import pki-core-11.5.1-1.el9

.gitignore

@@ -1 +1 @@
-SOURCES/pki-11.5.0.tar.gz
+SOURCES/pki-11.5.1.tar.gz

.pki-core.metadata

@@ -1 +1 @@
-dd717a1d8e14cfd558d8772ef37f425db84debee SOURCES/pki-11.5.0.tar.gz
+d7c0b18bd25d9ae00121f58544ea5dc840b18a8d SOURCES/pki-11.5.1.tar.gz

SPECS/pki-core.spec

@@ -9,7 +9,7 @@ Name:             pki-core
 # Upstream version number:
 %global           major_version 11
 %global           minor_version 5
-%global           update_version 0
+%global           update_version 1
 
 # Downstream release number:
 # - development/stabilization (unsupported): 0.<n> where n >= 1
@@ -63,9 +63,27 @@ ExcludeArch: i686
 # Java
 ################################################################################
 
-%global java_devel java-17-openjdk-devel
+%if 0%{?rhel}
-%global java_headless java-17-openjdk-headless
+
-%global java_home %{_jvmdir}/jre-17-openjdk
+%define java_devel java-17-openjdk-devel
+%define java_headless java-17-openjdk-headless
+%define java_home %{_jvmdir}/jre-17-openjdk
+
+%else
+
+# Use Java 21 on Fedora 40+, otherwise use Java 17.
+%global java_devel java-devel >= 1:17
+%global java_headless java-headless >= 1:17
+
+# Don't use find since it might not work well with local builds.
+#   find {_jvmdir} -maxdepth 1 | grep "jre-[0-9]\+$"
+%global java_home %(
+   source /usr/share/java-utils/java-functions;
+   _prefer_jre=true;
+   set_jvm;
+   echo $JAVA_HOME)
+
+%endif
 
 ################################################################################
 # Application Server
@@ -1011,6 +1029,7 @@ popd
 
 # Remove all symbol table and relocation information from the executable.
 C_FLAGS="-s"
+CXX_FLAGS="$CXX_FLAGS -g -fPIE -pie"
 
 %if 0%{?fedora}
 # https://sourceware.org/annobin/annobin.html/Test-gaps.html
@@ -1021,12 +1040,23 @@ C_FLAGS="$C_FLAGS -fcf-protection=full"
 
 # https://sourceware.org/annobin/annobin.html/Test-optimization.html
 C_FLAGS="$C_FLAGS -O2"
+CXX_FLAGS="$CXX_FLAGS -O2"
 
 # https://sourceware.org/annobin/annobin.html/Test-glibcxx-assertions.html
 C_FLAGS="$C_FLAGS -D_GLIBCXX_ASSERTIONS"
+CXX_FLAGS="$CXX_FLAGS -D_GLIBCXX_ASSERTIONS"
 
 # https://sourceware.org/annobin/annobin.html/Test-lto.html
 C_FLAGS="$C_FLAGS -fno-lto"
+
+# https://sourceware.org/annobin/annobin.html/Test-fortify.html
+C_FLAGS="$C_FLAGS -D_FORTIFY_SOURCE=3"
+CXX_FLAGS="$CXX_FLAGS -D_FORTIFY_SOURCE=3"
+
+# https://sourceware.org/annobin/annobin.html/Test-stack-clash.html
+C_FLAGS="$C_FLAGS -fstack-clash-protection"
+CXX_FLAGS="$CXX_FLAGS -fstack-clash-protection"
+
 %endif
 
 pkgs=base\
@@ -1060,6 +1090,7 @@ pkgs=base\
     --share-dir=%{_datadir} \
     --cmake=%{__cmake} \
     --c-flags="$C_FLAGS" \
+    --cxx-flags="$CXX_FLAGS" \
     --java-home=%{java_home} \
     --jni-dir=%{_jnidir} \
     --unit-dir=%{_unitdir} \
@@ -1501,6 +1532,9 @@ fi
 
 ################################################################################
 %changelog
+* Fri Jun 21 2024 Red Hat PKI Team <rhcs-maint@redhat.com> - 11.5.1-1
+- Rebase to PKI 11.5.1
+
 * Wed Feb 21 2024 Red Hat PKI Team <rhcs-maint@redhat.com> - 11.5.0-1
 - Rebase to PKI 11.5.0