.gitignore

@@ -1,2 +1,2 @@
-SOURCES/openjdk-jdk21u-jdk-21+35.tar.xz
+SOURCES/openjdk-21.0.5+11.tar.xz
 SOURCES/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz

.java-21-openjdk.metadata

@@ -1,2 +1,2 @@
-96686100a34c1cb88947097f91769154066a5e92 SOURCES/openjdk-jdk21u-jdk-21+35.tar.xz
+369c387555e8f6d25cc248e126e910c164aa4f05 SOURCES/openjdk-21.0.5+11.tar.xz
 c8281ee37b77d535c9c1af86609a531958ff7b34 SOURCES/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz

SOURCES/fips-21u-0a42e29b391.patch

@@ -116,7 +116,7 @@ index 00000000000..f48fc7f7e80
 +  AC_SUBST(NSS_LIBDIR)
 +])
 diff --git a/make/autoconf/libraries.m4 b/make/autoconf/libraries.m4
-index a1fc81564b1..ebad69d9dcf 100644
+index 51d4f724c33..feb0bcf3e75 100644
 --- a/make/autoconf/libraries.m4
 +++ b/make/autoconf/libraries.m4
 @@ -35,6 +35,7 @@ m4_include([lib-std.m4])
@@ -127,7 +127,7 @@ index a1fc81564b1..ebad69d9dcf 100644
  
  ################################################################################
  # Determine which libraries are needed for this configuration
-@@ -134,6 +135,7 @@ AC_DEFUN_ONCE([LIB_SETUP_LIBRARIES],
+@@ -128,6 +129,7 @@ AC_DEFUN_ONCE([LIB_SETUP_LIBRARIES],
    LIB_SETUP_X11
  
    LIB_TESTS_SETUP_GTEST
@@ -136,10 +136,10 @@ index a1fc81564b1..ebad69d9dcf 100644
    BASIC_JDKLIB_LIBS=""
    BASIC_JDKLIB_LIBS_TARGET=""
 diff --git a/make/autoconf/spec.gmk.in b/make/autoconf/spec.gmk.in
-index 0f85917814e..9419562b654 100644
+index f6def153c82..4d7abc33427 100644
 --- a/make/autoconf/spec.gmk.in
 +++ b/make/autoconf/spec.gmk.in
-@@ -867,6 +867,11 @@ INSTALL_SYSCONFDIR=@sysconfdir@
+@@ -873,6 +873,11 @@ INSTALL_SYSCONFDIR=@sysconfdir@
  # Libraries
  #
  
@@ -2959,7 +2959,7 @@ index 00000000000..f8d505ca815
 +}
 \ No newline at end of file
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
-index 6b26297b1b4..7ee5e07756c 100644
+index c3b412885a6..0e7ce73b158 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Key.java
 @@ -37,6 +37,8 @@ import javax.crypto.*;
@@ -2981,20 +2981,21 @@ index 6b26297b1b4..7ee5e07756c 100644
      private static final String PUBLIC = "public";
      private static final String PRIVATE = "private";
      private static final String SECRET = "secret";
-@@ -401,8 +406,10 @@ abstract class P11Key implements Key, Length {
+@@ -401,9 +406,10 @@ abstract class P11Key implements Key, Length {
                      new CK_ATTRIBUTE(CKA_EXTRACTABLE),
          });
  
--        boolean keySensitive = (attrs[0].getBoolean() ||
--                attrs[1].getBoolean() || !attrs[2].getBoolean());
+-        boolean keySensitive =
+-                (attrs[0].getBoolean() && P11Util.isNSS(session.token)) ||
+-                attrs[1].getBoolean() || !attrs[2].getBoolean();
 +        boolean exportable = plainKeySupportEnabled && !algorithm.equals("DH");
 +        boolean keySensitive = (!exportable &&
-+            (attrs[0].getBoolean() ||
-+             attrs[1].getBoolean() || !attrs[2].getBoolean()));
++               ((attrs[0].getBoolean() && P11Util.isNSS(session.token)) ||
++                attrs[1].getBoolean() || !attrs[2].getBoolean()));
  
          return switch (algorithm) {
              case "RSA" -> P11RSAPrivateKeyInternal.of(session, keyID, algorithm,
-@@ -454,7 +461,8 @@ abstract class P11Key implements Key, Length {
+@@ -455,7 +461,8 @@ abstract class P11Key implements Key, Length {
  
          public String getFormat() {
              token.ensureValid();
@@ -3004,7 +3005,7 @@ index 6b26297b1b4..7ee5e07756c 100644
                  return null;
              } else {
                  return "RAW";
-@@ -1624,4 +1632,3 @@ final class SessionKeyRef extends PhantomReference<P11Key> {
+@@ -1625,4 +1632,3 @@ final class SessionKeyRef extends PhantomReference<P11Key> {
          this.clear();
      }
  }
@@ -3204,7 +3205,7 @@ index 5cd6828d293..bae49c4e8a9 100644
                  debug.println("logout succeeded");
              }
 diff --git a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java
-index 3378409ca1c..7602a92a252 100644
+index a6f5f0a8764..9a07c96ca4e 100644
 --- a/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java
 +++ b/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/Token.java
 @@ -33,6 +33,7 @@ import java.lang.ref.*;

SOURCES/jdk8009550-rh910107-fail_to_load_pcsc_library.patch

@@ -1,125 +0,0 @@
-commit d0523302416bc6507696f20d1068f16427bcf6b8
-Author: Andrew Hughes <gnu.andrew@redhat.com>
-Date:   Thu Aug 24 01:23:49 2023 +0100
-
-    8009550: PlatformPCSC should load versioned so
-
-diff --git a/src/java.base/share/classes/sun/security/util/Debug.java b/src/java.base/share/classes/sun/security/util/Debug.java
-index bff273c6548..e5a6b288ff8 100644
---- a/src/java.base/share/classes/sun/security/util/Debug.java
-+++ b/src/java.base/share/classes/sun/security/util/Debug.java
-@@ -81,6 +81,7 @@ public static void Help()
-         System.err.println("logincontext  login context results");
-         System.err.println("jca           JCA engine class debugging");
-         System.err.println("keystore      KeyStore debugging");
-+        System.err.println("pcsc          Smartcard library debugging");
-         System.err.println("policy        loading and granting");
-         System.err.println("provider      security provider debugging");
-         System.err.println("pkcs11        PKCS11 session manager debugging");
-diff --git a/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java b/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java
-index bacff32efbc..d9f605ada1e 100644
---- a/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java
-+++ b/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java
-@@ -1,5 +1,6 @@
- /*
-  * Copyright (c) 2005, 2021, Oracle and/or its affiliates. All rights reserved.
-+ * Copyright (c) 2023, Red Hat Inc. All rights reserved.
-  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
-  *
-  * This code is free software; you can redistribute it and/or modify it
-@@ -46,8 +47,13 @@ class PlatformPCSC {
- 
-     private static final String PROP_NAME = "sun.security.smartcardio.library";
- 
--    private static final String LIB1 = "/usr/$LIBISA/libpcsclite.so";
--    private static final String LIB2 = "/usr/local/$LIBISA/libpcsclite.so";
-+    private static final String[] LIB_TEMPLATES = { "/usr/$LIBISA/libpcsclite.so",
-+                                                    "/usr/local/$LIBISA/libpcsclite.so",
-+                                                    "/usr/lib/$ARCH-linux-gnu/libpcsclite.so",
-+                                                    "/usr/lib/arm-linux-gnueabi/libpcsclite.so",
-+                                                    "/usr/lib/arm-linux-gnueabihf/libpcsclite.so",
-+                                                    "/usr/lib/$ARCH-kfreebsd-gnu/libpcsclite.so" };
-+    private static final String[] LIB_SUFFIXES = { ".1", ".0", "" };
-     private static final String PCSC_FRAMEWORK = "/System/Library/Frameworks/PCSC.framework/Versions/Current/PCSC";
- 
-     PlatformPCSC() {
-@@ -73,23 +79,38 @@ public Throwable run() {
-     });
- 
-     // expand $LIBISA to the system specific directory name for libraries
-+    // expand $ARCH to the Debian system architecture in use
-     private static String expand(String lib) {
-         int k = lib.indexOf("$LIBISA");
--        if (k == -1) {
--            return lib;
-+        if (k != -1) {
-+            String libDir;
-+            if ("64".equals(System.getProperty("sun.arch.data.model"))) {
-+                // assume Linux convention
-+                libDir = "lib64";
-+            } else {
-+                // must be 32-bit
-+                libDir = "lib";
-+            }
-+            lib = lib.replace("$LIBISA", libDir);
-         }
--        String s1 = lib.substring(0, k);
--        String s2 = lib.substring(k + 7);
--        String libDir;
--        if ("64".equals(System.getProperty("sun.arch.data.model"))) {
--            // assume Linux convention
--            libDir = "lib64";
--        } else {
--            // must be 32-bit
--            libDir = "lib";
-+
-+        k = lib.indexOf("$ARCH");
-+        if (k != -1) {
-+            String arch = System.getProperty("os.arch");
-+            lib = lib.replace("$ARCH", getDebianArchitecture(arch));
-         }
--        String s = s1 + libDir + s2;
--        return s;
-+
-+        return lib;
-+    }
-+
-+    private static String getDebianArchitecture(String jdkArch) {
-+        return switch (jdkArch) {
-+            case "amd64" -> "x86_64";
-+            case "ppc" -> "powerpc";
-+            case "ppc64" -> "powerpc64";
-+            case "ppc64le" -> "powerpc64le";
-+            default -> jdkArch;
-+        };
-     }
- 
-     private static String getLibraryName() throws IOException {
-@@ -98,15 +119,18 @@ private static String getLibraryName() throws IOException {
-         if (lib.length() != 0) {
-             return lib;
-         }
--        lib = expand(LIB1);
--        if (new File(lib).isFile()) {
--            // if LIB1 exists, use that
--            return lib;
--        }
--        lib = expand(LIB2);
--        if (new File(lib).isFile()) {
--            // if LIB2 exists, use that
--            return lib;
-+
-+        for (String template : LIB_TEMPLATES) {
-+            for (String suffix : LIB_SUFFIXES) {
-+                lib = expand(template) + suffix;
-+                if (debug != null) {
-+                    debug.println("Looking for " + lib);
-+                }
-+                if (new File(lib).isFile()) {
-+                    // if library exists, use that
-+                    return lib;
-+                }
-+            }
-         }
- 
-         // As of macos 11, framework libraries have been removed from the file

SPECS/java-21-openjdk.spec

@@ -1,3 +1,8 @@
+# To rebuild this RPM, you must first rebuild the portable
+# RPM using the java-21-openjdk-portable.specfile, install
+# it and then adjust portablerelease and portablesuffix
+# to match the new portable.
+
 # RPM conditionals so as to be able to dynamically produce
 # slowdebug/release builds. See:
 # http://rpm.org/user_doc/conditional_builds.html
@@ -97,9 +102,9 @@
 # similarly for other %%{_jvmdir}/{jre,java} and %%{_javadocdir}/{java,java-zip}
 %define is_release_build() %( if [ "%{?1}" == "%{debug_suffix_unquoted}" -o "%{?1}" == "%{fastdebug_suffix_unquoted}" ]; then echo "0" ; else echo "1"; fi )
 
-# while JDK is a techpreview(is_system_jdk=0), some provides are turned off. Once jdk stops to be an techpreview, move it to 1
-# as sytem JDK, we mean any JDK which can run whole system java stack without issues (like bytecode issues, module issues, dependencies...)
-%global is_system_jdk 0
+# Indicates whether this is the default JDK on this version of RHEL
+# Only the default/system JDK provides unversioned Provides like 'java', 'jre' and 'java-devel'
+%global is_system_jdk 1
 
 %global aarch64         aarch64 arm64 armv8
 # we need to distinguish between big and little endian PPC64
@@ -124,9 +129,9 @@
 # Set of architectures which support the serviceability agent
 %global sa_arches       %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} %{arm}
 # Set of architectures which support class data sharing
-# See https://bugzilla.redhat.com/show_bug.cgi?id=513605
-# MetaspaceShared::generate_vtable_methods is not implemented for the PPC JIT
-%global share_arches    %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{arm} s390x
+# As of JDK-8005165 in OpenJDK 10, class sharing is not arch-specific
+# However, it does segfault on the Zero assembler port, so currently JIT only
+%global share_arches    %{jit_arches}
 # Set of architectures for which we build the Shenandoah garbage collector
 %global shenandoah_arches x86_64 %{aarch64}
 # Set of architectures for which we build the Z garbage collector
@@ -137,6 +142,8 @@
 %global svml_arches x86_64
 # Set of architectures where we verify backtraces with gdb
 %global gdb_arches %{jit_arches} %{zero_arches}
+# Architecture on which we run Java only tests
+%global jdk_test_arch x86_64
 
 # By default, we build a debug build during main build on JIT architectures
 %if %{with slowdebug}
@@ -215,7 +222,13 @@
 %global hotspot_target hotspot
 
 # debugedit tool for rewriting ELF file paths
+%if 0%{?rhel} >= 10
+# From RHEL 10, the tool is in its own package installed in the usual location
+%global debugedit %{_bindir}/debugedit
+%else
+# On earlier versions of RHEL, it is part of the rpm package
 %global debugedit %{_rpmconfigdir}/debugedit
+%endif
 
 # Filter out flags from the optflags macro that cause problems with the OpenJDK build
 # We filter out -O flags so that the optimization of HotSpot is not lowered from O3 to O2
@@ -295,7 +308,7 @@
 # New Version-String scheme-style defines
 %global featurever 21
 %global interimver 0
-%global updatever 0
+%global updatever 5
 %global patchver 0
 # We don't add any LTS designator for STS packages (Fedora and EPEL).
 # We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined.
@@ -320,7 +333,7 @@
 %global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=%{name}&version=%{fedora}
 %else
 %if 0%{?rhel}
-%global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi?product=Red%20Hat%20Enterprise%20Linux%20%{rhel}&component=%{name}
+%global oj_vendor_bug_url https://access.redhat.com/support/cases/
 %else
 %global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi
 %endif
@@ -331,7 +344,7 @@
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      6.0.0pre00-c848b93a8598
 # Define current Git revision for the FIPS support patches
-%global fipsver 75ffdc48eda
+%global fipsver 0a42e29b391
 # Define JDK versions
 %global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver}
 %global javaver         %{featurever}
@@ -340,16 +353,28 @@
 # The tag used to create the OpenJDK tarball
 %global vcstag jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}
 
+# Define the OS the portable JDK is built on
+# This is undefined for CentOS & openjdk-portable-rhel-8 builds and
+# equals 'rhel7' for openjdk-portable-rhel-7 builds
+%if 0%{?centos} == 0
+%global pkgos rhel7
+%endif
+
 # Standard JPackage naming and versioning defines
 %global origin          openjdk
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{vcstag}
 %global top_level_dir_name_backup %{top_level_dir_name}-backup
-%global buildver        35
+%global buildver        11
 %global rpmrelease      2
 # Settings used by the portable build
-%global portablerelease 2
-%global portablesuffix el8
+%global portablerelease 1
+# Portable suffix differs between RHEL and CentOS
+%if 0%{?centos} == 0
+%global portablesuffix %{?pkgos:el7_9}%{!?pkgos:el8}
+%else
+%global portablesuffix el9
+%endif
 %global portablebuilddir /builddir/build/BUILD
 
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
@@ -373,7 +398,7 @@
 %if %{is_ga}
 %global build_type GA
 %global ea_designator ""
-%global ea_designator_zip ""
+%global ea_designator_zip %{nil}
 %global extraver %{nil}
 %global eaprefix %{nil}
 %else
@@ -434,7 +459,6 @@
 %define jrebindir()     %{expand:%{_jvmdir}/%{sdkdir -- %{?1}}/bin}
 
 %global alt_java_name     alt-java
-%global alt_java_versioned %{alt_java_name}-%{featurever}
 
 %global rpm_state_dir %{_localstatedir}/lib/rpm-state/
 
@@ -531,13 +555,16 @@ key=java
 alternatives \\
   --install %{_bindir}/java $key %{jrebindir -- %{?1}}/java $PRIORITY  --family %{family} \\
   --slave %{_jvmdir}/jre jre %{_jvmdir}/%{sdkdir -- %{?1}} \\
-  --slave %{_bindir}/%{alt_java_name} %{alt_java_name} %{_bindir}/%{alt_java_versioned} \\
+  --slave %{_bindir}/%{alt_java_name} %{alt_java_name} %{jrebindir -- %{?1}}/%{alt_java_name} \\
+  --slave %{_bindir}/jcmd jcmd %{sdkbindir -- %{?1}}/jcmd \\
   --slave %{_bindir}/keytool keytool %{jrebindir -- %{?1}}/keytool \\
   --slave %{_bindir}/rmiregistry rmiregistry %{jrebindir -- %{?1}}/rmiregistry \\
   --slave %{_mandir}/man1/java.1$ext java.1$ext \\
   %{_mandir}/man1/java-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/%{alt_java_name}.1$ext %{alt_java_name}.1$ext \\
   %{_mandir}/man1/%{alt_java_name}-%{uniquesuffix -- %{?1}}.1$ext \\
+  --slave %{_mandir}/man1/jcmd.1$ext jcmd.1$ext \\
+  %{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/keytool.1$ext keytool.1$ext \\
   %{_mandir}/man1/keytool-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/rmiregistry.1$ext rmiregistry.1$ext \\
@@ -557,10 +584,6 @@ alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} $key %{_jvmdir}/%{jre
 }
 
 %define post_headless() %{expand:
-%ifarch %{share_arches}
-%{jrebindir -- %{?1}}/java -Xshare:dump >/dev/null 2>/dev/null
-%endif
-
 update-desktop-database %{_datadir}/applications &> /dev/null || :
 /bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || :
 
@@ -626,7 +649,6 @@ alternatives \\
   --slave %{_bindir}/jarsigner jarsigner %{sdkbindir -- %{?1}}/jarsigner \\
   --slave %{_bindir}/javadoc javadoc %{sdkbindir -- %{?1}}/javadoc \\
   --slave %{_bindir}/javap javap %{sdkbindir -- %{?1}}/javap \\
-  --slave %{_bindir}/jcmd jcmd %{sdkbindir -- %{?1}}/jcmd \\
   --slave %{_bindir}/jconsole jconsole %{sdkbindir -- %{?1}}/jconsole \\
   --slave %{_bindir}/jdb jdb %{sdkbindir -- %{?1}}/jdb \\
   --slave %{_bindir}/jdeps jdeps %{sdkbindir -- %{?1}}/jdeps \\
@@ -654,8 +676,6 @@ alternatives \\
   %{_mandir}/man1/javadoc-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/javap.1$ext javap.1$ext \\
   %{_mandir}/man1/javap-%{uniquesuffix -- %{?1}}.1$ext \\
-  --slave %{_mandir}/man1/jcmd.1$ext jcmd.1$ext \\
-  %{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/jconsole.1$ext jconsole.1$ext \\
   %{_mandir}/man1/jconsole-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/jdb.1$ext jdb.1$ext \\
@@ -810,7 +830,6 @@ exit 0
 
 %define files_jre_headless() %{expand:
 %license %{_jvmdir}/%{sdkdir -- %{?1}}/legal
-%{_bindir}/%{alt_java_versioned}
 %doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/NEWS
 %doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/README.md
 %doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/java-%{featurever}-openjdk-portable.specfile
@@ -821,6 +840,8 @@ exit 0
 %{_jvmdir}/%{jrelnk -- %{?1}}
 %dir %{_jvmdir}/%{sdkdir -- %{?1}}/bin
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/java
+%{_jvmdir}/%{sdkdir -- %{?1}}/bin/%{alt_java_name}
+%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jcmd
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/keytool
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/rmiregistry
 %dir %{_jvmdir}/%{sdkdir -- %{?1}}/lib
@@ -885,11 +906,15 @@ exit 0
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/jfr/profile.jfc
 %{_mandir}/man1/java-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/%{alt_java_name}-%{uniquesuffix -- %{?1}}.1*
+%{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/keytool-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/rmiregistry-%{uniquesuffix -- %{?1}}.1*
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/%{vm_variant}/
 %ifarch %{share_arches}
-%attr(444, root, root) %ghost %{_jvmdir}/%{sdkdir -- %{?1}}/lib/%{vm_variant}/classes.jsa
+%attr(444, root, root) %{_jvmdir}/%{sdkdir -- %{?1}}/lib/%{vm_variant}/classes.jsa
+%ifnarch %{ix86} %{arm32}
+%attr(444, root, root) %{_jvmdir}/%{sdkdir -- %{?1}}/lib/%{vm_variant}/classes_nocoops.jsa
+%endif
 %endif
 %dir %{etcjavasubdir}
 %dir %{etcjavadir -- %{?1}}
@@ -929,13 +954,11 @@ exit 0
 %if %is_system_jdk
 %if %{is_release_build -- %{?1}}
 %ghost %{_bindir}/java
-%ghost %{_bindir}/%{alt_java_name}
 %ghost %{_jvmdir}/jre
+%ghost %{_bindir}/%{alt_java_name}
+%ghost %{_bindir}/jcmd
 %ghost %{_bindir}/keytool
-%ghost %{_bindir}/pack200
-%ghost %{_bindir}/rmid
 %ghost %{_bindir}/rmiregistry
-%ghost %{_bindir}/unpack200
 %ghost %{_jvmdir}/jre-%{origin}
 %ghost %{_jvmdir}/jre-%{javaver}
 %ghost %{_jvmdir}/jre-%{javaver}-%{origin}
@@ -955,7 +978,6 @@ exit 0
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/javadoc
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/javap
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jconsole
-%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jcmd
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jdb
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jdeps
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jdeprscan
@@ -993,7 +1015,6 @@ exit 0
 %{_mandir}/man1/javadoc-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/javap-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jconsole-%{uniquesuffix -- %{?1}}.1*
-%{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jdb-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jdeprscan-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jdeps-%{uniquesuffix -- %{?1}}.1*
@@ -1029,20 +1050,22 @@ exit 0
 %ghost %{_bindir}/jarsigner
 %ghost %{_bindir}/javadoc
 %ghost %{_bindir}/javap
-%ghost %{_bindir}/jcmd
 %ghost %{_bindir}/jconsole
 %ghost %{_bindir}/jdb
 %ghost %{_bindir}/jdeps
 %ghost %{_bindir}/jdeprscan
+%ghost %{_bindir}/jfr
 %ghost %{_bindir}/jimage
 %ghost %{_bindir}/jinfo
 %ghost %{_bindir}/jmap
 %ghost %{_bindir}/jps
+%ghost %{_bindir}/jpackage
 %ghost %{_bindir}/jrunscript
 %ghost %{_bindir}/jshell
 %ghost %{_bindir}/jstack
 %ghost %{_bindir}/jstat
 %ghost %{_bindir}/jstatd
+%ghost %{_bindir}/jwebserver
 %ghost %{_bindir}/serialver
 %ghost %{_jvmdir}/java-%{origin}
 %ghost %{_jvmdir}/java-%{javaver}
@@ -1098,9 +1121,6 @@ exit 0
 %endif
 }
 
-# x86 is not supported by OpenJDK 17
-ExcludeArch: %{ix86}
-
 # not-duplicated requires/provides/obsoletes for normal/debug packages
 %define java_rpo() %{expand:
 Requires: fontconfig%{?_isa}
@@ -1137,8 +1157,8 @@ Requires: ca-certificates
 # Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros
 Requires: javapackages-filesystem
 # Require zone-info data provided by tzdata-java sub-package
-# 2022g required as of JDK-8297804
-Requires: tzdata-java >= 2022g
+# 2024a required as of JDK-8325150
+Requires: tzdata-java >= 2024a
 # for support of kernel stream control
 # libsctp.so.1 is being `dlopen`ed on demand
 Requires: lksctp-tools%{?_isa}
@@ -1259,10 +1279,17 @@ Provides: java-%{origin}-src%{?1} = %{epoch}:%{version}-%{release}
 
 # Prevent brp-java-repack-jars from being run
 %global __jar_repack 0
+# Define the root name of the portable packages
+%global pkgnameroot java-%{featurever}-%{origin}-portable%{?pkgos:-%{pkgos}}
+
+# Define the architectures on which we build
+ExclusiveArch: %{aarch64} %{ppc64le} s390x x86_64
 
 Name:    java-%{javaver}-%{origin}
 Version: %{newjavaver}.%{buildver}
-Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
+Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}.1
+# Equivalent for the portable build
+%global prelease %{?eaprefix}%{portablerelease}%{?extraver}
 # java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons
 # and this change was brought into RHEL-4. java-1.5.0-ibm packages
 # also included the epoch in their virtual provides. This created a
@@ -1298,7 +1325,7 @@ License:  ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv
 URL:      http://openjdk.java.net/
 
 # The source tarball, generated using generate_source_tarball.sh
-Source0: https://openjdk-sources.osci.io/openjdk%{featurever}/openjdk-jdk%{featurever}u-%{vcstag}.tar.xz
+Source0: https://openjdk-sources.osci.io/openjdk%{featurever}/open%{vcstag}%{ea_designator_zip}.tar.xz
 
 # Use 'icedtea_sync.sh' to update the following
 # They are based on code contained in the IcedTea project (6.x).
@@ -1332,16 +1359,17 @@ Source18: TestTranslations.java
 # Include portable spec and instructions on how to rebuild
 Source19: README.md
 Source20: java-%{featurever}-openjdk-portable.specfile
+Source21: NEWS
 
 # Setup variables to reference correct sources
-%global releasezip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.unstripped.jdk.%{_arch}.tar.xz
-%global staticlibzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.static-libs.%{_arch}.tar.xz
-%global docszip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.docs.%{_arch}.tar.xz
-%global misczip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.misc.%{_arch}.tar.xz
-%global slowdebugzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.slowdebug.jdk.%{_arch}.tar.xz
-%global slowdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.slowdebug.static-libs.%{_arch}.tar.xz
-%global fastdebugzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.fastdebug.jdk.%{_arch}.tar.xz
-%global fastdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{portablerelease}.portable.fastdebug.static-libs.%{_arch}.tar.xz
+%global releasezip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.unstripped.jdk.%{_arch}.tar.xz
+%global staticlibzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.static-libs.%{_arch}.tar.xz
+%global docszip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.docs.%{_arch}.tar.xz
+%global misczip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.misc.%{_arch}.tar.xz
+%global slowdebugzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.slowdebug.jdk.%{_arch}.tar.xz
+%global slowdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.slowdebug.static-libs.%{_arch}.tar.xz
+%global fastdebugzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.fastdebug.jdk.%{_arch}.tar.xz
+%global fastdebugstaticlibzip %{_jvmdir}/%{name}-%{version}-%{prelease}.portable.fastdebug.static-libs.%{_arch}.tar.xz
 
 ############################################
 #
@@ -1393,10 +1421,6 @@ Patch1001: fips-%{featurever}u-%{fipsver}.patch
 #
 #############################################
 
-# JDK-8009550, RH910107: Depend on pcsc-lite-libs instead of pcsc-lite-devel as this is only in optional repo
-# PR: https://github.com/openjdk/jdk/pull/15409
-Patch6: jdk8009550-rh910107-fail_to_load_pcsc_library.patch
-
 # Currently empty
 
 #############################################
@@ -1405,8 +1429,6 @@ Patch6: jdk8009550-rh910107-fail_to_load_pcsc_library.patch
 #
 #############################################
 
-# Currently empty
-
 #############################################
 #
 # Portable build specific patches
@@ -1420,6 +1442,10 @@ BuildRequires: automake
 BuildRequires: alsa-lib-devel
 BuildRequires: binutils
 BuildRequires: cups-devel
+# From RHEL 10, debugedit is in its own package
+%if 0%{?rhel} >= 10
+BuildRequires: debugedit
+%endif
 BuildRequires: desktop-file-utils
 # elfutils only are OK for build without AOT
 BuildRequires: elfutils-devel
@@ -1443,25 +1469,25 @@ BuildRequires: xorg-x11-proto-devel
 BuildRequires: zip
 BuildRequires: javapackages-filesystem
 %if %{include_normal_build}
-BuildRequires: java-%{featurever}-openjdk-portable-unstripped = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
-BuildRequires: java-%{featurever}-openjdk-portable-static-libs = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: %{pkgnameroot}-unstripped = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
+BuildRequires: %{pkgnameroot}-static-libs = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
 %endif
 %if %{include_fastdebug_build}
-BuildRequires: java-%{featurever}-openjdk-portable-devel-fastdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
-BuildRequires: java-%{featurever}-openjdk-portable-static-libs-fastdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: %{pkgnameroot}-devel-fastdebug = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
+BuildRequires: %{pkgnameroot}-static-libs-fastdebug = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
 %endif
 %if %{include_debug_build}
-BuildRequires: java-%{featurever}-openjdk-portable-devel-slowdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
-BuildRequires: java-%{featurever}-openjdk-portable-static-libs-slowdebug = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: %{pkgnameroot}-devel-slowdebug = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
+BuildRequires: %{pkgnameroot}-static-libs-slowdebug = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
 %endif
-BuildRequires: java-%{featurever}-openjdk-portable-docs = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
-BuildRequires: java-%{featurever}-openjdk-portable-misc = %{epoch}:%{version}-%{portablerelease}.%{portablesuffix}
+BuildRequires: %{pkgnameroot}-docs = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
+BuildRequires: %{pkgnameroot}-misc = %{epoch}:%{version}-%{prelease}.%{portablesuffix}
 # Zero-assembler build requirement
 %ifarch %{zero_arches}
 BuildRequires: libffi-devel
 %endif
-# 2023c required as of JDK-8305113
-BuildRequires: tzdata-java >= 2023c
+# 2024a required as of JDK-8325150
+BuildRequires: tzdata-java >= 2024a
 # Earlier versions have a bug in tree vectorization on PPC
 BuildRequires: gcc >= 4.8.3-8
 
@@ -1477,19 +1503,22 @@ BuildRequires: harfbuzz-devel
 BuildRequires: lcms2-devel
 BuildRequires: libjpeg-devel
 BuildRequires: libpng-devel
+BuildRequires: zlib-devel
 %else
-# Version in src/java.desktop/share/native/libfreetype/include/freetype/freetype.h
-Provides: bundled(freetype) = 2.12.1
+# Version in src/java.desktop/share/legal/freetype.md
+Provides: bundled(freetype) = 2.13.2
 # Version in src/java.desktop/share/native/libsplashscreen/giflib/gif_lib.h
-Provides: bundled(giflib) = 5.2.1
+Provides: bundled(giflib) = 5.2.2
 # Version in src/java.desktop/share/native/libharfbuzz/hb-version.h
-Provides: bundled(harfbuzz) = 4.4.1
+Provides: bundled(harfbuzz) = 8.2.2
 # Version in src/java.desktop/share/native/liblcms/lcms2.h
-Provides: bundled(lcms2) = 2.12.0
+Provides: bundled(lcms2) = 2.16.0
 # Version in src/java.desktop/share/native/libjavajpeg/jpeglib.h
 Provides: bundled(libjpeg) = 6b
 # Version in src/java.desktop/share/native/libsplashscreen/libpng/png.h
-Provides: bundled(libpng) = 1.6.37
+Provides: bundled(libpng) = 1.6.43
+# Version in src/java.base/share/native/libzip/zlib/zlib.h
+Provides: bundled(zlib) = 1.3.1
 %endif
 
 # this is always built, also during debug-only build
@@ -1833,6 +1862,7 @@ if [ %{include_debug_build} -eq 0 -a  %{include_normal_build} -eq 0 -a  %{includ
   exit 14
 fi
 
+export XZ_OPT="-T0"
 %setup -q -c -n %{uniquesuffix ""} -T -a 0
 # https://bugzilla.redhat.com/show_bug.cgi?id=1189084
 prioritylength=`expr length %{priority}`
@@ -1849,11 +1879,22 @@ sh %{SOURCE12} %{top_level_dir_name}
 %endif
 
 # Patch the JDK
+# This syntax is deprecated:
+#    %patchN [...]
+# and should be replaced with:
+#    %patch -PN [...]
+# For example:
+#    %patch1001 -p1
+# becomes:
+#    %patch -P1001 -p1
+# The replacement format suggested by recent (circa Fedora 38) RPM
+# deprecation messages:
+#    %patch N [...]
+# is not backward-compatible with prior (circa RHEL-8) versions of
+# rpmbuild.
 pushd %{top_level_dir_name}
 # Add crypto policy and FIPS support
-%patch1001 -p1
-# Patches in need of upstreaming
-%patch6 -p1
+%patch -P1001 -p1
 popd # openjdk
 
 
@@ -1877,35 +1918,6 @@ if [ "x${UPSTREAM_EA_DESIGNATOR}" != "x%{ea_designator}" ] ; then
     exit 17
 fi
 
-# Extract systemtap tapsets
-%if %{with_systemtap}
-tar --strip-components=1 -x -I xz -f %{SOURCE8}
-%if %{include_debug_build}
-cp -r tapset tapset%{debug_suffix}
-%endif
-%if %{include_fastdebug_build}
-cp -r tapset tapset%{fastdebug_suffix}
-%endif
-
-for suffix in %{build_loop} ; do
-  for file in "tapset"$suffix/*.in; do
-    OUTPUT_FILE=`echo $file | sed -e "s:\.stp\.in$:-%{version}-%{release}.%{_arch}.stp:g"`
-    sed -e "s:@ABS_SERVER_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/%{vm_variant}/libjvm.so:g" $file > $file.1
-    sed -e "s:@JAVA_SPEC_VER@:%{javaver}:g" $file.1 > $file.2
-# TODO find out which architectures other than i686 have a client vm
-%ifarch %{ix86}
-    sed -e "s:@ABS_CLIENT_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/client/libjvm.so:g" $file.2 > $OUTPUT_FILE
-%else
-    sed -e "/@ABS_CLIENT_LIBJVM_SO@/d" $file.2 > $OUTPUT_FILE
-%endif
-    sed -i -e "s:@ABS_JAVA_HOME_DIR@:%{_jvmdir}/%{sdkdir -- $suffix}:g" $OUTPUT_FILE
-    sed -i -e "s:@INSTALL_ARCH_DIR@:%{archinstall}:g" $OUTPUT_FILE
-    sed -i -e "s:@prefix@:%{_jvmdir}/%{sdkdir -- $suffix}/:g" $OUTPUT_FILE
-  done
-done
-# systemtap tapsets ends
-%endif
-
 # Prepare desktop files
 # The _X_ syntax indicates variables that are replaced by make upstream
 # The @X@ syntax indicates variables that are replaced by configure upstream
@@ -1939,6 +1951,18 @@ function customisejdk() {
     fi
 }
 
+export XZ_OPT="-T0"
+
+mkdir -p $(dirname %{installoutputdir})
+
+docdir=%{installoutputdir -- "-docs"}
+tar -xJf %{docszip}
+mv java-%{featurever}-openjdk*.docs.* ${docdir}
+
+miscdir=%{installoutputdir -- "-misc"}
+tar -xJf %{misczip}
+mv java-%{featurever}-openjdk*.misc.* ${miscdir}
+
 for suffix in %{build_loop} ; do
 
   if [ "x$suffix" = "x" ] ; then
@@ -1957,17 +1981,32 @@ for suffix in %{build_loop} ; do
   # TODO: should verify checksums when using packages from buildroot
   tar -xJf ${jdkzip}
   tar -xJf ${staticlibzip}
-  mkdir -p $(dirname ${installdir})
   mv java-%{featurever}-openjdk* ${installdir}
 
   # Fix build paths in ELF files so it looks like we built them
-  portablenvr="%{name}-%{VERSION}-%{portablerelease}.%{portablesuffix}.%{_arch}"
+  portablenvr="%{name}-%{VERSION}-%{prelease}.%{portablesuffix}.%{_arch}"
   for file in $(find ${installdir} -type f) ; do
       if file ${file} | grep -q 'ELF'; then
           %{debugedit} -b %{portablebuilddir}/${portablenvr} -d $(pwd) -n ${file}
       fi
   done
 
+  # Set tapset variables to match this build
+%if %{with_systemtap}
+  for file in ${miscdir}/tapset${suffix}/*.in; do
+    OUTPUT_FILE=`echo $file | sed -e "s:\.stp\.in$:-%{version}-%{release}.%{_arch}.stp:g"`
+    sed -e "s:@ABS_SERVER_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/%{vm_variant}/libjvm.so:g" $file > ${OUTPUT_FILE}
+# TODO find out which architectures other than i686 have a client vm
+%ifarch %{ix86}
+    sed -i -e "s:@ABS_CLIENT_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/client/libjvm.so:g" ${OUTPUT_FILE}
+%else
+    sed -i -e "/@ABS_CLIENT_LIBJVM_SO@/d" ${OUTPUT_FILE}
+%endif
+    sed -i -e "s:@ABS_JAVA_HOME_DIR@:%{_jvmdir}/%{sdkdir -- $suffix}:g" $OUTPUT_FILE
+    sed -i -e "s:@prefix@:%{_jvmdir}/%{sdkdir -- $suffix}/:g" $OUTPUT_FILE
+  done
+%endif
+
   # Final setup on the main image
   customisejdk ${installdir}
 
@@ -1977,14 +2016,6 @@ for suffix in %{build_loop} ; do
 # build cycles
 done # end of release / debug cycle loop
 
-docdir=%{installoutputdir -- "-docs"}
-tar -xJf %{docszip}
-mv java-%{featurever}-openjdk*.docs.* ${docdir}
-
-miscdir=%{installoutputdir -- "-misc"}
-tar -xJf %{misczip}
-mv java-%{featurever}-openjdk*.misc.* ${miscdir}
-
 %check
 
 # We test debug first as it will give better diagnostics on a crash
@@ -1999,45 +2030,72 @@ export JAVA_HOME=$(pwd)/%{installoutputdir -- ${suffix}}
 $JAVA_HOME/bin/java -XX:+UnlockExperimentalVMOptions -XX:+UseShenandoahGC -version
 %endif
 
-# Check unlimited policy has been used
-$JAVA_HOME/bin/javac -d . %{SOURCE13}
-$JAVA_HOME/bin/java --add-opens java.base/javax.crypto=ALL-UNNAMED TestCryptoLevel
+# Only test on one architecture (the fastest) for Java only tests
+%ifarch %{jdk_test_arch}
+
+  # Check unlimited policy has been used
+  $JAVA_HOME/bin/javac -d . %{SOURCE13}
+  $JAVA_HOME/bin/java --add-opens java.base/javax.crypto=ALL-UNNAMED TestCryptoLevel
+
+  # Check ECC is working
+  $JAVA_HOME/bin/javac -d . %{SOURCE14}
+  $JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||")
 
-# Check ECC is working
-$JAVA_HOME/bin/javac -d . %{SOURCE14}
-$JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||")
+  # Check system crypto (policy) is active and can be disabled
+  # Test takes a single argument - true or false - to state whether system
+  # security properties are enabled or not.
+  $JAVA_HOME/bin/javac -d . %{SOURCE15}
+  export PROG=$(echo $(basename %{SOURCE15})|sed "s|\.java||")
+  export SEC_DEBUG="-Djava.security.debug=properties"
+  $JAVA_HOME/bin/java ${SEC_DEBUG} ${PROG} true
+  $JAVA_HOME/bin/java ${SEC_DEBUG} -Djava.security.disableSystemPropertiesFile=true ${PROG} false
 
-# Check system crypto (policy) is active and can be disabled
-# Test takes a single argument - true or false - to state whether system
-# security properties are enabled or not.
-$JAVA_HOME/bin/javac -d . %{SOURCE15}
-export PROG=$(echo $(basename %{SOURCE15})|sed "s|\.java||")
-export SEC_DEBUG="-Djava.security.debug=properties"
-$JAVA_HOME/bin/java ${SEC_DEBUG} ${PROG} true
-$JAVA_HOME/bin/java ${SEC_DEBUG} -Djava.security.disableSystemPropertiesFile=true ${PROG} false
+  # Check correct vendor values have been set
+  $JAVA_HOME/bin/javac -d . %{SOURCE16}
+  $JAVA_HOME/bin/java $(echo $(basename %{SOURCE16})|sed "s|\.java||") "%{oj_vendor}" "%{oj_vendor_url}" "%{oj_vendor_bug_url}" "%{oj_vendor_version}"
+
+%if ! 0%{?flatpak}
+  # Check translations are available for new timezones (during flatpak builds, the
+  # tzdb.dat used by this test is not where the test expects it, so this is
+  # disabled for flatpak builds)
+  # Disable test until we are on the latest JDK
+  $JAVA_HOME/bin/javac -d . %{SOURCE18}
+  $JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE
+  $JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR
+%endif
+
+  # Check src.zip has all sources. See RHBZ#1130490
+  unzip -l $JAVA_HOME/lib/src.zip | grep 'sun.misc.Unsafe'
+
+  # Check class files include useful debugging information
+  $JAVA_HOME/bin/javap -l java.lang.Object | grep "Compiled from"
+  $JAVA_HOME/bin/javap -l java.lang.Object | grep LineNumberTable
+  $JAVA_HOME/bin/javap -l java.lang.Object | grep LocalVariableTable
+
+  # Check generated class files include useful debugging information
+  $JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep "Compiled from"
+  $JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep LineNumberTable
+  $JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep LocalVariableTable
+
+%else
+
+  # Just run a basic java -version test on other architectures
+  $JAVA_HOME/bin/java -version
+
+%endif
 
 # Check java launcher has no SSB mitigation
 if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi
 
 # Check alt-java launcher has SSB mitigation on supported architectures
 # set_speculation function exists in both cases, so check for prctl call
-alt_java_binary=${RPM_BUILD_ROOT}%{_bindir}/%{alt_java_versioned}
+alt_java_binary=$RPM_BUILD_ROOT%{jrebindir -- $suffix}/%{alt_java_name}
 %ifarch %{ssbd_arches}
 nm ${alt_java_binary} | grep prctl
 %else
 if ! nm ${alt_java_binary} | grep prctl ; then true ; else false; fi
 %endif
 
-%if ! 0%{?flatpak}
-# Check translations are available for new timezones (during flatpak builds, the
-# tzdb.dat used by this test is not where the test expects it, so this is
-# disabled for flatpak builds)
-# Disable test until we are on the latest JDK
-$JAVA_HOME/bin/javac -d . %{SOURCE18}
-$JAVA_HOME/bin/java $(echo $(basename %{SOURCE18})|sed "s|\.java||") JRE
-$JAVA_HOME/bin/java -Djava.locale.providers=CLDR $(echo $(basename %{SOURCE18})|sed "s|\.java||") CLDR
-%endif
-
 %if %{include_staticlibs}
 # Check debug symbols in static libraries (smoke test)
 export STATIC_LIBS_HOME=${JAVA_HOME}/lib/static/linux-%{archinstall}/glibc
@@ -2112,19 +2170,6 @@ EOF
 grep 'JavaCallWrapper::JavaCallWrapper' gdb.out
 %endif
 
-# Check src.zip has all sources. See RHBZ#1130490
-unzip -l $JAVA_HOME/lib/src.zip | grep 'sun.misc.Unsafe'
-
-# Check class files include useful debugging information
-$JAVA_HOME/bin/javap -l java.lang.Object | grep "Compiled from"
-$JAVA_HOME/bin/javap -l java.lang.Object | grep LineNumberTable
-$JAVA_HOME/bin/javap -l java.lang.Object | grep LocalVariableTable
-
-# Check generated class files include useful debugging information
-$JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep "Compiled from"
-$JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep LineNumberTable
-$JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep LocalVariableTable
-
 # build cycles check
 done
 
@@ -2136,11 +2181,7 @@ for suffix in %{build_loop} ; do
 jdk_image=$(pwd)/%{installoutputdir -- ${suffix}}
 # Should match same definitions in build section
 docdir=$(pwd)/%{installoutputdir -- "-docs"}
-miscdir=%{installoutputdir -- "-misc"}
-
-# Install %{alt_java_name} binary versioned
-install -D -p -m 755 ${miscdir}/%{alt_java_name} \
-        $RPM_BUILD_ROOT%{_bindir}/%{alt_java_versioned}
+miscdir=$(pwd)/%{installoutputdir -- "-misc"}
 
 # Install release notes and rebuild instructions
 commondocdir=${RPM_BUILD_ROOT}%{_defaultdocdir}/%{uniquejavadocdir -- $suffix}
@@ -2151,14 +2192,13 @@ cp -a %{SOURCE19} %{SOURCE20} ${commondocdir}
 # Install the jdk
 mkdir -p $RPM_BUILD_ROOT%{_jvmdir}
 cp -a ${jdk_image} $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}
-
-pushd ${jdk_image}
+# Install %{alt_java_name} binary
+install -D -p -m 755 ${miscdir}/%{alt_java_name} $RPM_BUILD_ROOT%{jrebindir -- $suffix}
 
 %if %{with_systemtap}
   # Install systemtap support files
   install -dm 755 $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset
-  # note, that uniquesuffix  is in BUILD dir in this case
-  cp -a $RPM_BUILD_DIR/%{uniquesuffix ""}/tapset$suffix/*.stp $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset/
+  cp -a ${miscdir}/tapset$suffix/*.stp $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset/
   pushd  $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset/
    tapsetFiles=`ls *.stp`
   popd
@@ -2181,8 +2221,11 @@ pushd ${jdk_image}
     ln -sf %{sdkdir -- $suffix} %{jrelnk -- $suffix}
   popd
 
+  # Copy alt-java man page into image so it gets installed with the others
+  cp -a ${miscdir}/%{alt_java_name}.1 ${jdk_image}/man/man1
   # Install man pages
   install -d -m 755 $RPM_BUILD_ROOT%{_mandir}/man1
+  pushd ${jdk_image}
   for manpage in man/man1/*
   do
     # Convert man pages to UTF8 encoding
@@ -2193,8 +2236,7 @@ pushd ${jdk_image}
   done
   # Remove man pages from jdk image
   rm -rf $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/man
-
-popd
+  popd
 
 if ! echo $suffix | grep -q "debug" ; then
     # Install Javadoc documentation
@@ -2490,6 +2532,211 @@ cjc.mainProgram(args)
 %endif
 
 %changelog
+* Tue Oct 29 2024 Troy Dawson <tdawson@redhat.com> - 1:21.0.5.0.11-2.1
+- Bump release for October 2024 mass rebuild:
+  Resolves: RHEL-64018
+
+* Wed Oct 16 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.11-2
+- Update to jdk-21.0.5+11 (GA)
+- Update release notes to 21.0.5+11
+- Remove local JDK-8327501 & JDK-8328366 backport as this is now upstream.
+- Sync the copy of the portable specfile with the latest update
+- Related: RHEL-61276
+
+* Sun Oct 13 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.10-3
+- Sync the copy of the portable specfile with the latest update
+- ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **
+- Related: RHEL-61276
+
+* Sat Oct 12 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.10-2
+- Update to jdk-21.0.5+10 (GA)
+- Update release notes to 21.0.5+10
+- Switch to GA mode.
+- Revert JDK-8327501 & JDK-8328366 backport until more mature.
+- ** This tarball is embargoed until 2024-10-15 @ 1pm PT. **
+- Resolves: RHEL-61276
+
+* Fri Oct 11 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.5.0.9-0.1.ea
+- Update to jdk-21.0.5+9 (EA)
+- Update release notes to 21.0.5+9
+- Switch to EA mode
+- Bump giflib version to 5.2.2 following JDK-8328999
+- Bump libpng version to 1.6.43 following JDK-8329004
+- Sync with RHEL 7 portable build:
+  - Use ExclusiveArch over ExcludeArch
+  - pkgos definition needs to be early enough to be used in portablesuffix
+- Add build scripts to repository to ease remembering all CentOS & RHEL targets and options
+- Make build scripts executable
+- Sync the copy of the portable specfile with the latest update
+- Resolves: RHEL-62239
+- Resolves: RHEL-62241
+
+* Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.7-1
+- Update to jdk-21.0.4+7 (GA)
+- Update release notes to 21.0.4+7
+- Switch to GA mode.
+- Sync the copy of the portable specfile with the latest update
+- Add missing section headers in NEWS
+- Vary portablesuffix depending on whether we are on RHEL ('el8') or CentOS ('el9')
+- ** This tarball is embargoed until 2024-07-16 @ 1pm PT. **
+- Resolves: RHEL-47024
+
+* Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.5-0.1.ea
+- Update to jdk-21.0.4+5 (EA)
+- Update release notes to 21.0.4+5
+- Limit Java only tests to one architecture using jdk_test_arch
+- Actually require tzdata 2024a now it is available in the buildroot
+- Resolves: RHEL-45357
+- Resolves: RHEL-52735
+- Related: RHEL-52723
+
+* Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.4.0.1-0.1.ea
+- Update to jdk-21.0.4+1 (EA)
+- Update release notes to 21.0.4+1
+- Switch to EA mode
+- Bump LCMS 2 version to 2.16.0 following JDK-8321489
+- Add zlib build requirement or bundled version (1.3.1), depending on system_libs setting
+- Restore NEWS file so portable can be rebuilt
+- Sync the copy of the portable specfile with the latest update
+- Related: RHEL-45357
+- Resolves: RHEL-46026
+
+* Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.9-1
+- Update to jdk-21.0.3+9 (GA)
+- Update release notes to 21.0.3+9
+- Switch to GA mode.
+- Sync the copy of the portable specfile with the latest update
+- ** This tarball is embargoed until 2024-04-16 @ 1pm PT. **
+- Resolves: RHEL-32427
+
+* Sun Aug 04 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.7-0.1.ea
+- Update to jdk-21.0.3+7 (EA)
+- Update release notes to 21.0.3+7
+- Require tzdata 2024a due to upstream inclusion of JDK-8322725
+- Only require tzdata 2023d for now as 2024a is unavailable in buildroot
+- Drop JDK-8009550 which is now available upstream
+- Re-generate FIPS patch against 21.0.3+7 following backport of JDK-8325254
+- Resolves: RHEL-52723
+
+* Sat Aug 03 2024 Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.3.0.1-0.1.ea
+- Invoke xz in multi-threaded mode
+- generate_source_tarball.sh: Add WITH_TEMP environment variable
+- generate_source_tarball.sh: Multithread xz on all available cores
+- generate_source_tarball.sh: Add OPENJDK_LATEST environment variable
+- generate_source_tarball.sh: Update comment about tarball naming
+- generate_source_tarball.sh: Reformat comment header
+- generate_source_tarball.sh: Reformat and update help output
+- generate_source_tarball.sh: Do a shallow clone, for speed
+- generate_source_tarball.sh: Append -ea designator when required
+- generate_source_tarball.sh: Eliminate some removal prompting
+- generate_source_tarball.sh: Make tarball reproducible
+- generate_source_tarball.sh: Prefix temporary directory with temp-
+- generate_source_tarball.sh: Remove temporary directory exit conditions
+- generate_source_tarball.sh: Fix -ea logic to add dash
+- generate_source_tarball.sh: Set compile-command in Emacs
+- generate_source_tarball.sh: Remove REPO_NAME from FILE_NAME_ROOT
+- generate_source_tarball.sh: Move PROJECT_NAME and REPO_NAME checks
+- generate_source_tarball.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
+- generate_source_tarball.sh: shellcheck: Double-quote variable references (SC2086)
+- generate_source_tarball.sh: shellcheck: Do not use -a (SC2166)
+- generate_source_tarball.sh: shellcheck: Do not use $ on arithmetic variables (SC2004)
+- Use backward-compatible patch syntax
+- generate_source_tarball.sh: Ignore -ga tags with OPENJDK_LATEST
+- generate_source_tarball.sh: Fix whitespace
+- generate_source_tarball.sh: Remove trailing period in echo
+- generate_source_tarball.sh: Use long-style argument to grep
+- generate_source_tarball.sh: Add license
+- generate_source_tarball.sh: Add indentation instructions for Emacs
+- Related: RHEL-52723
+
+* Sat Aug 03 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.3.0.1-0.1.ea
+- Update to jdk-21.0.3+1 (EA)
+- Update release notes to 21.0.3+1
+- Switch to EA mode
+- Require tzdata 2023d due to local inclusion of JDK-8322725
+- Bump FreeType version to 2.13.2 following JDK-8316028
+- Install alt-java man page from the misc tarball as it is no longer in the JDK image
+- generate_source_tarball.sh: Update examples in header for clarity
+- generate_source_tarball.sh: Cleanup message issued when checkout already exists
+- generate_source_tarball.sh: Create directory in TMPDIR when using WITH_TEMP
+- generate_source_tarball.sh: Only add --depth=1 on non-local repositories
+- Move maintenance scripts to a scripts subdirectory
+- discover_trees.sh: Set compile-command and indentation instructions for Emacs
+- discover_trees.sh: shellcheck: Do not use -o (SC2166)
+- discover_trees.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
+- discover_trees.sh: shellcheck: Double-quote variable references (SC2086)
+- generate_source_tarball.sh: Add authorship
+- icedtea_sync.sh: Set compile-command and indentation instructions for Emacs
+- icedtea_sync.sh: shellcheck: Double-quote variable references (SC2086)
+- icedtea_sync.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
+- openjdk_news.sh: Set compile-command and indentation instructions for Emacs
+- openjdk_news.sh: shellcheck: Double-quote variable references (SC2086)
+- openjdk_news.sh: shellcheck: Remove x-prefixes since we use Bash (SC2268)
+- openjdk_news.sh: shellcheck: Remove deprecated egrep usage (SC2196)
+- generate_source_tarball.sh: Output values of new options WITH_TEMP and OPENJDK_LATEST
+- generate_source_tarball.sh: Double-quote DEPTH reference (SC2086)
+- generate_source_tarball.sh: Avoid empty DEPTH reference while still appeasing shellcheck
+- Related: RHEL-52723
+
+* Tue Jul 30 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-3
+- Fix gating.yaml to reference RHEL 10
+- Set this to be the default/system JDK providing 'java', 'jre', 'java-devel' ,etc.
+- Resolves: RHEL-34597
+- Resolves: RHEL-51617
+
+* Fri Apr 12 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-2
+- Define portablesuffix according to whether pkgos is defined or not
+- Handle debugedit being a separate package installed in /usr on RHEL/CentOS 10
+- Related: RHEL-45217
+
+* Tue Jan 09 2024 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.2.0.13-1
+- Update to jdk-21.0.2+13 (GA)
+- Sync the copy of the portable specfile with the latest update
+- Bump libpng version to 1.6.40 following JDK-8316030
+- Bump HarfBuzz version to 8.2.2 following JDK-8313643
+- Drop local JDK-8311630 patch which is now upstream
+- ** This tarball is embargoed until 2024-01-16 @ 1pm PT. **
+- Resolves: RHEL-45217
+
+* Mon Nov 06 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-3
+- Include JDK-8311630 patch to implement Foreign Function & Memory preview API on s390x
+- Sync the copy of the portable specfile with the latest update
+- Related: RHEL-45217
+
+* Mon Oct 30 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-2
+- Define pkgnameroot to simplify build requirements and allow '-rhel7' suffix on RHEL
+- Related: RHEL-45217
+
+* Fri Oct 27 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.1.0.12-1
+- Update to jdk-21.0.1.0+12 (GA)
+- Update release notes to 21.0.1.0+12
+- Sync the copy of the portable specfile with the latest update
+- Update openjdk_news script to specify subdirectory last
+- Add missing discover_trees script required by openjdk_news
+- Synchronise bundled versions with 21u sources (FreeType, LCMS, HarfBuzz, libpng)
+- Sync generate_tarball.sh with 11u & 17u version
+- Update bug URL for RHEL to point to the Red Hat customer portal
+- Fix upstream release URL for OpenJDK source
+- Following JDK-8005165, class data sharing can be enabled on all JIT architectures
+- Use tapsets from the misc tarball
+- Introduce 'prelease' for the portable release versioning, to handle EA builds
+- Make sure root installation directory is created first
+- Use in-place substitution for all but the first of the tapset changes
+- Synchronise runtime and buildtime tzdata requirements
+- Remove ghosts for binaries not in java-21-openjdk (pack200, rmid, unpack200)
+- Add missing jfr, jpackage and jwebserver alternative ghosts
+- Move jcmd to the headless package
+- Revert alt-java binary location to being within the JDK tree
+- Related: RHEL-45217
+
+* Fri Oct 27 2023 Jiri Vanek <jvanek@redhat.com> - 1:21.0.1.0.12-1
+- Exclude classes_nocoops.jsa on i686 and arm32
+- Related: RHEL-45217
+
+* Fri Oct 27 2023 Severin Gehwolf <sgehwolf@redhat.com> - 1:21.0.1.0.12-1
+- Fix packaging of CDS archives
+- Resolves: RHEL-45217
+
 * Thu Aug 24 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-2
 - Update documentation (README.md)
 - Replace alt-java patch with a binary separate from the JDK
@@ -2499,7 +2746,7 @@ cjc.mainProgram(args)
 - * No use of system libjpeg turbo to warrant RH649512 patch any more
 - Replace RH1684077 pcsc-lite-libs patch with better JDK-8009550 fix being upstreamed
 - Adapt alt-java test to new binary where there is always a set_speculation function
-- Related: rhbz#2192748
+- Related: RHEL-45217
 
 * Mon Aug 21 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.0.0.35-1
 - Update to jdk-21.0.0+35
@@ -2511,11 +2758,11 @@ cjc.mainProgram(args)
 - Re-enable tzdata tests now we are on the latest JDK and things are back in sync
 - Install jaxp.properties introduced by JDK-8303530
 - Install lible.so introduced by JDK-8306983
-- Related: rhbz#2192748
+- Related: RHEL-45217
 
 * Mon Aug 21 2023 Petra Alice Mikova <pmikova@redhat.com> - 1:21.0.0.0.35-1
 - Replace smoke test files used in the staticlibs test, as fdlibm was removed by JDK-8303798
-- Related: rhbz#2192748
+- Related: RHEL-45217
 
 * Wed Aug 16 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:20.0.0.0.36-1
 - Update to jdk-20.0.2+9
@@ -2523,12 +2770,12 @@ cjc.mainProgram(args)
 - Update system crypto policy & FIPS patch from new fips-20u tree
 - Update generate_tarball.sh ICEDTEA_VERSION
 - Update CLDR reference data following update to 42 (Rocky Mountain-Normalzeit => Rocky-Mountain-Normalzeit)
-- Related: rhbz#2192748
+- Related: RHEL-45217
 
 * Wed Aug 16 2023 Jiri Vanek <jvanek@redhat.com> - 1:20.0.0.0.36-1
 - Dropped JDK-8295447, JDK-8296239 & JDK-8299439 patches now upstream
 - Adapted rh1750419-redhat_alt_java.patch
-- Related: rhbz#2192748
+- Related: RHEL-45217
 
 * Tue Aug 15 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:19.0.1.0.10-1
 - Update to jdk-19.0.2 release
@@ -2537,7 +2784,7 @@ cjc.mainProgram(args)
 - Remove references to sample directory removed by JDK-8284999
 - Add local patch JDK-8295447 (javac NPE) which was accepted into 19u upstream but not in the GA tag
 - Add local patches for JDK-8296239 & JDK-8299439 (Croatia Euro update) which are present in 8u, 11u & 17u releases
-- Related: rhbz#2192748
+- Related: RHEL-45217
 
 * Thu Aug 10 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:18.0.2.0.9-1
 - Update to jdk-18.0.2 release
@@ -2548,22 +2795,26 @@ cjc.mainProgram(args)
 - Drop tzdata patches added for 17.0.7 which will eventually appear in the upstream tarball when we reach OpenJDK 21
 - Disable tzdata tests until we are on the latest JDK and things are back in sync
 - Use empty nss.fips.cfg until it is again available via the FIPS patch
-- Related: rhbz#2192748
+- Related: RHEL-45217
 
 * Thu Aug 10 2023 Petra Alice Mikova <pmikova@redhat.com> - 1:18.0.2.0.9-1
 - Update to ea version of jdk18
 - Add new slave jwebserver and corresponding manpage
 - Adjust rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch
-- Related: rhbz#2192748
+- Related: RHEL-45217
 
 * Thu Aug 10 2023 FeRD (Frank Dana) <ferdnyc@gmail.com> - 1:18.0.2.0.9-1
 - Add javaver- and origin-specific javadoc and javadoczip alternatives.
-- Related: rhbz#2192748
+- Related: RHEL-45217
+
+* Tue Aug 08 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-4
+- Set portablerelease and portablerhel to use the CentOS 9 build
+- Related: RHEL-45217
 
 * Tue Aug 08 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-4
 - Add files missed by centpkg import.
-- Related: rhbz#2192748
+- Related: RHEL-45217
 
 * Fri Aug 04 2023 Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.7.0.7-3
 - Create java-21-openjdk package based on java-17-openjdk
-- Related: rhbz#2192748
+- Related: RHEL-45217