Updated to jdk26

fipsver df044414ef4
Switch from static-libs-image to static-libs-graal-image to avoid large unneeded libjvm.a
2025-12-23 13:11:27 +01:00 · 2025-12-12 15:47:22 +01:00 · 2025-12-12 14:29:57 +01:00 · 2025-12-08 17:05:10 +01:00 · 2025-10-22 18:28:12 +02:00 · 2025-10-07 17:12:38 +02:00
16 changed files with 1773 additions and 4950 deletions
--- a/.gitignore
+++ b/.gitignore
@ -44,3 +44,18 @@
 /openjdk-22+32-ea.tar.xz
 /openjdk-jdk-22+36-ea.tar.xz
 /openjdk-jdk-22.0.1+8.tar.xz
+/openjdk-jdk-22.0.2+9.tar.xz
+/openjdk-jdk-23+37.tar.xz
+/openjdk-jdk-23.0.1+11.tar.xz
+/openjdk-23.0.2+7.tar.xz
+/openjdk-24+34-ea.tar.xz
+/openjdk-24+36.tar.xz
+/openjdk-24.0.1+9.tar.xz
+/openjdk-24.0.2+12.tar.xz
+/openjdk-25+13-ea.tar.xz
+/openjdk-25+26-ea.tar.xz
+/openjdk-25+32-ea.tar.xz
+/openjdk-jdk-25+36.tar.xz
+/openjdk-25+36.tar.xz
+/openjdk-25.0.1+8.tar.xz
+/openjdk-26+29-ea.tar.xz
--- a/JDK-8373246-8351842_broke_native_debugging_on_Linux.patch
+++ b/JDK-8373246-8351842_broke_native_debugging_on_Linux.patch
@ -0,0 +1,154 @@
+diff --git a/make/Bundles.gmk b/make/Bundles.gmk
+index 8161b3b036254..0b324e7e3f3fc 100644
+--- a/make/Bundles.gmk
+++ b/make/Bundles.gmk
+@@ -185,77 +185,30 @@ endif
+ 
+ ifneq ($(filter product-bundles% legacy-bundles, $(MAKECMDGOALS)), )
+ 
+-  SYMBOLS_EXCLUDE_PATTERN := %.debuginfo %.diz %.map
+-
+-  # There may be files with spaces in the names, so use ShellFindFiles
+-  # explicitly.
+  # There may be files with spaces in the names, so use ShellFindFiles explicitly.
+   ALL_JDK_FILES := $(call ShellFindFiles, $(JDK_IMAGE_DIR))
+-  ifneq ($(JDK_IMAGE_DIR), $(JDK_SYMBOLS_IMAGE_DIR))
+-    ALL_JDK_SYMBOLS_FILES := $(call ShellFindFiles, $(JDK_SYMBOLS_IMAGE_DIR))
+-  else
+-    ALL_JDK_SYMBOLS_FILES := $(ALL_JDK_FILES)
+-  endif
+   ifneq ($(JDK_IMAGE_DIR), $(JDK_DEMOS_IMAGE_DIR))
+     ALL_JDK_DEMOS_FILES := $(call ShellFindFiles, $(JDK_DEMOS_IMAGE_DIR))
+   else
+     ALL_JDK_DEMOS_FILES := $(ALL_JDK_FILES)
+   endif
+ 
+-  # Create special filter rules when dealing with unzipped .dSYM directories on
+-  # macosx
+-  ifeq ($(call isTargetOs, macosx), true)
+-    ifeq ($(ZIP_EXTERNAL_DEBUG_SYMBOLS), false)
+-      JDK_SYMBOLS_EXCLUDE_PATTERN := $(addprefix %, \
+-          $(call containing, .dSYM/, $(patsubst $(JDK_IMAGE_DIR)/%, %, \
+-          $(ALL_JDK_SYMBOLS_FILES))))
+-    endif
+-  endif
+-
+-  # Create special filter rules when dealing with debug symbols on windows
+-  ifeq ($(call isTargetOs, windows), true)
+-    ifeq ($(SHIP_DEBUG_SYMBOLS), )
+-      JDK_SYMBOLS_EXCLUDE_PATTERN := %.pdb
+-    endif
+-  endif
+-
+   JDK_BUNDLE_FILES := \
+       $(filter-out \
+-          $(JDK_SYMBOLS_EXCLUDE_PATTERN) \
+           $(JDK_EXTRA_EXCLUDES) \
+-          $(SYMBOLS_EXCLUDE_PATTERN) \
+           $(JDK_IMAGE_HOMEDIR)/demo/% \
+           , \
+           $(ALL_JDK_FILES) \
+       )
+ 
+-  JDK_SYMBOLS_BUNDLE_FILES := \
+-      $(call FindFiles, $(SYMBOLS_IMAGE_DIR))
+  JDK_SYMBOLS_BUNDLE_FILES := $(call FindFiles, $(SYMBOLS_IMAGE_DIR))
+ 
+   TEST_DEMOS_BUNDLE_FILES := $(filter $(JDK_DEMOS_IMAGE_HOMEDIR)/demo/%, \
+       $(ALL_JDK_DEMOS_FILES))
+ 
+   ALL_JRE_FILES := $(call ShellFindFiles, $(JRE_IMAGE_DIR))
+ 
+-  # Create special filter rules when dealing with unzipped .dSYM directories on
+-  # macosx
+-  ifeq ($(OPENJDK_TARGET_OS), macosx)
+-    ifeq ($(ZIP_EXTERNAL_DEBUG_SYMBOLS), false)
+-      JRE_SYMBOLS_EXCLUDE_PATTERN := $(addprefix %, \
+-          $(call containing, .dSYM/, $(patsubst $(JRE_IMAGE_DIR)/%, %, $(ALL_JRE_FILES))))
+-    endif
+-  endif
+-
+-  # Create special filter rules when dealing with debug symbols on windows
+-  ifeq ($(call isTargetOs, windows), true)
+-    ifeq ($(SHIP_DEBUG_SYMBOLS), )
+-      JRE_SYMBOLS_EXCLUDE_PATTERN := %.pdb
+-    endif
+-  endif
+-
+-  JRE_BUNDLE_FILES := $(filter-out \
+-      $(JRE_SYMBOLS_EXCLUDE_PATTERN) \
+-      $(SYMBOLS_EXCLUDE_PATTERN), \
+-      $(ALL_JRE_FILES))
+  JRE_BUNDLE_FILES := $(ALL_JRE_FILES)
+ 
+   ifeq ($(MACOSX_CODESIGN_MODE), hardened)
+     # Macosx release build and code signing available.
+diff --git a/make/CreateJmods.gmk b/make/CreateJmods.gmk
+index 3280b24924a34..32f107b6bb6a0 100644
+--- a/make/CreateJmods.gmk
+++ b/make/CreateJmods.gmk
+@@ -218,10 +218,14 @@ ifeq ($(call isTargetOs, windows), true)
+   ifeq ($(SHIP_DEBUG_SYMBOLS), )
+     JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.pdb,*.map}'
+   else
+-    JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.map}'
+    JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.map}'
+   endif
+ else
+-  JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.debuginfo,*.dSYM/**,*.dSYM}'
+  ifeq ($(SHIP_DEBUG_SYMBOLS), )
+    JMOD_FLAGS += --exclude '**{_the.*,_*.marker*,*.diz,*.debuginfo,*.dSYM/**,*.dSYM}'
+  else
+    JMOD_FLAGS += --exclude '**{_the.*,_*.marker*}'
+  endif
+ endif
+ 
+ # Unless we are creating a very large module, use the small tool JVM options
+diff --git a/make/autoconf/jdk-options.m4 b/make/autoconf/jdk-options.m4
+index bb18877800192..87d147d4f074b 100644
+--- a/make/autoconf/jdk-options.m4
+++ b/make/autoconf/jdk-options.m4
+@@ -316,23 +316,36 @@ AC_DEFUN_ONCE([JDKOPT_SETUP_DEBUG_SYMBOLS],
+   AC_MSG_CHECKING([if we should add external native debug symbols to the shipped bundles])
+   AC_ARG_WITH([external-symbols-in-bundles],
+       [AS_HELP_STRING([--with-external-symbols-in-bundles],
+-      [which type of external native debug symbol information shall be shipped in product bundles (none, public, full)
+-      (e.g. ship full/stripped pdbs on Windows) @<:@none@:>@])])
+      [which type of external native debug symbol information shall be shipped with bundles/images (none, public, full).
+      @<:@none in release builds, full otherwise. --with-native-debug-symbols=external/zipped is a prerequisite. public is only supported on Windows@:>@])],
+      [],
+      [with_external_symbols_in_bundles=default])
+ 
+   if test "x$with_external_symbols_in_bundles" = x || test "x$with_external_symbols_in_bundles" = xnone ; then
+     AC_MSG_RESULT([no])
+   elif test "x$with_external_symbols_in_bundles" = xfull || test "x$with_external_symbols_in_bundles" = xpublic ; then
+-    if test "x$OPENJDK_TARGET_OS" != xwindows ; then
+-      AC_MSG_ERROR([--with-external-symbols-in-bundles currently only works on windows!])
+-    elif test "x$COPY_DEBUG_SYMBOLS" != xtrue ; then
+-      AC_MSG_ERROR([--with-external-symbols-in-bundles only works when --with-native-debug-symbols=external is used!])
+-    elif test "x$with_external_symbols_in_bundles" = xfull ; then
+    if test "x$COPY_DEBUG_SYMBOLS" != xtrue ; then
+      AC_MSG_ERROR([--with-external-symbols-in-bundles only works when --with-native-debug-symbols=external/zipped is used!])
+    elif test "x$with_external_symbols_in_bundles" = xpublic && test "x$OPENJDK_TARGET_OS" != xwindows ; then
+      AC_MSG_ERROR([--with-external-symbols-in-bundles=public is only supported on Windows!])
+    fi
+
+    if test "x$with_external_symbols_in_bundles" = xfull ; then
+       AC_MSG_RESULT([full])
+       SHIP_DEBUG_SYMBOLS=full
+     else
+       AC_MSG_RESULT([public])
+       SHIP_DEBUG_SYMBOLS=public
+     fi
+  elif test "x$with_external_symbols_in_bundles" = xdefault ; then
+    if test "x$DEBUG_LEVEL" = xrelease ; then
+      AC_MSG_RESULT([no (default)])
+    elif test "x$COPY_DEBUG_SYMBOLS" = xtrue ; then
+      AC_MSG_RESULT([full (default)])
+      SHIP_DEBUG_SYMBOLS=full
+    else
+      AC_MSG_RESULT([no (default, native debug symbols are not external/zipped)])
+    fi
+   else
+     AC_MSG_ERROR([$with_external_symbols_in_bundles is an unknown value for --with-external-symbols-in-bundles])
+   fi
--- a/735
+++ b/735
@ -3,77 +3,668 @@ Key:
 JDK-X  - https://bugs.openjdk.java.net/browse/JDK-X
 CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY

-New in release OpenJDK 22.0.1 (2024-04-16):
+New in release OpenJDK 25.0.1 (2025-10-21):
 ===========================================

-  - JDK-8314164: java/net/HttpURLConnection/HttpURLConnectionExpectContinueTest.java fails intermittently in timeout
-  - JDK-8314275: Incorrect stepping in switch
-  - JDK-8315708: Enhance HTTP/2 client usage
-  - JDK-8317299: safepoint scalarization doesn't keep track of the depth of the JVM state
-  - JDK-8317804: com/sun/jdi/JdwpAllowTest.java fails on Alpine 3.17 / 3.18
-  - JDK-8318158: RISC-V: implement roundD/roundF intrinsics
-  - JDK-8318340: Improve RSA key implementations
-  - JDK-8318603: Parallelize sun/java2d/marlin/ClipShapeTest.java
-  - JDK-8318696: Do not use LFS64 symbols on Linux
-  - JDK-8319382: com/sun/jdi/JdwpAllowTest.java shows failures on AIX if prefixLen of mask is larger than 32 in IPv6 case
-  - JDK-8319851: Improve exception logging
-  - JDK-8320890: [AIX] Find a better way to mimic dl handle equality
-  - JDK-8321151: JDK-8294427 breaks Windows L&F on all older Windows versions
-  - JDK-8321374: Add a configure option to explicitly set CompanyName property in VersionInfo resource for Windows exe/dll
-  - JDK-8321408: Add Certainly roots R1 and E1
-  - JDK-8321480: ISO 4217 Amendment 176 Update
-  - JDK-8321489: Update LCMS to 2.16
-  - JDK-8321815: Shenandoah: gc state should be synchronized to java threads only once per safepoint
-  - JDK-8321972: test runtime/Unsafe/InternalErrorTest.java timeout on linux-riscv64 platform
-  - JDK-8322092: Bump version numbers for 22.0.1
-  - JDK-8322098: os::Linux::print_system_memory_info enhance the THP output with /sys/kernel/mm/transparent_hugepage/hpage_pmd_size
-  - JDK-8322122: Enhance generation of addresses
-  - JDK-8322159: ThisEscapeAnalyzer crashes for erroneous code
-  - JDK-8322163: runtime/Unsafe/InternalErrorTest.java fails on Alpine after JDK-8320886
-  - JDK-8322417: Console read line with zero out should zero out when throwing exception
-  - JDK-8322725: (tz) Update Timezone Data to 2023d
-  - JDK-8322772: Clean up code after JDK-8322417
-  - JDK-8322783: prioritize /etc/os-release over /etc/SuSE-release in hs_err/info output
-  - JDK-8322790: RISC-V: Tune costs for shuffles with no conversion
-  - JDK-8322945: Problemlist runtime/CompressedOops/CompressedClassPointers.java on AIX
-  - JDK-8323021: Shenandoah: Encountered reference count always attributed to first worker thread
-  - JDK-8323065: Unneccesary CodeBlob lookup in CompiledIC::internal_set_ic_destination
-  - JDK-8323086: Shenandoah: Heap could be corrupted by oom during evacuation
-  - JDK-8323154: C2: assert(cmp != nullptr && cmp->Opcode() == Op_Cmp(bt)) failed: no exit test
-  - JDK-8323170: j2dbench is using outdated  javac source/target to be able to build by itself
-  - JDK-8323210: Update the usage of cmsFLAGS_COPY_ALPHA
-  - JDK-8323331: fix typo hpage_pdm_size
-  - JDK-8323428: Shenandoah: Unused memory in regions compacted during a full GC should be mangled
-  - JDK-8323515: Create test alias "all" for all test roots
-  - JDK-8323637: Capture hotspot replay files in GHA
-  - JDK-8323657: Compilation of snippet results in VerifyError at runtime with --release 9 (and above)
-  - JDK-8323664: java/awt/font/JNICheck/FreeTypeScalerJNICheck.java still fails with JNI warning on some Windows configurations
-  - JDK-8323675: Race in jdk.javadoc-gendata
-  - JDK-8323920: Change milestone to fcs for all releases
-  - JDK-8323964: runtime/Thread/ThreadCountLimit.java fails intermittently on AIX
-  - JDK-8324041: ModuleOption.java failed with update release versioning scheme
-  - JDK-8324050: Issue store-store barrier after re-materializing objects during deoptimization
-  - JDK-8324280: RISC-V: Incorrect implementation in VM_Version::parse_satp_mode
-  - JDK-8324347: Enable "maybe-uninitialized" warning for FreeType 2.13.1
-  - JDK-8324598: use mem_unit when working with sysinfo memory and swap related information
-  - JDK-8324637: [aix] Implement support for reporting swap space in jdk.management
-  - JDK-8324647: Invalid test group of lib-test after JDK-8323515
-  - JDK-8324659: GHA: Generic jtreg errors are not reported
-  - JDK-8324753: [AIX] adjust os_posix after JDK-8318696
-  - JDK-8324937: GHA: Avoid multiple test suites per job
-  - JDK-8325074: ZGC fails assert(index == 0 || is_power_of_2(index)) failed: Incorrect load shift: 11
-  - JDK-8325150: (tz) Update Timezone Data to 2024a
-  - JDK-8325203: System.exit(0) kills the launched 3rd party application
-  - JDK-8325213: Flags introduced by configure script are not passed to ADLC build
-  - JDK-8325313: Header format error in TestIntrinsicBailOut after JDK-8317299
-  - JDK-8325326: [PPC64] Don't relocate in case of allocation failure
-  - JDK-8325470: [AIX] use fclose after fopen in read_psinfo
-  - JDK-8325496: Make TrimNativeHeapInterval a product switch
-  - JDK-8325590: Regression in round-tripping UTF-16 strings after JDK-8311906
-  - JDK-8325672: C2: allocate PhaseIdealLoop::_loop_or_ctrl from C->comp_arena()
-  - JDK-8325876: crashes in docker container tests on Linuxppc64le Power8 machines
-  - JDK-8326000: Remove obsolete comments for class sun.security.ssl.SunJSSE
-  - JDK-8326101: [PPC64] Need to bailout cleanly if creation of stubs fails when code cache is out of space
-  - JDK-8326360: Update the Zlib version in open/src/java.base/share/legal/zlib.md to 1.3
-  - JDK-8326638: Crash in PhaseIdealLoop::remix_address_expressions due to unexpected Region instead of Loop
-  - JDK-8327391: Add SipHash attribution file
+* CVEs
+  - CVE-2025-53057
+  - CVE-2025-53066
+  - CVE-2025-61748
+* Changes
+  - JDK-8315131: Clarify VarHandle set/get access on 32-bit platforms
+  - JDK-8352637: Enhance bytecode verification
+  - JDK-8356294: Enhance Path Factories
+  - JDK-8356587: Missing object ID X in pool jdk.types.Method
+  - JDK-8357826: Avoid running some jtreg tests when asan is configured
+  - JDK-8358452: JNI exception pending in Java_sun_awt_screencast_ScreencastHelper_remoteDesktopKeyImpl of screencast_pipewire.c:1214 (ID: 51119)
+  - JDK-8358577: Test serviceability/jvmti/thread/GetCurrentContendedMonitor/contmon01/contmon01.java failed: unexpexcted monitor object
+  - JDK-8358819: The first year is not displayed correctly in Japanese Calendar
+  - JDK-8359059: Bump version numbers for 25.0.1
+  - JDK-8359218: RISC-V: Only enable CRC32 intrinsic when AvoidUnalignedAccess == false
+  - JDK-8359270: C2: alignment check should consider base offset when emitting arraycopy runtime call
+  - JDK-8359454: Enhance String handling
+  - JDK-8359596: Behavior change when both -Xlint:options and -Xlint:-options flags are given
+  - JDK-8360179: RISC-V: Only enable BigInteger intrinsics when AvoidUnalignedAccess == false
+  - JDK-8360533: ContainerRuntimeVersionTestUtils fromVersionString fails with some docker versions
+  - JDK-8360647: [XWayland] [OL10] NumPad keys are not triggered
+  - JDK-8360679: Shenandoah: AOT saved adapter calls into broken GC barrier stub
+  - JDK-8360937: Enhance certificate handling
+  - JDK-8361212: Remove AffirmTrust root CAs
+  - JDK-8361532: RISC-V: Several vector tests fail after JDK-8354383
+  - JDK-8361829: [TESTBUG] RISC-V: compiler/vectorization/runner/BasicIntOpTest.java fails with RVV but not Zvbb
+  - JDK-8362109: Change milestone to fcs for all releases
+  - JDK-8362882: Update SubmissionPublisher() specification to reflect use of ForkJoinPool.asyncCommonPool()
+  - JDK-8366223: ZGC: ZPageAllocator::cleanup_failed_commit_multi_partition is broken
+  - JDK-8367031: [backout] Change java.time month/day field types to 'byte'
+  - JDK-8368308: ISO 4217 Amendment 180 Update
+
+Notes on individual issues:
+===========================
+
+core-libs/java.io:serialization:
+
+JDK-8367031: [backout] Change java.time month/day field types to 'byte'
+=======================================================================
+In the initial release of OpenJDK 25, attempting to read serialised
+Class objects created by earlier versions of OpenJDK for several of
+the `java.time` classes would fail with a
+`InvalidClassException`. Similarly, `java.time` Class objects
+serialised with OpenJDK 25 could not be read by older OpenJDK
+versions.  This was due to the type of the day and month fields in
+these classes being changed to `byte`. This change has now been
+reverted and compatibility between OpenJDK 25 and older versions
+restored.
+
+Note that this incompatibility occurred with the `Class` object and
+not an instance of the object i.e. `writeObject(LocalDate.class)`
+would produce incompatible serialised data, but
+`writeObject(LocalDate.now())` would not.
+
+security-libs/java.security:
+
+JDK-8361212: Remove AffirmTrust root CAs
+========================================
+The following root certificates from AffirmTrust, which were
+deactivated in the 21.0.5 release of October 2024, have been removed
+from the `cacerts` keystore:
+
+Alias name: affirmtrustcommercialca [jdk]
+CN=AffirmTrust Commercial
+O=AffirmTrust
+C=US
+SHA256: 03:76:AB:1D:54:C5:F9:80:3C:E4:B2:E2:01:A0:EE:7E:EF:7B:57:B6:36:E8:A9:3C:9B:8D:48:60:C9:6F:5F:A7
+
+Alias name: affirmtrustnetworkingca [jdk]
+CN=AffirmTrust Networking
+O=AffirmTrust
+C=US
+SHA256: 0A:81:EC:5A:92:97:77:F1:45:90:4A:F3:8D:5D:50:9F:66:B5:E2:C5:8F:CD:B5:31:05:8B:0E:17:F3:F0B4:1B
+
+Alias name: affirmtrustpremiumca [jdk]
+CN=AffirmTrust Premium
+O=AffirmTrust
+C=US
+SHA256: 70:A7:3F:7F:37:6B:60:07:42:48:90:45:34:B1:14:82:D5:BF:0E:69:8E:CC:49:8D:F5:25:77:EB:F2:E9:3B:9A
+
+Alias name: affirmtrustpremiumeccca [jdk]
+CN=AffirmTrust Premium ECC
+O=AffirmTrust
+C=US
+SHA256: BD:71:FD:F6:DA:97:E4:CF:62:D1:64:7A:DD:25:81:B0:7D:79:AD:F8:39:7E:B4:EC:BA:9C:5E:84:88:82:14:23
+
+New in release OpenJDK 25.0.0 (2025-09-16):
+===========================================
+Major changes are listed below.  Some changes may have been backported
+to earlier releases following their first appearance in OpenJDK 22
+through to 25.
+
+NEW FEATURES
+============
+
+Language Features
+=================
+
+Flexible Constructor Bodies
+============================
+https://openjdk.org/jeps/447
+https://openjdk.org/jeps/482
+https://openjdk.org/jeps/492
+https://openjdk.org/jeps/513
+
+In constructors in the Java programming language, allow statements to
+appear before an explicit constructor invocation, i.e., super(..) or
+this(..). The statements cannot reference the instance under
+construction, but they can initialize its fields. Initializing fields
+before invoking another constructor makes a class more reliable when
+methods are overridden.
+
+This language feature is now finalised (JEP 513). It was first
+introduced as a preview language feature
+(http://openjdk.java.net/jeps/12) in OpenJDK 22 (JEP 447) under the
+name "Statements before super(...)".  It reached a second preview in
+OpenJDK 23 (JEP 482) with the addition of allowing fields to be
+initialized before invoking another constructor. It reached a third
+preview in OpenJDK 24 (JEP 492).
+
+Unnamed Patterns and Variables
+==============================
+https://openjdk.org/jeps/443
+https://openjdk.org/jeps/456
+
+Enhance the Java language with unnamed patterns, which match a record
+component without stating the component's name or type, and unnamed
+variables, which can be initialized but not used. Both are denoted by
+an underscore character, _.
+
+This feature is now finalised (JEP 456). It was a preview feature
+(http://openjdk.java.net/jeps/12) in OpenJDK 21 (JEP 443).
+
+Primitive Types in Patterns, instanceof, and switch
+===================================================
+https://openjdk.org/jeps/455
+https://openjdk.org/jeps/488
+https://openjdk.org/jeps/507
+
+Enhance pattern matching by allowing primitive type patterns in all
+pattern contexts, and extend instanceof and switch to work with all
+primitive types.
+
+This is a preview language feature (http://openjdk.java.net/jeps/12)
+introduced in OpenJDK 23 (JEP 455) with a second preview in OpenJDK 24
+(JEP 488) and reaching a third in OpenJDK 25 (JEP 507).
+
+Module Import Declarations
+==========================
+https://openjdk.org/jeps/476
+https://openjdk.org/jeps/494
+https://openjdk.org/jeps/511
+
+Enhance the Java programming language with the ability to succinctly
+import all of the packages exported by a module. This simplifies the
+reuse of modular libraries, but does not require the importing code to
+be in a module itself.
+
+This language feature is now finalised (JEP 511). It was introduced as
+a preview language feature (http://openjdk.java.net/jeps/12) in
+OpenJDK 23 (JEP 476) and had a second preview in OpenJDK 24 (JEP 494).
+
+Library Features
+================
+
+Foreign Function & Memory API
+=============================
+https://openjdk.org/jeps/412
+https://openjdk.org/jeps/419
+https://openjdk.org/jeps/424
+https://openjdk.org/jeps/434
+https://openjdk.org/jeps/442
+https://openjdk.org/jeps/454
+
+Introduce an API by which Java programs can interoperate with code and
+data outside of the Java runtime. By efficiently invoking foreign
+functions (i.e., code outside the JVM), and by safely accessing
+foreign memory (i.e., memory not managed by the JVM), the API enables
+Java programs to call native libraries and process native data without
+the brittleness and danger of JNI.
+
+This API is now finalised (JEP 454). It was first introduced in
+incubation (https://openjdk.java.net/jeps/11) in OpenJDK 17 (JEP 412),
+and is an evolution of the Foreign Memory Access API (OpenJDK 14
+through 16) and Foreign Linker API (OpenJDK 16) (see release notes for
+java-17-openjdk). OpenJDK 18 saw a second round of incubation (JEP
+419) before its inclusion as a preview feature
+(http://openjdk.java.net/jeps/12) in OpenJDK 19 (JEP 424). A second
+preview took place in OpenJDK 20 (JEP 434) and a third and final
+preview in OpenJDK 21 (JEP 442).
+
+Prepare to Restrict the Use of JNI
+==================================
+https://openjdk.org/jeps/472
+
+Issue warnings about uses of the Java Native Interface (JNI) and
+adjust the Foreign Function & Memory (FFM) API to issue warnings in a
+consistent manner. All such warnings aim to prepare developers for a
+future release that ensures integrity by default by uniformly
+restricting JNI and the FFM API. Application developers can avoid both
+current warnings and future restrictions by selectively enabling these
+interfaces where essential using the --enable-native-access
+command-line option.
+
+Class-File API
+==============
+https://openjdk.org/jeps/457
+https://openjdk.org/jeps/466
+https://openjdk.org/jeps/484
+
+Provide a standard API for parsing, generating, and transforming Java
+class files.
+
+This API is now finalised (JEP 484). It was introduced as a preview
+library feature (http://openjdk.java.net/jeps/12) in OpenJDK 22 (JEP
+457) with a second preview in OpenJDK 23 (JEP 466).
+
+Vector API
+==========
+https://openjdk.org/jeps/338
+https://openjdk.org/jeps/414
+https://openjdk.org/jeps/417
+https://openjdk.org/jeps/426
+https://openjdk.org/jeps/438
+https://openjdk.org/jeps/448
+https://openjdk.org/jeps/460
+https://openjdk.org/jeps/469
+https://openjdk.org/jeps/489
+https://openjdk.org/jeps/508
+
+Introduce an API to express vector computations that reliably compile
+at runtime to optimal vector hardware instructions on supported CPU
+architectures and thus achieve superior performance to equivalent
+scalar computations.
+
+This is an incubation feature (https://openjdk.java.net/jeps/11)
+introduced in OpenJDK 16 (JEP 338). A second round of incubation took
+place in OpenJDK 17 (JEP 414), OpenJDK 18 (JEP 417) saw a third,
+OpenJDK 19 a fourth (JEP 426), OpenJDK 20 (JEP 438) a fifth, OpenJDK
+21 a sixth (JEP 448), OpenJDK 22 a seventh (JEP 460), OpenJDK 23 an
+eighth (JEP 469), OpenJDK 24 a ninth (JEP 489) and it reaches its
+tenth in OpenJDK 25 (JEP 508).
+
+Stream Gatherers
+================
+https://openjdk.org/jeps/461
+https://openjdk.org/jeps/473
+https://openjdk.org/jeps/485
+
+Enhance the Stream API to support custom intermediate operations. This
+will allow stream pipelines to transform data in ways that are not
+easily achievable with the existing built-in intermediate operations.
+
+This API is now finalised (JEP 485). It was introduced as a preview
+library feature (http://openjdk.java.net/jeps/12) in OpenJDK 22 (JEP
+461) with a second preview in OpenJDK 23 (JEP 473).
+
+Structured Concurrency
+======================
+https://openjdk.org/jeps/428
+https://openjdk.org/jeps/437
+https://openjdk.org/jeps/453
+https://openjdk.org/jeps/462
+https://openjdk.org/jeps/480
+https://openjdk.org/jeps/499
+https://openjdk.org/jeps/505
+
+Simplify multithreaded programming by introducing an API for
+structured concurrency. Structured concurrency treats multiple tasks
+running in different threads as a single unit of work, thereby
+streamlining error handling and cancellation, improving reliability,
+and enhancing observability.
+
+This API was first introduced in incubation
+(https://openjdk.java.net/jeps/11) in OpenJDK 19 (JEP 428) and had a
+second round of incubation in OpenJDK 20 (JEP 437). It became a
+preview feature (http://openjdk.java.net/jeps/12) in OpenJDK 21 (JEP
+453), reached its second preview in OpenJDK 22 (JEP 462), had a third
+preview in OpenJDK 23 (JEP 480), a fourth in OpenJDK 24 (JEP 499) and
+reaches its fifth in OpenJDK 25 (JEP 505).
+
+Compact Source Files and Instance Main Methods
+==============================================
+https://openjdk.org/jeps/445
+https://openjdk.org/jeps/463
+https://openjdk.org/jeps/477
+https://openjdk.org/jeps/495
+https://openjdk.org/jeps/512
+
+Evolve the Java programming language so that beginners can write their
+first programs without needing to understand language features
+designed for large programs. Far from using a separate dialect of the
+language, beginners can write streamlined declarations for
+single-class programs and then seamlessly expand their programs to use
+more advanced features as their skills grow. Experienced developers
+can likewise enjoy writing small programs succinctly, without the need
+for constructs intended for programming in the large.
+
+This library feature is now finalised (JEP 512) with some minor
+changes from the last release. It was first introduced as a preview
+(http://openjdk.java.net/jeps/12) in OpenJDK 21 (JEP 445) under the
+name "Unnamed Classes and Instance Main Methods". It reached a second
+preview in OpenJDK 22 (JEP 463) and a third in OpenJDK 23 (JEP 477)
+under the new name, "Implicitly Declared Classes and Instance Main
+Methods", due to the move away from unnamed classes to an implicitly
+declared name chosen by the host system. It had a fourth preview in
+OpenJDK 24 (JEP 495) with new terminology and a revised title ("Simple
+Source Files and Instance Main Methods"), but otherwise unchanged.
+
+Scoped Values
+=============
+https://openjdk.org/jeps/429
+https://openjdk.org/jeps/446
+https://openjdk.org/jeps/464
+https://openjdk.org/jeps/481
+https://openjdk.org/jeps/487
+https://openjdk.org/jeps/506
+
+Introduce scoped values, which enable the sharing of immutable data
+within and across threads. They are preferred to thread-local
+variables, especially when using large numbers of virtual threads.
+
+This API is now finalised (JEP 506). This API was first introduced in
+incubation (https://openjdk.java.net/jeps/11) in OpenJDK 20 (JEP
+429). It became a preview feature (http://openjdk.java.net/jeps/12) in
+OpenJDK 21 (JEP 446), had a second preview in OpenJDK 22 (JEP 464), a
+third in OpenJDK 23 (JEP 481) and a fourth in OpenJDK 24 (JEP 487).
+
+Key Derivation Function API
+===========================
+https://openjdk.org/jeps/478
+https://openjdk.org/jeps/510
+
+Introduce an API for Key Derivation Functions (KDFs), which are
+cryptographic algorithms for deriving additional keys from a secret
+key and other data.
+
+This API is now finalised (JEP 510). It was first introduced as a
+preview library feature (http://openjdk.java.net/jeps/12) in OpenJDK
+24 (JEP 478).
+
+Quantum-Resistant Module-Lattice-Based Key Encapsulation Mechanism
+==================================================================
+https://openjdk.org/jeps/496
+
+Enhance the security of Java applications by providing an
+implementation of the quantum-resistant Module-Lattice-Based
+Key-Encapsulation Mechanism (ML-KEM). Key encapsulation mechanisms
+(KEMs) are used to secure symmetric keys over insecure communication
+channels using public key cryptography. ML-KEM is designed to be
+secure against future quantum computing attacks. It has been
+standardized by the United States National Institute of Standards and
+Technology (NIST) in FIPS 203 [0].
+
+[0] https://csrc.nist.gov/pubs/fips/203/final
+
+Quantum-Resistant Module-Lattice-Based Digital Signature Algorithm
+==================================================================
+https://openjdk.org/jeps/497
+
+Enhance the security of Java applications by providing an
+implementation of the quantum-resistant Module-Lattice-Based Digital
+Signature Algorithm (ML-DSA). Digital signatures are used to detect
+unauthorized modifications to data and to authenticate the identity of
+signatories. ML-DSA is designed to be secure against future quantum
+computing attacks. It has been standardized by the United States
+National Institute of Standards and Technology (NIST) in FIPS 204 [0].
+
+[0] https://csrc.nist.gov/pubs/fips/204/final
+
+PEM Encodings of Cryptographic Objects
+======================================
+https://openjdk.org/jeps/470
+
+Introduce an API for encoding objects that represent cryptographic
+keys, certificates, and certificate revocation lists into the
+widely-used Privacy-Enhanced Mail (PEM) transport format, and for
+decoding from that format back into objects.
+
+This is a preview library feature (http://openjdk.java.net/jeps/12)
+introduced in OpenJDK 25 (JEP 470).
+
+Stable Values
+=============
+https://openjdk.org/jeps/502
+
+Introduce an API for stable values, which are objects that hold
+immutable data. Stable values are treated as constants by the JVM,
+enabling the same performance optimizations that are enabled by
+declaring a field final. Compared to final fields, however, stable
+values offer greater flexibility as to the timing of their
+initialization.
+
+This is a preview library feature (http://openjdk.java.net/jeps/12)
+introduced in OpenJDK 25 (JEP 502).
+
+Virtual Machine Enhancements
+============================
+
+Region Pinning for G1
+=====================
+https://openjdk.org/jeps/423
+
+Reduce latency by implementing region pinning in G1, so that garbage
+collection need not be disabled during Java Native Interface (JNI)
+critical regions.
+
+ZGC: Generational Mode by Default
+=================================
+https://openjdk.org/jeps/439
+https://openjdk.org/jeps/474
+
+Switch the default mode of the Z Garbage Collector (ZGC) to the
+generational mode. Deprecate the non-generational mode, with the
+intent to remove it in a future release.
+
+Late Barrier Expansion for G1
+=============================
+https://openjdk.org/jeps/475
+
+Simplify the implementation of the G1 garbage collector's barriers,
+which record information about application memory accesses, by
+shifting their expansion from early in the C2 JIT's compilation
+pipeline to later.
+
+Ahead-of-Time Class Loading & Linking
+=====================================
+https://openjdk.org/jeps/483
+https://openjdk.org/jeps/514
+
+Improve startup time by making the classes of an application instantly
+available, in a loaded and linked state, when the HotSpot Java Virtual
+Machine starts. Achieve this by monitoring the application during one
+run and storing the loaded and linked forms of all classes in a cache
+for use in subsequent runs. Lay a foundation for future improvements
+to both startup and warmup time.
+
+Using this feature requires a two stage process:
+
+1. Create the Ahead-of-Time cache from a training run of the
+application using the option `--XX:AOTCacheOutput=<cache name>` where
+`<cache name>` is the cache reference to use in later runs.
+
+2. When running the application in testing or production, use the
+option `-XX:AOTCache=<cache name>` to run the application with the
+cache generated in #2.
+
+Previously, in OpenJDK 24 (JEP 483), the training run and cache
+creation were handled by two separate steps:
+
+1. Populate the Ahead-of-Time configuration data with a training run
+of the application using the options `-XX:AOTMode=record
+-XX:AOTConfiguration=<config name>` where `<config name>` is the
+configuration reference to use in #2.
+
+2. Create the Ahead-of-Time cache using the options
+`-XX:AOTMode=create -XX:AOTConfiguration=<config name>
+-XX:AOTCache=<cache name>` where `<config name>` is the configuration
+reference from #1 and `<cache name>` is the cache reference to use in
+later runs.
+
+JEP 514 ("Ahead-of-Time Command-Line Ergonomics") in OpenJDK 25 adds
+the option `--XX:AOTCacheOutput` which performs both the above steps
+from a single command-line invocation using a temporary configuration
+file.  A new environment variable, `JDK_AOT_VM_OPTIONS`, can be used
+to pass options to the cache creation step without affecting the
+training run step.
+
+Ahead-of-Time Method Profiling
+==============================
+https://openjdk.org/jeps/515
+
+Improve warmup time by making method-execution profiles from a
+previous run of an application instantly available, when the HotSpot
+Java Virtual Machine starts. This will enable the JIT compiler to
+generate native code immediately upon application startup, rather than
+having to wait for profiles to be collected.
+
+Synchronize Virtual Threads without Pinning
+===========================================
+https://openjdk.org/jeps/491
+
+Improve the scalability of Java code that uses synchronized methods
+and statements by arranging for virtual threads that block in such
+constructs to release their underlying platform threads for use by
+other virtual threads. This will eliminate nearly all cases of virtual
+threads being pinned to platform threads, which severely restricts the
+number of virtual threads available to handle an application's
+workload.
+
+Compact Object Headers
+======================
+https://openjdk.org/jeps/450
+https://openjdk.org/jeps/519
+
+Reduce the size of object headers in the HotSpot JVM from between 96
+and 128 bits down to 64 bits on 64-bit architectures. This will reduce
+heap size, improve deployment density, and increase data locality.
+
+This is now a production feature in OpenJDK 25 (JEP 519) enabled using
+`-XX:+UseCompactObjectHeaders`. It was first introduced as an
+experimental feature (JEP 450) that also required the use of
+`-XX:+UnlockExperimentalVMOptions`.
+
+Generational Shenandoah
+=======================
+https://openjdk.org/jeps/404
+https://openjdk.org/jeps/521
+
+Enhance the Shenandoah garbage collector with experimental
+generational collection capabilities to improve sustainable
+throughput, load-spike resilience, and memory utilization.
+
+This is now a production feature in OpenJDK 25 (JEP 521) enabled using
+`-XX:ShenandoahGCMode=generational`. It was first introduced as an
+experimental feature (JEP 404) that also required the use of
+`-XX:+UnlockExperimentalVMOptions`.
+
+JFR Cooperative Sampling
+========================
+https://openjdk.org/jeps/518
+
+Improve the stability of the JDK Flight Recorder (JFR) when it
+asynchronously samples Java thread stacks. Achieve this by walking
+call stacks only at safepoints, while minimizing safepoint bias.
+
+JFR Method Timing & Tracing
+===========================
+https://openjdk.org/jeps/520
+
+Extend the JDK Flight Recorder (JFR) with facilities for method timing
+and tracing via bytecode instrumentation.
+
+JFR CPU-Time Profiling
+======================
+https://openjdk.org/jeps/509
+
+Enhance the JDK Flight Recorder (JFR) to capture more accurate
+CPU-time profiling information on Linux.
+
+This is an experimental feature so its JFR events are tagged with the
+`@Experimental` annotation. Unlike other experimental virtual machine
+features, it does not need to be explicitly enabled with
+`-XX:+UnlockExperimentalVMOptions`.
+
+Tools
+=====
+
+Launch Multi-File Source-Code Programs
+======================================
+https://openjdk.org/jeps/458
+
+Enhance the java application launcher to be able to run a program
+supplied as multiple files of Java source code. This will make the
+transition from small programs to larger ones more gradual, enabling
+developers to choose whether and when to go to the trouble of
+configuring a build tool.
+
+Markdown Documentation Comments
+===============================
+https://openjdk.org/jeps/467
+
+Enable JavaDoc documentation comments to be written in Markdown rather
+than solely in a mixture of HTML and JavaDoc @-tags.
+
+Linking Run-Time Images without JMODs
+=====================================
+https://openjdk.org/jeps/493
+
+Reduce the size of the JDK by approximately 25% by enabling the jlink
+tool to create custom run-time images without using the JDK's JMOD
+files.
+
+This feature must be enabled when the JDK is built using the
+--enable-linkable-runtime option.  It will not be enabled by default,
+and some JDK vendors may choose not to enable it.
+
+DEPRECATIONS
+============
+
+Deprecate the Memory-Access Methods in sun.misc.Unsafe for Removal
+==================================================================
+https://openjdk.org/jeps/471
+
+Deprecate the memory-access methods in sun.misc.Unsafe for removal in
+a future release. These unsupported methods have been superseded by
+standard APIs, namely the VarHandle API (JEP 193, OpenJDK 9) and the
+Foreign Function & Memory API (JEP 454, OpenJDK 22). We strongly
+encourage library developers to migrate from sun.misc.Unsafe to
+supported replacements, so that applications can migrate smoothly to
+modern JDK releases.
+
+Warn upon Use of Memory-Access Methods in sun.misc.Unsafe
+=========================================================
+https://openjdk.org/jeps/498
+
+Issue a warning at run time on the first occasion that any
+memory-access method in sun.misc.Unsafe is invoked. All of these
+unsupported methods were terminally deprecated in JDK 23 (see JEP 471
+above). They have been superseded by standard APIs, namely the
+VarHandle API (JEP 193, OpenJDK 9) and the Foreign Function & Memory
+API (JEP 454, OpenJDK 22). We strongly encourage library developers to
+migrate from sun.misc.Unsafe to supported replacements, so that
+applications can migrate smoothly to modern JDK releases.
+
+Permanently Disable the Security Manager
+========================================
+https://openjdk.org/jeps/486
+
+The Security Manager has not been the primary means of securing
+client-side Java code for many years, it has rarely been used to
+secure server-side code, and it is costly to maintain. We therefore
+deprecated it for removal in OpenJDK 17 via JEP 411 (2021). As the
+next step toward removing the Security Manager, we will revise the
+Java Platform specification so that developers cannot enable it and
+other Platform classes do not refer to it. This change will have no
+impact on the vast majority of applications, libraries, and tools. We
+will remove the Security Manager API in a future release.
+
+REMOVALS
+========
+
+String Templates
+================
+https://openjdk.org/jeps/430
+https://openjdk.org/jeps/459
+https://openjdk.org/jeps/465
+
+This was a preview feature (http://openjdk.java.net/jeps/12)
+introduced in OpenJDK 21 (JEP 430) with a second preview in OpenJDK 22
+(JEP 459).  A third preview was proposed but ultimately withdrawn for
+OpenJDK 23 (JEP 465) and the feature is no longer present.  See [0]
+for further explanation.
+
+[0] https://mail.openjdk.org/pipermail/amber-spec-experts/2024-April/004106.html
+
+Remove the Windows & Linux 32-bit x86 Ports
+===========================================
+https://openjdk.org/jeps/449
+https://openjdk.org/jeps/479
+https://openjdk.org/jeps/501
+https://openjdk.org/jeps/503
+
+Remove the source code and build support for the Windows (JEP 479) &
+Linux (JEP 503) 32-bit x86 ports. The Windows port was deprecated for
+removal in JDK 21 by JEP 449 and the Linux port was deprecated for
+removal in JDK 24 by JEP 501. Both deprecations took place with the
+express intent to remove the ports in a future release.
+
+Following this removal of these 32-bit x86 ports, the
+architecture-agnostic Zero port is the only way to run Java programs
+on 32-bit x86 processors.
+
+ZGC: Remove the Non-Generational Mode
+=====================================
+https://openjdk.org/jeps/439
+https://openjdk.org/jeps/474
+https://openjdk.org/jeps/490
+
+Remove the non-generational mode of the Z Garbage Collector (ZGC),
+keeping the generational mode as the default for ZGC (see JEP 439 &
+474).
--- a/README.md
+++ b/README.md
@ -4,11 +4,11 @@ This package contains the latest rolling release of OpenJDK. OpenJDK
 has a release cadence of six months, with a new release in March and
 September each year.

-The current release is OpenJDK 22. For a list of major changes from
+The current release is OpenJDK 25. For a list of major changes from
 OpenJDK 21, see the NEWS file included in this package and the
 upstream release page:

-https://openjdk.java.net/projects/jdk/22/
+https://openjdk.org/projects/jdk/25/

 This package is intended for those who want to follow the latest
 OpenJDK releases. Long term support versions of OpenJDK are available
--- a/TestTranslations.java
+++ b/TestTranslations.java
@ -50,11 +50,11 @@ public class TestTranslations {
                                          "Mountain Daylight Time", "MDT", "MDT",
                                          "Mountain Time", "MT", "MT"});
        map.put(Locale.FRANCE, new String[] { "heure normale des Rocheuses", "UTC\u221207:00", "MST",
-                                              "heure d\u2019\u00e9t\u00e9 des Rocheuses", "UTC\u221206:00", "MDT",
-                                              "heure des Rocheuses", "UTC\u221207:00", "MT"});
-        map.put(Locale.GERMANY, new String[] { "Rocky-Mountain-Normalzeit", "GMT-07:00", "MST",
-                                               "Rocky-Mountain-Sommerzeit", "GMT-06:00", "MDT",
-                                               "Rocky-Mountain-Zeit", "GMT-07:00", "MT"});
+                                              "heure d\u2019\u00e9t\u00e9 des Rocheuses", "UTC\u221206:00", "MST",
+                                              "heure des Rocheuses", "UTC\u221207:00", "MST"});
+        map.put(Locale.GERMANY, new String[] { "Rocky-Mountains-Normalzeit", "GMT-07:00", "MST",
+                                               "Rocky-Mountains-Sommerzeit", "GMT-06:00", "MST",
+                                               "Rocky-Mountains-Zeit", "GMT-07:00", "MST"});
        CIUDAD_JUAREZ = Collections.unmodifiableMap(map);
    }

@ -97,14 +97,10 @@ public class TestTranslations {

                System.out.printf("Checking locale %s for %s...\n", l, id);

-                if ("JRE".equals(localeProvider)) {
+                if ("JRE".equals(localeProvider) || "CLDR".equals(localeProvider)) {
                    expectedShortStd = expected[2];
                    expectedShortDST = expected[5];
                    expectedShortGen = expected[8];
-                } else if ("CLDR".equals(localeProvider)) {
-                    expectedShortStd = expected[1];
-                    expectedShortDST = expected[4];
-                    expectedShortGen = expected[7];
                } else {
                    System.err.printf("Invalid locale provider %s\n", localeProvider);
                    System.exit(3);
--- a/fips-21u-75ffdc48eda.patch
+++ b/fips-21u-75ffdc48eda.patch
--- a/fips-25u-df044414ef4.patch
+++ b/fips-25u-df044414ef4.patch
@ -0,0 +1,92 @@
+diff --git a/src/java.base/share/classes/java/security/Provider.java b/src/java.base/share/classes/java/security/Provider.java
+index de2845fb550..b1e416b90f4 100644
+--- a/src/java.base/share/classes/java/security/Provider.java
+++ b/src/java.base/share/classes/java/security/Provider.java
+@@ -1203,6 +1203,39 @@ public Set<Service> getServices() {
+         return serviceSet;
+     }
+ 
+    /* vvvvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvvvv */
+    private static final class RedHatFIPSFilter {
+        static final boolean IS_ON = Boolean.parseBoolean(
+                Security.getProperty("__redhat_fips_filter__"));
+        private static final Set<String> ANY_SERVICE_TYPE = Set.of();
+        private static final Map<String, Set<String>> ALLOW_LIST = Map.of(
+                "SunPKCS11-FIPS", ANY_SERVICE_TYPE,
+                "SUN", Set.of(
+                        "AlgorithmParameterGenerator",
+                        "AlgorithmParameters", "CertificateFactory",
+                        "CertPathBuilder", "CertPathValidator", "CertStore",
+                        "Configuration", "KeyStore"),
+                "SunEC", Set.of(
+                        "AlgorithmParameters", "KeyFactory"),
+                "SunJSSE", ANY_SERVICE_TYPE,
+                "SunJCE", Set.of(
+                        "AlgorithmParameters",
+                        "AlgorithmParameterGenerator", "KeyFactory",
+                        "SecretKeyFactory"),
+                "SunRsaSign", Set.of(
+                        "KeyFactory", "AlgorithmParameters"),
+                "XMLDSig", ANY_SERVICE_TYPE
+        );
+
+        static boolean isAllowed(String provName, String serviceType) {
+            Set<String> allowedServiceTypes = ALLOW_LIST.get(provName);
+            return allowedServiceTypes != null &&
+                    (allowedServiceTypes == ANY_SERVICE_TYPE ||
+                            allowedServiceTypes.contains(serviceType));
+        }
+    }
+    /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
+
+     /**
+      * Add a service. If a service of the same type with the same algorithm
+      * name exists, and it was added using {@link #putService putService()},
+@@ -1231,6 +1264,15 @@ protected void putService(Service s) {
+                     ("service.getProvider() must match this Provider object");
+         }
+         String type = s.getType();
+        /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */
+        if (RedHatFIPSFilter.IS_ON && !RedHatFIPSFilter.isAllowed(name, type)) {
+            if (debug != null) {
+                debug.println("The previous " + name + ".putService() call " +
+                        "was skipped by " + RedHatFIPSFilter.class.getName());
+            }
+            return;
+        }
+        /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
+         String algorithm = s.getAlgorithm();
+         ServiceKey key = new ServiceKey(type, algorithm, true);
+         implRemoveService(serviceMap.get(key));
+diff --git a/src/java.base/share/classes/java/security/Security.java b/src/java.base/share/classes/java/security/Security.java
+index 6969fe8a8e1..4501d5971c4 100644
+--- a/src/java.base/share/classes/java/security/Security.java
+++ b/src/java.base/share/classes/java/security/Security.java
+@@ -323,7 +323,27 @@ public Properties getInitialProperties() {
+     }
+ 
+     private static void initialize() {
+        /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */
+        /*   This 'include'-directives-only magic property is an internal     */
+        /*   implementation detail that could (and probably will!) change.    */
+        /*   Red Hat customers should NOT rely on this for their own use.     */
+        String fipsKernelFlag = "/proc/sys/crypto/fips_enabled";
+        boolean fipsModeOn;
+        try (InputStream is = new java.io.FileInputStream(fipsKernelFlag)) {
+            fipsModeOn = is.read() == '1';
+        } catch (IOException ioe) {
+            fipsModeOn = false;
+            if (sdebug != null) {
+                sdebug.println("Failed to read FIPS kernel file: " + ioe);
+            }
+        }
+        String fipsMagicPropName = "__redhat_fips__";
+        System.setProperty(fipsMagicPropName, "" + fipsModeOn);
+        /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
+         SecPropLoader.loadAll();
+        /* vvvvvvvvvvvvvvvvvvvvvvvvvvv FIPS PATCH vvvvvvvvvvvvvvvvvvvvvvvvvvv */
+        System.clearProperty(fipsMagicPropName);
+        /* ^^^^^^^^^^^^^^^^^^^^^^^^^^^ FIPS PATCH ^^^^^^^^^^^^^^^^^^^^^^^^^^^ */
+         initialSecurityProperties = (Properties) props.clone();
+         if (sdebug != null) {
+             for (String key : props.stringPropertyNames()) {
--- a/java-latest-openjdk-portable.spec
+++ b/java-latest-openjdk-portable.spec
--- a/jconsole.desktop.in
+++ b/jconsole.desktop.in
@ -1 +0,0 @@
-# this file is intentionally not here, as portable builds do not have desktop integration
--- a/openjdk_news.sh
+++ b/openjdk_news.sh
@ -1,76 +0,0 @@
-#!/bin/bash
-
-# Copyright (C) 2022 Red Hat, Inc.
-# Written by Andrew John Hughes <gnu.andrew@redhat.com>, 2012-2022
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the GNU Affero General Public License as
-# published by the Free Software Foundation, either version 3 of the
-# License, or (at your option) any later version.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-# GNU Affero General Public License for more details.
-#
-# You should have received a copy of the GNU Affero General Public License
-# along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-OLD_RELEASE=$1
-NEW_RELEASE=$2
-REPO=$3
-SUBDIR=$4
-SCRIPT_DIR=$(dirname ${0})
-
-if test "x${SUBDIR}" = "x"; then
-    echo "No subdirectory specified; using .";
-    SUBDIR=".";
-fi
-
-if test "x$REPO" = "x"; then
-    echo "No repository specified; using ${PWD}"
-    REPO=${PWD}
-fi
-
-if test x${TMPDIR} = x; then
-    TMPDIR=/tmp;
-fi
-
-echo "Repository: ${REPO}"
-
-if [ -e ${REPO}/.git ] ; then
-    TYPE=git;
-elif [ -e ${REPO}/.hg ] ; then
-    TYPE=hg;
-else
-    echo "No Mercurial or Git repository detected.";
-    exit 1;
-fi
-
-if test "x$OLD_RELEASE" = "x" || test "x$NEW_RELEASE" = "x"; then
-    echo "ERROR: Need to specify old and new release";
-    exit 2;
-fi
-
-echo "Listing fixes between $OLD_RELEASE and $NEW_RELEASE in $REPO"
-rm -f ${TMPDIR}/fixes2 ${TMPDIR}/fixes3 ${TMPDIR}/fixes
-for repos in . $(${SCRIPT_DIR}/discover_trees.sh ${REPO});
-do
-    if test "x$TYPE" = "xhg"; then
-	hg log -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R $REPO/$repos -G -M ${REPO}/${SUBDIR} | \
-	    grep -E '^[o:| ]*summary'|grep -v 'Added tag'|sed -r 's#^[o:| ]*summary:\W*([0-9])#  - JDK-\1#'| \
-	    sed 's#^[o:| ]*summary:\W*#  - #' >> ${TMPDIR}/fixes2;
-	hg log -v -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R $REPO/$repos -G -M ${REPO}/${SUBDIR} | \
-	    grep -E '^[o:| ]*[0-9]{7}'|sed -r 's#^[o:| ]*([0-9]{7})#  - JDK-\1#' >> ${TMPDIR}/fixes3;
-    else
-	git -C ${REPO} log --no-merges --pretty=format:%B ${NEW_RELEASE}...${OLD_RELEASE} -- ${SUBDIR} |grep -E '^[0-9]{7}' | \
-	    sed -r 's#^([0-9])#  - JDK-\1#' >> ${TMPDIR}/fixes2;
-	touch ${TMPDIR}/fixes3 ; # unused
-    fi
-done
-
-sort ${TMPDIR}/fixes2 ${TMPDIR}/fixes3 | uniq > ${TMPDIR}/fixes
-rm -f ${TMPDIR}/fixes2 ${TMPDIR}/fixes3
-
-echo "In ${TMPDIR}/fixes:"
-cat ${TMPDIR}/fixes
--- a/scripts/discover_trees.sh
+++ b/scripts/discover_trees.sh
@ -1,6 +1,6 @@
 #!/bin/sh

-# Copyright (C) 2020 Red Hat, Inc.
+# Copyright (C) 2024 Red Hat, Inc.
 # Written by Andrew John Hughes <gnu.andrew@redhat.com>.
 #
 # This program is free software: you can redistribute it and/or modify
@ -18,37 +18,44 @@

 TREE=${1}

-if test "x${TREE}" = "x"; then
+if test "${TREE}" = ""; then
    TREE=${PWD}
 fi

-if [ -e ${TREE}/nashorn/.hg -o -e ${TREE}/nashorn/merge.changeset ] ; then
+if [ -e "${TREE}"/nashorn/.hg ] || [ -e "${TREE}"/nashorn/merge.changeset ] ; then
    NASHORN="nashorn" ;
 fi

-if [ -e ${TREE}/corba/.hg -o -e ${TREE}/corba/merge.changeset ] ; then
+if [ -e "${TREE}"/corba/.hg ] || [ -e "${TREE}"/corba/merge.changeset ] ; then
    CORBA="corba";
 fi

-if [ -e ${TREE}/jaxp/.hg -o -e ${TREE}/jaxp/merge.changeset ] ; then
+if [ -e "${TREE}"/jaxp/.hg ] || [ -e "${TREE}"/jaxp/merge.changeset ] ; then
    JAXP="jaxp";
 fi

-if [ -e ${TREE}/jaxws/.hg -o -e ${TREE}/jaxws/merge.changeset ] ; then
+if [ -e "${TREE}"/jaxws/.hg ] || [ -e "${TREE}"/jaxws/merge.changeset ] ; then
    JAXWS="jaxws";
 fi

-if [ -e ${TREE}/langtools/.hg -o -e ${TREE}/langtools/merge.changeset ] ; then
+if [ -e "${TREE}"/langtools/.hg ] || [ -e "${TREE}"/langtools/merge.changeset ] ; then
    LANGTOOLS="langtools";
 fi

-if [ -e ${TREE}/jdk/.hg -o -e ${TREE}/jdk/merge.changeset ] ; then
+if [ -e "${TREE}"/jdk/.hg ] || [ -e "${TREE}"/jdk/merge.changeset ] ; then
    JDK="jdk";
 fi

-if [ -e ${TREE}/hotspot/.hg -o -e ${TREE}/hotspot/merge.changeset ] ; then
+if [ -e "${TREE}"/hotspot/.hg ] || [ -e "${TREE}"/hotspot/merge.changeset ] ; then
    HOTSPOT="hotspot";
 fi

 SUBTREES="${CORBA} ${JAXP} ${JAXWS} ${LANGTOOLS} ${NASHORN} ${JDK} ${HOTSPOT}";
-echo ${SUBTREES}
+echo "${SUBTREES}"
+
+# Local Variables:
+# compile-command: "shellcheck discover_trees.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
--- a/scripts/generate_source_tarball.sh
+++ b/scripts/generate_source_tarball.sh
@ -1,6 +1,10 @@
 #!/bin/bash

 # Copyright (C) 2024 Red Hat, Inc.
+# Written by:
+#     Andrew John Hughes <gnu.andrew@redhat.com>
+#     Thomas Fitzsimmons <fitzsim@redhat.com>
+#     Jiri Vanek <jvanek@redhat.com>
 #
 # This program is free software: you can redistribute it and/or modify
 # it under the terms of the GNU Affero General Public License as
@ -15,42 +19,46 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.

-# Generates the 'source tarball' for JDK projects.
+# Generates the source tarball for OpenJDK projects.
+#
+# There are multiple ways to specify the source code location and version:
+#
+# 1. Specify the version (VERSION), the location of the Git repository
+#    (REPO_ROOT) and the root of the output tarball name (FILE_NAME_ROOT)
+# 2. Specify the version (VERSION) along with an upstream project name
+#    (PROJECT_NAME) and repository name (REPO_NAME) that can be used
+#    to construct the URL of the upstream OpenJDK repository.
+# 3. Specify OPENJDK_LATEST=1 and allow the script to obtain the JDK
+#    feature version from the spec file, which is then used to
+#    obtain the latest build promotion from the upstream repository.
+#
+# An appropriate bootstrap JDK is also required for when ./configure
+# is run within the checked out repository to generate the .src-rev.
+# file. This can be specified by setting BOOT_JDK.
 #
 # Example 1:
-# When used from local repo set REPO_ROOT pointing to file:// with your repo.
-# If your local repo follows upstream forests conventions, it may be enough to
-# set OPENJDK_URL.
+# This will check out the specified version from the specified
+# repository and construct a tarball called openjdk-17.0.3+5.tar.xz:
+#
+# $ VERSION=jdk-17.0.3+5 FILE_NAME_ROOT=open${VERSION} \
+#   REPO_ROOT=$HOME/projects/openjdk/upstream/17u \
+#   BOOT_JDK=/usr/lib/jvm/java-17-openjdk ./generate_source_tarball.sh
 #
 # Example 2:
+# This will check out the same version as example 1, but from the
+# upstream repository:
+#
+# $ VERSION=jdk-25+36 PROJECT_NAME=openjdk REPO_NAME=jdk25u \
+#   BOOT_JDK=/usr/lib/jvm/java-17-openjdk sh scripts/generate_source_tarball.sh
+#
+# Example 3:
 # This will read the OpenJDK feature version from the spec file, then create a
 # tarball from the most recent tag for that version in the upstream Git
 # repository.
 #
-# $ OPENJDK_LATEST=1 ./generate_source_tarball.sh
-# [...]
-# Tarball is: temp-generated-source-tarball-ujD/openjdk-17.0.10+6-ea.tar.xz
+# $ OPENJDK_LATEST=1 \
+#   BOOT_JDK=/usr/lib/jvm/java-17-openjdk ./generate_source_tarball.sh
 #
-# Unless you use OPENJDK_LATEST, you have to set PROJECT_NAME, REPO_NAME and
-# VERSION, e.g.:
-#
-# PROJECT_NAME=openjdk
-# REPO_NAME=jdk22u
-# VERSION=jdk-22.0.1+8
-#
-# or to e.g., prepare systemtap, icedtea7's jstack and other tapsets:
-#
-# VERSION=6327cf1cea9e
-# REPO_NAME=icedtea7-2.6
-# PROJECT_NAME=release
-# OPENJDK_URL=http://icedtea.classpath.org/hg/
-# TO_COMPRESS="*/tapset"
-#
-# They are used to create correct name and are used in construction of sources
-# URL (unless REPO_ROOT is set).
-#
-# This script creates a single source tarball out of the repository based on the
-# given tag and removes code not allowed in Fedora/RHEL.

 set -e

@ -114,7 +122,7 @@ if [ "$OPENJDK_LATEST" != "" ] ; then
 fi

 if [ "$WITH_TEMP" != "" ] ; then
-    pushd "$(mktemp --directory temp-generated-source-tarball-XXX)"
+    pushd "$(mktemp --directory --tmpdir temp-generated-source-tarball-XXX)"
 fi

 if [ "$VERSION" = "" ] ; then
@ -200,18 +208,25 @@ echo -e "\tFILE_NAME_ROOT: ${FILE_NAME_ROOT}"
 echo -e "\tREPO_ROOT: ${REPO_ROOT}"
 echo -e "\tTO_COMPRESS: ${TO_COMPRESS}"
 echo -e "\tBOOT_JDK: ${BOOT_JDK}"
+echo -e "\tWITH_TEMP: ${WITH_TEMP}"
+echo -e "\tOPENJDK_LATEST: ${OPENJDK_LATEST}"

 if [ -d "${FILE_NAME_ROOT}" ] ; then
-    echo "exists exists exists exists exists exists exists "
-    echo "reusing reusing reusing reusing reusing reusing "
-    echo "${FILE_NAME_ROOT}"
+    echo "Reusing existing ${FILE_NAME_ROOT}"
    STAT_TIME="$(stat --format=%Y "${FILE_NAME_ROOT}")"
    TAR_TIME="$(date --date=@"${STAT_TIME}" --iso-8601=seconds)"
 else
    mkdir "${FILE_NAME_ROOT}"
    pushd "${FILE_NAME_ROOT}"
        echo "Cloning ${VERSION} root repository from ${REPO_ROOT}"
-        git clone --depth=1 -b "${VERSION}" "${REPO_ROOT}" "${VERSION}"
+        if realpath -q "${REPO_ROOT}"; then
+            echo "Local path detected; not adding depth argument";
+            DEPTH="--";
+        else
+            DEPTH="--depth=1";
+            echo "Remote repository detected; adding ${DEPTH}";
+        fi
+        git clone -b "${VERSION}" "${DEPTH}" "${REPO_ROOT}" "${VERSION}"
        pushd "${VERSION}"
            TAR_TIME="$(git log --max-count 1 --format=%cI)"
        popd
@ -227,39 +242,44 @@ pushd "${FILE_NAME_ROOT}"
    popd
    rm -rf build

-    EA_PART="$(awk -F= \
-               '/^DEFAULT_PROMOTED_VERSION_PRE/ { if ($2) print "-"$2 }' \
-               "${VERSION}"/make/conf/version-numbers.conf)"
-    TARBALL_BASE=${FILE_NAME_ROOT}${EA_PART}.tar
-    pushd "${VERSION}"
-        # Omit commit checks, history, and GHA from archive.
-        for skip in .jcheck .hgtags .hgignore .gitattributes .gitignore .github
-        do
-            echo "${skip}"" export-ignore" >> .git/info/attributes
-        done
-        # Do not bother with --mtime here; specify it to tar below.
-        # Unforunately, git-archive sorts added files like .src-rev at the end;
-        # retar below to use GNU tar --sort=name ordering which sorts .src-rev
-        # at the start.
-        git archive --output "${TARBALL_BASE}" --prefix="${VERSION}"/ \
-            --add-file=.src-rev --format=tar "${VERSION}"
-    popd
-    mv "${VERSION}" "${VERSION}".git
-    tar xf "${VERSION}".git/"${TARBALL_BASE}"
+    # Remove commit checks
+    echo "Removing $(find "${VERSION}" -name '.jcheck' -print)"
+    find "${VERSION}" -name '.jcheck' -print0 | xargs -0 rm -r
+
+    # Remove history and GHA
+    echo "find ${VERSION} -name '.hgtags'"
+    find "${VERSION}" -name '.hgtags' -exec rm -v '{}' '+'
+    echo "find ${VERSION} -name '.hgignore'"
+    find "${VERSION}" -name '.hgignore' -exec rm -v '{}' '+'
+    echo "find ${VERSION} -name '.gitattributes'"
+    find "${VERSION}" -name '.gitattributes' -exec rm -v '{}' '+'
+    echo "find ${VERSION} -name '.gitignore'"
+    find "${VERSION}" -name '.gitignore' -exec rm -v '{}' '+'
+    # Work around some Git objects not having write permissions.
+    echo "chmod --recursive u+w ${VERSION}/.git"
+    chmod --recursive u+w "${VERSION}"/.git
+    echo "find ${VERSION} -name '.git'"
+    find "${VERSION}" -name '.git' -exec rm -rv '{}' '+'
+    echo "find ${VERSION} -name '.github'"
+    find "${VERSION}" -name '.github' -exec rm -rv '{}' '+'
+
    echo "Compressing remaining forest"
    if [ "$COMPRESSION" = "xz" ] ; then
        SWITCH=cJf
    else
        SWITCH=czf
    fi
-    TARBALL_NAME=${TARBALL_BASE}.${COMPRESSION}
+    EA_PART="$(awk -F= \
+               '/^DEFAULT_PROMOTED_VERSION_PRE/ { if ($2) print "-"$2 }' \
+               "${VERSION}"/make/conf/version-numbers.conf)"
+    TARBALL_NAME=${FILE_NAME_ROOT}${EA_PART}.tar.${COMPRESSION}
    XZ_OPT=${XZ_OPT-"-T0"} \
          tar --mtime="${TAR_TIME}" --owner=root --group=root --sort=name \
-          -$SWITCH "${TARBALL_NAME}" "${TO_COMPRESS}"
+          --exclude-vcs -$SWITCH "${TARBALL_NAME}" "${TO_COMPRESS}"
    mv "${TARBALL_NAME}" ..
 popd
 if [ "$WITH_TEMP" != "" ] ; then
-    echo "Tarball is: $(realpath --relative-to=.. .)/${TARBALL_NAME}"
+    echo "Tarball is: $(realpath .)/${TARBALL_NAME}"
    popd
 else
    echo -n "Done. You may want to remove the uncompressed version"
--- a/scripts/get_bundle_versions.sh
+++ b/scripts/get_bundle_versions.sh
@ -0,0 +1,172 @@
+#!/usr/bin/env sh
+
+# Copyright (C) 2025 Red Hat, Inc.
+# Original written by Antonio Vieiro <avieirov@redhat.com>
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+if [ $# -ne 1 ]; then
+    echo "Usage: $0 openjdk-root-directory"
+    exit 1
+fi
+
+JDKROOT=$1
+
+if [ ! -d "${JDKROOT}" ] ; then
+    echo "${JDKROOT} is not a directory.";
+    exit 2
+fi
+
+# Work out the OpenJDK version
+# OpenJDK >= 10 has its version in the build machinery
+# OpenJDK >= 17 stores it in a new location (JDK-8258246)
+VERSION_FILE="${JDKROOT}"/make/conf/version-numbers.conf
+printf "Checking for %s..." "${VERSION_FILE}";
+if [ ! -f "${VERSION_FILE}" ] ; then
+    VERSION_FILE="${JDKROOT}"/make/autoconf/version-numbers
+    echo "Not found; using old version file ${VERSION_FILE}";
+else
+    echo "found.";
+fi
+if [ -e "${VERSION_FILE}" ] ; then
+    openjdk_version=$(grep '^DEFAULT_VERSION_FEATURE' "${VERSION_FILE}" | cut -d '=' -f 2)
+elif [ -e "${JDKROOT}"/jdk/src/java.base/share/classes/java/lang/Object.java ] ; then
+    openjdk_version=9;
+elif [ -e "${JDKROOT}"/common/autoconf ] ; then
+    openjdk_version=8;
+else
+    openjdk_version=7;
+fi
+echo "OpenJDK version: ${openjdk_version}";
+
+#
+# Freetype
+#
+if [ "${openjdk_version}" -gt 8 ] ; then
+    FREETYPE=src/java.desktop/share/native/libfreetype/include/freetype/freetype.h
+    ABS_FREETYPE="${JDKROOT}"/"${FREETYPE}"
+    if [ ! -f "${ABS_FREETYPE}" ]; then
+        echo "Freetype header not found!"
+        exit 2
+    fi
+    FREETYPE_VERSION=$(awk '/#define FREETYPE_MAJOR/ {MAJOR=$3} /#define FREETYPE_MINOR/ {MINOR=$3} /#define FREETYPE_PATCH/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_FREETYPE}")
+else
+    echo "No bundled FreeType on ${openjdk_version}";
+fi
+
+# giflib
+if [ "${openjdk_version}" -gt 8 ] ; then
+    GIFLIB=src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
+else
+    GIFLIB=jdk/src/share/native/sun/awt/giflib/gif_lib.h
+fi
+ABS_GIFLIB="${JDKROOT}"/"${GIFLIB}"
+if [ ! -f "${ABS_GIFLIB}" ]; then
+    echo "giflib header not found!"
+    exit 3
+fi
+GIFLIB_VERSION=$(awk '/#define GIFLIB_MAJOR/ {MAJOR=$3} /#define GIFLIB_MINOR/ {MINOR=$3} /#define GIFLIB_RELEASE/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_GIFLIB}")
+
+# harfbuzz
+if [ "${openjdk_version}" -gt 8 ] ; then
+    HARFBUZZ=src/java.desktop/share/native/libharfbuzz/hb-version.h
+    ABS_HARFBUZZ="${JDKROOT}/${HARFBUZZ}"
+    if [ ! -f "${ABS_HARFBUZZ}" ]; then
+        echo "HarfBuzz header not found!"
+        exit 4
+    fi
+    HARFBUZZ_VERSION=$(awk '/#define HB_VERSION_MAJOR/ {MAJOR=$3} /#define HB_VERSION_MINOR/ {MINOR=$3} /#define HB_VERSION_MICRO/ {PATCH=$3} END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_HARFBUZZ}")
+else
+    echo "No HarfBuzz on ${openjdk_version}";
+fi
+
+# lcms
+if [ "${openjdk_version}" -gt 8 ] ; then
+    LCMS=src/java.desktop/share/native/liblcms/lcms2.h
+else
+    LCMS=jdk/src/share/native/sun/java2d/cmm/lcms/lcms2.h
+fi
+ABS_LCMS="${JDKROOT}"/"${LCMS}"
+if [ ! -f "${ABS_LCMS}" ]; then
+    echo "lcms header not found!"
+    exit 5
+fi
+LCMS_VERSION=$(awk '/#define LCMS_VERSION/ { MAJOR=int($3 / 1000); REST=$3 % 1000; MINOR=int(REST / 10); PATCH=REST % 10; } END {printf "%s.%s.%s", MAJOR, MINOR, PATCH}' "${ABS_LCMS}")
+
+# jpeg
+if [ "${openjdk_version}" -gt 8 ] ; then
+    JPEG=src/java.desktop/share/native/libjavajpeg/jpeglib.h
+else
+    JPEG=jdk/src/share/native/sun/awt/image/jpeg/jpeglib.h
+fi
+ABS_JPEG="${JDKROOT}"/"${JPEG}"
+if [ ! -f "${ABS_JPEG}" ]; then
+    echo "jpeg header not found!"
+    exit 6
+fi
+JPEG_VERSION=$(awk '/#define JPEG_LIB_VERSION/ { VERSION=$3; MAJOR=int(VERSION / 10); MINOR=VERSION%10; } END {printf "%s%c", MAJOR, (MINOR+96)}' "${ABS_JPEG}")
+
+# png
+if [ "${openjdk_version}" -gt 8 ] ; then
+    PNG=src/java.desktop/share/native/libsplashscreen/libpng/png.h
+else
+    PNG=jdk/src/share/native/sun/awt/libpng/png.h
+fi
+ABS_PNG="${JDKROOT}"/"${PNG}"
+if [ ! -f "${ABS_PNG}" ]; then
+    echo "png header not found!"
+    exit 7
+fi
+PNG_VERSION=$(awk '/#define PNG_LIBPNG_VER_STRING/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_PNG}")
+
+# zlib
+if [ "${openjdk_version}" -gt 8 ] ; then
+    ZLIB=src/java.base/share/native/libzip/zlib/zlib.h
+else
+    ZLIB=jdk/src/share/native/java/util/zip/zlib/zlib.h
+fi
+ABS_ZLIB="${JDKROOT}"/"${ZLIB}"
+if [ ! -f "${ABS_ZLIB}" ]; then
+    echo "zlib header not found!"
+    exit 8
+fi
+ZLIB_VERSION=$(awk '/#define ZLIB_VERSION/ { VERSION=$3; gsub("\"", "", VERSION) } END {print VERSION}' "${ABS_ZLIB}")
+
+# Print output
+printf "\nRPM definitions:\n"
+if [ "${openjdk_version}" -gt 8 ] ; then
+    echo "# Version in ${FREETYPE}"
+    echo "Provides: bundled(freetype) = ${FREETYPE_VERSION}"
+fi
+echo "# Version in ${GIFLIB}"
+echo "Provides: bundled(giflib) = ${GIFLIB_VERSION}"
+if [ "${openjdk_version}" -gt 8 ] ; then
+    echo "# Version in ${HARFBUZZ}"
+    echo "Provides: bundled(harfbuzz) = ${HARFBUZZ_VERSION}"
+fi
+echo "# Version in ${LCMS}"
+echo "Provides: bundled(lcms2) = ${LCMS_VERSION}"
+echo "# Version in ${JPEG}"
+echo "Provides: bundled(libjpeg) = ${JPEG_VERSION}"
+echo "# Version in ${PNG}"
+echo "Provides: bundled(libpng) = ${PNG_VERSION}"
+echo "# Version in ${ZLIB}"
+echo "Provides: bundled(zlib) = ${ZLIB_VERSION}"
+
+# Local Variables:
+# compile-command: "shellcheck get_bundle_versions.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
--- a/scripts/icedtea_sync.sh
+++ b/scripts/icedtea_sync.sh
--- a/scripts/openjdk_news.sh
+++ b/scripts/openjdk_news.sh
@ -0,0 +1,114 @@
+#!/bin/bash
+
+# Copyright (C) 2024 Red Hat, Inc.
+# Written by Andrew John Hughes <gnu.andrew@redhat.com>, 2012-2022
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as
+# published by the Free Software Foundation, either version 3 of the
+# License, or (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+OLD_RELEASE=$1
+NEW_RELEASE=$2
+REPO=$3
+SUBDIR=$4
+SCRIPT_DIR=$(dirname "${0}")
+
+if test "${SUBDIR}" = ""; then
+    echo "No subdirectory specified; using .";
+    SUBDIR=".";
+fi
+
+if test "$REPO" = ""; then
+    echo "No repository specified; using ${PWD}"
+    REPO=${PWD}
+fi
+
+if test "${TMPDIR}" = ""; then
+    TMPDIR=/tmp;
+fi
+
+echo "Repository: ${REPO}"
+
+if [ -e "${REPO}/.git" ] ; then
+    TYPE=git;
+elif [ -e "${REPO}/.hg" ] ; then
+    TYPE=hg;
+else
+    echo "No Mercurial or Git repository detected.";
+    exit 1;
+fi
+
+if test "$OLD_RELEASE" = "" || test "$NEW_RELEASE" = ""; then
+    echo "ERROR: Need to specify old and new release";
+    exit 2;
+fi
+
+echo "Listing fixes between $OLD_RELEASE and $NEW_RELEASE in $REPO"
+rm -f "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" "${TMPDIR}/fixes"
+for repos in . $("${SCRIPT_DIR}/discover_trees.sh" "${REPO}");
+do
+    if test "$TYPE" = "hg"; then
+	hg log -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R "$REPO/$repos" -G -M "${REPO}/${SUBDIR}" | \
+	    grep -E '^[o:| ]*summary'|grep -v 'Added tag'|sed -r 's#^[o:| ]*summary:\W*([0-9])#  - JDK-\1#'| \
+	    sed 's#^[o:| ]*summary:\W*#  - #' >> "${TMPDIR}/fixes2";
+	hg log -v -r "tag('$NEW_RELEASE'):tag('$OLD_RELEASE') - tag('$OLD_RELEASE')" -R "$REPO/$repos" -G -M "${REPO}/${SUBDIR}" | \
+	    grep -E '^[o:| ]*[0-9]{7}'|sed -r 's#^[o:| ]*([0-9]{7})#  - JDK-\1#' >> "${TMPDIR}/fixes3";
+    else
+	git -C "${REPO}" log --no-merges --pretty=format:%B "${NEW_RELEASE}...${OLD_RELEASE}" -- "${SUBDIR}" |grep -E '^[0-9]{7}' | \
+	    sed -r 's#^([0-9])#  - JDK-\1#' >> "${TMPDIR}/fixes2";
+	touch "${TMPDIR}/fixes3" ; # unused
+    fi
+done
+
+sort "${TMPDIR}/fixes2" "${TMPDIR}/fixes3" > "${TMPDIR}/fixes4"
+uniq "${TMPDIR}/fixes4" > "${TMPDIR}/fixes"
+rm -f "${TMPDIR}/fixes2" "${TMPDIR}/fixes3"
+
+if ! [ -s "${TMPDIR}/fixes" ] ; then
+    echo "Failed to obtain fixes.";
+    exit 3;
+fi
+
+echo "In ${TMPDIR}/fixes:"
+cat "${TMPDIR}/fixes"
+
+printf "\nChecking for duplicates...";
+if uniq -d "${TMPDIR}/fixes4" | grep 'JDK' > "${TMPDIR}/dupes"; then
+    printf "found.\nWARNING: Review the following duplicates:\n";
+    cat "${TMPDIR}/dupes";
+else
+    echo "No apparent duplicates.";
+fi
+rm -f "${TMPDIR}/fixes4";
+
+printf "\nChecking for backouts...";
+if grep -i 'backout' "${TMPDIR}/fixes" > "${TMPDIR}/backouts"; then
+    printf "found.\nWARNING: Review the following backouts:\n"
+    cat "${TMPDIR}/backouts";
+else
+    echo "No apparent backouts.";
+fi
+printf "\nChecking for bundled library updates...";
+if grep -iE ':( \(tz\))? update.*(freetype|gif|harfbuzz|lcms|jpeg|png|timezone|zlib)' "${TMPDIR}/fixes" > "${TMPDIR}/bundles"; then
+    printf "found.\nWARNING: Review the following with respect to bundled provides:\n";
+    cat "${TMPDIR}/bundles";
+    echo "Compare the output of $(dirname "${0}")/get_bundle_versions.sh with the RPM using the JDK source tree"
+else
+    echo "No apparent library updates.";
+fi
+
+# Local Variables:
+# compile-command: "shellcheck openjdk_news.sh"
+# fill-column: 80
+# indent-tabs-mode: nil
+# sh-basic-offset: 4
+# End:
--- a/2
+++ b/2
@ -1 +1 @@
-SHA512 (openjdk-jdk-22.0.1+8.tar.xz) = 80107b40720a551db70c6719131234cfc2d7b257c0e147897c66fb1c6331e0294e98e0ce3646ddacc9d8c860e1cb55970eaec2f76763f9fd0a9aa15859e066b1
+SHA512 (openjdk-26+29-ea.tar.xz) = 4e80882e0de26eff7d46d762e255911d42544473cc5f12ab0af1997969a14cc697e1164cb3c90d894359b58cc42dbd2b233f00fa807dbfad41583da278e26666
Author	SHA1	Message	Date
Jiri Vanek	4d483d5093	Updated to jdk26	2025-12-23 13:11:27 +01:00
Jiri Vanek	573c2c7a36	fipsver df044414ef4	2025-12-12 15:47:22 +01:00
Jiri Vanek	d0dccee5d0	Switch from static-libs-image to static-libs-graal-image to avoid large unneeded libjvm.a	2025-12-12 14:29:57 +01:00
Jiri Vanek	8da764d82a	Added support for build with devkit in rhel and building by fastdebug if possible	2025-12-08 17:05:10 +01:00
Jiri Vanek	1cdac5f811	BUmped to October 2025 CPU and made to build by itslef by java-latest-openjdk instead of java-25-openjdk	2025-10-22 18:28:12 +02:00
Jiri Vanek	2748852214	BUmped release	2025-10-07 17:12:38 +02:00
Jiri Vanek	93d6522bfd	Moved to build by itslef - jdk25	2025-10-07 16:58:30 +02:00
Jiri Vanek	7b169ddefa	Split toolchains between el7 and epel8 This should return epel8 buildability, still maintain el7-like toolchain and also work in rawhide/el10	2025-10-06 15:14:23 +02:00
Jiri Vanek	162e0d77cb	removing revert8350202.patch again; skiping epel8 for now maybe pernamently	2025-09-22 17:34:41 +02:00
Jiri Vanek	70e5657156	Returned revert8350202.patch; still needed on epel8	2025-09-22 17:25:54 +02:00
Jiri Vanek	05a84d9ee2	Bumped to jdk25	2025-09-22 11:36:37 +02:00
Fedora Release Engineering	1d7ca7d82e	Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild	2025-07-24 17:55:42 +00:00
Jiri Vanek	8ff1c844a9	Reverted JDK-8350202 can not build on epel8	2025-07-21 20:16:42 +02:00
Jiri Vanek	31207ffae3	Updated to 24.0.2.0.12 minor changes: * added changelog * shenandoah included in risc arches * bumped bundled providfes * introduced XZ_OPTS to -T0 * scripts moved to scritps dir * scripts passesd through spell check	2025-07-21 19:33:26 +02:00
Jiri	dafff6d4c1	Bumped release	2025-05-26 13:11:31 +02:00
Severin Gehwolf	87c794a095	Update to upstream patch for glibc 2.42 build failure	2025-05-26 11:09:35 +00:00
Severin Gehwolf	2681c6e177	Re-introduce JMODs archive tarball	2025-05-13 12:42:18 +02:00
Severin Gehwolf	fa56012985	Add --disable-absolute-paths-in-output to not need debugedit The non-portable version of the build uses debugedit to modify built in paths to source files in debuginfo files. By setting --disable-absolute-paths-in-output we enable features added by JDK-8323667 and JDK-8284437. This feature was already implicitly used by the release build. Align release and fastdebug/slowdebug builds.	2025-04-28 16:49:07 +02:00
Severin Gehwolf	f3a237805c	Add patch for JDK-8355524, fixing a bug in JDK-8353185 There was a bug in the patch of JDK-8353185 which made the tzdb.dat upgrade to not work.	2025-04-25 10:44:59 +02:00
Severin Gehwolf	73e20c5c38	Add patches for JDK-8353185 and JDK-8350137 Those are in the July CPU update (24.0.2). Add them ahead of time.	2025-04-24 15:08:54 +02:00
Severin Gehwolf	4fa1f27dea	Don't do custom debuginfo stripping Use the --with-native-debug-symbols=external approach instead.	2025-04-23 11:15:36 +02:00
Severin Gehwolf	2f7e59623f	Revert hash sum calculation patches	2025-04-22 18:22:01 +02:00
Severin Gehwolf	dcabb97227	Fix FTBFS in rawhide with GCC 15	2025-04-17 17:08:12 +02:00
Jiri Vanek	66b9ab625c	Updated to security jdk-24.0.1+9 updated news	2025-04-16 15:28:05 +02:00
Jiri Vanek	f3ab962365	MAde unstripped jmodless jimage work and moved it to its own tarball by regeneratign the hashsums again	2025-04-04 17:19:20 +02:00
Jiri	04c53a74b8	Set rpmrelease to 4 Yet again the autorelease complain that the build already exists	2025-04-02 17:59:23 +02:00
Severin Gehwolf	50c8797062	Use SHA overrides file for builds with internal debug symbols This is so that the RPM installation can generate the overrides based on the portable build.	2025-04-02 17:36:59 +02:00
Severin Gehwolf	fee42c2479	Add patches for linking from run-time image (RPM support)	2025-04-02 17:36:51 +02:00
Jiri Vanek	840cb43e58	Bumped to 24+36 and built by itself	2025-02-17 16:26:07 +01:00
Jiri Vanek	3cf747910c	Fixed check by javap on classfiles symbols -l without -c no longer prints necessary info	2025-02-02 13:14:40 +01:00
Jiri Vanek	94d10b8b2a	Adjsuted NEWS for jdk24	2025-02-02 13:14:40 +01:00
Jiri Vanek	17dda09e75	Enabled jmod-less jlink capability and kept jmods https://openjdk.org/jeps/493	2025-02-02 13:14:21 +01:00
Jiri Vanek	527abd4d5d	Updated to jdk-24+34-ea	2025-02-02 12:19:55 +01:00
Jiri Vanek	5b0be33c4f	NEWS	2025-01-27 17:34:38 +01:00
Jiri Vanek	b131ab378d	Revert "Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild " This reverts commit `c469f03058`.	2025-01-27 16:17:12 +01:00
Jiri Vanek	8aeb686da3	January CPU 2025	2025-01-27 16:16:34 +01:00
Fedora Release Engineering	c469f03058	Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild	2025-01-17 07:41:46 +00:00
Jiri	552d7c1901	October CPU	2024-10-20 15:27:14 +02:00
Jiri	d5bdb14940	Moved to autorelease and autochagelog	2024-10-20 14:56:51 +02:00
Jiri	484457e91e	Bumped to build by itself (23)	2024-10-20 14:55:24 +02:00
Jiri Vanek	25a204173d	Fixed release	2024-09-25 09:35:09 +02:00
Jiri	bf3bbaef3b	updated to jdk23 udpated NEWS (for JEPS) and README.md for 23 links	2024-09-24 18:49:28 +02:00
Miroslav Suchý	87d4598cb0	convert license to SPDX This is part of https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_4	2024-09-02 09:00:37 +02:00
Jiri	c6f9958957	Updated news	2024-07-20 17:07:58 +02:00
Jiri	c8b2b4b72b	July CPU	2024-07-20 17:01:48 +02:00
Jiri	886f9e259a	Revert "Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild " This reverts commit `9d54a54811`.	2024-07-20 16:53:14 +02:00
Fedora Release Engineering	9d54a54811	Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild	2024-07-18 10:51:39 +00:00
				`@ -1 +0,0 @@`
				`# this file is intentionally not here, as portable builds do not have desktop integration`