Update to jdk-11.0.10.0+9

Update release notes to 11.0.10.0+9 Use JEP-322 Time-Based Versioning so we can handle a future 11.0.9.1-like release correctly. Still use 11.0.x rather than 11.0.x.0 for file naming, as the trailing zero is omitted from tags. Revert configure and built_doc_archive hacks to build 11.0.9.1 from 11.0.9.0 sources, and synced with RHEL version. Cleanup debug package descriptions and version number placement. Drop JDK-8250861, JDK-8222286 & JDK-8254177 as applied upstream Use system harfbuzz now this is supported. Update tarball generation script to use PR3818 which handles JDK-8171279 changes Use RSA as default for keytool, as DSA is disabled in all crypto policies except LEGACY Adjust RH1842572 patch due to context change from JDK-8213400 Following JDK-8005165, class data sharing can be enabled on all JIT architectures Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64) Need to support noarch for creating source RPMs for non-scratch builds. Update build documentation to reflect this is java-11-openjdk, not java-1.8.0-openjdk Remove redundant closure and immediate reopening of include_normal_build block. Include a test in the RPM to check the build has the correct vendor information. Fix location and comment differences from RHEL.
2020-12-22 06:15:10 +00:00 · 2020-12-22 06:15:10 +00:00 · b4c85aad69
parent 2278ab209d
commit b4c85aad69
10 changed files with 544 additions and 2230 deletions
--- a/.gitignore
+++ b/.gitignore
@ -70,3 +70,10 @@
 /jdk-updates-jdk11u-jdk-11.0.9+9-4curve.tar.xz
 /jdk-updates-jdk11u-jdk-11.0.9+10-4curve.tar.xz
 /jdk-updates-jdk11u-jdk-11.0.9+11-4curve.tar.xz
+/jdk-updates-jdk11u-jdk-11.0.10+1-4curve.tar.xz
+/jdk-updates-jdk11u-jdk-11.0.10+2-4curve.tar.xz
+/jdk-updates-jdk11u-jdk-11.0.10+3-4curve.tar.xz
+/jdk-updates-jdk11u-jdk-11.0.10+4-4curve.tar.xz
+/jdk-updates-jdk11u-jdk-11.0.10+5-4curve.tar.xz
+/jdk-updates-jdk11u-jdk-11.0.10+8-4curve.tar.xz
+/jdk-updates-jdk11u-jdk-11.0.10+9-4curve.tar.xz
--- a/CheckVendor.java
+++ b/CheckVendor.java
@ -0,0 +1,57 @@
+/* CheckVendor -- Check the vendor properties match specified values.
+   Copyright (C) 2020 Red Hat, Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+/**
+ * @test
+ */
+public class CheckVendor {
+
+    public static void main(String[] args) {
+	if (args.length < 3) {
+	    System.err.println("CheckVendor <VENDOR> <VENDOR-URL> <VENDOR-BUG-URL>");
+	    System.exit(1);
+	}
+
+	String vendor = System.getProperty("java.vendor");
+	String expectedVendor = args[0];
+	String vendorURL = System.getProperty("java.vendor.url");
+	String expectedVendorURL = args[1];
+	String vendorBugURL = System.getProperty("java.vendor.url.bug");
+	String expectedVendorBugURL = args[2];
+
+	if (!expectedVendor.equals(vendor)) {
+	    System.err.printf("Invalid vendor %s, expected %s\n",
+			      vendor, expectedVendor);
+	    System.exit(2);
+	}
+
+	if (!expectedVendorURL.equals(vendorURL)) {
+	    System.err.printf("Invalid vendor URL %s, expected %s\n",
+			      vendorURL, expectedVendorURL);
+	    System.exit(3);
+	}
+
+	if (!expectedVendorBugURL.equals(vendorBugURL)) {
+	    System.err.printf("Invalid vendor bug URL%s, expected %s\n",
+			      vendorBugURL, expectedVendorBugURL);
+	    System.exit(4);
+	}
+
+	System.err.printf("Vendor information verified as %s, %s, %s\n",
+			  vendor, vendorURL, vendorBugURL);
+    }
+}
--- a/260
+++ b/260
@ -3,6 +3,266 @@ Key:
 JDK-X  - https://bugs.openjdk.java.net/browse/JDK-X
 CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY

+New in release OpenJDK 11.0.10 (2021-01-19):
+=============================================
+Live versions of these release notes can be found at:
+  * https://bitly.com/openjdk11010
+  * https://builds.shipilev.net/backports-monitor/release-notes-11.0.10.txt
+
+* Security fixes
+  - JDK-8247619: Improve Direct Buffering of Characters
+* Other changes
+  - JDK-6722928: Support SSPI as a native GSS-API provider
+  - JDK-7185258: [macosx] Deadlock in SunToolKit.realSync()
+  - JDK-8152332: [macosx] JFileChooser cannot be serialized on Mac OS X
+  - JDK-8161684: [testconf] Add VerifyOops' testing into compiler tiers
+  - JDK-8171279: Support X25519 and X448 in TLS
+  - JDK-8173361: various crashes in JvmtiExport::post_compiled_method_load
+  - JDK-8173658: JvmtiExport::post_class_unload() is broken for non-JavaThread initiators
+  - JDK-8191006: hsdis disassembler plugin does not compile with binutils 2.29+
+  - JDK-8197981: Missing return statement in __sync_val_compare_and_swap_8
+  - JDK-8198334: java/awt/FileDialog/8003399/bug8003399.java fails in headless mode
+  - JDK-8200151: Add 8 JNDI tests to com/sun/jndi/dns/ConfigTests/
+  - JDK-8208279: Add 8 JNDI tests to com/sun/jndi/dns/EnvTests/
+  - JDK-8208483: Add 5 JNDI tests to com/sun/jndi/dns/FactoryTests/
+  - JDK-8208542: Add 4 JNDI tests to com/sun/jndi/dns/ListTests/
+  - JDK-8208665: Amend cross-compilation docs with qemu-debootstrap recipe
+  - JDK-8210088: ProblemList gc/epsilon/TestMemoryMXBeans.java
+  - JDK-8210339: Add 10 JNDI tests to com/sun/jndi/dns/FedTests/
+  - JDK-8211450: UndetVar::dup is not copying the kind field to the duplicated instance
+  - JDK-8212160: JVMTI agent crashes with "assert(_value != 0LL) failed: resolving NULL _value"
+  - JDK-8212226: SurfaceManager throws "Invalid Image variant" for MultiResolutionImage (Windows)
+  - JDK-8213400: Support choosing group name in keytool keypair generation
+  - JDK-8213535: Windows HiDPI html lightweight tooltips are truncated
+  - JDK-8213698: Improve devkit creation and add support for linux/ppc64/ppc64le/s390x
+  - JDK-8214025: assert(t->singleton()) failed: must be a constant when ScavengeRootsInCode < 2
+  - JDK-8214242: compiler/arguments/TestScavengeRootsInCode.java fails because of missing UnlockDiagnosticVMOptions
+  - JDK-8214787: Zero builds fail with "undefined JavaThread::thread_state()"
+  - JDK-8215583: Exclude runtime/handshake/HandshakeWalkSuspendExitTest.java
+  - JDK-8216012: Infinite loop in RSA KeyPairGenerator
+  - JDK-8216324: GetClassMethods is confused by the presence of default methods in super interfaces
+  - JDK-8217429: WebSocket over authenticating proxy fails to send Upgrade headers
+  - JDK-8217976: test/jdk/java/net/httpclient/websocket/WebSocketProxyTest.java fails intermittently
+  - JDK-8218021: Have jarsigner preserve posix permission attributes
+  - JDK-8218287: jshell tool: input behavior unstable after 12-ea+24 on Windows
+  - JDK-8218851: JVM crash in custom classloader stress test, JDK 12 & 13
+  - JDK-8220420: Cleanup c1_LinearScan
+  - JDK-8222072: JVMTI GenerateEvents() sends CompiledMethodLoad events to wrong jvmtiEnv
+  - JDK-8222286: Fix for JDK-8213419 is broken on s390
+  - JDK-8222527: HttpClient doesn't send HOST header when tunelling HTTP/1.1 through http proxy
+  - JDK-8222533: jtreg test jdk/internal/platform/cgroup/TestCgroupMetrics.java fails on SLES12.3 linux ppc64le machine
+  - JDK-8224506: [TESTBUG] TestDockerMemoryMetrics.java fails with exitValue = 137
+  - JDK-8224555: vmTestbase/nsk/jvmti/scenarios/contention/TC02/tc02t001/TestDescription.java failed
+  - JDK-8224650: Add tests to support X25519 and X448 in TLS
+  - JDK-8225072: Add LuxTrust certificate that is expiring in March 2021 to list of allowed but expired certs
+  - JDK-8225329: -XX:+PrintBiasedLockingStatistics causes crash during initialization on Windows platforms
+  - JDK-8225687: Newly added sspi.cpp in JDK-6722928 still contains some small errors
+  - JDK-8227006: [linux] Runtime.availableProcessors execution time increased by factor of 100
+  - JDK-8227275: Within native OOM error handling, assertions may hang the process
+  - JDK-8227647: [Graal] Test8009761.java fails due to "RuntimeException: static java.lang.Object compiler.uncommontrap.Test8009761.m3(boolean,boolean) not compiled"
+  - JDK-8229495: SIGILL in C2 generated OSR compilation
+  - JDK-8230910: libsspi_bridge does not build on Windows 32bit
+  - JDK-8232114: JVM crashed at imjpapi.dll in native code
+  - JDK-8234147: Avoid looking up standard charsets in core libraries
+  - JDK-8234393: [macos] printing ignores printer tray
+  - JDK-8234863: Increase default value of MaxInlineLevel
+  - JDK-8235218: Minimal VM is broken after JDK-8173361
+  - JDK-8235456: Minimal VM is broken after JDK-8212160
+  - JDK-8235829: graal crashes with Zombie.java test
+  - JDK-8236124: Minimal VM slowdebug build failed after JDK-8212160
+  - JDK-8236512: PKCS11 Connection closed after Cipher.doFinal and NoPadding
+  - JDK-8236944: The legVecZ operand should be limited to zmm0-zmm15 registers
+  - JDK-8237186: Fix typo in copyright header of java/io/Reader/TransferTo.java
+  - JDK-8237499: JFR: Include stack trace in the ThreadStart event
+  - JDK-8237512: AArch64: aarch64TestHook leaks a BufferBlob
+  - JDK-8237524: AArch64: String.compareTo() may return incorrect result
+  - JDK-8237950: C2 compilation fails with "Live Node limit exceeded limit" during ConvI2L::Ideal optimization
+  - JDK-8238579: HttpsURLConnection drops the timeout and hangs forever in read
+  - JDK-8239105: Add exception for expiring Digicert root certificates to VerifyCACerts test
+  - JDK-8239477: jdk/jfr/jcmd/TestJcmdStartStopDefault.java fails -XX:+VerifyOops with "verify_oop: rsi: broken oop"
+  - JDK-8239497: SEGV in EdgeUtils::field_name_symbol(Edge const&)
+  - JDK-8239886: Minimal VM build fails after JDK-8237499
+  - JDK-8240633: Memory leaks in the implementations of FileChooserUI
+  - JDK-8240690: Race condition between EDT and BasicDirectoryModel.FilesLoader.run0()
+  - JDK-8241234: Unify monitor enter/exit runtime entries.
+  - JDK-8241311: Move some charset mapping tests from closed to open
+  - JDK-8241797: Add some tests to the problem list
+  - JDK-8242029: AArch64: skip G1 array copy pre-barrier if marking not active
+  - JDK-8242335: Additional Tests for RSASSA-PSS
+  - JDK-8242480: Negative value may be returned by getFreeSwapSpaceSize() in the docker
+  - JDK-8242614: cleanup duplicated test ldap server in some com/sun/jndi/ldap/ tests
+  - JDK-8242846: Bring back test/jdk/tools/jlink/plugins/OrderResourcesPluginTest.java
+  - JDK-8243114: Implement montgomery{Multiply,Square}intrinsics on Windows
+  - JDK-8243290: Improve diagnostic messages for class verification and redefinition failures
+  - JDK-8243488: Add tests for set/get SendBufferSize and getReceiveBufferSize in DatagramSocket
+  - JDK-8243549: sun/security/ssl/CipherSuite/NamedGroupsWithCipherSuite.java failed with Unsupported signature algorithm: DSA
+  - JDK-8243617: compiler/onSpinWait/TestOnSpinWaitC1.java test uses wrong class
+  - JDK-8243619: compiler/codecache/CheckSegmentedCodeCache.java test misses -version
+  - JDK-8244142: some hotspot/runtime tests don't check exit code of forked JVM
+  - JDK-8244278: Excessive code cache flushes and sweeps
+  - JDK-8244282: test/hotspot/jtreg/compiler/intrinsics/Test8237524.java fails with --illegal-access=deny
+  - JDK-8244621: [macos10.15] Garbled FX printing plus CoreText warnings on Catalina when building with Xcode 11
+  - JDK-8244819: hsdis does not compile with binutils 2.34+
+  - JDK-8245051: c1 is broken if it is compiled by gcc without -fno-lifetime-dse
+  - JDK-8245168: jlink should not be treated as a "small" tool
+  - JDK-8245400: Upgrade to LittleCMS 2.11
+  - JDK-8246381: VM crashes with "Current BasicObjectLock* below than low_mark"
+  - JDK-8246434: Threads::print_on_error assumes that the heap has been set up
+  - JDK-8246648: issue with OperatingSystemImpl getFreeSwapSpaceSize in docker after 8242480
+  - JDK-8247201: Print potential pointer value of readable stack memory in hs_err file
+  - JDK-8247763: assert(outer->outcnt() == 2) failed: 'only phis' failure in LoopNode::verify_strip_mined()
+  - JDK-8247867: Upgrade to freetype 2.10.2
+  - JDK-8248190: Enable Power10 system and implement new byte-reverse instructions
+  - JDK-8248226: TestCloneAccessStressGCM fails with -XX:-ReduceBulkZeroing
+  - JDK-8248347: windows build broken by JDK-8243114
+  - JDK-8248532: Every time I change keyboard language at my MacBook, Java crashes
+  - JDK-8248552: C2 crashes with SIGFPE due to division by zero
+  - JDK-8248596: [TESTBUG] compiler/loopopts/PartialPeelingUnswitch.java times out with Graal enabled
+  - JDK-8248745: Add jarsigner and keytool tests for restricted algorithms
+  - JDK-8248791: sun/util/resources/cldr/TimeZoneNamesTest.java fails with -XX:-ReduceInitialCardMarks -XX:-ReduceBulkZeroing
+  - JDK-8248845: AArch64: stack corruption after spilling vector register
+  - JDK-8249176: Update GlobalSignR6CA test certificates
+  - JDK-8249183: JVM crash in "AwtFrame::WmSize" method
+  - JDK-8249192: MonitorInfo stores raw oops across safepoints
+  - JDK-8249602: C2: assert(cnt == _outcnt) failed: no insertions allowed
+  - JDK-8249603: C1: assert(has_error == false) failed: register allocation invalid
+  - JDK-8249605: C2: assert(no_dead_loop) failed: dead loop detected
+  - JDK-8249607: C2: assert(!had_error) failed: bad dominance
+  - JDK-8249608: Vector register used by C2 compiled method corrupted at safepoint
+  - JDK-8249672: Include microcode revision in features_string on x86
+  - JDK-8249748: gtest silently ignores bad jvm arguments
+  - JDK-8249821: Separate libharfbuzz from libfontmanager
+  - JDK-8250598: Hyper-V is detected in spite of running on host OS
+  - JDK-8250605: Linux x86_32 builds fail after JDK-8249821
+  - JDK-8250636: iso8601_time returns incorrect offset part on MacOS
+  - JDK-8250665: Wrong translation for the month name of May in ar_JO,LB,SY
+  - JDK-8250772: Test com/sun/jndi/ldap/NamingExceptionMessageTest.java fails intermittently with javax.naming.ServiceUnavailableException
+  - JDK-8250825: C2 crashes with assert(field != __null) failed: missing field
+  - JDK-8250894: Provide a configure option to build and run against the platform libharfbuzz
+  - JDK-8250928: JFR: Improve hash algorithm for stack traces
+  - JDK-8250968: Symlinks attributes not preserved when using jarsigner on zip files
+  - JDK-8250984: Memory Docker tests fail on some Linux kernels w/o cgroupv1 swap limit capabilities
+  - JDK-8251118: BiasedLocking::preserve_marks should not have a HandleMark
+  - JDK-8251189: com/sun/jndi/ldap/LdapDnsProviderTest.java failed due to timeout
+  - JDK-8251257: NMT: jcmd VM.native_memory scale=1 crashes target VM
+  - JDK-8251365: Build failure on AIX after 8250636
+  - JDK-8251397: NPE on ClassValue.ClassValueMap.cacheArray
+  - JDK-8251456: [TESTBUG] compiler/vectorization/TestVectorsNotSavedAtSafepoint.java failed OutOfMemoryError
+  - JDK-8251458: Parse::do_lookupswitch fails with "assert(_cnt >= 0) failed"
+  - JDK-8251535: Partial peeling at unsigned test adds incorrect loop exit check
+  - JDK-8251949: ZGC: Set explicit heap size for compiler/gcbarriers tests
+  - JDK-8252090: JFR: StreamWriterHost::write_unbuffered() stucks in an infinite loop OpenJDK (build 13.0.1+9)
+  - JDK-8252415: Bump update version for OpenJDK: jdk-11.0.10
+  - JDK-8252470: java/awt/dnd/DisposeFrameOnDragCrash/DisposeFrameOnDragTest.java fails on Windows
+  - JDK-8252497: Incorrect numeric currency code for ROL
+  - JDK-8252660: Shenandoah: support manageable SoftMaxHeapSize option
+  - JDK-8252679: Two windows specific FileDIalog tests may fail on some Windows_Server_2016_Standard
+  - JDK-8252696: Loop unswitching may cause out of bound array load to be executed
+  - JDK-8252754: Hash code calculation of JfrStackTrace is inconsistent
+  - JDK-8253219: Epsilon: clean up unnecessary includes
+  - JDK-8253224: Shenandoah: ShenandoahStrDedupQueue destructor calls virtual num_queues()
+  - JDK-8253226: Shenandoah: remove unimplemented ShenandoahStrDedupQueue::verify
+  - JDK-8253269: The CheckCommonColors test should provide more info on failure
+  - JDK-8253284: Zero OrderAccess barrier mappings are incorrect
+  - JDK-8253375: OSX build fails with Xcode 12.0 (12A7209)
+  - JDK-8253778: ShenandoahSafepoint::is_at_shenandoah_safepoint should not access VMThread state from other threads
+  - JDK-8253791: Issue with useAppleColor check in CSystemColors.m
+  - JDK-8254016: Test8237524 fails with -XX:-CompactStrings option
+  - JDK-8254081: java/security/cert/PolicyNode/GetPolicyQualifiers.java fails due to an expired certificate
+  - JDK-8254144: Non-x86 Zero builds fail with return-type warning in os_linux_zero.cpp
+  - JDK-8254166: Zero: return-type warning in zeroInterpreter_zero.cpp
+  - JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
+  - JDK-8254185: Fix Code cache sweeper heuristics for JDK 11
+  - JDK-8254190: [s390] interpreter misses exception check after calling monitorenter
+  - JDK-8254790: SIGSEGV in string_indexof_char and stringL_indexof_char intrinsics
+  - JDK-8254854: [cgroups v1] Metric limits not properly detected on some join controller combinations
+  - JDK-8254982: (tz) Upgrade time-zone data to tzdata2020c
+  - JDK-8255050: Add pkcs11/KeyStore/ClientAuth.sh to Problem list
+  - JDK-8255065: Zero: accessor_entry misses the IRIW case
+  - JDK-8255226: (tz) Upgrade time-zone data to tzdata2020d
+  - JDK-8255269: Unsigned overflow in g1Policy.cpp
+  - JDK-8255365: Problem list failing client manual tests
+  - JDK-8255457: Shenandoah: cleanup ShenandoahMarkTask
+  - JDK-8255466: C2 crashes at ciObject::get_oop() const+0x0
+  - JDK-8255550: x86: Assembler::cmpq(Address dst, Register src) encoding is incorrect
+  - JDK-8255603: Memory/Performance regression after JDK-8210985
+  - JDK-8255760: Shenandoah: match constants style in ShenandoahMarkTask fallback
+  - JDK-8255937: Better cleanup for test/jdk/javax/imageio/stream/StreamFlush.java
+  - JDK-8256427: Test com/sun/jndi/dns/ConfigTests/PortUnreachable.java does not work on AIX
+  - JDK-8256452: Integrate missing part of JDK-8232370 to 11u
+  - JDK-8256483: [TESTBUG] serviceability/jvmti/GetClassMethods/libOverpassMethods.c fails to compile on gcc 4.4.x
+  - JDK-8256557: libharfbuzz fails to link on gcc 4.4.x due to -Wl,-z,defs
+  - JDK-8256618: Zero: Linux x86_32 build still fails
+  - JDK-8256736: Zero: GTest tests fail with "unsuppported vm variant"
+  - JDK-8256809: Annotation processing causes NPE during flow analysis
+  - JDK-8257181: s390x builds are very noisy with gc-sections messages
+  - JDK-8257242: [macOS] Java app crashes while switching input methods
+  - JDK-8257545: SunJSSE FIPS regression in key exchange after JDK-8171279 11u backport
+  - JDK-8257641: Shenandoah: Query is_at_shenandoah_safepoint() from control thread should return false
+  - JDK-8257701: Shenandoah: objArrayKlass metadata is not marked with chunked arrays
+  - JDK-8258630: Add expiry exception for QuoVadis root certificate
+
+Notes on individual issues:
+===========================
+
+security-libs/java.security:
+
+JDK-8213821: -groupname Option Added to keytool Key Pair Generation
+===================================================================
+A new `-groupname` option has been added to `keytool -genkeypair` so
+that a user can specify a named group when generating a key pair. For
+example, `keytool -genkeypair -keyalg EC -groupname secp384r1` will
+generate an EC key pair by using the `secp384r1` curve. Because there
+might be multiple curves with the same size, using the `-groupname`
+option is preferred over the `-keysize` option.
+
+JDK-8248263: jarsigner Preserves POSIX File Permission and symlink Attributes
+=============================================================================
+When signing a file that contains POSIX file permission or symlink
+attributes, `jarsigner` now preserves these attributes in the newly
+signed file but warns that these attributes are unsigned and not
+protected by the signature. The same warning is printed during the
+`jarsigner -verify` operation for such files.
+
+Note that the `jar` tool does not read/write these attributes. This
+change is more visible to tools like `unzip` where these attributes
+are preserved.
+
+security-libs/javax.net.ssl:
+
+JDK-8225764:  Support for X25519 and X448 in TLS
+================================================
+
+The named elliptic curve groups `x25519` and `x448` are now available
+for JSSE key agreement in TLS versions 1.0 to 1.3, with `x25519` being
+the most preferred of the default enabled named groups.  The default
+ordered list is now:
+
+* x25519
+* secp256r1
+* secp384r1
+* secp521r1
+* x448
+* secp256k1
+* ffdhe2048
+* ffdhe3072
+* ffdhe4096
+* ffdhe6144
+* ffdhe8192
+
+The default list can be overridden using the system property *`jdk.tls.namedGroups`*.
+
+security-libs/org.ietf.jgss:
+
+JDK-8214079: Added a Default Native GSS-API Library on Windows
+==============================================================
+A native GSS-API library has been added to JDK on the Windows
+platform. The library is client-side only and uses the default
+credentials. It will be loaded when the `sun.security.jgss.native`
+system property is set to "true". A user can still load a third-party
+native GSS-API library by setting the system property
+`sun.security.jgss.lib` to its path.
+
 New in release OpenJDK 11.0.9.1 (2020-10-20):
 =============================================
 Live versions of these release notes can be found at:
--- a/generate_source_tarball.sh
+++ b/generate_source_tarball.sh
@ -4,7 +4,7 @@
 # Example:
 # When used from local repo set REPO_ROOT pointing to file:// with your repo
 # If your local repo follows upstream forests conventions, it may be enough to set OPENJDK_URL
-# If you want to use a local copy of patch PR3802, set the path to it in the PR3802 variable
+# If you want to use a local copy of patch PR3818, set the path to it in the PR3818 variable
 #
 # In any case you have to set PROJECT_NAME REPO_NAME and VERSION. eg:
 # PROJECT_NAME=jdk
@ -26,9 +26,9 @@
 # level folder, name is created, based on parameter
 #

-if [ ! "x$PR3802" = "x" ] ; then
-  if [ ! -f "$PR3802" ] ; then
-    echo "You have specified PR3802 as $PR3802 but it does not exist. Exiting"
+if [ ! "x$PR3818" = "x" ] ; then
+  if [ ! -f "$PR3818" ] ; then
+    echo "You have specified PR3818 as $PR3818 but it does not exist. Exiting"
    exit 1
  fi
 fi
@ -48,7 +48,7 @@ if [ "x$1" = "xhelp" ] ; then
    echo "FILE_NAME_ROOT - name of the archive, minus extensions (optional; defaults to PROJECT_NAME-REPO_NAME-VERSION)"
    echo "REPO_ROOT - the location of the Mercurial repository to archive (optional; defaults to OPENJDK_URL/PROJECT_NAME/REPO_NAME)"
    echo "TO_COMPRESS - what part of clone to pack (default is openjdk)"
-    echo "PR3802 - the path to the PR3802 patch to apply (optional; downloaded if unavailable)"
+    echo "PR3818 - the path to the PR3818 patch to apply (optional; downloaded if unavailable)"
    exit 1;
 fi

@ -126,17 +126,17 @@ pushd "${FILE_NAME_ROOT}"
 	    rm -vf ${CRYPTO_PATH}/ecp_224.c

            echo "Syncing EC list with NSS"
-            if [ "x$PR3802" = "x" ] ; then
-                # get pr3802.patch (from http://icedtea.classpath.org/hg/icedtea11) from most correct tag
+            if [ "x$PR3818" = "x" ] ; then
+                # get pr3818.patch (from http://icedtea.classpath.org/hg/icedtea11) from most correct tag
                # Do not push it or publish it (see http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=3751)
-		echo "PR3802 not found. Downloading..."
-		wget http://icedtea.classpath.org/hg/icedtea11/raw-file/tip/patches/pr3802-4curve.patch
-	        echo "Applying ${PWD}/pr3802.patch"
-		patch -Np1 < pr3802.patch
-		rm pr3802.patch
+		echo "PR3818 not found. Downloading..."
+		wget http://icedtea.classpath.org/hg/icedtea11/raw-file/tip/patches/pr3818-4curve.patch
+	        echo "Applying ${PWD}/pr3818.patch"
+		patch -Np1 < pr3818.patch
+		rm pr3818.patch
 	    else
-		echo "Applying ${PR3802}"
-		patch -Np1 < $PR3802
+		echo "Applying ${PR3818}"
+		patch -Np1 < $PR3818
            fi;
            find . -name '*.orig' -exec rm -vf '{}' ';'
        popd
--- a/java-11-openjdk.spec
+++ b/java-11-openjdk.spec
@ -5,10 +5,10 @@
 # Examples:
 #
 # Produce release, fastdebug *and* slowdebug builds on x86_64 (default):
-# $ rpmbuild -ba java-1.8.0-openjdk.spec
+# $ rpmbuild -ba java-11-openjdk.spec
 #
 # Produce only release builds (no slowdebug builds) on x86_64:
-# $ rpmbuild -ba java-1.8.0-openjdk.spec --without slowdebug --without fastdebug
+# $ rpmbuild -ba java-11-openjdk.spec --without slowdebug --without fastdebug
 #
 # Only produce a release build on x86_64:
 # $ fedpkg mockbuild --without slowdebug --without fastdebug
@ -44,10 +44,11 @@
 %global normal_suffix ""

 %global debug_warning This package is unoptimised with full debugging. Install only as needed and remove ASAP.
-%global debug_on with full debug on
+%global debug_on with full debugging on
+%global fastdebug_on with minimal debugging on
 %global fastdebug_warning This package is optimised with full debugging. Install only as needed and remove ASAP.
-%global for_fastdebug_on with minimal debug on
-%global for_debug for packages with debug on
+%global for_fastdebug for packages with minimal debugging on
+%global for_debug for packages with debugging on

 %if %{with release}
 %global include_normal_build 1
@ -86,8 +87,10 @@
 %global ppc64be         ppc64 ppc64p7
 # Set of architectures which support multiple ABIs
 %global multilib_arches %{power64} sparc64 x86_64
-# Set of architectures for which we build debug builds
+# Set of architectures for which we build slowdebug builds
 %global debug_arches    %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} s390x
+# Set of architectures for which we build fastdebug builds
+%global fastdebug_arches x86_64 ppc64le aarch64
 # Set of architectures with a Just-In-Time (JIT) compiler
 %global jit_arches      %{debug_arches} %{arm}
 # Set of architectures which run a full bootstrap cycle
@ -96,13 +99,12 @@
 %global systemtap_arches %{jit_arches}
 # Set of architectures with a Ahead-Of-Time (AOT) compiler
 %global aot_arches      x86_64 %{aarch64}
-%global fastdebug_arches x86_64 ppc64le aarch64
 # Set of architectures which support the serviceability agent
 %global sa_arches       %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} %{arm}
 # Set of architectures which support class data sharing
-# See https://bugzilla.redhat.com/show_bug.cgi?id=513605
-# MetaspaceShared::generate_vtable_methods is not implemented for the PPC JIT
-%global share_arches    %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{arm} s390x
+# As of JDK-8005165 in OpenJDK 10, class sharing is not arch-specific
+# However, it does segfault on the Zero assembler port, so currently JIT only
+%global share_arches    %{jit_arches}
 # Set of architectures for which we build the Shenandoah garbage collector
 %global shenandoah_arches x86_64 %{aarch64}
 # Set of architectures for which we build the Z garbage collector
@ -110,7 +112,7 @@
 # Set of architectures for which alt-java has SSB mitigation
 %global ssbd_arches x86_64

-# By default, we build a debug build during main build on JIT architectures
+# By default, we build a slowdebug build during main build on JIT architectures
 %if %{with slowdebug}
 %ifarch %{debug_arches}
 %global include_debug_build 1
@ -204,51 +206,63 @@
 # In some cases, the arch used by the JDK does
 # not match _arch.
 # Also, in some cases, the machine name used by SystemTap
-# does not match that given by _build_cpu
+# does not match that given by _target_cpu
 %ifarch x86_64
 %global archinstall amd64
+%global stapinstall x86_64
 %endif
 %ifarch ppc
 %global archinstall ppc
+%global stapinstall powerpc
 %endif
 %ifarch %{ppc64be}
 %global archinstall ppc64
+%global stapinstall powerpc
 %endif
 %ifarch %{ppc64le}
 %global archinstall ppc64le
+%global stapinstall powerpc
 %endif
 %ifarch %{ix86}
 %global archinstall i686
+%global stapinstall i386
 %endif
 %ifarch ia64
 %global archinstall ia64
+%global stapinstall ia64
 %endif
 %ifarch s390
 %global archinstall s390
+%global stapinstall s390
 %endif
 %ifarch s390x
 %global archinstall s390x
+%global stapinstall s390
 %endif
 %ifarch %{arm}
 %global archinstall arm
+%global stapinstall arm
 %endif
 %ifarch %{aarch64}
 %global archinstall aarch64
+%global stapinstall arm64
 %endif
 # 32 bit sparc, optimized for v9
 %ifarch sparcv9
 %global archinstall sparc
+%global stapinstall %{_target_cpu}
 %endif
 # 64 bit sparc
 %ifarch sparc64
 %global archinstall sparcv9
+%global stapinstall %{_target_cpu}
 %endif
-%ifnarch %{jit_arches}
-%global archinstall %{_arch}
+# Need to support noarch for srpm build
+%ifarch noarch
+%global archinstall %{nil}
+%global stapinstall %{nil}
 %endif

-
-
 %ifarch %{systemtap_arches}
 %global with_systemtap 1
 %else
@ -256,16 +270,18 @@
 %endif

 # New Version-String scheme-style defines
-# If you bump majorver, you must bump also vendor_version_string
-%global majorver 11
+%global featurever 11
+%global interimver 0
+%global updatever 10
+%global patchver 0
+# If you bump featurever, you must bump also vendor_version_string
 # Used via new version scheme. JDK 11 was
 # GA'ed in September 2018 => 18.9
 %global vendor_version_string 18.9
-%global securityver 9
-# buildjdkver is usually same as %%{majorver},
-# but in time of bootstrap of next jdk, it is majorver-1, 
+# buildjdkver is usually same as %%{featurever},
+# but in time of bootstrap of next jdk, it is featurever-1,
 # and this it is better to change it here, on single place
-%global buildjdkver %{majorver}
+%global buildjdkver %{featurever}
 # Add LTS designator for RHEL builds
 %if 0%{?rhel}
  %global lts_designator "LTS"
@ -275,6 +291,26 @@
  %global lts_designator_zip ""
 %endif

+# Define vendor information used by OpenJDK
+%global oj_vendor Red Hat, Inc.
+%global oj_vendor_url "https://www.redhat.com/"
+# Define what url should JVM offer in case of a crash report
+# order may be important, epel may have rhel declared
+%if 0%{?epel}
+%global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora%20EPEL&component=%{name}&version=epel%{epel}
+%else
+%if 0%{?fedora}
+# Does not work for rawhide, keeps the version field empty
+%global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=%{name}&version=%{fedora}
+%else
+%if 0%{?rhel}
+%global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi?product=Red%20Hat%20Enterprise%20Linux%20%{rhel}&component=%{name}
+%else
+%global oj_vendor_bug_url  https://bugzilla.redhat.com/enter_bug.cgi
+%endif
+%endif
+%endif
+
 # Define IcedTea version used for SystemTap tapsets and desktop file
 %global icedteaver      3.15.0

@ -282,20 +318,31 @@
 %global origin          openjdk
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{origin}
-%global minorver        0
-%global buildver        11
-%global rpmrelease      9
+%global buildver        9
+%global rpmrelease      0
 #%%global tagsuffix      ""
-# priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
+# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
-%global priority %( printf '%02d%02d%02d%02d' %{majorver} %{minorver} %{securityver} %{buildver} )
+# Using 10 digits may overflow the int used for priority, so we combine the patch and build versions
+# It is very unlikely we will ever have a patch version > 4 or a build version > 20, so we combine as (patch * 20) + build.
+# This means 11.0.9.0+11 would have had a priority of 11000911 as before
+# A 11.0.9.1+1 would have had a priority of 11000921 (20 * 1 + 1), thus ensuring it is bigger than 11.0.9.0+11
+%global combiver $( expr 20 '*' %{patchver} + %{buildver} )
+%global priority %( printf '%02d%02d%02d%02d' %{featurever} %{interimver} %{updatever} %{combiver} )
 %else
 # for techpreview, using 1, so slowdebugs can have 0
 %global priority %( printf '%08d' 1 )
 %endif
-%global newjavaver      %{majorver}.%{minorver}.%{securityver}
+%global newjavaver      %{featurever}.%{interimver}.%{updatever}.%{patchver}

-%global javaver         %{majorver}
+# Omit trailing 0 in filenames when the patch version is 0
+%if 0%{?patchver} > 0
+%global filever %{newjavaver}
+%else
+%global filever %{featurever}.%{interimver}.%{updatever}
+%endif
+
+%global javaver         %{featurever}

 # Define milestone (EA for pre-releases, GA for releases)
 # Release will be (where N is usually a number starting at 1):
@ -314,25 +361,8 @@
 %global eaprefix 0.
 %endif

-# Define what url should JVM offer in case of a crash report
-# order may be important, epel may have rhel declared
-%if 0%{?epel}
-%global bugs  https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora%20EPEL&component=%{name}&version=epel%{epel}
-%else
-%if 0%{?fedora}
-# Does not work for rawhide, keeps the version field empty
-%global bugs  https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=%{name}&version=%{fedora}
-%else
-%if 0%{?rhel}
-%global bugs  https://bugzilla.redhat.com/enter_bug.cgi?product=Red%20Hat%20Enterprise%20Linux%20%{rhel}&component=%{name}
-%else
-%global bugs  https://bugzilla.redhat.com/enter_bug.cgi
-%endif
-%endif
-%endif
-
 # parametrized macros are order-sensitive
-%global compatiblename  java-%{majorver}-%{origin}
+%global compatiblename  java-%{featurever}-%{origin}
 %global fullversion     %{compatiblename}-%{version}-%{release}
 # images directories from upstream build
 %global jdkimage                jdk
@ -386,10 +416,10 @@
 # and 32 bit architectures we place the tapsets under the arch
 # specific dir (note that systemtap will only pickup the tapset
 # for the primary arch for now). Systemtap uses the machine name
-# aka build_cpu as architecture specific directory name.
+# aka target_cpu as architecture specific directory name.
 %global tapsetroot /usr/share/systemtap
 %global tapsetdirttapset %{tapsetroot}/tapset/
-%global tapsetdir %{tapsetdirttapset}/%{_build_cpu}
+%global tapsetdir %{tapsetdirttapset}/%{stapinstall}
 %endif

 # not-duplicated scriptlets for normal/debug packages
@ -942,7 +972,7 @@ Requires: ca-certificates
 # Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros
 Requires: javapackages-filesystem
 # Require zone-info data provided by tzdata-java sub-package
-# 2020a required as of JDK-8243541 in 11.0.8+4
+# 2020b required as of JDK-8254177 in October CPU
 Requires: tzdata-java >= 2020b
 # for support of kernel stream control
 # libsctp.so.1 is being `dlopen`ed on demand
@ -1070,7 +1100,7 @@ Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist}
 # provides >= 1.6.0 must specify the epoch, "java >= 1:1.6.0".

 Epoch:   1
-Summary: %{origin_nice} Runtime Environment %{majorver}
+Summary: %{origin_nice} %{featurever} Runtime Environment

 # HotSpot code is licensed under GPLv2
 # JDK library code is licensed under GPLv2 with the Classpath exception
@ -1092,7 +1122,7 @@ URL:      http://openjdk.java.net/

 # to regenerate source0 (jdk) run update_package.sh
 # update_package.sh contains hard-coded repos, revisions, tags, and projects to regenerate the source archives
-Source0: jdk-updates-jdk%{majorver}u-jdk-%{newjavaver}+%{buildver}%{?tagsuffix:-%{tagsuffix}}-4curve.tar.xz
+Source0: jdk-updates-jdk%{featurever}u-jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}-4curve.tar.xz

 # Use 'icedtea_sync.sh' to update the following
 # They are based on code contained in the IcedTea project (3.x).
@ -1120,22 +1150,26 @@ Source14: TestECDSA.java
 # Verify system crypto (policy) can be disabled via a property
 Source15: TestSecurityProperties.java

+# Ensure vendor settings are correct
+Source16: CheckVendor.java
+
 ############################################
 #
 # RPM/distribution specific patches
 #
 ############################################

-# NSS via SunPKCS11 Provider (disabled comment
-# due to memory leak).
-Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
-# enable build of speculative store bypass hardened alt-java
-Patch600: rh1750419-redhat_alt_java.patch
-
 # Ignore AWTError when assistive technologies are loaded
 Patch1:    rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
 # Restrict access to java-atk-wrapper classes
 Patch2:    rh1648644-java_access_bridge_privileged_security.patch
+# NSS via SunPKCS11 Provider (disabled due to memory leak).
+Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
+# enable build of speculative store bypass hardened alt-java
+Patch600: rh1750419-redhat_alt_java.patch
+
+# RH1582504: Use RSA as default for keytool, as DSA is disabled in all crypto policies except LEGACY
+Patch1003: rh1842572-rsa_default_for_keytool.patch

 #############################################
 #
@ -1147,8 +1181,11 @@ Patch2:    rh1648644-java_access_bridge_privileged_security.patch

 #############################################
 #
-# OpenJDK specific patches
+# Upstreamable patches
 #
+# This section includes patches which need to
+# be reviewed & pushed to the current development
+# tree of OpenJDK.
 #############################################

 Patch3:    rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
@ -1166,12 +1203,6 @@ Patch7: pr3695-toggle_system_crypto_policy.patch
 # able to be removed once that release is out
 # and used by this RPM.
 #############################################
-# JDK-8222286: S390 ambiguous log2_intptr call
-Patch8: s390-8214206_fix.patch
-# JDK-8254177: (tz) Upgrade time-zone data to tzdata2020b
-Patch9: jdk8254177-tzdata2020b.patch
-# JDK-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
-Patch10: jdk8250861-crash_in_MinINode_Ideal.patch

 BuildRequires: autoconf
 BuildRequires: automake
@ -1186,6 +1217,7 @@ BuildRequires: freetype-devel
 BuildRequires: giflib-devel
 BuildRequires: gcc-c++
 BuildRequires: gdb
+BuildRequires: harfbuzz-devel
 BuildRequires: lcms2-devel
 BuildRequires: libjpeg-devel
 BuildRequires: libpng-devel
@ -1223,254 +1255,260 @@ BuildRequires: systemtap-sdt-devel
 %{java_rpo %{nil}}

 %description
-The %{origin_nice} runtime environment %{majorver}.
+The %{origin_nice} %{featurever} runtime environment.

 %if %{include_debug_build}
 %package slowdebug
-Summary: %{origin_nice} Runtime Environment %{majorver} %{debug_on}
+Summary: %{origin_nice} %{featurever} Runtime Environment %{debug_on}

 %{java_rpo -- %{debug_suffix_unquoted}}
 %description slowdebug
-The %{origin_nice} runtime environment %{majorver}.
+The %{origin_nice} %{featurever} runtime environment.
 %{debug_warning}
 %endif

 %if %{include_fastdebug_build}
 %package fastdebug
-Summary: %{origin_nice} Runtime Environment %{majorver} %{fastdebug_on}
+Summary: %{origin_nice} %{featurever} Runtime Environment %{fastdebug_on}
 Group:   Development/Languages

 %{java_rpo -- %{fastdebug_suffix_unquoted}}
 %description fastdebug
-The %{origin_nice} runtime environment.
+The %{origin_nice} %{featurever} runtime environment.
 %{fastdebug_warning}
 %endif

 %if %{include_normal_build}
 %package headless
-Summary: %{origin_nice} Headless Runtime Environment %{majorver}
+Summary: %{origin_nice} %{featurever} Headless Runtime Environment

 %{java_headless_rpo %{nil}}

 %description headless
-The %{origin_nice} runtime environment %{majorver} without audio and video support.
+The %{origin_nice} %{featurever} runtime environment without audio and video support.
 %endif

 %if %{include_debug_build}
 %package headless-slowdebug
-Summary: %{origin_nice} Runtime Environment %{majorver} %{debug_on}
+Summary: %{origin_nice} %{featurever} Runtime Environment %{debug_on}

 %{java_headless_rpo -- %{debug_suffix_unquoted}}

 %description headless-slowdebug
-The %{origin_nice} runtime environment %{majorver} without audio and video support.
+The %{origin_nice} %{featurever} runtime environment without audio and video support.
 %{debug_warning}
 %endif

 %if %{include_fastdebug_build}
 %package headless-fastdebug
-Summary: %{origin_nice} Runtime Environment %{fastdebug_on}
+Summary: %{origin_nice} %{featurever} Runtime Environment %{fastdebug_on}
 Group:   Development/Languages

 %{java_headless_rpo -- %{fastdebug_suffix_unquoted}}

 %description headless-fastdebug
-The %{origin_nice} runtime environment %{majorver} without audio and video support.
+The %{origin_nice} %{featurever} runtime environment without audio and video support.
 %{fastdebug_warning}
 %endif

 %if %{include_normal_build}
 %package devel
-Summary: %{origin_nice} Development Environment %{majorver}
+Summary: %{origin_nice} %{featurever} Development Environment

 %{java_devel_rpo %{nil}}

 %description devel
-The %{origin_nice} development tools %{majorver}.
+The %{origin_nice} %{featurever} development tools.
 %endif

 %if %{include_debug_build}
 %package devel-slowdebug
-Summary: %{origin_nice} Development Environment %{majorver} %{debug_on}
+Summary: %{origin_nice} %{featurever} Development Environment %{debug_on}

 %{java_devel_rpo -- %{debug_suffix_unquoted}}

 %description devel-slowdebug
-The %{origin_nice} development tools %{majorver}.
+The %{origin_nice} %{featurever} development tools.
 %{debug_warning}
 %endif

 %if %{include_fastdebug_build}
 %package devel-fastdebug
-Summary: %{origin_nice} Development Environment %{majorver} %{fastdebug_on}
+Summary: %{origin_nice} %{featurever} Development Environment %{fastdebug_on}
 Group:   Development/Tools

 %{java_devel_rpo -- %{fastdebug_suffix_unquoted}}

 %description devel-fastdebug
-The %{origin_nice} development tools %{majorver}.
+The %{origin_nice} %{featurever} development tools.
 %{fastdebug_warning}
 %endif

 %if %{include_normal_build}
 %package static-libs
-Summary: %{origin_nice} libraries for static linking %{majorver}
+Summary: %{origin_nice} %{featurever} libraries for static linking

 %{java_static_libs_rpo %{nil}}

 %description static-libs
-The %{origin_nice} libraries for static linking %{majorver}.
+The %{origin_nice} %{featurever} libraries for static linking.
 %endif

 %if %{include_debug_build}
 %package static-libs-slowdebug
-Summary: %{origin_nice} libraries for static linking %{majorver} %{debug_on}
+Summary: %{origin_nice} %{featurever} libraries for static linking %{debug_on}

 %{java_static_libs_rpo -- %{debug_suffix_unquoted}}

 %description static-libs-slowdebug
-The %{origin_nice} libraries for static linking %{majorver}.
+The %{origin_nice} %{featurever} libraries for static linking.
 %{debug_warning}
 %endif

 %if %{include_fastdebug_build}
 %package static-libs-fastdebug
-Summary: %{origin_nice} libraries for static linking %{majorver} %{fastdebug_on}
+Summary: %{origin_nice} %{featurever} libraries for static linking %{fastdebug_on}

 %{java_static_libs_rpo -- %{fastdebug_suffix_unquoted}}

 %description static-libs-fastdebug
-The %{origin_nice} libraries for static linking %{majorver}.
+The %{origin_nice} %{featurever} libraries for static linking.
 %{fastdebug_warning}
 %endif

 %if %{include_normal_build}
 %package jmods
-Summary: JMods for %{origin_nice} %{majorver}
+Summary: JMods for %{origin_nice} %{featurever}

 %{java_jmods_rpo %{nil}}

 %description jmods
-The JMods for %{origin_nice}.
+The JMods for %{origin_nice} %{featurever}.
 %endif

 %if %{include_debug_build}
 %package jmods-slowdebug
-Summary: JMods for %{origin_nice} %{majorver} %{debug_on}
+Summary: JMods for %{origin_nice} %{featurever} %{debug_on}

 %{java_jmods_rpo -- %{debug_suffix_unquoted}}

 %description jmods-slowdebug
-The JMods for %{origin_nice} %{majorver}.
+The JMods for %{origin_nice} %{featurever}.
 %{debug_warning}
 %endif

 %if %{include_fastdebug_build}
 %package jmods-fastdebug
-Summary: JMods for %{origin_nice} %{majorver} %{fastdebug_on}
+Summary: JMods for %{origin_nice} %{featurever} %{fastdebug_on}
 Group:   Development/Tools

 %{java_jmods_rpo -- %{fastdebug_suffix_unquoted}}

 %description jmods-fastdebug
-The JMods for %{origin_nice} %{majorver}.
+The JMods for %{origin_nice} %{featurever}.
 %{fastdebug_warning}
 %endif


 %if %{include_normal_build}
 %package demo
-Summary: %{origin_nice} Demos %{majorver}
+Summary: %{origin_nice} %{featurever} Demos

 %{java_demo_rpo %{nil}}

 %description demo
-The %{origin_nice} demos %{majorver}.
+The %{origin_nice} %{featurever} demos.
 %endif

 %if %{include_debug_build}
 %package demo-slowdebug
-Summary: %{origin_nice} Demos %{majorver} %{debug_on}
+Summary: %{origin_nice} %{featurever} Demos %{debug_on}

 %{java_demo_rpo -- %{debug_suffix_unquoted}}

 %description demo-slowdebug
-The %{origin_nice} demos %{majorver}.
+The %{origin_nice} %{featurever} demos.
 %{debug_warning}
 %endif

 %if %{include_fastdebug_build}
 %package demo-fastdebug
-Summary: %{origin_nice} Demos %{majorver} %{fastdebug_on}
+Summary: %{origin_nice} %{featurever} Demos %{fastdebug_on}
 Group:   Development/Languages

 %{java_demo_rpo -- %{fastdebug_suffix_unquoted}}

 %description demo-fastdebug
-The %{origin_nice} demos %{majorver}.
+The %{origin_nice} %{featurever} demos.
 %{fastdebug_warning}
 %endif

 %if %{include_normal_build}
 %package src
-Summary: %{origin_nice} Source Bundle %{majorver}
+Summary: %{origin_nice} %{featurever} Source Bundle

 %{java_src_rpo %{nil}}

 %description src
-The java-%{origin}-src sub-package contains the complete %{origin_nice} %{majorver}
+The %{compatiblename}-src sub-package contains the complete %{origin_nice} %{featurever}
 class library source code for use by IDE indexers and debuggers.
 %endif

 %if %{include_debug_build}
 %package src-slowdebug
-Summary: %{origin_nice} Source Bundle %{majorver} %{for_debug}
+Summary: %{origin_nice} %{featurever} Source Bundle %{for_debug}

 %{java_src_rpo -- %{debug_suffix_unquoted}}

 %description src-slowdebug
-The java-%{origin}-src-slowdebug sub-package contains the complete %{origin_nice} %{majorver}
- class library source code for use by IDE indexers and debuggers. Debugging %{for_debug}.
+The %{compatiblename}-src-slowdebug sub-package contains the complete %{origin_nice} %{featurever}
+ class library source code for use by IDE indexers and debuggers, %{for_debug}.
 %endif

 %if %{include_fastdebug_build}
 %package src-fastdebug
-Summary: %{origin_nice} Source Bundle %{majorver} %{for_fastdebug}
+Summary: %{origin_nice} %{featurever} Source Bundle %{for_fastdebug}
 Group:   Development/Languages

 %{java_src_rpo -- %{fastdebug_suffix_unquoted}}

 %description src-fastdebug
-The java-%{origin}-src-fastdebug sub-package contains the complete %{origin_nice} %{majorver}
- class library source code for use by IDE indexers and debuggers. Debugging %{for_fastdebug}.
+The %{compatiblename}-src-fastdebug sub-package contains the complete %{origin_nice} %{featurever}
+ class library source code for use by IDE indexers and debuggers, %{for_fastdebug}.
 %endif


 %if %{include_normal_build}
 %package javadoc
-Summary: %{origin_nice} %{majorver} API documentation
+Summary: %{origin_nice} %{featurever} API documentation
 Requires: javapackages-filesystem
 Obsoletes: javadoc-slowdebug < 1:11.0.3.7-4

 %{java_javadoc_rpo %{nil}}

 %description javadoc
-The %{origin_nice} %{majorver} API documentation.
-%endif
+The %{origin_nice} %{featurever} API documentation.

-%if %{include_normal_build}
 %package javadoc-zip
-Summary: %{origin_nice} %{majorver} API documentation compressed in a single archive
+Summary: %{origin_nice} %{featurever} API documentation compressed in a single archive
 Requires: javapackages-filesystem
 Obsoletes: javadoc-zip-slowdebug < 1:11.0.3.7-4

 %{java_javadoc_rpo %{nil}}

 %description javadoc-zip
-The %{origin_nice} %{majorver} API documentation compressed in a single archive.
+The %{origin_nice} %{featurever} API documentation compressed in a single archive.
 %endif

 %prep
+
+# Using the echo macro breaks rpmdev-bumpspec, as it parses the first line of stdout :-(
+%if 0%{?stapinstall:1}
+  echo "CPU: %{_target_cpu}, arch install directory: %{archinstall}, SystemTap install directory: %{stapinstall}"
+%else
+  %{error:Unrecognised architecture %{_target_cpu}}
+%endif
+
 if [ %{include_normal_build} -eq 0 -o  %{include_normal_build} -eq 1 ] ; then
  echo "include_normal_build is %{include_normal_build}"
 else
@ -1515,13 +1553,11 @@ pushd %{top_level_dir_name}
 %patch3 -p1
 %patch4 -p1
 %patch7 -p1
-%patch8 -p1
-%patch9 -p1
-%patch10 -p1
 popd # openjdk

 %patch1000
 %patch600
+%patch1003

 # Extract systemtap tapsets
 %if %{with_systemtap}
@ -1627,13 +1663,11 @@ bash ../configure \
    --with-version-build=%{buildver} \
    --with-version-pre="%{ea_designator}" \
    --with-version-opt=%{lts_designator} \
-    --with-version-patch=1 \
-    --with-version-date="2020-11-04" \
    --with-vendor-version-string="%{vendor_version_string}" \
-    --with-vendor-name="Red Hat, Inc." \
-    --with-vendor-url="https://www.redhat.com/" \
-    --with-vendor-bug-url="%{bugs}" \
-    --with-vendor-vm-bug-url="%{bugs}" \
+    --with-vendor-name="%{oj_vendor}" \
+    --with-vendor-url="%{oj_vendor_url}" \
+    --with-vendor-bug-url="%{oj_vendor_bug_url}" \
+    --with-vendor-vm-bug-url="%{oj_vendor_bug_url}" \
    --with-boot-jdk=/usr/lib/jvm/java-%{buildjdkver}-openjdk \
    --with-debug-level=$debugbuild \
    --with-native-debug-symbols=internal \
@ -1643,6 +1677,7 @@ bash ../configure \
    --with-giflib=system \
    --with-libpng=system \
    --with-lcms=system \
+    --with-harfbuzz=system \
    --with-stdc++lib=dynamic \
    --with-extra-cxxflags="$EXTRA_CPP_FLAGS" \
    --with-extra-cflags="$EXTRA_CFLAGS" \
@ -1722,6 +1757,10 @@ $JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||")
 $JAVA_HOME/bin/javac -d . %{SOURCE15}
 $JAVA_HOME/bin/java -Djava.security.disableSystemPropertiesFile=true $(echo $(basename %{SOURCE15})|sed "s|\.java||")

+# Check correct vendor values have been set
+$JAVA_HOME/bin/javac -d . %{SOURCE16}
+$JAVA_HOME/bin/java $(echo $(basename %{SOURCE16})|sed "s|\.java||") "%{oj_vendor}" %{oj_vendor_url} %{oj_vendor_bug_url}
+
 # Check java launcher has no SSB mitigation
 if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi

@ -1883,8 +1922,9 @@ if ! echo $suffix | grep -q "debug" ; then
  # Install Javadoc documentation
  install -d -m 755 $RPM_BUILD_ROOT%{_javadocdir}
  cp -a %{buildoutputdir -- $suffix}/images/docs $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}
-  #cp -a %{buildoutputdir -- $suffix}/bundles/jdk-%{newjavaver}%{ea_designator_zip}+%{buildver}%{lts_designator_zip}-docs.zip $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip  || ls -l %{buildoutputdir -- $suffix}/bundles/
-  cp -a %{buildoutputdir -- $suffix}/bundles/jdk-11.0.9.1+11-docs.zip $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip || ls -l %{buildoutputdir -- $suffix}/bundles/
+  built_doc_archive=jdk-%{filever}%{ea_designator_zip}+%{buildver}%{lts_designator_zip}-docs.zip
+  cp -a %{buildoutputdir -- $suffix}/bundles/${built_doc_archive} \
+     $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip || ls -l %{buildoutputdir -- $suffix}/bundles/
 fi

 # Install release notes
@ -2157,11 +2197,34 @@ require "copy_jdk_configs.lua"
 %endif

 %changelog
+* Mon Feb  1 2021 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.9-0
+- Update to jdk-11.0.10.0+9
+- Update release notes to 11.0.10.0+9
+- Use JEP-322 Time-Based Versioning so we can handle a future 11.0.9.1-like release correctly.
+- Still use 11.0.x rather than 11.0.x.0 for file naming, as the trailing zero is omitted from tags.
+- Revert configure and built_doc_archive hacks to build 11.0.9.1 from 11.0.9.0 sources, and synced with RHEL version.
+- Drop JDK-8250861, JDK-8222286 & JDK-8254177 as applied upstream
+- Use system harfbuzz now this is supported.
+- Update tarball generation script to use PR3818 which handles JDK-8171279 changes
+- Use RSA as default for keytool, as DSA is disabled in all crypto policies except LEGACY
+- Adjust RH1842572 RSA default patch due to context change from JDK-8213400
+- Following JDK-8005165, class data sharing can be enabled on all JIT architectures
+- Introduce stapinstall variable to set SystemTap arch directory correctly (e.g. arm64 on aarch64)
+- Need to support noarch for creating source RPMs for non-scratch builds.
+- Include a test in the RPM to check the build has the correct vendor information.
+- Update build documentation to reflect this is java-11-openjdk, not java-1.8.0-openjdk
+- Cleanup debug package descriptions and version number placement.
+- Remove redundant closure and immediate reopening of include_normal_build block.
+- Fix location and comment differences from RHEL.
+- Introduced nm based check to verify alt-java on x86_64 is patched, and no other alt-java or java is patched
+- Patch600 rh1750419-redhat_alt_java.patch amended to die, if it is used wrongly
+- Introduce ssbd_arches with currently only valid arch of x86_64 to separate real alt-java architectures
+
 * Tue Dec 22 2020 Jiri Vanek <jvanek@redhat.com> - 1:11.0.9.11-9
- fixed missing condition for fastdebug packages being counted as debug ones
+- Fixed missing condition for fastdebug packages being counted as debug ones

 * Sat Dec 19 2020 Jiri Vanek <jvanek@redhat.com> - 1:11.0.9.11-8
- removed lib-style provides for fastdebug_suffix_unquoted
+- Removed lib-style provides for fastdebug_suffix_unquoted

 * Thu Dec 17 2020 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.9.11-6
 - introduced nm based check to verify alt-java on x86_64 is patched, and no other alt-java or java is patched
@ -2169,9 +2232,9 @@ require "copy_jdk_configs.lua"
 - introduced ssbd_arches with currently only valid arch of x86_64 to separate real alt-java architectures

 * Tue Dec 01 2020 Jiri Vanek <jvanek@redhat.com> - 1:11.0.9.11-5
- removed patch6, rh1566890-CVE_2018_3639-speculative_store_bypass.patch, surpassed by new patch
- added patch600, rh1750419-redhat_alt_java.patch, suprassing removed patch
- no longer copying of java->alt-java as it is created by  patch600
+- Removed patch6, rh1566890-CVE_2018_3639-speculative_store_bypass.patch, surpassed by new patch
+- Added patch600, rh1750419-redhat_alt_java.patch, suprassing removed patch
+- No longer copying of java->alt-java as it is created by  patch600

 * Mon Nov 23 2020 Jiri Vanek <jvanek@redhat.com> - 1:11.0.9.11-4
 - Create a copy of java as alt-java with alternatives and man pages
--- a/jdk8250861-crash_in_MinINode_Ideal.patch
+++ b/jdk8250861-crash_in_MinINode_Ideal.patch
@ -1,32 +0,0 @@
-
-# HG changeset patch
-# User thartmann
-# Date 1604482955 -3600
-# Node ID 27723943c0dd65a191cbefe031cec001521e4b13
-# Parent  e9d90c9daf895b469b461b727b6887e7780b4ac2
-8250861: Crash in MinINode::Ideal(PhaseGVN*, bool)
-Summary: Added missing NULL checks.
-Reviewed-by: kvn, chagedorn
-
-diff -r e9d90c9daf89 -r 27723943c0dd src/hotspot/share/opto/addnode.cpp
--- a/src/hotspot/share/opto/addnode.cpp	Mon Nov 02 20:20:05 2020 +0100
-+++ b/src/hotspot/share/opto/addnode.cpp	Wed Nov 04 10:42:35 2020 +0100
-@@ -917,7 +917,7 @@
- 
-     // Transform MIN2(x + c0, MIN2(x + c1, z)) into MIN2(x + MIN2(c0, c1), z)
-     // if x == y and the additions can't overflow.
-    if (phase->eqv(x,y) &&
-+    if (phase->eqv(x,y) && tx != NULL &&
-         !can_overflow(tx, x_off) &&
-         !can_overflow(tx, y_off)) {
-       return new MinINode(phase->transform(new AddINode(x, phase->intcon(MIN2(x_off, y_off)))), r->in(2));
-@@ -925,7 +925,7 @@
-   } else {
-     // Transform MIN2(x + c0, y + c1) into x + MIN2(c0, c1)
-     // if x == y and the additions can't overflow.
-    if (phase->eqv(x,y) &&
-+    if (phase->eqv(x,y) && tx != NULL &&
-         !can_overflow(tx, x_off) &&
-         !can_overflow(tx, y_off)) {
-       return new AddINode(x,phase->intcon(MIN2(x_off,y_off)));
-
--- a/jdk8254177-tzdata2020b.patch
+++ b/jdk8254177-tzdata2020b.patch
--- a/rh1842572-rsa_default_for_keytool.patch
+++ b/rh1842572-rsa_default_for_keytool.patch
@ -0,0 +1,12 @@
+diff --git openjdk.orig/src/java.base/share/classes/sun/security/tools/keytool/Main.java openjdk/src/java.base/share/classes/sun/security/tools/keytool/Main.java
+--- openjdk.orig/src/java.base/share/classes/sun/security/tools/keytool/Main.java
+++ openjdk/src/java.base/share/classes/sun/security/tools/keytool/Main.java
+@@ -1135,7 +1135,7 @@
+             }
+         } else if (command == GENKEYPAIR) {
+             if (keyAlgName == null) {
+-                keyAlgName = "DSA";
+                keyAlgName = "RSA";
+             }
+             doGenKeyPair(alias, dname, keyAlgName, keysize, groupName, sigAlgName);
+             kssave = true;
--- a/s390-8214206_fix.patch
+++ b/s390-8214206_fix.patch
@ -1,12 +0,0 @@
-diff --git openjdk.orig/jdk/src/hotspot/share/runtime/os.cpp openjdk/jdk/src/hotspot/share/runtime/os.cpp
--- openjdk.orig/src/hotspot/share/runtime/os.cpp
-+++ openjdk/src/hotspot/share/runtime/os.cpp
-@@ -1368,7 +1368,7 @@
- }
- 
- void os::set_memory_serialize_page(address page) {
-  int count = log2_intptr(sizeof(class JavaThread)) - log2_int(64);
-+  int count = log2_intptr((uintptr_t) sizeof(class JavaThread)) - log2_int(64);
-   _mem_serialize_page = (volatile int32_t *)page;
-   // We initialize the serialization page shift count here
-   // We assume a cache line size of 64 bytes
--- a/2
+++ b/2
@ -1,2 +1,2 @@
 SHA512 (tapsets-icedtea-3.15.0.tar.xz) = c752a197cb3d812d50c35e11e4722772be40096c81d2a57933e0d9b8a3c708b9c157b8108a4e33a06ca7bb81648170994408c75d6f69d5ff12785d0c31009671
-SHA512 (jdk-updates-jdk11u-jdk-11.0.9+11-4curve.tar.xz) = 09234290f4e285e921082fb7ddfed3000155f08cb8e63970f2f123cf1c2e1980aebae2ca71faa76a6ba2c0836937ed8ee0b7ab0f53b73a712a00e777a7b2d4ac
+SHA512 (jdk-updates-jdk11u-jdk-11.0.10+9-4curve.tar.xz) = 758786a272d45d471f7ce4dfaba36941b36431dfedd67a3794b680655a9a95c5271c34f1ee1045273946654706aafb4451519ad643f5fc4113729150ba748d7a