp | 4 ++-- - src/hotspot/share/opto/subnode.cpp | 4 ++-- - src/hotspot/share/utilities/globalDefinitions.hpp | 12 ++++++++---- - 9 files changed, 20 insertions(+), 16 deletions(-) - diff --git a/src/hotspot/cpu/aarch64/assembler_aarch64.cpp b/src/hotspot/cpu/aarch64/assembler_aarch64.cpp -index 76f88764416..946bf1c4406 100644 +index b03344f2d80..ec4f2a0d6c3 100644 --- a/src/hotspot/cpu/aarch64/assembler_aarch64.cpp +++ b/src/hotspot/cpu/aarch64/assembler_aarch64.cpp -@@ -457,7 +457,7 @@ void Assembler::bang_stack_with_offset(int offset) { Unimplemented(); } +@@ -456,7 +456,7 @@ void Assembler::bang_stack_with_offset(int offset) { Unimplemented(); } bool asm_util::operand_valid_for_immediate_bits(int64_t imm, unsigned nbits) { guarantee(nbits == 8 || nbits == 12, "invalid nbits value"); - uint64_t uimm = (uint64_t)uabs((jlong)imm); -+ uint64_t uimm = (uint64_t)UABS((jlong)imm); ++ uint64_t uimm = (uint64_t)g_uabs((jlong)imm); if (uimm < (UCONST64(1) << nbits)) return true; if (uimm < (UCONST64(1) << (2 * nbits)) diff --git a/src/hotspot/cpu/aarch64/assembler_aarch64.hpp b/src/hotspot/cpu/aarch64/assembler_aarch64.hpp -index a5e0e2665af..639af579d9f 100644 +index 5c02e30963e..aee4a30b649 100644 --- a/src/hotspot/cpu/aarch64/assembler_aarch64.hpp +++ b/src/hotspot/cpu/aarch64/assembler_aarch64.hpp @@ -932,7 +932,7 @@ class Assembler : public AbstractAssembler { @@ -37,112 +20,112 @@ index a5e0e2665af..639af579d9f 100644 static bool reachable_from_branch_at(address branch, address target) { - return uabs(target - branch) < branch_range; -+ return UABS(target - branch) < branch_range; ++ return g_uabs(target - branch) < branch_range; } // Unconditional branch (immediate) diff --git a/src/hotspot/cpu/aarch64/macroAssembler_aarch64.cpp b/src/hotspot/cpu/aarch64/macroAssembler_aarch64.cpp -index d561fb912a3..3a7d2b96ecf 100644 +index fd6af0b9b4b..b6aa54b27a4 100644 --- a/src/hotspot/cpu/aarch64/macroAssembler_aarch64.cpp +++ b/src/hotspot/cpu/aarch64/macroAssembler_aarch64.cpp -@@ -3271,7 +3271,7 @@ void MacroAssembler::wrap_add_sub_imm_insn(Register Rd, Register Rn, uint64_t im +@@ -3267,7 +3267,7 @@ void MacroAssembler::wrap_add_sub_imm_insn(Register Rd, Register Rn, uint64_t im if (fits) { (this->*insn1)(Rd, Rn, imm); } else { - if (uabs(imm) < (1 << 24)) { -+ if (UABS(imm) < (1 << 24)) { ++ if (g_uabs(imm) < (1 << 24)) { (this->*insn1)(Rd, Rn, imm & -(1 << 12)); (this->*insn1)(Rd, Rd, imm & ((1 << 12)-1)); } else { diff --git a/src/hotspot/cpu/aarch64/stubGenerator_aarch64.cpp b/src/hotspot/cpu/aarch64/stubGenerator_aarch64.cpp -index de5df5c1af1..0acac529a20 100644 +index f5567dcc03a..0843489900c 100644 --- a/src/hotspot/cpu/aarch64/stubGenerator_aarch64.cpp +++ b/src/hotspot/cpu/aarch64/stubGenerator_aarch64.cpp -@@ -1133,7 +1133,7 @@ class StubGenerator: public StubCodeGenerator { +@@ -1162,7 +1162,7 @@ class StubGenerator: public StubCodeGenerator { void copy_memory_small(DecoratorSet decorators, BasicType type, Register s, Register d, Register count, int step) { bool is_backwards = step < 0; - size_t granularity = uabs(step); -+ size_t granularity = UABS(step); ++ size_t granularity = g_uabs(step); int direction = is_backwards ? -1 : 1; Label Lword, Lint, Lshort, Lbyte; -@@ -1192,7 +1192,7 @@ class StubGenerator: public StubCodeGenerator { +@@ -1221,7 +1221,7 @@ class StubGenerator: public StubCodeGenerator { Register s, Register d, Register count, int step) { copy_direction direction = step < 0 ? copy_backwards : copy_forwards; bool is_backwards = step < 0; - unsigned int granularity = uabs(step); -+ unsigned int granularity = UABS(step); ++ unsigned int granularity = g_uabs(step); const Register t0 = r3, t1 = r4; // <= 80 (or 96 for SIMD) bytes do inline. Direction doesn't matter because we always diff --git a/src/hotspot/cpu/riscv/assembler_riscv.hpp b/src/hotspot/cpu/riscv/assembler_riscv.hpp -index 31713d7362a..e193cf9fbb7 100644 +index 4773043e1ba..4a19b577d9f 100644 --- a/src/hotspot/cpu/riscv/assembler_riscv.hpp +++ b/src/hotspot/cpu/riscv/assembler_riscv.hpp -@@ -3393,7 +3393,7 @@ enum Nf { +@@ -3818,7 +3818,7 @@ enum Nf { static const unsigned long branch_range = 1 * M; static bool reachable_from_branch_at(address branch, address target) { - return uabs(target - branch) < branch_range; -+ return UABS(target - branch) < branch_range; ++ return g_uabs(target - branch) < branch_range; } // Decode the given instruction, checking if it's a 16-bit compressed diff --git a/src/hotspot/cpu/riscv/stubGenerator_riscv.cpp b/src/hotspot/cpu/riscv/stubGenerator_riscv.cpp -index 7e6fe50e8f8..35192700673 100644 +index fb4539267ae..e6bbd32bd3e 100644 --- a/src/hotspot/cpu/riscv/stubGenerator_riscv.cpp +++ b/src/hotspot/cpu/riscv/stubGenerator_riscv.cpp -@@ -874,7 +874,7 @@ class StubGenerator: public StubCodeGenerator { +@@ -886,7 +886,7 @@ class StubGenerator: public StubCodeGenerator { void copy_memory_v(Register s, Register d, Register count, int step) { bool is_backward = step < 0; - int granularity = uabs(step); -+ int granularity = UABS(step); ++ int granularity = g_uabs(step); const Register src = x30, dst = x31, vl = x14, cnt = x15, tmp1 = x16, tmp2 = x17; assert_different_registers(s, d, cnt, vl, tmp1, tmp2); -@@ -936,7 +936,7 @@ class StubGenerator: public StubCodeGenerator { +@@ -948,7 +948,7 @@ class StubGenerator: public StubCodeGenerator { } bool is_backwards = step < 0; - int granularity = uabs(step); -+ int granularity = UABS(step); ++ int granularity = g_uabs(step); const Register src = x30, dst = x31, cnt = x15, tmp3 = x16, tmp4 = x17, tmp5 = x14, tmp6 = x13; const Register gct1 = x28, gct2 = x29, gct3 = t2; diff --git a/src/hotspot/share/opto/mulnode.cpp b/src/hotspot/share/opto/mulnode.cpp -index ad98fda025f..a51024eb578 100644 +index 72562a657ea..4691c6a45b0 100644 --- a/src/hotspot/share/opto/mulnode.cpp +++ b/src/hotspot/share/opto/mulnode.cpp -@@ -245,7 +245,7 @@ Node *MulINode::Ideal(PhaseGVN *phase, bool can_reshape) { +@@ -258,7 +258,7 @@ Node *MulINode::Ideal(PhaseGVN *phase, bool can_reshape) { // Check for negative constant; if so negate the final result bool sign_flip = false; - unsigned int abs_con = uabs(con); -+ unsigned int abs_con = UABS(con); ++ unsigned int abs_con = g_uabs(con); if (abs_con != (unsigned int)con) { sign_flip = true; } -@@ -480,7 +480,7 @@ Node *MulLNode::Ideal(PhaseGVN *phase, bool can_reshape) { +@@ -493,7 +493,7 @@ Node *MulLNode::Ideal(PhaseGVN *phase, bool can_reshape) { // Check for negative constant; if so negate the final result bool sign_flip = false; - julong abs_con = uabs(con); -+ julong abs_con = UABS(con); ++ julong abs_con = g_uabs(con); if (abs_con != (julong)con) { sign_flip = true; } diff --git a/src/hotspot/share/opto/subnode.cpp b/src/hotspot/share/opto/subnode.cpp -index f1eca4682bd..a79c1c86e96 100644 +index d1384384101..aaf53f80b8b 100644 --- a/src/hotspot/share/opto/subnode.cpp +++ b/src/hotspot/share/opto/subnode.cpp -@@ -1923,14 +1923,14 @@ const Type* AbsNode::Value(PhaseGVN* phase) const { +@@ -1943,14 +1943,14 @@ const Type* AbsNode::Value(PhaseGVN* phase) const { case Type::Int: { const TypeInt* ti = t1->is_int(); if (ti->is_con()) { - return TypeInt::make(uabs(ti->get_con())); -+ return TypeInt::make(UABS(ti->get_con())); ++ return TypeInt::make(g_uabs(ti->get_con())); } break; } @@ -150,49 +133,40 @@ index f1eca4682bd..a79c1c86e96 100644 const TypeLong* tl = t1->is_long(); if (tl->is_con()) { - return TypeLong::make(uabs(tl->get_con())); -+ return TypeLong::make(UABS(tl->get_con())); ++ return TypeLong::make(g_uabs(tl->get_con())); } break; } diff --git a/src/hotspot/share/utilities/globalDefinitions.hpp b/src/hotspot/share/utilities/globalDefinitions.hpp -index ccd3106b471..274c0591411 100644 +index cc5f3ebb291..4ec61babec3 100644 --- a/src/hotspot/share/utilities/globalDefinitions.hpp +++ b/src/hotspot/share/utilities/globalDefinitions.hpp -@@ -1142,9 +1142,13 @@ inline T clamp(T value, T min, T max) { - inline bool is_odd (intx x) { return x & 1; } - inline bool is_even(intx x) { return !is_odd(x); } +@@ -1118,7 +1118,7 @@ inline bool is_even(intx x) { return !is_odd(x); } -+// Some compilers define uabs() in a conflicting way (e.g. GCC 15), -+// use a macro to work-around that name clash by calling it custom_uabs -+#define UABS(x) custom_uabs(x) -+ // abs methods which cannot overflow and so are well-defined across // the entire domain of integer types. -static inline unsigned int uabs(unsigned int n) { -+static inline unsigned int custom_uabs(unsigned int n) { ++static inline unsigned int g_uabs(unsigned int n) { union { unsigned int result; int value; -@@ -1153,7 +1157,7 @@ static inline unsigned int uabs(unsigned int n) { +@@ -1127,7 +1127,7 @@ static inline unsigned int uabs(unsigned int n) { if (value < 0) result = 0-result; return result; } -static inline julong uabs(julong n) { -+static inline julong custom_uabs(julong n) { ++static inline julong g_uabs(julong n) { union { julong result; jlong value; -@@ -1162,8 +1166,8 @@ static inline julong uabs(julong n) { +@@ -1136,8 +1136,8 @@ static inline julong uabs(julong n) { if (value < 0) result = 0-result; return result; } -static inline julong uabs(jlong n) { return uabs((julong)n); } -static inline unsigned int uabs(int n) { return uabs((unsigned int)n); } -+static inline julong custom_uabs(jlong n) { return custom_uabs((julong)n); } -+static inline unsigned int custom_uabs(int n) { return custom_uabs((unsigned int)n); } ++static inline julong g_uabs(jlong n) { return g_uabs((julong)n); } ++static inline unsigned int g_uabs(int n) { return g_uabs((unsigned int)n); } // "to" should be greater than "from." inline size_t byte_size(void* from, void* to) { --- -2.49.0 - From dafff6d4c19e3bb93f3ea78e6b37b3152b97ae2a Mon Sep 17 00:00:00 2001 From: Jiri Date: Mon, 26 May 2025 13:11:31 +0200 Subject: [PATCH 09/23] Bumped release --- java-latest-openjdk-portable.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index e04275e..667c736 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -402,7 +402,7 @@ %global top_level_dir_name %{vcstag} %global top_level_dir_name_backup %{top_level_dir_name}-backup %global buildver 9 -%global rpmrelease 1 +%global rpmrelease 2 #%%global tagsuffix %%{nil} # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit %if %is_system_jdk From 31207ffae30d0513aa8158ec7fa691d18e9d7c43 Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Mon, 21 Jul 2025 19:33:26 +0200 Subject: [PATCH 10/23] Updated to 24.0.2.0.12 minor changes: * added changelog * shenandoah included in risc arches * bumped bundled providfes * introduced XZ_OPTS to -T0 * scripts moved to scritps dir * scripts passesd through spell check --- .gitignore | 1 + NEWS | 180 ++++++++++++++++++ ...c48eda.patch => fips-21u-9203d50836c.patch | 41 ++-- java-latest-openjdk-portable.spec | 43 ++--- openjdk_news.sh | 76 -------- .../discover_trees.sh | 27 ++- .../generate_source_tarball.sh | 128 +++++++------ icedtea_sync.sh => scripts/icedtea_sync.sh | 0 scripts/openjdk_news.sh | 114 +++++++++++ sources | 2 +- 10 files changed, 426 insertions(+), 186 deletions(-) rename fips-21u-75ffdc48eda.patch => fips-21u-9203d50836c.patch (99%) delete mode 100755 openjdk_news.sh rename discover_trees.sh => scripts/discover_trees.sh (57%) rename generate_source_tarball.sh => scripts/generate_source_tarball.sh (70%) rename icedtea_sync.sh => scripts/icedtea_sync.sh (100%) create mode 100755 scripts/openjdk_news.sh diff --git a/.gitignore b/.gitignore index b56c1ea..7829d87 100644 --- a/.gitignore +++ b/.gitignore @@ -51,3 +51,4 @@ /openjdk-24+34-ea.tar.xz /openjdk-24+36.tar.xz /openjdk-24.0.1+9.tar.xz +/openjdk-24.0.2+12.tar.xz diff --git a/NEWS b/NEWS index 5cd16bd..8a27fc4 100644 --- a/NEWS +++ b/NEWS @@ -3,6 +3,186 @@ Key: JDK-X - https://bugs.openjdk.java.net/browse/JDK-X CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY JEP-XYZ: https://openjdk.org/jeps/XYZ +New in release OpenJDK 24.0.2+12 (2025-7-15): +=========================================== +* CVEs + - CVE-2025-30749 + - CVE-2025-30754 + - CVE-2025-50059 + - CVE-2025-50106 +* Changes + - JDK-8217914: java/net/httpclient/ConnectTimeoutHandshakeSync.java failed on connection refused while doing POST + - JDK-8276995: Bug in jdk.jfr.event.gc.collection.TestSystemGC + - JDK-8280991: [XWayland] No displayChanged event after setDisplayMode call + - JDK-8281511: java/net/ipv6tests/UdpTest.java fails with checkTime failed + - JDK-8286204: [Accessibility,macOS,VoiceOver] VoiceOver reads the spinner value 10 as 1 when user iterates to 10 for the first time on macOS + - JDK-8294155: Exception thrown before awaitAndCheck hangs PassFailJFrame + - JDK-8303770: Remove Baltimore root certificate expiring in May 2025 + - JDK-8305010: Test vmTestbase/nsk/jvmti/scenarios/sampling/SP05/sp05t003/TestDescription.java timed out: thread not suspended + - JDK-8314840: 3 gc/epsilon tests ignore external vm options + - JDK-8322983: Virtual Threads: exclude 2 tests + - JDK-8330598: java/net/httpclient/Http1ChunkedTest.java fails with java.util.MissingFormatArgumentException: Format specifier '%s' + - JDK-8330936: [ubsan] exclude function BilinearInterp and ShapeSINextSpan in libawt java2d from ubsan checks + - JDK-8334644: Automate javax/print/attribute/PageRangesException.java + - JDK-8336042: Caller/callee param size mismatch in deoptimization causes crash + - JDK-8338303: Linux ppc64le with toolchain clang - detection failure in early JVM startup + - JDK-8339889: Several compiler tests ignore vm flags and not marked as flagless + - JDK-8340784: Remove PassFailJFrame constructor with screenshots + - JDK-8342524: Use latch in AbstractButton/bug6298940.java instead of delay + - JDK-8342775: [Graal] java/util/concurrent/locks/Lock/OOMEInAQS.java fails OOME thrown from the UncaughtExceptionHandler + - JDK-8343191: Cgroup v1 subsystem fails to set subsystem path + - JDK-8343224: print/Dialog/PaperSizeError.java fails with MediaSizeName is not A4: A4 + - JDK-8343607: C2: Shenandoah crashes during barrier expansion in Continuation::enter + - JDK-8343882: BasicAnnoTests doesn't handle multiple annotations at the same position + - JDK-8343978: Update the default value of CodeEntryAlignment for Ampere-1A and 1B + - JDK-8344316: security/auth/callback/TextCallbackHandler/Password.java make runnable with JTReg and add the UI + - JDK-8344453: Test jdk/jfr/event/oldobject/TestSanityDefault.java timed out + - JDK-8344581: [TESTBUG] java/awt/Robot/ScreenCaptureRobotTest.java failing on macOS + - JDK-8344629: SSLSocketNoServerHelloClientShutdown test timeout + - JDK-8344892: beans/finder/MethodFinder.findMethod incorrectly returns null + - JDK-8344925: translet-name ignored when package-name is also set + - JDK-8345133: Test sun/security/tools/jarsigner/TsacertOptionTest.java failed: Warning found in stdout + - JDK-8345134: Test sun/security/tools/jarsigner/ConciseJarsigner.java failed: unable to find valid certification path to requested target + - JDK-8345185: Update jpackage to not include service bindings by default + - JDK-8345276: Remove EA from the JDK 24 version string with first RC promotion + - JDK-8345368: java/io/File/createTempFile/SpecialTempFile.java fails on Windows Server 2025 + - JDK-8345569: [ubsan] adjustments to filemap.cpp and virtualspace.cpp for macOS aarch64 + - JDK-8345590: AIX 'make all' fails after JDK-8339480 + - JDK-8345625: Better HTTP connections + - JDK-8345676: [ubsan] ProcessImpl_md.c:561:40: runtime error: applying zero offset to null pointer on macOS aarch64 + - JDK-8345728: [Accessibility,macOS,Screen Magnifier]: JCheckbox unchecked state does not magnify but works for checked state + - JDK-8346049: jdk/test/lib/security/timestamp/TsaServer.java warnings + - JDK-8346264: "Total compile time" counter should include time spent in failing/bailout compiles + - JDK-8346285: Update jarsigner compatibility test for change in default digest algorithm + - JDK-8346581: JRadioButton/ButtonGroupFocusTest.java fails in CI on Linux + - JDK-8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs + - JDK-8346671: java/nio/file/Files/probeContentType/Basic.java fails on Windows 2025 + - JDK-8346705: SNI not sent with Java 22+ using java.net.http.HttpClient.Builder#sslParameters + - JDK-8346832: runtime/CompressedOops/CompressedCPUSpecificClassSpaceReservation.java fails on RISC-V + - JDK-8346880: [aix] java/lang/ProcessHandle/InfoTest.java still fails: "reported cputime less than expected" + - JDK-8346881: [ubsan] logSelection.cpp:154:24 / logSelectionList.cpp:72:94 : runtime error: applying non-zero offset 1 to null pointer + - JDK-8346888: [ubsan] block.cpp:1617:30: runtime error: 9.97582e+36 is outside the range of representable values of type 'int' + - JDK-8346972: Test java/nio/channels/FileChannel/LoopingTruncate.java fails sometimes with IOException: There is not enough space on the disk + - JDK-8347000: Bug in com/sun/net/httpserver/bugs/B6361557.java test + - JDK-8347018: C2: Insertion of Assertion Predicates ignores the effects of PhaseIdealLoop::clone_up_backedge_goo() + - JDK-8347038: [JMH] jdk.incubator.vector.SpiltReplicate fails NoClassDefFoundError + - JDK-8347126: gc/stress/TestStressG1Uncommit.java gets OOM-killed + - JDK-8347171: (dc) java/nio/channels/DatagramChannel/InterruptibleOrNot.java fails with virtual thread factory + - JDK-8347173: java/net/DatagramSocket/InterruptibleDatagramSocket.java fails with virtual thread factory + - JDK-8347267: [macOS]: UnixOperatingSystem.c:67:40: runtime error: division by zero + - JDK-8347268: [ubsan] logOutput.cpp:357:21: runtime error: applying non-zero offset 1 to null pointer + - JDK-8347286: (fs) Remove some extensions from java/nio/file/Files/probeContentType/Basic.java + - JDK-8347296: WinInstallerUiTest fails in local test runs if the path to test work directory is longer that regular + - JDK-8347298: Bug in JPackageCommand.ignoreFakeRuntime() + - JDK-8347300: Don't exclude the "PATH" var from the environment when running app launchers in jpackage tests + - JDK-8347302: Mark test tools/jimage/JImageToolTest.java as flagless + - JDK-8347373: HTTP/2 flow control checks may count unprocessed data twice + - JDK-8347377: Add validation checks for ICC_Profile header fields + - JDK-8347427: JTabbedPane/8134116/Bug8134116.java has no license header + - JDK-8347564: ZGC: Crash in DependencyContext::clean_unloading_dependents + - JDK-8347576: Error output in libjsound has non matching format strings + - JDK-8347629: Test FailOverDirectExecutionControlTest.java fails with -Xcomp + - JDK-8347718: Unexpected NullPointerException in C2 compiled code due to ReduceAllocationMerges + - JDK-8347740: java/io/File/createTempFile/SpecialTempFile.java failing + - JDK-8347847: Enhance jar file support + - JDK-8347995: Race condition in jdk/java/net/httpclient/offline/FixedResponseHttpClient.java + - JDK-8347997: assert(false) failed: EA: missing memory path + - JDK-8348102: java/net/httpclient/HttpClientSNITest.java fails intermittently + - JDK-8348110: Update LCMS to 2.17 + - JDK-8348261: assert(n->is_Mem()) failed: memory node required + - JDK-8348299: Update List/ItemEventTest/ItemEventTest.java + - JDK-8348323: Corrupted timezone string in JVM crash log + - JDK-8348356: Update the release version after forking Apr CPU25_04 + - JDK-8348562: ZGC: segmentation fault due to missing node type check in barrier elision analysis + - JDK-8348582: Set -fstack-protector when building with clang + - JDK-8348596: Update FreeType to 2.13.3 + - JDK-8348597: Update HarfBuzz to 10.4.0 + - JDK-8348598: Update Libpng to 1.6.47 + - JDK-8348600: Update PipeWire to 1.3.81 + - JDK-8348675: TrayIcon tests fail in Ubuntu 24.10 Wayland + - JDK-8348936: [Accessibility,macOS,VoiceOver] VoiceOver doesn't announce untick on toggling the checkbox with "space" key on macOS + - JDK-8348989: Better Glyph drawing + - JDK-8349002: GenShen: Deadlock during shutdown + - JDK-8349039: Adjust exception No type named in database + - JDK-8349058: 'internal proprietary API' warnings make javac warnings unusable + - JDK-8349084: Update vectors used in several PQC benchmarks + - JDK-8349111: Enhance Swing supports + - JDK-8349150: Support precompiled headers on AIX + - JDK-8349183: [BACKOUT] Optimization for StringBuilder append boolean & null + - JDK-8349200: [JMH] time.format.ZonedDateTimeFormatterBenchmark fails + - JDK-8349213: G1: Clearing bitmaps during collection set merging not claimed by region + - JDK-8349214: Improve size optimization flags for MSVC builds + - JDK-8349239: [BACKOUT] Reuse StringLatin1::putCharsAt and StringUTF16::putCharsAt + - JDK-8349348: Refactor ClassLoaderDeadlock.sh and Deadlock.sh to run fully in java + - JDK-8349358: [JMH] Cannot access class jdk.internal.vm.ContinuationScope + - JDK-8349370: Bump version numbers for 24.0.2 + - JDK-8349375: Cleanup AIX special file build settings + - JDK-8349378: Build splashscreen lib with SIZE optimization + - JDK-8349492: Update sun/security/pkcs12/KeytoolOpensslInteropTest.java to use a recent Openssl version + - JDK-8349501: Relocate supporting classes in security/testlibrary to test/lib/jdk tree + - JDK-8349551: Failures in tests after JDK-8345625 + - JDK-8349584: Improve compiler processing + - JDK-8349594: Enhance TLS protocol support + - JDK-8349623: [ASAN] Gtest os_linux.glibc_mallinfo_wrapper_vm fails + - JDK-8349637: Integer.numberOfLeadingZeros outputs incorrectly in certain cases + - JDK-8349751: AIX build failure after upgrade pipewire to 1.3.81 + - JDK-8349753: Incorrect use of CodeBlob::is_buffer_blob() in few places + - JDK-8349787: java/lang/Thread/virtual/ThreadPollOnYield.java#default passes unexpectedly without libVThreadPinner.so + - JDK-8349943: [JMH] Use jvmArgs consistently + - JDK-8350103: Test containers/systemd/SystemdMemoryAwarenessTest.java fails on Linux ppc64le SLES15 SP6 + - JDK-8350137: After JDK-8348975, Linux builds contain man pages for windows only tools + - JDK-8350201: Out of bounds access on Linux aarch64 in os::print_register_info + - JDK-8350202: Tune for Power10 CPUs on Linux ppc64le + - JDK-8350211: CTW: Attempt to preload all classes in constant pool + - JDK-8350260: Improve HTML instruction formatting in PassFailJFrame + - JDK-8350313: Include timings for leaving safepoint in safepoint logging + - JDK-8350386: Test TestCodeCacheFull.java fails with option -XX:-UseCodeCacheFlushing + - JDK-8350483: AArch64: turn on signum intrinsics by default on Ampere CPUs + - JDK-8350498: Remove two Camerfirma root CA certificates + - JDK-8350499: Minimal build fails with slowdebug builds + - JDK-8350546: Several java/net/InetAddress tests fails UnknownHostException + - JDK-8350682: [JMH] vector.IndexInRangeBenchmark failed with IndexOutOfBoundsException for size=1024 + - JDK-8350683: Non-C2 / minimal JVM crashes in the build on ppc64 platforms + - JDK-8350786: Some java/lang jtreg tests miss requires vm.hasJFR + - JDK-8350820: OperatingSystemMXBean CpuLoad() methods return -1.0 on Windows + - JDK-8350924: javax/swing/JMenu/4213634/bug4213634.java fails + - JDK-8350991: Improve HTTP client header handling + - JDK-8351033: RISC-V: TestFloat16ScalarOperations asserts with offset (4210) is too large to be patched in one beq/bge/bgeu/blt/bltu/bne instruction! + - JDK-8351223: Update localized resources in keytool and jarsigner + - JDK-8351233: [ASAN] avx2-emu-funcs.hpp:151:20: error: ‘D.82188’ is used uninitialized + - JDK-8351277: Remove pipewire from AIX build + - JDK-8351382: New test containers/docker/TestMemoryWithSubgroups.java is failing + - JDK-8351500: G1: NUMA migrations cause crashes in region allocation + - JDK-8351639: Improve debuggability of test/langtools/jdk/jshell/JdiHangingListenExecutionControlTest.java test + - JDK-8351665: Remove unused UseNUMA in os_aix.cpp + - JDK-8351933: Inaccurate masking of TC subfield decrement in ForkJoinPool + - JDK-8352109: java/awt/Desktop/MailTest.java fails in platforms where Action.MAIL is not supported + - JDK-8352302: Test sun/security/tools/jarsigner/TimestampCheck.java is failing + - JDK-8352508: [Redo] G1: Pinned regions with pinned objects only reachable by native code crash VM + - JDK-8352512: TestVectorZeroCount: counter not reset between iterations + - JDK-8352706: httpclient HeadTest does not run on HTTP2 + - JDK-8352716: (tz) Update Timezone Data to 2025b + - JDK-8352946: SEGV_BND signal code of SIGSEGV missing from our signal-code table + - JDK-8353053: (fs) Add support for UserDefinedFileAttributeView on AIX + - JDK-8353066: Properly detect Windows/aarch64 as build platform + - JDK-8353185: Introduce the concept of upgradeable files in context of JEP 493 + - JDK-8353261: Problemlist 5 tests due to failures in the CI pipeline + - JDK-8353274: [PPC64] Bug related to -XX:+UseCompactObjectHeaders -XX:-UseSIGTRAP in JDK-8305895 + - JDK-8353329: Small memory leak when create GrowableArray with initial size 0 + - JDK-8353709: Debug symbols bundle should contain full debug files when building --with-external-symbols-in-bundles=public + - JDK-8353740: Problemlist 2 tests due to failures in the CI pipeline + - JDK-8353787: Increased number of SHA-384-Digest java.util.jar.Attributes$Name instances leading to higher memory footprint + - JDK-8353861: Problemlist 1 test due to failures in the CI pipeline + - JDK-8353946: Incorrect WINDOWS ifdef in os::build_agent_function_name + - JDK-8354657: Problemlist 2 tests due to failures in the CI pipeline + - JDK-8354831: Problemlist 2 tests due to failures in the CI pipeline + - JDK-8354861: Change milestone to fcs for all releases + - JDK-8354904: [Backout] JDK-8345625: Better HTTP connections + - JDK-8355524: Only every second line in upgradeable files is being used + - JDK-8355884: [macos] java/awt/Frame/I18NTitle.java fails on MacOS + - JDK-8356096: ISO 4217 Amendment 179 Update + - JDK-8359170: Add 2 TLS and 2 CS Sectigo roots + - JDK-8360147: Better Glyph drawing redux New in release OpenJDK 24.0.1+9 (2025-4-16): =========================================== diff --git a/fips-21u-75ffdc48eda.patch b/fips-21u-9203d50836c.patch similarity index 99% rename from fips-21u-75ffdc48eda.patch rename to fips-21u-9203d50836c.patch index 8413fe1..9966391 100644 --- a/fips-21u-75ffdc48eda.patch +++ b/fips-21u-9203d50836c.patch @@ -116,7 +116,7 @@ index 00000000000..f48fc7f7e80 + AC_SUBST(NSS_LIBDIR) +]) diff --git a/make/autoconf/libraries.m4 b/make/autoconf/libraries.m4 -index a1fc81564b1..ebad69d9dcf 100644 +index 51d4f724c33..feb0bcf3e75 100644 --- a/make/autoconf/libraries.m4 +++ b/make/autoconf/libraries.m4 @@ -35,6 +35,7 @@ m4_include([lib-std.m4]) @@ -127,7 +127,7 @@ index a1fc81564b1..ebad69d9dcf 100644 ################################################################################ # Determine which libraries are needed for this configuration -@@ -134,6 +135,7 @@ AC_DEFUN_ONCE([LIB_SETUP_LIBRARIES], +@@ -128,6 +129,7 @@ AC_DEFUN_ONCE([LIB_SETUP_LIBRARIES], LIB_SETUP_X11 LIB_TESTS_SETUP_GTEST @@ -136,10 +136,10 @@ index a1fc81564b1..ebad69d9dcf 100644 BASIC_JDKLIB_LIBS="" BASIC_JDKLIB_LIBS_TARGET="" diff --git a/make/autoconf/spec.gmk.in b/make/autoconf/spec.gmk.in -index 0f85917814e..9419562b654 100644 +index f6def153c82..4d7abc33427 100644 --- a/make/autoconf/spec.gmk.in +++ b/make/autoconf/spec.gmk.in -@@ -867,6 +867,11 @@ INSTALL_SYSCONFDIR=@sysconfdir@ +@@ -873,6 +873,11 @@ INSTALL_SYSCONFDIR=@sysconfdir@ # Libraries # @@ -1979,7 +1979,7 @@ index 539ef1e8ee8..435f57e3ff2 100644 "sun.security.rsa.PSSParameters", null); } diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security -index 5149edba0e5..8227d650a03 100644 +index f8b01a4ea1e..b325bf7e9fc 100644 --- a/src/java.base/share/conf/security/java.security +++ b/src/java.base/share/conf/security/java.security @@ -85,6 +85,17 @@ security.provider.tbd=Apple @@ -2959,7 +2959,7 @@ index 00000000000..f8d505ca815 +} \ No newline at end of file diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java -index 6b26297b1b4..7ee5e07756c 100644 +index 01fc06ae283..e3ca000d309 100644 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java @@ -37,6 +37,8 @@ import javax.crypto.*; @@ -2981,20 +2981,21 @@ index 6b26297b1b4..7ee5e07756c 100644 private static final String PUBLIC = "public"; private static final String PRIVATE = "private"; private static final String SECRET = "secret"; -@@ -401,8 +406,10 @@ abstract class P11Key implements Key, Length { +@@ -414,9 +419,10 @@ abstract class P11Key implements Key, Length { new CK_ATTRIBUTE(CKA_EXTRACTABLE), }); -- boolean keySensitive = (attrs[0].getBoolean() || -- attrs[1].getBoolean() || !attrs[2].getBoolean()); +- boolean keySensitive = +- (attrs[0].getBoolean() && P11Util.isNSS(session.token)) || +- attrs[1].getBoolean() || !attrs[2].getBoolean(); + boolean exportable = plainKeySupportEnabled && !algorithm.equals("DH"); + boolean keySensitive = (!exportable && -+ (attrs[0].getBoolean() || -+ attrs[1].getBoolean() || !attrs[2].getBoolean())); ++ ((attrs[0].getBoolean() && P11Util.isNSS(session.token)) || ++ attrs[1].getBoolean() || !attrs[2].getBoolean())); return switch (algorithm) { case "RSA" -> P11RSAPrivateKeyInternal.of(session, keyID, algorithm, -@@ -454,7 +461,8 @@ abstract class P11Key implements Key, Length { +@@ -468,7 +474,8 @@ abstract class P11Key implements Key, Length { public String getFormat() { token.ensureValid(); @@ -3004,13 +3005,13 @@ index 6b26297b1b4..7ee5e07756c 100644 return null; } else { return "RAW"; -@@ -1624,4 +1632,3 @@ final class SessionKeyRef extends PhantomReference { +@@ -1638,4 +1645,3 @@ final class SessionKeyRef extends PhantomReference { this.clear(); } } - diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java -index 5cd6828d293..bae49c4e8a9 100644 +index 0a62021633f..0723b69c2bc 100644 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java @@ -26,6 +26,9 @@ @@ -3021,7 +3022,7 @@ index 5cd6828d293..bae49c4e8a9 100644 +import java.lang.invoke.MethodHandles; +import java.lang.invoke.MethodType; import java.util.*; - + import java.util.stream.Collectors; import java.security.*; @@ -42,10 +45,12 @@ import javax.security.auth.callback.PasswordCallback; @@ -3140,7 +3141,7 @@ index 5cd6828d293..bae49c4e8a9 100644 } p11 = tmpPKCS11; -@@ -1389,11 +1461,52 @@ public final class SunPKCS11 extends AuthProvider { +@@ -1388,11 +1460,52 @@ public final class SunPKCS11 extends AuthProvider { } @Override @@ -3193,7 +3194,7 @@ index 5cd6828d293..bae49c4e8a9 100644 try { return newInstance0(param); } catch (PKCS11Exception e) { -@@ -1750,6 +1863,9 @@ public final class SunPKCS11 extends AuthProvider { +@@ -1749,6 +1862,9 @@ public final class SunPKCS11 extends AuthProvider { try { session = token.getOpSession(); p11.C_Logout(session.id()); @@ -3204,7 +3205,7 @@ index 5cd6828d293..bae49c4e8a9 100644 debug.println("logout succeeded"); } diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java -index 3378409ca1c..7602a92a252 100644 +index a6f5f0a8764..9a07c96ca4e 100644 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java @@ -33,6 +33,7 @@ import java.lang.ref.*; @@ -3251,7 +3252,7 @@ index 3378409ca1c..7602a92a252 100644 } diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java -index 4b06daaf264..55e14945469 100644 +index 0fd13fd6fa6..3c959c942a1 100644 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java @@ -49,6 +49,9 @@ package sun.security.pkcs11.wrapper; @@ -3311,7 +3312,7 @@ index 4b06daaf264..55e14945469 100644 } if (omitInitialize == false) { try { -@@ -1976,4 +2004,194 @@ static class SynchronizedPKCS11 extends PKCS11 { +@@ -2012,4 +2040,194 @@ static class SynchronizedPKCS11 extends PKCS11 { super.C_GenerateRandom(hSession, randomData); } } diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index 667c736..59554cb 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -36,10 +36,9 @@ # Build with system libraries %bcond_with system_libs - -%if (0%{?rhel} > 0 && 0%{?rhel} < 8) # This is RHEL 7 specific as it doesn't seem to have the # __brp_strip_static_archive macro. +%if 0%{?rhel} == 7 %define __os_install_post %{nil} %endif @@ -147,7 +146,7 @@ # However, it does segfault on the Zero assembler port, so currently JIT only %global share_arches %{jit_arches} # Set of architectures for which we build the Shenandoah garbage collector -%global shenandoah_arches x86_64 %{aarch64} +%global shenandoah_arches x86_64 %{aarch64} riscv64 # Set of architectures for which we build the Z garbage collector %global zgc_arches x86_64 riscv64 # Set of architectures for which alt-java has SSB mitigation @@ -337,7 +336,7 @@ # New Version-String scheme-style defines %global featurever 24 %global interimver 0 -%global updatever 1 +%global updatever 2 %global patchver 0 # buildjdkver is usually same as %%{featurever}, # but in time of bootstrap of next jdk, it is featurever-1, @@ -387,7 +386,7 @@ # Define IcedTea version used for SystemTap tapsets and desktop file %global icedteaver 6.0.0pre00-c848b93a8598 # Define current Git revision for the FIPS support patches -%global fipsver 75ffdc48eda +%global fipsver 9203d50836c # Define JDK versions %global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver} %global javaver %{featurever} @@ -401,8 +400,8 @@ %global origin_nice OpenJDK %global top_level_dir_name %{vcstag} %global top_level_dir_name_backup %{top_level_dir_name}-backup -%global buildver 9 -%global rpmrelease 2 +%global buildver 12 +%global rpmrelease 1 #%%global tagsuffix %%{nil} # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit %if %is_system_jdk @@ -647,7 +646,6 @@ Source18: TestTranslations.java # RPM/distribution specific patches # ############################################ - # Crypto policy and FIPS support patches # Patch is generated from the fips-21u tree at https://github.com/rh-openjdk/jdk/tree/fips-21u # as follows: git diff %%{vcstag} src make test > fips-21u-$(git show -s --format=%h HEAD).patch @@ -701,12 +699,8 @@ Patch1100: 0001-Fix-name-class-of-uabs-with-GCC-15.patch # OpenJDK patches which missed last update # ############################################# -# JDK-8350137: After JDK-8348975, Linux builds contain man pages for windows only tools -Patch2000: 0001-8350137-After-JDK-8348975-Linux-builds-contain-man-p.patch -# JDK-8353185: Introduce the concept of upgradeable files in context of JEP 493 -Patch2001: 0001-8353185-Introduce-the-concept-of-upgradeable-files-i.patch -# JDK-8355524: Only every second line in upgradeable files is being used -Patch2002: 0001-8355524-Only-every-second-line-in-upgradeable-files-.patch + +# Currently empty ############################################# # @@ -791,19 +785,22 @@ BuildRequires: harfbuzz-devel BuildRequires: lcms2-devel BuildRequires: libjpeg-devel BuildRequires: libpng-devel +BuildRequires: zlib-devel %else # Version in src/java.desktop/share/legal/freetype.md -Provides: bundled(freetype) = 2.13.0 +Provides: bundled(freetype) = 2.13.3 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h -Provides: bundled(giflib) = 5.2.1 +Provides: bundled(giflib) = 5.2.2 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h -Provides: bundled(harfbuzz) = 8.2.2 +Provides: bundled(harfbuzz) = 10.4.0 # Version in src/java.desktop/share/native/liblcms/lcms2.h -Provides: bundled(lcms2) = 2.15.0 +Provides: bundled(lcms2) = 2.17.0 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h Provides: bundled(libjpeg) = 6b # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h -Provides: bundled(libpng) = 1.6.40 +Provides: bundled(libpng) = 1.6.47 +# Version in src/java.base/share/native/libzip/zlib/zlib.h +Provides: bundled(zlib) = 1.3.1 # We link statically against libstdc++ to increase portability BuildRequires: libstdc++-static %endif @@ -982,6 +979,7 @@ echo "WARNING: The build of a fresh libjvm has been disabled due to a JDK versio echo "Build JDK version is %{buildjdkver}, feature JDK version is %{featurever}" %endif +export XZ_OPT="-T0" %setup -q -c -n %{uniquesuffix ""} -T -a 0 # https://bugzilla.redhat.com/show_bug.cgi?id=1189084 prioritylength=`expr length %{priority}` @@ -1002,11 +1000,6 @@ pushd %{top_level_dir_name} # Skipping fips patch whil eit is not ready for jdk22 %%patch -P1001 -p1 # Patches in need of upstreaming %patch -P1100 -p1 - -# Patches not yet in 24.0.1 -%patch -P2000 -p1 -%patch -P2001 -p1 -%patch -P2002 -p1 popd # openjdk @@ -1369,6 +1362,7 @@ packFullPatchedSources %if %{build_hotspot_first} # Build a fresh libjvm.so first and use it to bootstrap + echo "Building HotSpot only for the latest libjvm.so" cp -LR --preserve=mode,timestamps %{bootjdk} newboot systemjdk=$(pwd)/newboot buildjdk build/newboot ${systemjdk} %{hotspot_target} "release" "bundled" "internal" @@ -1428,7 +1422,6 @@ for suffix in %{build_loop} ; do findgeneratedsources ${installdir} ${builddir} $(pwd)/%{top_level_dir_name} installjdk ${builddir} ${installdir} fi - packagejdk ${installdir} ${packagesdir} %{altjavaoutputdir} %if %{system_libs} diff --git a/openjdk_news.sh b/openjdk_news.sh deleted file mode 100755 index d1bd061..0000000 --- a/openjdk_news.sh +++ /dev/null @@ -1,76 +0,0 @@ -#!/bin/bash - -# Copyright (C) 2022 Red Hat, Inc. -# Written by Andrew John Hughes , 2012-2022 -# -# This program is free software: you can redistribute it and/or modify -# it under the terms of the GNU Affero General Public License as -# published by the Free Software Foundation, either version 3 of the -# License, or (at your option) any later version. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# GNU Affero General Public License for more details. -# -# You should have received a copy of the GNU Affero General Public License -# along with this program. If not, see . - -OLD_RELEASE=$1 -NEW_RELEASE=$2 -REPO=$3 -SUBDIR=$4 -SCRIPT_DIR=$(dirname ${0}) - -if test "x${SUBDIR}" = "x"; then - echo "No subdirectory specified; using ."; - SUBDIR="."; -fi - -if test "x$REPO" = "x"; then - echo "No repository specified; using ${PWD}" - REPO=${PWD} -fi - -if test x${TMPDIR} = x; then - TMPDIR=/tmp; -fi - -echo "Repository: ${REPO}" - -if [ -e ${REPO}/.git ] ; then - TYPE=git; -elif [ -e ${REPO}/.hg ] ; then - TYPE=hg; -else - echo "No Mercurial or Git repository detected."; - exit 1; -fi - -if test "x$OLD_RELEASE" = "x" || test "x$NEW_RELEASE" = "x"; then - echo "ERROR: Need to specify old and new release"; - exit 2; -fi - -echo "Listing fixes between $OLD_RELEASE and $NEW_RELEASE in $REPO" -rm -f ${TMPDIR}/fixes2 ${TMPDIR}/fixes3 ${TMPDIR}/fixes -for repos in . $(${SCRIPT_DIR}/discover_trees.sh ${REPO}); -do - if test "x$TYPE" = "xhg"; then - hg log -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R $REPO/$repos -G -M ${REPO}/${SUBDIR} | \ - grep -E '^[o:| ]*summary'|grep -v 'Added tag'|sed -r 's#^[o:| ]*summary:\W*([0-9])# - JDK-\1#'| \ - sed 's#^[o:| ]*summary:\W*# - #' >> ${TMPDIR}/fixes2; - hg log -v -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R $REPO/$repos -G -M ${REPO}/${SUBDIR} | \ - grep -E '^[o:| ]*[0-9]{7}'|sed -r 's#^[o:| ]*([0-9]{7})# - JDK-\1#' >> ${TMPDIR}/fixes3; - else - git -C ${REPO} log --no-merges --pretty=format:%B ${NEW_RELEASE}...${OLD_RELEASE} -- ${SUBDIR} |grep -E '^[0-9]{7}' | \ - sed -r 's#^([0-9])# - JDK-\1#' >> ${TMPDIR}/fixes2; - touch ${TMPDIR}/fixes3 ; # unused - fi -done - -sort ${TMPDIR}/fixes2 ${TMPDIR}/fixes3 | uniq > ${TMPDIR}/fixes -rm -f ${TMPDIR}/fixes2 ${TMPDIR}/fixes3 - -echo "In ${TMPDIR}/fixes:" -cat ${TMPDIR}/fixes diff --git a/discover_trees.sh b/scripts/discover_trees.sh similarity index 57% rename from discover_trees.sh rename to scripts/discover_trees.sh index 8c31278..7a0b800 100755 --- a/discover_trees.sh +++ b/scripts/discover_trees.sh @@ -1,6 +1,6 @@ #!/bin/sh -# Copyright (C) 2020 Red Hat, Inc. +# Copyright (C) 2024 Red Hat, Inc. # Written by Andrew John Hughes . # # This program is free software: you can redistribute it and/or modify @@ -18,37 +18,44 @@ TREE=${1} -if test "x${TREE}" = "x"; then +if test "${TREE}" = ""; then TREE=${PWD} fi -if [ -e ${TREE}/nashorn/.hg -o -e ${TREE}/nashorn/merge.changeset ] ; then +if [ -e "${TREE}"/nashorn/.hg ] || [ -e "${TREE}"/nashorn/merge.changeset ] ; then NASHORN="nashorn" ; fi -if [ -e ${TREE}/corba/.hg -o -e ${TREE}/corba/merge.changeset ] ; then +if [ -e "${TREE}"/corba/.hg ] || [ -e "${TREE}"/corba/merge.changeset ] ; then CORBA="corba"; fi -if [ -e ${TREE}/jaxp/.hg -o -e ${TREE}/jaxp/merge.changeset ] ; then +if [ -e "${TREE}"/jaxp/.hg ] || [ -e "${TREE}"/jaxp/merge.changeset ] ; then JAXP="jaxp"; fi -if [ -e ${TREE}/jaxws/.hg -o -e ${TREE}/jaxws/merge.changeset ] ; then +if [ -e "${TREE}"/jaxws/.hg ] || [ -e "${TREE}"/jaxws/merge.changeset ] ; then JAXWS="jaxws"; fi -if [ -e ${TREE}/langtools/.hg -o -e ${TREE}/langtools/merge.changeset ] ; then +if [ -e "${TREE}"/langtools/.hg ] || [ -e "${TREE}"/langtools/merge.changeset ] ; then LANGTOOLS="langtools"; fi -if [ -e ${TREE}/jdk/.hg -o -e ${TREE}/jdk/merge.changeset ] ; then +if [ -e "${TREE}"/jdk/.hg ] || [ -e "${TREE}"/jdk/merge.changeset ] ; then JDK="jdk"; fi -if [ -e ${TREE}/hotspot/.hg -o -e ${TREE}/hotspot/merge.changeset ] ; then +if [ -e "${TREE}"/hotspot/.hg ] || [ -e "${TREE}"/hotspot/merge.changeset ] ; then HOTSPOT="hotspot"; fi SUBTREES="${CORBA} ${JAXP} ${JAXWS} ${LANGTOOLS} ${NASHORN} ${JDK} ${HOTSPOT}"; -echo ${SUBTREES} +echo "${SUBTREES}" + +# Local Variables: +# compile-command: "shellcheck discover_trees.sh" +# fill-column: 80 +# indent-tabs-mode: nil +# sh-basic-offset: 4 +# End: diff --git a/generate_source_tarball.sh b/scripts/generate_source_tarball.sh similarity index 70% rename from generate_source_tarball.sh rename to scripts/generate_source_tarball.sh index 9a0e233..ad163f3 100755 --- a/generate_source_tarball.sh +++ b/scripts/generate_source_tarball.sh @@ -1,6 +1,10 @@ #!/bin/bash # Copyright (C) 2024 Red Hat, Inc. +# Written by: +# Andrew John Hughes +# Thomas Fitzsimmons +# Jiri Vanek # # This program is free software: you can redistribute it and/or modify # it under the terms of the GNU Affero General Public License as @@ -15,42 +19,46 @@ # You should have received a copy of the GNU Affero General Public License # along with this program. If not, see . -# Generates the 'source tarball' for JDK projects. +# Generates the source tarball for OpenJDK projects. +# +# There are multiple ways to specify the source code location and version: +# +# 1. Specify the version (VERSION), the location of the Git repository +# (REPO_ROOT) and the root of the output tarball name (FILE_NAME_ROOT) +# 2. Specify the version (VERSION) along with an upstream project name +# (PROJECT_NAME) and repository name (REPO_NAME) that can be used +# to construct the URL of the upstream OpenJDK repository. +# 3. Specify OPENJDK_LATEST=1 and allow the script to obtain the JDK +# feature version from the spec file, which is then used to +# obtain the latest build promotion from the upstream repository. +# +# An appropriate bootstrap JDK is also required for when ./configure +# is run within the checked out repository to generate the .src-rev. +# file. This can be specified by setting BOOT_JDK. # # Example 1: -# When used from local repo set REPO_ROOT pointing to file:// with your repo. -# If your local repo follows upstream forests conventions, it may be enough to -# set OPENJDK_URL. +# This will check out the specified version from the specified +# repository and construct a tarball called openjdk-17.0.3+5.tar.xz: +# +# $ VERSION=jdk-17.0.3+5 FILE_NAME_ROOT=open${VERSION} \ +# REPO_ROOT=$HOME/projects/openjdk/upstream/17u \ +# BOOT_JDK=/usr/lib/jvm/java-17-openjdk ./generate_source_tarball.sh # # Example 2: +# This will check out the same version as example 1, but from the +# upstream repository: +# +# $ VERSION=jdk-17.0.3+5 PROJECT_NAME=openjdk REPO_NAME=jdk17u \ +# BOOT_JDK=/usr/lib/jvm/java-17-openjdk ./generate_source_tarball.sh +# +# Example 3: # This will read the OpenJDK feature version from the spec file, then create a # tarball from the most recent tag for that version in the upstream Git # repository. # -# $ OPENJDK_LATEST=1 ./generate_source_tarball.sh -# [...] -# Tarball is: temp-generated-source-tarball-ujD/openjdk-17.0.10+6-ea.tar.xz +# $ OPENJDK_LATEST=1 \ +# BOOT_JDK=/usr/lib/jvm/java-17-openjdk ./generate_source_tarball.sh # -# Unless you use OPENJDK_LATEST, you have to set PROJECT_NAME, REPO_NAME and -# VERSION, e.g.: -# -# PROJECT_NAME=openjdk -# REPO_NAME=jdk24u -# VERSION=jdk-24.0.1+9 -# -# or to e.g., prepare systemtap, icedtea7's jstack and other tapsets: -# -# VERSION=6327cf1cea9e -# REPO_NAME=icedtea7-2.6 -# PROJECT_NAME=release -# OPENJDK_URL=http://icedtea.classpath.org/hg/ -# TO_COMPRESS="*/tapset" -# -# They are used to create correct name and are used in construction of sources -# URL (unless REPO_ROOT is set). -# -# This script creates a single source tarball out of the repository based on the -# given tag and removes code not allowed in Fedora/RHEL. set -e @@ -114,7 +122,7 @@ if [ "$OPENJDK_LATEST" != "" ] ; then fi if [ "$WITH_TEMP" != "" ] ; then - pushd "$(mktemp --directory temp-generated-source-tarball-XXX)" + pushd "$(mktemp --directory --tmpdir temp-generated-source-tarball-XXX)" fi if [ "$VERSION" = "" ] ; then @@ -200,18 +208,25 @@ echo -e "\tFILE_NAME_ROOT: ${FILE_NAME_ROOT}" echo -e "\tREPO_ROOT: ${REPO_ROOT}" echo -e "\tTO_COMPRESS: ${TO_COMPRESS}" echo -e "\tBOOT_JDK: ${BOOT_JDK}" +echo -e "\tWITH_TEMP: ${WITH_TEMP}" +echo -e "\tOPENJDK_LATEST: ${OPENJDK_LATEST}" if [ -d "${FILE_NAME_ROOT}" ] ; then - echo "exists exists exists exists exists exists exists " - echo "reusing reusing reusing reusing reusing reusing " - echo "${FILE_NAME_ROOT}" + echo "Reusing existing ${FILE_NAME_ROOT}" STAT_TIME="$(stat --format=%Y "${FILE_NAME_ROOT}")" TAR_TIME="$(date --date=@"${STAT_TIME}" --iso-8601=seconds)" else mkdir "${FILE_NAME_ROOT}" pushd "${FILE_NAME_ROOT}" echo "Cloning ${VERSION} root repository from ${REPO_ROOT}" - git clone --depth=1 -b "${VERSION}" "${REPO_ROOT}" "${VERSION}" + if realpath -q "${REPO_ROOT}"; then + echo "Local path detected; not adding depth argument"; + DEPTH="--"; + else + DEPTH="--depth=1"; + echo "Remote repository detected; adding ${DEPTH}"; + fi + git clone -b "${VERSION}" "${DEPTH}" "${REPO_ROOT}" "${VERSION}" pushd "${VERSION}" TAR_TIME="$(git log --max-count 1 --format=%cI)" popd @@ -227,39 +242,44 @@ pushd "${FILE_NAME_ROOT}" popd rm -rf build - EA_PART="$(awk -F= \ - '/^DEFAULT_PROMOTED_VERSION_PRE/ { if ($2) print "-"$2 }' \ - "${VERSION}"/make/conf/version-numbers.conf)" - TARBALL_BASE=${FILE_NAME_ROOT}${EA_PART}.tar - pushd "${VERSION}" - # Omit commit checks, history, and GHA from archive. - for skip in .jcheck .hgtags .hgignore .gitattributes .gitignore .github - do - echo "${skip}"" export-ignore" >> .git/info/attributes - done - # Do not bother with --mtime here; specify it to tar below. - # Unforunately, git-archive sorts added files like .src-rev at the end; - # retar below to use GNU tar --sort=name ordering which sorts .src-rev - # at the start. - git archive --output "${TARBALL_BASE}" --prefix="${VERSION}"/ \ - --add-file=.src-rev --format=tar "${VERSION}" - popd - mv "${VERSION}" "${VERSION}".git - tar xf "${VERSION}".git/"${TARBALL_BASE}" + # Remove commit checks + echo "Removing $(find "${VERSION}" -name '.jcheck' -print)" + find "${VERSION}" -name '.jcheck' -print0 | xargs -0 rm -r + + # Remove history and GHA + echo "find ${VERSION} -name '.hgtags'" + find "${VERSION}" -name '.hgtags' -exec rm -v '{}' '+' + echo "find ${VERSION} -name '.hgignore'" + find "${VERSION}" -name '.hgignore' -exec rm -v '{}' '+' + echo "find ${VERSION} -name '.gitattributes'" + find "${VERSION}" -name '.gitattributes' -exec rm -v '{}' '+' + echo "find ${VERSION} -name '.gitignore'" + find "${VERSION}" -name '.gitignore' -exec rm -v '{}' '+' + # Work around some Git objects not having write permissions. + echo "chmod --recursive u+w ${VERSION}/.git" + chmod --recursive u+w "${VERSION}"/.git + echo "find ${VERSION} -name '.git'" + find "${VERSION}" -name '.git' -exec rm -rv '{}' '+' + echo "find ${VERSION} -name '.github'" + find "${VERSION}" -name '.github' -exec rm -rv '{}' '+' + echo "Compressing remaining forest" if [ "$COMPRESSION" = "xz" ] ; then SWITCH=cJf else SWITCH=czf fi - TARBALL_NAME=`echo ${TARBALL_BASE}.${COMPRESSION} | sed "s/-jdk-/-/g"` + EA_PART="$(awk -F= \ + '/^DEFAULT_PROMOTED_VERSION_PRE/ { if ($2) print "-"$2 }' \ + "${VERSION}"/make/conf/version-numbers.conf)" + TARBALL_NAME=${FILE_NAME_ROOT}${EA_PART}.tar.${COMPRESSION} XZ_OPT=${XZ_OPT-"-T0"} \ tar --mtime="${TAR_TIME}" --owner=root --group=root --sort=name \ - -$SWITCH "${TARBALL_NAME}" "${TO_COMPRESS}" + --exclude-vcs -$SWITCH "${TARBALL_NAME}" "${TO_COMPRESS}" mv "${TARBALL_NAME}" .. popd if [ "$WITH_TEMP" != "" ] ; then - echo "Tarball is: $(realpath --relative-to=.. .)/${TARBALL_NAME}" + echo "Tarball is: $(realpath .)/${TARBALL_NAME}" popd else echo -n "Done. You may want to remove the uncompressed version" diff --git a/icedtea_sync.sh b/scripts/icedtea_sync.sh similarity index 100% rename from icedtea_sync.sh rename to scripts/icedtea_sync.sh diff --git a/scripts/openjdk_news.sh b/scripts/openjdk_news.sh new file mode 100755 index 0000000..9574915 --- /dev/null +++ b/scripts/openjdk_news.sh @@ -0,0 +1,114 @@ +#!/bin/bash + +# Copyright (C) 2024 Red Hat, Inc. +# Written by Andrew John Hughes , 2012-2022 +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +OLD_RELEASE=$1 +NEW_RELEASE=$2 +REPO=$3 +SUBDIR=$4 +SCRIPT_DIR=$(dirname "${0}") + +if test "${SUBDIR}" = ""; then + echo "No subdirectory specified; using ."; + SUBDIR="."; +fi + +if test "$REPO" = ""; then + echo "No repository specified; using ${PWD}" + REPO=${PWD} +fi + +if test "${TMPDIR}" = ""; then + TMPDIR=/tmp; +fi + +echo "Repository: ${REPO}" + +if [ -e "${REPO}/.git" ] ; then + TYPE=git; +elif [ -e "${REPO}/.hg" ] ; then + TYPE=hg; +else + echo "No Mercurial or Git repository detected."; + exit 1; +fi + +if test "$OLD_RELEASE" = "" || test "$NEW_RELEASE" = ""; then + echo "ERROR: Need to specify old and new release"; + exit 2; +fi + +echo "Listing fixes between $OLD_RELEASE and $NEW_RELEASE in $REPO" +rm -f "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" "${TMPDIR}/fixes" +for repos in . $("${SCRIPT_DIR}/discover_trees.sh" "${REPO}"); +do + if test "$TYPE" = "hg"; then + hg log -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R "$REPO/$repos" -G -M "${REPO}/${SUBDIR}" | \ + grep -E '^[o:| ]*summary'|grep -v 'Added tag'|sed -r 's#^[o:| ]*summary:\W*([0-9])# - JDK-\1#'| \ + sed 's#^[o:| ]*summary:\W*# - #' >> "${TMPDIR}/fixes2"; + hg log -v -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R "$REPO/$repos" -G -M "${REPO}/${SUBDIR}" | \ + grep -E '^[o:| ]*[0-9]{7}'|sed -r 's#^[o:| ]*([0-9]{7})# - JDK-\1#' >> "${TMPDIR}/fixes3"; + else + git -C "${REPO}" log --no-merges --pretty=format:%B "${NEW_RELEASE}...${OLD_RELEASE}" -- "${SUBDIR}" |grep -E '^[0-9]{7}' | \ + sed -r 's#^([0-9])# - JDK-\1#' >> "${TMPDIR}/fixes2"; + touch "${TMPDIR}/fixes3" ; # unused + fi +done + +sort "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" > "${TMPDIR}/fixes4" +uniq "${TMPDIR}/fixes4" > "${TMPDIR}/fixes" +rm -f "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" + +if ! [ -s "${TMPDIR}/fixes" ] ; then + echo "Failed to obtain fixes."; + exit 3; +fi + +echo "In ${TMPDIR}/fixes:" +cat "${TMPDIR}/fixes" + +printf "\nChecking for duplicates..."; +if uniq -d "${TMPDIR}/fixes4" | grep 'JDK' > "${TMPDIR}/dupes"; then + printf "found.\nWARNING: Review the following duplicates:\n"; + cat "${TMPDIR}/dupes"; +else + echo "No apparent duplicates."; +fi +rm -f "${TMPDIR}/fixes4"; + +printf "\nChecking for backouts..."; +if grep -i 'backout' "${TMPDIR}/fixes" > "${TMPDIR}/backouts"; then + printf "found.\nWARNING: Review the following backouts:\n" + cat "${TMPDIR}/backouts"; +else + echo "No apparent backouts."; +fi +printf "\nChecking for bundled library updates..."; +if grep -iE ':( \(tz\))? update.*(freetype|gif|harfbuzz|lcms|jpeg|png|timezone|zlib)' "${TMPDIR}/fixes" > "${TMPDIR}/bundles"; then + printf "found.\nWARNING: Review the following with respect to bundled provides:\n"; + cat "${TMPDIR}/bundles"; + echo "Compare the output of $(dirname "${0}")/get_bundle_versions.sh with the RPM using the JDK source tree" +else + echo "No apparent library updates."; +fi + +# Local Variables: +# compile-command: "shellcheck openjdk_news.sh" +# fill-column: 80 +# indent-tabs-mode: nil +# sh-basic-offset: 4 +# End: diff --git a/sources b/sources index d00eba7..f50b623 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (openjdk-24.0.1+9.tar.xz) = 44bd46f4478d6c466850c39bfefd575bf05f349f58512ecb4ec441eebc7282e27b8dc521a3e7b9d086ada0b43f7399f2258a4237b635a891727144b67911a185 +SHA512 (openjdk-24.0.2+12.tar.xz) = 92dc174ad4fedb1138bc183a390a85a76fcc3aa1508d4d00f49012b28a8e3a5a1739b349f0fb03dedc6f7977eafa472c5f7608c61ae656c0ecf795b9e96a95ae From 8ff1c844a9b0eddaef4eb9c735aff84c0a21b2fb Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Mon, 21 Jul 2025 20:14:30 +0200 Subject: [PATCH 11/23] Reverted JDK-8350202 can not build on epel8 --- NEWS | 1 - java-latest-openjdk-portable.spec | 3 ++- revert8350202.patch | 31 +++++++++++++++++++++++++++++++ 3 files changed, 33 insertions(+), 2 deletions(-) create mode 100644 revert8350202.patch diff --git a/NEWS b/NEWS index 8a27fc4..12d32ec 100644 --- a/NEWS +++ b/NEWS @@ -132,7 +132,6 @@ New in release OpenJDK 24.0.2+12 (2025-7-15): - JDK-8350103: Test containers/systemd/SystemdMemoryAwarenessTest.java fails on Linux ppc64le SLES15 SP6 - JDK-8350137: After JDK-8348975, Linux builds contain man pages for windows only tools - JDK-8350201: Out of bounds access on Linux aarch64 in os::print_register_info - - JDK-8350202: Tune for Power10 CPUs on Linux ppc64le - JDK-8350211: CTW: Attempt to preload all classes in constant pool - JDK-8350260: Improve HTML instruction formatting in PassFailJFrame - JDK-8350313: Include timings for leaving safepoint in safepoint logging diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index 59554cb..8164525 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -707,8 +707,8 @@ Patch1100: 0001-Fix-name-class-of-uabs-with-GCC-15.patch # Portable build specific patches # ############################################# +Patch1101: revert8350202.patch -# Currently empty BuildRequires: autoconf BuildRequires: automake @@ -1000,6 +1000,7 @@ pushd %{top_level_dir_name} # Skipping fips patch whil eit is not ready for jdk22 %%patch -P1001 -p1 # Patches in need of upstreaming %patch -P1100 -p1 +%patch -P1101 -p1 popd # openjdk diff --git a/revert8350202.patch b/revert8350202.patch new file mode 100644 index 0000000..e325128 --- /dev/null +++ b/revert8350202.patch @@ -0,0 +1,31 @@ +From 3b9470ab57d45e491e18e2e86d9f349312016d81 Mon Sep 17 00:00:00 2001 +From: duke +Date: Fri, 7 Mar 2025 15:23:06 +0000 +Subject: [REVERT] Backport e1d0a9c832ef3e92faaed7f290ff56c0ed8a9d94 + +--- + make/autoconf/flags-cflags.m4 | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/make/autoconf/flags-cflags.m4 b/make/autoconf/flags-cflags.m4 +index 7f92bd015d3..a740de222d0 100644 +--- a/make/autoconf/flags-cflags.m4 ++++ b/make/autoconf/flags-cflags.m4 +@@ -743,7 +743,7 @@ AC_DEFUN([FLAGS_SETUP_CFLAGS_CPU_DEP], + elif test "x$FLAGS_CPU" = xppc64le; then + # Little endian machine uses ELFv2 ABI. + # Use Power8, this is the first CPU to support PPC64 LE with ELFv2 ABI. +- $1_CFLAGS_CPU_JVM="${$1_CFLAGS_CPU_JVM} -DABI_ELFv2 -mcpu=power8 -mtune=power10" ++ $1_CFLAGS_CPU_JVM="${$1_CFLAGS_CPU_JVM} -DABI_ELFv2 -mcpu=power8 -mtune=power8" + fi + elif test "x$FLAGS_CPU" = xs390x; then + $1_CFLAGS_CPU="-mbackchain -march=z10" +@@ -764,7 +764,7 @@ AC_DEFUN([FLAGS_SETUP_CFLAGS_CPU_DEP], + if test "x$FLAGS_CPU" = xppc64le; then + # Little endian machine uses ELFv2 ABI. + # Use Power8, this is the first CPU to support PPC64 LE with ELFv2 ABI. +- $1_CFLAGS_CPU_JVM="${$1_CFLAGS_CPU_JVM} -DABI_ELFv2 -mcpu=power8 -mtune=power10" ++ $1_CFLAGS_CPU_JVM="${$1_CFLAGS_CPU_JVM} -DABI_ELFv2 -mcpu=power8 -mtune=power8" + fi + fi + if test "x$OPENJDK_TARGET_OS" = xaix; then From 1d7ca7d82ef2c8c676b4aa5021e95b6812f83390 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 24 Jul 2025 17:55:42 +0000 Subject: [PATCH 12/23] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- java-latest-openjdk-portable.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index 8164525..c658ed7 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -568,7 +568,7 @@ Version: %{newjavaver}.%{buildver} # This package needs `.rolling` as part of Release so as to not conflict on install with # java-X-openjdk. I.e. when latest rolling release is also an LTS release packaged as # java-X-openjdk. See: https://bugzilla.redhat.com/show_bug.cgi?id=1647298 -Release: %{?eaprefix}%{rpmrelease}%{?extraver}.rolling%{?dist} +Release: %{?eaprefix}%{rpmrelease}%{?extraver}.rolling%{?dist}.1 # java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons # and this change was brought into RHEL-4. java-1.5.0-ibm packages # also included the epoch in their virtual provides. This created a @@ -1734,4 +1734,7 @@ done %endif %changelog +* Thu Jul 24 2025 Fedora Release Engineering - 1:24.0.2.0.12-1.rolling.1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + %autochangelog From 05a84d9ee26eb0ff738c645d02795ca1324098ca Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Mon, 22 Sep 2025 11:36:37 +0200 Subject: [PATCH 13/23] Bumped to jdk25 --- .gitignore | 5 + ...K-8348975-Linux-builds-contain-man-p.patch | 55 - ...e-the-concept-of-upgradeable-files-i.patch | 381 -- ...ry-second-line-in-upgradeable-files-.patch | 38 - 0001-Fix-name-class-of-uabs-with-GCC-15.patch | 172 - NEWS | 276 +- README.md | 4 +- fips-21u-9203d50836c.patch | 4234 ----------------- java-latest-openjdk-portable.spec | 20 +- jconsole.desktop.in | 1 - revert8350202.patch | 31 - scripts/generate_source_tarball.sh | 4 +- sources | 2 +- 13 files changed, 43 insertions(+), 5180 deletions(-) delete mode 100644 0001-8350137-After-JDK-8348975-Linux-builds-contain-man-p.patch delete mode 100644 0001-8353185-Introduce-the-concept-of-upgradeable-files-i.patch delete mode 100644 0001-8355524-Only-every-second-line-in-upgradeable-files-.patch delete mode 100644 0001-Fix-name-class-of-uabs-with-GCC-15.patch delete mode 100644 fips-21u-9203d50836c.patch delete mode 100644 jconsole.desktop.in delete mode 100644 revert8350202.patch diff --git a/.gitignore b/.gitignore index 7829d87..e5f004c 100644 --- a/.gitignore +++ b/.gitignore @@ -52,3 +52,8 @@ /openjdk-24+36.tar.xz /openjdk-24.0.1+9.tar.xz /openjdk-24.0.2+12.tar.xz +/openjdk-25+13-ea.tar.xz +/openjdk-25+26-ea.tar.xz +/openjdk-25+32-ea.tar.xz +/openjdk-jdk-25+36.tar.xz +/openjdk-25+36.tar.xz diff --git a/0001-8350137-After-JDK-8348975-Linux-builds-contain-man-p.patch b/0001-8350137-After-JDK-8348975-Linux-builds-contain-man-p.patch deleted file mode 100644 index c5a9c5c..0000000 --- a/0001-8350137-After-JDK-8348975-Linux-builds-contain-man-p.patch +++ /dev/null @@ -1,55 +0,0 @@ -From ef35e66937108b56742e4f1b9faddf7379aed805 Mon Sep 17 00:00:00 2001 -From: Nizar Benalla -Date: Wed, 26 Feb 2025 17:16:16 +0000 -Subject: [PATCH] 8350137: After JDK-8348975, Linux builds contain man pages - for windows only tools - -Backport-of: 53db57648a09c4c380064eea11fcdb680011d741 ---- - make/Docs.gmk | 2 +- - make/common/Modules.gmk | 9 ++++++++- - 2 files changed, 9 insertions(+), 2 deletions(-) - -diff --git a/make/Docs.gmk b/make/Docs.gmk -index fb2726e6dad..a75d8c74b7c 100644 ---- a/make/Docs.gmk -+++ b/make/Docs.gmk -@@ -680,7 +680,7 @@ ifeq ($(ENABLE_PANDOC), true) - - $(foreach m, $(ALL_MODULES), \ - $(eval MAN_$m := $(call ApplySpecFilter, $(filter %.md, $(call FindFiles, \ -- $(call FindModuleManDirs, $m))))) \ -+ $(call FindModuleManDirsForDocs, $m))))) \ - $(if $(MAN_$m), \ - $(eval $(call SetupProcessMarkdown, MAN_TO_HTML_$m, \ - FILES := $(MAN_$m), \ -diff --git a/make/common/Modules.gmk b/make/common/Modules.gmk -index c8c78ed8041..f87e240ad62 100644 ---- a/make/common/Modules.gmk -+++ b/make/common/Modules.gmk -@@ -92,7 +92,10 @@ SRC_SUBDIRS += share/classes - - SPEC_SUBDIRS += share/specs - --MAN_SUBDIRS += share/man windows/man -+MAN_SUBDIRS += share/man $(TARGET_OS)/man -+ -+# The docs should include the sum of all man pages for all platforms -+MAN_DOCS_SUBDIRS += share/man windows/man - - # Find all module-info.java files for the current build target platform and - # configuration. -@@ -158,6 +161,10 @@ FindModuleManDirs = \ - $(strip $(wildcard \ - $(foreach sub, $(MAN_SUBDIRS), $(addsuffix /$(strip $1)/$(sub), $(TOP_SRC_DIRS))))) - -+FindModuleManDirsForDocs = \ -+ $(strip $(wildcard \ -+ $(foreach sub, $(MAN_DOCS_SUBDIRS), $(addsuffix /$(strip $1)/$(sub), $(TOP_SRC_DIRS))))) -+ - # Construct the complete module source path - GetModuleSrcPath = \ - $(call PathList, \ --- -2.49.0 - diff --git a/0001-8353185-Introduce-the-concept-of-upgradeable-files-i.patch b/0001-8353185-Introduce-the-concept-of-upgradeable-files-i.patch deleted file mode 100644 index 829dc76..0000000 --- a/0001-8353185-Introduce-the-concept-of-upgradeable-files-i.patch +++ /dev/null @@ -1,381 +0,0 @@ -From 2c314dcb723d9c5df255761c3016b25fd8fb501e Mon Sep 17 00:00:00 2001 -From: Severin Gehwolf -Date: Thu, 17 Apr 2025 11:44:15 +0000 -Subject: [PATCH] 8353185: Introduce the concept of upgradeable files in - context of JEP 493 - -Backport-of: 4e24dc003c2304041b342371adf430b120a9fec8 ---- - make/modules/jdk.jlink/Java.gmk | 32 ++++ - .../jdk/tools/jlink/internal/JRTArchive.java | 22 ++- - .../jlink/internal/LinkableRuntimeImage.java | 47 +++++- - .../runtimelink/upgrade_files_java.base.conf | 4 + - .../UpgradeableFileCacertsTest.java | 153 ++++++++++++++++++ - 5 files changed, 254 insertions(+), 4 deletions(-) - create mode 100644 make/modules/jdk.jlink/Java.gmk - create mode 100644 src/jdk.jlink/share/classes/jdk/tools/jlink/internal/runtimelink/upgrade_files_java.base.conf - create mode 100644 test/jdk/tools/jlink/runtimeImage/UpgradeableFileCacertsTest.java - -diff --git a/make/modules/jdk.jlink/Java.gmk b/make/modules/jdk.jlink/Java.gmk -new file mode 100644 -index 00000000000..4ddd1eab03d ---- /dev/null -+++ b/make/modules/jdk.jlink/Java.gmk -@@ -0,0 +1,32 @@ -+# -+# Copyright (c) 2025, Oracle and/or its affiliates. All rights reserved. -+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. -+# -+# This code is free software; you can redistribute it and/or modify it -+# under the terms of the GNU General Public License version 2 only, as -+# published by the Free Software Foundation. Oracle designates this -+# particular file as subject to the "Classpath" exception as provided -+# by Oracle in the LICENSE file that accompanied this code. -+# -+# This code is distributed in the hope that it will be useful, but WITHOUT -+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -+# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -+# version 2 for more details (a copy is included in the LICENSE file that -+# accompanied this code). -+# -+# You should have received a copy of the GNU General Public License version -+# 2 along with this work; if not, write to the Free Software Foundation, -+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. -+# -+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA -+# or visit www.oracle.com if you need additional information or have any -+# questions. -+# -+ -+################################################################################ -+ -+# Instruct SetupJavaCompilation for the jdk.jlink module to include -+# upgrade_files_.conf files -+COPY += .conf -+ -+################################################################################ -diff --git a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JRTArchive.java b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JRTArchive.java -index df7d35ac777..aac220e5b94 100644 ---- a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JRTArchive.java -+++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/JRTArchive.java -@@ -45,6 +45,7 @@ - import java.util.List; - import java.util.Map; - import java.util.Objects; -+import java.util.Set; - import java.util.function.Function; - import java.util.function.Predicate; - import java.util.stream.Collectors; -@@ -76,6 +77,7 @@ public class JRTArchive implements Archive { - private final Map resDiff; - private final boolean errorOnModifiedFile; - private final TaskHelper taskHelper; -+ private final Set upgradeableFiles; - - /** - * JRTArchive constructor -@@ -86,12 +88,15 @@ public class JRTArchive implements Archive { - * install aborts the link. - * @param perModDiff The lib/modules (a.k.a jimage) diff for this module, - * possibly an empty list if there are no differences. -+ * @param taskHelper The task helper instance. -+ * @param upgradeableFiles The set of files that are allowed for upgrades. - */ - JRTArchive(String module, - Path path, - boolean errorOnModifiedFile, - List perModDiff, -- TaskHelper taskHelper) { -+ TaskHelper taskHelper, -+ Set upgradeableFiles) { - this.module = module; - this.path = path; - this.ref = ModuleFinder.ofSystem() -@@ -105,6 +110,7 @@ public class JRTArchive implements Archive { - this.resDiff = Objects.requireNonNull(perModDiff).stream() - .collect(Collectors.toMap(ResourceDiff::getName, Function.identity())); - this.taskHelper = taskHelper; -+ this.upgradeableFiles = upgradeableFiles; - } - - @Override -@@ -217,7 +223,8 @@ private void addNonClassResources() { - - // Read from the base JDK image. - Path path = BASE.resolve(m.resPath); -- if (shaSumMismatch(path, m.hashOrTarget, m.symlink)) { -+ if (!isUpgradeableFile(m.resPath) && -+ shaSumMismatch(path, m.hashOrTarget, m.symlink)) { - if (errorOnModifiedFile) { - String msg = taskHelper.getMessage("err.runtime.link.modified.file", path.toString()); - IOException cause = new IOException(msg); -@@ -239,6 +246,17 @@ private void addNonClassResources() { - } - } - -+ /** -+ * Certain files in a module are considered upgradeable. That is, -+ * their hash sums aren't checked. -+ * -+ * @param resPath The resource path of the file to check for upgradeability. -+ * @return {@code true} if the file is upgradeable. {@code false} otherwise. -+ */ -+ private boolean isUpgradeableFile(String resPath) { -+ return upgradeableFiles.contains(resPath); -+ } -+ - static boolean shaSumMismatch(Path res, String expectedSha, boolean isSymlink) { - if (isSymlink) { - return false; -diff --git a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java -index 935af4585ad..d564ed0bad8 100644 ---- a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java -+++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java -@@ -28,7 +28,10 @@ - import java.io.IOException; - import java.io.InputStream; - import java.nio.file.Path; -+import java.util.HashSet; - import java.util.List; -+import java.util.Scanner; -+import java.util.Set; - - import jdk.tools.jlink.internal.runtimelink.ResourceDiff; - -@@ -42,6 +45,9 @@ public class LinkableRuntimeImage { - public static final String RESPATH_PATTERN = "jdk/tools/jlink/internal/runtimelink/fs_%s_files"; - // The diff files per module for supporting linking from the run-time image - public static final String DIFF_PATTERN = "jdk/tools/jlink/internal/runtimelink/diff_%s"; -+ // meta data for upgradable files -+ private static final String UPGRADEABLE_FILES_PATTERN = "jdk/tools/jlink/internal/runtimelink/upgrade_files_%s.conf"; -+ private static final Module JDK_JLINK_MOD = LinkableRuntimeImage.class.getModule(); - - /** - * In order to be able to show whether or not a runtime is capable of -@@ -62,7 +68,38 @@ public static boolean isLinkableRuntime() { - - private static InputStream getDiffInputStream(String module) throws IOException { - String resourceName = String.format(DIFF_PATTERN, module); -- return LinkableRuntimeImage.class.getModule().getResourceAsStream(resourceName); -+ return JDK_JLINK_MOD.getResourceAsStream(resourceName); -+ } -+ -+ private static Set upgradeableFiles(String module) { -+ String resourceName = String.format(UPGRADEABLE_FILES_PATTERN, module); -+ InputStream filesIn = null; -+ try { -+ filesIn = JDK_JLINK_MOD.getResourceAsStream(resourceName); -+ } catch (IOException e) { -+ throw new AssertionError("Unexpected IO error getting res stream"); -+ } -+ if (filesIn == null) { -+ // no upgradeable files -+ return Set.of(); -+ } -+ Set upgradeableFiles = new HashSet<>(); -+ final InputStream in = filesIn; -+ try (in; -+ Scanner scanner = new Scanner(filesIn)) { -+ while (scanner.hasNextLine()) { -+ String line = scanner.nextLine(); -+ if (line.trim().startsWith("#")) { -+ // Skip comments -+ continue; -+ } -+ upgradeableFiles.add(scanner.nextLine()); -+ } -+ } catch (IOException e) { -+ throw new AssertionError("Failure to retrieve upgradeable files for " + -+ "module " + module, e); -+ } -+ return upgradeableFiles; - } - - public static Archive newArchive(String module, -@@ -81,7 +118,13 @@ public static Archive newArchive(String module, - throw new AssertionError("Failure to retrieve resource diff for " + - "module " + module, e); - } -- return new JRTArchive(module, path, !ignoreModifiedRuntime, perModuleDiff, taskHelper); -+ Set upgradeableFiles = upgradeableFiles(module); -+ return new JRTArchive(module, -+ path, -+ !ignoreModifiedRuntime, -+ perModuleDiff, -+ taskHelper, -+ upgradeableFiles); - } - - -diff --git a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/runtimelink/upgrade_files_java.base.conf b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/runtimelink/upgrade_files_java.base.conf -new file mode 100644 -index 00000000000..df2ca809f08 ---- /dev/null -+++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/runtimelink/upgrade_files_java.base.conf -@@ -0,0 +1,4 @@ -+# Configuration for resource paths of files allowed to be -+# upgraded (in java.base) -+lib/tzdb.dat -+lib/security/cacerts -diff --git a/test/jdk/tools/jlink/runtimeImage/UpgradeableFileCacertsTest.java b/test/jdk/tools/jlink/runtimeImage/UpgradeableFileCacertsTest.java -new file mode 100644 -index 00000000000..86e0f8cefd5 ---- /dev/null -+++ b/test/jdk/tools/jlink/runtimeImage/UpgradeableFileCacertsTest.java -@@ -0,0 +1,153 @@ -+/* -+ * Copyright (c) 2025, Red Hat, Inc. -+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. -+ * -+ * This code is free software; you can redistribute it and/or modify it -+ * under the terms of the GNU General Public License version 2 only, as -+ * published by the Free Software Foundation. -+ * -+ * This code is distributed in the hope that it will be useful, but WITHOUT -+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -+ * version 2 for more details (a copy is included in the LICENSE file that -+ * accompanied this code). -+ * -+ * You should have received a copy of the GNU General Public License version -+ * 2 along with this work; if not, write to the Free Software Foundation, -+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. -+ * -+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA -+ * or visit www.oracle.com if you need additional information or have any -+ * questions. -+ */ -+ -+import java.io.ByteArrayInputStream; -+import java.io.ByteArrayOutputStream; -+import java.io.FileInputStream; -+import java.io.FileOutputStream; -+import java.io.IOException; -+import java.io.InputStream; -+import java.nio.file.Path; -+import java.security.KeyStore; -+import java.security.cert.Certificate; -+import java.security.cert.CertificateException; -+import java.security.cert.CertificateFactory; -+import java.security.cert.X509Certificate; -+ -+import jdk.test.lib.process.OutputAnalyzer; -+import tests.Helper; -+ -+/* -+ * @test -+ * @summary Verify that no errors are reported for files that have been -+ * upgraded when linking from the run-time image -+ * @requires (vm.compMode != "Xcomp" & os.maxMemory >= 2g) -+ * @library ../../lib /test/lib -+ * @modules java.base/jdk.internal.jimage -+ * jdk.jlink/jdk.tools.jlink.internal -+ * jdk.jlink/jdk.tools.jlink.plugin -+ * jdk.jlink/jdk.tools.jimage -+ * @build tests.* jdk.test.lib.process.OutputAnalyzer -+ * jdk.test.lib.process.ProcessTools -+ * @run main/othervm -Xmx1g UpgradeableFileCacertsTest -+ */ -+public class UpgradeableFileCacertsTest extends ModifiedFilesTest { -+ -+ /* -+ * Generated with: -+ * $ rm -f server.keystore && keytool -genkey -alias jlink-upgrade-test \ -+ * -keyalg RSA -dname CN=jlink-upgrade-test \ -+ * -storepass changeit -keysize 3072 -sigalg SHA512withRSA \ -+ * -validity 7300 -keystore server.keystore -+ * $ keytool -export -alias jlink-upgrade-test -storepass changeit \ -+ * -keystore server.keystore -rfc -+ */ -+ private static final String CERT = """ -+ -----BEGIN CERTIFICATE----- -+ MIID3jCCAkagAwIBAgIJALiT/+HXBkSIMA0GCSqGSIb3DQEBDQUAMB0xGzAZBgNV -+ BAMTEmpsaW5rLXVwZ3JhZGUtdGVzdDAeFw0yNTA0MDQxMjA3MjJaFw00NTAzMzAx -+ MjA3MjJaMB0xGzAZBgNVBAMTEmpsaW5rLXVwZ3JhZGUtdGVzdDCCAaIwDQYJKoZI -+ hvcNAQEBBQADggGPADCCAYoCggGBANmrnCDKqSXEJRIiSi4yHWN97ILls3RqYjED -+ la3AZTeXnZrrEIgSjVFUMxCztYqbWoVzKa2lov42Vue2BXVYffcQ8TKc2EJDNO+2 -+ uRKQZpsN7RI4QoVBR2Rq8emrO8CrdOQT7Hh4agxkN9AOvGKMFdt+fXeCIPIuflKP -+ f+RfvhLfC2A70Y+Uu74C5uWgLloA/HF0SsVxf9KmqS9fZBQaiTYhKyoDghCRlWpa -+ nPIHB1XVaRdw8aSpCuzIOQzSCTTlLcammJkBjbFwMZdQG7eglTWzIYryZwe/cyY2 -+ xctLVW3xhUHvnMFG+MajeFny2mxNu163Rxf/rBu4e7jRC/LGSU784nJGapq5K170 -+ WbaeceKp+YORJBviFFORrmkPIwIgE+iGCD6PD6Xwu8vcpeuTVDgsSWMlfgCL3NoI -+ GXmdGiI2Xc/hQX7uzu3UBF6IcPDMTcYr2JKYbgu3v2/vDlJu3qO2ycUeePo5jhuG -+ X2WgcHkb6uOU4W5qdbCA+wFPVZBuwQIDAQABoyEwHzAdBgNVHQ4EFgQUtMJM0+ct -+ ssKqryRckk4YEWdYAZkwDQYJKoZIhvcNAQENBQADggGBAI8A6gJQ8wDx12sy2ZI4 -+ 1q9b+WG6w3LcFEF6Fko5NBizhtfmVycQv4mBa/NJgx4DZmd+5d60gJcTp/hJXGY0 -+ LZyFilm/AgxsLNUUQLbHAV6TWqd3ODWwswAuew9sFU6izl286a9W65tbMWL5r1EA -+ t34ZYVWZYbCS9+czU98WomH4uarRAOlzcEUui3ZX6ZcQxWbz/R2wtKcUPUAYnsqH -+ JPivpE25G5xW2Dp/yeQTrlffq9OLgZWVz0jtOguBUMnsUsgCcpQZtqZX08//wtpz -+ ohLHFGvpXTPbRumRasWWtnRR/QqGRT66tYDqybXXz37UtKZ8VKW0sv2ypVbmAEs5 -+ pLkA/3XiXlstJuCD6cW0Gfbpb5rrPPD46O3FDVlmqlTH3b/MsiQREdydqGzqY7uG -+ AA2GFVaKFASA5ls01CfHLAcrKxSVixditXvsjeIqhddB7Pnbsx20RdzPQoeo9/hF -+ WeIrh4zePDPZChuLR8ZyxeVJhLB71nTrTDDjwXarVez9Xw== -+ -----END CERTIFICATE----- -+ """; -+ -+ private static final String CERT_ALIAS = "jlink-upgrade-test"; -+ -+ public static void main(String[] args) throws Exception { -+ UpgradeableFileCacertsTest test = new UpgradeableFileCacertsTest(); -+ test.run(); -+ } -+ -+ @Override -+ String initialImageName() { -+ return "java-base-jlink-upgrade-cacerts"; -+ } -+ -+ @Override -+ void testAndAssert(Path modifiedFile, Helper helper, Path initialImage) throws Exception { -+ CapturingHandler handler = new CapturingHandler(); -+ jlinkUsingImage(new JlinkSpecBuilder() -+ .helper(helper) -+ .imagePath(initialImage) -+ .name("java-base-jlink-upgrade-cacerts-target") -+ .addModule("java.base") -+ .validatingModule("java.base") -+ .build(), handler); -+ OutputAnalyzer analyzer = handler.analyzer(); -+ // verify we don't get any modified warning -+ analyzer.stdoutShouldNotContain(modifiedFile.toString() + " has been modified"); -+ analyzer.stdoutShouldNotContain("java.lang.IllegalArgumentException"); -+ analyzer.stdoutShouldNotContain("IOException"); -+ } -+ -+ // Add an extra certificate in the cacerts file so that it no longer matches -+ // the recorded hash sum at build time. -+ protected Path modifyFileInImage(Path jmodLessImg) -+ throws IOException, AssertionError { -+ Path cacerts = jmodLessImg.resolve(Path.of("lib", "security", "cacerts")); -+ try (FileInputStream fin = new FileInputStream(cacerts.toFile())) { -+ KeyStore certStore = KeyStore.getInstance(cacerts.toFile(), -+ (char[])null); -+ certStore.load(fin, (char[])null); -+ X509Certificate cert; -+ try (ByteArrayInputStream bin = new ByteArrayInputStream(CERT.getBytes())) { -+ cert = (X509Certificate)generateCertificate(bin); -+ } catch (ClassCastException | CertificateException ce) { -+ throw new AssertionError("Test failed unexpectedly", ce); -+ } -+ certStore.setCertificateEntry(CERT_ALIAS, cert); -+ ByteArrayOutputStream bout = new ByteArrayOutputStream(); -+ certStore.store(bout, (char[])null); -+ try (FileOutputStream fout = new FileOutputStream(cacerts.toFile())) { -+ fout.write(bout.toByteArray()); -+ } -+ } catch (Exception e) { -+ throw new AssertionError("Test failed unexpectedly: ", e); -+ } -+ return cacerts; -+ } -+ -+ private Certificate generateCertificate(InputStream in) -+ throws CertificateException, IOException { -+ byte[] data = in.readAllBytes(); -+ return CertificateFactory.getInstance("X.509") -+ .generateCertificate(new ByteArrayInputStream(data)); -+ } -+} --- -2.49.0 - diff --git a/0001-8355524-Only-every-second-line-in-upgradeable-files-.patch b/0001-8355524-Only-every-second-line-in-upgradeable-files-.patch deleted file mode 100644 index 6c1c4e9..0000000 --- a/0001-8355524-Only-every-second-line-in-upgradeable-files-.patch +++ /dev/null @@ -1,38 +0,0 @@ -From 89f9268ed7c2cb86891f23a10482cd459454bd32 Mon Sep 17 00:00:00 2001 -From: Severin Gehwolf -Date: Fri, 25 Apr 2025 08:20:51 +0000 -Subject: [PATCH] 8355524: Only every second line in upgradeable files is being - used - -Reviewed-by: shade, alanb ---- - .../classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java | 2 +- - .../jlink/internal/runtimelink/upgrade_files_java.base.conf | 2 +- - 2 files changed, 2 insertions(+), 2 deletions(-) - -diff --git a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java -index d564ed0bad8..30c37961829 100644 ---- a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java -+++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/LinkableRuntimeImage.java -@@ -93,7 +93,7 @@ private static Set upgradeableFiles(String module) { - // Skip comments - continue; - } -- upgradeableFiles.add(scanner.nextLine()); -+ upgradeableFiles.add(line); - } - } catch (IOException e) { - throw new AssertionError("Failure to retrieve upgradeable files for " + -diff --git a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/runtimelink/upgrade_files_java.base.conf b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/runtimelink/upgrade_files_java.base.conf -index df2ca809f08..fc5e7b4f328 100644 ---- a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/runtimelink/upgrade_files_java.base.conf -+++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/runtimelink/upgrade_files_java.base.conf -@@ -1,4 +1,4 @@ - # Configuration for resource paths of files allowed to be - # upgraded (in java.base) --lib/tzdb.dat - lib/security/cacerts -+lib/tzdb.dat --- -2.49.0 - diff --git a/0001-Fix-name-class-of-uabs-with-GCC-15.patch b/0001-Fix-name-class-of-uabs-with-GCC-15.patch deleted file mode 100644 index a5031f9..0000000 --- a/0001-Fix-name-class-of-uabs-with-GCC-15.patch +++ /dev/null @@ -1,172 +0,0 @@ -diff --git a/src/hotspot/cpu/aarch64/assembler_aarch64.cpp b/src/hotspot/cpu/aarch64/assembler_aarch64.cpp -index b03344f2d80..ec4f2a0d6c3 100644 ---- a/src/hotspot/cpu/aarch64/assembler_aarch64.cpp -+++ b/src/hotspot/cpu/aarch64/assembler_aarch64.cpp -@@ -456,7 +456,7 @@ void Assembler::bang_stack_with_offset(int offset) { Unimplemented(); } - - bool asm_util::operand_valid_for_immediate_bits(int64_t imm, unsigned nbits) { - guarantee(nbits == 8 || nbits == 12, "invalid nbits value"); -- uint64_t uimm = (uint64_t)uabs((jlong)imm); -+ uint64_t uimm = (uint64_t)g_uabs((jlong)imm); - if (uimm < (UCONST64(1) << nbits)) - return true; - if (uimm < (UCONST64(1) << (2 * nbits)) -diff --git a/src/hotspot/cpu/aarch64/assembler_aarch64.hpp b/src/hotspot/cpu/aarch64/assembler_aarch64.hpp -index 5c02e30963e..aee4a30b649 100644 ---- a/src/hotspot/cpu/aarch64/assembler_aarch64.hpp -+++ b/src/hotspot/cpu/aarch64/assembler_aarch64.hpp -@@ -932,7 +932,7 @@ class Assembler : public AbstractAssembler { - static const uint64_t branch_range = NOT_DEBUG(128 * M) DEBUG_ONLY(2 * M); - - static bool reachable_from_branch_at(address branch, address target) { -- return uabs(target - branch) < branch_range; -+ return g_uabs(target - branch) < branch_range; - } - - // Unconditional branch (immediate) -diff --git a/src/hotspot/cpu/aarch64/macroAssembler_aarch64.cpp b/src/hotspot/cpu/aarch64/macroAssembler_aarch64.cpp -index fd6af0b9b4b..b6aa54b27a4 100644 ---- a/src/hotspot/cpu/aarch64/macroAssembler_aarch64.cpp -+++ b/src/hotspot/cpu/aarch64/macroAssembler_aarch64.cpp -@@ -3267,7 +3267,7 @@ void MacroAssembler::wrap_add_sub_imm_insn(Register Rd, Register Rn, uint64_t im - if (fits) { - (this->*insn1)(Rd, Rn, imm); - } else { -- if (uabs(imm) < (1 << 24)) { -+ if (g_uabs(imm) < (1 << 24)) { - (this->*insn1)(Rd, Rn, imm & -(1 << 12)); - (this->*insn1)(Rd, Rd, imm & ((1 << 12)-1)); - } else { -diff --git a/src/hotspot/cpu/aarch64/stubGenerator_aarch64.cpp b/src/hotspot/cpu/aarch64/stubGenerator_aarch64.cpp -index f5567dcc03a..0843489900c 100644 ---- a/src/hotspot/cpu/aarch64/stubGenerator_aarch64.cpp -+++ b/src/hotspot/cpu/aarch64/stubGenerator_aarch64.cpp -@@ -1162,7 +1162,7 @@ class StubGenerator: public StubCodeGenerator { - - void copy_memory_small(DecoratorSet decorators, BasicType type, Register s, Register d, Register count, int step) { - bool is_backwards = step < 0; -- size_t granularity = uabs(step); -+ size_t granularity = g_uabs(step); - int direction = is_backwards ? -1 : 1; - - Label Lword, Lint, Lshort, Lbyte; -@@ -1221,7 +1221,7 @@ class StubGenerator: public StubCodeGenerator { - Register s, Register d, Register count, int step) { - copy_direction direction = step < 0 ? copy_backwards : copy_forwards; - bool is_backwards = step < 0; -- unsigned int granularity = uabs(step); -+ unsigned int granularity = g_uabs(step); - const Register t0 = r3, t1 = r4; - - // <= 80 (or 96 for SIMD) bytes do inline. Direction doesn't matter because we always -diff --git a/src/hotspot/cpu/riscv/assembler_riscv.hpp b/src/hotspot/cpu/riscv/assembler_riscv.hpp -index 4773043e1ba..4a19b577d9f 100644 ---- a/src/hotspot/cpu/riscv/assembler_riscv.hpp -+++ b/src/hotspot/cpu/riscv/assembler_riscv.hpp -@@ -3818,7 +3818,7 @@ enum Nf { - static const unsigned long branch_range = 1 * M; - - static bool reachable_from_branch_at(address branch, address target) { -- return uabs(target - branch) < branch_range; -+ return g_uabs(target - branch) < branch_range; - } - - // Decode the given instruction, checking if it's a 16-bit compressed -diff --git a/src/hotspot/cpu/riscv/stubGenerator_riscv.cpp b/src/hotspot/cpu/riscv/stubGenerator_riscv.cpp -index fb4539267ae..e6bbd32bd3e 100644 ---- a/src/hotspot/cpu/riscv/stubGenerator_riscv.cpp -+++ b/src/hotspot/cpu/riscv/stubGenerator_riscv.cpp -@@ -886,7 +886,7 @@ class StubGenerator: public StubCodeGenerator { - - void copy_memory_v(Register s, Register d, Register count, int step) { - bool is_backward = step < 0; -- int granularity = uabs(step); -+ int granularity = g_uabs(step); - - const Register src = x30, dst = x31, vl = x14, cnt = x15, tmp1 = x16, tmp2 = x17; - assert_different_registers(s, d, cnt, vl, tmp1, tmp2); -@@ -948,7 +948,7 @@ class StubGenerator: public StubCodeGenerator { - } - - bool is_backwards = step < 0; -- int granularity = uabs(step); -+ int granularity = g_uabs(step); - - const Register src = x30, dst = x31, cnt = x15, tmp3 = x16, tmp4 = x17, tmp5 = x14, tmp6 = x13; - const Register gct1 = x28, gct2 = x29, gct3 = t2; -diff --git a/src/hotspot/share/opto/mulnode.cpp b/src/hotspot/share/opto/mulnode.cpp -index 72562a657ea..4691c6a45b0 100644 ---- a/src/hotspot/share/opto/mulnode.cpp -+++ b/src/hotspot/share/opto/mulnode.cpp -@@ -258,7 +258,7 @@ Node *MulINode::Ideal(PhaseGVN *phase, bool can_reshape) { - // Check for negative constant; if so negate the final result - bool sign_flip = false; - -- unsigned int abs_con = uabs(con); -+ unsigned int abs_con = g_uabs(con); - if (abs_con != (unsigned int)con) { - sign_flip = true; - } -@@ -493,7 +493,7 @@ Node *MulLNode::Ideal(PhaseGVN *phase, bool can_reshape) { - - // Check for negative constant; if so negate the final result - bool sign_flip = false; -- julong abs_con = uabs(con); -+ julong abs_con = g_uabs(con); - if (abs_con != (julong)con) { - sign_flip = true; - } -diff --git a/src/hotspot/share/opto/subnode.cpp b/src/hotspot/share/opto/subnode.cpp -index d1384384101..aaf53f80b8b 100644 ---- a/src/hotspot/share/opto/subnode.cpp -+++ b/src/hotspot/share/opto/subnode.cpp -@@ -1943,14 +1943,14 @@ const Type* AbsNode::Value(PhaseGVN* phase) const { - case Type::Int: { - const TypeInt* ti = t1->is_int(); - if (ti->is_con()) { -- return TypeInt::make(uabs(ti->get_con())); -+ return TypeInt::make(g_uabs(ti->get_con())); - } - break; - } - case Type::Long: { - const TypeLong* tl = t1->is_long(); - if (tl->is_con()) { -- return TypeLong::make(uabs(tl->get_con())); -+ return TypeLong::make(g_uabs(tl->get_con())); - } - break; - } -diff --git a/src/hotspot/share/utilities/globalDefinitions.hpp b/src/hotspot/share/utilities/globalDefinitions.hpp -index cc5f3ebb291..4ec61babec3 100644 ---- a/src/hotspot/share/utilities/globalDefinitions.hpp -+++ b/src/hotspot/share/utilities/globalDefinitions.hpp -@@ -1118,7 +1118,7 @@ inline bool is_even(intx x) { return !is_odd(x); } - - // abs methods which cannot overflow and so are well-defined across - // the entire domain of integer types. --static inline unsigned int uabs(unsigned int n) { -+static inline unsigned int g_uabs(unsigned int n) { - union { - unsigned int result; - int value; -@@ -1127,7 +1127,7 @@ static inline unsigned int uabs(unsigned int n) { - if (value < 0) result = 0-result; - return result; - } --static inline julong uabs(julong n) { -+static inline julong g_uabs(julong n) { - union { - julong result; - jlong value; -@@ -1136,8 +1136,8 @@ static inline julong uabs(julong n) { - if (value < 0) result = 0-result; - return result; - } --static inline julong uabs(jlong n) { return uabs((julong)n); } --static inline unsigned int uabs(int n) { return uabs((unsigned int)n); } -+static inline julong g_uabs(jlong n) { return g_uabs((julong)n); } -+static inline unsigned int g_uabs(int n) { return g_uabs((unsigned int)n); } - - // "to" should be greater than "from." - inline size_t byte_size(void* from, void* to) { diff --git a/NEWS b/NEWS index 12d32ec..d44c7e0 100644 --- a/NEWS +++ b/NEWS @@ -3,255 +3,33 @@ Key: JDK-X - https://bugs.openjdk.java.net/browse/JDK-X CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY JEP-XYZ: https://openjdk.org/jeps/XYZ -New in release OpenJDK 24.0.2+12 (2025-7-15): -=========================================== -* CVEs - - CVE-2025-30749 - - CVE-2025-30754 - - CVE-2025-50059 - - CVE-2025-50106 -* Changes - - JDK-8217914: java/net/httpclient/ConnectTimeoutHandshakeSync.java failed on connection refused while doing POST - - JDK-8276995: Bug in jdk.jfr.event.gc.collection.TestSystemGC - - JDK-8280991: [XWayland] No displayChanged event after setDisplayMode call - - JDK-8281511: java/net/ipv6tests/UdpTest.java fails with checkTime failed - - JDK-8286204: [Accessibility,macOS,VoiceOver] VoiceOver reads the spinner value 10 as 1 when user iterates to 10 for the first time on macOS - - JDK-8294155: Exception thrown before awaitAndCheck hangs PassFailJFrame - - JDK-8303770: Remove Baltimore root certificate expiring in May 2025 - - JDK-8305010: Test vmTestbase/nsk/jvmti/scenarios/sampling/SP05/sp05t003/TestDescription.java timed out: thread not suspended - - JDK-8314840: 3 gc/epsilon tests ignore external vm options - - JDK-8322983: Virtual Threads: exclude 2 tests - - JDK-8330598: java/net/httpclient/Http1ChunkedTest.java fails with java.util.MissingFormatArgumentException: Format specifier '%s' - - JDK-8330936: [ubsan] exclude function BilinearInterp and ShapeSINextSpan in libawt java2d from ubsan checks - - JDK-8334644: Automate javax/print/attribute/PageRangesException.java - - JDK-8336042: Caller/callee param size mismatch in deoptimization causes crash - - JDK-8338303: Linux ppc64le with toolchain clang - detection failure in early JVM startup - - JDK-8339889: Several compiler tests ignore vm flags and not marked as flagless - - JDK-8340784: Remove PassFailJFrame constructor with screenshots - - JDK-8342524: Use latch in AbstractButton/bug6298940.java instead of delay - - JDK-8342775: [Graal] java/util/concurrent/locks/Lock/OOMEInAQS.java fails OOME thrown from the UncaughtExceptionHandler - - JDK-8343191: Cgroup v1 subsystem fails to set subsystem path - - JDK-8343224: print/Dialog/PaperSizeError.java fails with MediaSizeName is not A4: A4 - - JDK-8343607: C2: Shenandoah crashes during barrier expansion in Continuation::enter - - JDK-8343882: BasicAnnoTests doesn't handle multiple annotations at the same position - - JDK-8343978: Update the default value of CodeEntryAlignment for Ampere-1A and 1B - - JDK-8344316: security/auth/callback/TextCallbackHandler/Password.java make runnable with JTReg and add the UI - - JDK-8344453: Test jdk/jfr/event/oldobject/TestSanityDefault.java timed out - - JDK-8344581: [TESTBUG] java/awt/Robot/ScreenCaptureRobotTest.java failing on macOS - - JDK-8344629: SSLSocketNoServerHelloClientShutdown test timeout - - JDK-8344892: beans/finder/MethodFinder.findMethod incorrectly returns null - - JDK-8344925: translet-name ignored when package-name is also set - - JDK-8345133: Test sun/security/tools/jarsigner/TsacertOptionTest.java failed: Warning found in stdout - - JDK-8345134: Test sun/security/tools/jarsigner/ConciseJarsigner.java failed: unable to find valid certification path to requested target - - JDK-8345185: Update jpackage to not include service bindings by default - - JDK-8345276: Remove EA from the JDK 24 version string with first RC promotion - - JDK-8345368: java/io/File/createTempFile/SpecialTempFile.java fails on Windows Server 2025 - - JDK-8345569: [ubsan] adjustments to filemap.cpp and virtualspace.cpp for macOS aarch64 - - JDK-8345590: AIX 'make all' fails after JDK-8339480 - - JDK-8345625: Better HTTP connections - - JDK-8345676: [ubsan] ProcessImpl_md.c:561:40: runtime error: applying zero offset to null pointer on macOS aarch64 - - JDK-8345728: [Accessibility,macOS,Screen Magnifier]: JCheckbox unchecked state does not magnify but works for checked state - - JDK-8346049: jdk/test/lib/security/timestamp/TsaServer.java warnings - - JDK-8346264: "Total compile time" counter should include time spent in failing/bailout compiles - - JDK-8346285: Update jarsigner compatibility test for change in default digest algorithm - - JDK-8346581: JRadioButton/ButtonGroupFocusTest.java fails in CI on Linux - - JDK-8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs - - JDK-8346671: java/nio/file/Files/probeContentType/Basic.java fails on Windows 2025 - - JDK-8346705: SNI not sent with Java 22+ using java.net.http.HttpClient.Builder#sslParameters - - JDK-8346832: runtime/CompressedOops/CompressedCPUSpecificClassSpaceReservation.java fails on RISC-V - - JDK-8346880: [aix] java/lang/ProcessHandle/InfoTest.java still fails: "reported cputime less than expected" - - JDK-8346881: [ubsan] logSelection.cpp:154:24 / logSelectionList.cpp:72:94 : runtime error: applying non-zero offset 1 to null pointer - - JDK-8346888: [ubsan] block.cpp:1617:30: runtime error: 9.97582e+36 is outside the range of representable values of type 'int' - - JDK-8346972: Test java/nio/channels/FileChannel/LoopingTruncate.java fails sometimes with IOException: There is not enough space on the disk - - JDK-8347000: Bug in com/sun/net/httpserver/bugs/B6361557.java test - - JDK-8347018: C2: Insertion of Assertion Predicates ignores the effects of PhaseIdealLoop::clone_up_backedge_goo() - - JDK-8347038: [JMH] jdk.incubator.vector.SpiltReplicate fails NoClassDefFoundError - - JDK-8347126: gc/stress/TestStressG1Uncommit.java gets OOM-killed - - JDK-8347171: (dc) java/nio/channels/DatagramChannel/InterruptibleOrNot.java fails with virtual thread factory - - JDK-8347173: java/net/DatagramSocket/InterruptibleDatagramSocket.java fails with virtual thread factory - - JDK-8347267: [macOS]: UnixOperatingSystem.c:67:40: runtime error: division by zero - - JDK-8347268: [ubsan] logOutput.cpp:357:21: runtime error: applying non-zero offset 1 to null pointer - - JDK-8347286: (fs) Remove some extensions from java/nio/file/Files/probeContentType/Basic.java - - JDK-8347296: WinInstallerUiTest fails in local test runs if the path to test work directory is longer that regular - - JDK-8347298: Bug in JPackageCommand.ignoreFakeRuntime() - - JDK-8347300: Don't exclude the "PATH" var from the environment when running app launchers in jpackage tests - - JDK-8347302: Mark test tools/jimage/JImageToolTest.java as flagless - - JDK-8347373: HTTP/2 flow control checks may count unprocessed data twice - - JDK-8347377: Add validation checks for ICC_Profile header fields - - JDK-8347427: JTabbedPane/8134116/Bug8134116.java has no license header - - JDK-8347564: ZGC: Crash in DependencyContext::clean_unloading_dependents - - JDK-8347576: Error output in libjsound has non matching format strings - - JDK-8347629: Test FailOverDirectExecutionControlTest.java fails with -Xcomp - - JDK-8347718: Unexpected NullPointerException in C2 compiled code due to ReduceAllocationMerges - - JDK-8347740: java/io/File/createTempFile/SpecialTempFile.java failing - - JDK-8347847: Enhance jar file support - - JDK-8347995: Race condition in jdk/java/net/httpclient/offline/FixedResponseHttpClient.java - - JDK-8347997: assert(false) failed: EA: missing memory path - - JDK-8348102: java/net/httpclient/HttpClientSNITest.java fails intermittently - - JDK-8348110: Update LCMS to 2.17 - - JDK-8348261: assert(n->is_Mem()) failed: memory node required - - JDK-8348299: Update List/ItemEventTest/ItemEventTest.java - - JDK-8348323: Corrupted timezone string in JVM crash log - - JDK-8348356: Update the release version after forking Apr CPU25_04 - - JDK-8348562: ZGC: segmentation fault due to missing node type check in barrier elision analysis - - JDK-8348582: Set -fstack-protector when building with clang - - JDK-8348596: Update FreeType to 2.13.3 - - JDK-8348597: Update HarfBuzz to 10.4.0 - - JDK-8348598: Update Libpng to 1.6.47 - - JDK-8348600: Update PipeWire to 1.3.81 - - JDK-8348675: TrayIcon tests fail in Ubuntu 24.10 Wayland - - JDK-8348936: [Accessibility,macOS,VoiceOver] VoiceOver doesn't announce untick on toggling the checkbox with "space" key on macOS - - JDK-8348989: Better Glyph drawing - - JDK-8349002: GenShen: Deadlock during shutdown - - JDK-8349039: Adjust exception No type named in database - - JDK-8349058: 'internal proprietary API' warnings make javac warnings unusable - - JDK-8349084: Update vectors used in several PQC benchmarks - - JDK-8349111: Enhance Swing supports - - JDK-8349150: Support precompiled headers on AIX - - JDK-8349183: [BACKOUT] Optimization for StringBuilder append boolean & null - - JDK-8349200: [JMH] time.format.ZonedDateTimeFormatterBenchmark fails - - JDK-8349213: G1: Clearing bitmaps during collection set merging not claimed by region - - JDK-8349214: Improve size optimization flags for MSVC builds - - JDK-8349239: [BACKOUT] Reuse StringLatin1::putCharsAt and StringUTF16::putCharsAt - - JDK-8349348: Refactor ClassLoaderDeadlock.sh and Deadlock.sh to run fully in java - - JDK-8349358: [JMH] Cannot access class jdk.internal.vm.ContinuationScope - - JDK-8349370: Bump version numbers for 24.0.2 - - JDK-8349375: Cleanup AIX special file build settings - - JDK-8349378: Build splashscreen lib with SIZE optimization - - JDK-8349492: Update sun/security/pkcs12/KeytoolOpensslInteropTest.java to use a recent Openssl version - - JDK-8349501: Relocate supporting classes in security/testlibrary to test/lib/jdk tree - - JDK-8349551: Failures in tests after JDK-8345625 - - JDK-8349584: Improve compiler processing - - JDK-8349594: Enhance TLS protocol support - - JDK-8349623: [ASAN] Gtest os_linux.glibc_mallinfo_wrapper_vm fails - - JDK-8349637: Integer.numberOfLeadingZeros outputs incorrectly in certain cases - - JDK-8349751: AIX build failure after upgrade pipewire to 1.3.81 - - JDK-8349753: Incorrect use of CodeBlob::is_buffer_blob() in few places - - JDK-8349787: java/lang/Thread/virtual/ThreadPollOnYield.java#default passes unexpectedly without libVThreadPinner.so - - JDK-8349943: [JMH] Use jvmArgs consistently - - JDK-8350103: Test containers/systemd/SystemdMemoryAwarenessTest.java fails on Linux ppc64le SLES15 SP6 - - JDK-8350137: After JDK-8348975, Linux builds contain man pages for windows only tools - - JDK-8350201: Out of bounds access on Linux aarch64 in os::print_register_info - - JDK-8350211: CTW: Attempt to preload all classes in constant pool - - JDK-8350260: Improve HTML instruction formatting in PassFailJFrame - - JDK-8350313: Include timings for leaving safepoint in safepoint logging - - JDK-8350386: Test TestCodeCacheFull.java fails with option -XX:-UseCodeCacheFlushing - - JDK-8350483: AArch64: turn on signum intrinsics by default on Ampere CPUs - - JDK-8350498: Remove two Camerfirma root CA certificates - - JDK-8350499: Minimal build fails with slowdebug builds - - JDK-8350546: Several java/net/InetAddress tests fails UnknownHostException - - JDK-8350682: [JMH] vector.IndexInRangeBenchmark failed with IndexOutOfBoundsException for size=1024 - - JDK-8350683: Non-C2 / minimal JVM crashes in the build on ppc64 platforms - - JDK-8350786: Some java/lang jtreg tests miss requires vm.hasJFR - - JDK-8350820: OperatingSystemMXBean CpuLoad() methods return -1.0 on Windows - - JDK-8350924: javax/swing/JMenu/4213634/bug4213634.java fails - - JDK-8350991: Improve HTTP client header handling - - JDK-8351033: RISC-V: TestFloat16ScalarOperations asserts with offset (4210) is too large to be patched in one beq/bge/bgeu/blt/bltu/bne instruction! - - JDK-8351223: Update localized resources in keytool and jarsigner - - JDK-8351233: [ASAN] avx2-emu-funcs.hpp:151:20: error: ‘D.82188’ is used uninitialized - - JDK-8351277: Remove pipewire from AIX build - - JDK-8351382: New test containers/docker/TestMemoryWithSubgroups.java is failing - - JDK-8351500: G1: NUMA migrations cause crashes in region allocation - - JDK-8351639: Improve debuggability of test/langtools/jdk/jshell/JdiHangingListenExecutionControlTest.java test - - JDK-8351665: Remove unused UseNUMA in os_aix.cpp - - JDK-8351933: Inaccurate masking of TC subfield decrement in ForkJoinPool - - JDK-8352109: java/awt/Desktop/MailTest.java fails in platforms where Action.MAIL is not supported - - JDK-8352302: Test sun/security/tools/jarsigner/TimestampCheck.java is failing - - JDK-8352508: [Redo] G1: Pinned regions with pinned objects only reachable by native code crash VM - - JDK-8352512: TestVectorZeroCount: counter not reset between iterations - - JDK-8352706: httpclient HeadTest does not run on HTTP2 - - JDK-8352716: (tz) Update Timezone Data to 2025b - - JDK-8352946: SEGV_BND signal code of SIGSEGV missing from our signal-code table - - JDK-8353053: (fs) Add support for UserDefinedFileAttributeView on AIX - - JDK-8353066: Properly detect Windows/aarch64 as build platform - - JDK-8353185: Introduce the concept of upgradeable files in context of JEP 493 - - JDK-8353261: Problemlist 5 tests due to failures in the CI pipeline - - JDK-8353274: [PPC64] Bug related to -XX:+UseCompactObjectHeaders -XX:-UseSIGTRAP in JDK-8305895 - - JDK-8353329: Small memory leak when create GrowableArray with initial size 0 - - JDK-8353709: Debug symbols bundle should contain full debug files when building --with-external-symbols-in-bundles=public - - JDK-8353740: Problemlist 2 tests due to failures in the CI pipeline - - JDK-8353787: Increased number of SHA-384-Digest java.util.jar.Attributes$Name instances leading to higher memory footprint - - JDK-8353861: Problemlist 1 test due to failures in the CI pipeline - - JDK-8353946: Incorrect WINDOWS ifdef in os::build_agent_function_name - - JDK-8354657: Problemlist 2 tests due to failures in the CI pipeline - - JDK-8354831: Problemlist 2 tests due to failures in the CI pipeline - - JDK-8354861: Change milestone to fcs for all releases - - JDK-8354904: [Backout] JDK-8345625: Better HTTP connections - - JDK-8355524: Only every second line in upgradeable files is being used - - JDK-8355884: [macos] java/awt/Frame/I18NTitle.java fails on MacOS - - JDK-8356096: ISO 4217 Amendment 179 Update - - JDK-8359170: Add 2 TLS and 2 CS Sectigo roots - - JDK-8360147: Better Glyph drawing redux -New in release OpenJDK 24.0.1+9 (2025-4-16): +New in release OpenJDK 25.0.0+32 (2025-06-9): =========================================== - - JDK-8211851: (ch) java/nio/channels/AsynchronousSocketChannel/StressLoopback.java times out (aix) - - JDK-8290043: serviceability/attach/ConcAttachTest.java failed "guarantee(!CheckJNICalls) failed: Attached JNI thread exited without being detached" - - JDK-8337494: Clarify JarInputStream behavior - - JDK-8337692: Better TLS connection support - - JDK-8338430: Improve compiler transformations - - JDK-8339356: Test javax/net/ssl/SSLSocket/Tls13PacketSize.java failed with java.net.SocketException: An established connection was aborted by the software in your host machine - - JDK-8342562: Enhance Deflater operations - - JDK-8343007: Enhance Buffered Image handling - - JDK-8344361: Restore null return for invalid services from legacy providers - - JDK-8345276: Remove EA from the JDK 24 version string with first RC promotion - - JDK-8345614: Improve AnnotationFormatError message for duplicate annotation interfaces - - JDK-8345684: OperatingSystemMXBean.getSystemCpuLoad() throws NPE - - JDK-8345959: Make JVM_IsStaticallyLinked JVM_LEAF - - JDK-8346014: Bump version numbers for 24.0.1 - - JDK-8346082: Output JVMTI agent information in hserr files - - JDK-8346239: Improve memory efficiency of JimageDiffGenerator - - JDK-8346324: javax/swing/JScrollBar/4865918/bug4865918.java fails in CI - - JDK-8346587: Distrust TLS server certificates anchored by Camerfirma Root CAs - - JDK-8346688: GenShen: Missing metadata trigger log message - - JDK-8346690: Shenandoah: Fix log message for end of GC usage report - - JDK-8346712: Remove com/sun/net/httpserver/TcpNoDelayNotRequired.java test - - JDK-8346713: [testsuite] NeverActAsServerClassMachine breaks TestPLABAdaptToMinTLABSize.java TestPinnedHumongousFragmentation.java TestPinnedObjectContents.java - - JDK-8346868: RISC-V: compiler/sharedstubs tests fail after JDK-8332689 - - JDK-8346887: DrawFocusRect() may cause an assertion failure - - JDK-8347124: Clean tests with --enable-linkable-runtime - - JDK-8347129: cpuset cgroups controller is required for no good reason - - JDK-8347256: Epsilon: Demote heap size and AlwaysPreTouch warnings to info level - - JDK-8347299: Add annotations to test cases in LicenseTest - - JDK-8347334: JimageDiffGenerator code clean-ups - - JDK-8347424: Fix and rewrite sun/security/x509/DNSName/LeadingPeriod.java test - - JDK-8347496: Test jdk/jfr/jvm/TestModularImage.java fails after JDK-8347124: No javac - - JDK-8347506: Compatible OCSP readtimeout property with OCSP timeout - - JDK-8347564: ZGC: Crash in DependencyContext::clean_unloading_dependents - - JDK-8347847: Enhance jar file support - - JDK-8347911: Limit the length of inflated text chunks - - JDK-8347965: (tz) Update Timezone Data to 2025a - - JDK-8348562: ZGC: segmentation fault due to missing node type check in barrier elision analysis - - JDK-8349058: 'internal proprietary API' warnings make javac warnings unusable - - JDK-8349084: Update vectors used in several PQC benchmarks - - JDK-8349183: [BACKOUT] Optimization for StringBuilder append boolean & null - - JDK-8349239: [BACKOUT] Reuse StringLatin1::putCharsAt and StringUTF16::putCharsAt - - JDK-8349828: Redo - Change milestone to fcs for newly created jdk24.0.1 branch - - JDK-8350820: OperatingSystemMXBean CpuLoad() methods return -1.0 on Windows +JDK 25 is in Rampdown Phase One. The overall feature set is frozen. No further JEPs will be targeted to this release. +The stabilization branch, jdk25, is open for select bug fixes and, with approval, late enhancements per the JDK Release Process (JEP 3). Integrate most stabilization changes via backports from the main line. -New in release OpenJDK 24.0.0+34 (2025-03-18): -=========================================== - - 404: Generational Shenandoah (Experimental) - - 450: Compact Object Headers (Experimental) - - 472: Prepare to Restrict the Use of JNI - - 475: Late Barrier Expansion for G1 - - 478: Key Derivation Function API (Preview) - - 479: Remove the Windows 32-bit x86 Port - - 483: Ahead-of-Time Class Loading & Linking - - 484: Class-File API - - 485: Stream Gatherers - - 486: Permanently Disable the Security Manager - - 487: Scoped Values (Fourth Preview) - - 488: Primitive Types in Patterns, instanceof, and switch (Second Preview) - - 489: Vector API (Ninth Incubator) - - 490: ZGC: Remove the Non-Generational Mode - - 491: Synchronize Virtual Threads without Pinning - - 492: Flexible Constructor Bodies (Third Preview) - - 493: Linking Run-Time Images without JMODs - - 494: Module Import Declarations (Second Preview) - - 495: Simple Source Files and Instance Main Methods (Fourth Preview) - - 496: Quantum-Resistant Module-Lattice-Based Key Encapsulation Mechanism - - 497: Quantum-Resistant Module-Lattice-Based Digital Signature Algorithm - - 498: Warn upon Use of Memory-Access Methods in sun.misc.Unsafe - - 499: Structured Concurrency (Fourth Preview) - - 501: Deprecate the 32-bit x86 Port for Removal + - JEP-470: PEM Encodings of Cryptographic Objects (Preview) + - JEP-502: Stable Values (Preview) + - JEP-503: Remove the 32-bit x86 Port + - JEP-505: Structured Concurrency (Fifth Preview) + - JEP-506: Scoped Values + - JEP-507: Primitive Types in Patterns, instanceof, and switch (Third Preview) + - JEP-508: Vector API (Tenth Incubator) + - JEP-509: JFR CPU-Time Profiling (Experimental) + - JEP-510: Key Derivation Function API + - JEP-511: Module Import Declarations + - JEP-512: Compact Source Files and Instance Main Methods + - JEP-513: Flexible Constructor Bodies + - JEP-514: Ahead-of-Time Command-Line Ergonomics + - JEP-515: Ahead-of-Time Method Profiling + - JEP-518: JFR Cooperative Sampling + - JEP-519: Compact Object Headers + - JEP-520: JFR Method Timing & Tracing + - JEP-521: Generational Shenandoah + ++ https://openjdk.org/projects/jdk/25/ ++ https://openjdk.org/projects/jdk/24/ ++ https://openjdk.org/projects/jdk/23/ ++ https://openjdk.org/projects/jdk/22/ +In case yo uare moving directly from jdk21 diff --git a/README.md b/README.md index 34d9d78..9a97482 100644 --- a/README.md +++ b/README.md @@ -4,11 +4,11 @@ This package contains the latest rolling release of OpenJDK. OpenJDK has a release cadence of six months, with a new release in March and September each year. -The current release is OpenJDK 23. For a list of major changes from +The current release is OpenJDK 25. For a list of major changes from OpenJDK 21, see the NEWS file included in this package and the upstream release page: -https://openjdk.org/projects/jdk/23/ +https://openjdk.org/projects/jdk/25/ This package is intended for those who want to follow the latest OpenJDK releases. Long term support versions of OpenJDK are available diff --git a/fips-21u-9203d50836c.patch b/fips-21u-9203d50836c.patch deleted file mode 100644 index 9966391..0000000 --- a/fips-21u-9203d50836c.patch +++ /dev/null @@ -1,4234 +0,0 @@ -diff --git a/make/autoconf/build-aux/pkg.m4 b/make/autoconf/build-aux/pkg.m4 -index 5f4b22bb27f..1ca9f5b8ffe 100644 ---- a/make/autoconf/build-aux/pkg.m4 -+++ b/make/autoconf/build-aux/pkg.m4 -@@ -179,3 +179,19 @@ else - ifelse([$3], , :, [$3]) - fi[]dnl - ])# PKG_CHECK_MODULES -+ -+dnl PKG_CHECK_VAR(VARIABLE, MODULE, CONFIG-VARIABLE, -+dnl [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND]) -+dnl ------------------------------------------- -+dnl Since: 0.28 -+dnl -+dnl Retrieves the value of the pkg-config variable for the given module. -+AC_DEFUN([PKG_CHECK_VAR], -+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl -+AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])dnl -+ -+_PKG_CONFIG([$1], [variable="][$3]["], [$2]) -+AS_VAR_COPY([$1], [pkg_cv_][$1]) -+ -+AS_VAR_IF([$1], [""], [$5], [$4])dnl -+])dnl PKG_CHECK_VAR -diff --git a/make/autoconf/lib-sysconf.m4 b/make/autoconf/lib-sysconf.m4 -new file mode 100644 -index 00000000000..f48fc7f7e80 ---- /dev/null -+++ b/make/autoconf/lib-sysconf.m4 -@@ -0,0 +1,87 @@ -+# -+# Copyright (c) 2021, Red Hat, Inc. -+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. -+# -+# This code is free software; you can redistribute it and/or modify it -+# under the terms of the GNU General Public License version 2 only, as -+# published by the Free Software Foundation. Oracle designates this -+# particular file as subject to the "Classpath" exception as provided -+# by Oracle in the LICENSE file that accompanied this code. -+# -+# This code is distributed in the hope that it will be useful, but WITHOUT -+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -+# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -+# version 2 for more details (a copy is included in the LICENSE file that -+# accompanied this code). -+# -+# You should have received a copy of the GNU General Public License version -+# 2 along with this work; if not, write to the Free Software Foundation, -+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. -+# -+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA -+# or visit www.oracle.com if you need additional information or have any -+# questions. -+# -+ -+################################################################################ -+# Setup system configuration libraries -+################################################################################ -+AC_DEFUN_ONCE([LIB_SETUP_SYSCONF_LIBS], -+[ -+ ############################################################################### -+ # -+ # Check for the NSS library -+ # -+ AC_MSG_CHECKING([for NSS library directory]) -+ PKG_CHECK_VAR(NSS_LIBDIR, nss, libdir, [AC_MSG_RESULT([$NSS_LIBDIR])], [AC_MSG_RESULT([not found])]) -+ -+ AC_MSG_CHECKING([whether to link the system NSS library with the System Configurator (libsysconf)]) -+ -+ # default is not available -+ DEFAULT_SYSCONF_NSS=no -+ -+ AC_ARG_ENABLE([sysconf-nss], [AS_HELP_STRING([--enable-sysconf-nss], -+ [build the System Configurator (libsysconf) using the system NSS library if available @<:@disabled@:>@])], -+ [ -+ case "${enableval}" in -+ yes) -+ sysconf_nss=yes -+ ;; -+ *) -+ sysconf_nss=no -+ ;; -+ esac -+ ], -+ [ -+ sysconf_nss=${DEFAULT_SYSCONF_NSS} -+ ]) -+ AC_MSG_RESULT([$sysconf_nss]) -+ -+ USE_SYSCONF_NSS=false -+ if test "x${sysconf_nss}" = "xyes"; then -+ PKG_CHECK_MODULES(NSS, nss >= 3.53, [NSS_FOUND=yes], [NSS_FOUND=no]) -+ if test "x${NSS_FOUND}" = "xyes"; then -+ AC_MSG_CHECKING([for system FIPS support in NSS]) -+ saved_libs="${LIBS}" -+ saved_cflags="${CFLAGS}" -+ CFLAGS="${CFLAGS} ${NSS_CFLAGS}" -+ LIBS="${LIBS} ${NSS_LIBS}" -+ AC_LANG_PUSH([C]) -+ AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include ]], -+ [[SECMOD_GetSystemFIPSEnabled()]])], -+ [AC_MSG_RESULT([yes])], -+ [AC_MSG_RESULT([no]) -+ AC_MSG_ERROR([System NSS FIPS detection unavailable])]) -+ AC_LANG_POP([C]) -+ CFLAGS="${saved_cflags}" -+ LIBS="${saved_libs}" -+ USE_SYSCONF_NSS=true -+ else -+ dnl NSS 3.53 is the one that introduces the SECMOD_GetSystemFIPSEnabled API -+ dnl in nss3/pk11pub.h. -+ AC_MSG_ERROR([--enable-sysconf-nss specified, but NSS 3.53 or above not found.]) -+ fi -+ fi -+ AC_SUBST(USE_SYSCONF_NSS) -+ AC_SUBST(NSS_LIBDIR) -+]) -diff --git a/make/autoconf/libraries.m4 b/make/autoconf/libraries.m4 -index 51d4f724c33..feb0bcf3e75 100644 ---- a/make/autoconf/libraries.m4 -+++ b/make/autoconf/libraries.m4 -@@ -35,6 +35,7 @@ m4_include([lib-std.m4]) - m4_include([lib-x11.m4]) - - m4_include([lib-tests.m4]) -+m4_include([lib-sysconf.m4]) - - ################################################################################ - # Determine which libraries are needed for this configuration -@@ -128,6 +129,7 @@ AC_DEFUN_ONCE([LIB_SETUP_LIBRARIES], - LIB_SETUP_X11 - - LIB_TESTS_SETUP_GTEST -+ LIB_SETUP_SYSCONF_LIBS - - BASIC_JDKLIB_LIBS="" - BASIC_JDKLIB_LIBS_TARGET="" -diff --git a/make/autoconf/spec.gmk.in b/make/autoconf/spec.gmk.in -index f6def153c82..4d7abc33427 100644 ---- a/make/autoconf/spec.gmk.in -+++ b/make/autoconf/spec.gmk.in -@@ -873,6 +873,11 @@ INSTALL_SYSCONFDIR=@sysconfdir@ - # Libraries - # - -+USE_SYSCONF_NSS:=@USE_SYSCONF_NSS@ -+NSS_LIBS:=@NSS_LIBS@ -+NSS_CFLAGS:=@NSS_CFLAGS@ -+NSS_LIBDIR:=@NSS_LIBDIR@ -+ - USE_EXTERNAL_LCMS:=@USE_EXTERNAL_LCMS@ - LCMS_CFLAGS:=@LCMS_CFLAGS@ - LCMS_LIBS:=@LCMS_LIBS@ -diff --git a/make/modules/java.base/Gendata.gmk b/make/modules/java.base/Gendata.gmk -index 9e5cfe2d0fc..434ade8e182 100644 ---- a/make/modules/java.base/Gendata.gmk -+++ b/make/modules/java.base/Gendata.gmk -@@ -98,3 +98,17 @@ $(GENDATA_JAVA_SECURITY): $(BUILD_TOOLS_JDK) $(GENDATA_JAVA_SECURITY_SRC) $(REST - TARGETS += $(GENDATA_JAVA_SECURITY) - - ################################################################################ -+ -+GENDATA_NSS_FIPS_CFG_SRC := $(TOPDIR)/src/java.base/share/conf/security/nss.fips.cfg.in -+GENDATA_NSS_FIPS_CFG := $(SUPPORT_OUTPUTDIR)/modules_conf/java.base/security/nss.fips.cfg -+ -+$(GENDATA_NSS_FIPS_CFG): $(GENDATA_NSS_FIPS_CFG_SRC) -+ $(call LogInfo, Generating nss.fips.cfg) -+ $(call MakeTargetDir) -+ $(call ExecuteWithLog, $(SUPPORT_OUTPUTDIR)/gensrc/java.base/_$(@F), \ -+ ( $(SED) -e 's:@NSS_LIBDIR@:$(NSS_LIBDIR):g' $< ) > $@ \ -+ ) -+ -+TARGETS += $(GENDATA_NSS_FIPS_CFG) -+ -+################################################################################ -diff --git a/make/modules/java.base/Lib.gmk b/make/modules/java.base/Lib.gmk -index 1e0f66726d0..59fe923f2c5 100644 ---- a/make/modules/java.base/Lib.gmk -+++ b/make/modules/java.base/Lib.gmk -@@ -163,6 +163,29 @@ ifeq ($(call isTargetOsType, unix), true) - endif - endif - -+################################################################################ -+# Create the systemconf library -+ -+LIBSYSTEMCONF_CFLAGS := -+LIBSYSTEMCONF_CXXFLAGS := -+ -+ifeq ($(USE_SYSCONF_NSS), true) -+ LIBSYSTEMCONF_CFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS -+ LIBSYSTEMCONF_CXXFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS -+endif -+ -+$(eval $(call SetupJdkLibrary, BUILD_LIBSYSTEMCONF, \ -+ NAME := systemconf, \ -+ OPTIMIZATION := LOW, \ -+ CFLAGS := $(CFLAGS_JDKLIB) $(LIBSYSTEMCONF_CFLAGS), \ -+ CXXFLAGS := $(CXXFLAGS_JDKLIB) $(LIBSYSTEMCONF_CXXFLAGS), \ -+ LDFLAGS := $(LDFLAGS_JDKLIB) \ -+ $(call SET_SHARED_LIBRARY_ORIGIN), \ -+ LIBS_unix := $(LIBDL) $(NSS_LIBS), \ -+)) -+ -+TARGETS += $(BUILD_LIBSYSTEMCONF) -+ - ################################################################################ - # Create the symbols file for static builds. - -diff --git a/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java b/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java -index 10093137151..b023c63ae58 100644 ---- a/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java -+++ b/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java -@@ -31,6 +31,7 @@ import java.security.SecureRandom; - import java.security.PrivilegedAction; - import java.util.HashMap; - import java.util.List; -+import jdk.internal.access.SharedSecrets; - import static sun.security.util.SecurityConstants.PROVIDER_VER; - import static sun.security.util.SecurityProviderConstants.*; - -@@ -82,6 +83,10 @@ import static sun.security.util.SecurityProviderConstants.*; - - public final class SunJCE extends Provider { - -+ private static final boolean systemFipsEnabled = -+ SharedSecrets.getJavaSecuritySystemConfiguratorAccess() -+ .isSystemFipsEnabled(); -+ - @java.io.Serial - private static final long serialVersionUID = 6812507587804302833L; - -@@ -147,298 +152,299 @@ public final class SunJCE extends Provider { - void putEntries() { - // reuse attribute map and reset before each reuse - HashMap attrs = new HashMap<>(3); -- attrs.put("SupportedModes", "ECB"); -- attrs.put("SupportedPaddings", "NOPADDING|PKCS1PADDING|OAEPPADDING" -- + "|OAEPWITHMD5ANDMGF1PADDING" -- + "|OAEPWITHSHA1ANDMGF1PADDING" -- + "|OAEPWITHSHA-1ANDMGF1PADDING" -- + "|OAEPWITHSHA-224ANDMGF1PADDING" -- + "|OAEPWITHSHA-256ANDMGF1PADDING" -- + "|OAEPWITHSHA-384ANDMGF1PADDING" -- + "|OAEPWITHSHA-512ANDMGF1PADDING" -- + "|OAEPWITHSHA-512/224ANDMGF1PADDING" -- + "|OAEPWITHSHA-512/256ANDMGF1PADDING"); -- attrs.put("SupportedKeyClasses", -- "java.security.interfaces.RSAPublicKey" + -- "|java.security.interfaces.RSAPrivateKey"); -- ps("Cipher", "RSA", -- "com.sun.crypto.provider.RSACipher", null, attrs); -- -- // common block cipher modes, pads -- final String BLOCK_MODES = "ECB|CBC|PCBC|CTR|CTS|CFB|OFB" + -- "|CFB8|CFB16|CFB24|CFB32|CFB40|CFB48|CFB56|CFB64" + -- "|OFB8|OFB16|OFB24|OFB32|OFB40|OFB48|OFB56|OFB64"; -- final String BLOCK_MODES128 = BLOCK_MODES + -- "|CFB72|CFB80|CFB88|CFB96|CFB104|CFB112|CFB120|CFB128" + -- "|OFB72|OFB80|OFB88|OFB96|OFB104|OFB112|OFB120|OFB128"; -- final String BLOCK_PADS = "NOPADDING|PKCS5PADDING|ISO10126PADDING"; -- -- attrs.clear(); -- attrs.put("SupportedModes", BLOCK_MODES); -- attrs.put("SupportedPaddings", BLOCK_PADS); -- attrs.put("SupportedKeyFormats", "RAW"); -- ps("Cipher", "DES", -- "com.sun.crypto.provider.DESCipher", null, attrs); -- psA("Cipher", "DESede", "com.sun.crypto.provider.DESedeCipher", -- attrs); -- ps("Cipher", "Blowfish", -- "com.sun.crypto.provider.BlowfishCipher", null, attrs); -- -- ps("Cipher", "RC2", -- "com.sun.crypto.provider.RC2Cipher", null, attrs); -- -- attrs.clear(); -- attrs.put("SupportedModes", BLOCK_MODES128); -- attrs.put("SupportedPaddings", BLOCK_PADS); -- attrs.put("SupportedKeyFormats", "RAW"); -- psA("Cipher", "AES", -- "com.sun.crypto.provider.AESCipher$General", attrs); -- -- attrs.clear(); -- attrs.put("SupportedKeyFormats", "RAW"); -- psA("Cipher", "AES/KW/NoPadding", -- "com.sun.crypto.provider.KeyWrapCipher$AES_KW_NoPadding", -- attrs); -- ps("Cipher", "AES/KW/PKCS5Padding", -- "com.sun.crypto.provider.KeyWrapCipher$AES_KW_PKCS5Padding", -- null, attrs); -- psA("Cipher", "AES/KWP/NoPadding", -- "com.sun.crypto.provider.KeyWrapCipher$AES_KWP_NoPadding", -- attrs); -- -- psA("Cipher", "AES_128/ECB/NoPadding", -- "com.sun.crypto.provider.AESCipher$AES128_ECB_NoPadding", -- attrs); -- psA("Cipher", "AES_128/CBC/NoPadding", -- "com.sun.crypto.provider.AESCipher$AES128_CBC_NoPadding", -- attrs); -- psA("Cipher", "AES_128/OFB/NoPadding", -- "com.sun.crypto.provider.AESCipher$AES128_OFB_NoPadding", -- attrs); -- psA("Cipher", "AES_128/CFB/NoPadding", -- "com.sun.crypto.provider.AESCipher$AES128_CFB_NoPadding", -- attrs); -- psA("Cipher", "AES_128/KW/NoPadding", -- "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_NoPadding", -- attrs); -- ps("Cipher", "AES_128/KW/PKCS5Padding", -- "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_PKCS5Padding", -- null, attrs); -- psA("Cipher", "AES_128/KWP/NoPadding", -- "com.sun.crypto.provider.KeyWrapCipher$AES128_KWP_NoPadding", -- attrs); -- -- psA("Cipher", "AES_192/ECB/NoPadding", -- "com.sun.crypto.provider.AESCipher$AES192_ECB_NoPadding", -- attrs); -- psA("Cipher", "AES_192/CBC/NoPadding", -- "com.sun.crypto.provider.AESCipher$AES192_CBC_NoPadding", -- attrs); -- psA("Cipher", "AES_192/OFB/NoPadding", -- "com.sun.crypto.provider.AESCipher$AES192_OFB_NoPadding", -- attrs); -- psA("Cipher", "AES_192/CFB/NoPadding", -- "com.sun.crypto.provider.AESCipher$AES192_CFB_NoPadding", -- attrs); -- psA("Cipher", "AES_192/KW/NoPadding", -- "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_NoPadding", -- attrs); -- ps("Cipher", "AES_192/KW/PKCS5Padding", -- "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_PKCS5Padding", -- null, attrs); -- psA("Cipher", "AES_192/KWP/NoPadding", -- "com.sun.crypto.provider.KeyWrapCipher$AES192_KWP_NoPadding", -- attrs); -- -- psA("Cipher", "AES_256/ECB/NoPadding", -- "com.sun.crypto.provider.AESCipher$AES256_ECB_NoPadding", -- attrs); -- psA("Cipher", "AES_256/CBC/NoPadding", -- "com.sun.crypto.provider.AESCipher$AES256_CBC_NoPadding", -- attrs); -- psA("Cipher", "AES_256/OFB/NoPadding", -- "com.sun.crypto.provider.AESCipher$AES256_OFB_NoPadding", -- attrs); -- psA("Cipher", "AES_256/CFB/NoPadding", -- "com.sun.crypto.provider.AESCipher$AES256_CFB_NoPadding", -- attrs); -- psA("Cipher", "AES_256/KW/NoPadding", -- "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_NoPadding", -- attrs); -- ps("Cipher", "AES_256/KW/PKCS5Padding", -- "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_PKCS5Padding", -- null, attrs); -- psA("Cipher", "AES_256/KWP/NoPadding", -- "com.sun.crypto.provider.KeyWrapCipher$AES256_KWP_NoPadding", -- attrs); -- -- attrs.clear(); -- attrs.put("SupportedModes", "GCM"); -- attrs.put("SupportedKeyFormats", "RAW"); -- -- ps("Cipher", "AES/GCM/NoPadding", -- "com.sun.crypto.provider.GaloisCounterMode$AESGCM", null, -- attrs); -- psA("Cipher", "AES_128/GCM/NoPadding", -- "com.sun.crypto.provider.GaloisCounterMode$AES128", -- attrs); -- psA("Cipher", "AES_192/GCM/NoPadding", -- "com.sun.crypto.provider.GaloisCounterMode$AES192", -- attrs); -- psA("Cipher", "AES_256/GCM/NoPadding", -- "com.sun.crypto.provider.GaloisCounterMode$AES256", -- attrs); -- -- attrs.clear(); -- attrs.put("SupportedModes", "CBC"); -- attrs.put("SupportedPaddings", "NOPADDING"); -- attrs.put("SupportedKeyFormats", "RAW"); -- ps("Cipher", "DESedeWrap", -- "com.sun.crypto.provider.DESedeWrapCipher", null, attrs); -- -- attrs.clear(); -- attrs.put("SupportedModes", "ECB"); -- attrs.put("SupportedPaddings", "NOPADDING"); -- attrs.put("SupportedKeyFormats", "RAW"); -- psA("Cipher", "ARCFOUR", -- "com.sun.crypto.provider.ARCFOURCipher", attrs); -- -- attrs.clear(); -- attrs.put("SupportedKeyFormats", "RAW"); -- ps("Cipher", "ChaCha20", -- "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Only", -- null, attrs); -- psA("Cipher", "ChaCha20-Poly1305", -- "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Poly1305", -- attrs); -- -- // PBES1 -- psA("Cipher", "PBEWithMD5AndDES", -- "com.sun.crypto.provider.PBEWithMD5AndDESCipher", -- null); -- ps("Cipher", "PBEWithMD5AndTripleDES", -- "com.sun.crypto.provider.PBEWithMD5AndTripleDESCipher"); -- psA("Cipher", "PBEWithSHA1AndDESede", -- "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndDESede", -- null); -- psA("Cipher", "PBEWithSHA1AndRC2_40", -- "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_40", -- null); -- psA("Cipher", "PBEWithSHA1AndRC2_128", -- "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_128", -- null); -- psA("Cipher", "PBEWithSHA1AndRC4_40", -- "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_40", -- null); -- -- psA("Cipher", "PBEWithSHA1AndRC4_128", -- "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_128", -- null); -- -- // PBES2 -- ps("Cipher", "PBEWithHmacSHA1AndAES_128", -- "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_128"); -- -- ps("Cipher", "PBEWithHmacSHA224AndAES_128", -- "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_128"); -- -- ps("Cipher", "PBEWithHmacSHA256AndAES_128", -- "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_128"); -- -- ps("Cipher", "PBEWithHmacSHA384AndAES_128", -- "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_128"); -- -- ps("Cipher", "PBEWithHmacSHA512AndAES_128", -- "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_128"); -- -- ps("Cipher", "PBEWithHmacSHA512/224AndAES_128", -- "com.sun.crypto.provider.PBES2Core$HmacSHA512_224AndAES_128"); -- -- ps("Cipher", "PBEWithHmacSHA512/256AndAES_128", -- "com.sun.crypto.provider.PBES2Core$HmacSHA512_256AndAES_128"); -- -- -- ps("Cipher", "PBEWithHmacSHA1AndAES_256", -- "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_256"); -- -- ps("Cipher", "PBEWithHmacSHA224AndAES_256", -- "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_256"); -- -- ps("Cipher", "PBEWithHmacSHA256AndAES_256", -- "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_256"); -- -- ps("Cipher", "PBEWithHmacSHA384AndAES_256", -- "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_256"); -- -- ps("Cipher", "PBEWithHmacSHA512AndAES_256", -- "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_256"); -- -- ps("Cipher", "PBEWithHmacSHA512/224AndAES_256", -- "com.sun.crypto.provider.PBES2Core$HmacSHA512_224AndAES_256"); -- -- ps("Cipher", "PBEWithHmacSHA512/256AndAES_256", -- "com.sun.crypto.provider.PBES2Core$HmacSHA512_256AndAES_256"); -- -- /* -- * Key(pair) Generator engines -- */ -- ps("KeyGenerator", "DES", -- "com.sun.crypto.provider.DESKeyGenerator"); -- psA("KeyGenerator", "DESede", -- "com.sun.crypto.provider.DESedeKeyGenerator", -- null); -- ps("KeyGenerator", "Blowfish", -- "com.sun.crypto.provider.BlowfishKeyGenerator"); -- psA("KeyGenerator", "AES", -- "com.sun.crypto.provider.AESKeyGenerator", -- null); -- ps("KeyGenerator", "RC2", -- "com.sun.crypto.provider.KeyGeneratorCore$RC2KeyGenerator"); -- psA("KeyGenerator", "ARCFOUR", -- "com.sun.crypto.provider.KeyGeneratorCore$ARCFOURKeyGenerator", -- null); -- ps("KeyGenerator", "ChaCha20", -- "com.sun.crypto.provider.KeyGeneratorCore$ChaCha20KeyGenerator"); -- ps("KeyGenerator", "HmacMD5", -- "com.sun.crypto.provider.HmacMD5KeyGenerator"); -- -- psA("KeyGenerator", "HmacSHA1", -- "com.sun.crypto.provider.HmacSHA1KeyGenerator", null); -- psA("KeyGenerator", "HmacSHA224", -- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA224", -- null); -- psA("KeyGenerator", "HmacSHA256", -- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA256", -- null); -- psA("KeyGenerator", "HmacSHA384", -- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA384", -- null); -- psA("KeyGenerator", "HmacSHA512", -- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512", -- null); -- psA("KeyGenerator", "HmacSHA512/224", -- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_224", -- null); -- psA("KeyGenerator", "HmacSHA512/256", -- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_256", -- null); -- -- psA("KeyGenerator", "HmacSHA3-224", -- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_224", -- null); -- psA("KeyGenerator", "HmacSHA3-256", -- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_256", -- null); -- psA("KeyGenerator", "HmacSHA3-384", -- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_384", -- null); -- psA("KeyGenerator", "HmacSHA3-512", -- "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_512", -- null); -- -- psA("KeyPairGenerator", "DiffieHellman", -- "com.sun.crypto.provider.DHKeyPairGenerator", -- null); -+ if (!systemFipsEnabled) { -+ attrs.put("SupportedModes", "ECB"); -+ attrs.put("SupportedPaddings", "NOPADDING|PKCS1PADDING|OAEPPADDING" -+ + "|OAEPWITHMD5ANDMGF1PADDING" -+ + "|OAEPWITHSHA1ANDMGF1PADDING" -+ + "|OAEPWITHSHA-1ANDMGF1PADDING" -+ + "|OAEPWITHSHA-224ANDMGF1PADDING" -+ + "|OAEPWITHSHA-256ANDMGF1PADDING" -+ + "|OAEPWITHSHA-384ANDMGF1PADDING" -+ + "|OAEPWITHSHA-512ANDMGF1PADDING" -+ + "|OAEPWITHSHA-512/224ANDMGF1PADDING" -+ + "|OAEPWITHSHA-512/256ANDMGF1PADDING"); -+ attrs.put("SupportedKeyClasses", -+ "java.security.interfaces.RSAPublicKey" + -+ "|java.security.interfaces.RSAPrivateKey"); -+ ps("Cipher", "RSA", -+ "com.sun.crypto.provider.RSACipher", null, attrs); -+ -+ // common block cipher modes, pads -+ final String BLOCK_MODES = "ECB|CBC|PCBC|CTR|CTS|CFB|OFB" + -+ "|CFB8|CFB16|CFB24|CFB32|CFB40|CFB48|CFB56|CFB64" + -+ "|OFB8|OFB16|OFB24|OFB32|OFB40|OFB48|OFB56|OFB64"; -+ final String BLOCK_MODES128 = BLOCK_MODES + -+ "|CFB72|CFB80|CFB88|CFB96|CFB104|CFB112|CFB120|CFB128" + -+ "|OFB72|OFB80|OFB88|OFB96|OFB104|OFB112|OFB120|OFB128"; -+ final String BLOCK_PADS = "NOPADDING|PKCS5PADDING|ISO10126PADDING"; -+ -+ attrs.clear(); -+ attrs.put("SupportedModes", BLOCK_MODES); -+ attrs.put("SupportedPaddings", BLOCK_PADS); -+ attrs.put("SupportedKeyFormats", "RAW"); -+ ps("Cipher", "DES", -+ "com.sun.crypto.provider.DESCipher", null, attrs); -+ psA("Cipher", "DESede", "com.sun.crypto.provider.DESedeCipher", -+ attrs); -+ ps("Cipher", "Blowfish", -+ "com.sun.crypto.provider.BlowfishCipher", null, attrs); -+ -+ ps("Cipher", "RC2", -+ "com.sun.crypto.provider.RC2Cipher", null, attrs); -+ -+ attrs.clear(); -+ attrs.put("SupportedModes", BLOCK_MODES128); -+ attrs.put("SupportedPaddings", BLOCK_PADS); -+ attrs.put("SupportedKeyFormats", "RAW"); -+ psA("Cipher", "AES", -+ "com.sun.crypto.provider.AESCipher$General", attrs); -+ -+ attrs.clear(); -+ attrs.put("SupportedKeyFormats", "RAW"); -+ psA("Cipher", "AES/KW/NoPadding", -+ "com.sun.crypto.provider.KeyWrapCipher$AES_KW_NoPadding", -+ attrs); -+ ps("Cipher", "AES/KW/PKCS5Padding", -+ "com.sun.crypto.provider.KeyWrapCipher$AES_KW_PKCS5Padding", -+ null, attrs); -+ psA("Cipher", "AES/KWP/NoPadding", -+ "com.sun.crypto.provider.KeyWrapCipher$AES_KWP_NoPadding", -+ attrs); -+ -+ psA("Cipher", "AES_128/ECB/NoPadding", -+ "com.sun.crypto.provider.AESCipher$AES128_ECB_NoPadding", -+ attrs); -+ psA("Cipher", "AES_128/CBC/NoPadding", -+ "com.sun.crypto.provider.AESCipher$AES128_CBC_NoPadding", -+ attrs); -+ psA("Cipher", "AES_128/OFB/NoPadding", -+ "com.sun.crypto.provider.AESCipher$AES128_OFB_NoPadding", -+ attrs); -+ psA("Cipher", "AES_128/CFB/NoPadding", -+ "com.sun.crypto.provider.AESCipher$AES128_CFB_NoPadding", -+ attrs); -+ psA("Cipher", "AES_128/KW/NoPadding", -+ "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_NoPadding", -+ attrs); -+ ps("Cipher", "AES_128/KW/PKCS5Padding", -+ "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_PKCS5Padding", -+ null, attrs); -+ psA("Cipher", "AES_128/KWP/NoPadding", -+ "com.sun.crypto.provider.KeyWrapCipher$AES128_KWP_NoPadding", -+ attrs); -+ -+ psA("Cipher", "AES_192/ECB/NoPadding", -+ "com.sun.crypto.provider.AESCipher$AES192_ECB_NoPadding", -+ attrs); -+ psA("Cipher", "AES_192/CBC/NoPadding", -+ "com.sun.crypto.provider.AESCipher$AES192_CBC_NoPadding", -+ attrs); -+ psA("Cipher", "AES_192/OFB/NoPadding", -+ "com.sun.crypto.provider.AESCipher$AES192_OFB_NoPadding", -+ attrs); -+ psA("Cipher", "AES_192/CFB/NoPadding", -+ "com.sun.crypto.provider.AESCipher$AES192_CFB_NoPadding", -+ attrs); -+ psA("Cipher", "AES_192/KW/NoPadding", -+ "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_NoPadding", -+ attrs); -+ ps("Cipher", "AES_192/KW/PKCS5Padding", -+ "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_PKCS5Padding", -+ null, attrs); -+ psA("Cipher", "AES_192/KWP/NoPadding", -+ "com.sun.crypto.provider.KeyWrapCipher$AES192_KWP_NoPadding", -+ attrs); -+ -+ psA("Cipher", "AES_256/ECB/NoPadding", -+ "com.sun.crypto.provider.AESCipher$AES256_ECB_NoPadding", -+ attrs); -+ psA("Cipher", "AES_256/CBC/NoPadding", -+ "com.sun.crypto.provider.AESCipher$AES256_CBC_NoPadding", -+ attrs); -+ psA("Cipher", "AES_256/OFB/NoPadding", -+ "com.sun.crypto.provider.AESCipher$AES256_OFB_NoPadding", -+ attrs); -+ psA("Cipher", "AES_256/CFB/NoPadding", -+ "com.sun.crypto.provider.AESCipher$AES256_CFB_NoPadding", -+ attrs); -+ psA("Cipher", "AES_256/KW/NoPadding", -+ "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_NoPadding", -+ attrs); -+ ps("Cipher", "AES_256/KW/PKCS5Padding", -+ "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_PKCS5Padding", -+ null, attrs); -+ psA("Cipher", "AES_256/KWP/NoPadding", -+ "com.sun.crypto.provider.KeyWrapCipher$AES256_KWP_NoPadding", -+ attrs); -+ -+ attrs.clear(); -+ attrs.put("SupportedModes", "GCM"); -+ attrs.put("SupportedKeyFormats", "RAW"); -+ -+ ps("Cipher", "AES/GCM/NoPadding", -+ "com.sun.crypto.provider.GaloisCounterMode$AESGCM", null, -+ attrs); -+ psA("Cipher", "AES_128/GCM/NoPadding", -+ "com.sun.crypto.provider.GaloisCounterMode$AES128", -+ attrs); -+ psA("Cipher", "AES_192/GCM/NoPadding", -+ "com.sun.crypto.provider.GaloisCounterMode$AES192", -+ attrs); -+ psA("Cipher", "AES_256/GCM/NoPadding", -+ "com.sun.crypto.provider.GaloisCounterMode$AES256", -+ attrs); -+ -+ attrs.clear(); -+ attrs.put("SupportedModes", "CBC"); -+ attrs.put("SupportedPaddings", "NOPADDING"); -+ attrs.put("SupportedKeyFormats", "RAW"); -+ ps("Cipher", "DESedeWrap", -+ "com.sun.crypto.provider.DESedeWrapCipher", null, attrs); -+ -+ attrs.clear(); -+ attrs.put("SupportedModes", "ECB"); -+ attrs.put("SupportedPaddings", "NOPADDING"); -+ attrs.put("SupportedKeyFormats", "RAW"); -+ psA("Cipher", "ARCFOUR", -+ "com.sun.crypto.provider.ARCFOURCipher", attrs); -+ -+ attrs.clear(); -+ attrs.put("SupportedKeyFormats", "RAW"); -+ ps("Cipher", "ChaCha20", -+ "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Only", -+ null, attrs); -+ psA("Cipher", "ChaCha20-Poly1305", -+ "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Poly1305", -+ attrs); -+ -+ // PBES1 -+ psA("Cipher", "PBEWithMD5AndDES", -+ "com.sun.crypto.provider.PBEWithMD5AndDESCipher", -+ null); -+ ps("Cipher", "PBEWithMD5AndTripleDES", -+ "com.sun.crypto.provider.PBEWithMD5AndTripleDESCipher"); -+ psA("Cipher", "PBEWithSHA1AndDESede", -+ "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndDESede", -+ null); -+ psA("Cipher", "PBEWithSHA1AndRC2_40", -+ "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_40", -+ null); -+ psA("Cipher", "PBEWithSHA1AndRC2_128", -+ "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_128", -+ null); -+ psA("Cipher", "PBEWithSHA1AndRC4_40", -+ "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_40", -+ null); -+ -+ psA("Cipher", "PBEWithSHA1AndRC4_128", -+ "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_128", -+ null); -+ -+ // PBES2 -+ ps("Cipher", "PBEWithHmacSHA1AndAES_128", -+ "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_128"); -+ -+ ps("Cipher", "PBEWithHmacSHA224AndAES_128", -+ "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_128"); -+ -+ ps("Cipher", "PBEWithHmacSHA256AndAES_128", -+ "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_128"); -+ -+ ps("Cipher", "PBEWithHmacSHA384AndAES_128", -+ "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_128"); -+ -+ ps("Cipher", "PBEWithHmacSHA512AndAES_128", -+ "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_128"); -+ -+ ps("Cipher", "PBEWithHmacSHA512/224AndAES_128", -+ "com.sun.crypto.provider.PBES2Core$HmacSHA512_224AndAES_128"); -+ -+ ps("Cipher", "PBEWithHmacSHA512/256AndAES_128", -+ "com.sun.crypto.provider.PBES2Core$HmacSHA512_256AndAES_128"); -+ -+ ps("Cipher", "PBEWithHmacSHA1AndAES_256", -+ "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_256"); -+ -+ ps("Cipher", "PBEWithHmacSHA224AndAES_256", -+ "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_256"); -+ -+ ps("Cipher", "PBEWithHmacSHA256AndAES_256", -+ "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_256"); -+ -+ ps("Cipher", "PBEWithHmacSHA384AndAES_256", -+ "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_256"); -+ -+ ps("Cipher", "PBEWithHmacSHA512AndAES_256", -+ "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_256"); -+ -+ ps("Cipher", "PBEWithHmacSHA512/224AndAES_256", -+ "com.sun.crypto.provider.PBES2Core$HmacSHA512_224AndAES_256"); -+ -+ ps("Cipher", "PBEWithHmacSHA512/256AndAES_256", -+ "com.sun.crypto.provider.PBES2Core$HmacSHA512_256AndAES_256"); -+ -+ /* -+ * Key(pair) Generator engines -+ */ -+ ps("KeyGenerator", "DES", -+ "com.sun.crypto.provider.DESKeyGenerator"); -+ psA("KeyGenerator", "DESede", -+ "com.sun.crypto.provider.DESedeKeyGenerator", -+ null); -+ ps("KeyGenerator", "Blowfish", -+ "com.sun.crypto.provider.BlowfishKeyGenerator"); -+ psA("KeyGenerator", "AES", -+ "com.sun.crypto.provider.AESKeyGenerator", -+ null); -+ ps("KeyGenerator", "RC2", -+ "com.sun.crypto.provider.KeyGeneratorCore$RC2KeyGenerator"); -+ psA("KeyGenerator", "ARCFOUR", -+ "com.sun.crypto.provider.KeyGeneratorCore$ARCFOURKeyGenerator", -+ null); -+ ps("KeyGenerator", "ChaCha20", -+ "com.sun.crypto.provider.KeyGeneratorCore$ChaCha20KeyGenerator"); -+ ps("KeyGenerator", "HmacMD5", -+ "com.sun.crypto.provider.HmacMD5KeyGenerator"); -+ -+ psA("KeyGenerator", "HmacSHA1", -+ "com.sun.crypto.provider.HmacSHA1KeyGenerator", null); -+ psA("KeyGenerator", "HmacSHA224", -+ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA224", -+ null); -+ psA("KeyGenerator", "HmacSHA256", -+ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA256", -+ null); -+ psA("KeyGenerator", "HmacSHA384", -+ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA384", -+ null); -+ psA("KeyGenerator", "HmacSHA512", -+ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512", -+ null); -+ psA("KeyGenerator", "HmacSHA512/224", -+ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_224", -+ null); -+ psA("KeyGenerator", "HmacSHA512/256", -+ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_256", -+ null); -+ -+ psA("KeyGenerator", "HmacSHA3-224", -+ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_224", -+ null); -+ psA("KeyGenerator", "HmacSHA3-256", -+ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_256", -+ null); -+ psA("KeyGenerator", "HmacSHA3-384", -+ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_384", -+ null); -+ psA("KeyGenerator", "HmacSHA3-512", -+ "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_512", -+ null); -+ -+ psA("KeyPairGenerator", "DiffieHellman", -+ "com.sun.crypto.provider.DHKeyPairGenerator", -+ null); -+ } - - /* - * Algorithm parameter generation engines -@@ -447,15 +453,17 @@ public final class SunJCE extends Provider { - "DiffieHellman", "com.sun.crypto.provider.DHParameterGenerator", - null); - -- /* -- * Key Agreement engines -- */ -- attrs.clear(); -- attrs.put("SupportedKeyClasses", "javax.crypto.interfaces.DHPublicKey" + -- "|javax.crypto.interfaces.DHPrivateKey"); -- psA("KeyAgreement", "DiffieHellman", -- "com.sun.crypto.provider.DHKeyAgreement", -- attrs); -+ if (!systemFipsEnabled) { -+ /* -+ * Key Agreement engines -+ */ -+ attrs.clear(); -+ attrs.put("SupportedKeyClasses", "javax.crypto.interfaces.DHPublicKey" + -+ "|javax.crypto.interfaces.DHPrivateKey"); -+ psA("KeyAgreement", "DiffieHellman", -+ "com.sun.crypto.provider.DHKeyAgreement", -+ attrs); -+ } - - /* - * Algorithm Parameter engines -@@ -625,10 +633,10 @@ public final class SunJCE extends Provider { - "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512AndAES_128"); - - ps("SecretKeyFactory", "PBEWithHmacSHA512/224AndAES_128", -- "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_224AndAES_128"); -+ "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_224AndAES_128"); - - ps("SecretKeyFactory", "PBEWithHmacSHA512/256AndAES_128", -- "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_256AndAES_128"); -+ "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_256AndAES_128"); - - ps("SecretKeyFactory", "PBEWithHmacSHA1AndAES_256", - "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA1AndAES_256"); -@@ -651,136 +659,137 @@ public final class SunJCE extends Provider { - ps("SecretKeyFactory", "PBEWithHmacSHA512/256AndAES_256", - "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_256AndAES_256"); - -- // PBKDF2 -- psA("SecretKeyFactory", "PBKDF2WithHmacSHA1", -- "com.sun.crypto.provider.PBKDF2Core$HmacSHA1", -- null); -- ps("SecretKeyFactory", "PBKDF2WithHmacSHA224", -- "com.sun.crypto.provider.PBKDF2Core$HmacSHA224"); -- ps("SecretKeyFactory", "PBKDF2WithHmacSHA256", -- "com.sun.crypto.provider.PBKDF2Core$HmacSHA256"); -- ps("SecretKeyFactory", "PBKDF2WithHmacSHA384", -- "com.sun.crypto.provider.PBKDF2Core$HmacSHA384"); -- ps("SecretKeyFactory", "PBKDF2WithHmacSHA512", -- "com.sun.crypto.provider.PBKDF2Core$HmacSHA512"); -- ps("SecretKeyFactory", "PBKDF2WithHmacSHA512/224", -- "com.sun.crypto.provider.PBKDF2Core$HmacSHA512_224"); -- ps("SecretKeyFactory", "PBKDF2WithHmacSHA512/256", -- "com.sun.crypto.provider.PBKDF2Core$HmacSHA512_256"); -- -- /* -- * MAC -- */ -- attrs.clear(); -- attrs.put("SupportedKeyFormats", "RAW"); -- ps("Mac", "HmacMD5", "com.sun.crypto.provider.HmacMD5", null, attrs); -- psA("Mac", "HmacSHA1", "com.sun.crypto.provider.HmacSHA1", -- attrs); -- psA("Mac", "HmacSHA224", -- "com.sun.crypto.provider.HmacCore$HmacSHA224", attrs); -- psA("Mac", "HmacSHA256", -- "com.sun.crypto.provider.HmacCore$HmacSHA256", attrs); -- psA("Mac", "HmacSHA384", -- "com.sun.crypto.provider.HmacCore$HmacSHA384", attrs); -- psA("Mac", "HmacSHA512", -- "com.sun.crypto.provider.HmacCore$HmacSHA512", attrs); -- psA("Mac", "HmacSHA512/224", -- "com.sun.crypto.provider.HmacCore$HmacSHA512_224", attrs); -- psA("Mac", "HmacSHA512/256", -- "com.sun.crypto.provider.HmacCore$HmacSHA512_256", attrs); -- psA("Mac", "HmacSHA3-224", -- "com.sun.crypto.provider.HmacCore$HmacSHA3_224", attrs); -- psA("Mac", "HmacSHA3-256", -- "com.sun.crypto.provider.HmacCore$HmacSHA3_256", attrs); -- psA("Mac", "HmacSHA3-384", -- "com.sun.crypto.provider.HmacCore$HmacSHA3_384", attrs); -- psA("Mac", "HmacSHA3-512", -- "com.sun.crypto.provider.HmacCore$HmacSHA3_512", attrs); -- -- ps("Mac", "HmacPBESHA1", -- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA1", -- null, attrs); -- ps("Mac", "HmacPBESHA224", -- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA224", -- null, attrs); -- ps("Mac", "HmacPBESHA256", -- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA256", -- null, attrs); -- ps("Mac", "HmacPBESHA384", -- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA384", -- null, attrs); -- ps("Mac", "HmacPBESHA512", -- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512", -- null, attrs); -- ps("Mac", "HmacPBESHA512/224", -- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512_224", -- null, attrs); -- ps("Mac", "HmacPBESHA512/256", -- "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512_256", -- null, attrs); -- -- -- // PBMAC1 -- ps("Mac", "PBEWithHmacSHA1", -- "com.sun.crypto.provider.PBMAC1Core$HmacSHA1", null, attrs); -- ps("Mac", "PBEWithHmacSHA224", -- "com.sun.crypto.provider.PBMAC1Core$HmacSHA224", null, attrs); -- ps("Mac", "PBEWithHmacSHA256", -- "com.sun.crypto.provider.PBMAC1Core$HmacSHA256", null, attrs); -- ps("Mac", "PBEWithHmacSHA384", -- "com.sun.crypto.provider.PBMAC1Core$HmacSHA384", null, attrs); -- ps("Mac", "PBEWithHmacSHA512", -- "com.sun.crypto.provider.PBMAC1Core$HmacSHA512", null, attrs); -- ps("Mac", "PBEWithHmacSHA512/224", -- "com.sun.crypto.provider.PBMAC1Core$HmacSHA512_224", null, attrs); -- ps("Mac", "PBEWithHmacSHA512/256", -- "com.sun.crypto.provider.PBMAC1Core$HmacSHA512_256", null, attrs); -- -- ps("Mac", "SslMacMD5", -- "com.sun.crypto.provider.SslMacCore$SslMacMD5", null, attrs); -- ps("Mac", "SslMacSHA1", -- "com.sun.crypto.provider.SslMacCore$SslMacSHA1", null, attrs); -- -- /* -- * KeyStore -- */ -- ps("KeyStore", "JCEKS", -- "com.sun.crypto.provider.JceKeyStore"); -- -- /* -- * KEMs -- */ -- attrs.clear(); -- attrs.put("ImplementedIn", "Software"); -- attrs.put("SupportedKeyClasses", "java.security.interfaces.ECKey" + -- "|java.security.interfaces.XECKey"); -- ps("KEM", "DHKEM", "com.sun.crypto.provider.DHKEM", null, attrs); -- -- /* -- * SSL/TLS mechanisms -- * -- * These are strictly internal implementations and may -- * be changed at any time. These names were chosen -- * because PKCS11/SunPKCS11 does not yet have TLS1.2 -- * mechanisms, and it will cause calls to come here. -- */ -- ps("KeyGenerator", "SunTlsPrf", -- "com.sun.crypto.provider.TlsPrfGenerator$V10"); -- ps("KeyGenerator", "SunTls12Prf", -- "com.sun.crypto.provider.TlsPrfGenerator$V12"); -- -- ps("KeyGenerator", "SunTlsMasterSecret", -- "com.sun.crypto.provider.TlsMasterSecretGenerator", -- List.of("SunTls12MasterSecret", "SunTlsExtendedMasterSecret"), -- null); -- -- ps("KeyGenerator", "SunTlsKeyMaterial", -- "com.sun.crypto.provider.TlsKeyMaterialGenerator", -- List.of("SunTls12KeyMaterial"), null); -- -- ps("KeyGenerator", "SunTlsRsaPremasterSecret", -- "com.sun.crypto.provider.TlsRsaPremasterSecretGenerator", -- List.of("SunTls12RsaPremasterSecret"), null); -+ if (!systemFipsEnabled) { -+ // PBKDF2 -+ psA("SecretKeyFactory", "PBKDF2WithHmacSHA1", -+ "com.sun.crypto.provider.PBKDF2Core$HmacSHA1", -+ null); -+ ps("SecretKeyFactory", "PBKDF2WithHmacSHA224", -+ "com.sun.crypto.provider.PBKDF2Core$HmacSHA224"); -+ ps("SecretKeyFactory", "PBKDF2WithHmacSHA256", -+ "com.sun.crypto.provider.PBKDF2Core$HmacSHA256"); -+ ps("SecretKeyFactory", "PBKDF2WithHmacSHA384", -+ "com.sun.crypto.provider.PBKDF2Core$HmacSHA384"); -+ ps("SecretKeyFactory", "PBKDF2WithHmacSHA512", -+ "com.sun.crypto.provider.PBKDF2Core$HmacSHA512"); -+ ps("SecretKeyFactory", "PBKDF2WithHmacSHA512/224", -+ "com.sun.crypto.provider.PBKDF2Core$HmacSHA512_224"); -+ ps("SecretKeyFactory", "PBKDF2WithHmacSHA512/256", -+ "com.sun.crypto.provider.PBKDF2Core$HmacSHA512_256"); -+ -+ /* -+ * MAC -+ */ -+ attrs.clear(); -+ attrs.put("SupportedKeyFormats", "RAW"); -+ ps("Mac", "HmacMD5", "com.sun.crypto.provider.HmacMD5", null, attrs); -+ psA("Mac", "HmacSHA1", "com.sun.crypto.provider.HmacSHA1", -+ attrs); -+ psA("Mac", "HmacSHA224", -+ "com.sun.crypto.provider.HmacCore$HmacSHA224", attrs); -+ psA("Mac", "HmacSHA256", -+ "com.sun.crypto.provider.HmacCore$HmacSHA256", attrs); -+ psA("Mac", "HmacSHA384", -+ "com.sun.crypto.provider.HmacCore$HmacSHA384", attrs); -+ psA("Mac", "HmacSHA512", -+ "com.sun.crypto.provider.HmacCore$HmacSHA512", attrs); -+ psA("Mac", "HmacSHA512/224", -+ "com.sun.crypto.provider.HmacCore$HmacSHA512_224", attrs); -+ psA("Mac", "HmacSHA512/256", -+ "com.sun.crypto.provider.HmacCore$HmacSHA512_256", attrs); -+ psA("Mac", "HmacSHA3-224", -+ "com.sun.crypto.provider.HmacCore$HmacSHA3_224", attrs); -+ psA("Mac", "HmacSHA3-256", -+ "com.sun.crypto.provider.HmacCore$HmacSHA3_256", attrs); -+ psA("Mac", "HmacSHA3-384", -+ "com.sun.crypto.provider.HmacCore$HmacSHA3_384", attrs); -+ psA("Mac", "HmacSHA3-512", -+ "com.sun.crypto.provider.HmacCore$HmacSHA3_512", attrs); -+ -+ ps("Mac", "HmacPBESHA1", -+ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA1", -+ null, attrs); -+ ps("Mac", "HmacPBESHA224", -+ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA224", -+ null, attrs); -+ ps("Mac", "HmacPBESHA256", -+ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA256", -+ null, attrs); -+ ps("Mac", "HmacPBESHA384", -+ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA384", -+ null, attrs); -+ ps("Mac", "HmacPBESHA512", -+ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512", -+ null, attrs); -+ ps("Mac", "HmacPBESHA512/224", -+ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512_224", -+ null, attrs); -+ ps("Mac", "HmacPBESHA512/256", -+ "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512_256", -+ null, attrs); -+ -+ // PBMAC1 -+ ps("Mac", "PBEWithHmacSHA1", -+ "com.sun.crypto.provider.PBMAC1Core$HmacSHA1", null, attrs); -+ ps("Mac", "PBEWithHmacSHA224", -+ "com.sun.crypto.provider.PBMAC1Core$HmacSHA224", null, attrs); -+ ps("Mac", "PBEWithHmacSHA256", -+ "com.sun.crypto.provider.PBMAC1Core$HmacSHA256", null, attrs); -+ ps("Mac", "PBEWithHmacSHA384", -+ "com.sun.crypto.provider.PBMAC1Core$HmacSHA384", null, attrs); -+ ps("Mac", "PBEWithHmacSHA512", -+ "com.sun.crypto.provider.PBMAC1Core$HmacSHA512", null, attrs); -+ ps("Mac", "PBEWithHmacSHA512/224", -+ "com.sun.crypto.provider.PBMAC1Core$HmacSHA512_224", null, attrs); -+ ps("Mac", "PBEWithHmacSHA512/256", -+ "com.sun.crypto.provider.PBMAC1Core$HmacSHA512_256", null, attrs); -+ -+ ps("Mac", "SslMacMD5", -+ "com.sun.crypto.provider.SslMacCore$SslMacMD5", null, attrs); -+ ps("Mac", "SslMacSHA1", -+ "com.sun.crypto.provider.SslMacCore$SslMacSHA1", null, attrs); -+ -+ /* -+ * KeyStore -+ */ -+ ps("KeyStore", "JCEKS", -+ "com.sun.crypto.provider.JceKeyStore"); -+ -+ /* -+ * KEMs -+ */ -+ attrs.clear(); -+ attrs.put("ImplementedIn", "Software"); -+ attrs.put("SupportedKeyClasses", "java.security.interfaces.ECKey" + -+ "|java.security.interfaces.XECKey"); -+ ps("KEM", "DHKEM", "com.sun.crypto.provider.DHKEM", null, attrs); -+ -+ /* -+ * SSL/TLS mechanisms -+ * -+ * These are strictly internal implementations and may -+ * be changed at any time. These names were chosen -+ * because PKCS11/SunPKCS11 does not yet have TLS1.2 -+ * mechanisms, and it will cause calls to come here. -+ */ -+ ps("KeyGenerator", "SunTlsPrf", -+ "com.sun.crypto.provider.TlsPrfGenerator$V10"); -+ ps("KeyGenerator", "SunTls12Prf", -+ "com.sun.crypto.provider.TlsPrfGenerator$V12"); -+ -+ ps("KeyGenerator", "SunTlsMasterSecret", -+ "com.sun.crypto.provider.TlsMasterSecretGenerator", -+ List.of("SunTls12MasterSecret", "SunTlsExtendedMasterSecret"), -+ null); -+ -+ ps("KeyGenerator", "SunTlsKeyMaterial", -+ "com.sun.crypto.provider.TlsKeyMaterialGenerator", -+ List.of("SunTls12KeyMaterial"), null); -+ -+ ps("KeyGenerator", "SunTlsRsaPremasterSecret", -+ "com.sun.crypto.provider.TlsRsaPremasterSecretGenerator", -+ List.of("SunTls12RsaPremasterSecret"), null); -+ } - } - - // Return the instance of this class or create one if needed. -diff --git a/src/java.base/share/classes/java/security/Security.java b/src/java.base/share/classes/java/security/Security.java -index 671529f71a1..af632936921 100644 ---- a/src/java.base/share/classes/java/security/Security.java -+++ b/src/java.base/share/classes/java/security/Security.java -@@ -34,6 +34,7 @@ import java.net.URL; - import jdk.internal.access.JavaSecurityPropertiesAccess; - import jdk.internal.event.EventHelper; - import jdk.internal.event.SecurityPropertyModificationEvent; -+import jdk.internal.access.JavaSecuritySystemConfiguratorAccess; - import jdk.internal.access.SharedSecrets; - import jdk.internal.util.StaticProperty; - import sun.security.util.Debug; -@@ -58,6 +59,11 @@ import sun.security.jca.*; - - public final class Security { - -+ private static final String SYS_PROP_SWITCH = -+ "java.security.disableSystemPropertiesFile"; -+ private static final String SEC_PROP_SWITCH = -+ "security.useSystemPropertiesFile"; -+ - /* Are we debugging? -- for developers */ - private static final Debug sdebug = - Debug.getInstance("properties"); -@@ -75,6 +81,19 @@ public final class Security { - } - - static { -+ // Initialise here as used by code with system properties disabled -+ SharedSecrets.setJavaSecuritySystemConfiguratorAccess( -+ new JavaSecuritySystemConfiguratorAccess() { -+ @Override -+ public boolean isSystemFipsEnabled() { -+ return SystemConfigurator.isSystemFipsEnabled(); -+ } -+ @Override -+ public boolean isPlainKeySupportEnabled() { -+ return SystemConfigurator.isPlainKeySupportEnabled(); -+ } -+ }); -+ - // doPrivileged here because there are multiple - // things in initialize that might require privs. - // (the FileInputStream call and the File.exists call, -@@ -96,6 +115,7 @@ public final class Security { - private static void initialize() { - props = new Properties(); - boolean overrideAll = false; -+ boolean systemSecPropsEnabled = false; - - // first load the system properties file - // to determine the value of security.overridePropertiesFile -@@ -116,6 +136,61 @@ public final class Security { - } - loadProps(null, extraPropFile, overrideAll); - } -+ -+ boolean sysUseProps = Boolean.valueOf(System.getProperty(SYS_PROP_SWITCH, "false")); -+ boolean secUseProps = Boolean.valueOf(props.getProperty(SEC_PROP_SWITCH)); -+ if (sdebug != null) { -+ sdebug.println(SYS_PROP_SWITCH + "=" + sysUseProps); -+ sdebug.println(SEC_PROP_SWITCH + "=" + secUseProps); -+ } -+ if (!sysUseProps && secUseProps) { -+ systemSecPropsEnabled = SystemConfigurator.configureSysProps(props); -+ if (!systemSecPropsEnabled) { -+ if (sdebug != null) { -+ sdebug.println("WARNING: System security properties could not be loaded."); -+ } -+ } -+ } else { -+ if (sdebug != null) { -+ sdebug.println("System security property support disabled by user."); -+ } -+ } -+ -+ if (systemSecPropsEnabled) { -+ boolean shouldEnable; -+ String sysProp = System.getProperty("com.redhat.fips"); -+ if (sysProp == null) { -+ shouldEnable = true; -+ if (sdebug != null) { -+ sdebug.println("com.redhat.fips unset, using default value of true"); -+ } -+ } else { -+ shouldEnable = Boolean.valueOf(sysProp); -+ if (sdebug != null) { -+ sdebug.println("com.redhat.fips set, using its value " + shouldEnable); -+ } -+ } -+ if (shouldEnable) { -+ boolean fipsEnabled = SystemConfigurator.configureFIPS(props); -+ if (sdebug != null) { -+ if (fipsEnabled) { -+ sdebug.println("FIPS mode support configured and enabled."); -+ } else { -+ sdebug.println("FIPS mode support disabled."); -+ } -+ } -+ } else { -+ if (sdebug != null ) { -+ sdebug.println("FIPS mode support disabled by user."); -+ } -+ } -+ } else { -+ if (sdebug != null) { -+ sdebug.println("WARNING: FIPS mode support can not be enabled without " + -+ "system security properties being enabled."); -+ } -+ } -+ - initialSecurityProperties = (Properties) props.clone(); - if (sdebug != null) { - for (String key : props.stringPropertyNames()) { -@@ -126,7 +201,7 @@ public final class Security { - - } - -- private static boolean loadProps(File masterFile, String extraPropFile, boolean overrideAll) { -+ static boolean loadProps(File masterFile, String extraPropFile, boolean overrideAll) { - InputStream is = null; - try { - if (masterFile != null && masterFile.exists()) { -diff --git a/src/java.base/share/classes/java/security/SystemConfigurator.java b/src/java.base/share/classes/java/security/SystemConfigurator.java -new file mode 100644 -index 00000000000..9d26a54f5d4 ---- /dev/null -+++ b/src/java.base/share/classes/java/security/SystemConfigurator.java -@@ -0,0 +1,232 @@ -+/* -+ * Copyright (c) 2019, 2021, Red Hat, Inc. -+ * -+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. -+ * -+ * This code is free software; you can redistribute it and/or modify it -+ * under the terms of the GNU General Public License version 2 only, as -+ * published by the Free Software Foundation. Oracle designates this -+ * particular file as subject to the "Classpath" exception as provided -+ * by Oracle in the LICENSE file that accompanied this code. -+ * -+ * This code is distributed in the hope that it will be useful, but WITHOUT -+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -+ * version 2 for more details (a copy is included in the LICENSE file that -+ * accompanied this code). -+ * -+ * You should have received a copy of the GNU General Public License version -+ * 2 along with this work; if not, write to the Free Software Foundation, -+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. -+ * -+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA -+ * or visit www.oracle.com if you need additional information or have any -+ * questions. -+ */ -+ -+package java.security; -+ -+import java.io.BufferedInputStream; -+import java.io.FileInputStream; -+import java.io.IOException; -+ -+import java.util.Iterator; -+import java.util.Map.Entry; -+import java.util.Properties; -+ -+import sun.security.util.Debug; -+ -+/** -+ * Internal class to align OpenJDK with global crypto-policies. -+ * Called from java.security.Security class initialization, -+ * during startup. -+ * -+ */ -+ -+final class SystemConfigurator { -+ -+ private static final Debug sdebug = -+ Debug.getInstance("properties"); -+ -+ private static final String CRYPTO_POLICIES_BASE_DIR = -+ "/etc/crypto-policies"; -+ -+ private static final String CRYPTO_POLICIES_JAVA_CONFIG = -+ CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config"; -+ -+ private static boolean systemFipsEnabled = false; -+ private static boolean plainKeySupportEnabled = false; -+ -+ private static final String SYSTEMCONF_NATIVE_LIB = "systemconf"; -+ -+ private static native boolean getSystemFIPSEnabled() -+ throws IOException; -+ -+ static { -+ @SuppressWarnings("removal") -+ var dummy = AccessController.doPrivileged(new PrivilegedAction() { -+ public Void run() { -+ System.loadLibrary(SYSTEMCONF_NATIVE_LIB); -+ return null; -+ } -+ }); -+ } -+ -+ /* -+ * Invoked when java.security.Security class is initialized, if -+ * java.security.disableSystemPropertiesFile property is not set and -+ * security.useSystemPropertiesFile is true. -+ */ -+ static boolean configureSysProps(Properties props) { -+ // now load the system file, if it exists, so its values -+ // will win if they conflict with the earlier values -+ return Security.loadProps(null, CRYPTO_POLICIES_JAVA_CONFIG, false); -+ } -+ -+ /* -+ * Invoked at the end of java.security.Security initialisation -+ * if java.security properties have been loaded -+ */ -+ static boolean configureFIPS(Properties props) { -+ boolean loadedProps = false; -+ -+ try { -+ if (enableFips()) { -+ if (sdebug != null) { sdebug.println("FIPS mode detected"); } -+ // Remove all security providers -+ Iterator> i = props.entrySet().iterator(); -+ while (i.hasNext()) { -+ Entry e = i.next(); -+ if (((String) e.getKey()).startsWith("security.provider")) { -+ if (sdebug != null) { sdebug.println("Removing provider: " + e); } -+ i.remove(); -+ } -+ } -+ // Add FIPS security providers -+ String fipsProviderValue = null; -+ for (int n = 1; -+ (fipsProviderValue = (String) props.get("fips.provider." + n)) != null; n++) { -+ String fipsProviderKey = "security.provider." + n; -+ if (sdebug != null) { -+ sdebug.println("Adding provider " + n + ": " + -+ fipsProviderKey + "=" + fipsProviderValue); -+ } -+ props.put(fipsProviderKey, fipsProviderValue); -+ } -+ // Add other security properties -+ String keystoreTypeValue = (String) props.get("fips.keystore.type"); -+ if (keystoreTypeValue != null) { -+ String nonFipsKeystoreType = props.getProperty("keystore.type"); -+ props.put("keystore.type", keystoreTypeValue); -+ if (keystoreTypeValue.equals("PKCS11")) { -+ // If keystore.type is PKCS11, javax.net.ssl.keyStore -+ // must be "NONE". See JDK-8238264. -+ System.setProperty("javax.net.ssl.keyStore", "NONE"); -+ } -+ if (System.getProperty("javax.net.ssl.trustStoreType") == null) { -+ // If no trustStoreType has been set, use the -+ // previous keystore.type under FIPS mode. In -+ // a default configuration, the Trust Store will -+ // be 'cacerts' (JKS type). -+ System.setProperty("javax.net.ssl.trustStoreType", -+ nonFipsKeystoreType); -+ } -+ if (sdebug != null) { -+ sdebug.println("FIPS mode default keystore.type = " + -+ keystoreTypeValue); -+ sdebug.println("FIPS mode javax.net.ssl.keyStore = " + -+ System.getProperty("javax.net.ssl.keyStore", "")); -+ sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " + -+ System.getProperty("javax.net.ssl.trustStoreType", "")); -+ } -+ } -+ loadedProps = true; -+ systemFipsEnabled = true; -+ String plainKeySupport = System.getProperty("com.redhat.fips.plainKeySupport", -+ "true"); -+ plainKeySupportEnabled = !"false".equals(plainKeySupport); -+ if (sdebug != null) { -+ if (plainKeySupportEnabled) { -+ sdebug.println("FIPS support enabled with plain key support"); -+ } else { -+ sdebug.println("FIPS support enabled without plain key support"); -+ } -+ } -+ } else { -+ if (sdebug != null) { sdebug.println("FIPS mode not detected"); } -+ } -+ } catch (Exception e) { -+ if (sdebug != null) { -+ sdebug.println("unable to load FIPS configuration"); -+ e.printStackTrace(); -+ } -+ } -+ return loadedProps; -+ } -+ -+ /** -+ * Returns whether or not global system FIPS alignment is enabled. -+ * -+ * Value is always 'false' before java.security.Security class is -+ * initialized. -+ * -+ * Call from out of this package through SharedSecrets: -+ * SharedSecrets.getJavaSecuritySystemConfiguratorAccess() -+ * .isSystemFipsEnabled(); -+ * -+ * @return a boolean value indicating whether or not global -+ * system FIPS alignment is enabled. -+ */ -+ static boolean isSystemFipsEnabled() { -+ return systemFipsEnabled; -+ } -+ -+ /** -+ * Returns {@code true} if system FIPS alignment is enabled -+ * and plain key support is allowed. Plain key support is -+ * enabled by default but can be disabled with -+ * {@code -Dcom.redhat.fips.plainKeySupport=false}. -+ * -+ * @return a boolean indicating whether plain key support -+ * should be enabled. -+ */ -+ static boolean isPlainKeySupportEnabled() { -+ return plainKeySupportEnabled; -+ } -+ -+ /** -+ * Determines whether FIPS mode should be enabled. -+ * -+ * OpenJDK FIPS mode will be enabled only if the system is in -+ * FIPS mode. -+ * -+ * Calls to this method only occur if the system property -+ * com.redhat.fips is not set to false. -+ * -+ * There are 2 possible ways in which OpenJDK detects that the system -+ * is in FIPS mode: 1) if the NSS SECMOD_GetSystemFIPSEnabled API is -+ * available at OpenJDK's built-time, it is called; 2) otherwise, the -+ * /proc/sys/crypto/fips_enabled file is read. -+ * -+ * @return true if the system is in FIPS mode -+ */ -+ private static boolean enableFips() throws Exception { -+ if (sdebug != null) { -+ sdebug.println("Calling getSystemFIPSEnabled (libsystemconf)..."); -+ } -+ try { -+ boolean fipsEnabled = getSystemFIPSEnabled(); -+ if (sdebug != null) { -+ sdebug.println("Call to getSystemFIPSEnabled (libsystemconf) returned: " -+ + fipsEnabled); -+ } -+ return fipsEnabled; -+ } catch (IOException e) { -+ if (sdebug != null) { -+ sdebug.println("Call to getSystemFIPSEnabled (libsystemconf) failed:"); -+ sdebug.println(e.getMessage()); -+ } -+ throw e; -+ } -+ } -+} -diff --git a/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java b/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java -new file mode 100644 -index 00000000000..3f3caac64dc ---- /dev/null -+++ b/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java -@@ -0,0 +1,31 @@ -+/* -+ * Copyright (c) 2020, Red Hat, Inc. -+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. -+ * -+ * This code is free software; you can redistribute it and/or modify it -+ * under the terms of the GNU General Public License version 2 only, as -+ * published by the Free Software Foundation. Oracle designates this -+ * particular file as subject to the "Classpath" exception as provided -+ * by Oracle in the LICENSE file that accompanied this code. -+ * -+ * This code is distributed in the hope that it will be useful, but WITHOUT -+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -+ * version 2 for more details (a copy is included in the LICENSE file that -+ * accompanied this code). -+ * -+ * You should have received a copy of the GNU General Public License version -+ * 2 along with this work; if not, write to the Free Software Foundation, -+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. -+ * -+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA -+ * or visit www.oracle.com if you need additional information or have any -+ * questions. -+ */ -+ -+package jdk.internal.access; -+ -+public interface JavaSecuritySystemConfiguratorAccess { -+ boolean isSystemFipsEnabled(); -+ boolean isPlainKeySupportEnabled(); -+} -diff --git a/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java b/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java -index 919d758a6e3..b1e5fbaf84a 100644 ---- a/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java -+++ b/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java -@@ -43,6 +43,7 @@ import java.io.PrintStream; - import java.io.PrintWriter; - import java.io.RandomAccessFile; - import java.security.ProtectionDomain; -+import java.security.Security; - import java.security.Signature; - - /** A repository of "shared secrets", which are a mechanism for -@@ -90,6 +91,7 @@ public class SharedSecrets { - private static JavaxCryptoSealedObjectAccess javaxCryptoSealedObjectAccess; - private static JavaxCryptoSpecAccess javaxCryptoSpecAccess; - private static JavaTemplateAccess javaTemplateAccess; -+ private static JavaSecuritySystemConfiguratorAccess javaSecuritySystemConfiguratorAccess; - - public static void setJavaUtilCollectionAccess(JavaUtilCollectionAccess juca) { - javaUtilCollectionAccess = juca; -@@ -537,4 +539,15 @@ public class SharedSecrets { - MethodHandles.lookup().ensureInitialized(c); - } catch (IllegalAccessException e) {} - } -+ -+ public static void setJavaSecuritySystemConfiguratorAccess(JavaSecuritySystemConfiguratorAccess jssca) { -+ javaSecuritySystemConfiguratorAccess = jssca; -+ } -+ -+ public static JavaSecuritySystemConfiguratorAccess getJavaSecuritySystemConfiguratorAccess() { -+ if (javaSecuritySystemConfiguratorAccess == null) { -+ ensureClassInitialized(Security.class); -+ } -+ return javaSecuritySystemConfiguratorAccess; -+ } - } -diff --git a/src/java.base/share/classes/module-info.java b/src/java.base/share/classes/module-info.java -index 06b141dcf22..e8cbf7f15d7 100644 ---- a/src/java.base/share/classes/module-info.java -+++ b/src/java.base/share/classes/module-info.java -@@ -158,6 +158,7 @@ module java.base { - java.naming, - java.rmi, - jdk.charsets, -+ jdk.crypto.ec, - jdk.jartool, - jdk.jlink, - jdk.jfr, -diff --git a/src/java.base/share/classes/sun/security/provider/SunEntries.java b/src/java.base/share/classes/sun/security/provider/SunEntries.java -index f036a411f1d..1e9de933bd9 100644 ---- a/src/java.base/share/classes/sun/security/provider/SunEntries.java -+++ b/src/java.base/share/classes/sun/security/provider/SunEntries.java -@@ -38,6 +38,7 @@ import java.util.HashMap; - import java.util.Iterator; - import java.util.LinkedHashSet; - -+import jdk.internal.access.SharedSecrets; - import jdk.internal.util.StaticProperty; - import sun.security.action.GetBooleanAction; - -@@ -91,6 +92,10 @@ import static sun.security.util.SecurityProviderConstants.getAliases; - - public final class SunEntries { - -+ private static final boolean systemFipsEnabled = -+ SharedSecrets.getJavaSecuritySystemConfiguratorAccess() -+ .isSystemFipsEnabled(); -+ - // the default algo used by SecureRandom class for new SecureRandom() calls - public static final String DEF_SECURE_RANDOM_ALGO; - -@@ -102,89 +107,92 @@ public final class SunEntries { - // common attribute map - HashMap attrs = new HashMap<>(3); - -- /* -- * SecureRandom engines -- */ -- attrs.put("ThreadSafe", "true"); -- if (NativePRNG.isAvailable()) { -- add(p, "SecureRandom", "NativePRNG", -- "sun.security.provider.NativePRNG", attrs); -- } -- if (NativePRNG.Blocking.isAvailable()) { -- add(p, "SecureRandom", "NativePRNGBlocking", -- "sun.security.provider.NativePRNG$Blocking", attrs); -- } -- if (NativePRNG.NonBlocking.isAvailable()) { -- add(p, "SecureRandom", "NativePRNGNonBlocking", -- "sun.security.provider.NativePRNG$NonBlocking", attrs); -- } -- attrs.put("ImplementedIn", "Software"); -- add(p, "SecureRandom", "DRBG", "sun.security.provider.DRBG", attrs); -- add(p, "SecureRandom", "SHA1PRNG", -- "sun.security.provider.SecureRandom", attrs); -- -- /* -- * Signature engines -- */ -- attrs.clear(); -- String dsaKeyClasses = "java.security.interfaces.DSAPublicKey" + -- "|java.security.interfaces.DSAPrivateKey"; -- attrs.put("SupportedKeyClasses", dsaKeyClasses); -- attrs.put("ImplementedIn", "Software"); -- -- attrs.put("KeySize", "1024"); // for NONE and SHA1 DSA signatures -- -- addWithAlias(p, "Signature", "SHA1withDSA", -- "sun.security.provider.DSA$SHA1withDSA", attrs); -- addWithAlias(p, "Signature", "NONEwithDSA", -- "sun.security.provider.DSA$RawDSA", attrs); -- -- // for DSA signatures with 224/256-bit digests -- attrs.put("KeySize", "2048"); -- -- addWithAlias(p, "Signature", "SHA224withDSA", -- "sun.security.provider.DSA$SHA224withDSA", attrs); -- addWithAlias(p, "Signature", "SHA256withDSA", -- "sun.security.provider.DSA$SHA256withDSA", attrs); -- -- addWithAlias(p, "Signature", "SHA3-224withDSA", -- "sun.security.provider.DSA$SHA3_224withDSA", attrs); -- addWithAlias(p, "Signature", "SHA3-256withDSA", -- "sun.security.provider.DSA$SHA3_256withDSA", attrs); -- -- attrs.put("KeySize", "3072"); // for DSA sig using 384/512-bit digests -- -- addWithAlias(p, "Signature", "SHA384withDSA", -- "sun.security.provider.DSA$SHA384withDSA", attrs); -- addWithAlias(p, "Signature", "SHA512withDSA", -- "sun.security.provider.DSA$SHA512withDSA", attrs); -- addWithAlias(p, "Signature", "SHA3-384withDSA", -- "sun.security.provider.DSA$SHA3_384withDSA", attrs); -- addWithAlias(p, "Signature", "SHA3-512withDSA", -- "sun.security.provider.DSA$SHA3_512withDSA", attrs); -+ if (!systemFipsEnabled) { -+ /* -+ * SecureRandom engines -+ */ -+ attrs.put("ThreadSafe", "true"); -+ if (NativePRNG.isAvailable()) { -+ add(p, "SecureRandom", "NativePRNG", -+ "sun.security.provider.NativePRNG", attrs); -+ } -+ if (NativePRNG.Blocking.isAvailable()) { -+ add(p, "SecureRandom", "NativePRNGBlocking", -+ "sun.security.provider.NativePRNG$Blocking", attrs); -+ } -+ if (NativePRNG.NonBlocking.isAvailable()) { -+ add(p, "SecureRandom", "NativePRNGNonBlocking", -+ "sun.security.provider.NativePRNG$NonBlocking", attrs); -+ } -+ attrs.put("ImplementedIn", "Software"); -+ add(p, "SecureRandom", "DRBG", "sun.security.provider.DRBG", attrs); -+ add(p, "SecureRandom", "SHA1PRNG", -+ "sun.security.provider.SecureRandom", attrs); - -- attrs.remove("KeySize"); -+ /* -+ * Signature engines -+ */ -+ attrs.clear(); -+ String dsaKeyClasses = "java.security.interfaces.DSAPublicKey" + -+ "|java.security.interfaces.DSAPrivateKey"; -+ attrs.put("SupportedKeyClasses", dsaKeyClasses); -+ attrs.put("ImplementedIn", "Software"); -+ -+ attrs.put("KeySize", "1024"); // for NONE and SHA1 DSA signatures -+ -+ addWithAlias(p, "Signature", "SHA1withDSA", -+ "sun.security.provider.DSA$SHA1withDSA", attrs); -+ addWithAlias(p, "Signature", "NONEwithDSA", -+ "sun.security.provider.DSA$RawDSA", attrs); -+ -+ // for DSA signatures with 224/256-bit digests -+ attrs.put("KeySize", "2048"); -+ -+ addWithAlias(p, "Signature", "SHA224withDSA", -+ "sun.security.provider.DSA$SHA224withDSA", attrs); -+ addWithAlias(p, "Signature", "SHA256withDSA", -+ "sun.security.provider.DSA$SHA256withDSA", attrs); -+ -+ addWithAlias(p, "Signature", "SHA3-224withDSA", -+ "sun.security.provider.DSA$SHA3_224withDSA", attrs); -+ addWithAlias(p, "Signature", "SHA3-256withDSA", -+ "sun.security.provider.DSA$SHA3_256withDSA", attrs); -+ -+ attrs.put("KeySize", "3072"); // for DSA sig using 384/512-bit digests -+ -+ addWithAlias(p, "Signature", "SHA384withDSA", -+ "sun.security.provider.DSA$SHA384withDSA", attrs); -+ addWithAlias(p, "Signature", "SHA512withDSA", -+ "sun.security.provider.DSA$SHA512withDSA", attrs); -+ addWithAlias(p, "Signature", "SHA3-384withDSA", -+ "sun.security.provider.DSA$SHA3_384withDSA", attrs); -+ addWithAlias(p, "Signature", "SHA3-512withDSA", -+ "sun.security.provider.DSA$SHA3_512withDSA", attrs); -+ -+ attrs.remove("KeySize"); -+ -+ add(p, "Signature", "SHA1withDSAinP1363Format", -+ "sun.security.provider.DSA$SHA1withDSAinP1363Format"); -+ add(p, "Signature", "NONEwithDSAinP1363Format", -+ "sun.security.provider.DSA$RawDSAinP1363Format"); -+ add(p, "Signature", "SHA224withDSAinP1363Format", -+ "sun.security.provider.DSA$SHA224withDSAinP1363Format"); -+ add(p, "Signature", "SHA256withDSAinP1363Format", -+ "sun.security.provider.DSA$SHA256withDSAinP1363Format"); -+ add(p, "Signature", "SHA384withDSAinP1363Format", -+ "sun.security.provider.DSA$SHA384withDSAinP1363Format"); -+ add(p, "Signature", "SHA512withDSAinP1363Format", -+ "sun.security.provider.DSA$SHA512withDSAinP1363Format"); -+ add(p, "Signature", "SHA3-224withDSAinP1363Format", -+ "sun.security.provider.DSA$SHA3_224withDSAinP1363Format"); -+ add(p, "Signature", "SHA3-256withDSAinP1363Format", -+ "sun.security.provider.DSA$SHA3_256withDSAinP1363Format"); -+ add(p, "Signature", "SHA3-384withDSAinP1363Format", -+ "sun.security.provider.DSA$SHA3_384withDSAinP1363Format"); -+ add(p, "Signature", "SHA3-512withDSAinP1363Format", -+ "sun.security.provider.DSA$SHA3_512withDSAinP1363Format"); - -- add(p, "Signature", "SHA1withDSAinP1363Format", -- "sun.security.provider.DSA$SHA1withDSAinP1363Format"); -- add(p, "Signature", "NONEwithDSAinP1363Format", -- "sun.security.provider.DSA$RawDSAinP1363Format"); -- add(p, "Signature", "SHA224withDSAinP1363Format", -- "sun.security.provider.DSA$SHA224withDSAinP1363Format"); -- add(p, "Signature", "SHA256withDSAinP1363Format", -- "sun.security.provider.DSA$SHA256withDSAinP1363Format"); -- add(p, "Signature", "SHA384withDSAinP1363Format", -- "sun.security.provider.DSA$SHA384withDSAinP1363Format"); -- add(p, "Signature", "SHA512withDSAinP1363Format", -- "sun.security.provider.DSA$SHA512withDSAinP1363Format"); -- add(p, "Signature", "SHA3-224withDSAinP1363Format", -- "sun.security.provider.DSA$SHA3_224withDSAinP1363Format"); -- add(p, "Signature", "SHA3-256withDSAinP1363Format", -- "sun.security.provider.DSA$SHA3_256withDSAinP1363Format"); -- add(p, "Signature", "SHA3-384withDSAinP1363Format", -- "sun.security.provider.DSA$SHA3_384withDSAinP1363Format"); -- add(p, "Signature", "SHA3-512withDSAinP1363Format", -- "sun.security.provider.DSA$SHA3_512withDSAinP1363Format"); -+ } - - attrs.clear(); - attrs.put("ImplementedIn", "Software"); -@@ -196,9 +204,11 @@ public final class SunEntries { - attrs.put("ImplementedIn", "Software"); - attrs.put("KeySize", "2048"); // for DSA KPG and APG only - -- String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$"; -- dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current"); -- addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs); -+ if (!systemFipsEnabled) { -+ String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$"; -+ dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current"); -+ addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs); -+ } - - /* - * Algorithm Parameter Generator engines -@@ -213,44 +223,46 @@ public final class SunEntries { - addWithAlias(p, "AlgorithmParameters", "DSA", - "sun.security.provider.DSAParameters", attrs); - -- /* -- * Key factories -- */ -- addWithAlias(p, "KeyFactory", "DSA", -- "sun.security.provider.DSAKeyFactory", attrs); -- addWithAlias(p, "KeyFactory", "HSS/LMS", -- "sun.security.provider.HSS$KeyFactoryImpl", attrs); -- -- /* -- * Digest engines -- */ -- addWithAlias(p, "MessageDigest", "MD2", "sun.security.provider.MD2", -- attrs); -- addWithAlias(p, "MessageDigest", "MD5", "sun.security.provider.MD5", -- attrs); -- addWithAlias(p, "MessageDigest", "SHA-1", "sun.security.provider.SHA", -- attrs); -+ if (!systemFipsEnabled) { -+ /* -+ * Key factories -+ */ -+ addWithAlias(p, "KeyFactory", "DSA", -+ "sun.security.provider.DSAKeyFactory", attrs); -+ addWithAlias(p, "KeyFactory", "HSS/LMS", -+ "sun.security.provider.HSS$KeyFactoryImpl", attrs); - -- addWithAlias(p, "MessageDigest", "SHA-224", -- "sun.security.provider.SHA2$SHA224", attrs); -- addWithAlias(p, "MessageDigest", "SHA-256", -- "sun.security.provider.SHA2$SHA256", attrs); -- addWithAlias(p, "MessageDigest", "SHA-384", -- "sun.security.provider.SHA5$SHA384", attrs); -- addWithAlias(p, "MessageDigest", "SHA-512", -- "sun.security.provider.SHA5$SHA512", attrs); -- addWithAlias(p, "MessageDigest", "SHA-512/224", -- "sun.security.provider.SHA5$SHA512_224", attrs); -- addWithAlias(p, "MessageDigest", "SHA-512/256", -- "sun.security.provider.SHA5$SHA512_256", attrs); -- addWithAlias(p, "MessageDigest", "SHA3-224", -- "sun.security.provider.SHA3$SHA224", attrs); -- addWithAlias(p, "MessageDigest", "SHA3-256", -- "sun.security.provider.SHA3$SHA256", attrs); -- addWithAlias(p, "MessageDigest", "SHA3-384", -- "sun.security.provider.SHA3$SHA384", attrs); -- addWithAlias(p, "MessageDigest", "SHA3-512", -- "sun.security.provider.SHA3$SHA512", attrs); -+ /* -+ * Digest engines -+ */ -+ addWithAlias(p, "MessageDigest", "MD2", "sun.security.provider.MD2", -+ attrs); -+ addWithAlias(p, "MessageDigest", "MD5", "sun.security.provider.MD5", -+ attrs); -+ addWithAlias(p, "MessageDigest", "SHA-1", "sun.security.provider.SHA", -+ attrs); -+ -+ addWithAlias(p, "MessageDigest", "SHA-224", -+ "sun.security.provider.SHA2$SHA224", attrs); -+ addWithAlias(p, "MessageDigest", "SHA-256", -+ "sun.security.provider.SHA2$SHA256", attrs); -+ addWithAlias(p, "MessageDigest", "SHA-384", -+ "sun.security.provider.SHA5$SHA384", attrs); -+ addWithAlias(p, "MessageDigest", "SHA-512", -+ "sun.security.provider.SHA5$SHA512", attrs); -+ addWithAlias(p, "MessageDigest", "SHA-512/224", -+ "sun.security.provider.SHA5$SHA512_224", attrs); -+ addWithAlias(p, "MessageDigest", "SHA-512/256", -+ "sun.security.provider.SHA5$SHA512_256", attrs); -+ addWithAlias(p, "MessageDigest", "SHA3-224", -+ "sun.security.provider.SHA3$SHA224", attrs); -+ addWithAlias(p, "MessageDigest", "SHA3-256", -+ "sun.security.provider.SHA3$SHA256", attrs); -+ addWithAlias(p, "MessageDigest", "SHA3-384", -+ "sun.security.provider.SHA3$SHA384", attrs); -+ addWithAlias(p, "MessageDigest", "SHA3-512", -+ "sun.security.provider.SHA3$SHA512", attrs); -+ } - - /* - * Certificates -diff --git a/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java b/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java -index 539ef1e8ee8..435f57e3ff2 100644 ---- a/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java -+++ b/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java -@@ -27,6 +27,7 @@ package sun.security.rsa; - - import java.util.*; - import java.security.Provider; -+import jdk.internal.access.SharedSecrets; - import static sun.security.util.SecurityProviderConstants.getAliases; - - /** -@@ -36,6 +37,10 @@ import static sun.security.util.SecurityProviderConstants.getAliases; - */ - public final class SunRsaSignEntries { - -+ private static final boolean systemFipsEnabled = -+ SharedSecrets.getJavaSecuritySystemConfiguratorAccess() -+ .isSystemFipsEnabled(); -+ - private void add(Provider p, String type, String algo, String cn, - List aliases, HashMap attrs) { - services.add(new Provider.Service(p, type, algo, cn, -@@ -63,42 +68,49 @@ public final class SunRsaSignEntries { - add(p, "KeyFactory", "RSA", - "sun.security.rsa.RSAKeyFactory$Legacy", - getAliases("PKCS1"), null); -- add(p, "KeyPairGenerator", "RSA", -- "sun.security.rsa.RSAKeyPairGenerator$Legacy", -- getAliases("PKCS1"), null); -- addA(p, "Signature", "MD2withRSA", -- "sun.security.rsa.RSASignature$MD2withRSA", attrs); -- addA(p, "Signature", "MD5withRSA", -- "sun.security.rsa.RSASignature$MD5withRSA", attrs); -- addA(p, "Signature", "SHA1withRSA", -- "sun.security.rsa.RSASignature$SHA1withRSA", attrs); -- addA(p, "Signature", "SHA224withRSA", -- "sun.security.rsa.RSASignature$SHA224withRSA", attrs); -- addA(p, "Signature", "SHA256withRSA", -- "sun.security.rsa.RSASignature$SHA256withRSA", attrs); -- addA(p, "Signature", "SHA384withRSA", -- "sun.security.rsa.RSASignature$SHA384withRSA", attrs); -- addA(p, "Signature", "SHA512withRSA", -- "sun.security.rsa.RSASignature$SHA512withRSA", attrs); -- addA(p, "Signature", "SHA512/224withRSA", -- "sun.security.rsa.RSASignature$SHA512_224withRSA", attrs); -- addA(p, "Signature", "SHA512/256withRSA", -- "sun.security.rsa.RSASignature$SHA512_256withRSA", attrs); -- addA(p, "Signature", "SHA3-224withRSA", -- "sun.security.rsa.RSASignature$SHA3_224withRSA", attrs); -- addA(p, "Signature", "SHA3-256withRSA", -- "sun.security.rsa.RSASignature$SHA3_256withRSA", attrs); -- addA(p, "Signature", "SHA3-384withRSA", -- "sun.security.rsa.RSASignature$SHA3_384withRSA", attrs); -- addA(p, "Signature", "SHA3-512withRSA", -- "sun.security.rsa.RSASignature$SHA3_512withRSA", attrs); -+ -+ if (!systemFipsEnabled) { -+ add(p, "KeyPairGenerator", "RSA", -+ "sun.security.rsa.RSAKeyPairGenerator$Legacy", -+ getAliases("PKCS1"), null); -+ addA(p, "Signature", "MD2withRSA", -+ "sun.security.rsa.RSASignature$MD2withRSA", attrs); -+ addA(p, "Signature", "MD5withRSA", -+ "sun.security.rsa.RSASignature$MD5withRSA", attrs); -+ addA(p, "Signature", "SHA1withRSA", -+ "sun.security.rsa.RSASignature$SHA1withRSA", attrs); -+ addA(p, "Signature", "SHA224withRSA", -+ "sun.security.rsa.RSASignature$SHA224withRSA", attrs); -+ addA(p, "Signature", "SHA256withRSA", -+ "sun.security.rsa.RSASignature$SHA256withRSA", attrs); -+ addA(p, "Signature", "SHA384withRSA", -+ "sun.security.rsa.RSASignature$SHA384withRSA", attrs); -+ addA(p, "Signature", "SHA512withRSA", -+ "sun.security.rsa.RSASignature$SHA512withRSA", attrs); -+ addA(p, "Signature", "SHA512/224withRSA", -+ "sun.security.rsa.RSASignature$SHA512_224withRSA", attrs); -+ addA(p, "Signature", "SHA512/256withRSA", -+ "sun.security.rsa.RSASignature$SHA512_256withRSA", attrs); -+ addA(p, "Signature", "SHA3-224withRSA", -+ "sun.security.rsa.RSASignature$SHA3_224withRSA", attrs); -+ addA(p, "Signature", "SHA3-256withRSA", -+ "sun.security.rsa.RSASignature$SHA3_256withRSA", attrs); -+ addA(p, "Signature", "SHA3-384withRSA", -+ "sun.security.rsa.RSASignature$SHA3_384withRSA", attrs); -+ addA(p, "Signature", "SHA3-512withRSA", -+ "sun.security.rsa.RSASignature$SHA3_512withRSA", attrs); -+ } - - addA(p, "KeyFactory", "RSASSA-PSS", - "sun.security.rsa.RSAKeyFactory$PSS", attrs); -- addA(p, "KeyPairGenerator", "RSASSA-PSS", -- "sun.security.rsa.RSAKeyPairGenerator$PSS", attrs); -- addA(p, "Signature", "RSASSA-PSS", -- "sun.security.rsa.RSAPSSSignature", attrs); -+ -+ if (!systemFipsEnabled) { -+ addA(p, "KeyPairGenerator", "RSASSA-PSS", -+ "sun.security.rsa.RSAKeyPairGenerator$PSS", attrs); -+ addA(p, "Signature", "RSASSA-PSS", -+ "sun.security.rsa.RSAPSSSignature", attrs); -+ } -+ - addA(p, "AlgorithmParameters", "RSASSA-PSS", - "sun.security.rsa.PSSParameters", null); - } -diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security -index f8b01a4ea1e..b325bf7e9fc 100644 ---- a/src/java.base/share/conf/security/java.security -+++ b/src/java.base/share/conf/security/java.security -@@ -85,6 +85,17 @@ security.provider.tbd=Apple - #endif - security.provider.tbd=SunPKCS11 - -+# -+# Security providers used when FIPS mode support is active -+# -+fips.provider.1=SunPKCS11 ${java.home}/conf/security/nss.fips.cfg -+fips.provider.2=SUN -+fips.provider.3=SunEC -+fips.provider.4=SunJSSE -+fips.provider.5=SunJCE -+fips.provider.6=SunRsaSign -+fips.provider.7=XMLDSig -+ - # - # A list of preferred providers for specific algorithms. These providers will - # be searched for matching algorithms before the list of registered providers. -@@ -295,6 +306,47 @@ policy.ignoreIdentityScope=false - # - keystore.type=pkcs12 - -+# -+# Default keystore type used when global crypto-policies are set to FIPS. -+# -+fips.keystore.type=pkcs12 -+ -+# -+# Location of the NSS DB keystore (PKCS11) in FIPS mode. -+# -+# The syntax for this property is identical to the 'nssSecmodDirectory' -+# attribute available in the SunPKCS11 NSS configuration file. Use the -+# 'sql:' prefix to refer to an SQLite DB. -+# -+# If the system property fips.nssdb.path is also specified, it supersedes -+# the security property value defined here. -+# -+# Note: the default value for this property points to an NSS DB that might be -+# readable by multiple operating system users and unsuitable to store keys. -+# -+fips.nssdb.path=sql:/etc/pki/nssdb -+ -+# -+# PIN for the NSS DB keystore (PKCS11) in FIPS mode. -+# -+# Values must take any of the following forms: -+# 1) pin: -+# Value: clear text PIN value. -+# 2) env: -+# Value: environment variable containing the PIN value. -+# 3) file: -+# Value: path to a file containing the PIN value in its first -+# line. -+# -+# If the system property fips.nssdb.pin is also specified, it supersedes -+# the security property value defined here. -+# -+# When used as a system property, UTF-8 encoded values are valid. When -+# used as a security property (such as in this file), encode non-Basic -+# Latin Unicode characters with \uXXXX. -+# -+fips.nssdb.pin=pin: -+ - # - # Controls compatibility mode for JKS and PKCS12 keystore types. - # -@@ -332,6 +384,13 @@ package.definition=sun.misc.,\ - # - security.overridePropertiesFile=true - -+# -+# Determines whether this properties file will be appended to -+# using the system properties file stored at -+# /etc/crypto-policies/back-ends/java.config -+# -+security.useSystemPropertiesFile=false -+ - # - # Determines the default key and trust manager factory algorithms for - # the javax.net.ssl package. -diff --git a/src/java.base/share/conf/security/nss.fips.cfg.in b/src/java.base/share/conf/security/nss.fips.cfg.in -new file mode 100644 -index 00000000000..55bbba98b7a ---- /dev/null -+++ b/src/java.base/share/conf/security/nss.fips.cfg.in -@@ -0,0 +1,8 @@ -+name = NSS-FIPS -+nssLibraryDirectory = @NSS_LIBDIR@ -+nssSecmodDirectory = ${fips.nssdb.path} -+nssDbMode = readWrite -+nssModule = fips -+ -+attributes(*,CKO_SECRET_KEY,CKK_GENERIC_SECRET)={ CKA_SIGN=true } -+ -diff --git a/src/java.base/share/lib/security/default.policy b/src/java.base/share/lib/security/default.policy -index 86d45147709..22fd8675503 100644 ---- a/src/java.base/share/lib/security/default.policy -+++ b/src/java.base/share/lib/security/default.policy -@@ -130,6 +130,7 @@ grant codeBase "jrt:/jdk.charsets" { - grant codeBase "jrt:/jdk.crypto.ec" { - permission java.lang.RuntimePermission - "accessClassInPackage.sun.security.*"; -+ permission java.lang.RuntimePermission "accessClassInPackage.jdk.internal.access"; - permission java.lang.RuntimePermission "loadLibrary.sunec"; - permission java.security.SecurityPermission "putProviderProperty.SunEC"; - permission java.security.SecurityPermission "clearProviderProperties.SunEC"; -@@ -150,6 +151,8 @@ grant codeBase "jrt:/jdk.crypto.cryptoki" { - permission java.util.PropertyPermission "os.name", "read"; - permission java.util.PropertyPermission "os.arch", "read"; - permission java.util.PropertyPermission "jdk.crypto.KeyAgreement.legacyKDF", "read"; -+ permission java.util.PropertyPermission "fips.nssdb.path", "read,write"; -+ permission java.util.PropertyPermission "fips.nssdb.pin", "read"; - permission java.security.SecurityPermission "putProviderProperty.*"; - permission java.security.SecurityPermission "clearProviderProperties.*"; - permission java.security.SecurityPermission "removeProviderProperty.*"; -diff --git a/src/java.base/share/native/libsystemconf/systemconf.c b/src/java.base/share/native/libsystemconf/systemconf.c -new file mode 100644 -index 00000000000..ddf9befe5bc ---- /dev/null -+++ b/src/java.base/share/native/libsystemconf/systemconf.c -@@ -0,0 +1,236 @@ -+/* -+ * Copyright (c) 2021, Red Hat, Inc. -+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. -+ * -+ * This code is free software; you can redistribute it and/or modify it -+ * under the terms of the GNU General Public License version 2 only, as -+ * published by the Free Software Foundation. Oracle designates this -+ * particular file as subject to the "Classpath" exception as provided -+ * by Oracle in the LICENSE file that accompanied this code. -+ * -+ * This code is distributed in the hope that it will be useful, but WITHOUT -+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -+ * version 2 for more details (a copy is included in the LICENSE file that -+ * accompanied this code). -+ * -+ * You should have received a copy of the GNU General Public License version -+ * 2 along with this work; if not, write to the Free Software Foundation, -+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. -+ * -+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA -+ * or visit www.oracle.com if you need additional information or have any -+ * questions. -+ */ -+ -+#include -+#include -+#include "jvm_md.h" -+#include -+ -+#ifdef LINUX -+ -+#ifdef SYSCONF_NSS -+#include -+#else -+#include -+#endif //SYSCONF_NSS -+ -+#include "java_security_SystemConfigurator.h" -+ -+#define MSG_MAX_SIZE 256 -+#define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled" -+ -+typedef int (SECMOD_GET_SYSTEM_FIPS_ENABLED_TYPE)(void); -+ -+static SECMOD_GET_SYSTEM_FIPS_ENABLED_TYPE *getSystemFIPSEnabled; -+static jmethodID debugPrintlnMethodID = NULL; -+static jobject debugObj = NULL; -+ -+static void dbgPrint(JNIEnv *env, const char* msg) -+{ -+ jstring jMsg; -+ if (debugObj != NULL) { -+ jMsg = (*env)->NewStringUTF(env, msg); -+ CHECK_NULL(jMsg); -+ (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg); -+ } -+} -+ -+static void throwIOException(JNIEnv *env, const char *msg) -+{ -+ jclass cls = (*env)->FindClass(env, "java/io/IOException"); -+ if (cls != 0) -+ (*env)->ThrowNew(env, cls, msg); -+} -+ -+static void handle_msg(JNIEnv *env, const char* msg, int msg_bytes) -+{ -+ if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) { -+ dbgPrint(env, msg); -+ } else { -+ dbgPrint(env, "systemconf: cannot render message"); -+ } -+} -+ -+// Only used when NSS is not linked at build time -+#ifndef SYSCONF_NSS -+ -+static void *nss_handle; -+ -+static jboolean loadNSS(JNIEnv *env) -+{ -+ char msg[MSG_MAX_SIZE]; -+ int msg_bytes; -+ const char* errmsg; -+ -+ nss_handle = dlopen(JNI_LIB_NAME("nss3"), RTLD_LAZY); -+ if (nss_handle == NULL) { -+ errmsg = dlerror(); -+ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "loadNSS: dlopen: %s\n", -+ errmsg); -+ handle_msg(env, msg, msg_bytes); -+ return JNI_FALSE; -+ } -+ dlerror(); /* Clear errors */ -+ getSystemFIPSEnabled = (SECMOD_GET_SYSTEM_FIPS_ENABLED_TYPE*)dlsym(nss_handle, "SECMOD_GetSystemFIPSEnabled"); -+ if ((errmsg = dlerror()) != NULL) { -+ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "loadNSS: dlsym: %s\n", -+ errmsg); -+ handle_msg(env, msg, msg_bytes); -+ return JNI_FALSE; -+ } -+ return JNI_TRUE; -+} -+ -+static void closeNSS(JNIEnv *env) -+{ -+ char msg[MSG_MAX_SIZE]; -+ int msg_bytes; -+ const char* errmsg; -+ -+ if (dlclose(nss_handle) != 0) { -+ errmsg = dlerror(); -+ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "closeNSS: dlclose: %s\n", -+ errmsg); -+ handle_msg(env, msg, msg_bytes); -+ } -+} -+ -+#endif -+ -+/* -+ * Class: java_security_SystemConfigurator -+ * Method: JNI_OnLoad -+ */ -+JNIEXPORT jint JNICALL DEF_JNI_OnLoad(JavaVM *vm, void *reserved) -+{ -+ JNIEnv *env; -+ jclass sysConfCls, debugCls; -+ jfieldID sdebugFld; -+ -+ if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) { -+ return JNI_EVERSION; /* JNI version not supported */ -+ } -+ -+ sysConfCls = (*env)->FindClass(env,"java/security/SystemConfigurator"); -+ if (sysConfCls == NULL) { -+ printf("libsystemconf: SystemConfigurator class not found\n"); -+ return JNI_ERR; -+ } -+ sdebugFld = (*env)->GetStaticFieldID(env, sysConfCls, -+ "sdebug", "Lsun/security/util/Debug;"); -+ if (sdebugFld == NULL) { -+ printf("libsystemconf: SystemConfigurator::sdebug field not found\n"); -+ return JNI_ERR; -+ } -+ debugObj = (*env)->GetStaticObjectField(env, sysConfCls, sdebugFld); -+ if (debugObj != NULL) { -+ debugCls = (*env)->FindClass(env,"sun/security/util/Debug"); -+ if (debugCls == NULL) { -+ printf("libsystemconf: Debug class not found\n"); -+ return JNI_ERR; -+ } -+ debugPrintlnMethodID = (*env)->GetMethodID(env, debugCls, -+ "println", "(Ljava/lang/String;)V"); -+ if (debugPrintlnMethodID == NULL) { -+ printf("libsystemconf: Debug::println(String) method not found\n"); -+ return JNI_ERR; -+ } -+ debugObj = (*env)->NewGlobalRef(env, debugObj); -+ } -+ -+#ifdef SYSCONF_NSS -+ getSystemFIPSEnabled = *SECMOD_GetSystemFIPSEnabled; -+#else -+ if (loadNSS(env) == JNI_FALSE) { -+ dbgPrint(env, "libsystemconf: Failed to load NSS library."); -+ } -+#endif -+ -+ return (*env)->GetVersion(env); -+} -+ -+/* -+ * Class: java_security_SystemConfigurator -+ * Method: JNI_OnUnload -+ */ -+JNIEXPORT void JNICALL DEF_JNI_OnUnload(JavaVM *vm, void *reserved) -+{ -+ JNIEnv *env; -+ -+ if (debugObj != NULL) { -+ if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) { -+ return; /* Should not happen */ -+ } -+#ifndef SYSCONF_NSS -+ closeNSS(env); -+#endif -+ (*env)->DeleteGlobalRef(env, debugObj); -+ } -+} -+ -+JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEnabled -+ (JNIEnv *env, jclass cls) -+{ -+ int fips_enabled; -+ char msg[MSG_MAX_SIZE]; -+ int msg_bytes; -+ -+ if (getSystemFIPSEnabled != NULL) { -+ dbgPrint(env, "getSystemFIPSEnabled: calling SECMOD_GetSystemFIPSEnabled"); -+ fips_enabled = (*getSystemFIPSEnabled)(); -+ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \ -+ " SECMOD_GetSystemFIPSEnabled returned 0x%x", fips_enabled); -+ handle_msg(env, msg, msg_bytes); -+ return (fips_enabled == 1 ? JNI_TRUE : JNI_FALSE); -+ } else { -+ FILE *fe; -+ -+ dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH); -+ if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) { -+ throwIOException(env, "Cannot open " FIPS_ENABLED_PATH); -+ return JNI_FALSE; -+ } -+ fips_enabled = fgetc(fe); -+ fclose(fe); -+ if (fips_enabled == EOF) { -+ throwIOException(env, "Cannot read " FIPS_ENABLED_PATH); -+ return JNI_FALSE; -+ } -+ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \ -+ " read character is '%c'", fips_enabled); -+ handle_msg(env, msg, msg_bytes); -+ return (fips_enabled == '1' ? JNI_TRUE : JNI_FALSE); -+ } -+} -+ -+#else // !LINUX -+ -+JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEnabled -+ (JNIEnv *env, jclass cls) -+{ -+ return JNI_FALSE; -+} -+ -+#endif -diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java -new file mode 100644 -index 00000000000..48d6d656a28 ---- /dev/null -+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java -@@ -0,0 +1,457 @@ -+/* -+ * Copyright (c) 2021, Red Hat, Inc. -+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. -+ * -+ * This code is free software; you can redistribute it and/or modify it -+ * under the terms of the GNU General Public License version 2 only, as -+ * published by the Free Software Foundation. Oracle designates this -+ * particular file as subject to the "Classpath" exception as provided -+ * by Oracle in the LICENSE file that accompanied this code. -+ * -+ * This code is distributed in the hope that it will be useful, but WITHOUT -+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -+ * version 2 for more details (a copy is included in the LICENSE file that -+ * accompanied this code). -+ * -+ * You should have received a copy of the GNU General Public License version -+ * 2 along with this work; if not, write to the Free Software Foundation, -+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. -+ * -+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA -+ * or visit www.oracle.com if you need additional information or have any -+ * questions. -+ */ -+ -+package sun.security.pkcs11; -+ -+import java.math.BigInteger; -+import java.security.KeyFactory; -+import java.security.Provider; -+import java.security.Security; -+import java.security.interfaces.RSAPrivateCrtKey; -+import java.security.interfaces.RSAPrivateKey; -+import java.util.HashMap; -+import java.util.Map; -+import java.util.concurrent.locks.ReentrantLock; -+ -+import javax.crypto.Cipher; -+import javax.crypto.SecretKeyFactory; -+import javax.crypto.spec.SecretKeySpec; -+import javax.crypto.spec.IvParameterSpec; -+ -+import sun.security.jca.JCAUtil; -+import sun.security.pkcs11.TemplateManager; -+import sun.security.pkcs11.wrapper.CK_ATTRIBUTE; -+import sun.security.pkcs11.wrapper.CK_MECHANISM; -+import static sun.security.pkcs11.wrapper.PKCS11Constants.*; -+import static sun.security.pkcs11.wrapper.PKCS11Exception.RV.*; -+import sun.security.pkcs11.wrapper.PKCS11Exception; -+import sun.security.rsa.RSAPrivateCrtKeyImpl; -+import sun.security.rsa.RSAUtil; -+import sun.security.rsa.RSAUtil.KeyType; -+import sun.security.util.Debug; -+import sun.security.util.ECUtil; -+ -+final class FIPSKeyImporter { -+ -+ private static final Debug debug = -+ Debug.getInstance("sunpkcs11"); -+ -+ private static volatile P11Key importerKey = null; -+ private static SecretKeySpec exporterKey = null; -+ private static volatile P11Key exporterKeyP11 = null; -+ private static final ReentrantLock importerKeyLock = new ReentrantLock(); -+ // Do not take the exporterKeyLock with the importerKeyLock held. -+ private static final ReentrantLock exporterKeyLock = new ReentrantLock(); -+ private static volatile CK_MECHANISM importerKeyMechanism = null; -+ private static volatile CK_MECHANISM exporterKeyMechanism = null; -+ private static Cipher importerCipher = null; -+ private static Cipher exporterCipher = null; -+ -+ private static volatile Provider sunECProvider = null; -+ private static final ReentrantLock sunECProviderLock = new ReentrantLock(); -+ -+ static Long importKey(SunPKCS11 sunPKCS11, long hSession, CK_ATTRIBUTE[] attributes) -+ throws PKCS11Exception { -+ long keyID = -1; -+ Token token = sunPKCS11.getToken(); -+ if (debug != null) { -+ debug.println("Private or Secret key will be imported in" + -+ " system FIPS mode."); -+ } -+ if (importerKey == null) { -+ importerKeyLock.lock(); -+ try { -+ if (importerKey == null) { -+ if (importerKeyMechanism == null) { -+ // Importer Key creation has not been tried yet. Try it. -+ createImporterKey(token); -+ } -+ if (importerKey == null || importerCipher == null) { -+ if (debug != null) { -+ debug.println("Importer Key could not be" + -+ " generated."); -+ } -+ throw new PKCS11Exception(CKR_GENERAL_ERROR, -+ " fips key importer"); -+ } -+ if (debug != null) { -+ debug.println("Importer Key successfully" + -+ " generated."); -+ } -+ } -+ } finally { -+ importerKeyLock.unlock(); -+ } -+ } -+ long importerKeyID = importerKey.getKeyID(); -+ try { -+ byte[] keyBytes = null; -+ byte[] encKeyBytes = null; -+ long keyClass = 0L; -+ long keyType = 0L; -+ Map attrsMap = new HashMap<>(); -+ for (CK_ATTRIBUTE attr : attributes) { -+ if (attr.type == CKA_CLASS) { -+ keyClass = attr.getLong(); -+ } else if (attr.type == CKA_KEY_TYPE) { -+ keyType = attr.getLong(); -+ } -+ attrsMap.put(attr.type, attr); -+ } -+ BigInteger v = null; -+ if (keyClass == CKO_PRIVATE_KEY) { -+ if (keyType == CKK_RSA) { -+ if (debug != null) { -+ debug.println("Importing an RSA private key..."); -+ } -+ keyBytes = sun.security.rsa.RSAPrivateCrtKeyImpl.newKey( -+ KeyType.RSA, -+ null, -+ ((v = attrsMap.get(CKA_MODULUS).getBigInteger()) != null) -+ ? v : BigInteger.ZERO, -+ ((v = attrsMap.get(CKA_PUBLIC_EXPONENT).getBigInteger()) != null) -+ ? v : BigInteger.ZERO, -+ ((v = attrsMap.get(CKA_PRIVATE_EXPONENT).getBigInteger()) != null) -+ ? v : BigInteger.ZERO, -+ ((v = attrsMap.get(CKA_PRIME_1).getBigInteger()) != null) -+ ? v : BigInteger.ZERO, -+ ((v = attrsMap.get(CKA_PRIME_2).getBigInteger()) != null) -+ ? v : BigInteger.ZERO, -+ ((v = attrsMap.get(CKA_EXPONENT_1).getBigInteger()) != null) -+ ? v : BigInteger.ZERO, -+ ((v = attrsMap.get(CKA_EXPONENT_2).getBigInteger()) != null) -+ ? v : BigInteger.ZERO, -+ ((v = attrsMap.get(CKA_COEFFICIENT).getBigInteger()) != null) -+ ? v : BigInteger.ZERO -+ ).getEncoded(); -+ } else if (keyType == CKK_DSA) { -+ if (debug != null) { -+ debug.println("Importing a DSA private key..."); -+ } -+ keyBytes = new sun.security.provider.DSAPrivateKey( -+ ((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null) -+ ? v : BigInteger.ZERO, -+ ((v = attrsMap.get(CKA_PRIME).getBigInteger()) != null) -+ ? v : BigInteger.ZERO, -+ ((v = attrsMap.get(CKA_SUBPRIME).getBigInteger()) != null) -+ ? v : BigInteger.ZERO, -+ ((v = attrsMap.get(CKA_BASE).getBigInteger()) != null) -+ ? v : BigInteger.ZERO -+ ).getEncoded(); -+ if (token.config.getNssNetscapeDbWorkaround() && -+ attrsMap.get(CKA_NETSCAPE_DB) == null) { -+ attrsMap.put(CKA_NETSCAPE_DB, -+ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO)); -+ } -+ } else if (keyType == CKK_EC) { -+ if (debug != null) { -+ debug.println("Importing an EC private key..."); -+ } -+ if (sunECProvider == null) { -+ sunECProviderLock.lock(); -+ try { -+ if (sunECProvider == null) { -+ sunECProvider = Security.getProvider("SunEC"); -+ } -+ } finally { -+ sunECProviderLock.unlock(); -+ } -+ } -+ keyBytes = ECUtil.generateECPrivateKey( -+ ((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null) -+ ? v : BigInteger.ZERO, -+ ECUtil.getECParameterSpec(sunECProvider, -+ attrsMap.get(CKA_EC_PARAMS).getByteArray())) -+ .getEncoded(); -+ if (token.config.getNssNetscapeDbWorkaround() && -+ attrsMap.get(CKA_NETSCAPE_DB) == null) { -+ attrsMap.put(CKA_NETSCAPE_DB, -+ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO)); -+ } -+ } else { -+ if (debug != null) { -+ debug.println("Unrecognized private key type."); -+ } -+ throw new PKCS11Exception(CKR_GENERAL_ERROR, -+ " fips key importer"); -+ } -+ } else if (keyClass == CKO_SECRET_KEY) { -+ if (debug != null) { -+ debug.println("Importing a secret key..."); -+ } -+ keyBytes = attrsMap.get(CKA_VALUE).getByteArray(); -+ } -+ if (keyBytes == null || keyBytes.length == 0) { -+ if (debug != null) { -+ debug.println("Private or secret key plain bytes could" + -+ " not be obtained. Import failed."); -+ } -+ throw new PKCS11Exception(CKR_GENERAL_ERROR, -+ " fips key importer"); -+ } -+ attributes = new CK_ATTRIBUTE[attrsMap.size()]; -+ attrsMap.values().toArray(attributes); -+ importerKeyLock.lock(); -+ try { -+ // No need to reset the cipher object because no multi-part -+ // operations are performed. -+ encKeyBytes = importerCipher.doFinal(keyBytes); -+ } finally { -+ importerKeyLock.unlock(); -+ } -+ attributes = token.getAttributes(TemplateManager.O_IMPORT, -+ keyClass, keyType, attributes); -+ keyID = token.p11.C_UnwrapKey(hSession, -+ importerKeyMechanism, importerKeyID, encKeyBytes, attributes); -+ if (debug != null) { -+ debug.println("Imported key ID: " + keyID); -+ } -+ } catch (Throwable t) { -+ if (t instanceof PKCS11Exception) { -+ throw (PKCS11Exception)t; -+ } -+ throw new PKCS11Exception(CKR_GENERAL_ERROR, -+ t.getMessage()); -+ } finally { -+ importerKey.releaseKeyID(); -+ } -+ return Long.valueOf(keyID); -+ } -+ -+ static void exportKey(SunPKCS11 sunPKCS11, long hSession, long hObject, -+ long keyClass, long keyType, Map sensitiveAttrs) -+ throws PKCS11Exception { -+ Token token = sunPKCS11.getToken(); -+ if (debug != null) { -+ debug.println("Private or Secret key will be exported in" + -+ " system FIPS mode."); -+ } -+ if (exporterKeyP11 == null) { -+ try { -+ exporterKeyLock.lock(); -+ if (exporterKeyP11 == null) { -+ if (exporterKeyMechanism == null) { -+ // Exporter Key creation has not been tried yet. Try it. -+ createExporterKey(token); -+ } -+ if (exporterKeyP11 == null || exporterCipher == null) { -+ if (debug != null) { -+ debug.println("Exporter Key could not be" + -+ " generated."); -+ } -+ throw new PKCS11Exception(CKR_GENERAL_ERROR, -+ " fips key exporter"); -+ } -+ if (debug != null) { -+ debug.println("Exporter Key successfully" + -+ " generated."); -+ } -+ } -+ } finally { -+ exporterKeyLock.unlock(); -+ } -+ } -+ long exporterKeyID = exporterKeyP11.getKeyID(); -+ try { -+ byte[] wrappedKeyBytes = token.p11.C_WrapKey(hSession, -+ exporterKeyMechanism, exporterKeyID, hObject); -+ byte[] plainExportedKey = null; -+ exporterKeyLock.lock(); -+ try { -+ // No need to reset the cipher object because no multi-part -+ // operations are performed. -+ plainExportedKey = exporterCipher.doFinal(wrappedKeyBytes); -+ } finally { -+ exporterKeyLock.unlock(); -+ } -+ if (keyClass == CKO_PRIVATE_KEY) { -+ exportPrivateKey(sensitiveAttrs, keyType, plainExportedKey); -+ } else if (keyClass == CKO_SECRET_KEY) { -+ checkAttrs(sensitiveAttrs, "CKO_SECRET_KEY", CKA_VALUE); -+ // CKA_VALUE is guaranteed to be present, since sensitiveAttrs' -+ // size is greater than 0 and no invalid attributes exist -+ sensitiveAttrs.get(CKA_VALUE).pValue = plainExportedKey; -+ } else { -+ throw new PKCS11Exception(CKR_GENERAL_ERROR, -+ " fips key exporter"); -+ } -+ } catch (Throwable t) { -+ if (t instanceof PKCS11Exception) { -+ throw (PKCS11Exception)t; -+ } -+ throw new PKCS11Exception(CKR_GENERAL_ERROR, -+ t.getMessage()); -+ } finally { -+ exporterKeyP11.releaseKeyID(); -+ } -+ } -+ -+ private static void exportPrivateKey( -+ Map sensitiveAttrs, long keyType, -+ byte[] plainExportedKey) throws Throwable { -+ if (keyType == CKK_RSA) { -+ checkAttrs(sensitiveAttrs, "CKO_PRIVATE_KEY CKK_RSA", -+ CKA_PRIVATE_EXPONENT, CKA_PRIME_1, CKA_PRIME_2, -+ CKA_EXPONENT_1, CKA_EXPONENT_2, CKA_COEFFICIENT); -+ RSAPrivateKey rsaPKey = RSAPrivateCrtKeyImpl.newKey( -+ RSAUtil.KeyType.RSA, "PKCS#8", plainExportedKey); -+ CK_ATTRIBUTE attr; -+ if ((attr = sensitiveAttrs.get(CKA_PRIVATE_EXPONENT)) != null) { -+ attr.pValue = rsaPKey.getPrivateExponent().toByteArray(); -+ } -+ if (rsaPKey instanceof RSAPrivateCrtKey) { -+ RSAPrivateCrtKey rsaPCrtKey = (RSAPrivateCrtKey) rsaPKey; -+ if ((attr = sensitiveAttrs.get(CKA_PRIME_1)) != null) { -+ attr.pValue = rsaPCrtKey.getPrimeP().toByteArray(); -+ } -+ if ((attr = sensitiveAttrs.get(CKA_PRIME_2)) != null) { -+ attr.pValue = rsaPCrtKey.getPrimeQ().toByteArray(); -+ } -+ if ((attr = sensitiveAttrs.get(CKA_EXPONENT_1)) != null) { -+ attr.pValue = rsaPCrtKey.getPrimeExponentP().toByteArray(); -+ } -+ if ((attr = sensitiveAttrs.get(CKA_EXPONENT_2)) != null) { -+ attr.pValue = rsaPCrtKey.getPrimeExponentQ().toByteArray(); -+ } -+ if ((attr = sensitiveAttrs.get(CKA_COEFFICIENT)) != null) { -+ attr.pValue = rsaPCrtKey.getCrtCoefficient().toByteArray(); -+ } -+ } else { -+ checkAttrs(sensitiveAttrs, "CKO_PRIVATE_KEY CKK_RSA", -+ CKA_PRIVATE_EXPONENT); -+ } -+ } else if (keyType == CKK_DSA) { -+ checkAttrs(sensitiveAttrs, "CKO_PRIVATE_KEY CKK_DSA", CKA_VALUE); -+ // CKA_VALUE is guaranteed to be present, since sensitiveAttrs' -+ // size is greater than 0 and no invalid attributes exist -+ sensitiveAttrs.get(CKA_VALUE).pValue = -+ new sun.security.provider.DSAPrivateKey(plainExportedKey) -+ .getX().toByteArray(); -+ } else if (keyType == CKK_EC) { -+ checkAttrs(sensitiveAttrs, "CKO_PRIVATE_KEY CKK_EC", CKA_VALUE); -+ // CKA_VALUE is guaranteed to be present, since sensitiveAttrs' -+ // size is greater than 0 and no invalid attributes exist -+ sensitiveAttrs.get(CKA_VALUE).pValue = -+ ECUtil.decodePKCS8ECPrivateKey(plainExportedKey) -+ .getS().toByteArray(); -+ } else { -+ throw new PKCS11Exception(CKR_GENERAL_ERROR, -+ " unsupported CKO_PRIVATE_KEY key type: " + keyType); -+ } -+ } -+ -+ private static void checkAttrs(Map sensitiveAttrs, -+ String keyName, long... validAttrs) -+ throws PKCS11Exception { -+ int sensitiveAttrsCount = sensitiveAttrs.size(); -+ if (sensitiveAttrsCount <= validAttrs.length) { -+ int validAttrsCount = 0; -+ for (long validAttr : validAttrs) { -+ if (sensitiveAttrs.containsKey(validAttr)) validAttrsCount++; -+ } -+ if (validAttrsCount == sensitiveAttrsCount) return; -+ } -+ throw new PKCS11Exception(CKR_GENERAL_ERROR, -+ " invalid attribute types for a " + keyName + " key object"); -+ } -+ -+ private static void createImporterKey(Token token) { -+ if (debug != null) { -+ debug.println("Generating Importer Key..."); -+ } -+ byte[] iv = new byte[16]; -+ JCAUtil.getSecureRandom().nextBytes(iv); -+ importerKeyMechanism = new CK_MECHANISM(CKM_AES_CBC_PAD, iv); -+ try { -+ CK_ATTRIBUTE[] attributes = token.getAttributes(TemplateManager.O_GENERATE, -+ CKO_SECRET_KEY, CKK_AES, new CK_ATTRIBUTE[] { -+ new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY), -+ new CK_ATTRIBUTE(CKA_VALUE_LEN, 256 >> 3)}); -+ Session s = null; -+ try { -+ s = token.getObjSession(); -+ long keyID = token.p11.C_GenerateKey( -+ s.id(), new CK_MECHANISM(CKM_AES_KEY_GEN), -+ attributes); -+ if (debug != null) { -+ debug.println("Importer Key ID: " + keyID); -+ } -+ importerKey = (P11Key)P11Key.secretKey(s, keyID, "AES", -+ 256 >> 3, null); -+ } catch (PKCS11Exception e) { -+ // best effort -+ } finally { -+ token.releaseSession(s); -+ } -+ if (importerKey != null) { -+ importerCipher = Cipher.getInstance("AES/CBC/PKCS5Padding"); -+ importerCipher.init(Cipher.ENCRYPT_MODE, importerKey, -+ new IvParameterSpec( -+ (byte[])importerKeyMechanism.pParameter), null); -+ } -+ } catch (Throwable t) { -+ // best effort -+ importerKey = null; -+ importerCipher = null; -+ // importerKeyMechanism value is kept initialized to indicate that -+ // Importer Key creation has been tried and failed. -+ if (debug != null) { -+ debug.println("Error generating the Importer Key"); -+ } -+ } -+ } -+ -+ private static void createExporterKey(Token token) { -+ if (debug != null) { -+ debug.println("Generating Exporter Key..."); -+ } -+ byte[] iv = new byte[16]; -+ JCAUtil.getSecureRandom().nextBytes(iv); -+ exporterKeyMechanism = new CK_MECHANISM(CKM_AES_CBC_PAD, iv); -+ byte[] exporterKeyRaw = new byte[32]; -+ JCAUtil.getSecureRandom().nextBytes(exporterKeyRaw); -+ exporterKey = new SecretKeySpec(exporterKeyRaw, "AES"); -+ try { -+ SecretKeyFactory skf = SecretKeyFactory.getInstance("AES"); -+ exporterKeyP11 = (P11Key)(skf.translateKey(exporterKey)); -+ if (exporterKeyP11 != null) { -+ exporterCipher = Cipher.getInstance("AES/CBC/PKCS5Padding"); -+ exporterCipher.init(Cipher.DECRYPT_MODE, exporterKey, -+ new IvParameterSpec( -+ (byte[])exporterKeyMechanism.pParameter), null); -+ } -+ } catch (Throwable t) { -+ // best effort -+ exporterKey = null; -+ exporterKeyP11 = null; -+ exporterCipher = null; -+ // exporterKeyMechanism value is kept initialized to indicate that -+ // Exporter Key creation has been tried and failed. -+ if (debug != null) { -+ debug.println("Error generating the Exporter Key"); -+ } -+ } -+ } -+} -diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSTokenLoginHandler.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSTokenLoginHandler.java -new file mode 100644 -index 00000000000..f8d505ca815 ---- /dev/null -+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSTokenLoginHandler.java -@@ -0,0 +1,149 @@ -+/* -+ * Copyright (c) 2022, Red Hat, Inc. -+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. -+ * -+ * This code is free software; you can redistribute it and/or modify it -+ * under the terms of the GNU General Public License version 2 only, as -+ * published by the Free Software Foundation. Oracle designates this -+ * particular file as subject to the "Classpath" exception as provided -+ * by Oracle in the LICENSE file that accompanied this code. -+ * -+ * This code is distributed in the hope that it will be useful, but WITHOUT -+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -+ * version 2 for more details (a copy is included in the LICENSE file that -+ * accompanied this code). -+ * -+ * You should have received a copy of the GNU General Public License version -+ * 2 along with this work; if not, write to the Free Software Foundation, -+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. -+ * -+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA -+ * or visit www.oracle.com if you need additional information or have any -+ * questions. -+ */ -+ -+package sun.security.pkcs11; -+ -+import java.io.BufferedReader; -+import java.io.ByteArrayInputStream; -+import java.io.InputStream; -+import java.io.InputStreamReader; -+import java.io.IOException; -+import java.nio.charset.StandardCharsets; -+import java.nio.file.Files; -+import java.nio.file.Path; -+import java.nio.file.Paths; -+import java.nio.file.StandardOpenOption; -+import java.security.ProviderException; -+ -+import javax.security.auth.callback.Callback; -+import javax.security.auth.callback.CallbackHandler; -+import javax.security.auth.callback.PasswordCallback; -+import javax.security.auth.callback.UnsupportedCallbackException; -+ -+import sun.security.util.Debug; -+import sun.security.util.SecurityProperties; -+ -+final class FIPSTokenLoginHandler implements CallbackHandler { -+ -+ private static final String FIPS_NSSDB_PIN_PROP = "fips.nssdb.pin"; -+ -+ private static final Debug debug = Debug.getInstance("sunpkcs11"); -+ -+ public void handle(Callback[] callbacks) -+ throws IOException, UnsupportedCallbackException { -+ if (!(callbacks[0] instanceof PasswordCallback)) { -+ throw new UnsupportedCallbackException(callbacks[0]); -+ } -+ PasswordCallback pc = (PasswordCallback)callbacks[0]; -+ pc.setPassword(getFipsNssdbPin()); -+ } -+ -+ private static char[] getFipsNssdbPin() throws ProviderException { -+ if (debug != null) { -+ debug.println("FIPS: Reading NSS DB PIN for token..."); -+ } -+ String pinProp = SecurityProperties -+ .privilegedGetOverridable(FIPS_NSSDB_PIN_PROP); -+ if (pinProp != null && !pinProp.isEmpty()) { -+ String[] pinPropParts = pinProp.split(":", 2); -+ if (pinPropParts.length < 2) { -+ throw new ProviderException("Invalid " + FIPS_NSSDB_PIN_PROP + -+ " property value."); -+ } -+ String prefix = pinPropParts[0].toLowerCase(); -+ String value = pinPropParts[1]; -+ String pin = null; -+ if (prefix.equals("env")) { -+ if (debug != null) { -+ debug.println("FIPS: PIN value from the '" + value + -+ "' environment variable."); -+ } -+ pin = System.getenv(value); -+ } else if (prefix.equals("file")) { -+ if (debug != null) { -+ debug.println("FIPS: PIN value from the '" + value + -+ "' file."); -+ } -+ pin = getPinFromFile(Paths.get(value)); -+ } else if (prefix.equals("pin")) { -+ if (debug != null) { -+ debug.println("FIPS: PIN value from the " + -+ FIPS_NSSDB_PIN_PROP + " property."); -+ } -+ pin = value; -+ } else { -+ throw new ProviderException("Unsupported prefix for " + -+ FIPS_NSSDB_PIN_PROP + "."); -+ } -+ if (pin != null && !pin.isEmpty()) { -+ if (debug != null) { -+ debug.println("FIPS: non-empty PIN."); -+ } -+ /* -+ * C_Login in libj2pkcs11 receives the PIN in a char[] and -+ * discards the upper byte of each char, before passing -+ * the value to the NSS Software Token. However, the -+ * NSS Software Token accepts any UTF-8 PIN value. Thus, -+ * expand the PIN here to account for later truncation. -+ */ -+ byte[] pinUtf8 = pin.getBytes(StandardCharsets.UTF_8); -+ char[] pinChar = new char[pinUtf8.length]; -+ for (int i = 0; i < pinChar.length; i++) { -+ pinChar[i] = (char)(pinUtf8[i] & 0xFF); -+ } -+ return pinChar; -+ } -+ } -+ if (debug != null) { -+ debug.println("FIPS: empty PIN."); -+ } -+ return null; -+ } -+ -+ /* -+ * This method extracts the token PIN from the first line of a password -+ * file in the same way as NSS modutil. See for example the -newpwfile -+ * argument used to change the password for an NSS DB. -+ */ -+ private static String getPinFromFile(Path f) throws ProviderException { -+ try (InputStream is = -+ Files.newInputStream(f, StandardOpenOption.READ)) { -+ /* -+ * SECU_FilePasswd in NSS (nss/cmd/lib/secutil.c), used by modutil, -+ * reads up to 4096 bytes. In addition, the NSS Software Token -+ * does not accept PINs longer than 500 bytes (see SFTK_MAX_PIN -+ * in nss/lib/softoken/pkcs11i.h). -+ */ -+ BufferedReader in = -+ new BufferedReader(new InputStreamReader( -+ new ByteArrayInputStream(is.readNBytes(4096)), -+ StandardCharsets.UTF_8)); -+ return in.readLine(); -+ } catch (IOException ioe) { -+ throw new ProviderException("Error reading " + FIPS_NSSDB_PIN_PROP + -+ " from the '" + f + "' file.", ioe); -+ } -+ } -+} -\ No newline at end of file -diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java -index 01fc06ae283..e3ca000d309 100644 ---- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java -+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java -@@ -37,6 +37,8 @@ import javax.crypto.*; - import javax.crypto.interfaces.*; - import javax.crypto.spec.*; - -+import jdk.internal.access.SharedSecrets; -+ - import sun.security.rsa.RSAUtil.KeyType; - import sun.security.rsa.RSAPublicKeyImpl; - import sun.security.rsa.RSAPrivateCrtKeyImpl; -@@ -72,6 +74,9 @@ abstract class P11Key implements Key, Length { - @Serial - private static final long serialVersionUID = -2575874101938349339L; - -+ private static final boolean plainKeySupportEnabled = SharedSecrets -+ .getJavaSecuritySystemConfiguratorAccess().isPlainKeySupportEnabled(); -+ - private static final String PUBLIC = "public"; - private static final String PRIVATE = "private"; - private static final String SECRET = "secret"; -@@ -414,9 +419,10 @@ abstract class P11Key implements Key, Length { - new CK_ATTRIBUTE(CKA_EXTRACTABLE), - }); - -- boolean keySensitive = -- (attrs[0].getBoolean() && P11Util.isNSS(session.token)) || -- attrs[1].getBoolean() || !attrs[2].getBoolean(); -+ boolean exportable = plainKeySupportEnabled && !algorithm.equals("DH"); -+ boolean keySensitive = (!exportable && -+ ((attrs[0].getBoolean() && P11Util.isNSS(session.token)) || -+ attrs[1].getBoolean() || !attrs[2].getBoolean())); - - return switch (algorithm) { - case "RSA" -> P11RSAPrivateKeyInternal.of(session, keyID, algorithm, -@@ -468,7 +474,8 @@ abstract class P11Key implements Key, Length { - - public String getFormat() { - token.ensureValid(); -- if (sensitive || !extractable || (isNSS && tokenObject)) { -+ if (!plainKeySupportEnabled && -+ (sensitive || !extractable || (isNSS && tokenObject))) { - return null; - } else { - return "RAW"; -@@ -1638,4 +1645,3 @@ final class SessionKeyRef extends PhantomReference { - this.clear(); - } - } -- -diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java -index 0a62021633f..0723b69c2bc 100644 ---- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java -+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java -@@ -26,6 +26,9 @@ - package sun.security.pkcs11; - - import java.io.*; -+import java.lang.invoke.MethodHandle; -+import java.lang.invoke.MethodHandles; -+import java.lang.invoke.MethodType; - import java.util.*; - import java.util.stream.Collectors; - import java.security.*; -@@ -42,10 +45,12 @@ import javax.security.auth.callback.PasswordCallback; - - import com.sun.crypto.provider.ChaCha20Poly1305Parameters; - -+import jdk.internal.access.SharedSecrets; - import jdk.internal.misc.InnocuousThread; - import sun.security.util.Debug; - import sun.security.util.ResourcesMgr; - import static sun.security.util.SecurityConstants.PROVIDER_VER; -+import sun.security.util.SecurityProperties; - import static sun.security.util.SecurityProviderConstants.getAliases; - - import sun.security.pkcs11.Secmod.*; -@@ -65,6 +70,39 @@ public final class SunPKCS11 extends AuthProvider { - @Serial - private static final long serialVersionUID = -1354835039035306505L; - -+ private static final boolean systemFipsEnabled = SharedSecrets -+ .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled(); -+ -+ private static final boolean plainKeySupportEnabled = SharedSecrets -+ .getJavaSecuritySystemConfiguratorAccess().isPlainKeySupportEnabled(); -+ -+ private static final MethodHandle fipsImportKey; -+ private static final MethodHandle fipsExportKey; -+ static { -+ MethodHandle fipsImportKeyTmp = null; -+ MethodHandle fipsExportKeyTmp = null; -+ if (plainKeySupportEnabled) { -+ try { -+ fipsImportKeyTmp = MethodHandles.lookup().findStatic( -+ FIPSKeyImporter.class, "importKey", -+ MethodType.methodType(Long.class, SunPKCS11.class, -+ long.class, CK_ATTRIBUTE[].class)); -+ fipsExportKeyTmp = MethodHandles.lookup().findStatic( -+ FIPSKeyImporter.class, "exportKey", -+ MethodType.methodType(void.class, SunPKCS11.class, -+ long.class, long.class, -+ long.class, long.class, Map.class)); -+ } catch (Throwable t) { -+ throw new SecurityException("FIPS key importer-exporter" + -+ " initialization failed", t); -+ } -+ } -+ fipsImportKey = fipsImportKeyTmp; -+ fipsExportKey = fipsExportKeyTmp; -+ } -+ -+ private static final String FIPS_NSSDB_PATH_PROP = "fips.nssdb.path"; -+ - static final Debug debug = Debug.getInstance("sunpkcs11"); - // the PKCS11 object through which we make the native calls - @SuppressWarnings("serial") // Type of field is not Serializable; -@@ -123,6 +161,29 @@ public final class SunPKCS11 extends AuthProvider { - return AccessController.doPrivileged(new PrivilegedExceptionAction<>() { - @Override - public SunPKCS11 run() throws Exception { -+ if (systemFipsEnabled) { -+ /* -+ * The nssSecmodDirectory attribute in the SunPKCS11 -+ * NSS configuration file takes the value of the -+ * fips.nssdb.path System property after expansion. -+ * Security properties expansion is unsupported. -+ */ -+ String nssdbPath = -+ SecurityProperties.privilegedGetOverridable( -+ FIPS_NSSDB_PATH_PROP); -+ if (System.getSecurityManager() != null) { -+ AccessController.doPrivileged( -+ (PrivilegedAction) () -> { -+ System.setProperty( -+ FIPS_NSSDB_PATH_PROP, -+ nssdbPath); -+ return null; -+ }); -+ } else { -+ System.setProperty( -+ FIPS_NSSDB_PATH_PROP, nssdbPath); -+ } -+ } - return new SunPKCS11(new Config(newConfigName)); - } - }); -@@ -325,9 +386,19 @@ public final class SunPKCS11 extends AuthProvider { - // request multithreaded access first - initArgs.flags = CKF_OS_LOCKING_OK; - PKCS11 tmpPKCS11; -+ MethodHandle fipsKeyImporter = null; -+ MethodHandle fipsKeyExporter = null; -+ if (plainKeySupportEnabled) { -+ fipsKeyImporter = MethodHandles.insertArguments( -+ fipsImportKey, 0, this); -+ fipsKeyExporter = MethodHandles.insertArguments( -+ fipsExportKey, 0, this); -+ } - try { -- tmpPKCS11 = PKCS11.getInstance(library, functionList, initArgs, -- config.getOmitInitialize()); -+ tmpPKCS11 = PKCS11.getInstance( -+ library, functionList, initArgs, -+ config.getOmitInitialize(), fipsKeyImporter, -+ fipsKeyExporter); - } catch (PKCS11Exception e) { - if (debug != null) { - debug.println("Multi-threaded initialization failed: " + e); -@@ -342,8 +413,9 @@ public final class SunPKCS11 extends AuthProvider { - } else { - initArgs.flags = 0; - } -- tmpPKCS11 = PKCS11.getInstance(library, functionList, initArgs, -- config.getOmitInitialize()); -+ tmpPKCS11 = PKCS11.getInstance(library, -+ functionList, initArgs, config.getOmitInitialize(), fipsKeyImporter, -+ fipsKeyExporter); - } - p11 = tmpPKCS11; - -@@ -1388,11 +1460,52 @@ public final class SunPKCS11 extends AuthProvider { - } - - @Override -+ @SuppressWarnings("removal") - public Object newInstance(Object param) - throws NoSuchAlgorithmException { - if (!token.isValid()) { - throw new NoSuchAlgorithmException("Token has been removed"); - } -+ if (systemFipsEnabled && !token.fipsLoggedIn && -+ !getType().equals("KeyStore")) { -+ /* -+ * The NSS Software Token in FIPS 140-2 mode requires a -+ * user login for most operations. See sftk_fipsCheck -+ * (nss/lib/softoken/fipstokn.c). In case of a KeyStore -+ * service, let the caller perform the login with -+ * KeyStore::load. Keytool, for example, does this to pass a -+ * PIN from either the -srcstorepass or -deststorepass -+ * argument. In case of a non-KeyStore service, perform the -+ * login now with the PIN available in the fips.nssdb.pin -+ * property. -+ */ -+ try { -+ if (System.getSecurityManager() != null) { -+ try { -+ AccessController.doPrivileged( -+ (PrivilegedExceptionAction) () -> { -+ token.ensureLoggedIn(null); -+ return null; -+ }); -+ } catch (PrivilegedActionException pae) { -+ Exception e = pae.getException(); -+ if (e instanceof LoginException le) { -+ throw le; -+ } else if (e instanceof PKCS11Exception p11e) { -+ throw p11e; -+ } else { -+ throw new RuntimeException(e); -+ } -+ } -+ } else { -+ token.ensureLoggedIn(null); -+ } -+ } catch (PKCS11Exception | LoginException e) { -+ throw new ProviderException("FIPS: error during the Token" + -+ " login required for the " + getType() + -+ " service.", e); -+ } -+ } - try { - return newInstance0(param); - } catch (PKCS11Exception e) { -@@ -1749,6 +1862,9 @@ public final class SunPKCS11 extends AuthProvider { - try { - session = token.getOpSession(); - p11.C_Logout(session.id()); -+ if (systemFipsEnabled) { -+ token.fipsLoggedIn = false; -+ } - if (debug != null) { - debug.println("logout succeeded"); - } -diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java -index a6f5f0a8764..9a07c96ca4e 100644 ---- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java -+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java -@@ -33,6 +33,7 @@ import java.lang.ref.*; - import java.security.*; - import javax.security.auth.login.LoginException; - -+import jdk.internal.access.SharedSecrets; - import sun.security.jca.JCAUtil; - - import sun.security.pkcs11.wrapper.*; -@@ -48,6 +49,9 @@ import static sun.security.pkcs11.wrapper.PKCS11Exception.RV.*; - */ - final class Token implements Serializable { - -+ private static final boolean systemFipsEnabled = SharedSecrets -+ .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled(); -+ - // need to be serializable to allow SecureRandom to be serialized - @Serial - private static final long serialVersionUID = 2541527649100571747L; -@@ -125,6 +129,10 @@ final class Token implements Serializable { - // flag indicating whether we are logged in - private volatile boolean loggedIn; - -+ // Flag indicating the login status for the NSS Software Token in FIPS mode. -+ // This Token is never asynchronously removed. Used from SunPKCS11. -+ volatile boolean fipsLoggedIn; -+ - // time we last checked login status - private long lastLoginCheck; - -@@ -242,7 +250,12 @@ final class Token implements Serializable { - // call provider.login() if not - void ensureLoggedIn(Session session) throws PKCS11Exception, LoginException { - if (!isLoggedIn(session)) { -- provider.login(null, null); -+ if (systemFipsEnabled) { -+ provider.login(null, new FIPSTokenLoginHandler()); -+ fipsLoggedIn = true; -+ } else { -+ provider.login(null, null); -+ } - } - } - -diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java -index 0fd13fd6fa6..3c959c942a1 100644 ---- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java -+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java -@@ -49,6 +49,9 @@ package sun.security.pkcs11.wrapper; - - import java.io.File; - import java.io.IOException; -+import java.lang.invoke.MethodHandle; -+import java.lang.invoke.MethodHandles; -+import java.lang.invoke.MethodType; - import java.util.*; - - import java.security.AccessController; -@@ -174,18 +177,43 @@ public class PKCS11 { - return version; - } - -+ /* -+ * Compatibility wrapper to allow this method to work as before -+ * when FIPS mode support is not active. -+ */ -+ public static synchronized PKCS11 getInstance(String pkcs11ModulePath, -+ String functionList, CK_C_INITIALIZE_ARGS pInitArgs, -+ boolean omitInitialize) throws IOException, PKCS11Exception { -+ return getInstance(pkcs11ModulePath, functionList, -+ pInitArgs, omitInitialize, null, null); -+ } -+ - public static synchronized PKCS11 getInstance(String pkcs11ModulePath, - String functionList, CK_C_INITIALIZE_ARGS pInitArgs, -- boolean omitInitialize) throws IOException, PKCS11Exception { -+ boolean omitInitialize, MethodHandle fipsKeyImporter, -+ MethodHandle fipsKeyExporter) -+ throws IOException, PKCS11Exception { - // we may only call C_Initialize once per native .so/.dll - // so keep a cache using the (non-canonicalized!) path - PKCS11 pkcs11 = moduleMap.get(pkcs11ModulePath); - if (pkcs11 == null) { -+ boolean nssFipsMode = fipsKeyImporter != null && -+ fipsKeyExporter != null; - if ((pInitArgs != null) - && ((pInitArgs.flags & CKF_OS_LOCKING_OK) != 0)) { -- pkcs11 = new PKCS11(pkcs11ModulePath, functionList); -+ if (nssFipsMode) { -+ pkcs11 = new FIPSPKCS11(pkcs11ModulePath, functionList, -+ fipsKeyImporter, fipsKeyExporter); -+ } else { -+ pkcs11 = new PKCS11(pkcs11ModulePath, functionList); -+ } - } else { -- pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList); -+ if (nssFipsMode) { -+ pkcs11 = new SynchronizedFIPSPKCS11(pkcs11ModulePath, -+ functionList, fipsKeyImporter, fipsKeyExporter); -+ } else { -+ pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList); -+ } - } - if (omitInitialize == false) { - try { -@@ -2012,4 +2040,194 @@ static class SynchronizedPKCS11 extends PKCS11 { - super.C_GenerateRandom(hSession, randomData); - } - } -+ -+// PKCS11 subclass that allows using plain private or secret keys in -+// FIPS-configured NSS Software Tokens. Only used when System FIPS -+// is enabled. -+static class FIPSPKCS11 extends PKCS11 { -+ private MethodHandle fipsKeyImporter; -+ private MethodHandle fipsKeyExporter; -+ private MethodHandle hC_GetAttributeValue; -+ FIPSPKCS11(String pkcs11ModulePath, String functionListName, -+ MethodHandle fipsKeyImporter, MethodHandle fipsKeyExporter) -+ throws IOException { -+ super(pkcs11ModulePath, functionListName); -+ this.fipsKeyImporter = fipsKeyImporter; -+ this.fipsKeyExporter = fipsKeyExporter; -+ try { -+ hC_GetAttributeValue = MethodHandles.insertArguments( -+ MethodHandles.lookup().findSpecial(PKCS11.class, -+ "C_GetAttributeValue", MethodType.methodType( -+ void.class, long.class, long.class, -+ CK_ATTRIBUTE[].class), -+ FIPSPKCS11.class), 0, this); -+ } catch (Throwable t) { -+ throw new RuntimeException( -+ "sun.security.pkcs11.wrapper.PKCS11" + -+ "::C_GetAttributeValue method not found.", t); -+ } -+ } -+ -+ public long C_CreateObject(long hSession, -+ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception { -+ // Creating sensitive key objects from plain key material in a -+ // FIPS-configured NSS Software Token is not allowed. We apply -+ // a key-unwrapping scheme to achieve so. -+ if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) { -+ try { -+ return ((Long)fipsKeyImporter.invoke(hSession, pTemplate)) -+ .longValue(); -+ } catch (Throwable t) { -+ if (t instanceof PKCS11Exception) { -+ throw (PKCS11Exception)t; -+ } -+ throw new PKCS11Exception(CKR_GENERAL_ERROR, -+ t.getMessage()); -+ } -+ } -+ return super.C_CreateObject(hSession, pTemplate); -+ } -+ -+ public void C_GetAttributeValue(long hSession, long hObject, -+ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception { -+ FIPSPKCS11Helper.C_GetAttributeValue(hC_GetAttributeValue, -+ fipsKeyExporter, hSession, hObject, pTemplate); -+ } -+} -+ -+// FIPSPKCS11 synchronized counterpart. -+static class SynchronizedFIPSPKCS11 extends SynchronizedPKCS11 { -+ private MethodHandle fipsKeyImporter; -+ private MethodHandle fipsKeyExporter; -+ private MethodHandle hC_GetAttributeValue; -+ SynchronizedFIPSPKCS11(String pkcs11ModulePath, String functionListName, -+ MethodHandle fipsKeyImporter, MethodHandle fipsKeyExporter) -+ throws IOException { -+ super(pkcs11ModulePath, functionListName); -+ this.fipsKeyImporter = fipsKeyImporter; -+ this.fipsKeyExporter = fipsKeyExporter; -+ try { -+ hC_GetAttributeValue = MethodHandles.insertArguments( -+ MethodHandles.lookup().findSpecial(SynchronizedPKCS11.class, -+ "C_GetAttributeValue", MethodType.methodType( -+ void.class, long.class, long.class, -+ CK_ATTRIBUTE[].class), -+ SynchronizedFIPSPKCS11.class), 0, this); -+ } catch (Throwable t) { -+ throw new RuntimeException( -+ "sun.security.pkcs11.wrapper.SynchronizedPKCS11" + -+ "::C_GetAttributeValue method not found.", t); -+ } -+ } -+ -+ public synchronized long C_CreateObject(long hSession, -+ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception { -+ // See FIPSPKCS11::C_CreateObject. -+ if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) { -+ try { -+ return ((Long)fipsKeyImporter.invoke(hSession, pTemplate)) -+ .longValue(); -+ } catch (Throwable t) { -+ if (t instanceof PKCS11Exception) { -+ throw (PKCS11Exception)t; -+ } -+ throw new PKCS11Exception(CKR_GENERAL_ERROR, -+ t.getMessage()); -+ } -+ } -+ return super.C_CreateObject(hSession, pTemplate); -+ } -+ -+ public synchronized void C_GetAttributeValue(long hSession, long hObject, -+ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception { -+ FIPSPKCS11Helper.C_GetAttributeValue(hC_GetAttributeValue, -+ fipsKeyExporter, hSession, hObject, pTemplate); -+ } -+} -+ -+private static class FIPSPKCS11Helper { -+ static boolean isSensitiveObject(CK_ATTRIBUTE[] pTemplate) { -+ for (CK_ATTRIBUTE attr : pTemplate) { -+ if (attr.type == CKA_CLASS && -+ (attr.getLong() == CKO_PRIVATE_KEY || -+ attr.getLong() == CKO_SECRET_KEY)) { -+ return true; -+ } -+ } -+ return false; -+ } -+ static void C_GetAttributeValue(MethodHandle hC_GetAttributeValue, -+ MethodHandle fipsKeyExporter, long hSession, long hObject, -+ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception { -+ Map sensitiveAttrs = new HashMap<>(); -+ List nonSensitiveAttrs = new LinkedList<>(); -+ FIPSPKCS11Helper.getAttributesBySensitivity(pTemplate, -+ sensitiveAttrs, nonSensitiveAttrs); -+ try { -+ if (sensitiveAttrs.size() > 0) { -+ long keyClass = -1L; -+ long keyType = -1L; -+ try { -+ // Secret and private keys have both class and type -+ // attributes, so we can query them at once. -+ CK_ATTRIBUTE[] queryAttrs = new CK_ATTRIBUTE[]{ -+ new CK_ATTRIBUTE(CKA_CLASS), -+ new CK_ATTRIBUTE(CKA_KEY_TYPE), -+ }; -+ hC_GetAttributeValue.invoke(hSession, hObject, queryAttrs); -+ keyClass = queryAttrs[0].getLong(); -+ keyType = queryAttrs[1].getLong(); -+ } catch (PKCS11Exception e) { -+ // If the query fails, the object is neither a secret nor a -+ // private key. As this case won't be handled with the FIPS -+ // Key Exporter, we keep keyClass initialized to -1L. -+ } -+ if (keyClass == CKO_SECRET_KEY || keyClass == CKO_PRIVATE_KEY) { -+ fipsKeyExporter.invoke(hSession, hObject, keyClass, keyType, -+ sensitiveAttrs); -+ if (nonSensitiveAttrs.size() > 0) { -+ CK_ATTRIBUTE[] pNonSensitiveAttrs = -+ new CK_ATTRIBUTE[nonSensitiveAttrs.size()]; -+ int i = 0; -+ for (CK_ATTRIBUTE nonSensAttr : nonSensitiveAttrs) { -+ pNonSensitiveAttrs[i++] = nonSensAttr; -+ } -+ hC_GetAttributeValue.invoke(hSession, hObject, -+ pNonSensitiveAttrs); -+ // libj2pkcs11 allocates new CK_ATTRIBUTE objects, so we -+ // update the reference on the previous CK_ATTRIBUTEs -+ i = 0; -+ for (CK_ATTRIBUTE nonSensAttr : nonSensitiveAttrs) { -+ nonSensAttr.pValue = pNonSensitiveAttrs[i++].pValue; -+ } -+ } -+ return; -+ } -+ } -+ hC_GetAttributeValue.invoke(hSession, hObject, pTemplate); -+ } catch (Throwable t) { -+ if (t instanceof PKCS11Exception) { -+ throw (PKCS11Exception)t; -+ } -+ throw new PKCS11Exception(CKR_GENERAL_ERROR, -+ t.getMessage()); -+ } -+ } -+ private static void getAttributesBySensitivity(CK_ATTRIBUTE[] pTemplate, -+ Map sensitiveAttrs, -+ List nonSensitiveAttrs) { -+ for (CK_ATTRIBUTE attr : pTemplate) { -+ long type = attr.type; -+ // Aligned with NSS' sftk_isSensitive in lib/softoken/pkcs11u.c -+ if (type == CKA_VALUE || type == CKA_PRIVATE_EXPONENT || -+ type == CKA_PRIME_1 || type == CKA_PRIME_2 || -+ type == CKA_EXPONENT_1 || type == CKA_EXPONENT_2 || -+ type == CKA_COEFFICIENT) { -+ sensitiveAttrs.put(type, attr); -+ } else { -+ nonSensitiveAttrs.add(attr); -+ } -+ } -+ } -+} - } -diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java -index 920422376f8..6aa308fa5f8 100644 ---- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java -+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java -@@ -215,6 +215,14 @@ public class PKCS11Exception extends Exception { - return res; - } - -+ /** -+ * Constructor taking the error code from the RV enum and -+ * extra info for error message. -+ */ -+ public PKCS11Exception(RV errorEnum, String extraInfo) { -+ this(errorEnum.value, extraInfo); -+ } -+ - /** - * Constructor taking the error code (the CKR_* constants in PKCS#11) and - * extra info for error message. -diff --git a/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java b/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java -index 7f8c4dba002..e65b11fc3ee 100644 ---- a/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java -+++ b/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java -@@ -34,6 +34,7 @@ import java.security.ProviderException; - import java.util.HashMap; - import java.util.List; - -+import jdk.internal.access.SharedSecrets; - import sun.security.ec.ed.EdDSAKeyFactory; - import sun.security.ec.ed.EdDSAKeyPairGenerator; - import sun.security.ec.ed.EdDSASignature; -@@ -50,6 +51,10 @@ public final class SunEC extends Provider { - - private static final long serialVersionUID = -2279741672933606418L; - -+ private static final boolean systemFipsEnabled = -+ SharedSecrets.getJavaSecuritySystemConfiguratorAccess() -+ .isSystemFipsEnabled(); -+ - private static class ProviderServiceA extends ProviderService { - ProviderServiceA(Provider p, String type, String algo, String cn, - HashMap attrs) { -@@ -240,83 +245,85 @@ public final class SunEC extends Provider { - putXDHEntries(); - putEdDSAEntries(); - -- /* -- * Signature engines -- */ -- putService(new ProviderService(this, "Signature", -- "NONEwithECDSA", "sun.security.ec.ECDSASignature$Raw", -- null, ATTRS)); -- putService(new ProviderServiceA(this, "Signature", -- "SHA1withECDSA", "sun.security.ec.ECDSASignature$SHA1", -- ATTRS)); -- putService(new ProviderServiceA(this, "Signature", -- "SHA224withECDSA", "sun.security.ec.ECDSASignature$SHA224", -- ATTRS)); -- putService(new ProviderServiceA(this, "Signature", -- "SHA256withECDSA", "sun.security.ec.ECDSASignature$SHA256", -- ATTRS)); -- putService(new ProviderServiceA(this, "Signature", -- "SHA384withECDSA", "sun.security.ec.ECDSASignature$SHA384", -- ATTRS)); -- putService(new ProviderServiceA(this, "Signature", -- "SHA512withECDSA", "sun.security.ec.ECDSASignature$SHA512", -- ATTRS)); -- putService(new ProviderServiceA(this, "Signature", -- "SHA3-224withECDSA", "sun.security.ec.ECDSASignature$SHA3_224", -- ATTRS)); -- putService(new ProviderServiceA(this, "Signature", -- "SHA3-256withECDSA", "sun.security.ec.ECDSASignature$SHA3_256", -- ATTRS)); -- putService(new ProviderServiceA(this, "Signature", -- "SHA3-384withECDSA", "sun.security.ec.ECDSASignature$SHA3_384", -- ATTRS)); -- putService(new ProviderServiceA(this, "Signature", -- "SHA3-512withECDSA", "sun.security.ec.ECDSASignature$SHA3_512", -- ATTRS)); -- -- putService(new ProviderService(this, "Signature", -- "NONEwithECDSAinP1363Format", -- "sun.security.ec.ECDSASignature$RawinP1363Format")); -- putService(new ProviderService(this, "Signature", -- "SHA1withECDSAinP1363Format", -- "sun.security.ec.ECDSASignature$SHA1inP1363Format")); -- putService(new ProviderService(this, "Signature", -- "SHA224withECDSAinP1363Format", -- "sun.security.ec.ECDSASignature$SHA224inP1363Format")); -- putService(new ProviderService(this, "Signature", -- "SHA256withECDSAinP1363Format", -- "sun.security.ec.ECDSASignature$SHA256inP1363Format")); -- putService(new ProviderService(this, "Signature", -- "SHA384withECDSAinP1363Format", -- "sun.security.ec.ECDSASignature$SHA384inP1363Format")); -- putService(new ProviderService(this, "Signature", -- "SHA512withECDSAinP1363Format", -- "sun.security.ec.ECDSASignature$SHA512inP1363Format")); -- -- putService(new ProviderService(this, "Signature", -- "SHA3-224withECDSAinP1363Format", -- "sun.security.ec.ECDSASignature$SHA3_224inP1363Format")); -- putService(new ProviderService(this, "Signature", -- "SHA3-256withECDSAinP1363Format", -- "sun.security.ec.ECDSASignature$SHA3_256inP1363Format")); -- putService(new ProviderService(this, "Signature", -- "SHA3-384withECDSAinP1363Format", -- "sun.security.ec.ECDSASignature$SHA3_384inP1363Format")); -- putService(new ProviderService(this, "Signature", -- "SHA3-512withECDSAinP1363Format", -- "sun.security.ec.ECDSASignature$SHA3_512inP1363Format")); -- -- /* -- * Key Pair Generator engine -- */ -- putService(new ProviderServiceA(this, "KeyPairGenerator", -- "EC", "sun.security.ec.ECKeyPairGenerator", ATTRS)); -- -- /* -- * Key Agreement engine -- */ -- putService(new ProviderService(this, "KeyAgreement", -- "ECDH", "sun.security.ec.ECDHKeyAgreement", null, ATTRS)); -+ if (!systemFipsEnabled) { -+ /* -+ * Signature engines -+ */ -+ putService(new ProviderService(this, "Signature", -+ "NONEwithECDSA", "sun.security.ec.ECDSASignature$Raw", -+ null, ATTRS)); -+ putService(new ProviderServiceA(this, "Signature", -+ "SHA1withECDSA", "sun.security.ec.ECDSASignature$SHA1", -+ ATTRS)); -+ putService(new ProviderServiceA(this, "Signature", -+ "SHA224withECDSA", "sun.security.ec.ECDSASignature$SHA224", -+ ATTRS)); -+ putService(new ProviderServiceA(this, "Signature", -+ "SHA256withECDSA", "sun.security.ec.ECDSASignature$SHA256", -+ ATTRS)); -+ putService(new ProviderServiceA(this, "Signature", -+ "SHA384withECDSA", "sun.security.ec.ECDSASignature$SHA384", -+ ATTRS)); -+ putService(new ProviderServiceA(this, "Signature", -+ "SHA512withECDSA", "sun.security.ec.ECDSASignature$SHA512", -+ ATTRS)); -+ putService(new ProviderServiceA(this, "Signature", -+ "SHA3-224withECDSA", "sun.security.ec.ECDSASignature$SHA3_224", -+ ATTRS)); -+ putService(new ProviderServiceA(this, "Signature", -+ "SHA3-256withECDSA", "sun.security.ec.ECDSASignature$SHA3_256", -+ ATTRS)); -+ putService(new ProviderServiceA(this, "Signature", -+ "SHA3-384withECDSA", "sun.security.ec.ECDSASignature$SHA3_384", -+ ATTRS)); -+ putService(new ProviderServiceA(this, "Signature", -+ "SHA3-512withECDSA", "sun.security.ec.ECDSASignature$SHA3_512", -+ ATTRS)); -+ -+ putService(new ProviderService(this, "Signature", -+ "NONEwithECDSAinP1363Format", -+ "sun.security.ec.ECDSASignature$RawinP1363Format")); -+ putService(new ProviderService(this, "Signature", -+ "SHA1withECDSAinP1363Format", -+ "sun.security.ec.ECDSASignature$SHA1inP1363Format")); -+ putService(new ProviderService(this, "Signature", -+ "SHA224withECDSAinP1363Format", -+ "sun.security.ec.ECDSASignature$SHA224inP1363Format")); -+ putService(new ProviderService(this, "Signature", -+ "SHA256withECDSAinP1363Format", -+ "sun.security.ec.ECDSASignature$SHA256inP1363Format")); -+ putService(new ProviderService(this, "Signature", -+ "SHA384withECDSAinP1363Format", -+ "sun.security.ec.ECDSASignature$SHA384inP1363Format")); -+ putService(new ProviderService(this, "Signature", -+ "SHA512withECDSAinP1363Format", -+ "sun.security.ec.ECDSASignature$SHA512inP1363Format")); -+ -+ putService(new ProviderService(this, "Signature", -+ "SHA3-224withECDSAinP1363Format", -+ "sun.security.ec.ECDSASignature$SHA3_224inP1363Format")); -+ putService(new ProviderService(this, "Signature", -+ "SHA3-256withECDSAinP1363Format", -+ "sun.security.ec.ECDSASignature$SHA3_256inP1363Format")); -+ putService(new ProviderService(this, "Signature", -+ "SHA3-384withECDSAinP1363Format", -+ "sun.security.ec.ECDSASignature$SHA3_384inP1363Format")); -+ putService(new ProviderService(this, "Signature", -+ "SHA3-512withECDSAinP1363Format", -+ "sun.security.ec.ECDSASignature$SHA3_512inP1363Format")); -+ -+ /* -+ * Key Pair Generator engine -+ */ -+ putService(new ProviderServiceA(this, "KeyPairGenerator", -+ "EC", "sun.security.ec.ECKeyPairGenerator", ATTRS)); -+ -+ /* -+ * Key Agreement engine -+ */ -+ putService(new ProviderService(this, "KeyAgreement", -+ "ECDH", "sun.security.ec.ECDHKeyAgreement", null, ATTRS)); -+ } - } - - private void putXDHEntries() { -@@ -333,23 +340,25 @@ public final class SunEC extends Provider { - "X448", "sun.security.ec.XDHKeyFactory.X448", - ATTRS)); - -- putService(new ProviderService(this, "KeyPairGenerator", -- "XDH", "sun.security.ec.XDHKeyPairGenerator", null, ATTRS)); -- putService(new ProviderServiceA(this, "KeyPairGenerator", -- "X25519", "sun.security.ec.XDHKeyPairGenerator.X25519", -- ATTRS)); -- putService(new ProviderServiceA(this, "KeyPairGenerator", -- "X448", "sun.security.ec.XDHKeyPairGenerator.X448", -- ATTRS)); -- -- putService(new ProviderService(this, "KeyAgreement", -- "XDH", "sun.security.ec.XDHKeyAgreement", null, ATTRS)); -- putService(new ProviderServiceA(this, "KeyAgreement", -- "X25519", "sun.security.ec.XDHKeyAgreement.X25519", -- ATTRS)); -- putService(new ProviderServiceA(this, "KeyAgreement", -- "X448", "sun.security.ec.XDHKeyAgreement.X448", -- ATTRS)); -+ if (!systemFipsEnabled) { -+ putService(new ProviderService(this, "KeyPairGenerator", -+ "XDH", "sun.security.ec.XDHKeyPairGenerator", null, ATTRS)); -+ putService(new ProviderServiceA(this, "KeyPairGenerator", -+ "X25519", "sun.security.ec.XDHKeyPairGenerator.X25519", -+ ATTRS)); -+ putService(new ProviderServiceA(this, "KeyPairGenerator", -+ "X448", "sun.security.ec.XDHKeyPairGenerator.X448", -+ ATTRS)); -+ -+ putService(new ProviderService(this, "KeyAgreement", -+ "XDH", "sun.security.ec.XDHKeyAgreement", null, ATTRS)); -+ putService(new ProviderServiceA(this, "KeyAgreement", -+ "X25519", "sun.security.ec.XDHKeyAgreement.X25519", -+ ATTRS)); -+ putService(new ProviderServiceA(this, "KeyAgreement", -+ "X448", "sun.security.ec.XDHKeyAgreement.X448", -+ ATTRS)); -+ } - } - - private void putEdDSAEntries() { -@@ -364,21 +373,23 @@ public final class SunEC extends Provider { - putService(new ProviderServiceA(this, "KeyFactory", - "Ed448", "sun.security.ec.ed.EdDSAKeyFactory.Ed448", ATTRS)); - -- putService(new ProviderService(this, "KeyPairGenerator", -- "EdDSA", "sun.security.ec.ed.EdDSAKeyPairGenerator", null, ATTRS)); -- putService(new ProviderServiceA(this, "KeyPairGenerator", -- "Ed25519", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed25519", -- ATTRS)); -- putService(new ProviderServiceA(this, "KeyPairGenerator", -- "Ed448", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed448", -- ATTRS)); -- -- putService(new ProviderService(this, "Signature", -- "EdDSA", "sun.security.ec.ed.EdDSASignature", null, ATTRS)); -- putService(new ProviderServiceA(this, "Signature", -- "Ed25519", "sun.security.ec.ed.EdDSASignature.Ed25519", ATTRS)); -- putService(new ProviderServiceA(this, "Signature", -- "Ed448", "sun.security.ec.ed.EdDSASignature.Ed448", ATTRS)); -+ if (!systemFipsEnabled) { -+ putService(new ProviderService(this, "KeyPairGenerator", -+ "EdDSA", "sun.security.ec.ed.EdDSAKeyPairGenerator", null, ATTRS)); -+ putService(new ProviderServiceA(this, "KeyPairGenerator", -+ "Ed25519", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed25519", -+ ATTRS)); -+ putService(new ProviderServiceA(this, "KeyPairGenerator", -+ "Ed448", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed448", -+ ATTRS)); -+ -+ putService(new ProviderService(this, "Signature", -+ "EdDSA", "sun.security.ec.ed.EdDSASignature", null, ATTRS)); -+ putService(new ProviderServiceA(this, "Signature", -+ "Ed25519", "sun.security.ec.ed.EdDSASignature.Ed25519", ATTRS)); -+ putService(new ProviderServiceA(this, "Signature", -+ "Ed448", "sun.security.ec.ed.EdDSASignature.Ed448", ATTRS)); -+ } - - } - } -diff --git a/test/jdk/sun/security/pkcs11/fips/NssdbPin.java b/test/jdk/sun/security/pkcs11/fips/NssdbPin.java -new file mode 100644 -index 00000000000..ce01c655eb8 ---- /dev/null -+++ b/test/jdk/sun/security/pkcs11/fips/NssdbPin.java -@@ -0,0 +1,349 @@ -+/* -+ * Copyright (c) 2022, Red Hat, Inc. -+ * -+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. -+ * -+ * This code is free software; you can redistribute it and/or modify it -+ * under the terms of the GNU General Public License version 2 only, as -+ * published by the Free Software Foundation. -+ * -+ * This code is distributed in the hope that it will be useful, but WITHOUT -+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -+ * version 2 for more details (a copy is included in the LICENSE file that -+ * accompanied this code). -+ * -+ * You should have received a copy of the GNU General Public License version -+ * 2 along with this work; if not, write to the Free Software Foundation, -+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. -+ * -+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA -+ * or visit www.oracle.com if you need additional information or have any -+ * questions. -+ */ -+ -+import java.lang.reflect.Method; -+import java.nio.charset.StandardCharsets; -+import java.nio.file.Files; -+import java.nio.file.Path; -+import java.security.KeyStore; -+import java.security.Provider; -+import java.security.Security; -+import java.util.Arrays; -+import java.util.function.Consumer; -+import java.util.List; -+import javax.crypto.Cipher; -+import javax.crypto.spec.SecretKeySpec; -+ -+import jdk.test.lib.process.Proc; -+import jdk.test.lib.util.FileUtils; -+ -+/* -+ * @test -+ * @bug 9999999 -+ * @summary -+ * Test that the fips.nssdb.path and fips.nssdb.pin properties can be used -+ * for a successful login into an NSS DB. Some additional unitary testing -+ * is then performed. This test depends on NSS modutil and must be run in -+ * FIPS mode (the SunPKCS11-NSS-FIPS security provider has to be available). -+ * @modules jdk.crypto.cryptoki/sun.security.pkcs11:+open -+ * @library /test/lib -+ * @requires (jdk.version.major >= 8) -+ * @run main/othervm/timeout=600 NssdbPin -+ * @author Martin Balao (mbalao@redhat.com) -+ */ -+ -+public final class NssdbPin { -+ -+ // Public properties and names -+ private static final String FIPS_NSSDB_PATH_PROP = "fips.nssdb.path"; -+ private static final String FIPS_NSSDB_PIN_PROP = "fips.nssdb.pin"; -+ private static final String FIPS_PROVIDER_NAME = "SunPKCS11-NSS-FIPS"; -+ private static final String NSSDB_TOKEN_NAME = -+ "NSS FIPS 140-2 Certificate DB"; -+ -+ // Data to be tested -+ private static final String[] PINS_TO_TEST = -+ new String[] { -+ "", -+ "1234567890abcdef1234567890ABCDEF\uA4F7" -+ }; -+ private static enum PropType { SYSTEM, SECURITY } -+ private static enum LoginType { IMPLICIT, EXPLICIT } -+ -+ // Internal test fields -+ private static final boolean DEBUG = true; -+ private static class TestContext { -+ String pin; -+ PropType propType; -+ Path workspace; -+ String nssdbPath; -+ Path nssdbPinFile; -+ LoginType loginType; -+ TestContext(String pin, Path workspace) { -+ this.pin = pin; -+ this.workspace = workspace; -+ this.nssdbPath = "sql:" + workspace; -+ this.loginType = LoginType.IMPLICIT; -+ } -+ } -+ -+ public static void main(String[] args) throws Throwable { -+ if (args.length == 3) { -+ // Executed by a child process. -+ mainChild(args[0], args[1], LoginType.valueOf(args[2])); -+ } else if (args.length == 0) { -+ // Executed by the parent process. -+ mainLauncher(); -+ // Test defaults -+ mainChild("sql:/etc/pki/nssdb", "", LoginType.IMPLICIT); -+ System.out.println("TEST PASS - OK"); -+ } else { -+ throw new Exception("Unexpected number of arguments."); -+ } -+ } -+ -+ private static void mainChild(String expectedPath, String expectedPin, -+ LoginType loginType) throws Throwable { -+ if (DEBUG) { -+ for (String prop : Arrays.asList(FIPS_NSSDB_PATH_PROP, -+ FIPS_NSSDB_PIN_PROP)) { -+ System.out.println(prop + " (System): " + -+ System.getProperty(prop)); -+ System.out.println(prop + " (Security): " + -+ Security.getProperty(prop)); -+ } -+ } -+ -+ /* -+ * Functional cross-test against an NSS DB generated by modutil -+ * with the same PIN. Check that we can perform a crypto operation -+ * that requires a login. The login might be explicit or implicit. -+ */ -+ Provider p = Security.getProvider(FIPS_PROVIDER_NAME); -+ if (DEBUG) { -+ System.out.println(FIPS_PROVIDER_NAME + ": " + p); -+ } -+ if (p == null) { -+ throw new Exception(FIPS_PROVIDER_NAME + " initialization failed."); -+ } -+ if (DEBUG) { -+ System.out.println("Login type: " + loginType); -+ } -+ if (loginType == LoginType.EXPLICIT) { -+ // Do the expansion to account for truncation, so C_Login in -+ // the NSS Software Token gets a UTF-8 encoded PIN. -+ byte[] pinUtf8 = expectedPin.getBytes(StandardCharsets.UTF_8); -+ char[] pinChar = new char[pinUtf8.length]; -+ for (int i = 0; i < pinChar.length; i++) { -+ pinChar[i] = (char)(pinUtf8[i] & 0xFF); -+ } -+ KeyStore.getInstance("PKCS11", p).load(null, pinChar); -+ if (DEBUG) { -+ System.out.println("Explicit login succeeded."); -+ } -+ } -+ if (DEBUG) { -+ System.out.println("Trying a crypto operation..."); -+ } -+ final int blockSize = 16; -+ Cipher cipher = Cipher.getInstance("AES/ECB/NoPadding", p); -+ cipher.init(Cipher.ENCRYPT_MODE, -+ new SecretKeySpec(new byte[blockSize], "AES")); -+ if (cipher.doFinal(new byte[blockSize]).length != blockSize) { -+ throw new Exception("Could not perform a crypto operation."); -+ } -+ if (DEBUG) { -+ if (loginType == LoginType.IMPLICIT) { -+ System.out.println("Implicit login succeeded."); -+ } -+ System.out.println("Crypto operation after login succeeded."); -+ } -+ -+ if (loginType == LoginType.IMPLICIT) { -+ /* -+ * Additional unitary testing. Expected to succeed at this point. -+ */ -+ if (DEBUG) { -+ System.out.println("Trying unitary test..."); -+ } -+ String sysPathProp = System.getProperty(FIPS_NSSDB_PATH_PROP); -+ if (DEBUG) { -+ System.out.println("Path value (as a System property): " + -+ sysPathProp); -+ } -+ if (!expectedPath.equals(sysPathProp)) { -+ throw new Exception("Path is different than expected: " + -+ sysPathProp + " (actual) vs " + expectedPath + -+ " (expected)."); -+ } -+ Class c = Class -+ .forName("sun.security.pkcs11.FIPSTokenLoginHandler"); -+ Method m = c.getDeclaredMethod("getFipsNssdbPin"); -+ m.setAccessible(true); -+ String pin = null; -+ char[] pinChar = (char[]) m.invoke(c); -+ if (pinChar != null) { -+ byte[] pinUtf8 = new byte[pinChar.length]; -+ for (int i = 0; i < pinUtf8.length; i++) { -+ pinUtf8[i] = (byte) pinChar[i]; -+ } -+ pin = new String(pinUtf8, StandardCharsets.UTF_8); -+ } -+ if (!expectedPin.isEmpty() && !expectedPin.equals(pin) || -+ expectedPin.isEmpty() && pin != null) { -+ throw new Exception("PIN is different than expected: '" + pin + -+ "' (actual) vs '" + expectedPin + "' (expected)."); -+ } -+ if (DEBUG) { -+ System.out.println("PIN value: " + pin); -+ System.out.println("Unitary test succeeded."); -+ } -+ } -+ } -+ -+ private static void mainLauncher() throws Throwable { -+ for (String pin : PINS_TO_TEST) { -+ Path workspace = Files.createTempDirectory(null); -+ try { -+ TestContext ctx = new TestContext(pin, workspace); -+ createNSSDB(ctx); -+ { -+ ctx.loginType = LoginType.IMPLICIT; -+ for (PropType propType : PropType.values()) { -+ ctx.propType = propType; -+ pinLauncher(ctx); -+ envLauncher(ctx); -+ fileLauncher(ctx); -+ } -+ } -+ explicitLoginLauncher(ctx); -+ } finally { -+ FileUtils.deleteFileTreeWithRetry(workspace); -+ } -+ } -+ } -+ -+ private static void pinLauncher(TestContext ctx) throws Throwable { -+ launchTest(p -> {}, "pin:" + ctx.pin, ctx); -+ } -+ -+ private static void envLauncher(TestContext ctx) throws Throwable { -+ final String NSSDB_PIN_ENV_VAR = "NSSDB_PIN_ENV_VAR"; -+ launchTest(p -> p.env(NSSDB_PIN_ENV_VAR, ctx.pin), -+ "env:" + NSSDB_PIN_ENV_VAR, ctx); -+ } -+ -+ private static void fileLauncher(TestContext ctx) throws Throwable { -+ // The file containing the PIN (ctx.nssdbPinFile) was created by the -+ // generatePinFile method, called from createNSSDB. -+ launchTest(p -> {}, "file:" + ctx.nssdbPinFile, ctx); -+ } -+ -+ private static void explicitLoginLauncher(TestContext ctx) -+ throws Throwable { -+ ctx.loginType = LoginType.EXPLICIT; -+ ctx.propType = PropType.SYSTEM; -+ launchTest(p -> {}, "Invalid PIN, must be ignored", ctx); -+ } -+ -+ private static void launchTest(Consumer procCb, String pinPropVal, -+ TestContext ctx) throws Throwable { -+ if (DEBUG) { -+ System.out.println("Launching JVM with " + FIPS_NSSDB_PATH_PROP + -+ "=" + ctx.nssdbPath + " and " + FIPS_NSSDB_PIN_PROP + -+ "=" + pinPropVal); -+ } -+ Proc p = Proc.create(NssdbPin.class.getName()) -+ .args(ctx.nssdbPath, ctx.pin, ctx.loginType.name()); -+ if (ctx.propType == PropType.SYSTEM) { -+ p.prop(FIPS_NSSDB_PATH_PROP, ctx.nssdbPath); -+ p.prop(FIPS_NSSDB_PIN_PROP, pinPropVal); -+ // Make sure that Security properties defaults are not used. -+ p.secprop(FIPS_NSSDB_PATH_PROP, ""); -+ p.secprop(FIPS_NSSDB_PIN_PROP, ""); -+ } else if (ctx.propType == PropType.SECURITY) { -+ p.secprop(FIPS_NSSDB_PATH_PROP, ctx.nssdbPath); -+ pinPropVal = escapeForPropsFile(pinPropVal); -+ p.secprop(FIPS_NSSDB_PIN_PROP, pinPropVal); -+ } else { -+ throw new Exception("Unsupported property type."); -+ } -+ if (DEBUG) { -+ p.inheritIO(); -+ p.prop("java.security.debug", "sunpkcs11"); -+ p.debug(NssdbPin.class.getName()); -+ -+ // Need the launched process to connect to a debugger? -+ //System.setProperty("test.vm.opts", "-Xdebug -Xrunjdwp:" + -+ // "transport=dt_socket,address=localhost:8000,suspend=y"); -+ } else { -+ p.nodump(); -+ } -+ procCb.accept(p); -+ p.start().waitFor(0); -+ } -+ -+ private static String escapeForPropsFile(String str) throws Throwable { -+ StringBuffer sb = new StringBuffer(); -+ for (int i = 0; i < str.length(); i++) { -+ int cp = str.codePointAt(i); -+ if (Character.UnicodeBlock.of(cp) -+ == Character.UnicodeBlock.BASIC_LATIN) { -+ sb.append(Character.toChars(cp)); -+ } else { -+ sb.append("\\u").append(String.format("%04X", cp)); -+ } -+ } -+ return sb.toString(); -+ } -+ -+ private static void createNSSDB(TestContext ctx) throws Throwable { -+ ProcessBuilder pb = getModutilPB(ctx, "-create"); -+ if (DEBUG) { -+ System.out.println("Creating an NSS DB in " + ctx.workspace + -+ "..."); -+ System.out.println("cmd: " + String.join(" ", pb.command())); -+ } -+ if (pb.start().waitFor() != 0) { -+ throw new Exception("NSS DB creation failed."); -+ } -+ generatePinFile(ctx); -+ pb = getModutilPB(ctx, "-changepw", NSSDB_TOKEN_NAME, -+ "-newpwfile", ctx.nssdbPinFile.toString()); -+ if (DEBUG) { -+ System.out.println("NSS DB created."); -+ System.out.println("Changing NSS DB PIN..."); -+ System.out.println("cmd: " + String.join(" ", pb.command())); -+ } -+ if (pb.start().waitFor() != 0) { -+ throw new Exception("NSS DB PIN change failed."); -+ } -+ if (DEBUG) { -+ System.out.println("NSS DB PIN changed."); -+ } -+ } -+ -+ private static ProcessBuilder getModutilPB(TestContext ctx, String... args) -+ throws Throwable { -+ ProcessBuilder pb = new ProcessBuilder("modutil", "-force"); -+ List pbCommand = pb.command(); -+ if (args != null) { -+ pbCommand.addAll(Arrays.asList(args)); -+ } -+ pbCommand.add("-dbdir"); -+ pbCommand.add(ctx.nssdbPath); -+ if (DEBUG) { -+ pb.inheritIO(); -+ } else { -+ pb.redirectError(ProcessBuilder.Redirect.INHERIT); -+ } -+ return pb; -+ } -+ -+ private static void generatePinFile(TestContext ctx) throws Throwable { -+ ctx.nssdbPinFile = Files.createTempFile(ctx.workspace, null, null); -+ Files.writeString(ctx.nssdbPinFile, ctx.pin + System.lineSeparator() + -+ "2nd line with garbage"); -+ } -+} -diff --git a/test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java b/test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java -new file mode 100644 -index 00000000000..87f1ad04505 ---- /dev/null -+++ b/test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java -@@ -0,0 +1,77 @@ -+/* -+ * Copyright (c) 2022, Red Hat, Inc. -+ * -+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. -+ * -+ * This code is free software; you can redistribute it and/or modify it -+ * under the terms of the GNU General Public License version 2 only, as -+ * published by the Free Software Foundation. -+ * -+ * This code is distributed in the hope that it will be useful, but WITHOUT -+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License -+ * version 2 for more details (a copy is included in the LICENSE file that -+ * accompanied this code). -+ * -+ * You should have received a copy of the GNU General Public License version -+ * 2 along with this work; if not, write to the Free Software Foundation, -+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. -+ * -+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA -+ * or visit www.oracle.com if you need additional information or have any -+ * questions. -+ */ -+ -+import java.security.Provider; -+import java.security.Security; -+ -+/* -+ * @test -+ * @bug 9999999 -+ * @requires (jdk.version.major >= 8) -+ * @run main/othervm/timeout=30 VerifyMissingAttributes -+ * @author Martin Balao (mbalao@redhat.com) -+ */ -+ -+public final class VerifyMissingAttributes { -+ -+ private static final String[] svcAlgImplementedIn = { -+ "AlgorithmParameterGenerator.DSA", -+ "AlgorithmParameters.DSA", -+ "CertificateFactory.X.509", -+ "KeyStore.JKS", -+ "KeyStore.CaseExactJKS", -+ "KeyStore.DKS", -+ "CertStore.Collection", -+ "CertStore.com.sun.security.IndexedCollection" -+ }; -+ -+ public static void main(String[] args) throws Throwable { -+ Provider sunProvider = Security.getProvider("SUN"); -+ for (String svcAlg : svcAlgImplementedIn) { -+ String filter = svcAlg + " ImplementedIn:Software"; -+ doQuery(sunProvider, filter); -+ } -+ if (Double.parseDouble( -+ System.getProperty("java.specification.version")) >= 17) { -+ String filter = "KeyFactory.RSASSA-PSS SupportedKeyClasses:" + -+ "java.security.interfaces.RSAPublicKey" + -+ "|java.security.interfaces.RSAPrivateKey"; -+ doQuery(Security.getProvider("SunRsaSign"), filter); -+ } -+ System.out.println("TEST PASS - OK"); -+ } -+ -+ private static void doQuery(Provider expectedProvider, String filter) -+ throws Exception { -+ if (expectedProvider == null) { -+ throw new Exception("Provider not found."); -+ } -+ Provider[] providers = Security.getProviders(filter); -+ if (providers == null || providers.length != 1 || -+ providers[0] != expectedProvider) { -+ throw new Exception("Failure retrieving the provider with this" + -+ " query: " + filter); -+ } -+ } -+} diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index c658ed7..2a294ff 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -334,9 +334,9 @@ %endif # New Version-String scheme-style defines -%global featurever 24 +%global featurever 25 %global interimver 0 -%global updatever 2 +%global updatever 0 %global patchver 0 # buildjdkver is usually same as %%{featurever}, # but in time of bootstrap of next jdk, it is featurever-1, @@ -386,7 +386,6 @@ # Define IcedTea version used for SystemTap tapsets and desktop file %global icedteaver 6.0.0pre00-c848b93a8598 # Define current Git revision for the FIPS support patches -%global fipsver 9203d50836c # Define JDK versions %global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver} %global javaver %{featurever} @@ -400,7 +399,7 @@ %global origin_nice OpenJDK %global top_level_dir_name %{vcstag} %global top_level_dir_name_backup %{top_level_dir_name}-backup -%global buildver 12 +%global buildver 36 %global rpmrelease 1 #%%global tagsuffix %%{nil} # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit @@ -684,15 +683,14 @@ Source18: TestTranslations.java # test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class # RH1940064: Enable XML Signature provider in FIPS mode # RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized [now part of JDK-8301553 upstream] -#Patch1001: fips-%{featurever}u-%{fipsver}.patch ############################################# # # OpenJDK patches in need of upstreaming # ############################################# -# Fix rawhide build failure with GCC 15 -Patch1100: 0001-Fix-name-class-of-uabs-with-GCC-15.patch + +# Currently empty ############################################# # @@ -707,8 +705,8 @@ Patch1100: 0001-Fix-name-class-of-uabs-with-GCC-15.patch # Portable build specific patches # ############################################# -Patch1101: revert8350202.patch +# Currently empty BuildRequires: autoconf BuildRequires: automake @@ -999,8 +997,6 @@ pushd %{top_level_dir_name} # Add crypto policy and FIPS support # Skipping fips patch whil eit is not ready for jdk22 %%patch -P1001 -p1 # Patches in need of upstreaming -%patch -P1100 -p1 -%patch -P1101 -p1 popd # openjdk @@ -1733,8 +1729,4 @@ done %{_jvmdir}/%{miscportablearchive}.sha256sum %endif -%changelog -* Thu Jul 24 2025 Fedora Release Engineering - 1:24.0.2.0.12-1.rolling.1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - %autochangelog diff --git a/jconsole.desktop.in b/jconsole.desktop.in deleted file mode 100644 index c1b8f6a..0000000 --- a/jconsole.desktop.in +++ /dev/null @@ -1 +0,0 @@ -# this file is intentionally not here, as portable builds do not have desktop integration diff --git a/revert8350202.patch b/revert8350202.patch deleted file mode 100644 index e325128..0000000 --- a/revert8350202.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 3b9470ab57d45e491e18e2e86d9f349312016d81 Mon Sep 17 00:00:00 2001 -From: duke -Date: Fri, 7 Mar 2025 15:23:06 +0000 -Subject: [REVERT] Backport e1d0a9c832ef3e92faaed7f290ff56c0ed8a9d94 - ---- - make/autoconf/flags-cflags.m4 | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/make/autoconf/flags-cflags.m4 b/make/autoconf/flags-cflags.m4 -index 7f92bd015d3..a740de222d0 100644 ---- a/make/autoconf/flags-cflags.m4 -+++ b/make/autoconf/flags-cflags.m4 -@@ -743,7 +743,7 @@ AC_DEFUN([FLAGS_SETUP_CFLAGS_CPU_DEP], - elif test "x$FLAGS_CPU" = xppc64le; then - # Little endian machine uses ELFv2 ABI. - # Use Power8, this is the first CPU to support PPC64 LE with ELFv2 ABI. -- $1_CFLAGS_CPU_JVM="${$1_CFLAGS_CPU_JVM} -DABI_ELFv2 -mcpu=power8 -mtune=power10" -+ $1_CFLAGS_CPU_JVM="${$1_CFLAGS_CPU_JVM} -DABI_ELFv2 -mcpu=power8 -mtune=power8" - fi - elif test "x$FLAGS_CPU" = xs390x; then - $1_CFLAGS_CPU="-mbackchain -march=z10" -@@ -764,7 +764,7 @@ AC_DEFUN([FLAGS_SETUP_CFLAGS_CPU_DEP], - if test "x$FLAGS_CPU" = xppc64le; then - # Little endian machine uses ELFv2 ABI. - # Use Power8, this is the first CPU to support PPC64 LE with ELFv2 ABI. -- $1_CFLAGS_CPU_JVM="${$1_CFLAGS_CPU_JVM} -DABI_ELFv2 -mcpu=power8 -mtune=power10" -+ $1_CFLAGS_CPU_JVM="${$1_CFLAGS_CPU_JVM} -DABI_ELFv2 -mcpu=power8 -mtune=power8" - fi - fi - if test "x$OPENJDK_TARGET_OS" = xaix; then diff --git a/scripts/generate_source_tarball.sh b/scripts/generate_source_tarball.sh index ad163f3..e01043d 100755 --- a/scripts/generate_source_tarball.sh +++ b/scripts/generate_source_tarball.sh @@ -48,8 +48,8 @@ # This will check out the same version as example 1, but from the # upstream repository: # -# $ VERSION=jdk-17.0.3+5 PROJECT_NAME=openjdk REPO_NAME=jdk17u \ -# BOOT_JDK=/usr/lib/jvm/java-17-openjdk ./generate_source_tarball.sh +# $ VERSION=jdk-25+36 PROJECT_NAME=openjdk REPO_NAME=jdk25u \ +# BOOT_JDK=/usr/lib/jvm/java-17-openjdk sh scripts/generate_source_tarball.sh # # Example 3: # This will read the OpenJDK feature version from the spec file, then create a diff --git a/sources b/sources index f50b623..6a09c68 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (openjdk-24.0.2+12.tar.xz) = 92dc174ad4fedb1138bc183a390a85a76fcc3aa1508d4d00f49012b28a8e3a5a1739b349f0fb03dedc6f7977eafa472c5f7608c61ae656c0ecf795b9e96a95ae +SHA512 (openjdk-25+36.tar.xz) = 062f55acdcccb32dd62377dce9573a70b0535312f2f69cb660be1d321b52ad3e24ef9c333055434b19e6fedb94dd5a1408addfb7e5f47d36664587ab1c12a22b From 70e5657156453033242506aa764cb32d6386bc4e Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Mon, 22 Sep 2025 17:25:54 +0200 Subject: [PATCH 14/23] Returned revert8350202.patch; still needed on epel8 --- java-latest-openjdk-portable.spec | 7 ++++--- revert8350202.patch | 31 +++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+), 3 deletions(-) create mode 100644 revert8350202.patch diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index 2a294ff..2d99fa2 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -400,7 +400,7 @@ %global top_level_dir_name %{vcstag} %global top_level_dir_name_backup %{top_level_dir_name}-backup %global buildver 36 -%global rpmrelease 1 +%global rpmrelease 2 #%%global tagsuffix %%{nil} # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit %if %is_system_jdk @@ -567,7 +567,7 @@ Version: %{newjavaver}.%{buildver} # This package needs `.rolling` as part of Release so as to not conflict on install with # java-X-openjdk. I.e. when latest rolling release is also an LTS release packaged as # java-X-openjdk. See: https://bugzilla.redhat.com/show_bug.cgi?id=1647298 -Release: %{?eaprefix}%{rpmrelease}%{?extraver}.rolling%{?dist}.1 +Release: %{?eaprefix}%{rpmrelease}%{?extraver}.rolling%{?dist} # java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons # and this change was brought into RHEL-4. java-1.5.0-ibm packages # also included the epoch in their virtual provides. This created a @@ -706,7 +706,7 @@ Source18: TestTranslations.java # ############################################# -# Currently empty +Patch1101: revert8350202.patch BuildRequires: autoconf BuildRequires: automake @@ -997,6 +997,7 @@ pushd %{top_level_dir_name} # Add crypto policy and FIPS support # Skipping fips patch whil eit is not ready for jdk22 %%patch -P1001 -p1 # Patches in need of upstreaming +%patch -P1101 -p1 popd # openjdk diff --git a/revert8350202.patch b/revert8350202.patch new file mode 100644 index 0000000..e325128 --- /dev/null +++ b/revert8350202.patch @@ -0,0 +1,31 @@ +From 3b9470ab57d45e491e18e2e86d9f349312016d81 Mon Sep 17 00:00:00 2001 +From: duke +Date: Fri, 7 Mar 2025 15:23:06 +0000 +Subject: [REVERT] Backport e1d0a9c832ef3e92faaed7f290ff56c0ed8a9d94 + +--- + make/autoconf/flags-cflags.m4 | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/make/autoconf/flags-cflags.m4 b/make/autoconf/flags-cflags.m4 +index 7f92bd015d3..a740de222d0 100644 +--- a/make/autoconf/flags-cflags.m4 ++++ b/make/autoconf/flags-cflags.m4 +@@ -743,7 +743,7 @@ AC_DEFUN([FLAGS_SETUP_CFLAGS_CPU_DEP], + elif test "x$FLAGS_CPU" = xppc64le; then + # Little endian machine uses ELFv2 ABI. + # Use Power8, this is the first CPU to support PPC64 LE with ELFv2 ABI. +- $1_CFLAGS_CPU_JVM="${$1_CFLAGS_CPU_JVM} -DABI_ELFv2 -mcpu=power8 -mtune=power10" ++ $1_CFLAGS_CPU_JVM="${$1_CFLAGS_CPU_JVM} -DABI_ELFv2 -mcpu=power8 -mtune=power8" + fi + elif test "x$FLAGS_CPU" = xs390x; then + $1_CFLAGS_CPU="-mbackchain -march=z10" +@@ -764,7 +764,7 @@ AC_DEFUN([FLAGS_SETUP_CFLAGS_CPU_DEP], + if test "x$FLAGS_CPU" = xppc64le; then + # Little endian machine uses ELFv2 ABI. + # Use Power8, this is the first CPU to support PPC64 LE with ELFv2 ABI. +- $1_CFLAGS_CPU_JVM="${$1_CFLAGS_CPU_JVM} -DABI_ELFv2 -mcpu=power8 -mtune=power10" ++ $1_CFLAGS_CPU_JVM="${$1_CFLAGS_CPU_JVM} -DABI_ELFv2 -mcpu=power8 -mtune=power8" + fi + fi + if test "x$OPENJDK_TARGET_OS" = xaix; then From 162e0d77cbc4bb3e9722d0abcd05b804705eb8a7 Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Mon, 22 Sep 2025 17:34:41 +0200 Subject: [PATCH 15/23] removing revert8350202.patch again; skiping epel8 for now maybe pernamently --- java-latest-openjdk-portable.spec | 3 +-- revert8350202.patch | 31 ------------------------------- 2 files changed, 1 insertion(+), 33 deletions(-) delete mode 100644 revert8350202.patch diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index 2d99fa2..62705e8 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -706,7 +706,7 @@ Source18: TestTranslations.java # ############################################# -Patch1101: revert8350202.patch +# Currently empty BuildRequires: autoconf BuildRequires: automake @@ -997,7 +997,6 @@ pushd %{top_level_dir_name} # Add crypto policy and FIPS support # Skipping fips patch whil eit is not ready for jdk22 %%patch -P1001 -p1 # Patches in need of upstreaming -%patch -P1101 -p1 popd # openjdk diff --git a/revert8350202.patch b/revert8350202.patch deleted file mode 100644 index e325128..0000000 --- a/revert8350202.patch +++ /dev/null @@ -1,31 +0,0 @@ -From 3b9470ab57d45e491e18e2e86d9f349312016d81 Mon Sep 17 00:00:00 2001 -From: duke -Date: Fri, 7 Mar 2025 15:23:06 +0000 -Subject: [REVERT] Backport e1d0a9c832ef3e92faaed7f290ff56c0ed8a9d94 - ---- - make/autoconf/flags-cflags.m4 | 4 ++-- - 1 file changed, 2 insertions(+), 2 deletions(-) - -diff --git a/make/autoconf/flags-cflags.m4 b/make/autoconf/flags-cflags.m4 -index 7f92bd015d3..a740de222d0 100644 ---- a/make/autoconf/flags-cflags.m4 -+++ b/make/autoconf/flags-cflags.m4 -@@ -743,7 +743,7 @@ AC_DEFUN([FLAGS_SETUP_CFLAGS_CPU_DEP], - elif test "x$FLAGS_CPU" = xppc64le; then - # Little endian machine uses ELFv2 ABI. - # Use Power8, this is the first CPU to support PPC64 LE with ELFv2 ABI. -- $1_CFLAGS_CPU_JVM="${$1_CFLAGS_CPU_JVM} -DABI_ELFv2 -mcpu=power8 -mtune=power10" -+ $1_CFLAGS_CPU_JVM="${$1_CFLAGS_CPU_JVM} -DABI_ELFv2 -mcpu=power8 -mtune=power8" - fi - elif test "x$FLAGS_CPU" = xs390x; then - $1_CFLAGS_CPU="-mbackchain -march=z10" -@@ -764,7 +764,7 @@ AC_DEFUN([FLAGS_SETUP_CFLAGS_CPU_DEP], - if test "x$FLAGS_CPU" = xppc64le; then - # Little endian machine uses ELFv2 ABI. - # Use Power8, this is the first CPU to support PPC64 LE with ELFv2 ABI. -- $1_CFLAGS_CPU_JVM="${$1_CFLAGS_CPU_JVM} -DABI_ELFv2 -mcpu=power8 -mtune=power10" -+ $1_CFLAGS_CPU_JVM="${$1_CFLAGS_CPU_JVM} -DABI_ELFv2 -mcpu=power8 -mtune=power8" - fi - fi - if test "x$OPENJDK_TARGET_OS" = xaix; then From 7b169ddefa968d7b6076fbe90dece28a5c83595f Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Thu, 2 Oct 2025 16:36:07 +0200 Subject: [PATCH 16/23] Split toolchains between el7 and epel8 This should return epel8 buildability, still maintain el7-like toolchain and also work in rawhide/el10 --- java-latest-openjdk-portable.spec | 50 +++++++++++++++++++++++-------- 1 file changed, 37 insertions(+), 13 deletions(-) diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index 62705e8..3434c7c 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -243,8 +243,25 @@ # Target to use to just build HotSpot %global hotspot_target hotspot +# When building on older systems, we need system, or self build legacy toolchains of explicit version +%if ((0%{?rhel} > 0 && 0%{?rhel} < 8)) || ((0%{?epel} > 0 && 0%{?epel} < 9)) +%global is_dtstoolchain 1 +%else +%global is_dtstoolchain 0 +%endif +%if ((0%{?rhel} > 0 && 0%{?rhel} < 8)) # DTS toolset to use to provide gcc & binutils %global dtsversion 10 +%global dtsname devtoolset +%endif +%if ((0%{?epel} > 0 && 0%{?epel} < 9)) +# GCC toolset to use to provide gcc & binutils +%global dtsversion 14 +%global dtsname gcc-toolset +%endif +%if %{is_dtstoolchain} +%global dtsid %{dtsname}-%{dtsversion} +%endif # Disable LTO as this causes build failures at the moment. # See RHBZ#1861401 @@ -718,14 +735,22 @@ BuildRequires: desktop-file-utils BuildRequires: elfutils-devel BuildRequires: file BuildRequires: fontconfig-devel -%if (0%{?rhel} > 0 && 0%{?rhel} < 8) -BuildRequires: devtoolset-%{dtsversion}-gcc -BuildRequires: devtoolset-%{dtsversion}-gcc-c++ -%else -BuildRequires: gcc -# gcc-c++ is already needed +%if %{is_dtstoolchain} +BuildRequires: %{dtsid}-gcc +BuildRequires: %{dtsid}-gcc-c++ %endif +%if %{is_dtstoolchain} && "%{?dtsname}" == "gcc-toolset" +# wee need slightly more for gcc-toolset +BuildRequires: %{dtsid}-annobin-annocheck +BuildRequires: %{dtsid}-annobin-plugin-gcc +BuildRequires: %{dtsid}-binutils +BuildRequires: %{dtsid}-gcc-plugin-annobin +%endif +%if ! %{is_dtstoolchain} +# Earlier versions have a bug in tree vectorization on PPC +BuildRequires: gcc >= 4.8.3-8 BuildRequires: gcc-c++ +%endif BuildRequires: gdb %if (0%{?rhel} > 0 && 0%{?rhel} < 8) # rhel7 only, portables only. Rhel8 have gtk3, rpms have runtime recommends of gtk @@ -768,8 +793,6 @@ BuildRequires: pandoc BuildRequires: tzdata-java >= 2023c # cacerts build requirement in portable mode BuildRequires: ca-certificates -# Earlier versions have a bug in tree vectorization on PPC -BuildRequires: gcc >= 4.8.3-8 %if %{with_systemtap} BuildRequires: systemtap-sdt-devel @@ -1101,8 +1124,8 @@ function buildjdk() { # rather than ${link_opt} as the system versions # are always used in a system_libs build, even # for the static library build -%if (0%{?rhel} > 0 && 0%{?rhel} < 8) - scl enable devtoolset-%{dtsversion} -- bash ${top_dir_abs_src_path}/configure \ +%if %{is_dtstoolchain} + scl enable %{dtsid} -- bash ${top_dir_abs_src_path}/configure \ %else bash ${top_dir_abs_src_path}/configure \ %endif @@ -1144,11 +1167,12 @@ function buildjdk() { %ifarch %{zgc_arches} --with-jvm-features=zgc \ %endif - --disable-warnings-as-errors + --disable-warnings-as-errors \ + || ( pwd; cat $(find | grep config.log) && false ) cat spec.gmk -%if (0%{?rhel} > 0 && 0%{?rhel} < 8) - scl enable devtoolset-%{dtsversion} -- make \ +%if %{is_dtstoolchain} + scl enable %{dtsid} -- make \ %else make \ %endif From 93d6522bfd2509d8f055b3fb1e4edc948ba52dd2 Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Tue, 7 Oct 2025 16:58:30 +0200 Subject: [PATCH 17/23] Moved to build by itslef - jdk25 --- java-latest-openjdk-portable.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index 3434c7c..99518f5 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -358,7 +358,7 @@ # buildjdkver is usually same as %%{featurever}, # but in time of bootstrap of next jdk, it is featurever-1, # and this it is better to change it here, on single place -%global buildjdkver 24 +%global buildjdkver 25 # We don't add any LTS designator for STS packages (Fedora and EPEL). # We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined. %if 0%{?rhel} && !0%{?epel} From 2748852214e905070f01cfd8febe989ddb5fb8f5 Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Tue, 7 Oct 2025 17:12:38 +0200 Subject: [PATCH 18/23] BUmped release --- java-latest-openjdk-portable.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index 99518f5..ad6bf58 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -417,7 +417,7 @@ %global top_level_dir_name %{vcstag} %global top_level_dir_name_backup %{top_level_dir_name}-backup %global buildver 36 -%global rpmrelease 2 +%global rpmrelease 3 #%%global tagsuffix %%{nil} # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit %if %is_system_jdk From 1cdac5f81175341202d3132d6fef6da66ef13e42 Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Wed, 22 Oct 2025 18:28:12 +0200 Subject: [PATCH 19/23] BUmped to October 2025 CPU and made to build by itslef by java-latest-openjdk instead of java-25-openjdk --- .gitignore | 1 + java-latest-openjdk-portable.spec | 8 ++++---- sources | 2 +- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index e5f004c..c2a5115 100644 --- a/.gitignore +++ b/.gitignore @@ -57,3 +57,4 @@ /openjdk-25+32-ea.tar.xz /openjdk-jdk-25+36.tar.xz /openjdk-25+36.tar.xz +/openjdk-25.0.1+8.tar.xz diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index ad6bf58..213f7b4 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -353,7 +353,7 @@ # New Version-String scheme-style defines %global featurever 25 %global interimver 0 -%global updatever 0 +%global updatever 1 %global patchver 0 # buildjdkver is usually same as %%{featurever}, # but in time of bootstrap of next jdk, it is featurever-1, @@ -369,7 +369,7 @@ %global lts_designator_zip "" %endif # JDK to use for bootstrapping -%global bootjdk /usr/lib/jvm/java-%{buildjdkver}-openjdk +%global bootjdk /usr/lib/jvm/java-latest-openjdk # Define whether to use the bootstrap JDK directly or with a fresh libjvm.so # This will only work where the bootstrap JDK is the same major version # as the JDK being built @@ -416,8 +416,8 @@ %global origin_nice OpenJDK %global top_level_dir_name %{vcstag} %global top_level_dir_name_backup %{top_level_dir_name}-backup -%global buildver 36 -%global rpmrelease 3 +%global buildver 8 +%global rpmrelease 1 #%%global tagsuffix %%{nil} # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit %if %is_system_jdk diff --git a/sources b/sources index 6a09c68..641515d 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (openjdk-25+36.tar.xz) = 062f55acdcccb32dd62377dce9573a70b0535312f2f69cb660be1d321b52ad3e24ef9c333055434b19e6fedb94dd5a1408addfb7e5f47d36664587ab1c12a22b +SHA512 (openjdk-25.0.1+8.tar.xz) = eb84d876f81ca02803283e8294c89b6acbed3753426811c3bcc228615c9618deefc85da4aa702800cac2feb103e628ee8b92292b316e9d7e12a58b6de69c5085 From 8da764d82ac2851ef8953ca2bcf20984439fc021 Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Fri, 5 Dec 2025 13:20:30 +0100 Subject: [PATCH 20/23] Added support for build with devkit in rhel and building by fastdebug if possible --- NEWS | 689 ++++++++++++++++++++++++++++-- TestTranslations.java | 16 +- java-latest-openjdk-portable.spec | 590 +++++++++++++++++-------- scripts/get_bundle_versions.sh | 172 ++++++++ 4 files changed, 1240 insertions(+), 227 deletions(-) create mode 100755 scripts/get_bundle_versions.sh diff --git a/NEWS b/NEWS index d44c7e0..0a4a628 100644 --- a/NEWS +++ b/NEWS @@ -2,34 +2,669 @@ Key: JDK-X - https://bugs.openjdk.java.net/browse/JDK-X CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY -JEP-XYZ: https://openjdk.org/jeps/XYZ -New in release OpenJDK 25.0.0+32 (2025-06-9): +New in release OpenJDK 25.0.1 (2025-10-21): =========================================== -JDK 25 is in Rampdown Phase One. The overall feature set is frozen. No further JEPs will be targeted to this release. -The stabilization branch, jdk25, is open for select bug fixes and, with approval, late enhancements per the JDK Release Process (JEP 3). Integrate most stabilization changes via backports from the main line. - - JEP-470: PEM Encodings of Cryptographic Objects (Preview) - - JEP-502: Stable Values (Preview) - - JEP-503: Remove the 32-bit x86 Port - - JEP-505: Structured Concurrency (Fifth Preview) - - JEP-506: Scoped Values - - JEP-507: Primitive Types in Patterns, instanceof, and switch (Third Preview) - - JEP-508: Vector API (Tenth Incubator) - - JEP-509: JFR CPU-Time Profiling (Experimental) - - JEP-510: Key Derivation Function API - - JEP-511: Module Import Declarations - - JEP-512: Compact Source Files and Instance Main Methods - - JEP-513: Flexible Constructor Bodies - - JEP-514: Ahead-of-Time Command-Line Ergonomics - - JEP-515: Ahead-of-Time Method Profiling - - JEP-518: JFR Cooperative Sampling - - JEP-519: Compact Object Headers - - JEP-520: JFR Method Timing & Tracing - - JEP-521: Generational Shenandoah +* CVEs + - CVE-2025-53057 + - CVE-2025-53066 + - CVE-2025-61748 +* Changes + - JDK-8315131: Clarify VarHandle set/get access on 32-bit platforms + - JDK-8352637: Enhance bytecode verification + - JDK-8356294: Enhance Path Factories + - JDK-8356587: Missing object ID X in pool jdk.types.Method + - JDK-8357826: Avoid running some jtreg tests when asan is configured + - JDK-8358452: JNI exception pending in Java_sun_awt_screencast_ScreencastHelper_remoteDesktopKeyImpl of screencast_pipewire.c:1214 (ID: 51119) + - JDK-8358577: Test serviceability/jvmti/thread/GetCurrentContendedMonitor/contmon01/contmon01.java failed: unexpexcted monitor object + - JDK-8358819: The first year is not displayed correctly in Japanese Calendar + - JDK-8359059: Bump version numbers for 25.0.1 + - JDK-8359218: RISC-V: Only enable CRC32 intrinsic when AvoidUnalignedAccess == false + - JDK-8359270: C2: alignment check should consider base offset when emitting arraycopy runtime call + - JDK-8359454: Enhance String handling + - JDK-8359596: Behavior change when both -Xlint:options and -Xlint:-options flags are given + - JDK-8360179: RISC-V: Only enable BigInteger intrinsics when AvoidUnalignedAccess == false + - JDK-8360533: ContainerRuntimeVersionTestUtils fromVersionString fails with some docker versions + - JDK-8360647: [XWayland] [OL10] NumPad keys are not triggered + - JDK-8360679: Shenandoah: AOT saved adapter calls into broken GC barrier stub + - JDK-8360937: Enhance certificate handling + - JDK-8361212: Remove AffirmTrust root CAs + - JDK-8361532: RISC-V: Several vector tests fail after JDK-8354383 + - JDK-8361829: [TESTBUG] RISC-V: compiler/vectorization/runner/BasicIntOpTest.java fails with RVV but not Zvbb + - JDK-8362109: Change milestone to fcs for all releases + - JDK-8362882: Update SubmissionPublisher() specification to reflect use of ForkJoinPool.asyncCommonPool() + - JDK-8366223: ZGC: ZPageAllocator::cleanup_failed_commit_multi_partition is broken + - JDK-8367031: [backout] Change java.time month/day field types to 'byte' + - JDK-8368308: ISO 4217 Amendment 180 Update -+ https://openjdk.org/projects/jdk/25/ -+ https://openjdk.org/projects/jdk/24/ -+ https://openjdk.org/projects/jdk/23/ -+ https://openjdk.org/projects/jdk/22/ -In case yo uare moving directly from jdk21 +Notes on individual issues: +=========================== + +core-libs/java.io:serialization: + +JDK-8367031: [backout] Change java.time month/day field types to 'byte' +======================================================================= +In the initial release of OpenJDK 25, attempting to read serialised +Class objects created by earlier versions of OpenJDK for several of +the `java.time` classes would fail with a +`InvalidClassException`. Similarly, `java.time` Class objects +serialised with OpenJDK 25 could not be read by older OpenJDK +versions. This was due to the type of the day and month fields in +these classes being changed to `byte`. This change has now been +reverted and compatibility between OpenJDK 25 and older versions +restored. + +Note that this incompatibility occurred with the `Class` object and +not an instance of the object i.e. `writeObject(LocalDate.class)` +would produce incompatible serialised data, but +`writeObject(LocalDate.now())` would not. + +security-libs/java.security: + +JDK-8361212: Remove AffirmTrust root CAs +======================================== +The following root certificates from AffirmTrust, which were +deactivated in the 21.0.5 release of October 2024, have been removed +from the `cacerts` keystore: + +Alias name: affirmtrustcommercialca [jdk] +CN=AffirmTrust Commercial +O=AffirmTrust +C=US +SHA256: 03:76:AB:1D:54:C5:F9:80:3C:E4:B2:E2:01:A0:EE:7E:EF:7B:57:B6:36:E8:A9:3C:9B:8D:48:60:C9:6F:5F:A7 + +Alias name: affirmtrustnetworkingca [jdk] +CN=AffirmTrust Networking +O=AffirmTrust +C=US +SHA256: 0A:81:EC:5A:92:97:77:F1:45:90:4A:F3:8D:5D:50:9F:66:B5:E2:C5:8F:CD:B5:31:05:8B:0E:17:F3:F0B4:1B + +Alias name: affirmtrustpremiumca [jdk] +CN=AffirmTrust Premium +O=AffirmTrust +C=US +SHA256: 70:A7:3F:7F:37:6B:60:07:42:48:90:45:34:B1:14:82:D5:BF:0E:69:8E:CC:49:8D:F5:25:77:EB:F2:E9:3B:9A + +Alias name: affirmtrustpremiumeccca [jdk] +CN=AffirmTrust Premium ECC +O=AffirmTrust +C=US +SHA256: BD:71:FD:F6:DA:97:E4:CF:62:D1:64:7A:DD:25:81:B0:7D:79:AD:F8:39:7E:B4:EC:BA:9C:5E:84:88:82:14:23 + +New in release OpenJDK 25.0.0 (2025-09-16): +=========================================== +Major changes are listed below. Some changes may have been backported +to earlier releases following their first appearance in OpenJDK 22 +through to 25. + +NEW FEATURES +============ + +Language Features +================= + +Flexible Constructor Bodies +============================ +https://openjdk.org/jeps/447 +https://openjdk.org/jeps/482 +https://openjdk.org/jeps/492 +https://openjdk.org/jeps/513 + +In constructors in the Java programming language, allow statements to +appear before an explicit constructor invocation, i.e., super(..) or +this(..). The statements cannot reference the instance under +construction, but they can initialize its fields. Initializing fields +before invoking another constructor makes a class more reliable when +methods are overridden. + +This language feature is now finalised (JEP 513). It was first +introduced as a preview language feature +(http://openjdk.java.net/jeps/12) in OpenJDK 22 (JEP 447) under the +name "Statements before super(...)". It reached a second preview in +OpenJDK 23 (JEP 482) with the addition of allowing fields to be +initialized before invoking another constructor. It reached a third +preview in OpenJDK 24 (JEP 492). + +Unnamed Patterns and Variables +============================== +https://openjdk.org/jeps/443 +https://openjdk.org/jeps/456 + +Enhance the Java language with unnamed patterns, which match a record +component without stating the component's name or type, and unnamed +variables, which can be initialized but not used. Both are denoted by +an underscore character, _. + +This feature is now finalised (JEP 456). It was a preview feature +(http://openjdk.java.net/jeps/12) in OpenJDK 21 (JEP 443). + +Primitive Types in Patterns, instanceof, and switch +=================================================== +https://openjdk.org/jeps/455 +https://openjdk.org/jeps/488 +https://openjdk.org/jeps/507 + +Enhance pattern matching by allowing primitive type patterns in all +pattern contexts, and extend instanceof and switch to work with all +primitive types. + +This is a preview language feature (http://openjdk.java.net/jeps/12) +introduced in OpenJDK 23 (JEP 455) with a second preview in OpenJDK 24 +(JEP 488) and reaching a third in OpenJDK 25 (JEP 507). + +Module Import Declarations +========================== +https://openjdk.org/jeps/476 +https://openjdk.org/jeps/494 +https://openjdk.org/jeps/511 + +Enhance the Java programming language with the ability to succinctly +import all of the packages exported by a module. This simplifies the +reuse of modular libraries, but does not require the importing code to +be in a module itself. + +This language feature is now finalised (JEP 511). It was introduced as +a preview language feature (http://openjdk.java.net/jeps/12) in +OpenJDK 23 (JEP 476) and had a second preview in OpenJDK 24 (JEP 494). + +Library Features +================ + +Foreign Function & Memory API +============================= +https://openjdk.org/jeps/412 +https://openjdk.org/jeps/419 +https://openjdk.org/jeps/424 +https://openjdk.org/jeps/434 +https://openjdk.org/jeps/442 +https://openjdk.org/jeps/454 + +Introduce an API by which Java programs can interoperate with code and +data outside of the Java runtime. By efficiently invoking foreign +functions (i.e., code outside the JVM), and by safely accessing +foreign memory (i.e., memory not managed by the JVM), the API enables +Java programs to call native libraries and process native data without +the brittleness and danger of JNI. + +This API is now finalised (JEP 454). It was first introduced in +incubation (https://openjdk.java.net/jeps/11) in OpenJDK 17 (JEP 412), +and is an evolution of the Foreign Memory Access API (OpenJDK 14 +through 16) and Foreign Linker API (OpenJDK 16) (see release notes for +java-17-openjdk). OpenJDK 18 saw a second round of incubation (JEP +419) before its inclusion as a preview feature +(http://openjdk.java.net/jeps/12) in OpenJDK 19 (JEP 424). A second +preview took place in OpenJDK 20 (JEP 434) and a third and final +preview in OpenJDK 21 (JEP 442). + +Prepare to Restrict the Use of JNI +================================== +https://openjdk.org/jeps/472 + +Issue warnings about uses of the Java Native Interface (JNI) and +adjust the Foreign Function & Memory (FFM) API to issue warnings in a +consistent manner. All such warnings aim to prepare developers for a +future release that ensures integrity by default by uniformly +restricting JNI and the FFM API. Application developers can avoid both +current warnings and future restrictions by selectively enabling these +interfaces where essential using the --enable-native-access +command-line option. + +Class-File API +============== +https://openjdk.org/jeps/457 +https://openjdk.org/jeps/466 +https://openjdk.org/jeps/484 + +Provide a standard API for parsing, generating, and transforming Java +class files. + +This API is now finalised (JEP 484). It was introduced as a preview +library feature (http://openjdk.java.net/jeps/12) in OpenJDK 22 (JEP +457) with a second preview in OpenJDK 23 (JEP 466). + +Vector API +========== +https://openjdk.org/jeps/338 +https://openjdk.org/jeps/414 +https://openjdk.org/jeps/417 +https://openjdk.org/jeps/426 +https://openjdk.org/jeps/438 +https://openjdk.org/jeps/448 +https://openjdk.org/jeps/460 +https://openjdk.org/jeps/469 +https://openjdk.org/jeps/489 +https://openjdk.org/jeps/508 + +Introduce an API to express vector computations that reliably compile +at runtime to optimal vector hardware instructions on supported CPU +architectures and thus achieve superior performance to equivalent +scalar computations. + +This is an incubation feature (https://openjdk.java.net/jeps/11) +introduced in OpenJDK 16 (JEP 338). A second round of incubation took +place in OpenJDK 17 (JEP 414), OpenJDK 18 (JEP 417) saw a third, +OpenJDK 19 a fourth (JEP 426), OpenJDK 20 (JEP 438) a fifth, OpenJDK +21 a sixth (JEP 448), OpenJDK 22 a seventh (JEP 460), OpenJDK 23 an +eighth (JEP 469), OpenJDK 24 a ninth (JEP 489) and it reaches its +tenth in OpenJDK 25 (JEP 508). + +Stream Gatherers +================ +https://openjdk.org/jeps/461 +https://openjdk.org/jeps/473 +https://openjdk.org/jeps/485 + +Enhance the Stream API to support custom intermediate operations. This +will allow stream pipelines to transform data in ways that are not +easily achievable with the existing built-in intermediate operations. + +This API is now finalised (JEP 485). It was introduced as a preview +library feature (http://openjdk.java.net/jeps/12) in OpenJDK 22 (JEP +461) with a second preview in OpenJDK 23 (JEP 473). + +Structured Concurrency +====================== +https://openjdk.org/jeps/428 +https://openjdk.org/jeps/437 +https://openjdk.org/jeps/453 +https://openjdk.org/jeps/462 +https://openjdk.org/jeps/480 +https://openjdk.org/jeps/499 +https://openjdk.org/jeps/505 + +Simplify multithreaded programming by introducing an API for +structured concurrency. Structured concurrency treats multiple tasks +running in different threads as a single unit of work, thereby +streamlining error handling and cancellation, improving reliability, +and enhancing observability. + +This API was first introduced in incubation +(https://openjdk.java.net/jeps/11) in OpenJDK 19 (JEP 428) and had a +second round of incubation in OpenJDK 20 (JEP 437). It became a +preview feature (http://openjdk.java.net/jeps/12) in OpenJDK 21 (JEP +453), reached its second preview in OpenJDK 22 (JEP 462), had a third +preview in OpenJDK 23 (JEP 480), a fourth in OpenJDK 24 (JEP 499) and +reaches its fifth in OpenJDK 25 (JEP 505). + +Compact Source Files and Instance Main Methods +============================================== +https://openjdk.org/jeps/445 +https://openjdk.org/jeps/463 +https://openjdk.org/jeps/477 +https://openjdk.org/jeps/495 +https://openjdk.org/jeps/512 + +Evolve the Java programming language so that beginners can write their +first programs without needing to understand language features +designed for large programs. Far from using a separate dialect of the +language, beginners can write streamlined declarations for +single-class programs and then seamlessly expand their programs to use +more advanced features as their skills grow. Experienced developers +can likewise enjoy writing small programs succinctly, without the need +for constructs intended for programming in the large. + +This library feature is now finalised (JEP 512) with some minor +changes from the last release. It was first introduced as a preview +(http://openjdk.java.net/jeps/12) in OpenJDK 21 (JEP 445) under the +name "Unnamed Classes and Instance Main Methods". It reached a second +preview in OpenJDK 22 (JEP 463) and a third in OpenJDK 23 (JEP 477) +under the new name, "Implicitly Declared Classes and Instance Main +Methods", due to the move away from unnamed classes to an implicitly +declared name chosen by the host system. It had a fourth preview in +OpenJDK 24 (JEP 495) with new terminology and a revised title ("Simple +Source Files and Instance Main Methods"), but otherwise unchanged. + +Scoped Values +============= +https://openjdk.org/jeps/429 +https://openjdk.org/jeps/446 +https://openjdk.org/jeps/464 +https://openjdk.org/jeps/481 +https://openjdk.org/jeps/487 +https://openjdk.org/jeps/506 + +Introduce scoped values, which enable the sharing of immutable data +within and across threads. They are preferred to thread-local +variables, especially when using large numbers of virtual threads. + +This API is now finalised (JEP 506). This API was first introduced in +incubation (https://openjdk.java.net/jeps/11) in OpenJDK 20 (JEP +429). It became a preview feature (http://openjdk.java.net/jeps/12) in +OpenJDK 21 (JEP 446), had a second preview in OpenJDK 22 (JEP 464), a +third in OpenJDK 23 (JEP 481) and a fourth in OpenJDK 24 (JEP 487). + +Key Derivation Function API +=========================== +https://openjdk.org/jeps/478 +https://openjdk.org/jeps/510 + +Introduce an API for Key Derivation Functions (KDFs), which are +cryptographic algorithms for deriving additional keys from a secret +key and other data. + +This API is now finalised (JEP 510). It was first introduced as a +preview library feature (http://openjdk.java.net/jeps/12) in OpenJDK +24 (JEP 478). + +Quantum-Resistant Module-Lattice-Based Key Encapsulation Mechanism +================================================================== +https://openjdk.org/jeps/496 + +Enhance the security of Java applications by providing an +implementation of the quantum-resistant Module-Lattice-Based +Key-Encapsulation Mechanism (ML-KEM). Key encapsulation mechanisms +(KEMs) are used to secure symmetric keys over insecure communication +channels using public key cryptography. ML-KEM is designed to be +secure against future quantum computing attacks. It has been +standardized by the United States National Institute of Standards and +Technology (NIST) in FIPS 203 [0]. + +[0] https://csrc.nist.gov/pubs/fips/203/final + +Quantum-Resistant Module-Lattice-Based Digital Signature Algorithm +================================================================== +https://openjdk.org/jeps/497 + +Enhance the security of Java applications by providing an +implementation of the quantum-resistant Module-Lattice-Based Digital +Signature Algorithm (ML-DSA). Digital signatures are used to detect +unauthorized modifications to data and to authenticate the identity of +signatories. ML-DSA is designed to be secure against future quantum +computing attacks. It has been standardized by the United States +National Institute of Standards and Technology (NIST) in FIPS 204 [0]. + +[0] https://csrc.nist.gov/pubs/fips/204/final + +PEM Encodings of Cryptographic Objects +====================================== +https://openjdk.org/jeps/470 + +Introduce an API for encoding objects that represent cryptographic +keys, certificates, and certificate revocation lists into the +widely-used Privacy-Enhanced Mail (PEM) transport format, and for +decoding from that format back into objects. + +This is a preview library feature (http://openjdk.java.net/jeps/12) +introduced in OpenJDK 25 (JEP 470). + +Stable Values +============= +https://openjdk.org/jeps/502 + +Introduce an API for stable values, which are objects that hold +immutable data. Stable values are treated as constants by the JVM, +enabling the same performance optimizations that are enabled by +declaring a field final. Compared to final fields, however, stable +values offer greater flexibility as to the timing of their +initialization. + +This is a preview library feature (http://openjdk.java.net/jeps/12) +introduced in OpenJDK 25 (JEP 502). + +Virtual Machine Enhancements +============================ + +Region Pinning for G1 +===================== +https://openjdk.org/jeps/423 + +Reduce latency by implementing region pinning in G1, so that garbage +collection need not be disabled during Java Native Interface (JNI) +critical regions. + +ZGC: Generational Mode by Default +================================= +https://openjdk.org/jeps/439 +https://openjdk.org/jeps/474 + +Switch the default mode of the Z Garbage Collector (ZGC) to the +generational mode. Deprecate the non-generational mode, with the +intent to remove it in a future release. + +Late Barrier Expansion for G1 +============================= +https://openjdk.org/jeps/475 + +Simplify the implementation of the G1 garbage collector's barriers, +which record information about application memory accesses, by +shifting their expansion from early in the C2 JIT's compilation +pipeline to later. + +Ahead-of-Time Class Loading & Linking +===================================== +https://openjdk.org/jeps/483 +https://openjdk.org/jeps/514 + +Improve startup time by making the classes of an application instantly +available, in a loaded and linked state, when the HotSpot Java Virtual +Machine starts. Achieve this by monitoring the application during one +run and storing the loaded and linked forms of all classes in a cache +for use in subsequent runs. Lay a foundation for future improvements +to both startup and warmup time. + +Using this feature requires a two stage process: + +1. Create the Ahead-of-Time cache from a training run of the +application using the option `--XX:AOTCacheOutput=` where +`` is the cache reference to use in later runs. + +2. When running the application in testing or production, use the +option `-XX:AOTCache=` to run the application with the +cache generated in #2. + +Previously, in OpenJDK 24 (JEP 483), the training run and cache +creation were handled by two separate steps: + +1. Populate the Ahead-of-Time configuration data with a training run +of the application using the options `-XX:AOTMode=record +-XX:AOTConfiguration=` where `` is the +configuration reference to use in #2. + +2. Create the Ahead-of-Time cache using the options +`-XX:AOTMode=create -XX:AOTConfiguration= +-XX:AOTCache=` where `` is the configuration +reference from #1 and `` is the cache reference to use in +later runs. + +JEP 514 ("Ahead-of-Time Command-Line Ergonomics") in OpenJDK 25 adds +the option `--XX:AOTCacheOutput` which performs both the above steps +from a single command-line invocation using a temporary configuration +file. A new environment variable, `JDK_AOT_VM_OPTIONS`, can be used +to pass options to the cache creation step without affecting the +training run step. + +Ahead-of-Time Method Profiling +============================== +https://openjdk.org/jeps/515 + +Improve warmup time by making method-execution profiles from a +previous run of an application instantly available, when the HotSpot +Java Virtual Machine starts. This will enable the JIT compiler to +generate native code immediately upon application startup, rather than +having to wait for profiles to be collected. + +Synchronize Virtual Threads without Pinning +=========================================== +https://openjdk.org/jeps/491 + +Improve the scalability of Java code that uses synchronized methods +and statements by arranging for virtual threads that block in such +constructs to release their underlying platform threads for use by +other virtual threads. This will eliminate nearly all cases of virtual +threads being pinned to platform threads, which severely restricts the +number of virtual threads available to handle an application's +workload. + +Compact Object Headers +====================== +https://openjdk.org/jeps/450 +https://openjdk.org/jeps/519 + +Reduce the size of object headers in the HotSpot JVM from between 96 +and 128 bits down to 64 bits on 64-bit architectures. This will reduce +heap size, improve deployment density, and increase data locality. + +This is now a production feature in OpenJDK 25 (JEP 519) enabled using +`-XX:+UseCompactObjectHeaders`. It was first introduced as an +experimental feature (JEP 450) that also required the use of +`-XX:+UnlockExperimentalVMOptions`. + +Generational Shenandoah +======================= +https://openjdk.org/jeps/404 +https://openjdk.org/jeps/521 + +Enhance the Shenandoah garbage collector with experimental +generational collection capabilities to improve sustainable +throughput, load-spike resilience, and memory utilization. + +This is now a production feature in OpenJDK 25 (JEP 521) enabled using +`-XX:ShenandoahGCMode=generational`. It was first introduced as an +experimental feature (JEP 404) that also required the use of +`-XX:+UnlockExperimentalVMOptions`. + +JFR Cooperative Sampling +======================== +https://openjdk.org/jeps/518 + +Improve the stability of the JDK Flight Recorder (JFR) when it +asynchronously samples Java thread stacks. Achieve this by walking +call stacks only at safepoints, while minimizing safepoint bias. + +JFR Method Timing & Tracing +=========================== +https://openjdk.org/jeps/520 + +Extend the JDK Flight Recorder (JFR) with facilities for method timing +and tracing via bytecode instrumentation. + +JFR CPU-Time Profiling +====================== +https://openjdk.org/jeps/509 + +Enhance the JDK Flight Recorder (JFR) to capture more accurate +CPU-time profiling information on Linux. + +This is an experimental feature so its JFR events are tagged with the +`@Experimental` annotation. Unlike other experimental virtual machine +features, it does not need to be explicitly enabled with +`-XX:+UnlockExperimentalVMOptions`. + +Tools +===== + +Launch Multi-File Source-Code Programs +====================================== +https://openjdk.org/jeps/458 + +Enhance the java application launcher to be able to run a program +supplied as multiple files of Java source code. This will make the +transition from small programs to larger ones more gradual, enabling +developers to choose whether and when to go to the trouble of +configuring a build tool. + +Markdown Documentation Comments +=============================== +https://openjdk.org/jeps/467 + +Enable JavaDoc documentation comments to be written in Markdown rather +than solely in a mixture of HTML and JavaDoc @-tags. + +Linking Run-Time Images without JMODs +===================================== +https://openjdk.org/jeps/493 + +Reduce the size of the JDK by approximately 25% by enabling the jlink +tool to create custom run-time images without using the JDK's JMOD +files. + +This feature must be enabled when the JDK is built using the +--enable-linkable-runtime option. It will not be enabled by default, +and some JDK vendors may choose not to enable it. + +DEPRECATIONS +============ + +Deprecate the Memory-Access Methods in sun.misc.Unsafe for Removal +================================================================== +https://openjdk.org/jeps/471 + +Deprecate the memory-access methods in sun.misc.Unsafe for removal in +a future release. These unsupported methods have been superseded by +standard APIs, namely the VarHandle API (JEP 193, OpenJDK 9) and the +Foreign Function & Memory API (JEP 454, OpenJDK 22). We strongly +encourage library developers to migrate from sun.misc.Unsafe to +supported replacements, so that applications can migrate smoothly to +modern JDK releases. + +Warn upon Use of Memory-Access Methods in sun.misc.Unsafe +========================================================= +https://openjdk.org/jeps/498 + +Issue a warning at run time on the first occasion that any +memory-access method in sun.misc.Unsafe is invoked. All of these +unsupported methods were terminally deprecated in JDK 23 (see JEP 471 +above). They have been superseded by standard APIs, namely the +VarHandle API (JEP 193, OpenJDK 9) and the Foreign Function & Memory +API (JEP 454, OpenJDK 22). We strongly encourage library developers to +migrate from sun.misc.Unsafe to supported replacements, so that +applications can migrate smoothly to modern JDK releases. + +Permanently Disable the Security Manager +======================================== +https://openjdk.org/jeps/486 + +The Security Manager has not been the primary means of securing +client-side Java code for many years, it has rarely been used to +secure server-side code, and it is costly to maintain. We therefore +deprecated it for removal in OpenJDK 17 via JEP 411 (2021). As the +next step toward removing the Security Manager, we will revise the +Java Platform specification so that developers cannot enable it and +other Platform classes do not refer to it. This change will have no +impact on the vast majority of applications, libraries, and tools. We +will remove the Security Manager API in a future release. + +REMOVALS +======== + +String Templates +================ +https://openjdk.org/jeps/430 +https://openjdk.org/jeps/459 +https://openjdk.org/jeps/465 + +This was a preview feature (http://openjdk.java.net/jeps/12) +introduced in OpenJDK 21 (JEP 430) with a second preview in OpenJDK 22 +(JEP 459). A third preview was proposed but ultimately withdrawn for +OpenJDK 23 (JEP 465) and the feature is no longer present. See [0] +for further explanation. + +[0] https://mail.openjdk.org/pipermail/amber-spec-experts/2024-April/004106.html + +Remove the Windows & Linux 32-bit x86 Ports +=========================================== +https://openjdk.org/jeps/449 +https://openjdk.org/jeps/479 +https://openjdk.org/jeps/501 +https://openjdk.org/jeps/503 + +Remove the source code and build support for the Windows (JEP 479) & +Linux (JEP 503) 32-bit x86 ports. The Windows port was deprecated for +removal in JDK 21 by JEP 449 and the Linux port was deprecated for +removal in JDK 24 by JEP 501. Both deprecations took place with the +express intent to remove the ports in a future release. + +Following this removal of these 32-bit x86 ports, the +architecture-agnostic Zero port is the only way to run Java programs +on 32-bit x86 processors. + +ZGC: Remove the Non-Generational Mode +===================================== +https://openjdk.org/jeps/439 +https://openjdk.org/jeps/474 +https://openjdk.org/jeps/490 + +Remove the non-generational mode of the Z Garbage Collector (ZGC), +keeping the generational mode as the default for ZGC (see JEP 439 & +474). diff --git a/TestTranslations.java b/TestTranslations.java index f6a4fe2..1b02c06 100644 --- a/TestTranslations.java +++ b/TestTranslations.java @@ -50,11 +50,11 @@ public class TestTranslations { "Mountain Daylight Time", "MDT", "MDT", "Mountain Time", "MT", "MT"}); map.put(Locale.FRANCE, new String[] { "heure normale des Rocheuses", "UTC\u221207:00", "MST", - "heure d\u2019\u00e9t\u00e9 des Rocheuses", "UTC\u221206:00", "MDT", - "heure des Rocheuses", "UTC\u221207:00", "MT"}); - map.put(Locale.GERMANY, new String[] { "Rocky-Mountain-Normalzeit", "GMT-07:00", "MST", - "Rocky-Mountain-Sommerzeit", "GMT-06:00", "MDT", - "Rocky-Mountain-Zeit", "GMT-07:00", "MT"}); + "heure d\u2019\u00e9t\u00e9 des Rocheuses", "UTC\u221206:00", "MST", + "heure des Rocheuses", "UTC\u221207:00", "MST"}); + map.put(Locale.GERMANY, new String[] { "Rocky-Mountains-Normalzeit", "GMT-07:00", "MST", + "Rocky-Mountains-Sommerzeit", "GMT-06:00", "MST", + "Rocky-Mountains-Zeit", "GMT-07:00", "MST"}); CIUDAD_JUAREZ = Collections.unmodifiableMap(map); } @@ -97,14 +97,10 @@ public class TestTranslations { System.out.printf("Checking locale %s for %s...\n", l, id); - if ("JRE".equals(localeProvider)) { + if ("JRE".equals(localeProvider) || "CLDR".equals(localeProvider)) { expectedShortStd = expected[2]; expectedShortDST = expected[5]; expectedShortGen = expected[8]; - } else if ("CLDR".equals(localeProvider)) { - expectedShortStd = expected[1]; - expectedShortDST = expected[4]; - expectedShortGen = expected[7]; } else { System.err.printf("Invalid locale provider %s\n", localeProvider); System.exit(3); diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index 213f7b4..7b48c3d 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -1,10 +1,5 @@ -%if (0%{?rhel} > 0 && 0%{?rhel} < 8) -# portable jdk 17 specific bug, _jvmdir being missing -%define _jvmdir /usr/lib/jvm -%endif - # debug_package %%{nil} is portable-jdks specific -%define debug_package %{nil} +%define debug_package %{nil} # RPM conditionals so as to be able to dynamically produce # slowdebug/release builds. See: @@ -65,6 +60,10 @@ # See: https://bugzilla.redhat.com/show_bug.cgi?id=1520879 %global _find_debuginfo_opts -g +# Disable LTO as this causes build failures at the moment. +# See RHBZ#1861401 +%define _lto_cflags %{nil} + # note: parametrized macros are order-sensitive (unlike not-parametrized) even with normal macros # also necessary when passing it as parameter to other macros. If not macro, then it is considered a switch # see the difference between global and define: @@ -160,6 +159,8 @@ %else %global gdb_arches %{jit_arches} %{zero_arches} %endif +# Architecture on which we run Java only tests +%global jdk_test_arch x86_64 # By default, we build a slowdebug build during main build on JIT architectures %if %{with slowdebug} @@ -243,29 +244,83 @@ # Target to use to just build HotSpot %global hotspot_target hotspot -# When building on older systems, we need system, or self build legacy toolchains of explicit version -%if ((0%{?rhel} > 0 && 0%{?rhel} < 8)) || ((0%{?epel} > 0 && 0%{?epel} < 9)) -%global is_dtstoolchain 1 + +# Individual build frameworks this specfile supports +# if elif ... elif ... elif ... else is unluckily buggy +# On rhel7 we need software collection +%if (0%{?rhel} == 7) +%global is_dtstoolchain collection +%global dtsversion 10 +%global dtsname devtoolset-%{dtsversion} +%global dts_command scl enable %{dtsname} -- +%global exclusive_arches %{nil} +%define dts_brs # Brs for collection\ +BuildRequires: %{dtsname}-gcc \ +BuildRequires: %{dtsname}-gcc-c++ %else -%global is_dtstoolchain 0 +# On rhel8 we have self built custom devkit +%if ((0%{?rhel} == 8) && (0%{?epel} == 0)) +%global is_dtstoolchain devkit +%global dtsversion 1.0-9 +%global dtsname %{origin}-devkit +%global dts_command %{nil} +%if 0%{?centos} == 0 +# centos had originally smaller set of devkit arches +%global exclusive_arches %{aarch64} %{ppc64le} s390x x86_64 riscv64 +%else +%global exclusive_arches %{aarch64} %{ppc64le} s390x x86_64 riscv64 +%endif +%define dts_brs # Brs for devkit\ +BuildRequires: %{dtsname} >= %{dtsversion} +%else +# On newest systems we use system gcc and friens +%if ((0%{?fedora} > 0) || (0%{?rhel} >= 9) || (0%{?epel} >= 9)) +%global is_dtstoolchain system +%global dtsversion %{nil} +%global dtsname %{nil} +%global exclusive_arches %{java_arches} +%define dts_brs # Brs for system\ +BuildRequires: gcc >= 4.8.3-8 \ +BuildRequires: gcc-c++ \ +# We link statically against libstdc++ to increase portability \ +BuildRequires: libstdc++-static +# When building on epel8, we need system, legacy toolchain of explicit version +%else +%if ((0%{?epel}) > 0 && (0%{?epel} <= 8)) +%global is_dtstoolchain toolset +%global dtsversion 14 +%global dtsname gcc-toolset-%{dtsversion} +%global exclusive_arches %{java_arches} +%define dts_brs # Brs for toolset\ +BuildRequires: %{dtsname}-gcc \ +BuildRequires: %{dtsname}-gcc-c++ \ +BuildRequires: %{dtsname}-annobin-annocheck \ +BuildRequires: %{dtsname}-annobin-plugin-gcc \ +BuildRequires: %{dtsname}-binutils \ +BuildRequires: %{dtsname}-gcc-plugin-annobin \ +# We link statically against libstdc++ to increase portability \ +BuildRequires: libstdc++-static +# no go +%else +"Unsupported system: fedora=0%{?fedora} rhel=0%{?rhel} epel=0%{?epel} centos=0%{?centos}" +exit 1 %endif -%if ((0%{?rhel} > 0 && 0%{?rhel} < 8)) -# DTS toolset to use to provide gcc & binutils -%global dtsversion 10 -%global dtsname devtoolset %endif -%if ((0%{?epel} > 0 && 0%{?epel} < 9)) -# GCC toolset to use to provide gcc & binutils -%global dtsversion 14 -%global dtsname gcc-toolset %endif -%if %{is_dtstoolchain} -%global dtsid %{dtsname}-%{dtsversion} %endif -# Disable LTO as this causes build failures at the moment. -# See RHBZ#1861401 -%define _lto_cflags %{nil} +%if ((0%{?epel}) > 0 || (0%{?fedora} > 8)) +%global use_portable_bootjdk 0 +%else +%global use_portable_bootjdk 1 +%endif + +# Check if pandoc is available to generate docs (including man pages) +%if 0%{?rhel} == 8 || 0%{?epel} > 0 || 0%{?fedora} > 0 +%global pandoc_available 1 +%else +%global pandoc_available 0 +%endif # Filter out flags from the optflags macro that cause problems with the OpenJDK build # We filter out -O flags so that the optimization of HotSpot is not lowered from O3 to O2 @@ -340,12 +395,10 @@ %global stapinstall %{nil} %endif +# on fedora and epel, we build systemtap in repacking to rpms +# thus having it disabled, and keeping the lines just for sync reasons %ifarch %{systemtap_arches} -%if (0%{?rhel} > 0 && !0%{?epel}) -%global with_systemtap 1 -%else %global with_systemtap 0 -%endif %else %global with_systemtap 0 %endif @@ -368,16 +421,6 @@ %global lts_designator "" %global lts_designator_zip "" %endif -# JDK to use for bootstrapping -%global bootjdk /usr/lib/jvm/java-latest-openjdk -# Define whether to use the bootstrap JDK directly or with a fresh libjvm.so -# This will only work where the bootstrap JDK is the same major version -# as the JDK being built -%if %{with fresh_libjvm} && %{buildjdkver} == %{featurever} -%global build_hotspot_first 1 -%else -%global build_hotspot_first 0 -%endif # Define vendor information used by OpenJDK %global oj_vendor Red Hat, Inc. @@ -403,6 +446,7 @@ # Define IcedTea version used for SystemTap tapsets and desktop file %global icedteaver 6.0.0pre00-c848b93a8598 # Define current Git revision for the FIPS support patches +%global fipsver 9203d50836c # Define JDK versions %global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver} %global javaver %{featurever} @@ -417,7 +461,7 @@ %global top_level_dir_name %{vcstag} %global top_level_dir_name_backup %{top_level_dir_name}-backup %global buildver 8 -%global rpmrelease 1 +%global rpmrelease 2 #%%global tagsuffix %%{nil} # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit %if %is_system_jdk @@ -469,11 +513,16 @@ %define uniquesuffix() %{expand:%{fullversion}.%{_arch}%{?1}} # portable only declarations %global jreimage jre -%define jreportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable%{1}.jre;g" | sed "s;openjdkportable;el;g") -%define jdkportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable%{1}.jdk;g" | sed "s;openjdkportable;el;g") -%define jdkportablesourcesnameimpl() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable%{1}.sources;g" | sed "s;openjdkportable;el;g" | sed "s;.%{_arch};.noarch;g") -%define staticlibsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable%{1}.static-libs;g" | sed "s;openjdkportable;el;g") -%define jmodsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable%{1}.jmods;g" | sed "s;openjdkportable;el;g") +%if ((0%{?fedora} > 0) || (0%{?epel} > 0)) +%define regexBase %{version}-%{release} +%else +%define regexBase el%{rhel}\\(_[0-9]\\)* +%endif +%define jreportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.jre;g" | sed "s;openjdkportable;el;g") +%define jdkportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.jdk;g" | sed "s;openjdkportable;el;g") +%define jdkportablesourcesnameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.sources;g" | sed "s;openjdkportable;el;g" | sed "s;.%{_arch};.noarch;g") +%define staticlibsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.static-libs;g" | sed "s;openjdkportable;el;g") +%define jmodsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.jmods;g" | sed "s;openjdkportable;el;g") %define jreportablearchive() %{expand:%{jreportablenameimpl -- %%{1}}.tar.xz} %define jdkportablearchive() %{expand:%{jdkportablenameimpl -- %%{1}}.tar.xz} %define jdkportablesourcesarchive() %{expand:%{jdkportablesourcesnameimpl -- %%{1}}.tar.xz} @@ -485,9 +534,9 @@ # Intentionally use jdkportablenameimpl here since we want to have static-libs files overlayed on # top of the JDK archive %define staticlibsportablename() %{expand:%{jdkportablenameimpl -- %%{1}}} -%define docportablename() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable.docs;g" | sed "s;openjdkportable;el;g") +%define docportablename() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable.docs;g" | sed "s;openjdkportable;el;g") %define docportablearchive() %{docportablename}.tar.xz -%define miscportablename() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable.misc;g" | sed "s;openjdkportable;el;g") +%define miscportablename() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable.misc;g" | sed "s;openjdkportable;el;g") %define miscportablearchive() %{miscportablename}.tar.xz # RPM 4.19 no longer accept our double percentaged %%{nil} passed to %%{1} @@ -498,6 +547,29 @@ %define staticlibsportablearchiveForFiles() %(echo %{staticlibsportablearchive -- ""}) %define jmodsportablearchiveForFiles() %(echo %{jmodsportablearchive -- ""}) +# JDK to use for bootstrapping +%ifarch %{fastdebug_arches} +%global bootdebugpkg fastdebug +%endif +%if %{use_portable_bootjdk} +%global bootjdkpkg_name java-%{featurever}-%{origin} +%global bootjdkpkg %{bootjdkpkg_name}-portable-devel%{?bootdebugpkg:-%{bootdebugpkg}} >= %{buildjdkver} +%global bootjdkzip %{_jvmdir}/%{bootjdkpkg_name}-*.portable%{?bootdebugpkg:.%{bootdebugpkg}}.jdk.%{_arch}.tar.xz +%global bootjdk %{_builddir}/%{uniquesuffix -- ""}/%{bootjdkpkg_name}.boot +%else +%global bootjdkpkg_name java-latest-openjdk +%global bootjdkpkg %{bootjdkpkg_name}-devel%{?bootdebugpkg:-%{bootdebugpkg}} +%global bootjdk /usr/lib/jvm/%{bootjdkpkg_name}%{?bootdebugpkg:-%{bootdebugpkg}} +%endif +# Define whether to use the bootstrap JDK directly or with a fresh libjvm.so +# This will only work where the bootstrap JDK is the same major version +# as the JDK being built +%if %{with fresh_libjvm} && %{buildjdkver} == %{featurever} +%global build_hotspot_first 1 +%else +%global build_hotspot_first 0 +%endif + ################################################################# # fix for https://bugzilla.redhat.com/show_bug.cgi?id=1111349 # https://bugzilla.redhat.com/show_bug.cgi?id=1590796#c14 @@ -547,13 +619,6 @@ %global alternatives_requires %{_sbindir}/alternatives %endif -# x86 is no longer supported -%if 0%{?java_arches:1} -ExclusiveArch: %{java_arches} -%else -ExcludeArch: %{ix86} -%endif - # Portables have no repo (requires/provides), but these are awesome for orientation in spec # Also scriptlets are happily missing and files are handled old fashion # not-duplicated requires/provides/obsoletes for normal/debug packages @@ -579,6 +644,15 @@ ExcludeArch: %{ix86} # this expression, when declared as global, filled component with java-x-vendor portable %define component %(echo %{name} | sed "s;-portable%{?pkgos:-%{pkgos}};;g") +# Define the architectures on which we build +# On RHEL, this should be the architectures with a devkit +%if "%{?exclusive_arches}" == "%{nil}" +# x86 is no longer supported +ExcludeArch: %{ix86} +%else +ExclusiveArch: %{exclusive_arches} +%endif + Name: java-latest-%{origin}-portable%{?pkgos:-%{pkgos}} Version: %{newjavaver}.%{buildver} # This package needs `.rolling` as part of Release so as to not conflict on install with @@ -663,7 +737,7 @@ Source18: TestTranslations.java # ############################################ # Crypto policy and FIPS support patches -# Patch is generated from the fips-21u tree at https://github.com/rh-openjdk/jdk/tree/fips-21u +# Patch is generated from the fips-25u tree at https://github.com/rh-openjdk/jdk/tree/fips-25u # as follows: git diff %%{vcstag} src make test > fips-21u-$(git show -s --format=%h HEAD).patch # Diff is limited to src and make subdirectories to exclude .github changes # The following list is generated by: @@ -700,6 +774,7 @@ Source18: TestTranslations.java # test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class # RH1940064: Enable XML Signature provider in FIPS mode # RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized [now part of JDK-8301553 upstream] +# Disabled in latest: Patch1001: fips-%%{featurever}u-%%{fipsver}.patch ############################################# # @@ -735,27 +810,8 @@ BuildRequires: desktop-file-utils BuildRequires: elfutils-devel BuildRequires: file BuildRequires: fontconfig-devel -%if %{is_dtstoolchain} -BuildRequires: %{dtsid}-gcc -BuildRequires: %{dtsid}-gcc-c++ -%endif -%if %{is_dtstoolchain} && "%{?dtsname}" == "gcc-toolset" -# wee need slightly more for gcc-toolset -BuildRequires: %{dtsid}-annobin-annocheck -BuildRequires: %{dtsid}-annobin-plugin-gcc -BuildRequires: %{dtsid}-binutils -BuildRequires: %{dtsid}-gcc-plugin-annobin -%endif -%if ! %{is_dtstoolchain} -# Earlier versions have a bug in tree vectorization on PPC -BuildRequires: gcc >= 4.8.3-8 -BuildRequires: gcc-c++ -%endif +%{dts_brs} BuildRequires: gdb -%if (0%{?rhel} > 0 && 0%{?rhel} < 8) -# rhel7 only, portables only. Rhel8 have gtk3, rpms have runtime recommends of gtk -BuildRequires: gtk2-devel -%endif BuildRequires: libxslt BuildRequires: libX11-devel BuildRequires: libXi-devel @@ -767,7 +823,7 @@ BuildRequires: libXtst-devel # Requirement for setting up nss.fips.cfg BuildRequires: nss-devel # Requirement for system security property test -# N/A for portable. RHEL7 doesn't provide them +# N/A for portable as we don't enable support for them #BuildRequires: crypto-policies BuildRequires: pkgconfig BuildRequires: xorg-x11-proto-devel @@ -775,22 +831,18 @@ BuildRequires: zip # to pack portable tarballs BuildRequires: tar BuildRequires: unzip -%if (0%{?rhel} > 0 && 0%{?rhel} < 8) -BuildRequires: javapackages-tools -BuildRequires: java-%{buildjdkver}-%{origin}%{?pkgos:-%{pkgos}}-devel -%else BuildRequires: javapackages-filesystem -BuildRequires: java-latest-openjdk-devel -%endif +BuildRequires: %{bootjdkpkg} # Zero-assembler build requirement %ifarch %{zero_arches} BuildRequires: libffi-devel %endif # Full documentation build requirements +# pandoc is only available on RHEL/CentOS 8, epels, and fedoras +%if %{pandoc_available} BuildRequires: graphviz BuildRequires: pandoc -# 2023c required as of JDK-8305113 -BuildRequires: tzdata-java >= 2023c +%endif # cacerts build requirement in portable mode BuildRequires: ca-certificates @@ -822,8 +874,6 @@ Provides: bundled(libjpeg) = 6b Provides: bundled(libpng) = 1.6.47 # Version in src/java.base/share/native/libzip/zlib/zlib.h Provides: bundled(zlib) = 1.3.1 -# We link statically against libstdc++ to increase portability -BuildRequires: libstdc++-static %endif # this is always built, also during debug-only build @@ -963,13 +1013,15 @@ The %{origin_nice} %{featurever} full patched sources of portable JDK to build, %prep -echo "Preparing %{oj_vendor_version}" - # Using the echo macro breaks rpmdev-bumpspec, as it parses the first line of stdout :-( +echo "Preparing %{oj_vendor_version}" +echo "System is RHEL=%{?rhel}%{!?rhel:0}, CentOS=%{?centos}%{!?centos:0}, EPEL=%{?epel}%{!?epel:0}, Fedora=%{?fedora}%{!?fedora:0}" +echo "Build JDK version is %{buildjdkver}, bootstrap JDK package is %{bootjdkpkg}" + %if 0%{?_build_cpu:1} echo "CPU: %{_target_cpu}, arch install directory: %{archinstall}, SystemTap install directory: %{_build_cpu}" %else - %{error:Unrecognised architecture %{_build_cpu}} + %{error:Unrecognised architecture %{_target_cpu}} %endif if [ %{include_normal_build} -eq 0 -o %{include_normal_build} -eq 1 ] ; then @@ -996,8 +1048,8 @@ if [ %{include_debug_build} -eq 0 -a %{include_normal_build} -eq 0 -a %{includ fi %if %{with fresh_libjvm} && ! %{build_hotspot_first} -echo "WARNING: The build of a fresh libjvm has been disabled due to a JDK version mismatch" -echo "Build JDK version is %{buildjdkver}, feature JDK version is %{featurever}" +%{warn: The build of a fresh libjvm has been disabled due to a JDK version mismatch} +%{warn: Build JDK version is %{buildjdkver}, feature JDK version is %{featurever}} %endif export XZ_OPT="-T0" @@ -1016,12 +1068,31 @@ sh %{SOURCE12} %{top_level_dir_name} %endif # Patch the JDK +# This syntax is deprecated: +# %%patchN [...] +# and should be replaced with: +# %%patch -PN [...] +# For example: +# %%patch1001 -p1 +# becomes: +# %%patch -P1001 -p1 +# The replacement format suggested by recent (circa Fedora 38) RPM +# deprecation messages: +# %%patch N [...] +# is not backward-compatible with prior (circa RHEL-8) versions of +# rpmbuild. pushd %{top_level_dir_name} # Add crypto policy and FIPS support -# Skipping fips patch whil eit is not ready for jdk22 %%patch -P1001 -p1 -# Patches in need of upstreaming +# Not suitable for latest +#%%patch -P1001 -p1 popd # openjdk +echo "Generating %{alt_java_name} man page" +altjavamanpage=%{top_level_dir_name}/src/java.base/share/man/%{alt_java_name}.md +altjavatext="Hardened java binary recommended for launching untrusted code from the Web e.g. javaws" +sed -r -e 's|([^/.])java([^./])|\1alt-java\2|g' %{top_level_dir_name}/src/java.base/share/man/java.md | \ + sed -e 's|JAVA(|ALT-JAVA(|' | \ + sed -e "s|java - launch a Java application|alt-java - ${altjavatext}|" >> ${altjavamanpage} # The OpenJDK version file includes the current # upstream version information. For some reason, @@ -1040,16 +1111,44 @@ if [ "x${UPSTREAM_EA_DESIGNATOR}" != "x%{ea_designator}" ] ; then echo "WARNING: Designator mismatch"; echo "Spec file is configured for a %{build_type} build with designator '%{ea_designator}'" echo "Upstream version-pre setting is '${UPSTREAM_EA_DESIGNATOR}'"; - #exit 17 + exit 17 fi -# Systemtap is processed in rpms +# Systemtap is processed in rpms on fedoras and epels # Prepare desktop files # Portables do not have desktop integration -%build +# Extract devkit +%if "%{is_dtstoolchain}" == "devkit" + devkittarball=%{_datadir}/%{dtsname}/sdk-%{_target_cpu}-%{_target_os}-gnu*.tar.gz + echo "Extracting devkit ${devkittarball}"; + mkdir devkit; + tar -C devkit --strip-components=1 -xzf ${devkittarball} + DEVKIT_ROOT=$(pwd)/devkit + source ${DEVKIT_ROOT}/devkit.info + echo "Installed ${DEVKIT_NAME} devkit" +%else +%if 0%{?centos} > 0 + echo "No devkit for CentOS %{?centos}" +%else + echo "No devkit for %{_target_cpu} on RHEL %{?rhel}"; +%endif +%endif +%if %{use_portable_bootjdk} + # Extract build JDK + pushd %{_jvmdir} + sha256sum --check %{bootjdkzip}.sha256sum + popd + tar -xJf %{bootjdkzip} + mv java-%{featurever}-openjdk-%{buildjdkver}* %{bootjdk} + # Print release information + echo "Installed boot JDK:" + cat %{bootjdk}/release +%endif + +%build # How many CPU's do we have? export NUM_PROC=%(/usr/bin/getconf _NPROCESSORS_ONLN 2> /dev/null || :) export NUM_PROC=${NUM_PROC:-1} @@ -1057,6 +1156,7 @@ export NUM_PROC=${NUM_PROC:-1} # Honor %%_smp_ncpus_max [ ${NUM_PROC} -gt %{?_smp_ncpus_max} ] && export NUM_PROC=%{?_smp_ncpus_max} %endif +export XZ_OPT="-T0" %ifarch s390x sparc64 alpha %{power64} %{aarch64} riscv64 export ARCH_DATA_MODEL=64 @@ -1080,14 +1180,61 @@ EXTRA_CFLAGS="$EXTRA_CFLAGS -fno-strict-aliasing" EXTRA_CFLAGS="$(echo ${EXTRA_CFLAGS} | sed -e 's|-mstackrealign|-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4|')" EXTRA_CPP_FLAGS="$(echo ${EXTRA_CPP_FLAGS} | sed -e 's|-mstackrealign|-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4|')" %endif +%if "%{is_dtstoolchain}" == "devkit" +# Remove annobin plugin reference which isn't available in the devkit +EXTRA_CFLAGS="$(echo ${EXTRA_CFLAGS} | sed -e 's|-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1||')" +EXTRA_CPP_FLAGS="$(echo ${EXTRA_CPP_FLAGS} | sed -e 's|-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1||')" +# Force DWARF 4 for compatibility +EXTRA_CFLAGS="${EXTRA_CFLAGS} -gdwarf-4" +EXTRA_CPP_FLAGS="${EXTRA_CPP_FLAGS} -gdwarf-4" +%endif + export EXTRA_CFLAGS EXTRA_CPP_FLAGS -echo "Building %{SOURCE11}" -mkdir %{miscinstalloutputdir} -mkdir %{altjavaoutputdir} -gcc ${EXTRA_CFLAGS} -o %{altjavaoutputdir}/%{alt_java_name} %{SOURCE11} - -echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}" +# Set modification times (mtimes) of files within JAR files generated +# by the OpenJDK build to a timestamp that is constant across RPM +# rebuilds. OpenJDK provides the --with-source-date configure option +# for this purpose. Potential arguments in the RPM build context are: +# +# A) --with-source-date="${SOURCE_DATE_EPOCH}" +# B) --with-source-date=version +# C) --with-source-date="${OPENJDK_UPSTREAM_TAG_EPOCH}" +# +# Consider Option A. Fedora 38 (rpm-4.18.2) and RHEL-8 (rpm-4.14.3) +# have different support for SOURCE_DATE_EPOCH. To keep +# SOURCE_DATE_EPOCH constant across RPM rebuilds, one could set the +# source_date_epoch_from_changelog macro to 1 on both Fedora 38 and +# RHEL-8. However, on RHEL-8, this results in the RPM build times +# being set to the timestamp of the most recent changelog. This is +# bad for tracing when RPMs were actually built. Fedora 38 supports a +# better behaviour via the introduction of the +# use_source_date_epoch_as_buildtime macro, set to 0 by default. +# There is no way to make this work on RHEL-8 as well though, so +# option A is suboptimal. +# +# Option B uses the value of the DEFAULT_VERSION_DATE field from +# make/conf/version-numbers.conf. DEFAULT_VERSION_DATE represents the +# aspirational eventual JDK general availability (GA) release date. +# When the RPM build occurs prior to GA, generated JAR files will have +# payload mtimes in the future relative to the RPM build time. +# Whereas for tarballs some tools will issue warnings about future +# mtimes, per OPENJDK-2583 apparently this is no problem for Java and +# JAR files. +# +# Option C uses the modification timestamp of files in the source +# tarball. The reproducibility logic in generate_source_tarball.sh +# sets them all to the commit time of the release-tagged OpenJDK +# commit, as archived in the tarball. This timestamp is deterministic +# across RPM rebuilds and is reliably in the past. Any file's mtime +# will do, so use version-numbers.conf's. +# +# Use option B for JAR files, based on the discussion in OPENJDK-2583. +# +# For portable tarballs, use option C (OPENJDK_UPSTREAM_TAG_EPOCH) for +# the modification times of all files in the portable tarballs. Doing +# so eliminates one source of variability across RPM rebuilds. +VERSION_FILE="$(pwd)"/"%{top_level_dir_name}"/make/conf/version-numbers.conf +OPENJDK_UPSTREAM_TAG_EPOCH="$(stat --format=%Y "${VERSION_FILE}")" function buildjdk() { local outputdir=${1} @@ -1096,6 +1243,7 @@ function buildjdk() { local debuglevel=${4} local link_opt=${5} local debug_symbols=${6} + local devkit=${7} local top_dir_abs_src_path=$(pwd)/%{top_level_dir_name} local top_dir_abs_build_path=$(pwd)/${outputdir} @@ -1117,6 +1265,20 @@ function buildjdk() { echo "Using debug_symbols: ${debug_symbols}" echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}" +%if "%{is_dtstoolchain}" == "devkit" + LIBPATH="${devkit}/lib:${devkit}/lib64" + echo "Setting library path to ${LIBPATH}" +%else +%if "%{is_dtstoolchain}" == "toolset" + toolset=/opt/rh/%{dtsname}/root/ + LIBPATH="${toolset}/lib:${toolset}/lib64" + echo "Setting library path to ${LIBPATH}" +%else + LIBPATH=${LD_LIBRARY_PATH} + echo "Keeping library path as ${LIBPATH}" +%endif +%endif + mkdir -p ${outputdir} pushd ${outputdir} @@ -1124,16 +1286,17 @@ function buildjdk() { # rather than ${link_opt} as the system versions # are always used in a system_libs build, even # for the static library build -%if %{is_dtstoolchain} - scl enable %{dtsid} -- bash ${top_dir_abs_src_path}/configure \ -%else - bash ${top_dir_abs_src_path}/configure \ -%endif + LD_LIBRARY_PATH=${LIBPATH} \ + %{?dts_command} bash ${top_dir_abs_src_path}/configure \ %ifarch %{zero_arches} --with-jvm-variants=zero \ %endif -%ifarch %{ppc64le} - --with-jobs=1 \ +%if "%{is_dtstoolchain}" == "devkit" + --with-devkit=${devkit} \ +%endif +%if "%{is_dtstoolchain}" == "toolset" + --with-extra-path="/opt/rh/%{dtsname}/root/bin:/opt/rh/%{dtsname}/root/usr/bin" \ + --with-toolchain-path="/opt/rh/%{dtsname}/root/bin:/opt/rh/%{dtsname}/root/usr/bin" \ %endif --with-version-build=%{buildver} \ --with-version-pre="%{ea_designator}" \ @@ -1162,7 +1325,7 @@ function buildjdk() { --with-extra-cflags="$EXTRA_CFLAGS" \ --with-extra-ldflags="%{ourldflags}" \ --with-num-cores="$NUM_PROC" \ - --with-source-date="${SOURCE_DATE_EPOCH}" \ + --with-source-date="version" \ --disable-javac-server \ %ifarch %{zgc_arches} --with-jvm-features=zgc \ @@ -1171,15 +1334,11 @@ function buildjdk() { || ( pwd; cat $(find | grep config.log) && false ) cat spec.gmk -%if %{is_dtstoolchain} - scl enable %{dtsid} -- make \ -%else - make \ -%endif - LOG=trace \ + LD_LIBRARY_PATH=${LIBPATH} \ + %{?dts_command} make LOG=trace \ WARNINGS_ARE_ERRORS="-Wno-error" \ - CFLAGS_WARNINGS_ARE_ERRORS="-Wno-error" \ - $maketargets || ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name "hs_err_pid*.log" | xargs cat && false ) + CFLAGS_WARNINGS_ARE_ERRORS="-Wno-error" $maketargets ||\ + ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name \"hs_err_pid*.log\" | xargs cat && false ) popd } @@ -1206,6 +1365,7 @@ function installjdk() { # legacy-jre-image target does not install any man pages for the JRE # We copy the jdk man directory and then remove pages for binaries that # don't exist in the JRE +%if %{pandoc_available} cp -a ${jdkimagepath}/man ${jreimagepath} for manpage in $(find ${jreimagepath}/man -name '*.1'); do filename=$(basename ${manpage}); @@ -1215,6 +1375,7 @@ function installjdk() { rm -f ${manpage}; fi; done +%endif for imagepath in ${jdkimagepath} ${jreimagepath}; do @@ -1232,13 +1393,6 @@ function installjdk() { # Install local files which are distributed with the JDK install -m 644 %{SOURCE10} ${imagepath} - # Create fake alt-java as a placeholder for future alt-java - pushd ${imagepath} - # add alt-java man page - echo "Hardened java binary recommended for launching untrusted code from the Web e.g. javaws" > man/man1/%{alt_java_name}.1 - cat man/man1/java.1 >> man/man1/%{alt_java_name}.1 - popd - # Print release information cat ${imagepath}/release fi @@ -1260,7 +1414,7 @@ function genchecksum() { function packFullPatchedSources() { srcpackagesdir=`pwd` - tar -cJf ${srcpackagesdir}/%{jdkportablesourcesarchive -- ""} --transform "s|^|%{jdkportablesourcesname -- ""}/|" %{top_level_dir_name} + createtar ${srcpackagesdir}/%{jdkportablesourcesarchive -- ""} --transform "s|^|%{jdkportablesourcesname -- ""}/|" %{top_level_dir_name} genchecksum ${srcpackagesdir}/%{jdkportablesourcesarchive -- ""} } @@ -1286,6 +1440,13 @@ function findgeneratedsources() { popd } +# Create a reproducible tarball in an appropriate way for +# the version of tar in use +function createtar() { + #FIXME, not finished + tar -cJf "$@" +} + function packagejdk() { local imagesdir=$(pwd)/${1}/images local docdir=$(pwd)/${1}/images/docs @@ -1329,13 +1490,13 @@ function packagejdk() { # Release images have external debug symbols if [ "x$suffix" = "x" ] ; then - tar -cJf ${debugarchive} $(find ${jdkname} -name \*.debuginfo) + createtar ${debugarchive} $(find ${jdkname} -name \*.debuginfo) genchecksum ${debugarchive} mkdir ${docname} mv ${docdir} ${docname} mv ${bundledir}/${built_doc_archive} ${docname} - tar -cJf ${docarchive} ${docname} + createtar ${docarchive} ${docname} genchecksum ${docarchive} mkdir ${miscname} @@ -1347,25 +1508,25 @@ function packagejdk() { %endif cp -av ${altjavadir}/%{alt_java_name} ${miscname} cp -avr ${gensources} ${miscname} - tar -cJf ${miscarchive} ${miscname} + createtar ${miscarchive} ${miscname} genchecksum ${miscarchive} fi - tar -cJf ${jmodsarchive} --exclude='**.debuginfo' ${jdkname}/jmods + createtar ${jmodsarchive} --exclude='**.debuginfo' ${jdkname}/jmods genchecksum ${jmodsarchive} rm -rv ${jdkname}/jmods - tar -cJf ${jdkarchive} --exclude='**.debuginfo' ${jdkname} + createtar ${jdkarchive} --exclude='**.debuginfo' ${jdkname} genchecksum ${jdkarchive} - tar -cJf ${jrearchive} --exclude='**.debuginfo' ${jrename} + createtar ${jrearchive} --exclude='**.debuginfo' ${jrename} genchecksum ${jrearchive} %if %{include_staticlibs} # Static libraries (needed for building graal vm with native image) # Tar as overlay. Transform to the JDK name, since we just want to "add" # static libraries to that folder - tar -cJf ${staticarchive} \ + createtar ${staticarchive} \ --transform "s|^%{static_libs_image}/lib/*|${staticname}/lib/static/linux-%{archinstall}/glibc/|" "%{static_libs_image}/lib" genchecksum ${staticarchive} %endif @@ -1381,12 +1542,34 @@ function packagejdk() { packFullPatchedSources +%if "%{is_dtstoolchain}" == "devkit" + DEVKIT_ROOT=$(pwd)/devkit + source ${DEVKIT_ROOT}/devkit.info + GCC="${DEVKIT_TOOLCHAIN_PATH}/gcc --sysroot=${DEVKIT_SYSROOT}" + LIBPATH="${DEVKIT_ROOT}/lib:${DEVKIT_ROOT}/lib64" +%else +%if "%{is_dtstoolchain}" == "toolset" + toolset=/opt/rh/%{dtsname}/root/ + GCC="${toolset}/usr/bin/gcc" + LIBPATH="${toolset}/lib:${toolset}/lib64" +%else + GCC=$(which gcc) +%endif +%endif + +echo "Building %{SOURCE11}" +mkdir %{miscinstalloutputdir} +mkdir %{altjavaoutputdir} +LD_LIBRARY_PATH="${LIBPATH}" ${GCC} ${EXTRA_CFLAGS} -o %{altjavaoutputdir}/%{alt_java_name} %{SOURCE11} + +echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}" + %if %{build_hotspot_first} # Build a fresh libjvm.so first and use it to bootstrap echo "Building HotSpot only for the latest libjvm.so" cp -LR --preserve=mode,timestamps %{bootjdk} newboot systemjdk=$(pwd)/newboot - buildjdk build/newboot ${systemjdk} %{hotspot_target} "release" "bundled" "internal" + buildjdk build/newboot ${systemjdk} %{hotspot_target} "release" "bundled" "internal" ${DEVKIT_ROOT} mv build/newboot/jdk/lib/%{vm_variant}/libjvm.so newboot/lib/%{vm_variant} %else systemjdk=%{bootjdk} @@ -1432,14 +1615,14 @@ for suffix in %{build_loop} ; do run_bootstrap=%{bootstrap_build} fi if ${run_bootstrap} ; then - buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild} ${link_opt} ${debug_symbols} + buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild} ${link_opt} ${debug_symbols} ${DEVKIT_ROOT} installjdk ${bootbuilddir} ${bootinstalldir} - buildjdk ${builddir} $(pwd)/${bootinstalldir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} + buildjdk ${builddir} $(pwd)/${bootinstalldir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} ${DEVKIT_ROOT} findgeneratedsources ${installdir} ${builddir} $(pwd)/%{top_level_dir_name} installjdk ${builddir} ${installdir} %{!?with_artifacts:rm -rf ${bootinstalldir}} else - buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} + buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} ${DEVKIT_ROOT} findgeneratedsources ${installdir} ${builddir} $(pwd)/%{top_level_dir_name} installjdk ${builddir} ${installdir} fi @@ -1459,7 +1642,7 @@ done # end of release / debug cycle loop # We test debug first as it will give better diagnostics on a crash for suffix in %{build_loop} ; do -# portable builds have static_libs embedded, thus top_dir_abs_main_build_path is same as top_dir_abs_staticlibs_build_path +# portable builds have static_libs embedded, thus top_dir_abs_main_build_path is same as top_dir_abs_staticlibs_build_path top_dir_abs_main_build_path=$(pwd)/%{installoutputdir -- ${suffix}} %if %{include_staticlibs} top_dir_abs_staticlibs_build_path=${top_dir_abs_main_build_path} @@ -1474,51 +1657,91 @@ export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage} #sed -i -e "s:^security.useSystemPropertiesFile=.*:security.useSystemPropertiesFile=true:" \ #${JAVA_HOME}/conf/security/java.security +# Set up tools +%if "%{is_dtstoolchain}" == "devkit" + DEVKIT_ROOT=$(pwd)/devkit + source ${DEVKIT_ROOT}/devkit.info + NM="${DEVKIT_TOOLCHAIN_PATH}/nm" +%else + NM=$(which nm) +%endif +# elfutils readelf supports more binaries than binutils version on RHEL 8 +# and debug symbols tests below were designed around this version +READELF=$(which eu-readelf) +# Only native gdb seems to work +# The devkit gdb needs the devkit stdc++ library but then the JVM +# segfaults when this is on the LD_LIBRARY_PATH +GDB=$(which gdb) + # Check Shenandoah is enabled %if %{use_shenandoah_hotspot} $JAVA_HOME/bin/java -XX:+UseShenandoahGC -version %endif -# Check unlimited policy has been used -$JAVA_HOME/bin/javac -d . %{SOURCE13} -$JAVA_HOME/bin/java --add-opens java.base/javax.crypto=ALL-UNNAMED TestCryptoLevel +# Only test on one architecture (the fastest) for Java only tests +%ifarch %{jdk_test_arch} -# Check ECC is working -$JAVA_HOME/bin/javac -d . %{SOURCE14} -$JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||") + # Check unlimited policy has been used + $JAVA_HOME/bin/javac -d . %{SOURCE13} + $JAVA_HOME/bin/java --add-opens java.base/javax.crypto=ALL-UNNAMED TestCryptoLevel -# Check system crypto (policy) is deactive and can not be enabled -# Test takes a single argument - true or false - to state whether system -# security properties are enabled or not. -$JAVA_HOME/bin/javac -d . %{SOURCE15} -export PROG=$(echo $(basename %{SOURCE15})|sed "s|\.java||") -export SEC_DEBUG="-Djava.security.debug=properties" -# Specific to portable:System security properties to be off by default -$JAVA_HOME/bin/java ${SEC_DEBUG} ${PROG} false -$JAVA_HOME/bin/java ${SEC_DEBUG} -Djava.security.disableSystemPropertiesFile=false ${PROG} false + # Check ECC is working + $JAVA_HOME/bin/javac -d . %{SOURCE14} + $JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||") -# Check correct vendor values have been set -$JAVA_HOME/bin/javac -d . %{SOURCE16} -$JAVA_HOME/bin/java $(echo $(basename %{SOURCE16})|sed "s|\.java||") "%{oj_vendor}" "%{oj_vendor_url}" "%{oj_vendor_bug_url}" "%{oj_vendor_version}" + # Check system crypto (policy) is deactive and can not be enabled + # Test takes a single argument - true or false - to state whether system + # security properties are enabled or not. + $JAVA_HOME/bin/javac -d . %{SOURCE15} + export PROG=$(echo $(basename %{SOURCE15})|sed "s|\.java||") + export SEC_DEBUG="-Djava.security.debug=properties" + # Specific to portable:System security properties to be off by default + $JAVA_HOME/bin/java ${SEC_DEBUG} ${PROG} false + $JAVA_HOME/bin/java ${SEC_DEBUG} -Djava.security.disableSystemPropertiesFile=false ${PROG} false + + # Check correct vendor values have been set + $JAVA_HOME/bin/javac -d . %{SOURCE16} + $JAVA_HOME/bin/java $(echo $(basename %{SOURCE16})|sed "s|\.java||") "%{oj_vendor}" "%{oj_vendor_url}" "%{oj_vendor_bug_url}" "%{oj_vendor_version}" + +%if ! 0%{?flatpak} + # Check translations are available for new timezones (during flatpak builds, the + # tzdb.dat used by this test is not where the test expects it, so this is + # disabled for flatpak builds) + # Disable test until we are on the latest JDK + $JAVA_HOME/bin/javac -d . %{SOURCE18} + $JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE || echo "Fedora is often ahead in timezones, ignoring" + $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR || echo "Fedora is often ahead in timezones, ignoring" +%endif + + # Check src.zip has all sources. See RHBZ#1130490 + unzip -l $JAVA_HOME/lib/src.zip | grep 'sun.misc.Unsafe' + + # Check class files include useful debugging information + $JAVA_HOME/bin/javap -c -l java.lang.Object | grep "Compiled from" + $JAVA_HOME/bin/javap -c -l java.lang.Object | grep LineNumberTable + $JAVA_HOME/bin/javap -c -l java.lang.Object | grep LocalVariableTable + + # Check generated class files include useful debugging information + $JAVA_HOME/bin/javap -c -l java.nio.ByteBuffer | grep "Compiled from" + $JAVA_HOME/bin/javap -c -l java.nio.ByteBuffer | grep LineNumberTable + $JAVA_HOME/bin/javap -c -l java.nio.ByteBuffer | grep LocalVariableTable + +%else + + # Just run a basic java -version test on other architectures + $JAVA_HOME/bin/java -version + +%endif # Check java launcher has no SSB mitigation -if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi +if ! ${NM} $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi # Check alt-java launcher has SSB mitigation on supported architectures # set_speculation function exists in both cases, so check for prctl call %ifarch %{ssbd_arches} -nm %{altjavaoutputdir}/%{alt_java_name} | grep prctl +${NM} %{altjavaoutputdir}/%{alt_java_name} | grep prctl %else -if ! nm %{altjavaoutputdir}/%{alt_java_name} | grep prctl ; then true ; else false; fi -%endif - -%if ! 0%{?flatpak} -# Check translations are available for new timezones (during flatpak builds, the -# tzdb.dat used by this test is not where the test expects it, so this is -# disabled for flatpak builds) -$JAVA_HOME/bin/javac -d . %{SOURCE18} -$JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE || echo "FIXME before release!" -$JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR || echo "FIXME before release!" +if ! ${NM} %{altjavaoutputdir}/%{alt_java_name} | grep prctl ; then true ; else false; fi %endif %if %{include_staticlibs} @@ -1526,8 +1749,8 @@ $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})| export STATIC_LIBS_HOME=${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image} ls -l $STATIC_LIBS_HOME ls -l $STATIC_LIBS_HOME/lib -readelf --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet4AddressImpl.c -readelf --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet6AddressImpl.c +${READELF} --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet4AddressImpl.c +${READELF} --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet6AddressImpl.c %endif # Release builds strip the debug symbols into external .debuginfo files @@ -1546,15 +1769,15 @@ do # Test for .debug_* sections in the shared object. This is the main test # Stripped objects will not contain these - eu-readelf -S "$lib" | grep "] .debug_" - test $(eu-readelf -S "$lib" | grep -E "\]\ .debug_(info|abbrev)" | wc --lines) == 2 + ${READELF} -S "$lib" | grep "] .debug_" + test $(${READELF} -S "$lib" | grep -E "\]\ .debug_(info|abbrev)" | wc --lines) == 2 # Test FILE symbols. These will most likely be removed by anything that # manipulates symbol tables because it's generally useless. So a nice test # that nothing has messed with symbols old_IFS="$IFS" IFS=$'\n' - for line in $(eu-readelf -s "$lib" | grep "00000000 0 FILE LOCAL DEFAULT") + for line in $(${READELF} -s "$lib" | grep "00000000 0 FILE LOCAL DEFAULT") do # We expect to see .cpp and .S files, except for architectures like aarch64 and # s390 where we expect .o and .oS files @@ -1564,17 +1787,17 @@ do # If this is the JVM, look for javaCalls.(cpp|o) in FILEs, for extra sanity checking if [ "`basename $lib`" = "libjvm.so" ]; then - eu-readelf -s "$lib" | \ + ${READELF} -s "$lib" | \ grep -E "00000000 0 FILE LOCAL DEFAULT ABS javaCalls.(cpp|o)$" fi # Test that there are no .gnu_debuglink sections pointing to another # debuginfo file. There shouldn't be any debuginfo files, so the link makes # no sense either - eu-readelf -S "$lib" | grep 'gnu' - if eu-readelf -S "$lib" | grep '] .gnu_debuglink' | grep PROGBITS; then + ${READELF} -S "$lib" | grep 'gnu' + if ${READELF} -S "$lib" | grep '] .gnu_debuglink' | grep PROGBITS; then echo "bad .gnu_debuglink section." - eu-readelf -x .gnu_debuglink "$lib" + ${READELF} -x .gnu_debuglink "$lib" false fi fi @@ -1586,7 +1809,7 @@ done # Using line number 1 might cause build problems. See: # https://bugzilla.redhat.com/show_bug.cgi?id=1539664 # https://bugzilla.redhat.com/show_bug.cgi?id=1538767 -gdb -q "$JAVA_HOME/bin/java" < +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +if [ $# -ne 1 ]; then + echo "Usage: $0 openjdk-root-directory" + exit 1 +fi + +JDKROOT=$1 + +if [ ! -d "${JDKROOT}" ] ; then + echo "${JDKROOT} is not a directory."; + exit 2 +fi + +# Work out the OpenJDK version +# OpenJDK >= 10 has its version in the build machinery +# OpenJDK >= 17 stores it in a new location (JDK-8258246) +VERSION_FILE="${JDKROOT}"/make/conf/version-numbers.conf +printf "Checking for %s..." "${VERSION_FILE}"; +if [ ! -f "${VERSION_FILE}" ] ; then + VERSION_FILE="${JDKROOT}"/make/autoconf/version-numbers + echo "Not found; using old version file ${VERSION_FILE}"; +else + echo "found."; +fi +if [ -e "${VERSION_FILE}" ] ; then + openjdk_version=$(grep '^DEFAULT_VERSION_FEATURE' "${VERSION_FILE}" | cut -d '=' -f 2) +elif [ -e "${JDKROOT}"/jdk/src/java.base/share/classes/java/lang/Object.java ] ; then + openjdk_version=9; +elif [ -e "${JDKROOT}"/common/autoconf ] ; then + openjdk_version=8; +else + openjdk_version=7; +fi +echo "OpenJDK version: ${openjdk_version}"; + +# +# Freetype +# +if [ "${openjdk_version}" -gt 8 ] ; then + FREETYPE=src/java.desktop/share/native/libfreetype/include/freetype/freetype.h + ABS_FREETYPE="${JDKROOT}"/"${FREETYPE}" + if [ ! -f "${ABS_FREETYPE}" ]; then + echo "Freetype header not found!" + exit 2 + fi + FREETYPE_VERSION=$(awk '/#define FREETYPE_MAJOR/ {MAJOR=$3} /#define FREETYPE_MINOR/ {MINOR=$3} /#define FREETYPE_PATCH/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_FREETYPE}") +else + echo "No bundled FreeType on ${openjdk_version}"; +fi + +# giflib +if [ "${openjdk_version}" -gt 8 ] ; then + GIFLIB=src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h +else + GIFLIB=jdk/src/share/native/sun/awt/giflib/gif_lib.h +fi +ABS_GIFLIB="${JDKROOT}"/"${GIFLIB}" +if [ ! -f "${ABS_GIFLIB}" ]; then + echo "giflib header not found!" + exit 3 +fi +GIFLIB_VERSION=$(awk '/#define GIFLIB_MAJOR/ {MAJOR=$3} /#define GIFLIB_MINOR/ {MINOR=$3} /#define GIFLIB_RELEASE/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_GIFLIB}") + +# harfbuzz +if [ "${openjdk_version}" -gt 8 ] ; then + HARFBUZZ=src/java.desktop/share/native/libharfbuzz/hb-version.h + ABS_HARFBUZZ="${JDKROOT}/${HARFBUZZ}" + if [ ! -f "${ABS_HARFBUZZ}" ]; then + echo "HarfBuzz header not found!" + exit 4 + fi + HARFBUZZ_VERSION=$(awk '/#define HB_VERSION_MAJOR/ {MAJOR=$3} /#define HB_VERSION_MINOR/ {MINOR=$3} /#define HB_VERSION_MICRO/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_HARFBUZZ}") +else + echo "No HarfBuzz on ${openjdk_version}"; +fi + +# lcms +if [ "${openjdk_version}" -gt 8 ] ; then + LCMS=src/java.desktop/share/native/liblcms/lcms2.h +else + LCMS=jdk/src/share/native/sun/java2d/cmm/lcms/lcms2.h +fi +ABS_LCMS="${JDKROOT}"/"${LCMS}" +if [ ! -f "${ABS_LCMS}" ]; then + echo "lcms header not found!" + exit 5 +fi +LCMS_VERSION=$(awk '/#define LCMS_VERSION/ { MAJOR=int($3 / 1000); REST=$3 % 1000; MINOR=int(REST / 10); PATCH=REST % 10; } END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_LCMS}") + +# jpeg +if [ "${openjdk_version}" -gt 8 ] ; then + JPEG=src/java.desktop/share/native/libjavajpeg/jpeglib.h +else + JPEG=jdk/src/share/native/sun/awt/image/jpeg/jpeglib.h +fi +ABS_JPEG="${JDKROOT}"/"${JPEG}" +if [ ! -f "${ABS_JPEG}" ]; then + echo "jpeg header not found!" + exit 6 +fi +JPEG_VERSION=$(awk '/#define JPEG_LIB_VERSION/ { VERSION=$3; MAJOR=int(VERSION / 10); MINOR=VERSION%10; } END {printf "%s%c", MAJOR, (MINOR+96)}' "${ABS_JPEG}") + +# png +if [ "${openjdk_version}" -gt 8 ] ; then + PNG=src/java.desktop/share/native/libsplashscreen/libpng/png.h +else + PNG=jdk/src/share/native/sun/awt/libpng/png.h +fi +ABS_PNG="${JDKROOT}"/"${PNG}" +if [ ! -f "${ABS_PNG}" ]; then + echo "png header not found!" + exit 7 +fi +PNG_VERSION=$(awk '/#define PNG_LIBPNG_VER_STRING/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_PNG}") + +# zlib +if [ "${openjdk_version}" -gt 8 ] ; then + ZLIB=src/java.base/share/native/libzip/zlib/zlib.h +else + ZLIB=jdk/src/share/native/java/util/zip/zlib/zlib.h +fi +ABS_ZLIB="${JDKROOT}"/"${ZLIB}" +if [ ! -f "${ABS_ZLIB}" ]; then + echo "zlib header not found!" + exit 8 +fi +ZLIB_VERSION=$(awk '/#define ZLIB_VERSION/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_ZLIB}") + +# Print output +printf "\nRPM definitions:\n" +if [ "${openjdk_version}" -gt 8 ] ; then + echo "# Version in ${FREETYPE}" + echo "Provides: bundled(freetype) = ${FREETYPE_VERSION}" +fi +echo "# Version in ${GIFLIB}" +echo "Provides: bundled(giflib) = ${GIFLIB_VERSION}" +if [ "${openjdk_version}" -gt 8 ] ; then + echo "# Version in ${HARFBUZZ}" + echo "Provides: bundled(harfbuzz) = ${HARFBUZZ_VERSION}" +fi +echo "# Version in ${LCMS}" +echo "Provides: bundled(lcms2) = ${LCMS_VERSION}" +echo "# Version in ${JPEG}" +echo "Provides: bundled(libjpeg) = ${JPEG_VERSION}" +echo "# Version in ${PNG}" +echo "Provides: bundled(libpng) = ${PNG_VERSION}" +echo "# Version in ${ZLIB}" +echo "Provides: bundled(zlib) = ${ZLIB_VERSION}" + +# Local Variables: +# compile-command: "shellcheck get_bundle_versions.sh" +# fill-column: 80 +# indent-tabs-mode: nil +# sh-basic-offset: 4 +# End: From d0dccee5d01eef9347d63e8d66f7d83509c83a7f Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Fri, 12 Dec 2025 14:29:57 +0100 Subject: [PATCH 21/23] Switch from static-libs-image to static-libs-graal-image to avoid large unneeded libjvm.a --- java-latest-openjdk-portable.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index 7b48c3d..ad21f2c 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -228,7 +228,7 @@ # other targets since this target is configured to use in-tree # AWT dependencies: lcms, libjpeg, libpng, libharfbuzz, giflib # and possibly others -%global static_libs_target static-libs-image +%global static_libs_target static-libs-graal-image %else %global static_libs_target %{nil} %endif @@ -500,7 +500,7 @@ exit 1 %global fullversion %{compatiblename}-%{version}-%{release} # images directories from upstream build %global jdkimage jdk -%global static_libs_image static-libs +%global static_libs_image static-libs-graal # output dir stub %define buildoutputdir() %{expand:build/jdk%{featurever}.build%{?1}} %define installoutputdir() %{expand:install/jdk%{featurever}.install%{?1}} From 573c2c7a36a8c78dc44fddfb7b83b32bdad3fce9 Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Fri, 12 Dec 2025 15:47:22 +0100 Subject: [PATCH 22/23] fipsver df044414ef4 --- fips-25u-df044414ef4.patch | 92 +++++++++++++++++++++++++++++++ java-latest-openjdk-portable.spec | 13 +++-- 2 files changed, 99 insertions(+), 6 deletions(-) create mode 100644 fips-25u-df044414ef4.patch diff --git a/fips-25u-df044414ef4.patch b/fips-25u-df044414ef4.patch new file mode 100644 index 0000000..8b210e6 --- /dev/null +++ b/fips-25u-df044414ef4.patch @@ -0,0 +1,92 @@ +diff --git a/src/java.base/share/classes/java/security/Provider.java b/src/java.base/share/classes/java/security/Provider.java +index de2845fb550..b1e416b90f4 100644 +--- a/src/java.base/share/classes/java/security/Provider.java ++++ b/src/java.base/share/classes/java/security/Provider.java +@@ -1203,6 +1203,39 @@ public Set getServices() { + return serviceSet; + } + ++ /* vvvvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvvvv */ ++ private static final class RedHatFIPSFilter { ++ static final boolean IS_ON = Boolean.parseBoolean( ++ Security.getProperty("__redhat_fips_filter__")); ++ private static final Set ANY_SERVICE_TYPE = Set.of(); ++ private static final Map> ALLOW_LIST = Map.of( ++ "SunPKCS11-FIPS", ANY_SERVICE_TYPE, ++ "SUN", Set.of( ++ "AlgorithmParameterGenerator", ++ "AlgorithmParameters", "CertificateFactory", ++ "CertPathBuilder", "CertPathValidator", "CertStore", ++ "Configuration", "KeyStore"), ++ "SunEC", Set.of( ++ "AlgorithmParameters", "KeyFactory"), ++ "SunJSSE", ANY_SERVICE_TYPE, ++ "SunJCE", Set.of( ++ "AlgorithmParameters", ++ "AlgorithmParameterGenerator", "KeyFactory", ++ "SecretKeyFactory"), ++ "SunRsaSign", Set.of( ++ "KeyFactory", "AlgorithmParameters"), ++ "XMLDSig", ANY_SERVICE_TYPE ++ ); ++ ++ static boolean isAllowed(String provName, String serviceType) { ++ Set allowedServiceTypes = ALLOW_LIST.get(provName); ++ return allowedServiceTypes != null && ++ (allowedServiceTypes == ANY_SERVICE_TYPE || ++ allowedServiceTypes.contains(serviceType)); ++ } ++ } ++ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ */ ++ + /** + * Add a service. If a service of the same type with the same algorithm + * name exists, and it was added using {@link #putService putService()}, +@@ -1231,6 +1264,15 @@ protected void putService(Service s) { + ("service.getProvider() must match this Provider object"); + } + String type = s.getType(); ++ /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */ ++ if (RedHatFIPSFilter.IS_ON && !RedHatFIPSFilter.isAllowed(name, type)) { ++ if (debug != null) { ++ debug.println("The previous " + name + ".putService() call " + ++ "was skipped by " + RedHatFIPSFilter.class.getName()); ++ } ++ return; ++ } ++ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */ + String algorithm = s.getAlgorithm(); + ServiceKey key = new ServiceKey(type, algorithm, true); + implRemoveService(serviceMap.get(key)); +diff --git a/src/java.base/share/classes/java/security/Security.java b/src/java.base/share/classes/java/security/Security.java +index 6969fe8a8e1..4501d5971c4 100644 +--- a/src/java.base/share/classes/java/security/Security.java ++++ b/src/java.base/share/classes/java/security/Security.java +@@ -323,7 +323,27 @@ public Properties getInitialProperties() { + } + + private static void initialize() { ++ /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */ ++ /* This 'include'-directives-only magic property is an internal */ ++ /* implementation detail that could (and probably will!) change. */ ++ /* Red Hat customers should NOT rely on this for their own use. */ ++ String fipsKernelFlag = "/proc/sys/crypto/fips_enabled"; ++ boolean fipsModeOn; ++ try (InputStream is = new java.io.FileInputStream(fipsKernelFlag)) { ++ fipsModeOn = is.read() == '1'; ++ } catch (IOException ioe) { ++ fipsModeOn = false; ++ if (sdebug != null) { ++ sdebug.println("Failed to read FIPS kernel file: " + ioe); ++ } ++ } ++ String fipsMagicPropName = "__redhat_fips__"; ++ System.setProperty(fipsMagicPropName, "" + fipsModeOn); ++ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */ + SecPropLoader.loadAll(); ++ /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */ ++ System.clearProperty(fipsMagicPropName); ++ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */ + initialSecurityProperties = (Properties) props.clone(); + if (sdebug != null) { + for (String key : props.stringPropertyNames()) { diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index ad21f2c..287c7fe 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -446,7 +446,7 @@ exit 1 # Define IcedTea version used for SystemTap tapsets and desktop file %global icedteaver 6.0.0pre00-c848b93a8598 # Define current Git revision for the FIPS support patches -%global fipsver 9203d50836c +%global fipsver df044414ef4 # Define JDK versions %global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver} %global javaver %{featurever} @@ -461,7 +461,7 @@ exit 1 %global top_level_dir_name %{vcstag} %global top_level_dir_name_backup %{top_level_dir_name}-backup %global buildver 8 -%global rpmrelease 2 +%global rpmrelease 3 #%%global tagsuffix %%{nil} # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit %if %is_system_jdk @@ -738,7 +738,7 @@ Source18: TestTranslations.java ############################################ # Crypto policy and FIPS support patches # Patch is generated from the fips-25u tree at https://github.com/rh-openjdk/jdk/tree/fips-25u -# as follows: git diff %%{vcstag} src make test > fips-21u-$(git show -s --format=%h HEAD).patch +# as follows: git diff %%{vcstag} src make test > fips-25u-$(git show -s --format=%h HEAD).patch # Diff is limited to src and make subdirectories to exclude .github changes # The following list is generated by: # git log %%{vcstag}.. --no-merges --format=%s --reverse: @@ -774,7 +774,8 @@ Source18: TestTranslations.java # test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class # RH1940064: Enable XML Signature provider in FIPS mode # RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized [now part of JDK-8301553 upstream] -# Disabled in latest: Patch1001: fips-%%{featurever}u-%%{fipsver}.patch +# usage in jdk >25 is experimental and may disapear +Patch1001: fips-%{featurever}u-%{fipsver}.patch ############################################# # @@ -1083,8 +1084,8 @@ sh %{SOURCE12} %{top_level_dir_name} # rpmbuild. pushd %{top_level_dir_name} # Add crypto policy and FIPS support -# Not suitable for latest -#%%patch -P1001 -p1 +# usage in jdk >25 is experimental and may disapear +%patch -P1001 -p1 popd # openjdk echo "Generating %{alt_java_name} man page" From 4d483d5093f07dedee7a83edf04a37a58e829009 Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Tue, 23 Dec 2025 12:44:54 +0100 Subject: [PATCH 23/23] Updated to jdk26 --- .gitignore | 1 + ...1842_broke_native_debugging_on_Linux.patch | 154 ++++++++++++++++++ java-latest-openjdk-portable.spec | 18 +- sources | 2 +- 4 files changed, 167 insertions(+), 8 deletions(-) create mode 100644 JDK-8373246-8351842_broke_native_debugging_on_Linux.patch diff --git a/.gitignore b/.gitignore index c2a5115..1f1fc8c 100644 --- a/.gitignore +++ b/.gitignore @@ -58,3 +58,4 @@ /openjdk-jdk-25+36.tar.xz /openjdk-25+36.tar.xz /openjdk-25.0.1+8.tar.xz +/openjdk-26+29-ea.tar.xz diff --git a/JDK-8373246-8351842_broke_native_debugging_on_Linux.patch b/JDK-8373246-8351842_broke_native_debugging_on_Linux.patch new file mode 100644 index 0000000..1f6ca4d --- /dev/null +++ b/JDK-8373246-8351842_broke_native_debugging_on_Linux.patch @@ -0,0 +1,154 @@ +diff --git a/make/Bundles.gmk b/make/Bundles.gmk +index 8161b3b036254..0b324e7e3f3fc 100644 +--- a/make/Bundles.gmk ++++ b/make/Bundles.gmk +@@ -185,77 +185,30 @@ endif + + ifneq ($(filter product-bundles% legacy-bundles, $(MAKECMDGOALS)), ) + +- SYMBOLS_EXCLUDE_PATTERN := %.debuginfo %.diz %.map +- +- # There may be files with spaces in the names, so use ShellFindFiles +- # explicitly. ++ # There may be files with spaces in the names, so use ShellFindFiles explicitly. + ALL_JDK_FILES := $(call ShellFindFiles, $(JDK_IMAGE_DIR)) +- ifneq ($(JDK_IMAGE_DIR), $(JDK_SYMBOLS_IMAGE_DIR)) +- ALL_JDK_SYMBOLS_FILES := $(call ShellFindFiles, $(JDK_SYMBOLS_IMAGE_DIR)) +- else +- ALL_JDK_SYMBOLS_FILES := $(ALL_JDK_FILES) +- endif + ifneq ($(JDK_IMAGE_DIR), $(JDK_DEMOS_IMAGE_DIR)) + ALL_JDK_DEMOS_FILES := $(call ShellFindFiles, $(JDK_DEMOS_IMAGE_DIR)) + else + ALL_JDK_DEMOS_FILES := $(ALL_JDK_FILES) + endif + +- # Create special filter rules when dealing with unzipped .dSYM directories on +- # macosx +- ifeq ($(call isTargetOs, macosx), true) +- ifeq ($(ZIP_EXTERNAL_DEBUG_SYMBOLS), false) +- JDK_SYMBOLS_EXCLUDE_PATTERN := $(addprefix %, \ +- $(call containing, .dSYM/, $(patsubst $(JDK_IMAGE_DIR)/%, %, \ +- $(ALL_JDK_SYMBOLS_FILES)))) +- endif +- endif +- +- # Create special filter rules when dealing with debug symbols on windows +- ifeq ($(call isTargetOs, windows), true) +- ifeq ($(SHIP_DEBUG_SYMBOLS), ) +- JDK_SYMBOLS_EXCLUDE_PATTERN := %.pdb +- endif +- endif +- + JDK_BUNDLE_FILES := \ + $(filter-out \ +- $(JDK_SYMBOLS_EXCLUDE_PATTERN) \ + $(JDK_EXTRA_EXCLUDES) \ +- $(SYMBOLS_EXCLUDE_PATTERN) \ + $(JDK_IMAGE_HOMEDIR)/demo/% \ + , \ + $(ALL_JDK_FILES) \ + ) + +- JDK_SYMBOLS_BUNDLE_FILES := \ +- $(call FindFiles, $(SYMBOLS_IMAGE_DIR)) ++ JDK_SYMBOLS_BUNDLE_FILES := $(call FindFiles, $(SYMBOLS_IMAGE_DIR)) + + TEST_DEMOS_BUNDLE_FILES := $(filter $(JDK_DEMOS_IMAGE_HOMEDIR)/demo/%, \ + $(ALL_JDK_DEMOS_FILES)) + + ALL_JRE_FILES := $(call ShellFindFiles, $(JRE_IMAGE_DIR)) + +- # Create special filter rules when dealing with unzipped .dSYM directories on +- # macosx +- ifeq ($(OPENJDK_TARGET_OS), macosx) +- ifeq ($(ZIP_EXTERNAL_DEBUG_SYMBOLS), false) +- JRE_SYMBOLS_EXCLUDE_PATTERN := $(addprefix %, \ +- $(call containing, .dSYM/, $(patsubst $(JRE_IMAGE_DIR)/%, %, $(ALL_JRE_FILES)))) +- endif +- endif +- +- # Create special filter rules when dealing with debug symbols on windows +- ifeq ($(call isTargetOs, windows), true) +- ifeq ($(SHIP_DEBUG_SYMBOLS), ) +- JRE_SYMBOLS_EXCLUDE_PATTERN := %.pdb +- endif +- endif +- +- JRE_BUNDLE_FILES := $(filter-out \ +- $(JRE_SYMBOLS_EXCLUDE_PATTERN) \ +- $(SYMBOLS_EXCLUDE_PATTERN), \ +- $(ALL_JRE_FILES)) ++ JRE_BUNDLE_FILES := $(ALL_JRE_FILES) + + ifeq ($(MACOSX_CODESIGN_MODE), hardened) + # Macosx release build and code signing available. +diff --git a/make/CreateJmods.gmk b/make/CreateJmods.gmk +index 3280b24924a34..32f107b6bb6a0 100644 +--- a/make/CreateJmods.gmk ++++ b/make/CreateJmods.gmk +@@ -218,10 +218,14 @@ ifeq ($(call isTargetOs, windows), true) + ifeq ($(SHIP_DEBUG_SYMBOLS), ) + JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.pdb,*.map}' + else +- JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.map}' ++ JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.map}' + endif + else +- JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.debuginfo,*.dSYM/**,*.dSYM}' ++ ifeq ($(SHIP_DEBUG_SYMBOLS), ) ++ JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.debuginfo,*.dSYM/**,*.dSYM}' ++ else ++ JMOD_FLAGS += --exclude '**{_the.*,_*.marker*}' ++ endif + endif + + # Unless we are creating a very large module, use the small tool JVM options +diff --git a/make/autoconf/jdk-options.m4 b/make/autoconf/jdk-options.m4 +index bb18877800192..87d147d4f074b 100644 +--- a/make/autoconf/jdk-options.m4 ++++ b/make/autoconf/jdk-options.m4 +@@ -316,23 +316,36 @@ AC_DEFUN_ONCE([JDKOPT_SETUP_DEBUG_SYMBOLS], + AC_MSG_CHECKING([if we should add external native debug symbols to the shipped bundles]) + AC_ARG_WITH([external-symbols-in-bundles], + [AS_HELP_STRING([--with-external-symbols-in-bundles], +- [which type of external native debug symbol information shall be shipped in product bundles (none, public, full) +- (e.g. ship full/stripped pdbs on Windows) @<:@none@:>@])]) ++ [which type of external native debug symbol information shall be shipped with bundles/images (none, public, full). ++ @<:@none in release builds, full otherwise. --with-native-debug-symbols=external/zipped is a prerequisite. public is only supported on Windows@:>@])], ++ [], ++ [with_external_symbols_in_bundles=default]) + + if test "x$with_external_symbols_in_bundles" = x || test "x$with_external_symbols_in_bundles" = xnone ; then + AC_MSG_RESULT([no]) + elif test "x$with_external_symbols_in_bundles" = xfull || test "x$with_external_symbols_in_bundles" = xpublic ; then +- if test "x$OPENJDK_TARGET_OS" != xwindows ; then +- AC_MSG_ERROR([--with-external-symbols-in-bundles currently only works on windows!]) +- elif test "x$COPY_DEBUG_SYMBOLS" != xtrue ; then +- AC_MSG_ERROR([--with-external-symbols-in-bundles only works when --with-native-debug-symbols=external is used!]) +- elif test "x$with_external_symbols_in_bundles" = xfull ; then ++ if test "x$COPY_DEBUG_SYMBOLS" != xtrue ; then ++ AC_MSG_ERROR([--with-external-symbols-in-bundles only works when --with-native-debug-symbols=external/zipped is used!]) ++ elif test "x$with_external_symbols_in_bundles" = xpublic && test "x$OPENJDK_TARGET_OS" != xwindows ; then ++ AC_MSG_ERROR([--with-external-symbols-in-bundles=public is only supported on Windows!]) ++ fi ++ ++ if test "x$with_external_symbols_in_bundles" = xfull ; then + AC_MSG_RESULT([full]) + SHIP_DEBUG_SYMBOLS=full + else + AC_MSG_RESULT([public]) + SHIP_DEBUG_SYMBOLS=public + fi ++ elif test "x$with_external_symbols_in_bundles" = xdefault ; then ++ if test "x$DEBUG_LEVEL" = xrelease ; then ++ AC_MSG_RESULT([no (default)]) ++ elif test "x$COPY_DEBUG_SYMBOLS" = xtrue ; then ++ AC_MSG_RESULT([full (default)]) ++ SHIP_DEBUG_SYMBOLS=full ++ else ++ AC_MSG_RESULT([no (default, native debug symbols are not external/zipped)]) ++ fi + else + AC_MSG_ERROR([$with_external_symbols_in_bundles is an unknown value for --with-external-symbols-in-bundles]) + fi diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index 287c7fe..16bb5eb 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -404,9 +404,9 @@ exit 1 %endif # New Version-String scheme-style defines -%global featurever 25 +%global featurever 26 %global interimver 0 -%global updatever 1 +%global updatever 0 %global patchver 0 # buildjdkver is usually same as %%{featurever}, # but in time of bootstrap of next jdk, it is featurever-1, @@ -460,8 +460,8 @@ exit 1 %global origin_nice OpenJDK %global top_level_dir_name %{vcstag} %global top_level_dir_name_backup %{top_level_dir_name}-backup -%global buildver 8 -%global rpmrelease 3 +%global buildver 29 +%global rpmrelease 1 #%%global tagsuffix %%{nil} # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit %if %is_system_jdk @@ -480,7 +480,7 @@ exit 1 # Release will be (where N is usually a number starting at 1): # - 0.N%%{?extraver}%%{?dist} for EA releases, # - N%%{?extraver}{?dist} for GA releases -%global is_ga 1 +%global is_ga 0 %if %{is_ga} %global build_type GA %global ea_designator "" @@ -775,7 +775,7 @@ Source18: TestTranslations.java # RH1940064: Enable XML Signature provider in FIPS mode # RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized [now part of JDK-8301553 upstream] # usage in jdk >25 is experimental and may disapear -Patch1001: fips-%{featurever}u-%{fipsver}.patch +Patch1001: fips-25u-%{fipsver}.patch ############################################# # @@ -791,7 +791,7 @@ Patch1001: fips-%{featurever}u-%{fipsver}.patch # ############################################# -# Currently empty +Patch1: JDK-8373246-8351842_broke_native_debugging_on_Linux.patch ############################################# # @@ -1086,6 +1086,7 @@ pushd %{top_level_dir_name} # Add crypto policy and FIPS support # usage in jdk >25 is experimental and may disapear %patch -P1001 -p1 +%patch -P1 -p1 popd # openjdk echo "Generating %{alt_java_name} man page" @@ -1491,6 +1492,9 @@ function packagejdk() { # Release images have external debug symbols if [ "x$suffix" = "x" ] ; then + # jdk26 is putting debugsymbols out of main image, + # we later reconstruct debuginfo subpakckages manually, so putting them back + cp -r symbols/* ${jdkname}/ createtar ${debugarchive} $(find ${jdkname} -name \*.debuginfo) genchecksum ${debugarchive} diff --git a/sources b/sources index 641515d..404d038 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (openjdk-25.0.1+8.tar.xz) = eb84d876f81ca02803283e8294c89b6acbed3753426811c3bcc228615c9618deefc85da4aa702800cac2feb103e628ee8b92292b316e9d7e12a58b6de69c5085 +SHA512 (openjdk-26+29-ea.tar.xz) = 4e80882e0de26eff7d46d762e255911d42544473cc5f12ab0af1997969a14cc697e1164cb3c90d894359b58cc42dbd2b233f00fa807dbfad41583da278e26666