Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package java-1_8_0-openjdk for
openSUSE:Factory checked in at 2026-11-10 16:29:50
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/java-1_8_0-openjdk (Old)
and /work/SRC/openSUSE:Factory/.java-1_8_0-openjdk.new.3759290 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "java-1_8_0-openjdk"
Tue Nov 10 16:29:50 2026 rev:119 rq:1396506 version:1.8.0.512
Changes:
--------
--- /work/SRC/openSUSE:Factory/java-1_8_0-openjdk/java-1_8_0-openjdk.changes
2026-09-18 22:08:42.002028723 +0200
+++
/work/SRC/openSUSE:Factory/.java-1_8_0-openjdk.new.3759290/java-1_8_0-openjdk.changes
2026-11-10 16:30:05.913985214 +0100
@@ -1,0 +2,225 @@
+Mon Nov 9 15:04:37 UTC 2026 - Fridrich Strba <[email protected]>
+
+- Upgrade to upstream tag jdk8u512-b09 (October 2026 CPU)
+ * Security fixes
+ + JDK-8383530: Enhance Javadoc Searching
+ + JDK-8383679, CVE-2026-87294, bsc#1286490: Enhance Certificate
+ Name Checks
+ + JDK-8383439, CVE-2026-83395, bsc#1286479: Enhance HTTP Client
+ Response Handling
+ + JDK-8386783: WebRowSet empty elements read value of previous
+ element
+ + JDK-8383301, CVE-2026-83387, bsc#1286478: Enhance WebRowSets
+ + JDK-8380715, CVE-2026-83374, bsc#1286472: Enhance PKCS5
+ padding
+ + JDK-8384654, CVE-2026-87367, bsc#1286943: Enhance Template
+ Handling
+ + JDK-8383699, CVE-2026-87290, bsc#1286484: Enhance XPath
+ Expressions
+ + JDK-8383047, CVE-2026-83380, bsc#1286476: Enhance LDAP logins
+ + JDK-8384021, CVE-2026-101516, bsc#1286395: Enhance Certificate
+ Constraint Checking
+ + JDK-8387152, CVE-2026-91462, bsc#1286547: Enhance krb5 tokens
+ + JDK-8387238, CVE-2026-91464, bsc#1286550: Enhance Kerberos
+ validation
+ + JDK-8386013: Enhance EventListenerList
+ + JDK-8382407: Enhance LDAP Lookups
+ + JDK-8386535, CVE-2026-91453, bsc#1286545: Improve HTTP headers
+ + JDK-8385476, CVE-2026-91400, bsc#1286517: Enhance MIDI file
+ handling
+ + JDK-8386923, CVE-2026-91461, bsc#1286546: Enhance TLS
+ Extensions
+ + JDK-8387217, CVE-2026-91463, bsc#1286549: Enhance krb5 client
+ + JDK-8386515, CVE-2026-91451, bsc#1286542: Enhance HTTP server
+ parsing
+ + JDK-8373677: Clear text HttpServer connection could fail fast
+ if receiving SSL ClientHello
+ + JDK-8383756, CVE-2026-87292, bsc#1286486: Enhance Network
+ Clients
+ + JDK-8383956, CVE-2026-87293, bsc#1286488: Enhance RMI
+ connections
+ + JDK-8383281: Enhance MD5 Digesting
+ + JDK-8384664, CVE-2026-91335, bsc#1286494: Enhance Image
+ Handling
+ + JDK-8384746, CVE-2026-91380, bsc#1286500: Enhance Preferences
+ + JDK-8384781, CVE-2026-91381, bsc#1286501: Enhance Font
+ Rendering
+ + JDK-8386552, CVE-2026-91418, bsc#1286539: Enhance GIF loading
+ + JDK-8270915: GIFImageReader disregards ignoreMetadata flag
+ which causes memory exhaustion
+ + JDK-8386525, CVE-2026-91452, bsc#1286544: Enhance HTTP Server
+ Handler
+ + JDK-8386187, CVE-2026-91415, bsc#1286537: Enhance font
+ rendering
+ + JDK-8386175, CVE-2026-91417, bsc#1286538: Enhance CORBA
+ + JDK-8385260, CVE-2026-91398, bsc#1286515: Enhance SOCKS5
+ support
+ + JDK-8385249, CVE-2026-91397, bsc#1286513: Enhance diagnostic
+ sessions
+ + JDK-8385229, CVE-2026-91396, bsc#1286510: Improve Pack200
+ handling
+ + JDK-8385219, CVE-2026-91395, bsc#1286508: Enhance Pack200
+ unpacking
+ + JDK-8384930, CVE-2026-91374, bsc#1286496: Enhance jstatd
+ + JDK-8384771, CVE-2026-91373, bsc#1286495: Enhance TLS
+ handshakes
+ + JDK-8384455: Enhance DataFlavor
+ + JDK-8384445, CVE-2026-91334, bsc#1286493: Enhance JPEG loading
+ + JDK-8384031, CVE-2026-83400, bsc#1286480: Enhance XML
+ Processing
+ + JDK-8383076, CVE-2026-83381, bsc#1286477: Enhance SASL
+ Authentication
+ + JDK-8382178, CVE-2026-83376, bsc#1286474: Enhance TLS
+ certificate handling
+ + JDK-8395142, CVE-2026-91403, bsc#1287264: CA Enhancements
+ + JDK-8395690, CVE-2026-114820, bsc#1287962: CA certificate
+ improvements
+ * Other fixes
+ + JDK-8394265: [21u] Add explicit zone offset test for
+ America/Rainy_River
+ + JDK-8393848: Align the JDK with Microsoft's new timezone
+ name for Manitoba
+ + JDK-8392538: Align the JDK with Microsoft's new timezone
+ names for British Columbia/Alberta
+ + JDK-8396048: (tz) Update to tzdata2026f
+ + JDK-8393337: (tz) Update Timezone Data to 2026e
+ + JDK-8393344: Cherry-pick metazone changes from CLDR to support
+ tzdata2026e for JDK update releases
+ + JDK-8392377: (tz) Update Timezone Data to 2026d
+ + JDK-8392519: Cherry-pick metazone changes from CLDR for
+ tzdata2026d, for JDK update release
+ + JDK-8377992: (zipfs) Align ZipFileSystem END header validation
+ with the ZipFile implementation
+ + JDK-8341625: Improve ZipFile validation of the END header
+ + JDK-8304013: Add a fast, non-manual alternative to
+ test/jdk/java/util/zip/ZipFile/TestTooManyEntries
+ + JDK-8377983: (zipfs) ZipFileSystem.initCEN needlessly reads
+ END header
+ + JDK-8316391: (zipfs) ZipFileSystem.readFullyAt does not
+ tolerate short reads
+ + JDK-8255380: (zipfs) ZipFileSystem::readExtra can fail if
+ zipinfo-time is not set to false
+ + JDK-8272746: ZipFile can't open big file
+ (NegativeArraySizeException)
+ + JDK-8392072: Follow-on fix for Improve certification checking
+ + JDK-8391256: TestZoneTextPrinterParser.java assertion fails
+ with expected: <Mountain Standard Time> but was: <Mountain
+ Daylight Time>
+ + JDK-8388214: (tz) Update Timezone Data to 2026c
+ + JDK-8325680: Uninitialised memory in deleteGSSCB of
+ GSSLibStub.c:179 8194630: GSS: Uninitialized
+ cb->initiator_address when using channel binding with native
+ kerberos
+ + JDK-8390380: Cherry-pick metazone changes from CLDR to support
+ tzdata2026c for JDK update releases
+ + JDK-8390388: Cherry-pick tz attributes from newer CLDR data
+ for jdk25u and earlier
+ + JDK-8381379: Support std/dstOffset attributes in CLDR's
+ metazone definitions
+ + JDK-8387123: Remove LuxTrust Global Root CA
+ + JDK-8250839: Improve test template SSLEngineTemplate with
+ SSLContextTemplate
+ + JDK-8349988: Change cgroup version detection logic to not
+ depend on /proc/cgroups 8347811: Container detection code for
+ cgroups v2 should use cgroup.controllers 8354878: File Leak in
+ CgroupSubsystemFactory::determine_type of
+ cgroupSubsystem_linux.cpp:300 8347129: cpuset cgroups
+ controller is required for no good reason
+ + JDK-8259662: Don't wrap SocketExceptions into SSLExceptions
+ in SSLSocketImpl
+ + JDK-8345149: [8u]
+ javax/sound/midi/Soundbanks/GetSoundBankSecurityException/
+ /GetSoundBankSecurityException.java fails with
+ FileSystemException
+ + JDK-8186464: ZipFile cannot read some InfoZip ZIP64 zip files
+ + JDK-8384902: Update GIFlib to 6.1.3
+ + JDK-8388811: [8u] VS2010 build broken by JDK-8374058
+ + JDK-8388142: [8u] Path to PreferredKey.java exclusion is wrong
+ + JDK-8369032: Add test to ensure serialized ICC_Profile stores
+ only necessary optional data
+ + JDK-8385390: Update FreeType to 2.14.3
+ + JDK-8378823: AIX build fails after zlib updated by JDK-8378631
+ + JDK-8252250: isnanf is obsolete
+ + JDK-8303215: Make thread stacks not use huge pages
+ + JDK-8313083: Print 'rss' and 'cache' as part of the
+ container information
+ + JDK-8298730: Refactor subsystem_file_line_contents and add
+ docs and tests
+ + JDK-8386275: Bump update version of OpenJDK: 8u512
+ + JDK-8239798: SSLSocket closes socket both socket endpoints on
+ a SocketTimeoutException
+ + JDK-8347000: Bug in com/sun/net/httpserver/bugs/B6361557.java
+ test
+ + JDK-8395369: Adjust aix VirtualMachineImpl.c to latest changes
+ on Linux
+ + JDK-8267617: Certificate's IP x509 NameConstraints raises
+ ArrayIndexOutOfBoundsException
+ + JDK-8282201: Consider removal of expiry check in
+ VerifyCACerts.java test
+ + JDK-8300167: Add validation of the raster's layout before
+ using in native
+ + JDK-8298240: Replace the usage of ImageLayoutException by the
+ CMMException
+ + JDK-8264666: Change implementation of safeAdd/safeMult in the
+ LCMSImageLayout class
+ + JDK-8290368: Introduce LDAP and RMI protocol-specific object
+ factory filters to JNDI implementation
+ + JDK-8240226: DeflateIn_InflateOut.java test incorrectly
+ assumes size of compressed file
+ + JDK-8204539: improve error messages in matchJavaTZ [windows]
+- Migrate build from icedtea framework to the openjdk/jdk8u upstream
+ repository
+- Added patches:
+ * improved-font-rendering.patch
+ + port icedtea font rendering improvements
+ * keytool-systemlineendings.patch
+ + use system line endings in keytool
+ * multiple-pkcs11-library-init.patch
+ + allow multiple initialization of PKCS#11 libraries
+ * system-libs.patch
+ + allow building against system libraries
+ * system-pcsclite.patch
+ + allow building against system pcsc-lite
+ * x11-hidpi.patch
+ + add HiDPI support on X11
+- Removed patches:
+ * Upgrade-to-tzdata2026c.patch
+ + integrated upstream
+ * icedtea-3.8.0-s390.patch
+ * java-1_8_0-openjdk-suse-desktop-files.patch
+ * reproducible-dist-id.patch
+ * reproducible-jvm-cfg-order.patch
+ + not needed after migration from icedtea framework
+- Modified patches:
+ * 1015432.patch
+ * JDK_1_8_0-8208602.patch
+ * adlc-parser.patch
+ * bsc1211968.patch
+ * disable-doclint-by-default.patch
+ * fips.patch
+ * java-40y.patch
+ * java-atk-wrapper-security.patch
+ * make-jobserver-detection.patch
+ * ppc-zero-hotspot.patch
+ * reproducible-classuse-order.patch
+ * reproducible-copyright-year.patch
+ * reproducible-directory-mtime.patch
+ * reproducible-generated-source-dates.patch
+ * reproducible-generated-timestamps.patch
+ * reproducible-javadoc-timestamp.patch
+ * reproducible-properties.patch
+ * reproducible-zip-extra-fields.patch
+ * riscv64-zero.patch
+ * tls13extensions.patch
+ * zero-javadoc-verbose.patch
+ + rediff on top of direct openjdk 8u tree
+
+-------------------------------------------------------------------
+Sat Sep 19 19:04:28 UTC 2026 - Fridrich Strba <[email protected]>
+
+- Added patch:
+ * Upgrade-to-tzdata2026c.patch
+ + port OpenJDK 8 to timezone data 2026c
+ (bsc#1275035, bsc#1280281)
+
+-------------------------------------------------------------------
Old:
----
aarch32-git.tar.xz
icedtea-3.40.1.tar.xz
icedtea-3.8.0-s390.patch
java-1_8_0-openjdk-suse-desktop-files.patch
openjdk-git.tar.xz
reproducible-dist-id.patch
reproducible-jvm-cfg-order.patch
shenandoah-git.tar.xz
New:
----
TestCryptoLevel.java
TestECDSA.java
config.guess
config.sub
improved-font-rendering.patch
jconsole.desktop.in
jdk8u512-b09.tar.gz
keytool-systemlineendings.patch
multiple-pkcs11-library-init.patch
nss.cfg.in
policytool.desktop.in
system-libs.patch
system-pcsclite.patch
systemtap-tapset.tar.xz
x11-hidpi.patch
----------(Old B)----------
Old: + integrated upstream
* icedtea-3.8.0-s390.patch
* java-1_8_0-openjdk-suse-desktop-files.patch
Old: * icedtea-3.8.0-s390.patch
* java-1_8_0-openjdk-suse-desktop-files.patch
* reproducible-dist-id.patch
Old: * java-1_8_0-openjdk-suse-desktop-files.patch
* reproducible-dist-id.patch
* reproducible-jvm-cfg-order.patch
Old: * reproducible-dist-id.patch
* reproducible-jvm-cfg-order.patch
+ not needed after migration from icedtea framework
----------(Old E)----------
----------(New B)----------
New:- Added patches:
* improved-font-rendering.patch
+ port icedtea font rendering improvements
New: + port icedtea font rendering improvements
* keytool-systemlineendings.patch
+ use system line endings in keytool
New: + use system line endings in keytool
* multiple-pkcs11-library-init.patch
+ allow multiple initialization of PKCS#11 libraries
New: + allow multiple initialization of PKCS#11 libraries
* system-libs.patch
+ allow building against system libraries
New: + allow building against system libraries
* system-pcsclite.patch
+ allow building against system pcsc-lite
New: + allow building against system pcsc-lite
* x11-hidpi.patch
+ add HiDPI support on X11
----------(New E)----------
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ java-1_8_0-openjdk.spec ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:10.913194319 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:10.916194445 +0100
@@ -19,9 +19,11 @@
# ugly hack to prevent spec-cleaner from changing make -> make_build
%global make make
%{!?aarch64:%global aarch64 aarch64 arm64 armv8}
-%global jit_arches %{ix86} x86_64 ppc64 ppc64le %{aarch64} %{arm}
-%global icedtea_version 3.40.1
-%global buildoutputdir openjdk.build/
+%global jit_arches %{ix86} x86_64 ppc64 ppc64le %{aarch64}
+%global openjdk_repo jdk8u
+%global openjdk_tag jdk8u%{updatever}-b%{buildver}
+%global openjdk_dir %{openjdk_repo}-%{openjdk_tag}
+%global buildoutputdir build
%global headless_binaries java keytool orbd policytool rmid rmiregistry
servertool tnameserv
%global headless_binaries_comma %(echo %{headless_binaries} | sed 's#\ #,#g')
%global devel_binaries javac appletviewer extcheck jar jarsigner javadoc javah
javap jcmd jconsole jhat jinfo jmap jps jrunscript jsadebugd jstack jstat
jstatd native2ascii rmic schemagen serialver wsgen wsimport xjc
@@ -43,8 +45,8 @@
%global priority 1805
%global featurever 8
%global javaver 1.%{featurever}.0
-%global updatever 504
-%global buildver 01
+%global updatever 512
+%global buildver 09
# Standard JPackage directories and symbolic links.
%global sdklnk java-%{javaver}-openjdk
%global archname %{sdklnk}
@@ -104,12 +106,6 @@
%ifarch ia64
%global archinstall ia64
%endif
-%ifarch s390
-%global archinstall s390
-%endif
-%ifarch s390x
-%global archinstall s390x
-%endif
%ifarch %{arm}
%global archinstall aarch32
%endif
@@ -178,15 +174,26 @@
License: Apache-1.1 AND Apache-2.0 AND GPL-1.0-or-later AND
GPL-2.0-only AND GPL-2.0-only WITH Classpath-exception-2.0 AND LGPL-2.0-only
AND MPL-1.0 AND MPL-1.1 AND LicenseRef-SUSE-Public-Domain AND W3C
Group: Development/Languages/Java
URL: https://openjdk.java.net/
-Source0:
https://icedtea.classpath.org/download/source/icedtea-%{icedtea_version}.tar.xz
-Source1:
https://icedtea.classpath.org/download/drops/icedtea8/%{icedtea_version}/openjdk-git.tar.xz
-Source2:
https://icedtea.classpath.org/download/drops/icedtea8/%{icedtea_version}/aarch32-git.tar.xz
-Source3:
https://icedtea.classpath.org/download/drops/icedtea8/%{icedtea_version}/shenandoah-git.tar.xz
-# nss fips configuration file
+Source0:
https://github.com/openjdk/%{openjdk_repo}/archive/%{openjdk_tag}.tar.gz
+Source10: systemtap-tapset.tar.xz
+Source11: jconsole.desktop.in
+Source12: policytool.desktop.in
+Source13: nss.cfg.in
+Source14: TestCryptoLevel.java
+Source15: TestECDSA.java
Source17: nss.fips.cfg.in
+Source100: config.guess
+Source101: config.sub
+# nss fips configuration file
# RPM/distribution specific patches
# bsc#1211968
Patch1: bsc1211968.patch
+Patch201: multiple-pkcs11-library-init.patch
+Patch203: system-pcsclite.patch
+Patch204: system-libs.patch
+Patch205: improved-font-rendering.patch
+Patch206: x11-hidpi.patch
+Patch207: keytool-systemlineendings.patch
# RHBZ 1015432
Patch2: 1015432.patch
# Restrict access to java-atk-wrapper classes
@@ -222,12 +229,8 @@
#
# Patch for PPC
Patch103: ppc-zero-hotspot.patch
-Patch1001: java-1_8_0-openjdk-suse-desktop-files.patch
-Patch1002: icedtea-3.8.0-s390.patch
# IcedTea-level reproducibility fixes - these patch the icedtea build itself,
# so unlike the openjdk ones above they are applied in %%prep
-Patch1003: reproducible-jvm-cfg-order.patch
-Patch1004: reproducible-dist-id.patch
Patch2001: disable-doclint-by-default.patch
Patch2002: JDK_1_8_0-8208602.patch
Patch3000: tls13extensions.patch
@@ -437,78 +440,126 @@
There are known issues with accessibility on, so please do not install
this package unless you really need to.
+%global bootcycle 1
+%if %{bootcycle}
+%global imagesdir bootcycle-build/images
+%global imagestarget bootcycle-images docs
+%else
+%global imagesdir images
+%global imagestarget images docs
+%endif
+
%prep
-%setup -q -n icedtea-%{icedtea_version}
+%setup -q -n %{openjdk_dir}
+cp %{SOURCE100} %{SOURCE101} common/autoconf/build-aux/
+%patch -P 1 -p1
+%patch -P 2 -p1
+%patch -P 3 -p1
+%patch -P 12 -p1
+%if %{with zero}
+%patch -P 14 -p1
+%endif
+%patch -P 15 -p1
+%patch -P 20 -p1
+%patch -P 21 -p1
+%patch -P 22 -p1
+%patch -P 23 -p1
+%patch -P 24 -p1
+%patch -P 25 -p1
+%patch -P 26 -p1
+%patch -P 27 -p1
+%patch -P 28 -p1
+%ifarch ppc ppc64 ppc64le
+%patch -P 103 -p1
+%endif
+%patch -P 201 -p1
+%patch -P 203 -p1
+%patch -P 204 -p1
+%patch -P 205 -p1
+%patch -P 206 -p1
+%patch -P 207 -p1
+%patch -P 2001 -p1
+%patch -P 2002 -p1
+%patch -P 3000 -p1
+%ifarch riscv64
+%patch -P 4000 -p1
+%endif
+%patch -P 5001 -p1
-%patch -P 1001 -p1
-%ifarch s390
-%patch -P 1002 -p1
+(cd common/autoconf && bash ./autogen.sh)
+
+# Extract systemtap tapsets
+%if %{with_systemtap}
+tar -x -I xz -f %{SOURCE10}
+for file in tapset/*.in; do
+ OUTPUT_FILE=`echo $file | sed -e s:\.in$::g`
+ sed -e
s:@ABS_SERVER_LIBJVM_SO@:%{_jvmdir}/%{sdkdir}/jre/lib/%{archinstall}/server/libjvm.so:g
$file > $file.1
+%ifarch %{ix86}
+ sed -e
s:@ABS_CLIENT_LIBJVM_SO@:%{_jvmdir}/%{sdkdir}/jre/lib/%{archinstall}/client/libjvm.so:g
$file.1 > $OUTPUT_FILE
+%else
+ sed -e '/@ABS_CLIENT_LIBJVM_SO@/d' $file.1 > $OUTPUT_FILE
%endif
+ sed -i -e s:@ABS_JAVA_HOME_DIR@:%{_jvmdir}/%{sdkdir}:g $OUTPUT_FILE
+done
+%endif
+
+# Prepare desktop files
+for file in %{SOURCE11} %{SOURCE12} ; do
+ OUTPUT_FILE=`basename $file | sed -e s:\.in$::g`
+ sed -e s:@JAVA_HOME@:%{_jvmdir}/%{sdkdir}:g $file > $OUTPUT_FILE
+ sed -i -e s:@VERSION@:%{javaver}:g $OUTPUT_FILE
+done
-# Reproducibility fixes to the icedtea build itself. These must be applied
-# before %%build runs autogen.sh, which regenerates configure and Makefile.in.
-%patch -P 1003 -p1
-%patch -P 1004 -p1
+# Setup nss.cfg
+sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE13} > nss.cfg
+sed -i -e "s:@NSS_SECMOD@:sql\:%{_sysconfdir}/pki/nssdb:g" nss.cfg
# Setup nss.fips.cfg
sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE17} > nss.fips.cfg
sed -i -e "s:@NSS_SECMOD@:sql\:%{_sysconfdir}/pki/nssdb:g" nss.fips.cfg
%build
-%define _lto_cflags %{nil}
-export LANG=C
-
# How many cpu's do we have?
export NUM_PROC=`%{_bindir}/getconf _NPROCESSORS_ONLN 2> /dev/null || :`
export NUM_PROC=${NUM_PROC:-1}
-CFLAGS=$(rpm -E '%{optflags}' | sed 's/-Wall\>//')
-CFLAGS="$CFLAGS -Wno-error"
-CXXFLAGS=${CFLAGS}
+EXTRA_CFLAGS="-Wno-error"; EXTRA_CPP_FLAGS="-Wno-error"
%ifarch ppc64 ppc64le ppc
-CFLAGS="$CFLAGS -fno-strict-aliasing"
+EXTRA_CFLAGS="$EXTRA_CFLAGS -fno-strict-aliasing"
%endif
%if 0%{?suse_version} >= 1330
-CFLAGS="$CFLAGS -std=gnu99 -fno-delete-null-pointer-checks -fno-lifetime-dse
-fcommon"
-CXXFLAGS="$CXXFLAGS -std=gnu++98 -fno-delete-null-pointer-checks
-fno-lifetime-dse -fcommon"
+ EXTRA_CFLAGS="$EXTRA_CFLAGS -std=gnu99 -fno-delete-null-pointer-checks
-fno-lifetime-dse -fcommon"
+ EXTRA_CPP_FLAGS="$EXTRA_CPP_FLAGS -std=gnu++98
-fno-delete-null-pointer-checks -fno-lifetime-dse -fcommon"
%endif
-export CFLAGS
-export CXXFLAGS
-
-%if 0%{?with_gcc}
-export CPP=cpp-%{with_gcc}
-export CXX=g++-%{with_gcc}
-export CC=gcc-%{with_gcc}
-export NM=gcc-nm-%{with_gcc}
+%ifarch %{ix86}
+ EXTRA_CFLAGS="$EXTRA_CFLAGS -mstackrealign -mincoming-stack-boundary=2
-mpreferred-stack-boundary=4"
%endif
-sh autogen.sh
-%configure \
- --disable-downloading \
- --with-tzdata-dir=%{_datadir}/javazi \
- --with-pkgversion="build %{javaver}_%{updatever}-b%{buildver}
suse-0%{?suse_version}-%{_arch}" \
- --disable-nss \
- --enable-sysconf-nss \
- --with-curves=all \
-%if %{with bootstrap}
- --enable-bootstrap \
-%else
- --disable-bootstrap \
-%endif
-%ifnarch %{arm} %{aarch64}
- --with-parallel-jobs="${NUM_PROC}" \
-%endif
-%ifarch s390
- --with-boot-jdk-jvmargs="-Xms256M -Xmx768M" \
-%endif
+mkdir -p %{buildoutputdir}
+
+pushd %{buildoutputdir}
+
+bash ../configure \
+%if 0%{?with_gcc}
+ CC="gcc-%{with_gcc}" \
+ CXX="g++-%{with_gcc}" \
+ CPP="cpp-%{with_gcc}" \
+ NM="gcc-nm-%{with_gcc}" \
+%endif
+ --with-milestone=fcs --with-update-version=%{updatever} \
+ --with-build-number=b%{buildver} \
+ --with-user-release-suffix="suse-0%{?suse_version}-%{_arch}" \
%if %{with zero}
- --enable-zero \
- --disable-jfr \
+ --with-jvm-variants=zero --disable-jfr \
%endif
+ --with-native-debug-symbols=internal --disable-zip-debug-info \
+ --enable-unlimited-crypto --with-stdc++lib=dynamic \
+ --with-zlib=system --with-giflib=system \
+ --with-libjpeg=system --with-libpng=system \
%if %{with_system_lcms}
- --enable-system-lcms \
+ --with-lcms=system \
%else
- --disable-system-lcms \
+ --with-lcms=bundled \
%endif
%if %{with_system_pcsc}
--enable-system-pcsc \
@@ -530,71 +581,27 @@
%else
--disable-improved-font-rendering \
%endif
-%ifarch %{arm}
- --with-hotspot-src-zip=%{SOURCE2} \
-%else
-%if %{without zero} && %{with_shenandoah}
- --with-hotspot-src-zip=%{SOURCE3} \
- --with-hotspot-build=shenandoah \
-%endif
-%endif
- --with-openjdk-src-zip=%{SOURCE1}
-
-# configure has captured CFLAGS/CXXFLAGS and passes them on as
-# --with-extra-cflags/--with-extra-cxxflags, so they must not stay in the
-# environment: hotspot's makefiles only ever do "CFLAGS +=" and compile C++
-# with "$(CXX) $(CXXFLAGS) $(CFLAGS)", so an inherited CFLAGS puts -std=gnu99
-# on every g++ command line ("valid for C/ObjC but not for C++").
-unset CFLAGS CXXFLAGS
-
-%make patch %{?_smp_mflags}
-
-patch -p0 -i %{PATCH1}
-patch -p0 -i %{PATCH2}
-patch -p0 -i %{PATCH3}
-patch -p0 -i %{PATCH12}
-
-%if %{with zero}
-patch -p0 -i %{PATCH14}
-%endif
-
-patch -p0 -i %{PATCH15}
-
-patch -p0 -i %{PATCH20}
-patch -p0 -i %{PATCH21}
-patch -p0 -i %{PATCH22}
-patch -p1 -i %{PATCH23}
-patch -p1 -i %{PATCH24}
-patch -p1 -i %{PATCH25}
-patch -p1 -i %{PATCH26}
-patch -p1 -i %{PATCH27}
-patch -p1 -i %{PATCH28}
-
-%ifarch ppc ppc64 ppc64le
-# PPC fixes
-patch -p0 -i %{PATCH103}
+%ifarch s390
+ --with-boot-jdk-jvmargs="-Xms256M -Xmx768M" \
%endif
+ --with-extra-cflags="$EXTRA_CFLAGS" --with-extra-cxxflags="$EXTRA_CPP_FLAGS"
+make JOBS=$NUM_PROC LOG=trace DEBUG_BINARIES=true POST_STRIP_CMD="" \
+ WARNINGS_ARE_ERRORS="-Wno-error" %{imagestarget}
-patch -p0 -i %{PATCH2001}
-patch -p0 -i %{PATCH2002}
+popd >& /dev/null
-patch -p0 -i %{PATCH3000}
+export JAVA_HOME=$(pwd)/%{buildoutputdir}/%{imagesdir}/j2sdk-image
+cp %{SOURCE14} %{SOURCE15} .
-patch -p0 -i %{PATCH4000}
+$JAVA_HOME/bin/javac TestCryptoLevel.java TestECDSA.java
-patch -p0 -i %{PATCH5001}
+$JAVA_HOME/bin/java TestCryptoLevel
-(cd openjdk/common/autoconf
- bash ./autogen.sh
-)
-
-%{make} %{?_smp_mflags}
-
-export JAVA_HOME=$(pwd)/%{buildoutputdir}images/j2sdk-image
+$JAVA_HOME/bin/java TestECDSA || true
# cacerts are generated in runtime in openSUSE
-if [ -f %{buildoutputdir}images/j2sdk-image/jre/lib/security/cacerts ]; then
- rm -f %{buildoutputdir}images/j2sdk-image/jre/lib/security/cacerts
+if [ -f %{buildoutputdir}/%{imagesdir}/j2sdk-image/jre/lib/security/cacerts ];
then
+ rm -f
%{buildoutputdir}/%{imagesdir}/j2sdk-image/jre/lib/security/cacerts
fi
# Check debug symbols are present and can identify code
@@ -618,7 +625,18 @@
# skip /usr/lib/rpm/brp-check-bytecode-version:
export NO_BRP_CHECK_BYTECODE_VERSION=true
-pushd %{buildoutputdir}images/j2sdk-image
+%if %{with_systemtap}
+ # Install systemtap support files.
+ install -dm 755 %{buildroot}%{_jvmdir}/%{sdkdir}/tapset
+ cp -a tapset/*.stp %{buildroot}%{_jvmdir}/%{sdkdir}/tapset/
+ install -d -m 755 %{buildroot}%{tapsetdir}
+ pushd %{buildroot}%{tapsetdir}
+ RELATIVE=$(%{abs2rel} %{_jvmdir}/%{sdkdir}/tapset %{tapsetdir})
+ ln -sf $RELATIVE/*.stp .
+ popd
+%endif
+
+pushd %{buildoutputdir}/%{imagesdir}/j2sdk-image
# Install main files.
install -d -m 755 %{buildroot}%{_jvmdir}/%{sdkdir}
@@ -685,24 +703,10 @@
[ -f bin/java-rmi.cgi ] && mv bin/java-rmi.cgi sample/rmi
cp -a sample %{buildroot}%{_jvmdir}/%{sdkdir}
-%if %{with_systemtap}
- # Install systemtap support files.
- cp -a tapset %{buildroot}%{_jvmdir}/%{sdkdir}
- pushd %{buildroot}%{_jvmdir}/%{sdkdir}/tapset
- for i in *.stp; do
- mv $i $(basename $i .stp)-%{javaver}.stp
- done
- popd
- install -d -m 755 %{buildroot}%{tapsetdir}
- pushd %{buildroot}%{tapsetdir}
- RELATIVE=$(%{abs2rel} %{_jvmdir}/%{sdkdir}/tapset %{tapsetdir})
- ln -sf $RELATIVE/*.stp .
- popd
-%endif
-
popd
# Install nss.fips.cfg: NSS configuration for global FIPS mode
(crypto-policies)
+install -m 644 nss.cfg %{buildroot}%{_jvmdir}/%{jredir}/lib/security/
install -m 644 nss.fips.cfg %{buildroot}%{_jvmdir}/%{jredir}/lib/security/
# Install Javadoc documentation.
@@ -712,7 +716,7 @@
# Install icons and menu entries.
for s in 16 24 32 48 ; do
install -D -p -m 644 \
- openjdk/jdk/src/solaris/classes/sun/awt/X11/java-icon${s}.png \
+ jdk/src/solaris/classes/sun/awt/X11/java-icon${s}.png \
%{buildroot}%{_datadir}/icons/hicolor/${s}x${s}/apps/java-%{javaver}-openjdk.png
done
@@ -1162,9 +1166,9 @@
%dir %{_libdir}/jvm-exports
%dir %{_libdir}/jvm-private
-%doc %{buildoutputdir}images/j2sdk-image/jre/ASSEMBLY_EXCEPTION
-%license %{buildoutputdir}images/j2sdk-image/jre/LICENSE
-%doc %{buildoutputdir}images/j2sdk-image/jre/THIRD_PARTY_README
+%doc %{buildoutputdir}/%{imagesdir}/j2sdk-image/jre/ASSEMBLY_EXCEPTION
+%license %{buildoutputdir}/%{imagesdir}/j2sdk-image/jre/LICENSE
+%doc %{buildoutputdir}/%{imagesdir}/j2sdk-image/jre/THIRD_PARTY_README
%dir %{_jvmdir}/%{sdkdir}
%{_jvmdir}/%{jrelnk}
++++++ 1015432.patch ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:10.995197749 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:11.003198084 +0100
@@ -1,6 +1,8 @@
---- openjdk/hotspot/src/os/linux/vm/os_linux.cpp Wed Oct 23 15:44:12
2013 -0700
-+++ openjdk/hotspot/src/os/linux/vm/os_linux.cpp Thu Dec 19 16:03:33
2013 +0000
-@@ -4797,9 +4797,19 @@
+diff --git a/hotspot/src/os/linux/vm/os_linux.cpp
b/hotspot/src/os/linux/vm/os_linux.cpp
+index 742e17d115..af900264ee 100644
+--- a/hotspot/src/os/linux/vm/os_linux.cpp
++++ b/hotspot/src/os/linux/vm/os_linux.cpp
+@@ -5200,9 +5200,19 @@ jint os::init_2(void)
// size. Add a page for compiler2 recursion in main thread.
// Add in 2*BytesPerWord times page size to account for VM stack during
// class initialization depending on 32 or 64 bit VM.
++++++ JDK_1_8_0-8208602.patch ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:11.021198837 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:11.025199004 +0100
@@ -1,15 +1,7 @@
-
-# HG changeset patch
-# User weijun
-# Date 1533101708 -28800
-# Node ID 9d92ff04a29c12a5d47f2ca4e772f7716bfdb8ff
-# Parent b6e0bfe4a6ec5d8d9d9476c05627dfb47f2263e1
-8208602: Cannot read PEM X.509 cert if there is whitespace after the header or
footer
-Reviewed-by: xuelei
-
-diff -r b6e0bfe4a6ec -r 9d92ff04a29c
src/java.base/share/classes/sun/security/provider/X509Factory.java
---- openjdk/jdk/src/share/classes/sun/security/provider/X509Factory.java
Wed Aug 01 01:40:44 2018 -0400
-+++ openjdk/jdk/src/share/classes/sun/security/provider/X509Factory.java
Wed Aug 01 13:35:08 2018 +0800
+diff --git a/jdk/src/share/classes/sun/security/provider/X509Factory.java
b/jdk/src/share/classes/sun/security/provider/X509Factory.java
+index e0deae26cc..beb4efab40 100644
+--- a/jdk/src/share/classes/sun/security/provider/X509Factory.java
++++ b/jdk/src/share/classes/sun/security/provider/X509Factory.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 1998, 2014, Oracle and/or its affiliates. All rights
reserved.
@@ -17,7 +9,7 @@
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
-@@ -635,7 +635,8 @@
+@@ -634,7 +634,8 @@ public class X509Factory extends CertificateFactorySpi {
if (next != '\r') footer.append((char)next);
}
@@ -27,9 +19,10 @@
return Pem.decode(new String(data, 0, pos));
}
-diff -r b6e0bfe4a6ec -r 9d92ff04a29c
test/jdk/sun/security/provider/X509Factory/BadPem.java
---- openjdk/jdk/test/sun/security/provider/X509Factory/BadPem.java Wed Aug
01 01:40:44 2018 -0400
-+++ openjdk/jdk/test/sun/security/provider/X509Factory/BadPem.java Wed Aug
01 13:35:08 2018 +0800
+diff --git a/jdk/test/sun/security/provider/X509Factory/BadPem.java
b/jdk/test/sun/security/provider/X509Factory/BadPem.java
+index 9147ab8ce9..e800b6ac56 100644
+--- a/jdk/test/sun/security/provider/X509Factory/BadPem.java
++++ b/jdk/test/sun/security/provider/X509Factory/BadPem.java
@@ -1,5 +1,5 @@
/*
- * Copyright (c) 2015, Oracle and/or its affiliates. All rights reserved.
@@ -37,7 +30,7 @@
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
-@@ -23,14 +23,13 @@
+@@ -23,13 +23,12 @@
/*
* @test
@@ -53,8 +46,7 @@
import java.io.PrintStream;
import java.security.KeyStore;
import java.security.cert.CertificateException;
- import java.util.Arrays;
-@@ -49,10 +48,12 @@
+@@ -48,10 +47,12 @@ public class BadPem {
String pass = "passphrase";
String alias = "dummy";
@@ -67,7 +59,7 @@
ByteArrayOutputStream bout = new ByteArrayOutputStream();
PrintStream pout = new PrintStream(bout);
byte[] CRLF = new byte[] {'\r', '\n'};
-@@ -64,14 +65,20 @@
+@@ -63,14 +64,20 @@ public class BadPem {
}
pout.println(X509Factory.END_CERT);
@@ -91,4 +83,3 @@
}
-
++++++ TestCryptoLevel.java ++++++
/* TestCryptoLevel -- Ensure unlimited crypto policy is in use.
Copyright (C) 2012 Red Hat, Inc.
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
import java.lang.reflect.Field;
import java.lang.reflect.Method;
import java.lang.reflect.InvocationTargetException;
import java.security.Permission;
import java.security.PermissionCollection;
public class TestCryptoLevel
{
public static void main(String[] args)
throws NoSuchFieldException, ClassNotFoundException,
IllegalAccessException, InvocationTargetException
{
Class<?> cls = null;
Method def = null, exempt = null;
try
{
cls = Class.forName("javax.crypto.JceSecurity");
}
catch (ClassNotFoundException ex)
{
System.err.println("Running a non-Sun JDK.");
System.exit(0);
}
try
{
def = cls.getDeclaredMethod("getDefaultPolicy");
exempt = cls.getDeclaredMethod("getExemptPolicy");
}
catch (NoSuchMethodException ex)
{
System.err.println("Running IcedTea with the original crypto patch.");
System.exit(0);
}
def.setAccessible(true);
exempt.setAccessible(true);
PermissionCollection defPerms = (PermissionCollection) def.invoke(null);
PermissionCollection exemptPerms = (PermissionCollection)
exempt.invoke(null);
Class<?> apCls = Class.forName("javax.crypto.CryptoAllPermission");
Field apField = apCls.getDeclaredField("INSTANCE");
apField.setAccessible(true);
Permission allPerms = (Permission) apField.get(null);
if (defPerms.implies(allPerms) && (exemptPerms == null ||
exemptPerms.implies(allPerms)))
{
System.err.println("Running with the unlimited policy.");
System.exit(0);
}
else
{
System.err.println("WARNING: Running with a restricted crypto policy.");
System.exit(-1);
}
}
}
++++++ TestECDSA.java ++++++
/* TestECDSA -- Ensure ECDSA signatures are working.
Copyright (C) 2016 Red Hat, Inc.
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU Affero General Public License as
published by the Free Software Foundation, either version 3 of the
License, or (at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU Affero General Public License for more details.
You should have received a copy of the GNU Affero General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
import java.math.BigInteger;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.Signature;
/**
* @test
*/
public class TestECDSA {
public static void main(String[] args) throws Exception {
KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
KeyPair key = keyGen.generateKeyPair();
byte[] data = "This is a string to sign".getBytes("UTF-8");
Signature dsa = Signature.getInstance("NONEwithECDSA");
dsa.initSign(key.getPrivate());
dsa.update(data);
byte[] sig = dsa.sign();
System.out.println("Signature: " + new BigInteger(1, sig).toString(16));
Signature dsaCheck = Signature.getInstance("NONEwithECDSA");
dsaCheck.initVerify(key.getPublic());
dsaCheck.update(data);
boolean success = dsaCheck.verify(sig);
if (!success) {
throw new RuntimeException("Test failed. Signature verification
error");
}
System.out.println("Test passed.");
}
}
++++++ adlc-parser.patch ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:11.111202601 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:11.116202810 +0100
@@ -1,6 +1,8 @@
---- openjdk/hotspot/src/share/vm/adlc/formsopt.cpp 2014-07-03
21:56:12.000000000 +0200
-+++ openjdk/hotspot/src/share/vm/adlc/formsopt.cpp 2014-07-14
11:43:21.900408570 +0200
-@@ -347,6 +347,7 @@
+diff --git a/hotspot/src/share/vm/adlc/formsopt.cpp
b/hotspot/src/share/vm/adlc/formsopt.cpp
+index ac8ffff296..3fe42992aa 100644
+--- a/hotspot/src/share/vm/adlc/formsopt.cpp
++++ b/hotspot/src/share/vm/adlc/formsopt.cpp
+@@ -440,6 +440,7 @@ FrameForm::FrameForm() {
_return_value = NULL;
_c_return_value = NULL;
_interpreter_frame_pointer_reg = NULL;
++++++ bsc1211968.patch ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:11.135203605 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:11.138203731 +0100
@@ -1,6 +1,8 @@
---- openjdk/jdk/src/share/classes/sun/security/ssl/DHKeyExchange.java
2023-11-14 07:18:11.483931806 +0100
-+++ openjdk/jdk/src/share/classes/sun/security/ssl/DHKeyExchange.java
2023-11-14 07:20:21.018138340 +0100
-@@ -253,11 +253,7 @@
+diff --git a/jdk/src/share/classes/sun/security/ssl/DHKeyExchange.java
b/jdk/src/share/classes/sun/security/ssl/DHKeyExchange.java
+index 49f5a90254..2e3d6218d7 100644
+--- a/jdk/src/share/classes/sun/security/ssl/DHKeyExchange.java
++++ b/jdk/src/share/classes/sun/security/ssl/DHKeyExchange.java
+@@ -253,11 +253,7 @@ final class DHKeyExchange {
static {
String property = GetPropertyAction.privilegedGetProperty(
"jdk.tls.ephemeralDHKeySize");
++++++ config.guess ++++++
++++ 1808 lines (skipped)
++++++ config.sub ++++++
++++ 1961 lines (skipped)
++++++ disable-doclint-by-default.patch ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:11.201206366 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:11.207206617 +0100
@@ -1,18 +1,8 @@
-Disable doclint by default
-
-OpenJDK 8 adds and enables doclint by default. This catches issues in
-javadoc comments. It is too strict, breaks javadoc compilation and, in
-general, breaks the build for old code known to build with previous
-versions of OpenJDK.
-
-See: http://blog.joda.org/2014/02/turning-off-doclint-in-jdk-8-javadoc.html
-See:
https://lists.fedoraproject.org/pipermail/java-devel/2014-February/005150.html
-
-Author: Andrew John Hughes <[email protected]>
-Author: Emmanuel Bourg <[email protected]>
---- openjdk/langtools/src/share/classes/com/sun/tools/javadoc/DocEnv.java
-+++ openjdk/langtools/src/share/classes/com/sun/tools/javadoc/DocEnv.java
-@@ -811,10 +811,9 @@
+diff --git a/langtools/src/share/classes/com/sun/tools/javadoc/DocEnv.java
b/langtools/src/share/classes/com/sun/tools/javadoc/DocEnv.java
+index 3db4597958..a59b56daaa 100644
+--- a/langtools/src/share/classes/com/sun/tools/javadoc/DocEnv.java
++++ b/langtools/src/share/classes/com/sun/tools/javadoc/DocEnv.java
+@@ -812,10 +812,9 @@ public class DocEnv {
doclintOpts.add(opt == null ? DocLint.XMSGS_OPTION :
DocLint.XMSGS_CUSTOM_PREFIX + opt);
}
@@ -26,9 +16,11 @@
return;
}
---- openjdk/langtools/test/tools/javadoc/doclint/DocLintTest.java
-+++ openjdk/langtools/test/tools/javadoc/doclint/DocLintTest.java
-@@ -130,12 +130,12 @@
+diff --git a/langtools/test/tools/javadoc/doclint/DocLintTest.java
b/langtools/test/tools/javadoc/doclint/DocLintTest.java
+index 346b457f29..3a1fd67d31 100644
+--- a/langtools/test/tools/javadoc/doclint/DocLintTest.java
++++ b/langtools/test/tools/javadoc/doclint/DocLintTest.java
+@@ -130,12 +130,12 @@ public class DocLintTest {
};
test(Collections.<String>emptyList(),
@@ -45,7 +37,7 @@
test(Arrays.asList("-Xdoclint:none"),
Main.Result.OK,
-@@ -158,8 +158,8 @@
+@@ -158,8 +158,8 @@ public class DocLintTest {
EnumSet.of(Message.DL_WRN12));
test(Arrays.asList(rawDiags, "-private"),
++++++ fips.patch ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:11.233207705 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:11.238207914 +0100
@@ -1,6 +1,8 @@
---- openjdk/common/autoconf/configure.ac 2022-02-08 15:00:13.864829794
+0100
-+++ openjdk/common/autoconf/configure.ac 2022-02-08 15:00:30.560949558
+0100
-@@ -212,6 +212,7 @@
+diff --git a/common/autoconf/configure.ac b/common/autoconf/configure.ac
+index 151e5a109f..a8761b500e 100644
+--- a/common/autoconf/configure.ac
++++ b/common/autoconf/configure.ac
+@@ -212,6 +212,7 @@ LIB_SETUP_FREETYPE
LIB_SETUP_ALSA
LIB_SETUP_FONTCONFIG
LIB_SETUP_MISC_LIBS
@@ -8,9 +10,11 @@
LIB_SETUP_STATIC_LINK_LIBSTDCPP
LIB_SETUP_ON_WINDOWS
---- openjdk/common/autoconf/libraries.m4 2022-02-08 15:00:13.864829794
+0100
-+++ openjdk/common/autoconf/libraries.m4 2022-02-08 15:00:30.560949558
+0100
-@@ -1334,3 +1334,63 @@
+diff --git a/common/autoconf/libraries.m4 b/common/autoconf/libraries.m4
+index 85cfe1fe19..b2d1f665e0 100644
+--- a/common/autoconf/libraries.m4
++++ b/common/autoconf/libraries.m4
+@@ -1161,3 +1161,63 @@ AC_DEFUN_ONCE([LIB_SETUP_ON_WINDOWS],
BASIC_DEPRECATED_ARG_WITH([dxsdk-include])
fi
])
@@ -74,9 +78,11 @@
+ fi
+ AC_SUBST(USE_SYSCONF_NSS)
+])
---- openjdk/common/autoconf/spec.gmk.in 2022-02-08 15:00:13.864829794
+0100
-+++ openjdk/common/autoconf/spec.gmk.in 2022-02-08 15:00:30.560949558
+0100
-@@ -313,6 +313,10 @@
+diff --git a/common/autoconf/spec.gmk.in b/common/autoconf/spec.gmk.in
+index 8ce3f216c6..fb58f31725 100644
+--- a/common/autoconf/spec.gmk.in
++++ b/common/autoconf/spec.gmk.in
+@@ -312,6 +312,10 @@ CUPS_CFLAGS:=@CUPS_CFLAGS@
ALSA_LIBS:=@ALSA_LIBS@
ALSA_CFLAGS:=@ALSA_CFLAGS@
@@ -87,42 +93,10 @@
PACKAGE_PATH=@PACKAGE_PATH@
# Source file for cacerts
---- openjdk/common/bin/compare_exceptions.sh.incl 2022-02-08
15:00:13.864829794 +0100
-+++ openjdk/common/bin/compare_exceptions.sh.incl 2022-02-08
15:00:30.560949558 +0100
-@@ -280,6 +280,7 @@
- ./jre/lib/i386/libsplashscreen.so
- ./jre/lib/i386/libsunec.so
- ./jre/lib/i386/libsunwjdga.so
-+./jre/lib/i386/libsystemconf.so
- ./jre/lib/i386/libunpack.so
- ./jre/lib/i386/libverify.so
- ./jre/lib/i386/libzip.so
-@@ -432,6 +433,7 @@
- ./jre/lib/amd64/libsplashscreen.so
- ./jre/lib/amd64/libsunec.so
- ./jre/lib/amd64/libsunwjdga.so
-+./jre/lib/amd64/libsystemconf.so
- ./jre/lib/amd64/libunpack.so
- ./jre/lib/amd64/libverify.so
- ./jre/lib/amd64/libzip.so
-@@ -585,6 +587,7 @@
- ./jre/lib/sparc/libsplashscreen.so
- ./jre/lib/sparc/libsunec.so
- ./jre/lib/sparc/libsunwjdga.so
-+./jre/lib/sparc/libsystemconf.so
- ./jre/lib/sparc/libunpack.so
- ./jre/lib/sparc/libverify.so
- ./jre/lib/sparc/libzip.so
-@@ -738,6 +741,7 @@
- ./jre/lib/sparcv9/libsplashscreen.so
- ./jre/lib/sparcv9/libsunec.so
- ./jre/lib/sparcv9/libsunwjdga.so
-+./jre/lib/sparcv9/libsystemconf.so
- ./jre/lib/sparcv9/libunpack.so
- ./jre/lib/sparcv9/libverify.so
- ./jre/lib/sparcv9/libzip.so
---- openjdk/common/nb_native/nbproject/configurations.xml 2022-02-08
15:00:13.868829822 +0100
-+++ openjdk/common/nb_native/nbproject/configurations.xml 2022-02-08
15:00:30.564949586 +0100
+diff --git a/common/nb_native/nbproject/configurations.xml
b/common/nb_native/nbproject/configurations.xml
+index d2beed0b93..3b6aef98d9 100644
+--- a/common/nb_native/nbproject/configurations.xml
++++ b/common/nb_native/nbproject/configurations.xml
@@ -53,6 +53,9 @@
<in>jvmtiEnterTrace.cpp</in>
</df>
@@ -133,21 +107,23 @@
</df>
</df>
<df name="jdk">
-@@ -12771,6 +12774,11 @@
- ex="false"
+@@ -12772,6 +12775,11 @@
tool="0"
flavor2="0">
-+ </item>
+ </item>
+ <item path="../../jdk/src/solaris/native/java/security/systemconf.c"
+ ex="false"
+ tool="0"
+ flavor2="0">
- </item>
++ </item>
<item path="../../jdk/src/share/native/java/util/TimeZone.c"
ex="false"
---- openjdk/jdk/make/lib/SecurityLibraries.gmk 2022-02-08 15:00:15.708843020
+0100
-+++ openjdk/jdk/make/lib/SecurityLibraries.gmk 2022-02-08 15:00:30.564949586
+0100
-@@ -300,3 +300,34 @@
+ tool="0"
+diff --git a/jdk/make/lib/SecurityLibraries.gmk
b/jdk/make/lib/SecurityLibraries.gmk
+index 39f7e46c55..1f44badc9e 100644
+--- a/jdk/make/lib/SecurityLibraries.gmk
++++ b/jdk/make/lib/SecurityLibraries.gmk
+@@ -324,3 +324,34 @@ ifeq ($(OPENJDK_TARGET_OS), solaris)
endif
endif
@@ -182,8 +158,11 @@
+ BUILD_LIBRARIES += $(BUILD_LIBSYSTEMCONF)
+endif
+
---- openjdk/jdk/make/mapfiles/libsystemconf/mapfile-vers 1970-01-01
01:00:00.000000000 +0100
-+++ openjdk/jdk/make/mapfiles/libsystemconf/mapfile-vers 2022-02-08
15:00:30.564949586 +0100
+diff --git a/jdk/make/mapfiles/libsystemconf/mapfile-vers
b/jdk/make/mapfiles/libsystemconf/mapfile-vers
+new file mode 100644
+index 0000000000..a65ceb3b78
+--- /dev/null
++++ b/jdk/make/mapfiles/libsystemconf/mapfile-vers
@@ -0,0 +1,35 @@
+#
+# Copyright (c) 2021, Red Hat, Inc.
@@ -220,9 +199,11 @@
+ local:
+ *;
+};
---- openjdk/jdk/src/share/classes/java/security/Security.java 2022-02-08
15:00:16.912851658 +0100
-+++ openjdk/jdk/src/share/classes/java/security/Security.java 2022-02-08
15:03:03.346045505 +0100
-@@ -30,6 +30,8 @@
+diff --git a/jdk/src/share/classes/java/security/Security.java
b/jdk/src/share/classes/java/security/Security.java
+index 0db09da706..adae0e47a4 100644
+--- a/jdk/src/share/classes/java/security/Security.java
++++ b/jdk/src/share/classes/java/security/Security.java
+@@ -30,6 +30,8 @@ import java.util.*;
import java.util.concurrent.ConcurrentHashMap;
import java.io.*;
import java.net.URL;
@@ -231,7 +212,7 @@
import sun.security.util.Debug;
import sun.security.util.PropertyExpander;
-@@ -69,6 +71,19 @@
+@@ -62,6 +64,19 @@ public final class Security {
}
static {
@@ -251,41 +232,26 @@
// doPrivileged here because there are multiple
// things in initialize that might require privs.
// (the FileInputStream call and the File.exists call,
-@@ -188,29 +203,10 @@
+@@ -179,6 +194,14 @@ public final class Security {
+ }
}
- String disableSystemProps =
System.getProperty("java.security.disableSystemPropertiesFile");
-- if (disableSystemProps == null &&
-- "true".equalsIgnoreCase(props.getProperty
-- ("security.useSystemPropertiesFile"))) {
--
-- // now load the system file, if it exists, so its values
-- // will win if they conflict with the earlier values
-- try (BufferedInputStream bis =
-- new BufferedInputStream(new
FileInputStream(SYSTEM_PROPERTIES))) {
-- props.load(bis);
++ String disableSystemProps =
System.getProperty("java.security.disableSystemPropertiesFile");
+ if ((disableSystemProps == null ||
"false".equalsIgnoreCase(disableSystemProps)) &&
+
"true".equalsIgnoreCase(props.getProperty("security.useSystemPropertiesFile")))
{
+ if (SystemConfigurator.configure(props)) {
- loadedProps = true;
--
-- if (sdebug != null) {
-- sdebug.println("reading system security properties file "
+
-- SYSTEM_PROPERTIES);
-- sdebug.println(props.toString());
-- }
-- } catch (IOException e) {
-- if (sdebug != null) {
-- sdebug.println
-- ("unable to load security properties from " +
-- SYSTEM_PROPERTIES);
-- e.printStackTrace();
-- }
- }
- }
-
---- openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
1970-01-01 01:00:00.000000000 +0100
-+++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
2022-02-08 15:03:03.346045505 +0100
++ loadedProps = true;
++ }
++ }
++
+ if (!loadedProps) {
+ initializeStatic();
+ if (sdebug != null) {
+diff --git a/jdk/src/share/classes/java/security/SystemConfigurator.java
b/jdk/src/share/classes/java/security/SystemConfigurator.java
+new file mode 100644
+index 0000000000..926a8f2cfa
+--- /dev/null
++++ b/jdk/src/share/classes/java/security/SystemConfigurator.java
@@ -0,0 +1,236 @@
+/*
+ * Copyright (c) 2019, 2021, Red Hat, Inc.
@@ -523,8 +489,11 @@
+ }
+ }
+}
----
openjdk/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
1970-01-01 01:00:00.000000000 +0100
-+++
openjdk/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
2022-02-08 15:03:03.346045505 +0100
+diff --git
a/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
b/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
+new file mode 100644
+index 0000000000..5c30a8b29c
+--- /dev/null
++++ b/jdk/src/share/classes/sun/misc/JavaSecuritySystemConfiguratorAccess.java
@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2020, Red Hat, Inc.
@@ -557,9 +526,11 @@
+ boolean isSystemFipsEnabled();
+ boolean isPlainKeySupportEnabled();
+}
---- openjdk/jdk/src/share/classes/sun/misc/SharedSecrets.java 2022-02-08
15:00:17.096852977 +0100
-+++ openjdk/jdk/src/share/classes/sun/misc/SharedSecrets.java 2022-02-08
15:00:30.568949614 +0100
-@@ -63,6 +63,7 @@
+diff --git a/jdk/src/share/classes/sun/misc/SharedSecrets.java
b/jdk/src/share/classes/sun/misc/SharedSecrets.java
+index f065a2c685..40ca609e02 100644
+--- a/jdk/src/share/classes/sun/misc/SharedSecrets.java
++++ b/jdk/src/share/classes/sun/misc/SharedSecrets.java
+@@ -63,6 +63,7 @@ public class SharedSecrets {
private static JavaObjectInputStreamReadString
javaObjectInputStreamReadString;
private static JavaObjectInputStreamAccess javaObjectInputStreamAccess;
private static JavaSecuritySignatureAccess javaSecuritySignatureAccess;
@@ -567,7 +538,7 @@
public static JavaUtilJarAccess javaUtilJarAccess() {
if (javaUtilJarAccess == null) {
-@@ -248,4 +249,12 @@
+@@ -248,4 +249,12 @@ public class SharedSecrets {
}
return javaxCryptoSealedObjectAccess;
}
@@ -580,8 +551,11 @@
+ return javaSecuritySystemConfiguratorAccess;
+ }
}
---- openjdk/jdk/src/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
1970-01-01 01:00:00.000000000 +0100
-+++ openjdk/jdk/src/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
2022-02-08 15:03:03.346045505 +0100
+diff --git a/jdk/src/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
b/jdk/src/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
+new file mode 100644
+index 0000000000..14d1945039
+--- /dev/null
++++ b/jdk/src/share/classes/sun/security/pkcs11/FIPSKeyImporter.java
@@ -0,0 +1,290 @@
+/*
+ * Copyright (c) 2021, Red Hat, Inc.
@@ -873,8 +847,10 @@
+ }
+ }
+}
---- openjdk/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
2022-02-08 15:00:17.144853321 +0100
-+++ openjdk/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
2022-02-08 15:03:03.350045534 +0100
+diff --git a/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
b/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
+index 27aaa5a2df..e450c35c48 100644
+--- a/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
++++ b/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
@@ -26,6 +26,9 @@
package sun.security.pkcs11;
@@ -885,7 +861,7 @@
import java.util.*;
import java.security.*;
-@@ -42,6 +45,8 @@
+@@ -42,6 +45,8 @@ import javax.security.auth.callback.ConfirmationCallback;
import javax.security.auth.callback.PasswordCallback;
import javax.security.auth.callback.TextOutputCallback;
@@ -894,7 +870,7 @@
import sun.security.util.Debug;
import sun.security.util.ResourcesMgr;
-@@ -58,6 +63,29 @@
+@@ -58,6 +63,29 @@ import static sun.security.pkcs11.wrapper.PKCS11Constants.*;
*/
public final class SunPKCS11 extends AuthProvider {
@@ -924,7 +900,7 @@
private static final long serialVersionUID = -1354835039035306505L;
static final Debug debug = Debug.getInstance("sunpkcs11");
-@@ -320,10 +348,15 @@
+@@ -320,10 +348,15 @@ public final class SunPKCS11 extends AuthProvider {
// request multithreaded access first
initArgs.flags = CKF_OS_LOCKING_OK;
PKCS11 tmpPKCS11;
@@ -941,7 +917,7 @@
} catch (PKCS11Exception e) {
if (debug != null) {
debug.println("Multi-threaded initialization failed: " +
e);
-@@ -339,7 +372,7 @@
+@@ -339,7 +372,7 @@ public final class SunPKCS11 extends AuthProvider {
initArgs.flags = 0;
}
tmpPKCS11 = PKCS11.getInstance(library,
@@ -950,7 +926,7 @@
}
p11 = tmpPKCS11;
-@@ -379,6 +412,24 @@
+@@ -379,6 +412,24 @@ public final class SunPKCS11 extends AuthProvider {
if (nssModule != null) {
nssModule.setProvider(this);
}
@@ -975,9 +951,11 @@
} catch (Exception e) {
if (config.getHandleStartupErrors() == Config.ERR_IGNORE_ALL) {
throw new UnsupportedOperationException
---- openjdk/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
2022-02-08 15:00:17.148853350 +0100
-+++ openjdk/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
2022-02-08 15:03:03.350045534 +0100
-@@ -49,6 +49,7 @@
+diff --git a/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
b/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
+index 2e42d1d9fb..6c9c920254 100644
+--- a/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
++++ b/jdk/src/share/classes/sun/security/pkcs11/wrapper/PKCS11.java
+@@ -49,6 +49,7 @@ package sun.security.pkcs11.wrapper;
import java.io.File;
import java.io.IOException;
@@ -985,7 +963,7 @@
import java.util.*;
import java.security.AccessController;
-@@ -147,17 +148,29 @@
+@@ -147,17 +148,29 @@ public class PKCS11 {
public static synchronized PKCS11 getInstance(String pkcs11ModulePath,
String functionList, CK_C_INITIALIZE_ARGS pInitArgs,
@@ -1016,7 +994,7 @@
if (omitInitialize == false) {
try {
pkcs11.C_Initialize(pInitArgs);
-@@ -1905,4 +1918,69 @@
+@@ -1905,4 +1918,69 @@ static class SynchronizedPKCS11 extends PKCS11 {
super.C_GenerateRandom(hSession, randomData);
}
}
@@ -1086,9 +1064,11 @@
+ }
+}
}
---- openjdk/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
2022-02-08 15:00:17.152853378 +0100
-+++ openjdk/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
2022-02-08 15:03:03.350045534 +0100
-@@ -33,8 +33,13 @@
+diff --git a/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
b/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
+index ffee2c1603..9811947982 100644
+--- a/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
++++ b/jdk/src/share/classes/sun/security/ssl/KeyManagerFactoryImpl.java
+@@ -33,8 +33,13 @@ import java.security.KeyStore.*;
import javax.net.ssl.*;
@@ -1102,7 +1082,7 @@
X509ExtendedKeyManager keyManager;
boolean isInitialized;
-@@ -62,7 +67,8 @@
+@@ -62,7 +67,8 @@ abstract class KeyManagerFactoryImpl extends
KeyManagerFactorySpi {
KeyStoreException, NoSuchAlgorithmException,
UnrecoverableKeyException {
if ((ks != null) && SunJSSE.isFIPS()) {
@@ -1112,7 +1092,7 @@
throw new KeyStoreException("FIPS mode: KeyStore must be "
+ "from provider " +
SunJSSE.cryptoProvider.getName());
}
-@@ -91,8 +97,8 @@
+@@ -91,8 +97,8 @@ abstract class KeyManagerFactoryImpl extends
KeyManagerFactorySpi {
keyManager = new X509KeyManagerImpl(
Collections.<Builder>emptyList());
} else {
@@ -1123,9 +1103,11 @@
throw new KeyStoreException(
"FIPS mode: KeyStore must be " +
"from provider " + SunJSSE.cryptoProvider.getName());
---- openjdk/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
2022-02-08 15:00:17.152853378 +0100
-+++ openjdk/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
2022-02-08 15:00:30.568949614 +0100
-@@ -31,6 +31,7 @@
+diff --git a/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
b/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
+index 820e10164f..05f037eb16 100644
+--- a/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
++++ b/jdk/src/share/classes/sun/security/ssl/SSLContextImpl.java
+@@ -31,6 +31,7 @@ import java.security.*;
import java.security.cert.*;
import java.util.*;
import javax.net.ssl.*;
@@ -1133,7 +1115,7 @@
import sun.security.action.GetPropertyAction;
import sun.security.provider.certpath.AlgorithmChecker;
import sun.security.validator.Validator;
-@@ -539,6 +540,23 @@
+@@ -539,6 +540,23 @@ public abstract class SSLContextImpl extends
SSLContextSpi {
static {
if (SunJSSE.isFIPS()) {
@@ -1157,7 +1139,7 @@
supportedProtocols = Arrays.asList(
ProtocolVersion.TLS13,
ProtocolVersion.TLS12,
-@@ -553,6 +571,7 @@
+@@ -553,6 +571,7 @@ public abstract class SSLContextImpl extends SSLContextSpi
{
ProtocolVersion.TLS11,
ProtocolVersion.TLS10
});
@@ -1165,7 +1147,7 @@
} else {
supportedProtocols = Arrays.asList(
ProtocolVersion.TLS13,
-@@ -612,6 +631,16 @@
+@@ -612,6 +631,16 @@ public abstract class SSLContextImpl extends
SSLContextSpi {
static ProtocolVersion[] getSupportedProtocols() {
if (SunJSSE.isFIPS()) {
@@ -1182,7 +1164,7 @@
return new ProtocolVersion[] {
ProtocolVersion.TLS13,
ProtocolVersion.TLS12,
-@@ -939,6 +968,16 @@
+@@ -939,6 +968,16 @@ public abstract class SSLContextImpl extends
SSLContextSpi {
static ProtocolVersion[] getProtocols() {
if (SunJSSE.isFIPS()) {
@@ -1197,11 +1179,13 @@
+ };
+ }
return new ProtocolVersion[]{
+ ProtocolVersion.TLS13,
ProtocolVersion.TLS12,
- ProtocolVersion.TLS11,
---- openjdk/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
2022-02-08 15:00:17.156853408 +0100
-+++ openjdk/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
2022-02-08 15:00:30.568949614 +0100
-@@ -30,6 +30,8 @@
+diff --git a/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
b/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
+index 2845dc3793..d605726010 100644
+--- a/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
++++ b/jdk/src/share/classes/sun/security/ssl/SunJSSE.java
+@@ -30,6 +30,8 @@ import static
sun.security.util.SecurityConstants.PROVIDER_VER;
import java.security.*;
@@ -1210,7 +1194,7 @@
/**
* The JSSE provider.
*
-@@ -215,8 +217,13 @@
+@@ -215,8 +217,13 @@ public abstract class SunJSSE extends
java.security.Provider {
"sun.security.ssl.SSLContextImpl$TLS11Context");
put("SSLContext.TLSv1.2",
"sun.security.ssl.SSLContextImpl$TLS12Context");
@@ -1224,12 +1208,15 @@
put("SSLContext.TLS",
"sun.security.ssl.SSLContextImpl$TLSContext");
if (isfips == false) {
---- openjdk/jdk/src/share/lib/security/java.security-linux 2022-02-08
15:00:17.300854441 +0100
-+++ openjdk/jdk/src/share/lib/security/java.security-linux 2022-02-08
15:00:30.568949614 +0100
-@@ -80,6 +80,14 @@
- #security.provider.10=sun.security.pkcs11.SunPKCS11
${java.home}/lib/security/nss.cfg
+diff --git a/jdk/src/share/lib/security/java.security-linux
b/jdk/src/share/lib/security/java.security-linux
+index 2f9e0348e2..e8db1101c0 100644
+--- a/jdk/src/share/lib/security/java.security-linux
++++ b/jdk/src/share/lib/security/java.security-linux
+@@ -75,6 +75,14 @@ security.provider.7=com.sun.security.sasl.Provider
+ security.provider.8=org.jcp.xml.dsig.internal.dom.XMLDSigRI
+ security.provider.9=sun.security.smartcardio.SunPCSC
- #
++#
+# Security providers used when global crypto-policies are set to FIPS.
+#
+fips.provider.1=sun.security.pkcs11.SunPKCS11
${java.home}/lib/security/nss.fips.cfg
@@ -1237,24 +1224,40 @@
+fips.provider.3=sun.security.ec.SunEC
+fips.provider.4=com.sun.net.ssl.internal.ssl.Provider SunPKCS11-NSS-FIPS
+
-+#
+ #
# Sun Provider SecureRandom seed source.
#
- # Select the primary source of seed data for the "SHA1PRNG" and
-@@ -175,6 +183,11 @@
+@@ -170,6 +178,11 @@ policy.ignoreIdentityScope=false
+ #
keystore.type=jks
- #
++#
+# Default keystore type used when global crypto-policies are set to FIPS.
+#
+fips.keystore.type=PKCS11
+
-+#
+ #
# Controls compatibility mode for the JKS keystore type.
#
- # When set to 'true', the JKS keystore type supports loading
---- openjdk/jdk/src/solaris/native/java/security/systemconf.c 1970-01-01
01:00:00.000000000 +0100
-+++ openjdk/jdk/src/solaris/native/java/security/systemconf.c 2022-02-08
15:00:30.568949614 +0100
+@@ -291,6 +304,13 @@ package.definition=sun.,\
+ #
+ security.overridePropertiesFile=true
+
++#
++# Determines whether this properties file will be appended to
++# using the system properties file stored at
++# /etc/crypto-policies/back-ends/java.config
++#
++security.useSystemPropertiesFile=true
++
+ #
+ # Determines the default key and trust manager factory algorithms for
+ # the javax.net.ssl package.
+diff --git a/jdk/src/solaris/native/java/security/systemconf.c
b/jdk/src/solaris/native/java/security/systemconf.c
+new file mode 100644
+index 0000000000..34d0ff0ce9
+--- /dev/null
++++ b/jdk/src/solaris/native/java/security/systemconf.c
@@ -0,0 +1,170 @@
+/*
+ * Copyright (c) 2021, Red Hat, Inc.
++++++ improved-font-rendering.patch ++++++
++++ 1154 lines (skipped)
++++++ java-40y.patch ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:11.276209503 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:11.286209921 +0100
@@ -1,19 +1,7 @@
-# Widen the currency cut-over sanity check from 10 to 40 years
-#
-# GenerateCurrencyData rejects any special-case cut-over time that is more
-# than 10 years away from the current time. That guard is about catching
-# typos in CurrencyData.properties, but it also makes the build fail when it
-# is run with a clock far from the data's epoch - which is what happens when
-# testing reproducibility with a shifted clock, and will happen anyway as
-# the data ages.
-#
-# Same change as java-40y.patch carries for java-17-openjdk.
-#
-
-diff --git
a/openjdk/jdk/make/src/classes/build/tools/generatecurrencydata/GenerateCurrencyData.java
b/openjdk/jdk/make/src/classes/build/tools/generatecurrencydata/GenerateCurrencyData.java
-index d599d9744fd..b544701fe66 100644
----
a/openjdk/jdk/make/src/classes/build/tools/generatecurrencydata/GenerateCurrencyData.java
-+++
b/openjdk/jdk/make/src/classes/build/tools/generatecurrencydata/GenerateCurrencyData.java
+diff --git
a/jdk/make/src/classes/build/tools/generatecurrencydata/GenerateCurrencyData.java
b/jdk/make/src/classes/build/tools/generatecurrencydata/GenerateCurrencyData.java
+index d599d9744f..b544701fe6 100644
+---
a/jdk/make/src/classes/build/tools/generatecurrencydata/GenerateCurrencyData.java
++++
b/jdk/make/src/classes/build/tools/generatecurrencydata/GenerateCurrencyData.java
@@ -283,8 +283,8 @@ public class GenerateCurrencyData {
checkCurrencyCode(newCurrency);
String timeString = currencyInfo.substring(4, length - 4);
++++++ java-atk-wrapper-security.patch ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:11.308210842 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:11.312211009 +0100
@@ -1,6 +1,8 @@
---- openjdk/jdk/src/share/lib/security/java.security-linux 2014-07-15
23:08:27.000000000 +0200
-+++ openjdk/jdk/src/share/lib/security/java.security-linux 2014-07-18
09:04:45.127566697 +0200
-@@ -227,7 +227,9 @@
+diff --git a/jdk/src/share/lib/security/java.security-linux
b/jdk/src/share/lib/security/java.security-linux
+index 63b0ff9e73..2f9e0348e2 100644
+--- a/jdk/src/share/lib/security/java.security-linux
++++ b/jdk/src/share/lib/security/java.security-linux
+@@ -226,7 +226,9 @@ package.access=sun.,\
com.sun.activation.registries.,\
jdk.jfr.events.,\
jdk.jfr.internal.,\
@@ -11,7 +13,7 @@
#
# List of comma-separated packages that start with or equal this string
-@@ -280,7 +282,9 @@
+@@ -279,7 +281,9 @@ package.definition=sun.,\
com.sun.activation.registries.,\
jdk.jfr.events.,\
jdk.jfr.internal.,\
++++++ jconsole.desktop.in ++++++
[Desktop Entry]
Name=OpenJDK @VERSION@ Monitoring & Management Console
GenericName=OpenJDK Monitoring & Management Console
Comment=Monitor and manage OpenJDK applications
Exec=@JAVA_HOME@/bin/jconsole
Icon=java-@VERSION@-openjdk
Terminal=false
Type=Application
StartupWMClass=sun-tools-jconsole-JConsole
Categories=Development;Profiling;Java;
Version=1.0
++++++ keytool-systemlineendings.patch ++++++
diff --git a/jdk/src/share/classes/sun/security/pkcs10/PKCS10.java
b/jdk/src/share/classes/sun/security/pkcs10/PKCS10.java
index 9698c18cf1..b079e7f4d4 100644
--- a/jdk/src/share/classes/sun/security/pkcs10/PKCS10.java
+++ b/jdk/src/share/classes/sun/security/pkcs10/PKCS10.java
@@ -30,11 +30,13 @@ import java.io.PrintStream;
import java.io.IOException;
import java.math.BigInteger;
+import java.security.AccessController;
import java.security.cert.CertificateException;
import java.security.*;
import java.util.Base64;
+import sun.security.action.GetPropertyAction;
import sun.security.util.*;
import sun.security.x509.AlgorithmId;
import sun.security.x509.X509Key;
@@ -74,6 +76,14 @@ import sun.security.util.SignatureUtil;
* @author Hemma Prafullchandra
*/
public class PKCS10 {
+
+ private static final byte[] sysLineEndings;
+
+ static {
+ sysLineEndings =
+ AccessController.doPrivileged(new
GetPropertyAction("line.separator")).getBytes();
+ }
+
/**
* Constructs an unsigned PKCS #10 certificate request. Before this
* request may be used, it must be encoded and signed. Then it
@@ -303,13 +313,39 @@ public class PKCS10 {
*/
public void print(PrintStream out)
throws IOException, SignatureException {
+ print(out, false);
+ }
+
+ /**
+ * Prints an E-Mailable version of the certificate request on the print
+ * stream passed. The format is a common base64 encoded one, supported
+ * by most Certificate Authorities because Netscape web servers have
+ * used this for some time. Some certificate authorities expect some
+ * more information, in particular contact information for the web
+ * server administrator.
+ *
+ * @param out the print stream where the certificate request
+ * will be printed.
+ * @param systemLineEndings true if the request should be terminated
+ * using the system line endings.
+ * @exception IOException when an output operation failed
+ * @exception SignatureException when the certificate request was
+ * not yet signed.
+ */
+ public void print(PrintStream out, boolean systemLineEndings)
+ throws IOException, SignatureException {
+ byte[] lineEndings;
+
if (encoded == null)
throw new SignatureException("Cert request was not signed");
+ if (systemLineEndings)
+ lineEndings = sysLineEndings;
+ else
+ lineEndings = new byte[] {'\r', '\n'}; // CRLF
- byte[] CRLF = new byte[] {'\r', '\n'};
out.println("-----BEGIN NEW CERTIFICATE REQUEST-----");
- out.println(Base64.getMimeEncoder(64, CRLF).encodeToString(encoded));
+ out.println(Base64.getMimeEncoder(64,
lineEndings).encodeToString(encoded));
out.println("-----END NEW CERTIFICATE REQUEST-----");
}
diff --git a/jdk/src/share/classes/sun/security/tools/keytool/Main.java
b/jdk/src/share/classes/sun/security/tools/keytool/Main.java
index 9c04e60589..3518b0eb89 100644
--- a/jdk/src/share/classes/sun/security/tools/keytool/Main.java
+++ b/jdk/src/share/classes/sun/security/tools/keytool/Main.java
@@ -131,6 +131,7 @@ public final class Main {
private String infilename = null;
private String outfilename = null;
private String srcksfname = null;
+ private boolean systemLineEndings = false;
// User-specified providers are added before any command is called.
// However, they are not removed before the end of the main() method.
@@ -198,7 +199,7 @@ public final class Main {
CERTREQ("Generates.a.certificate.request",
ALIAS, SIGALG, FILEOUT, KEYPASS, KEYSTORE, DNAME,
STOREPASS, STORETYPE, PROVIDERNAME, PROVIDERCLASS,
- PROVIDERARG, PROVIDERPATH, V, PROTECTED),
+ PROVIDERARG, PROVIDERPATH, SYSTEMLINEENDINGS, V, PROTECTED),
CHANGEALIAS("Changes.an.entry.s.alias",
ALIAS, DESTALIAS, KEYPASS, KEYSTORE, STOREPASS,
STORETYPE, PROVIDERNAME, PROVIDERCLASS, PROVIDERARG,
@@ -331,6 +332,7 @@ public final class Main {
STARTDATE("startdate", "<startdate>",
"certificate.validity.start.date.time"),
STOREPASS("storepass", "<arg>", "keystore.password"),
STORETYPE("storetype", "<storetype>", "keystore.type"),
+ SYSTEMLINEENDINGS("systemlineendings", null, "system.line.endings"),
TRUSTCACERTS("trustcacerts", null, "trust.certificates.from.cacerts"),
V("v", null, "verbose.output"),
VALIDITY("validity", "<valDays>", "validity.number.of.days");
@@ -571,6 +573,8 @@ public final class Main {
protectedPath = true;
} else if (collator.compare(flags, "-srcprotected") == 0) {
srcprotectedPath = true;
+ } else if (collator.compare(flags, "-systemlineendings") == 0) {
+ systemLineEndings = true;
} else {
System.err.println(rb.getString("Illegal.option.") + flags);
tinyHelp();
@@ -1488,7 +1492,7 @@ public final class Main {
// Sign the request and base-64 encode it
request.encodeAndSign(subject, signature);
- request.print(out);
+ request.print(out, systemLineEndings);
checkWeak(rb.getString("the.generated.certificate.request"), request);
}
@@ -4617,4 +4621,3 @@ class Pair<A, B> {
return new Pair<>(a,b);
}
}
-
diff --git a/jdk/src/share/classes/sun/security/tools/keytool/Resources.java
b/jdk/src/share/classes/sun/security/tools/keytool/Resources.java
index d3955359d9..4649ef8b16 100644
--- a/jdk/src/share/classes/sun/security/tools/keytool/Resources.java
+++ b/jdk/src/share/classes/sun/security/tools/keytool/Resources.java
@@ -168,6 +168,8 @@ public class Resources extends java.util.ListResourceBundle
{
"keystore password"}, //-storepass
{"keystore.type",
"keystore type"}, //-storetype
+ {"system.line.endings",
+ "use system line endings rather than CRLF to terminate
output"}, //-systemlineendings
{"trust.certificates.from.cacerts",
"trust certificates from cacerts"}, //-trustcacerts
{"verbose.output",
++++++ make-jobserver-detection.patch ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:11.370213435 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:11.373213561 +0100
@@ -1,7 +1,7 @@
-Index: openjdk/make/MakeHelpers.gmk
-===================================================================
---- openjdk/make/MakeHelpers.gmk.orig
-+++ openjdk/make/MakeHelpers.gmk
+diff --git a/make/MakeHelpers.gmk b/make/MakeHelpers.gmk
+index c999535555..6efb364566 100644
+--- a/make/MakeHelpers.gmk
++++ b/make/MakeHelpers.gmk
@@ -145,7 +145,7 @@ endef
# Hook to be called as the very first thing when running a normal build
++++++ multiple-pkcs11-library-init.patch ++++++
diff --git a/jdk/src/share/classes/sun/security/pkcs11/Config.java
b/jdk/src/share/classes/sun/security/pkcs11/Config.java
index 60ca2b3dca..b38f32be65 100644
--- a/jdk/src/share/classes/sun/security/pkcs11/Config.java
+++ b/jdk/src/share/classes/sun/security/pkcs11/Config.java
@@ -53,6 +53,7 @@ final class Config {
static final int ERR_HALT = 1;
static final int ERR_IGNORE_ALL = 2;
static final int ERR_IGNORE_LIB = 3;
+ static final int ERR_IGNORE_MULTI_INIT = 4;
// same as allowSingleThreadedModules but controlled via a system property
// and applied to all providers. if set to false, no SunPKCS11 instances
@@ -1002,6 +1003,8 @@ final class Config {
handleStartupErrors = ERR_IGNORE_LIB;
} else if (val.equals("halt")) {
handleStartupErrors = ERR_HALT;
+ } else if (val.equals("ignoreMultipleInitialisation")) {
+ handleStartupErrors = ERR_IGNORE_MULTI_INIT;
} else {
throw excToken("Invalid value for handleStartupErrors:");
}
diff --git a/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
b/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
index fedcd7743e..27aaa5a2df 100644
--- a/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
+++ b/jdk/src/share/classes/sun/security/pkcs11/SunPKCS11.java
@@ -168,26 +168,37 @@ public final class SunPKCS11 extends AuthProvider {
String nssLibraryDirectory = config.getNssLibraryDirectory();
String nssSecmodDirectory = config.getNssSecmodDirectory();
boolean nssOptimizeSpace = config.getNssOptimizeSpace();
+ int errorHandling = config.getHandleStartupErrors();
if (secmod.isInitialized()) {
if (nssSecmodDirectory != null) {
String s = secmod.getConfigDir();
if ((s != null) &&
(s.equals(nssSecmodDirectory) == false)) {
- throw new ProviderException("Secmod directory "
- + nssSecmodDirectory
- + " invalid, NSS already initialized with "
- + s);
+ String msg = "Secmod directory " +
nssSecmodDirectory
+ + " invalid, NSS already initialized with " +
s;
+ if (errorHandling == Config.ERR_IGNORE_MULTI_INIT
||
+ errorHandling == Config.ERR_IGNORE_ALL) {
+ throw new UnsupportedOperationException(msg);
+ } else {
+ throw new ProviderException(msg);
+ }
}
}
if (nssLibraryDirectory != null) {
String s = secmod.getLibDir();
if ((s != null) &&
(s.equals(nssLibraryDirectory) == false)) {
- throw new ProviderException("NSS library directory
"
+ String msg = "NSS library directory "
+ nssLibraryDirectory
+ " invalid, NSS already initialized with "
- + s);
+ + s;
+ if (errorHandling == Config.ERR_IGNORE_MULTI_INIT
||
+ errorHandling == Config.ERR_IGNORE_ALL) {
+ throw new UnsupportedOperationException(msg);
+ } else {
+ throw new ProviderException(msg);
+ }
}
}
} else {
++++++ nss.cfg.in ++++++
name = NSS
nssLibraryDirectory = @NSS_LIBDIR@
nssDbMode = noDb
attributes = compatibility
handleStartupErrors = ignoreMultipleInitialisation
++++++ policytool.desktop.in ++++++
[Desktop Entry]
Name=OpenJDK @VERSION@ Policy Tool
GenericName=OpenJDK Policy Tool
Comment=Manage OpenJDK policy files
Exec=@JAVA_HOME@/jre/bin/policytool
Icon=java-@VERSION@-openjdk
Terminal=false
Type=Application
StartupWMClass=sun-security-tools-PolicyTool
Categories=System;DesktopSettings;Security;Java;
Version=1.0
++++++ ppc-zero-hotspot.patch ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:11.472217702 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:11.482218120 +0100
@@ -1,6 +1,7 @@
-diff -up openjdk/hotspot/src/os_cpu/linux_zero/vm/globals_linux_zero.hpp.ppc64
openjdk/hotspot/src/os_cpu/linux_zero/vm/globals_linux_zero.hpp
---- openjdk/hotspot/src/os_cpu/linux_zero/vm/globals_linux_zero.hpp.ppc64
2013-02-22 19:02:06.000000000 +0100
-+++ openjdk/hotspot/src/os_cpu/linux_zero/vm/globals_linux_zero.hpp
2013-04-18 16:21:24.897403406 +0200
+diff --git a/hotspot/src/os_cpu/linux_zero/vm/globals_linux_zero.hpp
b/hotspot/src/os_cpu/linux_zero/vm/globals_linux_zero.hpp
+index 663f0ac45c..bfa6c7828f 100644
+--- a/hotspot/src/os_cpu/linux_zero/vm/globals_linux_zero.hpp
++++ b/hotspot/src/os_cpu/linux_zero/vm/globals_linux_zero.hpp
@@ -32,11 +32,15 @@
//
++++++ reproducible-classuse-order.patch ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:11.509219250 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:11.513219417 +0100
@@ -1,34 +1,8 @@
-# Give the javadoc class-use tables a total ordering
-#
-# ClassUseWriter.pkgDivide sorts each list of uses with Collections.sort, i.e.
-# by Doc.compareTo, whose key is the member's own name plus its signature
-# (ExecutableMemberDocImpl.generateKey). The declaring class is not part of
-# that key, so every _Dyn*Stub.get_val() in org.omg.DynamicAny has the
-# identical key "get_val()", all the comparisons return 0, and the stable sort
-# leaves those rows in the order they were inserted.
-#
-# That insertion order is the order of RootDoc.classes(), which comes from the
-# package Scope and ultimately from the order javac's file manager listed the
-# source directory, so it varies between builds. Thirteen class-use pages
-# differed between two builds this way - the same rows, rotated.
-#
-# Break the tie on the qualified name, which does include the declaring class.
-# Entries that already compared unequal keep their position, so nothing else in
-# the generated documentation moves. IndexBuilder.DocComparator already breaks
-# its ties the same way, which is why the index pages were unaffected.
-#
-# JDK-8039410 fixed this upstream in 9 by routing the sort through
-# Util.makeComparatorForClassUse(); that change also rewrites IndexBuilder and
-# adds 160 lines of comparator plumbing to Util.java, none of which JDK 8
needs.
-#
-# Diffed against the icedtea8 drop rather than exported from the jdk8u tree:
-# icedtea's langtools has a newer ClassUseWriter.java than jdk8u492-ga, so a
-# patch generated from git does not apply here.
-#
-
----
a/openjdk/langtools/src/share/classes/com/sun/tools/doclets/formats/html/ClassUseWriter.java
2026-07-29 21:17:30.204172822 +0200
-+++
b/openjdk/langtools/src/share/classes/com/sun/tools/doclets/formats/html/ClassUseWriter.java
2026-07-29 21:17:41.462022551 +0200
-@@ -28,6 +28,7 @@
+diff --git
a/langtools/src/share/classes/com/sun/tools/doclets/formats/html/ClassUseWriter.java
b/langtools/src/share/classes/com/sun/tools/doclets/formats/html/ClassUseWriter.java
+index 75bc023fd9..d96b985c8b 100644
+---
a/langtools/src/share/classes/com/sun/tools/doclets/formats/html/ClassUseWriter.java
++++
b/langtools/src/share/classes/com/sun/tools/doclets/formats/html/ClassUseWriter.java
+@@ -28,6 +28,7 @@ package com.sun.tools.doclets.formats.html;
import java.io.IOException;
import java.util.ArrayList;
import java.util.Collections;
@@ -36,7 +10,7 @@
import java.util.HashMap;
import java.util.Iterator;
import java.util.List;
-@@ -176,11 +177,22 @@
+@@ -178,11 +179,22 @@ public class ClassUseWriter extends
SubWriterHolderWriter {
}
}
@@ -57,7 +31,7 @@
if (list != null) {
- Collections.sort(list);
+ Collections.sort(list, useComparator);
- for (ProgramElementDoc doc : list) {
- PackageDoc pkg = doc.containingPackage();
- pkgSet.add(pkg);
+ Iterator<? extends ProgramElementDoc> it = list.iterator();
+ while (it.hasNext()) {
+ ProgramElementDoc doc = it.next();
++++++ reproducible-copyright-year.patch ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:11.529220086 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:11.534220295 +0100
@@ -1,23 +1,7 @@
-# Derive the copyright year from SOURCE_DATE_EPOCH
-#
-# configure takes COPYRIGHT_YEAR from the wall clock unless
-# --with-copyright-year is given. That year is substituted into the bottom
-# line of every generated javadoc page (make/Javadoc.gmk CopyrightLine), so
-# two builds that straddle New Year produce a different javadoc bundle in
-# its entirety - which is what the whole -javadoc subpackage differing came
-# down to.
-#
-# Honour SOURCE_DATE_EPOCH when it is set and no explicit year was asked
-# for, which is what later releases do via JDK-8282567.
-#
-# The spec re-runs openjdk/common/autoconf/autogen.sh after applying the
-# patches, so generated-configure.sh does not need patching too.
-#
-
-diff --git a/openjdk/common/autoconf/jdk-options.m4
b/openjdk/common/autoconf/jdk-options.m4
-index 18ba585209b..bd1bf7bd549 100644
---- a/openjdk/common/autoconf/jdk-options.m4
-+++ b/openjdk/common/autoconf/jdk-options.m4
+diff --git a/common/autoconf/jdk-options.m4 b/common/autoconf/jdk-options.m4
+index 18ba585209..bd1bf7bd54 100644
+--- a/common/autoconf/jdk-options.m4
++++ b/common/autoconf/jdk-options.m4
@@ -596,6 +596,16 @@ AC_DEFUN_ONCE([JDKOPT_SETUP_JDK_VERSION_NUMBERS],
AC_MSG_ERROR([Copyright year must have a value])
elif test "x$with_copyright_year" != x; then
++++++ reproducible-directory-mtime.patch ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:11.550220964 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:11.557221257 +0100
@@ -1,6 +1,8 @@
---- openjdk/jdk/src/share/classes/java/io/File.java 2024-10-07
14:14:13.587124931 +0200
-+++ openjdk/jdk/src/share/classes/java/io/File.java 2024-10-07
14:15:27.187669663 +0200
-@@ -1352,7 +1352,11 @@
+diff --git a/jdk/src/share/classes/java/io/File.java
b/jdk/src/share/classes/java/io/File.java
+index 24fb1c92c2..6f53905937 100644
+--- a/jdk/src/share/classes/java/io/File.java
++++ b/jdk/src/share/classes/java/io/File.java
+@@ -1352,7 +1352,11 @@ public class File
if (isInvalid()) {
return false;
}
++++++ reproducible-generated-source-dates.patch ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:11.579222178 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:11.582222303 +0100
@@ -1,30 +1,7 @@
-# Use SOURCE_DATE_EPOCH for dates written into generated sources
-#
-# Three build tools stamp the current date into the sources they generate, so
-# the result depends on when the build runs, and all three end up in the
-# shipped src.zip.
-#
-# - CopyrightHeaders.getYear() in the CLDR converter used the current year,
-# which puts "Copyright (c) 2012, 2026" into one build and "2012, 2027"
-# into the next.
-#
-# - GenerateCharacter wrote "This file was generated AUTOMATICALLY from a
-# template file <full timestamp>" into the CharacterData*.java files.
-#
-# - EquivMapsGenerator did the same as the CLDR converter for the copyright
-# header of sun/util/locale/LocaleEquivalentMaps.java.
-#
-# Take the date from SOURCE_DATE_EPOCH when it is set, and keep the current
-# time otherwise. The year is still computed in America/Los_Angeles, as
-# before, so only the instant changes.
-#
-# Backported from the same fix made for java-11-openjdk.
-#
-
-diff --git
a/openjdk/jdk/make/src/classes/build/tools/cldrconverter/CopyrightHeaders.java
b/openjdk/jdk/make/src/classes/build/tools/cldrconverter/CopyrightHeaders.java
-index 1ea0186bc03..7c349ec0c07 100644
----
a/openjdk/jdk/make/src/classes/build/tools/cldrconverter/CopyrightHeaders.java
-+++
b/openjdk/jdk/make/src/classes/build/tools/cldrconverter/CopyrightHeaders.java
+diff --git
a/jdk/make/src/classes/build/tools/cldrconverter/CopyrightHeaders.java
b/jdk/make/src/classes/build/tools/cldrconverter/CopyrightHeaders.java
+index 1ea0186bc0..7c349ec0c0 100644
+--- a/jdk/make/src/classes/build/tools/cldrconverter/CopyrightHeaders.java
++++ b/jdk/make/src/classes/build/tools/cldrconverter/CopyrightHeaders.java
@@ -145,8 +145,17 @@ class CopyrightHeaders {
}
@@ -45,10 +22,10 @@
}
// no instantiation
-diff --git
a/openjdk/jdk/make/src/classes/build/tools/generatecharacter/GenerateCharacter.java
b/openjdk/jdk/make/src/classes/build/tools/generatecharacter/GenerateCharacter.java
-index 83973ef07c4..dbc4230fb51 100644
----
a/openjdk/jdk/make/src/classes/build/tools/generatecharacter/GenerateCharacter.java
-+++
b/openjdk/jdk/make/src/classes/build/tools/generatecharacter/GenerateCharacter.java
+diff --git
a/jdk/make/src/classes/build/tools/generatecharacter/GenerateCharacter.java
b/jdk/make/src/classes/build/tools/generatecharacter/GenerateCharacter.java
+index 83973ef07c..dbc4230fb5 100644
+--- a/jdk/make/src/classes/build/tools/generatecharacter/GenerateCharacter.java
++++ b/jdk/make/src/classes/build/tools/generatecharacter/GenerateCharacter.java
@@ -686,6 +686,17 @@ OUTER: for (int i = 0; i < n; i += m) {
* @see GenerateCharacter#replaceCommand
*/
@@ -76,10 +53,10 @@
int marklen = commandMarker.length();
LOOP: while(true) {
try {
-diff --git
a/openjdk/jdk/make/src/classes/build/tools/generatelsrequivmaps/EquivMapsGenerator.java
b/openjdk/jdk/make/src/classes/build/tools/generatelsrequivmaps/EquivMapsGenerator.java
-index ba83f92a183..7e732752697 100644
----
a/openjdk/jdk/make/src/classes/build/tools/generatelsrequivmaps/EquivMapsGenerator.java
-+++
b/openjdk/jdk/make/src/classes/build/tools/generatelsrequivmaps/EquivMapsGenerator.java
+diff --git
a/jdk/make/src/classes/build/tools/generatelsrequivmaps/EquivMapsGenerator.java
b/jdk/make/src/classes/build/tools/generatelsrequivmaps/EquivMapsGenerator.java
+index ba83f92a18..7e73275269 100644
+---
a/jdk/make/src/classes/build/tools/generatelsrequivmaps/EquivMapsGenerator.java
++++
b/jdk/make/src/classes/build/tools/generatelsrequivmaps/EquivMapsGenerator.java
@@ -226,9 +226,16 @@ public class EquivMapsGenerator {
+ "}";
++++++ reproducible-generated-timestamps.patch ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:11.603223181 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:11.609223432 +0100
@@ -1,28 +1,7 @@
-# Drop build timestamps from generated javadoc and CORBA output
-#
-# Three more places stamp the wall clock into shipped files:
-#
-# - HtmlDocletWriter emits <meta name="date" content="..."> into every
-# javadoc page. This is the same concern as the "Generated by javadoc"
-# comment that reproducible-javadoc-timestamp.patch already suppresses,
-# so suppress it the same way, when SOURCE_DATE_EPOCH is set. On its own
-# it accounted for all 11969 differing HTML files.
-#
-# - MC.java writes "Generated from input file <f> on <date>" into the CORBA
-# log wrapper sources.
-#
-# - The IDL compiler writes the generation time into the prolog of every
-# file it generates.
-#
-# The two CORBA generators just drop the date; it carries no information the
-# build does not already have, and both feed src.zip - 525 of its entries
-# differed between two builds because of them.
-#
-
-diff --git
a/openjdk/corba/src/share/classes/com/sun/tools/corba/se/idl/toJavaPortable/Util.java
b/openjdk/corba/src/share/classes/com/sun/tools/corba/se/idl/toJavaPortable/Util.java
-index 7e0d8373dab..e271bf7820e 100644
----
a/openjdk/corba/src/share/classes/com/sun/tools/corba/se/idl/toJavaPortable/Util.java
-+++
b/openjdk/corba/src/share/classes/com/sun/tools/corba/se/idl/toJavaPortable/Util.java
+diff --git
a/corba/src/share/classes/com/sun/tools/corba/se/idl/toJavaPortable/Util.java
b/corba/src/share/classes/com/sun/tools/corba/se/idl/toJavaPortable/Util.java
+index 7e0d8373da..e271bf7820 100644
+---
a/corba/src/share/classes/com/sun/tools/corba/se/idl/toJavaPortable/Util.java
++++
b/corba/src/share/classes/com/sun/tools/corba/se/idl/toJavaPortable/Util.java
@@ -68,11 +68,8 @@ package com.sun.tools.corba.se.idl.toJavaPortable;
import java.io.File;
import java.io.PrintWriter;
@@ -62,10 +41,10 @@
stream.println ("*/");
stream.println ();
} // writeProlog
-diff --git
a/openjdk/corba/src/share/classes/com/sun/tools/corba/se/logutil/MC.java
b/openjdk/corba/src/share/classes/com/sun/tools/corba/se/logutil/MC.java
-index b2fd98a5205..007827f5e05 100644
---- a/openjdk/corba/src/share/classes/com/sun/tools/corba/se/logutil/MC.java
-+++ b/openjdk/corba/src/share/classes/com/sun/tools/corba/se/logutil/MC.java
+diff --git a/corba/src/share/classes/com/sun/tools/corba/se/logutil/MC.java
b/corba/src/share/classes/com/sun/tools/corba/se/logutil/MC.java
+index b2fd98a520..007827f5e0 100644
+--- a/corba/src/share/classes/com/sun/tools/corba/se/logutil/MC.java
++++ b/corba/src/share/classes/com/sun/tools/corba/se/logutil/MC.java
@@ -30,7 +30,6 @@ import java.io.FileOutputStream;
import java.io.IOException;
@@ -83,10 +62,10 @@
pw.println();
}
-diff --git
a/openjdk/langtools/src/share/classes/com/sun/tools/doclets/formats/html/HtmlDocletWriter.java
b/openjdk/langtools/src/share/classes/com/sun/tools/doclets/formats/html/HtmlDocletWriter.java
-index 76229a1f7b7..baa1cd37659 100644
----
a/openjdk/langtools/src/share/classes/com/sun/tools/doclets/formats/html/HtmlDocletWriter.java
-+++
b/openjdk/langtools/src/share/classes/com/sun/tools/doclets/formats/html/HtmlDocletWriter.java
+diff --git
a/langtools/src/share/classes/com/sun/tools/doclets/formats/html/HtmlDocletWriter.java
b/langtools/src/share/classes/com/sun/tools/doclets/formats/html/HtmlDocletWriter.java
+index 76229a1f7b..baa1cd3765 100644
+---
a/langtools/src/share/classes/com/sun/tools/doclets/formats/html/HtmlDocletWriter.java
++++
b/langtools/src/share/classes/com/sun/tools/doclets/formats/html/HtmlDocletWriter.java
@@ -400,7 +400,7 @@ public class HtmlDocletWriter extends HtmlDocWriter {
head.addContent(meta);
}
++++++ reproducible-javadoc-timestamp.patch ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:11.628224227 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:11.632224394 +0100
@@ -1,6 +1,8 @@
----
openjdk/langtools/src/share/classes/com/sun/tools/doclets/formats/html/markup/HtmlDocWriter.java
2024-10-07 14:14:13.353789871 +0200
-+++
openjdk/langtools/src/share/classes/com/sun/tools/doclets/formats/html/markup/HtmlDocWriter.java
2024-10-07 14:27:56.233184616 +0200
-@@ -328,7 +328,7 @@
+diff --git
a/langtools/src/share/classes/com/sun/tools/doclets/formats/html/markup/HtmlDocWriter.java
b/langtools/src/share/classes/com/sun/tools/doclets/formats/html/markup/HtmlDocWriter.java
+index 1ddf6e67b0..e3fbb7927d 100644
+---
a/langtools/src/share/classes/com/sun/tools/doclets/formats/html/markup/HtmlDocWriter.java
++++
b/langtools/src/share/classes/com/sun/tools/doclets/formats/html/markup/HtmlDocWriter.java
+@@ -328,7 +328,7 @@ public abstract class HtmlDocWriter extends HtmlWriter {
protected Comment getGeneratedBy(boolean timestamp) {
String text = "Generated by javadoc"; // marker string, deliberately
not localized
++++++ reproducible-properties.patch ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:11.653225273 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:11.659225524 +0100
@@ -1,6 +1,8 @@
---- openjdk/jdk/src/share/classes/java/util/Properties.java 2024-10-07
14:14:13.617125153 +0200
-+++ openjdk/jdk/src/share/classes/java/util/Properties.java 2024-10-07
14:35:53.223317114 +0200
-@@ -826,7 +826,12 @@
+diff --git a/jdk/src/share/classes/java/util/Properties.java
b/jdk/src/share/classes/java/util/Properties.java
+index aba5fd1a33..2a550ff1e8 100644
+--- a/jdk/src/share/classes/java/util/Properties.java
++++ b/jdk/src/share/classes/java/util/Properties.java
+@@ -826,7 +826,12 @@ class Properties extends Hashtable<Object,Object> {
if (comments != null) {
writeComments(bw, comments);
}
++++++ reproducible-zip-extra-fields.patch ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:11.678226319 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:11.682226486 +0100
@@ -1,19 +1,7 @@
-# Pass -X to zip so archives carry no access times
-#
-# SetupZipArchive builds the demo src.zip files with InfoZIP zip, which by
-# default records a "UT" extra field per entry holding the file's mtime and
-# its access time. The access time differs between builds, and
-# strip-nondeterminism does not normalise it - it only rewrites the mtime,
-# which is why two demo src.zip files still differed after everything else
-# had been fixed.
-#
-# -X drops the extra attributes entirely.
-#
-
-diff --git a/openjdk/make/common/JavaCompilation.gmk
b/openjdk/make/common/JavaCompilation.gmk
-index bc34720245e..ba46b2b0c52 100644
---- a/openjdk/make/common/JavaCompilation.gmk
-+++ b/openjdk/make/common/JavaCompilation.gmk
+diff --git a/make/common/JavaCompilation.gmk b/make/common/JavaCompilation.gmk
+index bc34720245..ba46b2b0c5 100644
+--- a/make/common/JavaCompilation.gmk
++++ b/make/common/JavaCompilation.gmk
@@ -305,7 +305,7 @@ define SetupZipArchive
$$($1_ZIP) : $$($1_ALL_SRCS) $$($1_EXTRA_DEPS)
$(MKDIR) -p $$(@D)
++++++ riscv64-zero.patch ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:11.696227072 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:11.699227197 +0100
@@ -1,7 +1,7 @@
-Index: openjdk/common/autoconf/build-aux/autoconf-config.sub
-===================================================================
---- openjdk.orig/common/autoconf/build-aux/autoconf-config.sub
-+++ openjdk/common/autoconf/build-aux/autoconf-config.sub
+diff --git a/common/autoconf/build-aux/autoconf-config.sub
b/common/autoconf/build-aux/autoconf-config.sub
+index 1aab2b303e..662b002a12 100644
+--- a/common/autoconf/build-aux/autoconf-config.sub
++++ b/common/autoconf/build-aux/autoconf-config.sub
@@ -302,6 +302,7 @@ case $basic_machine in
| pdp10 | pdp11 | pj | pjl \
| powerpc | powerpc64 | powerpc64le | powerpcle | ppcbe \
@@ -18,11 +18,11 @@
| romp-* | rs6000-* \
| sh-* | sh[1234]-* | sh[24]a-* | sh[23]e-* | sh[34]eb-* | sheb-* |
shbe-* \
| shle-* | sh[1234]le-* | sh3ele-* | sh64-* | sh64le-* \
-Index: openjdk/hotspot/src/os/linux/vm/os_linux.cpp
-===================================================================
---- openjdk.orig/hotspot/src/os/linux/vm/os_linux.cpp
-+++ openjdk/hotspot/src/os/linux/vm/os_linux.cpp
-@@ -365,7 +365,7 @@ void os::init_system_properties_values()
+diff --git a/hotspot/src/os/linux/vm/os_linux.cpp
b/hotspot/src/os/linux/vm/os_linux.cpp
+index af900264ee..8ccc879e9d 100644
+--- a/hotspot/src/os/linux/vm/os_linux.cpp
++++ b/hotspot/src/os/linux/vm/os_linux.cpp
+@@ -364,7 +364,7 @@ void os::init_system_properties_values() {
// 1: ...
// ...
// 7: The default directories, normally /lib and /usr/lib.
++++++ system-libs.patch ++++++
++++ 1214 lines (skipped)
++++++ system-pcsclite.patch ++++++
diff --git a/jdk/make/lib/SecurityLibraries.gmk
b/jdk/make/lib/SecurityLibraries.gmk
index 23c6419bdb..39f7e46c55 100644
--- a/jdk/make/lib/SecurityLibraries.gmk
+++ b/jdk/make/lib/SecurityLibraries.gmk
@@ -64,6 +64,14 @@ BUILD_LIBRARIES += $(BUILD_LIBJAAS)
##########################################################################################
+ifeq ($(USE_EXTERNAL_PCSC), true)
+ J2PCSC_CFLAGS := -DUSE_SYSTEM_PCSC $(PCSC_CFLAGS)
+ J2PCSC_LIBS := $(PCSC_LIBS)
+else
+ J2PCSC_CFLAGS :=
-I$(JDK_TOPDIR)/src/$(OPENJDK_TARGET_OS_API_DIR)/native/sun/security/smartcardio/MUSCLE
+ J2PCSC_LIBS := $(LIBDL)
+endif
+
$(eval $(call SetupNativeCompilation,BUILD_LIBJ2PCSC, \
LIBRARY := j2pcsc, \
OUTPUT_DIR := $(INSTALL_LIBRARIES_HERE), \
@@ -72,14 +80,13 @@ $(eval $(call SetupNativeCompilation,BUILD_LIBJ2PCSC, \
LANG := C, \
CFLAGS_posix := -D__sun_jdk, \
OPTIMIZATION := LOW, \
- CFLAGS := $(CFLAGS_JDKLIB) \
+ CFLAGS := $(CFLAGS_JDKLIB) $(J2PCSC_CFLAGS) \
-I$(JDK_TOPDIR)/src/share/native/sun/security/smartcardio \
-
-I$(JDK_TOPDIR)/src/$(OPENJDK_TARGET_OS_API_DIR)/native/sun/security/smartcardio
\
-
-I$(JDK_TOPDIR)/src/$(OPENJDK_TARGET_OS_API_DIR)/native/sun/security/smartcardio/MUSCLE,
\
+
-I$(JDK_TOPDIR)/src/$(OPENJDK_TARGET_OS_API_DIR)/native/sun/security/smartcardio,
\
MAPFILE := $(JDK_TOPDIR)/make/mapfiles/libj2pcsc/mapfile-vers, \
LDFLAGS := $(LDFLAGS_JDKLIB) \
$(call SET_SHARED_LIBRARY_ORIGIN), \
- LDFLAGS_SUFFIX_posix := $(LIBDL), \
+ LDFLAGS_SUFFIX_posix := $(J2PCSC_LIBS), \
LDFLAGS_SUFFIX_windows := winscard.lib, \
LDFLAGS_SUFFIX_solaris := -lc, \
VERSIONINFO_RESOURCE := $(JDK_TOPDIR)/src/windows/resource/version.rc, \
@@ -154,6 +161,10 @@ ifneq ($(BUILD_CRYPTO), no)
BUILD_LIBKRB5_NAME := osxkrb5
BUILD_LIBKRB5_SRC := $(JDK_TOPDIR)/src/share/native/sun/security/krb5
BUILD_LIBKRB5_LIBS := -framework Kerberos
+ else ifeq ($(USE_EXTERNAL_KRB5), true)
+ BUILD_LIBKRB5_NAME := j2krb5
+ BUILD_LIBKRB5_SRC :=
$(JDK_TOPDIR)/src/$(OPENJDK_TARGET_OS_API_DIR)/native/sun/security/krb5
+ BUILD_LIBKRB5_LIBS := $(KRB5_LIBS)
endif
ifneq ($(BUILD_LIBKRB5_NAME), )
@@ -165,7 +176,7 @@ ifneq ($(BUILD_CRYPTO), no)
SRC := $(BUILD_LIBKRB5_SRC), \
LANG := C, \
OPTIMIZATION := LOW, \
- CFLAGS := $(CFLAGS_JDKLIB) \
+ CFLAGS := $(CFLAGS_JDKLIB) $(KRB5_CFLAGS) \
-I$(JDK_TOPDIR)/src/share/native/sun/security/krb5 \
-I$(JDK_TOPDIR)/src/$(OPENJDK_TARGET_OS_API_DIR)/native/sun/security/krb5, \
LDFLAGS := $(LDFLAGS_JDKLIB) \
diff --git a/jdk/src/solaris/native/sun/security/smartcardio/pcsc_md.c
b/jdk/src/solaris/native/sun/security/smartcardio/pcsc_md.c
index f344f4a00d..29d874e3e3 100644
--- a/jdk/src/solaris/native/sun/security/smartcardio/pcsc_md.c
+++ b/jdk/src/solaris/native/sun/security/smartcardio/pcsc_md.c
@@ -36,6 +36,7 @@
#include "pcsc_md.h"
+#ifndef USE_SYSTEM_PCSC
void *hModule;
FPTR_SCardEstablishContext scardEstablishContext;
FPTR_SCardConnect scardConnect;
@@ -47,6 +48,7 @@ FPTR_SCardListReaders scardListReaders;
FPTR_SCardBeginTransaction scardBeginTransaction;
FPTR_SCardEndTransaction scardEndTransaction;
FPTR_SCardControl scardControl;
+#endif
/*
* Throws a Java Exception by name
@@ -75,6 +77,7 @@ void throwIOException(JNIEnv *env, const char *msg)
throwByName(env, "java/io/IOException", msg);
}
+#ifndef USE_SYSTEM_PCSC
void *findFunction(JNIEnv *env, void *hModule, char *functionName) {
void *fAddress = dlsym(hModule, functionName);
if (fAddress == NULL) {
@@ -85,9 +88,11 @@ void *findFunction(JNIEnv *env, void *hModule, char
*functionName) {
}
return fAddress;
}
+#endif
JNIEXPORT void JNICALL Java_sun_security_smartcardio_PlatformPCSC_initialize
(JNIEnv *env, jclass thisClass, jstring jLibName) {
+#ifndef USE_SYSTEM_PCSC
const char *libName = (*env)->GetStringUTFChars(env, jLibName, NULL);
if (libName == NULL) {
throwNullPointerException(env, "PCSC library name is null");
@@ -141,4 +146,6 @@ JNIEXPORT void JNICALL
Java_sun_security_smartcardio_PlatformPCSC_initialize
#else
scardControl = (FPTR_SCardControl) findFunction(env,
hModule, "SCardControl132");
#endif // __APPLE__
+
+#endif // USE_SYSTEM_PCSC
}
diff --git a/jdk/src/solaris/native/sun/security/smartcardio/pcsc_md.h
b/jdk/src/solaris/native/sun/security/smartcardio/pcsc_md.h
index db93c9cd93..cead5f73a8 100644
--- a/jdk/src/solaris/native/sun/security/smartcardio/pcsc_md.h
+++ b/jdk/src/solaris/native/sun/security/smartcardio/pcsc_md.h
@@ -23,6 +23,8 @@
* questions.
*/
+#ifndef USE_SYSTEM_PCSC
+
typedef LONG (*FPTR_SCardEstablishContext)(DWORD dwScope,
LPCVOID pvReserved1,
LPCVOID pvReserved2,
@@ -111,3 +113,41 @@ extern FPTR_SCardListReaders scardListReaders;
extern FPTR_SCardBeginTransaction scardBeginTransaction;
extern FPTR_SCardEndTransaction scardEndTransaction;
extern FPTR_SCardControl scardControl;
+
+#else
+
+#define CALL_SCardEstablishContext(dwScope, pvReserved1, pvReserved2,
phContext) \
+ (SCardEstablishContext(dwScope, pvReserved1, pvReserved2, phContext))
+
+#define CALL_SCardConnect(hContext, szReader, dwSharedMode,
dwPreferredProtocols, phCard, pdwActiveProtocols) \
+ (SCardConnect(hContext, szReader, dwSharedMode, dwPreferredProtocols,
phCard, pdwActiveProtocols))
+
+#define CALL_SCardDisconnect(hCard, dwDisposition) \
+ (SCardDisconnect(hCard, dwDisposition))
+
+#define CALL_SCardStatus(hCard, mszReaderNames, pcchReaderLen, pdwState,
pdwProtocol, pbAtr, pcbAtrLen) \
+ (SCardStatus(hCard, mszReaderNames, pcchReaderLen, pdwState, pdwProtocol,
pbAtr, pcbAtrLen))
+
+#define CALL_SCardGetStatusChange(hContext, dwTimeout, rgReaderStates,
cReaders) \
+ (SCardGetStatusChange(hContext, dwTimeout, rgReaderStates, cReaders))
+
+#define CALL_SCardTransmit(hCard, pioSendPci, pbSendBuffer, cbSendLength, \
+ pioRecvPci, pbRecvBuffer, pcbRecvLength) \
+ (SCardTransmit(hCard, pioSendPci, pbSendBuffer, cbSendLength, \
+ pioRecvPci, pbRecvBuffer, pcbRecvLength))
+
+#define CALL_SCardListReaders(hContext, mszGroups, mszReaders, pcchReaders) \
+ (SCardListReaders(hContext, mszGroups, mszReaders, pcchReaders))
+
+#define CALL_SCardBeginTransaction(hCard) \
+ (SCardBeginTransaction(hCard))
+
+#define CALL_SCardEndTransaction(hCard, dwDisposition) \
+ (SCardEndTransaction(hCard, dwDisposition))
+
+#define CALL_SCardControl(hCard, dwControlCode, pbSendBuffer, cbSendLength, \
+ pbRecvBuffer, pcbRecvLength, lpBytesReturned) \
+ (SCardControl(hCard, dwControlCode, pbSendBuffer, cbSendLength, \
+ pbRecvBuffer, pcbRecvLength, lpBytesReturned))
+
+#endif
++++++ tls13extensions.patch ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:11.736228745 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:11.742228996 +0100
@@ -1,6 +1,8 @@
---- openjdk/jdk/src/share/classes/sun/security/ssl/SSLExtension.java
2021-05-21 08:10:00.830159018 +0200
-+++ openjdk/jdk/src/share/classes/sun/security/ssl/SSLExtension.java
2021-05-21 08:11:40.258772361 +0200
-@@ -198,7 +198,7 @@
+diff --git a/jdk/src/share/classes/sun/security/ssl/SSLExtension.java
b/jdk/src/share/classes/sun/security/ssl/SSLExtension.java
+index a4b14c0849..3cf38c8d5a 100644
+--- a/jdk/src/share/classes/sun/security/ssl/SSLExtension.java
++++ b/jdk/src/share/classes/sun/security/ssl/SSLExtension.java
+@@ -198,7 +198,7 @@ enum SSLExtension implements SSLStringizer {
CH_SIGNATURE_ALGORITHMS_CERT (0x0032, "signature_algorithms_cert",
SSLHandshake.CLIENT_HELLO,
@@ -9,7 +11,7 @@
CertSignAlgsExtension.chNetworkProducer,
CertSignAlgsExtension.chOnLoadConsumer,
null,
-@@ -319,7 +319,7 @@
+@@ -319,7 +319,7 @@ enum SSLExtension implements SSLStringizer {
CH_SUPPORTED_VERSIONS (0x002B, "supported_versions",
SSLHandshake.CLIENT_HELLO,
++++++ x11-hidpi.patch ++++++
++++ 3356 lines (skipped)
++++++ zero-javadoc-verbose.patch ++++++
--- /var/tmp/diff_new_pack.3bcg7J/_old 2026-11-10 16:30:11.771230209 +0100
+++ /var/tmp/diff_new_pack.3bcg7J/_new 2026-11-10 16:30:11.774230334 +0100
@@ -1,6 +1,8 @@
---- openjdk/make/Javadoc.gmk
-+++ openjdk/make/Javadoc.gmk
-@@ -260,7 +260,6 @@ $(call CopyrightLine,$(COPYRIGHT_URL),$(
+diff --git a/make/Javadoc.gmk b/make/Javadoc.gmk
+index f65465c31f..5bf388140c 100644
+--- a/make/Javadoc.gmk
++++ b/make/Javadoc.gmk
+@@ -270,7 +270,6 @@ Also see the <a target="_blank"
href="http://www.oracle.com/technetwork/java/red
# Common javadoc options used by all
COMMON_JAVADOCFLAGS = \
-XDignore.symbol.file=true \
