diff --git a/.gitignore b/.gitignore
index b780ca0..1f1fc8c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -47,3 +47,15 @@
 /openjdk-jdk-22.0.2+9.tar.xz
 /openjdk-jdk-23+37.tar.xz
 /openjdk-jdk-23.0.1+11.tar.xz
+/openjdk-23.0.2+7.tar.xz
+/openjdk-24+34-ea.tar.xz
+/openjdk-24+36.tar.xz
+/openjdk-24.0.1+9.tar.xz
+/openjdk-24.0.2+12.tar.xz
+/openjdk-25+13-ea.tar.xz
+/openjdk-25+26-ea.tar.xz
+/openjdk-25+32-ea.tar.xz
+/openjdk-jdk-25+36.tar.xz
+/openjdk-25+36.tar.xz
+/openjdk-25.0.1+8.tar.xz
+/openjdk-26+29-ea.tar.xz
diff --git a/JDK-8373246-8351842_broke_native_debugging_on_Linux.patch b/JDK-8373246-8351842_broke_native_debugging_on_Linux.patch
new file mode 100644
index 0000000..1f6ca4d
--- /dev/null
+++ b/JDK-8373246-8351842_broke_native_debugging_on_Linux.patch
@@ -0,0 +1,154 @@
+diff --git a/make/Bundles.gmk b/make/Bundles.gmk
+index 8161b3b036254..0b324e7e3f3fc 100644
+--- a/make/Bundles.gmk
++++ b/make/Bundles.gmk
+@@ -185,77 +185,30 @@ endif
+ 
+ ifneq ($(filter product-bundles% legacy-bundles, $(MAKECMDGOALS)), )
+ 
+-  SYMBOLS_EXCLUDE_PATTERN := %.debuginfo %.diz %.map
+-
+-  # There may be files with spaces in the names, so use ShellFindFiles
+-  # explicitly.
++  # There may be files with spaces in the names, so use ShellFindFiles explicitly.
+   ALL_JDK_FILES := $(call ShellFindFiles, $(JDK_IMAGE_DIR))
+-  ifneq ($(JDK_IMAGE_DIR), $(JDK_SYMBOLS_IMAGE_DIR))
+-    ALL_JDK_SYMBOLS_FILES := $(call ShellFindFiles, $(JDK_SYMBOLS_IMAGE_DIR))
+-  else
+-    ALL_JDK_SYMBOLS_FILES := $(ALL_JDK_FILES)
+-  endif
+   ifneq ($(JDK_IMAGE_DIR), $(JDK_DEMOS_IMAGE_DIR))
+     ALL_JDK_DEMOS_FILES := $(call ShellFindFiles, $(JDK_DEMOS_IMAGE_DIR))
+   else
+     ALL_JDK_DEMOS_FILES := $(ALL_JDK_FILES)
+   endif
+ 
+-  # Create special filter rules when dealing with unzipped .dSYM directories on
+-  # macosx
+-  ifeq ($(call isTargetOs, macosx), true)
+-    ifeq ($(ZIP_EXTERNAL_DEBUG_SYMBOLS), false)
+-      JDK_SYMBOLS_EXCLUDE_PATTERN := $(addprefix %, \
+-          $(call containing, .dSYM/, $(patsubst $(JDK_IMAGE_DIR)/%, %, \
+-          $(ALL_JDK_SYMBOLS_FILES))))
+-    endif
+-  endif
+-
+-  # Create special filter rules when dealing with debug symbols on windows
+-  ifeq ($(call isTargetOs, windows), true)
+-    ifeq ($(SHIP_DEBUG_SYMBOLS), )
+-      JDK_SYMBOLS_EXCLUDE_PATTERN := %.pdb
+-    endif
+-  endif
+-
+   JDK_BUNDLE_FILES := \
+       $(filter-out \
+-          $(JDK_SYMBOLS_EXCLUDE_PATTERN) \
+           $(JDK_EXTRA_EXCLUDES) \
+-          $(SYMBOLS_EXCLUDE_PATTERN) \
+           $(JDK_IMAGE_HOMEDIR)/demo/% \
+           , \
+           $(ALL_JDK_FILES) \
+       )
+ 
+-  JDK_SYMBOLS_BUNDLE_FILES := \
+-      $(call FindFiles, $(SYMBOLS_IMAGE_DIR))
++  JDK_SYMBOLS_BUNDLE_FILES := $(call FindFiles, $(SYMBOLS_IMAGE_DIR))
+ 
+   TEST_DEMOS_BUNDLE_FILES := $(filter $(JDK_DEMOS_IMAGE_HOMEDIR)/demo/%, \
+       $(ALL_JDK_DEMOS_FILES))
+ 
+   ALL_JRE_FILES := $(call ShellFindFiles, $(JRE_IMAGE_DIR))
+ 
+-  # Create special filter rules when dealing with unzipped .dSYM directories on
+-  # macosx
+-  ifeq ($(OPENJDK_TARGET_OS), macosx)
+-    ifeq ($(ZIP_EXTERNAL_DEBUG_SYMBOLS), false)
+-      JRE_SYMBOLS_EXCLUDE_PATTERN := $(addprefix %, \
+-          $(call containing, .dSYM/, $(patsubst $(JRE_IMAGE_DIR)/%, %, $(ALL_JRE_FILES))))
+-    endif
+-  endif
+-
+-  # Create special filter rules when dealing with debug symbols on windows
+-  ifeq ($(call isTargetOs, windows), true)
+-    ifeq ($(SHIP_DEBUG_SYMBOLS), )
+-      JRE_SYMBOLS_EXCLUDE_PATTERN := %.pdb
+-    endif
+-  endif
+-
+-  JRE_BUNDLE_FILES := $(filter-out \
+-      $(JRE_SYMBOLS_EXCLUDE_PATTERN) \
+-      $(SYMBOLS_EXCLUDE_PATTERN), \
+-      $(ALL_JRE_FILES))
++  JRE_BUNDLE_FILES := $(ALL_JRE_FILES)
+ 
+   ifeq ($(MACOSX_CODESIGN_MODE), hardened)
+     # Macosx release build and code signing available.
+diff --git a/make/CreateJmods.gmk b/make/CreateJmods.gmk
+index 3280b24924a34..32f107b6bb6a0 100644
+--- a/make/CreateJmods.gmk
++++ b/make/CreateJmods.gmk
+@@ -218,10 +218,14 @@ ifeq ($(call isTargetOs, windows), true)
+   ifeq ($(SHIP_DEBUG_SYMBOLS), )
+     JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.pdb,*.map}'
+   else
+-    JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.map}'
++    JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.map}'
+   endif
+ else
+-  JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.debuginfo,*.dSYM/**,*.dSYM}'
++  ifeq ($(SHIP_DEBUG_SYMBOLS), )
++    JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.debuginfo,*.dSYM/**,*.dSYM}'
++  else
++    JMOD_FLAGS += --exclude '**{_the.*,_*.marker*}'
++  endif
+ endif
+ 
+ # Unless we are creating a very large module, use the small tool JVM options
+diff --git a/make/autoconf/jdk-options.m4 b/make/autoconf/jdk-options.m4
+index bb18877800192..87d147d4f074b 100644
+--- a/make/autoconf/jdk-options.m4
++++ b/make/autoconf/jdk-options.m4
+@@ -316,23 +316,36 @@ AC_DEFUN_ONCE([JDKOPT_SETUP_DEBUG_SYMBOLS],
+   AC_MSG_CHECKING([if we should add external native debug symbols to the shipped bundles])
+   AC_ARG_WITH([external-symbols-in-bundles],
+       [AS_HELP_STRING([--with-external-symbols-in-bundles],
+-      [which type of external native debug symbol information shall be shipped in product bundles (none, public, full)
+-      (e.g. ship full/stripped pdbs on Windows) @<:@none@:>@])])
++      [which type of external native debug symbol information shall be shipped with bundles/images (none, public, full).
++      @<:@none in release builds, full otherwise. --with-native-debug-symbols=external/zipped is a prerequisite. public is only supported on Windows@:>@])],
++      [],
++      [with_external_symbols_in_bundles=default])
+ 
+   if test "x$with_external_symbols_in_bundles" = x || test "x$with_external_symbols_in_bundles" = xnone ; then
+     AC_MSG_RESULT([no])
+   elif test "x$with_external_symbols_in_bundles" = xfull || test "x$with_external_symbols_in_bundles" = xpublic ; then
+-    if test "x$OPENJDK_TARGET_OS" != xwindows ; then
+-      AC_MSG_ERROR([--with-external-symbols-in-bundles currently only works on windows!])
+-    elif test "x$COPY_DEBUG_SYMBOLS" != xtrue ; then
+-      AC_MSG_ERROR([--with-external-symbols-in-bundles only works when --with-native-debug-symbols=external is used!])
+-    elif test "x$with_external_symbols_in_bundles" = xfull ; then
++    if test "x$COPY_DEBUG_SYMBOLS" != xtrue ; then
++      AC_MSG_ERROR([--with-external-symbols-in-bundles only works when --with-native-debug-symbols=external/zipped is used!])
++    elif test "x$with_external_symbols_in_bundles" = xpublic && test "x$OPENJDK_TARGET_OS" != xwindows ; then
++      AC_MSG_ERROR([--with-external-symbols-in-bundles=public is only supported on Windows!])
++    fi
++
++    if test "x$with_external_symbols_in_bundles" = xfull ; then
+       AC_MSG_RESULT([full])
+       SHIP_DEBUG_SYMBOLS=full
+     else
+       AC_MSG_RESULT([public])
+       SHIP_DEBUG_SYMBOLS=public
+     fi
++  elif test "x$with_external_symbols_in_bundles" = xdefault ; then
++    if test "x$DEBUG_LEVEL" = xrelease ; then
++      AC_MSG_RESULT([no (default)])
++    elif test "x$COPY_DEBUG_SYMBOLS" = xtrue ; then
++      AC_MSG_RESULT([full (default)])
++      SHIP_DEBUG_SYMBOLS=full
++    else
++      AC_MSG_RESULT([no (default, native debug symbols are not external/zipped)])
++    fi
+   else
+     AC_MSG_ERROR([$with_external_symbols_in_bundles is an unknown value for --with-external-symbols-in-bundles])
+   fi
diff --git a/NEWS b/NEWS
index 8159c68..0a4a628 100644
--- a/NEWS
+++ b/NEWS
@@ -2,221 +2,669 @@ Key:
 
 JDK-X  - https://bugs.openjdk.java.net/browse/JDK-X
 CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
-JEP-XYZ: https://openjdk.org/jeps/XYZ
 
-New in release OpenJDK 23.0.1+11 (2024-10-15):
+New in release OpenJDK 25.0.1 (2025-10-21):
 ===========================================
-  - JDK-6967482: TAB-key does not work in JTables after selecting details-view in JFileChooser
-  - JDK-8166352: FilePane.createDetailsView() removes JTable TAB, SHIFT-TAB functionality
-  - JDK-8299813: java/nio/channels/DatagramChannel/Disconnect.java fails with jtreg test timeout due to lost datagram
-  - JDK-8307383: Enhance DTLS connections
-  - JDK-8311208: Improve CDS Support
-  - JDK-8325525: Create jtreg test case for JDK-8325203
-  - JDK-8328286: Enhance HTTP client
-  - JDK-8328544: Improve handling of vectorization
-  - JDK-8328726: Better Kerberos support
-  - JDK-8331411: Shenandoah: Reconsider spinning duration in ShenandoahLock
-  - JDK-8331446: Improve deserialization support
-  - JDK-8332524: Instead of printing "TLSv1.3," it is showing "TLS13"
-  - JDK-8332644: Improve graph optimizations
-  - JDK-8332818: ubsan: archiveHeapLoader.cpp:70:27: runtime error: applying non-zero offset 18446744073707454464 to null pointer
-  - JDK-8333652: RISC-V: compiler/vectorapi/VectorGatherMaskFoldingTest.java fails when using RVV
-  - JDK-8333716: Shenandoah: Check for disarmed method before taking the nmethod lock
-  - JDK-8333887: ubsan: unsafe.cpp:247:13: runtime error: store to null pointer of type 'volatile int'
-  - JDK-8334041: Bump version numbers for 23.0.1
-  - JDK-8334123: log the opening of Type 1 fonts
-  - JDK-8334239: Introduce macro for ubsan method/function exclusions
-  - JDK-8334653: ISO 4217 Amendment 177 Update
-  - JDK-8335536: Fix assertion failure in IdealGraphPrinter when append is true
-  - JDK-8335713: Enhance vectorization analysis
-  - JDK-8335775: Remove extraneous 's' in comment of rawmonitor.cpp test file
-  - JDK-8336301: test/jdk/java/nio/channels/AsyncCloseAndInterrupt.java leaves around a FIFO file upon test completion
-  - JDK-8336366: Change milestone to fcs for all releases
-  - JDK-8337103: The change for RDP2 CPU24_10 has corrupted line endings in the file version-numbers.conf.
-  - JDK-8337664: Distrust TLS server certificates issued after Oct 2024 and anchored by Entrust Root CAs
-  - JDK-8338696: (fs) BasicFileAttributes.creationTime() falls back to epoch if birth time is unavailable (Linux)
-  - JDK-8341057: Add 2 SSL.com TLS roots
-  - JDK-8341059: Change Entrust TLS distrust date to November 12, 2024
 
-New in release OpenJDK 23.0.0+37 (2024-09-17):
-===========================================
-  - JEP-455: 	Primitive Types in Patterns, instanceof, and switch (Preview)
-  - JEP-466: 	Class-File API (Second Preview)
-  - JEP-467: 	Markdown Documentation Comments
-  - JEP-469: 	Vector API (Eighth Incubator)
-  - JEP-473: 	Stream Gatherers (Second Preview)
-  - JEP-471: 	Deprecate the Memory-Access Methods in sun.misc.Unsafe for Removal
-  - JEP-474: 	ZGC: Generational Mode by Default
-  - JEP-476: 	Module Import Declarations (Preview)
-  - JEP-477: 	Implicitly Declared Classes and Instance Main Methods (Third Preview)
-  - JEP-480: 	Structured Concurrency (Third Preview)
-  - JEP-481: 	Scoped Values (Third Preview)
-  - JEP-482: 	Flexible Constructor Bodies (Second Preview)
+* CVEs
+  - CVE-2025-53057
+  - CVE-2025-53066
+  - CVE-2025-61748
+* Changes
+  - JDK-8315131: Clarify VarHandle set/get access on 32-bit platforms
+  - JDK-8352637: Enhance bytecode verification
+  - JDK-8356294: Enhance Path Factories
+  - JDK-8356587: Missing object ID X in pool jdk.types.Method
+  - JDK-8357826: Avoid running some jtreg tests when asan is configured
+  - JDK-8358452: JNI exception pending in Java_sun_awt_screencast_ScreencastHelper_remoteDesktopKeyImpl of screencast_pipewire.c:1214 (ID: 51119)
+  - JDK-8358577: Test serviceability/jvmti/thread/GetCurrentContendedMonitor/contmon01/contmon01.java failed: unexpexcted monitor object
+  - JDK-8358819: The first year is not displayed correctly in Japanese Calendar
+  - JDK-8359059: Bump version numbers for 25.0.1
+  - JDK-8359218: RISC-V: Only enable CRC32 intrinsic when AvoidUnalignedAccess == false
+  - JDK-8359270: C2: alignment check should consider base offset when emitting arraycopy runtime call
+  - JDK-8359454: Enhance String handling
+  - JDK-8359596: Behavior change when both -Xlint:options and -Xlint:-options flags are given
+  - JDK-8360179: RISC-V: Only enable BigInteger intrinsics when AvoidUnalignedAccess == false
+  - JDK-8360533: ContainerRuntimeVersionTestUtils fromVersionString fails with some docker versions
+  - JDK-8360647: [XWayland] [OL10] NumPad keys are not triggered
+  - JDK-8360679: Shenandoah: AOT saved adapter calls into broken GC barrier stub
+  - JDK-8360937: Enhance certificate handling
+  - JDK-8361212: Remove AffirmTrust root CAs
+  - JDK-8361532: RISC-V: Several vector tests fail after JDK-8354383
+  - JDK-8361829: [TESTBUG] RISC-V: compiler/vectorization/runner/BasicIntOpTest.java fails with RVV but not Zvbb
+  - JDK-8362109: Change milestone to fcs for all releases
+  - JDK-8362882: Update SubmissionPublisher() specification to reflect use of ForkJoinPool.asyncCommonPool()
+  - JDK-8366223: ZGC: ZPageAllocator::cleanup_failed_commit_multi_partition is broken
+  - JDK-8367031: [backout] Change java.time month/day field types to 'byte'
+  - JDK-8368308: ISO 4217 Amendment 180 Update
 
-New in release OpenJDK 22.0.1 (2024-07-17):
+Notes on individual issues:
+===========================
+
+core-libs/java.io:serialization:
+
+JDK-8367031: [backout] Change java.time month/day field types to 'byte'
+=======================================================================
+In the initial release of OpenJDK 25, attempting to read serialised
+Class objects created by earlier versions of OpenJDK for several of
+the `java.time` classes would fail with a
+`InvalidClassException`. Similarly, `java.time` Class objects
+serialised with OpenJDK 25 could not be read by older OpenJDK
+versions.  This was due to the type of the day and month fields in
+these classes being changed to `byte`. This change has now been
+reverted and compatibility between OpenJDK 25 and older versions
+restored.
+
+Note that this incompatibility occurred with the `Class` object and
+not an instance of the object i.e. `writeObject(LocalDate.class)`
+would produce incompatible serialised data, but
+`writeObject(LocalDate.now())` would not.
+
+security-libs/java.security:
+
+JDK-8361212: Remove AffirmTrust root CAs
+========================================
+The following root certificates from AffirmTrust, which were
+deactivated in the 21.0.5 release of October 2024, have been removed
+from the `cacerts` keystore:
+
+Alias name: affirmtrustcommercialca [jdk]
+CN=AffirmTrust Commercial
+O=AffirmTrust
+C=US
+SHA256: 03:76:AB:1D:54:C5:F9:80:3C:E4:B2:E2:01:A0:EE:7E:EF:7B:57:B6:36:E8:A9:3C:9B:8D:48:60:C9:6F:5F:A7
+
+Alias name: affirmtrustnetworkingca [jdk]
+CN=AffirmTrust Networking
+O=AffirmTrust
+C=US
+SHA256: 0A:81:EC:5A:92:97:77:F1:45:90:4A:F3:8D:5D:50:9F:66:B5:E2:C5:8F:CD:B5:31:05:8B:0E:17:F3:F0B4:1B
+
+Alias name: affirmtrustpremiumca [jdk]
+CN=AffirmTrust Premium
+O=AffirmTrust
+C=US
+SHA256: 70:A7:3F:7F:37:6B:60:07:42:48:90:45:34:B1:14:82:D5:BF:0E:69:8E:CC:49:8D:F5:25:77:EB:F2:E9:3B:9A
+
+Alias name: affirmtrustpremiumeccca [jdk]
+CN=AffirmTrust Premium ECC
+O=AffirmTrust
+C=US
+SHA256: BD:71:FD:F6:DA:97:E4:CF:62:D1:64:7A:DD:25:81:B0:7D:79:AD:F8:39:7E:B4:EC:BA:9C:5E:84:88:82:14:23
+
+New in release OpenJDK 25.0.0 (2025-09-16):
 ===========================================
-  - JDK-8185862: AWT Assertion Failure in ::GetDIBits(hBMDC, hBM, 0, 1, 0, gpBitmapInfo, 0) 'awt_Win32GraphicsDevice.cpp', at line 185
-  - JDK-8187759: Background not refreshed when painting over a transparent JFrame
-  - JDK-8238169: BasicDirectoryModel getDirectories and DoChangeContents.run can deadlock
-  - JDK-8261433: Better pkcs11 performance for libpkcs11:C_EncryptInit/libpkcs11:C_DecryptInit
-  - JDK-8295111: dpkg appears to have problems resolving symbolically linked native libraries
-  - JDK-8305072: Win32ShellFolder2.compareTo is inconsistent
-  - JDK-8309218: java/util/concurrent/locks/Lock/OOMEInAQS.java still times out with ZGC, Generational ZGC, and SerialGC
-  - JDK-8310072: JComboBox/DisabledComboBoxFontTestAuto: Enabled and disabled ComboBox does not match in these LAFs: GTK+
-  - JDK-8310513: [s390x] Intrinsify recursive ObjectMonitor locking
-  - JDK-8312383: Log X509ExtendedKeyManager implementation class name in TLS/SSL connection
-  - JDK-8314794: Improve UTF8 String supports
-  - JDK-8315708: Enhance HTTP/2 client usage
-  - JDK-8316138: Add GlobalSign 2 TLS root certificates
-  - JDK-8316328: Test jdk/jfr/event/oldobject/TestSanityDefault.java times out for some heap sizes
-  - JDK-8319548: Unexpected internal name for Filler array klass causes error in VisualVM
-  - JDK-8319859: Better symbol storage
-  - JDK-8320005: Allow loading of shared objects with .a extension on AIX
-  - JDK-8320097: Improve Image transformations
-  - JDK-8320548: Improved loop handling
-  - JDK-8320692: Null icon returned for .exe without custom icon
-  - JDK-8320707: Virtual thread test updates
-  - JDK-8321075: RISC-V: UseSystemMemoryBarrier lacking proper OS support
-  - JDK-8322078: ZipSourceCache.testKeySourceMapping() test fails with The process cannot access the file because it is being used by another process
-  - JDK-8322122: Enhance generation of addresses
-  - JDK-8322484: 22-b26 Regression in J2dBench-bimg_misc-G1 (and more) on Windows-x64 and macOS-x64
-  - JDK-8322503: Shenandoah: Clarify gc state usage
-  - JDK-8322726: C2: Unloaded signature class kills argument value
-  - JDK-8322943: runtime/CompressedOops/CompressedClassPointers.java fails on AIX
-  - JDK-8322962: Upcall stub might go undetected when freezing frames
-  - JDK-8323231: Improve array management
-  - JDK-8323390: Enhance mask blit functionality
-  - JDK-8323519: Add applications/ctw/modules to Hotspot tiered testing
-  - JDK-8323552: AbstractMemorySegmentImpl#mismatch returns -1 when comparing distinct areas of the same instance of MemorySegment
-  - JDK-8323670: A few client tests intermittently throw ConcurrentModificationException
-  - JDK-8323685: PrintSystemDictionaryAtExit has mutex rank assert
-  - JDK-8323782: Race: Thread::interrupt vs. AbstractInterruptibleChannel.begin
-  - JDK-8323801: <s> tag doesn't strikethrough the text
-  - JDK-8323918: Update the release version after forking Apr CPU24_04
-  - JDK-8323919: Update the Jul CPU24_07 release date in master branch after forking Apr CPU24_04
-  - JDK-8323994: gtest runner repeats test name for every single gtest assertion
-  - JDK-8324121: SIGFPE in PhaseIdealLoop::extract_long_range_checks
-  - JDK-8324243: Compilation failures in java.desktop module with gcc 14
-  - JDK-8324559: Improve 2D image handling
-  - JDK-8324632: Update Zlib Data Compression Library to Version 1.3.1
-  - JDK-8324646: Avoid Class.forName in SecureRandom constructor
-  - JDK-8324648: Avoid NoSuchMethodError when instantiating NativePRNG
-  - JDK-8324733: [macos14] Problem list tests which fail due to macOS bug described in JDK-8322653
-  - JDK-8324834: Use _LARGE_FILES on AIX
-  - JDK-8324874: AArch64: crypto pmull based CRC32/CRC32C intrinsics clobber V8-V15 registers
-  - JDK-8324933: ConcurrentHashTable::statistics_calculate synchronization is expensive
-  - JDK-8325028: (ch) Pipe channels should lazily set socket to non-blocking mode on first use by virtual thread
-  - JDK-8325095: C2: bailout message broken: ResourceArea allocated string used after free
-  - JDK-8325179: Race in BasicDirectoryModel.validateFileCache
-  - JDK-8325255: jdk.internal.util.ReferencedKeySet::add using wrong test
-  - JDK-8325313: Header format error in TestIntrinsicBailOut after JDK-8317299
-  - JDK-8325432: enhance assert message "relocation addr must be in this section"
-  - JDK-8325567: jspawnhelper without args fails with segfault
-  - JDK-8325579: Inconsistent behavior in com.sun.jndi.ldap.Connection::createSocket
-  - JDK-8325587: Shenandoah: ShenandoahLock should allow blocking in VM
-  - JDK-8325600: Better symbol storage
-  - JDK-8325613: CTW: Stale method cleanup requires GC after Sweeper removal
-  - JDK-8325621: Improve jspawnhelper version checks
-  - JDK-8325730: StringBuilder.toString allocation for the empty String
-  - JDK-8325743: test/jdk/java/nio/channels/unixdomain/SocketOptions.java enhance user name output in error case
-  - JDK-8325763: Revert properties: vm.opt.x.*
-  - JDK-8325862: set -XX:+ErrorFileToStderr when executing java in containers for some container related jtreg tests
-  - JDK-8326006: Allow TEST_VM_FLAGLESS to set flagless mode
-  - JDK-8326106: Write and clear stack trace table outside of safepoint
-  - JDK-8326140: src/jdk.accessibility/windows/native/libjavaaccessbridge/AccessBridgeJavaEntryPoints.cpp ReleaseStringChars might be missing in early returns
-  - JDK-8326201: [S390] Need to bailout cleanly if creation of stubs fails when code cache is out of space
-  - JDK-8326351: Update the Zlib version in open/src/java.base/share/legal/zlib.md to 1.3.1
-  - JDK-8326446: The User and System of jdk.CPULoad on Apple M1 are inaccurate
-  - JDK-8326496: [test] checkHsErrFileContent  support printing hserr in error case
-  - JDK-8326521: JFR: CompilerPhase event test fails on windows 32 bit
-  - JDK-8326529: JFR: Test for CompilerCompile events fails due to time out
-  - JDK-8326643: JDK server does not send a dummy change_cipher_spec record after HelloRetryRequest message
-  - JDK-8326891: Prefer RPATH over RUNPATH for $ORIGIN rpaths in internal JDK binaries
-  - JDK-8326936: RISC-V: Shenandoah GC crashes due to incorrect atomic memory operations
-  - JDK-8326960: GHA: RISC-V sysroot cannot be debootstrapped due to ongoing Debian t64 transition
-  - JDK-8326974: ODR violation in macroAssembler_aarch64.cpp
-  - JDK-8327040: Problemlist ActionListenerCalledTwiceTest.java test failing in macos14
-  - JDK-8327059: os::Linux::print_proc_sys_info add swappiness information
-  - JDK-8327137: Add test for ConcurrentModificationException in BasicDirectoryModel
-  - JDK-8327391: Add SipHash attribution file
-  - JDK-8327413: Enhance compilation efficiency
-  - JDK-8327467: Bump version numbers for 22.0.2
-  - JDK-8327468: Do not restart close if errno is EINTR [macOS/linux]
-  - JDK-8327501: Common ForkJoinPool prevents class unloading in some cases
-  - JDK-8327631: Update IANA Language Subtag Registry to Version 2024-03-07
-  - JDK-8327990: [macosx-aarch64] Various tests fail with -XX:+AssertWXAtThreadSync
-  - JDK-8328066: WhiteBoxResizeTest failure on linux-x86: Could not reserve enough space for 2097152KB object heap
-  - JDK-8328075: Shenandoah: Avoid forwarding when objects don't move in full-GC
-  - JDK-8328165: improve assert(idx < _maxlrg) failed: oob
-  - JDK-8328166: Epsilon: 'EpsilonHeap::allocate_work' misuses the parameter 'size' as size in bytes
-  - JDK-8328168: Epsilon: Premature OOM when allocating object larger than uncommitted heap size
-  - JDK-8328316: Finisher cannot emit if stream is sequential and integrator returned false
-  - JDK-8328366: Thread.setContextClassloader from thread in FJP commonPool task no longer works after JDK-8327501
-  - JDK-8328524: [x86] StringRepeat.java failure on linux-x86: Could not reserve enough space for 2097152KB object heap
-  - JDK-8328589: unify os::breakpoint among posix platforms
-  - JDK-8328604: remove on_aix() function
-  - JDK-8328638: Fallback option for POST-only OCSP requests
-  - JDK-8328702: C2: Crash during parsing because sub type check is not folded
-  - JDK-8328703: Illegal accesses in Java_jdk_internal_org_jline_terminal_impl_jna_linux_CLibraryImpl_ioctl0
-  - JDK-8328705: GHA: Cross-compilation jobs do not require build JDK
-  - JDK-8328709: AIX os::get_summary_cpu_info  support Power 10
-  - JDK-8328744: Parallel: Parallel GC throws OOM before heap is fully expanded
-  - JDK-8328776: [AIX] remove checked_vmgetinfo, use vmgetinfo directly
-  - JDK-8328812: Update and move siphash license
-  - JDK-8328822: C2: "negative trip count?" assert failure in profile predicate code
-  - JDK-8328825: Google CAInterop test failures
-  - JDK-8328948: GHA: Restoring sysroot from cache skips the build after JDK-8326960
-  - JDK-8328953: JEditorPane.read throws ChangedCharSetException
-  - JDK-8328988: [macos14] Problem list LightweightEventTest.java which fails due to macOS bug described in JDK-8322653
-  - JDK-8328989: Incorrect milestone for release JDK 22.0.2
-  - JDK-8328997: Remove unnecessary template parameter lists in GrowableArray
-  - JDK-8329013: StackOverflowError when starting Apache Tomcat with signed jar
-  - JDK-8329109: Threads::print_on() tries to print CPU time for terminated GC threads
-  - JDK-8329134: Reconsider TLAB zapping
-  - JDK-8329163: C2: possible overflow in PhaseIdealLoop::extract_long_range_checks()
-  - JDK-8329213: Better validation for com.sun.security.ocsp.useget option
-  - JDK-8329223: Parallel: Parallel GC resizes heap even if -Xms = -Xmx
-  - JDK-8329510: Update ProblemList for JFileChooser/8194044/FileSystemRootTest.java
-  - JDK-8329528: G1 does not update TAMS correctly when dropping retained regions during Concurrent Start pause
-  - JDK-8329545: [s390x] Fix garbage value being passed in Argument Register
-  - JDK-8329570: G1: Excessive is_obj_dead_cond calls in verification
-  - JDK-8329605: hs errfile generic events - move memory protections and nmethod flushes to separate sections
-  - JDK-8329656: assertion failed in MAP_ARCHIVE_MMAP_FAILURE path: Invalid immediate -5 0
-  - JDK-8329663: hs_err file event log entry for thread adding/removing should print current thread
-  - JDK-8329823: RISC-V: Need to sync CPU features with related JVM flags
-  - JDK-8329840: Fix ZPhysicalMemorySegment::_end type
-  - JDK-8329850: [AIX] Allow loading of different members of same shared library archive
-  - JDK-8329862: libjli GetApplicationHome cleanups and enhance jli tracing
-  - JDK-8329958: Windows x86 build fails: downcallLinker.cpp(36) redefinition
-  - JDK-8329961: Buffer overflow in os::Linux::kernel_version
-  - JDK-8330011: [s390x] update block-comments to make code consistent
-  - JDK-8330027: Identity hashes of archived objects must be based on a reproducible random seed
-  - JDK-8330094: RISC-V: Save and restore FRM in the call stub
-  - JDK-8330156: RISC-V: Range check auipc + signed 12 imm instruction
-  - JDK-8330232: Change milestone to fcs for all releases
-  - JDK-8330242: RISC-V: Simplify and remove CORRECT_COMPILER_ATOMIC_SUPPORT in atomic_linux_riscv.hpp
-  - JDK-8330275: Crash in XMark::follow_array
-  - JDK-8330464: hserr generic events - add entry for the before_exit calls
-  - JDK-8330523: Reduce runtime and improve efficiency of KeepAliveTest
-  - JDK-8330524: Linux ppc64le compile warning with clang  in os_linux_ppc.cpp
-  - JDK-8330576: ZYoungCompactionLimit should have range check
-  - JDK-8330615: avoid signed integer overflows in zip_util.c readCen / hashN
-  - JDK-8330748: ByteArrayOutputStream.writeTo(OutputStream) pins carrier
-  - JDK-8330814: Cleanups for KeepAliveCache tests
-  - JDK-8330815: Use pattern matching for instanceof in KeepAliveCache
-  - JDK-8331031: unify os::dont_yield and os::naked_yield across Posix platforms
-  - JDK-8331164: createJMHBundle.sh download jars fail when url needed to be redirected
-  - JDK-8331167: UBSan enabled build fails in adlc on macOS
-  - JDK-8331298: avoid alignment checks in UBSAN enabled build
-  - JDK-8331331: :tier1 target explanation in doc/testing.md is incorrect
-  - JDK-8331344: No compiler replay file with CompilerCommand MemLimit
-  - JDK-8331352: error: template-id not allowed for constructor/destructor in C++20
-  - JDK-8331466: Problemlist serviceability/dcmd/gc/RunFinalizationTest.java on generic-all
-  - JDK-8331589: The DEFAULT_PROMOTED_VERSION_PRE not correct for RDP2 CPU24_07
-  - JDK-8331714: Make OopMapCache installation lock-free
-  - JDK-8331746: Create a test to verify that the cmm id is not ignored
-  - JDK-8331885: C2: meet between unloaded and speculative types is not symmetric
-  - JDK-8331894: [jdk22] compiler/print/CompileCommandMemLimit.java fails after backporting JDK-8325095
-  - JDK-8331942: On Linux aarch64, CDS archives should be using 64K alignment by default
-  - JDK-8332253: Linux arm32 build fails after 8292591
-  - JDK-8332490: JMH org.openjdk.bench.java.util.zip.InflaterInputStreams.inflaterInputStreamRead OOM
+Major changes are listed below.  Some changes may have been backported
+to earlier releases following their first appearance in OpenJDK 22
+through to 25.
+
+NEW FEATURES
+============
+
+Language Features
+=================
+
+Flexible Constructor Bodies
+============================
+https://openjdk.org/jeps/447
+https://openjdk.org/jeps/482
+https://openjdk.org/jeps/492
+https://openjdk.org/jeps/513
+
+In constructors in the Java programming language, allow statements to
+appear before an explicit constructor invocation, i.e., super(..) or
+this(..). The statements cannot reference the instance under
+construction, but they can initialize its fields. Initializing fields
+before invoking another constructor makes a class more reliable when
+methods are overridden.
+
+This language feature is now finalised (JEP 513). It was first
+introduced as a preview language feature
+(http://openjdk.java.net/jeps/12) in OpenJDK 22 (JEP 447) under the
+name "Statements before super(...)".  It reached a second preview in
+OpenJDK 23 (JEP 482) with the addition of allowing fields to be
+initialized before invoking another constructor. It reached a third
+preview in OpenJDK 24 (JEP 492).
+
+Unnamed Patterns and Variables
+==============================
+https://openjdk.org/jeps/443
+https://openjdk.org/jeps/456
+
+Enhance the Java language with unnamed patterns, which match a record
+component without stating the component's name or type, and unnamed
+variables, which can be initialized but not used. Both are denoted by
+an underscore character, _.
+
+This feature is now finalised (JEP 456). It was a preview feature
+(http://openjdk.java.net/jeps/12) in OpenJDK 21 (JEP 443).
+
+Primitive Types in Patterns, instanceof, and switch
+===================================================
+https://openjdk.org/jeps/455
+https://openjdk.org/jeps/488
+https://openjdk.org/jeps/507
+
+Enhance pattern matching by allowing primitive type patterns in all
+pattern contexts, and extend instanceof and switch to work with all
+primitive types.
+
+This is a preview language feature (http://openjdk.java.net/jeps/12)
+introduced in OpenJDK 23 (JEP 455) with a second preview in OpenJDK 24
+(JEP 488) and reaching a third in OpenJDK 25 (JEP 507).
+
+Module Import Declarations
+==========================
+https://openjdk.org/jeps/476
+https://openjdk.org/jeps/494
+https://openjdk.org/jeps/511
+
+Enhance the Java programming language with the ability to succinctly
+import all of the packages exported by a module. This simplifies the
+reuse of modular libraries, but does not require the importing code to
+be in a module itself.
+
+This language feature is now finalised (JEP 511). It was introduced as
+a preview language feature (http://openjdk.java.net/jeps/12) in
+OpenJDK 23 (JEP 476) and had a second preview in OpenJDK 24 (JEP 494).
+
+Library Features
+================
+
+Foreign Function & Memory API
+=============================
+https://openjdk.org/jeps/412
+https://openjdk.org/jeps/419
+https://openjdk.org/jeps/424
+https://openjdk.org/jeps/434
+https://openjdk.org/jeps/442
+https://openjdk.org/jeps/454
+
+Introduce an API by which Java programs can interoperate with code and
+data outside of the Java runtime. By efficiently invoking foreign
+functions (i.e., code outside the JVM), and by safely accessing
+foreign memory (i.e., memory not managed by the JVM), the API enables
+Java programs to call native libraries and process native data without
+the brittleness and danger of JNI.
+
+This API is now finalised (JEP 454). It was first introduced in
+incubation (https://openjdk.java.net/jeps/11) in OpenJDK 17 (JEP 412),
+and is an evolution of the Foreign Memory Access API (OpenJDK 14
+through 16) and Foreign Linker API (OpenJDK 16) (see release notes for
+java-17-openjdk). OpenJDK 18 saw a second round of incubation (JEP
+419) before its inclusion as a preview feature
+(http://openjdk.java.net/jeps/12) in OpenJDK 19 (JEP 424). A second
+preview took place in OpenJDK 20 (JEP 434) and a third and final
+preview in OpenJDK 21 (JEP 442).
+
+Prepare to Restrict the Use of JNI
+==================================
+https://openjdk.org/jeps/472
+
+Issue warnings about uses of the Java Native Interface (JNI) and
+adjust the Foreign Function & Memory (FFM) API to issue warnings in a
+consistent manner. All such warnings aim to prepare developers for a
+future release that ensures integrity by default by uniformly
+restricting JNI and the FFM API. Application developers can avoid both
+current warnings and future restrictions by selectively enabling these
+interfaces where essential using the --enable-native-access
+command-line option.
+
+Class-File API
+==============
+https://openjdk.org/jeps/457
+https://openjdk.org/jeps/466
+https://openjdk.org/jeps/484
+
+Provide a standard API for parsing, generating, and transforming Java
+class files.
+
+This API is now finalised (JEP 484). It was introduced as a preview
+library feature (http://openjdk.java.net/jeps/12) in OpenJDK 22 (JEP
+457) with a second preview in OpenJDK 23 (JEP 466).
+
+Vector API
+==========
+https://openjdk.org/jeps/338
+https://openjdk.org/jeps/414
+https://openjdk.org/jeps/417
+https://openjdk.org/jeps/426
+https://openjdk.org/jeps/438
+https://openjdk.org/jeps/448
+https://openjdk.org/jeps/460
+https://openjdk.org/jeps/469
+https://openjdk.org/jeps/489
+https://openjdk.org/jeps/508
+
+Introduce an API to express vector computations that reliably compile
+at runtime to optimal vector hardware instructions on supported CPU
+architectures and thus achieve superior performance to equivalent
+scalar computations.
+
+This is an incubation feature (https://openjdk.java.net/jeps/11)
+introduced in OpenJDK 16 (JEP 338). A second round of incubation took
+place in OpenJDK 17 (JEP 414), OpenJDK 18 (JEP 417) saw a third,
+OpenJDK 19 a fourth (JEP 426), OpenJDK 20 (JEP 438) a fifth, OpenJDK
+21 a sixth (JEP 448), OpenJDK 22 a seventh (JEP 460), OpenJDK 23 an
+eighth (JEP 469), OpenJDK 24 a ninth (JEP 489) and it reaches its
+tenth in OpenJDK 25 (JEP 508).
+
+Stream Gatherers
+================
+https://openjdk.org/jeps/461
+https://openjdk.org/jeps/473
+https://openjdk.org/jeps/485
+
+Enhance the Stream API to support custom intermediate operations. This
+will allow stream pipelines to transform data in ways that are not
+easily achievable with the existing built-in intermediate operations.
+
+This API is now finalised (JEP 485). It was introduced as a preview
+library feature (http://openjdk.java.net/jeps/12) in OpenJDK 22 (JEP
+461) with a second preview in OpenJDK 23 (JEP 473).
+
+Structured Concurrency
+======================
+https://openjdk.org/jeps/428
+https://openjdk.org/jeps/437
+https://openjdk.org/jeps/453
+https://openjdk.org/jeps/462
+https://openjdk.org/jeps/480
+https://openjdk.org/jeps/499
+https://openjdk.org/jeps/505
+
+Simplify multithreaded programming by introducing an API for
+structured concurrency. Structured concurrency treats multiple tasks
+running in different threads as a single unit of work, thereby
+streamlining error handling and cancellation, improving reliability,
+and enhancing observability.
+
+This API was first introduced in incubation
+(https://openjdk.java.net/jeps/11) in OpenJDK 19 (JEP 428) and had a
+second round of incubation in OpenJDK 20 (JEP 437). It became a
+preview feature (http://openjdk.java.net/jeps/12) in OpenJDK 21 (JEP
+453), reached its second preview in OpenJDK 22 (JEP 462), had a third
+preview in OpenJDK 23 (JEP 480), a fourth in OpenJDK 24 (JEP 499) and
+reaches its fifth in OpenJDK 25 (JEP 505).
+
+Compact Source Files and Instance Main Methods
+==============================================
+https://openjdk.org/jeps/445
+https://openjdk.org/jeps/463
+https://openjdk.org/jeps/477
+https://openjdk.org/jeps/495
+https://openjdk.org/jeps/512
+
+Evolve the Java programming language so that beginners can write their
+first programs without needing to understand language features
+designed for large programs. Far from using a separate dialect of the
+language, beginners can write streamlined declarations for
+single-class programs and then seamlessly expand their programs to use
+more advanced features as their skills grow. Experienced developers
+can likewise enjoy writing small programs succinctly, without the need
+for constructs intended for programming in the large.
+
+This library feature is now finalised (JEP 512) with some minor
+changes from the last release. It was first introduced as a preview
+(http://openjdk.java.net/jeps/12) in OpenJDK 21 (JEP 445) under the
+name "Unnamed Classes and Instance Main Methods". It reached a second
+preview in OpenJDK 22 (JEP 463) and a third in OpenJDK 23 (JEP 477)
+under the new name, "Implicitly Declared Classes and Instance Main
+Methods", due to the move away from unnamed classes to an implicitly
+declared name chosen by the host system. It had a fourth preview in
+OpenJDK 24 (JEP 495) with new terminology and a revised title ("Simple
+Source Files and Instance Main Methods"), but otherwise unchanged.
+
+Scoped Values
+=============
+https://openjdk.org/jeps/429
+https://openjdk.org/jeps/446
+https://openjdk.org/jeps/464
+https://openjdk.org/jeps/481
+https://openjdk.org/jeps/487
+https://openjdk.org/jeps/506
+
+Introduce scoped values, which enable the sharing of immutable data
+within and across threads. They are preferred to thread-local
+variables, especially when using large numbers of virtual threads.
+
+This API is now finalised (JEP 506). This API was first introduced in
+incubation (https://openjdk.java.net/jeps/11) in OpenJDK 20 (JEP
+429). It became a preview feature (http://openjdk.java.net/jeps/12) in
+OpenJDK 21 (JEP 446), had a second preview in OpenJDK 22 (JEP 464), a
+third in OpenJDK 23 (JEP 481) and a fourth in OpenJDK 24 (JEP 487).
+
+Key Derivation Function API
+===========================
+https://openjdk.org/jeps/478
+https://openjdk.org/jeps/510
+
+Introduce an API for Key Derivation Functions (KDFs), which are
+cryptographic algorithms for deriving additional keys from a secret
+key and other data.
+
+This API is now finalised (JEP 510). It was first introduced as a
+preview library feature (http://openjdk.java.net/jeps/12) in OpenJDK
+24 (JEP 478).
+
+Quantum-Resistant Module-Lattice-Based Key Encapsulation Mechanism
+==================================================================
+https://openjdk.org/jeps/496
+
+Enhance the security of Java applications by providing an
+implementation of the quantum-resistant Module-Lattice-Based
+Key-Encapsulation Mechanism (ML-KEM). Key encapsulation mechanisms
+(KEMs) are used to secure symmetric keys over insecure communication
+channels using public key cryptography. ML-KEM is designed to be
+secure against future quantum computing attacks. It has been
+standardized by the United States National Institute of Standards and
+Technology (NIST) in FIPS 203 [0].
+
+[0] https://csrc.nist.gov/pubs/fips/203/final
+
+Quantum-Resistant Module-Lattice-Based Digital Signature Algorithm
+==================================================================
+https://openjdk.org/jeps/497
+
+Enhance the security of Java applications by providing an
+implementation of the quantum-resistant Module-Lattice-Based Digital
+Signature Algorithm (ML-DSA). Digital signatures are used to detect
+unauthorized modifications to data and to authenticate the identity of
+signatories. ML-DSA is designed to be secure against future quantum
+computing attacks. It has been standardized by the United States
+National Institute of Standards and Technology (NIST) in FIPS 204 [0].
+
+[0] https://csrc.nist.gov/pubs/fips/204/final
+
+PEM Encodings of Cryptographic Objects
+======================================
+https://openjdk.org/jeps/470
+
+Introduce an API for encoding objects that represent cryptographic
+keys, certificates, and certificate revocation lists into the
+widely-used Privacy-Enhanced Mail (PEM) transport format, and for
+decoding from that format back into objects.
+
+This is a preview library feature (http://openjdk.java.net/jeps/12)
+introduced in OpenJDK 25 (JEP 470).
+
+Stable Values
+=============
+https://openjdk.org/jeps/502
+
+Introduce an API for stable values, which are objects that hold
+immutable data. Stable values are treated as constants by the JVM,
+enabling the same performance optimizations that are enabled by
+declaring a field final. Compared to final fields, however, stable
+values offer greater flexibility as to the timing of their
+initialization.
+
+This is a preview library feature (http://openjdk.java.net/jeps/12)
+introduced in OpenJDK 25 (JEP 502).
+
+Virtual Machine Enhancements
+============================
+
+Region Pinning for G1
+=====================
+https://openjdk.org/jeps/423
+
+Reduce latency by implementing region pinning in G1, so that garbage
+collection need not be disabled during Java Native Interface (JNI)
+critical regions.
+
+ZGC: Generational Mode by Default
+=================================
+https://openjdk.org/jeps/439
+https://openjdk.org/jeps/474
+
+Switch the default mode of the Z Garbage Collector (ZGC) to the
+generational mode. Deprecate the non-generational mode, with the
+intent to remove it in a future release.
+
+Late Barrier Expansion for G1
+=============================
+https://openjdk.org/jeps/475
+
+Simplify the implementation of the G1 garbage collector's barriers,
+which record information about application memory accesses, by
+shifting their expansion from early in the C2 JIT's compilation
+pipeline to later.
+
+Ahead-of-Time Class Loading & Linking
+=====================================
+https://openjdk.org/jeps/483
+https://openjdk.org/jeps/514
+
+Improve startup time by making the classes of an application instantly
+available, in a loaded and linked state, when the HotSpot Java Virtual
+Machine starts. Achieve this by monitoring the application during one
+run and storing the loaded and linked forms of all classes in a cache
+for use in subsequent runs. Lay a foundation for future improvements
+to both startup and warmup time.
+
+Using this feature requires a two stage process:
+
+1. Create the Ahead-of-Time cache from a training run of the
+application using the option `--XX:AOTCacheOutput=<cache name>` where
+`<cache name>` is the cache reference to use in later runs.
+
+2. When running the application in testing or production, use the
+option `-XX:AOTCache=<cache name>` to run the application with the
+cache generated in #2.
+
+Previously, in OpenJDK 24 (JEP 483), the training run and cache
+creation were handled by two separate steps:
+
+1. Populate the Ahead-of-Time configuration data with a training run
+of the application using the options `-XX:AOTMode=record
+-XX:AOTConfiguration=<config name>` where `<config name>` is the
+configuration reference to use in #2.
+
+2. Create the Ahead-of-Time cache using the options
+`-XX:AOTMode=create -XX:AOTConfiguration=<config name>
+-XX:AOTCache=<cache name>` where `<config name>` is the configuration
+reference from #1 and `<cache name>` is the cache reference to use in
+later runs.
+
+JEP 514 ("Ahead-of-Time Command-Line Ergonomics") in OpenJDK 25 adds
+the option `--XX:AOTCacheOutput` which performs both the above steps
+from a single command-line invocation using a temporary configuration
+file.  A new environment variable, `JDK_AOT_VM_OPTIONS`, can be used
+to pass options to the cache creation step without affecting the
+training run step.
+
+Ahead-of-Time Method Profiling
+==============================
+https://openjdk.org/jeps/515
+
+Improve warmup time by making method-execution profiles from a
+previous run of an application instantly available, when the HotSpot
+Java Virtual Machine starts. This will enable the JIT compiler to
+generate native code immediately upon application startup, rather than
+having to wait for profiles to be collected.
+
+Synchronize Virtual Threads without Pinning
+===========================================
+https://openjdk.org/jeps/491
+
+Improve the scalability of Java code that uses synchronized methods
+and statements by arranging for virtual threads that block in such
+constructs to release their underlying platform threads for use by
+other virtual threads. This will eliminate nearly all cases of virtual
+threads being pinned to platform threads, which severely restricts the
+number of virtual threads available to handle an application's
+workload.
+
+Compact Object Headers
+======================
+https://openjdk.org/jeps/450
+https://openjdk.org/jeps/519
+
+Reduce the size of object headers in the HotSpot JVM from between 96
+and 128 bits down to 64 bits on 64-bit architectures. This will reduce
+heap size, improve deployment density, and increase data locality.
+
+This is now a production feature in OpenJDK 25 (JEP 519) enabled using
+`-XX:+UseCompactObjectHeaders`. It was first introduced as an
+experimental feature (JEP 450) that also required the use of
+`-XX:+UnlockExperimentalVMOptions`.
+
+Generational Shenandoah
+=======================
+https://openjdk.org/jeps/404
+https://openjdk.org/jeps/521
+
+Enhance the Shenandoah garbage collector with experimental
+generational collection capabilities to improve sustainable
+throughput, load-spike resilience, and memory utilization.
+
+This is now a production feature in OpenJDK 25 (JEP 521) enabled using
+`-XX:ShenandoahGCMode=generational`. It was first introduced as an
+experimental feature (JEP 404) that also required the use of
+`-XX:+UnlockExperimentalVMOptions`.
+
+JFR Cooperative Sampling
+========================
+https://openjdk.org/jeps/518
+
+Improve the stability of the JDK Flight Recorder (JFR) when it
+asynchronously samples Java thread stacks. Achieve this by walking
+call stacks only at safepoints, while minimizing safepoint bias.
+
+JFR Method Timing & Tracing
+===========================
+https://openjdk.org/jeps/520
+
+Extend the JDK Flight Recorder (JFR) with facilities for method timing
+and tracing via bytecode instrumentation.
+
+JFR CPU-Time Profiling
+======================
+https://openjdk.org/jeps/509
+
+Enhance the JDK Flight Recorder (JFR) to capture more accurate
+CPU-time profiling information on Linux.
+
+This is an experimental feature so its JFR events are tagged with the
+`@Experimental` annotation. Unlike other experimental virtual machine
+features, it does not need to be explicitly enabled with
+`-XX:+UnlockExperimentalVMOptions`.
+
+Tools
+=====
+
+Launch Multi-File Source-Code Programs
+======================================
+https://openjdk.org/jeps/458
+
+Enhance the java application launcher to be able to run a program
+supplied as multiple files of Java source code. This will make the
+transition from small programs to larger ones more gradual, enabling
+developers to choose whether and when to go to the trouble of
+configuring a build tool.
+
+Markdown Documentation Comments
+===============================
+https://openjdk.org/jeps/467
+
+Enable JavaDoc documentation comments to be written in Markdown rather
+than solely in a mixture of HTML and JavaDoc @-tags.
+
+Linking Run-Time Images without JMODs
+=====================================
+https://openjdk.org/jeps/493
+
+Reduce the size of the JDK by approximately 25% by enabling the jlink
+tool to create custom run-time images without using the JDK's JMOD
+files.
+
+This feature must be enabled when the JDK is built using the
+--enable-linkable-runtime option.  It will not be enabled by default,
+and some JDK vendors may choose not to enable it.
+
+DEPRECATIONS
+============
+
+Deprecate the Memory-Access Methods in sun.misc.Unsafe for Removal
+==================================================================
+https://openjdk.org/jeps/471
+
+Deprecate the memory-access methods in sun.misc.Unsafe for removal in
+a future release. These unsupported methods have been superseded by
+standard APIs, namely the VarHandle API (JEP 193, OpenJDK 9) and the
+Foreign Function & Memory API (JEP 454, OpenJDK 22). We strongly
+encourage library developers to migrate from sun.misc.Unsafe to
+supported replacements, so that applications can migrate smoothly to
+modern JDK releases.
+
+Warn upon Use of Memory-Access Methods in sun.misc.Unsafe
+=========================================================
+https://openjdk.org/jeps/498
+
+Issue a warning at run time on the first occasion that any
+memory-access method in sun.misc.Unsafe is invoked. All of these
+unsupported methods were terminally deprecated in JDK 23 (see JEP 471
+above). They have been superseded by standard APIs, namely the
+VarHandle API (JEP 193, OpenJDK 9) and the Foreign Function & Memory
+API (JEP 454, OpenJDK 22). We strongly encourage library developers to
+migrate from sun.misc.Unsafe to supported replacements, so that
+applications can migrate smoothly to modern JDK releases.
+
+Permanently Disable the Security Manager
+========================================
+https://openjdk.org/jeps/486
+
+The Security Manager has not been the primary means of securing
+client-side Java code for many years, it has rarely been used to
+secure server-side code, and it is costly to maintain. We therefore
+deprecated it for removal in OpenJDK 17 via JEP 411 (2021). As the
+next step toward removing the Security Manager, we will revise the
+Java Platform specification so that developers cannot enable it and
+other Platform classes do not refer to it. This change will have no
+impact on the vast majority of applications, libraries, and tools. We
+will remove the Security Manager API in a future release.
+
+REMOVALS
+========
+
+String Templates
+================
+https://openjdk.org/jeps/430
+https://openjdk.org/jeps/459
+https://openjdk.org/jeps/465
+
+This was a preview feature (http://openjdk.java.net/jeps/12)
+introduced in OpenJDK 21 (JEP 430) with a second preview in OpenJDK 22
+(JEP 459).  A third preview was proposed but ultimately withdrawn for
+OpenJDK 23 (JEP 465) and the feature is no longer present.  See [0]
+for further explanation.
+
+[0] https://mail.openjdk.org/pipermail/amber-spec-experts/2024-April/004106.html
+
+Remove the Windows & Linux 32-bit x86 Ports
+===========================================
+https://openjdk.org/jeps/449
+https://openjdk.org/jeps/479
+https://openjdk.org/jeps/501
+https://openjdk.org/jeps/503
+
+Remove the source code and build support for the Windows (JEP 479) &
+Linux (JEP 503) 32-bit x86 ports. The Windows port was deprecated for
+removal in JDK 21 by JEP 449 and the Linux port was deprecated for
+removal in JDK 24 by JEP 501. Both deprecations took place with the
+express intent to remove the ports in a future release.
+
+Following this removal of these 32-bit x86 ports, the
+architecture-agnostic Zero port is the only way to run Java programs
+on 32-bit x86 processors.
+
+ZGC: Remove the Non-Generational Mode
+=====================================
+https://openjdk.org/jeps/439
+https://openjdk.org/jeps/474
+https://openjdk.org/jeps/490
+
+Remove the non-generational mode of the Z Garbage Collector (ZGC),
+keeping the generational mode as the default for ZGC (see JEP 439 &
+474).
diff --git a/README.md b/README.md
index 34d9d78..9a97482 100644
--- a/README.md
+++ b/README.md
@@ -4,11 +4,11 @@ This package contains the latest rolling release of OpenJDK. OpenJDK
 has a release cadence of six months, with a new release in March and
 September each year.
 
-The current release is OpenJDK 23. For a list of major changes from
+The current release is OpenJDK 25. For a list of major changes from
 OpenJDK 21, see the NEWS file included in this package and the
 upstream release page:
 
-https://openjdk.org/projects/jdk/23/
+https://openjdk.org/projects/jdk/25/
 
 This package is intended for those who want to follow the latest
 OpenJDK releases. Long term support versions of OpenJDK are available
diff --git a/TestTranslations.java b/TestTranslations.java
index f6a4fe2..1b02c06 100644
--- a/TestTranslations.java
+++ b/TestTranslations.java
@@ -50,11 +50,11 @@ public class TestTranslations {
                                           "Mountain Daylight Time", "MDT", "MDT",
                                           "Mountain Time", "MT", "MT"});
         map.put(Locale.FRANCE, new String[] { "heure normale des Rocheuses", "UTC\u221207:00", "MST",
-                                              "heure d\u2019\u00e9t\u00e9 des Rocheuses", "UTC\u221206:00", "MDT",
-                                              "heure des Rocheuses", "UTC\u221207:00", "MT"});
-        map.put(Locale.GERMANY, new String[] { "Rocky-Mountain-Normalzeit", "GMT-07:00", "MST",
-                                               "Rocky-Mountain-Sommerzeit", "GMT-06:00", "MDT",
-                                               "Rocky-Mountain-Zeit", "GMT-07:00", "MT"});
+                                              "heure d\u2019\u00e9t\u00e9 des Rocheuses", "UTC\u221206:00", "MST",
+                                              "heure des Rocheuses", "UTC\u221207:00", "MST"});
+        map.put(Locale.GERMANY, new String[] { "Rocky-Mountains-Normalzeit", "GMT-07:00", "MST",
+                                               "Rocky-Mountains-Sommerzeit", "GMT-06:00", "MST",
+                                               "Rocky-Mountains-Zeit", "GMT-07:00", "MST"});
         CIUDAD_JUAREZ = Collections.unmodifiableMap(map);
     }
 
@@ -97,14 +97,10 @@ public class TestTranslations {
 
                 System.out.printf("Checking locale %s for %s...\n", l, id);
 
-                if ("JRE".equals(localeProvider)) {
+                if ("JRE".equals(localeProvider) || "CLDR".equals(localeProvider)) {
                     expectedShortStd = expected[2];
                     expectedShortDST = expected[5];
                     expectedShortGen = expected[8];
-                } else if ("CLDR".equals(localeProvider)) {
-                    expectedShortStd = expected[1];
-                    expectedShortDST = expected[4];
-                    expectedShortGen = expected[7];
                 } else {
                     System.err.printf("Invalid locale provider %s\n", localeProvider);
                     System.exit(3);
diff --git a/fips-21u-75ffdc48eda.patch b/fips-21u-75ffdc48eda.patch
deleted file mode 100644
index 8413fe1..0000000
--- a/fips-21u-75ffdc48eda.patch
+++ /dev/null
@@ -1,4233 +0,0 @@
-diff --git a/make/autoconf/build-aux/pkg.m4 b/make/autoconf/build-aux/pkg.m4
-index 5f4b22bb27f..1ca9f5b8ffe 100644
---- a/make/autoconf/build-aux/pkg.m4
-+++ b/make/autoconf/build-aux/pkg.m4
-@@ -179,3 +179,19 @@ else
- 	ifelse([$3], , :, [$3])
- fi[]dnl
- ])# PKG_CHECK_MODULES
-+
-+dnl PKG_CHECK_VAR(VARIABLE, MODULE, CONFIG-VARIABLE,
-+dnl [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
-+dnl -------------------------------------------
-+dnl Since: 0.28
-+dnl
-+dnl Retrieves the value of the pkg-config variable for the given module.
-+AC_DEFUN([PKG_CHECK_VAR],
-+[AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
-+AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])dnl
-+
-+_PKG_CONFIG([$1], [variable="][$3]["], [$2])
-+AS_VAR_COPY([$1], [pkg_cv_][$1])
-+
-+AS_VAR_IF([$1], [""], [$5], [$4])dnl
-+])dnl PKG_CHECK_VAR
-diff --git a/make/autoconf/lib-sysconf.m4 b/make/autoconf/lib-sysconf.m4
-new file mode 100644
-index 00000000000..f48fc7f7e80
---- /dev/null
-+++ b/make/autoconf/lib-sysconf.m4
-@@ -0,0 +1,87 @@
-+#
-+# Copyright (c) 2021, Red Hat, Inc.
-+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+#
-+# This code is free software; you can redistribute it and/or modify it
-+# under the terms of the GNU General Public License version 2 only, as
-+# published by the Free Software Foundation.  Oracle designates this
-+# particular file as subject to the "Classpath" exception as provided
-+# by Oracle in the LICENSE file that accompanied this code.
-+#
-+# This code is distributed in the hope that it will be useful, but WITHOUT
-+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-+# version 2 for more details (a copy is included in the LICENSE file that
-+# accompanied this code).
-+#
-+# You should have received a copy of the GNU General Public License version
-+# 2 along with this work; if not, write to the Free Software Foundation,
-+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+#
-+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+# or visit www.oracle.com if you need additional information or have any
-+# questions.
-+#
-+
-+################################################################################
-+# Setup system configuration libraries
-+################################################################################
-+AC_DEFUN_ONCE([LIB_SETUP_SYSCONF_LIBS],
-+[
-+  ###############################################################################
-+  #
-+  # Check for the NSS library
-+  #
-+  AC_MSG_CHECKING([for NSS library directory])
-+  PKG_CHECK_VAR(NSS_LIBDIR, nss, libdir, [AC_MSG_RESULT([$NSS_LIBDIR])], [AC_MSG_RESULT([not found])])
-+
-+  AC_MSG_CHECKING([whether to link the system NSS library with the System Configurator (libsysconf)])
-+
-+  # default is not available
-+  DEFAULT_SYSCONF_NSS=no
-+
-+  AC_ARG_ENABLE([sysconf-nss], [AS_HELP_STRING([--enable-sysconf-nss],
-+     [build the System Configurator (libsysconf) using the system NSS library if available @<:@disabled@:>@])],
-+  [
-+    case "${enableval}" in
-+      yes)
-+        sysconf_nss=yes
-+        ;;
-+      *)
-+        sysconf_nss=no
-+        ;;
-+    esac
-+  ],
-+  [
-+    sysconf_nss=${DEFAULT_SYSCONF_NSS}
-+  ])
-+  AC_MSG_RESULT([$sysconf_nss])
-+
-+  USE_SYSCONF_NSS=false
-+  if test "x${sysconf_nss}" = "xyes"; then
-+      PKG_CHECK_MODULES(NSS, nss >= 3.53, [NSS_FOUND=yes], [NSS_FOUND=no])
-+      if test "x${NSS_FOUND}" = "xyes"; then
-+         AC_MSG_CHECKING([for system FIPS support in NSS])
-+         saved_libs="${LIBS}"
-+         saved_cflags="${CFLAGS}"
-+         CFLAGS="${CFLAGS} ${NSS_CFLAGS}"
-+         LIBS="${LIBS} ${NSS_LIBS}"
-+         AC_LANG_PUSH([C])
-+         AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <nss3/pk11pub.h>]],
-+                                         [[SECMOD_GetSystemFIPSEnabled()]])],
-+                        [AC_MSG_RESULT([yes])],
-+                        [AC_MSG_RESULT([no])
-+                        AC_MSG_ERROR([System NSS FIPS detection unavailable])])
-+         AC_LANG_POP([C])
-+         CFLAGS="${saved_cflags}"
-+         LIBS="${saved_libs}"
-+         USE_SYSCONF_NSS=true
-+      else
-+         dnl NSS 3.53 is the one that introduces the SECMOD_GetSystemFIPSEnabled API
-+         dnl in nss3/pk11pub.h.
-+         AC_MSG_ERROR([--enable-sysconf-nss specified, but NSS 3.53 or above not found.])
-+      fi
-+  fi
-+  AC_SUBST(USE_SYSCONF_NSS)
-+  AC_SUBST(NSS_LIBDIR)
-+])
-diff --git a/make/autoconf/libraries.m4 b/make/autoconf/libraries.m4
-index a1fc81564b1..ebad69d9dcf 100644
---- a/make/autoconf/libraries.m4
-+++ b/make/autoconf/libraries.m4
-@@ -35,6 +35,7 @@ m4_include([lib-std.m4])
- m4_include([lib-x11.m4])
- 
- m4_include([lib-tests.m4])
-+m4_include([lib-sysconf.m4])
- 
- ################################################################################
- # Determine which libraries are needed for this configuration
-@@ -134,6 +135,7 @@ AC_DEFUN_ONCE([LIB_SETUP_LIBRARIES],
-   LIB_SETUP_X11
- 
-   LIB_TESTS_SETUP_GTEST
-+  LIB_SETUP_SYSCONF_LIBS
- 
-   BASIC_JDKLIB_LIBS=""
-   BASIC_JDKLIB_LIBS_TARGET=""
-diff --git a/make/autoconf/spec.gmk.in b/make/autoconf/spec.gmk.in
-index 0f85917814e..9419562b654 100644
---- a/make/autoconf/spec.gmk.in
-+++ b/make/autoconf/spec.gmk.in
-@@ -867,6 +867,11 @@ INSTALL_SYSCONFDIR=@sysconfdir@
- # Libraries
- #
- 
-+USE_SYSCONF_NSS:=@USE_SYSCONF_NSS@
-+NSS_LIBS:=@NSS_LIBS@
-+NSS_CFLAGS:=@NSS_CFLAGS@
-+NSS_LIBDIR:=@NSS_LIBDIR@
-+
- USE_EXTERNAL_LCMS:=@USE_EXTERNAL_LCMS@
- LCMS_CFLAGS:=@LCMS_CFLAGS@
- LCMS_LIBS:=@LCMS_LIBS@
-diff --git a/make/modules/java.base/Gendata.gmk b/make/modules/java.base/Gendata.gmk
-index 9e5cfe2d0fc..434ade8e182 100644
---- a/make/modules/java.base/Gendata.gmk
-+++ b/make/modules/java.base/Gendata.gmk
-@@ -98,3 +98,17 @@ $(GENDATA_JAVA_SECURITY): $(BUILD_TOOLS_JDK) $(GENDATA_JAVA_SECURITY_SRC) $(REST
- TARGETS += $(GENDATA_JAVA_SECURITY)
- 
- ################################################################################
-+
-+GENDATA_NSS_FIPS_CFG_SRC := $(TOPDIR)/src/java.base/share/conf/security/nss.fips.cfg.in
-+GENDATA_NSS_FIPS_CFG := $(SUPPORT_OUTPUTDIR)/modules_conf/java.base/security/nss.fips.cfg
-+
-+$(GENDATA_NSS_FIPS_CFG): $(GENDATA_NSS_FIPS_CFG_SRC)
-+	$(call LogInfo, Generating nss.fips.cfg)
-+	$(call MakeTargetDir)
-+	$(call ExecuteWithLog, $(SUPPORT_OUTPUTDIR)/gensrc/java.base/_$(@F), \
-+	    ( $(SED) -e 's:@NSS_LIBDIR@:$(NSS_LIBDIR):g' $< ) > $@ \
-+	)
-+
-+TARGETS += $(GENDATA_NSS_FIPS_CFG)
-+
-+################################################################################
-diff --git a/make/modules/java.base/Lib.gmk b/make/modules/java.base/Lib.gmk
-index 1e0f66726d0..59fe923f2c5 100644
---- a/make/modules/java.base/Lib.gmk
-+++ b/make/modules/java.base/Lib.gmk
-@@ -163,6 +163,29 @@ ifeq ($(call isTargetOsType, unix), true)
-   endif
- endif
- 
-+################################################################################
-+# Create the systemconf library
-+
-+LIBSYSTEMCONF_CFLAGS :=
-+LIBSYSTEMCONF_CXXFLAGS :=
-+
-+ifeq ($(USE_SYSCONF_NSS), true)
-+  LIBSYSTEMCONF_CFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS
-+  LIBSYSTEMCONF_CXXFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS
-+endif
-+
-+$(eval $(call SetupJdkLibrary, BUILD_LIBSYSTEMCONF, \
-+    NAME := systemconf, \
-+    OPTIMIZATION := LOW, \
-+    CFLAGS := $(CFLAGS_JDKLIB) $(LIBSYSTEMCONF_CFLAGS), \
-+    CXXFLAGS := $(CXXFLAGS_JDKLIB) $(LIBSYSTEMCONF_CXXFLAGS), \
-+    LDFLAGS := $(LDFLAGS_JDKLIB) \
-+        $(call SET_SHARED_LIBRARY_ORIGIN), \
-+    LIBS_unix := $(LIBDL) $(NSS_LIBS), \
-+))
-+
-+TARGETS += $(BUILD_LIBSYSTEMCONF)
-+
- ################################################################################
- # Create the symbols file for static builds.
- 
-diff --git a/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java b/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java
-index 10093137151..b023c63ae58 100644
---- a/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java
-+++ b/src/java.base/share/classes/com/sun/crypto/provider/SunJCE.java
-@@ -31,6 +31,7 @@ import java.security.SecureRandom;
- import java.security.PrivilegedAction;
- import java.util.HashMap;
- import java.util.List;
-+import jdk.internal.access.SharedSecrets;
- import static sun.security.util.SecurityConstants.PROVIDER_VER;
- import static sun.security.util.SecurityProviderConstants.*;
- 
-@@ -82,6 +83,10 @@ import static sun.security.util.SecurityProviderConstants.*;
- 
- public final class SunJCE extends Provider {
- 
-+    private static final boolean systemFipsEnabled =
-+            SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+            .isSystemFipsEnabled();
-+
-     @java.io.Serial
-     private static final long serialVersionUID = 6812507587804302833L;
- 
-@@ -147,298 +152,299 @@ public final class SunJCE extends Provider {
-     void putEntries() {
-         // reuse attribute map and reset before each reuse
-         HashMap<String, String> attrs = new HashMap<>(3);
--        attrs.put("SupportedModes", "ECB");
--        attrs.put("SupportedPaddings", "NOPADDING|PKCS1PADDING|OAEPPADDING"
--                + "|OAEPWITHMD5ANDMGF1PADDING"
--                + "|OAEPWITHSHA1ANDMGF1PADDING"
--                + "|OAEPWITHSHA-1ANDMGF1PADDING"
--                + "|OAEPWITHSHA-224ANDMGF1PADDING"
--                + "|OAEPWITHSHA-256ANDMGF1PADDING"
--                + "|OAEPWITHSHA-384ANDMGF1PADDING"
--                + "|OAEPWITHSHA-512ANDMGF1PADDING"
--                + "|OAEPWITHSHA-512/224ANDMGF1PADDING"
--                + "|OAEPWITHSHA-512/256ANDMGF1PADDING");
--        attrs.put("SupportedKeyClasses",
--                "java.security.interfaces.RSAPublicKey" +
--                "|java.security.interfaces.RSAPrivateKey");
--        ps("Cipher", "RSA",
--                "com.sun.crypto.provider.RSACipher", null, attrs);
--
--        // common block cipher modes, pads
--        final String BLOCK_MODES = "ECB|CBC|PCBC|CTR|CTS|CFB|OFB" +
--            "|CFB8|CFB16|CFB24|CFB32|CFB40|CFB48|CFB56|CFB64" +
--            "|OFB8|OFB16|OFB24|OFB32|OFB40|OFB48|OFB56|OFB64";
--        final String BLOCK_MODES128 = BLOCK_MODES +
--            "|CFB72|CFB80|CFB88|CFB96|CFB104|CFB112|CFB120|CFB128" +
--            "|OFB72|OFB80|OFB88|OFB96|OFB104|OFB112|OFB120|OFB128";
--        final String BLOCK_PADS = "NOPADDING|PKCS5PADDING|ISO10126PADDING";
--
--        attrs.clear();
--        attrs.put("SupportedModes", BLOCK_MODES);
--        attrs.put("SupportedPaddings", BLOCK_PADS);
--        attrs.put("SupportedKeyFormats", "RAW");
--        ps("Cipher", "DES",
--                "com.sun.crypto.provider.DESCipher", null, attrs);
--        psA("Cipher", "DESede", "com.sun.crypto.provider.DESedeCipher",
--                attrs);
--        ps("Cipher", "Blowfish",
--                "com.sun.crypto.provider.BlowfishCipher", null, attrs);
--
--        ps("Cipher", "RC2",
--                "com.sun.crypto.provider.RC2Cipher", null, attrs);
--
--        attrs.clear();
--        attrs.put("SupportedModes", BLOCK_MODES128);
--        attrs.put("SupportedPaddings", BLOCK_PADS);
--        attrs.put("SupportedKeyFormats", "RAW");
--        psA("Cipher", "AES",
--                "com.sun.crypto.provider.AESCipher$General", attrs);
--
--        attrs.clear();
--        attrs.put("SupportedKeyFormats", "RAW");
--        psA("Cipher", "AES/KW/NoPadding",
--                "com.sun.crypto.provider.KeyWrapCipher$AES_KW_NoPadding",
--                attrs);
--        ps("Cipher", "AES/KW/PKCS5Padding",
--                "com.sun.crypto.provider.KeyWrapCipher$AES_KW_PKCS5Padding",
--                null, attrs);
--        psA("Cipher", "AES/KWP/NoPadding",
--                "com.sun.crypto.provider.KeyWrapCipher$AES_KWP_NoPadding",
--                attrs);
--
--        psA("Cipher", "AES_128/ECB/NoPadding",
--                "com.sun.crypto.provider.AESCipher$AES128_ECB_NoPadding",
--                attrs);
--        psA("Cipher", "AES_128/CBC/NoPadding",
--                "com.sun.crypto.provider.AESCipher$AES128_CBC_NoPadding",
--                attrs);
--        psA("Cipher", "AES_128/OFB/NoPadding",
--                "com.sun.crypto.provider.AESCipher$AES128_OFB_NoPadding",
--                attrs);
--        psA("Cipher", "AES_128/CFB/NoPadding",
--                "com.sun.crypto.provider.AESCipher$AES128_CFB_NoPadding",
--                attrs);
--        psA("Cipher", "AES_128/KW/NoPadding",
--                "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_NoPadding",
--                attrs);
--        ps("Cipher", "AES_128/KW/PKCS5Padding",
--                "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_PKCS5Padding",
--                null, attrs);
--        psA("Cipher", "AES_128/KWP/NoPadding",
--                "com.sun.crypto.provider.KeyWrapCipher$AES128_KWP_NoPadding",
--                attrs);
--
--        psA("Cipher", "AES_192/ECB/NoPadding",
--                "com.sun.crypto.provider.AESCipher$AES192_ECB_NoPadding",
--                attrs);
--        psA("Cipher", "AES_192/CBC/NoPadding",
--                "com.sun.crypto.provider.AESCipher$AES192_CBC_NoPadding",
--                attrs);
--        psA("Cipher", "AES_192/OFB/NoPadding",
--                "com.sun.crypto.provider.AESCipher$AES192_OFB_NoPadding",
--                attrs);
--        psA("Cipher", "AES_192/CFB/NoPadding",
--                "com.sun.crypto.provider.AESCipher$AES192_CFB_NoPadding",
--                attrs);
--        psA("Cipher", "AES_192/KW/NoPadding",
--                "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_NoPadding",
--                attrs);
--        ps("Cipher", "AES_192/KW/PKCS5Padding",
--                "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_PKCS5Padding",
--                null, attrs);
--        psA("Cipher", "AES_192/KWP/NoPadding",
--                "com.sun.crypto.provider.KeyWrapCipher$AES192_KWP_NoPadding",
--                attrs);
--
--        psA("Cipher", "AES_256/ECB/NoPadding",
--                "com.sun.crypto.provider.AESCipher$AES256_ECB_NoPadding",
--                attrs);
--        psA("Cipher", "AES_256/CBC/NoPadding",
--                "com.sun.crypto.provider.AESCipher$AES256_CBC_NoPadding",
--                attrs);
--        psA("Cipher", "AES_256/OFB/NoPadding",
--                "com.sun.crypto.provider.AESCipher$AES256_OFB_NoPadding",
--                attrs);
--        psA("Cipher", "AES_256/CFB/NoPadding",
--                "com.sun.crypto.provider.AESCipher$AES256_CFB_NoPadding",
--                attrs);
--        psA("Cipher", "AES_256/KW/NoPadding",
--                "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_NoPadding",
--                attrs);
--        ps("Cipher", "AES_256/KW/PKCS5Padding",
--                "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_PKCS5Padding",
--                null, attrs);
--        psA("Cipher", "AES_256/KWP/NoPadding",
--                "com.sun.crypto.provider.KeyWrapCipher$AES256_KWP_NoPadding",
--                attrs);
--
--        attrs.clear();
--        attrs.put("SupportedModes", "GCM");
--        attrs.put("SupportedKeyFormats", "RAW");
--
--        ps("Cipher", "AES/GCM/NoPadding",
--                "com.sun.crypto.provider.GaloisCounterMode$AESGCM", null,
--                attrs);
--        psA("Cipher", "AES_128/GCM/NoPadding",
--                "com.sun.crypto.provider.GaloisCounterMode$AES128",
--                attrs);
--        psA("Cipher", "AES_192/GCM/NoPadding",
--                "com.sun.crypto.provider.GaloisCounterMode$AES192",
--                attrs);
--        psA("Cipher", "AES_256/GCM/NoPadding",
--                "com.sun.crypto.provider.GaloisCounterMode$AES256",
--                attrs);
--
--        attrs.clear();
--        attrs.put("SupportedModes", "CBC");
--        attrs.put("SupportedPaddings", "NOPADDING");
--        attrs.put("SupportedKeyFormats", "RAW");
--        ps("Cipher", "DESedeWrap",
--                "com.sun.crypto.provider.DESedeWrapCipher", null, attrs);
--
--        attrs.clear();
--        attrs.put("SupportedModes", "ECB");
--        attrs.put("SupportedPaddings", "NOPADDING");
--        attrs.put("SupportedKeyFormats", "RAW");
--        psA("Cipher", "ARCFOUR",
--                "com.sun.crypto.provider.ARCFOURCipher", attrs);
--
--        attrs.clear();
--        attrs.put("SupportedKeyFormats", "RAW");
--        ps("Cipher",  "ChaCha20",
--                "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Only",
--                null, attrs);
--        psA("Cipher",  "ChaCha20-Poly1305",
--                "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Poly1305",
--                attrs);
--
--        // PBES1
--        psA("Cipher", "PBEWithMD5AndDES",
--                "com.sun.crypto.provider.PBEWithMD5AndDESCipher",
--                null);
--        ps("Cipher", "PBEWithMD5AndTripleDES",
--                "com.sun.crypto.provider.PBEWithMD5AndTripleDESCipher");
--        psA("Cipher", "PBEWithSHA1AndDESede",
--                "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndDESede",
--                null);
--        psA("Cipher", "PBEWithSHA1AndRC2_40",
--                "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_40",
--                null);
--        psA("Cipher", "PBEWithSHA1AndRC2_128",
--                "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_128",
--                null);
--        psA("Cipher", "PBEWithSHA1AndRC4_40",
--                "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_40",
--                null);
--
--        psA("Cipher", "PBEWithSHA1AndRC4_128",
--                "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_128",
--                null);
--
--        // PBES2
--        ps("Cipher", "PBEWithHmacSHA1AndAES_128",
--                "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_128");
--
--        ps("Cipher", "PBEWithHmacSHA224AndAES_128",
--                "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_128");
--
--        ps("Cipher", "PBEWithHmacSHA256AndAES_128",
--                "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_128");
--
--        ps("Cipher", "PBEWithHmacSHA384AndAES_128",
--                "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_128");
--
--        ps("Cipher", "PBEWithHmacSHA512AndAES_128",
--                "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_128");
--
--        ps("Cipher", "PBEWithHmacSHA512/224AndAES_128",
--                "com.sun.crypto.provider.PBES2Core$HmacSHA512_224AndAES_128");
--
--        ps("Cipher", "PBEWithHmacSHA512/256AndAES_128",
--                "com.sun.crypto.provider.PBES2Core$HmacSHA512_256AndAES_128");
--
--
--        ps("Cipher", "PBEWithHmacSHA1AndAES_256",
--                "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_256");
--
--        ps("Cipher", "PBEWithHmacSHA224AndAES_256",
--                "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_256");
--
--        ps("Cipher", "PBEWithHmacSHA256AndAES_256",
--                "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_256");
--
--        ps("Cipher", "PBEWithHmacSHA384AndAES_256",
--                "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_256");
--
--        ps("Cipher", "PBEWithHmacSHA512AndAES_256",
--                "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_256");
--
--        ps("Cipher", "PBEWithHmacSHA512/224AndAES_256",
--                "com.sun.crypto.provider.PBES2Core$HmacSHA512_224AndAES_256");
--
--        ps("Cipher", "PBEWithHmacSHA512/256AndAES_256",
--                "com.sun.crypto.provider.PBES2Core$HmacSHA512_256AndAES_256");
--
--        /*
--         * Key(pair) Generator engines
--         */
--        ps("KeyGenerator", "DES",
--                "com.sun.crypto.provider.DESKeyGenerator");
--        psA("KeyGenerator", "DESede",
--                "com.sun.crypto.provider.DESedeKeyGenerator",
--                null);
--        ps("KeyGenerator", "Blowfish",
--                "com.sun.crypto.provider.BlowfishKeyGenerator");
--        psA("KeyGenerator", "AES",
--                "com.sun.crypto.provider.AESKeyGenerator",
--                null);
--        ps("KeyGenerator", "RC2",
--                "com.sun.crypto.provider.KeyGeneratorCore$RC2KeyGenerator");
--        psA("KeyGenerator", "ARCFOUR",
--                "com.sun.crypto.provider.KeyGeneratorCore$ARCFOURKeyGenerator",
--                null);
--        ps("KeyGenerator", "ChaCha20",
--                "com.sun.crypto.provider.KeyGeneratorCore$ChaCha20KeyGenerator");
--        ps("KeyGenerator", "HmacMD5",
--                "com.sun.crypto.provider.HmacMD5KeyGenerator");
--
--        psA("KeyGenerator", "HmacSHA1",
--                "com.sun.crypto.provider.HmacSHA1KeyGenerator", null);
--        psA("KeyGenerator", "HmacSHA224",
--                "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA224",
--                null);
--        psA("KeyGenerator", "HmacSHA256",
--                "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA256",
--                null);
--        psA("KeyGenerator", "HmacSHA384",
--                "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA384",
--                null);
--        psA("KeyGenerator", "HmacSHA512",
--                "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512",
--                null);
--        psA("KeyGenerator", "HmacSHA512/224",
--                "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_224",
--                null);
--        psA("KeyGenerator", "HmacSHA512/256",
--                "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_256",
--                null);
--
--        psA("KeyGenerator", "HmacSHA3-224",
--                "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_224",
--                null);
--        psA("KeyGenerator", "HmacSHA3-256",
--                "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_256",
--                null);
--        psA("KeyGenerator", "HmacSHA3-384",
--                "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_384",
--                null);
--        psA("KeyGenerator", "HmacSHA3-512",
--                "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_512",
--                null);
--
--        psA("KeyPairGenerator", "DiffieHellman",
--                "com.sun.crypto.provider.DHKeyPairGenerator",
--                null);
-+        if (!systemFipsEnabled) {
-+            attrs.put("SupportedModes", "ECB");
-+            attrs.put("SupportedPaddings", "NOPADDING|PKCS1PADDING|OAEPPADDING"
-+                    + "|OAEPWITHMD5ANDMGF1PADDING"
-+                    + "|OAEPWITHSHA1ANDMGF1PADDING"
-+                    + "|OAEPWITHSHA-1ANDMGF1PADDING"
-+                    + "|OAEPWITHSHA-224ANDMGF1PADDING"
-+                    + "|OAEPWITHSHA-256ANDMGF1PADDING"
-+                    + "|OAEPWITHSHA-384ANDMGF1PADDING"
-+                    + "|OAEPWITHSHA-512ANDMGF1PADDING"
-+                    + "|OAEPWITHSHA-512/224ANDMGF1PADDING"
-+                    + "|OAEPWITHSHA-512/256ANDMGF1PADDING");
-+            attrs.put("SupportedKeyClasses",
-+                    "java.security.interfaces.RSAPublicKey" +
-+                    "|java.security.interfaces.RSAPrivateKey");
-+            ps("Cipher", "RSA",
-+                    "com.sun.crypto.provider.RSACipher", null, attrs);
-+
-+            // common block cipher modes, pads
-+            final String BLOCK_MODES = "ECB|CBC|PCBC|CTR|CTS|CFB|OFB" +
-+                "|CFB8|CFB16|CFB24|CFB32|CFB40|CFB48|CFB56|CFB64" +
-+                "|OFB8|OFB16|OFB24|OFB32|OFB40|OFB48|OFB56|OFB64";
-+            final String BLOCK_MODES128 = BLOCK_MODES +
-+                "|CFB72|CFB80|CFB88|CFB96|CFB104|CFB112|CFB120|CFB128" +
-+                "|OFB72|OFB80|OFB88|OFB96|OFB104|OFB112|OFB120|OFB128";
-+            final String BLOCK_PADS = "NOPADDING|PKCS5PADDING|ISO10126PADDING";
-+
-+            attrs.clear();
-+            attrs.put("SupportedModes", BLOCK_MODES);
-+            attrs.put("SupportedPaddings", BLOCK_PADS);
-+            attrs.put("SupportedKeyFormats", "RAW");
-+            ps("Cipher", "DES",
-+                    "com.sun.crypto.provider.DESCipher", null, attrs);
-+            psA("Cipher", "DESede", "com.sun.crypto.provider.DESedeCipher",
-+                    attrs);
-+            ps("Cipher", "Blowfish",
-+                    "com.sun.crypto.provider.BlowfishCipher", null, attrs);
-+
-+            ps("Cipher", "RC2",
-+                    "com.sun.crypto.provider.RC2Cipher", null, attrs);
-+
-+            attrs.clear();
-+            attrs.put("SupportedModes", BLOCK_MODES128);
-+            attrs.put("SupportedPaddings", BLOCK_PADS);
-+            attrs.put("SupportedKeyFormats", "RAW");
-+            psA("Cipher", "AES",
-+                    "com.sun.crypto.provider.AESCipher$General", attrs);
-+
-+            attrs.clear();
-+            attrs.put("SupportedKeyFormats", "RAW");
-+            psA("Cipher", "AES/KW/NoPadding",
-+                    "com.sun.crypto.provider.KeyWrapCipher$AES_KW_NoPadding",
-+                    attrs);
-+            ps("Cipher", "AES/KW/PKCS5Padding",
-+                    "com.sun.crypto.provider.KeyWrapCipher$AES_KW_PKCS5Padding",
-+                    null, attrs);
-+            psA("Cipher", "AES/KWP/NoPadding",
-+                    "com.sun.crypto.provider.KeyWrapCipher$AES_KWP_NoPadding",
-+                    attrs);
-+
-+            psA("Cipher", "AES_128/ECB/NoPadding",
-+                    "com.sun.crypto.provider.AESCipher$AES128_ECB_NoPadding",
-+                    attrs);
-+            psA("Cipher", "AES_128/CBC/NoPadding",
-+                    "com.sun.crypto.provider.AESCipher$AES128_CBC_NoPadding",
-+                    attrs);
-+            psA("Cipher", "AES_128/OFB/NoPadding",
-+                    "com.sun.crypto.provider.AESCipher$AES128_OFB_NoPadding",
-+                    attrs);
-+            psA("Cipher", "AES_128/CFB/NoPadding",
-+                    "com.sun.crypto.provider.AESCipher$AES128_CFB_NoPadding",
-+                    attrs);
-+            psA("Cipher", "AES_128/KW/NoPadding",
-+                    "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_NoPadding",
-+                    attrs);
-+            ps("Cipher", "AES_128/KW/PKCS5Padding",
-+                    "com.sun.crypto.provider.KeyWrapCipher$AES128_KW_PKCS5Padding",
-+                    null, attrs);
-+            psA("Cipher", "AES_128/KWP/NoPadding",
-+                    "com.sun.crypto.provider.KeyWrapCipher$AES128_KWP_NoPadding",
-+                    attrs);
-+
-+            psA("Cipher", "AES_192/ECB/NoPadding",
-+                    "com.sun.crypto.provider.AESCipher$AES192_ECB_NoPadding",
-+                    attrs);
-+            psA("Cipher", "AES_192/CBC/NoPadding",
-+                    "com.sun.crypto.provider.AESCipher$AES192_CBC_NoPadding",
-+                    attrs);
-+            psA("Cipher", "AES_192/OFB/NoPadding",
-+                    "com.sun.crypto.provider.AESCipher$AES192_OFB_NoPadding",
-+                    attrs);
-+            psA("Cipher", "AES_192/CFB/NoPadding",
-+                    "com.sun.crypto.provider.AESCipher$AES192_CFB_NoPadding",
-+                    attrs);
-+            psA("Cipher", "AES_192/KW/NoPadding",
-+                    "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_NoPadding",
-+                    attrs);
-+            ps("Cipher", "AES_192/KW/PKCS5Padding",
-+                    "com.sun.crypto.provider.KeyWrapCipher$AES192_KW_PKCS5Padding",
-+                    null, attrs);
-+            psA("Cipher", "AES_192/KWP/NoPadding",
-+                    "com.sun.crypto.provider.KeyWrapCipher$AES192_KWP_NoPadding",
-+                    attrs);
-+
-+            psA("Cipher", "AES_256/ECB/NoPadding",
-+                    "com.sun.crypto.provider.AESCipher$AES256_ECB_NoPadding",
-+                    attrs);
-+            psA("Cipher", "AES_256/CBC/NoPadding",
-+                    "com.sun.crypto.provider.AESCipher$AES256_CBC_NoPadding",
-+                    attrs);
-+            psA("Cipher", "AES_256/OFB/NoPadding",
-+                    "com.sun.crypto.provider.AESCipher$AES256_OFB_NoPadding",
-+                    attrs);
-+            psA("Cipher", "AES_256/CFB/NoPadding",
-+                    "com.sun.crypto.provider.AESCipher$AES256_CFB_NoPadding",
-+                    attrs);
-+            psA("Cipher", "AES_256/KW/NoPadding",
-+                    "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_NoPadding",
-+                    attrs);
-+            ps("Cipher", "AES_256/KW/PKCS5Padding",
-+                    "com.sun.crypto.provider.KeyWrapCipher$AES256_KW_PKCS5Padding",
-+                    null, attrs);
-+            psA("Cipher", "AES_256/KWP/NoPadding",
-+                    "com.sun.crypto.provider.KeyWrapCipher$AES256_KWP_NoPadding",
-+                    attrs);
-+
-+            attrs.clear();
-+            attrs.put("SupportedModes", "GCM");
-+            attrs.put("SupportedKeyFormats", "RAW");
-+
-+            ps("Cipher", "AES/GCM/NoPadding",
-+                    "com.sun.crypto.provider.GaloisCounterMode$AESGCM", null,
-+                    attrs);
-+            psA("Cipher", "AES_128/GCM/NoPadding",
-+                    "com.sun.crypto.provider.GaloisCounterMode$AES128",
-+                    attrs);
-+            psA("Cipher", "AES_192/GCM/NoPadding",
-+                    "com.sun.crypto.provider.GaloisCounterMode$AES192",
-+                    attrs);
-+            psA("Cipher", "AES_256/GCM/NoPadding",
-+                    "com.sun.crypto.provider.GaloisCounterMode$AES256",
-+                    attrs);
-+
-+            attrs.clear();
-+            attrs.put("SupportedModes", "CBC");
-+            attrs.put("SupportedPaddings", "NOPADDING");
-+            attrs.put("SupportedKeyFormats", "RAW");
-+            ps("Cipher", "DESedeWrap",
-+                    "com.sun.crypto.provider.DESedeWrapCipher", null, attrs);
-+
-+            attrs.clear();
-+            attrs.put("SupportedModes", "ECB");
-+            attrs.put("SupportedPaddings", "NOPADDING");
-+            attrs.put("SupportedKeyFormats", "RAW");
-+            psA("Cipher", "ARCFOUR",
-+                    "com.sun.crypto.provider.ARCFOURCipher", attrs);
-+
-+            attrs.clear();
-+            attrs.put("SupportedKeyFormats", "RAW");
-+            ps("Cipher",  "ChaCha20",
-+                    "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Only",
-+                    null, attrs);
-+            psA("Cipher",  "ChaCha20-Poly1305",
-+                    "com.sun.crypto.provider.ChaCha20Cipher$ChaCha20Poly1305",
-+                    attrs);
-+
-+            // PBES1
-+            psA("Cipher", "PBEWithMD5AndDES",
-+                    "com.sun.crypto.provider.PBEWithMD5AndDESCipher",
-+                    null);
-+            ps("Cipher", "PBEWithMD5AndTripleDES",
-+                    "com.sun.crypto.provider.PBEWithMD5AndTripleDESCipher");
-+            psA("Cipher", "PBEWithSHA1AndDESede",
-+                    "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndDESede",
-+                    null);
-+            psA("Cipher", "PBEWithSHA1AndRC2_40",
-+                    "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_40",
-+                    null);
-+            psA("Cipher", "PBEWithSHA1AndRC2_128",
-+                    "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC2_128",
-+                    null);
-+            psA("Cipher", "PBEWithSHA1AndRC4_40",
-+                    "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_40",
-+                    null);
-+
-+            psA("Cipher", "PBEWithSHA1AndRC4_128",
-+                    "com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndRC4_128",
-+                    null);
-+
-+            // PBES2
-+            ps("Cipher", "PBEWithHmacSHA1AndAES_128",
-+                    "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_128");
-+
-+            ps("Cipher", "PBEWithHmacSHA224AndAES_128",
-+                    "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_128");
-+
-+            ps("Cipher", "PBEWithHmacSHA256AndAES_128",
-+                    "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_128");
-+
-+            ps("Cipher", "PBEWithHmacSHA384AndAES_128",
-+                    "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_128");
-+
-+            ps("Cipher", "PBEWithHmacSHA512AndAES_128",
-+                    "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_128");
-+
-+            ps("Cipher", "PBEWithHmacSHA512/224AndAES_128",
-+                    "com.sun.crypto.provider.PBES2Core$HmacSHA512_224AndAES_128");
-+
-+            ps("Cipher", "PBEWithHmacSHA512/256AndAES_128",
-+                    "com.sun.crypto.provider.PBES2Core$HmacSHA512_256AndAES_128");
-+
-+            ps("Cipher", "PBEWithHmacSHA1AndAES_256",
-+                    "com.sun.crypto.provider.PBES2Core$HmacSHA1AndAES_256");
-+
-+            ps("Cipher", "PBEWithHmacSHA224AndAES_256",
-+                    "com.sun.crypto.provider.PBES2Core$HmacSHA224AndAES_256");
-+
-+            ps("Cipher", "PBEWithHmacSHA256AndAES_256",
-+                    "com.sun.crypto.provider.PBES2Core$HmacSHA256AndAES_256");
-+
-+            ps("Cipher", "PBEWithHmacSHA384AndAES_256",
-+                    "com.sun.crypto.provider.PBES2Core$HmacSHA384AndAES_256");
-+
-+            ps("Cipher", "PBEWithHmacSHA512AndAES_256",
-+                    "com.sun.crypto.provider.PBES2Core$HmacSHA512AndAES_256");
-+
-+            ps("Cipher", "PBEWithHmacSHA512/224AndAES_256",
-+                    "com.sun.crypto.provider.PBES2Core$HmacSHA512_224AndAES_256");
-+
-+            ps("Cipher", "PBEWithHmacSHA512/256AndAES_256",
-+                    "com.sun.crypto.provider.PBES2Core$HmacSHA512_256AndAES_256");
-+
-+            /*
-+             * Key(pair) Generator engines
-+             */
-+            ps("KeyGenerator", "DES",
-+                    "com.sun.crypto.provider.DESKeyGenerator");
-+            psA("KeyGenerator", "DESede",
-+                    "com.sun.crypto.provider.DESedeKeyGenerator",
-+                    null);
-+            ps("KeyGenerator", "Blowfish",
-+                    "com.sun.crypto.provider.BlowfishKeyGenerator");
-+            psA("KeyGenerator", "AES",
-+                    "com.sun.crypto.provider.AESKeyGenerator",
-+                    null);
-+            ps("KeyGenerator", "RC2",
-+                    "com.sun.crypto.provider.KeyGeneratorCore$RC2KeyGenerator");
-+            psA("KeyGenerator", "ARCFOUR",
-+                    "com.sun.crypto.provider.KeyGeneratorCore$ARCFOURKeyGenerator",
-+                    null);
-+            ps("KeyGenerator", "ChaCha20",
-+                    "com.sun.crypto.provider.KeyGeneratorCore$ChaCha20KeyGenerator");
-+            ps("KeyGenerator", "HmacMD5",
-+                    "com.sun.crypto.provider.HmacMD5KeyGenerator");
-+
-+            psA("KeyGenerator", "HmacSHA1",
-+                    "com.sun.crypto.provider.HmacSHA1KeyGenerator", null);
-+            psA("KeyGenerator", "HmacSHA224",
-+                    "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA224",
-+                    null);
-+            psA("KeyGenerator", "HmacSHA256",
-+                    "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA256",
-+                    null);
-+            psA("KeyGenerator", "HmacSHA384",
-+                    "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA384",
-+                    null);
-+            psA("KeyGenerator", "HmacSHA512",
-+                    "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512",
-+                    null);
-+            psA("KeyGenerator", "HmacSHA512/224",
-+                    "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_224",
-+                    null);
-+            psA("KeyGenerator", "HmacSHA512/256",
-+                    "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA512_256",
-+                    null);
-+
-+            psA("KeyGenerator", "HmacSHA3-224",
-+                    "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_224",
-+                    null);
-+            psA("KeyGenerator", "HmacSHA3-256",
-+                    "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_256",
-+                    null);
-+            psA("KeyGenerator", "HmacSHA3-384",
-+                    "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_384",
-+                    null);
-+            psA("KeyGenerator", "HmacSHA3-512",
-+                    "com.sun.crypto.provider.KeyGeneratorCore$HmacKG$SHA3_512",
-+                    null);
-+
-+            psA("KeyPairGenerator", "DiffieHellman",
-+                    "com.sun.crypto.provider.DHKeyPairGenerator",
-+                    null);
-+        }
- 
-         /*
-          * Algorithm parameter generation engines
-@@ -447,15 +453,17 @@ public final class SunJCE extends Provider {
-                 "DiffieHellman", "com.sun.crypto.provider.DHParameterGenerator",
-                 null);
- 
--        /*
--         * Key Agreement engines
--         */
--        attrs.clear();
--        attrs.put("SupportedKeyClasses", "javax.crypto.interfaces.DHPublicKey" +
--                        "|javax.crypto.interfaces.DHPrivateKey");
--        psA("KeyAgreement", "DiffieHellman",
--                "com.sun.crypto.provider.DHKeyAgreement",
--                attrs);
-+        if (!systemFipsEnabled) {
-+            /*
-+             * Key Agreement engines
-+             */
-+            attrs.clear();
-+            attrs.put("SupportedKeyClasses", "javax.crypto.interfaces.DHPublicKey" +
-+                            "|javax.crypto.interfaces.DHPrivateKey");
-+            psA("KeyAgreement", "DiffieHellman",
-+                    "com.sun.crypto.provider.DHKeyAgreement",
-+                    attrs);
-+        }
- 
-         /*
-          * Algorithm Parameter engines
-@@ -625,10 +633,10 @@ public final class SunJCE extends Provider {
-                 "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512AndAES_128");
- 
-         ps("SecretKeyFactory", "PBEWithHmacSHA512/224AndAES_128",
--                "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_224AndAES_128");
-+               "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_224AndAES_128");
- 
-         ps("SecretKeyFactory", "PBEWithHmacSHA512/256AndAES_128",
--                "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_256AndAES_128");
-+               "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_256AndAES_128");
- 
-         ps("SecretKeyFactory", "PBEWithHmacSHA1AndAES_256",
-                 "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA1AndAES_256");
-@@ -651,136 +659,137 @@ public final class SunJCE extends Provider {
-         ps("SecretKeyFactory", "PBEWithHmacSHA512/256AndAES_256",
-                 "com.sun.crypto.provider.PBEKeyFactory$PBEWithHmacSHA512_256AndAES_256");
- 
--        // PBKDF2
--        psA("SecretKeyFactory", "PBKDF2WithHmacSHA1",
--                "com.sun.crypto.provider.PBKDF2Core$HmacSHA1",
--                null);
--        ps("SecretKeyFactory", "PBKDF2WithHmacSHA224",
--                "com.sun.crypto.provider.PBKDF2Core$HmacSHA224");
--        ps("SecretKeyFactory", "PBKDF2WithHmacSHA256",
--                "com.sun.crypto.provider.PBKDF2Core$HmacSHA256");
--        ps("SecretKeyFactory", "PBKDF2WithHmacSHA384",
--                "com.sun.crypto.provider.PBKDF2Core$HmacSHA384");
--        ps("SecretKeyFactory", "PBKDF2WithHmacSHA512",
--                "com.sun.crypto.provider.PBKDF2Core$HmacSHA512");
--        ps("SecretKeyFactory", "PBKDF2WithHmacSHA512/224",
--                "com.sun.crypto.provider.PBKDF2Core$HmacSHA512_224");
--        ps("SecretKeyFactory", "PBKDF2WithHmacSHA512/256",
--                "com.sun.crypto.provider.PBKDF2Core$HmacSHA512_256");
--
--        /*
--         * MAC
--         */
--        attrs.clear();
--        attrs.put("SupportedKeyFormats", "RAW");
--        ps("Mac", "HmacMD5", "com.sun.crypto.provider.HmacMD5", null, attrs);
--        psA("Mac", "HmacSHA1", "com.sun.crypto.provider.HmacSHA1",
--                attrs);
--        psA("Mac", "HmacSHA224",
--                "com.sun.crypto.provider.HmacCore$HmacSHA224", attrs);
--        psA("Mac", "HmacSHA256",
--                "com.sun.crypto.provider.HmacCore$HmacSHA256", attrs);
--        psA("Mac", "HmacSHA384",
--                "com.sun.crypto.provider.HmacCore$HmacSHA384", attrs);
--        psA("Mac", "HmacSHA512",
--                "com.sun.crypto.provider.HmacCore$HmacSHA512", attrs);
--        psA("Mac", "HmacSHA512/224",
--                "com.sun.crypto.provider.HmacCore$HmacSHA512_224", attrs);
--        psA("Mac", "HmacSHA512/256",
--                "com.sun.crypto.provider.HmacCore$HmacSHA512_256", attrs);
--        psA("Mac", "HmacSHA3-224",
--                "com.sun.crypto.provider.HmacCore$HmacSHA3_224", attrs);
--        psA("Mac", "HmacSHA3-256",
--                "com.sun.crypto.provider.HmacCore$HmacSHA3_256", attrs);
--        psA("Mac", "HmacSHA3-384",
--                "com.sun.crypto.provider.HmacCore$HmacSHA3_384", attrs);
--        psA("Mac", "HmacSHA3-512",
--                "com.sun.crypto.provider.HmacCore$HmacSHA3_512", attrs);
--
--        ps("Mac", "HmacPBESHA1",
--                "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA1",
--                null, attrs);
--        ps("Mac", "HmacPBESHA224",
--                "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA224",
--                null, attrs);
--        ps("Mac", "HmacPBESHA256",
--                "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA256",
--                null, attrs);
--        ps("Mac", "HmacPBESHA384",
--                "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA384",
--                null, attrs);
--        ps("Mac", "HmacPBESHA512",
--                "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512",
--                null, attrs);
--        ps("Mac", "HmacPBESHA512/224",
--                "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512_224",
--                null, attrs);
--        ps("Mac", "HmacPBESHA512/256",
--                "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512_256",
--                null, attrs);
--
--
--        // PBMAC1
--        ps("Mac", "PBEWithHmacSHA1",
--                "com.sun.crypto.provider.PBMAC1Core$HmacSHA1", null, attrs);
--        ps("Mac", "PBEWithHmacSHA224",
--                "com.sun.crypto.provider.PBMAC1Core$HmacSHA224", null, attrs);
--        ps("Mac", "PBEWithHmacSHA256",
--                "com.sun.crypto.provider.PBMAC1Core$HmacSHA256", null, attrs);
--        ps("Mac", "PBEWithHmacSHA384",
--                "com.sun.crypto.provider.PBMAC1Core$HmacSHA384", null, attrs);
--        ps("Mac", "PBEWithHmacSHA512",
--                "com.sun.crypto.provider.PBMAC1Core$HmacSHA512", null, attrs);
--        ps("Mac", "PBEWithHmacSHA512/224",
--                "com.sun.crypto.provider.PBMAC1Core$HmacSHA512_224", null, attrs);
--        ps("Mac", "PBEWithHmacSHA512/256",
--                "com.sun.crypto.provider.PBMAC1Core$HmacSHA512_256", null, attrs);
--
--        ps("Mac", "SslMacMD5",
--                "com.sun.crypto.provider.SslMacCore$SslMacMD5", null, attrs);
--        ps("Mac", "SslMacSHA1",
--                "com.sun.crypto.provider.SslMacCore$SslMacSHA1", null, attrs);
--
--        /*
--         * KeyStore
--         */
--        ps("KeyStore", "JCEKS",
--                "com.sun.crypto.provider.JceKeyStore");
--
--        /*
--         * KEMs
--         */
--        attrs.clear();
--        attrs.put("ImplementedIn", "Software");
--        attrs.put("SupportedKeyClasses", "java.security.interfaces.ECKey" +
--                "|java.security.interfaces.XECKey");
--        ps("KEM", "DHKEM", "com.sun.crypto.provider.DHKEM", null, attrs);
--
--        /*
--         * SSL/TLS mechanisms
--         *
--         * These are strictly internal implementations and may
--         * be changed at any time.  These names were chosen
--         * because PKCS11/SunPKCS11 does not yet have TLS1.2
--         * mechanisms, and it will cause calls to come here.
--         */
--        ps("KeyGenerator", "SunTlsPrf",
--                "com.sun.crypto.provider.TlsPrfGenerator$V10");
--        ps("KeyGenerator", "SunTls12Prf",
--                "com.sun.crypto.provider.TlsPrfGenerator$V12");
--
--        ps("KeyGenerator", "SunTlsMasterSecret",
--                "com.sun.crypto.provider.TlsMasterSecretGenerator",
--                List.of("SunTls12MasterSecret", "SunTlsExtendedMasterSecret"),
--                null);
--
--        ps("KeyGenerator", "SunTlsKeyMaterial",
--                "com.sun.crypto.provider.TlsKeyMaterialGenerator",
--                List.of("SunTls12KeyMaterial"), null);
--
--        ps("KeyGenerator", "SunTlsRsaPremasterSecret",
--                "com.sun.crypto.provider.TlsRsaPremasterSecretGenerator",
--                List.of("SunTls12RsaPremasterSecret"), null);
-+        if (!systemFipsEnabled) {
-+            // PBKDF2
-+            psA("SecretKeyFactory", "PBKDF2WithHmacSHA1",
-+                    "com.sun.crypto.provider.PBKDF2Core$HmacSHA1",
-+                    null);
-+            ps("SecretKeyFactory", "PBKDF2WithHmacSHA224",
-+                    "com.sun.crypto.provider.PBKDF2Core$HmacSHA224");
-+            ps("SecretKeyFactory", "PBKDF2WithHmacSHA256",
-+                    "com.sun.crypto.provider.PBKDF2Core$HmacSHA256");
-+            ps("SecretKeyFactory", "PBKDF2WithHmacSHA384",
-+                    "com.sun.crypto.provider.PBKDF2Core$HmacSHA384");
-+            ps("SecretKeyFactory", "PBKDF2WithHmacSHA512",
-+                    "com.sun.crypto.provider.PBKDF2Core$HmacSHA512");
-+            ps("SecretKeyFactory", "PBKDF2WithHmacSHA512/224",
-+                    "com.sun.crypto.provider.PBKDF2Core$HmacSHA512_224");
-+            ps("SecretKeyFactory", "PBKDF2WithHmacSHA512/256",
-+                    "com.sun.crypto.provider.PBKDF2Core$HmacSHA512_256");
-+
-+            /*
-+             * MAC
-+             */
-+            attrs.clear();
-+            attrs.put("SupportedKeyFormats", "RAW");
-+            ps("Mac", "HmacMD5", "com.sun.crypto.provider.HmacMD5", null, attrs);
-+            psA("Mac", "HmacSHA1", "com.sun.crypto.provider.HmacSHA1",
-+                    attrs);
-+            psA("Mac", "HmacSHA224",
-+                    "com.sun.crypto.provider.HmacCore$HmacSHA224", attrs);
-+            psA("Mac", "HmacSHA256",
-+                    "com.sun.crypto.provider.HmacCore$HmacSHA256", attrs);
-+            psA("Mac", "HmacSHA384",
-+                    "com.sun.crypto.provider.HmacCore$HmacSHA384", attrs);
-+            psA("Mac", "HmacSHA512",
-+                    "com.sun.crypto.provider.HmacCore$HmacSHA512", attrs);
-+            psA("Mac", "HmacSHA512/224",
-+                    "com.sun.crypto.provider.HmacCore$HmacSHA512_224", attrs);
-+            psA("Mac", "HmacSHA512/256",
-+                    "com.sun.crypto.provider.HmacCore$HmacSHA512_256", attrs);
-+            psA("Mac", "HmacSHA3-224",
-+                    "com.sun.crypto.provider.HmacCore$HmacSHA3_224", attrs);
-+            psA("Mac", "HmacSHA3-256",
-+                    "com.sun.crypto.provider.HmacCore$HmacSHA3_256", attrs);
-+            psA("Mac", "HmacSHA3-384",
-+                    "com.sun.crypto.provider.HmacCore$HmacSHA3_384", attrs);
-+            psA("Mac", "HmacSHA3-512",
-+                    "com.sun.crypto.provider.HmacCore$HmacSHA3_512", attrs);
-+
-+            ps("Mac", "HmacPBESHA1",
-+                    "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA1",
-+                    null, attrs);
-+            ps("Mac", "HmacPBESHA224",
-+                    "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA224",
-+                    null, attrs);
-+            ps("Mac", "HmacPBESHA256",
-+                    "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA256",
-+                    null, attrs);
-+            ps("Mac", "HmacPBESHA384",
-+                    "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA384",
-+                    null, attrs);
-+            ps("Mac", "HmacPBESHA512",
-+                    "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512",
-+                    null, attrs);
-+            ps("Mac", "HmacPBESHA512/224",
-+                    "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512_224",
-+                    null, attrs);
-+            ps("Mac", "HmacPBESHA512/256",
-+                    "com.sun.crypto.provider.HmacPKCS12PBECore$HmacPKCS12PBE_SHA512_256",
-+                    null, attrs);
-+
-+            // PBMAC1
-+            ps("Mac", "PBEWithHmacSHA1",
-+                    "com.sun.crypto.provider.PBMAC1Core$HmacSHA1", null, attrs);
-+            ps("Mac", "PBEWithHmacSHA224",
-+                    "com.sun.crypto.provider.PBMAC1Core$HmacSHA224", null, attrs);
-+            ps("Mac", "PBEWithHmacSHA256",
-+                    "com.sun.crypto.provider.PBMAC1Core$HmacSHA256", null, attrs);
-+            ps("Mac", "PBEWithHmacSHA384",
-+                    "com.sun.crypto.provider.PBMAC1Core$HmacSHA384", null, attrs);
-+            ps("Mac", "PBEWithHmacSHA512",
-+                    "com.sun.crypto.provider.PBMAC1Core$HmacSHA512", null, attrs);
-+            ps("Mac", "PBEWithHmacSHA512/224",
-+                    "com.sun.crypto.provider.PBMAC1Core$HmacSHA512_224", null, attrs);
-+            ps("Mac", "PBEWithHmacSHA512/256",
-+                    "com.sun.crypto.provider.PBMAC1Core$HmacSHA512_256", null, attrs);
-+
-+            ps("Mac", "SslMacMD5",
-+                    "com.sun.crypto.provider.SslMacCore$SslMacMD5", null, attrs);
-+            ps("Mac", "SslMacSHA1",
-+                    "com.sun.crypto.provider.SslMacCore$SslMacSHA1", null, attrs);
-+
-+            /*
-+             * KeyStore
-+             */
-+            ps("KeyStore", "JCEKS",
-+                    "com.sun.crypto.provider.JceKeyStore");
-+
-+            /*
-+             * KEMs
-+             */
-+            attrs.clear();
-+            attrs.put("ImplementedIn", "Software");
-+            attrs.put("SupportedKeyClasses", "java.security.interfaces.ECKey" +
-+                      "|java.security.interfaces.XECKey");
-+            ps("KEM", "DHKEM", "com.sun.crypto.provider.DHKEM", null, attrs);
-+
-+            /*
-+             * SSL/TLS mechanisms
-+             *
-+             * These are strictly internal implementations and may
-+             * be changed at any time.  These names were chosen
-+             * because PKCS11/SunPKCS11 does not yet have TLS1.2
-+             * mechanisms, and it will cause calls to come here.
-+             */
-+            ps("KeyGenerator", "SunTlsPrf",
-+                    "com.sun.crypto.provider.TlsPrfGenerator$V10");
-+            ps("KeyGenerator", "SunTls12Prf",
-+                    "com.sun.crypto.provider.TlsPrfGenerator$V12");
-+
-+            ps("KeyGenerator", "SunTlsMasterSecret",
-+                    "com.sun.crypto.provider.TlsMasterSecretGenerator",
-+                    List.of("SunTls12MasterSecret", "SunTlsExtendedMasterSecret"),
-+                    null);
-+
-+            ps("KeyGenerator", "SunTlsKeyMaterial",
-+                    "com.sun.crypto.provider.TlsKeyMaterialGenerator",
-+                    List.of("SunTls12KeyMaterial"), null);
-+
-+            ps("KeyGenerator", "SunTlsRsaPremasterSecret",
-+                    "com.sun.crypto.provider.TlsRsaPremasterSecretGenerator",
-+                    List.of("SunTls12RsaPremasterSecret"), null);
-+        }
-     }
- 
-     // Return the instance of this class or create one if needed.
-diff --git a/src/java.base/share/classes/java/security/Security.java b/src/java.base/share/classes/java/security/Security.java
-index 671529f71a1..af632936921 100644
---- a/src/java.base/share/classes/java/security/Security.java
-+++ b/src/java.base/share/classes/java/security/Security.java
-@@ -34,6 +34,7 @@ import java.net.URL;
- import jdk.internal.access.JavaSecurityPropertiesAccess;
- import jdk.internal.event.EventHelper;
- import jdk.internal.event.SecurityPropertyModificationEvent;
-+import jdk.internal.access.JavaSecuritySystemConfiguratorAccess;
- import jdk.internal.access.SharedSecrets;
- import jdk.internal.util.StaticProperty;
- import sun.security.util.Debug;
-@@ -58,6 +59,11 @@ import sun.security.jca.*;
- 
- public final class Security {
- 
-+    private static final String SYS_PROP_SWITCH =
-+        "java.security.disableSystemPropertiesFile";
-+    private static final String SEC_PROP_SWITCH =
-+        "security.useSystemPropertiesFile";
-+
-     /* Are we debugging? -- for developers */
-     private static final Debug sdebug =
-                         Debug.getInstance("properties");
-@@ -75,6 +81,19 @@ public final class Security {
-     }
- 
-     static {
-+        // Initialise here as used by code with system properties disabled
-+        SharedSecrets.setJavaSecuritySystemConfiguratorAccess(
-+            new JavaSecuritySystemConfiguratorAccess() {
-+                @Override
-+                public boolean isSystemFipsEnabled() {
-+                    return SystemConfigurator.isSystemFipsEnabled();
-+                }
-+                @Override
-+                public boolean isPlainKeySupportEnabled() {
-+                    return SystemConfigurator.isPlainKeySupportEnabled();
-+                }
-+            });
-+
-         // doPrivileged here because there are multiple
-         // things in initialize that might require privs.
-         // (the FileInputStream call and the File.exists call,
-@@ -96,6 +115,7 @@ public final class Security {
-     private static void initialize() {
-         props = new Properties();
-         boolean overrideAll = false;
-+        boolean systemSecPropsEnabled = false;
- 
-         // first load the system properties file
-         // to determine the value of security.overridePropertiesFile
-@@ -116,6 +136,61 @@ public final class Security {
-             }
-             loadProps(null, extraPropFile, overrideAll);
-         }
-+
-+        boolean sysUseProps = Boolean.valueOf(System.getProperty(SYS_PROP_SWITCH, "false"));
-+        boolean secUseProps = Boolean.valueOf(props.getProperty(SEC_PROP_SWITCH));
-+        if (sdebug != null) {
-+            sdebug.println(SYS_PROP_SWITCH + "=" + sysUseProps);
-+            sdebug.println(SEC_PROP_SWITCH + "=" + secUseProps);
-+        }
-+        if (!sysUseProps && secUseProps) {
-+            systemSecPropsEnabled = SystemConfigurator.configureSysProps(props);
-+            if (!systemSecPropsEnabled) {
-+                if (sdebug != null) {
-+                    sdebug.println("WARNING: System security properties could not be loaded.");
-+                }
-+            }
-+        } else {
-+            if (sdebug != null) {
-+                sdebug.println("System security property support disabled by user.");
-+            }
-+        }
-+
-+        if (systemSecPropsEnabled) {
-+            boolean shouldEnable;
-+            String sysProp = System.getProperty("com.redhat.fips");
-+            if (sysProp == null) {
-+                shouldEnable = true;
-+                if (sdebug != null) {
-+                    sdebug.println("com.redhat.fips unset, using default value of true");
-+                }
-+            } else {
-+                shouldEnable = Boolean.valueOf(sysProp);
-+                if (sdebug != null) {
-+                    sdebug.println("com.redhat.fips set, using its value " + shouldEnable);
-+                }
-+            }
-+            if (shouldEnable) {
-+                boolean fipsEnabled = SystemConfigurator.configureFIPS(props);
-+                if (sdebug != null) {
-+                    if (fipsEnabled) {
-+                        sdebug.println("FIPS mode support configured and enabled.");
-+                    } else {
-+                        sdebug.println("FIPS mode support disabled.");
-+                    }
-+                }
-+            } else {
-+                if (sdebug != null ) {
-+                    sdebug.println("FIPS mode support disabled by user.");
-+                }
-+            }
-+        } else {
-+            if (sdebug != null) {
-+                sdebug.println("WARNING: FIPS mode support can not be enabled without " +
-+                               "system security properties being enabled.");
-+            }
-+        }
-+
-         initialSecurityProperties = (Properties) props.clone();
-         if (sdebug != null) {
-             for (String key : props.stringPropertyNames()) {
-@@ -126,7 +201,7 @@ public final class Security {
- 
-     }
- 
--    private static boolean loadProps(File masterFile, String extraPropFile, boolean overrideAll) {
-+    static boolean loadProps(File masterFile, String extraPropFile, boolean overrideAll) {
-         InputStream is = null;
-         try {
-             if (masterFile != null && masterFile.exists()) {
-diff --git a/src/java.base/share/classes/java/security/SystemConfigurator.java b/src/java.base/share/classes/java/security/SystemConfigurator.java
-new file mode 100644
-index 00000000000..9d26a54f5d4
---- /dev/null
-+++ b/src/java.base/share/classes/java/security/SystemConfigurator.java
-@@ -0,0 +1,232 @@
-+/*
-+ * Copyright (c) 2019, 2021, Red Hat, Inc.
-+ *
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation.  Oracle designates this
-+ * particular file as subject to the "Classpath" exception as provided
-+ * by Oracle in the LICENSE file that accompanied this code.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+package java.security;
-+
-+import java.io.BufferedInputStream;
-+import java.io.FileInputStream;
-+import java.io.IOException;
-+
-+import java.util.Iterator;
-+import java.util.Map.Entry;
-+import java.util.Properties;
-+
-+import sun.security.util.Debug;
-+
-+/**
-+ * Internal class to align OpenJDK with global crypto-policies.
-+ * Called from java.security.Security class initialization,
-+ * during startup.
-+ *
-+ */
-+
-+final class SystemConfigurator {
-+
-+    private static final Debug sdebug =
-+            Debug.getInstance("properties");
-+
-+    private static final String CRYPTO_POLICIES_BASE_DIR =
-+            "/etc/crypto-policies";
-+
-+    private static final String CRYPTO_POLICIES_JAVA_CONFIG =
-+            CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config";
-+
-+    private static boolean systemFipsEnabled = false;
-+    private static boolean plainKeySupportEnabled = false;
-+
-+    private static final String SYSTEMCONF_NATIVE_LIB = "systemconf";
-+
-+    private static native boolean getSystemFIPSEnabled()
-+            throws IOException;
-+
-+    static {
-+        @SuppressWarnings("removal")
-+        var dummy = AccessController.doPrivileged(new PrivilegedAction<Void>() {
-+            public Void run() {
-+                System.loadLibrary(SYSTEMCONF_NATIVE_LIB);
-+                return null;
-+            }
-+        });
-+    }
-+
-+    /*
-+     * Invoked when java.security.Security class is initialized, if
-+     * java.security.disableSystemPropertiesFile property is not set and
-+     * security.useSystemPropertiesFile is true.
-+     */
-+    static boolean configureSysProps(Properties props) {
-+        // now load the system file, if it exists, so its values
-+        // will win if they conflict with the earlier values
-+        return Security.loadProps(null, CRYPTO_POLICIES_JAVA_CONFIG, false);
-+    }
-+
-+    /*
-+     * Invoked at the end of java.security.Security initialisation
-+     * if java.security properties have been loaded
-+     */
-+    static boolean configureFIPS(Properties props) {
-+        boolean loadedProps = false;
-+
-+        try {
-+            if (enableFips()) {
-+                if (sdebug != null) { sdebug.println("FIPS mode detected"); }
-+                // Remove all security providers
-+                Iterator<Entry<Object, Object>> i = props.entrySet().iterator();
-+                while (i.hasNext()) {
-+                    Entry<Object, Object> e = i.next();
-+                    if (((String) e.getKey()).startsWith("security.provider")) {
-+                        if (sdebug != null) { sdebug.println("Removing provider: " + e); }
-+                        i.remove();
-+                    }
-+                }
-+                // Add FIPS security providers
-+                String fipsProviderValue = null;
-+                for (int n = 1;
-+                     (fipsProviderValue = (String) props.get("fips.provider." + n)) != null; n++) {
-+                    String fipsProviderKey = "security.provider." + n;
-+                    if (sdebug != null) {
-+                        sdebug.println("Adding provider " + n + ": " +
-+                                fipsProviderKey + "=" + fipsProviderValue);
-+                    }
-+                    props.put(fipsProviderKey, fipsProviderValue);
-+                }
-+                // Add other security properties
-+                String keystoreTypeValue = (String) props.get("fips.keystore.type");
-+                if (keystoreTypeValue != null) {
-+                    String nonFipsKeystoreType = props.getProperty("keystore.type");
-+                    props.put("keystore.type", keystoreTypeValue);
-+                    if (keystoreTypeValue.equals("PKCS11")) {
-+                        // If keystore.type is PKCS11, javax.net.ssl.keyStore
-+                        // must be "NONE". See JDK-8238264.
-+                        System.setProperty("javax.net.ssl.keyStore", "NONE");
-+                    }
-+                    if (System.getProperty("javax.net.ssl.trustStoreType") == null) {
-+                        // If no trustStoreType has been set, use the
-+                        // previous keystore.type under FIPS mode. In
-+                        // a default configuration, the Trust Store will
-+                        // be 'cacerts' (JKS type).
-+                        System.setProperty("javax.net.ssl.trustStoreType",
-+                                nonFipsKeystoreType);
-+                    }
-+                    if (sdebug != null) {
-+                        sdebug.println("FIPS mode default keystore.type = " +
-+                                keystoreTypeValue);
-+                        sdebug.println("FIPS mode javax.net.ssl.keyStore = " +
-+                                        System.getProperty("javax.net.ssl.keyStore", ""));
-+                        sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " +
-+                                System.getProperty("javax.net.ssl.trustStoreType", ""));
-+                    }
-+                }
-+                loadedProps = true;
-+                systemFipsEnabled = true;
-+                String plainKeySupport = System.getProperty("com.redhat.fips.plainKeySupport",
-+                                                            "true");
-+                plainKeySupportEnabled = !"false".equals(plainKeySupport);
-+                if (sdebug != null) {
-+                    if (plainKeySupportEnabled) {
-+                        sdebug.println("FIPS support enabled with plain key support");
-+                    } else {
-+                        sdebug.println("FIPS support enabled without plain key support");
-+                    }
-+                }
-+            } else {
-+                if (sdebug != null) { sdebug.println("FIPS mode not detected"); }
-+            }
-+        } catch (Exception e) {
-+            if (sdebug != null) {
-+                sdebug.println("unable to load FIPS configuration");
-+                e.printStackTrace();
-+            }
-+        }
-+        return loadedProps;
-+    }
-+
-+    /**
-+     * Returns whether or not global system FIPS alignment is enabled.
-+     *
-+     * Value is always 'false' before java.security.Security class is
-+     * initialized.
-+     *
-+     * Call from out of this package through SharedSecrets:
-+     *   SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+     *           .isSystemFipsEnabled();
-+     *
-+     * @return  a boolean value indicating whether or not global
-+     *          system FIPS alignment is enabled.
-+     */
-+    static boolean isSystemFipsEnabled() {
-+        return systemFipsEnabled;
-+    }
-+
-+    /**
-+     * Returns {@code true} if system FIPS alignment is enabled
-+     * and plain key support is allowed.  Plain key support is
-+     * enabled by default but can be disabled with
-+     * {@code -Dcom.redhat.fips.plainKeySupport=false}.
-+     *
-+     * @return a boolean indicating whether plain key support
-+     *         should be enabled.
-+     */
-+    static boolean isPlainKeySupportEnabled() {
-+        return plainKeySupportEnabled;
-+    }
-+
-+    /**
-+     * Determines whether FIPS mode should be enabled.
-+     *
-+     * OpenJDK FIPS mode will be enabled only if the system is in
-+     * FIPS mode.
-+     *
-+     * Calls to this method only occur if the system property
-+     * com.redhat.fips is not set to false.
-+     *
-+     * There are 2 possible ways in which OpenJDK detects that the system
-+     * is in FIPS mode: 1) if the NSS SECMOD_GetSystemFIPSEnabled API is
-+     * available at OpenJDK's built-time, it is called; 2) otherwise, the
-+     * /proc/sys/crypto/fips_enabled file is read.
-+     *
-+     * @return true if the system is in FIPS mode
-+     */
-+    private static boolean enableFips() throws Exception {
-+        if (sdebug != null) {
-+            sdebug.println("Calling getSystemFIPSEnabled (libsystemconf)...");
-+        }
-+        try {
-+            boolean fipsEnabled = getSystemFIPSEnabled();
-+            if (sdebug != null) {
-+                sdebug.println("Call to getSystemFIPSEnabled (libsystemconf) returned: "
-+                               + fipsEnabled);
-+            }
-+            return fipsEnabled;
-+        } catch (IOException e) {
-+            if (sdebug != null) {
-+                sdebug.println("Call to getSystemFIPSEnabled (libsystemconf) failed:");
-+                sdebug.println(e.getMessage());
-+            }
-+            throw e;
-+        }
-+    }
-+}
-diff --git a/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java b/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java
-new file mode 100644
-index 00000000000..3f3caac64dc
---- /dev/null
-+++ b/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java
-@@ -0,0 +1,31 @@
-+/*
-+ * Copyright (c) 2020, Red Hat, Inc.
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation.  Oracle designates this
-+ * particular file as subject to the "Classpath" exception as provided
-+ * by Oracle in the LICENSE file that accompanied this code.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+package jdk.internal.access;
-+
-+public interface JavaSecuritySystemConfiguratorAccess {
-+    boolean isSystemFipsEnabled();
-+    boolean isPlainKeySupportEnabled();
-+}
-diff --git a/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java b/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
-index 919d758a6e3..b1e5fbaf84a 100644
---- a/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
-+++ b/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java
-@@ -43,6 +43,7 @@ import java.io.PrintStream;
- import java.io.PrintWriter;
- import java.io.RandomAccessFile;
- import java.security.ProtectionDomain;
-+import java.security.Security;
- import java.security.Signature;
- 
- /** A repository of "shared secrets", which are a mechanism for
-@@ -90,6 +91,7 @@ public class SharedSecrets {
-     private static JavaxCryptoSealedObjectAccess javaxCryptoSealedObjectAccess;
-     private static JavaxCryptoSpecAccess javaxCryptoSpecAccess;
-     private static JavaTemplateAccess javaTemplateAccess;
-+    private static JavaSecuritySystemConfiguratorAccess javaSecuritySystemConfiguratorAccess;
- 
-     public static void setJavaUtilCollectionAccess(JavaUtilCollectionAccess juca) {
-         javaUtilCollectionAccess = juca;
-@@ -537,4 +539,15 @@ public class SharedSecrets {
-             MethodHandles.lookup().ensureInitialized(c);
-         } catch (IllegalAccessException e) {}
-     }
-+
-+    public static void setJavaSecuritySystemConfiguratorAccess(JavaSecuritySystemConfiguratorAccess jssca) {
-+        javaSecuritySystemConfiguratorAccess = jssca;
-+    }
-+
-+    public static JavaSecuritySystemConfiguratorAccess getJavaSecuritySystemConfiguratorAccess() {
-+        if (javaSecuritySystemConfiguratorAccess == null) {
-+            ensureClassInitialized(Security.class);
-+        }
-+        return javaSecuritySystemConfiguratorAccess;
-+    }
- }
-diff --git a/src/java.base/share/classes/module-info.java b/src/java.base/share/classes/module-info.java
-index 06b141dcf22..e8cbf7f15d7 100644
---- a/src/java.base/share/classes/module-info.java
-+++ b/src/java.base/share/classes/module-info.java
-@@ -158,6 +158,7 @@ module java.base {
-         java.naming,
-         java.rmi,
-         jdk.charsets,
-+        jdk.crypto.ec,
-         jdk.jartool,
-         jdk.jlink,
-         jdk.jfr,
-diff --git a/src/java.base/share/classes/sun/security/provider/SunEntries.java b/src/java.base/share/classes/sun/security/provider/SunEntries.java
-index f036a411f1d..1e9de933bd9 100644
---- a/src/java.base/share/classes/sun/security/provider/SunEntries.java
-+++ b/src/java.base/share/classes/sun/security/provider/SunEntries.java
-@@ -38,6 +38,7 @@ import java.util.HashMap;
- import java.util.Iterator;
- import java.util.LinkedHashSet;
- 
-+import jdk.internal.access.SharedSecrets;
- import jdk.internal.util.StaticProperty;
- import sun.security.action.GetBooleanAction;
- 
-@@ -91,6 +92,10 @@ import static sun.security.util.SecurityProviderConstants.getAliases;
- 
- public final class SunEntries {
- 
-+    private static final boolean systemFipsEnabled =
-+            SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+            .isSystemFipsEnabled();
-+
-     // the default algo used by SecureRandom class for new SecureRandom() calls
-     public static final String DEF_SECURE_RANDOM_ALGO;
- 
-@@ -102,89 +107,92 @@ public final class SunEntries {
-         // common attribute map
-         HashMap<String, String> attrs = new HashMap<>(3);
- 
--        /*
--         * SecureRandom engines
--         */
--        attrs.put("ThreadSafe", "true");
--        if (NativePRNG.isAvailable()) {
--            add(p, "SecureRandom", "NativePRNG",
--                    "sun.security.provider.NativePRNG", attrs);
--        }
--        if (NativePRNG.Blocking.isAvailable()) {
--            add(p, "SecureRandom", "NativePRNGBlocking",
--                    "sun.security.provider.NativePRNG$Blocking", attrs);
--        }
--        if (NativePRNG.NonBlocking.isAvailable()) {
--            add(p, "SecureRandom", "NativePRNGNonBlocking",
--                    "sun.security.provider.NativePRNG$NonBlocking", attrs);
--        }
--        attrs.put("ImplementedIn", "Software");
--        add(p, "SecureRandom", "DRBG", "sun.security.provider.DRBG", attrs);
--        add(p, "SecureRandom", "SHA1PRNG",
--                "sun.security.provider.SecureRandom", attrs);
--
--        /*
--         * Signature engines
--         */
--        attrs.clear();
--        String dsaKeyClasses = "java.security.interfaces.DSAPublicKey" +
--                "|java.security.interfaces.DSAPrivateKey";
--        attrs.put("SupportedKeyClasses", dsaKeyClasses);
--        attrs.put("ImplementedIn", "Software");
--
--        attrs.put("KeySize", "1024"); // for NONE and SHA1 DSA signatures
--
--        addWithAlias(p, "Signature", "SHA1withDSA",
--                "sun.security.provider.DSA$SHA1withDSA", attrs);
--        addWithAlias(p, "Signature", "NONEwithDSA",
--                "sun.security.provider.DSA$RawDSA", attrs);
--
--        // for DSA signatures with 224/256-bit digests
--        attrs.put("KeySize", "2048");
--
--        addWithAlias(p, "Signature", "SHA224withDSA",
--                "sun.security.provider.DSA$SHA224withDSA", attrs);
--        addWithAlias(p, "Signature", "SHA256withDSA",
--                "sun.security.provider.DSA$SHA256withDSA", attrs);
--
--        addWithAlias(p, "Signature", "SHA3-224withDSA",
--                "sun.security.provider.DSA$SHA3_224withDSA", attrs);
--        addWithAlias(p, "Signature", "SHA3-256withDSA",
--                "sun.security.provider.DSA$SHA3_256withDSA", attrs);
--
--        attrs.put("KeySize", "3072"); // for DSA sig using 384/512-bit digests
--
--        addWithAlias(p, "Signature", "SHA384withDSA",
--                "sun.security.provider.DSA$SHA384withDSA", attrs);
--        addWithAlias(p, "Signature", "SHA512withDSA",
--                "sun.security.provider.DSA$SHA512withDSA", attrs);
--        addWithAlias(p, "Signature", "SHA3-384withDSA",
--                "sun.security.provider.DSA$SHA3_384withDSA", attrs);
--        addWithAlias(p, "Signature", "SHA3-512withDSA",
--                "sun.security.provider.DSA$SHA3_512withDSA", attrs);
-+        if (!systemFipsEnabled) {
-+            /*
-+             * SecureRandom engines
-+             */
-+            attrs.put("ThreadSafe", "true");
-+            if (NativePRNG.isAvailable()) {
-+                add(p, "SecureRandom", "NativePRNG",
-+                        "sun.security.provider.NativePRNG", attrs);
-+            }
-+            if (NativePRNG.Blocking.isAvailable()) {
-+                add(p, "SecureRandom", "NativePRNGBlocking",
-+                        "sun.security.provider.NativePRNG$Blocking", attrs);
-+            }
-+            if (NativePRNG.NonBlocking.isAvailable()) {
-+                add(p, "SecureRandom", "NativePRNGNonBlocking",
-+                        "sun.security.provider.NativePRNG$NonBlocking", attrs);
-+            }
-+            attrs.put("ImplementedIn", "Software");
-+            add(p, "SecureRandom", "DRBG", "sun.security.provider.DRBG", attrs);
-+            add(p, "SecureRandom", "SHA1PRNG",
-+                    "sun.security.provider.SecureRandom", attrs);
- 
--        attrs.remove("KeySize");
-+            /*
-+             * Signature engines
-+             */
-+            attrs.clear();
-+            String dsaKeyClasses = "java.security.interfaces.DSAPublicKey" +
-+                    "|java.security.interfaces.DSAPrivateKey";
-+            attrs.put("SupportedKeyClasses", dsaKeyClasses);
-+            attrs.put("ImplementedIn", "Software");
-+
-+            attrs.put("KeySize", "1024"); // for NONE and SHA1 DSA signatures
-+
-+            addWithAlias(p, "Signature", "SHA1withDSA",
-+                    "sun.security.provider.DSA$SHA1withDSA", attrs);
-+            addWithAlias(p, "Signature", "NONEwithDSA",
-+                    "sun.security.provider.DSA$RawDSA", attrs);
-+
-+            // for DSA signatures with 224/256-bit digests
-+            attrs.put("KeySize", "2048");
-+
-+            addWithAlias(p, "Signature", "SHA224withDSA",
-+                    "sun.security.provider.DSA$SHA224withDSA", attrs);
-+            addWithAlias(p, "Signature", "SHA256withDSA",
-+                    "sun.security.provider.DSA$SHA256withDSA", attrs);
-+
-+            addWithAlias(p, "Signature", "SHA3-224withDSA",
-+                    "sun.security.provider.DSA$SHA3_224withDSA", attrs);
-+            addWithAlias(p, "Signature", "SHA3-256withDSA",
-+                    "sun.security.provider.DSA$SHA3_256withDSA", attrs);
-+
-+            attrs.put("KeySize", "3072"); // for DSA sig using 384/512-bit digests
-+
-+            addWithAlias(p, "Signature", "SHA384withDSA",
-+                    "sun.security.provider.DSA$SHA384withDSA", attrs);
-+            addWithAlias(p, "Signature", "SHA512withDSA",
-+                    "sun.security.provider.DSA$SHA512withDSA", attrs);
-+            addWithAlias(p, "Signature", "SHA3-384withDSA",
-+                    "sun.security.provider.DSA$SHA3_384withDSA", attrs);
-+            addWithAlias(p, "Signature", "SHA3-512withDSA",
-+                    "sun.security.provider.DSA$SHA3_512withDSA", attrs);
-+
-+            attrs.remove("KeySize");
-+
-+            add(p, "Signature", "SHA1withDSAinP1363Format",
-+                    "sun.security.provider.DSA$SHA1withDSAinP1363Format");
-+            add(p, "Signature", "NONEwithDSAinP1363Format",
-+                    "sun.security.provider.DSA$RawDSAinP1363Format");
-+            add(p, "Signature", "SHA224withDSAinP1363Format",
-+                    "sun.security.provider.DSA$SHA224withDSAinP1363Format");
-+            add(p, "Signature", "SHA256withDSAinP1363Format",
-+                    "sun.security.provider.DSA$SHA256withDSAinP1363Format");
-+            add(p, "Signature", "SHA384withDSAinP1363Format",
-+                    "sun.security.provider.DSA$SHA384withDSAinP1363Format");
-+            add(p, "Signature", "SHA512withDSAinP1363Format",
-+                    "sun.security.provider.DSA$SHA512withDSAinP1363Format");
-+            add(p, "Signature", "SHA3-224withDSAinP1363Format",
-+                    "sun.security.provider.DSA$SHA3_224withDSAinP1363Format");
-+            add(p, "Signature", "SHA3-256withDSAinP1363Format",
-+                    "sun.security.provider.DSA$SHA3_256withDSAinP1363Format");
-+            add(p, "Signature", "SHA3-384withDSAinP1363Format",
-+                    "sun.security.provider.DSA$SHA3_384withDSAinP1363Format");
-+            add(p, "Signature", "SHA3-512withDSAinP1363Format",
-+                    "sun.security.provider.DSA$SHA3_512withDSAinP1363Format");
- 
--        add(p, "Signature", "SHA1withDSAinP1363Format",
--                "sun.security.provider.DSA$SHA1withDSAinP1363Format");
--        add(p, "Signature", "NONEwithDSAinP1363Format",
--                "sun.security.provider.DSA$RawDSAinP1363Format");
--        add(p, "Signature", "SHA224withDSAinP1363Format",
--                "sun.security.provider.DSA$SHA224withDSAinP1363Format");
--        add(p, "Signature", "SHA256withDSAinP1363Format",
--                "sun.security.provider.DSA$SHA256withDSAinP1363Format");
--        add(p, "Signature", "SHA384withDSAinP1363Format",
--                "sun.security.provider.DSA$SHA384withDSAinP1363Format");
--        add(p, "Signature", "SHA512withDSAinP1363Format",
--                "sun.security.provider.DSA$SHA512withDSAinP1363Format");
--        add(p, "Signature", "SHA3-224withDSAinP1363Format",
--                "sun.security.provider.DSA$SHA3_224withDSAinP1363Format");
--        add(p, "Signature", "SHA3-256withDSAinP1363Format",
--                "sun.security.provider.DSA$SHA3_256withDSAinP1363Format");
--        add(p, "Signature", "SHA3-384withDSAinP1363Format",
--                "sun.security.provider.DSA$SHA3_384withDSAinP1363Format");
--        add(p, "Signature", "SHA3-512withDSAinP1363Format",
--                "sun.security.provider.DSA$SHA3_512withDSAinP1363Format");
-+        }
- 
-         attrs.clear();
-         attrs.put("ImplementedIn", "Software");
-@@ -196,9 +204,11 @@ public final class SunEntries {
-         attrs.put("ImplementedIn", "Software");
-         attrs.put("KeySize", "2048"); // for DSA KPG and APG only
- 
--        String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$";
--        dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current");
--        addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs);
-+        if (!systemFipsEnabled) {
-+            String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$";
-+            dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current");
-+            addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs);
-+        }
- 
-         /*
-          * Algorithm Parameter Generator engines
-@@ -213,44 +223,46 @@ public final class SunEntries {
-         addWithAlias(p, "AlgorithmParameters", "DSA",
-                 "sun.security.provider.DSAParameters", attrs);
- 
--        /*
--         * Key factories
--         */
--        addWithAlias(p, "KeyFactory", "DSA",
--                "sun.security.provider.DSAKeyFactory", attrs);
--        addWithAlias(p, "KeyFactory", "HSS/LMS",
--                "sun.security.provider.HSS$KeyFactoryImpl", attrs);
--
--        /*
--         * Digest engines
--         */
--        addWithAlias(p, "MessageDigest", "MD2", "sun.security.provider.MD2",
--                attrs);
--        addWithAlias(p, "MessageDigest", "MD5", "sun.security.provider.MD5",
--                attrs);
--        addWithAlias(p, "MessageDigest", "SHA-1", "sun.security.provider.SHA",
--                attrs);
-+        if (!systemFipsEnabled) {
-+            /*
-+             * Key factories
-+             */
-+            addWithAlias(p, "KeyFactory", "DSA",
-+                    "sun.security.provider.DSAKeyFactory", attrs);
-+            addWithAlias(p, "KeyFactory", "HSS/LMS",
-+                    "sun.security.provider.HSS$KeyFactoryImpl", attrs);
- 
--        addWithAlias(p, "MessageDigest", "SHA-224",
--                "sun.security.provider.SHA2$SHA224", attrs);
--        addWithAlias(p, "MessageDigest", "SHA-256",
--                "sun.security.provider.SHA2$SHA256", attrs);
--        addWithAlias(p, "MessageDigest", "SHA-384",
--                "sun.security.provider.SHA5$SHA384", attrs);
--        addWithAlias(p, "MessageDigest", "SHA-512",
--                "sun.security.provider.SHA5$SHA512", attrs);
--        addWithAlias(p, "MessageDigest", "SHA-512/224",
--                "sun.security.provider.SHA5$SHA512_224", attrs);
--        addWithAlias(p, "MessageDigest", "SHA-512/256",
--                "sun.security.provider.SHA5$SHA512_256", attrs);
--        addWithAlias(p, "MessageDigest", "SHA3-224",
--                "sun.security.provider.SHA3$SHA224", attrs);
--        addWithAlias(p, "MessageDigest", "SHA3-256",
--                "sun.security.provider.SHA3$SHA256", attrs);
--        addWithAlias(p, "MessageDigest", "SHA3-384",
--                "sun.security.provider.SHA3$SHA384", attrs);
--        addWithAlias(p, "MessageDigest", "SHA3-512",
--                "sun.security.provider.SHA3$SHA512", attrs);
-+            /*
-+             * Digest engines
-+             */
-+            addWithAlias(p, "MessageDigest", "MD2", "sun.security.provider.MD2",
-+                         attrs);
-+            addWithAlias(p, "MessageDigest", "MD5", "sun.security.provider.MD5",
-+                         attrs);
-+            addWithAlias(p, "MessageDigest", "SHA-1", "sun.security.provider.SHA",
-+                         attrs);
-+
-+            addWithAlias(p, "MessageDigest", "SHA-224",
-+                    "sun.security.provider.SHA2$SHA224", attrs);
-+            addWithAlias(p, "MessageDigest", "SHA-256",
-+                    "sun.security.provider.SHA2$SHA256", attrs);
-+            addWithAlias(p, "MessageDigest", "SHA-384",
-+                    "sun.security.provider.SHA5$SHA384", attrs);
-+            addWithAlias(p, "MessageDigest", "SHA-512",
-+                    "sun.security.provider.SHA5$SHA512", attrs);
-+            addWithAlias(p, "MessageDigest", "SHA-512/224",
-+                    "sun.security.provider.SHA5$SHA512_224", attrs);
-+            addWithAlias(p, "MessageDigest", "SHA-512/256",
-+                    "sun.security.provider.SHA5$SHA512_256", attrs);
-+            addWithAlias(p, "MessageDigest", "SHA3-224",
-+                    "sun.security.provider.SHA3$SHA224", attrs);
-+            addWithAlias(p, "MessageDigest", "SHA3-256",
-+                    "sun.security.provider.SHA3$SHA256", attrs);
-+            addWithAlias(p, "MessageDigest", "SHA3-384",
-+                    "sun.security.provider.SHA3$SHA384", attrs);
-+            addWithAlias(p, "MessageDigest", "SHA3-512",
-+                    "sun.security.provider.SHA3$SHA512", attrs);
-+        }
- 
-         /*
-          * Certificates
-diff --git a/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java b/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java
-index 539ef1e8ee8..435f57e3ff2 100644
---- a/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java
-+++ b/src/java.base/share/classes/sun/security/rsa/SunRsaSignEntries.java
-@@ -27,6 +27,7 @@ package sun.security.rsa;
- 
- import java.util.*;
- import java.security.Provider;
-+import jdk.internal.access.SharedSecrets;
- import static sun.security.util.SecurityProviderConstants.getAliases;
- 
- /**
-@@ -36,6 +37,10 @@ import static sun.security.util.SecurityProviderConstants.getAliases;
-  */
- public final class SunRsaSignEntries {
- 
-+    private static final boolean systemFipsEnabled =
-+            SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+            .isSystemFipsEnabled();
-+
-     private void add(Provider p, String type, String algo, String cn,
-              List<String> aliases, HashMap<String, String> attrs) {
-          services.add(new Provider.Service(p, type, algo, cn,
-@@ -63,42 +68,49 @@ public final class SunRsaSignEntries {
-         add(p, "KeyFactory", "RSA",
-                 "sun.security.rsa.RSAKeyFactory$Legacy",
-                 getAliases("PKCS1"), null);
--        add(p, "KeyPairGenerator", "RSA",
--                "sun.security.rsa.RSAKeyPairGenerator$Legacy",
--                getAliases("PKCS1"), null);
--        addA(p, "Signature", "MD2withRSA",
--                "sun.security.rsa.RSASignature$MD2withRSA", attrs);
--        addA(p, "Signature", "MD5withRSA",
--                "sun.security.rsa.RSASignature$MD5withRSA", attrs);
--        addA(p, "Signature", "SHA1withRSA",
--                "sun.security.rsa.RSASignature$SHA1withRSA", attrs);
--        addA(p, "Signature", "SHA224withRSA",
--                "sun.security.rsa.RSASignature$SHA224withRSA", attrs);
--        addA(p, "Signature", "SHA256withRSA",
--                "sun.security.rsa.RSASignature$SHA256withRSA", attrs);
--        addA(p, "Signature", "SHA384withRSA",
--                "sun.security.rsa.RSASignature$SHA384withRSA", attrs);
--        addA(p, "Signature", "SHA512withRSA",
--                "sun.security.rsa.RSASignature$SHA512withRSA", attrs);
--        addA(p, "Signature", "SHA512/224withRSA",
--                "sun.security.rsa.RSASignature$SHA512_224withRSA", attrs);
--        addA(p, "Signature", "SHA512/256withRSA",
--                "sun.security.rsa.RSASignature$SHA512_256withRSA", attrs);
--        addA(p, "Signature", "SHA3-224withRSA",
--                "sun.security.rsa.RSASignature$SHA3_224withRSA", attrs);
--        addA(p, "Signature", "SHA3-256withRSA",
--                "sun.security.rsa.RSASignature$SHA3_256withRSA", attrs);
--        addA(p, "Signature", "SHA3-384withRSA",
--               "sun.security.rsa.RSASignature$SHA3_384withRSA", attrs);
--        addA(p, "Signature", "SHA3-512withRSA",
--                "sun.security.rsa.RSASignature$SHA3_512withRSA", attrs);
-+
-+        if (!systemFipsEnabled) {
-+            add(p, "KeyPairGenerator", "RSA",
-+                    "sun.security.rsa.RSAKeyPairGenerator$Legacy",
-+                    getAliases("PKCS1"), null);
-+            addA(p, "Signature", "MD2withRSA",
-+                    "sun.security.rsa.RSASignature$MD2withRSA", attrs);
-+            addA(p, "Signature", "MD5withRSA",
-+                    "sun.security.rsa.RSASignature$MD5withRSA", attrs);
-+            addA(p, "Signature", "SHA1withRSA",
-+                    "sun.security.rsa.RSASignature$SHA1withRSA", attrs);
-+            addA(p, "Signature", "SHA224withRSA",
-+                    "sun.security.rsa.RSASignature$SHA224withRSA", attrs);
-+            addA(p, "Signature", "SHA256withRSA",
-+                    "sun.security.rsa.RSASignature$SHA256withRSA", attrs);
-+            addA(p, "Signature", "SHA384withRSA",
-+                    "sun.security.rsa.RSASignature$SHA384withRSA", attrs);
-+            addA(p, "Signature", "SHA512withRSA",
-+                    "sun.security.rsa.RSASignature$SHA512withRSA", attrs);
-+            addA(p, "Signature", "SHA512/224withRSA",
-+                    "sun.security.rsa.RSASignature$SHA512_224withRSA", attrs);
-+            addA(p, "Signature", "SHA512/256withRSA",
-+                    "sun.security.rsa.RSASignature$SHA512_256withRSA", attrs);
-+            addA(p, "Signature", "SHA3-224withRSA",
-+                    "sun.security.rsa.RSASignature$SHA3_224withRSA", attrs);
-+            addA(p, "Signature", "SHA3-256withRSA",
-+                    "sun.security.rsa.RSASignature$SHA3_256withRSA", attrs);
-+            addA(p, "Signature", "SHA3-384withRSA",
-+                   "sun.security.rsa.RSASignature$SHA3_384withRSA", attrs);
-+            addA(p, "Signature", "SHA3-512withRSA",
-+                    "sun.security.rsa.RSASignature$SHA3_512withRSA", attrs);
-+        }
- 
-         addA(p, "KeyFactory", "RSASSA-PSS",
-                 "sun.security.rsa.RSAKeyFactory$PSS", attrs);
--        addA(p, "KeyPairGenerator", "RSASSA-PSS",
--                "sun.security.rsa.RSAKeyPairGenerator$PSS", attrs);
--        addA(p, "Signature", "RSASSA-PSS",
--                "sun.security.rsa.RSAPSSSignature", attrs);
-+
-+        if (!systemFipsEnabled) {
-+            addA(p, "KeyPairGenerator", "RSASSA-PSS",
-+                    "sun.security.rsa.RSAKeyPairGenerator$PSS", attrs);
-+            addA(p, "Signature", "RSASSA-PSS",
-+                    "sun.security.rsa.RSAPSSSignature", attrs);
-+        }
-+
-         addA(p, "AlgorithmParameters", "RSASSA-PSS",
-                 "sun.security.rsa.PSSParameters", null);
-     }
-diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security
-index 5149edba0e5..8227d650a03 100644
---- a/src/java.base/share/conf/security/java.security
-+++ b/src/java.base/share/conf/security/java.security
-@@ -85,6 +85,17 @@ security.provider.tbd=Apple
- #endif
- security.provider.tbd=SunPKCS11
- 
-+#
-+# Security providers used when FIPS mode support is active
-+#
-+fips.provider.1=SunPKCS11 ${java.home}/conf/security/nss.fips.cfg
-+fips.provider.2=SUN
-+fips.provider.3=SunEC
-+fips.provider.4=SunJSSE
-+fips.provider.5=SunJCE
-+fips.provider.6=SunRsaSign
-+fips.provider.7=XMLDSig
-+
- #
- # A list of preferred providers for specific algorithms. These providers will
- # be searched for matching algorithms before the list of registered providers.
-@@ -295,6 +306,47 @@ policy.ignoreIdentityScope=false
- #
- keystore.type=pkcs12
- 
-+#
-+# Default keystore type used when global crypto-policies are set to FIPS.
-+#
-+fips.keystore.type=pkcs12
-+
-+#
-+# Location of the NSS DB keystore (PKCS11) in FIPS mode.
-+#
-+# The syntax for this property is identical to the 'nssSecmodDirectory'
-+# attribute available in the SunPKCS11 NSS configuration file. Use the
-+# 'sql:' prefix to refer to an SQLite DB.
-+#
-+# If the system property fips.nssdb.path is also specified, it supersedes
-+# the security property value defined here.
-+#
-+# Note: the default value for this property points to an NSS DB that might be
-+# readable by multiple operating system users and unsuitable to store keys.
-+#
-+fips.nssdb.path=sql:/etc/pki/nssdb
-+
-+#
-+# PIN for the NSS DB keystore (PKCS11) in FIPS mode.
-+#
-+# Values must take any of the following forms:
-+#   1) pin:<value>
-+#        Value: clear text PIN value.
-+#   2) env:<value>
-+#        Value: environment variable containing the PIN value.
-+#   3) file:<value>
-+#        Value: path to a file containing the PIN value in its first
-+#        line.
-+#
-+# If the system property fips.nssdb.pin is also specified, it supersedes
-+# the security property value defined here.
-+#
-+# When used as a system property, UTF-8 encoded values are valid. When
-+# used as a security property (such as in this file), encode non-Basic
-+# Latin Unicode characters with \uXXXX.
-+#
-+fips.nssdb.pin=pin:
-+
- #
- # Controls compatibility mode for JKS and PKCS12 keystore types.
- #
-@@ -332,6 +384,13 @@ package.definition=sun.misc.,\
- #
- security.overridePropertiesFile=true
- 
-+#
-+# Determines whether this properties file will be appended to
-+# using the system properties file stored at
-+# /etc/crypto-policies/back-ends/java.config
-+#
-+security.useSystemPropertiesFile=false
-+
- #
- # Determines the default key and trust manager factory algorithms for
- # the javax.net.ssl package.
-diff --git a/src/java.base/share/conf/security/nss.fips.cfg.in b/src/java.base/share/conf/security/nss.fips.cfg.in
-new file mode 100644
-index 00000000000..55bbba98b7a
---- /dev/null
-+++ b/src/java.base/share/conf/security/nss.fips.cfg.in
-@@ -0,0 +1,8 @@
-+name = NSS-FIPS
-+nssLibraryDirectory = @NSS_LIBDIR@
-+nssSecmodDirectory = ${fips.nssdb.path}
-+nssDbMode = readWrite
-+nssModule = fips
-+
-+attributes(*,CKO_SECRET_KEY,CKK_GENERIC_SECRET)={ CKA_SIGN=true }
-+
-diff --git a/src/java.base/share/lib/security/default.policy b/src/java.base/share/lib/security/default.policy
-index 86d45147709..22fd8675503 100644
---- a/src/java.base/share/lib/security/default.policy
-+++ b/src/java.base/share/lib/security/default.policy
-@@ -130,6 +130,7 @@ grant codeBase "jrt:/jdk.charsets" {
- grant codeBase "jrt:/jdk.crypto.ec" {
-     permission java.lang.RuntimePermission
-                    "accessClassInPackage.sun.security.*";
-+    permission java.lang.RuntimePermission "accessClassInPackage.jdk.internal.access";
-     permission java.lang.RuntimePermission "loadLibrary.sunec";
-     permission java.security.SecurityPermission "putProviderProperty.SunEC";
-     permission java.security.SecurityPermission "clearProviderProperties.SunEC";
-@@ -150,6 +151,8 @@ grant codeBase "jrt:/jdk.crypto.cryptoki" {
-     permission java.util.PropertyPermission "os.name", "read";
-     permission java.util.PropertyPermission "os.arch", "read";
-     permission java.util.PropertyPermission "jdk.crypto.KeyAgreement.legacyKDF", "read";
-+    permission java.util.PropertyPermission "fips.nssdb.path", "read,write";
-+    permission java.util.PropertyPermission "fips.nssdb.pin", "read";
-     permission java.security.SecurityPermission "putProviderProperty.*";
-     permission java.security.SecurityPermission "clearProviderProperties.*";
-     permission java.security.SecurityPermission "removeProviderProperty.*";
-diff --git a/src/java.base/share/native/libsystemconf/systemconf.c b/src/java.base/share/native/libsystemconf/systemconf.c
-new file mode 100644
-index 00000000000..ddf9befe5bc
---- /dev/null
-+++ b/src/java.base/share/native/libsystemconf/systemconf.c
-@@ -0,0 +1,236 @@
-+/*
-+ * Copyright (c) 2021, Red Hat, Inc.
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation.  Oracle designates this
-+ * particular file as subject to the "Classpath" exception as provided
-+ * by Oracle in the LICENSE file that accompanied this code.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+#include <jni.h>
-+#include <jni_util.h>
-+#include "jvm_md.h"
-+#include <stdio.h>
-+
-+#ifdef LINUX
-+
-+#ifdef SYSCONF_NSS
-+#include <nss3/pk11pub.h>
-+#else
-+#include <dlfcn.h>
-+#endif //SYSCONF_NSS
-+
-+#include "java_security_SystemConfigurator.h"
-+
-+#define MSG_MAX_SIZE 256
-+#define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled"
-+
-+typedef int (SECMOD_GET_SYSTEM_FIPS_ENABLED_TYPE)(void);
-+
-+static SECMOD_GET_SYSTEM_FIPS_ENABLED_TYPE *getSystemFIPSEnabled;
-+static jmethodID debugPrintlnMethodID = NULL;
-+static jobject debugObj = NULL;
-+
-+static void dbgPrint(JNIEnv *env, const char* msg)
-+{
-+    jstring jMsg;
-+    if (debugObj != NULL) {
-+        jMsg = (*env)->NewStringUTF(env, msg);
-+        CHECK_NULL(jMsg);
-+        (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg);
-+    }
-+}
-+
-+static void throwIOException(JNIEnv *env, const char *msg)
-+{
-+    jclass cls = (*env)->FindClass(env, "java/io/IOException");
-+    if (cls != 0)
-+        (*env)->ThrowNew(env, cls, msg);
-+}
-+
-+static void handle_msg(JNIEnv *env, const char* msg, int msg_bytes)
-+{
-+  if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) {
-+    dbgPrint(env, msg);
-+  } else {
-+    dbgPrint(env, "systemconf: cannot render message");
-+  }
-+}
-+
-+// Only used when NSS is not linked at build time
-+#ifndef SYSCONF_NSS
-+
-+static void *nss_handle;
-+
-+static jboolean loadNSS(JNIEnv *env)
-+{
-+  char msg[MSG_MAX_SIZE];
-+  int msg_bytes;
-+  const char* errmsg;
-+
-+  nss_handle = dlopen(JNI_LIB_NAME("nss3"), RTLD_LAZY);
-+  if (nss_handle == NULL) {
-+    errmsg = dlerror();
-+    msg_bytes = snprintf(msg, MSG_MAX_SIZE, "loadNSS: dlopen: %s\n",
-+                         errmsg);
-+    handle_msg(env, msg, msg_bytes);
-+    return JNI_FALSE;
-+  }
-+  dlerror(); /* Clear errors */
-+  getSystemFIPSEnabled = (SECMOD_GET_SYSTEM_FIPS_ENABLED_TYPE*)dlsym(nss_handle, "SECMOD_GetSystemFIPSEnabled");
-+  if ((errmsg = dlerror()) != NULL) {
-+    msg_bytes = snprintf(msg, MSG_MAX_SIZE, "loadNSS: dlsym: %s\n",
-+                         errmsg);
-+    handle_msg(env, msg, msg_bytes);
-+    return JNI_FALSE;
-+  }
-+  return JNI_TRUE;
-+}
-+
-+static void closeNSS(JNIEnv *env)
-+{
-+  char msg[MSG_MAX_SIZE];
-+  int msg_bytes;
-+  const char* errmsg;
-+
-+  if (dlclose(nss_handle) != 0) {
-+    errmsg = dlerror();
-+    msg_bytes = snprintf(msg, MSG_MAX_SIZE, "closeNSS: dlclose: %s\n",
-+                         errmsg);
-+    handle_msg(env, msg, msg_bytes);
-+  }
-+}
-+
-+#endif
-+
-+/*
-+ * Class:     java_security_SystemConfigurator
-+ * Method:    JNI_OnLoad
-+ */
-+JNIEXPORT jint JNICALL DEF_JNI_OnLoad(JavaVM *vm, void *reserved)
-+{
-+    JNIEnv *env;
-+    jclass sysConfCls, debugCls;
-+    jfieldID sdebugFld;
-+
-+    if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) {
-+        return JNI_EVERSION; /* JNI version not supported */
-+    }
-+
-+    sysConfCls = (*env)->FindClass(env,"java/security/SystemConfigurator");
-+    if (sysConfCls == NULL) {
-+        printf("libsystemconf: SystemConfigurator class not found\n");
-+        return JNI_ERR;
-+    }
-+    sdebugFld = (*env)->GetStaticFieldID(env, sysConfCls,
-+            "sdebug", "Lsun/security/util/Debug;");
-+    if (sdebugFld == NULL) {
-+        printf("libsystemconf: SystemConfigurator::sdebug field not found\n");
-+        return JNI_ERR;
-+    }
-+    debugObj = (*env)->GetStaticObjectField(env, sysConfCls, sdebugFld);
-+    if (debugObj != NULL) {
-+        debugCls = (*env)->FindClass(env,"sun/security/util/Debug");
-+        if (debugCls == NULL) {
-+            printf("libsystemconf: Debug class not found\n");
-+            return JNI_ERR;
-+        }
-+        debugPrintlnMethodID = (*env)->GetMethodID(env, debugCls,
-+                "println", "(Ljava/lang/String;)V");
-+        if (debugPrintlnMethodID == NULL) {
-+            printf("libsystemconf: Debug::println(String) method not found\n");
-+            return JNI_ERR;
-+        }
-+        debugObj = (*env)->NewGlobalRef(env, debugObj);
-+    }
-+
-+#ifdef SYSCONF_NSS
-+    getSystemFIPSEnabled = *SECMOD_GetSystemFIPSEnabled;
-+#else
-+    if (loadNSS(env) == JNI_FALSE) {
-+      dbgPrint(env, "libsystemconf: Failed to load NSS library.");
-+    }
-+#endif
-+
-+    return (*env)->GetVersion(env);
-+}
-+
-+/*
-+ * Class:     java_security_SystemConfigurator
-+ * Method:    JNI_OnUnload
-+ */
-+JNIEXPORT void JNICALL DEF_JNI_OnUnload(JavaVM *vm, void *reserved)
-+{
-+    JNIEnv *env;
-+
-+    if (debugObj != NULL) {
-+        if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) {
-+            return; /* Should not happen */
-+        }
-+#ifndef SYSCONF_NSS
-+        closeNSS(env);
-+#endif
-+        (*env)->DeleteGlobalRef(env, debugObj);
-+    }
-+}
-+
-+JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEnabled
-+  (JNIEnv *env, jclass cls)
-+{
-+    int fips_enabled;
-+    char msg[MSG_MAX_SIZE];
-+    int msg_bytes;
-+
-+    if (getSystemFIPSEnabled != NULL) {
-+      dbgPrint(env, "getSystemFIPSEnabled: calling SECMOD_GetSystemFIPSEnabled");
-+      fips_enabled = (*getSystemFIPSEnabled)();
-+      msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:"   \
-+                           " SECMOD_GetSystemFIPSEnabled returned 0x%x", fips_enabled);
-+      handle_msg(env, msg, msg_bytes);
-+      return (fips_enabled == 1 ? JNI_TRUE : JNI_FALSE);
-+    } else {
-+      FILE *fe;
-+
-+      dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH);
-+      if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) {
-+        throwIOException(env, "Cannot open " FIPS_ENABLED_PATH);
-+        return JNI_FALSE;
-+      }
-+      fips_enabled = fgetc(fe);
-+      fclose(fe);
-+      if (fips_enabled == EOF) {
-+        throwIOException(env, "Cannot read " FIPS_ENABLED_PATH);
-+        return JNI_FALSE;
-+      }
-+      msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:"   \
-+                           " read character is '%c'", fips_enabled);
-+      handle_msg(env, msg, msg_bytes);
-+      return (fips_enabled == '1' ? JNI_TRUE : JNI_FALSE);
-+    }
-+}
-+
-+#else // !LINUX
-+
-+JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEnabled
-+  (JNIEnv *env, jclass cls)
-+{
-+    return JNI_FALSE;
-+}
-+
-+#endif
-diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
-new file mode 100644
-index 00000000000..48d6d656a28
---- /dev/null
-+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
-@@ -0,0 +1,457 @@
-+/*
-+ * Copyright (c) 2021, Red Hat, Inc.
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation.  Oracle designates this
-+ * particular file as subject to the "Classpath" exception as provided
-+ * by Oracle in the LICENSE file that accompanied this code.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+package sun.security.pkcs11;
-+
-+import java.math.BigInteger;
-+import java.security.KeyFactory;
-+import java.security.Provider;
-+import java.security.Security;
-+import java.security.interfaces.RSAPrivateCrtKey;
-+import java.security.interfaces.RSAPrivateKey;
-+import java.util.HashMap;
-+import java.util.Map;
-+import java.util.concurrent.locks.ReentrantLock;
-+
-+import javax.crypto.Cipher;
-+import javax.crypto.SecretKeyFactory;
-+import javax.crypto.spec.SecretKeySpec;
-+import javax.crypto.spec.IvParameterSpec;
-+
-+import sun.security.jca.JCAUtil;
-+import sun.security.pkcs11.TemplateManager;
-+import sun.security.pkcs11.wrapper.CK_ATTRIBUTE;
-+import sun.security.pkcs11.wrapper.CK_MECHANISM;
-+import static sun.security.pkcs11.wrapper.PKCS11Constants.*;
-+import static sun.security.pkcs11.wrapper.PKCS11Exception.RV.*;
-+import sun.security.pkcs11.wrapper.PKCS11Exception;
-+import sun.security.rsa.RSAPrivateCrtKeyImpl;
-+import sun.security.rsa.RSAUtil;
-+import sun.security.rsa.RSAUtil.KeyType;
-+import sun.security.util.Debug;
-+import sun.security.util.ECUtil;
-+
-+final class FIPSKeyImporter {
-+
-+    private static final Debug debug =
-+            Debug.getInstance("sunpkcs11");
-+
-+    private static volatile P11Key importerKey = null;
-+    private static SecretKeySpec exporterKey = null;
-+    private static volatile P11Key exporterKeyP11 = null;
-+    private static final ReentrantLock importerKeyLock = new ReentrantLock();
-+    // Do not take the exporterKeyLock with the importerKeyLock held.
-+    private static final ReentrantLock exporterKeyLock = new ReentrantLock();
-+    private static volatile CK_MECHANISM importerKeyMechanism = null;
-+    private static volatile CK_MECHANISM exporterKeyMechanism = null;
-+    private static Cipher importerCipher = null;
-+    private static Cipher exporterCipher = null;
-+
-+    private static volatile Provider sunECProvider = null;
-+    private static final ReentrantLock sunECProviderLock = new ReentrantLock();
-+
-+    static Long importKey(SunPKCS11 sunPKCS11, long hSession, CK_ATTRIBUTE[] attributes)
-+            throws PKCS11Exception {
-+        long keyID = -1;
-+        Token token = sunPKCS11.getToken();
-+        if (debug != null) {
-+            debug.println("Private or Secret key will be imported in" +
-+                    " system FIPS mode.");
-+        }
-+        if (importerKey == null) {
-+            importerKeyLock.lock();
-+            try {
-+                if (importerKey == null) {
-+                    if (importerKeyMechanism == null) {
-+                        // Importer Key creation has not been tried yet. Try it.
-+                        createImporterKey(token);
-+                    }
-+                    if (importerKey == null || importerCipher == null) {
-+                        if (debug != null) {
-+                            debug.println("Importer Key could not be" +
-+                                    " generated.");
-+                        }
-+                        throw new PKCS11Exception(CKR_GENERAL_ERROR,
-+                                " fips key importer");
-+                    }
-+                    if (debug != null) {
-+                        debug.println("Importer Key successfully" +
-+                                " generated.");
-+                    }
-+                }
-+            } finally {
-+                importerKeyLock.unlock();
-+            }
-+        }
-+        long importerKeyID = importerKey.getKeyID();
-+        try {
-+            byte[] keyBytes = null;
-+            byte[] encKeyBytes = null;
-+            long keyClass = 0L;
-+            long keyType = 0L;
-+            Map<Long, CK_ATTRIBUTE> attrsMap = new HashMap<>();
-+            for (CK_ATTRIBUTE attr : attributes) {
-+                if (attr.type == CKA_CLASS) {
-+                    keyClass = attr.getLong();
-+                } else if (attr.type == CKA_KEY_TYPE) {
-+                    keyType = attr.getLong();
-+                }
-+                attrsMap.put(attr.type, attr);
-+            }
-+            BigInteger v = null;
-+            if (keyClass == CKO_PRIVATE_KEY) {
-+                if (keyType == CKK_RSA) {
-+                    if (debug != null) {
-+                        debug.println("Importing an RSA private key...");
-+                    }
-+                    keyBytes = sun.security.rsa.RSAPrivateCrtKeyImpl.newKey(
-+                            KeyType.RSA,
-+                            null,
-+                            ((v = attrsMap.get(CKA_MODULUS).getBigInteger()) != null)
-+                                    ? v : BigInteger.ZERO,
-+                            ((v = attrsMap.get(CKA_PUBLIC_EXPONENT).getBigInteger()) != null)
-+                                    ? v : BigInteger.ZERO,
-+                            ((v = attrsMap.get(CKA_PRIVATE_EXPONENT).getBigInteger()) != null)
-+                                    ? v : BigInteger.ZERO,
-+                            ((v = attrsMap.get(CKA_PRIME_1).getBigInteger()) != null)
-+                                    ? v : BigInteger.ZERO,
-+                            ((v = attrsMap.get(CKA_PRIME_2).getBigInteger()) != null)
-+                                    ? v : BigInteger.ZERO,
-+                            ((v = attrsMap.get(CKA_EXPONENT_1).getBigInteger()) != null)
-+                                    ? v : BigInteger.ZERO,
-+                            ((v = attrsMap.get(CKA_EXPONENT_2).getBigInteger()) != null)
-+                                    ? v : BigInteger.ZERO,
-+                            ((v = attrsMap.get(CKA_COEFFICIENT).getBigInteger()) != null)
-+                                    ? v : BigInteger.ZERO
-+                            ).getEncoded();
-+                } else if (keyType == CKK_DSA) {
-+                    if (debug != null) {
-+                        debug.println("Importing a DSA private key...");
-+                    }
-+                    keyBytes = new sun.security.provider.DSAPrivateKey(
-+                            ((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null)
-+                                    ? v : BigInteger.ZERO,
-+                            ((v = attrsMap.get(CKA_PRIME).getBigInteger()) != null)
-+                                    ? v : BigInteger.ZERO,
-+                            ((v = attrsMap.get(CKA_SUBPRIME).getBigInteger()) != null)
-+                                    ? v : BigInteger.ZERO,
-+                            ((v = attrsMap.get(CKA_BASE).getBigInteger()) != null)
-+                                    ? v : BigInteger.ZERO
-+                            ).getEncoded();
-+                    if (token.config.getNssNetscapeDbWorkaround() &&
-+                            attrsMap.get(CKA_NETSCAPE_DB) == null) {
-+                        attrsMap.put(CKA_NETSCAPE_DB,
-+                                new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO));
-+                    }
-+                } else if (keyType == CKK_EC) {
-+                    if (debug != null) {
-+                        debug.println("Importing an EC private key...");
-+                    }
-+                    if (sunECProvider == null) {
-+                        sunECProviderLock.lock();
-+                        try {
-+                            if (sunECProvider == null) {
-+                                sunECProvider = Security.getProvider("SunEC");
-+                            }
-+                        } finally {
-+                            sunECProviderLock.unlock();
-+                        }
-+                    }
-+                    keyBytes = ECUtil.generateECPrivateKey(
-+                            ((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null)
-+                                    ? v : BigInteger.ZERO,
-+                            ECUtil.getECParameterSpec(sunECProvider,
-+                                    attrsMap.get(CKA_EC_PARAMS).getByteArray()))
-+                            .getEncoded();
-+                    if (token.config.getNssNetscapeDbWorkaround() &&
-+                            attrsMap.get(CKA_NETSCAPE_DB) == null) {
-+                        attrsMap.put(CKA_NETSCAPE_DB,
-+                                new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO));
-+                    }
-+                } else {
-+                    if (debug != null) {
-+                        debug.println("Unrecognized private key type.");
-+                    }
-+                    throw new PKCS11Exception(CKR_GENERAL_ERROR,
-+                            " fips key importer");
-+                }
-+            } else if (keyClass == CKO_SECRET_KEY) {
-+                if (debug != null) {
-+                    debug.println("Importing a secret key...");
-+                }
-+                keyBytes = attrsMap.get(CKA_VALUE).getByteArray();
-+            }
-+            if (keyBytes == null || keyBytes.length == 0) {
-+                if (debug != null) {
-+                    debug.println("Private or secret key plain bytes could" +
-+                            " not be obtained. Import failed.");
-+                }
-+                throw new PKCS11Exception(CKR_GENERAL_ERROR,
-+                        " fips key importer");
-+            }
-+            attributes = new CK_ATTRIBUTE[attrsMap.size()];
-+            attrsMap.values().toArray(attributes);
-+            importerKeyLock.lock();
-+            try {
-+                // No need to reset the cipher object because no multi-part
-+                // operations are performed.
-+                encKeyBytes = importerCipher.doFinal(keyBytes);
-+            } finally {
-+                importerKeyLock.unlock();
-+            }
-+            attributes = token.getAttributes(TemplateManager.O_IMPORT,
-+                    keyClass, keyType, attributes);
-+            keyID = token.p11.C_UnwrapKey(hSession,
-+                    importerKeyMechanism, importerKeyID, encKeyBytes, attributes);
-+            if (debug != null) {
-+                debug.println("Imported key ID: " + keyID);
-+            }
-+        } catch (Throwable t) {
-+            if (t instanceof PKCS11Exception) {
-+                throw (PKCS11Exception)t;
-+            }
-+            throw new PKCS11Exception(CKR_GENERAL_ERROR,
-+                    t.getMessage());
-+        } finally {
-+            importerKey.releaseKeyID();
-+        }
-+        return Long.valueOf(keyID);
-+    }
-+
-+    static void exportKey(SunPKCS11 sunPKCS11, long hSession, long hObject,
-+            long keyClass, long keyType, Map<Long, CK_ATTRIBUTE> sensitiveAttrs)
-+            throws PKCS11Exception {
-+        Token token = sunPKCS11.getToken();
-+        if (debug != null) {
-+            debug.println("Private or Secret key will be exported in" +
-+                    " system FIPS mode.");
-+        }
-+        if (exporterKeyP11 == null) {
-+            try {
-+                exporterKeyLock.lock();
-+                if (exporterKeyP11 == null) {
-+                    if (exporterKeyMechanism == null) {
-+                        // Exporter Key creation has not been tried yet. Try it.
-+                        createExporterKey(token);
-+                    }
-+                    if (exporterKeyP11 == null || exporterCipher == null) {
-+                        if (debug != null) {
-+                            debug.println("Exporter Key could not be" +
-+                                    " generated.");
-+                        }
-+                        throw new PKCS11Exception(CKR_GENERAL_ERROR,
-+                                " fips key exporter");
-+                    }
-+                    if (debug != null) {
-+                        debug.println("Exporter Key successfully" +
-+                                " generated.");
-+                    }
-+                }
-+            } finally {
-+                exporterKeyLock.unlock();
-+            }
-+        }
-+        long exporterKeyID = exporterKeyP11.getKeyID();
-+        try {
-+            byte[] wrappedKeyBytes = token.p11.C_WrapKey(hSession,
-+                    exporterKeyMechanism, exporterKeyID, hObject);
-+            byte[] plainExportedKey = null;
-+            exporterKeyLock.lock();
-+            try {
-+                // No need to reset the cipher object because no multi-part
-+                // operations are performed.
-+                plainExportedKey = exporterCipher.doFinal(wrappedKeyBytes);
-+            } finally {
-+                exporterKeyLock.unlock();
-+            }
-+            if (keyClass == CKO_PRIVATE_KEY) {
-+                exportPrivateKey(sensitiveAttrs, keyType, plainExportedKey);
-+            } else if (keyClass == CKO_SECRET_KEY) {
-+                checkAttrs(sensitiveAttrs, "CKO_SECRET_KEY", CKA_VALUE);
-+                // CKA_VALUE is guaranteed to be present, since sensitiveAttrs'
-+                // size is greater than 0 and no invalid attributes exist
-+                sensitiveAttrs.get(CKA_VALUE).pValue = plainExportedKey;
-+            } else {
-+                throw new PKCS11Exception(CKR_GENERAL_ERROR,
-+                        " fips key exporter");
-+            }
-+        } catch (Throwable t) {
-+            if (t instanceof PKCS11Exception) {
-+                throw (PKCS11Exception)t;
-+            }
-+            throw new PKCS11Exception(CKR_GENERAL_ERROR,
-+                    t.getMessage());
-+        } finally {
-+            exporterKeyP11.releaseKeyID();
-+        }
-+    }
-+
-+    private static void exportPrivateKey(
-+            Map<Long, CK_ATTRIBUTE> sensitiveAttrs, long keyType,
-+            byte[] plainExportedKey) throws Throwable {
-+        if (keyType == CKK_RSA) {
-+            checkAttrs(sensitiveAttrs, "CKO_PRIVATE_KEY CKK_RSA",
-+                    CKA_PRIVATE_EXPONENT, CKA_PRIME_1, CKA_PRIME_2,
-+                    CKA_EXPONENT_1, CKA_EXPONENT_2, CKA_COEFFICIENT);
-+            RSAPrivateKey rsaPKey = RSAPrivateCrtKeyImpl.newKey(
-+                    RSAUtil.KeyType.RSA, "PKCS#8", plainExportedKey);
-+            CK_ATTRIBUTE attr;
-+            if ((attr = sensitiveAttrs.get(CKA_PRIVATE_EXPONENT)) != null) {
-+                attr.pValue = rsaPKey.getPrivateExponent().toByteArray();
-+            }
-+            if (rsaPKey instanceof RSAPrivateCrtKey) {
-+                RSAPrivateCrtKey rsaPCrtKey = (RSAPrivateCrtKey) rsaPKey;
-+                if ((attr = sensitiveAttrs.get(CKA_PRIME_1)) != null) {
-+                    attr.pValue = rsaPCrtKey.getPrimeP().toByteArray();
-+                }
-+                if ((attr = sensitiveAttrs.get(CKA_PRIME_2)) != null) {
-+                    attr.pValue = rsaPCrtKey.getPrimeQ().toByteArray();
-+                }
-+                if ((attr = sensitiveAttrs.get(CKA_EXPONENT_1)) != null) {
-+                    attr.pValue = rsaPCrtKey.getPrimeExponentP().toByteArray();
-+                }
-+                if ((attr = sensitiveAttrs.get(CKA_EXPONENT_2)) != null) {
-+                    attr.pValue = rsaPCrtKey.getPrimeExponentQ().toByteArray();
-+                }
-+                if ((attr = sensitiveAttrs.get(CKA_COEFFICIENT)) != null) {
-+                    attr.pValue = rsaPCrtKey.getCrtCoefficient().toByteArray();
-+                }
-+            } else {
-+                checkAttrs(sensitiveAttrs, "CKO_PRIVATE_KEY CKK_RSA",
-+                        CKA_PRIVATE_EXPONENT);
-+            }
-+        } else if (keyType == CKK_DSA) {
-+            checkAttrs(sensitiveAttrs, "CKO_PRIVATE_KEY CKK_DSA", CKA_VALUE);
-+            // CKA_VALUE is guaranteed to be present, since sensitiveAttrs'
-+            // size is greater than 0 and no invalid attributes exist
-+            sensitiveAttrs.get(CKA_VALUE).pValue =
-+                    new sun.security.provider.DSAPrivateKey(plainExportedKey)
-+                            .getX().toByteArray();
-+        } else if (keyType == CKK_EC) {
-+            checkAttrs(sensitiveAttrs, "CKO_PRIVATE_KEY CKK_EC", CKA_VALUE);
-+            // CKA_VALUE is guaranteed to be present, since sensitiveAttrs'
-+            // size is greater than 0 and no invalid attributes exist
-+            sensitiveAttrs.get(CKA_VALUE).pValue =
-+                    ECUtil.decodePKCS8ECPrivateKey(plainExportedKey)
-+                            .getS().toByteArray();
-+        } else {
-+            throw new PKCS11Exception(CKR_GENERAL_ERROR,
-+                    " unsupported CKO_PRIVATE_KEY key type: " + keyType);
-+        }
-+    }
-+
-+    private static void checkAttrs(Map<Long, CK_ATTRIBUTE> sensitiveAttrs,
-+                                     String keyName, long... validAttrs)
-+            throws PKCS11Exception {
-+        int sensitiveAttrsCount = sensitiveAttrs.size();
-+        if (sensitiveAttrsCount <= validAttrs.length) {
-+            int validAttrsCount = 0;
-+            for (long validAttr : validAttrs) {
-+                if (sensitiveAttrs.containsKey(validAttr)) validAttrsCount++;
-+            }
-+            if (validAttrsCount == sensitiveAttrsCount) return;
-+        }
-+        throw new PKCS11Exception(CKR_GENERAL_ERROR,
-+                " invalid attribute types for a " + keyName + " key object");
-+    }
-+
-+    private static void createImporterKey(Token token) {
-+        if (debug != null) {
-+            debug.println("Generating Importer Key...");
-+        }
-+        byte[] iv = new byte[16];
-+        JCAUtil.getSecureRandom().nextBytes(iv);
-+        importerKeyMechanism = new CK_MECHANISM(CKM_AES_CBC_PAD, iv);
-+        try {
-+            CK_ATTRIBUTE[] attributes = token.getAttributes(TemplateManager.O_GENERATE,
-+                            CKO_SECRET_KEY, CKK_AES, new CK_ATTRIBUTE[] {
-+                                    new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY),
-+                                    new CK_ATTRIBUTE(CKA_VALUE_LEN, 256 >> 3)});
-+            Session s = null;
-+            try {
-+                s = token.getObjSession();
-+                long keyID = token.p11.C_GenerateKey(
-+                        s.id(), new CK_MECHANISM(CKM_AES_KEY_GEN),
-+                        attributes);
-+                if (debug != null) {
-+                    debug.println("Importer Key ID: " + keyID);
-+                }
-+                importerKey = (P11Key)P11Key.secretKey(s, keyID, "AES",
-+                        256 >> 3, null);
-+            } catch (PKCS11Exception e) {
-+                // best effort
-+            } finally {
-+                token.releaseSession(s);
-+            }
-+            if (importerKey != null) {
-+                importerCipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
-+                importerCipher.init(Cipher.ENCRYPT_MODE, importerKey,
-+                        new IvParameterSpec(
-+                                (byte[])importerKeyMechanism.pParameter), null);
-+            }
-+        } catch (Throwable t) {
-+            // best effort
-+            importerKey = null;
-+            importerCipher = null;
-+            // importerKeyMechanism value is kept initialized to indicate that
-+            // Importer Key creation has been tried and failed.
-+            if (debug != null) {
-+                debug.println("Error generating the Importer Key");
-+            }
-+        }
-+    }
-+
-+    private static void createExporterKey(Token token) {
-+        if (debug != null) {
-+            debug.println("Generating Exporter Key...");
-+        }
-+        byte[] iv = new byte[16];
-+        JCAUtil.getSecureRandom().nextBytes(iv);
-+        exporterKeyMechanism = new CK_MECHANISM(CKM_AES_CBC_PAD, iv);
-+        byte[] exporterKeyRaw = new byte[32];
-+        JCAUtil.getSecureRandom().nextBytes(exporterKeyRaw);
-+        exporterKey = new SecretKeySpec(exporterKeyRaw, "AES");
-+        try {
-+            SecretKeyFactory skf = SecretKeyFactory.getInstance("AES");
-+            exporterKeyP11 = (P11Key)(skf.translateKey(exporterKey));
-+            if (exporterKeyP11 != null) {
-+                exporterCipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
-+                exporterCipher.init(Cipher.DECRYPT_MODE, exporterKey,
-+                        new IvParameterSpec(
-+                                (byte[])exporterKeyMechanism.pParameter), null);
-+            }
-+        } catch (Throwable t) {
-+            // best effort
-+            exporterKey = null;
-+            exporterKeyP11 = null;
-+            exporterCipher = null;
-+            // exporterKeyMechanism value is kept initialized to indicate that
-+            // Exporter Key creation has been tried and failed.
-+            if (debug != null) {
-+                debug.println("Error generating the Exporter Key");
-+            }
-+        }
-+    }
-+}
-diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSTokenLoginHandler.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSTokenLoginHandler.java
-new file mode 100644
-index 00000000000..f8d505ca815
---- /dev/null
-+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSTokenLoginHandler.java
-@@ -0,0 +1,149 @@
-+/*
-+ * Copyright (c) 2022, Red Hat, Inc.
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation.  Oracle designates this
-+ * particular file as subject to the "Classpath" exception as provided
-+ * by Oracle in the LICENSE file that accompanied this code.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+package sun.security.pkcs11;
-+
-+import java.io.BufferedReader;
-+import java.io.ByteArrayInputStream;
-+import java.io.InputStream;
-+import java.io.InputStreamReader;
-+import java.io.IOException;
-+import java.nio.charset.StandardCharsets;
-+import java.nio.file.Files;
-+import java.nio.file.Path;
-+import java.nio.file.Paths;
-+import java.nio.file.StandardOpenOption;
-+import java.security.ProviderException;
-+
-+import javax.security.auth.callback.Callback;
-+import javax.security.auth.callback.CallbackHandler;
-+import javax.security.auth.callback.PasswordCallback;
-+import javax.security.auth.callback.UnsupportedCallbackException;
-+
-+import sun.security.util.Debug;
-+import sun.security.util.SecurityProperties;
-+
-+final class FIPSTokenLoginHandler implements CallbackHandler {
-+
-+    private static final String FIPS_NSSDB_PIN_PROP = "fips.nssdb.pin";
-+
-+    private static final Debug debug = Debug.getInstance("sunpkcs11");
-+
-+    public void handle(Callback[] callbacks)
-+            throws IOException, UnsupportedCallbackException {
-+        if (!(callbacks[0] instanceof PasswordCallback)) {
-+            throw new UnsupportedCallbackException(callbacks[0]);
-+        }
-+        PasswordCallback pc = (PasswordCallback)callbacks[0];
-+        pc.setPassword(getFipsNssdbPin());
-+    }
-+
-+    private static char[] getFipsNssdbPin() throws ProviderException {
-+        if (debug != null) {
-+            debug.println("FIPS: Reading NSS DB PIN for token...");
-+        }
-+        String pinProp = SecurityProperties
-+                .privilegedGetOverridable(FIPS_NSSDB_PIN_PROP);
-+        if (pinProp != null && !pinProp.isEmpty()) {
-+            String[] pinPropParts = pinProp.split(":", 2);
-+            if (pinPropParts.length < 2) {
-+                throw new ProviderException("Invalid " + FIPS_NSSDB_PIN_PROP +
-+                        " property value.");
-+            }
-+            String prefix = pinPropParts[0].toLowerCase();
-+            String value = pinPropParts[1];
-+            String pin = null;
-+            if (prefix.equals("env")) {
-+                if (debug != null) {
-+                    debug.println("FIPS: PIN value from the '" + value +
-+                            "' environment variable.");
-+                }
-+                pin = System.getenv(value);
-+            } else if (prefix.equals("file")) {
-+                if (debug != null) {
-+                    debug.println("FIPS: PIN value from the '" + value +
-+                            "' file.");
-+                }
-+                pin = getPinFromFile(Paths.get(value));
-+            } else if (prefix.equals("pin")) {
-+                if (debug != null) {
-+                    debug.println("FIPS: PIN value from the " +
-+                            FIPS_NSSDB_PIN_PROP + " property.");
-+                }
-+                pin = value;
-+            } else {
-+                throw new ProviderException("Unsupported prefix for " +
-+                        FIPS_NSSDB_PIN_PROP + ".");
-+            }
-+            if (pin != null && !pin.isEmpty()) {
-+                if (debug != null) {
-+                    debug.println("FIPS: non-empty PIN.");
-+                }
-+                /*
-+                 * C_Login in libj2pkcs11 receives the PIN in a char[] and
-+                 * discards the upper byte of each char, before passing
-+                 * the value to the NSS Software Token. However, the
-+                 * NSS Software Token accepts any UTF-8 PIN value. Thus,
-+                 * expand the PIN here to account for later truncation.
-+                 */
-+                byte[] pinUtf8 = pin.getBytes(StandardCharsets.UTF_8);
-+                char[] pinChar = new char[pinUtf8.length];
-+                for (int i = 0; i < pinChar.length; i++) {
-+                    pinChar[i] = (char)(pinUtf8[i] & 0xFF);
-+                }
-+                return pinChar;
-+            }
-+        }
-+        if (debug != null) {
-+            debug.println("FIPS: empty PIN.");
-+        }
-+        return null;
-+    }
-+
-+    /*
-+     * This method extracts the token PIN from the first line of a password
-+     * file in the same way as NSS modutil. See for example the -newpwfile
-+     * argument used to change the password for an NSS DB.
-+     */
-+    private static String getPinFromFile(Path f) throws ProviderException {
-+        try (InputStream is =
-+                Files.newInputStream(f, StandardOpenOption.READ)) {
-+            /*
-+             * SECU_FilePasswd in NSS (nss/cmd/lib/secutil.c), used by modutil,
-+             * reads up to 4096 bytes. In addition, the NSS Software Token
-+             * does not accept PINs longer than 500 bytes (see SFTK_MAX_PIN
-+             * in nss/lib/softoken/pkcs11i.h).
-+             */
-+            BufferedReader in =
-+                    new BufferedReader(new InputStreamReader(
-+                            new ByteArrayInputStream(is.readNBytes(4096)),
-+                            StandardCharsets.UTF_8));
-+            return in.readLine();
-+        } catch (IOException ioe) {
-+            throw new ProviderException("Error reading " + FIPS_NSSDB_PIN_PROP +
-+                    " from the '" + f + "' file.", ioe);
-+        }
-+    }
-+}
-\ No newline at end of file
-diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
-index 6b26297b1b4..7ee5e07756c 100644
---- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
-+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
-@@ -37,6 +37,8 @@ import javax.crypto.*;
- import javax.crypto.interfaces.*;
- import javax.crypto.spec.*;
- 
-+import jdk.internal.access.SharedSecrets;
-+
- import sun.security.rsa.RSAUtil.KeyType;
- import sun.security.rsa.RSAPublicKeyImpl;
- import sun.security.rsa.RSAPrivateCrtKeyImpl;
-@@ -72,6 +74,9 @@ abstract class P11Key implements Key, Length {
-     @Serial
-     private static final long serialVersionUID = -2575874101938349339L;
- 
-+    private static final boolean plainKeySupportEnabled = SharedSecrets
-+            .getJavaSecuritySystemConfiguratorAccess().isPlainKeySupportEnabled();
-+
-     private static final String PUBLIC = "public";
-     private static final String PRIVATE = "private";
-     private static final String SECRET = "secret";
-@@ -401,8 +406,10 @@ abstract class P11Key implements Key, Length {
-                     new CK_ATTRIBUTE(CKA_EXTRACTABLE),
-         });
- 
--        boolean keySensitive = (attrs[0].getBoolean() ||
--                attrs[1].getBoolean() || !attrs[2].getBoolean());
-+        boolean exportable = plainKeySupportEnabled && !algorithm.equals("DH");
-+        boolean keySensitive = (!exportable &&
-+            (attrs[0].getBoolean() ||
-+             attrs[1].getBoolean() || !attrs[2].getBoolean()));
- 
-         return switch (algorithm) {
-             case "RSA" -> P11RSAPrivateKeyInternal.of(session, keyID, algorithm,
-@@ -454,7 +461,8 @@ abstract class P11Key implements Key, Length {
- 
-         public String getFormat() {
-             token.ensureValid();
--            if (sensitive || !extractable || (isNSS && tokenObject)) {
-+            if (!plainKeySupportEnabled &&
-+                (sensitive || !extractable || (isNSS && tokenObject))) {
-                 return null;
-             } else {
-                 return "RAW";
-@@ -1624,4 +1632,3 @@ final class SessionKeyRef extends PhantomReference<P11Key> {
-         this.clear();
-     }
- }
--
-diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
-index 5cd6828d293..bae49c4e8a9 100644
---- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
-+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java
-@@ -26,6 +26,9 @@
- package sun.security.pkcs11;
- 
- import java.io.*;
-+import java.lang.invoke.MethodHandle;
-+import java.lang.invoke.MethodHandles;
-+import java.lang.invoke.MethodType;
- import java.util.*;
- 
- import java.security.*;
-@@ -42,10 +45,12 @@ import javax.security.auth.callback.PasswordCallback;
- 
- import com.sun.crypto.provider.ChaCha20Poly1305Parameters;
- 
-+import jdk.internal.access.SharedSecrets;
- import jdk.internal.misc.InnocuousThread;
- import sun.security.util.Debug;
- import sun.security.util.ResourcesMgr;
- import static sun.security.util.SecurityConstants.PROVIDER_VER;
-+import sun.security.util.SecurityProperties;
- import static sun.security.util.SecurityProviderConstants.getAliases;
- 
- import sun.security.pkcs11.Secmod.*;
-@@ -65,6 +70,39 @@ public final class SunPKCS11 extends AuthProvider {
-     @Serial
-     private static final long serialVersionUID = -1354835039035306505L;
- 
-+    private static final boolean systemFipsEnabled = SharedSecrets
-+            .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled();
-+
-+    private static final boolean plainKeySupportEnabled = SharedSecrets
-+            .getJavaSecuritySystemConfiguratorAccess().isPlainKeySupportEnabled();
-+
-+    private static final MethodHandle fipsImportKey;
-+    private static final MethodHandle fipsExportKey;
-+    static {
-+        MethodHandle fipsImportKeyTmp = null;
-+        MethodHandle fipsExportKeyTmp = null;
-+        if (plainKeySupportEnabled) {
-+            try {
-+                fipsImportKeyTmp = MethodHandles.lookup().findStatic(
-+                        FIPSKeyImporter.class, "importKey",
-+                        MethodType.methodType(Long.class, SunPKCS11.class,
-+                        long.class, CK_ATTRIBUTE[].class));
-+                fipsExportKeyTmp = MethodHandles.lookup().findStatic(
-+                        FIPSKeyImporter.class, "exportKey",
-+                        MethodType.methodType(void.class, SunPKCS11.class,
-+                        long.class, long.class,
-+                        long.class, long.class, Map.class));
-+            } catch (Throwable t) {
-+                throw new SecurityException("FIPS key importer-exporter" +
-+                        " initialization failed", t);
-+            }
-+        }
-+        fipsImportKey = fipsImportKeyTmp;
-+        fipsExportKey = fipsExportKeyTmp;
-+    }
-+
-+    private static final String FIPS_NSSDB_PATH_PROP = "fips.nssdb.path";
-+
-     static final Debug debug = Debug.getInstance("sunpkcs11");
-     // the PKCS11 object through which we make the native calls
-     @SuppressWarnings("serial") // Type of field is not Serializable;
-@@ -123,6 +161,29 @@ public final class SunPKCS11 extends AuthProvider {
-             return AccessController.doPrivileged(new PrivilegedExceptionAction<>() {
-                 @Override
-                 public SunPKCS11 run() throws Exception {
-+                    if (systemFipsEnabled) {
-+                        /*
-+                         * The nssSecmodDirectory attribute in the SunPKCS11
-+                         * NSS configuration file takes the value of the
-+                         * fips.nssdb.path System property after expansion.
-+                         * Security properties expansion is unsupported.
-+                         */
-+                        String nssdbPath =
-+                                SecurityProperties.privilegedGetOverridable(
-+                                        FIPS_NSSDB_PATH_PROP);
-+                        if (System.getSecurityManager() != null) {
-+                            AccessController.doPrivileged(
-+                                    (PrivilegedAction<Void>) () -> {
-+                                        System.setProperty(
-+                                                FIPS_NSSDB_PATH_PROP,
-+                                                nssdbPath);
-+                                        return null;
-+                                    });
-+                        } else {
-+                            System.setProperty(
-+                                    FIPS_NSSDB_PATH_PROP, nssdbPath);
-+                        }
-+                    }
-                     return new SunPKCS11(new Config(newConfigName));
-                 }
-             });
-@@ -325,9 +386,19 @@ public final class SunPKCS11 extends AuthProvider {
-             // request multithreaded access first
-             initArgs.flags = CKF_OS_LOCKING_OK;
-             PKCS11 tmpPKCS11;
-+            MethodHandle fipsKeyImporter = null;
-+            MethodHandle fipsKeyExporter = null;
-+            if (plainKeySupportEnabled) {
-+                fipsKeyImporter = MethodHandles.insertArguments(
-+                        fipsImportKey, 0, this);
-+                fipsKeyExporter = MethodHandles.insertArguments(
-+                        fipsExportKey, 0, this);
-+            }
-             try {
--                tmpPKCS11 = PKCS11.getInstance(library, functionList, initArgs,
--                    config.getOmitInitialize());
-+                tmpPKCS11 = PKCS11.getInstance(
-+                    library, functionList, initArgs,
-+                    config.getOmitInitialize(), fipsKeyImporter,
-+                    fipsKeyExporter);
-             } catch (PKCS11Exception e) {
-                 if (debug != null) {
-                     debug.println("Multi-threaded initialization failed: " + e);
-@@ -342,8 +413,9 @@ public final class SunPKCS11 extends AuthProvider {
-                 } else {
-                     initArgs.flags = 0;
-                 }
--                tmpPKCS11 = PKCS11.getInstance(library, functionList, initArgs,
--                    config.getOmitInitialize());
-+                tmpPKCS11 = PKCS11.getInstance(library,
-+                    functionList, initArgs, config.getOmitInitialize(), fipsKeyImporter,
-+                    fipsKeyExporter);
-             }
-             p11 = tmpPKCS11;
- 
-@@ -1389,11 +1461,52 @@ public final class SunPKCS11 extends AuthProvider {
-         }
- 
-         @Override
-+        @SuppressWarnings("removal")
-         public Object newInstance(Object param)
-                 throws NoSuchAlgorithmException {
-             if (!token.isValid()) {
-                 throw new NoSuchAlgorithmException("Token has been removed");
-             }
-+            if (systemFipsEnabled && !token.fipsLoggedIn &&
-+                    !getType().equals("KeyStore")) {
-+                /*
-+                 * The NSS Software Token in FIPS 140-2 mode requires a
-+                 * user login for most operations. See sftk_fipsCheck
-+                 * (nss/lib/softoken/fipstokn.c). In case of a KeyStore
-+                 * service, let the caller perform the login with
-+                 * KeyStore::load. Keytool, for example, does this to pass a
-+                 * PIN from either the -srcstorepass or -deststorepass
-+                 * argument. In case of a non-KeyStore service, perform the
-+                 * login now with the PIN available in the fips.nssdb.pin
-+                 * property.
-+                 */
-+                try {
-+                    if (System.getSecurityManager() != null) {
-+                        try {
-+                            AccessController.doPrivileged(
-+                                    (PrivilegedExceptionAction<Void>) () -> {
-+                                        token.ensureLoggedIn(null);
-+                                        return null;
-+                                    });
-+                        } catch (PrivilegedActionException pae) {
-+                            Exception e = pae.getException();
-+                            if (e instanceof LoginException le) {
-+                                throw le;
-+                            } else if (e instanceof PKCS11Exception p11e) {
-+                                throw p11e;
-+                            } else {
-+                                throw new RuntimeException(e);
-+                            }
-+                        }
-+                    } else {
-+                        token.ensureLoggedIn(null);
-+                    }
-+                } catch (PKCS11Exception | LoginException e) {
-+                    throw new ProviderException("FIPS: error during the Token" +
-+                            " login required for the " + getType() +
-+                            " service.", e);
-+                }
-+            }
-             try {
-                 return newInstance0(param);
-             } catch (PKCS11Exception e) {
-@@ -1750,6 +1863,9 @@ public final class SunPKCS11 extends AuthProvider {
-         try {
-             session = token.getOpSession();
-             p11.C_Logout(session.id());
-+            if (systemFipsEnabled) {
-+                token.fipsLoggedIn = false;
-+            }
-             if (debug != null) {
-                 debug.println("logout succeeded");
-             }
-diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java
-index 3378409ca1c..7602a92a252 100644
---- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java
-+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java
-@@ -33,6 +33,7 @@ import java.lang.ref.*;
- import java.security.*;
- import javax.security.auth.login.LoginException;
- 
-+import jdk.internal.access.SharedSecrets;
- import sun.security.jca.JCAUtil;
- 
- import sun.security.pkcs11.wrapper.*;
-@@ -48,6 +49,9 @@ import static sun.security.pkcs11.wrapper.PKCS11Exception.RV.*;
-  */
- final class Token implements Serializable {
- 
-+    private static final boolean systemFipsEnabled = SharedSecrets
-+            .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled();
-+
-     // need to be serializable to allow SecureRandom to be serialized
-     @Serial
-     private static final long serialVersionUID = 2541527649100571747L;
-@@ -125,6 +129,10 @@ final class Token implements Serializable {
-     // flag indicating whether we are logged in
-     private volatile boolean loggedIn;
- 
-+    // Flag indicating the login status for the NSS Software Token in FIPS mode.
-+    // This Token is never asynchronously removed. Used from SunPKCS11.
-+    volatile boolean fipsLoggedIn;
-+
-     // time we last checked login status
-     private long lastLoginCheck;
- 
-@@ -242,7 +250,12 @@ final class Token implements Serializable {
-     // call provider.login() if not
-     void ensureLoggedIn(Session session) throws PKCS11Exception, LoginException {
-         if (!isLoggedIn(session)) {
--            provider.login(null, null);
-+            if (systemFipsEnabled) {
-+                provider.login(null, new FIPSTokenLoginHandler());
-+                fipsLoggedIn = true;
-+            } else {
-+                provider.login(null, null);
-+            }
-         }
-     }
- 
-diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
-index 4b06daaf264..55e14945469 100644
---- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
-+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
-@@ -49,6 +49,9 @@ package sun.security.pkcs11.wrapper;
- 
- import java.io.File;
- import java.io.IOException;
-+import java.lang.invoke.MethodHandle;
-+import java.lang.invoke.MethodHandles;
-+import java.lang.invoke.MethodType;
- import java.util.*;
- 
- import java.security.AccessController;
-@@ -174,18 +177,43 @@ public class PKCS11 {
-         return version;
-     }
- 
-+    /*
-+     * Compatibility wrapper to allow this method to work as before
-+     * when FIPS mode support is not active.
-+     */
-+    public static synchronized PKCS11 getInstance(String pkcs11ModulePath,
-+           String functionList, CK_C_INITIALIZE_ARGS pInitArgs,
-+           boolean omitInitialize) throws IOException, PKCS11Exception {
-+        return getInstance(pkcs11ModulePath, functionList,
-+                           pInitArgs, omitInitialize, null, null);
-+    }
-+
-     public static synchronized PKCS11 getInstance(String pkcs11ModulePath,
-             String functionList, CK_C_INITIALIZE_ARGS pInitArgs,
--            boolean omitInitialize) throws IOException, PKCS11Exception {
-+            boolean omitInitialize, MethodHandle fipsKeyImporter,
-+            MethodHandle fipsKeyExporter)
-+                    throws IOException, PKCS11Exception {
-         // we may only call C_Initialize once per native .so/.dll
-         // so keep a cache using the (non-canonicalized!) path
-         PKCS11 pkcs11 = moduleMap.get(pkcs11ModulePath);
-         if (pkcs11 == null) {
-+            boolean nssFipsMode = fipsKeyImporter != null &&
-+                    fipsKeyExporter != null;
-             if ((pInitArgs != null)
-                     && ((pInitArgs.flags & CKF_OS_LOCKING_OK) != 0)) {
--                pkcs11 = new PKCS11(pkcs11ModulePath, functionList);
-+                if (nssFipsMode) {
-+                    pkcs11 = new FIPSPKCS11(pkcs11ModulePath, functionList,
-+                            fipsKeyImporter, fipsKeyExporter);
-+                } else {
-+                    pkcs11 = new PKCS11(pkcs11ModulePath, functionList);
-+                }
-             } else {
--                pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList);
-+                if (nssFipsMode) {
-+                    pkcs11 = new SynchronizedFIPSPKCS11(pkcs11ModulePath,
-+                            functionList, fipsKeyImporter, fipsKeyExporter);
-+                } else {
-+                    pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList);
-+                }
-             }
-             if (omitInitialize == false) {
-                 try {
-@@ -1976,4 +2004,194 @@ static class SynchronizedPKCS11 extends PKCS11 {
-         super.C_GenerateRandom(hSession, randomData);
-     }
- }
-+
-+// PKCS11 subclass that allows using plain private or secret keys in
-+// FIPS-configured NSS Software Tokens. Only used when System FIPS
-+// is enabled.
-+static class FIPSPKCS11 extends PKCS11 {
-+    private MethodHandle fipsKeyImporter;
-+    private MethodHandle fipsKeyExporter;
-+    private MethodHandle hC_GetAttributeValue;
-+    FIPSPKCS11(String pkcs11ModulePath, String functionListName,
-+            MethodHandle fipsKeyImporter, MethodHandle fipsKeyExporter)
-+                    throws IOException {
-+        super(pkcs11ModulePath, functionListName);
-+        this.fipsKeyImporter = fipsKeyImporter;
-+        this.fipsKeyExporter = fipsKeyExporter;
-+        try {
-+            hC_GetAttributeValue = MethodHandles.insertArguments(
-+                    MethodHandles.lookup().findSpecial(PKCS11.class,
-+                            "C_GetAttributeValue", MethodType.methodType(
-+                                    void.class, long.class, long.class,
-+                                    CK_ATTRIBUTE[].class),
-+                            FIPSPKCS11.class), 0, this);
-+        } catch (Throwable t) {
-+            throw new RuntimeException(
-+                    "sun.security.pkcs11.wrapper.PKCS11" +
-+                    "::C_GetAttributeValue method not found.", t);
-+        }
-+    }
-+
-+    public long C_CreateObject(long hSession,
-+            CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception {
-+        // Creating sensitive key objects from plain key material in a
-+        // FIPS-configured NSS Software Token is not allowed. We apply
-+        // a key-unwrapping scheme to achieve so.
-+        if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) {
-+            try {
-+                return ((Long)fipsKeyImporter.invoke(hSession, pTemplate))
-+                        .longValue();
-+            } catch (Throwable t) {
-+                if (t instanceof PKCS11Exception) {
-+                    throw (PKCS11Exception)t;
-+                }
-+                throw new PKCS11Exception(CKR_GENERAL_ERROR,
-+                        t.getMessage());
-+            }
-+        }
-+        return super.C_CreateObject(hSession, pTemplate);
-+    }
-+
-+    public void C_GetAttributeValue(long hSession, long hObject,
-+            CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception {
-+        FIPSPKCS11Helper.C_GetAttributeValue(hC_GetAttributeValue,
-+                fipsKeyExporter, hSession, hObject, pTemplate);
-+    }
-+}
-+
-+// FIPSPKCS11 synchronized counterpart.
-+static class SynchronizedFIPSPKCS11 extends SynchronizedPKCS11 {
-+    private MethodHandle fipsKeyImporter;
-+    private MethodHandle fipsKeyExporter;
-+    private MethodHandle hC_GetAttributeValue;
-+    SynchronizedFIPSPKCS11(String pkcs11ModulePath, String functionListName,
-+            MethodHandle fipsKeyImporter, MethodHandle fipsKeyExporter)
-+                    throws IOException {
-+        super(pkcs11ModulePath, functionListName);
-+        this.fipsKeyImporter = fipsKeyImporter;
-+        this.fipsKeyExporter = fipsKeyExporter;
-+        try {
-+            hC_GetAttributeValue = MethodHandles.insertArguments(
-+                    MethodHandles.lookup().findSpecial(SynchronizedPKCS11.class,
-+                            "C_GetAttributeValue", MethodType.methodType(
-+                                    void.class, long.class, long.class,
-+                                    CK_ATTRIBUTE[].class),
-+                            SynchronizedFIPSPKCS11.class), 0, this);
-+        } catch (Throwable t) {
-+            throw new RuntimeException(
-+                    "sun.security.pkcs11.wrapper.SynchronizedPKCS11" +
-+                    "::C_GetAttributeValue method not found.", t);
-+        }
-+    }
-+
-+    public synchronized long C_CreateObject(long hSession,
-+            CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception {
-+        // See FIPSPKCS11::C_CreateObject.
-+        if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) {
-+            try {
-+                return ((Long)fipsKeyImporter.invoke(hSession, pTemplate))
-+                        .longValue();
-+            } catch (Throwable t) {
-+                if (t instanceof PKCS11Exception) {
-+                    throw (PKCS11Exception)t;
-+                }
-+                throw new PKCS11Exception(CKR_GENERAL_ERROR,
-+                        t.getMessage());
-+            }
-+        }
-+        return super.C_CreateObject(hSession, pTemplate);
-+    }
-+
-+    public synchronized void C_GetAttributeValue(long hSession, long hObject,
-+            CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception {
-+        FIPSPKCS11Helper.C_GetAttributeValue(hC_GetAttributeValue,
-+                fipsKeyExporter, hSession, hObject, pTemplate);
-+    }
-+}
-+
-+private static class FIPSPKCS11Helper {
-+    static boolean isSensitiveObject(CK_ATTRIBUTE[] pTemplate) {
-+        for (CK_ATTRIBUTE attr : pTemplate) {
-+            if (attr.type == CKA_CLASS &&
-+                    (attr.getLong() == CKO_PRIVATE_KEY ||
-+                    attr.getLong() == CKO_SECRET_KEY)) {
-+                return true;
-+            }
-+        }
-+        return false;
-+    }
-+    static void C_GetAttributeValue(MethodHandle hC_GetAttributeValue,
-+            MethodHandle fipsKeyExporter, long hSession, long hObject,
-+            CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception {
-+        Map<Long, CK_ATTRIBUTE> sensitiveAttrs = new HashMap<>();
-+        List<CK_ATTRIBUTE> nonSensitiveAttrs = new LinkedList<>();
-+        FIPSPKCS11Helper.getAttributesBySensitivity(pTemplate,
-+                sensitiveAttrs, nonSensitiveAttrs);
-+        try {
-+            if (sensitiveAttrs.size() > 0) {
-+                long keyClass = -1L;
-+                long keyType = -1L;
-+                try {
-+                    // Secret and private keys have both class and type
-+                    // attributes, so we can query them at once.
-+                    CK_ATTRIBUTE[] queryAttrs = new CK_ATTRIBUTE[]{
-+                            new CK_ATTRIBUTE(CKA_CLASS),
-+                            new CK_ATTRIBUTE(CKA_KEY_TYPE),
-+                    };
-+                    hC_GetAttributeValue.invoke(hSession, hObject, queryAttrs);
-+                    keyClass = queryAttrs[0].getLong();
-+                    keyType = queryAttrs[1].getLong();
-+                } catch (PKCS11Exception e) {
-+                    // If the query fails, the object is neither a secret nor a
-+                    // private key. As this case won't be handled with the FIPS
-+                    // Key Exporter, we keep keyClass initialized to -1L.
-+                }
-+                if (keyClass == CKO_SECRET_KEY || keyClass == CKO_PRIVATE_KEY) {
-+                    fipsKeyExporter.invoke(hSession, hObject, keyClass, keyType,
-+                            sensitiveAttrs);
-+                    if (nonSensitiveAttrs.size() > 0) {
-+                        CK_ATTRIBUTE[] pNonSensitiveAttrs =
-+                                new CK_ATTRIBUTE[nonSensitiveAttrs.size()];
-+                        int i = 0;
-+                        for (CK_ATTRIBUTE nonSensAttr : nonSensitiveAttrs) {
-+                            pNonSensitiveAttrs[i++] = nonSensAttr;
-+                        }
-+                        hC_GetAttributeValue.invoke(hSession, hObject,
-+                                pNonSensitiveAttrs);
-+                        // libj2pkcs11 allocates new CK_ATTRIBUTE objects, so we
-+                        // update the reference on the previous CK_ATTRIBUTEs
-+                        i = 0;
-+                        for (CK_ATTRIBUTE nonSensAttr : nonSensitiveAttrs) {
-+                            nonSensAttr.pValue = pNonSensitiveAttrs[i++].pValue;
-+                        }
-+                    }
-+                    return;
-+                }
-+            }
-+            hC_GetAttributeValue.invoke(hSession, hObject, pTemplate);
-+        } catch (Throwable t) {
-+            if (t instanceof PKCS11Exception) {
-+                throw (PKCS11Exception)t;
-+            }
-+            throw new PKCS11Exception(CKR_GENERAL_ERROR,
-+                    t.getMessage());
-+        }
-+    }
-+    private static void getAttributesBySensitivity(CK_ATTRIBUTE[] pTemplate,
-+            Map<Long, CK_ATTRIBUTE> sensitiveAttrs,
-+            List<CK_ATTRIBUTE> nonSensitiveAttrs) {
-+        for (CK_ATTRIBUTE attr : pTemplate) {
-+            long type = attr.type;
-+            // Aligned with NSS' sftk_isSensitive in lib/softoken/pkcs11u.c
-+            if (type == CKA_VALUE || type == CKA_PRIVATE_EXPONENT ||
-+                    type == CKA_PRIME_1 || type == CKA_PRIME_2 ||
-+                    type == CKA_EXPONENT_1 || type == CKA_EXPONENT_2 ||
-+                    type == CKA_COEFFICIENT) {
-+                sensitiveAttrs.put(type, attr);
-+            } else {
-+                nonSensitiveAttrs.add(attr);
-+            }
-+        }
-+    }
-+}
- }
-diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java
-index 920422376f8..6aa308fa5f8 100644
---- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java
-+++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java
-@@ -215,6 +215,14 @@ public class PKCS11Exception extends Exception {
-         return res;
-     }
- 
-+    /**
-+     * Constructor taking the error code from the RV enum and
-+     * extra info for error message.
-+     */
-+    public PKCS11Exception(RV errorEnum, String extraInfo) {
-+        this(errorEnum.value, extraInfo);
-+    }
-+
-     /**
-      * Constructor taking the error code (the CKR_* constants in PKCS#11) and
-      * extra info for error message.
-diff --git a/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java b/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
-index 7f8c4dba002..e65b11fc3ee 100644
---- a/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
-+++ b/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java
-@@ -34,6 +34,7 @@ import java.security.ProviderException;
- import java.util.HashMap;
- import java.util.List;
- 
-+import jdk.internal.access.SharedSecrets;
- import sun.security.ec.ed.EdDSAKeyFactory;
- import sun.security.ec.ed.EdDSAKeyPairGenerator;
- import sun.security.ec.ed.EdDSASignature;
-@@ -50,6 +51,10 @@ public final class SunEC extends Provider {
- 
-     private static final long serialVersionUID = -2279741672933606418L;
- 
-+    private static final boolean systemFipsEnabled =
-+            SharedSecrets.getJavaSecuritySystemConfiguratorAccess()
-+            .isSystemFipsEnabled();
-+
-     private static class ProviderServiceA extends ProviderService {
-         ProviderServiceA(Provider p, String type, String algo, String cn,
-             HashMap<String, String> attrs) {
-@@ -240,83 +245,85 @@ public final class SunEC extends Provider {
-         putXDHEntries();
-         putEdDSAEntries();
- 
--        /*
--         * Signature engines
--         */
--        putService(new ProviderService(this, "Signature",
--            "NONEwithECDSA", "sun.security.ec.ECDSASignature$Raw",
--            null, ATTRS));
--        putService(new ProviderServiceA(this, "Signature",
--            "SHA1withECDSA", "sun.security.ec.ECDSASignature$SHA1",
--            ATTRS));
--        putService(new ProviderServiceA(this, "Signature",
--            "SHA224withECDSA", "sun.security.ec.ECDSASignature$SHA224",
--            ATTRS));
--        putService(new ProviderServiceA(this, "Signature",
--            "SHA256withECDSA", "sun.security.ec.ECDSASignature$SHA256",
--            ATTRS));
--        putService(new ProviderServiceA(this, "Signature",
--            "SHA384withECDSA", "sun.security.ec.ECDSASignature$SHA384",
--            ATTRS));
--        putService(new ProviderServiceA(this, "Signature",
--            "SHA512withECDSA", "sun.security.ec.ECDSASignature$SHA512",
--            ATTRS));
--        putService(new ProviderServiceA(this, "Signature",
--            "SHA3-224withECDSA", "sun.security.ec.ECDSASignature$SHA3_224",
--            ATTRS));
--        putService(new ProviderServiceA(this, "Signature",
--            "SHA3-256withECDSA", "sun.security.ec.ECDSASignature$SHA3_256",
--            ATTRS));
--        putService(new ProviderServiceA(this, "Signature",
--            "SHA3-384withECDSA", "sun.security.ec.ECDSASignature$SHA3_384",
--            ATTRS));
--        putService(new ProviderServiceA(this, "Signature",
--            "SHA3-512withECDSA", "sun.security.ec.ECDSASignature$SHA3_512",
--            ATTRS));
--
--        putService(new ProviderService(this, "Signature",
--             "NONEwithECDSAinP1363Format",
--             "sun.security.ec.ECDSASignature$RawinP1363Format"));
--        putService(new ProviderService(this, "Signature",
--             "SHA1withECDSAinP1363Format",
--             "sun.security.ec.ECDSASignature$SHA1inP1363Format"));
--        putService(new ProviderService(this, "Signature",
--             "SHA224withECDSAinP1363Format",
--             "sun.security.ec.ECDSASignature$SHA224inP1363Format"));
--        putService(new ProviderService(this, "Signature",
--             "SHA256withECDSAinP1363Format",
--             "sun.security.ec.ECDSASignature$SHA256inP1363Format"));
--        putService(new ProviderService(this, "Signature",
--            "SHA384withECDSAinP1363Format",
--            "sun.security.ec.ECDSASignature$SHA384inP1363Format"));
--        putService(new ProviderService(this, "Signature",
--            "SHA512withECDSAinP1363Format",
--            "sun.security.ec.ECDSASignature$SHA512inP1363Format"));
--
--        putService(new ProviderService(this, "Signature",
--             "SHA3-224withECDSAinP1363Format",
--             "sun.security.ec.ECDSASignature$SHA3_224inP1363Format"));
--        putService(new ProviderService(this, "Signature",
--             "SHA3-256withECDSAinP1363Format",
--             "sun.security.ec.ECDSASignature$SHA3_256inP1363Format"));
--        putService(new ProviderService(this, "Signature",
--            "SHA3-384withECDSAinP1363Format",
--            "sun.security.ec.ECDSASignature$SHA3_384inP1363Format"));
--        putService(new ProviderService(this, "Signature",
--            "SHA3-512withECDSAinP1363Format",
--            "sun.security.ec.ECDSASignature$SHA3_512inP1363Format"));
--
--        /*
--         *  Key Pair Generator engine
--         */
--        putService(new ProviderServiceA(this, "KeyPairGenerator",
--            "EC", "sun.security.ec.ECKeyPairGenerator", ATTRS));
--
--        /*
--         * Key Agreement engine
--         */
--        putService(new ProviderService(this, "KeyAgreement",
--            "ECDH", "sun.security.ec.ECDHKeyAgreement", null, ATTRS));
-+        if (!systemFipsEnabled) {
-+            /*
-+             * Signature engines
-+             */
-+            putService(new ProviderService(this, "Signature",
-+                "NONEwithECDSA", "sun.security.ec.ECDSASignature$Raw",
-+                null, ATTRS));
-+            putService(new ProviderServiceA(this, "Signature",
-+                "SHA1withECDSA", "sun.security.ec.ECDSASignature$SHA1",
-+                ATTRS));
-+            putService(new ProviderServiceA(this, "Signature",
-+                "SHA224withECDSA", "sun.security.ec.ECDSASignature$SHA224",
-+                ATTRS));
-+            putService(new ProviderServiceA(this, "Signature",
-+                "SHA256withECDSA", "sun.security.ec.ECDSASignature$SHA256",
-+                ATTRS));
-+            putService(new ProviderServiceA(this, "Signature",
-+                "SHA384withECDSA", "sun.security.ec.ECDSASignature$SHA384",
-+                ATTRS));
-+            putService(new ProviderServiceA(this, "Signature",
-+                "SHA512withECDSA", "sun.security.ec.ECDSASignature$SHA512",
-+                ATTRS));
-+            putService(new ProviderServiceA(this, "Signature",
-+                "SHA3-224withECDSA", "sun.security.ec.ECDSASignature$SHA3_224",
-+                ATTRS));
-+            putService(new ProviderServiceA(this, "Signature",
-+                "SHA3-256withECDSA", "sun.security.ec.ECDSASignature$SHA3_256",
-+                ATTRS));
-+            putService(new ProviderServiceA(this, "Signature",
-+                "SHA3-384withECDSA", "sun.security.ec.ECDSASignature$SHA3_384",
-+                ATTRS));
-+            putService(new ProviderServiceA(this, "Signature",
-+                "SHA3-512withECDSA", "sun.security.ec.ECDSASignature$SHA3_512",
-+                ATTRS));
-+
-+            putService(new ProviderService(this, "Signature",
-+                 "NONEwithECDSAinP1363Format",
-+                 "sun.security.ec.ECDSASignature$RawinP1363Format"));
-+            putService(new ProviderService(this, "Signature",
-+                 "SHA1withECDSAinP1363Format",
-+                 "sun.security.ec.ECDSASignature$SHA1inP1363Format"));
-+            putService(new ProviderService(this, "Signature",
-+                 "SHA224withECDSAinP1363Format",
-+                 "sun.security.ec.ECDSASignature$SHA224inP1363Format"));
-+            putService(new ProviderService(this, "Signature",
-+                 "SHA256withECDSAinP1363Format",
-+                 "sun.security.ec.ECDSASignature$SHA256inP1363Format"));
-+            putService(new ProviderService(this, "Signature",
-+                "SHA384withECDSAinP1363Format",
-+                "sun.security.ec.ECDSASignature$SHA384inP1363Format"));
-+            putService(new ProviderService(this, "Signature",
-+                "SHA512withECDSAinP1363Format",
-+                "sun.security.ec.ECDSASignature$SHA512inP1363Format"));
-+
-+            putService(new ProviderService(this, "Signature",
-+                 "SHA3-224withECDSAinP1363Format",
-+                 "sun.security.ec.ECDSASignature$SHA3_224inP1363Format"));
-+            putService(new ProviderService(this, "Signature",
-+                 "SHA3-256withECDSAinP1363Format",
-+                 "sun.security.ec.ECDSASignature$SHA3_256inP1363Format"));
-+            putService(new ProviderService(this, "Signature",
-+                "SHA3-384withECDSAinP1363Format",
-+                "sun.security.ec.ECDSASignature$SHA3_384inP1363Format"));
-+            putService(new ProviderService(this, "Signature",
-+                "SHA3-512withECDSAinP1363Format",
-+                "sun.security.ec.ECDSASignature$SHA3_512inP1363Format"));
-+
-+            /*
-+             *  Key Pair Generator engine
-+             */
-+            putService(new ProviderServiceA(this, "KeyPairGenerator",
-+                "EC", "sun.security.ec.ECKeyPairGenerator", ATTRS));
-+
-+            /*
-+             * Key Agreement engine
-+             */
-+            putService(new ProviderService(this, "KeyAgreement",
-+                "ECDH", "sun.security.ec.ECDHKeyAgreement", null, ATTRS));
-+        }
-     }
- 
-     private void putXDHEntries() {
-@@ -333,23 +340,25 @@ public final class SunEC extends Provider {
-             "X448", "sun.security.ec.XDHKeyFactory.X448",
-             ATTRS));
- 
--        putService(new ProviderService(this, "KeyPairGenerator",
--            "XDH", "sun.security.ec.XDHKeyPairGenerator", null, ATTRS));
--        putService(new ProviderServiceA(this, "KeyPairGenerator",
--            "X25519", "sun.security.ec.XDHKeyPairGenerator.X25519",
--            ATTRS));
--        putService(new ProviderServiceA(this, "KeyPairGenerator",
--            "X448", "sun.security.ec.XDHKeyPairGenerator.X448",
--            ATTRS));
--
--        putService(new ProviderService(this, "KeyAgreement",
--            "XDH", "sun.security.ec.XDHKeyAgreement", null, ATTRS));
--        putService(new ProviderServiceA(this, "KeyAgreement",
--            "X25519", "sun.security.ec.XDHKeyAgreement.X25519",
--            ATTRS));
--        putService(new ProviderServiceA(this, "KeyAgreement",
--            "X448", "sun.security.ec.XDHKeyAgreement.X448",
--            ATTRS));
-+        if (!systemFipsEnabled) {
-+            putService(new ProviderService(this, "KeyPairGenerator",
-+                "XDH", "sun.security.ec.XDHKeyPairGenerator", null, ATTRS));
-+            putService(new ProviderServiceA(this, "KeyPairGenerator",
-+                "X25519", "sun.security.ec.XDHKeyPairGenerator.X25519",
-+                ATTRS));
-+            putService(new ProviderServiceA(this, "KeyPairGenerator",
-+                "X448", "sun.security.ec.XDHKeyPairGenerator.X448",
-+                ATTRS));
-+
-+            putService(new ProviderService(this, "KeyAgreement",
-+                "XDH", "sun.security.ec.XDHKeyAgreement", null, ATTRS));
-+            putService(new ProviderServiceA(this, "KeyAgreement",
-+                "X25519", "sun.security.ec.XDHKeyAgreement.X25519",
-+                ATTRS));
-+            putService(new ProviderServiceA(this, "KeyAgreement",
-+                "X448", "sun.security.ec.XDHKeyAgreement.X448",
-+                ATTRS));
-+        }
-     }
- 
-     private void putEdDSAEntries() {
-@@ -364,21 +373,23 @@ public final class SunEC extends Provider {
-         putService(new ProviderServiceA(this, "KeyFactory",
-             "Ed448", "sun.security.ec.ed.EdDSAKeyFactory.Ed448", ATTRS));
- 
--        putService(new ProviderService(this, "KeyPairGenerator",
--            "EdDSA", "sun.security.ec.ed.EdDSAKeyPairGenerator", null, ATTRS));
--        putService(new ProviderServiceA(this, "KeyPairGenerator",
--            "Ed25519", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed25519",
--            ATTRS));
--        putService(new ProviderServiceA(this, "KeyPairGenerator",
--            "Ed448", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed448",
--            ATTRS));
--
--        putService(new ProviderService(this, "Signature",
--            "EdDSA", "sun.security.ec.ed.EdDSASignature", null, ATTRS));
--        putService(new ProviderServiceA(this, "Signature",
--            "Ed25519", "sun.security.ec.ed.EdDSASignature.Ed25519", ATTRS));
--        putService(new ProviderServiceA(this, "Signature",
--            "Ed448", "sun.security.ec.ed.EdDSASignature.Ed448", ATTRS));
-+        if (!systemFipsEnabled) {
-+            putService(new ProviderService(this, "KeyPairGenerator",
-+                "EdDSA", "sun.security.ec.ed.EdDSAKeyPairGenerator", null, ATTRS));
-+            putService(new ProviderServiceA(this, "KeyPairGenerator",
-+                "Ed25519", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed25519",
-+                ATTRS));
-+            putService(new ProviderServiceA(this, "KeyPairGenerator",
-+                "Ed448", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed448",
-+                ATTRS));
-+
-+            putService(new ProviderService(this, "Signature",
-+                "EdDSA", "sun.security.ec.ed.EdDSASignature", null, ATTRS));
-+            putService(new ProviderServiceA(this, "Signature",
-+                "Ed25519", "sun.security.ec.ed.EdDSASignature.Ed25519", ATTRS));
-+            putService(new ProviderServiceA(this, "Signature",
-+                "Ed448", "sun.security.ec.ed.EdDSASignature.Ed448", ATTRS));
-+        }
- 
-     }
- }
-diff --git a/test/jdk/sun/security/pkcs11/fips/NssdbPin.java b/test/jdk/sun/security/pkcs11/fips/NssdbPin.java
-new file mode 100644
-index 00000000000..ce01c655eb8
---- /dev/null
-+++ b/test/jdk/sun/security/pkcs11/fips/NssdbPin.java
-@@ -0,0 +1,349 @@
-+/*
-+ * Copyright (c) 2022, Red Hat, Inc.
-+ *
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+import java.lang.reflect.Method;
-+import java.nio.charset.StandardCharsets;
-+import java.nio.file.Files;
-+import java.nio.file.Path;
-+import java.security.KeyStore;
-+import java.security.Provider;
-+import java.security.Security;
-+import java.util.Arrays;
-+import java.util.function.Consumer;
-+import java.util.List;
-+import javax.crypto.Cipher;
-+import javax.crypto.spec.SecretKeySpec;
-+
-+import jdk.test.lib.process.Proc;
-+import jdk.test.lib.util.FileUtils;
-+
-+/*
-+ * @test
-+ * @bug 9999999
-+ * @summary
-+ *   Test that the fips.nssdb.path and fips.nssdb.pin properties can be used
-+ *   for a successful login into an NSS DB. Some additional unitary testing
-+ *   is then performed. This test depends on NSS modutil and must be run in
-+ *   FIPS mode (the SunPKCS11-NSS-FIPS security provider has to be available).
-+ * @modules jdk.crypto.cryptoki/sun.security.pkcs11:+open
-+ * @library /test/lib
-+ * @requires (jdk.version.major >= 8)
-+ * @run main/othervm/timeout=600 NssdbPin
-+ * @author Martin Balao (mbalao@redhat.com)
-+ */
-+
-+public final class NssdbPin {
-+
-+    // Public properties and names
-+    private static final String FIPS_NSSDB_PATH_PROP = "fips.nssdb.path";
-+    private static final String FIPS_NSSDB_PIN_PROP = "fips.nssdb.pin";
-+    private static final String FIPS_PROVIDER_NAME = "SunPKCS11-NSS-FIPS";
-+    private static final String NSSDB_TOKEN_NAME =
-+            "NSS FIPS 140-2 Certificate DB";
-+
-+    // Data to be tested
-+    private static final String[] PINS_TO_TEST =
-+            new String[] {
-+                    "",
-+                    "1234567890abcdef1234567890ABCDEF\uA4F7"
-+            };
-+    private static enum PropType { SYSTEM, SECURITY }
-+    private static enum LoginType { IMPLICIT, EXPLICIT }
-+
-+    // Internal test fields
-+    private static final boolean DEBUG = true;
-+    private static class TestContext {
-+        String pin;
-+        PropType propType;
-+        Path workspace;
-+        String nssdbPath;
-+        Path nssdbPinFile;
-+        LoginType loginType;
-+        TestContext(String pin, Path workspace) {
-+            this.pin = pin;
-+            this.workspace = workspace;
-+            this.nssdbPath = "sql:" + workspace;
-+            this.loginType = LoginType.IMPLICIT;
-+        }
-+    }
-+
-+    public static void main(String[] args) throws Throwable {
-+        if (args.length == 3) {
-+            // Executed by a child process.
-+            mainChild(args[0], args[1], LoginType.valueOf(args[2]));
-+        } else if (args.length == 0) {
-+            // Executed by the parent process.
-+            mainLauncher();
-+            // Test defaults
-+            mainChild("sql:/etc/pki/nssdb", "", LoginType.IMPLICIT);
-+            System.out.println("TEST PASS - OK");
-+        } else {
-+            throw new Exception("Unexpected number of arguments.");
-+        }
-+    }
-+
-+    private static void mainChild(String expectedPath, String expectedPin,
-+            LoginType loginType) throws Throwable {
-+        if (DEBUG) {
-+            for (String prop : Arrays.asList(FIPS_NSSDB_PATH_PROP,
-+                    FIPS_NSSDB_PIN_PROP)) {
-+                System.out.println(prop + " (System): " +
-+                        System.getProperty(prop));
-+                System.out.println(prop + " (Security): " +
-+                        Security.getProperty(prop));
-+            }
-+        }
-+
-+        /*
-+         * Functional cross-test against an NSS DB generated by modutil
-+         * with the same PIN. Check that we can perform a crypto operation
-+         * that requires a login. The login might be explicit or implicit.
-+         */
-+        Provider p = Security.getProvider(FIPS_PROVIDER_NAME);
-+        if (DEBUG) {
-+            System.out.println(FIPS_PROVIDER_NAME + ": " + p);
-+        }
-+        if (p == null) {
-+            throw new Exception(FIPS_PROVIDER_NAME + " initialization failed.");
-+        }
-+        if (DEBUG) {
-+            System.out.println("Login type: " + loginType);
-+        }
-+        if (loginType == LoginType.EXPLICIT) {
-+            // Do the expansion to account for truncation, so C_Login in
-+            // the NSS Software Token gets a UTF-8 encoded PIN.
-+            byte[] pinUtf8 = expectedPin.getBytes(StandardCharsets.UTF_8);
-+            char[] pinChar = new char[pinUtf8.length];
-+            for (int i = 0; i < pinChar.length; i++) {
-+                pinChar[i] = (char)(pinUtf8[i] & 0xFF);
-+            }
-+            KeyStore.getInstance("PKCS11", p).load(null, pinChar);
-+            if (DEBUG) {
-+                System.out.println("Explicit login succeeded.");
-+            }
-+        }
-+        if (DEBUG) {
-+            System.out.println("Trying a crypto operation...");
-+        }
-+        final int blockSize = 16;
-+        Cipher cipher = Cipher.getInstance("AES/ECB/NoPadding", p);
-+        cipher.init(Cipher.ENCRYPT_MODE,
-+                new SecretKeySpec(new byte[blockSize], "AES"));
-+        if (cipher.doFinal(new byte[blockSize]).length != blockSize) {
-+            throw new Exception("Could not perform a crypto operation.");
-+        }
-+        if (DEBUG) {
-+            if (loginType == LoginType.IMPLICIT) {
-+                System.out.println("Implicit login succeeded.");
-+            }
-+            System.out.println("Crypto operation after login succeeded.");
-+        }
-+
-+        if (loginType == LoginType.IMPLICIT) {
-+            /*
-+             * Additional unitary testing. Expected to succeed at this point.
-+             */
-+            if (DEBUG) {
-+                System.out.println("Trying unitary test...");
-+            }
-+            String sysPathProp = System.getProperty(FIPS_NSSDB_PATH_PROP);
-+            if (DEBUG) {
-+                System.out.println("Path value (as a System property): " +
-+                        sysPathProp);
-+            }
-+            if (!expectedPath.equals(sysPathProp)) {
-+                throw new Exception("Path is different than expected: " +
-+                        sysPathProp + " (actual) vs " + expectedPath +
-+                        " (expected).");
-+            }
-+            Class<?> c = Class
-+                    .forName("sun.security.pkcs11.FIPSTokenLoginHandler");
-+            Method m = c.getDeclaredMethod("getFipsNssdbPin");
-+            m.setAccessible(true);
-+            String pin = null;
-+            char[] pinChar = (char[]) m.invoke(c);
-+            if (pinChar != null) {
-+                byte[] pinUtf8 = new byte[pinChar.length];
-+                for (int i = 0; i < pinUtf8.length; i++) {
-+                    pinUtf8[i] = (byte) pinChar[i];
-+                }
-+                pin = new String(pinUtf8, StandardCharsets.UTF_8);
-+            }
-+            if (!expectedPin.isEmpty() && !expectedPin.equals(pin) ||
-+                    expectedPin.isEmpty() && pin != null) {
-+                throw new Exception("PIN is different than expected: '" + pin +
-+                         "' (actual) vs '" + expectedPin + "' (expected).");
-+            }
-+            if (DEBUG) {
-+                System.out.println("PIN value: " + pin);
-+                System.out.println("Unitary test succeeded.");
-+            }
-+        }
-+    }
-+
-+    private static void mainLauncher() throws Throwable {
-+        for (String pin : PINS_TO_TEST) {
-+            Path workspace = Files.createTempDirectory(null);
-+            try {
-+                TestContext ctx = new TestContext(pin, workspace);
-+                createNSSDB(ctx);
-+                {
-+                    ctx.loginType = LoginType.IMPLICIT;
-+                    for (PropType propType : PropType.values()) {
-+                        ctx.propType = propType;
-+                        pinLauncher(ctx);
-+                        envLauncher(ctx);
-+                        fileLauncher(ctx);
-+                    }
-+                }
-+                explicitLoginLauncher(ctx);
-+            } finally {
-+                FileUtils.deleteFileTreeWithRetry(workspace);
-+            }
-+        }
-+    }
-+
-+    private static void pinLauncher(TestContext ctx) throws Throwable {
-+        launchTest(p -> {}, "pin:" + ctx.pin, ctx);
-+    }
-+
-+    private static void envLauncher(TestContext ctx) throws Throwable {
-+        final String NSSDB_PIN_ENV_VAR = "NSSDB_PIN_ENV_VAR";
-+        launchTest(p -> p.env(NSSDB_PIN_ENV_VAR, ctx.pin),
-+                "env:" + NSSDB_PIN_ENV_VAR, ctx);
-+    }
-+
-+    private static void fileLauncher(TestContext ctx) throws Throwable {
-+        // The file containing the PIN (ctx.nssdbPinFile) was created by the
-+        // generatePinFile method, called from createNSSDB.
-+        launchTest(p -> {}, "file:" + ctx.nssdbPinFile, ctx);
-+    }
-+
-+    private static void explicitLoginLauncher(TestContext ctx)
-+            throws Throwable {
-+        ctx.loginType = LoginType.EXPLICIT;
-+        ctx.propType = PropType.SYSTEM;
-+        launchTest(p -> {}, "Invalid PIN, must be ignored", ctx);
-+    }
-+
-+    private static void launchTest(Consumer<Proc> procCb, String pinPropVal,
-+            TestContext ctx) throws Throwable {
-+        if (DEBUG) {
-+            System.out.println("Launching JVM with " + FIPS_NSSDB_PATH_PROP +
-+                    "=" + ctx.nssdbPath + " and " + FIPS_NSSDB_PIN_PROP +
-+                    "=" + pinPropVal);
-+        }
-+        Proc p = Proc.create(NssdbPin.class.getName())
-+                .args(ctx.nssdbPath, ctx.pin, ctx.loginType.name());
-+        if (ctx.propType == PropType.SYSTEM) {
-+            p.prop(FIPS_NSSDB_PATH_PROP, ctx.nssdbPath);
-+            p.prop(FIPS_NSSDB_PIN_PROP, pinPropVal);
-+            // Make sure that Security properties defaults are not used.
-+            p.secprop(FIPS_NSSDB_PATH_PROP, "");
-+            p.secprop(FIPS_NSSDB_PIN_PROP, "");
-+        } else if (ctx.propType == PropType.SECURITY) {
-+            p.secprop(FIPS_NSSDB_PATH_PROP, ctx.nssdbPath);
-+            pinPropVal = escapeForPropsFile(pinPropVal);
-+            p.secprop(FIPS_NSSDB_PIN_PROP, pinPropVal);
-+        } else {
-+            throw new Exception("Unsupported property type.");
-+        }
-+        if (DEBUG) {
-+            p.inheritIO();
-+            p.prop("java.security.debug", "sunpkcs11");
-+            p.debug(NssdbPin.class.getName());
-+
-+            // Need the launched process to connect to a debugger?
-+            //System.setProperty("test.vm.opts", "-Xdebug -Xrunjdwp:" +
-+            //         "transport=dt_socket,address=localhost:8000,suspend=y");
-+        } else {
-+            p.nodump();
-+        }
-+        procCb.accept(p);
-+        p.start().waitFor(0);
-+    }
-+
-+    private static String escapeForPropsFile(String str) throws Throwable {
-+        StringBuffer sb = new StringBuffer();
-+        for (int i = 0; i < str.length(); i++) {
-+            int cp = str.codePointAt(i);
-+            if (Character.UnicodeBlock.of(cp)
-+                    == Character.UnicodeBlock.BASIC_LATIN) {
-+                sb.append(Character.toChars(cp));
-+            } else {
-+                sb.append("\\u").append(String.format("%04X", cp));
-+            }
-+        }
-+        return sb.toString();
-+    }
-+
-+    private static void createNSSDB(TestContext ctx) throws Throwable {
-+        ProcessBuilder pb = getModutilPB(ctx, "-create");
-+        if (DEBUG) {
-+            System.out.println("Creating an NSS DB in " + ctx.workspace +
-+                    "...");
-+            System.out.println("cmd: " + String.join(" ", pb.command()));
-+        }
-+        if (pb.start().waitFor() != 0) {
-+            throw new Exception("NSS DB creation failed.");
-+        }
-+        generatePinFile(ctx);
-+        pb = getModutilPB(ctx, "-changepw", NSSDB_TOKEN_NAME,
-+                "-newpwfile", ctx.nssdbPinFile.toString());
-+        if (DEBUG) {
-+            System.out.println("NSS DB created.");
-+            System.out.println("Changing NSS DB PIN...");
-+            System.out.println("cmd: " + String.join(" ", pb.command()));
-+        }
-+        if (pb.start().waitFor() != 0) {
-+            throw new Exception("NSS DB PIN change failed.");
-+        }
-+        if (DEBUG) {
-+            System.out.println("NSS DB PIN changed.");
-+        }
-+    }
-+
-+    private static ProcessBuilder getModutilPB(TestContext ctx, String... args)
-+            throws Throwable {
-+        ProcessBuilder pb = new ProcessBuilder("modutil", "-force");
-+        List<String> pbCommand = pb.command();
-+        if (args != null) {
-+            pbCommand.addAll(Arrays.asList(args));
-+        }
-+        pbCommand.add("-dbdir");
-+        pbCommand.add(ctx.nssdbPath);
-+        if (DEBUG) {
-+            pb.inheritIO();
-+        } else {
-+            pb.redirectError(ProcessBuilder.Redirect.INHERIT);
-+        }
-+        return pb;
-+    }
-+
-+    private static void generatePinFile(TestContext ctx) throws Throwable {
-+        ctx.nssdbPinFile = Files.createTempFile(ctx.workspace, null, null);
-+        Files.writeString(ctx.nssdbPinFile, ctx.pin + System.lineSeparator() +
-+                "2nd line with garbage");
-+    }
-+}
-diff --git a/test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java b/test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java
-new file mode 100644
-index 00000000000..87f1ad04505
---- /dev/null
-+++ b/test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java
-@@ -0,0 +1,77 @@
-+/*
-+ * Copyright (c) 2022, Red Hat, Inc.
-+ *
-+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-+ *
-+ * This code is free software; you can redistribute it and/or modify it
-+ * under the terms of the GNU General Public License version 2 only, as
-+ * published by the Free Software Foundation.
-+ *
-+ * This code is distributed in the hope that it will be useful, but WITHOUT
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
-+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
-+ * version 2 for more details (a copy is included in the LICENSE file that
-+ * accompanied this code).
-+ *
-+ * You should have received a copy of the GNU General Public License version
-+ * 2 along with this work; if not, write to the Free Software Foundation,
-+ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
-+ * or visit www.oracle.com if you need additional information or have any
-+ * questions.
-+ */
-+
-+import java.security.Provider;
-+import java.security.Security;
-+
-+/*
-+ * @test
-+ * @bug 9999999
-+ * @requires (jdk.version.major >= 8)
-+ * @run main/othervm/timeout=30 VerifyMissingAttributes
-+ * @author Martin Balao (mbalao@redhat.com)
-+ */
-+
-+public final class VerifyMissingAttributes {
-+
-+    private static final String[] svcAlgImplementedIn = {
-+            "AlgorithmParameterGenerator.DSA",
-+            "AlgorithmParameters.DSA",
-+            "CertificateFactory.X.509",
-+            "KeyStore.JKS",
-+            "KeyStore.CaseExactJKS",
-+            "KeyStore.DKS",
-+            "CertStore.Collection",
-+            "CertStore.com.sun.security.IndexedCollection"
-+    };
-+
-+    public static void main(String[] args) throws Throwable {
-+        Provider sunProvider = Security.getProvider("SUN");
-+        for (String svcAlg : svcAlgImplementedIn) {
-+            String filter = svcAlg + " ImplementedIn:Software";
-+            doQuery(sunProvider, filter);
-+        }
-+        if (Double.parseDouble(
-+                System.getProperty("java.specification.version")) >= 17) {
-+            String filter = "KeyFactory.RSASSA-PSS SupportedKeyClasses:" +
-+                    "java.security.interfaces.RSAPublicKey" +
-+                    "|java.security.interfaces.RSAPrivateKey";
-+            doQuery(Security.getProvider("SunRsaSign"), filter);
-+        }
-+        System.out.println("TEST PASS - OK");
-+    }
-+
-+    private static void doQuery(Provider expectedProvider, String filter)
-+            throws Exception {
-+        if (expectedProvider == null) {
-+            throw new Exception("Provider not found.");
-+        }
-+        Provider[] providers = Security.getProviders(filter);
-+        if (providers == null || providers.length != 1 ||
-+                providers[0] != expectedProvider) {
-+            throw new Exception("Failure retrieving the provider with this" +
-+                    " query: " + filter);
-+        }
-+    }
-+}
diff --git a/fips-25u-df044414ef4.patch b/fips-25u-df044414ef4.patch
new file mode 100644
index 0000000..8b210e6
--- /dev/null
+++ b/fips-25u-df044414ef4.patch
@@ -0,0 +1,92 @@
+diff --git a/src/java.base/share/classes/java/security/Provider.java b/src/java.base/share/classes/java/security/Provider.java
+index de2845fb550..b1e416b90f4 100644
+--- a/src/java.base/share/classes/java/security/Provider.java
++++ b/src/java.base/share/classes/java/security/Provider.java
+@@ -1203,6 +1203,39 @@ public Set<Service> getServices() {
+         return serviceSet;
+     }
+ 
++    /* vvvvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvvvv */
++    private static final class RedHatFIPSFilter {
++        static final boolean IS_ON = Boolean.parseBoolean(
++                Security.getProperty("__redhat_fips_filter__"));
++        private static final Set<String> ANY_SERVICE_TYPE = Set.of();
++        private static final Map<String, Set<String>> ALLOW_LIST = Map.of(
++                "SunPKCS11-FIPS", ANY_SERVICE_TYPE,
++                "SUN", Set.of(
++                        "AlgorithmParameterGenerator",
++                        "AlgorithmParameters", "CertificateFactory",
++                        "CertPathBuilder", "CertPathValidator", "CertStore",
++                        "Configuration", "KeyStore"),
++                "SunEC", Set.of(
++                        "AlgorithmParameters", "KeyFactory"),
++                "SunJSSE", ANY_SERVICE_TYPE,
++                "SunJCE", Set.of(
++                        "AlgorithmParameters",
++                        "AlgorithmParameterGenerator", "KeyFactory",
++                        "SecretKeyFactory"),
++                "SunRsaSign", Set.of(
++                        "KeyFactory", "AlgorithmParameters"),
++                "XMLDSig", ANY_SERVICE_TYPE
++        );
++
++        static boolean isAllowed(String provName, String serviceType) {
++            Set<String> allowedServiceTypes = ALLOW_LIST.get(provName);
++            return allowedServiceTypes != null &&
++                    (allowedServiceTypes == ANY_SERVICE_TYPE ||
++                            allowedServiceTypes.contains(serviceType));
++        }
++    }
++    /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
++
+     /**
+      * Add a service. If a service of the same type with the same algorithm
+      * name exists, and it was added using {@link #putService putService()},
+@@ -1231,6 +1264,15 @@ protected void putService(Service s) {
+                     ("service.getProvider() must match this Provider object");
+         }
+         String type = s.getType();
++        /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */
++        if (RedHatFIPSFilter.IS_ON && !RedHatFIPSFilter.isAllowed(name, type)) {
++            if (debug != null) {
++                debug.println("The previous " + name + ".putService() call " +
++                        "was skipped by " + RedHatFIPSFilter.class.getName());
++            }
++            return;
++        }
++        /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
+         String algorithm = s.getAlgorithm();
+         ServiceKey key = new ServiceKey(type, algorithm, true);
+         implRemoveService(serviceMap.get(key));
+diff --git a/src/java.base/share/classes/java/security/Security.java b/src/java.base/share/classes/java/security/Security.java
+index 6969fe8a8e1..4501d5971c4 100644
+--- a/src/java.base/share/classes/java/security/Security.java
++++ b/src/java.base/share/classes/java/security/Security.java
+@@ -323,7 +323,27 @@ public Properties getInitialProperties() {
+     }
+ 
+     private static void initialize() {
++        /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */
++        /*   This 'include'-directives-only magic property is an internal     */
++        /*   implementation detail that could (and probably will!) change.    */
++        /*   Red Hat customers should NOT rely on this for their own use.     */
++        String fipsKernelFlag = "/proc/sys/crypto/fips_enabled";
++        boolean fipsModeOn;
++        try (InputStream is = new java.io.FileInputStream(fipsKernelFlag)) {
++            fipsModeOn = is.read() == '1';
++        } catch (IOException ioe) {
++            fipsModeOn = false;
++            if (sdebug != null) {
++                sdebug.println("Failed to read FIPS kernel file: " + ioe);
++            }
++        }
++        String fipsMagicPropName = "__redhat_fips__";
++        System.setProperty(fipsMagicPropName, "" + fipsModeOn);
++        /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
+         SecPropLoader.loadAll();
++        /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */
++        System.clearProperty(fipsMagicPropName);
++        /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
+         initialSecurityProperties = (Properties) props.clone();
+         if (sdebug != null) {
+             for (String key : props.stringPropertyNames()) {
diff --git a/java-latest-openjdk-portable.spec b/java-latest-openjdk-portable.spec
index 622cbf0..16bb5eb 100644
--- a/java-latest-openjdk-portable.spec
+++ b/java-latest-openjdk-portable.spec
@@ -1,10 +1,5 @@
-%if (0%{?rhel} > 0 && 0%{?rhel} < 8)
-# portable jdk 17 specific bug, _jvmdir being missing
-%define _jvmdir /usr/lib/jvm
-%endif
-
 # debug_package %%{nil} is portable-jdks specific
-%define  debug_package %{nil}
+%define debug_package %{nil}
 
 # RPM conditionals so as to be able to dynamically produce
 # slowdebug/release builds. See:
@@ -36,10 +31,9 @@
 # Build with system libraries
 %bcond_with system_libs
 
-
-%if (0%{?rhel} > 0 && 0%{?rhel} < 8)
 # This is RHEL 7 specific as it doesn't seem to have the
 # __brp_strip_static_archive macro.
+%if 0%{?rhel} == 7
 %define __os_install_post %{nil}
 %endif
 
@@ -66,6 +60,10 @@
 # See: https://bugzilla.redhat.com/show_bug.cgi?id=1520879
 %global _find_debuginfo_opts -g
 
+# Disable LTO as this causes build failures at the moment.
+# See RHBZ#1861401
+%define _lto_cflags %{nil}
+
 # note: parametrized macros are order-sensitive (unlike not-parametrized) even with normal macros
 # also necessary when passing it as parameter to other macros. If not macro, then it is considered a switch
 # see the difference between global and define:
@@ -147,7 +145,7 @@
 # However, it does segfault on the Zero assembler port, so currently JIT only
 %global share_arches    %{jit_arches}
 # Set of architectures for which we build the Shenandoah garbage collector
-%global shenandoah_arches x86_64 %{aarch64}
+%global shenandoah_arches x86_64 %{aarch64} riscv64
 # Set of architectures for which we build the Z garbage collector
 %global zgc_arches x86_64 riscv64
 # Set of architectures for which alt-java has SSB mitigation
@@ -161,6 +159,8 @@
 %else
 %global gdb_arches %{jit_arches} %{zero_arches}
 %endif
+# Architecture on which we run Java only tests
+%global jdk_test_arch x86_64
 
 # By default, we build a slowdebug build during main build on JIT architectures
 %if %{with slowdebug}
@@ -228,7 +228,7 @@
 # other targets since this target is configured to use in-tree
 # AWT dependencies: lcms, libjpeg, libpng, libharfbuzz, giflib
 # and possibly others
-%global static_libs_target static-libs-image
+%global static_libs_target static-libs-graal-image
 %else
 %global static_libs_target %{nil}
 %endif
@@ -244,12 +244,83 @@
 # Target to use to just build HotSpot
 %global hotspot_target hotspot
 
-# DTS toolset to use to provide gcc & binutils
-%global dtsversion 10
 
-# Disable LTO as this causes build failures at the moment.
-# See RHBZ#1861401
-%define _lto_cflags %{nil}
+# Individual build frameworks this specfile supports
+# if elif ... elif ... elif ... else  is unluckily buggy
+# On rhel7 we need software collection
+%if (0%{?rhel} == 7)
+%global is_dtstoolchain  collection
+%global dtsversion       10
+%global dtsname          devtoolset-%{dtsversion}
+%global dts_command      scl enable %{dtsname} --
+%global exclusive_arches %{nil}
+%define dts_brs # Brs for collection\
+BuildRequires: %{dtsname}-gcc \
+BuildRequires: %{dtsname}-gcc-c++
+%else
+# On rhel8 we have self built custom devkit
+%if ((0%{?rhel} == 8) && (0%{?epel} == 0))
+%global is_dtstoolchain  devkit
+%global dtsversion       1.0-9
+%global dtsname          %{origin}-devkit
+%global dts_command      %{nil}
+%if 0%{?centos} == 0
+# centos had originally smaller set of devkit arches
+%global exclusive_arches %{aarch64} %{ppc64le} s390x x86_64 riscv64
+%else
+%global exclusive_arches %{aarch64} %{ppc64le} s390x x86_64 riscv64
+%endif
+%define dts_brs # Brs for devkit\
+BuildRequires: %{dtsname} >= %{dtsversion}
+%else
+# On newest systems we use system gcc and friens
+%if ((0%{?fedora} > 0) || (0%{?rhel} >= 9) || (0%{?epel} >= 9))
+%global is_dtstoolchain  system
+%global dtsversion       %{nil}
+%global dtsname          %{nil}
+%global exclusive_arches %{java_arches}
+%define dts_brs # Brs for system\
+BuildRequires: gcc >= 4.8.3-8 \
+BuildRequires: gcc-c++ \
+# We link statically against libstdc++ to increase portability \
+BuildRequires: libstdc++-static
+# When building on epel8, we need system, legacy toolchain of explicit version
+%else
+%if ((0%{?epel}) > 0 && (0%{?epel} <= 8))
+%global is_dtstoolchain  toolset
+%global dtsversion       14
+%global dtsname          gcc-toolset-%{dtsversion}
+%global exclusive_arches %{java_arches}
+%define dts_brs # Brs for toolset\
+BuildRequires: %{dtsname}-gcc \
+BuildRequires: %{dtsname}-gcc-c++ \
+BuildRequires: %{dtsname}-annobin-annocheck \
+BuildRequires: %{dtsname}-annobin-plugin-gcc \
+BuildRequires: %{dtsname}-binutils \
+BuildRequires: %{dtsname}-gcc-plugin-annobin \
+# We link statically against libstdc++ to increase portability \
+BuildRequires: libstdc++-static
+# no go
+%else
+"Unsupported system: fedora=0%{?fedora} rhel=0%{?rhel} epel=0%{?epel} centos=0%{?centos}"
+exit 1
+%endif
+%endif
+%endif
+%endif
+
+%if ((0%{?epel}) > 0 || (0%{?fedora} > 8))
+%global use_portable_bootjdk 0
+%else
+%global use_portable_bootjdk 1
+%endif
+
+# Check if pandoc is available to generate docs (including man pages)
+%if 0%{?rhel} == 8 || 0%{?epel} > 0 || 0%{?fedora} > 0
+%global pandoc_available 1
+%else
+%global pandoc_available 0
+%endif
 
 # Filter out flags from the optflags macro that cause problems with the OpenJDK build
 # We filter out -O flags so that the optimization of HotSpot is not lowered from O3 to O2
@@ -324,25 +395,23 @@
 %global stapinstall %{nil}
 %endif
 
+# on fedora and epel, we build systemtap in repacking to rpms
+# thus having it disabled, and keeping the lines just for sync reasons
 %ifarch %{systemtap_arches}
-%if (0%{?rhel} > 0 && !0%{?epel})
-%global with_systemtap 1
-%else
 %global with_systemtap 0
-%endif
 %else
 %global with_systemtap 0
 %endif
 
 # New Version-String scheme-style defines
-%global featurever 23
+%global featurever 26
 %global interimver 0
-%global updatever 1
+%global updatever 0
 %global patchver 0
 # buildjdkver is usually same as %%{featurever},
 # but in time of bootstrap of next jdk, it is featurever-1,
 # and this it is better to change it here, on single place
-%global buildjdkver 23
+%global buildjdkver 25
 # We don't add any LTS designator for STS packages (Fedora and EPEL).
 # We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined.
 %if 0%{?rhel} && !0%{?epel}
@@ -352,16 +421,6 @@
   %global lts_designator ""
   %global lts_designator_zip ""
 %endif
-# JDK to use for bootstrapping
-%global bootjdk /usr/lib/jvm/java-%{buildjdkver}-openjdk
-# Define whether to use the bootstrap JDK directly or with a fresh libjvm.so
-# This will only work where the bootstrap JDK is the same major version
-# as the JDK being built
-%if %{with fresh_libjvm} && %{buildjdkver} == %{featurever}
-%global build_hotspot_first 1
-%else
-%global build_hotspot_first 0
-%endif
 
 # Define vendor information used by OpenJDK
 %global oj_vendor Red Hat, Inc.
@@ -387,7 +446,7 @@
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      6.0.0pre00-c848b93a8598
 # Define current Git revision for the FIPS support patches
-%global fipsver 75ffdc48eda
+%global fipsver df044414ef4
 # Define JDK versions
 %global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
 %global javaver         %{featurever}
@@ -401,8 +460,8 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{vcstag}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        11
-%global rpmrelease      %(echo "%autorelease" | sed 's;%{?dist};;')
+%global buildver        29
+%global rpmrelease      1
 #%%global tagsuffix     %%{nil}
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
@@ -421,7 +480,7 @@
 # Release will be (where N is usually a number starting at 1):
 # - 0.N%%{?extraver}%%{?dist} for EA releases,
 # - N%%{?extraver}{?dist} for GA releases
-%global is_ga           1
+%global is_ga           0
 %if %{is_ga}
 %global build_type GA
 %global ea_designator ""
@@ -441,7 +500,7 @@
 %global fullversion     %{compatiblename}-%{version}-%{release}
 # images directories from upstream build
 %global jdkimage                jdk
-%global static_libs_image       static-libs
+%global static_libs_image       static-libs-graal
 # output dir stub
 %define buildoutputdir() %{expand:build/jdk%{featurever}.build%{?1}}
 %define installoutputdir() %{expand:install/jdk%{featurever}.install%{?1}}
@@ -454,23 +513,30 @@
 %define uniquesuffix()        %{expand:%{fullversion}.%{_arch}%{?1}}
 # portable only declarations
 %global jreimage                jre
-%define jreportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable%{1}.jre;g" | sed "s;openjdkportable;el;g")
-%define jdkportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable%{1}.jdk;g" | sed "s;openjdkportable;el;g")
-%define jdkportablesourcesnameimpl() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable%{1}.sources;g" | sed "s;openjdkportable;el;g" | sed "s;.%{_arch};.noarch;g")
-%define staticlibsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable%{1}.static-libs;g" | sed "s;openjdkportable;el;g")
+%if ((0%{?fedora} > 0) || (0%{?epel} > 0))
+%define regexBase %{version}-%{release}
+%else
+%define regexBase el%{rhel}\\(_[0-9]\\)*
+%endif
+%define jreportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.jre;g" | sed "s;openjdkportable;el;g")
+%define jdkportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.jdk;g" | sed "s;openjdkportable;el;g")
+%define jdkportablesourcesnameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.sources;g" | sed "s;openjdkportable;el;g" | sed "s;.%{_arch};.noarch;g")
+%define staticlibsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.static-libs;g" | sed "s;openjdkportable;el;g")
+%define jmodsportablenameimpl() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable%{1}.jmods;g" | sed "s;openjdkportable;el;g")
 %define jreportablearchive()  %{expand:%{jreportablenameimpl -- %%{1}}.tar.xz}
 %define jdkportablearchive()  %{expand:%{jdkportablenameimpl -- %%{1}}.tar.xz}
 %define jdkportablesourcesarchive()  %{expand:%{jdkportablesourcesnameimpl -- %%{1}}.tar.xz}
 %define staticlibsportablearchive()  %{expand:%{staticlibsportablenameimpl -- %%{1}}.tar.xz}
+%define jmodsportablearchive()  %{expand:%{jmodsportablenameimpl -- %%{1}}.tar.xz}
 %define jreportablename()     %{expand:%{jreportablenameimpl -- %%{1}}}
 %define jdkportablename()     %{expand:%{jdkportablenameimpl -- %%{1}}}
 %define jdkportablesourcesname()     %{expand:%{jdkportablesourcesnameimpl -- %%{1}}}
 # Intentionally use jdkportablenameimpl here since we want to have static-libs files overlayed on
 # top of the JDK archive
 %define staticlibsportablename()     %{expand:%{jdkportablenameimpl -- %%{1}}}
-%define docportablename() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable.docs;g" | sed "s;openjdkportable;el;g")
+%define docportablename() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable.docs;g" | sed "s;openjdkportable;el;g")
 %define docportablearchive()  %{docportablename}.tar.xz
-%define miscportablename() %(echo %{uniquesuffix ""} | sed "s;%{version}-%{release};\\0.portable.misc;g" | sed "s;openjdkportable;el;g")
+%define miscportablename() %(echo %{uniquesuffix ""} | sed "s;%{regexBase};\\0.portable.misc;g" | sed "s;openjdkportable;el;g")
 %define miscportablearchive()  %{miscportablename}.tar.xz
 
 # RPM 4.19 no longer accept our double percentaged %%{nil} passed to %%{1}
@@ -479,6 +545,30 @@
 %define jdkportablearchiveForFiles()  %(echo %{jdkportablearchive -- ""})
 %define jdkportablesourcesarchiveForFiles()  %(echo %{jdkportablesourcesarchive -- ""})
 %define staticlibsportablearchiveForFiles()  %(echo %{staticlibsportablearchive -- ""})
+%define jmodsportablearchiveForFiles()  %(echo %{jmodsportablearchive -- ""})
+
+# JDK to use for bootstrapping
+%ifarch %{fastdebug_arches}
+%global bootdebugpkg fastdebug
+%endif
+%if %{use_portable_bootjdk}
+%global bootjdkpkg_name java-%{featurever}-%{origin}
+%global bootjdkpkg %{bootjdkpkg_name}-portable-devel%{?bootdebugpkg:-%{bootdebugpkg}} >= %{buildjdkver}
+%global bootjdkzip %{_jvmdir}/%{bootjdkpkg_name}-*.portable%{?bootdebugpkg:.%{bootdebugpkg}}.jdk.%{_arch}.tar.xz
+%global bootjdk %{_builddir}/%{uniquesuffix -- ""}/%{bootjdkpkg_name}.boot
+%else
+%global bootjdkpkg_name java-latest-openjdk
+%global bootjdkpkg %{bootjdkpkg_name}-devel%{?bootdebugpkg:-%{bootdebugpkg}}
+%global bootjdk /usr/lib/jvm/%{bootjdkpkg_name}%{?bootdebugpkg:-%{bootdebugpkg}}
+%endif
+# Define whether to use the bootstrap JDK directly or with a fresh libjvm.so
+# This will only work where the bootstrap JDK is the same major version
+# as the JDK being built
+%if %{with fresh_libjvm} && %{buildjdkver} == %{featurever}
+%global build_hotspot_first 1
+%else
+%global build_hotspot_first 0
+%endif
 
 #################################################################
 # fix for https://bugzilla.redhat.com/show_bug.cgi?id=1111349
@@ -529,13 +619,6 @@
 %global alternatives_requires %{_sbindir}/alternatives
 %endif
 
-# x86 is no longer supported
-%if 0%{?java_arches:1}
-ExclusiveArch:  %{java_arches}
-%else
-ExcludeArch: %{ix86}
-%endif
-
 # Portables have no repo (requires/provides), but these are awesome for orientation in spec
 # Also scriptlets are happily missing and files are handled old fashion
 # not-duplicated requires/provides/obsoletes for normal/debug packages
@@ -548,9 +631,6 @@ ExcludeArch: %{ix86}
 %define java_static_libs_rpo() %{expand:
 }
 
-%define java_unstripped_rpo() %{expand:
-}
-
 %define java_docs_rpo() %{expand:
 }
 
@@ -564,6 +644,15 @@ ExcludeArch: %{ix86}
 # this expression, when declared as global, filled component with java-x-vendor portable
 %define component %(echo %{name} | sed "s;-portable%{?pkgos:-%{pkgos}};;g")
 
+# Define the architectures on which we build
+# On RHEL, this should be the architectures with a devkit
+%if "%{?exclusive_arches}" == "%{nil}"
+# x86 is no longer supported
+ExcludeArch: %{ix86}
+%else
+ExclusiveArch:  %{exclusive_arches}
+%endif
+
 Name:    java-latest-%{origin}-portable%{?pkgos:-%{pkgos}}
 Version: %{newjavaver}.%{buildver}
 # This package needs `.rolling` as part of Release so as to not conflict on install with
@@ -606,7 +695,7 @@ License:  Apache-1.1 AND Apache-2.0 AND LicenseRef-Callaway-BSD AND LicenseRef-C
 URL:      http://openjdk.java.net/
 
 # The source tarball, generated using generate_source_tarball.sh
-Source0: https://openjdk-sources.osci.io/openjdk%{featurever}/openjdk-%{vcstag}%{ea_designator_zip}.tar.xz
+Source0: https://openjdk-sources.osci.io/openjdk%{featurever}/open%{vcstag}%{ea_designator_zip}.tar.xz
 
 # Use 'icedtea_sync.sh' to update the following
 # They are based on code contained in the IcedTea project (6.x).
@@ -647,10 +736,9 @@ Source18: TestTranslations.java
 # RPM/distribution specific patches
 #
 ############################################
-
 # Crypto policy and FIPS support patches
-# Patch is generated from the fips-21u tree at https://github.com/rh-openjdk/jdk/tree/fips-21u
-# as follows: git diff %%{vcstag} src make test > fips-21u-$(git show -s --format=%h HEAD).patch
+# Patch is generated from the fips-25u tree at https://github.com/rh-openjdk/jdk/tree/fips-25u
+# as follows: git diff %%{vcstag} src make test > fips-25u-$(git show -s --format=%h HEAD).patch
 # Diff is limited to src and make subdirectories to exclude .github changes
 # The following list is generated by:
 # git log %%{vcstag}.. --no-merges --format=%s --reverse:
@@ -686,7 +774,8 @@ Source18: TestTranslations.java
 # test/jdk/sun/security/pkcs11/fips/VerifyMissingAttributes.java: fixed jtreg main class
 # RH1940064: Enable XML Signature provider in FIPS mode
 # RH2173781: Avoid calling C_GetInfo() too early, before cryptoki is initialized [now part of JDK-8301553 upstream]
-#Patch1001: fips-%{featurever}u-%{fipsver}.patch
+# usage in jdk >25 is experimental and may disapear
+Patch1001: fips-25u-%{fipsver}.patch
 
 #############################################
 #
@@ -702,7 +791,7 @@ Source18: TestTranslations.java
 #
 #############################################
 
-# Currently empty
+Patch1: JDK-8373246-8351842_broke_native_debugging_on_Linux.patch
 
 #############################################
 #
@@ -722,19 +811,8 @@ BuildRequires: desktop-file-utils
 BuildRequires: elfutils-devel
 BuildRequires: file
 BuildRequires: fontconfig-devel
-%if (0%{?rhel} > 0 && 0%{?rhel} < 8)
-BuildRequires: devtoolset-%{dtsversion}-gcc
-BuildRequires: devtoolset-%{dtsversion}-gcc-c++
-%else
-BuildRequires: gcc
-# gcc-c++ is already needed
-%endif
-BuildRequires: gcc-c++
+%{dts_brs}
 BuildRequires: gdb
-%if (0%{?rhel} > 0 && 0%{?rhel} < 8)
-# rhel7 only, portables only. Rhel8 have gtk3, rpms have runtime recommends of gtk
-BuildRequires: gtk2-devel
-%endif
 BuildRequires: libxslt
 BuildRequires: libX11-devel
 BuildRequires: libXi-devel
@@ -746,7 +824,7 @@ BuildRequires: libXtst-devel
 # Requirement for setting up nss.fips.cfg
 BuildRequires: nss-devel
 # Requirement for system security property test
-# N/A for portable. RHEL7 doesn't provide them
+# N/A for portable as we don't enable support for them
 #BuildRequires: crypto-policies
 BuildRequires: pkgconfig
 BuildRequires: xorg-x11-proto-devel
@@ -754,26 +832,20 @@ BuildRequires: zip
 # to pack portable tarballs
 BuildRequires: tar
 BuildRequires: unzip
-%if (0%{?rhel} > 0 && 0%{?rhel} < 8)
-BuildRequires: javapackages-tools
-BuildRequires: java-%{buildjdkver}-%{origin}%{?pkgos:-%{pkgos}}-devel
-%else
 BuildRequires: javapackages-filesystem
-BuildRequires: java-latest-openjdk-devel
-%endif
+BuildRequires: %{bootjdkpkg}
 # Zero-assembler build requirement
 %ifarch %{zero_arches}
 BuildRequires: libffi-devel
 %endif
 # Full documentation build requirements
+# pandoc is only available on RHEL/CentOS 8, epels, and fedoras
+%if %{pandoc_available}
 BuildRequires: graphviz
 BuildRequires: pandoc
-# 2023c required as of JDK-8305113
-BuildRequires: tzdata-java >= 2023c
+%endif
 # cacerts build requirement in portable mode
 BuildRequires: ca-certificates
-# Earlier versions have a bug in tree vectorization on PPC
-BuildRequires: gcc >= 4.8.3-8
 
 %if %{with_systemtap}
 BuildRequires: systemtap-sdt-devel
@@ -787,21 +859,22 @@ BuildRequires: harfbuzz-devel
 BuildRequires: lcms2-devel
 BuildRequires: libjpeg-devel
 BuildRequires: libpng-devel
+BuildRequires: zlib-devel
 %else
 # Version in src/java.desktop/share/legal/freetype.md
-Provides: bundled(freetype) = 2.13.0
+Provides: bundled(freetype) = 2.13.3
 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
-Provides: bundled(giflib) = 5.2.1
+Provides: bundled(giflib) = 5.2.2
 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h
-Provides: bundled(harfbuzz) = 8.2.2
+Provides: bundled(harfbuzz) = 10.4.0
 # Version in src/java.desktop/share/native/liblcms/lcms2.h
-Provides: bundled(lcms2) = 2.15.0
+Provides: bundled(lcms2) = 2.17.0
 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h
 Provides: bundled(libjpeg) = 6b
 # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h
-Provides: bundled(libpng) = 1.6.40
-# We link statically against libstdc++ to increase portability
-BuildRequires: libstdc++-static
+Provides: bundled(libpng) = 1.6.47
+# Version in src/java.base/share/native/libzip/zlib/zlib.h
+Provides: bundled(zlib) = 1.3.1
 %endif
 
 # this is always built, also during debug-only build
@@ -915,17 +988,6 @@ The %{origin_nice} %{featurever} libraries for static linking - portable edition
 # staticlibs
 %endif
 
-%if %{include_normal_build}
-%package unstripped
-Summary: The %{origin_nice} %{featurever} runtime environment.
-
-%{java_unstripped_rpo %{nil}}
-
-%description unstripped
-The %{origin_nice} %{featurever} runtime environment.
-
-%endif
-
 %if %{include_normal_build}
 %package docs
 Summary: %{origin_nice} %{featurever} API documentation
@@ -952,13 +1014,15 @@ The %{origin_nice} %{featurever} full patched sources of portable JDK to build,
 
 %prep
 
-echo "Preparing %{oj_vendor_version}"
-
 # Using the echo macro breaks rpmdev-bumpspec, as it parses the first line of stdout :-(
+echo "Preparing %{oj_vendor_version}"
+echo "System is RHEL=%{?rhel}%{!?rhel:0}, CentOS=%{?centos}%{!?centos:0}, EPEL=%{?epel}%{!?epel:0}, Fedora=%{?fedora}%{!?fedora:0}"
+echo "Build JDK version is %{buildjdkver}, bootstrap JDK package is %{bootjdkpkg}"
+
 %if 0%{?_build_cpu:1}
   echo "CPU: %{_target_cpu}, arch install directory: %{archinstall}, SystemTap install directory: %{_build_cpu}"
 %else
-  %{error:Unrecognised architecture %{_build_cpu}}
+  %{error:Unrecognised architecture %{_target_cpu}}
 %endif
 
 if [ %{include_normal_build} -eq 0 -o  %{include_normal_build} -eq 1 ] ; then
@@ -985,10 +1049,11 @@ if [ %{include_debug_build} -eq 0 -a  %{include_normal_build} -eq 0 -a  %{includ
 fi
 
 %if %{with fresh_libjvm} && ! %{build_hotspot_first}
-echo "WARNING: The build of a fresh libjvm has been disabled due to a JDK version mismatch"
-echo "Build JDK version is %{buildjdkver}, feature JDK version is %{featurever}"
+%{warn: The build of a fresh libjvm has been disabled due to a JDK version mismatch}
+%{warn: Build JDK version is %{buildjdkver}, feature JDK version is %{featurever}}
 %endif
 
+export XZ_OPT="-T0"
 %setup -q -c -n %{uniquesuffix ""} -T -a 0
 # https://bugzilla.redhat.com/show_bug.cgi?id=1189084
 prioritylength=`expr length %{priority}`
@@ -1004,12 +1069,32 @@ sh %{SOURCE12} %{top_level_dir_name}
 %endif
 
 # Patch the JDK
+# This syntax is deprecated:
+#    %%patchN [...]
+# and should be replaced with:
+#    %%patch -PN [...]
+# For example:
+#    %%patch1001 -p1
+# becomes:
+#    %%patch -P1001 -p1
+# The replacement format suggested by recent (circa Fedora 38) RPM
+# deprecation messages:
+#    %%patch N [...]
+# is not backward-compatible with prior (circa RHEL-8) versions of
+# rpmbuild.
 pushd %{top_level_dir_name}
 # Add crypto policy and FIPS support
-# Skipping fips patch whil eit is not ready for jdk22 %%patch -P1001 -p1
-# Patches in need of upstreaming
+# usage in jdk >25 is experimental and may disapear
+%patch -P1001 -p1
+%patch -P1 -p1
 popd # openjdk
 
+echo "Generating %{alt_java_name} man page"
+altjavamanpage=%{top_level_dir_name}/src/java.base/share/man/%{alt_java_name}.md
+altjavatext="Hardened java binary recommended for launching untrusted code from the Web e.g. javaws"
+sed -r -e 's|([^/.])java([^./])|\1alt-java\2|g' %{top_level_dir_name}/src/java.base/share/man/java.md | \
+    sed -e 's|JAVA(|ALT-JAVA(|' | \
+    sed -e "s|java - launch a Java application|alt-java - ${altjavatext}|" >> ${altjavamanpage}
 
 # The OpenJDK version file includes the current
 # upstream version information. For some reason,
@@ -1028,16 +1113,44 @@ if [ "x${UPSTREAM_EA_DESIGNATOR}" != "x%{ea_designator}" ] ; then
     echo "WARNING: Designator mismatch";
     echo "Spec file is configured for a %{build_type} build with designator '%{ea_designator}'"
     echo "Upstream version-pre setting is '${UPSTREAM_EA_DESIGNATOR}'";
-    #exit 17
+    exit 17
 fi
 
-# Systemtap is processed in rpms
+# Systemtap is processed in rpms on fedoras and epels
 
 # Prepare desktop files
 # Portables do not have desktop integration
 
-%build
+# Extract devkit
+%if "%{is_dtstoolchain}" ==  "devkit"
+  devkittarball=%{_datadir}/%{dtsname}/sdk-%{_target_cpu}-%{_target_os}-gnu*.tar.gz
+  echo "Extracting devkit ${devkittarball}";
+  mkdir devkit;
+  tar -C devkit --strip-components=1 -xzf ${devkittarball}
+  DEVKIT_ROOT=$(pwd)/devkit
+  source ${DEVKIT_ROOT}/devkit.info
+  echo "Installed ${DEVKIT_NAME} devkit"
+%else
+%if 0%{?centos} > 0
+  echo "No devkit for CentOS %{?centos}"
+%else
+  echo "No devkit for %{_target_cpu} on RHEL %{?rhel}";
+%endif
+%endif
 
+%if %{use_portable_bootjdk}
+  # Extract build JDK
+  pushd %{_jvmdir}
+  sha256sum --check %{bootjdkzip}.sha256sum
+  popd
+  tar -xJf %{bootjdkzip}
+  mv java-%{featurever}-openjdk-%{buildjdkver}* %{bootjdk}
+  # Print release information
+  echo "Installed boot JDK:"
+  cat %{bootjdk}/release
+%endif
+
+%build
 # How many CPU's do we have?
 export NUM_PROC=%(/usr/bin/getconf _NPROCESSORS_ONLN 2> /dev/null || :)
 export NUM_PROC=${NUM_PROC:-1}
@@ -1045,6 +1158,7 @@ export NUM_PROC=${NUM_PROC:-1}
 # Honor %%_smp_ncpus_max
 [ ${NUM_PROC} -gt %{?_smp_ncpus_max} ] && export NUM_PROC=%{?_smp_ncpus_max}
 %endif
+export XZ_OPT="-T0"
 
 %ifarch s390x sparc64 alpha %{power64} %{aarch64} riscv64
 export ARCH_DATA_MODEL=64
@@ -1068,14 +1182,61 @@ EXTRA_CFLAGS="$EXTRA_CFLAGS -fno-strict-aliasing"
 EXTRA_CFLAGS="$(echo ${EXTRA_CFLAGS} | sed -e 's|-mstackrealign|-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4|')"
 EXTRA_CPP_FLAGS="$(echo ${EXTRA_CPP_FLAGS} | sed -e 's|-mstackrealign|-mincoming-stack-boundary=2 -mpreferred-stack-boundary=4|')"
 %endif
+%if "%{is_dtstoolchain}" ==  "devkit"
+# Remove annobin plugin reference which isn't available in the devkit
+EXTRA_CFLAGS="$(echo ${EXTRA_CFLAGS} | sed -e 's|-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1||')"
+EXTRA_CPP_FLAGS="$(echo ${EXTRA_CPP_FLAGS} | sed -e 's|-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1||')"
+# Force DWARF 4 for compatibility
+EXTRA_CFLAGS="${EXTRA_CFLAGS} -gdwarf-4"
+EXTRA_CPP_FLAGS="${EXTRA_CPP_FLAGS} -gdwarf-4"
+%endif
+
 export EXTRA_CFLAGS EXTRA_CPP_FLAGS
 
-echo "Building %{SOURCE11}"
-mkdir %{miscinstalloutputdir}
-mkdir %{altjavaoutputdir}
-gcc ${EXTRA_CFLAGS} -o %{altjavaoutputdir}/%{alt_java_name} %{SOURCE11}
-
-echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}"
+# Set modification times (mtimes) of files within JAR files generated
+# by the OpenJDK build to a timestamp that is constant across RPM
+# rebuilds.  OpenJDK provides the --with-source-date configure option
+# for this purpose.  Potential arguments in the RPM build context are:
+#
+# A) --with-source-date="${SOURCE_DATE_EPOCH}"
+# B) --with-source-date=version
+# C) --with-source-date="${OPENJDK_UPSTREAM_TAG_EPOCH}"
+#
+# Consider Option A.  Fedora 38 (rpm-4.18.2) and RHEL-8 (rpm-4.14.3)
+# have different support for SOURCE_DATE_EPOCH.  To keep
+# SOURCE_DATE_EPOCH constant across RPM rebuilds, one could set the
+# source_date_epoch_from_changelog macro to 1 on both Fedora 38 and
+# RHEL-8.  However, on RHEL-8, this results in the RPM build times
+# being set to the timestamp of the most recent changelog.  This is
+# bad for tracing when RPMs were actually built.  Fedora 38 supports a
+# better behaviour via the introduction of the
+# use_source_date_epoch_as_buildtime macro, set to 0 by default.
+# There is no way to make this work on RHEL-8 as well though, so
+# option A is suboptimal.
+#
+# Option B uses the value of the DEFAULT_VERSION_DATE field from
+# make/conf/version-numbers.conf.  DEFAULT_VERSION_DATE represents the
+# aspirational eventual JDK general availability (GA) release date.
+# When the RPM build occurs prior to GA, generated JAR files will have
+# payload mtimes in the future relative to the RPM build time.
+# Whereas for tarballs some tools will issue warnings about future
+# mtimes, per OPENJDK-2583 apparently this is no problem for Java and
+# JAR files.
+#
+# Option C uses the modification timestamp of files in the source
+# tarball. The reproducibility logic in generate_source_tarball.sh
+# sets them all to the commit time of the release-tagged OpenJDK
+# commit, as archived in the tarball.  This timestamp is deterministic
+# across RPM rebuilds and is reliably in the past.  Any file's mtime
+# will do, so use version-numbers.conf's.
+#
+# Use option B for JAR files, based on the discussion in OPENJDK-2583.
+#
+# For portable tarballs, use option C (OPENJDK_UPSTREAM_TAG_EPOCH) for
+# the modification times of all files in the portable tarballs.  Doing
+# so eliminates one source of variability across RPM rebuilds.
+VERSION_FILE="$(pwd)"/"%{top_level_dir_name}"/make/conf/version-numbers.conf
+OPENJDK_UPSTREAM_TAG_EPOCH="$(stat --format=%Y "${VERSION_FILE}")"
 
 function buildjdk() {
     local outputdir=${1}
@@ -1084,6 +1245,7 @@ function buildjdk() {
     local debuglevel=${4}
     local link_opt=${5}
     local debug_symbols=${6}
+    local devkit=${7}
 
     local top_dir_abs_src_path=$(pwd)/%{top_level_dir_name}
     local top_dir_abs_build_path=$(pwd)/${outputdir}
@@ -1105,6 +1267,20 @@ function buildjdk() {
     echo "Using debug_symbols: ${debug_symbols}"
     echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}"
 
+%if "%{is_dtstoolchain}" ==  "devkit"
+    LIBPATH="${devkit}/lib:${devkit}/lib64"
+    echo "Setting library path to ${LIBPATH}"
+%else
+%if "%{is_dtstoolchain}" ==  "toolset"
+    toolset=/opt/rh/%{dtsname}/root/
+    LIBPATH="${toolset}/lib:${toolset}/lib64"
+    echo "Setting library path to ${LIBPATH}"
+%else
+    LIBPATH=${LD_LIBRARY_PATH}
+    echo "Keeping library path as ${LIBPATH}"
+%endif
+%endif
+
     mkdir -p ${outputdir}
     pushd ${outputdir}
 
@@ -1112,16 +1288,17 @@ function buildjdk() {
     # rather than ${link_opt} as the system versions
     # are always used in a system_libs build, even
     # for the static library build
-%if (0%{?rhel} > 0 && 0%{?rhel} < 8)
-    scl enable devtoolset-%{dtsversion} -- bash ${top_dir_abs_src_path}/configure \
-%else
-    bash ${top_dir_abs_src_path}/configure \
-%endif
+    LD_LIBRARY_PATH=${LIBPATH} \
+    %{?dts_command} bash ${top_dir_abs_src_path}/configure \
 %ifarch %{zero_arches}
     --with-jvm-variants=zero \
 %endif
-%ifarch %{ppc64le}
-    --with-jobs=1 \
+%if "%{is_dtstoolchain}" ==  "devkit"
+    --with-devkit=${devkit} \
+%endif
+%if "%{is_dtstoolchain}" ==  "toolset"
+    --with-extra-path="/opt/rh/%{dtsname}/root/bin:/opt/rh/%{dtsname}/root/usr/bin" \
+    --with-toolchain-path="/opt/rh/%{dtsname}/root/bin:/opt/rh/%{dtsname}/root/usr/bin" \
 %endif
     --with-version-build=%{buildver} \
     --with-version-pre="%{ea_designator}" \
@@ -1134,7 +1311,10 @@ function buildjdk() {
     --with-boot-jdk=${buildjdk} \
     --with-debug-level=${debuglevel} \
     --with-native-debug-symbols="${debug_symbols}" \
+    --disable-absolute-paths-in-output \
     --enable-unlimited-crypto \
+    --enable-linkable-runtime \
+    --enable-keep-packaged-modules \
     --with-zlib=%{link_type} \
     --with-freetype=%{link_type} \
     --with-libjpeg=${link_opt} \
@@ -1147,79 +1327,28 @@ function buildjdk() {
     --with-extra-cflags="$EXTRA_CFLAGS" \
     --with-extra-ldflags="%{ourldflags}" \
     --with-num-cores="$NUM_PROC" \
-    --with-source-date="${SOURCE_DATE_EPOCH}" \
+    --with-source-date="version" \
     --disable-javac-server \
 %ifarch %{zgc_arches}
     --with-jvm-features=zgc \
 %endif
-    --disable-warnings-as-errors
+    --disable-warnings-as-errors  \
+    || ( pwd; cat $(find | grep config.log) && false )
 
     cat spec.gmk
-%if (0%{?rhel} > 0 && 0%{?rhel} < 8)
-    scl enable devtoolset-%{dtsversion} -- make \
-%else
-    make \
-%endif
-      LOG=trace \
+    LD_LIBRARY_PATH=${LIBPATH} \
+    %{?dts_command} make LOG=trace \
       WARNINGS_ARE_ERRORS="-Wno-error" \
-      CFLAGS_WARNINGS_ARE_ERRORS="-Wno-error" \
-      $maketargets || ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name "hs_err_pid*.log" | xargs cat && false )
+      CFLAGS_WARNINGS_ARE_ERRORS="-Wno-error" $maketargets ||\
+        ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name \"hs_err_pid*.log\" | xargs cat && false )
     popd
 }
 
-function stripjdk() {
-    local outputdir=${1}
-    local jdkimagepath=${outputdir}/images/%{jdkimage}
-    local jreimagepath=${outputdir}/images/%{jreimage}
-    local jmodimagepath=${outputdir}/images/jmods
-    local supportdir=${outputdir}/support
-
-    if [ "x$suffix" = "x" ] ; then
-        # Keep the unstripped version for consumption by RHEL RPMs
-        cp -a ${jdkimagepath}{,.unstripped}
-
-        # Strip the files
-        for file in $(find ${jdkimagepath} ${jreimagepath} ${supportdir} -type f) ; do
-            if file ${file} | grep -q 'ELF'; then
-                noextfile=${file/.so/};
-                objcopy --only-keep-debug ${file} ${noextfile}.debuginfo;
-                objcopy --add-gnu-debuglink=${noextfile}.debuginfo ${file};
-                strip -g ${file};
-            fi
-        done
-
-        # Rebuild jmod files against the stripped binaries
-        if [ ! -d ${supportdir} ] ; then
-            echo "Support directory missing.";
-            exit 15
-        fi
-        for cmd in $(find ${supportdir} -name '*.jmod_exec.cmdline') ; do
-            pre=${cmd/_exec/_pre};
-            post=${cmd/_exec/_post};
-            jmod=$(echo ${cmd}|sed 's#.*_create_##'|sed 's#_exec.cmdline##')
-            echo "Rebuilding ${jmod} against stripped binaries...";
-            if [ -e ${pre} ] ; then
-                echo "Executing ${pre}...";
-                cat ${pre} | sh -s ;
-            fi
-            echo "Executing ${cmd}...";
-            cat ${cmd} | sh -s ;
-            if [ -e ${post} ] ; then
-                echo "Executing ${post}...";
-                cat ${post} | sh -s ;
-            fi
-        done
-        rm -rf ${jdkimagepath}/jmods
-        cp -a ${jmodimagepath} ${jdkimagepath}
-    fi
-}
-
 function installjdk() {
     local outputdir=${1}
     local installdir=${2}
     local jdkimagepath=${installdir}/images/%{jdkimage}
     local jreimagepath=${installdir}/images/%{jreimage}
-    local unstripped=${jdkimagepath}.unstripped
 
     echo "Installing build from ${outputdir} to ${installdir}..."
     mkdir -p ${installdir}
@@ -1238,6 +1367,7 @@ function installjdk() {
     # legacy-jre-image target does not install any man pages for the JRE
     # We copy the jdk man directory and then remove pages for binaries that
     # don't exist in the JRE
+%if %{pandoc_available}
     cp -a ${jdkimagepath}/man ${jreimagepath}
     for manpage in $(find ${jreimagepath}/man -name '*.1'); do
         filename=$(basename ${manpage});
@@ -1247,8 +1377,9 @@ function installjdk() {
             rm -f ${manpage};
         fi;
     done
+%endif
 
-    for imagepath in ${jdkimagepath} ${jreimagepath} ${unstripped}; do
+    for imagepath in ${jdkimagepath} ${jreimagepath}; do
 
         if [ -d ${imagepath} ] ; then
             # the build (erroneously) removes read permissions from some jars
@@ -1264,13 +1395,6 @@ function installjdk() {
             # Install local files which are distributed with the JDK
             install -m 644 %{SOURCE10} ${imagepath}
 
-            # Create fake alt-java as a placeholder for future alt-java
-            pushd ${imagepath}
-            # add alt-java man page
-            echo "Hardened java binary recommended for launching untrusted code from the Web e.g. javaws" > man/man1/%{alt_java_name}.1
-            cat man/man1/java.1 >> man/man1/%{alt_java_name}.1
-            popd
-
             # Print release information
             cat ${imagepath}/release
         fi
@@ -1292,7 +1416,7 @@ function genchecksum() {
 
 function packFullPatchedSources() {
   srcpackagesdir=`pwd`
-  tar -cJf ${srcpackagesdir}/%{jdkportablesourcesarchive -- ""} --transform "s|^|%{jdkportablesourcesname -- ""}/|" %{top_level_dir_name}
+  createtar ${srcpackagesdir}/%{jdkportablesourcesarchive -- ""} --transform "s|^|%{jdkportablesourcesname -- ""}/|" %{top_level_dir_name}
   genchecksum ${srcpackagesdir}/%{jdkportablesourcesarchive -- ""}
 }
 
@@ -1318,6 +1442,13 @@ function findgeneratedsources() {
   popd
 }
 
+# Create a reproducible tarball in an appropriate way for
+# the version of tar in use
+function createtar() {
+  #FIXME, not finished
+  tar -cJf  "$@"
+}
+
 function packagejdk() {
     local imagesdir=$(pwd)/${1}/images
     local docdir=$(pwd)/${1}/images/docs
@@ -1340,12 +1471,12 @@ function packagejdk() {
 
     jdkname=%{jdkportablename -- "$nameSuffix"}
     jdkarchive=${packagesdir}/%{jdkportablearchive -- "$nameSuffix"}
+    jmodsarchive=${packagesdir}/%{jmodsportablearchive -- "$nameSuffix"}
     jrename=%{jreportablename -- "$nameSuffix"}
     jrearchive=${packagesdir}/%{jreportablearchive -- "$nameSuffix"}
     staticname=%{staticlibsportablename -- "$nameSuffix"}
     staticarchive=${packagesdir}/%{staticlibsportablearchive -- "$nameSuffix"}
     debugarchive=${packagesdir}/%{jdkportablearchive -- "${nameSuffix}.debuginfo"}
-    unstrippedarchive=${packagesdir}/%{jdkportablearchive -- "${nameSuffix}.unstripped"}
     if [ "x$suffix" = "x" ] ; then
       docname=%{docportablename}
       docarchive=${packagesdir}/%{docportablearchive}
@@ -1355,27 +1486,22 @@ function packagejdk() {
     miscname=%{miscportablename}
     miscarchive=${packagesdir}/%{miscportablearchive}
 
-    if [ "x$suffix" = "x" ] ; then
-        # Keep the unstripped version for consumption by RHEL RPMs
-        mv %{jdkimage}.unstripped ${jdkname}
-        tar -cJf ${unstrippedarchive} ${jdkname}
-        genchecksum ${unstrippedarchive}
-        mv ${jdkname} %{jdkimage}.unstripped
-    fi
-
     # Rename directories for packaging
     mv %{jdkimage} ${jdkname}
     mv %{jreimage} ${jrename}
 
     # Release images have external debug symbols
     if [ "x$suffix" = "x" ] ; then
-        tar -cJf ${debugarchive} $(find ${jdkname} -name \*.debuginfo)
+        # jdk26 is putting debugsymbols out of main image, 
+        # we later reconstruct debuginfo subpakckages manually, so putting them back
+        cp -r symbols/* ${jdkname}/
+        createtar ${debugarchive} $(find ${jdkname} -name \*.debuginfo)
         genchecksum ${debugarchive}
 
         mkdir ${docname}
         mv ${docdir} ${docname}
         mv ${bundledir}/${built_doc_archive} ${docname}
-        tar -cJf ${docarchive} ${docname}
+        createtar ${docarchive} ${docname}
         genchecksum ${docarchive}
 
         mkdir ${miscname}
@@ -1387,21 +1513,25 @@ function packagejdk() {
 %endif
         cp -av ${altjavadir}/%{alt_java_name} ${miscname}
         cp -avr ${gensources} ${miscname}
-        tar -cJf ${miscarchive} ${miscname}
+        createtar ${miscarchive} ${miscname}
         genchecksum ${miscarchive}
     fi
 
-    tar -cJf ${jdkarchive} --exclude='**.debuginfo' ${jdkname}
+    createtar ${jmodsarchive} --exclude='**.debuginfo' ${jdkname}/jmods
+    genchecksum ${jmodsarchive}
+    rm -rv ${jdkname}/jmods
+
+    createtar ${jdkarchive} --exclude='**.debuginfo' ${jdkname}
     genchecksum ${jdkarchive}
 
-    tar -cJf ${jrearchive}  --exclude='**.debuginfo' ${jrename}
+    createtar ${jrearchive}  --exclude='**.debuginfo' ${jrename}
     genchecksum ${jrearchive}
 
 %if %{include_staticlibs}
     # Static libraries (needed for building graal vm with native image)
     # Tar as overlay. Transform to the JDK name, since we just want to "add"
     # static libraries to that folder
-    tar -cJf ${staticarchive} \
+    createtar ${staticarchive} \
         --transform "s|^%{static_libs_image}/lib/*|${staticname}/lib/static/linux-%{archinstall}/glibc/|" "%{static_libs_image}/lib"
     genchecksum ${staticarchive}
 %endif
@@ -1417,11 +1547,34 @@ function packagejdk() {
 
 packFullPatchedSources
 
+%if "%{is_dtstoolchain}" ==  "devkit"
+  DEVKIT_ROOT=$(pwd)/devkit
+  source ${DEVKIT_ROOT}/devkit.info
+  GCC="${DEVKIT_TOOLCHAIN_PATH}/gcc --sysroot=${DEVKIT_SYSROOT}"
+  LIBPATH="${DEVKIT_ROOT}/lib:${DEVKIT_ROOT}/lib64"
+%else
+%if "%{is_dtstoolchain}" ==  "toolset"
+    toolset=/opt/rh/%{dtsname}/root/
+    GCC="${toolset}/usr/bin/gcc"
+    LIBPATH="${toolset}/lib:${toolset}/lib64"
+%else
+  GCC=$(which gcc)
+%endif
+%endif
+
+echo "Building %{SOURCE11}"
+mkdir %{miscinstalloutputdir}
+mkdir %{altjavaoutputdir}
+LD_LIBRARY_PATH="${LIBPATH}" ${GCC} ${EXTRA_CFLAGS} -o %{altjavaoutputdir}/%{alt_java_name} %{SOURCE11}
+
+echo "Building %{newjavaver}-%{buildver}, pre=%{ea_designator}, opt=%{lts_designator}"
+
 %if %{build_hotspot_first}
   # Build a fresh libjvm.so first and use it to bootstrap
+  echo "Building HotSpot only for the latest libjvm.so"
   cp -LR --preserve=mode,timestamps %{bootjdk} newboot
   systemjdk=$(pwd)/newboot
-  buildjdk build/newboot ${systemjdk} %{hotspot_target} "release" "bundled" "internal"
+  buildjdk build/newboot ${systemjdk} %{hotspot_target} "release" "bundled" "internal" ${DEVKIT_ROOT}
   mv build/newboot/jdk/lib/%{vm_variant}/libjvm.so newboot/lib/%{vm_variant}
 %else
   systemjdk=%{bootjdk}
@@ -1434,10 +1587,14 @@ for suffix in %{build_loop} ; do
       # change --something to something
       debugbuild=`echo $suffix  | sed "s/-//g"`
   fi
-  # We build with internal debug symbols and do
-  # our own stripping for one version of the
-  # release build
-  debug_symbols=internal
+  # We build with 'external' debug symbols for the
+  # release build and build with 'internal' for
+  # slowdebug/fastdebug variants
+  if [ "x$suffix" = "x" ] ; then
+    debug_symbols=external
+  else
+    debug_symbols=internal
+  fi
 
   builddir=%{buildoutputdir -- ${suffix}}
   bootbuilddir=boot${builddir}
@@ -1463,17 +1620,15 @@ for suffix in %{build_loop} ; do
       run_bootstrap=%{bootstrap_build}
   fi
   if ${run_bootstrap} ; then
-      buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild} ${link_opt} ${debug_symbols}
+      buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild} ${link_opt} ${debug_symbols} ${DEVKIT_ROOT}
       installjdk ${bootbuilddir} ${bootinstalldir}
-      buildjdk ${builddir} $(pwd)/${bootinstalldir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols}
+      buildjdk ${builddir} $(pwd)/${bootinstalldir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} ${DEVKIT_ROOT}
       findgeneratedsources ${installdir} ${builddir} $(pwd)/%{top_level_dir_name}
-      stripjdk ${builddir}
       installjdk ${builddir} ${installdir}
       %{!?with_artifacts:rm -rf ${bootinstalldir}}
   else
-      buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols}
+      buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} ${debug_symbols} ${DEVKIT_ROOT}
       findgeneratedsources ${installdir} ${builddir} $(pwd)/%{top_level_dir_name}
-      stripjdk ${builddir}
       installjdk ${builddir} ${installdir}
   fi
   packagejdk ${installdir} ${packagesdir} %{altjavaoutputdir}
@@ -1492,7 +1647,7 @@ done # end of release / debug cycle loop
 # We test debug first as it will give better diagnostics on a crash
 for suffix in %{build_loop} ; do
 
-# portable builds have static_libs embedded, thus top_dir_abs_main_build_path is same as  top_dir_abs_staticlibs_build_path
+# portable builds have static_libs embedded, thus top_dir_abs_main_build_path is same as top_dir_abs_staticlibs_build_path
 top_dir_abs_main_build_path=$(pwd)/%{installoutputdir -- ${suffix}}
 %if %{include_staticlibs}
 top_dir_abs_staticlibs_build_path=${top_dir_abs_main_build_path}
@@ -1507,51 +1662,91 @@ export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage}
 #sed -i -e "s:^security.useSystemPropertiesFile=.*:security.useSystemPropertiesFile=true:" \
 #${JAVA_HOME}/conf/security/java.security
 
+# Set up tools
+%if "%{is_dtstoolchain}" ==  "devkit"
+  DEVKIT_ROOT=$(pwd)/devkit
+  source ${DEVKIT_ROOT}/devkit.info
+  NM="${DEVKIT_TOOLCHAIN_PATH}/nm"
+%else
+  NM=$(which nm)
+%endif
+# elfutils readelf supports more binaries than binutils version on RHEL 8
+# and debug symbols tests below were designed around this version
+READELF=$(which eu-readelf)
+# Only native gdb seems to work
+# The devkit gdb needs the devkit stdc++ library but then the JVM
+# segfaults when this is on the LD_LIBRARY_PATH
+GDB=$(which gdb)
+
 # Check Shenandoah is enabled
 %if %{use_shenandoah_hotspot}
 $JAVA_HOME/bin/java -XX:+UseShenandoahGC -version
 %endif
 
-# Check unlimited policy has been used
-$JAVA_HOME/bin/javac -d . %{SOURCE13}
-$JAVA_HOME/bin/java --add-opens java.base/javax.crypto=ALL-UNNAMED TestCryptoLevel
+# Only test on one architecture (the fastest) for Java only tests
+%ifarch %{jdk_test_arch}
 
-# Check ECC is working
-$JAVA_HOME/bin/javac -d . %{SOURCE14}
-$JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||")
+  # Check unlimited policy has been used
+  $JAVA_HOME/bin/javac -d . %{SOURCE13}
+  $JAVA_HOME/bin/java --add-opens java.base/javax.crypto=ALL-UNNAMED TestCryptoLevel
 
-# Check system crypto (policy) is deactive and can not be enabled
-# Test takes a single argument - true or false - to state whether system
-# security properties are enabled or not.
-$JAVA_HOME/bin/javac -d . %{SOURCE15}
-export PROG=$(echo $(basename %{SOURCE15})|sed "s|\.java||")
-export SEC_DEBUG="-Djava.security.debug=properties"
-# Specific to portable:System security properties to be off by default
-$JAVA_HOME/bin/java ${SEC_DEBUG} ${PROG} false
-$JAVA_HOME/bin/java ${SEC_DEBUG} -Djava.security.disableSystemPropertiesFile=false ${PROG} false
+  # Check ECC is working
+  $JAVA_HOME/bin/javac -d . %{SOURCE14}
+  $JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||")
 
-# Check correct vendor values have been set
-$JAVA_HOME/bin/javac -d . %{SOURCE16}
-$JAVA_HOME/bin/java $(echo $(basename %{SOURCE16})|sed "s|\.java||") "%{oj_vendor}" "%{oj_vendor_url}" "%{oj_vendor_bug_url}" "%{oj_vendor_version}"
+  # Check system crypto (policy) is deactive and can not be enabled
+  # Test takes a single argument - true or false - to state whether system
+  # security properties are enabled or not.
+  $JAVA_HOME/bin/javac -d . %{SOURCE15}
+  export PROG=$(echo $(basename %{SOURCE15})|sed "s|\.java||")
+  export SEC_DEBUG="-Djava.security.debug=properties"
+  # Specific to portable:System security properties to be off by default
+  $JAVA_HOME/bin/java ${SEC_DEBUG} ${PROG} false
+  $JAVA_HOME/bin/java ${SEC_DEBUG} -Djava.security.disableSystemPropertiesFile=false ${PROG} false
+
+  # Check correct vendor values have been set
+  $JAVA_HOME/bin/javac -d . %{SOURCE16}
+  $JAVA_HOME/bin/java $(echo $(basename %{SOURCE16})|sed "s|\.java||") "%{oj_vendor}" "%{oj_vendor_url}" "%{oj_vendor_bug_url}" "%{oj_vendor_version}"
+
+%if ! 0%{?flatpak}
+  # Check translations are available for new timezones (during flatpak builds, the
+  # tzdb.dat used by this test is not where the test expects it, so this is
+  # disabled for flatpak builds)
+  # Disable test until we are on the latest JDK
+  $JAVA_HOME/bin/javac -d . %{SOURCE18}
+  $JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE || echo "Fedora is often ahead in timezones, ignoring"
+  $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR || echo "Fedora is often ahead in timezones, ignoring"
+%endif
+
+  # Check src.zip has all sources. See RHBZ#1130490
+  unzip -l $JAVA_HOME/lib/src.zip | grep 'sun.misc.Unsafe'
+
+  # Check class files include useful debugging information
+  $JAVA_HOME/bin/javap -c -l java.lang.Object | grep "Compiled from"
+  $JAVA_HOME/bin/javap -c -l java.lang.Object | grep LineNumberTable
+  $JAVA_HOME/bin/javap -c -l java.lang.Object | grep LocalVariableTable
+
+  # Check generated class files include useful debugging information
+  $JAVA_HOME/bin/javap -c -l java.nio.ByteBuffer | grep "Compiled from"
+  $JAVA_HOME/bin/javap -c -l java.nio.ByteBuffer | grep LineNumberTable
+  $JAVA_HOME/bin/javap -c -l java.nio.ByteBuffer | grep LocalVariableTable
+
+%else
+
+  # Just run a basic java -version test on other architectures
+  $JAVA_HOME/bin/java -version
+
+%endif
 
 # Check java launcher has no SSB mitigation
-if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi
+if ! ${NM} $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi
 
 # Check alt-java launcher has SSB mitigation on supported architectures
 # set_speculation function exists in both cases, so check for prctl call
 %ifarch %{ssbd_arches}
-nm %{altjavaoutputdir}/%{alt_java_name} | grep prctl
+${NM} %{altjavaoutputdir}/%{alt_java_name} | grep prctl
 %else
-if ! nm %{altjavaoutputdir}/%{alt_java_name} | grep prctl ; then true ; else false; fi
-%endif
-
-%if ! 0%{?flatpak}
-# Check translations are available for new timezones (during flatpak builds, the
-# tzdb.dat used by this test is not where the test expects it, so this is
-# disabled for flatpak builds)
-$JAVA_HOME/bin/javac -d . %{SOURCE18}
-$JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE || echo "FIXME before release!"
-$JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR || echo "FIXME before release!"
+if ! ${NM} %{altjavaoutputdir}/%{alt_java_name} | grep prctl ; then true ; else false; fi
 %endif
 
 %if %{include_staticlibs}
@@ -1559,8 +1754,8 @@ $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|
 export STATIC_LIBS_HOME=${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image}
 ls -l $STATIC_LIBS_HOME
 ls -l $STATIC_LIBS_HOME/lib
-readelf --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet4AddressImpl.c
-readelf --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet6AddressImpl.c
+${READELF} --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet4AddressImpl.c
+${READELF} --debug-dump $STATIC_LIBS_HOME/lib/libnet.a | grep Inet6AddressImpl.c
 %endif
 
 # Release builds strip the debug symbols into external .debuginfo files
@@ -1579,15 +1774,15 @@ do
 
     # Test for .debug_* sections in the shared object. This is the main test
     # Stripped objects will not contain these
-    eu-readelf -S "$lib" | grep "] .debug_"
-    test $(eu-readelf -S "$lib" | grep -E "\]\ .debug_(info|abbrev)" | wc --lines) == 2
+    ${READELF} -S "$lib" | grep "] .debug_"
+    test $(${READELF} -S "$lib" | grep -E "\]\ .debug_(info|abbrev)" | wc --lines) == 2
 
     # Test FILE symbols. These will most likely be removed by anything that
     # manipulates symbol tables because it's generally useless. So a nice test
     # that nothing has messed with symbols
     old_IFS="$IFS"
     IFS=$'\n'
-    for line in $(eu-readelf -s "$lib" | grep "00000000      0 FILE    LOCAL  DEFAULT")
+    for line in $(${READELF} -s "$lib" | grep "00000000      0 FILE    LOCAL  DEFAULT")
     do
      # We expect to see .cpp and .S files, except for architectures like aarch64 and
      # s390 where we expect .o and .oS files
@@ -1597,17 +1792,17 @@ do
 
     # If this is the JVM, look for javaCalls.(cpp|o) in FILEs, for extra sanity checking
     if [ "`basename $lib`" = "libjvm.so" ]; then
-      eu-readelf -s "$lib" | \
+      ${READELF} -s "$lib" | \
         grep -E "00000000      0 FILE    LOCAL  DEFAULT      ABS javaCalls.(cpp|o)$"
     fi
 
     # Test that there are no .gnu_debuglink sections pointing to another
     # debuginfo file. There shouldn't be any debuginfo files, so the link makes
     # no sense either
-    eu-readelf -S "$lib" | grep 'gnu'
-    if eu-readelf -S "$lib" | grep '] .gnu_debuglink' | grep PROGBITS; then
+    ${READELF} -S "$lib" | grep 'gnu'
+    if ${READELF} -S "$lib" | grep '] .gnu_debuglink' | grep PROGBITS; then
       echo "bad .gnu_debuglink section."
-      eu-readelf -x .gnu_debuglink "$lib"
+      ${READELF} -x .gnu_debuglink "$lib"
       false
     fi
   fi
@@ -1619,7 +1814,7 @@ done
 # Using line number 1 might cause build problems. See:
 # https://bugzilla.redhat.com/show_bug.cgi?id=1539664
 # https://bugzilla.redhat.com/show_bug.cgi?id=1538767
-gdb -q "$JAVA_HOME/bin/java" <<EOF | tee gdb.out
+${GDB} -q "$JAVA_HOME/bin/java" <<EOF | tee gdb.out
 handle SIGSEGV pass nostop noprint
 handle SIGILL pass nostop noprint
 set breakpoint pending on
@@ -1634,19 +1829,6 @@ EOF
 grep 'JavaCallWrapper::JavaCallWrapper' gdb.out
 %endif
 
-# Check src.zip has all sources. See RHBZ#1130490
-$JAVA_HOME/bin/jar -tf $JAVA_HOME/lib/src.zip | grep 'sun.misc.Unsafe'
-
-# Check class files include useful debugging information
-$JAVA_HOME/bin/javap -l java.lang.Object | grep "Compiled from"
-$JAVA_HOME/bin/javap -l java.lang.Object | grep LineNumberTable
-$JAVA_HOME/bin/javap -l java.lang.Object | grep LocalVariableTable
-
-# Check generated class files include useful debugging information
-$JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep "Compiled from"
-$JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep LineNumberTable
-$JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep LocalVariableTable
-
 # build cycles check
 done
 
@@ -1666,15 +1848,17 @@ for suffix in %{build_loop} ; do
         nameSuffix=`echo "$suffix"| sed s/-/./`
     fi
 
-    # These definitions should match those in installjdk
+    # These definitions should match those in packagejdk
     jdkarchive=${packagesdir}/%{jdkportablearchive -- "$nameSuffix"}
+    jmodsarchive=${packagesdir}/%{jmodsportablearchive -- "$nameSuffix"}
     jrearchive=${packagesdir}/%{jreportablearchive -- "$nameSuffix"}
     staticarchive=${packagesdir}/%{staticlibsportablearchive -- "$nameSuffix"}
     debugarchive=${packagesdir}/%{jdkportablearchive -- "${nameSuffix}.debuginfo"}
-    unstrippedarchive=${packagesdir}/%{jdkportablearchive -- "${nameSuffix}.unstripped"}
 
     mv ${jdkarchive} $RPM_BUILD_ROOT%{_jvmdir}/
     mv ${jdkarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/
+    mv ${jmodsarchive} $RPM_BUILD_ROOT%{_jvmdir}/
+    mv ${jmodsarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/
     mv ${jrearchive} $RPM_BUILD_ROOT%{_jvmdir}/
     mv ${jrearchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/
 
@@ -1686,8 +1870,6 @@ for suffix in %{build_loop} ; do
     if [ "x$suffix" = "x" ] ; then
         mv ${debugarchive} $RPM_BUILD_ROOT%{_jvmdir}/
         mv ${debugarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/
-        mv ${unstrippedarchive} $RPM_BUILD_ROOT%{_jvmdir}/
-        mv ${unstrippedarchive}.sha256sum $RPM_BUILD_ROOT%{_jvmdir}/
     fi
 done
 
@@ -1724,6 +1906,8 @@ done
 %{_jvmdir}/%{jdkportablearchive -- .debuginfo}
 %{_jvmdir}/%{jdkportablearchiveForFiles}.sha256sum
 %{_jvmdir}/%{jdkportablearchive -- .debuginfo}.sha256sum
+%{_jvmdir}/%{jmodsportablearchiveForFiles}
+%{_jvmdir}/%{jmodsportablearchiveForFiles}.sha256sum
 %endif
 
 %if %{include_normal_build}
@@ -1732,10 +1916,6 @@ done
 %{_jvmdir}/%{staticlibsportablearchiveForFiles}
 %{_jvmdir}/%{staticlibsportablearchiveForFiles}.sha256sum
 %endif
-
-%files unstripped
-%{_jvmdir}/%{jdkportablearchive -- .unstripped}
-%{_jvmdir}/%{jdkportablearchive -- .unstripped}.sha256sum
 %endif
 
 %if %{include_debug_build}
@@ -1746,6 +1926,8 @@ done
 %files devel-slowdebug
 %{_jvmdir}/%{jdkportablearchive -- .slowdebug}
 %{_jvmdir}/%{jdkportablearchive -- .slowdebug}.sha256sum
+%{_jvmdir}/%{jmodsportablearchive -- .slowdebug}
+%{_jvmdir}/%{jmodsportablearchive -- .slowdebug}.sha256sum
 
 %if %{include_staticlibs}
 %files static-libs-slowdebug
@@ -1762,6 +1944,8 @@ done
 %files devel-fastdebug
 %{_jvmdir}/%{jdkportablearchive -- .fastdebug}
 %{_jvmdir}/%{jdkportablearchive -- .fastdebug}.sha256sum
+%{_jvmdir}/%{jmodsportablearchive -- .fastdebug}
+%{_jvmdir}/%{jmodsportablearchive -- .fastdebug}.sha256sum
 
 %if %{include_staticlibs}
 %files static-libs-fastdebug
@@ -1784,5 +1968,4 @@ done
 %{_jvmdir}/%{miscportablearchive}.sha256sum
 %endif
 
-%changelog
 %autochangelog
diff --git a/jconsole.desktop.in b/jconsole.desktop.in
deleted file mode 100644
index c1b8f6a..0000000
--- a/jconsole.desktop.in
+++ /dev/null
@@ -1 +0,0 @@
-# this file is intentionally not here, as portable builds do not have desktop integration
diff --git a/openjdk_news.sh b/openjdk_news.sh
deleted file mode 100755
index d1bd061..0000000
--- a/openjdk_news.sh
+++ /dev/null
@@ -1,76 +0,0 @@
-#!/bin/bash
-
-# Copyright (C) 2022 Red Hat, Inc.
-# Written by Andrew John Hughes <gnu.andrew@redhat.com>, 2012-2022
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU Affero General Public License as
-# published by the Free Software Foundation, either version 3 of the
-# License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU Affero General Public License for more details.
-#
-# You should have received a copy of the GNU Affero General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-OLD_RELEASE=$1
-NEW_RELEASE=$2
-REPO=$3
-SUBDIR=$4
-SCRIPT_DIR=$(dirname ${0})
-
-if test "x${SUBDIR}" = "x"; then
-    echo "No subdirectory specified; using .";
-    SUBDIR=".";
-fi
-
-if test "x$REPO" = "x"; then
-    echo "No repository specified; using ${PWD}"
-    REPO=${PWD}
-fi
-
-if test x${TMPDIR} = x; then
-    TMPDIR=/tmp;
-fi
-
-echo "Repository: ${REPO}"
-
-if [ -e ${REPO}/.git ] ; then
-    TYPE=git;
-elif [ -e ${REPO}/.hg ] ; then
-    TYPE=hg;
-else
-    echo "No Mercurial or Git repository detected.";
-    exit 1;
-fi
-
-if test "x$OLD_RELEASE" = "x" || test "x$NEW_RELEASE" = "x"; then
-    echo "ERROR: Need to specify old and new release";
-    exit 2;
-fi
-
-echo "Listing fixes between $OLD_RELEASE and $NEW_RELEASE in $REPO"
-rm -f ${TMPDIR}/fixes2 ${TMPDIR}/fixes3 ${TMPDIR}/fixes
-for repos in . $(${SCRIPT_DIR}/discover_trees.sh ${REPO});
-do
-    if test "x$TYPE" = "xhg"; then
-	hg log -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R $REPO/$repos -G -M ${REPO}/${SUBDIR} | \
-	    grep -E '^[o:| ]*summary'|grep -v 'Added tag'|sed -r 's#^[o:| ]*summary:\W*([0-9])#  - JDK-\1#'| \
-	    sed 's#^[o:| ]*summary:\W*#  - #' >> ${TMPDIR}/fixes2;
-	hg log -v -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R $REPO/$repos -G -M ${REPO}/${SUBDIR} | \
-	    grep -E '^[o:| ]*[0-9]{7}'|sed -r 's#^[o:| ]*([0-9]{7})#  - JDK-\1#' >> ${TMPDIR}/fixes3;
-    else
-	git -C ${REPO} log --no-merges --pretty=format:%B ${NEW_RELEASE}...${OLD_RELEASE} -- ${SUBDIR} |grep -E '^[0-9]{7}' | \
-	    sed -r 's#^([0-9])#  - JDK-\1#' >> ${TMPDIR}/fixes2;
-	touch ${TMPDIR}/fixes3 ; # unused
-    fi
-done
-
-sort ${TMPDIR}/fixes2 ${TMPDIR}/fixes3 | uniq > ${TMPDIR}/fixes
-rm -f ${TMPDIR}/fixes2 ${TMPDIR}/fixes3
-
-echo "In ${TMPDIR}/fixes:"
-cat ${TMPDIR}/fixes
diff --git a/discover_trees.sh b/scripts/discover_trees.sh
similarity index 57%
rename from discover_trees.sh
rename to scripts/discover_trees.sh
index 8c31278..7a0b800 100755
--- a/discover_trees.sh
+++ b/scripts/discover_trees.sh
@@ -1,6 +1,6 @@
 #!/bin/sh
 
-# Copyright (C) 2020 Red Hat, Inc.
+# Copyright (C) 2024 Red Hat, Inc.
 # Written by Andrew John Hughes <gnu.andrew@redhat.com>.
 #
 # This program is free software: you can redistribute it and/or modify
@@ -18,37 +18,44 @@
 
 TREE=${1}
 
-if test "x${TREE}" = "x"; then
+if test "${TREE}" = ""; then
     TREE=${PWD}
 fi
 
-if [ -e ${TREE}/nashorn/.hg -o -e ${TREE}/nashorn/merge.changeset ] ; then
+if [ -e "${TREE}"/nashorn/.hg ] || [ -e "${TREE}"/nashorn/merge.changeset ] ; then
     NASHORN="nashorn" ;
 fi
 
-if [ -e ${TREE}/corba/.hg -o -e ${TREE}/corba/merge.changeset ] ; then
+if [ -e "${TREE}"/corba/.hg ] || [ -e "${TREE}"/corba/merge.changeset ] ; then
     CORBA="corba";
 fi
 
-if [ -e ${TREE}/jaxp/.hg -o -e ${TREE}/jaxp/merge.changeset ] ; then
+if [ -e "${TREE}"/jaxp/.hg ] || [ -e "${TREE}"/jaxp/merge.changeset ] ; then
     JAXP="jaxp";
 fi
 
-if [ -e ${TREE}/jaxws/.hg -o -e ${TREE}/jaxws/merge.changeset ] ; then
+if [ -e "${TREE}"/jaxws/.hg ] || [ -e "${TREE}"/jaxws/merge.changeset ] ; then
     JAXWS="jaxws";
 fi
 
-if [ -e ${TREE}/langtools/.hg -o -e ${TREE}/langtools/merge.changeset ] ; then
+if [ -e "${TREE}"/langtools/.hg ] || [ -e "${TREE}"/langtools/merge.changeset ] ; then
     LANGTOOLS="langtools";
 fi
 
-if [ -e ${TREE}/jdk/.hg -o -e ${TREE}/jdk/merge.changeset ] ; then
+if [ -e "${TREE}"/jdk/.hg ] || [ -e "${TREE}"/jdk/merge.changeset ] ; then
     JDK="jdk";
 fi
 
-if [ -e ${TREE}/hotspot/.hg -o -e ${TREE}/hotspot/merge.changeset ] ; then
+if [ -e "${TREE}"/hotspot/.hg ] || [ -e "${TREE}"/hotspot/merge.changeset ] ; then
     HOTSPOT="hotspot";
 fi
 
 SUBTREES="${CORBA} ${JAXP} ${JAXWS} ${LANGTOOLS} ${NASHORN} ${JDK} ${HOTSPOT}";
-echo ${SUBTREES}
+echo "${SUBTREES}"
+
+# Local Variables:
+# compile-command: "shellcheck discover_trees.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/generate_source_tarball.sh b/scripts/generate_source_tarball.sh
similarity index 70%
rename from generate_source_tarball.sh
rename to scripts/generate_source_tarball.sh
index c62430a..e01043d 100755
--- a/generate_source_tarball.sh
+++ b/scripts/generate_source_tarball.sh
@@ -1,6 +1,10 @@
 #!/bin/bash
 
 # Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#     Thomas Fitzsimmons <fitzsim@redhat.com>
+#     Jiri Vanek <jvanek@redhat.com>
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License as
@@ -15,42 +19,46 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-# Generates the 'source tarball' for JDK projects.
+# Generates the source tarball for OpenJDK projects.
+#
+# There are multiple ways to specify the source code location and version:
+#
+# 1. Specify the version (VERSION), the location of the Git repository
+#    (REPO_ROOT) and the root of the output tarball name (FILE_NAME_ROOT)
+# 2. Specify the version (VERSION) along with an upstream project name
+#    (PROJECT_NAME) and repository name (REPO_NAME) that can be used
+#    to construct the URL of the upstream OpenJDK repository.
+# 3. Specify OPENJDK_LATEST=1 and allow the script to obtain the JDK
+#    feature version from the spec file, which is then used to
+#    obtain the latest build promotion from the upstream repository.
+#
+# An appropriate bootstrap JDK is also required for when ./configure
+# is run within the checked out repository to generate the .src-rev.
+# file. This can be specified by setting BOOT_JDK.
 #
 # Example 1:
-# When used from local repo set REPO_ROOT pointing to file:// with your repo.
-# If your local repo follows upstream forests conventions, it may be enough to
-# set OPENJDK_URL.
+# This will check out the specified version from the specified
+# repository and construct a tarball called openjdk-17.0.3+5.tar.xz:
+#
+# $ VERSION=jdk-17.0.3+5 FILE_NAME_ROOT=open${VERSION} \
+#   REPO_ROOT=$HOME/projects/openjdk/upstream/17u \
+#   BOOT_JDK=/usr/lib/jvm/java-17-openjdk ./generate_source_tarball.sh
 #
 # Example 2:
+# This will check out the same version as example 1, but from the
+# upstream repository:
+#
+# $ VERSION=jdk-25+36 PROJECT_NAME=openjdk REPO_NAME=jdk25u \
+#   BOOT_JDK=/usr/lib/jvm/java-17-openjdk sh scripts/generate_source_tarball.sh
+#
+# Example 3:
 # This will read the OpenJDK feature version from the spec file, then create a
 # tarball from the most recent tag for that version in the upstream Git
 # repository.
 #
-# $ OPENJDK_LATEST=1 ./generate_source_tarball.sh
-# [...]
-# Tarball is: temp-generated-source-tarball-ujD/openjdk-17.0.10+6-ea.tar.xz
+# $ OPENJDK_LATEST=1 \
+#   BOOT_JDK=/usr/lib/jvm/java-17-openjdk ./generate_source_tarball.sh
 #
-# Unless you use OPENJDK_LATEST, you have to set PROJECT_NAME, REPO_NAME and
-# VERSION, e.g.:
-#
-# PROJECT_NAME=openjdk
-# REPO_NAME=jdk23u
-# VERSION=jdk-23.0.1+11
-#
-# or to e.g., prepare systemtap, icedtea7's jstack and other tapsets:
-#
-# VERSION=6327cf1cea9e
-# REPO_NAME=icedtea7-2.6
-# PROJECT_NAME=release
-# OPENJDK_URL=http://icedtea.classpath.org/hg/
-# TO_COMPRESS="*/tapset"
-#
-# They are used to create correct name and are used in construction of sources
-# URL (unless REPO_ROOT is set).
-#
-# This script creates a single source tarball out of the repository based on the
-# given tag and removes code not allowed in Fedora/RHEL.
 
 set -e
 
@@ -114,7 +122,7 @@ if [ "$OPENJDK_LATEST" != "" ] ; then
 fi
 
 if [ "$WITH_TEMP" != "" ] ; then
-    pushd "$(mktemp --directory temp-generated-source-tarball-XXX)"
+    pushd "$(mktemp --directory --tmpdir temp-generated-source-tarball-XXX)"
 fi
 
 if [ "$VERSION" = "" ] ; then
@@ -200,18 +208,25 @@ echo -e "\tFILE_NAME_ROOT: ${FILE_NAME_ROOT}"
 echo -e "\tREPO_ROOT: ${REPO_ROOT}"
 echo -e "\tTO_COMPRESS: ${TO_COMPRESS}"
 echo -e "\tBOOT_JDK: ${BOOT_JDK}"
+echo -e "\tWITH_TEMP: ${WITH_TEMP}"
+echo -e "\tOPENJDK_LATEST: ${OPENJDK_LATEST}"
 
 if [ -d "${FILE_NAME_ROOT}" ] ; then
-    echo "exists exists exists exists exists exists exists "
-    echo "reusing reusing reusing reusing reusing reusing "
-    echo "${FILE_NAME_ROOT}"
+    echo "Reusing existing ${FILE_NAME_ROOT}"
     STAT_TIME="$(stat --format=%Y "${FILE_NAME_ROOT}")"
     TAR_TIME="$(date --date=@"${STAT_TIME}" --iso-8601=seconds)"
 else
     mkdir "${FILE_NAME_ROOT}"
     pushd "${FILE_NAME_ROOT}"
         echo "Cloning ${VERSION} root repository from ${REPO_ROOT}"
-        git clone --depth=1 -b "${VERSION}" "${REPO_ROOT}" "${VERSION}"
+        if realpath -q "${REPO_ROOT}"; then
+            echo "Local path detected; not adding depth argument";
+            DEPTH="--";
+        else
+            DEPTH="--depth=1";
+            echo "Remote repository detected; adding ${DEPTH}";
+        fi
+        git clone -b "${VERSION}" "${DEPTH}" "${REPO_ROOT}" "${VERSION}"
         pushd "${VERSION}"
             TAR_TIME="$(git log --max-count 1 --format=%cI)"
         popd
@@ -227,39 +242,44 @@ pushd "${FILE_NAME_ROOT}"
     popd
     rm -rf build
 
-    EA_PART="$(awk -F= \
-               '/^DEFAULT_PROMOTED_VERSION_PRE/ { if ($2) print "-"$2 }' \
-               "${VERSION}"/make/conf/version-numbers.conf)"
-    TARBALL_BASE=${FILE_NAME_ROOT}${EA_PART}.tar
-    pushd "${VERSION}"
-        # Omit commit checks, history, and GHA from archive.
-        for skip in .jcheck .hgtags .hgignore .gitattributes .gitignore .github
-        do
-            echo "${skip}"" export-ignore" >> .git/info/attributes
-        done
-        # Do not bother with --mtime here; specify it to tar below.
-        # Unforunately, git-archive sorts added files like .src-rev at the end;
-        # retar below to use GNU tar --sort=name ordering which sorts .src-rev
-        # at the start.
-        git archive --output "${TARBALL_BASE}" --prefix="${VERSION}"/ \
-            --add-file=.src-rev --format=tar "${VERSION}"
-    popd
-    mv "${VERSION}" "${VERSION}".git
-    tar xf "${VERSION}".git/"${TARBALL_BASE}"
+    # Remove commit checks
+    echo "Removing $(find "${VERSION}" -name '.jcheck' -print)"
+    find "${VERSION}" -name '.jcheck' -print0 | xargs -0 rm -r
+
+    # Remove history and GHA
+    echo "find ${VERSION} -name '.hgtags'"
+    find "${VERSION}" -name '.hgtags' -exec rm -v '{}' '+'
+    echo "find ${VERSION} -name '.hgignore'"
+    find "${VERSION}" -name '.hgignore' -exec rm -v '{}' '+'
+    echo "find ${VERSION} -name '.gitattributes'"
+    find "${VERSION}" -name '.gitattributes' -exec rm -v '{}' '+'
+    echo "find ${VERSION} -name '.gitignore'"
+    find "${VERSION}" -name '.gitignore' -exec rm -v '{}' '+'
+    # Work around some Git objects not having write permissions.
+    echo "chmod --recursive u+w ${VERSION}/.git"
+    chmod --recursive u+w "${VERSION}"/.git
+    echo "find ${VERSION} -name '.git'"
+    find "${VERSION}" -name '.git' -exec rm -rv '{}' '+'
+    echo "find ${VERSION} -name '.github'"
+    find "${VERSION}" -name '.github' -exec rm -rv '{}' '+'
+
     echo "Compressing remaining forest"
     if [ "$COMPRESSION" = "xz" ] ; then
         SWITCH=cJf
     else
         SWITCH=czf
     fi
-    TARBALL_NAME=${TARBALL_BASE}.${COMPRESSION}
+    EA_PART="$(awk -F= \
+               '/^DEFAULT_PROMOTED_VERSION_PRE/ { if ($2) print "-"$2 }' \
+               "${VERSION}"/make/conf/version-numbers.conf)"
+    TARBALL_NAME=${FILE_NAME_ROOT}${EA_PART}.tar.${COMPRESSION}
     XZ_OPT=${XZ_OPT-"-T0"} \
           tar --mtime="${TAR_TIME}" --owner=root --group=root --sort=name \
-          -$SWITCH "${TARBALL_NAME}" "${TO_COMPRESS}"
+          --exclude-vcs -$SWITCH "${TARBALL_NAME}" "${TO_COMPRESS}"
     mv "${TARBALL_NAME}" ..
 popd
 if [ "$WITH_TEMP" != "" ] ; then
-    echo "Tarball is: $(realpath --relative-to=.. .)/${TARBALL_NAME}"
+    echo "Tarball is: $(realpath .)/${TARBALL_NAME}"
     popd
 else
     echo -n "Done. You may want to remove the uncompressed version"
diff --git a/scripts/get_bundle_versions.sh b/scripts/get_bundle_versions.sh
new file mode 100755
index 0000000..dddbee4
--- /dev/null
+++ b/scripts/get_bundle_versions.sh
@@ -0,0 +1,172 @@
+#!/usr/bin/env sh
+
+# Copyright (C) 2025 Red Hat, Inc.
+# Original written by Antonio Vieiro <avieirov@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+if [ $# -ne 1 ]; then
+    echo "Usage: $0 openjdk-root-directory"
+    exit 1
+fi
+
+JDKROOT=$1
+
+if [ ! -d "${JDKROOT}" ] ; then
+    echo "${JDKROOT} is not a directory.";
+    exit 2
+fi
+
+# Work out the OpenJDK version
+# OpenJDK >= 10 has its version in the build machinery
+# OpenJDK >= 17 stores it in a new location (JDK-8258246)
+VERSION_FILE="${JDKROOT}"/make/conf/version-numbers.conf
+printf "Checking for %s..." "${VERSION_FILE}";
+if [ ! -f "${VERSION_FILE}" ] ; then
+    VERSION_FILE="${JDKROOT}"/make/autoconf/version-numbers
+    echo "Not found; using old version file ${VERSION_FILE}";
+else
+    echo "found.";
+fi
+if [ -e "${VERSION_FILE}" ] ; then
+    openjdk_version=$(grep '^DEFAULT_VERSION_FEATURE' "${VERSION_FILE}" | cut -d '=' -f 2)
+elif [ -e "${JDKROOT}"/jdk/src/java.base/share/classes/java/lang/Object.java ] ; then
+    openjdk_version=9;
+elif [ -e "${JDKROOT}"/common/autoconf ] ; then
+    openjdk_version=8;
+else
+    openjdk_version=7;
+fi
+echo "OpenJDK version: ${openjdk_version}";
+
+#
+# Freetype
+#
+if [ "${openjdk_version}" -gt 8 ] ; then
+    FREETYPE=src/java.desktop/share/native/libfreetype/include/freetype/freetype.h
+    ABS_FREETYPE="${JDKROOT}"/"${FREETYPE}"
+    if [ ! -f "${ABS_FREETYPE}" ]; then
+        echo "Freetype header not found!"
+        exit 2
+    fi
+    FREETYPE_VERSION=$(awk '/#define FREETYPE_MAJOR/ {MAJOR=$3} /#define FREETYPE_MINOR/ {MINOR=$3} /#define FREETYPE_PATCH/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_FREETYPE}")
+else
+    echo "No bundled FreeType on ${openjdk_version}";
+fi
+
+# giflib
+if [ "${openjdk_version}" -gt 8 ] ; then
+    GIFLIB=src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
+else
+    GIFLIB=jdk/src/share/native/sun/awt/giflib/gif_lib.h
+fi
+ABS_GIFLIB="${JDKROOT}"/"${GIFLIB}"
+if [ ! -f "${ABS_GIFLIB}" ]; then
+    echo "giflib header not found!"
+    exit 3
+fi
+GIFLIB_VERSION=$(awk '/#define GIFLIB_MAJOR/ {MAJOR=$3} /#define GIFLIB_MINOR/ {MINOR=$3} /#define GIFLIB_RELEASE/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_GIFLIB}")
+
+# harfbuzz
+if [ "${openjdk_version}" -gt 8 ] ; then
+    HARFBUZZ=src/java.desktop/share/native/libharfbuzz/hb-version.h
+    ABS_HARFBUZZ="${JDKROOT}/${HARFBUZZ}"
+    if [ ! -f "${ABS_HARFBUZZ}" ]; then
+        echo "HarfBuzz header not found!"
+        exit 4
+    fi
+    HARFBUZZ_VERSION=$(awk '/#define HB_VERSION_MAJOR/ {MAJOR=$3} /#define HB_VERSION_MINOR/ {MINOR=$3} /#define HB_VERSION_MICRO/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_HARFBUZZ}")
+else
+    echo "No HarfBuzz on ${openjdk_version}";
+fi
+
+# lcms
+if [ "${openjdk_version}" -gt 8 ] ; then
+    LCMS=src/java.desktop/share/native/liblcms/lcms2.h
+else
+    LCMS=jdk/src/share/native/sun/java2d/cmm/lcms/lcms2.h
+fi
+ABS_LCMS="${JDKROOT}"/"${LCMS}"
+if [ ! -f "${ABS_LCMS}" ]; then
+    echo "lcms header not found!"
+    exit 5
+fi
+LCMS_VERSION=$(awk '/#define LCMS_VERSION/ { MAJOR=int($3 / 1000); REST=$3 % 1000; MINOR=int(REST / 10); PATCH=REST % 10; } END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_LCMS}")
+
+# jpeg
+if [ "${openjdk_version}" -gt 8 ] ; then
+    JPEG=src/java.desktop/share/native/libjavajpeg/jpeglib.h
+else
+    JPEG=jdk/src/share/native/sun/awt/image/jpeg/jpeglib.h
+fi
+ABS_JPEG="${JDKROOT}"/"${JPEG}"
+if [ ! -f "${ABS_JPEG}" ]; then
+    echo "jpeg header not found!"
+    exit 6
+fi
+JPEG_VERSION=$(awk '/#define JPEG_LIB_VERSION/ { VERSION=$3; MAJOR=int(VERSION / 10); MINOR=VERSION%10; } END {printf "%s%c", MAJOR, (MINOR+96)}' "${ABS_JPEG}")
+
+# png
+if [ "${openjdk_version}" -gt 8 ] ; then
+    PNG=src/java.desktop/share/native/libsplashscreen/libpng/png.h
+else
+    PNG=jdk/src/share/native/sun/awt/libpng/png.h
+fi
+ABS_PNG="${JDKROOT}"/"${PNG}"
+if [ ! -f "${ABS_PNG}" ]; then
+    echo "png header not found!"
+    exit 7
+fi
+PNG_VERSION=$(awk '/#define PNG_LIBPNG_VER_STRING/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_PNG}")
+
+# zlib
+if [ "${openjdk_version}" -gt 8 ] ; then
+    ZLIB=src/java.base/share/native/libzip/zlib/zlib.h
+else
+    ZLIB=jdk/src/share/native/java/util/zip/zlib/zlib.h
+fi
+ABS_ZLIB="${JDKROOT}"/"${ZLIB}"
+if [ ! -f "${ABS_ZLIB}" ]; then
+    echo "zlib header not found!"
+    exit 8
+fi
+ZLIB_VERSION=$(awk '/#define ZLIB_VERSION/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_ZLIB}")
+
+# Print output
+printf "\nRPM definitions:\n"
+if [ "${openjdk_version}" -gt 8 ] ; then
+    echo "# Version in ${FREETYPE}"
+    echo "Provides: bundled(freetype) = ${FREETYPE_VERSION}"
+fi
+echo "# Version in ${GIFLIB}"
+echo "Provides: bundled(giflib) = ${GIFLIB_VERSION}"
+if [ "${openjdk_version}" -gt 8 ] ; then
+    echo "# Version in ${HARFBUZZ}"
+    echo "Provides: bundled(harfbuzz) = ${HARFBUZZ_VERSION}"
+fi
+echo "# Version in ${LCMS}"
+echo "Provides: bundled(lcms2) = ${LCMS_VERSION}"
+echo "# Version in ${JPEG}"
+echo "Provides: bundled(libjpeg) = ${JPEG_VERSION}"
+echo "# Version in ${PNG}"
+echo "Provides: bundled(libpng) = ${PNG_VERSION}"
+echo "# Version in ${ZLIB}"
+echo "Provides: bundled(zlib) = ${ZLIB_VERSION}"
+
+# Local Variables:
+# compile-command: "shellcheck get_bundle_versions.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/icedtea_sync.sh b/scripts/icedtea_sync.sh
similarity index 100%
rename from icedtea_sync.sh
rename to scripts/icedtea_sync.sh
diff --git a/scripts/openjdk_news.sh b/scripts/openjdk_news.sh
new file mode 100755
index 0000000..9574915
--- /dev/null
+++ b/scripts/openjdk_news.sh
@@ -0,0 +1,114 @@
+#!/bin/bash
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by Andrew John Hughes <gnu.andrew@redhat.com>, 2012-2022
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+OLD_RELEASE=$1
+NEW_RELEASE=$2
+REPO=$3
+SUBDIR=$4
+SCRIPT_DIR=$(dirname "${0}")
+
+if test "${SUBDIR}" = ""; then
+    echo "No subdirectory specified; using .";
+    SUBDIR=".";
+fi
+
+if test "$REPO" = ""; then
+    echo "No repository specified; using ${PWD}"
+    REPO=${PWD}
+fi
+
+if test "${TMPDIR}" = ""; then
+    TMPDIR=/tmp;
+fi
+
+echo "Repository: ${REPO}"
+
+if [ -e "${REPO}/.git" ] ; then
+    TYPE=git;
+elif [ -e "${REPO}/.hg" ] ; then
+    TYPE=hg;
+else
+    echo "No Mercurial or Git repository detected.";
+    exit 1;
+fi
+
+if test "$OLD_RELEASE" = "" || test "$NEW_RELEASE" = ""; then
+    echo "ERROR: Need to specify old and new release";
+    exit 2;
+fi
+
+echo "Listing fixes between $OLD_RELEASE and $NEW_RELEASE in $REPO"
+rm -f "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" "${TMPDIR}/fixes"
+for repos in . $("${SCRIPT_DIR}/discover_trees.sh" "${REPO}");
+do
+    if test "$TYPE" = "hg"; then
+	hg log -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R "$REPO/$repos" -G -M "${REPO}/${SUBDIR}" | \
+	    grep -E '^[o:| ]*summary'|grep -v 'Added tag'|sed -r 's#^[o:| ]*summary:\W*([0-9])#  - JDK-\1#'| \
+	    sed 's#^[o:| ]*summary:\W*#  - #' >> "${TMPDIR}/fixes2";
+	hg log -v -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R "$REPO/$repos" -G -M "${REPO}/${SUBDIR}" | \
+	    grep -E '^[o:| ]*[0-9]{7}'|sed -r 's#^[o:| ]*([0-9]{7})#  - JDK-\1#' >> "${TMPDIR}/fixes3";
+    else
+	git -C "${REPO}" log --no-merges --pretty=format:%B "${NEW_RELEASE}...${OLD_RELEASE}" -- "${SUBDIR}" |grep -E '^[0-9]{7}' | \
+	    sed -r 's#^([0-9])#  - JDK-\1#' >> "${TMPDIR}/fixes2";
+	touch "${TMPDIR}/fixes3" ; # unused
+    fi
+done
+
+sort "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" > "${TMPDIR}/fixes4"
+uniq "${TMPDIR}/fixes4" > "${TMPDIR}/fixes"
+rm -f "${TMPDIR}/fixes2" "${TMPDIR}/fixes3"
+
+if ! [ -s "${TMPDIR}/fixes" ] ; then
+    echo "Failed to obtain fixes.";
+    exit 3;
+fi
+
+echo "In ${TMPDIR}/fixes:"
+cat "${TMPDIR}/fixes"
+
+printf "\nChecking for duplicates...";
+if uniq -d "${TMPDIR}/fixes4" | grep 'JDK' > "${TMPDIR}/dupes"; then
+    printf "found.\nWARNING: Review the following duplicates:\n";
+    cat "${TMPDIR}/dupes";
+else
+    echo "No apparent duplicates.";
+fi
+rm -f "${TMPDIR}/fixes4";
+
+printf "\nChecking for backouts...";
+if grep -i 'backout' "${TMPDIR}/fixes" > "${TMPDIR}/backouts"; then
+    printf "found.\nWARNING: Review the following backouts:\n"
+    cat "${TMPDIR}/backouts";
+else
+    echo "No apparent backouts.";
+fi
+printf "\nChecking for bundled library updates...";
+if grep -iE ':( \(tz\))? update.*(freetype|gif|harfbuzz|lcms|jpeg|png|timezone|zlib)' "${TMPDIR}/fixes" > "${TMPDIR}/bundles"; then
+    printf "found.\nWARNING: Review the following with respect to bundled provides:\n";
+    cat "${TMPDIR}/bundles";
+    echo "Compare the output of $(dirname "${0}")/get_bundle_versions.sh with the RPM using the JDK source tree"
+else
+    echo "No apparent library updates.";
+fi
+
+# Local Variables:
+# compile-command: "shellcheck openjdk_news.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
diff --git a/sources b/sources
index d7639bc..404d038 100644
--- a/sources
+++ b/sources
@@ -1 +1 @@
-SHA512 (openjdk-jdk-23.0.1+11.tar.xz) = cb7e679c4fca057f3631117bec02e4e361d104936c50f40b6d26860f3f93f7a98fd000916feea3df5b5b61ff1eafb9c502f08694e0e49d84e31778b5e9c3f7f1
+SHA512 (openjdk-26+29-ea.tar.xz) = 4e80882e0de26eff7d46d762e255911d42544473cc5f12ab0af1997969a14cc697e1164cb3c90d894359b58cc42dbd2b233f00fa807dbfad41583da278e26666