From 279b16ab6c2873dec4cb30def49817c012a77f30 Mon Sep 17 00:00:00 2001 From: Jiri Date: Thu, 10 Apr 2025 20:37:13 +0200 Subject: [PATCH 1/6] Disabled pandoc requirement for build --- java-latest-openjdk-portable.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index c3ae220..6052025 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -769,7 +769,8 @@ BuildRequires: libffi-devel %endif # Full documentation build requirements BuildRequires: graphviz -BuildRequires: pandoc +# pandoc missing in epel10 temporary? +# BuildRequires: pandoc # 2023c required as of JDK-8305113 BuildRequires: tzdata-java >= 2023c # cacerts build requirement in portable mode From 30ed4003e254f3d6aba232958547c1f9a0a2031e Mon Sep 17 00:00:00 2001 From: Jiri Date: Fri, 11 Apr 2025 10:12:55 +0200 Subject: [PATCH 2/6] Revert "Disabled pandoc requirement for build" This reverts commit 279b16ab6c2873dec4cb30def49817c012a77f30. Without pandoc, there are no man pages --- java-latest-openjdk-portable.spec | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index 6052025..c3ae220 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -769,8 +769,7 @@ BuildRequires: libffi-devel %endif # Full documentation build requirements BuildRequires: graphviz -# pandoc missing in epel10 temporary? -# BuildRequires: pandoc +BuildRequires: pandoc # 2023c required as of JDK-8305113 BuildRequires: tzdata-java >= 2023c # cacerts build requirement in portable mode From 8da764d82ac2851ef8953ca2bcf20984439fc021 Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Fri, 5 Dec 2025 13:20:30 +0100 Subject: [PATCH 3/6] Added support for build with devkit in rhel and building by fastdebug if possible --- NEWS | 689 ++++++++++++++++++++++++++++-- TestTranslations.java | 16 +- java-latest-openjdk-portable.spec | 590 +++++++++++++++++-------- scripts/get_bundle_versions.sh | 172 ++++++++ 4 files changed, 1240 insertions(+), 227 deletions(-) create mode 100755 scripts/get_bundle_versions.sh diff --git a/NEWS b/NEWS index d44c7e0..0a4a628 100644 --- a/NEWS +++ b/NEWS @@ -2,34 +2,669 @@ Key: JDK-X - https://bugs.openjdk.java.net/browse/JDK-X CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY -JEP-XYZ: https://openjdk.org/jeps/XYZ -New in release OpenJDK 25.0.0+32 (2025-06-9): +New in release OpenJDK 25.0.1 (2025-10-21): =========================================== -JDK 25 is in Rampdown Phase One. The overall feature set is frozen. No further JEPs will be targeted to this release. -The stabilization branch, jdk25, is open for select bug fixes and, with approval, late enhancements per the JDK Release Process (JEP 3). Integrate most stabilization changes via backports from the main line. - - JEP-470: PEM Encodings of Cryptographic Objects (Preview) - - JEP-502: Stable Values (Preview) - - JEP-503: Remove the 32-bit x86 Port - - JEP-505: Structured Concurrency (Fifth Preview) - - JEP-506: Scoped Values - - JEP-507: Primitive Types in Patterns, instanceof, and switch (Third Preview) - - JEP-508: Vector API (Tenth Incubator) - - JEP-509: JFR CPU-Time Profiling (Experimental) - - JEP-510: Key Derivation Function API - - JEP-511: Module Import Declarations - - JEP-512: Compact Source Files and Instance Main Methods - - JEP-513: Flexible Constructor Bodies - - JEP-514: Ahead-of-Time Command-Line Ergonomics - - JEP-515: Ahead-of-Time Method Profiling - - JEP-518: JFR Cooperative Sampling - - JEP-519: Compact Object Headers - - JEP-520: JFR Method Timing & Tracing - - JEP-521: Generational Shenandoah +* CVEs + - CVE-2025-53057 + - CVE-2025-53066 + - CVE-2025-61748 +* Changes + - JDK-8315131: Clarify VarHandle set/get access on 32-bit platforms + - JDK-8352637: Enhance bytecode verification + - JDK-8356294: Enhance Path Factories + - JDK-8356587: Missing object ID X in pool jdk.types.Method + - JDK-8357826: Avoid running some jtreg tests when asan is configured + - JDK-8358452: JNI exception pending in Java_sun_awt_screencast_ScreencastHelper_remoteDesktopKeyImpl of screencast_pipewire.c:1214 (ID: 51119) + - JDK-8358577: Test serviceability/jvmti/thread/GetCurrentContendedMonitor/contmon01/contmon01.java failed: unexpexcted monitor object + - JDK-8358819: The first year is not displayed correctly in Japanese Calendar + - JDK-8359059: Bump version numbers for 25.0.1 + - JDK-8359218: RISC-V: Only enable CRC32 intrinsic when AvoidUnalignedAccess == false + - JDK-8359270: C2: alignment check should consider base offset when emitting arraycopy runtime call + - JDK-8359454: Enhance String handling + - JDK-8359596: Behavior change when both -Xlint:options and -Xlint:-options flags are given + - JDK-8360179: RISC-V: Only enable BigInteger intrinsics when AvoidUnalignedAccess == false + - JDK-8360533: ContainerRuntimeVersionTestUtils fromVersionString fails with some docker versions + - JDK-8360647: [XWayland] [OL10] NumPad keys are not triggered + - JDK-8360679: Shenandoah: AOT saved adapter calls into broken GC barrier stub + - JDK-8360937: Enhance certificate handling + - JDK-8361212: Remove AffirmTrust root CAs + - JDK-8361532: RISC-V: Several vector tests fail after JDK-8354383 + - JDK-8361829: [TESTBUG] RISC-V: compiler/vectorization/runner/BasicIntOpTest.java fails with RVV but not Zvbb + - JDK-8362109: Change milestone to fcs for all releases + - JDK-8362882: Update SubmissionPublisher() specification to reflect use of ForkJoinPool.asyncCommonPool() + - JDK-8366223: ZGC: ZPageAllocator::cleanup_failed_commit_multi_partition is broken + - JDK-8367031: [backout] Change java.time month/day field types to 'byte' + - JDK-8368308: ISO 4217 Amendment 180 Update -+ https://openjdk.org/projects/jdk/25/ -+ https://openjdk.org/projects/jdk/24/ -+ https://openjdk.org/projects/jdk/23/ -+ https://openjdk.org/projects/jdk/22/ -In case yo uare moving directly from jdk21 +Notes on individual issues: +=========================== + +core-libs/java.io:serialization: + +JDK-8367031: [backout] Change java.time month/day field types to 'byte' +======================================================================= +In the initial release of OpenJDK 25, attempting to read serialised +Class objects created by earlier versions of OpenJDK for several of +the `java.time` classes would fail with a +`InvalidClassException`. Similarly, `java.time` Class objects +serialised with OpenJDK 25 could not be read by older OpenJDK +versions. This was due to the type of the day and month fields in +these classes being changed to `byte`. This change has now been +reverted and compatibility between OpenJDK 25 and older versions +restored. + +Note that this incompatibility occurred with the `Class` object and +not an instance of the object i.e. `writeObject(LocalDate.class)` +would produce incompatible serialised data, but +`writeObject(LocalDate.now())` would not. + +security-libs/java.security: + +JDK-8361212: Remove AffirmTrust root CAs +======================================== +The following root certificates from AffirmTrust, which were +deactivated in the 21.0.5 release of October 2024, have been removed +from the `cacerts` keystore: + +Alias name: affirmtrustcommercialca [jdk] +CN=AffirmTrust Commercial +O=AffirmTrust +C=US +SHA256: 03:76:AB:1D:54:C5:F9:80:3C:E4:B2:E2:01:A0:EE:7E:EF:7B:57:B6:36:E8:A9:3C:9B:8D:48:60:C9:6F:5F:A7 + +Alias name: affirmtrustnetworkingca [jdk] +CN=AffirmTrust Networking +O=AffirmTrust +C=US +SHA256: 0A:81:EC:5A:92:97:77:F1:45:90:4A:F3:8D:5D:50:9F:66:B5:E2:C5:8F:CD:B5:31:05:8B:0E:17:F3:F0B4:1B + +Alias name: affirmtrustpremiumca [jdk] +CN=AffirmTrust Premium +O=AffirmTrust +C=US +SHA256: 70:A7:3F:7F:37:6B:60:07:42:48:90:45:34:B1:14:82:D5:BF:0E:69:8E:CC:49:8D:F5:25:77:EB:F2:E9:3B:9A + +Alias name: affirmtrustpremiumeccca [jdk] +CN=AffirmTrust Premium ECC +O=AffirmTrust +C=US +SHA256: BD:71:FD:F6:DA:97:E4:CF:62:D1:64:7A:DD:25:81:B0:7D:79:AD:F8:39:7E:B4:EC:BA:9C:5E:84:88:82:14:23 + +New in release OpenJDK 25.0.0 (2025-09-16): +=========================================== +Major changes are listed below. Some changes may have been backported +to earlier releases following their first appearance in OpenJDK 22 +through to 25. + +NEW FEATURES +============ + +Language Features +================= + +Flexible Constructor Bodies +============================ +https://openjdk.org/jeps/447 +https://openjdk.org/jeps/482 +https://openjdk.org/jeps/492 +https://openjdk.org/jeps/513 + +In constructors in the Java programming language, allow statements to +appear before an explicit constructor invocation, i.e., super(..) or +this(..). The statements cannot reference the instance under +construction, but they can initialize its fields. Initializing fields +before invoking another constructor makes a class more reliable when +methods are overridden. + +This language feature is now finalised (JEP 513). It was first +introduced as a preview language feature +(http://openjdk.java.net/jeps/12) in OpenJDK 22 (JEP 447) under the +name "Statements before super(...)". It reached a second preview in +OpenJDK 23 (JEP 482) with the addition of allowing fields to be +initialized before invoking another constructor. It reached a third +preview in OpenJDK 24 (JEP 492). + +Unnamed Patterns and Variables +============================== +https://openjdk.org/jeps/443 +https://openjdk.org/jeps/456 + +Enhance the Java language with unnamed patterns, which match a record +component without stating the component's name or type, and unnamed +variables, which can be initialized but not used. Both are denoted by +an underscore character, _. + +This feature is now finalised (JEP 456). It was a preview feature +(http://openjdk.java.net/jeps/12) in OpenJDK 21 (JEP 443). + +Primitive Types in Patterns, instanceof, and switch +=================================================== +https://openjdk.org/jeps/455 +https://openjdk.org/jeps/488 +https://openjdk.org/jeps/507 + +Enhance pattern matching by allowing primitive type patterns in all +pattern contexts, and extend instanceof and switch to work with all +primitive types. + +This is a preview language feature (http://openjdk.java.net/jeps/12) +introduced in OpenJDK 23 (JEP 455) with a second preview in OpenJDK 24 +(JEP 488) and reaching a third in OpenJDK 25 (JEP 507). + +Module Import Declarations +========================== +https://openjdk.org/jeps/476 +https://openjdk.org/jeps/494 +https://openjdk.org/jeps/511 + +Enhance the Java programming language with the ability to succinctly +import all of the packages exported by a module. This simplifies the +reuse of modular libraries, but does not require the importing code to +be in a module itself. + +This language feature is now finalised (JEP 511). It was introduced as +a preview language feature (http://openjdk.java.net/jeps/12) in +OpenJDK 23 (JEP 476) and had a second preview in OpenJDK 24 (JEP 494). + +Library Features +================ + +Foreign Function & Memory API +============================= +https://openjdk.org/jeps/412 +https://openjdk.org/jeps/419 +https://openjdk.org/jeps/424 +https://openjdk.org/jeps/434 +https://openjdk.org/jeps/442 +https://openjdk.org/jeps/454 + +Introduce an API by which Java programs can interoperate with code and +data outside of the Java runtime. By efficiently invoking foreign +functions (i.e., code outside the JVM), and by safely accessing +foreign memory (i.e., memory not managed by the JVM), the API enables +Java programs to call native libraries and process native data without +the brittleness and danger of JNI. + +This API is now finalised (JEP 454). It was first introduced in +incubation (https://openjdk.java.net/jeps/11) in OpenJDK 17 (JEP 412), +and is an evolution of the Foreign Memory Access API (OpenJDK 14 +through 16) and Foreign Linker API (OpenJDK 16) (see release notes for +java-17-openjdk). OpenJDK 18 saw a second round of incubation (JEP +419) before its inclusion as a preview feature +(http://openjdk.java.net/jeps/12) in OpenJDK 19 (JEP 424). A second +preview took place in OpenJDK 20 (JEP 434) and a third and final +preview in OpenJDK 21 (JEP 442). + +Prepare to Restrict the Use of JNI +================================== +https://openjdk.org/jeps/472 + +Issue warnings about uses of the Java Native Interface (JNI) and +adjust the Foreign Function & Memory (FFM) API to issue warnings in a +consistent manner. All such warnings aim to prepare developers for a +future release that ensures integrity by default by uniformly +restricting JNI and the FFM API. Application developers can avoid both +current warnings and future restrictions by selectively enabling these +interfaces where essential using the --enable-native-access +command-line option. + +Class-File API +============== +https://openjdk.org/jeps/457 +https://openjdk.org/jeps/466 +https://openjdk.org/jeps/484 + +Provide a standard API for parsing, generating, and transforming Java +class files. + +This API is now finalised (JEP 484). It was introduced as a preview +library feature (http://openjdk.java.net/jeps/12) in OpenJDK 22 (JEP +457) with a second preview in OpenJDK 23 (JEP 466). + +Vector API +========== +https://openjdk.org/jeps/338 +https://openjdk.org/jeps/414 +https://openjdk.org/jeps/417 +https://openjdk.org/jeps/426 +https://openjdk.org/jeps/438 +https://openjdk.org/jeps/448 +https://openjdk.org/jeps/460 +https://openjdk.org/jeps/469 +https://openjdk.org/jeps/489 +https://openjdk.org/jeps/508 + +Introduce an API to express vector computations that reliably compile +at runtime to optimal vector hardware instructions on supported CPU +architectures and thus achieve superior performance to equivalent +scalar computations. + +This is an incubation feature (https://openjdk.java.net/jeps/11) +introduced in OpenJDK 16 (JEP 338). A second round of incubation took +place in OpenJDK 17 (JEP 414), OpenJDK 18 (JEP 417) saw a third, +OpenJDK 19 a fourth (JEP 426), OpenJDK 20 (JEP 438) a fifth, OpenJDK +21 a sixth (JEP 448), OpenJDK 22 a seventh (JEP 460), OpenJDK 23 an +eighth (JEP 469), OpenJDK 24 a ninth (JEP 489) and it reaches its +tenth in OpenJDK 25 (JEP 508). + +Stream Gatherers +================ +https://openjdk.org/jeps/461 +https://openjdk.org/jeps/473 +https://openjdk.org/jeps/485 + +Enhance the Stream API to support custom intermediate operations. This +will allow stream pipelines to transform data in ways that are not +easily achievable with the existing built-in intermediate operations. + +This API is now finalised (JEP 485). It was introduced as a preview +library feature (http://openjdk.java.net/jeps/12) in OpenJDK 22 (JEP +461) with a second preview in OpenJDK 23 (JEP 473). + +Structured Concurrency +====================== +https://openjdk.org/jeps/428 +https://openjdk.org/jeps/437 +https://openjdk.org/jeps/453 +https://openjdk.org/jeps/462 +https://openjdk.org/jeps/480 +https://openjdk.org/jeps/499 +https://openjdk.org/jeps/505 + +Simplify multithreaded programming by introducing an API for +structured concurrency. Structured concurrency treats multiple tasks +running in different threads as a single unit of work, thereby +streamlining error handling and cancellation, improving reliability, +and enhancing observability. + +This API was first introduced in incubation +(https://openjdk.java.net/jeps/11) in OpenJDK 19 (JEP 428) and had a +second round of incubation in OpenJDK 20 (JEP 437). It became a +preview feature (http://openjdk.java.net/jeps/12) in OpenJDK 21 (JEP +453), reached its second preview in OpenJDK 22 (JEP 462), had a third +preview in OpenJDK 23 (JEP 480), a fourth in OpenJDK 24 (JEP 499) and +reaches its fifth in OpenJDK 25 (JEP 505). + +Compact Source Files and Instance Main Methods +============================================== +https://openjdk.org/jeps/445 +https://openjdk.org/jeps/463 +https://openjdk.org/jeps/477 +https://openjdk.org/jeps/495 +https://openjdk.org/jeps/512 + +Evolve the Java programming language so that beginners can write their +first programs without needing to understand language features +designed for large programs. Far from using a separate dialect of the +language, beginners can write streamlined declarations for +single-class programs and then seamlessly expand their programs to use +more advanced features as their skills grow. Experienced developers +can likewise enjoy writing small programs succinctly, without the need +for constructs intended for programming in the large. + +This library feature is now finalised (JEP 512) with some minor +changes from the last release. It was first introduced as a preview +(http://openjdk.java.net/jeps/12) in OpenJDK 21 (JEP 445) under the +name "Unnamed Classes and Instance Main Methods". It reached a second +preview in OpenJDK 22 (JEP 463) and a third in OpenJDK 23 (JEP 477) +under the new name, "Implicitly Declared Classes and Instance Main +Methods", due to the move away from unnamed classes to an implicitly +declared name chosen by the host system. It had a fourth preview in +OpenJDK 24 (JEP 495) with new terminology and a revised title ("Simple +Source Files and Instance Main Methods"), but otherwise unchanged. + +Scoped Values +============= +https://openjdk.org/jeps/429 +https://openjdk.org/jeps/446 +https://openjdk.org/jeps/464 +https://openjdk.org/jeps/481 +https://openjdk.org/jeps/487 +https://openjdk.org/jeps/506 + +Introduce scoped values, which enable the sharing of immutable data +within and across threads. They are preferred to thread-local +variables, especially when using large numbers of virtual threads. + +This API is now finalised (JEP 506). This API was first introduced in +incubation (https://openjdk.java.net/jeps/11) in OpenJDK 20 (JEP +429). It became a preview feature (http://openjdk.java.net/jeps/12) in +OpenJDK 21 (JEP 446), had a second preview in OpenJDK 22 (JEP 464), a +third in OpenJDK 23 (JEP 481) and a fourth in OpenJDK 24 (JEP 487). + +Key Derivation Function API +=========================== +https://openjdk.org/jeps/478 +https://openjdk.org/jeps/510 + +Introduce an API for Key Derivation Functions (KDFs), which are +cryptographic algorithms for deriving additional keys from a secret +key and other data. + +This API is now finalised (JEP 510). It was first introduced as a +preview library feature (http://openjdk.java.net/jeps/12) in OpenJDK +24 (JEP 478). + +Quantum-Resistant Module-Lattice-Based Key Encapsulation Mechanism +================================================================== +https://openjdk.org/jeps/496 + +Enhance the security of Java applications by providing an +implementation of the quantum-resistant Module-Lattice-Based +Key-Encapsulation Mechanism (ML-KEM). Key encapsulation mechanisms +(KEMs) are used to secure symmetric keys over insecure communication +channels using public key cryptography. ML-KEM is designed to be +secure against future quantum computing attacks. It has been +standardized by the United States National Institute of Standards and +Technology (NIST) in FIPS 203 [0]. + +[0] https://csrc.nist.gov/pubs/fips/203/final + +Quantum-Resistant Module-Lattice-Based Digital Signature Algorithm +================================================================== +https://openjdk.org/jeps/497 + +Enhance the security of Java applications by providing an +implementation of the quantum-resistant Module-Lattice-Based Digital +Signature Algorithm (ML-DSA). Digital signatures are used to detect +unauthorized modifications to data and to authenticate the identity of +signatories. ML-DSA is designed to be secure against future quantum +computing attacks. It has been standardized by the United States +National Institute of Standards and Technology (NIST) in FIPS 204 [0]. + +[0] https://csrc.nist.gov/pubs/fips/204/final + +PEM Encodings of Cryptographic Objects +====================================== +https://openjdk.org/jeps/470 + +Introduce an API for encoding objects that represent cryptographic +keys, certificates, and certificate revocation lists into the +widely-used Privacy-Enhanced Mail (PEM) transport format, and for +decoding from that format back into objects. + +This is a preview library feature (http://openjdk.java.net/jeps/12) +introduced in OpenJDK 25 (JEP 470). + +Stable Values +============= +https://openjdk.org/jeps/502 + +Introduce an API for stable values, which are objects that hold +immutable data. Stable values are treated as constants by the JVM, +enabling the same performance optimizations that are enabled by +declaring a field final. Compared to final fields, however, stable +values offer greater flexibility as to the timing of their +initialization. + +This is a preview library feature (http://openjdk.java.net/jeps/12) +introduced in OpenJDK 25 (JEP 502). + +Virtual Machine Enhancements +============================ + +Region Pinning for G1 +===================== +https://openjdk.org/jeps/423 + +Reduce latency by implementing region pinning in G1, so that garbage +collection need not be disabled during Java Native Interface (JNI) +critical regions. + +ZGC: Generational Mode by Default +================================= +https://openjdk.org/jeps/439 +https://openjdk.org/jeps/474 + +Switch the default mode of the Z Garbage Collector (ZGC) to the +generational mode. Deprecate the non-generational mode, with the +intent to remove it in a future release. + +Late Barrier Expansion for G1 +============================= +https://openjdk.org/jeps/475 + +Simplify the implementation of the G1 garbage collector's barriers, +which record information about application memory accesses, by +shifting their expansion from early in the C2 JIT's compilation +pipeline to later. + +Ahead-of-Time Class Loading & Linking +===================================== +https://openjdk.org/jeps/483 +https://openjdk.org/jeps/514 + +Improve startup time by making the classes of an application instantly +available, in a loaded and linked state, when the HotSpot Java Virtual +Machine starts. Achieve this by monitoring the application during one +run and storing the loaded and linked forms of all classes in a cache +for use in subsequent runs. Lay a foundation for future improvements +to both startup and warmup time. + +Using this feature requires a two stage process: + +1. Create the Ahead-of-Time cache from a training run of the +application using the option `--XX:AOTCacheOutput=` where +`` is the cache reference to use in later runs. + +2. When running the application in testing or production, use the +option `-XX:AOTCache=` to run the application with the +cache generated in #2. + +Previously, in OpenJDK 24 (JEP 483), the training run and cache +creation were handled by two separate steps: + +1. Populate the Ahead-of-Time configuration data with a training run +of the application using the options `-XX:AOTMode=record +-XX:AOTConfiguration=` where `` is the +configuration reference to use in #2. + +2. Create the Ahead-of-Time cache using the options +`-XX:AOTMode=create -XX:AOTConfiguration= +-XX:AOTCache=` where `` is the configuration +reference from #1 and `` is the cache reference to use in +later runs. + +JEP 514 ("Ahead-of-Time Command-Line Ergonomics") in OpenJDK 25 adds +the option `--XX:AOTCacheOutput` which performs both the above steps +from a single command-line invocation using a temporary configuration +file. A new environment variable, `JDK_AOT_VM_OPTIONS`, can be used +to pass options to the cache creation step without affecting the +training run step. + +Ahead-of-Time Method Profiling +============================== +https://openjdk.org/jeps/515 + +Improve warmup time by making method-execution profiles from a +previous run of an application instantly available, when the HotSpot +Java Virtual Machine starts. This will enable the JIT compiler to +generate native code immediately upon application startup, rather than +having to wait for profiles to be collected. + +Synchronize Virtual Threads without Pinning +=========================================== +https://openjdk.org/jeps/491 + +Improve the scalability of Java code that uses synchronized methods +and statements by arranging for virtual threads that block in such +constructs to release their underlying platform threads for use by +other virtual threads. This will eliminate nearly all cases of virtual +threads being pinned to platform threads, which severely restricts the +number of virtual threads available to handle an application's +workload. + +Compact Object Headers +====================== +https://openjdk.org/jeps/450 +https://openjdk.org/jeps/519 + +Reduce the size of object headers in the HotSpot JVM from between 96 +and 128 bits down to 64 bits on 64-bit architectures. This will reduce +heap size, improve deployment density, and increase data locality. + +This is now a production feature in OpenJDK 25 (JEP 519) enabled using +`-XX:+UseCompactObjectHeaders`. It was first introduced as an +experimental feature (JEP 450) that also required the use of +`-XX:+UnlockExperimentalVMOptions`. + +Generational Shenandoah +======================= +https://openjdk.org/jeps/404 +https://openjdk.org/jeps/521 + +Enhance the Shenandoah garbage collector with experimental +generational collection capabilities to improve sustainable +throughput, load-spike resilience, and memory utilization. + +This is now a production feature in OpenJDK 25 (JEP 521) enabled using +`-XX:ShenandoahGCMode=generational`. It was first introduced as an +experimental feature (JEP 404) that also required the use of +`-XX:+UnlockExperimentalVMOptions`. + +JFR Cooperative Sampling +======================== +https://openjdk.org/jeps/518 + +Improve the stability of the JDK Flight Recorder (JFR) when it +asynchronously samples Java thread stacks. Achieve this by walking +call stacks only at safepoints, while minimizing safepoint bias. + +JFR Method Timing & Tracing +=========================== +https://openjdk.org/jeps/520 + +Extend the JDK Flight Recorder (JFR) with facilities for method timing +and tracing via bytecode instrumentation. + +JFR CPU-Time Profiling +====================== +https://openjdk.org/jeps/509 + +Enhance the JDK Flight Recorder (JFR) to capture more accurate +CPU-time profiling information on Linux. + +This is an experimental feature so its JFR events are tagged with the +`@Experimental` annotation. Unlike other experimental virtual machine +features, it does not need to be explicitly enabled with +`-XX:+UnlockExperimentalVMOptions`. + +Tools +===== + +Launch Multi-File Source-Code Programs +====================================== +https://openjdk.org/jeps/458 + +Enhance the java application launcher to be able to run a program +supplied as multiple files of Java source code. This will make the +transition from small programs to larger ones more gradual, enabling +developers to choose whether and when to go to the trouble of +configuring a build tool. + +Markdown Documentation Comments +=============================== +https://openjdk.org/jeps/467 + +Enable JavaDoc documentation comments to be written in Markdown rather +than solely in a mixture of HTML and JavaDoc @-tags. + +Linking Run-Time Images without JMODs +===================================== +https://openjdk.org/jeps/493 + +Reduce the size of the JDK by approximately 25% by enabling the jlink +tool to create custom run-time images without using the JDK's JMOD +files. + +This feature must be enabled when the JDK is built using the +--enable-linkable-runtime option. It will not be enabled by default, +and some JDK vendors may choose not to enable it. + +DEPRECATIONS +============ + +Deprecate the Memory-Access Methods in sun.misc.Unsafe for Removal +================================================================== +https://openjdk.org/jeps/471 + +Deprecate the memory-access methods in sun.misc.Unsafe for removal in +a future release. These unsupported methods have been superseded by +standard APIs, namely the VarHandle API (JEP 193, OpenJDK 9) and the +Foreign Function & Memory API (JEP 454, OpenJDK 22). We strongly +encourage library developers to migrate from sun.misc.Unsafe to +supported replacements, so that applications can migrate smoothly to +modern JDK releases. + +Warn upon Use of Memory-Access Methods in sun.misc.Unsafe +========================================================= +https://openjdk.org/jeps/498 + +Issue a warning at run time on the first occasion that any +memory-access method in sun.misc.Unsafe is invoked. All of these +unsupported methods were terminally deprecated in JDK 23 (see JEP 471 +above). They have been superseded by standard APIs, namely the +VarHandle API (JEP 193, OpenJDK 9) and the Foreign Function & Memory +API (JEP 454, OpenJDK 22). We strongly encourage library developers to +migrate from sun.misc.Unsafe to supported replacements, so that +applications can migrate smoothly to modern JDK releases. + +Permanently Disable the Security Manager +======================================== +https://openjdk.org/jeps/486 + +The Security Manager has not been the primary means of securing +client-side Java code for many years, it has rarely been used to +secure server-side code, and it is costly to maintain. We therefore +deprecated it for removal in OpenJDK 17 via JEP 411 (2021). As the +next step toward removing the Security Manager, we will revise the +Java Platform specification so that developers cannot enable it and +other Platform classes do not refer to it. This change will have no +impact on the vast majority of applications, libraries, and tools. We +will remove the Security Manager API in a future release. + +REMOVALS +======== + +String Templates +================ +https://openjdk.org/jeps/430 +https://openjdk.org/jeps/459 +https://openjdk.org/jeps/465 + +This was a preview feature (http://openjdk.java.net/jeps/12) +introduced in OpenJDK 21 (JEP 430) with a second preview in OpenJDK 22 +(JEP 459). A third preview was proposed but ultimately withdrawn for +OpenJDK 23 (JEP 465) and the feature is no longer present. See [0] +for further explanation. + +[0] https://mail.openjdk.org/pipermail/amber-spec-experts/2024-April/004106.html + +Remove the Windows & Linux 32-bit x86 Ports +=========================================== +https://openjdk.org/jeps/449 +https://openjdk.org/jeps/479 +https://openjdk.org/jeps/501 +https://openjdk.org/jeps/503 + +Remove the source code and build support for the Windows (JEP 479) & +Linux (JEP 503) 32-bit x86 ports. The Windows port was deprecated for +removal in JDK 21 by JEP 449 and the Linux port was deprecated for +removal in JDK 24 by JEP 501. Both deprecations took place with the +express intent to remove the ports in a future release. + +Following this removal of these 32-bit x86 ports, the +architecture-agnostic Zero port is the only way to run Java programs +on 32-bit x86 processors. + +ZGC: Remove the Non-Generational Mode +===================================== +https://openjdk.org/jeps/439 +https://openjdk.org/jeps/474 +https://openjdk.org/jeps/490 + +Remove the non-generational mode of the Z Garbage Collector (ZGC), +keeping the generational mode as the default for ZGC (see JEP 439 & +474). diff --git a/TestTranslations.java b/TestTranslations.java index f6a4fe2..1b02c06 100644 --- a/TestTranslations.java +++ b/TestTranslations.java @@ -50,11 +50,11 @@ public class TestTranslations { "Mountain Daylight Time", "MDT", "MDT", "Mountain Time", "MT", "MT"}); map.put(Locale.FRANCE, new String[] { "heure normale des Rocheuses", "UTC\u221207:00", "MST", - "heure d\u2019\u00e9t\u00e9 des Rocheuses", "UTC\u221206:00", "MDT", - "heure des Rocheuses", "UTC\u221207:00", "MT"}); - map.put(Locale.GERMANY, new String[] { "Rocky-Mountain-Normalzeit", "GMT-07:00", "MST", - "Rocky-Mountain-Sommerzeit", "GMT-06:00", "MDT", - "Rocky-Mountain-Zeit", "GMT-07:00", "MT"}); + "heure d\u2019\u00e9t\u00e9 des Rocheuses", "UTC\u221206:00", "MST", + "heure des Rocheuses", "UTC\u221207:00", "MST"}); + map.put(Locale.GERMANY, new String[] { "Rocky-Mountains-Normalzeit", "GMT-07:00", "MST", + "Rocky-Mountains-Sommerzeit", "GMT-06:00", "MST", + "Rocky-Mountains-Zeit", "GMT-07:00", "MST"}); CIUDAD_JUAREZ = Collections.unmodifiableMap(map); } @@ -97,14 +97,10 @@ public class TestTranslations { System.out.printf("Checking locale %s for %s...\n", l, id); - if ("JRE".equals(localeProvider)) { + if ("JRE".equals(localeProvider) || "CLDR".equals(localeProvider)) { expectedShortStd = expected[2]; expectedShortDST = expected[5]; expectedShortGen = expected[8]; - } else if ("CLDR".equals(localeProvider)) { - expectedShortStd = expected[1]; - expectedShortDST = expected[4]; - expectedShortGen = expected[7]; } else { System.err.printf("Invalid locale provider %s\n", localeProvider); System.exit(3); diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index 213f7b4..7b48c3d 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -1,10 +1,5 @@ -%if (0%{?rhel} > 0 && 0%{?rhel} < 8) -# portable jdk 17 specific bug, _jvmdir being missing -%define _jvmdir /usr/lib/jvm -%endif - # debug_package %%{nil} is portable-jdks specific -%define debug_package %{nil} +%define debug_package %{nil} # RPM conditionals so as to be able to dynamically produce # slowdebug/release builds. See: @@ -65,6 +60,10 @@ # See: https://bugzilla.redhat.com/show_bug.cgi?id=1520879 %global _find_debuginfo_opts -g +# Disable LTO as this causes build failures at the moment. +# See RHBZ#1861401 +%define _lto_cflags %{nil} + # note: parametrized macros are order-sensitive (unlike not-parametrized) even with normal macros # also necessary when passing it as parameter to other macros. If not macro, then it is considered a switch # see the difference between global and define: @@ -160,6 +159,8 @@ %else %global gdb_arches %{jit_arches} %{zero_arches} %endif +# Architecture on which we run Java only tests +%global jdk_test_arch x86_64 # By default, we build a slowdebug build during main build on JIT architectures %if %{with slowdebug} @@ -243,29 +244,83 @@ # Target to use to just build HotSpot %global hotspot_target hotspot -# When building on older systems, we need system, or self build legacy toolchains of explicit version -%if ((0%{?rhel} > 0 && 0%{?rhel} < 8)) || ((0%{?epel} > 0 && 0%{?epel} < 9)) -%global is_dtstoolchain 1 + +# Individual build frameworks this specfile supports +# if elif ... elif ... elif ... else is unluckily buggy +# On rhel7 we need software collection +%if (0%{?rhel} == 7) +%global is_dtstoolchain collection +%global dtsversion 10 +%global dtsname devtoolset-%{dtsversion} +%global dts_command scl enable %{dtsname} -- +%global exclusive_arches %{nil} +%define dts_brs # Brs for collection\ +BuildRequires: %{dtsname}-gcc \ +BuildRequires: %{dtsname}-gcc-c++ %else -%global is_dtstoolchain 0 +# On rhel8 we have self built custom devkit +%if ((0%{?rhel} == 8) && (0%{?epel} == 0)) +%global is_dtstoolchain devkit +%global dtsversion 1.0-9 +%global dtsname %{origin}-devkit +%global dts_command %{nil} +%if 0%{?centos} == 0 +# centos had originally smaller set of devkit arches +%global exclusive_arches %{aarch64} %{ppc64le} s390x x86_64 riscv64 +%else +%global exclusive_arches %{aarch64} %{ppc64le} s390x x86_64 riscv64 +%endif +%define dts_brs # Brs for devkit\ +BuildRequires: %{dtsname} >= %{dtsversion} +%else +# On newest systems we use system gcc and friens +%if ((0%{?fedora} > 0) || (0%{?rhel} >= 9) || (0%{?epel} >= 9)) +%global is_dtstoolchain system +%global dtsversion %{nil} +%global dtsname %{nil} +%global exclusive_arches %{java_arches} +%define dts_brs # Brs for system\ +BuildRequires: gcc >= 4.8.3-8 \ +BuildRequires: gcc-c++ \ +# We link statically against libstdc++ to increase portability \ +BuildRequires: libstdc++-static +# When building on epel8, we need system, legacy toolchain of explicit version +%else +%if ((0%{?epel}) > 0 && (0%{?epel} <= 8)) +%global is_dtstoolchain toolset +%global dtsversion 14 +%global dtsname gcc-toolset-%{dtsversion} +%global exclusive_arches %{java_arches} +%define dts_brs # Brs for toolset\ +BuildRequires: %{dtsname}-gcc \ +BuildRequires: %{dtsname}-gcc-c++ \ +BuildRequires: %{dtsname}-annobin-annocheck \ +BuildRequires: %{dtsname}-annobin-plugin-gcc \ +BuildRequires: %{dtsname}-binutils \ +BuildRequires: %{dtsname}-gcc-plugin-annobin \ +# We link statically against libstdc++ to increase portability \ +BuildRequires: libstdc++-static +# no go +%else +"Unsupported system: fedora=0%{?fedora} rhel=0%{?rhel} epel=0%{?epel} centos=0%{?centos}" +exit 1 %endif -%if ((0%{?rhel} > 0 && 0%{?rhel} < 8)) -# DTS toolset to use to provide gcc & binutils -%global dtsversion 10 -%global dtsname devtoolset %endif -%if ((0%{?epel} > 0 && 0%{?epel} < 9)) -# GCC toolset to use to provide gcc & binutils -%global dtsversion 14 -%global dtsname gcc-toolset %endif -%if %{is_dtstoolchain} -%global dtsid %{dtsname}-%{dtsversion} %endif -# Disable LTO as this causes build failures at the moment. -# See RHBZ#1861401 -%define _lto_cflags %{nil} +%if ((0%{?epel}) > 0 || (0%{?fedora} > 8)) +%global use_portable_bootjdk 0 +%else +%global use_portable_bootjdk 1 +%endif + +# Check if pandoc is available to generate docs (including man pages) +%if 0%{?rhel} == 8 || 0%{?epel} > 0 || 0%{?fedora} > 0 +%global pandoc_available 1 +%else +%global pandoc_available 0 +%endif # Filter out flags from the optflags macro that cause problems with the OpenJDK build # We filter out -O flags so that the optimization of HotSpot is not lowered from O3 to O2 @@ -340,12 +395,10 @@ %global stapinstall %{nil} %endif +# on fedora and epel, we build systemtap in repacking to rpms +# thus having it disabled, and keeping the lines just for sync reasons %ifarch %{systemtap_arches} -%if (0%{?rhel} > 0 && !0%{?epel}) -%global with_systemtap 1 -%else %global with_systemtap 0 -%endif %else %global with_systemtap 0 %endif @@ -368,16 +421,6 @@ %global lts_designator "" %global lts_designator_zip "" %endif -# JDK to use for bootstrapping -%global bootjdk /usr/lib/jvm/java-latest-openjdk -# Define whether to use the bootstrap JDK directly or with a fresh libjvm.so -# This will only work where the bootstrap JDK is the same major version -# as the JDK being built -%if %{with fresh_libjvm} && %{buildjdkver} == %{featurever} -%global build_hotspot_first 1 -%else -%global build_hotspot_first 0 -%endif # Define vendor information used by OpenJDK %global oj_vendor Red Hat, Inc. @@ -403,6 +446,7 @@ # Define IcedTea version used for SystemTap tapsets and desktop file %global icedteaver 6.0.0pre00-c848b93a8598 # Define current Git revision for the FIPS support patches +%global fipsver 9203d50836c # Define JDK versions %global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver} %global javaver %{featurever} @@ -417,7 +461,7 @@ %global top_level_dir_name %{vcstag} %global top_level_dir_name_backup %{top_level_dir_name}-backup %global buildver 8 -%global rpmrelease 1 +%global rpmrelease 2 #%%global tagsuffix %%{nil} # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit %if %is_system_jdk @@ -469,11 +513,16 @@ %define uniquesuffix() %{expand:%{fullversion}.%{_arch}%{?1}} # portable only declarations %global jreimage jre -%define jreportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable%{1}.jre;g" | sed "s;openjdkportable;el;g") -%define jdkportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable%{1}.jdk;g" | sed "s;openjdkportable;el;g") -%define jdkportablesourcesnameimpl() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable%{1}.sources;g" | sed "s;openjdkportable;el;g" | sed "s;.%{_arch};.noarch;g") -%define staticlibsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable%{1}.static-libs;g" | sed "s;openjdkportable;el;g") -%define jmodsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable%{1}.jmods;g" | sed "s;openjdkportable;el;g") +%if ((0%{?fedora} > 0) || (0%{?epel} > 0)) +%define regexBase %{version}-%{release} +%else +%define regexBase el%{rhel}\\(_[0-9]\\)* +%endif +%define jreportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.jre;g" | sed "s;openjdkportable;el;g") +%define jdkportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.jdk;g" | sed "s;openjdkportable;el;g") +%define jdkportablesourcesnameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.sources;g" | sed "s;openjdkportable;el;g" | sed "s;.%{_arch};.noarch;g") +%define staticlibsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.static-libs;g" | sed "s;openjdkportable;el;g") +%define jmodsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.jmods;g" | sed "s;openjdkportable;el;g") %define jreportablearchive() %{expand:%{jreportablenameimpl -- %%{1}}.tar.xz} %define jdkportablearchive() %{expand:%{jdkportablenameimpl -- %%{1}}.tar.xz} %define jdkportablesourcesarchive() %{expand:%{jdkportablesourcesnameimpl -- %%{1}}.tar.xz} @@ -485,9 +534,9 @@ # Intentionally use jdkportablenameimpl here since we want to have static-libs files overlayed on # top of the JDK archive %define staticlibsportablename() %{expand:%{jdkportablenameimpl -- %%{1}}} -%define docportablename() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable.docs;g" | sed "s;openjdkportable;el;g") +%define docportablename() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable.docs;g" | sed "s;openjdkportable;el;g") %define docportablearchive() %{docportablename}.tar.xz -%define miscportablename() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable.misc;g" | sed "s;openjdkportable;el;g") +%define miscportablename() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable.misc;g" | sed "s;openjdkportable;el;g") %define miscportablearchive() %{miscportablename}.tar.xz # RPM 4.19 no longer accept our double percentaged %%{nil} passed to %%{1} @@ -498,6 +547,29 @@ %define staticlibsportablearchiveForFiles() %(echo %{staticlibsportablearchive -- ""}) %define jmodsportablearchiveForFiles() %(echo %{jmodsportablearchive -- ""}) +# JDK to use for bootstrapping +%ifarch %{fastdebug_arches} +%global bootdebugpkg fastdebug +%endif +%if %{use_portable_bootjdk} +%global bootjdkpkg_name java-%{featurever}-%{origin} +%global bootjdkpkg %{bootjdkpkg_name}-portable-devel%{?bootdebugpkg:-%{bootdebugpkg}} >= %{buildjdkver} +%global bootjdkzip %{_jvmdir}/%{bootjdkpkg_name}-*.portable%{?bootdebugpkg:.%{bootdebugpkg}}.jdk.%{_arch}.tar.xz +%global bootjdk %{_builddir}/%{uniquesuffix -- ""}/%{bootjdkpkg_name}.boot +%else +%global bootjdkpkg_name java-latest-openjdk +%global bootjdkpkg %{bootjdkpkg_name}-devel%{?bootdebugpkg:-%{bootdebugpkg}} +%global bootjdk /usr/lib/jvm/%{bootjdkpkg_name}%{?bootdebugpkg:-%{bootdebugpkg}} +%endif +# Define whether to use the bootstrap JDK directly or with a fresh libjvm.so +# This will only work where the bootstrap JDK is the same major version +# as the JDK being built +%if %{with fresh_libjvm} && %{buildjdkver} == %{featurever} +%global build_hotspot_first 1 +%else +%global build_hotspot_first 0 +%endif + ################################################################# # fix for https://bugzilla.redhat.com/show_bug.cgi?id=1111349 # https://bugzilla.redhat.com/show_bug.cgi?id=1590796#c14 @@ -547,13 +619,6 @@ %global alternatives_requires %{_sbindir}/alternatives %endif -# x86 is no longer supported -%if 0%{?java_arches:1} -ExclusiveArch: %{java_arches} -%else -ExcludeArch: %{ix86} -%endif - # Portables have no repo (requires/provides), but these are awesome for orientation in spec # Also scriptlets are happily missing and files are handled old fashion # not-duplicated requires/provides/obsoletes for normal/debug packages @@ -579,6 +644,15 @@ ExcludeArch: %{ix86} # this expression, when declared as global, filled component with java-x-vendor portable %define component %(echo %{name} | sed "s;-portable%{?pkgos:-%{pkgos}};;g") +# Define the architectures on which we build +# On RHEL, this should be the architectures with a devkit +%if "%{?exclusive_arches}" == "%{nil}" +# x86 is no longer supported +ExcludeArch: %{ix86} +%else +ExclusiveArch: %{exclusive_arches} +%endif + Name: java-latest-%{origin}-portable%{?pkgos:-%{pkgos}} Version: %{newjavaver}.%{buildver} # This package needs `.rolling` as part of Release so as to not conflict on install with @@ -663,7 +737,7 @@ Source18: TestTranslations.java # ############################################ # Crypto policy and FIPS support patches -# Patch is generated from the fips-21u tree at https://github.com/rh-openjdk/jdk/tree/fips-21u +# Patch is generated from the fips-25u tree at https://github.com/rh-openjdk/jdk/tree/fips-25u # as follows: git diff %%{vcstag} src make test > fips-21u-$(git show -s --format=%h HEAD).patch # Diff is limited to src and make subdirectories to exclude .github changes # The following list is generated by: @@ -700,6 +774,7 @@ Source18: TestTranslations.java # test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class # RH1940064: Enable XML Signature provider in FIPS mode # RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized [now part of JDK-8301553 upstream] +# Disabled in latest: Patch1001: fips-%%{featurever}u-%%{fipsver}.patch ############################################# # @@ -735,27 +810,8 @@ BuildRequires: desktop-file-utils BuildRequires: elfutils-devel BuildRequires: file BuildRequires: fontconfig-devel -%if %{is_dtstoolchain} -BuildRequires: %{dtsid}-gcc -BuildRequires: %{dtsid}-gcc-c++ -%endif -%if %{is_dtstoolchain} && "%{?dtsname}" == "gcc-toolset" -# wee need slightly more for gcc-toolset -BuildRequires: %{dtsid}-annobin-annocheck -BuildRequires: %{dtsid}-annobin-plugin-gcc -BuildRequires: %{dtsid}-binutils -BuildRequires: %{dtsid}-gcc-plugin-annobin -%endif -%if ! %{is_dtstoolchain} -# Earlier versions have a bug in tree vectorization on PPC -BuildRequires: gcc >= 4.8.3-8 -BuildRequires: gcc-c++ -%endif +%{dts_brs} BuildRequires: gdb -%if (0%{?rhel} > 0 && 0%{?rhel} < 8) -# rhel7 only, portables only. Rhel8 have gtk3, rpms have runtime recommends of gtk -BuildRequires: gtk2-devel -%endif BuildRequires: libxslt BuildRequires: libX11-devel BuildRequires: libXi-devel @@ -767,7 +823,7 @@ BuildRequires: libXtst-devel # Requirement for setting up nss.fips.cfg BuildRequires: nss-devel # Requirement for system security property test -# N/A for portable. RHEL7 doesn't provide them +# N/A for portable as we don't enable support for them #BuildRequires: crypto-policies BuildRequires: pkgconfig BuildRequires: xorg-x11-proto-devel @@ -775,22 +831,18 @@ BuildRequires: zip # to pack portable tarballs BuildRequires: tar BuildRequires: unzip -%if (0%{?rhel} > 0 && 0%{?rhel} < 8) -BuildRequires: javapackages-tools -BuildRequires: java-%{buildjdkver}-%{origin}%{?pkgos:-%{pkgos}}-devel -%else BuildRequires: javapackages-filesystem -BuildRequires: java-latest-openjdk-devel -%endif +BuildRequires: %{bootjdkpkg} # Zero-assembler build requirement %ifarch %{zero_arches} BuildRequires: libffi-devel %endif # Full documentation build requirements +# pandoc is only available on RHEL/CentOS 8, epels, and fedoras +%if %{pandoc_available} BuildRequires: graphviz BuildRequires: pandoc -# 2023c required as of JDK-8305113 -BuildRequires: tzdata-java >= 2023c +%endif # cacerts build requirement in portable mode BuildRequires: ca-certificates @@ -822,8 +874,6 @@ Provides: bundled(libjpeg) = 6b Provides: bundled(libpng) = 1.6.47 # Version in src/java.base/share/native/libzip/zlib/zlib.h Provides: bundled(zlib) = 1.3.1 -# We link statically against libstdc++ to increase portability -BuildRequires: libstdc++-static %endif # this is always built, also during debug-only build @@ -963,13 +1013,15 @@ The %{origin_nice} %{featurever} full patched sources of portable JDK to build, %prep -echo "Preparing %{oj_vendor_version}" - # Using the echo macro breaks rpmdev-bumpspec, as it parses the first line of stdout :-( +echo "Preparing %{oj_vendor_version}" +echo "System is RHEL=%{?rhel}%{!?rhel:0}, CentOS=%{?centos}%{!?centos:0}, EPEL=%{?epel}%{!?epel:0}, Fedora=%{?fedora}%{!?fedora:0}" +echo "Build JDK version is %{buildjdkver}, bootstrap JDK package is %{bootjdkpkg}" + %if 0%{?_build_cpu:1} echo "CPU: %{_target_cpu}, arch install directory: %{archinstall}, SystemTap install directory: %{_build_cpu}" %else - %{error:Unrecognised architecture %{_build_cpu}} + %{error:Unrecognised architecture %{_target_cpu}} %endif if [ %{include_normal_build} -eq 0 -o %{include_normal_build} -eq 1 ] ; then @@ -996,8 +1048,8 @@ if [ %{include_debug_build} -eq 0 -a %{include_normal_build} -eq 0 -a %{includ fi %if %{with fresh_libjvm} && ! %{build_hotspot_first} -echo "WARNING: The build of a fresh libjvm has been disabled due to a JDK version mismatch" -echo "Build JDK version is %{buildjdkver}, feature JDK version is %{featurever}" +%{warn: The build of a fresh libjvm has been disabled due to a JDK version mismatch} +%{warn: Build JDK version is %{buildjdkver}, feature JDK version is %{featurever}} %endif export XZ_OPT="-T0" @@ -1016,12 +1068,31 @@ sh %{SOURCE12} %{top_level_dir_name} %endif # Patch the JDK +# This syntax is deprecated: +# %%patchN [...] +# and should be replaced with: +# %%patch -PN [...] +# For example: +# %%patch1001 -p1 +# becomes: +# %%patch -P1001 -p1 +# The replacement format suggested by recent (circa Fedora 38) RPM +# deprecation messages: +# %%patch N [...] +# is not backward-compatible with prior (circa RHEL-8) versions of +# rpmbuild. pushd %{top_level_dir_name} # Add crypto policy and FIPS support -# Skipping fips patch whil eit is not ready for jdk22 %%patch -P1001 -p1 -# Patches in need of upstreaming +# Not suitable for latest +#%%patch -P1001 -p1 popd # openjdk +echo "Generating %{alt_java_name} man page" +altjavamanpage=%{top_level_dir_name}/src/java.base/share/man/%{alt_java_name}.md +altjavatext="Hardened java binary recommended for launching untrusted code from the Web e.g. javaws" +sed -r -e 's|([^/.])java([^./])|\1alt-java\2|g' %{top_level_dir_name}/src/java.base/share/man/java.md | \ + sed -e 's|JAVA(|ALT-JAVA(|' | \ + sed -e "s|java - launch a Java application|alt-java - ${altjavatext}|" >> ${altjavamanpage} # The OpenJDK version file includes the current # upstream version information. For some reason, @@ -1040,16 +1111,44 @@ if [ "x${UPSTREAM_EA_DESIGNATOR}" != "x%{ea_designator}" ] ; then echo "WARNING: Designator mismatch"; echo "Spec file is configured for a %{build_type} build with designator '%{ea_designator}'" echo "Upstream version-pre setting is '${UPSTREAM_EA_DESIGNATOR}'"; - #exit 17 + exit 17 fi -# Systemtap is processed in rpms +# Systemtap is processed in rpms on fedoras and epels # Prepare desktop files # Portables do not have desktop integration -%build +# Extract devkit +%if "%{is_dtstoolchain}" == "devkit" + devkittarball=%{_datadir}/%{dtsname}/sdk-%{_target_cpu}-%{_target_os}-gnu*.tar.gz + echo "Extracting devkit ${devkittarball}"; + mkdir devkit; + tar -C devkit --strip-components=1 -xzf ${devkittarball} + DEVKIT_ROOT=$(pwd)/devkit + source ${DEVKIT_ROOT}/devkit.info + echo "Installed ${DEVKIT_NAME} devkit" +%else +%if 0%{?centos} > 0 + echo "No devkit for CentOS %{?centos}" +%else + echo "No devkit for %{_target_cpu} on RHEL %{?rhel}"; +%endif +%endif +%if %{use_portable_bootjdk} + # Extract build JDK + pushd %{_jvmdir} + sha256sum --check %{bootjdkzip}.sha256sum + popd + tar -xJf %{bootjdkzip} + mv java-%{featurever}-openjdk-%{buildjdkver}* %{bootjdk} + # Print release information + echo "Installed boot JDK:" + cat %{bootjdk}/release +%endif + +%build # How many CPU's do we have? export NUM_PROC=%(/usr/bin/getconf _NPROCESSORS_ONLN 2> /dev/null || :) export NUM_PROC=${NUM_PROC:-1} @@ -1057,6 +1156,7 @@ export NUM_PROC=${NUM_PROC:-1} # Honor %%_smp_ncpus_max [ ${NUM_PROC} -gt %{?_smp_ncpus_max} ] && export NUM_PROC=%{?_smp_ncpus_max} %endif +export XZ_OPT="-T0" %ifarch s390x sparc64 alpha %{power64} %{aarch64} riscv64 export ARCH_DATA_MODEL=64 @@ -1080,14 +1180,61 @@ EXTRA_CFLAGS="$EXTRA_CFLAGS -fno-strict-aliasing" EXTRA_CFLAGS="$(echo ${EXTRA_CFLAGS} | sed -e 's|-mstackrealign|-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4|')" EXTRA_CPP_FLAGS="$(echo ${EXTRA_CPP_FLAGS} | sed -e 's|-mstackrealign|-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4|')" %endif +%if "%{is_dtstoolchain}" == "devkit" +# Remove annobin plugin reference which isn't available in the devkit +EXTRA_CFLAGS="$(echo ${EXTRA_CFLAGS} | sed -e 's|-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1||')" +EXTRA_CPP_FLAGS="$(echo ${EXTRA_CPP_FLAGS} | sed -e 's|-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1||')" +# Force DWARF 4 for compatibility +EXTRA_CFLAGS="${EXTRA_CFLAGS} -gdwarf-4" +EXTRA_CPP_FLAGS="${EXTRA_CPP_FLAGS} -gdwarf-4" +%endif + export EXTRA_CFLAGS EXTRA_CPP_FLAGS -echo "Building %{SOURCE11}" -mkdir %{miscinstalloutputdir} -mkdir %{altjavaoutputdir} -gcc ${EXTRA_CFLAGS} -o %{altjavaoutputdir}/%{alt_java_name} %{SOURCE11} - -echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}" +# Set modification times (mtimes) of files within JAR files generated +# by the OpenJDK build to a timestamp that is constant across RPM +# rebuilds. OpenJDK provides the --with-source-date configure option +# for this purpose. Potential arguments in the RPM build context are: +# +# A) --with-source-date="${SOURCE_DATE_EPOCH}" +# B) --with-source-date=version +# C) --with-source-date="${OPENJDK_UPSTREAM_TAG_EPOCH}" +# +# Consider Option A. Fedora 38 (rpm-4.18.2) and RHEL-8 (rpm-4.14.3) +# have different support for SOURCE_DATE_EPOCH. To keep +# SOURCE_DATE_EPOCH constant across RPM rebuilds, one could set the +# source_date_epoch_from_changelog macro to 1 on both Fedora 38 and +# RHEL-8. However, on RHEL-8, this results in the RPM build times +# being set to the timestamp of the most recent changelog. This is +# bad for tracing when RPMs were actually built. Fedora 38 supports a +# better behaviour via the introduction of the +# use_source_date_epoch_as_buildtime macro, set to 0 by default. +# There is no way to make this work on RHEL-8 as well though, so +# option A is suboptimal. +# +# Option B uses the value of the DEFAULT_VERSION_DATE field from +# make/conf/version-numbers.conf. DEFAULT_VERSION_DATE represents the +# aspirational eventual JDK general availability (GA) release date. +# When the RPM build occurs prior to GA, generated JAR files will have +# payload mtimes in the future relative to the RPM build time. +# Whereas for tarballs some tools will issue warnings about future +# mtimes, per OPENJDK-2583 apparently this is no problem for Java and +# JAR files. +# +# Option C uses the modification timestamp of files in the source +# tarball. The reproducibility logic in generate_source_tarball.sh +# sets them all to the commit time of the release-tagged OpenJDK +# commit, as archived in the tarball. This timestamp is deterministic +# across RPM rebuilds and is reliably in the past. Any file's mtime +# will do, so use version-numbers.conf's. +# +# Use option B for JAR files, based on the discussion in OPENJDK-2583. +# +# For portable tarballs, use option C (OPENJDK_UPSTREAM_TAG_EPOCH) for +# the modification times of all files in the portable tarballs. Doing +# so eliminates one source of variability across RPM rebuilds. +VERSION_FILE="$(pwd)"/"%{top_level_dir_name}"/make/conf/version-numbers.conf +OPENJDK_UPSTREAM_TAG_EPOCH="$(stat --format=%Y "${VERSION_FILE}")" function buildjdk() { local outputdir=${1} @@ -1096,6 +1243,7 @@ function buildjdk() { local debuglevel=${4} local link_opt=${5} local debug_symbols=${6} + local devkit=${7} local top_dir_abs_src_path=$(pwd)/%{top_level_dir_name} local top_dir_abs_build_path=$(pwd)/${outputdir} @@ -1117,6 +1265,20 @@ function buildjdk() { echo "Using debug_symbols: ${debug_symbols}" echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}" +%if "%{is_dtstoolchain}" == "devkit" + LIBPATH="${devkit}/lib:${devkit}/lib64" + echo "Setting library path to ${LIBPATH}" +%else +%if "%{is_dtstoolchain}" == "toolset" + toolset=/opt/rh/%{dtsname}/root/ + LIBPATH="${toolset}/lib:${toolset}/lib64" + echo "Setting library path to ${LIBPATH}" +%else + LIBPATH=${LD_LIBRARY_PATH} + echo "Keeping library path as ${LIBPATH}" +%endif +%endif + mkdir -p ${outputdir} pushd ${outputdir} @@ -1124,16 +1286,17 @@ function buildjdk() { # rather than ${link_opt} as the system versions # are always used in a system_libs build, even # for the static library build -%if %{is_dtstoolchain} - scl enable %{dtsid} -- bash ${top_dir_abs_src_path}/configure \ -%else - bash ${top_dir_abs_src_path}/configure \ -%endif + LD_LIBRARY_PATH=${LIBPATH} \ + %{?dts_command} bash ${top_dir_abs_src_path}/configure \ %ifarch %{zero_arches} --with-jvm-variants=zero \ %endif -%ifarch %{ppc64le} - --with-jobs=1 \ +%if "%{is_dtstoolchain}" == "devkit" + --with-devkit=${devkit} \ +%endif +%if "%{is_dtstoolchain}" == "toolset" + --with-extra-path="/opt/rh/%{dtsname}/root/bin:/opt/rh/%{dtsname}/root/usr/bin" \ + --with-toolchain-path="/opt/rh/%{dtsname}/root/bin:/opt/rh/%{dtsname}/root/usr/bin" \ %endif --with-version-build=%{buildver} \ --with-version-pre="%{ea_designator}" \ @@ -1162,7 +1325,7 @@ function buildjdk() { --with-extra-cflags="$EXTRA_CFLAGS" \ --with-extra-ldflags="%{ourldflags}" \ --with-num-cores="$NUM_PROC" \ - --with-source-date="${SOURCE_DATE_EPOCH}" \ + --with-source-date="version" \ --disable-javac-server \ %ifarch %{zgc_arches} --with-jvm-features=zgc \ @@ -1171,15 +1334,11 @@ function buildjdk() { || ( pwd; cat $(find | grep config.log) && false ) cat spec.gmk -%if %{is_dtstoolchain} - scl enable %{dtsid} -- make \ -%else - make \ -%endif - LOG=trace \ + LD_LIBRARY_PATH=${LIBPATH} \ + %{?dts_command} make LOG=trace \ WARNINGS_ARE_ERRORS="-Wno-error" \ - CFLAGS_WARNINGS_ARE_ERRORS="-Wno-error" \ - $maketargets || ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name "hs_err_pid*.log" | xargs cat && false ) + CFLAGS_WARNINGS_ARE_ERRORS="-Wno-error" $maketargets ||\ + ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name \"hs_err_pid*.log\" | xargs cat && false ) popd } @@ -1206,6 +1365,7 @@ function installjdk() { # legacy-jre-image target does not install any man pages for the JRE # We copy the jdk man directory and then remove pages for binaries that # don't exist in the JRE +%if %{pandoc_available} cp -a ${jdkimagepath}/man ${jreimagepath} for manpage in $(find ${jreimagepath}/man -name '*.1'); do filename=$(basename ${manpage}); @@ -1215,6 +1375,7 @@ function installjdk() { rm -f ${manpage}; fi; done +%endif for imagepath in ${jdkimagepath} ${jreimagepath}; do @@ -1232,13 +1393,6 @@ function installjdk() { # Install local files which are distributed with the JDK install -m 644 %{SOURCE10} ${imagepath} - # Create fake alt-java as a placeholder for future alt-java - pushd ${imagepath} - # add alt-java man page - echo "Hardened java binary recommended for launching untrusted code from the Web e.g. javaws" > man/man1/%{alt_java_name}.1 - cat man/man1/java.1 >> man/man1/%{alt_java_name}.1 - popd - # Print release information cat ${imagepath}/release fi @@ -1260,7 +1414,7 @@ function genchecksum() { function packFullPatchedSources() { srcpackagesdir=`pwd` - tar -cJf ${srcpackagesdir}/%{jdkportablesourcesarchive -- ""} --transform "s|^|%{jdkportablesourcesname -- ""}/|" %{top_level_dir_name} + createtar ${srcpackagesdir}/%{jdkportablesourcesarchive -- ""} --transform "s|^|%{jdkportablesourcesname -- ""}/|" %{top_level_dir_name} genchecksum ${srcpackagesdir}/%{jdkportablesourcesarchive -- ""} } @@ -1286,6 +1440,13 @@ function findgeneratedsources() { popd } +# Create a reproducible tarball in an appropriate way for +# the version of tar in use +function createtar() { + #FIXME, not finished + tar -cJf "$@" +} + function packagejdk() { local imagesdir=$(pwd)/${1}/images local docdir=$(pwd)/${1}/images/docs @@ -1329,13 +1490,13 @@ function packagejdk() { # Release images have external debug symbols if [ "x$suffix" = "x" ] ; then - tar -cJf ${debugarchive} $(find ${jdkname} -name \*.debuginfo) + createtar ${debugarchive} $(find ${jdkname} -name \*.debuginfo) genchecksum ${debugarchive} mkdir ${docname} mv ${docdir} ${docname} mv ${bundledir}/${built_doc_archive} ${docname} - tar -cJf ${docarchive} ${docname} + createtar ${docarchive} ${docname} genchecksum ${docarchive} mkdir ${miscname} @@ -1347,25 +1508,25 @@ function packagejdk() { %endif cp -av ${altjavadir}/%{alt_java_name} ${miscname} cp -avr ${gensources} ${miscname} - tar -cJf ${miscarchive} ${miscname} + createtar ${miscarchive} ${miscname} genchecksum ${miscarchive} fi - tar -cJf ${jmodsarchive} --exclude='**.debuginfo' ${jdkname}/jmods + createtar ${jmodsarchive} --exclude='**.debuginfo' ${jdkname}/jmods genchecksum ${jmodsarchive} rm -rv ${jdkname}/jmods - tar -cJf ${jdkarchive} --exclude='**.debuginfo' ${jdkname} + createtar ${jdkarchive} --exclude='**.debuginfo' ${jdkname} genchecksum ${jdkarchive} - tar -cJf ${jrearchive} --exclude='**.debuginfo' ${jrename} + createtar ${jrearchive} --exclude='**.debuginfo' ${jrename} genchecksum ${jrearchive} %if %{include_staticlibs} # Static libraries (needed for building graal vm with native image) # Tar as overlay. Transform to the JDK name, since we just want to "add" # static libraries to that folder - tar -cJf ${staticarchive} \ + createtar ${staticarchive} \ --transform "s|^%{static_libs_image}/lib/*|${staticname}/lib/static/linux-%{archinstall}/glibc/|" "%{static_libs_image}/lib" genchecksum ${staticarchive} %endif @@ -1381,12 +1542,34 @@ function packagejdk() { packFullPatchedSources +%if "%{is_dtstoolchain}" == "devkit" + DEVKIT_ROOT=$(pwd)/devkit + source ${DEVKIT_ROOT}/devkit.info + GCC="${DEVKIT_TOOLCHAIN_PATH}/gcc --sysroot=${DEVKIT_SYSROOT}" + LIBPATH="${DEVKIT_ROOT}/lib:${DEVKIT_ROOT}/lib64" +%else +%if "%{is_dtstoolchain}" == "toolset" + toolset=/opt/rh/%{dtsname}/root/ + GCC="${toolset}/usr/bin/gcc" + LIBPATH="${toolset}/lib:${toolset}/lib64" +%else + GCC=$(which gcc) +%endif +%endif + +echo "Building %{SOURCE11}" +mkdir %{miscinstalloutputdir} +mkdir %{altjavaoutputdir} +LD_LIBRARY_PATH="${LIBPATH}" ${GCC} ${EXTRA_CFLAGS} -o %{altjavaoutputdir}/%{alt_java_name} %{SOURCE11} + +echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}" + %if %{build_hotspot_first} # Build a fresh libjvm.so first and use it to bootstrap echo "Building HotSpot only for the latest libjvm.so" cp -LR --preserve=mode,timestamps %{bootjdk} newboot systemjdk=$(pwd)/newboot - buildjdk build/newboot ${systemjdk} %{hotspot_target} "release" "bundled" "internal" + buildjdk build/newboot ${systemjdk} %{hotspot_target} "release" "bundled" "internal" ${DEVKIT_ROOT} mv build/newboot/jdk/lib/%{vm_variant}/libjvm.so newboot/lib/%{vm_variant} %else systemjdk=%{bootjdk} @@ -1432,14 +1615,14 @@ for suffix in %{build_loop} ; do run_bootstrap=%{bootstrap_build} fi if ${run_bootstrap} ; then - buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild} ${link_opt} ${debug_symbols} + buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild} ${link_opt} ${debug_symbols} ${DEVKIT_ROOT} installjdk ${bootbuilddir} ${bootinstalldir} - buildjdk ${builddir} $(pwd)/${bootinstalldir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} + buildjdk ${builddir} $(pwd)/${bootinstalldir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} ${DEVKIT_ROOT} findgeneratedsources ${installdir} ${builddir} $(pwd)/%{top_level_dir_name} installjdk ${builddir} ${installdir} %{!?with_artifacts:rm -rf ${bootinstalldir}} else - buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} + buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} ${DEVKIT_ROOT} findgeneratedsources ${installdir} ${builddir} $(pwd)/%{top_level_dir_name} installjdk ${builddir} ${installdir} fi @@ -1459,7 +1642,7 @@ done # end of release / debug cycle loop # We test debug first as it will give better diagnostics on a crash for suffix in %{build_loop} ; do -# portable builds have static_libs embedded, thus top_dir_abs_main_build_path is same as top_dir_abs_staticlibs_build_path +# portable builds have static_libs embedded, thus top_dir_abs_main_build_path is same as top_dir_abs_staticlibs_build_path top_dir_abs_main_build_path=$(pwd)/%{installoutputdir -- ${suffix}} %if %{include_staticlibs} top_dir_abs_staticlibs_build_path=${top_dir_abs_main_build_path} @@ -1474,51 +1657,91 @@ export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage} #sed -i -e "s:^security.useSystemPropertiesFile=.*:security.useSystemPropertiesFile=true:" \ #${JAVA_HOME}/conf/security/java.security +# Set up tools +%if "%{is_dtstoolchain}" == "devkit" + DEVKIT_ROOT=$(pwd)/devkit + source ${DEVKIT_ROOT}/devkit.info + NM="${DEVKIT_TOOLCHAIN_PATH}/nm" +%else + NM=$(which nm) +%endif +# elfutils readelf supports more binaries than binutils version on RHEL 8 +# and debug symbols tests below were designed around this version +READELF=$(which eu-readelf) +# Only native gdb seems to work +# The devkit gdb needs the devkit stdc++ library but then the JVM +# segfaults when this is on the LD_LIBRARY_PATH +GDB=$(which gdb) + # Check Shenandoah is enabled %if %{use_shenandoah_hotspot} $JAVA_HOME/bin/java -XX:+UseShenandoahGC -version %endif -# Check unlimited policy has been used -$JAVA_HOME/bin/javac -d . %{SOURCE13} -$JAVA_HOME/bin/java --add-opens java.base/javax.crypto=ALL-UNNAMED TestCryptoLevel +# Only test on one architecture (the fastest) for Java only tests +%ifarch %{jdk_test_arch} -# Check ECC is working -$JAVA_HOME/bin/javac -d . %{SOURCE14} -$JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||") + # Check unlimited policy has been used + $JAVA_HOME/bin/javac -d . %{SOURCE13} + $JAVA_HOME/bin/java --add-opens java.base/javax.crypto=ALL-UNNAMED TestCryptoLevel -# Check system crypto (policy) is deactive and can not be enabled -# Test takes a single argument - true or false - to state whether system -# security properties are enabled or not. -$JAVA_HOME/bin/javac -d . %{SOURCE15} -export PROG=$(echo $(basename %{SOURCE15})|sed "s|\.java||") -export SEC_DEBUG="-Djava.security.debug=properties" -# Specific to portable:System security properties to be off by default -$JAVA_HOME/bin/java ${SEC_DEBUG} ${PROG} false -$JAVA_HOME/bin/java ${SEC_DEBUG} -Djava.security.disableSystemPropertiesFile=false ${PROG} false + # Check ECC is working + $JAVA_HOME/bin/javac -d . %{SOURCE14} + $JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||") -# Check correct vendor values have been set -$JAVA_HOME/bin/javac -d . %{SOURCE16} -$JAVA_HOME/bin/java $(echo $(basename %{SOURCE16})|sed "s|\.java||") "%{oj_vendor}" "%{oj_vendor_url}" "%{oj_vendor_bug_url}" "%{oj_vendor_version}" + # Check system crypto (policy) is deactive and can not be enabled + # Test takes a single argument - true or false - to state whether system + # security properties are enabled or not. + $JAVA_HOME/bin/javac -d . %{SOURCE15} + export PROG=$(echo $(basename %{SOURCE15})|sed "s|\.java||") + export SEC_DEBUG="-Djava.security.debug=properties" + # Specific to portable:System security properties to be off by default + $JAVA_HOME/bin/java ${SEC_DEBUG} ${PROG} false + $JAVA_HOME/bin/java ${SEC_DEBUG} -Djava.security.disableSystemPropertiesFile=false ${PROG} false + + # Check correct vendor values have been set + $JAVA_HOME/bin/javac -d . %{SOURCE16} + $JAVA_HOME/bin/java $(echo $(basename %{SOURCE16})|sed "s|\.java||") "%{oj_vendor}" "%{oj_vendor_url}" "%{oj_vendor_bug_url}" "%{oj_vendor_version}" + +%if ! 0%{?flatpak} + # Check translations are available for new timezones (during flatpak builds, the + # tzdb.dat used by this test is not where the test expects it, so this is + # disabled for flatpak builds) + # Disable test until we are on the latest JDK + $JAVA_HOME/bin/javac -d . %{SOURCE18} + $JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE || echo "Fedora is often ahead in timezones, ignoring" + $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR || echo "Fedora is often ahead in timezones, ignoring" +%endif + + # Check src.zip has all sources. See RHBZ#1130490 + unzip -l $JAVA_HOME/lib/src.zip | grep 'sun.misc.Unsafe' + + # Check class files include useful debugging information + $JAVA_HOME/bin/javap -c -l java.lang.Object | grep "Compiled from" + $JAVA_HOME/bin/javap -c -l java.lang.Object | grep LineNumberTable + $JAVA_HOME/bin/javap -c -l java.lang.Object | grep LocalVariableTable + + # Check generated class files include useful debugging information + $JAVA_HOME/bin/javap -c -l java.nio.ByteBuffer | grep "Compiled from" + $JAVA_HOME/bin/javap -c -l java.nio.ByteBuffer | grep LineNumberTable + $JAVA_HOME/bin/javap -c -l java.nio.ByteBuffer | grep LocalVariableTable + +%else + + # Just run a basic java -version test on other architectures + $JAVA_HOME/bin/java -version + +%endif # Check java launcher has no SSB mitigation -if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi +if ! ${NM} $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi # Check alt-java launcher has SSB mitigation on supported architectures # set_speculation function exists in both cases, so check for prctl call %ifarch %{ssbd_arches} -nm %{altjavaoutputdir}/%{alt_java_name} | grep prctl +${NM} %{altjavaoutputdir}/%{alt_java_name} | grep prctl %else -if ! nm %{altjavaoutputdir}/%{alt_java_name} | grep prctl ; then true ; else false; fi -%endif - -%if ! 0%{?flatpak} -# Check translations are available for new timezones (during flatpak builds, the -# tzdb.dat used by this test is not where the test expects it, so this is -# disabled for flatpak builds) -$JAVA_HOME/bin/javac -d . %{SOURCE18} -$JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE || echo "FIXME before release!" -$JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR || echo "FIXME before release!" +if ! ${NM} %{altjavaoutputdir}/%{alt_java_name} | grep prctl ; then true ; else false; fi %endif %if %{include_staticlibs} @@ -1526,8 +1749,8 @@ $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})| export STATIC_LIBS_HOME=${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image} ls -l $STATIC_LIBS_HOME ls -l $STATIC_LIBS_HOME/lib -readelf --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet4AddressImpl.c -readelf --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet6AddressImpl.c +${READELF} --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet4AddressImpl.c +${READELF} --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet6AddressImpl.c %endif # Release builds strip the debug symbols into external .debuginfo files @@ -1546,15 +1769,15 @@ do # Test for .debug_* sections in the shared object. This is the main test # Stripped objects will not contain these - eu-readelf -S "$lib" | grep "] .debug_" - test $(eu-readelf -S "$lib" | grep -E "\]\ .debug_(info|abbrev)" | wc --lines) == 2 + ${READELF} -S "$lib" | grep "] .debug_" + test $(${READELF} -S "$lib" | grep -E "\]\ .debug_(info|abbrev)" | wc --lines) == 2 # Test FILE symbols. These will most likely be removed by anything that # manipulates symbol tables because it's generally useless. So a nice test # that nothing has messed with symbols old_IFS="$IFS" IFS=$'\n' - for line in $(eu-readelf -s "$lib" | grep "00000000 0 FILE LOCAL DEFAULT") + for line in $(${READELF} -s "$lib" | grep "00000000 0 FILE LOCAL DEFAULT") do # We expect to see .cpp and .S files, except for architectures like aarch64 and # s390 where we expect .o and .oS files @@ -1564,17 +1787,17 @@ do # If this is the JVM, look for javaCalls.(cpp|o) in FILEs, for extra sanity checking if [ "`basename $lib`" = "libjvm.so" ]; then - eu-readelf -s "$lib" | \ + ${READELF} -s "$lib" | \ grep -E "00000000 0 FILE LOCAL DEFAULT ABS javaCalls.(cpp|o)$" fi # Test that there are no .gnu_debuglink sections pointing to another # debuginfo file. There shouldn't be any debuginfo files, so the link makes # no sense either - eu-readelf -S "$lib" | grep 'gnu' - if eu-readelf -S "$lib" | grep '] .gnu_debuglink' | grep PROGBITS; then + ${READELF} -S "$lib" | grep 'gnu' + if ${READELF} -S "$lib" | grep '] .gnu_debuglink' | grep PROGBITS; then echo "bad .gnu_debuglink section." - eu-readelf -x .gnu_debuglink "$lib" + ${READELF} -x .gnu_debuglink "$lib" false fi fi @@ -1586,7 +1809,7 @@ done # Using line number 1 might cause build problems. See: # https://bugzilla.redhat.com/show_bug.cgi?id=1539664 # https://bugzilla.redhat.com/show_bug.cgi?id=1538767 -gdb -q "$JAVA_HOME/bin/java" < +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see . + +if [ $# -ne 1 ]; then + echo "Usage: $0 openjdk-root-directory" + exit 1 +fi + +JDKROOT=$1 + +if [ ! -d "${JDKROOT}" ] ; then + echo "${JDKROOT} is not a directory."; + exit 2 +fi + +# Work out the OpenJDK version +# OpenJDK >= 10 has its version in the build machinery +# OpenJDK >= 17 stores it in a new location (JDK-8258246) +VERSION_FILE="${JDKROOT}"/make/conf/version-numbers.conf +printf "Checking for %s..." "${VERSION_FILE}"; +if [ ! -f "${VERSION_FILE}" ] ; then + VERSION_FILE="${JDKROOT}"/make/autoconf/version-numbers + echo "Not found; using old version file ${VERSION_FILE}"; +else + echo "found."; +fi +if [ -e "${VERSION_FILE}" ] ; then + openjdk_version=$(grep '^DEFAULT_VERSION_FEATURE' "${VERSION_FILE}" | cut -d '=' -f 2) +elif [ -e "${JDKROOT}"/jdk/src/java.base/share/classes/java/lang/Object.java ] ; then + openjdk_version=9; +elif [ -e "${JDKROOT}"/common/autoconf ] ; then + openjdk_version=8; +else + openjdk_version=7; +fi +echo "OpenJDK version: ${openjdk_version}"; + +# +# Freetype +# +if [ "${openjdk_version}" -gt 8 ] ; then + FREETYPE=src/java.desktop/share/native/libfreetype/include/freetype/freetype.h + ABS_FREETYPE="${JDKROOT}"/"${FREETYPE}" + if [ ! -f "${ABS_FREETYPE}" ]; then + echo "Freetype header not found!" + exit 2 + fi + FREETYPE_VERSION=$(awk '/#define FREETYPE_MAJOR/ {MAJOR=$3} /#define FREETYPE_MINOR/ {MINOR=$3} /#define FREETYPE_PATCH/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_FREETYPE}") +else + echo "No bundled FreeType on ${openjdk_version}"; +fi + +# giflib +if [ "${openjdk_version}" -gt 8 ] ; then + GIFLIB=src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h +else + GIFLIB=jdk/src/share/native/sun/awt/giflib/gif_lib.h +fi +ABS_GIFLIB="${JDKROOT}"/"${GIFLIB}" +if [ ! -f "${ABS_GIFLIB}" ]; then + echo "giflib header not found!" + exit 3 +fi +GIFLIB_VERSION=$(awk '/#define GIFLIB_MAJOR/ {MAJOR=$3} /#define GIFLIB_MINOR/ {MINOR=$3} /#define GIFLIB_RELEASE/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_GIFLIB}") + +# harfbuzz +if [ "${openjdk_version}" -gt 8 ] ; then + HARFBUZZ=src/java.desktop/share/native/libharfbuzz/hb-version.h + ABS_HARFBUZZ="${JDKROOT}/${HARFBUZZ}" + if [ ! -f "${ABS_HARFBUZZ}" ]; then + echo "HarfBuzz header not found!" + exit 4 + fi + HARFBUZZ_VERSION=$(awk '/#define HB_VERSION_MAJOR/ {MAJOR=$3} /#define HB_VERSION_MINOR/ {MINOR=$3} /#define HB_VERSION_MICRO/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_HARFBUZZ}") +else + echo "No HarfBuzz on ${openjdk_version}"; +fi + +# lcms +if [ "${openjdk_version}" -gt 8 ] ; then + LCMS=src/java.desktop/share/native/liblcms/lcms2.h +else + LCMS=jdk/src/share/native/sun/java2d/cmm/lcms/lcms2.h +fi +ABS_LCMS="${JDKROOT}"/"${LCMS}" +if [ ! -f "${ABS_LCMS}" ]; then + echo "lcms header not found!" + exit 5 +fi +LCMS_VERSION=$(awk '/#define LCMS_VERSION/ { MAJOR=int($3 / 1000); REST=$3 % 1000; MINOR=int(REST / 10); PATCH=REST % 10; } END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_LCMS}") + +# jpeg +if [ "${openjdk_version}" -gt 8 ] ; then + JPEG=src/java.desktop/share/native/libjavajpeg/jpeglib.h +else + JPEG=jdk/src/share/native/sun/awt/image/jpeg/jpeglib.h +fi +ABS_JPEG="${JDKROOT}"/"${JPEG}" +if [ ! -f "${ABS_JPEG}" ]; then + echo "jpeg header not found!" + exit 6 +fi +JPEG_VERSION=$(awk '/#define JPEG_LIB_VERSION/ { VERSION=$3; MAJOR=int(VERSION / 10); MINOR=VERSION%10; } END {printf "%s%c", MAJOR, (MINOR+96)}' "${ABS_JPEG}") + +# png +if [ "${openjdk_version}" -gt 8 ] ; then + PNG=src/java.desktop/share/native/libsplashscreen/libpng/png.h +else + PNG=jdk/src/share/native/sun/awt/libpng/png.h +fi +ABS_PNG="${JDKROOT}"/"${PNG}" +if [ ! -f "${ABS_PNG}" ]; then + echo "png header not found!" + exit 7 +fi +PNG_VERSION=$(awk '/#define PNG_LIBPNG_VER_STRING/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_PNG}") + +# zlib +if [ "${openjdk_version}" -gt 8 ] ; then + ZLIB=src/java.base/share/native/libzip/zlib/zlib.h +else + ZLIB=jdk/src/share/native/java/util/zip/zlib/zlib.h +fi +ABS_ZLIB="${JDKROOT}"/"${ZLIB}" +if [ ! -f "${ABS_ZLIB}" ]; then + echo "zlib header not found!" + exit 8 +fi +ZLIB_VERSION=$(awk '/#define ZLIB_VERSION/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_ZLIB}") + +# Print output +printf "\nRPM definitions:\n" +if [ "${openjdk_version}" -gt 8 ] ; then + echo "# Version in ${FREETYPE}" + echo "Provides: bundled(freetype) = ${FREETYPE_VERSION}" +fi +echo "# Version in ${GIFLIB}" +echo "Provides: bundled(giflib) = ${GIFLIB_VERSION}" +if [ "${openjdk_version}" -gt 8 ] ; then + echo "# Version in ${HARFBUZZ}" + echo "Provides: bundled(harfbuzz) = ${HARFBUZZ_VERSION}" +fi +echo "# Version in ${LCMS}" +echo "Provides: bundled(lcms2) = ${LCMS_VERSION}" +echo "# Version in ${JPEG}" +echo "Provides: bundled(libjpeg) = ${JPEG_VERSION}" +echo "# Version in ${PNG}" +echo "Provides: bundled(libpng) = ${PNG_VERSION}" +echo "# Version in ${ZLIB}" +echo "Provides: bundled(zlib) = ${ZLIB_VERSION}" + +# Local Variables: +# compile-command: "shellcheck get_bundle_versions.sh" +# fill-column: 80 +# indent-tabs-mode: nil +# sh-basic-offset: 4 +# End: From d0dccee5d01eef9347d63e8d66f7d83509c83a7f Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Fri, 12 Dec 2025 14:29:57 +0100 Subject: [PATCH 4/6] Switch from static-libs-image to static-libs-graal-image to avoid large unneeded libjvm.a --- java-latest-openjdk-portable.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index 7b48c3d..ad21f2c 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -228,7 +228,7 @@ # other targets since this target is configured to use in-tree # AWT dependencies: lcms, libjpeg, libpng, libharfbuzz, giflib # and possibly others -%global static_libs_target static-libs-image +%global static_libs_target static-libs-graal-image %else %global static_libs_target %{nil} %endif @@ -500,7 +500,7 @@ exit 1 %global fullversion %{compatiblename}-%{version}-%{release} # images directories from upstream build %global jdkimage jdk -%global static_libs_image static-libs +%global static_libs_image static-libs-graal # output dir stub %define buildoutputdir() %{expand:build/jdk%{featurever}.build%{?1}} %define installoutputdir() %{expand:install/jdk%{featurever}.install%{?1}} From 573c2c7a36a8c78dc44fddfb7b83b32bdad3fce9 Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Fri, 12 Dec 2025 15:47:22 +0100 Subject: [PATCH 5/6] fipsver df044414ef4 --- fips-25u-df044414ef4.patch | 92 +++++++++++++++++++++++++++++++ java-latest-openjdk-portable.spec | 13 +++-- 2 files changed, 99 insertions(+), 6 deletions(-) create mode 100644 fips-25u-df044414ef4.patch diff --git a/fips-25u-df044414ef4.patch b/fips-25u-df044414ef4.patch new file mode 100644 index 0000000..8b210e6 --- /dev/null +++ b/fips-25u-df044414ef4.patch @@ -0,0 +1,92 @@ +diff --git a/src/java.base/share/classes/java/security/Provider.java b/src/java.base/share/classes/java/security/Provider.java +index de2845fb550..b1e416b90f4 100644 +--- a/src/java.base/share/classes/java/security/Provider.java ++++ b/src/java.base/share/classes/java/security/Provider.java +@@ -1203,6 +1203,39 @@ public Set getServices() { + return serviceSet; + } + ++ /* vvvvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvvvv */ ++ private static final class RedHatFIPSFilter { ++ static final boolean IS_ON = Boolean.parseBoolean( ++ Security.getProperty("__redhat_fips_filter__")); ++ private static final Set ANY_SERVICE_TYPE = Set.of(); ++ private static final Map> ALLOW_LIST = Map.of( ++ "SunPKCS11-FIPS", ANY_SERVICE_TYPE, ++ "SUN", Set.of( ++ "AlgorithmParameterGenerator", ++ "AlgorithmParameters", "CertificateFactory", ++ "CertPathBuilder", "CertPathValidator", "CertStore", ++ "Configuration", "KeyStore"), ++ "SunEC", Set.of( ++ "AlgorithmParameters", "KeyFactory"), ++ "SunJSSE", ANY_SERVICE_TYPE, ++ "SunJCE", Set.of( ++ "AlgorithmParameters", ++ "AlgorithmParameterGenerator", "KeyFactory", ++ "SecretKeyFactory"), ++ "SunRsaSign", Set.of( ++ "KeyFactory", "AlgorithmParameters"), ++ "XMLDSig", ANY_SERVICE_TYPE ++ ); ++ ++ static boolean isAllowed(String provName, String serviceType) { ++ Set allowedServiceTypes = ALLOW_LIST.get(provName); ++ return allowedServiceTypes != null && ++ (allowedServiceTypes == ANY_SERVICE_TYPE || ++ allowedServiceTypes.contains(serviceType)); ++ } ++ } ++ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ */ ++ + /** + * Add a service. If a service of the same type with the same algorithm + * name exists, and it was added using {@link #putService putService()}, +@@ -1231,6 +1264,15 @@ protected void putService(Service s) { + ("service.getProvider() must match this Provider object"); + } + String type = s.getType(); ++ /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */ ++ if (RedHatFIPSFilter.IS_ON && !RedHatFIPSFilter.isAllowed(name, type)) { ++ if (debug != null) { ++ debug.println("The previous " + name + ".putService() call " + ++ "was skipped by " + RedHatFIPSFilter.class.getName()); ++ } ++ return; ++ } ++ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */ + String algorithm = s.getAlgorithm(); + ServiceKey key = new ServiceKey(type, algorithm, true); + implRemoveService(serviceMap.get(key)); +diff --git a/src/java.base/share/classes/java/security/Security.java b/src/java.base/share/classes/java/security/Security.java +index 6969fe8a8e1..4501d5971c4 100644 +--- a/src/java.base/share/classes/java/security/Security.java ++++ b/src/java.base/share/classes/java/security/Security.java +@@ -323,7 +323,27 @@ public Properties getInitialProperties() { + } + + private static void initialize() { ++ /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */ ++ /* This 'include'-directives-only magic property is an internal */ ++ /* implementation detail that could (and probably will!) change. */ ++ /* Red Hat customers should NOT rely on this for their own use. */ ++ String fipsKernelFlag = "/proc/sys/crypto/fips_enabled"; ++ boolean fipsModeOn; ++ try (InputStream is = new java.io.FileInputStream(fipsKernelFlag)) { ++ fipsModeOn = is.read() == '1'; ++ } catch (IOException ioe) { ++ fipsModeOn = false; ++ if (sdebug != null) { ++ sdebug.println("Failed to read FIPS kernel file: " + ioe); ++ } ++ } ++ String fipsMagicPropName = "__redhat_fips__"; ++ System.setProperty(fipsMagicPropName, "" + fipsModeOn); ++ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */ + SecPropLoader.loadAll(); ++ /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */ ++ System.clearProperty(fipsMagicPropName); ++ /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */ + initialSecurityProperties = (Properties) props.clone(); + if (sdebug != null) { + for (String key : props.stringPropertyNames()) { diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index ad21f2c..287c7fe 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -446,7 +446,7 @@ exit 1 # Define IcedTea version used for SystemTap tapsets and desktop file %global icedteaver 6.0.0pre00-c848b93a8598 # Define current Git revision for the FIPS support patches -%global fipsver 9203d50836c +%global fipsver df044414ef4 # Define JDK versions %global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver} %global javaver %{featurever} @@ -461,7 +461,7 @@ exit 1 %global top_level_dir_name %{vcstag} %global top_level_dir_name_backup %{top_level_dir_name}-backup %global buildver 8 -%global rpmrelease 2 +%global rpmrelease 3 #%%global tagsuffix %%{nil} # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit %if %is_system_jdk @@ -738,7 +738,7 @@ Source18: TestTranslations.java ############################################ # Crypto policy and FIPS support patches # Patch is generated from the fips-25u tree at https://github.com/rh-openjdk/jdk/tree/fips-25u -# as follows: git diff %%{vcstag} src make test > fips-21u-$(git show -s --format=%h HEAD).patch +# as follows: git diff %%{vcstag} src make test > fips-25u-$(git show -s --format=%h HEAD).patch # Diff is limited to src and make subdirectories to exclude .github changes # The following list is generated by: # git log %%{vcstag}.. --no-merges --format=%s --reverse: @@ -774,7 +774,8 @@ Source18: TestTranslations.java # test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class # RH1940064: Enable XML Signature provider in FIPS mode # RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized [now part of JDK-8301553 upstream] -# Disabled in latest: Patch1001: fips-%%{featurever}u-%%{fipsver}.patch +# usage in jdk >25 is experimental and may disapear +Patch1001: fips-%{featurever}u-%{fipsver}.patch ############################################# # @@ -1083,8 +1084,8 @@ sh %{SOURCE12} %{top_level_dir_name} # rpmbuild. pushd %{top_level_dir_name} # Add crypto policy and FIPS support -# Not suitable for latest -#%%patch -P1001 -p1 +# usage in jdk >25 is experimental and may disapear +%patch -P1001 -p1 popd # openjdk echo "Generating %{alt_java_name} man page" From 4d483d5093f07dedee7a83edf04a37a58e829009 Mon Sep 17 00:00:00 2001 From: Jiri Vanek Date: Tue, 23 Dec 2025 12:44:54 +0100 Subject: [PATCH 6/6] Updated to jdk26 --- .gitignore | 1 + ...1842_broke_native_debugging_on_Linux.patch | 154 ++++++++++++++++++ java-latest-openjdk-portable.spec | 18 +- sources | 2 +- 4 files changed, 167 insertions(+), 8 deletions(-) create mode 100644 JDK-8373246-8351842_broke_native_debugging_on_Linux.patch diff --git a/.gitignore b/.gitignore index c2a5115..1f1fc8c 100644 --- a/.gitignore +++ b/.gitignore @@ -58,3 +58,4 @@ /openjdk-jdk-25+36.tar.xz /openjdk-25+36.tar.xz /openjdk-25.0.1+8.tar.xz +/openjdk-26+29-ea.tar.xz diff --git a/JDK-8373246-8351842_broke_native_debugging_on_Linux.patch b/JDK-8373246-8351842_broke_native_debugging_on_Linux.patch new file mode 100644 index 0000000..1f6ca4d --- /dev/null +++ b/JDK-8373246-8351842_broke_native_debugging_on_Linux.patch @@ -0,0 +1,154 @@ +diff --git a/make/Bundles.gmk b/make/Bundles.gmk +index 8161b3b036254..0b324e7e3f3fc 100644 +--- a/make/Bundles.gmk ++++ b/make/Bundles.gmk +@@ -185,77 +185,30 @@ endif + + ifneq ($(filter product-bundles% legacy-bundles, $(MAKECMDGOALS)), ) + +- SYMBOLS_EXCLUDE_PATTERN := %.debuginfo %.diz %.map +- +- # There may be files with spaces in the names, so use ShellFindFiles +- # explicitly. ++ # There may be files with spaces in the names, so use ShellFindFiles explicitly. + ALL_JDK_FILES := $(call ShellFindFiles, $(JDK_IMAGE_DIR)) +- ifneq ($(JDK_IMAGE_DIR), $(JDK_SYMBOLS_IMAGE_DIR)) +- ALL_JDK_SYMBOLS_FILES := $(call ShellFindFiles, $(JDK_SYMBOLS_IMAGE_DIR)) +- else +- ALL_JDK_SYMBOLS_FILES := $(ALL_JDK_FILES) +- endif + ifneq ($(JDK_IMAGE_DIR), $(JDK_DEMOS_IMAGE_DIR)) + ALL_JDK_DEMOS_FILES := $(call ShellFindFiles, $(JDK_DEMOS_IMAGE_DIR)) + else + ALL_JDK_DEMOS_FILES := $(ALL_JDK_FILES) + endif + +- # Create special filter rules when dealing with unzipped .dSYM directories on +- # macosx +- ifeq ($(call isTargetOs, macosx), true) +- ifeq ($(ZIP_EXTERNAL_DEBUG_SYMBOLS), false) +- JDK_SYMBOLS_EXCLUDE_PATTERN := $(addprefix %, \ +- $(call containing, .dSYM/, $(patsubst $(JDK_IMAGE_DIR)/%, %, \ +- $(ALL_JDK_SYMBOLS_FILES)))) +- endif +- endif +- +- # Create special filter rules when dealing with debug symbols on windows +- ifeq ($(call isTargetOs, windows), true) +- ifeq ($(SHIP_DEBUG_SYMBOLS), ) +- JDK_SYMBOLS_EXCLUDE_PATTERN := %.pdb +- endif +- endif +- + JDK_BUNDLE_FILES := \ + $(filter-out \ +- $(JDK_SYMBOLS_EXCLUDE_PATTERN) \ + $(JDK_EXTRA_EXCLUDES) \ +- $(SYMBOLS_EXCLUDE_PATTERN) \ + $(JDK_IMAGE_HOMEDIR)/demo/% \ + , \ + $(ALL_JDK_FILES) \ + ) + +- JDK_SYMBOLS_BUNDLE_FILES := \ +- $(call FindFiles, $(SYMBOLS_IMAGE_DIR)) ++ JDK_SYMBOLS_BUNDLE_FILES := $(call FindFiles, $(SYMBOLS_IMAGE_DIR)) + + TEST_DEMOS_BUNDLE_FILES := $(filter $(JDK_DEMOS_IMAGE_HOMEDIR)/demo/%, \ + $(ALL_JDK_DEMOS_FILES)) + + ALL_JRE_FILES := $(call ShellFindFiles, $(JRE_IMAGE_DIR)) + +- # Create special filter rules when dealing with unzipped .dSYM directories on +- # macosx +- ifeq ($(OPENJDK_TARGET_OS), macosx) +- ifeq ($(ZIP_EXTERNAL_DEBUG_SYMBOLS), false) +- JRE_SYMBOLS_EXCLUDE_PATTERN := $(addprefix %, \ +- $(call containing, .dSYM/, $(patsubst $(JRE_IMAGE_DIR)/%, %, $(ALL_JRE_FILES)))) +- endif +- endif +- +- # Create special filter rules when dealing with debug symbols on windows +- ifeq ($(call isTargetOs, windows), true) +- ifeq ($(SHIP_DEBUG_SYMBOLS), ) +- JRE_SYMBOLS_EXCLUDE_PATTERN := %.pdb +- endif +- endif +- +- JRE_BUNDLE_FILES := $(filter-out \ +- $(JRE_SYMBOLS_EXCLUDE_PATTERN) \ +- $(SYMBOLS_EXCLUDE_PATTERN), \ +- $(ALL_JRE_FILES)) ++ JRE_BUNDLE_FILES := $(ALL_JRE_FILES) + + ifeq ($(MACOSX_CODESIGN_MODE), hardened) + # Macosx release build and code signing available. +diff --git a/make/CreateJmods.gmk b/make/CreateJmods.gmk +index 3280b24924a34..32f107b6bb6a0 100644 +--- a/make/CreateJmods.gmk ++++ b/make/CreateJmods.gmk +@@ -218,10 +218,14 @@ ifeq ($(call isTargetOs, windows), true) + ifeq ($(SHIP_DEBUG_SYMBOLS), ) + JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.pdb,*.map}' + else +- JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.map}' ++ JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.map}' + endif + else +- JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.debuginfo,*.dSYM/**,*.dSYM}' ++ ifeq ($(SHIP_DEBUG_SYMBOLS), ) ++ JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.debuginfo,*.dSYM/**,*.dSYM}' ++ else ++ JMOD_FLAGS += --exclude '**{_the.*,_*.marker*}' ++ endif + endif + + # Unless we are creating a very large module, use the small tool JVM options +diff --git a/make/autoconf/jdk-options.m4 b/make/autoconf/jdk-options.m4 +index bb18877800192..87d147d4f074b 100644 +--- a/make/autoconf/jdk-options.m4 ++++ b/make/autoconf/jdk-options.m4 +@@ -316,23 +316,36 @@ AC_DEFUN_ONCE([JDKOPT_SETUP_DEBUG_SYMBOLS], + AC_MSG_CHECKING([if we should add external native debug symbols to the shipped bundles]) + AC_ARG_WITH([external-symbols-in-bundles], + [AS_HELP_STRING([--with-external-symbols-in-bundles], +- [which type of external native debug symbol information shall be shipped in product bundles (none, public, full) +- (e.g. ship full/stripped pdbs on Windows) @<:@none@:>@])]) ++ [which type of external native debug symbol information shall be shipped with bundles/images (none, public, full). ++ @<:@none in release builds, full otherwise. --with-native-debug-symbols=external/zipped is a prerequisite. public is only supported on Windows@:>@])], ++ [], ++ [with_external_symbols_in_bundles=default]) + + if test "x$with_external_symbols_in_bundles" = x || test "x$with_external_symbols_in_bundles" = xnone ; then + AC_MSG_RESULT([no]) + elif test "x$with_external_symbols_in_bundles" = xfull || test "x$with_external_symbols_in_bundles" = xpublic ; then +- if test "x$OPENJDK_TARGET_OS" != xwindows ; then +- AC_MSG_ERROR([--with-external-symbols-in-bundles currently only works on windows!]) +- elif test "x$COPY_DEBUG_SYMBOLS" != xtrue ; then +- AC_MSG_ERROR([--with-external-symbols-in-bundles only works when --with-native-debug-symbols=external is used!]) +- elif test "x$with_external_symbols_in_bundles" = xfull ; then ++ if test "x$COPY_DEBUG_SYMBOLS" != xtrue ; then ++ AC_MSG_ERROR([--with-external-symbols-in-bundles only works when --with-native-debug-symbols=external/zipped is used!]) ++ elif test "x$with_external_symbols_in_bundles" = xpublic && test "x$OPENJDK_TARGET_OS" != xwindows ; then ++ AC_MSG_ERROR([--with-external-symbols-in-bundles=public is only supported on Windows!]) ++ fi ++ ++ if test "x$with_external_symbols_in_bundles" = xfull ; then + AC_MSG_RESULT([full]) + SHIP_DEBUG_SYMBOLS=full + else + AC_MSG_RESULT([public]) + SHIP_DEBUG_SYMBOLS=public + fi ++ elif test "x$with_external_symbols_in_bundles" = xdefault ; then ++ if test "x$DEBUG_LEVEL" = xrelease ; then ++ AC_MSG_RESULT([no (default)]) ++ elif test "x$COPY_DEBUG_SYMBOLS" = xtrue ; then ++ AC_MSG_RESULT([full (default)]) ++ SHIP_DEBUG_SYMBOLS=full ++ else ++ AC_MSG_RESULT([no (default, native debug symbols are not external/zipped)]) ++ fi + else + AC_MSG_ERROR([$with_external_symbols_in_bundles is an unknown value for --with-external-symbols-in-bundles]) + fi diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec index 287c7fe..16bb5eb 100644 --- a/java-latest-openjdk-portable.spec +++ b/java-latest-openjdk-portable.spec @@ -404,9 +404,9 @@ exit 1 %endif # New Version-String scheme-style defines -%global featurever 25 +%global featurever 26 %global interimver 0 -%global updatever 1 +%global updatever 0 %global patchver 0 # buildjdkver is usually same as %%{featurever}, # but in time of bootstrap of next jdk, it is featurever-1, @@ -460,8 +460,8 @@ exit 1 %global origin_nice OpenJDK %global top_level_dir_name %{vcstag} %global top_level_dir_name_backup %{top_level_dir_name}-backup -%global buildver 8 -%global rpmrelease 3 +%global buildver 29 +%global rpmrelease 1 #%%global tagsuffix %%{nil} # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit %if %is_system_jdk @@ -480,7 +480,7 @@ exit 1 # Release will be (where N is usually a number starting at 1): # - 0.N%%{?extraver}%%{?dist} for EA releases, # - N%%{?extraver}{?dist} for GA releases -%global is_ga 1 +%global is_ga 0 %if %{is_ga} %global build_type GA %global ea_designator "" @@ -775,7 +775,7 @@ Source18: TestTranslations.java # RH1940064: Enable XML Signature provider in FIPS mode # RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized [now part of JDK-8301553 upstream] # usage in jdk >25 is experimental and may disapear -Patch1001: fips-%{featurever}u-%{fipsver}.patch +Patch1001: fips-25u-%{fipsver}.patch ############################################# # @@ -791,7 +791,7 @@ Patch1001: fips-%{featurever}u-%{fipsver}.patch # ############################################# -# Currently empty +Patch1: JDK-8373246-8351842_broke_native_debugging_on_Linux.patch ############################################# # @@ -1086,6 +1086,7 @@ pushd %{top_level_dir_name} # Add crypto policy and FIPS support # usage in jdk >25 is experimental and may disapear %patch -P1001 -p1 +%patch -P1 -p1 popd # openjdk echo "Generating %{alt_java_name} man page" @@ -1491,6 +1492,9 @@ function packagejdk() { # Release images have external debug symbols if [ "x$suffix" = "x" ] ; then + # jdk26 is putting debugsymbols out of main image, + # we later reconstruct debuginfo subpakckages manually, so putting them back + cp -r symbols/* ${jdkname}/ createtar ${debugarchive} $(find ${jdkname} -name \*.debuginfo) genchecksum ${debugarchive} diff --git a/sources b/sources index 641515d..404d038 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (openjdk-25.0.1+8.tar.xz) = eb84d876f81ca02803283e8294c89b6acbed3753426811c3bcc228615c9618deefc85da4aa702800cac2feb103e628ee8b92292b316e9d7e12a58b6de69c5085 +SHA512 (openjdk-26+29-ea.tar.xz) = 4e80882e0de26eff7d46d762e255911d42544473cc5f12ab0af1997969a14cc697e1164cb3c90d894359b58cc42dbd2b233f00fa807dbfad41583da278e26666