December 2021 - Arch-excludes - Fedora Mailing-Lists

Architecture specific change in rpms/clevis-pin-tpm2.git

by githook-noreply＠fedoraproject.org

The package rpms/clevis-pin-tpm2.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/clevis-pin-tpm2.git/commit/?id=61.... Change: -ExcludeArch: s390x %{power64} Thanks. Full change: ============ commit 613d053bd24f52c1a70b006b0bc8ef9ea43c7ef5 Author: Peter Robinson <pbrobinson(a)gmail.com> Date: Wed Dec 8 19:44:30 2021 +0000 Update to 0.5.0 diff --git a/clevis-pin-tpm2.spec b/clevis-pin-tpm2.spec index 98a3b13..02b5194 100644 --- a/clevis-pin-tpm2.spec +++ b/clevis-pin-tpm2.spec @@ -1,9 +1,10 @@ -%bcond_without check +# Needs a TPMv2 +%bcond_with check %global __cargo_skip_build 0 %global __cargo_is_lib() false Name: clevis-pin-tpm2 -Version: 0.4.1 +Version: 0.5.0 Release: 1%{?dist} Summary: Clevis PIN for unlocking with TPM2 supporting Authorized Policies @@ -12,9 +13,6 @@ URL: https://github.com/fedora-iot/clevis-pin-tpm2/ Source: %{url}/archive/v%{version}/%{name}-%{version}.tar.gz ExclusiveArch: %{rust_arches} -# RHBZ 1869980 -ExcludeArch: s390x %{power64} - BuildRequires: rust-packaging Requires: clevis @@ -47,6 +45,9 @@ ln -s /usr/bin/clevis-pin-tpm2 %{buildroot}/usr/bin/clevis-decrypt-tpm2plus %{_bindir}/clevis-*-tpm2plus %changelog +* Wed Dec 08 2021 Peter Robinson <pbrobinson(a)fedoraproject.org> - 0.5.0-1 +- Update to 0.5.0 + * Wed Nov 03 2021 Peter Robinson <pbrobinson(a)fedoraproject.org> - 0.4.1-1 - Update to 0.4.1 diff --git a/sources b/sources index 04fcc66..3ccec82 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (clevis-pin-tpm2-0.4.1.tar.gz) = 0d1ca0fea5f988aca9d7860e7de20cf9118afedf32acaf84082a5b310090a2fe8474de6c6f1c8496a689238fb923dec1e5df219352ecb78e0b7f25b03025dea5 +SHA512 (clevis-pin-tpm2-0.5.0.tar.gz) = b07ae472508e48d3456a35dbd1499e8e5321ee2800ec45e161f27fdf4ec859cb5582e52ba21629ec2ca9ed9a18ed66a8eacdae5edb9c1bb8495be316787c47e3

2 years, 5 months

1
0
0 / 0

Architecture specific change in rpms/rust-josekit.git

by githook-noreply＠fedoraproject.org

The package rpms/rust-josekit.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/rust-josekit.git/commit/?id=7b6df.... Change: +ExclusiveArch: %{rust_arches} Thanks. Full change: ============ commit 7b6dfe7862881ae7b964acd43b1b60f540be66ea Author: Peter Robinson <pbrobinson(a)gmail.com> Date: Wed Dec 8 18:48:32 2021 +0000 initial import diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..cba5d98 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +/josekit-*.crate diff --git a/rust-josekit.spec b/rust-josekit.spec new file mode 100644 index 0000000..4832892 --- /dev/null +++ b/rust-josekit.spec @@ -0,0 +1,71 @@ +# Generated by rust2rpm 20 +%bcond_without check +%global debug_package %{nil} + +%global crate josekit + +Name: rust-%{crate} +Version: 0.7.4 +Release: %autorelease +Summary: JOSE (Javascript Object Signing and Encryption) library for Rust + +# Upstream license specification: MIT OR Apache-2.0 +License: MIT or ASL 2.0 +URL: https://crates.io/crates/josekit +Source: %{crates_source} + +ExclusiveArch: %{rust_arches} + +BuildRequires: rust-packaging + +%global _description %{expand: +JOSE (Javascript Object Signing and Encryption) library for Rust.} + +%description %{_description} + +%package devel +Summary: %{summary} +BuildArch: noarch + +%description devel %{_description} + +This package contains library source intended for building other packages which +use the "%{crate}" crate. + +%files devel +%license LICENSE-APACHE LICENSE-MIT +%doc README.md +%{cargo_registry}/%{crate}-%{version_no_tilde}/ + +%package -n %{name}+default-devel +Summary: %{summary} +BuildArch: noarch + +%description -n %{name}+default-devel %{_description} + +This package contains library source intended for building other packages which +use the "default" feature of the "%{crate}" crate. + +%files -n %{name}+default-devel +%ghost %{cargo_registry}/%{crate}-%{version_no_tilde}/Cargo.toml + +%prep +%autosetup -n %{crate}-%{version_no_tilde} -p1 +%cargo_prep + +%generate_buildrequires +%cargo_generate_buildrequires + +%build +%cargo_build + +%install +%cargo_install + +%if %{with check} +%check +%cargo_test +%endif + +%changelog +%autochangelog diff --git a/sources b/sources new file mode 100644 index 0000000..fa17fbc --- /dev/null +++ b/sources @@ -0,0 +1 @@ +SHA512 (josekit-0.7.4.crate) = 46ecbdd5f59132fdf70107e6b9dcd768b6a235ad067cd9a9395236fb2e37e86396916dc4a664e060d46ee3843e3d798e916698cd049fe357acc390df8c54da02

2 years, 5 months

1
0
0 / 0

[Report] Packages Restricting Arches

by root

New package excluding arches (17) ============================ - rust-actix-codec ExclusiveArch: %{rust_arches} - rust-actix-connect ExclusiveArch: %{rust_arches} - rust-actix-http ExclusiveArch: %{rust_arches} - rust-actix-router ExclusiveArch: %{rust_arches} - rust-actix-server ExclusiveArch: %{rust_arches} - rust-actix-service ExclusiveArch: %{rust_arches} - rust-actix-testing ExclusiveArch: %{rust_arches} - rust-actix-tls ExclusiveArch: %{rust_arches} - rust-actix-utils ExclusiveArch: %{rust_arches} - rust-actix-web ExclusiveArch: %{rust_arches} - rust-actix-web-codegen ExclusiveArch: %{rust_arches} - rust-actix0.10 ExclusiveArch: %{rust_arches} - rust-actix_derive0.5 ExclusiveArch: %{rust_arches} - rust-brotli-sys ExclusiveArch: %{rust_arches} - rust-brotli2 ExclusiveArch: %{rust_arches} - rust-bytes0.6 ExclusiveArch: %{rust_arches} - rust-bytestring ExclusiveArch: %{rust_arches} List of packages currently excluding arches (2300) =========================================== - 0ad ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ppc64le - 90-Second-Portraits ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc64le - GoldenCheetah ExclusiveArch: %{qt5_qtwebengine_arches} - GtkAda ExclusiveArch: %{GPRbuild_arches} - GtkAda3 ExclusiveArch: %{GPRbuild_arches} - OpenColorIO ExclusiveArch: x86_64 ppc64le - OpenImageIO ExclusiveArch: x86_64 ppc64le - OpenMolcas ExclusiveArch: x86_64 aarch64 ppc64le s390x - PragmARC ExclusiveArch: %{GPRbuild_arches} - R-V8 ExclusiveArch: %{nodejs_arches} - RdRand ExclusiveArch: %{ix86} x86_64 - RediSearch ExclusiveArch: x86_64 - SLOF ExclusiveArch: ppc64le - YafaRay ExclusiveArch: %{ix86} x86_64 - aboot ExclusiveArch: alpha - accel-config ExclusiveArch: %{ix86} x86_64 - acpid ExclusiveArch: ia64 x86_64 %{ix86} %{arm} aarch64 - ahven ExclusiveArch: %{GPRbuild_arches} - algobox ExclusiveArch: %{qt5_qtwebengine_arches} - alleyoop ExclusiveArch: %{ix86} x86_64 ppc ppc64 ppc64le s390x %{arm} aarch64 - american-fuzzy-lop ExclusiveArch: %{ix86} x86_64 s390x - anet ExclusiveArch: %{GPRbuild_arches} - anki ExclusiveArch: %{qt5_qtwebengine_arches} noarch - apmd ExclusiveArch: %{ix86} - appstream-generator ExclusiveArch: %{ldc_arches} - arm-trusted-firmware ExclusiveArch: aarch64 - aunit ExclusiveArch: %GPRbuild_arches - avgtime ExclusiveArch: %{ldc_arches} - aws ExclusiveArch: %GPRbuild_arches - bcal ExclusiveArch: x86_64 aarch64 ia64 ppc64 ppc64le s390x - bcc ExclusiveArch: x86_64 %{power64} aarch64 s390x armv7hl - bcm283x-firmware ExclusiveArch: %{arm} aarch64 - berusky2 ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 %{mips} - biosdevname ExclusiveArch: %{ix86} x86_64 - blender ExclusiveArch: x86_64 aarch64 ppc64le s390x - bless ExclusiveArch: %mono_arches - bpftrace ExclusiveArch: x86_64 %{power64} aarch64 s390x - calamares ExclusiveArch: %{ix86} x86_64 aarch64 - calibre ExclusiveArch: %{qt5_qtwebengine_arches} - ccdciel ExclusiveArch: %{fpc_arches} - cdcollect ExclusiveArch: %{mono_arches} - ceph ExclusiveArch: x86_64 aarch64 ppc64le s390x - chromium ExclusiveArch: x86_64 i686 ExclusiveArch: x86_64 aarch64 ExclusiveArch: x86_64 i686 aarch64 - cjdns ExclusiveArch: %{nodejs_arches} - clevis-pin-tpm2 ExclusiveArch: %{rust_arches} - cmospwd ExclusiveArch: %{ix86} x86_64 - cmrt ExclusiveArch: %{ix86} x86_64 ia64 - coffee-script ExclusiveArch: %{nodejs_arches} noarch - colorful ExclusiveArch: %{fpc_arches} - cpu-x ExclusiveArch: i686 x86_64 - cpufetch ExclusiveArch: %{arm} aarch64 x86_64 ppc ppc64 ppc64le - cpuid ExclusiveArch: %{ix86} x86_64 - cqrlog ExclusiveArch: %{fpc_arches} - crash ExclusiveArch: %{ix86} ia64 x86_64 ppc ppc64 s390 s390x %{arm} aarch64 ppc64le - crash-gcore-command ExclusiveArch: aarch64 ppc64le x86_64 - crash-trace-command ExclusiveArch: aarch64 ppc64le s390x x86_64 - cri-tools ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm}} - criu ExclusiveArch: x86_64 %{arm} ppc64le aarch64 s390x - cryptlib ExclusiveArch: x86_64 %{ix86} aarch64 ppc64 ppc64le - cryptobone ExclusiveArch: x86_64 %{ix86} ppc64 ppc64le aarch64 - csslint ExclusiveArch: %{nodejs_arches} noarch - daq ExclusiveArch: x86_64 aarch64 - darktable ExclusiveArch: x86_64 aarch64 ExclusiveArch: x86_64 ppc64le - dbus-parsec ExclusiveArch: %{rust_arches} - dbus-sharp ExclusiveArch: %mono_arches - dbus-sharp-glib ExclusiveArch: %mono_arches - dbxtool ExclusiveArch: i386 x86_64 aarch64 - deepin-daemon ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm}} - deepin-desktop-schemas ExclusiveArch: %{go_arches} - dlm ExclusiveArch: i686 x86_64 - dmidecode ExclusiveArch: %{ix86} x86_64 ia64 aarch64 - dmtcp ExclusiveArch: x86_64 - docker-distribution ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - dolphin-emu ExclusiveArch: x86_64 aarch64 - dotnet-build-reference-packages ExclusiveArch: aarch64 x86_64 ExclusiveArch: x86_64 - dotnet3.1 ExclusiveArch: aarch64 x86_64 ExclusiveArch: x86_64 - dotnet5.0 ExclusiveArch: aarch64 x86_64 ExclusiveArch: x86_64 - dotnet5.0-build-reference-packages ExclusiveArch: aarch64 x86_64 ExclusiveArch: x86_64 - doublecmd ExclusiveArch: %{ix86} x86_64 - dpdk ExclusiveArch: x86_64 i686 aarch64 ppc64le - dxvk-native ExclusiveArch: %{ix86} x86_64 - dyninst ExclusiveArch: %{ix86} x86_64 ppc64le aarch64 - e3 ExclusiveArch: %{ix86} x86_64 - eclipse-swt ExclusiveArch: s390x x86_64 aarch64 ppc64le - edk2 ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ExclusiveArch: x86_64 aarch64 - efibootmgr ExclusiveArch: %{efi} - efifs ExclusiveArch: %{efi} - efitools ExclusiveArch: %{efi} - efivar ExclusiveArch: %{efi} - elk ExclusiveArch: x86_64 %{ix86} ExclusiveArch: x86_64 %{ix86} aarch64 %{arm} %{power64} - emacs-slime ExclusiveArch: %{arm} %{ix86} x86_64 ppc sparcv9 aarch64 - enki ExclusiveArch: %{qt5_qtwebengine_arches} noarch - envytools ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - eric ExclusiveArch: %{qt5_qtwebengine_arches} noarch - eth-tools ExclusiveArch: x86_64 - extlinux-bootloader ExclusiveArch: %{arm} aarch64 - fasttrack ExclusiveArch: %{qt5_qtwebengine_arches} - fcitx-libpinyin ExclusiveArch: %{qt5_qtwebengine_arches} - fedora-dockerfiles ExclusiveArch: %{go_arches} - fes ExclusiveArch: %{ix86} x86_64 - fkill-cli ExclusiveArch: %{nodejs_arches} noarch - florist ExclusiveArch: %{GPRbuild_arches} - fluent-bit ExclusiveArch: x86_64 aarch64 - fpc ExclusiveArch: %{arm} aarch64 %{ix86} x86_64 ppc64le - frescobaldi ExclusiveArch: %{qt5_qtwebengine_arches} - frysk ExclusiveArch: %{ix86} x86_64 ppc64 - fwts ExclusiveArch: x86_64 %{arm} aarch64 s390x riscv64 %{power64} - fwupd-efi ExclusiveArch: x86_64 aarch64 - fx ExclusiveArch: %{nodejs_arches} noarch - fx-completion ExclusiveArch: %{nodejs_arches} noarch - ga ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ppc64le - gbrainy ExclusiveArch: %mono_arches - gdb-exploitable ExclusiveArch: x86_64 i386 ExclusiveArch: x86_64 noarch - gearhead1 ExclusiveArch: %{fpc_arches} - gela-asis ExclusiveArch: %GPRbuild_arches - ghdl ExclusiveArch: %{GNAT_arches} - ghostwriter ExclusiveArch: %{qt5_qtwebengine_arches} - gio-sharp ExclusiveArch: %mono_arches - gir-to-d ExclusiveArch: %{ldc_arches} - git-octopus ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm}} - gitqlient ExclusiveArch: %{qt5_qtwebengine_arches} - giver ExclusiveArch: %{mono_arches} - gkeyfile-sharp ExclusiveArch: %mono_arches - glibc32 ExclusiveArch: x86_64 - glibd ExclusiveArch: %{ldc_arches} - gmqcc ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - gnatcoll ExclusiveArch: %{GPRbuild_arches} - gnatcoll-bindings ExclusiveArch: %{GPRbuild_arches} - gnatcoll-db ExclusiveArch: %{GPRbuild_arches} - gnome-boxes ExclusiveArch: x86_64 - gnome-desktop-sharp ExclusiveArch: %mono_arches - gnome-do ExclusiveArch: %mono_arches - gnome-keyring-sharp ExclusiveArch: %mono_arches - gnome-rdp ExclusiveArch: %{mono_arches} - gnome-sharp ExclusiveArch: %mono_arches - gnome-subtitles ExclusiveArch: %mono_arches - gnu-efi ExclusiveArch: %{efi} - go-bindata ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - go-compilers ExclusiveArch: %{go_arches} - go-rpm-macros ExclusiveArch: %{golang_arches} %{gccgo_arches} - godep ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - golang ExclusiveArch: %{golang_arches} - gomtree ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - gotun ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} ExclusiveArch: x86_64 - goverlay ExclusiveArch: %{fpc_arches} - gprbuild ExclusiveArch: %{GPRbuild_arches} %{bootstrap_arch} - gprolog ExclusiveArch: x86_64 %{ix86} ppc alpha - grafana ExclusiveArch: %{grafana_arches} - grafana-pcp ExclusiveArch: %{grafanapcp_arches} - gtk-sharp-beans ExclusiveArch: %mono_arches - gtk-sharp2 ExclusiveArch: %mono_arches - gtk-sharp3 ExclusiveArch: %{mono_arches} - gtkd ExclusiveArch: %{ldc_arches} - gudev-sharp ExclusiveArch: %mono_arches - guestfs-tools ExclusiveArch: %{kernel_arches} - hedgewars ExclusiveArch: %{fpc_arches} - hsakmt ExclusiveArch: x86_64 aarch64 - hyena ExclusiveArch: %{mono_arches} - hyperscan ExclusiveArch: x86_64 - hyperv-daemons ExclusiveArch: i686 x86_64 - i3status-rs ExclusiveArch: %{rust_arches} - icaro ExclusiveArch: %{ix86} x86_64 noarch - imvirt ExclusiveArch: %{ix86} x86_64 ia64 - indistarter ExclusiveArch: %{fpc_arches} - infinipath-psm ExclusiveArch: x86_64 - intel-cmt-cat ExclusiveArch: x86_64 i686 i586 ExclusiveArch: x86_64 i686 i586 - intel-gmmlib ExclusiveArch: x86_64 i686 - intel-ipp-crypto-mb ExclusiveArch: x86_64 ExclusiveArch: x86_64 - intel-ipsec-mb ExclusiveArch: x86_64 ExclusiveArch: x86_64 - intel-mediasdk ExclusiveArch: x86_64 - intel-undervolt ExclusiveArch: i386 x86_64 - ioport ExclusiveArch: %{ix86} x86_64 - ipmctl ExclusiveArch: x86_64 - ispc ExclusiveArch: x86_64 aarch64 - iucode-tool ExclusiveArch: %{ix86} x86_64 - iyfct ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc64le - java-1.8.0-openjdk-aarch32 ExclusiveArch: %{arm} - jigawatts ExclusiveArch: x86_64 %{arm} ppc64le aarch64 s390x - kchmviewer ExclusiveArch: %{qt5_qtwebengine_arches} - keepass ExclusiveArch: %{mono_arches} - kernel ExclusiveArch: noarch x86_64 s390x %{arm} aarch64 ppc64le ExclusiveArch: noarch i386 i686 x86_64 s390x %{arm} aarch64 ppc64le - keyring-ima-signer ExclusiveArch: %{rust_arches} - kf5-akonadi-search ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-audiocd-kio ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-kalarmcal ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-kblog ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-kcalendarcore ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-kcalendarutils ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-kitinerary ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-ktnef ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-libkdcraw ExclusiveArch: x86_64 ppc64le %{arm} - kicad ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ppc64le - kiwix-desktop ExclusiveArch: %{qt5_qtwebengine_arches} - klee ExclusiveArch: x86_64 - knot-resolver ExclusiveArch: %{ix86} x86_64 ExclusiveArch: %{arm} aarch64 %{ix86} x86_64 - knotes ExclusiveArch: x86_64 %{arm} - kompose ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 s390x - kubernetes ExclusiveArch: x86_64 aarch64 ppc64le s390x %{arm} - lazarus ExclusiveArch: %{fpc_arches} - lazpaint ExclusiveArch: %{fpc_arches} - ldc ExclusiveArch: %{ldc_arches} - libbsr ExclusiveArch: %{power64} - libclc ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 %{power64} s390x - libcxl ExclusiveArch: %{power64} - libdfp ExclusiveArch: ppc ppc64 ppc64le s390 s390x x86_64 - libdispatch ExclusiveArch: x86_64 aarch64 - libguestfs ExclusiveArch: %{kernel_arches} - libica ExclusiveArch: s390 s390x - libipt ExclusiveArch: %{ix86} x86_64 ExclusiveArch: %{ix86} x86_64 - libkgapi ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - libnxz ExclusiveArch: ppc64le - libocxl ExclusiveArch: ppc64le - libpmemobj-cpp ExclusiveArch: x86_64 ppc64le - libpsm2 ExclusiveArch: x86_64 - libquentier ExclusiveArch: %{qt5_qtwebengine_arches} - libretro-desmume2015 ExclusiveArch: i686 x86_64 - librtas ExclusiveArch: %{power64} - libservicelog ExclusiveArch: ppc %{power64} - libsmbios ExclusiveArch: x86_64 %{ix86} - libunwind ExclusiveArch: %{arm} aarch64 hppa ia64 mips ppc %{power64} s390x %{ix86} x86_64 - libva-intel-hybrid-driver ExclusiveArch: %{ix86} x86_64 ia64 - libvma ExclusiveArch: x86_64 ppc64le ppc64 aarch64 - libvmi ExclusiveArch: x86_64 - libvpd ExclusiveArch: %{power64} - libxsmm ExclusiveArch: x86_64 - libzfcphbaapi ExclusiveArch: s390 s390x - lightdm ExclusiveArch: x86_64 ppc64le - llhttp ExclusiveArch: %{nodejs_arches} - log4net ExclusiveArch: %mono_arches - lrmi ExclusiveArch: %{ix86} - lsvpd ExclusiveArch: %{power64} - luajit ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} aarch64 - luxcorerender ExclusiveArch: x86_64 - mactel-boot ExclusiveArch: x86_64 - manifest-tool ExclusiveArch: x86_64 aarch64 ppc64le s390x - marked ExclusiveArch: %{nodejs_arches} noarch ExclusiveArch: %{ix86} x86_64 %{arm} noarch - matreshka ExclusiveArch: %GPRbuild_arches - maxima ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc sparcv9 ExclusiveArch: %{ix86} x86_64 ppc sparcv9 - mbpfan ExclusiveArch: x86_64 - mcelog ExclusiveArch: i686 x86_64 - mdevctl ExclusiveArch: %{rust_arches} - mediaconch ExclusiveArch: %{qt5_qtwebengine_arches} - mellowplayer ExclusiveArch: %{qt5_qtwebengine_arches} - memkind ExclusiveArch: x86_64 ppc64 ppc64le s390x aarch64 - memtest86+ ExclusiveArch: %{ix86} x86_64 - mesos ExclusiveArch: x86_64 - microcode_ctl ExclusiveArch: %{ix86} x86_64 - micropython ExclusiveArch: %{arm} %{ix86} x86_64 - mine_detector ExclusiveArch: %{GPRbuild_arches} - minetest ExclusiveArch: %{ix86} x86_64 ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} aarch64 - mingw-libidn2 ExclusiveArch: %{ix86} x86_64 %{arm} - mingw-wine-gecko ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - mirrorlist-server ExclusiveArch: %{rust_arches} - mkbootdisk ExclusiveArch: %{ix86} sparc sparc64 x86_64 - mod_mono ExclusiveArch: %mono_arches - module-build-service ExclusiveArch: %{ix86} x86_64 noarch - mokutil ExclusiveArch: %{ix86} x86_64 aarch64 %{arm} - mono ExclusiveArch: %mono_arches - mono-addins ExclusiveArch: %mono_arches - mono-basic ExclusiveArch: %{mono_arches} - mono-bouncycastle ExclusiveArch: %mono_arches - mono-cecil ExclusiveArch: %mono_arches - mono-cecil-flowanalysis ExclusiveArch: %mono_arches - mono-reflection ExclusiveArch: %mono_arches - mono-tools ExclusiveArch: %mono_arches - mono-zeroconf ExclusiveArch: %mono_arches - monobristol ExclusiveArch: %{mono_arches} - monodevelop ExclusiveArch: %mono_arches - monodevelop-debugger-gdb ExclusiveArch: %{mono_arches} - monosim ExclusiveArch: %mono_arches - mrrescue ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc64le - msr-tools ExclusiveArch: %{ix86} x86_64 - mustache-d ExclusiveArch: %{ldc_arches} - mysql-connector-net ExclusiveArch: %{mono_arches} - nant ExclusiveArch: %mono_arches - nativejit ExclusiveArch: x86_64 - nbc ExclusiveArch: %{fpc_arches} - nbdkit ExclusiveArch: x86_64 - ndesk-dbus ExclusiveArch: %{mono_arches} - ndesk-dbus-glib ExclusiveArch: %{mono_arches} - newsflash ExclusiveArch: %{rust_arches} - newtonsoft-json ExclusiveArch: %{mono_arches} - nispor ExclusiveArch: %{rust_arches} - nodejs ExclusiveArch: %{nodejs_arches} - nodejs-acorn-object-spread ExclusiveArch: %{nodejs_arches} noarch ExclusiveArch: %{ix86} x86_64 %{arm} noarch - nodejs-backbone ExclusiveArch: %{nodejs_arches} noarch - nodejs-bash-language-server ExclusiveArch: %{nodejs_arches} noarch - nodejs-buble ExclusiveArch: %{nodejs_arches} noarch - nodejs-colors ExclusiveArch: %{nodejs_arches} noarch - nodejs-generic-pool ExclusiveArch: %{nodejs_arches} noarch - nodejs-linefix ExclusiveArch: %{nodejs_arches} noarch ExclusiveArch: %{ix86} x86_64 %{arm} noarch - nodejs-nodemon ExclusiveArch: %{nodejs_arches} noarch - nodejs-packaging ExclusiveArch: %{nodejs_arches} noarch - nodejs-replace-require-self ExclusiveArch: %{nodejs_arches} noarch - nodejs-supervisor ExclusiveArch: %{nodejs_arches} noarch - nodejs-svgo ExclusiveArch: %{nodejs_arches} noarch - nodejs-tape ExclusiveArch: %{nodejs_arches} noarch - nodejs-typescript ExclusiveArch: %{nodejs_arches} noarch - nodejs-underscore ExclusiveArch: %{nodejs_arches} noarch ExclusiveArch: %{ix86} x86_64 %{arm} noarch - notify-sharp ExclusiveArch: %{mono_arches} - notify-sharp3 ExclusiveArch: %{mono_arches} - npm-name-cli ExclusiveArch: %{nodejs_arches} noarch - nuget ExclusiveArch: %{mono_arches} - numatop ExclusiveArch: x86_64 ppc64le - nunit ExclusiveArch: %{mono_arches} - nunit2 ExclusiveArch: %{mono_arches} - nvml ExclusiveArch: x86_64 ppc64le - nwchem ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ppc64le - obs-service-rust2rpm ExclusiveArch: %{rust_arches} noarch - oci-kvm-hook ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm}} - oci-seccomp-bpf-hook ExclusiveArch: x86_64 %%{power64} aarch64 s390x armv7hl - oci-umount ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ppc64le s390x %{mips} - oidn ExclusiveArch: x86_64 - olpc-kbdshim ExclusiveArch: %{ix86} %{arm} - olpc-utils ExclusiveArch: %{ix86} %{arm} - onednn ExclusiveArch: x86_64 aarch64 ppc64le s390x - onedrive ExclusiveArch: %{ldc_arches} - opae ExclusiveArch: x86_64 - opal-prd ExclusiveArch: ppc64le - open-vm-tools ExclusiveArch: x86_64 ExclusiveArch: %{ix86} x86_64 aarch64 - openblas ExclusiveArch: %{openblas_arches} - openjfx ExclusiveArch: x86_64 - openjfx8 ExclusiveArch: x86_64 - openlibm ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 %{power64} - openni ExclusiveArch: %{ix86} x86_64 %{arm} - openni-primesense ExclusiveArch: %{ix86} x86_64 %{arm} - openshadinglanguage ExclusiveArch: x86_64 aarch64 ppc64le s390x - openssl-ibmca ExclusiveArch: s390 s390x - origin ExclusiveArch: %{go_arches} ExclusiveArch: x86_64 aarch64 ppc64le s390x - orion ExclusiveArch: %{qt5_qtwebengine_arches} - orthorobot ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc64le - pacemaker ExclusiveArch: aarch64 i686 ppc64le s390x x86_64 %{arm} ExclusiveArch: aarch64 i686 ppc64le s390x x86_64 - paflib ExclusiveArch: ppc %{power64} - parsec ExclusiveArch: %{rust_arches} - parsec-tool ExclusiveArch: %{rust_arches} - pcc ExclusiveArch: %{ix86} x86_64 - pcm ExclusiveArch: %{ix86} x86_64 - pcmciautils ExclusiveArch: %{ix86} x86_64 ia64 ppc ppc64 %{arm} - pdbg ExclusiveArch: ppc64le - pdfmod ExclusiveArch: %mono_arches - perl-Dumbbench ExclusiveArch: %{ix86} x86_64 noarch - perl-Parse-DMIDecode ExclusiveArch: %{ix86} x86_64 ia64 aarch64 - pesign ExclusiveArch: %{ix86} x86_64 ia64 aarch64 %{arm} - pesign-test-app ExclusiveArch: x86_64 - pinta ExclusiveArch: %mono_arches - pioneer ExclusiveArch: %{ix86} x86_64 - playonlinux ExclusiveArch: %{arm} aarch64 %{ix86} x86_64 - pmdk-convert ExclusiveArch: x86_64 - pmemkv ExclusiveArch: x86_64 - podman ExclusiveArch: %{golang_arches} - poppler-sharp ExclusiveArch: %mono_arches - popub ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - powerpc-utils ExclusiveArch: ppc %{power64} - ppc64-diag ExclusiveArch: ppc %{power64} - pveclib ExclusiveArch: ppc %{power64} - pvs-sbcl ExclusiveArch: %{ix86} x86_64 ppc sparcv9 - pyqtwebengine ExclusiveArch: %{qt5_qtwebengine_arches} - python-cryptography ExclusiveArch: %{rust_arches} - python-etcd ExclusiveArch: noarch %{ix86} x86_64 %{arm} aarch64 ppc64le s390x - python-healpy ExclusiveArch: aarch64 ppc64 ppc64le x86_64 s390x - python-javabridge ExclusiveArch: i686 x86_64 - python-openoffice ExclusiveArch: noarch x86_64 - python-pymoc ExclusiveArch: aarch64 ppc64 ppc64le x86_64 s390x - python-setuptools-rust ExclusiveArch: %{rust_arches} - q4wine ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - qatzip ExclusiveArch: x86_64 - qcint ExclusiveArch: x86_64 - qclib ExclusiveArch: s390 s390x - qemu-sanity-check ExclusiveArch: %{kernel_arches} - qevercloud ExclusiveArch: %{qt5_qtwebengine_arches} - qmapshack ExclusiveArch: %{qt5_qtwebengine_arches} - qt4pas ExclusiveArch: %{fpc_arches} - qt5-qtwebengine ExclusiveArch: %{qt5_qtwebengine_arches} - quantum-espresso ExclusiveArch: x86_64 %{ix86} aarch64 %{power64} - quentier ExclusiveArch: %{qt5_qtwebengine_arches} - rear ExclusiveArch: %ix86 x86_64 ppc ppc64 ppc64le ia64 - reg ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm}} - renderdoc ExclusiveArch: x86_64 - reptyr ExclusiveArch: %{ix86} x86_64 %{arm} - rescene ExclusiveArch: %{mono_arches} - restool ExclusiveArch: aarch64 - restsharp ExclusiveArch: %{mono_arches} - rhythmbox-alternative-toolbar ExclusiveArch: %{ix86} %{arm} x86_64 ppc64 ppc64le - rocm-runtime ExclusiveArch: x86_64 aarch64 - rocminfo ExclusiveArch: x86_64 aarch64 - rpg-cli ExclusiveArch: %{rust_arches} - rpm-ostree ExclusiveArch: %{rust_arches} - rr ExclusiveArch: %{ix86} x86_64 aarch64 - rssguard ExclusiveArch: %{qt5_qtwebengine_arches} - rubygem-childprocess ExclusiveArch: %{ix86} x86_64 noarch - runc ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ppc64le %{mips} s390x - rust ExclusiveArch: %{rust_arches} - rust-Inflector ExclusiveArch: %{rust_arches} - rust-ab_glyph ExclusiveArch: %{rust_arches} - rust-ab_glyph_rasterizer ExclusiveArch: %{rust_arches} - rust-abomonation ExclusiveArch: %{rust_arches} - rust-actix ExclusiveArch: %{rust_arches} - rust-actix-codec ExclusiveArch: %{rust_arches} - rust-actix-connect ExclusiveArch: %{rust_arches} - rust-actix-http ExclusiveArch: %{rust_arches} - rust-actix-macros ExclusiveArch: %{rust_arches} - rust-actix-router ExclusiveArch: %{rust_arches} - rust-actix-rt ExclusiveArch: %{rust_arches} - rust-actix-server ExclusiveArch: %{rust_arches} - rust-actix-service ExclusiveArch: %{rust_arches} - rust-actix-testing ExclusiveArch: %{rust_arches} - rust-actix-threadpool ExclusiveArch: %{rust_arches} - rust-actix-tls ExclusiveArch: %{rust_arches} - rust-actix-utils ExclusiveArch: %{rust_arches} - rust-actix-web ExclusiveArch: %{rust_arches} - rust-actix-web-codegen ExclusiveArch: %{rust_arches} - rust-actix0.10 ExclusiveArch: %{rust_arches} - rust-actix_derive ExclusiveArch: %{rust_arches} - rust-actix_derive0.5 ExclusiveArch: %{rust_arches} - rust-addr2line ExclusiveArch: %{rust_arches} - rust-adler ExclusiveArch: %{rust_arches} - rust-adler32 ExclusiveArch: %{rust_arches} - rust-aead ExclusiveArch: %{rust_arches} - rust-aes ExclusiveArch: %{rust_arches} - rust-aes-gcm ExclusiveArch: %{rust_arches} - rust-afterburn ExclusiveArch: %{rust_arches} - rust-ahash ExclusiveArch: %{rust_arches} - rust-ahash0.4 ExclusiveArch: %{rust_arches} - rust-aho-corasick ExclusiveArch: %{rust_arches} - rust-alacritty ExclusiveArch: %{rust_arches} - rust-alacritty_config_derive ExclusiveArch: %{rust_arches} - rust-alacritty_terminal ExclusiveArch: %{rust_arches} - rust-alga ExclusiveArch: %{rust_arches} - rust-alga_derive ExclusiveArch: %{rust_arches} - rust-aliasable ExclusiveArch: %{rust_arches} - rust-alloc-no-stdlib ExclusiveArch: %{rust_arches} - rust-alloc-stdlib ExclusiveArch: %{rust_arches} - rust-alsa ExclusiveArch: %{rust_arches} - rust-alsa-sys ExclusiveArch: %{rust_arches} - rust-ambient-authority ExclusiveArch: %{rust_arches} - rust-ammonia ExclusiveArch: %{rust_arches} - rust-andrew ExclusiveArch: %{rust_arches} - rust-ansi_colours ExclusiveArch: %{rust_arches} - rust-ansi_term ExclusiveArch: %{rust_arches} - rust-ansi_term0.11 ExclusiveArch: %{rust_arches} - rust-antidote ExclusiveArch: %{rust_arches} - rust-anyhow ExclusiveArch: %{rust_arches} - rust-aom-sys ExclusiveArch: %{rust_arches} - rust-app_dirs ExclusiveArch: %{rust_arches} - rust-approx ExclusiveArch: %{rust_arches} - rust-ar ExclusiveArch: %{rust_arches} - rust-arbitrary ExclusiveArch: %{rust_arches} - rust-arbitrary0.4 ExclusiveArch: %{rust_arches} - rust-arc-swap ExclusiveArch: %{rust_arches} - rust-arg_enum_proc_macro ExclusiveArch: %{rust_arches} - rust-argh ExclusiveArch: %{rust_arches} - rust-argh_derive ExclusiveArch: %{rust_arches} - rust-argh_shared ExclusiveArch: %{rust_arches} - rust-argparse ExclusiveArch: %{rust_arches} - rust-array-init ExclusiveArch: %{rust_arches} - rust-arrayref ExclusiveArch: %{rust_arches} - rust-arrayvec ExclusiveArch: %{rust_arches} - rust-arrayvec0.5 ExclusiveArch: %{rust_arches} - rust-article_scraper ExclusiveArch: %{rust_arches} - rust-ascii ExclusiveArch: %{rust_arches} - rust-ascii-canvas ExclusiveArch: %{rust_arches} - rust-askalono ExclusiveArch: %{rust_arches} - rust-askalono-cli ExclusiveArch: %{rust_arches} - rust-askama ExclusiveArch: %{rust_arches} - rust-askama_derive ExclusiveArch: %{rust_arches} - rust-askama_escape ExclusiveArch: %{rust_arches} - rust-askama_shared ExclusiveArch: %{rust_arches} - rust-asn1 ExclusiveArch: %{rust_arches} - rust-asn1_derive ExclusiveArch: %{rust_arches} - rust-assert-impl ExclusiveArch: %{rust_arches} - rust-assert-json-diff ExclusiveArch: %{rust_arches} - rust-assert_approx_eq ExclusiveArch: %{rust_arches} - rust-assert_cli ExclusiveArch: %{rust_arches} - rust-assert_cmd ExclusiveArch: %{rust_arches} - rust-assert_fs ExclusiveArch: %{rust_arches} - rust-assert_matches ExclusiveArch: %{rust_arches} - rust-assign ExclusiveArch: %{rust_arches} - rust-async-attributes ExclusiveArch: %{rust_arches} - rust-async-channel ExclusiveArch: %{rust_arches} - rust-async-compression ExclusiveArch: %{rust_arches} - rust-async-executor ExclusiveArch: %{rust_arches} - rust-async-global-executor ExclusiveArch: %{rust_arches} - rust-async-io ExclusiveArch: %{rust_arches} - rust-async-lock ExclusiveArch: %{rust_arches} - rust-async-mutex ExclusiveArch: %{rust_arches} - rust-async-process ExclusiveArch: %{rust_arches} - rust-async-std ExclusiveArch: %{rust_arches} - rust-async-stream ExclusiveArch: %{rust_arches} - rust-async-stream-impl ExclusiveArch: %{rust_arches} - rust-async-task ExclusiveArch: %{rust_arches} - rust-async-trait ExclusiveArch: %{rust_arches} - rust-asyncgit ExclusiveArch: %{rust_arches} - rust-atk ExclusiveArch: %{rust_arches} - rust-atk-sys ExclusiveArch: %{rust_arches} - rust-atom ExclusiveArch: %{rust_arches} - rust-atomic-waker ExclusiveArch: %{rust_arches} - rust-attohttpc ExclusiveArch: %{rust_arches} - rust-atty ExclusiveArch: %{rust_arches} - rust-autocfg ExclusiveArch: %{rust_arches} - rust-automod ExclusiveArch: %{rust_arches} - rust-av-metrics ExclusiveArch: %{rust_arches} - rust-average ExclusiveArch: %{rust_arches} - rust-aws-nitro-enclaves-cose ExclusiveArch: %{rust_arches} - rust-az ExclusiveArch: %{rust_arches} - rust-backtrace ExclusiveArch: %{rust_arches} - rust-base100 ExclusiveArch: %{rust_arches} - rust-base64 ExclusiveArch: %{rust_arches} - rust-base64-0.10 ExclusiveArch: %{rust_arches} - rust-base64-0.11 ExclusiveArch: %{rust_arches} - rust-base64_0.12 ExclusiveArch: %{rust_arches} - rust-bat ExclusiveArch: %{rust_arches} - rust-battery ExclusiveArch: %{rust_arches} - rust-beef ExclusiveArch: %{rust_arches} - rust-below ExclusiveArch: %{rust_arches} - rust-below-common ExclusiveArch: %{rust_arches} - rust-below-config ExclusiveArch: %{rust_arches} - rust-below-dump ExclusiveArch: %{rust_arches} - rust-below-model ExclusiveArch: %{rust_arches} - rust-below-render ExclusiveArch: %{rust_arches} - rust-below-store ExclusiveArch: %{rust_arches} - rust-below-view ExclusiveArch: %{rust_arches} - rust-below_derive ExclusiveArch: %{rust_arches} - rust-bencher ExclusiveArch: %{rust_arches} - rust-benfred-read-process-memory ExclusiveArch: %{rust_arches} - rust-bincode ExclusiveArch: %{rust_arches} - rust-bincode0.8 ExclusiveArch: %{rust_arches} - rust-bindgen ExclusiveArch: %{rust_arches} - rust-binfarce ExclusiveArch: %{rust_arches} - rust-biscuit ExclusiveArch: %{rust_arches} - rust-bit-set ExclusiveArch: %{rust_arches} - rust-bit-vec ExclusiveArch: %{rust_arches} - rust-bitfield ExclusiveArch: %{rust_arches} - rust-bitflags ExclusiveArch: %{rust_arches} - rust-bitmaps ExclusiveArch: %{rust_arches} - rust-bitreader ExclusiveArch: %{rust_arches} - rust-bitstream-io ExclusiveArch: %{rust_arches} - rust-bitvec ExclusiveArch: %{rust_arches} - rust-blake2 ExclusiveArch: %{rust_arches} - rust-blobby ExclusiveArch: %{rust_arches} - rust-blobby0.1 ExclusiveArch: %{rust_arches} - rust-block-buffer ExclusiveArch: %{rust_arches} - rust-block-modes ExclusiveArch: %{rust_arches} - rust-block-padding ExclusiveArch: %{rust_arches} - rust-blocking ExclusiveArch: %{rust_arches} - rust-blsctl ExclusiveArch: %{rust_arches} - rust-bodhi ExclusiveArch: %{rust_arches} - rust-bodhi-cli ExclusiveArch: %{rust_arches} - rust-bootupd ExclusiveArch: x86_64 aarch64 - rust-box_drawing ExclusiveArch: %{rust_arches} - rust-boxfnonce ExclusiveArch: %{rust_arches} - rust-brotli ExclusiveArch: %{rust_arches} - rust-brotli-decompressor ExclusiveArch: %{rust_arches} - rust-brotli-sys ExclusiveArch: %{rust_arches} - rust-brotli2 ExclusiveArch: %{rust_arches} - rust-bstr ExclusiveArch: %{rust_arches} - rust-btrd ExclusiveArch: %{rust_arches} - rust-buf_redux ExclusiveArch: %{rust_arches} - rust-buffered-reader ExclusiveArch: %{rust_arches} - rust-bufsize ExclusiveArch: %{rust_arches} - rust-bufstream ExclusiveArch: %{rust_arches} - rust-bugreport ExclusiveArch: %{rust_arches} - rust-build-env ExclusiveArch: %{rust_arches} - rust-build_const ExclusiveArch: %{rust_arches} - rust-bumpalo ExclusiveArch: %{rust_arches} - rust-byte-unit ExclusiveArch: %{rust_arches} - rust-byte-unit3 ExclusiveArch: %{rust_arches} - rust-bytecheck ExclusiveArch: %{rust_arches} - rust-bytecheck_derive ExclusiveArch: %{rust_arches} - rust-bytecount ExclusiveArch: %{rust_arches} - rust-bytelines ExclusiveArch: %{rust_arches} - rust-bytemuck ExclusiveArch: %{rust_arches} - rust-bytemuck_derive ExclusiveArch: %{rust_arches} - rust-byteorder ExclusiveArch: %{rust_arches} - rust-bytes ExclusiveArch: %{rust_arches} - rust-bytes0.4 ExclusiveArch: %{rust_arches} - rust-bytes0.5 ExclusiveArch: %{rust_arches} - rust-bytes0.6 ExclusiveArch: %{rust_arches} - rust-bytesize ExclusiveArch: %{rust_arches} - rust-bytestring ExclusiveArch: %{rust_arches} - rust-bzip2 ExclusiveArch: %{rust_arches} - rust-bzip2-sys ExclusiveArch: %{rust_arches} - rust-cache-padded ExclusiveArch: %{rust_arches} - rust-cairo-rs ExclusiveArch: %{rust_arches} - rust-cairo-sys-rs ExclusiveArch: %{rust_arches} - rust-calloop ExclusiveArch: %{rust_arches} - rust-calloop0.6 ExclusiveArch: %{rust_arches} - rust-camino ExclusiveArch: %{rust_arches} - rust-cap-primitives ExclusiveArch: %{rust_arches} - rust-cap-rand ExclusiveArch: %{rust_arches} - rust-cap-std ExclusiveArch: %{rust_arches} - rust-capnp ExclusiveArch: %{rust_arches} - rust-capnp-futures ExclusiveArch: %{rust_arches} - rust-capnp-rpc ExclusiveArch: %{rust_arches} - rust-caps ExclusiveArch: %{rust_arches} - rust-cargo ExclusiveArch: %{rust_arches} - rust-cargo-bloat ExclusiveArch: %{rust_arches} - rust-cargo-c ExclusiveArch: %{rust_arches} - rust-cargo-edit ExclusiveArch: %{rust_arches} - rust-cargo-husky ExclusiveArch: %{rust_arches} - rust-cargo-insta ExclusiveArch: %{rust_arches} - rust-cargo-platform ExclusiveArch: %{rust_arches} - rust-cargo-readme ExclusiveArch: %{rust_arches} - rust-cargo-util ExclusiveArch: %{rust_arches} - rust-cargo_metadata ExclusiveArch: %{rust_arches} - rust-cascade ExclusiveArch: %{rust_arches} - rust-case ExclusiveArch: %{rust_arches} - rust-cassowary ExclusiveArch: %{rust_arches} - rust-cast ExclusiveArch: %{rust_arches} - rust-cbindgen ExclusiveArch: %{rust_arches} - rust-cc ExclusiveArch: %{rust_arches} - rust-cedarwood ExclusiveArch: %{rust_arches} - rust-cexpr ExclusiveArch: %{rust_arches} - rust-cfg-expr ExclusiveArch: %{rust_arches} - rust-cfg-if ExclusiveArch: %{rust_arches} - rust-cfg-if0.1 ExclusiveArch: %{rust_arches} - rust-cgmath ExclusiveArch: %{rust_arches} - rust-cgroupfs ExclusiveArch: %{rust_arches} - rust-chainerror ExclusiveArch: %{rust_arches} - rust-charset ExclusiveArch: %{rust_arches} - rust-chbs ExclusiveArch: %{rust_arches} - rust-checked_int_cast ExclusiveArch: %{rust_arches} - rust-chlorine ExclusiveArch: %{rust_arches} - rust-choosier ExclusiveArch: %{rust_arches} - rust-chrono ExclusiveArch: %{rust_arches} - rust-chrono-humanize ExclusiveArch: %{rust_arches} - rust-chrono-tz ExclusiveArch: %{rust_arches} - rust-chunked_transfer ExclusiveArch: %{rust_arches} - rust-cipher ExclusiveArch: %{rust_arches} - rust-clang-ast ExclusiveArch: %{rust_arches} - rust-clang-sys ExclusiveArch: %{rust_arches} - rust-clap ExclusiveArch: %{rust_arches} - rust-clap-verbosity-flag ExclusiveArch: %{rust_arches} - rust-clap2 ExclusiveArch: %{rust_arches} - rust-clap_derive ExclusiveArch: %{rust_arches} - rust-clap_generate ExclusiveArch: %{rust_arches} - rust-clap_generate_fig ExclusiveArch: %{rust_arches} - rust-claxon ExclusiveArch: %{rust_arches} - rust-clicolors-control ExclusiveArch: %{rust_arches} - rust-clipboard ExclusiveArch: %{rust_arches} - rust-clircle ExclusiveArch: %{rust_arches} - rust-cloudflare-zlib ExclusiveArch: x86_64 aarch64 - rust-cloudflare-zlib-sys ExclusiveArch: x86_64 aarch64 - rust-cmake ExclusiveArch: %{rust_arches} - rust-codespan-reporting ExclusiveArch: %{rust_arches} - rust-codicon ExclusiveArch: %{rust_arches} - rust-color-backtrace ExclusiveArch: %{rust_arches} - rust-color_quant ExclusiveArch: %{rust_arches} - rust-colored ExclusiveArch: %{rust_arches} - rust-colored1 ExclusiveArch: %{rust_arches} - rust-colored_json ExclusiveArch: %{rust_arches} - rust-colorful ExclusiveArch: %{rust_arches} - rust-combine ExclusiveArch: %{rust_arches} - rust-comfy-table ExclusiveArch: %{rust_arches} - rust-compiletest_rs ExclusiveArch: %{rust_arches} - rust-compress-tools ExclusiveArch: %{rust_arches} - rust-comrak ExclusiveArch: %{rust_arches} - rust-concurrent-queue ExclusiveArch: %{rust_arches} - rust-configparser ExclusiveArch: %{rust_arches} - rust-confy ExclusiveArch: %{rust_arches} - rust-console ExclusiveArch: %{rust_arches} - rust-console0.11 ExclusiveArch: %{rust_arches} - rust-console0.12 ExclusiveArch: %{rust_arches} - rust-console0.13 ExclusiveArch: %{rust_arches} - rust-console0.9 ExclusiveArch: %{rust_arches} - rust-console_error_panic_hook ExclusiveArch: %{rust_arches} - rust-const-cstr ExclusiveArch: %{rust_arches} - rust-const-random ExclusiveArch: %{rust_arches} - rust-const-random-macro ExclusiveArch: %{rust_arches} - rust-const_fn ExclusiveArch: %{rust_arches} - rust-constant_time_eq ExclusiveArch: %{rust_arches} - rust-content_inspector ExclusiveArch: %{rust_arches} - rust-conv ExclusiveArch: %{rust_arches} - rust-convert_case ExclusiveArch: %{rust_arches} - rust-cookie ExclusiveArch: %{rust_arches} - rust-cookie_store ExclusiveArch: %{rust_arches} - rust-copydeps ExclusiveArch: %{rust_arches} - rust-copyless ExclusiveArch: %{rust_arches} - rust-copypasta ExclusiveArch: %{rust_arches} - rust-cordic ExclusiveArch: %{rust_arches} - rust-coreos-installer ExclusiveArch: %{rust_arches} - rust-counted-array ExclusiveArch: %{rust_arches} - rust-cpal ExclusiveArch: %{rust_arches} - rust-cpio ExclusiveArch: %{rust_arches} - rust-cpp_demangle ExclusiveArch: %{rust_arches} - rust-cpufeatures ExclusiveArch: %{rust_arches} - rust-cpython ExclusiveArch: %{rust_arches} - rust-cranelift-bforest ExclusiveArch: %{rust_arches} - rust-cranelift-codegen ExclusiveArch: %{rust_arches} - rust-cranelift-codegen-meta ExclusiveArch: %{rust_arches} - rust-cranelift-codegen-shared ExclusiveArch: %{rust_arches} - rust-cranelift-entity ExclusiveArch: %{rust_arches} - rust-cranelift-frontend ExclusiveArch: %{rust_arches} - rust-cranelift-native ExclusiveArch: %{rust_arches} - rust-cranelift-wasm ExclusiveArch: %{rust_arches} - rust-crates-io ExclusiveArch: %{rust_arches} - rust-crc ExclusiveArch: %{rust_arches} - rust-crc-any ExclusiveArch: %{rust_arches} - rust-crc-core ExclusiveArch: %{rust_arches} - rust-crc32fast ExclusiveArch: %{rust_arches} - rust-criterion ExclusiveArch: %{rust_arches} - rust-criterion-plot ExclusiveArch: %{rust_arches} - rust-crossbeam ExclusiveArch: %{rust_arches} - rust-crossbeam-channel ExclusiveArch: %{rust_arches} - rust-crossbeam-channel0.4 ExclusiveArch: %{rust_arches} - rust-crossbeam-deque ExclusiveArch: %{rust_arches} - rust-crossbeam-deque0.7 ExclusiveArch: %{rust_arches} - rust-crossbeam-epoch ExclusiveArch: %{rust_arches} - rust-crossbeam-epoch0.8 ExclusiveArch: %{rust_arches} - rust-crossbeam-queue ExclusiveArch: %{rust_arches} - rust-crossbeam-queue0.2 ExclusiveArch: %{rust_arches} - rust-crossbeam-utils ExclusiveArch: %{rust_arches} - rust-crossbeam-utils0.7 ExclusiveArch: %{rust_arches} - rust-crossbeam0.7 ExclusiveArch: %{rust_arches} - rust-crossfont ExclusiveArch: %{rust_arches} - rust-crossterm ExclusiveArch: %{rust_arches} - rust-crossterm0.17 ExclusiveArch: %{rust_arches} - rust-crossterm0.19 ExclusiveArch: %{rust_arches} - rust-crosstermion ExclusiveArch: %{rust_arches} - rust-crunchy ExclusiveArch: %{rust_arches} - rust-crypto-hash ExclusiveArch: %{rust_arches} - rust-crypto-mac ExclusiveArch: %{rust_arches} - rust-crypto-mac0.8 ExclusiveArch: %{rust_arches} - rust-cryptoki ExclusiveArch: %{rust_arches} - rust-cryptoki-sys ExclusiveArch: %{rust_arches} - rust-cryptovec ExclusiveArch: %{rust_arches} - rust-cssparser ExclusiveArch: %{rust_arches} - rust-cssparser-macros ExclusiveArch: %{rust_arches} - rust-cstr-argument ExclusiveArch: %{rust_arches} - rust-csv ExclusiveArch: %{rust_arches} - rust-csv-core ExclusiveArch: %{rust_arches} - rust-ct-logs ExclusiveArch: %{rust_arches} - rust-ctor ExclusiveArch: %{rust_arches} - rust-ctr ExclusiveArch: %{rust_arches} - rust-ctrlc ExclusiveArch: %{rust_arches} - rust-cty ExclusiveArch: %{rust_arches} - rust-curl ExclusiveArch: %{rust_arches} - rust-curl-sys ExclusiveArch: %{rust_arches} - rust-cursive ExclusiveArch: %{rust_arches} - rust-cursive-tabs ExclusiveArch: %{rust_arches} - rust-cursive_buffered_backend ExclusiveArch: %{rust_arches} - rust-cursive_core ExclusiveArch: %{rust_arches} - rust-curve25519-dalek ExclusiveArch: %{rust_arches} - rust-custom_derive ExclusiveArch: %{rust_arches} - rust-cxx ExclusiveArch: %{rust_arches} - rust-cxx-build ExclusiveArch: %{rust_arches} - rust-cxx-gen ExclusiveArch: %{rust_arches} - rust-cxxbridge-flags ExclusiveArch: %{rust_arches} - rust-cxxbridge-macro ExclusiveArch: %{rust_arches} - rust-darling ExclusiveArch: %{rust_arches} - rust-darling_core ExclusiveArch: %{rust_arches} - rust-darling_macro ExclusiveArch: %{rust_arches} - rust-dashmap ExclusiveArch: %{rust_arches} - rust-data-encoding ExclusiveArch: %{rust_arches} - rust-data-url ExclusiveArch: %{rust_arches} - rust-datetime ExclusiveArch: %{rust_arches} - rust-dav1d-sys ExclusiveArch: %{rust_arches} - rust-dbus ExclusiveArch: %{rust_arches} - rust-dbus-codegen ExclusiveArch: %{rust_arches} - rust-dbus-crossroads ExclusiveArch: %{rust_arches} - rust-dbus-tokio ExclusiveArch: %{rust_arches} - rust-dbus-tree ExclusiveArch: %{rust_arches} - rust-dbus0.8 ExclusiveArch: %{rust_arches} - rust-debug-helper ExclusiveArch: %{rust_arches} - rust-decimal ExclusiveArch: %{rust_arches} - rust-defer-drop ExclusiveArch: %{rust_arches} - rust-deflate ExclusiveArch: %{rust_arches} - rust-defmac ExclusiveArch: %{rust_arches} - rust-delta_e ExclusiveArch: %{rust_arches} - rust-derivative ExclusiveArch: %{rust_arches} - rust-derive-new ExclusiveArch: %{rust_arches} - rust-derive_arbitrary ExclusiveArch: %{rust_arches} - rust-derive_arbitrary0.4 ExclusiveArch: %{rust_arches} - rust-derive_builder ExclusiveArch: %{rust_arches} - rust-derive_builder0.9 ExclusiveArch: %{rust_arches} - rust-derive_builder_core ExclusiveArch: %{rust_arches} - rust-derive_builder_core0.9 ExclusiveArch: %{rust_arches} - rust-derive_builder_macro ExclusiveArch: %{rust_arches} - rust-derive_more ExclusiveArch: %{rust_arches} - rust-des ExclusiveArch: %{rust_arches} - rust-desed ExclusiveArch: %{rust_arches} - rust-deunicode ExclusiveArch: %{rust_arches} - rust-devicemapper ExclusiveArch: %{rust_arches} - rust-devicemapper-sys ExclusiveArch: %{rust_arches} - rust-dialoguer ExclusiveArch: %{rust_arches} - rust-diesel ExclusiveArch: %{rust_arches} - rust-diesel_derives ExclusiveArch: %{rust_arches} - rust-diesel_migrations ExclusiveArch: %{rust_arches} - rust-diff ExclusiveArch: %{rust_arches} - rust-difference ExclusiveArch: %{rust_arches} - rust-difflib ExclusiveArch: %{rust_arches} - rust-diffus ExclusiveArch: %{rust_arches} - rust-diffus-derive ExclusiveArch: %{rust_arches} - rust-digest ExclusiveArch: %{rust_arches} - rust-directories ExclusiveArch: %{rust_arches} - rust-directories-next ExclusiveArch: %{rust_arches} - rust-dirs ExclusiveArch: %{rust_arches} - rust-dirs-next ExclusiveArch: %{rust_arches} - rust-dirs-sys ExclusiveArch: %{rust_arches} - rust-dirs-sys-next ExclusiveArch: %{rust_arches} - rust-dirs2 ExclusiveArch: %{rust_arches} - rust-dirs3 ExclusiveArch: %{rust_arches} - rust-diskonaut ExclusiveArch: %{rust_arches} - rust-displaydoc ExclusiveArch: %{rust_arches} - rust-dissimilar ExclusiveArch: %{rust_arches} - rust-dlib ExclusiveArch: %{rust_arches} - rust-dlib0.4 ExclusiveArch: %{rust_arches} - rust-dlv-list ExclusiveArch: %{rust_arches} - rust-dns-lookup ExclusiveArch: %{rust_arches} - rust-dns-parser ExclusiveArch: %{rust_arches} - rust-doc-comment ExclusiveArch: %{rust_arches} - rust-docmatic ExclusiveArch: %{rust_arches} - rust-docopt ExclusiveArch: %{rust_arches} - rust-dotenv ExclusiveArch: %{rust_arches} - rust-downcast ExclusiveArch: %{rust_arches} - rust-downcast-rs ExclusiveArch: %{rust_arches} - rust-drg ExclusiveArch: %{rust_arches} - rust-dtoa ExclusiveArch: %{rust_arches} - rust-dtoa-short ExclusiveArch: %{rust_arches} - rust-dua-cli ExclusiveArch: %{rust_arches} - rust-duct ExclusiveArch: %{rust_arches} - rust-dummy ExclusiveArch: %{rust_arches} - rust-dunce ExclusiveArch: %{rust_arches} - rust-dutree ExclusiveArch: %{rust_arches} - rust-dyn-clone ExclusiveArch: %{rust_arches} - rust-easy-cast ExclusiveArch: %{rust_arches} - rust-easy-parallel ExclusiveArch: %{rust_arches} - rust-edit ExclusiveArch: %{rust_arches} - rust-edit-distance ExclusiveArch: %{rust_arches} - rust-either ExclusiveArch: %{rust_arches} - rust-elasticlunr-rs ExclusiveArch: %{rust_arches} - rust-elf ExclusiveArch: %{rust_arches} - rust-elfcat ExclusiveArch: %{rust_arches} - rust-ena ExclusiveArch: %{rust_arches} - rust-encode_unicode ExclusiveArch: %{rust_arches} - rust-encoding ExclusiveArch: %{rust_arches} - rust-encoding-index-japanese ExclusiveArch: %{rust_arches} - rust-encoding-index-korean ExclusiveArch: %{rust_arches} - rust-encoding-index-simpchinese ExclusiveArch: %{rust_arches} - rust-encoding-index-singlebyte ExclusiveArch: %{rust_arches} - rust-encoding-index-tradchinese ExclusiveArch: %{rust_arches} - rust-encoding_index_tests ExclusiveArch: %{rust_arches} - rust-encoding_rs ExclusiveArch: %{rust_arches} - rust-encoding_rs_io ExclusiveArch: %{rust_arches} - rust-endian-type ExclusiveArch: %{rust_arches} - rust-entities ExclusiveArch: %{rust_arches} - rust-enum-as-inner ExclusiveArch: %{rust_arches} - rust-enum-iterator ExclusiveArch: %{rust_arches} - rust-enum-iterator-derive ExclusiveArch: %{rust_arches} - rust-enum-map ExclusiveArch: %{rust_arches} - rust-enum-map-derive ExclusiveArch: %{rust_arches} - rust-enum-repr ExclusiveArch: %{rust_arches} - rust-enum_primitive ExclusiveArch: %{rust_arches} - rust-enumflags2 ExclusiveArch: %{rust_arches} - rust-enumflags2_derive ExclusiveArch: %{rust_arches} - rust-enumset ExclusiveArch: %{rust_arches} - rust-enumset_derive ExclusiveArch: %{rust_arches} - rust-env_logger ExclusiveArch: %{rust_arches} - rust-env_logger0.4 ExclusiveArch: %{rust_arches} - rust-env_logger0.5 ExclusiveArch: %{rust_arches} - rust-env_logger0.6 ExclusiveArch: %{rust_arches} - rust-env_logger0.7 ExclusiveArch: %{rust_arches} - rust-env_logger0.8 ExclusiveArch: %{rust_arches} - rust-env_proxy ExclusiveArch: %{rust_arches} - rust-environment ExclusiveArch: %{rust_arches} - rust-envsubst ExclusiveArch: %{rust_arches} - rust-epoll ExclusiveArch: %{rust_arches} - rust-erased-serde ExclusiveArch: %{rust_arches} - rust-err-derive ExclusiveArch: %{rust_arches} - rust-errln ExclusiveArch: %{rust_arches} - rust-errno ExclusiveArch: %{rust_arches} - rust-error-chain ExclusiveArch: %{rust_arches} - rust-escaper ExclusiveArch: %{rust_arches} - rust-escargot ExclusiveArch: %{rust_arches} - rust-euclid ExclusiveArch: %{rust_arches} - rust-event-listener ExclusiveArch: %{rust_arches} - rust-exa ExclusiveArch: %{rust_arches} - rust-executable-path ExclusiveArch: %{rust_arches} - rust-exitcode ExclusiveArch: %{rust_arches} - rust-exitfailure ExclusiveArch: %{rust_arches} - rust-expat-sys ExclusiveArch: %{rust_arches} - rust-extend ExclusiveArch: %{rust_arches} - rust-extprim ExclusiveArch: %{rust_arches} - rust-extprim_literals_macros ExclusiveArch: %{rust_arches} - rust-faccess ExclusiveArch: %{rust_arches} - rust-fail ExclusiveArch: %{rust_arches} - rust-failure ExclusiveArch: %{rust_arches} - rust-failure-tools ExclusiveArch: %{rust_arches} - rust-failure_derive ExclusiveArch: %{rust_arches} - rust-fake ExclusiveArch: %{rust_arches} - rust-fake-simd ExclusiveArch: %{rust_arches} - rust-fallible-iterator ExclusiveArch: %{rust_arches} - rust-fallible-streaming-iterator ExclusiveArch: %{rust_arches} - rust-fallible_collections ExclusiveArch: %{rust_arches} - rust-fancy-regex ExclusiveArch: %{rust_arches} - rust-fastrand ExclusiveArch: %{rust_arches} - rust-fb_procfs ExclusiveArch: %{rust_arches} - rust-fbthrift_codegen_includer_proc_macro ExclusiveArch: %{rust_arches} - rust-fd-find ExclusiveArch: %{rust_arches} - rust-fd-lock ExclusiveArch: %{rust_arches} - rust-fdlimit ExclusiveArch: %{rust_arches} - rust-fedora ExclusiveArch: %{rust_arches} - rust-fedora-coreos-pinger ExclusiveArch: %{rust_arches} - rust-fedora-update-feedback ExclusiveArch: %{rust_arches} - rust-feed-rs ExclusiveArch: %{rust_arches} - rust-feedbin_api ExclusiveArch: %{rust_arches} - rust-feedly_api ExclusiveArch: %{rust_arches} - rust-femme ExclusiveArch: %{rust_arches} - rust-fern ExclusiveArch: %{rust_arches} - rust-fever_api ExclusiveArch: %{rust_arches} - rust-ffsend ExclusiveArch: %{rust_arches} - rust-ffsend-api ExclusiveArch: %{rust_arches} - rust-field-offset ExclusiveArch: %{rust_arches} - rust-file-per-thread-logger ExclusiveArch: %{rust_arches} - rust-filedescriptor ExclusiveArch: %{rust_arches} - rust-filesize ExclusiveArch: %{rust_arches} - rust-filetime ExclusiveArch: %{rust_arches} - rust-filetreelist ExclusiveArch: %{rust_arches} - rust-find-crate ExclusiveArch: %{rust_arches} - rust-fixed ExclusiveArch: %{rust_arches} - rust-fixedbitset ExclusiveArch: %{rust_arches} - rust-flate2 ExclusiveArch: %{rust_arches} - rust-float-cmp ExclusiveArch: %{rust_arches} - rust-float-ord ExclusiveArch: %{rust_arches} - rust-fluent ExclusiveArch: %{rust_arches} - rust-fluent-bundle ExclusiveArch: %{rust_arches} - rust-fluent-langneg ExclusiveArch: %{rust_arches} - rust-fluent-syntax ExclusiveArch: %{rust_arches} - rust-fn-error-context ExclusiveArch: %{rust_arches} - rust-fnv ExclusiveArch: %{rust_arches} - rust-font-kit ExclusiveArch: %{rust_arches} - rust-foreign-types ExclusiveArch: %{rust_arches} - rust-foreign-types-macros ExclusiveArch: %{rust_arches} - rust-foreign-types-shared ExclusiveArch: %{rust_arches} - rust-foreign-types-shared0.1 ExclusiveArch: %{rust_arches} - rust-foreign-types0.3 ExclusiveArch: %{rust_arches} - rust-form_urlencoded ExclusiveArch: %{rust_arches} - rust-fragile ExclusiveArch: %{rust_arches} - rust-freetype ExclusiveArch: %{rust_arches} - rust-freetype-rs ExclusiveArch: %{rust_arches} - rust-freetype-sys ExclusiveArch: %{rust_arches} - rust-fs-set-times ExclusiveArch: %{rust_arches} - rust-fs2 ExclusiveArch: %{rust_arches} - rust-fs_extra ExclusiveArch: %{rust_arches} - rust-funty ExclusiveArch: %{rust_arches} - rust-futf ExclusiveArch: %{rust_arches} - rust-futures ExclusiveArch: %{rust_arches} - rust-futures-channel ExclusiveArch: %{rust_arches} - rust-futures-core ExclusiveArch: %{rust_arches} - rust-futures-cpupool ExclusiveArch: %{rust_arches} - rust-futures-executor ExclusiveArch: %{rust_arches} - rust-futures-io ExclusiveArch: %{rust_arches} - rust-futures-lite ExclusiveArch: %{rust_arches} - rust-futures-macro ExclusiveArch: %{rust_arches} - rust-futures-sink ExclusiveArch: %{rust_arches} - rust-futures-task ExclusiveArch: %{rust_arches} - rust-futures-test ExclusiveArch: %{rust_arches} - rust-futures-timer ExclusiveArch: %{rust_arches} - rust-futures-util ExclusiveArch: %{rust_arches} - rust-futures0.1 ExclusiveArch: %{rust_arches} - rust-fuzzy-matcher ExclusiveArch: %{rust_arches} - rust-fxhash ExclusiveArch: %{rust_arches} - rust-gdk ExclusiveArch: %{rust_arches} - rust-gdk-pixbuf ExclusiveArch: %{rust_arches} - rust-gdk-pixbuf-sys ExclusiveArch: %{rust_arches} - rust-gdk-sys ExclusiveArch: %{rust_arches} - rust-gdk4 ExclusiveArch: %{rust_arches} - rust-gdk4-sys ExclusiveArch: %{rust_arches} - rust-generic-array ExclusiveArch: %{rust_arches} - rust-generic-array0.12 ExclusiveArch: %{rust_arches} - rust-genmesh ExclusiveArch: %{rust_arches} - rust-getch ExclusiveArch: %{rust_arches} - rust-gethostname ExclusiveArch: %{rust_arches} - rust-getopts ExclusiveArch: %{rust_arches} - rust-getrandom ExclusiveArch: %{rust_arches} - rust-getrandom0.1 ExclusiveArch: %{rust_arches} - rust-getset ExclusiveArch: %{rust_arches} - rust-gettext-rs ExclusiveArch: %{rust_arches} - rust-gettext-sys ExclusiveArch: %{rust_arches} - rust-ghash ExclusiveArch: %{rust_arches} - rust-ghost ExclusiveArch: %{rust_arches} - rust-gif ExclusiveArch: %{rust_arches} - rust-gimli ExclusiveArch: %{rust_arches} - rust-gio ExclusiveArch: %{rust_arches} - rust-gio-sys ExclusiveArch: %{rust_arches} - rust-gir-format-check ExclusiveArch: %{rust_arches} - rust-git-delta ExclusiveArch: %{rust_arches} - rust-git-version ExclusiveArch: %{rust_arches} - rust-git-version-macro ExclusiveArch: %{rust_arches} - rust-git2 ExclusiveArch: %{rust_arches} - rust-git2-curl ExclusiveArch: %{rust_arches} - rust-gitui ExclusiveArch: %{rust_arches} - rust-gl_generator ExclusiveArch: %{rust_arches} - rust-glam ExclusiveArch: %{rust_arches} - rust-glib ExclusiveArch: %{rust_arches} - rust-glib-macros ExclusiveArch: %{rust_arches} - rust-glib-sys ExclusiveArch: %{rust_arches} - rust-glob ExclusiveArch: %{rust_arches} - rust-globset ExclusiveArch: %{rust_arches} - rust-globwalk ExclusiveArch: %{rust_arches} - rust-glutin ExclusiveArch: %{rust_arches} - rust-glutin_egl_sys ExclusiveArch: %{rust_arches} - rust-glutin_glx_sys ExclusiveArch: %{rust_arches} - rust-gobject-sys ExclusiveArch: %{rust_arches} - rust-goblin ExclusiveArch: %{rust_arches} - rust-gptman ExclusiveArch: %{rust_arches} - rust-graphene-rs ExclusiveArch: %{rust_arches} - rust-graphene-sys ExclusiveArch: %{rust_arches} - rust-grep ExclusiveArch: %{rust_arches} - rust-grep-cli ExclusiveArch: %{rust_arches} - rust-grep-matcher ExclusiveArch: %{rust_arches} - rust-grep-pcre2 ExclusiveArch: %{rust_arches} - rust-grep-printer ExclusiveArch: %{rust_arches} - rust-grep-regex ExclusiveArch: %{rust_arches} - rust-grep-searcher ExclusiveArch: %{rust_arches} - rust-groupable ExclusiveArch: %{rust_arches} - rust-gsk4 ExclusiveArch: %{rust_arches} - rust-gsk4-sys ExclusiveArch: %{rust_arches} - rust-gstreamer ExclusiveArch: %{rust_arches} - rust-gstreamer-audio ExclusiveArch: %{rust_arches} - rust-gstreamer-audio-sys ExclusiveArch: %{rust_arches} - rust-gstreamer-base ExclusiveArch: %{rust_arches} - rust-gstreamer-base-sys ExclusiveArch: %{rust_arches} - rust-gstreamer-editing-services ExclusiveArch: %{rust_arches} - rust-gstreamer-editing-services-sys ExclusiveArch: %{rust_arches} - rust-gstreamer-pbutils ExclusiveArch: %{rust_arches} - rust-gstreamer-pbutils-sys ExclusiveArch: %{rust_arches} - rust-gstreamer-player ExclusiveArch: %{rust_arches} - rust-gstreamer-player-sys ExclusiveArch: %{rust_arches} - rust-gstreamer-sys ExclusiveArch: %{rust_arches} - rust-gstreamer-video ExclusiveArch: %{rust_arches} - rust-gstreamer-video-sys ExclusiveArch: %{rust_arches} - rust-gtk ExclusiveArch: %{rust_arches} - rust-gtk-sys ExclusiveArch: %{rust_arches} - rust-gtk3-macros ExclusiveArch: %{rust_arches} - rust-gtk4 ExclusiveArch: %{rust_arches} - rust-gtk4-macros ExclusiveArch: %{rust_arches} - rust-gtk4-sys ExclusiveArch: %{rust_arches} - rust-gzip-header ExclusiveArch: %{rust_arches} - rust-h2 ExclusiveArch: %{rust_arches} - rust-h2_0.2 ExclusiveArch: %{rust_arches} - rust-half ExclusiveArch: %{rust_arches} - rust-hamcrest2 ExclusiveArch: %{rust_arches} - rust-handlebars ExclusiveArch: %{rust_arches} - rust-hashbrown ExclusiveArch: %{rust_arches} - rust-hashbrown0.9 ExclusiveArch: %{rust_arches} - rust-hashlink ExclusiveArch: %{rust_arches} - rust-headers ExclusiveArch: %{rust_arches} - rust-headers-core ExclusiveArch: %{rust_arches} - rust-headers-derive ExclusiveArch: %{rust_arches} - rust-heapsize ExclusiveArch: %{rust_arches} - rust-heatseeker ExclusiveArch: %{rust_arches} - rust-heck ExclusiveArch: %{rust_arches} - rust-hex ExclusiveArch: %{rust_arches} - rust-hex-literal ExclusiveArch: %{rust_arches} - rust-hex-literal-impl ExclusiveArch: %{rust_arches} - rust-hex-literal0.2 ExclusiveArch: %{rust_arches} - rust-hexyl ExclusiveArch: %{rust_arches} - rust-hidapi ExclusiveArch: %{rust_arches} - rust-hkdf ExclusiveArch: %{rust_arches} - rust-hmac ExclusiveArch: %{rust_arches} - rust-home ExclusiveArch: %{rust_arches} - rust-horrorshow ExclusiveArch: %{rust_arches} - rust-hostname ExclusiveArch: %{rust_arches} - rust-hostname-validator ExclusiveArch: %{rust_arches} - rust-hound ExclusiveArch: %{rust_arches} - rust-html-escape ExclusiveArch: %{rust_arches} - rust-html2pango ExclusiveArch: %{rust_arches} - rust-html5ever ExclusiveArch: %{rust_arches} - rust-http ExclusiveArch: %{rust_arches} - rust-http-body ExclusiveArch: %{rust_arches} - rust-http-body0.3 ExclusiveArch: %{rust_arches} - rust-http0.1 ExclusiveArch: %{rust_arches} - rust-httparse ExclusiveArch: %{rust_arches} - rust-httpdate ExclusiveArch: %{rust_arches} - rust-human-panic ExclusiveArch: %{rust_arches} - rust-human-sort ExclusiveArch: %{rust_arches} - rust-humansize ExclusiveArch: %{rust_arches} - rust-humantime ExclusiveArch: %{rust_arches} - rust-humantime-serde ExclusiveArch: %{rust_arches} - rust-humantime1 ExclusiveArch: %{rust_arches} - rust-hyper ExclusiveArch: %{rust_arches} - rust-hyper-native-tls ExclusiveArch: %{rust_arches} - rust-hyper-rustls ExclusiveArch: %{rust_arches} - rust-hyper-staticfile ExclusiveArch: %{rust_arches} - rust-hyper-tls ExclusiveArch: %{rust_arches} - rust-hyper-tls0.4 ExclusiveArch: %{rust_arches} - rust-hyper0.10 ExclusiveArch: %{rust_arches} - rust-hyper0.13 ExclusiveArch: %{rust_arches} - rust-hyperfine ExclusiveArch: %{rust_arches} - rust-i18n-config ExclusiveArch: %{rust_arches} - rust-i18n-embed ExclusiveArch: %{rust_arches} - rust-i18n-embed-fl ExclusiveArch: %{rust_arches} - rust-i18n-embed-impl ExclusiveArch: %{rust_arches} - rust-i3ipc ExclusiveArch: %{rust_arches} - rust-iai ExclusiveArch: %{rust_arches} - rust-ident_case ExclusiveArch: %{rust_arches} - rust-idna ExclusiveArch: %{rust_arches} - rust-idna0.1 ExclusiveArch: %{rust_arches} - rust-ignore ExclusiveArch: %{rust_arches} - rust-im-rc ExclusiveArch: %{rust_arches} - rust-image ExclusiveArch: %{rust_arches} - rust-image-roll ExclusiveArch: %{rust_arches} - rust-imgref ExclusiveArch: %{rust_arches} - rust-imgui ExclusiveArch: %{rust_arches} - rust-imgui-sys ExclusiveArch: %{rust_arches} - rust-imgui-winit-support ExclusiveArch: %{rust_arches} - rust-indexmap ExclusiveArch: %{rust_arches} - rust-indicatif ExclusiveArch: %{rust_arches} - rust-indoc ExclusiveArch: %{rust_arches} - rust-inferno ExclusiveArch: %{rust_arches} - rust-inflate ExclusiveArch: %{rust_arches} - rust-inotify ExclusiveArch: %{rust_arches} - rust-inotify-sys ExclusiveArch: %{rust_arches} - rust-input_buffer ExclusiveArch: %{rust_arches} - rust-insta ExclusiveArch: %{rust_arches} - rust-instant ExclusiveArch: %{rust_arches} - rust-interpolate_name ExclusiveArch: %{rust_arches} - rust-intervaltree ExclusiveArch: %{rust_arches} - rust-intl-memoizer ExclusiveArch: %{rust_arches} - rust-intl_pluralrules ExclusiveArch: %{rust_arches} - rust-invalidstring ExclusiveArch: %{rust_arches} - rust-inventory ExclusiveArch: %{rust_arches} - rust-inventory-impl ExclusiveArch: %{rust_arches} - rust-io-extras ExclusiveArch: %{rust_arches} - rust-io-lifetimes ExclusiveArch: %{rust_arches} - rust-ioctl-rs ExclusiveArch: %{rust_arches} - rust-iocuddle ExclusiveArch: %{rust_arches} - rust-iovec ExclusiveArch: %{rust_arches} - rust-ipnet ExclusiveArch: %{rust_arches} - rust-ipnetwork ExclusiveArch: %{rust_arches} - rust-iptables ExclusiveArch: %{rust_arches} - rust-iron ExclusiveArch: %{rust_arches} - rust-iso8601 ExclusiveArch: %{rust_arches} - rust-iter-read ExclusiveArch: %{rust_arches} - rust-itertools ExclusiveArch: %{rust_arches} - rust-itertools-num ExclusiveArch: %{rust_arches} - rust-itertools0.8 ExclusiveArch: %{rust_arches} - rust-itertools0.9 ExclusiveArch: %{rust_arches} - rust-itoa ExclusiveArch: %{rust_arches} - rust-ivf ExclusiveArch: %{rust_arches} - rust-javascriptcore-rs ExclusiveArch: %{rust_arches} - rust-javascriptcore-rs-sys ExclusiveArch: %{rust_arches} - rust-jetscii ExclusiveArch: %{rust_arches} - rust-jieba-rs ExclusiveArch: %{rust_arches} - rust-jobserver ExclusiveArch: %{rust_arches} - rust-jpeg-decoder ExclusiveArch: %{rust_arches} - rust-jql ExclusiveArch: %{rust_arches} - rust-js-sys ExclusiveArch: %{rust_arches} - rust-js_int ExclusiveArch: %{rust_arches} - rust-json ExclusiveArch: %{rust_arches} - rust-just ExclusiveArch: %{rust_arches} - rust-jwalk ExclusiveArch: %{rust_arches} - rust-k9 ExclusiveArch: %{rust_arches} - rust-keccak ExclusiveArch: %{rust_arches} - rust-khronos_api ExclusiveArch: %{rust_arches} - rust-kv-log-macro ExclusiveArch: %{rust_arches} - rust-lab ExclusiveArch: %{rust_arches} - rust-lalrpop ExclusiveArch: %{rust_arches} - rust-lalrpop-util ExclusiveArch: %{rust_arches} - rust-language-tags ExclusiveArch: %{rust_arches} - rust-lazy-init ExclusiveArch: %{rust_arches} - rust-lazy_static ExclusiveArch: %{rust_arches} - rust-lazycell ExclusiveArch: %{rust_arches} - rust-leb128 ExclusiveArch: %{rust_arches} - rust-lewton ExclusiveArch: %{rust_arches} - rust-lexical-core ExclusiveArch: %{rust_arches} - rust-lexiclean ExclusiveArch: %{rust_arches} - rust-libblkid-rs ExclusiveArch: %{rust_arches} - rust-libblkid-rs-sys ExclusiveArch: %{rust_arches} - rust-libbpf-cargo ExclusiveArch: %{rust_arches} - rust-libbpf-rs ExclusiveArch: %{rust_arches} - rust-libbpf-sys ExclusiveArch: %{rust_arches} - rust-libc ExclusiveArch: %{rust_arches} - rust-libcryptsetup-rs ExclusiveArch: %{rust_arches} - rust-libcryptsetup-rs-sys ExclusiveArch: %{rust_arches} - rust-libdbus-sys ExclusiveArch: %{rust_arches} - rust-libdeflate-sys ExclusiveArch: %{rust_arches} - rust-libdeflater ExclusiveArch: %{rust_arches} - rust-libflate ExclusiveArch: %{rust_arches} - rust-libflate_lz77 ExclusiveArch: %{rust_arches} - rust-libgit2-sys ExclusiveArch: %{rust_arches} - rust-libhandy ExclusiveArch: %{rust_arches} - rust-libhandy-sys ExclusiveArch: %{rust_arches} - rust-libloading ExclusiveArch: %{rust_arches} - rust-libloading0.6 ExclusiveArch: %{rust_arches} - rust-libm ExclusiveArch: %{rust_arches} - rust-libmount ExclusiveArch: %{rust_arches} - rust-libnotcurses-sys ExclusiveArch: %{rust_arches} - rust-liboverdrop ExclusiveArch: %{rust_arches} - rust-libpulse-binding ExclusiveArch: %{rust_arches} - rust-libpulse-sys ExclusiveArch: %{rust_arches} - rust-libslirp ExclusiveArch: %{rust_arches} - rust-libslirp-sys ExclusiveArch: %{rust_arches} - rust-libsqlite3-sys ExclusiveArch: %{rust_arches} - rust-libssh2-sys ExclusiveArch: %{rust_arches} - rust-libsystemd ExclusiveArch: %{rust_arches} - rust-libsystemd-sys ExclusiveArch: %{rust_arches} - rust-libudev ExclusiveArch: %{rust_arches} - rust-libudev-sys ExclusiveArch: %{rust_arches} - rust-libwebp ExclusiveArch: %{rust_arches} - rust-libwebp-sys2 ExclusiveArch: %{rust_arches} - rust-libxml ExclusiveArch: %{rust_arches} - rust-libz-sys ExclusiveArch: %{rust_arches} - rust-line-wrap ExclusiveArch: %{rust_arches} - rust-link-cplusplus ExclusiveArch: %{rust_arches} - rust-linked-hash-map ExclusiveArch: %{rust_arches} - rust-linkify ExclusiveArch: %{rust_arches} - rust-linreg ExclusiveArch: %{rust_arches} - rust-linux-raw-sys ExclusiveArch: %{rust_arches} - rust-linux_proc ExclusiveArch: %{rust_arches} - rust-lipsum ExclusiveArch: %{rust_arches} - rust-listenfd ExclusiveArch: %{rust_arches} - rust-lmdb ExclusiveArch: %{rust_arches} - rust-lmdb-sys ExclusiveArch: %{rust_arches} - rust-locale ExclusiveArch: %{rust_arches} - rust-locale_config ExclusiveArch: %{rust_arches} - rust-lock_api ExclusiveArch: %{rust_arches} - rust-lockfree ExclusiveArch: %{rust_arches} - rust-log ExclusiveArch: %{rust_arches} - rust-log-mdc ExclusiveArch: %{rust_arches} - rust-log-panics ExclusiveArch: %{rust_arches} - rust-log0.3 ExclusiveArch: %{rust_arches} - rust-log4rs ExclusiveArch: %{rust_arches} - rust-loggerv ExclusiveArch: %{rust_arches} - rust-loopdev ExclusiveArch: %{rust_arches} - rust-lru-cache ExclusiveArch: %{rust_arches} - rust-lscolors ExclusiveArch: %{rust_arches} - rust-lsd ExclusiveArch: %{rust_arches} - rust-lzma-sys ExclusiveArch: %{rust_arches} - rust-lzw ExclusiveArch: %{rust_arches} - rust-mac ExclusiveArch: %{rust_arches} - rust-macro-attr ExclusiveArch: %{rust_arches} - rust-macroquad_macro ExclusiveArch: %{rust_arches} - rust-magic-crypt ExclusiveArch: %{rust_arches} - rust-maildir ExclusiveArch: %{rust_arches} - rust-mailparse ExclusiveArch: %{rust_arches} - rust-man ExclusiveArch: %{rust_arches} - rust-maplit ExclusiveArch: %{rust_arches} - rust-markup5ever ExclusiveArch: %{rust_arches} - rust-markup5ever_rcdom ExclusiveArch: %{rust_arches} - rust-match_cfg ExclusiveArch: %{rust_arches} - rust-matches ExclusiveArch: %{rust_arches} - rust-matrixcompare ExclusiveArch: %{rust_arches} - rust-matrixcompare-core ExclusiveArch: %{rust_arches} - rust-matrixcompare-mock ExclusiveArch: %{rust_arches} - rust-matrixmultiply ExclusiveArch: %{rust_arches} - rust-maxminddb ExclusiveArch: %{rust_arches} - rust-maybe-owned ExclusiveArch: %{rust_arches} - rust-maybe-uninit ExclusiveArch: %{rust_arches} - rust-mbox ExclusiveArch: %{rust_arches} - rust-mbrman ExclusiveArch: %{rust_arches} - rust-md-5 ExclusiveArch: %{rust_arches} - rust-md5 ExclusiveArch: %{rust_arches} - rust-mdl ExclusiveArch: %{rust_arches} - rust-memchr ExclusiveArch: %{rust_arches} - rust-memmap ExclusiveArch: %{rust_arches} - rust-memmap2 ExclusiveArch: %{rust_arches} - rust-memmap2_0.1 ExclusiveArch: %{rust_arches} - rust-memoffset ExclusiveArch: %{rust_arches} - rust-memoffset0.5 ExclusiveArch: %{rust_arches} - rust-memsec ExclusiveArch: %{rust_arches} - rust-migrations_internals ExclusiveArch: %{rust_arches} - rust-migrations_macros ExclusiveArch: %{rust_arches} - rust-mime ExclusiveArch: %{rust_arches} - rust-mime0.2 ExclusiveArch: %{rust_arches} - rust-mime_guess ExclusiveArch: %{rust_arches} - rust-mime_guess1 ExclusiveArch: %{rust_arches} - rust-miniflux_api ExclusiveArch: %{rust_arches} - rust-minify-html ExclusiveArch: %{rust_arches} - rust-minimal-lexical ExclusiveArch: %{rust_arches} - rust-minimp3 ExclusiveArch: %{rust_arches} - rust-minimp3-sys ExclusiveArch: %{rust_arches} - rust-miniz-sys ExclusiveArch: %{rust_arches} - rust-miniz_oxide ExclusiveArch: %{rust_arches} - rust-miniz_oxide0.3 ExclusiveArch: %{rust_arches} - rust-miniz_oxide_c_api ExclusiveArch: %{rust_arches} - rust-mint ExclusiveArch: %{rust_arches} - rust-mio ExclusiveArch: %{rust_arches} - rust-mio-extras ExclusiveArch: %{rust_arches} - rust-mio-uds ExclusiveArch: %{rust_arches} - rust-mio0.6 ExclusiveArch: %{rust_arches} - rust-mktemp ExclusiveArch: %{rust_arches} - rust-mnt ExclusiveArch: %{rust_arches} - rust-mockall ExclusiveArch: %{rust_arches} - rust-mockall_derive ExclusiveArch: %{rust_arches} - rust-mockall_double ExclusiveArch: %{rust_arches} - rust-mockito ExclusiveArch: %{rust_arches} - rust-modifier ExclusiveArch: %{rust_arches} - rust-more-asserts ExclusiveArch: %{rust_arches} - rust-mp4parse ExclusiveArch: %{rust_arches} - rust-msgbox ExclusiveArch: %{rust_arches} - rust-muldiv ExclusiveArch: %{rust_arches} - rust-multimap ExclusiveArch: %{rust_arches} - rust-multipart ExclusiveArch: %{rust_arches} - rust-mustache ExclusiveArch: %{rust_arches} - rust-nalgebra ExclusiveArch: %{rust_arches} - rust-nalgebra-macros ExclusiveArch: %{rust_arches} - rust-nasm-rs ExclusiveArch: %{rust_arches} - rust-native-tls ExclusiveArch: %{rust_arches} - rust-natord ExclusiveArch: %{rust_arches} - rust-navi ExclusiveArch: %{rust_arches} - rust-nb-connect ExclusiveArch: %{rust_arches} - rust-ncurses ExclusiveArch: %{rust_arches} - rust-net2 ExclusiveArch: %{rust_arches} - rust-netlink-packet-core ExclusiveArch: %{rust_arches} - rust-netlink-packet-route ExclusiveArch: %{rust_arches} - rust-netlink-packet-utils ExclusiveArch: %{rust_arches} - rust-netlink-proto ExclusiveArch: %{rust_arches} - rust-netlink-sys ExclusiveArch: %{rust_arches} - rust-netmap_sys ExclusiveArch: %{rust_arches} - rust-nettle ExclusiveArch: %{rust_arches} - rust-nettle-sys ExclusiveArch: %{rust_arches} - rust-new_debug_unreachable ExclusiveArch: %{rust_arches} - rust-news-flash ExclusiveArch: %{rust_arches} - rust-newsblur_api ExclusiveArch: %{rust_arches} - rust-newtype_derive ExclusiveArch: %{rust_arches} - rust-nibble_vec ExclusiveArch: %{rust_arches} - rust-nix ExclusiveArch: %{rust_arches} - rust-nix0.14 ExclusiveArch: %{rust_arches} - rust-nix0.17 ExclusiveArch: %{rust_arches} - rust-nix0.18 ExclusiveArch: %{rust_arches} - rust-nix0.20 ExclusiveArch: %{rust_arches} - rust-no-panic ExclusiveArch: %{rust_arches} - rust-nodrop ExclusiveArch: %{rust_arches} - rust-nom ExclusiveArch: %{rust_arches} - rust-nom4 ExclusiveArch: %{rust_arches} - rust-nom5 ExclusiveArch: %{rust_arches} - rust-nom6 ExclusiveArch: %{rust_arches} - rust-noop_proc_macro ExclusiveArch: %{rust_arches} - rust-normalize-line-endings ExclusiveArch: %{rust_arches} - rust-notify ExclusiveArch: %{rust_arches} - rust-notify-rust ExclusiveArch: %{rust_arches} - rust-num ExclusiveArch: %{rust_arches} - rust-num-bigint ExclusiveArch: %{rust_arches} - rust-num-bigint-dig ExclusiveArch: %{rust_arches} - rust-num-bigint0.3 ExclusiveArch: %{rust_arches} - rust-num-complex ExclusiveArch: %{rust_arches} - rust-num-complex0.3 ExclusiveArch: %{rust_arches} - rust-num-derive ExclusiveArch: %{rust_arches} - rust-num-format ExclusiveArch: %{rust_arches} - rust-num-integer ExclusiveArch: %{rust_arches} - rust-num-iter ExclusiveArch: %{rust_arches} - rust-num-rational ExclusiveArch: %{rust_arches} - rust-num-rational0.3 ExclusiveArch: %{rust_arches} - rust-num-traits ExclusiveArch: %{rust_arches} - rust-num-traits0.1 ExclusiveArch: %{rust_arches} - rust-num0.3 ExclusiveArch: %{rust_arches} - rust-num_cpus ExclusiveArch: %{rust_arches} - rust-num_enum ExclusiveArch: %{rust_arches} - rust-num_enum_derive ExclusiveArch: %{rust_arches} - rust-number_prefix ExclusiveArch: %{rust_arches} - rust-numtoa ExclusiveArch: %{rust_arches} - rust-oauth2 ExclusiveArch: %{rust_arches} - rust-obfstr ExclusiveArch: %{rust_arches} - rust-obj ExclusiveArch: %{rust_arches} - rust-object ExclusiveArch: %{rust_arches} - rust-odds ExclusiveArch: %{rust_arches} - rust-ogg ExclusiveArch: %{rust_arches} - rust-oid ExclusiveArch: %{rust_arches} - rust-once_cell ExclusiveArch: %{rust_arches} - rust-onig ExclusiveArch: %{rust_arches} - rust-onig_sys ExclusiveArch: %{rust_arches} - rust-oorandom ExclusiveArch: %{rust_arches} - rust-opaque-debug ExclusiveArch: %{rust_arches} - rust-open ExclusiveArch: %{rust_arches} - rust-open1 ExclusiveArch: %{rust_arches} - rust-openat ExclusiveArch: %{rust_arches} - rust-openat-ext ExclusiveArch: %{rust_arches} - rust-opener ExclusiveArch: %{rust_arches} - rust-openssh-keys ExclusiveArch: %{rust_arches} - rust-openssl ExclusiveArch: %{rust_arches} - rust-openssl-probe ExclusiveArch: %{rust_arches} - rust-openssl-sys ExclusiveArch: %{rust_arches} - rust-opml ExclusiveArch: %{rust_arches} - rust-ord_subset ExclusiveArch: %{rust_arches} - rust-ordered-float ExclusiveArch: %{rust_arches} - rust-ordered-multimap ExclusiveArch: %{rust_arches} - rust-os_info ExclusiveArch: %{rust_arches} - rust-os_pipe ExclusiveArch: %{rust_arches} - rust-os_str_bytes ExclusiveArch: %{rust_arches} - rust-os_type ExclusiveArch: %{rust_arches} - rust-osmesa-sys ExclusiveArch: %{rust_arches} - rust-osstrtools ExclusiveArch: %{rust_arches} - rust-ostree ExclusiveArch: %{rust_arches} - rust-ostree-sys ExclusiveArch: %{rust_arches} - rust-ouroboros ExclusiveArch: %{rust_arches} - rust-ouroboros_macro ExclusiveArch: %{rust_arches} - rust-owned-alloc ExclusiveArch: %{rust_arches} - rust-owned_ttf_parser ExclusiveArch: %{rust_arches} - rust-owning_ref ExclusiveArch: %{rust_arches} - rust-oxipng ExclusiveArch: %{rust_arches} - rust-packaging ExclusiveArch: %{rust_arches} - rust-pad ExclusiveArch: %{rust_arches} - rust-page_size ExclusiveArch: %{rust_arches} - rust-pager ExclusiveArch: %{rust_arches} - rust-palette ExclusiveArch: %{rust_arches} - rust-palette_derive ExclusiveArch: %{rust_arches} - rust-pam ExclusiveArch: %{rust_arches} - rust-pam-client ExclusiveArch: %{rust_arches} - rust-pam-sys ExclusiveArch: %{rust_arches} - rust-pancurses ExclusiveArch: %{rust_arches} - rust-pango ExclusiveArch: %{rust_arches} - rust-pango-sys ExclusiveArch: %{rust_arches} - rust-pangocairo ExclusiveArch: %{rust_arches} - rust-pangocairo-sys ExclusiveArch: %{rust_arches} - rust-parity-wasm ExclusiveArch: %{rust_arches} - rust-parking ExclusiveArch: %{rust_arches} - rust-parking_lot ExclusiveArch: %{rust_arches} - rust-parking_lot_core ExclusiveArch: %{rust_arches} - rust-parse-zoneinfo ExclusiveArch: %{rust_arches} - rust-parse_cfg ExclusiveArch: %{rust_arches} - rust-parsec-client ExclusiveArch: %{rust_arches} - rust-parsec-interface ExclusiveArch: %{rust_arches} - rust-partial-io ExclusiveArch: %{rust_arches} - rust-partition-identity ExclusiveArch: %{rust_arches} - rust-paste ExclusiveArch: %{rust_arches} - rust-path-absolutize ExclusiveArch: %{rust_arches} - rust-path-dedot ExclusiveArch: %{rust_arches} - rust-path-slash ExclusiveArch: %{rust_arches} - rust-pathdiff ExclusiveArch: %{rust_arches} - rust-pathfinder_geometry ExclusiveArch: %{rust_arches} - rust-pathfinder_simd ExclusiveArch: %{rust_arches} - rust-pbr ExclusiveArch: %{rust_arches} - rust-pcap ExclusiveArch: %{rust_arches} - rust-pcre2 ExclusiveArch: %{rust_arches} - rust-pcre2-sys ExclusiveArch: %{rust_arches} - rust-peeking_take_while ExclusiveArch: %{rust_arches} - rust-peg ExclusiveArch: %{rust_arches} - rust-peg-macros ExclusiveArch: %{rust_arches} - rust-peg-runtime ExclusiveArch: %{rust_arches} - rust-peg0.5 ExclusiveArch: %{rust_arches} - rust-pem ExclusiveArch: %{rust_arches} - rust-pem0.8 ExclusiveArch: %{rust_arches} - rust-percent-encoding ExclusiveArch: %{rust_arches} - rust-percent-encoding1 ExclusiveArch: %{rust_arches} - rust-peresil ExclusiveArch: %{rust_arches} - rust-permutate ExclusiveArch: %{rust_arches} - rust-permutohedron ExclusiveArch: %{rust_arches} - rust-pest ExclusiveArch: %{rust_arches} - rust-pest_derive ExclusiveArch: %{rust_arches} - rust-pest_generator ExclusiveArch: %{rust_arches} - rust-pest_meta ExclusiveArch: %{rust_arches} - rust-petgraph ExclusiveArch: %{rust_arches} - rust-phf ExclusiveArch: %{rust_arches} - rust-phf0.7 ExclusiveArch: %{rust_arches} - rust-phf_codegen ExclusiveArch: %{rust_arches} - rust-phf_codegen0.7 ExclusiveArch: %{rust_arches} - rust-phf_generator ExclusiveArch: %{rust_arches} - rust-phf_generator0.7 ExclusiveArch: %{rust_arches} - rust-phf_macros ExclusiveArch: %{rust_arches} - rust-phf_macros0.7 ExclusiveArch: %{rust_arches} - rust-phf_shared ExclusiveArch: %{rust_arches} - rust-phf_shared0.7 ExclusiveArch: %{rust_arches} - rust-picky-asn1 ExclusiveArch: %{rust_arches} - rust-picky-asn1-der ExclusiveArch: %{rust_arches} - rust-picky-asn1-x509 ExclusiveArch: %{rust_arches} - rust-pico-args ExclusiveArch: %{rust_arches} - rust-pid ExclusiveArch: %{rust_arches} - rust-pin-project ExclusiveArch: %{rust_arches} - rust-pin-project-internal ExclusiveArch: %{rust_arches} - rust-pin-project-internal0.4 ExclusiveArch: %{rust_arches} - rust-pin-project-lite ExclusiveArch: %{rust_arches} - rust-pin-project-lite0.1 ExclusiveArch: %{rust_arches} - rust-pin-project0.4 ExclusiveArch: %{rust_arches} - rust-pin-utils ExclusiveArch: %{rust_arches} - rust-pipe ExclusiveArch: %{rust_arches} - rust-piper ExclusiveArch: %{rust_arches} - rust-pkcs11 ExclusiveArch: %{rust_arches} - rust-pkg-config ExclusiveArch: %{rust_arches} - rust-plain ExclusiveArch: %{rust_arches} - rust-pleaser ExclusiveArch: %{rust_arches} - rust-plist ExclusiveArch: %{rust_arches} - rust-plotlib ExclusiveArch: %{rust_arches} - rust-plotters ExclusiveArch: %{rust_arches} - rust-plotters-backend ExclusiveArch: %{rust_arches} - rust-plotters-bitmap ExclusiveArch: %{rust_arches} - rust-plotters-svg ExclusiveArch: %{rust_arches} - rust-plugin ExclusiveArch: %{rust_arches} - rust-pnet_base ExclusiveArch: %{rust_arches} - rust-pnet_datalink ExclusiveArch: %{rust_arches} - rust-pnet_sys ExclusiveArch: %{rust_arches} - rust-png ExclusiveArch: %{rust_arches} - rust-podio ExclusiveArch: %{rust_arches} - rust-polling ExclusiveArch: %{rust_arches} - rust-polyval ExclusiveArch: %{rust_arches} - rust-pom ExclusiveArch: %{rust_arches} - rust-pommes ExclusiveArch: %{rust_arches} - rust-posish ExclusiveArch: %{rust_arches} - rust-ppv-lite86 ExclusiveArch: %{rust_arches} - rust-pq-sys ExclusiveArch: %{rust_arches} - rust-precomputed-hash ExclusiveArch: %{rust_arches} - rust-predicates ExclusiveArch: %{rust_arches} - rust-predicates-core ExclusiveArch: %{rust_arches} - rust-predicates-tree ExclusiveArch: %{rust_arches} - rust-predicates1 ExclusiveArch: %{rust_arches} - rust-pretty-git-prompt ExclusiveArch: %{rust_arches} - rust-pretty-hex ExclusiveArch: %{rust_arches} - rust-pretty_assertions ExclusiveArch: %{rust_arches} - rust-pretty_assertions0.6 ExclusiveArch: %{rust_arches} - rust-pretty_env_logger ExclusiveArch: %{rust_arches} - rust-prettytable-rs ExclusiveArch: %{rust_arches} - rust-proc-macro-crate ExclusiveArch: %{rust_arches} - rust-proc-macro-crate0.1 ExclusiveArch: %{rust_arches} - rust-proc-macro-error ExclusiveArch: %{rust_arches} - rust-proc-macro-error-attr ExclusiveArch: %{rust_arches} - rust-proc-macro-hack ExclusiveArch: %{rust_arches} - rust-proc-macro2 ExclusiveArch: %{rust_arches} - rust-proc-macro2-0.4 ExclusiveArch: %{rust_arches} - rust-proc-maps ExclusiveArch: %{rust_arches} - rust-proc-mounts ExclusiveArch: %{rust_arches} - rust-proc-quote-impl ExclusiveArch: %{rust_arches} - rust-procedural-masquerade ExclusiveArch: %{rust_arches} - rust-process_control ExclusiveArch: %{rust_arches} - rust-process_path ExclusiveArch: %{rust_arches} - rust-procfs ExclusiveArch: %{rust_arches} - rust-procs ExclusiveArch: %{rust_arches} - rust-progress-streams ExclusiveArch: %{rust_arches} - rust-prometheus ExclusiveArch: %{rust_arches} - rust-proptest ExclusiveArch: %{rust_arches} - rust-proptest-derive ExclusiveArch: %{rust_arches} - rust-proptest0.10 ExclusiveArch: %{rust_arches} - rust-prost ExclusiveArch: %{rust_arches} - rust-prost-build ExclusiveArch: %{rust_arches} - rust-prost-derive ExclusiveArch: %{rust_arches} - rust-prost-types ExclusiveArch: %{rust_arches} - rust-protobuf ExclusiveArch: %{rust_arches} - rust-protobuf-codegen ExclusiveArch: %{rust_arches} - rust-protobuf-codegen-pure ExclusiveArch: %{rust_arches} - rust-protoc ExclusiveArch: %{rust_arches} - rust-protoc-rust ExclusiveArch: %{rust_arches} - rust-psa-crypto ExclusiveArch: %{rust_arches} - rust-psa-crypto-sys ExclusiveArch: %{rust_arches} - rust-psd ExclusiveArch: %{rust_arches} - rust-psm ExclusiveArch: %{rust_arches} - rust-ptr_meta ExclusiveArch: %{rust_arches} - rust-ptr_meta_derive ExclusiveArch: %{rust_arches} - rust-publicsuffix ExclusiveArch: %{rust_arches} - rust-pulldown-cmark ExclusiveArch: %{rust_arches} - rust-pulse ExclusiveArch: %{rust_arches} - rust-pure-rust-locales ExclusiveArch: %{rust_arches} - rust-pyo3 ExclusiveArch: %{rust_arches} - rust-pyo3-build-config ExclusiveArch: %{rust_arches} - rust-pyo3-macros ExclusiveArch: %{rust_arches} - rust-pyo3-macros-backend ExclusiveArch: %{rust_arches} - rust-python-launcher ExclusiveArch: %{rust_arches} - rust-python3-sys ExclusiveArch: %{rust_arches} - rust-qr2term ExclusiveArch: %{rust_arches} - rust-qrcode ExclusiveArch: %{rust_arches} - rust-qstring ExclusiveArch: %{rust_arches} - rust-quad-rand ExclusiveArch: %{rust_arches} - rust-quantiles ExclusiveArch: %{rust_arches} - rust-quick-error ExclusiveArch: %{rust_arches} - rust-quick-error1 ExclusiveArch: %{rust_arches} - rust-quick-xml ExclusiveArch: %{rust_arches} - rust-quick-xml0.20 ExclusiveArch: %{rust_arches} - rust-quickcheck ExclusiveArch: %{rust_arches} - rust-quickcheck0.6 ExclusiveArch: %{rust_arches} - rust-quickcheck0.9 ExclusiveArch: %{rust_arches} - rust-quickcheck_macros ExclusiveArch: %{rust_arches} - rust-quickersort ExclusiveArch: %{rust_arches} - rust-quote ExclusiveArch: %{rust_arches} - rust-quote0.3 ExclusiveArch: %{rust_arches} - rust-quote0.6 ExclusiveArch: %{rust_arches} - rust-quoted_printable ExclusiveArch: %{rust_arches} - rust-r2d2 ExclusiveArch: %{rust_arches} - rust-radium ExclusiveArch: %{rust_arches} - rust-radix64 ExclusiveArch: %{rust_arches} - rust-radix_trie ExclusiveArch: %{rust_arches} - rust-rand ExclusiveArch: %{rust_arches} - rust-rand0.4 ExclusiveArch: %{rust_arches} - rust-rand0.5 ExclusiveArch: %{rust_arches} - rust-rand0.6 ExclusiveArch: %{rust_arches} - rust-rand0.7 ExclusiveArch: %{rust_arches} - rust-rand_chacha ExclusiveArch: %{rust_arches} - rust-rand_chacha0.1 ExclusiveArch: %{rust_arches} - rust-rand_chacha0.2 ExclusiveArch: %{rust_arches} - rust-rand_core ExclusiveArch: %{rust_arches} - rust-rand_core0.3 ExclusiveArch: %{rust_arches} - rust-rand_core0.4 ExclusiveArch: %{rust_arches} - rust-rand_core0.5 ExclusiveArch: %{rust_arches} - rust-rand_distr ExclusiveArch: %{rust_arches} - rust-rand_hc ExclusiveArch: %{rust_arches} - rust-rand_hc0.1 ExclusiveArch: %{rust_arches} - rust-rand_isaac ExclusiveArch: %{rust_arches} - rust-rand_isaac0.1 ExclusiveArch: %{rust_arches} - rust-rand_isaac0.2 ExclusiveArch: %{rust_arches} - rust-rand_jitter ExclusiveArch: %{rust_arches} - rust-rand_jitter0.1 ExclusiveArch: %{rust_arches} - rust-rand_os ExclusiveArch: %{rust_arches} - rust-rand_os0.1 ExclusiveArch: %{rust_arches} - rust-rand_pcg ExclusiveArch: %{rust_arches} - rust-rand_pcg0.1 ExclusiveArch: %{rust_arches} - rust-rand_pcg0.2 ExclusiveArch: %{rust_arches} - rust-rand_xorshift ExclusiveArch: %{rust_arches} - rust-rand_xorshift0.1 ExclusiveArch: %{rust_arches} - rust-rand_xorshift0.2 ExclusiveArch: %{rust_arches} - rust-rand_xoshiro ExclusiveArch: %{rust_arches} - rust-random-fast-rng ExclusiveArch: %{rust_arches} - rust-random-trait ExclusiveArch: %{rust_arches} - rust-randomize ExclusiveArch: %{rust_arches} - rust-rav1e ExclusiveArch: %{rust_arches} - rust-raw-window-handle ExclusiveArch: %{rust_arches} - rust-rawpointer ExclusiveArch: %{rust_arches} - rust-rawslice ExclusiveArch: %{rust_arches} - rust-rayon ExclusiveArch: %{rust_arches} - rust-rayon-core ExclusiveArch: %{rust_arches} - rust-rbspy ExclusiveArch: %{rust_arches} - rust-rbspy-ruby-structs ExclusiveArch: %{rust_arches} - rust-rbspy-testdata ExclusiveArch: %{rust_arches} - rust-rd-agent ExclusiveArch: %{rust_arches} - rust-rd-agent-intf ExclusiveArch: %{rust_arches} - rust-rd-hashd ExclusiveArch: %{rust_arches} - rust-rd-hashd-intf ExclusiveArch: %{rust_arches} - rust-rd-util ExclusiveArch: %{rust_arches} - rust-read-process-memory ExclusiveArch: %{rust_arches} - rust-read_input ExclusiveArch: %{rust_arches} - rust-readability-fork ExclusiveArch: %{rust_arches} - rust-readwrite ExclusiveArch: %{rust_arches} - rust-recycler ExclusiveArch: %{rust_arches} - rust-ref-cast ExclusiveArch: %{rust_arches} - rust-ref-cast-impl ExclusiveArch: %{rust_arches} - rust-regalloc ExclusiveArch: %{rust_arches} - rust-regex ExclusiveArch: %{rust_arches} - rust-regex-automata ExclusiveArch: %{rust_arches} - rust-regex-syntax ExclusiveArch: %{rust_arches} - rust-region ExclusiveArch: %{rust_arches} - rust-relative-path ExclusiveArch: %{rust_arches} - rust-relay ExclusiveArch: %{rust_arches} - rust-remoteprocess ExclusiveArch: %{rust_arches} - rust-remove_dir_all ExclusiveArch: %{rust_arches} - rust-rend ExclusiveArch: %{rust_arches} - rust-rental ExclusiveArch: %{rust_arches} - rust-rental-impl ExclusiveArch: %{rust_arches} - rust-reqwest ExclusiveArch: %{rust_arches} - rust-reqwest0.10 ExclusiveArch: %{rust_arches} - rust-resctl-bench ExclusiveArch: %{rust_arches} - rust-resctl-bench-intf ExclusiveArch: %{rust_arches} - rust-resctl-demo ExclusiveArch: %{rust_arches} - rust-resize ExclusiveArch: %{rust_arches} - rust-resolv-conf ExclusiveArch: %{rust_arches} - rust-restson ExclusiveArch: %{rust_arches} - rust-retry ExclusiveArch: %{rust_arches} - rust-rgb ExclusiveArch: %{rust_arches} - rust-ring ExclusiveArch: %{rust_arches} - rust-ripgrep ExclusiveArch: %{rust_arches} - rust-rkyv ExclusiveArch: %{rust_arches} - rust-rkyv_derive ExclusiveArch: %{rust_arches} - rust-rle-decode-fast ExclusiveArch: %{rust_arches} - rust-rmp ExclusiveArch: %{rust_arches} - rust-rmp-serde ExclusiveArch: %{rust_arches} - rust-rodio ExclusiveArch: %{rust_arches} - rust-roff ExclusiveArch: %{rust_arches} - rust-ron ExclusiveArch: %{rust_arches} - rust-roxmltree ExclusiveArch: %{rust_arches} - rust-rpassword ExclusiveArch: %{rust_arches} - rust-rpick ExclusiveArch: %{rust_arches} - rust-rsa ExclusiveArch: %{rust_arches} - rust-rspec ExclusiveArch: %{rust_arches} - rust-rtnetlink ExclusiveArch: %{rust_arches} - rust-rudo ExclusiveArch: %{rust_arches} - rust-ruma ExclusiveArch: %{rust_arches} - rust-ruma-api ExclusiveArch: %{rust_arches} - rust-ruma-api-macros ExclusiveArch: %{rust_arches} - rust-ruma-appservice-api ExclusiveArch: %{rust_arches} - rust-ruma-client-api ExclusiveArch: %{rust_arches} - rust-ruma-common ExclusiveArch: %{rust_arches} - rust-ruma-events ExclusiveArch: %{rust_arches} - rust-ruma-events-macros ExclusiveArch: %{rust_arches} - rust-ruma-federation-api ExclusiveArch: %{rust_arches} - rust-ruma-identifiers ExclusiveArch: %{rust_arches} - rust-ruma-identifiers-macros ExclusiveArch: %{rust_arches} - rust-ruma-identifiers-validation ExclusiveArch: %{rust_arches} - rust-ruma-identity-service-api ExclusiveArch: %{rust_arches} - rust-ruma-push-gateway-api ExclusiveArch: %{rust_arches} - rust-ruma-serde ExclusiveArch: %{rust_arches} - rust-ruma-serde-macros ExclusiveArch: %{rust_arches} - rust-ruma-signatures ExclusiveArch: %{rust_arches} - rust-rusqlite ExclusiveArch: %{rust_arches} - rust-rust-embed ExclusiveArch: %{rust_arches} - rust-rust-embed-impl ExclusiveArch: %{rust_arches} - rust-rust-embed-utils ExclusiveArch: %{rust_arches} - rust-rust-ini ExclusiveArch: %{rust_arches} - rust-rust-stemmers ExclusiveArch: %{rust_arches} - rust-rust_decimal ExclusiveArch: %{rust_arches} - rust-rust_hawktracer ExclusiveArch: %{rust_arches} - rust-rust_hawktracer_normal_macro ExclusiveArch: %{rust_arches} - rust-rust_hawktracer_proc_macro ExclusiveArch: %{rust_arches} - rust-rust_hawktracer_sys ExclusiveArch: %{rust_arches} - rust-rustbus ExclusiveArch: %{rust_arches} - rust-rustbus_derive ExclusiveArch: %{rust_arches} - rust-rustc-demangle ExclusiveArch: %{rust_arches} - rust-rustc-hash ExclusiveArch: %{rust_arches} - rust-rustc-serialize ExclusiveArch: %{rust_arches} - rust-rustc-test ExclusiveArch: %{rust_arches} - rust-rustc_tools_util ExclusiveArch: %{rust_arches} - rust-rustc_version ExclusiveArch: %{rust_arches} - rust-rustc_version0.3 ExclusiveArch: %{rust_arches} - rust-rustdoc-stripper ExclusiveArch: %{rust_arches} - rust-rustfilt ExclusiveArch: %{rust_arches} - rust-rustfix ExclusiveArch: %{rust_arches} - rust-rustio ExclusiveArch: %{rust_arches} - rust-rustix ExclusiveArch: %{rust_arches} - rust-rustls ExclusiveArch: %{rust_arches} - rust-rustls-native-certs ExclusiveArch: %{rust_arches} - rust-rusttype ExclusiveArch: %{rust_arches} - rust-rustversion ExclusiveArch: %{rust_arches} - rust-rusty-fork ExclusiveArch: %{rust_arches} - rust-rustyline ExclusiveArch: %{rust_arches} - rust-rustyline-derive ExclusiveArch: %{rust_arches} - rust-ryu ExclusiveArch: %{rust_arches} - rust-safe-transmute ExclusiveArch: %{rust_arches} - rust-safe_arch ExclusiveArch: %{rust_arches} - rust-safemem ExclusiveArch: %{rust_arches} - rust-same-file ExclusiveArch: %{rust_arches} - rust-sapp-kms ExclusiveArch: %{rust_arches} - rust-sapp-linux ExclusiveArch: %{rust_arches} - rust-sass-rs ExclusiveArch: %{rust_arches} - rust-sass-sys ExclusiveArch: %{rust_arches} - rust-scan_fmt ExclusiveArch: %{rust_arches} - rust-scheduled-thread-pool ExclusiveArch: %{rust_arches} - rust-scoped-tls ExclusiveArch: %{rust_arches} - rust-scoped-tls-hkt ExclusiveArch: %{rust_arches} - rust-scoped_threadpool ExclusiveArch: %{rust_arches} - rust-scopeguard ExclusiveArch: %{rust_arches} - rust-scopetime ExclusiveArch: %{rust_arches} - rust-scratch ExclusiveArch: %{rust_arches} - rust-scroll ExclusiveArch: %{rust_arches} - rust-scroll_derive ExclusiveArch: %{rust_arches} - rust-sct ExclusiveArch: %{rust_arches} - rust-sd ExclusiveArch: %{rust_arches} - rust-sd-notify ExclusiveArch: %{rust_arches} - rust-seahash ExclusiveArch: %{rust_arches} - rust-seahash3 ExclusiveArch: %{rust_arches} - rust-secrecy ExclusiveArch: %{rust_arches} - rust-secret-service ExclusiveArch: %{rust_arches} - rust-self_cell ExclusiveArch: %{rust_arches} - rust-semver ExclusiveArch: %{rust_arches} - rust-semver-parser ExclusiveArch: %{rust_arches} - rust-semver-parser0.9 ExclusiveArch: %{rust_arches} - rust-semver0.11 ExclusiveArch: %{rust_arches} - rust-sequoia-autocrypt ExclusiveArch: %{rust_arches} - rust-sequoia-ipc ExclusiveArch: %{rust_arches} - rust-sequoia-keyring-linter ExclusiveArch: %{rust_arches} - rust-sequoia-net ExclusiveArch: %{rust_arches} - rust-sequoia-octopus-librnp ExclusiveArch: %{rust_arches} - rust-sequoia-openpgp ExclusiveArch: %{rust_arches} - rust-sequoia-sop ExclusiveArch: %{rust_arches} - rust-sequoia-sq ExclusiveArch: %{rust_arches} - rust-sequoia-sqv ExclusiveArch: %{rust_arches} - rust-serde ExclusiveArch: %{rust_arches} - rust-serde-big-array ExclusiveArch: %{rust_arches} - rust-serde-pickle ExclusiveArch: %{rust_arches} - rust-serde-value ExclusiveArch: %{rust_arches} - rust-serde-xml-rs ExclusiveArch: %{rust_arches} - rust-serde_bser ExclusiveArch: %{rust_arches} - rust-serde_bytes ExclusiveArch: %{rust_arches} - rust-serde_cbor ExclusiveArch: %{rust_arches} - rust-serde_derive ExclusiveArch: %{rust_arches} - rust-serde_fmt ExclusiveArch: %{rust_arches} - rust-serde_ignored ExclusiveArch: %{rust_arches} - rust-serde_json ExclusiveArch: %{rust_arches} - rust-serde_repr ExclusiveArch: %{rust_arches} - rust-serde_stacker ExclusiveArch: %{rust_arches} - rust-serde_test ExclusiveArch: %{rust_arches} - rust-serde_url_params ExclusiveArch: %{rust_arches} - rust-serde_urlencoded ExclusiveArch: %{rust_arches} - rust-serde_urlencoded0.6 ExclusiveArch: %{rust_arches} - rust-serde_with ExclusiveArch: %{rust_arches} - rust-serde_with_macros ExclusiveArch: %{rust_arches} - rust-serde_yaml ExclusiveArch: %{rust_arches} - rust-serial-core ExclusiveArch: %{rust_arches} - rust-serial_test ExclusiveArch: %{rust_arches} - rust-serial_test_derive ExclusiveArch: %{rust_arches} - rust-servo-fontconfig ExclusiveArch: %{rust_arches} - rust-servo-fontconfig-sys ExclusiveArch: %{rust_arches} - rust-sev ExclusiveArch: %{rust_arches} - rust-sevctl ExclusiveArch: %{rust_arches} - rust-sha-1 ExclusiveArch: %{rust_arches} - rust-sha1 ExclusiveArch: %{rust_arches} - rust-sha1collisiondetection ExclusiveArch: %{rust_arches} - rust-sha2 ExclusiveArch: %{rust_arches} - rust-sha3 ExclusiveArch: %{rust_arches} - rust-shadow-rs ExclusiveArch: %{rust_arches} - rust-shared_child ExclusiveArch: %{rust_arches} - rust-shared_library ExclusiveArch: %{rust_arches} - rust-shell-escape ExclusiveArch: %{rust_arches} - rust-shell-words ExclusiveArch: %{rust_arches} - rust-shellexpand ExclusiveArch: %{rust_arches} - rust-shellwords ExclusiveArch: %{rust_arches} - rust-shlex ExclusiveArch: %{rust_arches} - rust-signal-hook ExclusiveArch: %{rust_arches} - rust-signal-hook-mio ExclusiveArch: %{rust_arches} - rust-signal-hook-registry ExclusiveArch: %{rust_arches} - rust-signal-hook0.1 ExclusiveArch: %{rust_arches} - rust-signature ExclusiveArch: x86_64 aarch64 - rust-silver ExclusiveArch: %{rust_arches} - rust-simba ExclusiveArch: %{rust_arches} - rust-simd_helpers ExclusiveArch: %{rust_arches} - rust-simdutf8 ExclusiveArch: %{rust_arches} - rust-similar ExclusiveArch: %{rust_arches} - rust-similar-asserts ExclusiveArch: %{rust_arches} - rust-simple-error ExclusiveArch: %{rust_arches} - rust-simple_asn1 ExclusiveArch: %{rust_arches} - rust-simple_logger ExclusiveArch: %{rust_arches} - rust-simplelog ExclusiveArch: %{rust_arches} - rust-siphasher ExclusiveArch: %{rust_arches} - rust-size ExclusiveArch: %{rust_arches} - rust-sized-chunks ExclusiveArch: %{rust_arches} - rust-skeptic ExclusiveArch: %{rust_arches} - rust-skim ExclusiveArch: %{rust_arches} - rust-slab ExclusiveArch: %{rust_arches} - rust-slice-deque ExclusiveArch: %{rust_arches} - rust-slog ExclusiveArch: %{rust_arches} - rust-slog-async ExclusiveArch: %{rust_arches} - rust-slog-scope ExclusiveArch: %{rust_arches} - rust-slog-term ExclusiveArch: %{rust_arches} - rust-slotmap ExclusiveArch: %{rust_arches} - rust-slug ExclusiveArch: %{rust_arches} - rust-sluice ExclusiveArch: %{rust_arches} - rust-smallbitvec ExclusiveArch: %{rust_arches} - rust-smallstr ExclusiveArch: %{rust_arches} - rust-smallvec ExclusiveArch: %{rust_arches} - rust-smart-default ExclusiveArch: %{rust_arches} - rust-smawk ExclusiveArch: %{rust_arches} - rust-smithay-client-toolkit ExclusiveArch: %{rust_arches} - rust-smithay-client-toolkit0.12 ExclusiveArch: %{rust_arches} - rust-smithay-clipboard ExclusiveArch: %{rust_arches} - rust-snafu ExclusiveArch: %{rust_arches} - rust-snafu-derive ExclusiveArch: %{rust_arches} - rust-snake_case ExclusiveArch: %{rust_arches} - rust-socket2 ExclusiveArch: %{rust_arches} - rust-socket2_0.3 ExclusiveArch: %{rust_arches} - rust-sop ExclusiveArch: %{rust_arches} - rust-soup-sys ExclusiveArch: %{rust_arches} - rust-spin ExclusiveArch: %{rust_arches} - rust-spin_on ExclusiveArch: %{rust_arches} - rust-spinning_top ExclusiveArch: %{rust_arches} - rust-spmc ExclusiveArch: %{rust_arches} - rust-ssh-key-dir ExclusiveArch: %{rust_arches} - rust-stable_deref_trait ExclusiveArch: %{rust_arches} - rust-stacker ExclusiveArch: %{rust_arches} - rust-standback ExclusiveArch: %{rust_arches} - rust-starship ExclusiveArch: %{rust_arches} - rust-starship_module_config_derive ExclusiveArch: %{rust_arches} - rust-static_assertions ExclusiveArch: %{rust_arches} - rust-statistical ExclusiveArch: %{rust_arches} - rust-statrs ExclusiveArch: %{rust_arches} - rust-stb_truetype ExclusiveArch: %{rust_arches} - rust-stderrlog ExclusiveArch: %{rust_arches} - rust-str_stack ExclusiveArch: %{rust_arches} - rust-stratisd_proc_macros ExclusiveArch: %{rust_arches} - rust-streaming-stats ExclusiveArch: %{rust_arches} - rust-streebog ExclusiveArch: %{rust_arches} - rust-string ExclusiveArch: %{rust_arches} - rust-string_cache ExclusiveArch: %{rust_arches} - rust-string_cache_codegen ExclusiveArch: %{rust_arches} - rust-string_cache_shared ExclusiveArch: %{rust_arches} - rust-strings ExclusiveArch: %{rust_arches} - rust-strip-ansi-escapes ExclusiveArch: %{rust_arches} - rust-strong-xml ExclusiveArch: %{rust_arches} - rust-strong-xml-derive ExclusiveArch: %{rust_arches} - rust-strsim ExclusiveArch: %{rust_arches} - rust-structopt ExclusiveArch: %{rust_arches} - rust-structopt-derive ExclusiveArch: %{rust_arches} - rust-structopt-derive0.2 ExclusiveArch: %{rust_arches} - rust-structopt0.2 ExclusiveArch: %{rust_arches} - rust-strum ExclusiveArch: %{rust_arches} - rust-strum_macros ExclusiveArch: %{rust_arches} - rust-subprocess ExclusiveArch: %{rust_arches} - rust-subtle ExclusiveArch: %{rust_arches} - rust-sudo_plugin ExclusiveArch: %{rust_arches} - rust-sudo_plugin-sys ExclusiveArch: %{rust_arches} - rust-sval ExclusiveArch: %{rust_arches} - rust-sval_derive ExclusiveArch: %{rust_arches} - rust-sval_json ExclusiveArch: %{rust_arches} - rust-svg ExclusiveArch: %{rust_arches} - rust-svg_metadata ExclusiveArch: %{rust_arches} - rust-svgfilters ExclusiveArch: %{rust_arches} - rust-svgtypes ExclusiveArch: %{rust_arches} - rust-sxd-document ExclusiveArch: %{rust_arches} - rust-syn ExclusiveArch: %{rust_arches} - rust-syn0.15 ExclusiveArch: %{rust_arches} - rust-synom ExclusiveArch: %{rust_arches} - rust-synstructure ExclusiveArch: %{rust_arches} - rust-syntect ExclusiveArch: %{rust_arches} - rust-sys-info ExclusiveArch: %{rust_arches} - rust-sysctl ExclusiveArch: %{rust_arches} - rust-sysinfo ExclusiveArch: %{rust_arches} - rust-syslog ExclusiveArch: %{rust_arches} - rust-system-deps ExclusiveArch: %{rust_arches} - rust-system76_ectool ExclusiveArch: %{rust_arches} - rust-systemd ExclusiveArch: %{rust_arches} - rust-tabular ExclusiveArch: %{rust_arches} - rust-tabwriter ExclusiveArch: %{rust_arches} - rust-take ExclusiveArch: %{rust_arches} - rust-take_mut ExclusiveArch: %{rust_arches} - rust-takeable ExclusiveArch: %{rust_arches} - rust-takeable-option ExclusiveArch: %{rust_arches} - rust-tap ExclusiveArch: %{rust_arches} - rust-tar ExclusiveArch: %{rust_arches} - rust-target ExclusiveArch: %{rust_arches} - rust-target-lexicon ExclusiveArch: %{rust_arches} - rust-tealdeer ExclusiveArch: %{rust_arches} - rust-teloxide ExclusiveArch: %{rust_arches} - rust-teloxide-macros ExclusiveArch: %{rust_arches} - rust-tempdir ExclusiveArch: %{rust_arches} - rust-tempfile ExclusiveArch: %{rust_arches} - rust-temptree ExclusiveArch: %{rust_arches} - rust-tendril ExclusiveArch: %{rust_arches} - rust-tera ExclusiveArch: %{rust_arches} - rust-term ExclusiveArch: %{rust_arches} - rust-term0.6 ExclusiveArch: %{rust_arches} - rust-term_grid ExclusiveArch: %{rust_arches} - rust-term_size ExclusiveArch: %{rust_arches} - rust-termcolor ExclusiveArch: %{rust_arches} - rust-terminal_size ExclusiveArch: %{rust_arches} - rust-terminfo ExclusiveArch: %{rust_arches} - rust-termion ExclusiveArch: %{rust_arches} - rust-termios ExclusiveArch: %{rust_arches} - rust-test-assembler ExclusiveArch: %{rust_arches} - rust-test-case ExclusiveArch: %{rust_arches} - rust-tester ExclusiveArch: %{rust_arches} - rust-testing_logger ExclusiveArch: %{rust_arches} - rust-textwrap ExclusiveArch: %{rust_arches} - rust-textwrap0.11 ExclusiveArch: %{rust_arches} - rust-textwrap0.12 ExclusiveArch: %{rust_arches} - rust-thiserror ExclusiveArch: %{rust_arches} - rust-thiserror-impl ExclusiveArch: %{rust_arches} - rust-thread-id ExclusiveArch: %{rust_arches} - rust-thread-tree ExclusiveArch: %{rust_arches} - rust-thread_local ExclusiveArch: %{rust_arches} - rust-threadpool ExclusiveArch: %{rust_arches} - rust-tiff ExclusiveArch: %{rust_arches} - rust-tiger ExclusiveArch: %{rust_arches} - rust-time ExclusiveArch: %{rust_arches} - rust-time-macros ExclusiveArch: %{rust_arches} - rust-time-macros-impl ExclusiveArch: %{rust_arches} - rust-time-macros0.1 ExclusiveArch: %{rust_arches} - rust-time0.1 ExclusiveArch: %{rust_arches} - rust-time0.2 ExclusiveArch: %{rust_arches} - rust-timebomb ExclusiveArch: %{rust_arches} - rust-timer ExclusiveArch: %{rust_arches} - rust-timerfd ExclusiveArch: %{rust_arches} - rust-tiny-keccak ExclusiveArch: %{rust_arches} - rust-tiny_http ExclusiveArch: %{rust_arches} - rust-tiny_http0.6 ExclusiveArch: %{rust_arches} - rust-tinyfiledialogs ExclusiveArch: %{rust_arches} - rust-tinystr ExclusiveArch: %{rust_arches} - rust-tinytemplate ExclusiveArch: %{rust_arches} - rust-tinyvec ExclusiveArch: %{rust_arches} - rust-tinyvec_macros ExclusiveArch: %{rust_arches} - rust-tokei ExclusiveArch: %{rust_arches} - rust-tokio ExclusiveArch: %{rust_arches} - rust-tokio-codec ExclusiveArch: %{rust_arches} - rust-tokio-core ExclusiveArch: %{rust_arches} - rust-tokio-current-thread ExclusiveArch: %{rust_arches} - rust-tokio-executor ExclusiveArch: %{rust_arches} - rust-tokio-fs ExclusiveArch: %{rust_arches} - rust-tokio-io ExclusiveArch: %{rust_arches} - rust-tokio-macros ExclusiveArch: %{rust_arches} - rust-tokio-macros0.2 ExclusiveArch: %{rust_arches} - rust-tokio-mock-task ExclusiveArch: %{rust_arches} - rust-tokio-native-tls ExclusiveArch: %{rust_arches} - rust-tokio-openssl ExclusiveArch: %{rust_arches} - rust-tokio-openssl0.4 ExclusiveArch: %{rust_arches} - rust-tokio-reactor ExclusiveArch: %{rust_arches} - rust-tokio-rustls ExclusiveArch: %{rust_arches} - rust-tokio-socks ExclusiveArch: %{rust_arches} - rust-tokio-socks0.3 ExclusiveArch: %{rust_arches} - rust-tokio-stream ExclusiveArch: %{rust_arches} - rust-tokio-sync ExclusiveArch: %{rust_arches} - rust-tokio-tcp ExclusiveArch: %{rust_arches} - rust-tokio-test ExclusiveArch: %{rust_arches} - rust-tokio-threadpool ExclusiveArch: %{rust_arches} - rust-tokio-timer ExclusiveArch: %{rust_arches} - rust-tokio-tls ExclusiveArch: %{rust_arches} - rust-tokio-tls0.2 ExclusiveArch: %{rust_arches} - rust-tokio-tungstenite ExclusiveArch: %{rust_arches} - rust-tokio-udp ExclusiveArch: %{rust_arches} - rust-tokio-uds ExclusiveArch: %{rust_arches} - rust-tokio-util ExclusiveArch: %{rust_arches} - rust-tokio-util0.3 ExclusiveArch: %{rust_arches} - rust-tokio0.1 ExclusiveArch: %{rust_arches} - rust-tokio0.2 ExclusiveArch: %{rust_arches} - rust-toml ExclusiveArch: %{rust_arches} - rust-toml0.4 ExclusiveArch: %{rust_arches} - rust-toml_edit ExclusiveArch: %{rust_arches} - rust-tower-layer ExclusiveArch: %{rust_arches} - rust-tower-service ExclusiveArch: %{rust_arches} - rust-tower-test ExclusiveArch: %{rust_arches} - rust-tower-util ExclusiveArch: %{rust_arches} - rust-tpm2-policy ExclusiveArch: %{rust_arches} - rust-tracing ExclusiveArch: %{rust_arches} - rust-tracing-attributes ExclusiveArch: %{rust_arches} - rust-tracing-core ExclusiveArch: %{rust_arches} - rust-tracing-futures ExclusiveArch: %{rust_arches} - rust-traitobject ExclusiveArch: %{rust_arches} - rust-trash ExclusiveArch: %{rust_arches} - rust-treebitmap ExclusiveArch: %{rust_arches} - rust-treeline ExclusiveArch: %{rust_arches} - rust-trust-dns-https ExclusiveArch: %{rust_arches} - rust-trust-dns-native-tls ExclusiveArch: %{rust_arches} - rust-trust-dns-native-tls0.19 ExclusiveArch: %{rust_arches} - rust-trust-dns-openssl ExclusiveArch: %{rust_arches} - rust-trust-dns-openssl0.19 ExclusiveArch: %{rust_arches} - rust-trust-dns-proto ExclusiveArch: %{rust_arches} - rust-trust-dns-proto0.19 ExclusiveArch: %{rust_arches} - rust-trust-dns-resolver ExclusiveArch: %{rust_arches} - rust-trust-dns-resolver0.19 ExclusiveArch: %{rust_arches} - rust-trust-dns-rustls ExclusiveArch: %{rust_arches} - rust-try-lock ExclusiveArch: %{rust_arches} - rust-trybuild ExclusiveArch: %{rust_arches} - rust-tss-esapi ExclusiveArch: %{rust_arches} - rust-tss-esapi-sys ExclusiveArch: %{rust_arches} - rust-ttf-parser ExclusiveArch: %{rust_arches} - rust-tui ExclusiveArch: %{rust_arches} - rust-tui-react ExclusiveArch: %{rust_arches} - rust-tui0.11 ExclusiveArch: %{rust_arches} - rust-tui0.9 ExclusiveArch: %{rust_arches} - rust-tuikit ExclusiveArch: %{rust_arches} - rust-tungstenite ExclusiveArch: %{rust_arches} - rust-twoway ExclusiveArch: %{rust_arches} - rust-type-map ExclusiveArch: %{rust_arches} - rust-typeable ExclusiveArch: %{rust_arches} - rust-typed-arena ExclusiveArch: %{rust_arches} - rust-typemap ExclusiveArch: %{rust_arches} - rust-typenum ExclusiveArch: %{rust_arches} - rust-typetag ExclusiveArch: %{rust_arches} - rust-typetag-impl ExclusiveArch: %{rust_arches} - rust-tzfile ExclusiveArch: %{rust_arches} - rust-ucd-parse ExclusiveArch: %{rust_arches} - rust-ucd-trie ExclusiveArch: %{rust_arches} - rust-ucd-util ExclusiveArch: %{rust_arches} - rust-unchecked-index ExclusiveArch: %{rust_arches} - rust-unescape ExclusiveArch: %{rust_arches} - rust-unic-char-property ExclusiveArch: %{rust_arches} - rust-unic-char-range ExclusiveArch: %{rust_arches} - rust-unic-common ExclusiveArch: %{rust_arches} - rust-unic-langid ExclusiveArch: %{rust_arches} - rust-unic-langid-impl ExclusiveArch: %{rust_arches} - rust-unic-langid-macros ExclusiveArch: %{rust_arches} - rust-unic-langid-macros-impl ExclusiveArch: %{rust_arches} - rust-unic-locale ExclusiveArch: %{rust_arches} - rust-unic-locale-impl ExclusiveArch: %{rust_arches} - rust-unic-locale-macros ExclusiveArch: %{rust_arches} - rust-unic-locale-macros-impl ExclusiveArch: %{rust_arches} - rust-unic-segment ExclusiveArch: %{rust_arches} - rust-unic-ucd-category ExclusiveArch: %{rust_arches} - rust-unic-ucd-common ExclusiveArch: %{rust_arches} - rust-unic-ucd-segment ExclusiveArch: %{rust_arches} - rust-unic-ucd-version ExclusiveArch: %{rust_arches} - rust-unicase ExclusiveArch: %{rust_arches} - rust-unicase1 ExclusiveArch: %{rust_arches} - rust-unicode-bidi ExclusiveArch: %{rust_arches} - rust-unicode-linebreak ExclusiveArch: %{rust_arches} - rust-unicode-normalization ExclusiveArch: %{rust_arches} - rust-unicode-segmentation ExclusiveArch: %{rust_arches} - rust-unicode-truncate ExclusiveArch: %{rust_arches} - rust-unicode-width ExclusiveArch: %{rust_arches} - rust-unicode-xid ExclusiveArch: %{rust_arches} - rust-unicode-xid0.1 ExclusiveArch: %{rust_arches} - rust-unicode_categories ExclusiveArch: %{rust_arches} - rust-unindent ExclusiveArch: %{rust_arches} - rust-universal-hash ExclusiveArch: %{rust_arches} - rust-unix_socket ExclusiveArch: %{rust_arches} - rust-unreachable ExclusiveArch: %{rust_arches} - rust-unsafe-any ExclusiveArch: %{rust_arches} - rust-unsafe-io ExclusiveArch: %{rust_arches} - rust-untrusted ExclusiveArch: %{rust_arches} - rust-uom ExclusiveArch: %{rust_arches} - rust-url ExclusiveArch: %{rust_arches} - rust-url1 ExclusiveArch: %{rust_arches} - rust-url_serde ExclusiveArch: %{rust_arches} - rust-urlencoding ExclusiveArch: %{rust_arches} - rust-urlocator ExclusiveArch: %{rust_arches} - rust-urlshortener ExclusiveArch: %{rust_arches} - rust-users ExclusiveArch: %{rust_arches} - rust-users0.10 ExclusiveArch: %{rust_arches} - rust-utf-8 ExclusiveArch: %{rust_arches} - rust-utf8-cstr ExclusiveArch: %{rust_arches} - rust-utf8-ranges ExclusiveArch: %{rust_arches} - rust-utf8-width ExclusiveArch: %{rust_arches} - rust-utf8parse ExclusiveArch: %{rust_arches} - rust-uuid ExclusiveArch: %{rust_arches} - rust-uuid0.7 ExclusiveArch: %{rust_arches} - rust-v_frame ExclusiveArch: %{rust_arches} - rust-value-bag ExclusiveArch: %{rust_arches} - rust-varlink ExclusiveArch: %{rust_arches} - rust-varlink-cli ExclusiveArch: %{rust_arches} - rust-varlink_generator ExclusiveArch: %{rust_arches} - rust-varlink_parser ExclusiveArch: %{rust_arches} - rust-varlink_stdinterfaces ExclusiveArch: %{rust_arches} - rust-vcpkg ExclusiveArch: %{rust_arches} - rust-vec_map ExclusiveArch: %{rust_arches} - rust-vergen ExclusiveArch: %{rust_arches} - rust-vergen3 ExclusiveArch: %{rust_arches} - rust-version ExclusiveArch: %{rust_arches} - rust-version-compare ExclusiveArch: %{rust_arches} - rust-version-sync ExclusiveArch: %{rust_arches} - rust-version-sync0.8 ExclusiveArch: %{rust_arches} - rust-version_check ExclusiveArch: %{rust_arches} - rust-versions ExclusiveArch: %{rust_arches} - rust-virtio-bindings ExclusiveArch: x86_64 aarch64 ppc64le - rust-vm-memory ExclusiveArch: x86_64 aarch64 ppc64le - rust-vmm-sys-util ExclusiveArch: x86_64 aarch64 ppc64le - rust-vmw_backdoor ExclusiveArch: %{rust_arches} - rust-void ExclusiveArch: %{rust_arches} - rust-vsprintf ExclusiveArch: %{rust_arches} - rust-vte ExclusiveArch: %{rust_arches} - rust-vte_generate_state_changes ExclusiveArch: %{rust_arches} - rust-wait-timeout ExclusiveArch: %{rust_arches} - rust-waker-fn ExclusiveArch: %{rust_arches} - rust-walkdir ExclusiveArch: %{rust_arches} - rust-want ExclusiveArch: %{rust_arches} - rust-warp ExclusiveArch: %{rust_arches} - rust-wasm-bindgen ExclusiveArch: %{rust_arches} - rust-wasm-bindgen-backend ExclusiveArch: %{rust_arches} - rust-wasm-bindgen-futures ExclusiveArch: %{rust_arches} - rust-wasm-bindgen-macro ExclusiveArch: %{rust_arches} - rust-wasm-bindgen-macro-support ExclusiveArch: %{rust_arches} - rust-wasm-bindgen-shared ExclusiveArch: %{rust_arches} - rust-wasm-bindgen-test ExclusiveArch: %{rust_arches} - rust-wasm-bindgen-test-macro ExclusiveArch: %{rust_arches} - rust-wasmer_enumset ExclusiveArch: %{rust_arches} - rust-wasmer_enumset_derive ExclusiveArch: %{rust_arches} - rust-wasmparser ExclusiveArch: %{rust_arches} - rust-wasmtime-cache ExclusiveArch: %{rust_arches} - rust-wasmtime-environ ExclusiveArch: %{rust_arches} - rust-wasmtime-fiber ExclusiveArch: %{rust_arches} - rust-wasmtime-types ExclusiveArch: %{rust_arches} - rust-wast ExclusiveArch: %{rust_arches} - rust-wat ExclusiveArch: %{rust_arches} - rust-watchman_client ExclusiveArch: %{rust_arches} - rust-wayland-client ExclusiveArch: %{rust_arches} - rust-wayland-commons ExclusiveArch: %{rust_arches} - rust-wayland-cursor ExclusiveArch: %{rust_arches} - rust-wayland-egl ExclusiveArch: %{rust_arches} - rust-wayland-protocols ExclusiveArch: %{rust_arches} - rust-wayland-scanner ExclusiveArch: %{rust_arches} - rust-wayland-server ExclusiveArch: %{rust_arches} - rust-wayland-sys ExclusiveArch: %{rust_arches} - rust-web-sys ExclusiveArch: %{rust_arches} - rust-webbrowser ExclusiveArch: %{rust_arches} - rust-webkit2gtk ExclusiveArch: %{rust_arches} - rust-webkit2gtk-sys ExclusiveArch: %{rust_arches} - rust-webpki ExclusiveArch: %{rust_arches} - rust-webpki-roots ExclusiveArch: %{rust_arches} - rust-websocket ExclusiveArch: %{rust_arches} - rust-websocket-base ExclusiveArch: %{rust_arches} - rust-weezl ExclusiveArch: %{rust_arches} - rust-which ExclusiveArch: %{rust_arches} - rust-wide ExclusiveArch: %{rust_arches} - rust-wild ExclusiveArch: %{rust_arches} - rust-wildmatch ExclusiveArch: %{rust_arches} - rust-winit ExclusiveArch: %{rust_arches} - rust-witx ExclusiveArch: %{rust_arches} - rust-ws ExclusiveArch: %{rust_arches} - rust-wyz ExclusiveArch: %{rust_arches} - rust-x11 ExclusiveArch: %{rust_arches} - rust-x11-clipboard ExclusiveArch: %{rust_arches} - rust-x11-dl ExclusiveArch: %{rust_arches} - rust-xattr ExclusiveArch: %{rust_arches} - rust-xcb ExclusiveArch: %{rust_arches} - rust-xcursor ExclusiveArch: %{rust_arches} - rust-xdg ExclusiveArch: %{rust_arches} - rust-xi-unicode ExclusiveArch: %{rust_arches} - rust-xkbcommon ExclusiveArch: %{rust_arches} - rust-xml-rs ExclusiveArch: %{rust_arches} - rust-xml5ever ExclusiveArch: %{rust_arches} - rust-xmlparser ExclusiveArch: %{rust_arches} - rust-xmltree ExclusiveArch: %{rust_arches} - rust-xmlwriter ExclusiveArch: %{rust_arches} - rust-xz2 ExclusiveArch: %{rust_arches} - rust-y4m ExclusiveArch: %{rust_arches} - rust-yaml-rust ExclusiveArch: %{rust_arches} - rust-yaml-rust0.3 ExclusiveArch: %{rust_arches} - rust-ybaas ExclusiveArch: %{rust_arches} - rust-yubibomb ExclusiveArch: %{rust_arches} - rust-zbase32 ExclusiveArch: %{rust_arches} - rust-zbus ExclusiveArch: %{rust_arches} - rust-zbus_macros ExclusiveArch: %{rust_arches} - rust-zcomponents ExclusiveArch: %{rust_arches} - rust-zeroize ExclusiveArch: %{rust_arches} - rust-zeroize_derive ExclusiveArch: %{rust_arches} - rust-zincati ExclusiveArch: %{rust_arches} - rust-zip ExclusiveArch: %{rust_arches} - rust-zmq-sys ExclusiveArch: %{rust_arches} - rust-zoneinfo_compiled ExclusiveArch: %{rust_arches} - rust-zopfli ExclusiveArch: %{rust_arches} - rust-zoxide ExclusiveArch: %{rust_arches} - rust-zram-generator ExclusiveArch: %{rust_arches} - rust-zstd ExclusiveArch: %{rust_arches} - rust-zstd-safe ExclusiveArch: %{rust_arches} - rust-zstd-sys ExclusiveArch: %{rust_arches} - rust-zvariant ExclusiveArch: %{rust_arches} - rust-zvariant_derive ExclusiveArch: %{rust_arches} - s390utils ExclusiveArch: s390 s390x - safetyblanket ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc64le - sagemath ExclusiveArch: aarch64 %{ix86} x86_64 ppc sparcv9 - sbcl ExclusiveArch: %{arm} %{ix86} x86_64 ppc sparcv9 aarch64 - sbd ExclusiveArch: i686 x86_64 s390x aarch64 ppc64le - sbsigntools ExclusiveArch: x86_64 aarch64 %{arm} %{ix86} - sdsl-lite ExclusiveArch: %{power64} x86_64 aarch64 - seabios ExclusiveArch: x86_64 - seadrive-gui ExclusiveArch: %{qt5_qtwebengine_arches} - seafile-client ExclusiveArch: %{qt5_qtwebengine_arches} - seamonkey ExclusiveArch: x86_64 - seqan3 ExclusiveArch: %{power64} x86_64 aarch64 - servicelog ExclusiveArch: ppc %{power64} - sgabios ExclusiveArch: %{ix86} x86_64 - sharpfont ExclusiveArch: %mono_arches - sharpziplib ExclusiveArch: %{mono_arches} - shim ExclusiveArch: %{efi} - shim-unsigned-aarch64 ExclusiveArch: aarch64 - shim-unsigned-x64 ExclusiveArch: x86_64 - sigul ExclusiveArch: x86_64 - skopeo ExclusiveArch: %{go_arches} - skychart ExclusiveArch: %{fpc_arches} - snapd ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ppc64le s390x - soup-sharp ExclusiveArch: %{mono_arches} - sparkleshare ExclusiveArch: %{mono_arches} - spicctrl ExclusiveArch: %{ix86} x86_64 - spice ExclusiveArch: x86_64 ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - springlobby ExclusiveArch: %{ix86} x86_64 - squeekboard ExclusiveArch: %{rust_arches} - startdde ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - statsd ExclusiveArch: %{nodejs_arches} noarch - stratis-cli ExclusiveArch: %{rust_arches} noarch - stratisd ExclusiveArch: %{rust_arches} ExclusiveArch: ${rust_arches} - stripesnoop ExclusiveArch: %{ix86} x86_64 - supercollider ExclusiveArch: %{qt5_qtwebengine_arches} - supermin ExclusiveArch: %{kernel_arches} - svt-av1 ExclusiveArch: x86_64 - svt-vp9 ExclusiveArch: x86_64 - swift-lang ExclusiveArch: x86_64 aarch64 - sysbench ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} aarch64 ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} aarch64 ppc64le s390x - syslinux ExclusiveArch: %{ix86} x86_64 ExclusiveArch: %{ix86} x86_64 - system76-keyboard-configurator ExclusiveArch: %{rust_arches} - taglib-sharp ExclusiveArch: %{mono_arches} - tarantool ExclusiveArch: %{ix86} x86_64 - tboot ExclusiveArch: %{ix86} x86_64 - tdlib ExclusiveArch: x86_64 - templates_parser ExclusiveArch: %GPRbuild_arches - ternimal ExclusiveArch: %{rust_arches} - testcloud ExclusiveArch: %{kernel_arches} noarch - themonospot-base ExclusiveArch: %mono_arches - themonospot-console ExclusiveArch: %mono_arches - themonospot-gui-gtk ExclusiveArch: %mono_arches - themonospot-plugin-avi ExclusiveArch: %mono_arches - themonospot-plugin-mkv ExclusiveArch: %mono_arches - thermald ExclusiveArch: %{ix86} x86_64 - tilix ExclusiveArch: %{ldc_arches} - tmux-top ExclusiveArch: %{go_arches} - tomboy ExclusiveArch: %{mono_arches} - topojson-client ExclusiveArch: %{nodejs_arches} noarch - topojson-server ExclusiveArch: %{nodejs_arches} noarch - topojson-simplify ExclusiveArch: %{nodejs_arches} noarch - torbrowser-launcher ExclusiveArch: %{ix86} x86_64 - tuned-profiles-nfv-host-bin ExclusiveArch: %{ix86} x86_64 - uClibc ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} - ucx ExclusiveArch: aarch64 ppc64le x86_64 - uglify-js ExclusiveArch: %{nodejs_arches} noarch - unetbootin ExclusiveArch: %{ix86} x86_64 - ursa-major ExclusiveArch: noarch aarch64 ppc64le s390x x86_64 - usd ExclusiveArch: aarch64 x86_64 - v8-314 ExclusiveArch: %{ix86} x86_64 %{arm} mips mipsel ppc ppc64 - valgrind ExclusiveArch: %{ix86} x86_64 ppc ppc64 ppc64le s390x armv7hl aarch64 - vboot-utils ExclusiveArch: %{arm} aarch64 %{ix86} x86_64 - vim-go ExclusiveArch: %{?golang_arches}%{!?golang_arches:%{ix86} x86_64 %{arm}} - virt-p2v ExclusiveArch: x86_64 - virt-v2v ExclusiveArch: x86_64 - virtualbox-guest-additions ExclusiveArch: i686 x86_64 - vkd3d ExclusiveArch: %{ix86} x86_64 %{arm} ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - vmaf ExclusiveArch: x86_64 - vmemcache ExclusiveArch: x86_64 ppc64 ppc64le s390x aarch64 - vrq ExclusiveArch: %{ix86} x86_64 - warsow ExclusiveArch: %{ix86} x86_64 %{arm} - warsow-data ExclusiveArch: %{ix86} x86_64 %{arm} noarch ExclusiveArch: %{ix86} x86_64 %{arm} - webkit2-sharp ExclusiveArch: %mono_arches - wine ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ExclusiveArch: %{ix86} %{arm} - wine-dxvk ExclusiveArch: %{ix86} x86_64 - winetricks ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - wxMaxima ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc sparcv9 - x2goclient ExclusiveArch: x86_64 - xe-guest-utilities-latest ExclusiveArch: %{ix86} x86_64 - xen ExclusiveArch: %{ix86} x86_64 armv7hl aarch64 - xmlada ExclusiveArch: %{GPRbuild_arches} - xorg-x11-drv-armsoc ExclusiveArch: %{arm} aarch64 - xorg-x11-drv-intel ExclusiveArch: %{ix86} x86_64 - xorg-x11-drv-openchrome ExclusiveArch: %{ix86} x86_64 - xorg-x11-drv-vesa ExclusiveArch: %{ix86} x86_64 - xorg-x11-drv-vmware ExclusiveArch: %{ix86} x86_64 ia64 - xsp ExclusiveArch: %mono_arches - yarnpkg ExclusiveArch: %{nodejs_arches} noarch - zeal ExclusiveArch: %{qt5_qtwebengine_arches} - zeromq-ada ExclusiveArch: %{GPRbuild_arches} - zig ExclusiveArch: %{zig_arches} - zlib-ada ExclusiveArch: %{GPRbuild_arches} - zlib-ng ExclusiveArch: aarch64 i686 ppc64le s390x x86_64 - zola ExclusiveArch: %{rust_arches}

2 years, 5 months

1
0
0 / 0

Architecture specific change in rpms/java-17-openjdk.git

by githook-noreply＠fedoraproject.org

The package rpms/java-17-openjdk.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/java-17-openjdk.git/commit/?id=f3.... Change: +%ifnarch s390x Thanks. Full change: ============ commit 7ae5d5bd64a15e2e84d785dc56b5fb9e62ea113a Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org> Date: Fri Nov 5 22:46:45 2021 +0000 Handle Fedora in distro conditionals that currently only pertain to RHEL. diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec index bd2d867..00a6c16 100644 --- a/java-17-openjdk.spec +++ b/java-17-openjdk.spec @@ -298,7 +298,7 @@ %global top_level_dir_name %{origin} %global top_level_dir_name_backup %{top_level_dir_name}-backup %global buildver 12 -%global rpmrelease 8 +%global rpmrelease 9 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit %if %is_system_jdk # Using 10 digits may overflow the int used for priority, so we combine the patch and build versions @@ -937,7 +937,8 @@ Requires: libXcomposite%{?_isa} Requires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release} OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release} # for java-X-openjdk package's desktop binding -%if 0%{?rhel} >= 8 +# Where recommendations are available, recommend Gtk+ for the Swing look and feel +%if 0%{?rhel} >= 8 || 0%{?fedora} > 0 Recommends: gtk3%{?_isa} %endif @@ -978,8 +979,11 @@ Requires: cups-libs Requires(post): %{alternatives_requires} # Postun requires alternatives to uninstall tool alternatives Requires(postun): %{alternatives_requires} -# for optional support of kernel stream control, card reader and printing bindings +# Where suggestions are available, recommend the sctp and pcsc libraries +# for optional support of kernel stream control and card reader +%if 0%{?rhel} >= 8 || 0%{?fedora} > 0 Suggests: lksctp-tools%{?_isa}, pcsc-lite-libs%{?_isa} +%endif # Standard JPackage base provides Provides: jre-%{javaver}-%{origin}-headless%{?1} = %{epoch}:%{version}-%{release} @@ -1091,7 +1095,8 @@ Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist} Epoch: 1 Summary: %{origin_nice} %{featurever} Runtime Environment -%if 0%{?rhel} <= 8 +# Groups are only used up to RHEL 8 and on Fedora versions prior to F30 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1254,7 +1259,7 @@ The %{origin_nice} %{featurever} runtime environment. %if %{include_debug_build} %package slowdebug Summary: %{origin_nice} %{featurever} Runtime Environment %{debug_on} -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1267,7 +1272,7 @@ The %{origin_nice} %{featurever} runtime environment. %if %{include_fastdebug_build} %package fastdebug Summary: %{origin_nice} %{featurever} Runtime Environment %{fastdebug_on} -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1280,7 +1285,7 @@ The %{origin_nice} %{featurever} runtime environment. %if %{include_normal_build} %package headless Summary: %{origin_nice} %{featurever} Headless Runtime Environment -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1293,7 +1298,9 @@ The %{origin_nice} %{featurever} runtime environment without audio and video sup %if %{include_debug_build} %package headless-slowdebug Summary: %{origin_nice} %{featurever} Runtime Environment %{debug_on} +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages +%endif %{java_headless_rpo -- %{debug_suffix_unquoted}} @@ -1305,7 +1312,9 @@ The %{origin_nice} %{featurever} runtime environment without audio and video sup %if %{include_fastdebug_build} %package headless-fastdebug Summary: %{origin_nice} %{featurever} Runtime Environment %{fastdebug_on} +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages +%endif %{java_headless_rpo -- %{fastdebug_suffix_unquoted}} @@ -1317,7 +1326,7 @@ The %{origin_nice} %{featurever} runtime environment without audio and video sup %if %{include_normal_build} %package devel Summary: %{origin_nice} %{featurever} Development Environment -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1330,7 +1339,7 @@ The %{origin_nice} %{featurever} development tools. %if %{include_debug_build} %package devel-slowdebug Summary: %{origin_nice} %{featurever} Development Environment %{debug_on} -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1344,7 +1353,9 @@ The %{origin_nice} %{featurever} development tools. %if %{include_fastdebug_build} %package devel-fastdebug Summary: %{origin_nice} %{featurever} Development Environment %{fastdebug_on} +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Tools +%endif %{java_devel_rpo -- %{fastdebug_suffix_unquoted}} @@ -1393,7 +1404,7 @@ The %{origin_nice} %{featurever} libraries for static linking. %if %{include_normal_build} %package jmods Summary: JMods for %{origin_nice} %{featurever} -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1406,7 +1417,7 @@ The JMods for %{origin_nice} %{featurever}. %if %{include_debug_build} %package jmods-slowdebug Summary: JMods for %{origin_nice} %{featurever} %{debug_on} -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1420,7 +1431,9 @@ The JMods for %{origin_nice} %{featurever}. %if %{include_fastdebug_build} %package jmods-fastdebug Summary: JMods for %{origin_nice} %{featurever} %{fastdebug_on} +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Tools +%endif %{java_jmods_rpo -- %{fastdebug_suffix_unquoted}} @@ -1432,7 +1445,7 @@ The JMods for %{origin_nice} %{featurever}. %if %{include_normal_build} %package demo Summary: %{origin_nice} %{featurever} Demos -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1445,7 +1458,7 @@ The %{origin_nice} %{featurever} demos. %if %{include_debug_build} %package demo-slowdebug Summary: %{origin_nice} %{featurever} Demos %{debug_on} -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1459,7 +1472,9 @@ The %{origin_nice} %{featurever} demos. %if %{include_fastdebug_build} %package demo-fastdebug Summary: %{origin_nice} %{featurever} Demos %{fastdebug_on} +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages +%endif %{java_demo_rpo -- %{fastdebug_suffix_unquoted}} @@ -1471,7 +1486,7 @@ The %{origin_nice} %{featurever} demos. %if %{include_normal_build} %package src Summary: %{origin_nice} %{featurever} Source Bundle -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1485,7 +1500,7 @@ class library source code for use by IDE indexers and debuggers. %if %{include_debug_build} %package src-slowdebug Summary: %{origin_nice} %{featurever} Source Bundle %{for_debug} -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1499,7 +1514,9 @@ The %{compatiblename}-src-slowdebug sub-package contains the complete %{origin_n %if %{include_fastdebug_build} %package src-fastdebug Summary: %{origin_nice} %{featurever} Source Bundle %{for_fastdebug} +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages +%endif %{java_src_rpo -- %{fastdebug_suffix_unquoted}} @@ -1511,7 +1528,7 @@ The %{compatiblename}-src-fastdebug sub-package contains the complete %{origin_n %if %{include_normal_build} %package javadoc Summary: %{origin_nice} %{featurever} API documentation -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Documentation %endif Requires: javapackages-filesystem @@ -1526,7 +1543,7 @@ The %{origin_nice} %{featurever} API documentation. %if %{include_normal_build} %package javadoc-zip Summary: %{origin_nice} %{featurever} API documentation compressed in a single archive -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Documentation %endif Requires: javapackages-filesystem @@ -2355,6 +2372,8 @@ cjc.mainProgram(args) %endif %changelog -* Thu Nov 18 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.0.0.35-8 -- inital import +* Mov Nov 29 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-9 +- Handle Fedora in distro conditionals that currently only pertain to RHEL. +* Thu Nov 18 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.0.0.35-8 +-- inital import commit 108126b081dcb467cb7d10d3e9a6e1aa84e1ed0a Author: Jiri Vanek <jvanek(a)redhat.com> Date: Tue Dec 7 15:52:30 2021 +0100 Added missing files from latest and 11 diff --git a/.gitignore b/.gitignore index cd592ed..1cf80ea 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,22 @@ +/jdk-jdk12-jdk-12+33.tar.xz +/systemtap_3.2_tapsets_hg-icedtea8-9d464368e06d.tar.xz +/jdk-updates-jdk12u-jdk-12.0.1+12.tar.xz +/jdk-jdk13-jdk-13+27.tar.xz +/jdk-jdk13-jdk-13+28.tar.xz +/jdk-jdk13-jdk-13+33.tar.xz +/jdk-updates-jdk13u-jdk-13.0.1+9.tar.xz +/jdk-updates-jdk13u-jdk-13.0.2+8.tar.xz +/jdk-jdk14-jdk-14+36.tar.xz +/jdk-updates-jdk14u-jdk-14.0.1+7.tar.xz +/jdk-updates-jdk14u-jdk-14.0.2+12.tar.xz +/jdk-jdk15-jdk-15+36.tar.xz +/jdk-updates-jdk15u-jdk-15.0.1+9.tar.xz +/tapsets-icedtea-3.15.0.tar.xz +/jdk-updates-jdk15u-jdk-15.0.2+7.tar.xz +/openjdk-jdk16-jdk-16+36.tar.xz +/openjdk-jdk16u-jdk-16.0.1+9.tar.xz +/openjdk-jdk17-jdk-17+26.tar.xz +/openjdk-jdk17-jdk-17+33.tar.xz +/openjdk-jdk17-jdk-17+35.tar.xz /openjdk-jdk17u-jdk-17.0.1+12.tar.xz /tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz diff --git a/README.md b/README.md index b11f5d3..079e78c 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,10 @@ -# java-17-openjdk +Package of LTS OpenJDK 17 +OpenJDK have release cadence of 6 months. but 3/4 of them are Short Term Supported for 6 months only. -The java-17-openjdk package +JDK17 is last LTS release of Java platform. It is bringing many cool improvements - http://openjdk.java.net/projects/jdk/17/ and is landing to your Fedora. Where it will be maintained for several years. You will always be allowed to install Used LTSs in build root, and alongside via alternatives. + +See announcement: http://mail.openjdk.java.net/pipermail/discuss/2017-September/004281.html +See java SIG plans: https://jvanek.fedorapeople.org/devconf/2018/changesInjavaReleaseProcess.pdf + +https://fedoraproject.org/wiki/Changes/Java17 +https://fedoraproject.org/wiki/Changes/java-11-openjdk-TechPreview diff --git a/generate_source_tarball.sh b/generate_source_tarball.sh new file mode 100755 index 0000000..1a019ff --- /dev/null +++ b/generate_source_tarball.sh @@ -0,0 +1,156 @@ +#!/bin/bash +# Generates the 'source tarball' for JDK projects. +# +# Example: +# When used from local repo set REPO_ROOT pointing to file:// with your repo +# If your local repo follows upstream forests conventions, it may be enough to set OPENJDK_URL +# If you want to use a local copy of patch PR3788, set the path to it in the PR3788 variable +# +# In any case you have to set PROJECT_NAME REPO_NAME and VERSION. eg: +# PROJECT_NAME=openjdk +# REPO_NAME=jdk16 +# VERSION=HEAD +# or to eg prepare systemtap: +# icedtea7's jstack and other tapsets +# VERSION=6327cf1cea9e +# REPO_NAME=icedtea7-2.6 +# PROJECT_NAME=release +# OPENJDK_URL=http://icedtea.classpath.org/hg/ +# TO_COMPRESS="*/tapset" +# +# They are used to create correct name and are used in construction of sources url (unless REPO_ROOT is set) + +# This script creates a single source tarball out of the repository +# based on the given tag and removes code not allowed in fedora/rhel. For +# consistency, the source tarball will always contain 'openjdk' as the top +# level folder, name is created, based on parameter +# + +if [ ! "x$PR3823" = "x" ] ; then + if [ ! -f "$PR3823" ] ; then + echo "You have specified PR3823 as $PR3823 but it does not exist. Exiting" + exit 1 + fi +fi + +set -e + +OPENJDK_URL_DEFAULT=https://github.com +COMPRESSION_DEFAULT=xz + +if [ "x$1" = "xhelp" ] ; then + echo -e "Behaviour may be specified by setting the following variables:\n" + echo "VERSION - the version of the specified OpenJDK project" + echo "PROJECT_NAME -- the name of the OpenJDK project being archived (optional; only needed by defaults)" + echo "REPO_NAME - the name of the OpenJDK repository (optional; only needed by defaults)" + echo "OPENJDK_URL - the URL to retrieve code from (optional; defaults to ${OPENJDK_URL_DEFAULT})" + echo "COMPRESSION - the compression type to use (optional; defaults to ${COMPRESSION_DEFAULT})" + echo "FILE_NAME_ROOT - name of the archive, minus extensions (optional; defaults to PROJECT_NAME-REPO_NAME-VERSION)" + echo "TO_COMPRESS - what part of clone to pack (default is openjdk)" + echo "PR3823 - the path to the PR3823 patch to apply (optional; downloaded if unavailable)" + exit 1; +fi + + +if [ "x$VERSION" = "x" ] ; then + echo "No VERSION specified" + exit -2 +fi +echo "Version: ${VERSION}" + +# REPO_NAME is only needed when we default on REPO_ROOT and FILE_NAME_ROOT +if [ "x$FILE_NAME_ROOT" = "x" -o "x$REPO_ROOT" = "x" ] ; then + if [ "x$PROJECT_NAME" = "x" ] ; then + echo "No PROJECT_NAME specified" + exit -1 + fi + echo "Project name: ${PROJECT_NAME}" + if [ "x$REPO_NAME" = "x" ] ; then + echo "No REPO_NAME specified" + exit -3 + fi + echo "Repository name: ${REPO_NAME}" +fi + +if [ "x$OPENJDK_URL" = "x" ] ; then + OPENJDK_URL=${OPENJDK_URL_DEFAULT} + echo "No OpenJDK URL specified; defaulting to ${OPENJDK_URL}" +else + echo "OpenJDK URL: ${OPENJDK_URL}" +fi + +if [ "x$COMPRESSION" = "x" ] ; then + # rhel 5 needs tar.gz + COMPRESSION=${COMPRESSION_DEFAULT} +fi +echo "Creating a tar.${COMPRESSION} archive" + +if [ "x$FILE_NAME_ROOT" = "x" ] ; then + FILE_NAME_ROOT=${PROJECT_NAME}-${REPO_NAME}-${VERSION} + echo "No file name root specified; default to ${FILE_NAME_ROOT}" +fi +if [ "x$REPO_ROOT" = "x" ] ; then + REPO_ROOT="${OPENJDK_URL}/${PROJECT_NAME}/${REPO_NAME}.git" + echo "No repository root specified; default to ${REPO_ROOT}" +fi; + +if [ "x$TO_COMPRESS" = "x" ] ; then + TO_COMPRESS="openjdk" + echo "No to be compressed targets specified, ; default to ${TO_COMPRESS}" +fi; + +if [ -d ${FILE_NAME_ROOT} ] ; then + echo "exists exists exists exists exists exists exists " + echo "reusing reusing reusing reusing reusing reusing " + echo ${FILE_NAME_ROOT} +else + mkdir "${FILE_NAME_ROOT}" + pushd "${FILE_NAME_ROOT}" + echo "Cloning ${VERSION} root repository from ${REPO_ROOT}" + git clone -b ${VERSION} ${REPO_ROOT} openjdk + popd +fi +pushd "${FILE_NAME_ROOT}" + if [ -d openjdk/src ]; then + pushd openjdk + echo "Removing EC source code we don't build" + CRYPTO_PATH=src/jdk.crypto.ec/share/native/libsunec/impl + rm -vf ${CRYPTO_PATH}/ec2.h + rm -vf ${CRYPTO_PATH}/ec2_163.c + rm -vf ${CRYPTO_PATH}/ec2_193.c + rm -vf ${CRYPTO_PATH}/ec2_233.c + rm -vf ${CRYPTO_PATH}/ec2_aff.c + rm -vf ${CRYPTO_PATH}/ec2_mont.c + rm -vf ${CRYPTO_PATH}/ecp_192.c + rm -vf ${CRYPTO_PATH}/ecp_224.c + + echo "Syncing EC list with NSS" + if [ "x$PR3823" = "x" ] ; then + # originally for 8: + # get PR3823.patch (from http://icedtea.classpath.org/hg/icedtea16) from most correct tag + # Do not push it or publish it (see https://icedtea.classpath.org/bugzilla/show_bug.cgi?id=3823) + echo "PR3823 not found. Downloading..." + wget https://icedtea.classpath.org/hg/icedtea16/raw-file/tip/patches/pr3823.patch + echo "Applying ${PWD}/pr3823.patch" + patch -Np1 < pr3823.patch + rm pr3823.patch + else + echo "Applying ${PR3823}" + patch -Np1 < $PR3823 + fi; + find . -name '*.orig' -exec rm -vf '{}' ';' + popd + fi + + echo "Compressing remaining forest" + if [ "X$COMPRESSION" = "Xxz" ] ; then + SWITCH=cJf + else + SWITCH=czf + fi + tar --exclude-vcs -$SWITCH ${FILE_NAME_ROOT}.tar.${COMPRESSION} $TO_COMPRESS + mv ${FILE_NAME_ROOT}.tar.${COMPRESSION} .. +popd +echo "Done. You may want to remove the uncompressed version - $FILE_NAME_ROOT." + + diff --git a/icedtea_sync.sh b/icedtea_sync.sh new file mode 100755 index 0000000..e5c54f3 --- /dev/null +++ b/icedtea_sync.sh @@ -0,0 +1,192 @@ +#!/bin/bash + +# Copyright (C) 2019 Red Hat, Inc. +# Written by Andrew John Hughes <gnu.andrew(a)redhat.com>. +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. + +ICEDTEA_USE_VCS=true + +ICEDTEA_VERSION=3.15.0 +ICEDTEA_URL=https://icedtea.classpath.org/download/source +ICEDTEA_SIGNING_KEY=CFDA0F9B35964222 + +ICEDTEA_HG_URL=https://icedtea.classpath.org/hg/icedtea11 + +set -e + +RPM_DIR=${PWD} +if [ ! -f ${RPM_DIR}/jconsole.desktop.in ] ; then + echo "Not in RPM source tree."; + exit 1; +fi + +if test "x${TMPDIR}" = "x"; then + TMPDIR=/tmp; +fi +WORKDIR=${TMPDIR}/it.sync + +echo "Using working directory ${WORKDIR}" +mkdir ${WORKDIR} +pushd ${WORKDIR} + +if test "x${WGET}" = "x"; then + WGET=$(which wget); + if test "x${WGET}" = "x"; then + echo "wget not found"; + exit 1; + fi +fi + +if test "x${TAR}" = "x"; then + TAR=$(which tar) + if test "x${TAR}" = "x"; then + echo "tar not found"; + exit 2; + fi +fi + +echo "Dependencies:"; +echo -e "\tWGET: ${WGET}"; +echo -e "\tTAR: ${TAR}\n"; + +if test "x${ICEDTEA_USE_VCS}" = "xtrue"; then + echo "Mode: Using VCS"; + + if test "x${GREP}" = "x"; then + GREP=$(which grep); + if test "x${GREP}" = "x"; then + echo "grep not found"; + exit 3; + fi + fi + + if test "x${CUT}" = "x"; then + CUT=$(which cut); + if test "x${CUT}" = "x"; then + echo "cut not found"; + exit 4; + fi + fi + + if test "x${TR}" = "x"; then + TR=$(which tr); + if test "x${TR}" = "x"; then + echo "tr not found"; + exit 5; + fi + fi + + if test "x${HG}" = "x"; then + HG=$(which hg); + if test "x${HG}" = "x"; then + echo "hg not found"; + exit 6; + fi + fi + + echo "Dependencies:"; + echo -e "\tGREP: ${GREP}"; + echo -e "\tCUT: ${CUT}"; + echo -e "\tTR: ${TR}"; + echo -e "\tHG: ${HG}"; + + echo "Checking out repository from VCS..."; + ${HG} clone ${ICEDTEA_HG_URL} icedtea + + echo "Obtaining version from configure.ac..."; + ROOT_VER=$(${GREP} '^AC_INIT' icedtea/configure.ac|${CUT} -d ',' -f 2|${TR} -d '[][:space:]') + echo "Root version from configure: ${ROOT_VER}"; + + VCS_REV=$(${HG} log -R icedtea --template '{node|short}' -r tip) + echo "VCS revision: ${VCS_REV}"; + + ICEDTEA_VERSION="${ROOT_VER}-${VCS_REV}" + echo "Creating icedtea-${ICEDTEA_VERSION}"; + mkdir icedtea-${ICEDTEA_VERSION} + echo "Copying required files from checkout to icedtea-${ICEDTEA_VERSION}"; + # Commented out for now as IcedTea 6's jconsole.desktop.in is outdated + #cp -a icedtea/jconsole.desktop.in ../icedtea-${ICEDTEA_VERSION} + cp -a ${RPM_DIR}/jconsole.desktop.in icedtea-${ICEDTEA_VERSION} + cp -a icedtea/tapset icedtea-${ICEDTEA_VERSION} + + rm -rf icedtea +else + echo "Mode: Using tarball"; + + if test "x${ICEDTEA_VERSION}" = "x"; then + echo "No IcedTea version specified for tarball download."; + exit 3; + fi + + if test "x${CHECKSUM}" = "x"; then + CHECKSUM=$(which sha256sum) + if test "x${CHECKSUM}" = "x"; then + echo "sha256sum not found"; + exit 4; + fi + fi + + if test "x${PGP}" = "x"; then + PGP=$(which gpg) + if test "x${PGP}" = "x"; then + echo "gpg not found"; + exit 5; + fi + fi + + echo "Dependencies:"; + echo -e "\tCHECKSUM: ${CHECKSUM}"; + echo -e "\tPGP: ${PGP}\n"; + + echo "Checking for IcedTea signing key ${ICEDTEA_SIGNING_KEY}..."; + if ! gpg --list-keys ${ICEDTEA_SIGNING_KEY}; then + echo "IcedTea signing key ${ICEDTEA_SIGNING_KEY} not installed."; + exit 6; + fi + + echo "Downloading IcedTea release tarball..."; + ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz + echo "Downloading IcedTea tarball signature..."; + ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz.sig + echo "Downloading IcedTea tarball checksums..."; + ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.sha256 + + echo "Verifying checksums..."; + ${CHECKSUM} --check --ignore-missing icedtea-${ICEDTEA_VERSION}.sha256 + + echo "Checking signature..."; + ${PGP} --verify icedtea-${ICEDTEA_VERSION}.tar.xz.sig + + echo "Extracting files..."; + ${TAR} xJf icedtea-${ICEDTEA_VERSION}.tar.xz \ + icedtea-${ICEDTEA_VERSION}/tapset \ + icedtea-${ICEDTEA_VERSION}/jconsole.desktop.in + + rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz + rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz.sig + rm -vf icedtea-${ICEDTEA_VERSION}.sha256 +fi + +echo "Replacing desktop files..."; +mv -v icedtea-${ICEDTEA_VERSION}/jconsole.desktop.in ${RPM_DIR} + +echo "Creating new tapset tarball..."; +mv -v icedtea-${ICEDTEA_VERSION} openjdk +${TAR} cJf ${RPM_DIR}/tapsets-icedtea-${ICEDTEA_VERSION}.tar.xz openjdk + +rm -rvf openjdk + +popd +rm -rf ${WORKDIR} commit f32499609c2a8c0f4e91ecefab86feddf7585cc3 Author: Jiri Vanek <jvanek(a)redhat.com> Date: Tue Dec 7 15:45:09 2021 +0100 Initial load diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..cd592ed --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +/openjdk-jdk17u-jdk-17.0.1+12.tar.xz +/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz diff --git a/NEWS b/NEWS new file mode 100644 index 0000000..9d37ff9 --- /dev/null +++ b/NEWS @@ -0,0 +1,619 @@ +Key: + +JDK-X - https://bugs.openjdk.java.net/browse/JDK-X +CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY + +New in release OpenJDK 17.0.1 (2021-10-19): +=========================================== +Live versions of these release notes can be found at: + * https://builds.shipilev.net/backports-monitor/release-notes-17.0.1.txt + +* Security fixes + - JDK-8263314: Enhance XML Dsig modes + - JDK-8265167, CVE-2021-35556: Richer Text Editors + - JDK-8265574: Improve handling of sheets + - JDK-8265580, CVE-2021-35559: Enhanced style for RTF kit + - JDK-8265776: Improve Stream handling for SSL + - JDK-8266097, CVE-2021-35561: Better hashing support + - JDK-8266103: Better specified spec values + - JDK-8266109: More Resilient Classloading + - JDK-8266115: More Manifest Jar Loading + - JDK-8266137, CVE-2021-35564: Improve Keystore integrity + - JDK-8266689, CVE-2021-35567: More Constrained Delegation + - JDK-8267086: ArrayIndexOutOfBoundsException in java.security.KeyFactory.generatePublic + - JDK-8267712: Better LDAP reference processing + - JDK-8267729, CVE-2021-35578: Improve TLS client handshaking + - JDK-8267735, CVE-2021-35586: Better BMP support + - JDK-8268193: Improve requests of certificates + - JDK-8268199: Correct certificate requests + - JDK-8268205: Enhance DTLS client handshake + - JDK-8268500: Better specified ParameterSpecs + - JDK-8268506: More Manifest Digests + - JDK-8269618, CVE-2021-35603: Better session identification + - JDK-8269624: Enhance method selection support + - JDK-8270398: Enhance canonicalization + - JDK-8270404: Better canonicalization +* Other changes + - JDK-8225082: Remove IdenTrust certificate that is expiring in September 2021 + - JDK-8243543: jtreg test security/infra/java/security/cert/CertPathValidator/certification/BuypassCA.java fails + - JDK-8248899: security/infra/java/security/cert/CertPathValidator/certification/QuoVadisCA.java fails, Certificate has been revoked + - JDK-8261088: Repeatable annotations without @Target cannot have containers that target module declarations + - JDK-8262731: [macOS] Exception from "Printable.print" is swallowed during "PrinterJob.print" + - JDK-8263531: Remove unused buffer int + - JDK-8266182: Automate manual steps listed in the test jdk/sun/security/pkcs12/ParamsTest.java + - JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type + - JDK-8267666: Add option to jcmd GC.heap_dump to use existing file + - JDK-8268019: C2: assert(no_dead_loop) failed: dead loop detected + - JDK-8268261: C2: assert(n != __null) failed: Bad immediate dominator info. + - JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm performance + - JDK-8268963: [IR Framework] Some default regexes matching on PrintOptoAssembly in IRNode.java do not work on all platforms + - JDK-8269297: Bump version numbers for JDK 17.0.1 + - JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should be more resilient + - JDK-8269574: C2: Avoid redundant uncommon traps in GraphKit::builtin_throw() for JVMTI exception events + - JDK-8269763: The JEditorPane is blank after JDK-8265167 + - JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports incorrect process cpu usage in containers + - JDK-8269882: stack-use-after-scope in NewObjectA + - JDK-8269897: Shenandoah: Resolve UNKNOWN access strength, where possible + - JDK-8269934: RunThese24H.java failed with EXCEPTION_ACCESS_VIOLATION in java_lang_Thread::get_thread_status + - JDK-8269993: [Test]: java/net/httpclient/DigestEchoClientSSL.java contains redundant @run tags + - JDK-8270094: Shenandoah: Provide human-readable labels for test configurations + - JDK-8270096: Shenandoah: Optimize gc/shenandoah/TestRefprocSanity.java for interpreter mode + - JDK-8270098: ZGC: ZBarrierSetC2::clone_at_expansion fails with "Guard against surprises" assert + - JDK-8270137: Kerberos Credential Retrieval from Cache not Working in Cross-Realm Setup + - JDK-8270280: security/infra/java/security/cert/CertPathValidator/certification/LetsEncryptCA.java OCSP response error + - JDK-8270344: Session resumption errors + - JDK-8271203: C2: assert(iff->Opcode() == Op_If || iff->Opcode() == Op_CountedLoopEnd || iff->Opcode() == Op_RangeCheck) failed: Check this code when new subtype is added + - JDK-8271276: C2: Wrong JVM state used for receiver null check + - JDK-8271335: Updating RE Configs for BUILD REQUEST 17.0.1+4 + - JDK-8271589: fatal error with variable shift count integer rotate operation. + - JDK-8271723: Unproblemlist runtime/InvocationTests/invokevirtualTests.java + - JDK-8271730: Client authentication using RSASSA-PSS fails after correct certificate requests + - JDK-8271925: ZGC: Arraycopy stub passes invalid oop to load barrier + - JDK-8272124: Cgroup v1 initialization causes NullPointerException when cgroup path contains colon + - JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash when clone null CallProjections.fallthrough_ioproj + - JDK-8272326: java/util/Random/RandomTestMoments.java had two Gaussian fails + - JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz after JDK-8255790 + - JDK-8272472: StackGuardPages test doesn't build with glibc 2.34 + - JDK-8272581: sun/security/pkcs11/Provider/MultipleLogins.sh fails after JDK-8266182 + - JDK-8272602: [macos] not all KEY_PRESSED events sent when control modifier is used + - JDK-8272700: [macos] Build failure with Xcode 13.0 after JDK-8264848 + - JDK-8272708: [Test]: Cleanup: test/jdk/security/infra/java/security/cert/CertPathValidator/certification/BuypassCA.java no longer needs ocspEnabled + - JDK-8272806: [macOS] "Apple AWT Internal Exception" when input method is changed + - JDK-8273358: macOS Monterey does not have the font Times needed by Serif + +Notes on individual issues: +=========================== + +security-libs/java.security: + +JDK-8271434: Removed IdenTrust Root Certificate +=============================================== +The following root certificate from IdenTrust has been removed from +the `cacerts` keystore: + +Alias Name: identrustdstx3 [jdk] +Distinguished Name: CN=DST Root CA X3, O=Digital Signature Trust Co. + +New in release OpenJDK 17.0.0 (2021-09-14): +=========================================== +The full list of changes in the interim releases from 11u to 17u can be found at: + * https://builds.shipilev.net/backports-monitor/release-notes-12.txt + * https://builds.shipilev.net/backports-monitor/release-notes-13.txt + * https://builds.shipilev.net/backports-monitor/release-notes-14.txt + * https://builds.shipilev.net/backports-monitor/release-notes-15.txt + * https://builds.shipilev.net/backports-monitor/release-notes-16.txt + * https://builds.shipilev.net/backports-monitor/release-notes-17.txt + +Major changes are listed below. Some changes may have been backported +to earlier releases following their first appearance in OpenJDK 12 +through to 17. + +NEW FEATURES +============ + +Language Features +================= + +Switch Expressions +================== +https://openjdk.java.net/jeps/325 +https://openjdk.java.net/jeps/354 +https://openjdk.java.net/jeps/361 + +Extend the `switch` statement so that it can be used as either a +statement or an expression, and that both forms can use either a +"traditional" or "simplified" scoping and control flow behavior. Both +forms can use either traditional `case ... :` labels (with fall +through) or new `case ... ->` labels (with no fall through), with a +further new statement for yielding a value from a `switch` +expression. These changes will simplify everyday coding, and also +prepare the way for the use of pattern matching in `switch`. + +This was a preview feature (http://openjdk.java.net/jeps/12) in +OpenJDK 12 & 13 and became final in OpenJDK 14. + +Text Blocks +=========== +https://openjdk.java.net/jeps/355 +https://openjdk.java.net/jeps/368 +https://openjdk.java.net/jeps/378 + +Add text blocks to the Java language. A text block is a multi-line +string literal that avoids the need for most escape sequences, +automatically formats the string in a predictable way, and gives the +developer control over format when desired. + +This was a preview feature (http://openjdk.java.net/jeps/12) in +OpenJDK 13 & 14 and became final in OpenJDK 15. + +Pattern Matching for instanceof +=============================== +https://openjdk.java.net/jeps/305 +https://openjdk.java.net/jeps/375 +https://openjdk.java.net/jeps/394 +http://cr.openjdk.java.net/~briangoetz/amber/pattern-match.html + +Enhance the Java programming language with pattern matching for the +`instanceof` operator. Pattern matching allows common logic in a +program, namely the conditional extraction of components from objects, +to be expressed more concisely and safely. + +This was a preview feature (http://openjdk.java.net/jeps/12) in +OpenJDK 14 & 15 and became final in OpenJDK 16. + +Records +======= +https://openjdk.java.net/jeps/359 +https://openjdk.java.net/jeps/384 +https://openjdk.java.net/jeps/395 + +Enhance the Java programming language with records. Records provide a +compact syntax for declaring classes which are transparent holders for +shallowly immutable data. + +This was a preview feature (http://openjdk.java.net/jeps/12) in +OpenJDK 14 & 15 and became final in OpenJDK 16. + +Sealed Classes +============== +https://openjdk.java.net/jeps/360 +https://openjdk.java.net/jeps/397 +https://openjdk.java.net/jeps/409 +https://cr.openjdk.java.net/~briangoetz/amber/datum.html + +Enhance the Java programming language with sealed classes and +interfaces. Sealed classes and interfaces restrict which other classes +or interfaces may extend or implement them. + +This was a preview feature (http://openjdk.java.net/jeps/12) in +OpenJDK 15 & 16 and became final in OpenJDK 17. + +Restore Always-Strict Floating-Point Semantics +============================================== +https://openjdk.java.net/jeps/306 + +Make floating-point operations consistently strict, rather than have +both strict floating-point semantics (`strictfp`) and subtly different +default floating-point semantics. This will restore the original +floating-point semantics to the language and VM, matching the +semantics before the introduction of strict and default floating-point +modes in Java SE 1.2. + +Pattern Matching for switch +=========================== +https://openjdk.java.net/jeps/406 + +Enhance the Java programming language with pattern matching for +`switch` expressions and statements, along with extensions to the +language of patterns. Extending pattern matching to `switch` allows an +expression to be tested against a number of patterns, each with a +specific action, so that complex data-oriented queries can be +expressed concisely and safely. + +This is a preview feature (http://openjdk.java.net/jeps/12) in OpenJDK +17. + +Library Features +================ + +JVM Constants API +================= +https://openjdk.java.net/jeps/334 + +Introduce an API to model nominal descriptions of key class-file and +run-time artifacts, in particular constants that are loadable from the +constant pool. + +Reimplement the Legacy Socket API +================================= +https://openjdk.java.net/jeps/353 + +Replace the underlying implementation used by the `java.net.Socket` +and `java.net.ServerSocket` APIs with a simpler and more modern +implementation that is easy to maintain and debug. The new +implementation will be easy to adapt to work with user-mode threads, +a.k.a. fibers, currently being explored in Project Loom +(https://openjdk.java.net/projects/loom). + +JFR Event Streaming +=================== +https://openjdk.java.net/jeps/349 + +Expose JDK Flight Recorder data for continuous monitoring. + +Non-Volatile Mapped Byte Buffers +================================ +https://openjdk.java.net/jeps/352 + +Add new JDK-specific file mapping modes so that the `FileChannel` API +can be used to create `MappedByteBuffer` instances that refer to +non-volatile memory. + +Helpful NullPointerExceptions +============================= +https://openjdk.java.net/jeps/358 + +Improve the usability of `NullPointerException`s generated by the JVM +by describing precisely which variable was `null`. + +Foreign-Memory Access API +========================= +https://openjdk.java.net/jeps/370 +https://openjdk.java.net/jeps/383 +https://openjdk.java.net/jeps/393 + +Introduce an API to allow Java programs to safely and efficiently +access foreign memory outside of the Java heap. + +This was a incubation feature (https://openjdk.java.net/jeps/11) in +OpenJDK 14, 15 & 16, now superseded by the Foreign Function & Memory +API in OpenJDK 17 (see below). + +Edwards-Curve Digital Signature Algorithm (EdDSA) +================================================= +https://openjdk.java.net/jeps/339 + +Implement cryptographic signatures using the Edwards-Curve Digital +Signature Algorithm (EdDSA) as described by RFC 8032 +(https://tools.ietf.org/html/rfc8032). + +Hidden Classes +============== +https://openjdk.java.net/jeps/371 + +Introduce hidden classes, which are classes that cannot be used +directly by the bytecode of other classes. Hidden classes are intended +for use by frameworks that generate classes at run time and use them +indirectly, via reflection. A hidden class may be defined as a member +of an access control nest (https://openjdk.java.net/jeps/181), and may +be unloaded independently of other classes. + +Reimplement the Legacy DatagramSocket API +========================================= +https://openjdk.java.net/jeps/373 + +Replace the underlying implementations of the +`java.net.DatagramSocket` and `java.net.MulticastSocket` APIs with +simpler and more modern implementations that are easy to maintain and +debug. The new implementations will be easy to adapt to work with +virtual threads, currently being explored in Project Loom +(https://openjdk.java.net/projects/loom). This is a follow-on to JEP +353 (see above), which already reimplemented the legacy Socket API. + +Vector API +========== +https://openjdk.java.net/jeps/338 +https://openjdk.java.net/jeps/414 + +Provide an initial iteration of an incubator module, +`jdk.incubator.vector`, to express vector computations that reliably +compile at runtime to optimal vector hardware instructions on +supported CPU architectures and thus achieve superior performance to +equivalent scalar computations. + +This is an incubation feature (https://openjdk.java.net/jeps/11) +introduced in OpenJDK 16. + +Unix-Domain Socket Channels +=========================== +https://openjdk.java.net/jeps/380 + +Add Unix-domain (`AF_UNIX`) socket support to the socket channel and +server-socket channel APIs in the `java.nio.channels` package. Extend +the inherited channel mechanism to support Unix-domain socket channels +and server socket channels. + +Foreign Linker API (Incubator) +============================== +https://openjdk.java.net/jeps/389 + +Introduce an API that offers statically-typed, pure-Java access to +native code. This API, together with the Foreign-Memory API (see +above), will considerably simplify the otherwise error-prone process +of binding to a native library. + +This was an incubation feature (https://openjdk.java.net/jeps/11) +introduced in OpenJDK 16, now superseded by the Foreign Function & +Memory API in OpenJDK 17 (see below). + +Strongly Encapsulate JDK Internals by Default +============================================= +https://openjdk.java.net/jeps/396 +https://openjdk.java.net/jeps/403 + +Strongly encapsulate all internal elements of the JDK by default, +except for critical internal APIs such as `sun.misc.Unsafe`. It will +no longer be possible to relax the strong encapsulation of internal +elements via a single command-line option, as was possible in OpenJDK +9 through 16. + +Enhanced Pseudo-Random Number Generators +======================================== +https://openjdk.java.net/jeps/356 + +Provide new interface types and implementations for pseudo-random +number generators (PRNGs), including jumpable PRNGs and an additional +class of splittable PRNG algorithms (LXM). + +Foreign Function & Memory API +============================= +https://openjdk.java.net/jeps/412 + +Introduce an API by which Java programs can interoperate with code and +data outside of the Java runtime. By efficiently invoking foreign +functions (i.e., code outside the JVM), and by safely accessing +foreign memory (i.e., memory not managed by the JVM), the API enables +Java programs to call native libraries and process native data without +the brittleness and danger of JNI. + +This API is an incubation feature (https://openjdk.java.net/jeps/11) +introduced in OpenJDK 17, and is an evolution of the Foreign Memory +Access API (OpenJDK 14 through 16) and Foreign Linker API (OpenJDK +16) (see above). + +Context-Specific Deserialization Filters +======================================== +https://openjdk.java.net/jeps/415 + +Allow applications to configure context-specific and +dynamically-selected deserialization filters via a JVM-wide filter +factory that is invoked to select a filter for each individual +deserialization operation. + +Tools +===== + +Packaging Tool +============== +https://openjdk.java.net/jeps/343 +https://openjdk.java.net/jeps/392 + +Provide the `jpackage` tool, for packaging self-contained Java +applications. + +JVM Features +============ + +Shenandoah: A Low-Pause-Time Garbage Collector +============================================== +https://openjdk.java.net/jeps/189 +https://openjdk.java.net/jeps/379 + +Add a new garbage collection (GC) algorithm named Shenandoah which +reduces GC pause times by doing evacuation work concurrently with the +running Java threads. Pause times with Shenandoah are independent of +heap size, meaning you will have the same consistent pause times +whether your heap is 200 MB or 200 GB. + +Shenandoah has been provided in Red Hat builds of OpenJDK 8 since +8u131 in April 2017 and in all 11u builds. + +Upstream, it was introduced in OpenJDK 12 as an experimental feature +and became a production feature in OpenJDK 15. It was backported to +OpenJDK 11 with the 11.0.9 release in October 2020. + +Abortable Mixed Collections for G1 +================================== +https://openjdk.java.net/jeps/344 + +Make G1 mixed collections abortable if they might exceed the pause +target. + +Promptly Return Unused Committed Memory from G1 +=============================================== +https://openjdk.java.net/jeps/346 + +Enhance the G1 garbage collector to automatically return Java heap +memory to the operating system when idle. + +Dynamic CDS Archives +==================== +https://openjdk.java.net/jeps/310 +https://openjdk.java.net/jeps/350 + +Extend application class-data sharing to allow the dynamic archiving +of classes at the end of Java application execution. The archived +classes will include all loaded application classes and library +classes that are not present in the default, base-layer CDS archive. + +ZGC: Uncommit Unused Memory (Experimental) +========================================== +https://openjdk.java.net/jeps/351 + +Enhance ZGC to return unused heap memory to the operating system. + +NUMA-Aware Memory Allocation for G1 +=================================== +https://openjdk.java.net/jeps/345 + +Improve G1 performance on large machines by implementing NUMA-aware +memory allocation. + +ZGC on macOS (Experimental) +=========================== +https://openjdk.java.net/jeps/364 + +Port the ZGC garbage collector to macOS. + +ZGC on Windows (Experimental) +============================= +https://openjdk.java.net/jeps/365 + +Port the ZGC garbage collector to Windows. + +ZGC: A Scalable Low-Latency Garbage Collector (Production) +========================================================== +https://openjdk.java.net/jeps/377 + +Change the Z Garbage Collector from an experimental feature into a +product feature. + +ZGC: Concurrent Thread-Stack Processing +======================================= +https://openjdk.java.net/jeps/376 + +Move ZGC thread-stack processing from safepoints to a concurrent +phase. + +Elastic Metaspace +================= +https://openjdk.java.net/jeps/387 + +Return unused HotSpot class-metadata (i.e., metaspace) memory to the +operating system more promptly, reduce metaspace footprint, and +simplify the metaspace code in order to reduce maintenance costs. + +Ports +===== + +Alpine Linux Port +================= +https://openjdk.java.net/jeps/386 + +Port the JDK to Alpine Linux, and to other Linux distributions that +use musl as their primary C library, on both the x64 and AArch64 +architectures, + +Windows/AArch64 Port +==================== +https://openjdk.java.net/jeps/388 + +Port the JDK to Windows/AArch64. + +New macOS Rendering Pipeline +============================ +https://openjdk.java.net/jeps/382 + +Implement a Java 2D internal rendering pipeline for macOS using the +Apple Metal API as alternative to the existing pipeline, which uses +the deprecated Apple OpenGL API. + +macOS/AArch64 Port +================== +https://openjdk.java.net/jeps/391 + +Port the JDK to macOS/AArch64. + +DEPRECATIONS +============ + +Deprecate the ParallelScavenge + SerialOld GC Combination +========================================================= +https://openjdk.java.net/jeps/366 + +Deprecate the combination of the Parallel Scavenge and Serial Old +garbage collection algorithms. + +Deprecate and Disable Biased Locking +==================================== +https://openjdk.java.net/jeps/374 + +Disable biased locking by default, and deprecate all related +command-line options. + +Warnings for Value-Based Classes +================================ +https://openjdk.java.net/jeps/390 + +Designate the primitive wrapper classes as value-based and deprecate +their constructors for removal, prompting new deprecation +warnings. Provide warnings about improper attempts to synchronize on +instances of any value-based classes in the Java Platform. + +Deprecate the Applet API for Removal +==================================== +https://openjdk.java.net/jeps/398 + +Deprecate the Applet API for removal. It is essentially irrelevant +since all web-browser vendors have either removed support for Java +browser plug-ins or announced plans to do so. + +Deprecate the Security Manager for Removal +========================================== +https://openjdk.java.net/jeps/411 + +Deprecate the Security Manager for removal in a future release. The +Security Manager dates from Java 1.0. It has not been the primary +means of securing client-side Java code for many years, and it has +rarely been used to secure server-side code. To move Java forward, we +intend to deprecate the Security Manager for removal in concert with +the legacy Applet API (see above). . + +REMOVALS +======== + +Remove the Concurrent Mark Sweep (CMS) Garbage Collector +======================================================== +https://openjdk.java.net/jeps/363 + +Remove the Concurrent Mark Sweep (CMS) garbage collector. + +Remove the Pack200 Tools and API +================================ +https://openjdk.java.net/jeps/336 +https://openjdk.java.net/jeps/367 + +Remove the `pack200` and `unpack200` tools, and the `Pack200` API in +the `java.util.jar` package. These tools and API were deprecated for +removal in OpenJDK 11 with the express intent to remove them in a +future release. + +Remove the Nashorn JavaScript Engine +==================================== +https://openjdk.java.net/jeps/372 + +Remove the Nashorn JavaScript script engine and APIs, and the `jjs` +tool. The engine, the APIs, and the tool were deprecated for removal +in OpenJDK 11 with the express intent to remove them in a future +release. + +Remove the Solaris and SPARC Ports +================================== +https://openjdk.java.net/jeps/362 +https://openjdk.java.net/jeps/381 + +Remove the source code and build support for the Solaris/SPARC, +Solaris/x64, and Linux/SPARC ports. These ports were deprecated for +removal in OpenJDK 14 (JEP 362) and removed in OpenJDK 15 (JEP 381). + +Remove RMI Activation +===================== +https://openjdk.java.net/jeps/385 +https://openjdk.java.net/jeps/407 +https://docs.oracle.com/en/java/javase/14/docs/specs/rmi/activation.html + +Remove the Remote Method Invocation (RMI) Activation mechanism, while +preserving the rest of RMI. RMI Activation is an obsolete part of RMI +that has been optional since OpenJDK 8 and was deprecated in OpenJDK +15. + +Remove the Experimental AOT and JIT Compiler +============================================ +https://openjdk.java.net/jeps/410 + +Remove the experimental Java-based ahead-of-time (AOT) and +just-in-time (JIT) compiler. This compiler has seen little use since +its introduction and the effort required to maintain it is +significant. Retain the experimental Java-level JVM compiler +interface (JVMCI) so that developers can continue to use +externally-built versions of the compiler for JIT compilation. diff --git a/TestCryptoLevel.java b/TestCryptoLevel.java new file mode 100644 index 0000000..b32b7ae --- /dev/null +++ b/TestCryptoLevel.java @@ -0,0 +1,72 @@ +/* TestCryptoLevel -- Ensure unlimited crypto policy is in use. + Copyright (C) 2012 Red Hat, Inc. + +This program is free software: you can redistribute it and/or modify +it under the terms of the GNU Affero General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. + +This program is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU Affero General Public License for more details. + +You should have received a copy of the GNU Affero General Public License +along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +import java.lang.reflect.Field; +import java.lang.reflect.Method; +import java.lang.reflect.InvocationTargetException; + +import java.security.Permission; +import java.security.PermissionCollection; + +public class TestCryptoLevel +{ + public static void main(String[] args) + throws NoSuchFieldException, ClassNotFoundException, + IllegalAccessException, InvocationTargetException + { + Class<?> cls = null; + Method def = null, exempt = null; + + try + { + cls = Class.forName("javax.crypto.JceSecurity"); + } + catch (ClassNotFoundException ex) + { + System.err.println("Running a non-Sun JDK."); + System.exit(0); + } + try + { + def = cls.getDeclaredMethod("getDefaultPolicy"); + exempt = cls.getDeclaredMethod("getExemptPolicy"); + } + catch (NoSuchMethodException ex) + { + System.err.println("Running IcedTea with the original crypto patch."); + System.exit(0); + } + def.setAccessible(true); + exempt.setAccessible(true); + PermissionCollection defPerms = (PermissionCollection) def.invoke(null); + PermissionCollection exemptPerms = (PermissionCollection) exempt.invoke(null); + Class<?> apCls = Class.forName("javax.crypto.CryptoAllPermission"); + Field apField = apCls.getDeclaredField("INSTANCE"); + apField.setAccessible(true); + Permission allPerms = (Permission) apField.get(null); + if (defPerms.implies(allPerms) && (exemptPerms == null || exemptPerms.implies(allPerms))) + { + System.err.println("Running with the unlimited policy."); + System.exit(0); + } + else + { + System.err.println("WARNING: Running with a restricted crypto policy."); + System.exit(-1); + } + } +} diff --git a/TestECDSA.java b/TestECDSA.java new file mode 100644 index 0000000..6eb9cb2 --- /dev/null +++ b/TestECDSA.java @@ -0,0 +1,49 @@ +/* TestECDSA -- Ensure ECDSA signatures are working. + Copyright (C) 2016 Red Hat, Inc. + +This program is free software: you can redistribute it and/or modify +it under the terms of the GNU Affero General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. + +This program is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU Affero General Public License for more details. + +You should have received a copy of the GNU Affero General Public License +along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +import java.math.BigInteger; +import java.security.KeyPair; +import java.security.KeyPairGenerator; +import java.security.Signature; + +/** + * @test + */ +public class TestECDSA { + + public static void main(String[] args) throws Exception { + KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC"); + KeyPair key = keyGen.generateKeyPair(); + + byte[] data = "This is a string to sign".getBytes("UTF-8"); + + Signature dsa = Signature.getInstance("NONEwithECDSA"); + dsa.initSign(key.getPrivate()); + dsa.update(data); + byte[] sig = dsa.sign(); + System.out.println("Signature: " + new BigInteger(1, sig).toString(16)); + + Signature dsaCheck = Signature.getInstance("NONEwithECDSA"); + dsaCheck.initVerify(key.getPublic()); + dsaCheck.update(data); + boolean success = dsaCheck.verify(sig); + if (!success) { + throw new RuntimeException("Test failed. Signature verification error"); + } + System.out.println("Test passed."); + } +} diff --git a/TestSecurityProperties.java b/TestSecurityProperties.java new file mode 100644 index 0000000..06a0b07 --- /dev/null +++ b/TestSecurityProperties.java @@ -0,0 +1,43 @@ +import java.io.File; +import java.io.FileInputStream; +import java.security.Security; +import java.util.Properties; + +public class TestSecurityProperties { + // JDK 11 + private static final String JDK_PROPS_FILE_JDK_11 = System.getProperty("java.home") + "/conf/security/java.security"; + // JDK 8 + private static final String JDK_PROPS_FILE_JDK_8 = System.getProperty("java.home") + "/lib/security/java.security"; + + public static void main(String[] args) { + Properties jdkProps = new Properties(); + loadProperties(jdkProps); + for (Object key: jdkProps.keySet()) { + String sKey = (String)key; + String securityVal = Security.getProperty(sKey); + String jdkSecVal = jdkProps.getProperty(sKey); + if (!securityVal.equals(jdkSecVal)) { + String msg = "Expected value '" + jdkSecVal + "' for key '" + + sKey + "'" + " but got value '" + securityVal + "'"; + throw new RuntimeException("Test failed! " + msg); + } else { + System.out.println("DEBUG: " + sKey + " = " + jdkSecVal + " as expected."); + } + } + System.out.println("TestSecurityProperties PASSED!"); + } + + private static void loadProperties(Properties props) { + String javaVersion = System.getProperty("java.version"); + System.out.println("Debug: Java version is " + javaVersion); + String propsFile = JDK_PROPS_FILE_JDK_11; + if (javaVersion.startsWith("1.8.0")) { + propsFile = JDK_PROPS_FILE_JDK_8; + } + try (FileInputStream fin = new FileInputStream(new File(propsFile))) { + props.load(fin); + } catch (Exception e) { + throw new RuntimeException("Test failed!", e); + } + } +} diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec new file mode 100644 index 0000000..bd2d867 --- /dev/null +++ b/java-17-openjdk.spec @@ -0,0 +1,2360 @@ +# RPM conditionals so as to be able to dynamically produce +# slowdebug/release builds. See: +# http://rpm.org/user_doc/conditional_builds.html +# +# Examples: +# +# Produce release, fastdebug *and* slowdebug builds on x86_64 (default): +# $ rpmbuild -ba java-17-openjdk.spec +# +# Produce only release builds (no debug builds) on x86_64: +# $ rpmbuild -ba java-17-openjdk.spec --without slowdebug --without fastdebug +# +# Only produce a release build on x86_64: +# $ fedpkg mockbuild --without slowdebug --without fastdebug + +# Enable fastdebug builds by default on relevant arches. +%bcond_without fastdebug +# Enable slowdebug builds by default on relevant arches. +%bcond_without slowdebug +# Enable release builds by default on relevant arches. +%bcond_without release +# Enable static library builds by default. +%bcond_without staticlibs + +# Workaround for stripping of debug symbols from static libraries +%if %{with staticlibs} +%define __brp_strip_static_archive %{nil} +%global include_staticlibs 1 +%else +%global include_staticlibs 0 +%endif + +# The -g flag says to use strip -g instead of full strip on DSOs or EXEs. +# This fixes detailed NMT and other tools which need minimal debug info. +# See: https://bugzilla.redhat.com/show_bug.cgi?id=1520879 +%global _find_debuginfo_opts -g + +# With LTO flags enabled, debuginfo checks fail for some reason. Disable +# LTO for a passing build. This really needs to be looked at. +%define _lto_cflags %{nil} + +# note: parametrized macros are order-sensitive (unlike not-parametrized) even with normal macros +# also necessary when passing it as parameter to other macros. If not macro, then it is considered a switch +# see the difference between global and define: +# See https://github.com/rpm-software-management/rpm/issues/127 to comments at "pmatilai commented on Aug 18, 2017" +# (initiated in https://bugzilla.redhat.com/show_bug.cgi?id=1482192) +%global debug_suffix_unquoted -slowdebug +%global fastdebug_suffix_unquoted -fastdebug +%global main_suffix_unquoted -main +%global staticlibs_suffix_unquoted -staticlibs +# quoted one for shell operations +%global debug_suffix "%{debug_suffix_unquoted}" +%global fastdebug_suffix "%{fastdebug_suffix_unquoted}" +%global normal_suffix "" +%global main_suffix "%{main_suffix_unquoted}" +%global staticlibs_suffix "%{staticlibs_suffix_unquoted}" + +%global debug_warning This package is unoptimised with full debugging. Install only as needed and remove ASAP. +%global fastdebug_warning This package is optimised with full debugging. Install only as needed and remove ASAP. +%global debug_on unoptimised with full debugging on +%global fastdebug_on optimised with full debugging on +%global for_fastdebug for packages with debugging on and optimisation +%global for_debug for packages with debugging on and no optimisation + +%if %{with release} +%global include_normal_build 1 +%else +%global include_normal_build 0 +%endif + +%if %{include_normal_build} +%global normal_build %{normal_suffix} +%else +%global normal_build %{nil} +%endif + +# We have hardcoded list of files, which is appearing in alternatives, and in files +# in alternatives those are slaves and master, very often triplicated by man pages +# in files all masters and slaves are ghosted +# the ghosts are here to allow installation via query like `dnf install /usr/bin/java` +# you can list those files, with appropriate sections: cat *.spec | grep -e --install -e --slave -e post_ -e alternatives +# TODO - fix those hardcoded lists via single list +# Those files must *NOT* be ghosted for *slowdebug* packages +# FIXME - if you are moving jshell or jlink or similar, always modify all three sections +# you can check via headless and devels: +# rpm -ql --noghost java-11-openjdk-headless-11.0.1.13-8.fc29.x86_64.rpm | grep bin +# == rpm -ql java-11-openjdk-headless-slowdebug-11.0.1.13-8.fc29.x86_64.rpm | grep bin +# != rpm -ql java-11-openjdk-headless-11.0.1.13-8.fc29.x86_64.rpm | grep bin +# similarly for other %%{_jvmdir}/{jre,java} and %%{_javadocdir}/{java,java-zip} +%define is_release_build() %( if [ "%{?1}" == "%{debug_suffix_unquoted}" -o "%{?1}" == "%{fastdebug_suffix_unquoted}" ]; then echo "0" ; else echo "1"; fi ) + +# while JDK is a techpreview(is_system_jdk=0), some provides are turned off. Once jdk stops to be an techpreview, move it to 1 +# as sytem JDK, we mean any JDK which can run whole system java stack without issues (like bytecode issues, module issues, dependencies...) +%global is_system_jdk 0 + +%global aarch64 aarch64 arm64 armv8 +# we need to distinguish between big and little endian PPC64 +%global ppc64le ppc64le +%global ppc64be ppc64 ppc64p7 +# Set of architectures which support multiple ABIs +%global multilib_arches %{power64} sparc64 x86_64 +# Set of architectures for which we build debug builds +%global debug_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} s390x +# Set of architectures with a Just-In-Time (JIT) compiler +%global jit_arches %{debug_arches} %{arm} +# Set of architectures which run a full bootstrap cycle +%global bootstrap_arches %{jit_arches} +# Set of architectures which support SystemTap tapsets +%global systemtap_arches %{jit_arches} +# Set of architectures with a Ahead-Of-Time (AOT) compiler +%global aot_arches x86_64 %{aarch64} +%global fastdebug_arches x86_64 ppc64le aarch64 +# Set of architectures which support the serviceability agent +%global sa_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} %{arm} +# Set of architectures which support class data sharing +# See https://bugzilla.redhat.com/show_bug.cgi?id=513605 +# MetaspaceShared::generate_vtable_methods is not implemented for the PPC JIT +%global share_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{arm} s390x +# Set of architectures for which we build the Shenandoah garbage collector +%global shenandoah_arches x86_64 %{aarch64} +# Set of architectures for which we build the Z garbage collector +%global zgc_arches x86_64 +# Set of architectures for which alt-java has SSB mitigation +%global ssbd_arches x86_64 +# Set of architectures for which java has short vector math library (libsvml.so) +%global svml_arches x86_64 + +# By default, we build a debug build during main build on JIT architectures +%if %{with slowdebug} +%ifarch %{debug_arches} +%global include_debug_build 1 +%else +%global include_debug_build 0 +%endif +%else +%global include_debug_build 0 +%endif + +# On certain architectures, we compile the Shenandoah GC +%ifarch %{shenandoah_arches} +%global use_shenandoah_hotspot 1 +%else +%global use_shenandoah_hotspot 0 +%endif + +# By default, we build a fastdebug build during main build only on fastdebug architectures +%if %{with fastdebug} +%ifarch %{fastdebug_arches} +%global include_fastdebug_build 1 +%else +%global include_fastdebug_build 0 +%endif +%else +%global include_fastdebug_build 0 +%endif + +%if %{include_debug_build} +%global slowdebug_build %{debug_suffix} +%else +%global slowdebug_build %{nil} +%endif + +%if %{include_fastdebug_build} +%global fastdebug_build %{fastdebug_suffix} +%else +%global fastdebug_build %{nil} +%endif + +# If you disable both builds, then the build fails +# Build and test slowdebug first as it provides the best diagnostics +%global build_loop %{slowdebug_build} %{fastdebug_build} %{normal_build} + +%if %{include_staticlibs} +%global staticlibs_loop %{staticlibs_suffix} +%else +%global staticlibs_loop %{nil} +%endif + +%ifarch %{bootstrap_arches} +%global bootstrap_build true +%else +%global bootstrap_build false +%endif + +%if %{include_staticlibs} +# Extra target for producing the static-libraries. Separate from +# other targets since this target is configured to use in-tree +# AWT dependencies: lcms, libjpeg, libpng, libharfbuzz, giflib +# and possibly others +%global static_libs_target static-libs-image +%else +%global static_libs_target %{nil} +%endif + +# RPM JDK builds keep the debug symbols internal, to be later stripped by RPM +%global debug_symbols internal + +# unlike portables,the rpms have to use static_libs_target very dynamically +%global bootstrap_targets images +%global release_targets images docs-zip +# No docs nor bootcycle for debug builds +%global debug_targets images + + +# Filter out flags from the optflags macro that cause problems with the OpenJDK build +# We filter out -O flags so that the optimization of HotSpot is not lowered from O3 to O2 +# We filter out -Wall which will otherwise cause HotSpot to produce hundreds of thousands of warnings (100+mb logs) +# We replace it with -Wformat (required by -Werror=format-security) and -Wno-cpp to avoid FORTIFY_SOURCE warnings +# We filter out -fexceptions as the HotSpot build explicitly does -fno-exceptions and it's otherwise the default for C++ +%global ourflags %(echo %optflags | sed -e 's|-Wall|-Wformat -Wno-cpp|' | sed -r -e 's|-O[0-9]*||') +%global ourcppflags %(echo %ourflags | sed -e 's|-fexceptions||') +%global ourldflags %{__global_ldflags} + +# With disabled nss is NSS deactivated, so NSS_LIBDIR can contain the wrong path +# the initialization must be here. Later the pkg-config have buggy behavior +# looks like openjdk RPM specific bug +# Always set this so the nss.cfg file is not broken +%global NSS_LIBDIR %(pkg-config --variable=libdir nss) + +# In some cases, the arch used by the JDK does +# not match _arch. +# Also, in some cases, the machine name used by SystemTap +# does not match that given by _build_cpu +%ifarch x86_64 +%global archinstall amd64 +%endif +%ifarch ppc +%global archinstall ppc +%endif +%ifarch %{ppc64be} +%global archinstall ppc64 +%endif +%ifarch %{ppc64le} +%global archinstall ppc64le +%endif +%ifarch %{ix86} +%global archinstall i686 +%endif +%ifarch ia64 +%global archinstall ia64 +%endif +%ifarch s390 +%global archinstall s390 +%endif +%ifarch s390x +%global archinstall s390x +%endif +%ifarch %{arm} +%global archinstall arm +%endif +%ifarch %{aarch64} +%global archinstall aarch64 +%endif +# 32 bit sparc, optimized for v9 +%ifarch sparcv9 +%global archinstall sparc +%endif +# 64 bit sparc +%ifarch sparc64 +%global archinstall sparcv9 +%endif +%ifnarch %{jit_arches} +%global archinstall %{_arch} +%endif + + + +%ifarch %{systemtap_arches} +%global with_systemtap 1 +%else +%global with_systemtap 0 +%endif + +# New Version-String scheme-style defines +%global featurever 17 +%global interimver 0 +%global updatever 1 +%global patchver 0 +# If you bump featurever, you must also bump vendor_version_string +# Used via new version scheme. JDK 17 was +# GA'ed in September 2021 => 21.9 +%global vendor_version_string 21.9 +# buildjdkver is usually same as %%{featurever}, +# but in time of bootstrap of next jdk, it is featurever-1, +# and this it is better to change it here, on single place +%global buildjdkver 17 +# We don't add any LTS designator for STS packages (this package). +# Neither for Fedora nor EPEL which would have %%{rhel} macro defined. + %global lts_designator "" + %global lts_designator_zip "" + +# Define IcedTea version used for SystemTap tapsets and desktop file +%global icedteaver 6.0.0pre00-c848b93a8598 + +# Standard JPackage naming and versioning defines +%global origin openjdk +%global origin_nice OpenJDK +%global top_level_dir_name %{origin} +%global top_level_dir_name_backup %{top_level_dir_name}-backup +%global buildver 12 +%global rpmrelease 8 +# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit +%if %is_system_jdk +# Using 10 digits may overflow the int used for priority, so we combine the patch and build versions +# It is very unlikely we will ever have a patch version > 4 or a build version > 20, so we combine as (patch * 20) + build. +# This means 11.0.9.0+11 would have had a priority of 11000911 as before +# A 11.0.9.1+1 would have had a priority of 11000921 (20 * 1 + 1), thus ensuring it is bigger than 11.0.9.0+11 +%global combiver $( expr 20 '*' %{patchver} + %{buildver} ) +%global priority %( printf '%02d%02d%02d%02d' %{featurever} %{interimver} %{updatever} %{combiver} ) +%else +# for techpreview, using 1, so slowdebugs can have 0 +%global priority %( printf '%08d' 1 ) +%endif +%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver} +%global javaver %{featurever} + +# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames +%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn}) + +# Define milestone (EA for pre-releases, GA for releases) +# Release will be (where N is usually a number starting at 1): +# - 0.N%%{?extraver}%%{?dist} for EA releases, +# - N%%{?extraver}{?dist} for GA releases +%global is_ga 1 +%if %{is_ga} +%global build_type GA +%global expected_ea_designator "" +%global ea_designator_zip "" +%global extraver %{nil} +%global eaprefix %{nil} +%else +%global build_type EA +%global expected_ea_designator ea +%global ea_designator_zip -%{expected_ea_designator} +%global extraver .%{expected_ea_designator} +%global eaprefix 0. +%endif + +# Define what url should JVM offer in case of a crash report +# order may be important, epel may have rhel declared +%if 0%{?epel} +%global bugs https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora%20EPEL&component... +%else +%if 0%{?fedora} +# Does not work for rawhide, keeps the version field empty +%global bugs https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=%{name... +%else +%if 0%{?rhel} +%global bugs https://bugzilla.redhat.com/enter_bug.cgi?product=Red%20Hat%20Enterprise%... +%else +%global bugs https://bugzilla.redhat.com/enter_bug.cgi +%endif +%endif +%endif + +# parametrized macros are order-sensitive +%global compatiblename java-%{featurever}-%{origin} +%global fullversion %{compatiblename}-%{version}-%{release} +# images directories from upstream build +%global jdkimage jdk +%global static_libs_image static-libs +# output dir stub +%define buildoutputdir() %{expand:build/jdk%{featurever}.build%{?1}} +# we can copy the javadoc to not arched dir, or make it not noarch +%define uniquejavadocdir() %{expand:%{fullversion}.%{_arch}%{?1}} +# main id and dir of this jdk +%define uniquesuffix() %{expand:%{fullversion}.%{_arch}%{?1}} + +################################################################# +# fix for https://bugzilla.redhat.com/show_bug.cgi?id=1111349 +# https://bugzilla.redhat.com/show_bug.cgi?id=1590796#c14 +# https://bugzilla.redhat.com/show_bug.cgi?id=1655938 +%global _privatelibs libsplashscreen[.]so.*|libawt_xawt[.]so.*|libjli[.]so.*|libattach[.]so.*|libawt[.]so.*|libextnet[.]so.*|libawt_headless[.]so.*|libdt_socket[.]so.*|libfontmanager[.]so.*|libinstrument[.]so.*|libj2gss[.]so.*|libj2pcsc[.]so.*|libj2pkcs11[.]so.*|libjaas[.]so.*|libjavajpeg[.]so.*|libjdwp[.]so.*|libjimage[.]so.*|libjsound[.]so.*|liblcms[.]so.*|libmanagement[.]so.*|libmanagement_agent[.]so.*|libmanagement_ext[.]so.*|libmlib_image[.]so.*|libnet[.]so.*|libnio[.]so.*|libprefs[.]so.*|librmi[.]so.*|libsaproc[.]so.*|libsctp[.]so.*|libsystemconf[.]so.*|libzip[.]so.* +%global _publiclibs libjawt[.]so.*|libjava[.]so.*|libjvm[.]so.*|libverify[.]so.*|libjsig[.]so.* +%if %is_system_jdk +%global __provides_exclude ^(%{_privatelibs})$ +%global __requires_exclude ^(%{_privatelibs})$ +# Never generate lib-style provides/requires for any debug packages +%global __provides_exclude_from ^.*/%{uniquesuffix -- %{debug_suffix_unquoted}}/.*$ +%global __requires_exclude_from ^.*/%{uniquesuffix -- %{debug_suffix_unquoted}}/.*$ +%global __provides_exclude_from ^.*/%{uniquesuffix -- %{fastdebug_suffix_unquoted}}/.*$ +%global __requires_exclude_from ^.*/%{uniquesuffix -- %{fastdebug_suffix_unquoted}}/.*$ +%else +# Don't generate provides/requires for JDK provided shared libraries at all. +%global __provides_exclude ^(%{_privatelibs}|%{_publiclibs})$ +%global __requires_exclude ^(%{_privatelibs}|%{_publiclibs})$ +%endif + + +%global etcjavasubdir %{_sysconfdir}/java/java-%{javaver}-%{origin} +%define etcjavadir() %{expand:%{etcjavasubdir}/%{uniquesuffix -- %{?1}}} +# Standard JPackage directories and symbolic links. +%define sdkdir() %{expand:%{uniquesuffix -- %{?1}}} +%define jrelnk() %{expand:jre-%{javaver}-%{origin}-%{version}-%{release}.%{_arch}%{?1}} + +%define sdkbindir() %{expand:%{_jvmdir}/%{sdkdir -- %{?1}}/bin} +%define jrebindir() %{expand:%{_jvmdir}/%{sdkdir -- %{?1}}/bin} + +%global alt_java_name alt-java + +%global rpm_state_dir %{_localstatedir}/lib/rpm-state/ + +# For flatpack builds hard-code /usr/sbin/alternatives, +# otherwise use %%{_sbindir} relative path. +%if 0%{?flatpak} +%global alternatives_requires /usr/sbin/alternatives +%else +%global alternatives_requires %{_sbindir}/alternatives +%endif + +%if %{with_systemtap} +# Where to install systemtap tapset (links) +# We would like these to be in a package specific sub-dir, +# but currently systemtap doesn't support that, so we have to +# use the root tapset dir for now. To distinguish between 64 +# and 32 bit architectures we place the tapsets under the arch +# specific dir (note that systemtap will only pickup the tapset +# for the primary arch for now). Systemtap uses the machine name +# aka build_cpu as architecture specific directory name. +%global tapsetroot /usr/share/systemtap +%global tapsetdirttapset %{tapsetroot}/tapset/ +%global tapsetdir %{tapsetdirttapset}/%{_build_cpu} +%endif + +# not-duplicated scriptlets for normal/debug packages +%global update_desktop_icons /usr/bin/gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || : + + +%define post_script() %{expand: +update-desktop-database %{_datadir}/applications &> /dev/null || : +/bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || : +exit 0 +} + +%define alternatives_java_install() %{expand: +PRIORITY=%{priority} +if [ "%{?1}" == %{debug_suffix} ]; then + let PRIORITY=PRIORITY-1 +fi + +ext=.gz +alternatives \\ + --install %{_bindir}/java java %{jrebindir -- %{?1}}/java $PRIORITY --family %{name}.%{_arch} \\ + --slave %{_jvmdir}/jre jre %{_jvmdir}/%{sdkdir -- %{?1}} \\ + --slave %{_bindir}/%{alt_java_name} %{alt_java_name} %{jrebindir -- %{?1}}/%{alt_java_name} \\ + --slave %{_bindir}/keytool keytool %{jrebindir -- %{?1}}/keytool \\ + --slave %{_bindir}/rmiregistry rmiregistry %{jrebindir -- %{?1}}/rmiregistry \\ + --slave %{_mandir}/man1/java.1$ext java.1$ext \\ + %{_mandir}/man1/java-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/%{alt_java_name}.1$ext %{alt_java_name}.1$ext \\ + %{_mandir}/man1/%{alt_java_name}-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/keytool.1$ext keytool.1$ext \\ + %{_mandir}/man1/keytool-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/rmiregistry.1$ext rmiregistry.1$ext \\ + %{_mandir}/man1/rmiregistry-%{uniquesuffix -- %{?1}}.1$ext + +for X in %{origin} %{javaver} ; do + alternatives --install %{_jvmdir}/jre-"$X" jre_"$X" %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family %{name}.%{_arch} +done + +alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} jre_%{javaver}_%{origin} %{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family %{name}.%{_arch} +} + +%define post_headless() %{expand: +%ifarch %{share_arches} +%{jrebindir -- %{?1}}/java -Xshare:dump >/dev/null 2>/dev/null +%endif + +update-desktop-database %{_datadir}/applications &> /dev/null || : +/bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || : + +# see pretrans where this file is declared +# also see that pretrans is only for non-debug +if [ ! "%{?1}" == %{debug_suffix} ]; then + if [ -f %{_libexecdir}/copy_jdk_configs_fixFiles.sh ] ; then + sh %{_libexecdir}/copy_jdk_configs_fixFiles.sh %{rpm_state_dir}/%{name}.%{_arch} %{_jvmdir}/%{sdkdir -- %{?1}} + fi +fi + +exit 0 +} + +%define postun_script() %{expand: +update-desktop-database %{_datadir}/applications &> /dev/null || : +if [ $1 -eq 0 ] ; then + /bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null + %{update_desktop_icons} +fi +exit 0 +} + + +%define postun_headless() %{expand: + alternatives --remove java %{jrebindir -- %{?1}}/java + alternatives --remove jre_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} + alternatives --remove jre_%{javaver} %{_jvmdir}/%{sdkdir -- %{?1}} + alternatives --remove jre_%{javaver}_%{origin} %{_jvmdir}/%{jrelnk -- %{?1}} +} + +%define posttrans_script() %{expand: +%{update_desktop_icons} +} + + +%define alternatives_javac_install() %{expand: +PRIORITY=%{priority} +if [ "%{?1}" == %{debug_suffix} ]; then + let PRIORITY=PRIORITY-1 +fi + +ext=.gz +alternatives \\ + --install %{_bindir}/javac javac %{sdkbindir -- %{?1}}/javac $PRIORITY --family %{name}.%{_arch} \\ + --slave %{_jvmdir}/java java_sdk %{_jvmdir}/%{sdkdir -- %{?1}} \\ + --slave %{_bindir}/jlink jlink %{sdkbindir -- %{?1}}/jlink \\ + --slave %{_bindir}/jmod jmod %{sdkbindir -- %{?1}}/jmod \\ +%ifarch %{sa_arches} + --slave %{_bindir}/jhsdb jhsdb %{sdkbindir -- %{?1}}/jhsdb \\ +%endif + --slave %{_bindir}/jar jar %{sdkbindir -- %{?1}}/jar \\ + --slave %{_bindir}/jarsigner jarsigner %{sdkbindir -- %{?1}}/jarsigner \\ + --slave %{_bindir}/javadoc javadoc %{sdkbindir -- %{?1}}/javadoc \\ + --slave %{_bindir}/javap javap %{sdkbindir -- %{?1}}/javap \\ + --slave %{_bindir}/jcmd jcmd %{sdkbindir -- %{?1}}/jcmd \\ + --slave %{_bindir}/jconsole jconsole %{sdkbindir -- %{?1}}/jconsole \\ + --slave %{_bindir}/jdb jdb %{sdkbindir -- %{?1}}/jdb \\ + --slave %{_bindir}/jdeps jdeps %{sdkbindir -- %{?1}}/jdeps \\ + --slave %{_bindir}/jdeprscan jdeprscan %{sdkbindir -- %{?1}}/jdeprscan \\ + --slave %{_bindir}/jfr jfr %{sdkbindir -- %{?1}}/jfr \\ + --slave %{_bindir}/jimage jimage %{sdkbindir -- %{?1}}/jimage \\ + --slave %{_bindir}/jinfo jinfo %{sdkbindir -- %{?1}}/jinfo \\ + --slave %{_bindir}/jmap jmap %{sdkbindir -- %{?1}}/jmap \\ + --slave %{_bindir}/jps jps %{sdkbindir -- %{?1}}/jps \\ + --slave %{_bindir}/jpackage jpackage %{sdkbindir -- %{?1}}/jpackage \\ + --slave %{_bindir}/jrunscript jrunscript %{sdkbindir -- %{?1}}/jrunscript \\ + --slave %{_bindir}/jshell jshell %{sdkbindir -- %{?1}}/jshell \\ + --slave %{_bindir}/jstack jstack %{sdkbindir -- %{?1}}/jstack \\ + --slave %{_bindir}/jstat jstat %{sdkbindir -- %{?1}}/jstat \\ + --slave %{_bindir}/jstatd jstatd %{sdkbindir -- %{?1}}/jstatd \\ + --slave %{_bindir}/serialver serialver %{sdkbindir -- %{?1}}/serialver \\ + --slave %{_mandir}/man1/jar.1$ext jar.1$ext \\ + %{_mandir}/man1/jar-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jarsigner.1$ext jarsigner.1$ext \\ + %{_mandir}/man1/jarsigner-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/javac.1$ext javac.1$ext \\ + %{_mandir}/man1/javac-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/javadoc.1$ext javadoc.1$ext \\ + %{_mandir}/man1/javadoc-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/javap.1$ext javap.1$ext \\ + %{_mandir}/man1/javap-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jcmd.1$ext jcmd.1$ext \\ + %{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jconsole.1$ext jconsole.1$ext \\ + %{_mandir}/man1/jconsole-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jdb.1$ext jdb.1$ext \\ + %{_mandir}/man1/jdb-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jdeps.1$ext jdeps.1$ext \\ + %{_mandir}/man1/jdeps-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jinfo.1$ext jinfo.1$ext \\ + %{_mandir}/man1/jinfo-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jmap.1$ext jmap.1$ext \\ + %{_mandir}/man1/jmap-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jps.1$ext jps.1$ext \\ + %{_mandir}/man1/jps-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jpackage.1$ext jpackage.1$ext \\ + %{_mandir}/man1/jpackage-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jrunscript.1$ext jrunscript.1$ext \\ + %{_mandir}/man1/jrunscript-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jstack.1$ext jstack.1$ext \\ + %{_mandir}/man1/jstack-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jstat.1$ext jstat.1$ext \\ + %{_mandir}/man1/jstat-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jstatd.1$ext jstatd.1$ext \\ + %{_mandir}/man1/jstatd-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/serialver.1$ext serialver.1$ext \\ + %{_mandir}/man1/serialver-%{uniquesuffix -- %{?1}}.1$ext \\ + +for X in %{origin} %{javaver} ; do + alternatives \\ + --install %{_jvmdir}/java-"$X" java_sdk_"$X" %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family %{name}.%{_arch} +done + +update-alternatives --install %{_jvmdir}/java-%{javaver}-%{origin} java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family %{name}.%{_arch} +} + +%define post_devel() %{expand: +update-desktop-database %{_datadir}/applications &> /dev/null || : +/bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || : + +exit 0 +} + +%define postun_devel() %{expand: + alternatives --remove javac %{sdkbindir -- %{?1}}/javac + alternatives --remove java_sdk_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} + alternatives --remove java_sdk_%{javaver} %{_jvmdir}/%{sdkdir -- %{?1}} + alternatives --remove java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} + +update-desktop-database %{_datadir}/applications &> /dev/null || : + +if [ $1 -eq 0 ] ; then + /bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null + %{update_desktop_icons} +fi +exit 0 +} + +%define posttrans_devel() %{expand: +%{alternatives_javac_install -- %{?1}} +%{update_desktop_icons} +} + +%define alternatives_javadoc_install() %{expand: +PRIORITY=%{priority} +if [ "%{?1}" == %{debug_suffix} ]; then + let PRIORITY=PRIORITY-1 +fi + +alternatives \\ + --install %{_javadocdir}/java javadocdir %{_javadocdir}/%{uniquejavadocdir -- %{?1}}/api \\ + $PRIORITY --family %{name} +exit 0 +} + +%define postun_javadoc() %{expand: + alternatives --remove javadocdir %{_javadocdir}/%{uniquejavadocdir -- %{?1}}/api +exit 0 +} + +%define alternatives_javadoczip_install() %{expand: +PRIORITY=%{priority} +if [ "%{?1}" == %{debug_suffix} ]; then + let PRIORITY=PRIORITY-1 +fi + +alternatives \\ + --install %{_javadocdir}/java-zip javadoczip %{_javadocdir}/%{uniquejavadocdir -- %{?1}}.zip \\ + $PRIORITY --family %{name} +exit 0 +} + +%define postun_javadoc_zip() %{expand: + alternatives --remove javadoczip %{_javadocdir}/%{uniquejavadocdir -- %{?1}}.zip +exit 0 +} + +%define files_jre() %{expand: +%{_datadir}/icons/hicolor/*x*/apps/java-%{javaver}-%{origin}.png +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsplashscreen.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libawt_xawt.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjawt.so +} + + +%define files_jre_headless() %{expand: +%license %{_jvmdir}/%{sdkdir -- %{?1}}/legal +%doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/NEWS +%dir %{_sysconfdir}/.java/.systemPrefs +%dir %{_sysconfdir}/.java +%dir %{_jvmdir}/%{sdkdir -- %{?1}} +%{_jvmdir}/%{sdkdir -- %{?1}}/release +%{_jvmdir}/%{jrelnk -- %{?1}} +%dir %{_jvmdir}/%{sdkdir -- %{?1}}/bin +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/java +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/%{alt_java_name} +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/keytool +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/rmiregistry +%dir %{_jvmdir}/%{sdkdir -- %{?1}}/lib +%ifarch %{jit_arches} +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/classlist +%endif +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/jexec +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/jspawnhelper +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/jrt-fs.jar +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/modules +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/psfont.properties.ja +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/psfontj2d.properties +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/tzdb.dat +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjli.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/jvm.cfg +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libattach.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libawt.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libextnet.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjsig.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libawt_headless.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libdt_socket.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libfontmanager.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libinstrument.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libj2gss.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libj2pcsc.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libj2pkcs11.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjaas.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjava.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjavajpeg.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjdwp.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjimage.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjsound.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/liblcms.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libmanagement.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libmanagement_agent.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libmanagement_ext.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libmlib_image.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libnet.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libnio.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libprefs.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/librmi.so +# Some architectures don't have the serviceability agent +%ifarch %{sa_arches} +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsaproc.so +%endif +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsctp.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsystemconf.so +%ifarch %{svml_arches} +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsvml.so +%endif +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsyslookup.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libverify.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libzip.so +%dir %{_jvmdir}/%{sdkdir -- %{?1}}/lib/jfr +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/jfr/default.jfc +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/jfr/profile.jfc +%{_mandir}/man1/java-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/%{alt_java_name}-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/keytool-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/rmiregistry-%{uniquesuffix -- %{?1}}.1* +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/server/ +%ifarch %{share_arches} +%attr(444, root, root) %ghost %{_jvmdir}/%{sdkdir -- %{?1}}/lib/server/classes.jsa +%endif +%dir %{etcjavasubdir} +%dir %{etcjavadir -- %{?1}} +%dir %{etcjavadir -- %{?1}}/lib +%dir %{etcjavadir -- %{?1}}/lib/security +%{etcjavadir -- %{?1}}/lib/security/cacerts +%dir %{etcjavadir -- %{?1}}/conf +%dir %{etcjavadir -- %{?1}}/conf/sdp +%dir %{etcjavadir -- %{?1}}/conf/management +%dir %{etcjavadir -- %{?1}}/conf/security +%dir %{etcjavadir -- %{?1}}/conf/security/policy +%dir %{etcjavadir -- %{?1}}/conf/security/policy/limited +%dir %{etcjavadir -- %{?1}}/conf/security/policy/unlimited +%config(noreplace) %{etcjavadir -- %{?1}}/lib/security/default.policy +%config(noreplace) %{etcjavadir -- %{?1}}/lib/security/blocked.certs +%config(noreplace) %{etcjavadir -- %{?1}}/lib/security/public_suffix_list.dat +%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/policy/limited/exempt_local.policy +%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/policy/limited/default_local.policy +%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/policy/limited/default_US_export.policy +%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/policy/unlimited/default_local.policy +%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/policy/unlimited/default_US_export.policy + %{etcjavadir -- %{?1}}/conf/security/policy/README.txt +%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/java.policy +%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/java.security +%config(noreplace) %{etcjavadir -- %{?1}}/conf/logging.properties +%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/nss.cfg +%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/nss.fips.cfg +%config(noreplace) %{etcjavadir -- %{?1}}/conf/management/jmxremote.access +# This is a config template, thus not config-noreplace +%config %{etcjavadir -- %{?1}}/conf/management/jmxremote.password.template +%config %{etcjavadir -- %{?1}}/conf/sdp/sdp.conf.template +%config(noreplace) %{etcjavadir -- %{?1}}/conf/management/management.properties +%config(noreplace) %{etcjavadir -- %{?1}}/conf/net.properties +%config(noreplace) %{etcjavadir -- %{?1}}/conf/sound.properties +%{_jvmdir}/%{sdkdir -- %{?1}}/conf +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/security +%if %is_system_jdk +%if %{is_release_build -- %{?1}} +%ghost %{_bindir}/java +%ghost %{_bindir}/%{alt_java_name} +%ghost %{_jvmdir}/jre +%ghost %{_bindir}/keytool +%ghost %{_bindir}/pack200 +%ghost %{_bindir}/rmid +%ghost %{_bindir}/rmiregistry +%ghost %{_bindir}/unpack200 +%ghost %{_jvmdir}/jre-%{origin} +%ghost %{_jvmdir}/jre-%{javaver} +%ghost %{_jvmdir}/jre-%{javaver}-%{origin} +%endif +%endif +# https://bugzilla.redhat.com/show_bug.cgi?id=1820172 +# https://docs.fedoraproject.org/en-US/packaging-guidelines/Directory_Repla... +%ghost %{_jvmdir}/%{sdkdir -- %{?1}}/conf.rpmmoved +%ghost %{_jvmdir}/%{sdkdir -- %{?1}}/lib/security.rpmmoved +} + +%define files_devel() %{expand: +%dir %{_jvmdir}/%{sdkdir -- %{?1}}/bin +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jar +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jarsigner +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/javac +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/javadoc +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/javap +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jconsole +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jcmd +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jdb +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jdeps +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jdeprscan +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jfr +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jimage +# Some architectures don't have the serviceability agent +%ifarch %{sa_arches} +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jhsdb +%{_mandir}/man1/jhsdb-%{uniquesuffix -- %{?1}}.1.gz +%endif +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jinfo +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jlink +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jmap +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jmod +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jps +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jpackage +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jrunscript +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jshell +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jstack +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jstat +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jstatd +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/serialver +%{_jvmdir}/%{sdkdir -- %{?1}}/include +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/ct.sym +%if %{with_systemtap} +%{_jvmdir}/%{sdkdir -- %{?1}}/tapset +%endif +%{_datadir}/applications/*jconsole%{?1}.desktop +%{_mandir}/man1/jar-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jarsigner-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/javac-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/javadoc-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/javap-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jconsole-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jdb-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jdeps-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jinfo-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jmap-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jps-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jpackage-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jrunscript-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jstack-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jstat-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jstatd-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/serialver-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jdeprscan-%{uniquesuffix -- %{?1}}.1.gz +%{_mandir}/man1/jlink-%{uniquesuffix -- %{?1}}.1.gz +%{_mandir}/man1/jmod-%{uniquesuffix -- %{?1}}.1.gz +%{_mandir}/man1/jshell-%{uniquesuffix -- %{?1}}.1.gz +%{_mandir}/man1/jfr-%{uniquesuffix -- %{?1}}.1.gz + +%if %{with_systemtap} +%dir %{tapsetroot} +%dir %{tapsetdirttapset} +%dir %{tapsetdir} +%{tapsetdir}/*%{_arch}%{?1}.stp +%endif +%if %is_system_jdk +%if %{is_release_build -- %{?1}} +%ghost %{_bindir}/javac +%ghost %{_jvmdir}/java +%ghost %{_jvmdir}/%{alt_java_name} +%ghost %{_bindir}/jlink +%ghost %{_bindir}/jmod +%ghost %{_bindir}/jhsdb +%ghost %{_bindir}/jar +%ghost %{_bindir}/jarsigner +%ghost %{_bindir}/javadoc +%ghost %{_bindir}/javap +%ghost %{_bindir}/jcmd +%ghost %{_bindir}/jconsole +%ghost %{_bindir}/jdb +%ghost %{_bindir}/jdeps +%ghost %{_bindir}/jdeprscan +%ghost %{_bindir}/jimage +%ghost %{_bindir}/jinfo +%ghost %{_bindir}/jmap +%ghost %{_bindir}/jps +%ghost %{_bindir}/jrunscript +%ghost %{_bindir}/jshell +%ghost %{_bindir}/jstack +%ghost %{_bindir}/jstat +%ghost %{_bindir}/jstatd +%ghost %{_bindir}/serialver +%ghost %{_jvmdir}/java-%{origin} +%ghost %{_jvmdir}/java-%{javaver} +%ghost %{_jvmdir}/java-%{javaver}-%{origin} +%endif +%endif +} + +%define files_jmods() %{expand: +%{_jvmdir}/%{sdkdir -- %{?1}}/jmods +} + +%define files_demo() %{expand: +%license %{_jvmdir}/%{sdkdir -- %{?1}}/legal +%{_jvmdir}/%{sdkdir -- %{?1}}/demo +%{_jvmdir}/%{sdkdir -- %{?1}}/sample +} + +%define files_src() %{expand: +%license %{_jvmdir}/%{sdkdir -- %{?1}}/legal +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/src.zip +} + +%define files_static_libs() %{expand: +%dir %{_jvmdir}/%{sdkdir -- %{?1}}/lib/static +%dir %{_jvmdir}/%{sdkdir -- %{?1}}/lib/static/linux-%{archinstall} +%dir %{_jvmdir}/%{sdkdir -- %{?1}}/lib/static/linux-%{archinstall}/glibc +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/static/linux-%{archinstall}/glibc/lib*.a +} + +%define files_javadoc() %{expand: +%doc %{_javadocdir}/%{uniquejavadocdir -- %{?1}} +%license %{_jvmdir}/%{sdkdir -- %{?1}}/legal +%if %is_system_jdk +%if %{is_release_build -- %{?1}} +%ghost %{_javadocdir}/java +%endif +%endif +} + +%define files_javadoc_zip() %{expand: +%doc %{_javadocdir}/%{uniquejavadocdir -- %{?1}}.zip +%license %{_jvmdir}/%{sdkdir -- %{?1}}/legal +%if %is_system_jdk +%if %{is_release_build -- %{?1}} +%ghost %{_javadocdir}/java-zip +%endif +%endif +} + +# not-duplicated requires/provides/obsoletes for normal/debug packages +%define java_rpo() %{expand: +Requires: fontconfig%{?_isa} +Requires: xorg-x11-fonts-Type1 +# Require libXcomposite explicitly since it's only dynamically loaded +# at runtime. Fixes screenshot issues. See JDK-8150954. +Requires: libXcomposite%{?_isa} +# Requires rest of java +Requires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release} +OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release} +# for java-X-openjdk package's desktop binding +%if 0%{?rhel} >= 8 +Recommends: gtk3%{?_isa} +%endif + +Provides: java-%{javaver}-%{origin}%{?1} = %{epoch}:%{version}-%{release} + +# Standard JPackage base provides +Provides: jre-%{javaver}%{?1} = %{epoch}:%{version}-%{release} +Provides: jre-%{javaver}-%{origin}%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{javaver}%{?1} = %{epoch}:%{version}-%{release} +%if %is_system_jdk +Provides: java-%{origin}%{?1} = %{epoch}:%{version}-%{release} +Provides: jre-%{origin}%{?1} = %{epoch}:%{version}-%{release} +Provides: java%{?1} = %{epoch}:%{version}-%{release} +Provides: jre%{?1} = %{epoch}:%{version}-%{release} +%endif +} + +%define java_headless_rpo() %{expand: +# Require /etc/pki/java/cacerts +Requires: ca-certificates +# Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros +Requires: javapackages-filesystem +# Require zone-info data provided by tzdata-java sub-package +Requires: tzdata-java >= 2015d +# for support of kernel stream control +# libsctp.so.1 is being `dlopen`ed on demand +Requires: lksctp-tools%{?_isa} +%if ! 0%{?flatpak} +# tool to copy jdk's configs - should be Recommends only, but then only dnf/yum enforce it, +# not rpm transaction and so no configs are persisted when pure rpm -u is run. It may be +# considered as regression +Requires: copy-jdk-configs >= 4.0 +OrderWithRequires: copy-jdk-configs +%endif +# for printing support +Requires: cups-libs +# Post requires alternatives to install tool alternatives +Requires(post): %{alternatives_requires} +# Postun requires alternatives to uninstall tool alternatives +Requires(postun): %{alternatives_requires} +# for optional support of kernel stream control, card reader and printing bindings +Suggests: lksctp-tools%{?_isa}, pcsc-lite-libs%{?_isa} + +# Standard JPackage base provides +Provides: jre-%{javaver}-%{origin}-headless%{?1} = %{epoch}:%{version}-%{release} +Provides: jre-%{javaver}-headless%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{javaver}-%{origin}-headless%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{javaver}-headless%{?1} = %{epoch}:%{version}-%{release} +%if %is_system_jdk +Provides: java-%{origin}-headless%{?1} = %{epoch}:%{version}-%{release} +Provides: jre-%{origin}-headless%{?1} = %{epoch}:%{version}-%{release} +Provides: jre-headless%{?1} = %{epoch}:%{version}-%{release} +Provides: java-headless%{?1} = %{epoch}:%{version}-%{release} +%endif +} + +%define java_devel_rpo() %{expand: +# Requires base package +Requires: %{name}%{?1}%{?_isa} = %{epoch}:%{version}-%{release} +OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release} +# Post requires alternatives to install tool alternatives +Requires(post): %{alternatives_requires} +# Postun requires alternatives to uninstall tool alternatives +Requires(postun): %{alternatives_requires} + +# Standard JPackage devel provides +Provides: java-sdk-%{javaver}-%{origin}%{?1} = %{epoch}:%{version}-%{release} +Provides: java-sdk-%{javaver}%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{javaver}-devel%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{javaver}-%{origin}-devel%{?1} = %{epoch}:%{version}-%{release} +%if %is_system_jdk +Provides: java-devel-%{origin}%{?1} = %{epoch}:%{version}-%{release} +Provides: java-sdk-%{origin}%{?1} = %{epoch}:%{version}-%{release} +Provides: java-devel%{?1} = %{epoch}:%{version}-%{release} +Provides: java-sdk%{?1} = %{epoch}:%{version}-%{release} +%endif +} + +%define java_static_libs_rpo() %{expand: +Requires: %{name}-devel%{?1}%{?_isa} = %{epoch}:%{version}-%{release} +OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release} +} + +%define java_jmods_rpo() %{expand: +# Requires devel package +# as jmods are bytecode, they should be OK without any _isa +Requires: %{name}-devel%{?1} = %{epoch}:%{version}-%{release} +OrderWithRequires: %{name}-headless%{?1} = %{epoch}:%{version}-%{release} + +Provides: java-%{javaver}-jmods%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{javaver}-%{origin}-jmods%{?1} = %{epoch}:%{version}-%{release} +%if %is_system_jdk +Provides: java-jmods%{?1} = %{epoch}:%{version}-%{release} +%endif +} + +%define java_demo_rpo() %{expand: +Requires: %{name}%{?1}%{?_isa} = %{epoch}:%{version}-%{release} +OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release} + +Provides: java-%{javaver}-demo%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{javaver}-%{origin}-demo%{?1} = %{epoch}:%{version}-%{release} +%if %is_system_jdk +Provides: java-demo%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{origin}-demo%{?1} = %{epoch}:%{version}-%{release} +%endif +} + +%define java_javadoc_rpo() %{expand: +OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release} +# Post requires alternatives to install javadoc alternative +Requires(post): %{alternatives_requires} +# Postun requires alternatives to uninstall javadoc alternative +Requires(postun): %{alternatives_requires} + +# Standard JPackage javadoc provides +Provides: java-%{javaver}-javadoc%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{javaver}-%{origin}-javadoc%{?1} = %{epoch}:%{version}-%{release} +%if %is_system_jdk +Provides: java-javadoc%{?1} = %{epoch}:%{version}-%{release} +%endif +} + +%define java_src_rpo() %{expand: +Requires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release} + +# Standard JPackage sources provides +Provides: java-%{javaver}-src%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{javaver}-%{origin}-src%{?1} = %{epoch}:%{version}-%{release} +%if %is_system_jdk +Provides: java-src%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{origin}-src%{?1} = %{epoch}:%{version}-%{release} +%endif +} + +# Prevent brp-java-repack-jars from being run +%global __jar_repack 0 + +Name: java-17-%{origin} +Version: %{newjavaver}.%{buildver} +Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist} +# java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons +# and this change was brought into RHEL-4. java-1.5.0-ibm packages +# also included the epoch in their virtual provides. This created a +# situation where in-the-wild java-1.5.0-ibm packages provided "java = +# 1:1.5.0". In RPM terms, "1.6.0 < 1:1.5.0" since 1.6.0 is +# interpreted as 0:1.6.0. So the "java >= 1.6.0" requirement would be +# satisfied by the 1:1.5.0 packages. Thus we need to set the epoch in +# JDK package >= 1.6.0 to 1, and packages referring to JDK virtual +# provides >= 1.6.0 must specify the epoch, "java >= 1:1.6.0". + +Epoch: 1 +Summary: %{origin_nice} %{featurever} Runtime Environment +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +# HotSpot code is licensed under GPLv2 +# JDK library code is licensed under GPLv2 with the Classpath exception +# The Apache license is used in code taken from Apache projects (primarily xalan & xerces) +# DOM levels 2 & 3 and the XML digital signature schemas are licensed under the W3C Software License +# The JSR166 concurrency code is in the public domain +# The BSD and MIT licenses are used for a number of third-party libraries (see ADDITIONAL_LICENSE_INFO) +# The OpenJDK source tree includes: +# - JPEG library (IJG), zlib & libpng (zlib), giflib (MIT), harfbuzz (ISC), +# - freetype (FTL), jline (BSD) and LCMS (MIT) +# - jquery (MIT), jdk.crypto.cryptoki PKCS 11 wrapper (RSA) +# - public_suffix_list.dat from publicsuffix.org (MPLv2.0) +# The test code includes copies of NSS under the Mozilla Public License v2.0 +# The PCSClite headers are under a BSD with advertising license +# The elliptic curve cryptography (ECC) source code is licensed under the LGPLv2.1 or any later version +License: ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA +URL: http://openjdk.java.net/ + + +# to regenerate source0 (jdk) run update_package.sh +# update_package.sh contains hard-coded repos, revisions, tags, and projects to regenerate the source archives +Source0: openjdk-jdk%{featurever}u-jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}.tar.xz + +# Use 'icedtea_sync.sh' to update the following +# They are based on code contained in the IcedTea project (6.x). +# Systemtap tapsets. Zipped up to keep it small. +Source8: tapsets-icedtea-%{icedteaver}.tar.xz + +# Desktop files. Adapted from IcedTea +Source9: jconsole.desktop.in + +# Release notes +Source10: NEWS + +# nss configuration file +Source11: nss.cfg.in + +# Removed libraries that we link instead +Source12: remove-intree-libraries.sh + +# Ensure we aren't using the limited crypto policy +Source13: TestCryptoLevel.java + +# Ensure ECDSA is working +Source14: TestECDSA.java + +# Verify system crypto (policy) can be disabled via a property +Source15: TestSecurityProperties.java + +# nss fips configuration file +Source17: nss.fips.cfg.in + +############################################ +# +# RPM/distribution specific patches +# +############################################ + +# NSS via SunPKCS11 Provider (disabled comment +# due to memory leak). +Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch +# RH1750419: enable build of speculative store bypass hardened alt-java (CVE-2018-3639) +Patch600: rh1750419-redhat_alt_java.patch + +# Ignore AWTError when assistive technologies are loaded +Patch1: rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch +# Restrict access to java-atk-wrapper classes +Patch2: rh1648644-java_access_bridge_privileged_security.patch +Patch3: rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch +# Follow system wide crypto policy RHBZ#1249083 +Patch4: pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch +# PR3695: Allow use of system crypto policy to be disabled by the user +Patch5: pr3695-toggle_system_crypto_policy.patch +# Depend on pcs-lite-libs instead of pcs-lite-devel as this is only in optional repo +Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch + +# FIPS support patches +# RH1655466: Support RHEL FIPS mode using SunPKCS11 provider +Patch1001: rh1655466-global_crypto_and_fips.patch +# RH1818909: No ciphersuites availale for SSLSocket in FIPS mode +Patch1002: rh1818909-fips_default_keystore_type.patch +# RH1860986: Disable TLSv1.3 with the NSS-FIPS provider until PKCS#11 v3.0 support is available +Patch1004: rh1860986-disable_tlsv1.3_in_fips_mode.patch +# RH1915071: Always initialise JavaSecuritySystemConfiguratorAccess +Patch1007: rh1915071-always_initialise_configurator_access.patch +# RH1929465: Improve system FIPS detection +Patch1008: rh1929465-improve_system_FIPS_detection.patch +Patch1011: rh1929465-dont_define_unused_throwioexception.patch +# RH1995150: Disable non-FIPS crypto in SUN and SunEC security providers +Patch1009: rh1995150-disable_non-fips_crypto.patch +# RH1996182: Login to the NSS software token in FIPS mode +Patch1010: rh1996182-login_to_nss_software_token.patch +Patch1012: rh1996182-extend_security_policy.patch +# RH1991003: Allow plain key import unless com.redhat.fips.plainKeySupport is set to false +Patch1013: rh1991003-enable_fips_keys_import.patch + +############################################# +# +# OpenJDK patches in need of upstreaming +# +############################################# +# JDK-8276572: Fake libsyslookup.so library causes tooling issues +Patch2000: jdk8276572-fake_libsyslookup_causes_tooling_issues.patch + + +BuildRequires: autoconf +BuildRequires: automake +BuildRequires: alsa-lib-devel +BuildRequires: binutils +BuildRequires: cups-devel +BuildRequires: desktop-file-utils +# elfutils only are OK for build without AOT +BuildRequires: elfutils-devel +BuildRequires: fontconfig-devel +BuildRequires: freetype-devel +BuildRequires: giflib-devel +BuildRequires: gcc-c++ +BuildRequires: gdb +BuildRequires: harfbuzz-devel +BuildRequires: lcms2-devel +BuildRequires: libjpeg-devel +BuildRequires: libpng-devel +BuildRequires: libxslt +BuildRequires: libX11-devel +BuildRequires: libXi-devel +BuildRequires: libXinerama-devel +BuildRequires: libXrandr-devel +BuildRequires: libXrender-devel +BuildRequires: libXt-devel +BuildRequires: libXtst-devel +# Requirements for setting up the nss.cfg and FIPS support +BuildRequires: nss-devel >= 3.53 +BuildRequires: pkgconfig +BuildRequires: xorg-x11-proto-devel +BuildRequires: zip +BuildRequires: javapackages-filesystem +BuildRequires: java-latest-openjdk-devel +# Zero-assembler build requirement +%ifnarch %{jit_arches} +BuildRequires: libffi-devel +%endif +BuildRequires: tzdata-java >= 2015d +# Earlier versions have a bug in tree vectorization on PPC +BuildRequires: gcc >= 4.8.3-8 + +%if %{with_systemtap} +BuildRequires: systemtap-sdt-devel +%endif +BuildRequires: make + +# this is always built, also during debug-only build +# when it is built in debug-only this package is just placeholder +%{java_rpo %{nil}} + +%description +The %{origin_nice} %{featurever} runtime environment. + +%if %{include_debug_build} +%package slowdebug +Summary: %{origin_nice} %{featurever} Runtime Environment %{debug_on} +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_rpo -- %{debug_suffix_unquoted}} +%description slowdebug +The %{origin_nice} %{featurever} runtime environment. +%{debug_warning} +%endif + +%if %{include_fastdebug_build} +%package fastdebug +Summary: %{origin_nice} %{featurever} Runtime Environment %{fastdebug_on} +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_rpo -- %{fastdebug_suffix_unquoted}} +%description fastdebug +The %{origin_nice} %{featurever} runtime environment. +%{fastdebug_warning} +%endif + +%if %{include_normal_build} +%package headless +Summary: %{origin_nice} %{featurever} Headless Runtime Environment +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_headless_rpo %{nil}} + +%description headless +The %{origin_nice} %{featurever} runtime environment without audio and video support. +%endif + +%if %{include_debug_build} +%package headless-slowdebug +Summary: %{origin_nice} %{featurever} Runtime Environment %{debug_on} +Group: Development/Languages + +%{java_headless_rpo -- %{debug_suffix_unquoted}} + +%description headless-slowdebug +The %{origin_nice} %{featurever} runtime environment without audio and video support. +%{debug_warning} +%endif + +%if %{include_fastdebug_build} +%package headless-fastdebug +Summary: %{origin_nice} %{featurever} Runtime Environment %{fastdebug_on} +Group: Development/Languages + +%{java_headless_rpo -- %{fastdebug_suffix_unquoted}} + +%description headless-fastdebug +The %{origin_nice} %{featurever} runtime environment without audio and video support. +%{fastdebug_warning} +%endif + +%if %{include_normal_build} +%package devel +Summary: %{origin_nice} %{featurever} Development Environment +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_devel_rpo %{nil}} + +%description devel +The %{origin_nice} %{featurever} development tools. +%endif + +%if %{include_debug_build} +%package devel-slowdebug +Summary: %{origin_nice} %{featurever} Development Environment %{debug_on} +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_devel_rpo -- %{debug_suffix_unquoted}} + +%description devel-slowdebug +The %{origin_nice} %{featurever} development tools. +%{debug_warning} +%endif + +%if %{include_fastdebug_build} +%package devel-fastdebug +Summary: %{origin_nice} %{featurever} Development Environment %{fastdebug_on} +Group: Development/Tools + +%{java_devel_rpo -- %{fastdebug_suffix_unquoted}} + +%description devel-fastdebug +The %{origin_nice} %{featurever} development tools . +%{fastdebug_warning} +%endif + +%if %{include_staticlibs} + +%if %{include_normal_build} +%package static-libs +Summary: %{origin_nice} %{featurever} libraries for static linking + +%{java_static_libs_rpo %{nil}} + +%description static-libs +The %{origin_nice} %{featurever} libraries for static linking. +%endif + +%if %{include_debug_build} +%package static-libs-slowdebug +Summary: %{origin_nice} %{featurever} libraries for static linking %{debug_on} + +%{java_static_libs_rpo -- %{debug_suffix_unquoted}} + +%description static-libs-slowdebug +The %{origin_nice} %{featurever} libraries for static linking. +%{debug_warning} +%endif + +%if %{include_fastdebug_build} +%package static-libs-fastdebug +Summary: %{origin_nice} %{featurever} libraries for static linking %{fastdebug_on} + +%{java_static_libs_rpo -- %{fastdebug_suffix_unquoted}} + +%description static-libs-fastdebug +The %{origin_nice} %{featurever} libraries for static linking. +%{fastdebug_warning} +%endif + +# staticlibs +%endif + +%if %{include_normal_build} +%package jmods +Summary: JMods for %{origin_nice} %{featurever} +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_jmods_rpo %{nil}} + +%description jmods +The JMods for %{origin_nice} %{featurever}. +%endif + +%if %{include_debug_build} +%package jmods-slowdebug +Summary: JMods for %{origin_nice} %{featurever} %{debug_on} +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_jmods_rpo -- %{debug_suffix_unquoted}} + +%description jmods-slowdebug +The JMods for %{origin_nice} %{featurever}. +%{debug_warning} +%endif + +%if %{include_fastdebug_build} +%package jmods-fastdebug +Summary: JMods for %{origin_nice} %{featurever} %{fastdebug_on} +Group: Development/Tools + +%{java_jmods_rpo -- %{fastdebug_suffix_unquoted}} + +%description jmods-fastdebug +The JMods for %{origin_nice} %{featurever}. +%{fastdebug_warning} +%endif + +%if %{include_normal_build} +%package demo +Summary: %{origin_nice} %{featurever} Demos +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_demo_rpo %{nil}} + +%description demo +The %{origin_nice} %{featurever} demos. +%endif + +%if %{include_debug_build} +%package demo-slowdebug +Summary: %{origin_nice} %{featurever} Demos %{debug_on} +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_demo_rpo -- %{debug_suffix_unquoted}} + +%description demo-slowdebug +The %{origin_nice} %{featurever} demos. +%{debug_warning} +%endif + +%if %{include_fastdebug_build} +%package demo-fastdebug +Summary: %{origin_nice} %{featurever} Demos %{fastdebug_on} +Group: Development/Languages + +%{java_demo_rpo -- %{fastdebug_suffix_unquoted}} + +%description demo-fastdebug +The %{origin_nice} %{featurever} demos. +%{fastdebug_warning} +%endif + +%if %{include_normal_build} +%package src +Summary: %{origin_nice} %{featurever} Source Bundle +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_src_rpo %{nil}} + +%description src +The %{compatiblename}-src sub-package contains the complete %{origin_nice} %{featurever} +class library source code for use by IDE indexers and debuggers. +%endif + +%if %{include_debug_build} +%package src-slowdebug +Summary: %{origin_nice} %{featurever} Source Bundle %{for_debug} +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_src_rpo -- %{debug_suffix_unquoted}} + +%description src-slowdebug +The %{compatiblename}-src-slowdebug sub-package contains the complete %{origin_nice} %{featurever} + class library source code for use by IDE indexers and debuggers, %{for_debug}. +%endif + +%if %{include_fastdebug_build} +%package src-fastdebug +Summary: %{origin_nice} %{featurever} Source Bundle %{for_fastdebug} +Group: Development/Languages + +%{java_src_rpo -- %{fastdebug_suffix_unquoted}} + +%description src-fastdebug +The %{compatiblename}-src-fastdebug sub-package contains the complete %{origin_nice} %{featurever} + class library source code for use by IDE indexers and debuggers, %{for_fastdebug}. +%endif + +%if %{include_normal_build} +%package javadoc +Summary: %{origin_nice} %{featurever} API documentation +%if 0%{?rhel} <= 8 +Group: Documentation +%endif +Requires: javapackages-filesystem +Obsoletes: javadoc-slowdebug < 1:13.0.0.33-1.rolling + +%{java_javadoc_rpo %{nil}} + +%description javadoc +The %{origin_nice} %{featurever} API documentation. +%endif + +%if %{include_normal_build} +%package javadoc-zip +Summary: %{origin_nice} %{featurever} API documentation compressed in a single archive +%if 0%{?rhel} <= 8 +Group: Documentation +%endif +Requires: javapackages-filesystem +Obsoletes: javadoc-zip-slowdebug < 1:13.0.0.33-1.rolling + +%{java_javadoc_rpo %{nil}} + +%description javadoc-zip +The %{origin_nice} %{featurever} API documentation compressed in a single archive. +%endif + +%prep +if [ %{include_normal_build} -eq 0 -o %{include_normal_build} -eq 1 ] ; then + echo "include_normal_build is %{include_normal_build}" +else + echo "include_normal_build is %{include_normal_build}, that is invalid. Use 1 for yes or 0 for no" + exit 11 +fi +if [ %{include_debug_build} -eq 0 -o %{include_debug_build} -eq 1 ] ; then + echo "include_debug_build is %{include_debug_build}" +else + echo "include_debug_build is %{include_debug_build}, that is invalid. Use 1 for yes or 0 for no" + exit 12 +fi +if [ %{include_fastdebug_build} -eq 0 -o %{include_fastdebug_build} -eq 1 ] ; then + echo "include_fastdebug_build is %{include_fastdebug_build}" +else + echo "include_fastdebug_build is %{include_fastdebug_build}, that is invalid. Use 1 for yes or 0 for no" + exit 13 +fi +if [ %{include_debug_build} -eq 0 -a %{include_normal_build} -eq 0 -a %{include_fastdebug_build} -eq 0 ] ; then + echo "You have disabled all builds (normal,fastdebug,slowdebug). That is a no go." + exit 14 +fi +%setup -q -c -n %{uniquesuffix ""} -T -a 0 +# https://bugzilla.redhat.com/show_bug.cgi?id=1189084 +prioritylength=`expr length %{priority}` +if [ $prioritylength -ne 8 ] ; then + echo "priority must be 8 digits in total, violated" + exit 14 +fi + +# OpenJDK patches +# Remove libraries that are linked by both static and dynamic builds +sh %{SOURCE12} %{top_level_dir_name} + +# Patch the JDK +pushd %{top_level_dir_name} +%patch1 -p1 +%patch2 -p1 +%patch3 -p1 +%patch4 -p1 +%patch5 -p1 +%patch6 -p1 +popd # openjdk + +%patch1000 +%patch600 +%patch1001 +%patch1002 +%patch1004 +%patch1007 +%patch1008 +%patch1009 +%patch1010 +%patch1011 +%patch1012 +%patch1013 +%patch2000 + +# Extract systemtap tapsets +%if %{with_systemtap} +tar --strip-components=1 -x -I xz -f %{SOURCE8} +%if %{include_debug_build} +cp -r tapset tapset%{debug_suffix} +%endif +%if %{include_fastdebug_build} +cp -r tapset tapset%{fastdebug_suffix} +%endif + +for suffix in %{build_loop} ; do + for file in "tapset"$suffix/*.in; do + OUTPUT_FILE=`echo $file | sed -e "s:\.stp\.in$:-%{version}-%{release}.%{_arch}.stp:g"` + sed -e "s:@ABS_SERVER_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/server/libjvm.so:g" $file > $file.1 + sed -e "s:@JAVA_SPEC_VER@:%{javaver}:g" $file.1 > $file.2 +# TODO find out which architectures other than i686 have a client vm +%ifarch %{ix86} + sed -e "s:@ABS_CLIENT_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/client/libjvm.so:g" $file.2 > $OUTPUT_FILE +%else + sed -e "/@ABS_CLIENT_LIBJVM_SO@/d" $file.2 > $OUTPUT_FILE +%endif + sed -i -e "s:@ABS_JAVA_HOME_DIR@:%{_jvmdir}/%{sdkdir -- $suffix}:g" $OUTPUT_FILE + sed -i -e "s:@INSTALL_ARCH_DIR@:%{archinstall}:g" $OUTPUT_FILE + sed -i -e "s:@prefix@:%{_jvmdir}/%{sdkdir -- $suffix}/:g" $OUTPUT_FILE + done +done +# systemtap tapsets ends +%endif + +# Prepare desktop files +# The _X_ syntax indicates variables that are replaced by make upstream +# The @X@ syntax indicates variables that are replaced by configure upstream +for suffix in %{build_loop} ; do +for file in %{SOURCE9}; do + FILE=`basename $file | sed -e s:\.in$::g` + EXT="${FILE##*.}" + NAME="${FILE%.*}" + OUTPUT_FILE=$NAME$suffix.$EXT + sed -e "s:_SDKBINDIR_:%{sdkbindir -- $suffix}:g" $file > $OUTPUT_FILE + sed -i -e "s:@target_cpu@:%{_arch}:g" $OUTPUT_FILE + sed -i -e "s:@OPENJDK_VER@:%{version}-%{release}.%{_arch}$suffix:g" $OUTPUT_FILE + sed -i -e "s:@JAVA_VER@:%{javaver}:g" $OUTPUT_FILE + sed -i -e "s:@JAVA_VENDOR@:%{origin}:g" $OUTPUT_FILE +done +done + +# Setup nss.cfg +sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE11} > nss.cfg + +# Setup nss.fips.cfg +sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE17} > nss.fips.cfg + +%build +# How many CPU's do we have? +export NUM_PROC=%(/usr/bin/getconf _NPROCESSORS_ONLN 2> /dev/null || :) +export NUM_PROC=${NUM_PROC:-1} +%if 0%{?_smp_ncpus_max} +# Honor %%_smp_ncpus_max +[ ${NUM_PROC} -gt %{?_smp_ncpus_max} ] && export NUM_PROC=%{?_smp_ncpus_max} +%endif + +%ifarch s390x sparc64 alpha %{power64} %{aarch64} +export ARCH_DATA_MODEL=64 +%endif +%ifarch alpha +export CFLAGS="$CFLAGS -mieee" +%endif + +# We use ourcppflags because the OpenJDK build seems to +# pass EXTRA_CFLAGS to the HotSpot C++ compiler... +# Explicitly set the C++ standard as the default has changed on GCC >= 6 +EXTRA_CFLAGS="%ourcppflags" +EXTRA_CPP_FLAGS="%ourcppflags" + +%ifarch %{power64} ppc +# fix rpmlint warnings +EXTRA_CFLAGS="$EXTRA_CFLAGS -fno-strict-aliasing" +%endif +export EXTRA_CFLAGS + +function buildjdk() { + local outputdir=${1} + local buildjdk=${2} + local maketargets="${3}" + local debuglevel=${4} + local link_opt=${5} + + local top_dir_abs_src_path=$(pwd)/%{top_level_dir_name} + local top_dir_abs_build_path=$(pwd)/${outputdir} + + # The OpenJDK version file includes the current + # upstream version information. For some reason, + # configure does not automatically use the + # default pre-version supplied there (despite + # what the file claims), so we pass it manually + # to configure + VERSION_FILE=${top_dir_abs_src_path}/make/conf/version-numbers.conf + if [ -f ${VERSION_FILE} ] ; then + EA_DESIGNATOR=$(grep '^DEFAULT_PROMOTED_VERSION_PRE' ${VERSION_FILE} | cut -d '=' -f 2) + else + echo "Could not find OpenJDK version file."; + exit 16 + fi + if [ "x${EA_DESIGNATOR}" != "x%{expected_ea_designator}" ] ; then + echo "Spec file is configured for a %{build_type} build, but upstream version-pre setting is ${EA_DESIGNATOR}"; + exit 17 + fi + + echo "Using output directory: ${outputdir}"; + echo "Checking build JDK ${buildjdk} is operational..." + ${buildjdk}/bin/java -version + echo "Using make targets: ${maketargets}" + echo "Using debuglevel: ${debuglevel}" + echo "Using link_opt: ${link_opt}" + echo "Building %{newjavaver}-%{buildver}, pre=${EA_DESIGNATOR}, opt=%{lts_designator}" + + mkdir -p ${outputdir} + pushd ${outputdir} + + bash ${top_dir_abs_src_path}/configure \ +%ifnarch %{jit_arches} + --with-jvm-variants=zero \ +%endif +%ifarch %{ppc64le} + --with-jobs=1 \ +%endif + --with-version-build=%{buildver} \ + --with-version-pre="${EA_DESIGNATOR}" \ + --with-version-opt=%{lts_designator} \ + --with-vendor-version-string="%{vendor_version_string}" \ + --with-vendor-name="Red Hat, Inc." \ + --with-vendor-url="https://www.redhat.com/" \ + --with-vendor-bug-url="%{bugs}" \ + --with-vendor-vm-bug-url="%{bugs}" \ + --with-boot-jdk=${buildjdk} \ + --with-debug-level=${debuglevel} \ + --with-native-debug-symbols="%{debug_symbols}" \ + --enable-sysconf-nss \ + --enable-unlimited-crypto \ + --with-zlib=system \ + --with-libjpeg=${link_opt} \ + --with-giflib=${link_opt} \ + --with-libpng=${link_opt} \ + --with-lcms=${link_opt} \ + --with-harfbuzz=${link_opt} \ + --with-stdc++lib=dynamic \ + --with-extra-cxxflags="$EXTRA_CPP_FLAGS" \ + --with-extra-cflags="$EXTRA_CFLAGS" \ + --with-extra-ldflags="%{ourldflags}" \ + --with-num-cores="$NUM_PROC" \ + --with-source-date="${SOURCE_DATE_EPOCH}" \ + --disable-javac-server \ +%ifarch %{zgc_arches} + --with-jvm-features=zgc \ +%endif + --disable-warnings-as-errors + + cat spec.gmk + + make \ + LOG=trace \ + WARNINGS_ARE_ERRORS="-Wno-error" \ + CFLAGS_WARNINGS_ARE_ERRORS="-Wno-error" \ + $maketargets || ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name "hs_err_pid*.log" | xargs cat && false ) + + popd +} + +function installjdk() { + local imagepath=${1} + + # the build (erroneously) removes read permissions from some jars + # this is a regression in OpenJDK 7 (our compiler): + # http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=1437 + find ${imagepath} -iname '*.jar' -exec chmod ugo+r {} \; + + # Build screws up permissions on binaries + # https://bugs.openjdk.java.net/browse/JDK-8173610 + find ${imagepath} -iname '*.so' -exec chmod +x {} \; + find ${imagepath}/bin/ -exec chmod +x {} \; + + # Install nss.cfg right away as we will be using the JRE above + install -m 644 nss.cfg ${imagepath}/conf/security/ + + # Install nss.fips.cfg: NSS configuration for global FIPS mode (crypto-policies) + install -m 644 nss.fips.cfg ${imagepath}/conf/security/ + + # Use system-wide tzdata + rm ${imagepath}/lib/tzdb.dat + ln -s %{_datadir}/javazi-1.8/tzdb.dat ${imagepath}/lib/tzdb.dat + + # Create fake alt-java as a placeholder for future alt-java + pushd ${imagepath} + # add alt-java man page + echo "Hardened java binary recommended for launching untrusted code from the Web e.g. javaws" > man/man1/%{alt_java_name}.1 + cat man/man1/java.1 >> man/man1/%{alt_java_name}.1 + popd +} + +for suffix in %{build_loop} ; do + + if [ "x$suffix" = "x" ] ; then + debugbuild=release + else + # change --something to something + debugbuild=`echo $suffix | sed "s/-//g"` + fi + + systemjdk=/usr/lib/jvm/java-%{buildjdkver}-openjdk + + for loop in %{main_suffix} %{staticlibs_loop} ; do + + builddir=%{buildoutputdir -- ${suffix}${loop}} + bootbuilddir=boot${builddir} + + if test "x${loop}" = "x%{main_suffix}" ; then + # Copy the source tree so we can remove all in-tree libraries + cp -a %{top_level_dir_name} %{top_level_dir_name_backup} + # Remove all libraries that are linked + sh %{SOURCE12} %{top_level_dir_name} full + # Use system libraries + link_opt="system" + # Debug builds don't need same targets as release for + # build speed-up. We also avoid bootstrapping these + # slower builds. + if echo $debugbuild | grep -q "debug" ; then + maketargets="%{debug_targets}" + run_bootstrap=false + else + maketargets="%{release_targets}" + run_bootstrap=%{bootstrap_build} + fi + if ${run_bootstrap} ; then + buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild} ${link_opt} + buildjdk ${builddir} $(pwd)/${bootbuilddir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt} + rm -rf ${bootbuilddir} + else + buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} + fi + # Restore original source tree we modified by removing full in-tree sources + rm -rf %{top_level_dir_name} + mv %{top_level_dir_name_backup} %{top_level_dir_name} + else + # Use bundled libraries for building statically + link_opt="bundled" + # Static library cycle only builds the static libraries + maketargets="%{static_libs_target}" + # Always just do the one build for the static libraries + buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} + fi + + done # end of main / staticlibs loop + + # Final setup on the main image + top_dir_abs_main_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{main_suffix}} + installjdk ${top_dir_abs_main_build_path}/images/%{jdkimage} + +# build cycles +done # end of release / debug cycle loop + +%check + +# We test debug first as it will give better diagnostics on a crash +for suffix in %{build_loop} ; do + +top_dir_abs_main_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{main_suffix}} +%if %{include_staticlibs} +top_dir_abs_staticlibs_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{staticlibs_loop}} +%endif + +export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage} + +#check Shenandoah is enabled +%if %{use_shenandoah_hotspot} +$JAVA_HOME//bin/java -XX:+UnlockExperimentalVMOptions -XX:+UseShenandoahGC -version +%endif + +# Check unlimited policy has been used +$JAVA_HOME/bin/javac -d . %{SOURCE13} +$JAVA_HOME/bin/java --add-opens java.base/javax.crypto=ALL-UNNAMED TestCryptoLevel + +# Check ECC is working +$JAVA_HOME/bin/javac -d . %{SOURCE14} +$JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||") + +# Check system crypto (policy) can be disabled +$JAVA_HOME/bin/javac -d . %{SOURCE15} +$JAVA_HOME/bin/java -Djava.security.disableSystemPropertiesFile=true $(echo $(basename %{SOURCE15})|sed "s|\.java||") + +# Check java launcher has no SSB mitigation +if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi + +# Check alt-java launcher has SSB mitigation on supported architectures +%ifarch %{ssbd_arches} +nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation +%else +if ! nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation ; then true ; else false; fi +%endif + +%if %{include_staticlibs} +# Check debug symbols in static libraries (smoke test) +export STATIC_LIBS_HOME=${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image} +readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep w_remainder.c +readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep e_remainder.c +%endif + +so_suffix="so" +# Check debug symbols are present and can identify code +find "$JAVA_HOME" -iname "*.$so_suffix" -print0 | while read -d $'\0' lib +do + if [ -f "$lib" ] ; then + echo "Testing $lib for debug symbols" + # All these tests rely on RPM failing the build if the exit code of any set + # of piped commands is non-zero. + + # Test for .debug_* sections in the shared object. This is the main test + # Stripped objects will not contain these + eu-readelf -S "$lib" | grep "] .debug_" + test $(eu-readelf -S "$lib" | grep -E "\]\ .debug_(info|abbrev)" | wc --lines) == 2 + + # Test FILE symbols. These will most likely be removed by anything that + # manipulates symbol tables because it's generally useless. So a nice test + # that nothing has messed with symbols + old_IFS="$IFS" + IFS=$'\n' + for line in $(eu-readelf -s "$lib" | grep "00000000 0 FILE LOCAL DEFAULT") + do + # We expect to see .cpp files, except for architectures like aarch64 and + # s390 where we expect .o and .oS files + echo "$line" | grep -E "ABS ((.*/)?[-_a-zA-Z0-9]+\.(c|cc|cpp|cxx|o|oS))?$" + done + IFS="$old_IFS" + + # If this is the JVM, look for javaCalls.(cpp|o) in FILEs, for extra sanity checking + if [ "`basename $lib`" = "libjvm.so" ]; then + eu-readelf -s "$lib" | \ + grep -E "00000000 0 FILE LOCAL DEFAULT ABS javaCalls.(cpp|o)$" + fi + + # Test that there are no .gnu_debuglink sections pointing to another + # debuginfo file. There shouldn't be any debuginfo files, so the link makes + # no sense either + eu-readelf -S "$lib" | grep 'gnu' + if eu-readelf -S "$lib" | grep '] .gnu_debuglink' | grep PROGBITS; then + echo "bad .gnu_debuglink section." + eu-readelf -x .gnu_debuglink "$lib" + false + fi + fi +done + +# Make sure gdb can do a backtrace based on line numbers on libjvm.so +# javaCalls.cpp:58 should map to: +# http://hg.openjdk.java.net/jdk8u/jdk8u/hotspot/file/ff3b27e6bcc2/src/shar... +# Using line number 1 might cause build problems. See: +# https://bugzilla.redhat.com/show_bug.cgi?id=1539664 +# https://bugzilla.redhat.com/show_bug.cgi?id=1538767 +gdb -q "$JAVA_HOME/bin/java" <<EOF | tee gdb.out +handle SIGSEGV pass nostop noprint +handle SIGILL pass nostop noprint +set breakpoint pending on +break javaCalls.cpp:1 +commands 1 +backtrace +quit +end +run -version +EOF +%if 0%{?fedora} > 0 +# This fails on s390x for some reason. Disable for now. See: +# https://koji.fedoraproject.org/koji/taskinfo?taskID=41499227 +%ifnarch s390x +grep 'JavaCallWrapper::JavaCallWrapper' gdb.out +%endif +%endif + +# Check src.zip has all sources. See RHBZ#1130490 +$JAVA_HOME/bin/jar -tf $JAVA_HOME/lib/src.zip | grep 'sun.misc.Unsafe' + +# Check class files include useful debugging information +$JAVA_HOME/bin/javap -l java.lang.Object | grep "Compiled from" +$JAVA_HOME/bin/javap -l java.lang.Object | grep LineNumberTable +$JAVA_HOME/bin/javap -l java.lang.Object | grep LocalVariableTable + +# Check generated class files include useful debugging information +$JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep "Compiled from" +$JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep LineNumberTable +$JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep LocalVariableTable + +# build cycles check +done + +%install +STRIP_KEEP_SYMTAB=libjvm* + +for suffix in %{build_loop} ; do + +top_dir_abs_main_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{main_suffix}} +%if %{include_staticlibs} +top_dir_abs_staticlibs_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{staticlibs_loop}} +%endif +jdk_image=${top_dir_abs_main_build_path}/images/%{jdkimage} + +# Install the jdk +mkdir -p $RPM_BUILD_ROOT%{_jvmdir} +cp -a ${jdk_image} $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix} + +pushd ${jdk_image} + +%if %{with_systemtap} + # Install systemtap support files + install -dm 755 $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset + # note, that uniquesuffix is in BUILD dir in this case + cp -a $RPM_BUILD_DIR/%{uniquesuffix ""}/tapset$suffix/*.stp $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset/ + pushd $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset/ + tapsetFiles=`ls *.stp` + popd + install -d -m 755 $RPM_BUILD_ROOT%{tapsetdir} + for name in $tapsetFiles ; do + targetName=`echo $name | sed "s/.stp/$suffix.stp/"` + ln -sf %{_jvmdir}/%{sdkdir -- $suffix}/tapset/$name $RPM_BUILD_ROOT%{tapsetdir}/$targetName + done +%endif + + # Remove empty cacerts database + rm -f $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/lib/security/cacerts + # Install cacerts symlink needed by some apps which hard-code the path + pushd $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/lib/security + ln -sf /etc/pki/java/cacerts . + popd + + # Install version-ed symlinks + pushd $RPM_BUILD_ROOT%{_jvmdir} + ln -sf %{sdkdir -- $suffix} %{jrelnk -- $suffix} + popd + + # Install man pages + install -d -m 755 $RPM_BUILD_ROOT%{_mandir}/man1 + for manpage in man/man1/* + do + # Convert man pages to UTF8 encoding + iconv -f ISO_8859-1 -t UTF8 $manpage -o $manpage.tmp + mv -f $manpage.tmp $manpage + install -m 644 -p $manpage $RPM_BUILD_ROOT%{_mandir}/man1/$(basename \ + $manpage .1)-%{uniquesuffix -- $suffix}.1 + done + # Remove man pages from jdk image + rm -rf $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/man + +popd +# Install static libs artefacts +%if %{include_staticlibs} +mkdir -p $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/lib/static/linux-%{archinstall}/glibc +cp -a ${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image}/lib/*.a \ + $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/lib/static/linux-%{archinstall}/glibc +%endif + +if ! echo $suffix | grep -q "debug" ; then + # Install Javadoc documentation + install -d -m 755 $RPM_BUILD_ROOT%{_javadocdir} + cp -a ${top_dir_abs_main_build_path}/images/docs $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix} + built_doc_archive=jdk-%{filever}%{ea_designator_zip}+%{buildver}%{lts_designator_zip}-docs.zip + cp -a ${top_dir_abs_main_build_path}/bundles/${built_doc_archive} \ + $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip || ls -l ${top_dir_abs_main_build_path}/bundles/ +fi + +# Install release notes +commondocdir=${RPM_BUILD_ROOT}%{_defaultdocdir}/%{uniquejavadocdir -- $suffix} +install -d -m 755 ${commondocdir} +cp -a %{SOURCE10} ${commondocdir} + +# Install icons and menu entries +for s in 16 24 32 48 ; do + install -D -p -m 644 \ + %{top_level_dir_name}/src/java.desktop/unix/classes/sun/awt/X11/java-icon${s}.png \ + $RPM_BUILD_ROOT%{_datadir}/icons/hicolor/${s}x${s}/apps/java-%{javaver}-%{origin}.png +done + +# Install desktop files +install -d -m 755 $RPM_BUILD_ROOT%{_datadir}/{applications,pixmaps} +for e in jconsole$suffix ; do + desktop-file-install --vendor=%{uniquesuffix -- $suffix} --mode=644 \ + --dir=$RPM_BUILD_ROOT%{_datadir}/applications $e.desktop +done + +# Install /etc/.java/.systemPrefs/ directory +# See https://bugzilla.redhat.com/show_bug.cgi?id=741821 +mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/.java/.systemPrefs + +# copy samples next to demos; samples are mostly js files +cp -r %{top_level_dir_name}/src/sample $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix}/ + + +# moving config files to /etc +mkdir -p $RPM_BUILD_ROOT/%{etcjavadir -- $suffix} +mkdir -p $RPM_BUILD_ROOT/%{etcjavadir -- $suffix}/lib +mv $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix}/conf/ $RPM_BUILD_ROOT/%{etcjavadir -- $suffix} +mv $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix}/lib/security $RPM_BUILD_ROOT/%{etcjavadir -- $suffix}/lib +pushd $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix} + ln -s %{etcjavadir -- $suffix}/conf ./conf +popd +pushd $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix}/lib + ln -s %{etcjavadir -- $suffix}/lib/security ./security +popd +# end moving files to /etc + +# stabilize permissions +find $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix}/ -name "*.so" -exec chmod 755 {} \; ; +find $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix}/ -type d -exec chmod 755 {} \; ; +find $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix}/legal -type f -exec chmod 644 {} \; ; + +# end, dual install +done + +%if %{include_normal_build} +# intentionally only for non-debug +%pretrans headless -p <lua> +-- see https://bugzilla.redhat.com/show_bug.cgi?id=1038092 for whole issue +-- see https://bugzilla.redhat.com/show_bug.cgi?id=1290388 for pretrans over pre +-- if copy-jdk-configs is in transaction, it installs in pretrans to temp +-- if copy_jdk_configs is in temp, then it means that copy-jdk-configs is in transaction and so is +-- preferred over one in %%{_libexecdir}. If it is not in transaction, then depends +-- whether copy-jdk-configs is installed or not. If so, then configs are copied +-- (copy_jdk_configs from %%{_libexecdir} used) or not copied at all +local posix = require "posix" + +if (os.getenv("debug") == "true") then + debug = true; + print("cjc: in spec debug is on") +else + debug = false; +end + +SOURCE1 = "%{rpm_state_dir}/copy_jdk_configs.lua" +SOURCE2 = "%{_libexecdir}/copy_jdk_configs.lua" + +local stat1 = posix.stat(SOURCE1, "type"); +local stat2 = posix.stat(SOURCE2, "type"); + + if (stat1 ~= nil) then + if (debug) then + print(SOURCE1 .." exists - copy-jdk-configs in transaction, using this one.") + end; + package.path = package.path .. ";" .. SOURCE1 +else + if (stat2 ~= nil) then + if (debug) then + print(SOURCE2 .." exists - copy-jdk-configs already installed and NOT in transaction. Using.") + end; + package.path = package.path .. ";" .. SOURCE2 + else + if (debug) then + print(SOURCE1 .." does NOT exists") + print(SOURCE2 .." does NOT exists") + print("No config files will be copied") + end + return + end +end +arg = nil ; -- it is better to null the arg up, no meter if they exists or not, and use cjc as module in unified way, instead of relaying on "main" method during require "copy_jdk_configs.lua" +cjc = require "copy_jdk_configs.lua" +args = {"--currentjvm", "%{uniquesuffix %{nil}}", "--jvmdir", "%{_jvmdir %{nil}}", "--origname", "%{name}", "--origjavaver", "%{javaver}", "--arch", "%{_arch}", "--temp", "%{rpm_state_dir}/%{name}.%{_arch}"} +cjc.mainProgram(args) + +%post +%{post_script %{nil}} + +%post headless +%{post_headless %{nil}} + +%postun +%{postun_script %{nil}} + +%postun headless +%{postun_headless %{nil}} + +%posttrans +%{posttrans_script %{nil}} + +%posttrans headless +%{alternatives_java_install %{nil}} + +%post devel +%{post_devel %{nil}} + +%postun devel +%{postun_devel %{nil}} + +%posttrans devel +%{posttrans_devel %{nil}} + +%posttrans javadoc +%{alternatives_javadoc_install %{nil}} + +%postun javadoc +%{postun_javadoc %{nil}} + +%posttrans javadoc-zip +%{alternatives_javadoczip_install %{nil}} + +%postun javadoc-zip +%{postun_javadoc_zip %{nil}} +%endif + +%if %{include_debug_build} +%post slowdebug +%{post_script -- %{debug_suffix_unquoted}} + +%post headless-slowdebug +%{post_headless -- %{debug_suffix_unquoted}} + +%posttrans headless-slowdebug +%{alternatives_java_install -- %{debug_suffix_unquoted}} + +%postun slowdebug +%{postun_script -- %{debug_suffix_unquoted}} + +%postun headless-slowdebug +%{postun_headless -- %{debug_suffix_unquoted}} + +%posttrans slowdebug +%{posttrans_script -- %{debug_suffix_unquoted}} + +%post devel-slowdebug +%{post_devel -- %{debug_suffix_unquoted}} + +%postun devel-slowdebug +%{postun_devel -- %{debug_suffix_unquoted}} + +%posttrans devel-slowdebug +%{posttrans_devel -- %{debug_suffix_unquoted}} +%endif + +%if %{include_fastdebug_build} +%post fastdebug +%{post_script -- %{fastdebug_suffix_unquoted}} + +%post headless-fastdebug +%{post_headless -- %{fastdebug_suffix_unquoted}} + +%postun fastdebug +%{postun_script -- %{fastdebug_suffix_unquoted}} + +%postun headless-fastdebug +%{postun_headless -- %{fastdebug_suffix_unquoted}} + +%posttrans fastdebug +%{posttrans_script -- %{fastdebug_suffix_unquoted}} + +%posttrans headless-fastdebug +%{alternatives_java_install -- %{fastdebug_suffix_unquoted}} + +%post devel-fastdebug +%{post_devel -- %{fastdebug_suffix_unquoted}} + +%postun devel-fastdebug +%{postun_devel -- %{fastdebug_suffix_unquoted}} + +%posttrans devel-fastdebug +%{posttrans_devel -- %{fastdebug_suffix_unquoted}} + +%endif + +%if %{include_normal_build} +%files +# main package builds always +%{files_jre %{nil}} +%else +%files +# placeholder +%endif + + +%if %{include_normal_build} +%files headless +# important note, see https://bugzilla.redhat.com/show_bug.cgi?id=1038092 for whole issue +# all config/noreplace files (and more) have to be declared in pretrans. See pretrans +%{files_jre_headless %{nil}} + +%files devel +%{files_devel %{nil}} + +%if %{include_staticlibs} +%files static-libs +%{files_static_libs %{nil}} +%endif + +%files jmods +%{files_jmods %{nil}} + +%files demo +%{files_demo %{nil}} + +%files src +%{files_src %{nil}} + +%files javadoc +%{files_javadoc %{nil}} + +# This puts a huge documentation file in /usr/share +# It is now architecture-dependent, as eg. AOT and Graal are now x86_64 only +# same for debug variant +%files javadoc-zip +%{files_javadoc_zip %{nil}} +%endif + +%if %{include_debug_build} +%files slowdebug +%{files_jre -- %{debug_suffix_unquoted}} + +%files headless-slowdebug +%{files_jre_headless -- %{debug_suffix_unquoted}} + +%files devel-slowdebug +%{files_devel -- %{debug_suffix_unquoted}} + +%if %{include_staticlibs} +%files static-libs-slowdebug +%{files_static_libs -- %{debug_suffix_unquoted}} +%endif + +%files jmods-slowdebug +%{files_jmods -- %{debug_suffix_unquoted}} + +%files demo-slowdebug +%{files_demo -- %{debug_suffix_unquoted}} + +%files src-slowdebug +%{files_src -- %{debug_suffix_unquoted}} +%endif + +%if %{include_fastdebug_build} +%files fastdebug +%{files_jre -- %{fastdebug_suffix_unquoted}} + +%files headless-fastdebug +%{files_jre_headless -- %{fastdebug_suffix_unquoted}} + +%files devel-fastdebug +%{files_devel -- %{fastdebug_suffix_unquoted}} + +%if %{include_staticlibs} +%files static-libs-fastdebug +%{files_static_libs -- %{fastdebug_suffix_unquoted}} +%endif + +%files jmods-fastdebug +%{files_jmods -- %{fastdebug_suffix_unquoted}} + +%files demo-fastdebug +%{files_demo -- %{fastdebug_suffix_unquoted}} + +%files src-fastdebug +%{files_src -- %{fastdebug_suffix_unquoted}} + +%endif + +%changelog +* Thu Nov 18 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.0.0.35-8 +- inital import + diff --git a/jconsole.desktop.in b/jconsole.desktop.in new file mode 100644 index 0000000..8a3b04d --- /dev/null +++ b/jconsole.desktop.in @@ -0,0 +1,10 @@ +[Desktop Entry] +Name=OpenJDK @JAVA_VER@ for @target_cpu@ Monitoring & Management Console (@OPENJDK_VER@) +Comment=Monitor and manage OpenJDK applications +Exec=_SDKBINDIR_/jconsole +Icon=java-@JAVA_VER@-@JAVA_VENDOR@ +Terminal=false +Type=Application +StartupWMClass=sun-tools-jconsole-JConsole +Categories=Development;Profiling;Java; +Version=1.0 diff --git a/jdk8276572-fake_libsyslookup_causes_tooling_issues.patch b/jdk8276572-fake_libsyslookup_causes_tooling_issues.patch new file mode 100644 index 0000000..dee144b --- /dev/null +++ b/jdk8276572-fake_libsyslookup_causes_tooling_issues.patch @@ -0,0 +1,21 @@ +commit a4724332098cd8bff44ee27e9190fd28fa5c1865 +Author: Andrew John Hughes <andrew(a)openjdk.org> +Date: Fri Nov 5 21:05:42 2021 +0000 + + 8276572: Fake libsyslookup.so library causes tooling issues + + Reviewed-by: shade, mcimadamore + +diff --git openjdk.orig/src/jdk.incubator.foreign/share/native/libsyslookup/syslookup.c openjdk/src/jdk.incubator.foreign/share/native/libsyslookup/syslookup.c +index fdf99866786..b1f543bfdb7 100644 +--- openjdk.orig/src/jdk.incubator.foreign/share/native/libsyslookup/syslookup.c ++++ openjdk/src/jdk.incubator.foreign/share/native/libsyslookup/syslookup.c +@@ -26,3 +26,8 @@ + // Note: the include below is not strictly required, as dependencies will be pulled using linker flags. + // Adding at least one #include removes unwanted warnings on some platforms. + #include <stdlib.h> ++ ++// Simple dummy function so this library appears as a normal library to tooling. ++char* syslookup() { ++ return "syslookup"; ++} diff --git a/nss.cfg.in b/nss.cfg.in new file mode 100644 index 0000000..377a39c --- /dev/null +++ b/nss.cfg.in @@ -0,0 +1,5 @@ +name = NSS +nssLibraryDirectory = @NSS_LIBDIR@ +nssDbMode = noDb +attributes = compatibility +handleStartupErrors = ignoreMultipleInitialisation diff --git a/nss.fips.cfg.in b/nss.fips.cfg.in new file mode 100644 index 0000000..1aff153 --- /dev/null +++ b/nss.fips.cfg.in @@ -0,0 +1,6 @@ +name = NSS-FIPS +nssLibraryDirectory = @NSS_LIBDIR@ +nssSecmodDirectory = sql:/etc/pki/nssdb +nssDbMode = readOnly +nssModule = fips + diff --git a/pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch b/pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch new file mode 100644 index 0000000..4efbe9a --- /dev/null +++ b/pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch @@ -0,0 +1,88 @@ + +# HG changeset patch +# User andrew +# Date 1478057514 0 +# Node ID 1c4d5cb2096ae55106111da200b0bcad304f650c +# Parent 3d53f19b48384e5252f4ec8891f7a3a82d77af2a +PR3183: Support Fedora/RHEL system crypto policy +diff -r 3d53f19b4838 -r 1c4d5cb2096a src/java.base/share/classes/java/security/Security.java +--- a/src/java.base/share/classes/java/security/Security.java Wed Oct 26 03:51:39 2016 +0100 ++++ b/src/java.base/share/classes/java/security/Security.java Wed Nov 02 03:31:54 2016 +0000 +@@ -43,6 +43,9 @@ + * implementation-specific location, which is typically the properties file + * {@code conf/security/java.security} in the Java installation directory. + * ++ * <p>Additional default values of security properties are read from a ++ * system-specific location, if available.</p> ++ * + * @author Benjamin Renaud + * @since 1.1 + */ +@@ -52,6 +55,10 @@ + private static final Debug sdebug = + Debug.getInstance("properties"); + ++ /* System property file*/ ++ private static final String SYSTEM_PROPERTIES = ++ "/etc/crypto-policies/back-ends/java.config"; ++ + /* The java.security properties */ + private static Properties props; + +@@ -93,6 +100,7 @@ + if (sdebug != null) { + sdebug.println("reading security properties file: " + + propFile); ++ sdebug.println(props.toString()); + } + } catch (IOException e) { + if (sdebug != null) { +@@ -114,6 +122,31 @@ + } + + if ("true".equalsIgnoreCase(props.getProperty ++ ("security.useSystemPropertiesFile"))) { ++ ++ // now load the system file, if it exists, so its values ++ // will win if they conflict with the earlier values ++ try (BufferedInputStream bis = ++ new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) { ++ props.load(bis); ++ loadedProps = true; ++ ++ if (sdebug != null) { ++ sdebug.println("reading system security properties file " + ++ SYSTEM_PROPERTIES); ++ sdebug.println(props.toString()); ++ } ++ } catch (IOException e) { ++ if (sdebug != null) { ++ sdebug.println ++ ("unable to load security properties from " + ++ SYSTEM_PROPERTIES); ++ e.printStackTrace(); ++ } ++ } ++ } ++ ++ if ("true".equalsIgnoreCase(props.getProperty + ("security.overridePropertiesFile"))) { + + String extraPropFile = System.getProperty +diff -r 3d53f19b4838 -r 1c4d5cb2096a src/java.base/share/conf/security/java.security +--- a/src/java.base/share/conf/security/java.security Wed Oct 26 03:51:39 2016 +0100 ++++ b/src/java.base/share/conf/security/java.security Wed Nov 02 03:31:54 2016 +0000 +@@ -276,6 +276,13 @@ + security.overridePropertiesFile=true + + # ++# Determines whether this properties file will be appended to ++# using the system properties file stored at ++# /etc/crypto-policies/back-ends/java.config ++# ++security.useSystemPropertiesFile=true ++ ++# + # Determines the default key and trust manager factory algorithms for + # the javax.net.ssl package. + # diff --git a/pr3695-toggle_system_crypto_policy.patch b/pr3695-toggle_system_crypto_policy.patch new file mode 100644 index 0000000..3799237 --- /dev/null +++ b/pr3695-toggle_system_crypto_policy.patch @@ -0,0 +1,78 @@ +# HG changeset patch +# User andrew +# Date 1545198926 0 +# Wed Dec 19 05:55:26 2018 +0000 +# Node ID f2cbd688824c128db7fa848c8732fb0ab3507776 +# Parent 81f07f6d1f8b7b51b136d3974c61bc8bb513770c +PR3695: Allow use of system crypto policy to be disabled by the user +Summary: Read user overrides first so security.useSystemPropertiesFile can be disabled and add -Djava.security.disableSystemPropertiesFile + +diff --git a/src/java.base/share/classes/java/security/Security.java b/src/java.base/share/classes/java/security/Security.java +--- a/src/java.base/share/classes/java/security/Security.java ++++ b/src/java.base/share/classes/java/security/Security.java +@@ -125,31 +125,6 @@ + } + + if ("true".equalsIgnoreCase(props.getProperty +- ("security.useSystemPropertiesFile"))) { +- +- // now load the system file, if it exists, so its values +- // will win if they conflict with the earlier values +- try (BufferedInputStream bis = +- new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) { +- props.load(bis); +- loadedProps = true; +- +- if (sdebug != null) { +- sdebug.println("reading system security properties file " + +- SYSTEM_PROPERTIES); +- sdebug.println(props.toString()); +- } +- } catch (IOException e) { +- if (sdebug != null) { +- sdebug.println +- ("unable to load security properties from " + +- SYSTEM_PROPERTIES); +- e.printStackTrace(); +- } +- } +- } +- +- if ("true".equalsIgnoreCase(props.getProperty + ("security.overridePropertiesFile"))) { + + String extraPropFile = System.getProperty +@@ -215,6 +190,33 @@ + } + } + ++ String disableSystemProps = System.getProperty("java.security.disableSystemPropertiesFile"); ++ if (disableSystemProps == null && ++ "true".equalsIgnoreCase(props.getProperty ++ ("security.useSystemPropertiesFile"))) { ++ ++ // now load the system file, if it exists, so its values ++ // will win if they conflict with the earlier values ++ try (BufferedInputStream bis = ++ new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) { ++ props.load(bis); ++ loadedProps = true; ++ ++ if (sdebug != null) { ++ sdebug.println("reading system security properties file " + ++ SYSTEM_PROPERTIES); ++ sdebug.println(props.toString()); ++ } ++ } catch (IOException e) { ++ if (sdebug != null) { ++ sdebug.println ++ ("unable to load security properties from " + ++ SYSTEM_PROPERTIES); ++ e.printStackTrace(); ++ } ++ } ++ } ++ + if (!loadedProps) { + initializeStatic(); + if (sdebug != null) { diff --git a/remove-intree-libraries.sh b/remove-intree-libraries.sh new file mode 100644 index 0000000..e999c7e --- /dev/null +++ b/remove-intree-libraries.sh @@ -0,0 +1,157 @@ +#!/bin/sh + +# Arguments: <JDK TREE> <MINIMAL|FULL> +TREE=${1} +TYPE=${2} + +ZIP_SRC=src/java.base/share/native/libzip/zlib/ +JPEG_SRC=src/java.desktop/share/native/libjavajpeg/ +GIF_SRC=src/java.desktop/share/native/libsplashscreen/giflib/ +PNG_SRC=src/java.desktop/share/native/libsplashscreen/libpng/ +LCMS_SRC=src/java.desktop/share/native/liblcms/ + +if test "x${TREE}" = "x"; then + echo "$0 <JDK_TREE> (MINIMAL|FULL)"; + exit 1; +fi + +if test "x${TYPE}" = "x"; then + TYPE=minimal; +fi + +if test "x${TYPE}" != "xminimal" -a "x${TYPE}" != "xfull"; then + echo "Type must be minimal or full"; + exit 2; +fi + +echo "Removing in-tree libraries from ${TREE}" +echo "Cleansing operation: ${TYPE}"; + +cd ${TREE} + +echo "Removing built-in libs (they will be linked)" + +# On full runs, allow for zlib having already been deleted by minimal +echo "Removing zlib" +if [ "x${TYPE}" = "xminimal" -a ! -d ${ZIP_SRC} ]; then + echo "${ZIP_SRC} does not exist. Refusing to proceed." + exit 1 +fi +rm -rvf ${ZIP_SRC} + +# Minimal is limited to just zlib so finish here +if test "x${TYPE}" = "xminimal"; then + echo "Finished."; + exit 0; +fi + +echo "Removing libjpeg" +if [ ! -f ${JPEG_SRC}/jdhuff.c ]; then # some file that should definitely exist + echo "${JPEG_SRC} does not contain jpeg sources. Refusing to proceed." + exit 1 +fi + +rm -vf ${JPEG_SRC}/jcomapi.c +rm -vf ${JPEG_SRC}/jdapimin.c +rm -vf ${JPEG_SRC}/jdapistd.c +rm -vf ${JPEG_SRC}/jdcoefct.c +rm -vf ${JPEG_SRC}/jdcolor.c +rm -vf ${JPEG_SRC}/jdct.h +rm -vf ${JPEG_SRC}/jddctmgr.c +rm -vf ${JPEG_SRC}/jdhuff.c +rm -vf ${JPEG_SRC}/jdhuff.h +rm -vf ${JPEG_SRC}/jdinput.c +rm -vf ${JPEG_SRC}/jdmainct.c +rm -vf ${JPEG_SRC}/jdmarker.c +rm -vf ${JPEG_SRC}/jdmaster.c +rm -vf ${JPEG_SRC}/jdmerge.c +rm -vf ${JPEG_SRC}/jdphuff.c +rm -vf ${JPEG_SRC}/jdpostct.c +rm -vf ${JPEG_SRC}/jdsample.c +rm -vf ${JPEG_SRC}/jerror.c +rm -vf ${JPEG_SRC}/jerror.h +rm -vf ${JPEG_SRC}/jidctflt.c +rm -vf ${JPEG_SRC}/jidctfst.c +rm -vf ${JPEG_SRC}/jidctint.c +rm -vf ${JPEG_SRC}/jidctred.c +rm -vf ${JPEG_SRC}/jinclude.h +rm -vf ${JPEG_SRC}/jmemmgr.c +rm -vf ${JPEG_SRC}/jmemsys.h +rm -vf ${JPEG_SRC}/jmemnobs.c +rm -vf ${JPEG_SRC}/jmorecfg.h +rm -vf ${JPEG_SRC}/jpegint.h +rm -vf ${JPEG_SRC}/jpeglib.h +rm -vf ${JPEG_SRC}/jquant1.c +rm -vf ${JPEG_SRC}/jquant2.c +rm -vf ${JPEG_SRC}/jutils.c +rm -vf ${JPEG_SRC}/jcapimin.c +rm -vf ${JPEG_SRC}/jcapistd.c +rm -vf ${JPEG_SRC}/jccoefct.c +rm -vf ${JPEG_SRC}/jccolor.c +rm -vf ${JPEG_SRC}/jcdctmgr.c +rm -vf ${JPEG_SRC}/jchuff.c +rm -vf ${JPEG_SRC}/jchuff.h +rm -vf ${JPEG_SRC}/jcinit.c +rm -vf ${JPEG_SRC}/jconfig.h +rm -vf ${JPEG_SRC}/jcmainct.c +rm -vf ${JPEG_SRC}/jcmarker.c +rm -vf ${JPEG_SRC}/jcmaster.c +rm -vf ${JPEG_SRC}/jcparam.c +rm -vf ${JPEG_SRC}/jcphuff.c +rm -vf ${JPEG_SRC}/jcprepct.c +rm -vf ${JPEG_SRC}/jcsample.c +rm -vf ${JPEG_SRC}/jctrans.c +rm -vf ${JPEG_SRC}/jdtrans.c +rm -vf ${JPEG_SRC}/jfdctflt.c +rm -vf ${JPEG_SRC}/jfdctfst.c +rm -vf ${JPEG_SRC}/jfdctint.c +rm -vf ${JPEG_SRC}/jversion.h +rm -vf ${JPEG_SRC}/README + +echo "Removing giflib" +if [ ! -d ${GIF_SRC} ]; then + echo "${GIF_SRC} does not exist. Refusing to proceed." + exit 1 +fi +rm -rvf ${GIF_SRC} + +echo "Removing libpng" +if [ ! -d ${PNG_SRC} ]; then + echo "${PNG_SRC} does not exist. Refusing to proceed." + exit 1 +fi +rm -rvf ${PNG_SRC} + +echo "Removing lcms" +if [ ! -d ${LCMS_SRC} ]; then + echo "${LCMS_SRC} does not exist. Refusing to proceed." + exit 1 +fi +rm -vf ${LCMS_SRC}/cmscam02.c +rm -vf ${LCMS_SRC}/cmscgats.c +rm -vf ${LCMS_SRC}/cmscnvrt.c +rm -vf ${LCMS_SRC}/cmserr.c +rm -vf ${LCMS_SRC}/cmsgamma.c +rm -vf ${LCMS_SRC}/cmsgmt.c +rm -vf ${LCMS_SRC}/cmshalf.c +rm -vf ${LCMS_SRC}/cmsintrp.c +rm -vf ${LCMS_SRC}/cmsio0.c +rm -vf ${LCMS_SRC}/cmsio1.c +rm -vf ${LCMS_SRC}/cmslut.c +rm -vf ${LCMS_SRC}/cmsmd5.c +rm -vf ${LCMS_SRC}/cmsmtrx.c +rm -vf ${LCMS_SRC}/cmsnamed.c +rm -vf ${LCMS_SRC}/cmsopt.c +rm -vf ${LCMS_SRC}/cmspack.c +rm -vf ${LCMS_SRC}/cmspcs.c +rm -vf ${LCMS_SRC}/cmsplugin.c +rm -vf ${LCMS_SRC}/cmsps2.c +rm -vf ${LCMS_SRC}/cmssamp.c +rm -vf ${LCMS_SRC}/cmssm.c +rm -vf ${LCMS_SRC}/cmstypes.c +rm -vf ${LCMS_SRC}/cmsvirt.c +rm -vf ${LCMS_SRC}/cmswtpnt.c +rm -vf ${LCMS_SRC}/cmsxform.c +rm -vf ${LCMS_SRC}/lcms2.h +rm -vf ${LCMS_SRC}/lcms2_internal.h +rm -vf ${LCMS_SRC}/lcms2_plugin.h diff --git a/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch b/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch new file mode 100644 index 0000000..3042186 --- /dev/null +++ b/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch @@ -0,0 +1,16 @@ +diff -r 618ad1237e73 src/java.desktop/share/classes/java/awt/Toolkit.java +--- a/src/java.desktop/share/classes/java/awt/Toolkit.java Thu Jun 13 19:37:49 2019 +0200 ++++ b/src/java.desktop/share/classes/java/awt/Toolkit.java Thu Jul 04 10:35:42 2019 +0200 +@@ -595,7 +595,11 @@ + toolkit = new HeadlessToolkit(toolkit); + } + if (!GraphicsEnvironment.isHeadless()) { +- loadAssistiveTechnologies(); ++ try { ++ loadAssistiveTechnologies(); ++ } catch (AWTError error) { ++ // ignore silently ++ } + } + } + return toolkit; diff --git a/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch b/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch new file mode 100644 index 0000000..7be1fae --- /dev/null +++ b/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch @@ -0,0 +1,12 @@ +diff --git openjdk/src/java.base/share/conf/security/java.security openjdk/src/java.base/share/conf/security/java.security +index 534bdae5a16..2df2b59cbf6 100644 +--- openjdk/src/java.base/share/conf/security/java.security ++++ openjdk/src/java.base/share/conf/security/java.security +@@ -78,6 +78,7 @@ security.provider.tbd=SunMSCAPI + security.provider.tbd=Apple + #endif + security.provider.tbd=SunPKCS11 ++#security.provider.tbd=SunPKCS11 ${java.home}/lib/security/nss.cfg + + # + # A list of preferred providers for specific algorithms. These providers will diff --git a/rh1648644-java_access_bridge_privileged_security.patch b/rh1648644-java_access_bridge_privileged_security.patch new file mode 100644 index 0000000..53026ad --- /dev/null +++ b/rh1648644-java_access_bridge_privileged_security.patch @@ -0,0 +1,20 @@ +--- openjdk/src/java.base/share/conf/security/java.security ++++ openjdk/src/java.base/share/conf/security/java.security +@@ -304,6 +304,8 @@ + # + package.access=sun.misc.,\ + sun.reflect.,\ ++ org.GNOME.Accessibility.,\ ++ org.GNOME.Bonobo.,\ + + # + # List of comma-separated packages that start with or equal this string +@@ -316,6 +318,8 @@ + # + package.definition=sun.misc.,\ + sun.reflect.,\ ++ org.GNOME.Accessibility.,\ ++ org.GNOME.Bonobo.,\ + + # + # Determines whether this properties file can be appended to diff --git a/rh1655466-global_crypto_and_fips.patch b/rh1655466-global_crypto_and_fips.patch new file mode 100644 index 0000000..80cd91c --- /dev/null +++ b/rh1655466-global_crypto_and_fips.patch @@ -0,0 +1,205 @@ +diff --git a/src/java.base/share/classes/javopenjdk.orig///security/Security.java openjdk///src/java.base/share/classes/java/security/Security.java +--- openjdk.orig/src/java.base/share/classes/java/security/Security.java ++++ openjdk/src/java.base/share/classes/java/security/Security.java +@@ -196,26 +196,8 @@ + if (disableSystemProps == null && + "true".equalsIgnoreCase(props.getProperty + ("security.useSystemPropertiesFile"))) { +- +- // now load the system file, if it exists, so its values +- // will win if they conflict with the earlier values +- try (BufferedInputStream bis = +- new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) { +- props.load(bis); ++ if (SystemConfigurator.configure(props)) { + loadedProps = true; +- +- if (sdebug != null) { +- sdebug.println("reading system security properties file " + +- SYSTEM_PROPERTIES); +- sdebug.println(props.toString()); +- } +- } catch (IOException e) { +- if (sdebug != null) { +- sdebug.println +- ("unable to load security properties from " + +- SYSTEM_PROPERTIES); +- e.printStackTrace(); +- } + } + } + +diff --git a/src/java.base/share/classes/javopenjdk.orig///security/SystemConfigurator.java openjdk///src/java.base/share/classes/java/security/SystemConfigurator.java +new file mode 100644 +--- /dev/null ++++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java +@@ -0,0 +1,151 @@ ++/* ++ * Copyright (c) 2019, Red Hat, Inc. ++ * ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++package java.security; ++ ++import java.io.BufferedInputStream; ++import java.io.FileInputStream; ++import java.io.IOException; ++ ++import java.nio.file.Files; ++import java.nio.file.Path; ++ ++import java.util.Iterator; ++import java.util.Map.Entry; ++import java.util.Properties; ++import java.util.function.Consumer; ++import java.util.regex.Matcher; ++import java.util.regex.Pattern; ++ ++import sun.security.util.Debug; ++ ++/** ++ * Internal class to align OpenJDK with global crypto-policies. ++ * Called from java.security.Security class initialization, ++ * during startup. ++ * ++ */ ++ ++class SystemConfigurator { ++ ++ private static final Debug sdebug = ++ Debug.getInstance("properties"); ++ ++ private static final String CRYPTO_POLICIES_BASE_DIR = ++ "/etc/crypto-policies"; ++ ++ private static final String CRYPTO_POLICIES_JAVA_CONFIG = ++ CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config"; ++ ++ private static final String CRYPTO_POLICIES_CONFIG = ++ CRYPTO_POLICIES_BASE_DIR + "/config"; ++ ++ private static final class SecurityProviderInfo { ++ int number; ++ String key; ++ String value; ++ SecurityProviderInfo(int number, String key, String value) { ++ this.number = number; ++ this.key = key; ++ this.value = value; ++ } ++ } ++ ++ /* ++ * Invoked when java.security.Security class is initialized, if ++ * java.security.disableSystemPropertiesFile property is not set and ++ * security.useSystemPropertiesFile is true. ++ */ ++ static boolean configure(Properties props) { ++ boolean loadedProps = false; ++ ++ try (BufferedInputStream bis = ++ new BufferedInputStream( ++ new FileInputStream(CRYPTO_POLICIES_JAVA_CONFIG))) { ++ props.load(bis); ++ loadedProps = true; ++ if (sdebug != null) { ++ sdebug.println("reading system security properties file " + ++ CRYPTO_POLICIES_JAVA_CONFIG); ++ sdebug.println(props.toString()); ++ } ++ } catch (IOException e) { ++ if (sdebug != null) { ++ sdebug.println("unable to load security properties from " + ++ CRYPTO_POLICIES_JAVA_CONFIG); ++ e.printStackTrace(); ++ } ++ } ++ ++ try { ++ if (enableFips()) { ++ if (sdebug != null) { sdebug.println("FIPS mode detected"); } ++ loadedProps = false; ++ // Remove all security providers ++ Iterator<Entry<Object, Object>> i = props.entrySet().iterator(); ++ while (i.hasNext()) { ++ Entry<Object, Object> e = i.next(); ++ if (((String) e.getKey()).startsWith("security.provider")) { ++ if (sdebug != null) { sdebug.println("Removing provider: " + e); } ++ i.remove(); ++ } ++ } ++ // Add FIPS security providers ++ String fipsProviderValue = null; ++ for (int n = 1; ++ (fipsProviderValue = (String) props.get("fips.provider." + n)) != null; n++) { ++ String fipsProviderKey = "security.provider." + n; ++ if (sdebug != null) { ++ sdebug.println("Adding provider " + n + ": " + ++ fipsProviderKey + "=" + fipsProviderValue); ++ } ++ props.put(fipsProviderKey, fipsProviderValue); ++ } ++ loadedProps = true; ++ } ++ } catch (Exception e) { ++ if (sdebug != null) { ++ sdebug.println("unable to load FIPS configuration"); ++ e.printStackTrace(); ++ } ++ } ++ return loadedProps; ++ } ++ ++ /* ++ * FIPS is enabled only if crypto-policies are set to "FIPS" ++ * and the com.redhat.fips property is true. ++ */ ++ private static boolean enableFips() throws Exception { ++ boolean fipsEnabled = Boolean.valueOf(System.getProperty("com.redhat.fips", "true")); ++ if (fipsEnabled) { ++ String cryptoPoliciesConfig = new String(Files.readAllBytes(Path.of(CRYPTO_POLICIES_CONFIG))); ++ if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); } ++ Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE); ++ return pattern.matcher(cryptoPoliciesConfig).find(); ++ } else { ++ return false; ++ } ++ } ++} +diff --git openjdk.orig///src/java.base/share/conf/security/java.security openjdk///src/java.base/share/conf/security/java.security +--- openjdk.orig/src/java.base/share/conf/security/java.security ++++ openjdk/src/java.base/share/conf/security/java.security +@@ -87,6 +87,14 @@ + #security.provider.tbd=SunPKCS11 ${java.home}/lib/security/nss.cfg + + # ++# Security providers used when global crypto-policies are set to FIPS. ++# ++fips.provider.1=SunPKCS11 ${java.home}/conf/security/nss.fips.cfg ++fips.provider.2=SUN ++fips.provider.3=SunEC ++fips.provider.4=SunJSSE ++ ++# + # A list of preferred providers for specific algorithms. These providers will + # be searched for matching algorithms before the list of registered providers. + # Entries containing errors (parsing, etc) will be ignored. Use the diff --git a/rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch b/rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch new file mode 100644 index 0000000..5e2b254 --- /dev/null +++ b/rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch @@ -0,0 +1,13 @@ +--- openjdk/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java 2013-03-01 10:48:12.038189968 +0100 ++++ openjdk/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java 2013-03-01 10:48:11.913188505 +0100 +@@ -48,8 +48,8 @@ + + private final static String PROP_NAME = "sun.security.smartcardio.library"; + +- private final static String LIB1 = "/usr/$LIBISA/libpcsclite.so"; +- private final static String LIB2 = "/usr/local/$LIBISA/libpcsclite.so"; ++ private final static String LIB1 = "/usr/$LIBISA/libpcsclite.so.1"; ++ private final static String LIB2 = "/usr/local/$LIBISA/libpcsclite.so.1"; + private final static String PCSC_FRAMEWORK = "/System/Library/Frameworks/PCSC.framework/Versions/Current/PCSC"; + + PlatformPCSC() { diff --git a/rh1750419-redhat_alt_java.patch b/rh1750419-redhat_alt_java.patch new file mode 100644 index 0000000..88f5e5a --- /dev/null +++ b/rh1750419-redhat_alt_java.patch @@ -0,0 +1,117 @@ +diff --git openjdk.orig/make/modules/java.base/Launcher.gmk openjdk/make/modules/java.base/Launcher.gmk +index 700ddefda49..2882de68eb2 100644 +--- openjdk.orig/make/modules/java.base/Launcher.gmk ++++ openjdk/make/modules/java.base/Launcher.gmk +@@ -41,6 +41,14 @@ $(eval $(call SetupBuildLauncher, java, \ + OPTIMIZATION := HIGH, \ + )) + ++#Wno-error=cpp is present to allow commented warning in ifdef part of main.c ++$(eval $(call SetupBuildLauncher, alt-java, \ ++ CFLAGS := -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES -DREDHAT_ALT_JAVA -Wno-error=cpp, \ ++ EXTRA_RCFLAGS := $(JAVA_RCFLAGS), \ ++ VERSION_INFO_RESOURCE := $(JAVA_VERSION_INFO_RESOURCE), \ ++ OPTIMIZATION := HIGH, \ ++)) ++ + ifeq ($(call isTargetOs, windows), true) + $(eval $(call SetupBuildLauncher, javaw, \ + CFLAGS := -DJAVAW -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES, \ +diff --git openjdk.orig/src/java.base/share/native/launcher/alt_main.h openjdk/src/java.base/share/native/launcher/alt_main.h +new file mode 100644 +index 00000000000..697df2898ac +--- /dev/null ++++ openjdk/src/java.base/share/native/launcher/alt_main.h +@@ -0,0 +1,73 @@ ++/* ++ * Copyright (c) 2019, Red Hat, Inc. All rights reserved. ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. Oracle designates this ++ * particular file as subject to the "Classpath" exception as provided ++ * by Oracle in the LICENSE file that accompanied this code. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++#ifdef REDHAT_ALT_JAVA ++ ++#include <sys/prctl.h> ++ ++ ++/* Per task speculation control */ ++#ifndef PR_GET_SPECULATION_CTRL ++# define PR_GET_SPECULATION_CTRL 52 ++#endif ++#ifndef PR_SET_SPECULATION_CTRL ++# define PR_SET_SPECULATION_CTRL 53 ++#endif ++/* Speculation control variants */ ++#ifndef PR_SPEC_STORE_BYPASS ++# define PR_SPEC_STORE_BYPASS 0 ++#endif ++/* Return and control values for PR_SET/GET_SPECULATION_CTRL */ ++ ++#ifndef PR_SPEC_NOT_AFFECTED ++# define PR_SPEC_NOT_AFFECTED 0 ++#endif ++#ifndef PR_SPEC_PRCTL ++# define PR_SPEC_PRCTL (1UL << 0) ++#endif ++#ifndef PR_SPEC_ENABLE ++# define PR_SPEC_ENABLE (1UL << 1) ++#endif ++#ifndef PR_SPEC_DISABLE ++# define PR_SPEC_DISABLE (1UL << 2) ++#endif ++#ifndef PR_SPEC_FORCE_DISABLE ++# define PR_SPEC_FORCE_DISABLE (1UL << 3) ++#endif ++#ifndef PR_SPEC_DISABLE_NOEXEC ++# define PR_SPEC_DISABLE_NOEXEC (1UL << 4) ++#endif ++ ++static void set_speculation() __attribute__((constructor)); ++static void set_speculation() { ++ if ( prctl(PR_SET_SPECULATION_CTRL, ++ PR_SPEC_STORE_BYPASS, ++ PR_SPEC_DISABLE_NOEXEC, 0, 0) == 0 ) { ++ return; ++ } ++ prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0); ++} ++ ++#endif // REDHAT_ALT_JAVA +diff --git openjdk.orig/src/java.base/share/native/launcher/main.c openjdk/src/java.base/share/native/launcher/main.c +index b734fe2ba78..79dc8307650 100644 +--- openjdk.orig/src/java.base/share/native/launcher/main.c ++++ openjdk/src/java.base/share/native/launcher/main.c +@@ -34,6 +34,14 @@ + #include "jli_util.h" + #include "jni.h" + ++#ifdef REDHAT_ALT_JAVA ++#if defined(__linux__) && defined(__x86_64__) ++#include "alt_main.h" ++#else ++#warning alt-java requested but SSB mitigation not available on this platform. ++#endif ++#endif ++ + #ifdef _MSC_VER + #if _MSC_VER > 1400 && _MSC_VER < 1600 + diff --git a/rh1818909-fips_default_keystore_type.patch b/rh1818909-fips_default_keystore_type.patch new file mode 100644 index 0000000..ff34f3e --- /dev/null +++ b/rh1818909-fips_default_keystore_type.patch @@ -0,0 +1,52 @@ +diff -r 6efbd7b35a10 src/share/classes/java/security/SystemConfigurator.java +--- openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java Thu Jan 23 18:22:31 2020 -0300 ++++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java Mon Mar 02 19:20:17 2020 -0300 +@@ -123,6 +123,33 @@ + } + props.put(fipsProviderKey, fipsProviderValue); + } ++ // Add other security properties ++ String keystoreTypeValue = (String) props.get("fips.keystore.type"); ++ if (keystoreTypeValue != null) { ++ String nonFipsKeystoreType = props.getProperty("keystore.type"); ++ props.put("keystore.type", keystoreTypeValue); ++ if (keystoreTypeValue.equals("PKCS11")) { ++ // If keystore.type is PKCS11, javax.net.ssl.keyStore ++ // must be "NONE". See JDK-8238264. ++ System.setProperty("javax.net.ssl.keyStore", "NONE"); ++ } ++ if (System.getProperty("javax.net.ssl.trustStoreType") == null) { ++ // If no trustStoreType has been set, use the ++ // previous keystore.type under FIPS mode. In ++ // a default configuration, the Trust Store will ++ // be 'cacerts' (JKS type). ++ System.setProperty("javax.net.ssl.trustStoreType", ++ nonFipsKeystoreType); ++ } ++ if (sdebug != null) { ++ sdebug.println("FIPS mode default keystore.type = " + ++ keystoreTypeValue); ++ sdebug.println("FIPS mode javax.net.ssl.keyStore = " + ++ System.getProperty("javax.net.ssl.keyStore", "")); ++ sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " + ++ System.getProperty("javax.net.ssl.trustStoreType", "")); ++ } ++ } + loadedProps = true; + } + } catch (Exception e) { +diff -r 6efbd7b35a10 src/share/lib/security/java.security-linux +--- openjdk.orig/src/java.base/share/conf/security/java.security Thu Jan 23 18:22:31 2020 -0300 ++++ openjdk/src/java.base/share/conf/security/java.security Mon Mar 02 19:20:17 2020 -0300 +@@ -299,6 +299,11 @@ + keystore.type=pkcs12 + + # ++# Default keystore type used when global crypto-policies are set to FIPS. ++# ++fips.keystore.type=PKCS11 ++ ++# + # Controls compatibility mode for JKS and PKCS12 keystore types. + # + # When set to 'true', both JKS and PKCS12 keystore types support loading diff --git a/rh1860986-disable_tlsv1.3_in_fips_mode.patch b/rh1860986-disable_tlsv1.3_in_fips_mode.patch new file mode 100644 index 0000000..8dcd9a8 --- /dev/null +++ b/rh1860986-disable_tlsv1.3_in_fips_mode.patch @@ -0,0 +1,318 @@ +diff --git openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java +index f9baf8c9742..60fa75cab45 100644 +--- openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java ++++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java +@@ -1,11 +1,13 @@ + /* +- * Copyright (c) 2019, Red Hat, Inc. ++ * Copyright (c) 2019, 2020, Red Hat, Inc. + * + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as +- * published by the Free Software Foundation. ++ * published by the Free Software Foundation. Oracle designates this ++ * particular file as subject to the "Classpath" exception as provided ++ * by Oracle in the LICENSE file that accompanied this code. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or +@@ -34,10 +36,10 @@ import java.nio.file.Path; + import java.util.Iterator; + import java.util.Map.Entry; + import java.util.Properties; +-import java.util.function.Consumer; +-import java.util.regex.Matcher; + import java.util.regex.Pattern; + ++import jdk.internal.access.JavaSecuritySystemConfiguratorAccess; ++import jdk.internal.access.SharedSecrets; + import sun.security.util.Debug; + + /** +@@ -47,7 +49,7 @@ import sun.security.util.Debug; + * + */ + +-class SystemConfigurator { ++final class SystemConfigurator { + + private static final Debug sdebug = + Debug.getInstance("properties"); +@@ -61,15 +63,16 @@ class SystemConfigurator { + private static final String CRYPTO_POLICIES_CONFIG = + CRYPTO_POLICIES_BASE_DIR + "/config"; + +- private static final class SecurityProviderInfo { +- int number; +- String key; +- String value; +- SecurityProviderInfo(int number, String key, String value) { +- this.number = number; +- this.key = key; +- this.value = value; +- } ++ private static boolean systemFipsEnabled = false; ++ ++ static { ++ SharedSecrets.setJavaSecuritySystemConfiguratorAccess( ++ new JavaSecuritySystemConfiguratorAccess() { ++ @Override ++ public boolean isSystemFipsEnabled() { ++ return SystemConfigurator.isSystemFipsEnabled(); ++ } ++ }); + } + + /* +@@ -128,9 +131,9 @@ class SystemConfigurator { + String nonFipsKeystoreType = props.getProperty("keystore.type"); + props.put("keystore.type", keystoreTypeValue); + if (keystoreTypeValue.equals("PKCS11")) { +- // If keystore.type is PKCS11, javax.net.ssl.keyStore +- // must be "NONE". See JDK-8238264. +- System.setProperty("javax.net.ssl.keyStore", "NONE"); ++ // If keystore.type is PKCS11, javax.net.ssl.keyStore ++ // must be "NONE". See JDK-8238264. ++ System.setProperty("javax.net.ssl.keyStore", "NONE"); + } + if (System.getProperty("javax.net.ssl.trustStoreType") == null) { + // If no trustStoreType has been set, use the +@@ -144,12 +147,13 @@ class SystemConfigurator { + sdebug.println("FIPS mode default keystore.type = " + + keystoreTypeValue); + sdebug.println("FIPS mode javax.net.ssl.keyStore = " + +- System.getProperty("javax.net.ssl.keyStore", "")); ++ System.getProperty("javax.net.ssl.keyStore", "")); + sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " + + System.getProperty("javax.net.ssl.trustStoreType", "")); + } + } + loadedProps = true; ++ systemFipsEnabled = true; + } + } catch (Exception e) { + if (sdebug != null) { +@@ -160,13 +164,30 @@ class SystemConfigurator { + return loadedProps; + } + ++ /** ++ * Returns whether or not global system FIPS alignment is enabled. ++ * ++ * Value is always 'false' before java.security.Security class is ++ * initialized. ++ * ++ * Call from out of this package through SharedSecrets: ++ * SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ * .isSystemFipsEnabled(); ++ * ++ * @return a boolean value indicating whether or not global ++ * system FIPS alignment is enabled. ++ */ ++ static boolean isSystemFipsEnabled() { ++ return systemFipsEnabled; ++ } ++ + /* + * FIPS is enabled only if crypto-policies are set to "FIPS" + * and the com.redhat.fips property is true. + */ + private static boolean enableFips() throws Exception { +- boolean fipsEnabled = Boolean.valueOf(System.getProperty("com.redhat.fips", "true")); +- if (fipsEnabled) { ++ boolean shouldEnable = Boolean.valueOf(System.getProperty("com.redhat.fips", "true")); ++ if (shouldEnable) { + String cryptoPoliciesConfig = new String(Files.readAllBytes(Path.of(CRYPTO_POLICIES_CONFIG))); + if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); } + Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE); +diff --git openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java +new file mode 100644 +index 00000000000..a31e93ec02e +--- /dev/null ++++ openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java +@@ -0,0 +1,30 @@ ++/* ++ * Copyright (c) 2020, Red Hat, Inc. ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. Oracle designates this ++ * particular file as subject to the "Classpath" exception as provided ++ * by Oracle in the LICENSE file that accompanied this code. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++package jdk.internal.access; ++ ++public interface JavaSecuritySystemConfiguratorAccess { ++ boolean isSystemFipsEnabled(); ++} +diff --git openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java +index f6d3638c3dd..5a2c9eb0c46 100644 +--- openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java ++++ openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java +@@ -81,6 +81,7 @@ public class SharedSecrets { + private static JavaSecuritySpecAccess javaSecuritySpecAccess; + private static JavaxCryptoSealedObjectAccess javaxCryptoSealedObjectAccess; + private static JavaxCryptoSpecAccess javaxCryptoSpecAccess; ++ private static JavaSecuritySystemConfiguratorAccess javaSecuritySystemConfiguratorAccess; + + public static void setJavaUtilCollectionAccess(JavaUtilCollectionAccess juca) { + javaUtilCollectionAccess = juca; +@@ -442,4 +443,12 @@ public class SharedSecrets { + MethodHandles.lookup().ensureInitialized(c); + } catch (IllegalAccessException e) {} + } ++ ++ public static void setJavaSecuritySystemConfiguratorAccess(JavaSecuritySystemConfiguratorAccess jssca) { ++ javaSecuritySystemConfiguratorAccess = jssca; ++ } ++ ++ public static JavaSecuritySystemConfiguratorAccess getJavaSecuritySystemConfiguratorAccess() { ++ return javaSecuritySystemConfiguratorAccess; ++ } + } +diff --git openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java +index 6ffdfeda18d..775b185fb06 100644 +--- openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java ++++ openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java +@@ -32,6 +32,7 @@ import java.security.cert.*; + import java.util.*; + import java.util.concurrent.locks.ReentrantLock; + import javax.net.ssl.*; ++import jdk.internal.access.SharedSecrets; + import sun.security.action.GetPropertyAction; + import sun.security.provider.certpath.AlgorithmChecker; + import sun.security.validator.Validator; +@@ -536,22 +537,40 @@ public abstract class SSLContextImpl extends SSLContextSpi { + private static final List<CipherSuite> serverDefaultCipherSuites; + + static { +- supportedProtocols = Arrays.asList( +- ProtocolVersion.TLS13, +- ProtocolVersion.TLS12, +- ProtocolVersion.TLS11, +- ProtocolVersion.TLS10, +- ProtocolVersion.SSL30, +- ProtocolVersion.SSL20Hello +- ); +- +- serverDefaultProtocols = getAvailableProtocols( +- new ProtocolVersion[] { +- ProtocolVersion.TLS13, +- ProtocolVersion.TLS12, +- ProtocolVersion.TLS11, +- ProtocolVersion.TLS10 +- }); ++ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ .isSystemFipsEnabled()) { ++ // RH1860986: TLSv1.3 key derivation not supported with ++ // the Security Providers available in system FIPS mode. ++ supportedProtocols = Arrays.asList( ++ ProtocolVersion.TLS12, ++ ProtocolVersion.TLS11, ++ ProtocolVersion.TLS10 ++ ); ++ ++ serverDefaultProtocols = getAvailableProtocols( ++ new ProtocolVersion[] { ++ ProtocolVersion.TLS12, ++ ProtocolVersion.TLS11, ++ ProtocolVersion.TLS10 ++ }); ++ } else { ++ supportedProtocols = Arrays.asList( ++ ProtocolVersion.TLS13, ++ ProtocolVersion.TLS12, ++ ProtocolVersion.TLS11, ++ ProtocolVersion.TLS10, ++ ProtocolVersion.SSL30, ++ ProtocolVersion.SSL20Hello ++ ); ++ ++ serverDefaultProtocols = getAvailableProtocols( ++ new ProtocolVersion[] { ++ ProtocolVersion.TLS13, ++ ProtocolVersion.TLS12, ++ ProtocolVersion.TLS11, ++ ProtocolVersion.TLS10 ++ }); ++ } + + supportedCipherSuites = getApplicableSupportedCipherSuites( + supportedProtocols); +@@ -842,12 +861,23 @@ public abstract class SSLContextImpl extends SSLContextSpi { + ProtocolVersion[] candidates; + if (refactored.isEmpty()) { + // Client and server use the same default protocols. +- candidates = new ProtocolVersion[] { +- ProtocolVersion.TLS13, +- ProtocolVersion.TLS12, +- ProtocolVersion.TLS11, +- ProtocolVersion.TLS10 +- }; ++ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ .isSystemFipsEnabled()) { ++ // RH1860986: TLSv1.3 key derivation not supported with ++ // the Security Providers available in system FIPS mode. ++ candidates = new ProtocolVersion[] { ++ ProtocolVersion.TLS12, ++ ProtocolVersion.TLS11, ++ ProtocolVersion.TLS10 ++ }; ++ } else { ++ candidates = new ProtocolVersion[] { ++ ProtocolVersion.TLS13, ++ ProtocolVersion.TLS12, ++ ProtocolVersion.TLS11, ++ ProtocolVersion.TLS10 ++ }; ++ } + } else { + // Use the customized TLS protocols. + candidates = +diff --git openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java +index 894e26dfad8..8b16378b96b 100644 +--- openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java ++++ openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java +@@ -27,6 +27,8 @@ package sun.security.ssl; + + import java.security.*; + import java.util.*; ++ ++import jdk.internal.access.SharedSecrets; + import static sun.security.util.SecurityConstants.PROVIDER_VER; + + /** +@@ -102,8 +104,13 @@ public class SunJSSE extends java.security.Provider { + "sun.security.ssl.SSLContextImpl$TLS11Context", null, null); + ps("SSLContext", "TLSv1.2", + "sun.security.ssl.SSLContextImpl$TLS12Context", null, null); +- ps("SSLContext", "TLSv1.3", +- "sun.security.ssl.SSLContextImpl$TLS13Context", null, null); ++ if (!SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ .isSystemFipsEnabled()) { ++ // RH1860986: TLSv1.3 key derivation not supported with ++ // the Security Providers available in system FIPS mode. ++ ps("SSLContext", "TLSv1.3", ++ "sun.security.ssl.SSLContextImpl$TLS13Context", null, null); ++ } + ps("SSLContext", "TLS", + "sun.security.ssl.SSLContextImpl$TLSContext", + List.of("SSL"), null); diff --git a/rh1915071-always_initialise_configurator_access.patch b/rh1915071-always_initialise_configurator_access.patch new file mode 100644 index 0000000..513fbbf --- /dev/null +++ b/rh1915071-always_initialise_configurator_access.patch @@ -0,0 +1,70 @@ +diff --git openjdk/src/java.base/share/classes/java/security/Security.java openjdk/src/java.base/share/classes/java/security/Security.java +index f1633afb627..ce32c939253 100644 +--- openjdk/src/java.base/share/classes/java/security/Security.java ++++ openjdk/src/java.base/share/classes/java/security/Security.java +@@ -32,6 +32,7 @@ import java.net.URL; + + import jdk.internal.event.EventHelper; + import jdk.internal.event.SecurityPropertyModificationEvent; ++import jdk.internal.access.JavaSecuritySystemConfiguratorAccess; + import jdk.internal.access.SharedSecrets; + import jdk.internal.util.StaticProperty; + import sun.security.util.Debug; +@@ -74,6 +75,15 @@ public final class Security { + } + + static { ++ // Initialise here as used by code with system properties disabled ++ SharedSecrets.setJavaSecuritySystemConfiguratorAccess( ++ new JavaSecuritySystemConfiguratorAccess() { ++ @Override ++ public boolean isSystemFipsEnabled() { ++ return SystemConfigurator.isSystemFipsEnabled(); ++ } ++ }); ++ + // doPrivileged here because there are multiple + // things in initialize that might require privs. + // (the FileInputStream call and the File.exists call, +@@ -194,9 +204,8 @@ public final class Security { + } + + String disableSystemProps = System.getProperty("java.security.disableSystemPropertiesFile"); +- if (disableSystemProps == null && +- "true".equalsIgnoreCase(props.getProperty +- ("security.useSystemPropertiesFile"))) { ++ if ((disableSystemProps == null || "false".equalsIgnoreCase(disableSystemProps)) && ++ "true".equalsIgnoreCase(props.getProperty("security.useSystemPropertiesFile"))) { + if (SystemConfigurator.configure(props)) { + loadedProps = true; + } +diff --git openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java +index 60fa75cab45..10b54aa4ce4 100644 +--- openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java ++++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java +@@ -38,8 +38,6 @@ import java.util.Map.Entry; + import java.util.Properties; + import java.util.regex.Pattern; + +-import jdk.internal.access.JavaSecuritySystemConfiguratorAccess; +-import jdk.internal.access.SharedSecrets; + import sun.security.util.Debug; + + /** +@@ -65,16 +63,6 @@ final class SystemConfigurator { + + private static boolean systemFipsEnabled = false; + +- static { +- SharedSecrets.setJavaSecuritySystemConfiguratorAccess( +- new JavaSecuritySystemConfiguratorAccess() { +- @Override +- public boolean isSystemFipsEnabled() { +- return SystemConfigurator.isSystemFipsEnabled(); +- } +- }); +- } +- + /* + * Invoked when java.security.Security class is initialized, if + * java.security.disableSystemPropertiesFile property is not set and diff --git a/rh1929465-dont_define_unused_throwioexception.patch b/rh1929465-dont_define_unused_throwioexception.patch new file mode 100644 index 0000000..eba090f --- /dev/null +++ b/rh1929465-dont_define_unused_throwioexception.patch @@ -0,0 +1,69 @@ +commit 90e344e7d4987af610fa0054c92d18fe1c2edd41 +Author: Andrew Hughes <gnu.andrew(a)redhat.com> +Date: Sat Aug 28 01:15:28 2021 +0100 + + RH1929465: Don't define unused throwIOException function when using NSS detection + +diff --git openjdk.orig/src/java.base/linux/native/libsystemconf/systemconf.c openjdk/src/java.base/linux/native/libsystemconf/systemconf.c +index 6f4656bfcb6..38919d6bb0f 100644 +--- openjdk.orig/src/java.base/linux/native/libsystemconf/systemconf.c ++++ openjdk/src/java.base/linux/native/libsystemconf/systemconf.c +@@ -34,14 +34,34 @@ + + #include "java_security_SystemConfigurator.h" + +-#define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled" + #define MSG_MAX_SIZE 96 + + static jmethodID debugPrintlnMethodID = NULL; + static jobject debugObj = NULL; + +-static void throwIOException(JNIEnv *env, const char *msg); +-static void dbgPrint(JNIEnv *env, const char* msg); ++// Only used when NSS is unavailable and FIPS_ENABLED_PATH is read ++#ifndef SYSCONF_NSS ++ ++#define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled" ++ ++static void throwIOException(JNIEnv *env, const char *msg) ++{ ++ jclass cls = (*env)->FindClass(env, "java/io/IOException"); ++ if (cls != 0) ++ (*env)->ThrowNew(env, cls, msg); ++} ++ ++#endif ++ ++static void dbgPrint(JNIEnv *env, const char* msg) ++{ ++ jstring jMsg; ++ if (debugObj != NULL) { ++ jMsg = (*env)->NewStringUTF(env, msg); ++ CHECK_NULL(jMsg); ++ (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg); ++ } ++} + + /* + * Class: java_security_SystemConfigurator +@@ -149,20 +169,3 @@ JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEn + + #endif // SYSCONF_NSS + } +- +-static void throwIOException(JNIEnv *env, const char *msg) +-{ +- jclass cls = (*env)->FindClass(env, "java/io/IOException"); +- if (cls != 0) +- (*env)->ThrowNew(env, cls, msg); +-} +- +-static void dbgPrint(JNIEnv *env, const char* msg) +-{ +- jstring jMsg; +- if (debugObj != NULL) { +- jMsg = (*env)->NewStringUTF(env, msg); +- CHECK_NULL(jMsg); +- (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg); +- } +-} diff --git a/rh1929465-improve_system_FIPS_detection.patch b/rh1929465-improve_system_FIPS_detection.patch new file mode 100644 index 0000000..4dfd1d4 --- /dev/null +++ b/rh1929465-improve_system_FIPS_detection.patch @@ -0,0 +1,428 @@ +diff --git openjdk/make/autoconf/lib-sysconf.m4 openjdk/make/autoconf/lib-sysconf.m4 +new file mode 100644 +index 00000000000..b2b1c1787da +--- /dev/null ++++ openjdk/make/autoconf/lib-sysconf.m4 +@@ -0,0 +1,84 @@ ++# ++# Copyright (c) 2021, Red Hat, Inc. ++# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++# ++# This code is free software; you can redistribute it and/or modify it ++# under the terms of the GNU General Public License version 2 only, as ++# published by the Free Software Foundation. Oracle designates this ++# particular file as subject to the "Classpath" exception as provided ++# by Oracle in the LICENSE file that accompanied this code. ++# ++# This code is distributed in the hope that it will be useful, but WITHOUT ++# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++# version 2 for more details (a copy is included in the LICENSE file that ++# accompanied this code). ++# ++# You should have received a copy of the GNU General Public License version ++# 2 along with this work; if not, write to the Free Software Foundation, ++# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++# ++# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++# or visit www.oracle.com if you need additional information or have any ++# questions. ++# ++ ++################################################################################ ++# Setup system configuration libraries ++################################################################################ ++AC_DEFUN_ONCE([LIB_SETUP_SYSCONF_LIBS], ++[ ++ ############################################################################### ++ # ++ # Check for the NSS library ++ # ++ ++ AC_MSG_CHECKING([whether to use the system NSS library with the System Configurator (libsysconf)]) ++ ++ # default is not available ++ DEFAULT_SYSCONF_NSS=no ++ ++ AC_ARG_ENABLE([sysconf-nss], [AS_HELP_STRING([--enable-sysconf-nss], ++ [build the System Configurator (libsysconf) using the system NSS library if available @<:@disabled@:>@])], ++ [ ++ case "${enableval}" in ++ yes) ++ sysconf_nss=yes ++ ;; ++ *) ++ sysconf_nss=no ++ ;; ++ esac ++ ], ++ [ ++ sysconf_nss=${DEFAULT_SYSCONF_NSS} ++ ]) ++ AC_MSG_RESULT([$sysconf_nss]) ++ ++ USE_SYSCONF_NSS=false ++ if test "x${sysconf_nss}" = "xyes"; then ++ PKG_CHECK_MODULES(NSS, nss >= 3.53, [NSS_FOUND=yes], [NSS_FOUND=no]) ++ if test "x${NSS_FOUND}" = "xyes"; then ++ AC_MSG_CHECKING([for system FIPS support in NSS]) ++ saved_libs="${LIBS}" ++ saved_cflags="${CFLAGS}" ++ CFLAGS="${CFLAGS} ${NSS_CFLAGS}" ++ LIBS="${LIBS} ${NSS_LIBS}" ++ AC_LANG_PUSH([C]) ++ AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <nss3/pk11pub.h>]], ++ [[SECMOD_GetSystemFIPSEnabled()]])], ++ [AC_MSG_RESULT([yes])], ++ [AC_MSG_RESULT([no]) ++ AC_MSG_ERROR([System NSS FIPS detection unavailable])]) ++ AC_LANG_POP([C]) ++ CFLAGS="${saved_cflags}" ++ LIBS="${saved_libs}" ++ USE_SYSCONF_NSS=true ++ else ++ dnl NSS 3.53 is the one that introduces the SECMOD_GetSystemFIPSEnabled API ++ dnl in nss3/pk11pub.h. ++ AC_MSG_ERROR([--enable-sysconf-nss specified, but NSS 3.53 or above not found.]) ++ fi ++ fi ++ AC_SUBST(USE_SYSCONF_NSS) ++]) +diff --git openjdk/make/autoconf/libraries.m4 openjdk/make/autoconf/libraries.m4 +index a65d91ee974..a8f054c1397 100644 +--- openjdk/make/autoconf/libraries.m4 ++++ openjdk/make/autoconf/libraries.m4 +@@ -33,6 +33,7 @@ m4_include([lib-std.m4]) + m4_include([lib-x11.m4]) + m4_include([lib-fontconfig.m4]) + m4_include([lib-tests.m4]) ++m4_include([lib-sysconf.m4]) + + ################################################################################ + # Determine which libraries are needed for this configuration +@@ -104,6 +105,7 @@ AC_DEFUN_ONCE([LIB_SETUP_LIBRARIES], + LIB_SETUP_BUNDLED_LIBS + LIB_SETUP_MISC_LIBS + LIB_TESTS_SETUP_GTEST ++ LIB_SETUP_SYSCONF_LIBS + + BASIC_JDKLIB_LIBS="" + if test "x$TOOLCHAIN_TYPE" != xmicrosoft; then +diff --git openjdk/make/autoconf/spec.gmk.in openjdk/make/autoconf/spec.gmk.in +index 29445c8c24f..9b1b512a34a 100644 +--- openjdk/make/autoconf/spec.gmk.in ++++ openjdk/make/autoconf/spec.gmk.in +@@ -834,6 +834,10 @@ INSTALL_SYSCONFDIR=@sysconfdir@ + # Libraries + # + ++USE_SYSCONF_NSS:=@USE_SYSCONF_NSS@ ++NSS_LIBS:=@NSS_LIBS@ ++NSS_CFLAGS:=@NSS_CFLAGS@ ++ + USE_EXTERNAL_LCMS:=@USE_EXTERNAL_LCMS@ + LCMS_CFLAGS:=@LCMS_CFLAGS@ + LCMS_LIBS:=@LCMS_LIBS@ +diff --git openjdk/make/modules/java.base/Lib.gmk openjdk/make/modules/java.base/Lib.gmk +index 5658ff342e5..cb7a56852f7 100644 +--- openjdk/make/modules/java.base/Lib.gmk ++++ openjdk/make/modules/java.base/Lib.gmk +@@ -167,6 +167,31 @@ ifeq ($(call isTargetOsType, unix), true) + endif + endif + ++################################################################################ ++# Create the systemconf library ++ ++LIBSYSTEMCONF_CFLAGS := ++LIBSYSTEMCONF_CXXFLAGS := ++ ++ifeq ($(USE_SYSCONF_NSS), true) ++ LIBSYSTEMCONF_CFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS ++ LIBSYSTEMCONF_CXXFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS ++endif ++ ++ifeq ($(OPENJDK_BUILD_OS), linux) ++ $(eval $(call SetupJdkLibrary, BUILD_LIBSYSTEMCONF, \ ++ NAME := systemconf, \ ++ OPTIMIZATION := LOW, \ ++ CFLAGS := $(CFLAGS_JDKLIB) $(LIBSYSTEMCONF_CFLAGS), \ ++ CXXFLAGS := $(CXXFLAGS_JDKLIB) $(LIBSYSTEMCONF_CXXFLAGS), \ ++ LDFLAGS := $(LDFLAGS_JDKLIB) \ ++ $(call SET_SHARED_LIBRARY_ORIGIN), \ ++ LIBS_unix := $(LIBDL) $(NSS_LIBS), \ ++ )) ++ ++ TARGETS += $(BUILD_LIBSYSTEMCONF) ++endif ++ + ################################################################################ + # Create the symbols file for static builds. + +diff --git openjdk/src/java.base/linux/native/libsystemconf/systemconf.c openjdk/src/java.base/linux/native/libsystemconf/systemconf.c +new file mode 100644 +index 00000000000..6f4656bfcb6 +--- /dev/null ++++ openjdk/src/java.base/linux/native/libsystemconf/systemconf.c +@@ -0,0 +1,168 @@ ++/* ++ * Copyright (c) 2021, Red Hat, Inc. ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. Oracle designates this ++ * particular file as subject to the "Classpath" exception as provided ++ * by Oracle in the LICENSE file that accompanied this code. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++#include <dlfcn.h> ++#include <jni.h> ++#include <jni_util.h> ++#include <stdio.h> ++ ++#ifdef SYSCONF_NSS ++#include <nss3/pk11pub.h> ++#endif //SYSCONF_NSS ++ ++#include "java_security_SystemConfigurator.h" ++ ++#define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled" ++#define MSG_MAX_SIZE 96 ++ ++static jmethodID debugPrintlnMethodID = NULL; ++static jobject debugObj = NULL; ++ ++static void throwIOException(JNIEnv *env, const char *msg); ++static void dbgPrint(JNIEnv *env, const char* msg); ++ ++/* ++ * Class: java_security_SystemConfigurator ++ * Method: JNI_OnLoad ++ */ ++JNIEXPORT jint JNICALL DEF_JNI_OnLoad(JavaVM *vm, void *reserved) ++{ ++ JNIEnv *env; ++ jclass sysConfCls, debugCls; ++ jfieldID sdebugFld; ++ ++ if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) { ++ return JNI_EVERSION; /* JNI version not supported */ ++ } ++ ++ sysConfCls = (*env)->FindClass(env,"java/security/SystemConfigurator"); ++ if (sysConfCls == NULL) { ++ printf("libsystemconf: SystemConfigurator class not found\n"); ++ return JNI_ERR; ++ } ++ sdebugFld = (*env)->GetStaticFieldID(env, sysConfCls, ++ "sdebug", "Lsun/security/util/Debug;"); ++ if (sdebugFld == NULL) { ++ printf("libsystemconf: SystemConfigurator::sdebug field not found\n"); ++ return JNI_ERR; ++ } ++ debugObj = (*env)->GetStaticObjectField(env, sysConfCls, sdebugFld); ++ if (debugObj != NULL) { ++ debugCls = (*env)->FindClass(env,"sun/security/util/Debug"); ++ if (debugCls == NULL) { ++ printf("libsystemconf: Debug class not found\n"); ++ return JNI_ERR; ++ } ++ debugPrintlnMethodID = (*env)->GetMethodID(env, debugCls, ++ "println", "(Ljava/lang/String;)V"); ++ if (debugPrintlnMethodID == NULL) { ++ printf("libsystemconf: Debug::println(String) method not found\n"); ++ return JNI_ERR; ++ } ++ debugObj = (*env)->NewGlobalRef(env, debugObj); ++ } ++ ++ return (*env)->GetVersion(env); ++} ++ ++/* ++ * Class: java_security_SystemConfigurator ++ * Method: JNI_OnUnload ++ */ ++JNIEXPORT void JNICALL DEF_JNI_OnUnload(JavaVM *vm, void *reserved) ++{ ++ JNIEnv *env; ++ ++ if (debugObj != NULL) { ++ if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) { ++ return; /* Should not happen */ ++ } ++ (*env)->DeleteGlobalRef(env, debugObj); ++ } ++} ++ ++JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEnabled ++ (JNIEnv *env, jclass cls) ++{ ++ int fips_enabled; ++ char msg[MSG_MAX_SIZE]; ++ int msg_bytes; ++ ++#ifdef SYSCONF_NSS ++ ++ dbgPrint(env, "getSystemFIPSEnabled: calling SECMOD_GetSystemFIPSEnabled"); ++ fips_enabled = SECMOD_GetSystemFIPSEnabled(); ++ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \ ++ " SECMOD_GetSystemFIPSEnabled returned 0x%x", fips_enabled); ++ if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) { ++ dbgPrint(env, msg); ++ } else { ++ dbgPrint(env, "getSystemFIPSEnabled: cannot render" \ ++ " SECMOD_GetSystemFIPSEnabled return value"); ++ } ++ return (fips_enabled == 1 ? JNI_TRUE : JNI_FALSE); ++ ++#else // SYSCONF_NSS ++ ++ FILE *fe; ++ ++ dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH); ++ if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) { ++ throwIOException(env, "Cannot open " FIPS_ENABLED_PATH); ++ } ++ fips_enabled = fgetc(fe); ++ fclose(fe); ++ if (fips_enabled == EOF) { ++ throwIOException(env, "Cannot read " FIPS_ENABLED_PATH); ++ } ++ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \ ++ " read character is '%c'", fips_enabled); ++ if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) { ++ dbgPrint(env, msg); ++ } else { ++ dbgPrint(env, "getSystemFIPSEnabled: cannot render" \ ++ " read character"); ++ } ++ return (fips_enabled == '1' ? JNI_TRUE : JNI_FALSE); ++ ++#endif // SYSCONF_NSS ++} ++ ++static void throwIOException(JNIEnv *env, const char *msg) ++{ ++ jclass cls = (*env)->FindClass(env, "java/io/IOException"); ++ if (cls != 0) ++ (*env)->ThrowNew(env, cls, msg); ++} ++ ++static void dbgPrint(JNIEnv *env, const char* msg) ++{ ++ jstring jMsg; ++ if (debugObj != NULL) { ++ jMsg = (*env)->NewStringUTF(env, msg); ++ CHECK_NULL(jMsg); ++ (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg); ++ } ++} +diff --git openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java +index 10b54aa4ce4..6aa1419dfd0 100644 +--- openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java ++++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2019, 2020, Red Hat, Inc. ++ * Copyright (c) 2019, 2021, Red Hat, Inc. + * + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * +@@ -30,13 +30,9 @@ import java.io.BufferedInputStream; + import java.io.FileInputStream; + import java.io.IOException; + +-import java.nio.file.Files; +-import java.nio.file.Path; +- + import java.util.Iterator; + import java.util.Map.Entry; + import java.util.Properties; +-import java.util.regex.Pattern; + + import sun.security.util.Debug; + +@@ -58,11 +54,23 @@ final class SystemConfigurator { + private static final String CRYPTO_POLICIES_JAVA_CONFIG = + CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config"; + +- private static final String CRYPTO_POLICIES_CONFIG = +- CRYPTO_POLICIES_BASE_DIR + "/config"; +- + private static boolean systemFipsEnabled = false; + ++ private static final String SYSTEMCONF_NATIVE_LIB = "systemconf"; ++ ++ private static native boolean getSystemFIPSEnabled() ++ throws IOException; ++ ++ static { ++ @SuppressWarnings("removal") ++ var dummy = AccessController.doPrivileged(new PrivilegedAction<Void>() { ++ public Void run() { ++ System.loadLibrary(SYSTEMCONF_NATIVE_LIB); ++ return null; ++ } ++ }); ++ } ++ + /* + * Invoked when java.security.Security class is initialized, if + * java.security.disableSystemPropertiesFile property is not set and +@@ -170,16 +178,34 @@ final class SystemConfigurator { + } + + /* +- * FIPS is enabled only if crypto-policies are set to "FIPS" +- * and the com.redhat.fips property is true. ++ * OpenJDK FIPS mode will be enabled only if the com.redhat.fips ++ * system property is true (default) and the system is in FIPS mode. ++ * ++ * There are 2 possible ways in which OpenJDK detects that the system ++ * is in FIPS mode: 1) if the NSS SECMOD_GetSystemFIPSEnabled API is ++ * available at OpenJDK's built-time, it is called; 2) otherwise, the ++ * /proc/sys/crypto/fips_enabled file is read. + */ + private static boolean enableFips() throws Exception { + boolean shouldEnable = Boolean.valueOf(System.getProperty("com.redhat.fips", "true")); + if (shouldEnable) { +- String cryptoPoliciesConfig = new String(Files.readAllBytes(Path.of(CRYPTO_POLICIES_CONFIG))); +- if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); } +- Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE); +- return pattern.matcher(cryptoPoliciesConfig).find(); ++ if (sdebug != null) { ++ sdebug.println("Calling getSystemFIPSEnabled (libsystemconf)..."); ++ } ++ try { ++ shouldEnable = getSystemFIPSEnabled(); ++ if (sdebug != null) { ++ sdebug.println("Call to getSystemFIPSEnabled (libsystemconf) returned: " ++ + shouldEnable); ++ } ++ return shouldEnable; ++ } catch (IOException e) { ++ if (sdebug != null) { ++ sdebug.println("Call to getSystemFIPSEnabled (libsystemconf) failed:"); ++ sdebug.println(e.getMessage()); ++ } ++ throw e; ++ } + } else { + return false; + } diff --git a/rh1991003-enable_fips_keys_import.patch b/rh1991003-enable_fips_keys_import.patch new file mode 100644 index 0000000..79d2743 --- /dev/null +++ b/rh1991003-enable_fips_keys_import.patch @@ -0,0 +1,579 @@ +commit abcd0954643eddbf826d96291d44a143038ab750 +Author: Martin Balao <mbalao(a)redhat.com> +Date: Sun Oct 10 18:14:01 2021 +0100 + + RH1991003: Enable the import of plain keys into the NSS software token. + + This can be individually disabled using -Dcom.redhat.fips.plainKeySupport=false + +diff --git openjdk.orig/src/java.base/share/classes/java/security/Security.java openjdk/src/java.base/share/classes/java/security/Security.java +index ce32c939253..dc7020ce668 100644 +--- openjdk.orig/src/java.base/share/classes/java/security/Security.java ++++ openjdk/src/java.base/share/classes/java/security/Security.java +@@ -82,6 +82,10 @@ public final class Security { + public boolean isSystemFipsEnabled() { + return SystemConfigurator.isSystemFipsEnabled(); + } ++ @Override ++ public boolean isPlainKeySupportEnabled() { ++ return SystemConfigurator.isPlainKeySupportEnabled(); ++ } + }); + + // doPrivileged here because there are multiple +diff --git openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java +index 6aa1419dfd0..ecab722848e 100644 +--- openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java ++++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java +@@ -55,6 +55,7 @@ final class SystemConfigurator { + CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config"; + + private static boolean systemFipsEnabled = false; ++ private static boolean plainKeySupportEnabled = false; + + private static final String SYSTEMCONF_NATIVE_LIB = "systemconf"; + +@@ -150,6 +151,16 @@ final class SystemConfigurator { + } + loadedProps = true; + systemFipsEnabled = true; ++ String plainKeySupport = System.getProperty("com.redhat.fips.plainKeySupport", ++ "true"); ++ plainKeySupportEnabled = !"false".equals(plainKeySupport); ++ if (sdebug != null) { ++ if (plainKeySupportEnabled) { ++ sdebug.println("FIPS support enabled with plain key support"); ++ } else { ++ sdebug.println("FIPS support enabled without plain key support"); ++ } ++ } + } + } catch (Exception e) { + if (sdebug != null) { +@@ -177,6 +188,19 @@ final class SystemConfigurator { + return systemFipsEnabled; + } + ++ /** ++ * Returns {@code true} if system FIPS alignment is enabled ++ * and plain key support is allowed. Plain key support is ++ * enabled by default but can be disabled with ++ * {@code -Dcom.redhat.fips.plainKeySupport=false}. ++ * ++ * @return a boolean indicating whether plain key support ++ * should be enabled. ++ */ ++ static boolean isPlainKeySupportEnabled() { ++ return plainKeySupportEnabled; ++ } ++ + /* + * OpenJDK FIPS mode will be enabled only if the com.redhat.fips + * system property is true (default) and the system is in FIPS mode. +diff --git openjdk.orig/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java +index a31e93ec02e..3f3caac64dc 100644 +--- openjdk.orig/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java ++++ openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java +@@ -27,4 +27,5 @@ package jdk.internal.access; + + public interface JavaSecuritySystemConfiguratorAccess { + boolean isSystemFipsEnabled(); ++ boolean isPlainKeySupportEnabled(); + } +diff --git openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java +new file mode 100644 +index 00000000000..bee3a1e1537 +--- /dev/null ++++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java +@@ -0,0 +1,291 @@ ++/* ++ * Copyright (c) 2021, Red Hat, Inc. ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. Oracle designates this ++ * particular file as subject to the "Classpath" exception as provided ++ * by Oracle in the LICENSE file that accompanied this code. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++package sun.security.pkcs11; ++ ++import java.math.BigInteger; ++import java.security.KeyFactory; ++import java.security.Provider; ++import java.security.Security; ++import java.util.HashMap; ++import java.util.Map; ++import java.util.concurrent.locks.ReentrantLock; ++ ++import javax.crypto.Cipher; ++import javax.crypto.spec.DHPrivateKeySpec; ++import javax.crypto.spec.IvParameterSpec; ++ ++import sun.security.jca.JCAUtil; ++import sun.security.pkcs11.TemplateManager; ++import sun.security.pkcs11.wrapper.CK_ATTRIBUTE; ++import sun.security.pkcs11.wrapper.CK_MECHANISM; ++import static sun.security.pkcs11.wrapper.PKCS11Constants.*; ++import static sun.security.pkcs11.wrapper.PKCS11Exception.*; ++import sun.security.pkcs11.wrapper.PKCS11Exception; ++import sun.security.rsa.RSAUtil.KeyType; ++import sun.security.util.Debug; ++import sun.security.util.ECUtil; ++ ++final class FIPSKeyImporter { ++ ++ private static final Debug debug = ++ Debug.getInstance("sunpkcs11"); ++ ++ private static P11Key importerKey = null; ++ private static final ReentrantLock importerKeyLock = new ReentrantLock(); ++ private static CK_MECHANISM importerKeyMechanism = null; ++ private static Cipher importerCipher = null; ++ ++ private static Provider sunECProvider = null; ++ private static final ReentrantLock sunECProviderLock = new ReentrantLock(); ++ ++ private static KeyFactory DHKF = null; ++ private static final ReentrantLock DHKFLock = new ReentrantLock(); ++ ++ static Long importKey(SunPKCS11 sunPKCS11, long hSession, CK_ATTRIBUTE[] attributes) ++ throws PKCS11Exception { ++ long keyID = -1; ++ Token token = sunPKCS11.getToken(); ++ if (debug != null) { ++ debug.println("Private or Secret key will be imported in" + ++ " system FIPS mode."); ++ } ++ if (importerKey == null) { ++ importerKeyLock.lock(); ++ try { ++ if (importerKey == null) { ++ if (importerKeyMechanism == null) { ++ // Importer Key creation has not been tried yet. Try it. ++ createImporterKey(token); ++ } ++ if (importerKey == null || importerCipher == null) { ++ if (debug != null) { ++ debug.println("Importer Key could not be" + ++ " generated."); ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR); ++ } ++ if (debug != null) { ++ debug.println("Importer Key successfully" + ++ " generated."); ++ } ++ } ++ } finally { ++ importerKeyLock.unlock(); ++ } ++ } ++ long importerKeyID = importerKey.getKeyID(); ++ try { ++ byte[] keyBytes = null; ++ byte[] encKeyBytes = null; ++ long keyClass = 0L; ++ long keyType = 0L; ++ Map<Long, CK_ATTRIBUTE> attrsMap = new HashMap<>(); ++ for (CK_ATTRIBUTE attr : attributes) { ++ if (attr.type == CKA_CLASS) { ++ keyClass = attr.getLong(); ++ } else if (attr.type == CKA_KEY_TYPE) { ++ keyType = attr.getLong(); ++ } ++ attrsMap.put(attr.type, attr); ++ } ++ BigInteger v = null; ++ if (keyClass == CKO_PRIVATE_KEY) { ++ if (keyType == CKK_RSA) { ++ if (debug != null) { ++ debug.println("Importing an RSA private key..."); ++ } ++ keyBytes = sun.security.rsa.RSAPrivateCrtKeyImpl.newKey( ++ KeyType.RSA, ++ null, ++ ((v = attrsMap.get(CKA_MODULUS).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PUBLIC_EXPONENT).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PRIVATE_EXPONENT).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PRIME_1).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PRIME_2).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_EXPONENT_1).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_EXPONENT_2).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_COEFFICIENT).getBigInteger()) != null) ++ ? v : BigInteger.ZERO ++ ).getEncoded(); ++ } else if (keyType == CKK_DSA) { ++ if (debug != null) { ++ debug.println("Importing a DSA private key..."); ++ } ++ keyBytes = new sun.security.provider.DSAPrivateKey( ++ ((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PRIME).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_SUBPRIME).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_BASE).getBigInteger()) != null) ++ ? v : BigInteger.ZERO ++ ).getEncoded(); ++ if (token.config.getNssNetscapeDbWorkaround() && ++ attrsMap.get(CKA_NETSCAPE_DB) == null) { ++ attrsMap.put(CKA_NETSCAPE_DB, ++ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO)); ++ } ++ } else if (keyType == CKK_EC) { ++ if (debug != null) { ++ debug.println("Importing an EC private key..."); ++ } ++ if (sunECProvider == null) { ++ sunECProviderLock.lock(); ++ try { ++ if (sunECProvider == null) { ++ sunECProvider = Security.getProvider("SunEC"); ++ } ++ } finally { ++ sunECProviderLock.unlock(); ++ } ++ } ++ keyBytes = ECUtil.generateECPrivateKey( ++ ((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ECUtil.getECParameterSpec(sunECProvider, ++ attrsMap.get(CKA_EC_PARAMS).getByteArray())) ++ .getEncoded(); ++ if (token.config.getNssNetscapeDbWorkaround() && ++ attrsMap.get(CKA_NETSCAPE_DB) == null) { ++ attrsMap.put(CKA_NETSCAPE_DB, ++ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO)); ++ } ++ } else if (keyType == CKK_DH) { ++ if (debug != null) { ++ debug.println("Importing a Diffie-Hellman private key..."); ++ } ++ if (DHKF == null) { ++ DHKFLock.lock(); ++ try { ++ if (DHKF == null) { ++ DHKF = KeyFactory.getInstance( ++ "DH", P11Util.getSunJceProvider()); ++ } ++ } finally { ++ DHKFLock.unlock(); ++ } ++ } ++ DHPrivateKeySpec spec = new DHPrivateKeySpec ++ (((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PRIME).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_BASE).getBigInteger()) != null) ++ ? v : BigInteger.ZERO); ++ keyBytes = DHKF.generatePrivate(spec).getEncoded(); ++ if (token.config.getNssNetscapeDbWorkaround() && ++ attrsMap.get(CKA_NETSCAPE_DB) == null) { ++ attrsMap.put(CKA_NETSCAPE_DB, ++ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO)); ++ } ++ } else { ++ if (debug != null) { ++ debug.println("Unrecognized private key type."); ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR); ++ } ++ } else if (keyClass == CKO_SECRET_KEY) { ++ if (debug != null) { ++ debug.println("Importing a secret key..."); ++ } ++ keyBytes = attrsMap.get(CKA_VALUE).getByteArray(); ++ } ++ if (keyBytes == null || keyBytes.length == 0) { ++ if (debug != null) { ++ debug.println("Private or secret key plain bytes could" + ++ " not be obtained. Import failed."); ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR); ++ } ++ importerCipher.init(Cipher.ENCRYPT_MODE, importerKey, ++ new IvParameterSpec((byte[])importerKeyMechanism.pParameter), ++ null); ++ attributes = new CK_ATTRIBUTE[attrsMap.size()]; ++ attrsMap.values().toArray(attributes); ++ encKeyBytes = importerCipher.doFinal(keyBytes); ++ attributes = token.getAttributes(TemplateManager.O_IMPORT, ++ keyClass, keyType, attributes); ++ keyID = token.p11.C_UnwrapKey(hSession, ++ importerKeyMechanism, importerKeyID, encKeyBytes, attributes); ++ if (debug != null) { ++ debug.println("Imported key ID: " + keyID); ++ } ++ } catch (Throwable t) { ++ throw new PKCS11Exception(CKR_GENERAL_ERROR); ++ } finally { ++ importerKey.releaseKeyID(); ++ } ++ return Long.valueOf(keyID); ++ } ++ ++ private static void createImporterKey(Token token) { ++ if (debug != null) { ++ debug.println("Generating Importer Key..."); ++ } ++ byte[] iv = new byte[16]; ++ JCAUtil.getSecureRandom().nextBytes(iv); ++ importerKeyMechanism = new CK_MECHANISM(CKM_AES_CBC_PAD, iv); ++ try { ++ CK_ATTRIBUTE[] attributes = token.getAttributes(TemplateManager.O_GENERATE, ++ CKO_SECRET_KEY, CKK_AES, new CK_ATTRIBUTE[] { ++ new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY), ++ new CK_ATTRIBUTE(CKA_VALUE_LEN, 256 >> 3)}); ++ Session s = null; ++ try { ++ s = token.getObjSession(); ++ long keyID = token.p11.C_GenerateKey( ++ s.id(), new CK_MECHANISM(CKM_AES_KEY_GEN), ++ attributes); ++ if (debug != null) { ++ debug.println("Importer Key ID: " + keyID); ++ } ++ importerKey = (P11Key)P11Key.secretKey(s, keyID, "AES", ++ 256 >> 3, null); ++ } catch (PKCS11Exception e) { ++ // best effort ++ } finally { ++ token.releaseSession(s); ++ } ++ if (importerKey != null) { ++ importerCipher = Cipher.getInstance("AES/CBC/PKCS5Padding"); ++ } ++ } catch (Throwable t) { ++ // best effort ++ importerKey = null; ++ importerCipher = null; ++ // importerKeyMechanism value is kept initialized to indicate that ++ // Importer Key creation has been tried and failed. ++ } ++ } ++} +diff --git openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java +index 5d3963ea893..42c72b393fd 100644 +--- openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java ++++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java +@@ -26,6 +26,9 @@ + package sun.security.pkcs11; + + import java.io.*; ++import java.lang.invoke.MethodHandle; ++import java.lang.invoke.MethodHandles; ++import java.lang.invoke.MethodType; + import java.util.*; + + import java.security.*; +@@ -66,6 +69,26 @@ public final class SunPKCS11 extends AuthProvider { + private static final boolean systemFipsEnabled = SharedSecrets + .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled(); + ++ private static final boolean plainKeySupportEnabled = SharedSecrets ++ .getJavaSecuritySystemConfiguratorAccess().isPlainKeySupportEnabled(); ++ ++ private static final MethodHandle fipsImportKey; ++ static { ++ MethodHandle fipsImportKeyTmp = null; ++ if (plainKeySupportEnabled) { ++ try { ++ fipsImportKeyTmp = MethodHandles.lookup().findStatic( ++ FIPSKeyImporter.class, "importKey", ++ MethodType.methodType(Long.class, SunPKCS11.class, ++ long.class, CK_ATTRIBUTE[].class)); ++ } catch (Throwable t) { ++ throw new SecurityException("FIPS key importer initialization" + ++ " failed", t); ++ } ++ } ++ fipsImportKey = fipsImportKeyTmp; ++ } ++ + private static final long serialVersionUID = -1354835039035306505L; + + static final Debug debug = Debug.getInstance("sunpkcs11"); +@@ -324,10 +347,15 @@ public final class SunPKCS11 extends AuthProvider { + // request multithreaded access first + initArgs.flags = CKF_OS_LOCKING_OK; + PKCS11 tmpPKCS11; ++ MethodHandle fipsKeyImporter = null; ++ if (plainKeySupportEnabled) { ++ fipsKeyImporter = MethodHandles.insertArguments( ++ fipsImportKey, 0, this); ++ } + try { + tmpPKCS11 = PKCS11.getInstance( + library, functionList, initArgs, +- config.getOmitInitialize()); ++ config.getOmitInitialize(), fipsKeyImporter); + } catch (PKCS11Exception e) { + if (debug != null) { + debug.println("Multi-threaded initialization failed: " + e); +@@ -343,7 +371,7 @@ public final class SunPKCS11 extends AuthProvider { + initArgs.flags = 0; + } + tmpPKCS11 = PKCS11.getInstance(library, +- functionList, initArgs, config.getOmitInitialize()); ++ functionList, initArgs, config.getOmitInitialize(), fipsKeyImporter); + } + p11 = tmpPKCS11; + +diff --git openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java +index 5c0aacd1a67..4d80145cb91 100644 +--- openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java ++++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java +@@ -49,6 +49,7 @@ package sun.security.pkcs11.wrapper; + + import java.io.File; + import java.io.IOException; ++import java.lang.invoke.MethodHandle; + import java.util.*; + + import java.security.AccessController; +@@ -152,16 +153,28 @@ public class PKCS11 { + + public static synchronized PKCS11 getInstance(String pkcs11ModulePath, + String functionList, CK_C_INITIALIZE_ARGS pInitArgs, +- boolean omitInitialize) throws IOException, PKCS11Exception { ++ boolean omitInitialize, MethodHandle fipsKeyImporter) ++ throws IOException, PKCS11Exception { + // we may only call C_Initialize once per native .so/.dll + // so keep a cache using the (non-canonicalized!) path + PKCS11 pkcs11 = moduleMap.get(pkcs11ModulePath); + if (pkcs11 == null) { ++ boolean nssFipsMode = fipsKeyImporter != null; + if ((pInitArgs != null) + && ((pInitArgs.flags & CKF_OS_LOCKING_OK) != 0)) { +- pkcs11 = new PKCS11(pkcs11ModulePath, functionList); ++ if (nssFipsMode) { ++ pkcs11 = new FIPSPKCS11(pkcs11ModulePath, functionList, ++ fipsKeyImporter); ++ } else { ++ pkcs11 = new PKCS11(pkcs11ModulePath, functionList); ++ } + } else { +- pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList); ++ if (nssFipsMode) { ++ pkcs11 = new SynchronizedFIPSPKCS11(pkcs11ModulePath, ++ functionList, fipsKeyImporter); ++ } else { ++ pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList); ++ } + } + if (omitInitialize == false) { + try { +@@ -1911,4 +1924,69 @@ static class SynchronizedPKCS11 extends PKCS11 { + super.C_GenerateRandom(hSession, randomData); + } + } ++ ++// PKCS11 subclass that allows using plain private or secret keys in ++// FIPS-configured NSS Software Tokens. Only used when System FIPS ++// is enabled. ++static class FIPSPKCS11 extends PKCS11 { ++ private MethodHandle fipsKeyImporter; ++ FIPSPKCS11(String pkcs11ModulePath, String functionListName, ++ MethodHandle fipsKeyImporter) throws IOException { ++ super(pkcs11ModulePath, functionListName); ++ this.fipsKeyImporter = fipsKeyImporter; ++ } ++ ++ public synchronized long C_CreateObject(long hSession, ++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception { ++ // Creating sensitive key objects from plain key material in a ++ // FIPS-configured NSS Software Token is not allowed. We apply ++ // a key-unwrapping scheme to achieve so. ++ if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) { ++ try { ++ return ((Long)fipsKeyImporter.invoke(hSession, pTemplate)) ++ .longValue(); ++ } catch (Throwable t) { ++ throw new PKCS11Exception(CKR_GENERAL_ERROR); ++ } ++ } ++ return super.C_CreateObject(hSession, pTemplate); ++ } ++} ++ ++// FIPSPKCS11 synchronized counterpart. ++static class SynchronizedFIPSPKCS11 extends SynchronizedPKCS11 { ++ private MethodHandle fipsKeyImporter; ++ SynchronizedFIPSPKCS11(String pkcs11ModulePath, String functionListName, ++ MethodHandle fipsKeyImporter) throws IOException { ++ super(pkcs11ModulePath, functionListName); ++ this.fipsKeyImporter = fipsKeyImporter; ++ } ++ ++ public synchronized long C_CreateObject(long hSession, ++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception { ++ // See FIPSPKCS11::C_CreateObject. ++ if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) { ++ try { ++ return ((Long)fipsKeyImporter.invoke(hSession, pTemplate)) ++ .longValue(); ++ } catch (Throwable t) { ++ throw new PKCS11Exception(CKR_GENERAL_ERROR); ++ } ++ } ++ return super.C_CreateObject(hSession, pTemplate); ++ } ++} ++ ++private static class FIPSPKCS11Helper { ++ static boolean isSensitiveObject(CK_ATTRIBUTE[] pTemplate) { ++ for (CK_ATTRIBUTE attr : pTemplate) { ++ if (attr.type == CKA_CLASS && ++ (attr.getLong() == CKO_PRIVATE_KEY || ++ attr.getLong() == CKO_SECRET_KEY)) { ++ return true; ++ } ++ } ++ return false; ++ } ++} + } +diff --git openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java +index e2d6d371bec..dc5e7eefdd3 100644 +--- openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java ++++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java +@@ -219,6 +219,14 @@ public class PKCS11Exception extends Exception { + return "0x" + Functions.toFullHexString((int)errorCode); + } + ++ /** ++ * Constructor taking the error code (the CKR_* constants in PKCS#11) with ++ * no extra info for the error message. ++ */ ++ public PKCS11Exception(long errorCode) { ++ this(errorCode, null); ++ } ++ + /** + * Constructor taking the error code (the CKR_* constants in PKCS#11) and + * extra info for error message. diff --git a/rh1995150-disable_non-fips_crypto.patch b/rh1995150-disable_non-fips_crypto.patch new file mode 100644 index 0000000..b3d0ae7 --- /dev/null +++ b/rh1995150-disable_non-fips_crypto.patch @@ -0,0 +1,596 @@ +diff --git openjdk/src/java.base/share/classes/module-info.java openjdk/src/java.base/share/classes/module-info.java +index 9d4a794de1a..39e69362458 100644 +--- openjdk/src/java.base/share/classes/module-info.java ++++ openjdk/src/java.base/share/classes/module-info.java +@@ -151,6 +151,7 @@ module java.base { + java.management, + java.naming, + java.rmi, ++ jdk.crypto.ec, + jdk.jartool, + jdk.jlink, + jdk.net, +diff --git openjdk/src/java.base/share/classes/sun/security/provider/SunEntries.java openjdk/src/java.base/share/classes/sun/security/provider/SunEntries.java +index 912cad59714..c5e13c98bd9 100644 +--- openjdk/src/java.base/share/classes/sun/security/provider/SunEntries.java ++++ openjdk/src/java.base/share/classes/sun/security/provider/SunEntries.java +@@ -30,6 +30,7 @@ import java.net.*; + import java.util.*; + import java.security.*; + ++import jdk.internal.access.SharedSecrets; + import jdk.internal.util.StaticProperty; + import sun.security.action.GetPropertyAction; + import sun.security.util.SecurityProviderConstants; +@@ -83,6 +84,10 @@ import static sun.security.util.SecurityProviderConstants.getAliases; + + public final class SunEntries { + ++ private static final boolean systemFipsEnabled = ++ SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ .isSystemFipsEnabled(); ++ + // the default algo used by SecureRandom class for new SecureRandom() calls + public static final String DEF_SECURE_RANDOM_ALGO; + +@@ -94,147 +99,149 @@ public final class SunEntries { + // common attribute map + HashMap<String, String> attrs = new HashMap<>(3); + +- /* +- * SecureRandom engines +- */ +- attrs.put("ThreadSafe", "true"); +- if (NativePRNG.isAvailable()) { +- add(p, "SecureRandom", "NativePRNG", +- "sun.security.provider.NativePRNG", attrs); +- } +- if (NativePRNG.Blocking.isAvailable()) { +- add(p, "SecureRandom", "NativePRNGBlocking", +- "sun.security.provider.NativePRNG$Blocking", attrs); +- } +- if (NativePRNG.NonBlocking.isAvailable()) { +- add(p, "SecureRandom", "NativePRNGNonBlocking", +- "sun.security.provider.NativePRNG$NonBlocking", attrs); ++ if (!systemFipsEnabled) { ++ /* ++ * SecureRandom engines ++ */ ++ attrs.put("ThreadSafe", "true"); ++ if (NativePRNG.isAvailable()) { ++ add(p, "SecureRandom", "NativePRNG", ++ "sun.security.provider.NativePRNG", attrs); ++ } ++ if (NativePRNG.Blocking.isAvailable()) { ++ add(p, "SecureRandom", "NativePRNGBlocking", ++ "sun.security.provider.NativePRNG$Blocking", attrs); ++ } ++ if (NativePRNG.NonBlocking.isAvailable()) { ++ add(p, "SecureRandom", "NativePRNGNonBlocking", ++ "sun.security.provider.NativePRNG$NonBlocking", attrs); ++ } ++ attrs.put("ImplementedIn", "Software"); ++ add(p, "SecureRandom", "DRBG", "sun.security.provider.DRBG", attrs); ++ add(p, "SecureRandom", "SHA1PRNG", ++ "sun.security.provider.SecureRandom", attrs); ++ ++ /* ++ * Signature engines ++ */ ++ attrs.clear(); ++ String dsaKeyClasses = "java.security.interfaces.DSAPublicKey" + ++ "|java.security.interfaces.DSAPrivateKey"; ++ attrs.put("SupportedKeyClasses", dsaKeyClasses); ++ attrs.put("ImplementedIn", "Software"); ++ ++ attrs.put("KeySize", "1024"); // for NONE and SHA1 DSA signatures ++ ++ addWithAlias(p, "Signature", "SHA1withDSA", ++ "sun.security.provider.DSA$SHA1withDSA", attrs); ++ addWithAlias(p, "Signature", "NONEwithDSA", ++ "sun.security.provider.DSA$RawDSA", attrs); ++ ++ // for DSA signatures with 224/256-bit digests ++ attrs.put("KeySize", "2048"); ++ ++ addWithAlias(p, "Signature", "SHA224withDSA", ++ "sun.security.provider.DSA$SHA224withDSA", attrs); ++ addWithAlias(p, "Signature", "SHA256withDSA", ++ "sun.security.provider.DSA$SHA256withDSA", attrs); ++ ++ addWithAlias(p, "Signature", "SHA3-224withDSA", ++ "sun.security.provider.DSA$SHA3_224withDSA", attrs); ++ addWithAlias(p, "Signature", "SHA3-256withDSA", ++ "sun.security.provider.DSA$SHA3_256withDSA", attrs); ++ ++ attrs.put("KeySize", "3072"); // for DSA sig using 384/512-bit digests ++ ++ addWithAlias(p, "Signature", "SHA384withDSA", ++ "sun.security.provider.DSA$SHA384withDSA", attrs); ++ addWithAlias(p, "Signature", "SHA512withDSA", ++ "sun.security.provider.DSA$SHA512withDSA", attrs); ++ addWithAlias(p, "Signature", "SHA3-384withDSA", ++ "sun.security.provider.DSA$SHA3_384withDSA", attrs); ++ addWithAlias(p, "Signature", "SHA3-512withDSA", ++ "sun.security.provider.DSA$SHA3_512withDSA", attrs); ++ ++ attrs.remove("KeySize"); ++ ++ add(p, "Signature", "SHA1withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA1withDSAinP1363Format"); ++ add(p, "Signature", "NONEwithDSAinP1363Format", ++ "sun.security.provider.DSA$RawDSAinP1363Format"); ++ add(p, "Signature", "SHA224withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA224withDSAinP1363Format"); ++ add(p, "Signature", "SHA256withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA256withDSAinP1363Format"); ++ add(p, "Signature", "SHA384withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA384withDSAinP1363Format"); ++ add(p, "Signature", "SHA512withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA512withDSAinP1363Format"); ++ add(p, "Signature", "SHA3-224withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA3_224withDSAinP1363Format"); ++ add(p, "Signature", "SHA3-256withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA3_256withDSAinP1363Format"); ++ add(p, "Signature", "SHA3-384withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA3_384withDSAinP1363Format"); ++ add(p, "Signature", "SHA3-512withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA3_512withDSAinP1363Format"); ++ /* ++ * Key Pair Generator engines ++ */ ++ attrs.clear(); ++ attrs.put("ImplementedIn", "Software"); ++ attrs.put("KeySize", "2048"); // for DSA KPG and APG only ++ ++ String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$"; ++ dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current"); ++ addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs); ++ ++ /* ++ * Algorithm Parameter Generator engines ++ */ ++ addWithAlias(p, "AlgorithmParameterGenerator", "DSA", ++ "sun.security.provider.DSAParameterGenerator", attrs); ++ attrs.remove("KeySize"); ++ ++ /* ++ * Algorithm Parameter engines ++ */ ++ addWithAlias(p, "AlgorithmParameters", "DSA", ++ "sun.security.provider.DSAParameters", attrs); ++ ++ /* ++ * Key factories ++ */ ++ addWithAlias(p, "KeyFactory", "DSA", ++ "sun.security.provider.DSAKeyFactory", attrs); ++ ++ /* ++ * Digest engines ++ */ ++ add(p, "MessageDigest", "MD2", "sun.security.provider.MD2", attrs); ++ add(p, "MessageDigest", "MD5", "sun.security.provider.MD5", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-1", "sun.security.provider.SHA", ++ attrs); ++ ++ addWithAlias(p, "MessageDigest", "SHA-224", ++ "sun.security.provider.SHA2$SHA224", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-256", ++ "sun.security.provider.SHA2$SHA256", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-384", ++ "sun.security.provider.SHA5$SHA384", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-512", ++ "sun.security.provider.SHA5$SHA512", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-512/224", ++ "sun.security.provider.SHA5$SHA512_224", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-512/256", ++ "sun.security.provider.SHA5$SHA512_256", attrs); ++ addWithAlias(p, "MessageDigest", "SHA3-224", ++ "sun.security.provider.SHA3$SHA224", attrs); ++ addWithAlias(p, "MessageDigest", "SHA3-256", ++ "sun.security.provider.SHA3$SHA256", attrs); ++ addWithAlias(p, "MessageDigest", "SHA3-384", ++ "sun.security.provider.SHA3$SHA384", attrs); ++ addWithAlias(p, "MessageDigest", "SHA3-512", ++ "sun.security.provider.SHA3$SHA512", attrs); + } +- attrs.put("ImplementedIn", "Software"); +- add(p, "SecureRandom", "DRBG", "sun.security.provider.DRBG", attrs); +- add(p, "SecureRandom", "SHA1PRNG", +- "sun.security.provider.SecureRandom", attrs); +- +- /* +- * Signature engines +- */ +- attrs.clear(); +- String dsaKeyClasses = "java.security.interfaces.DSAPublicKey" + +- "|java.security.interfaces.DSAPrivateKey"; +- attrs.put("SupportedKeyClasses", dsaKeyClasses); +- attrs.put("ImplementedIn", "Software"); +- +- attrs.put("KeySize", "1024"); // for NONE and SHA1 DSA signatures +- +- addWithAlias(p, "Signature", "SHA1withDSA", +- "sun.security.provider.DSA$SHA1withDSA", attrs); +- addWithAlias(p, "Signature", "NONEwithDSA", +- "sun.security.provider.DSA$RawDSA", attrs); +- +- // for DSA signatures with 224/256-bit digests +- attrs.put("KeySize", "2048"); +- +- addWithAlias(p, "Signature", "SHA224withDSA", +- "sun.security.provider.DSA$SHA224withDSA", attrs); +- addWithAlias(p, "Signature", "SHA256withDSA", +- "sun.security.provider.DSA$SHA256withDSA", attrs); +- +- addWithAlias(p, "Signature", "SHA3-224withDSA", +- "sun.security.provider.DSA$SHA3_224withDSA", attrs); +- addWithAlias(p, "Signature", "SHA3-256withDSA", +- "sun.security.provider.DSA$SHA3_256withDSA", attrs); +- +- attrs.put("KeySize", "3072"); // for DSA sig using 384/512-bit digests +- +- addWithAlias(p, "Signature", "SHA384withDSA", +- "sun.security.provider.DSA$SHA384withDSA", attrs); +- addWithAlias(p, "Signature", "SHA512withDSA", +- "sun.security.provider.DSA$SHA512withDSA", attrs); +- addWithAlias(p, "Signature", "SHA3-384withDSA", +- "sun.security.provider.DSA$SHA3_384withDSA", attrs); +- addWithAlias(p, "Signature", "SHA3-512withDSA", +- "sun.security.provider.DSA$SHA3_512withDSA", attrs); +- +- attrs.remove("KeySize"); +- +- add(p, "Signature", "SHA1withDSAinP1363Format", +- "sun.security.provider.DSA$SHA1withDSAinP1363Format"); +- add(p, "Signature", "NONEwithDSAinP1363Format", +- "sun.security.provider.DSA$RawDSAinP1363Format"); +- add(p, "Signature", "SHA224withDSAinP1363Format", +- "sun.security.provider.DSA$SHA224withDSAinP1363Format"); +- add(p, "Signature", "SHA256withDSAinP1363Format", +- "sun.security.provider.DSA$SHA256withDSAinP1363Format"); +- add(p, "Signature", "SHA384withDSAinP1363Format", +- "sun.security.provider.DSA$SHA384withDSAinP1363Format"); +- add(p, "Signature", "SHA512withDSAinP1363Format", +- "sun.security.provider.DSA$SHA512withDSAinP1363Format"); +- add(p, "Signature", "SHA3-224withDSAinP1363Format", +- "sun.security.provider.DSA$SHA3_224withDSAinP1363Format"); +- add(p, "Signature", "SHA3-256withDSAinP1363Format", +- "sun.security.provider.DSA$SHA3_256withDSAinP1363Format"); +- add(p, "Signature", "SHA3-384withDSAinP1363Format", +- "sun.security.provider.DSA$SHA3_384withDSAinP1363Format"); +- add(p, "Signature", "SHA3-512withDSAinP1363Format", +- "sun.security.provider.DSA$SHA3_512withDSAinP1363Format"); +- /* +- * Key Pair Generator engines +- */ +- attrs.clear(); +- attrs.put("ImplementedIn", "Software"); +- attrs.put("KeySize", "2048"); // for DSA KPG and APG only +- +- String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$"; +- dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current"); +- addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs); +- +- /* +- * Algorithm Parameter Generator engines +- */ +- addWithAlias(p, "AlgorithmParameterGenerator", "DSA", +- "sun.security.provider.DSAParameterGenerator", attrs); +- attrs.remove("KeySize"); +- +- /* +- * Algorithm Parameter engines +- */ +- addWithAlias(p, "AlgorithmParameters", "DSA", +- "sun.security.provider.DSAParameters", attrs); +- +- /* +- * Key factories +- */ +- addWithAlias(p, "KeyFactory", "DSA", +- "sun.security.provider.DSAKeyFactory", attrs); +- +- /* +- * Digest engines +- */ +- add(p, "MessageDigest", "MD2", "sun.security.provider.MD2", attrs); +- add(p, "MessageDigest", "MD5", "sun.security.provider.MD5", attrs); +- addWithAlias(p, "MessageDigest", "SHA-1", "sun.security.provider.SHA", +- attrs); +- +- addWithAlias(p, "MessageDigest", "SHA-224", +- "sun.security.provider.SHA2$SHA224", attrs); +- addWithAlias(p, "MessageDigest", "SHA-256", +- "sun.security.provider.SHA2$SHA256", attrs); +- addWithAlias(p, "MessageDigest", "SHA-384", +- "sun.security.provider.SHA5$SHA384", attrs); +- addWithAlias(p, "MessageDigest", "SHA-512", +- "sun.security.provider.SHA5$SHA512", attrs); +- addWithAlias(p, "MessageDigest", "SHA-512/224", +- "sun.security.provider.SHA5$SHA512_224", attrs); +- addWithAlias(p, "MessageDigest", "SHA-512/256", +- "sun.security.provider.SHA5$SHA512_256", attrs); +- addWithAlias(p, "MessageDigest", "SHA3-224", +- "sun.security.provider.SHA3$SHA224", attrs); +- addWithAlias(p, "MessageDigest", "SHA3-256", +- "sun.security.provider.SHA3$SHA256", attrs); +- addWithAlias(p, "MessageDigest", "SHA3-384", +- "sun.security.provider.SHA3$SHA384", attrs); +- addWithAlias(p, "MessageDigest", "SHA3-512", +- "sun.security.provider.SHA3$SHA512", attrs); + + /* + * Certificates +diff --git openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java +index 8c9e4f9dbe6..9eeb3013e0d 100644 +--- openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java ++++ openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java +@@ -38,6 +38,7 @@ import java.util.HashMap; + import java.util.Iterator; + import java.util.List; + ++import jdk.internal.access.SharedSecrets; + import sun.security.ec.ed.EdDSAAlgorithmParameters; + import sun.security.ec.ed.EdDSAKeyFactory; + import sun.security.ec.ed.EdDSAKeyPairGenerator; +@@ -56,6 +57,10 @@ public final class SunEC extends Provider { + + private static final long serialVersionUID = -2279741672933606418L; + ++ private static final boolean systemFipsEnabled = ++ SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ .isSystemFipsEnabled(); ++ + private static class ProviderServiceA extends ProviderService { + ProviderServiceA(Provider p, String type, String algo, String cn, + HashMap<String, String> attrs) { +@@ -249,85 +254,86 @@ public final class SunEC extends Provider { + + putXDHEntries(); + putEdDSAEntries(); +- +- /* +- * Signature engines +- */ +- putService(new ProviderService(this, "Signature", +- "NONEwithECDSA", "sun.security.ec.ECDSASignature$Raw", +- null, ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA1withECDSA", "sun.security.ec.ECDSASignature$SHA1", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA224withECDSA", "sun.security.ec.ECDSASignature$SHA224", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA256withECDSA", "sun.security.ec.ECDSASignature$SHA256", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA384withECDSA", "sun.security.ec.ECDSASignature$SHA384", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA512withECDSA", "sun.security.ec.ECDSASignature$SHA512", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA3-224withECDSA", "sun.security.ec.ECDSASignature$SHA3_224", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA3-256withECDSA", "sun.security.ec.ECDSASignature$SHA3_256", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA3-384withECDSA", "sun.security.ec.ECDSASignature$SHA3_384", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA3-512withECDSA", "sun.security.ec.ECDSASignature$SHA3_512", +- ATTRS)); +- +- putService(new ProviderService(this, "Signature", +- "NONEwithECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$RawinP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA1withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA1inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA224withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA224inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA256withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA256inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA384withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA384inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA512withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA512inP1363Format")); +- +- putService(new ProviderService(this, "Signature", +- "SHA3-224withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA3_224inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA3-256withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA3_256inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA3-384withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA3_384inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA3-512withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA3_512inP1363Format")); +- +- /* +- * Key Pair Generator engine +- */ +- putService(new ProviderService(this, "KeyPairGenerator", +- "EC", "sun.security.ec.ECKeyPairGenerator", +- List.of("EllipticCurve"), ATTRS)); +- +- /* +- * Key Agreement engine +- */ +- putService(new ProviderService(this, "KeyAgreement", +- "ECDH", "sun.security.ec.ECDHKeyAgreement", null, ATTRS)); ++ if (!systemFipsEnabled) { ++ /* ++ * Signature engines ++ */ ++ putService(new ProviderService(this, "Signature", ++ "NONEwithECDSA", "sun.security.ec.ECDSASignature$Raw", ++ null, ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA1withECDSA", "sun.security.ec.ECDSASignature$SHA1", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA224withECDSA", "sun.security.ec.ECDSASignature$SHA224", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA256withECDSA", "sun.security.ec.ECDSASignature$SHA256", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA384withECDSA", "sun.security.ec.ECDSASignature$SHA384", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA512withECDSA", "sun.security.ec.ECDSASignature$SHA512", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA3-224withECDSA", "sun.security.ec.ECDSASignature$SHA3_224", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA3-256withECDSA", "sun.security.ec.ECDSASignature$SHA3_256", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA3-384withECDSA", "sun.security.ec.ECDSASignature$SHA3_384", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA3-512withECDSA", "sun.security.ec.ECDSASignature$SHA3_512", ++ ATTRS)); ++ ++ putService(new ProviderService(this, "Signature", ++ "NONEwithECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$RawinP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA1withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA1inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA224withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA224inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA256withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA256inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA384withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA384inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA512withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA512inP1363Format")); ++ ++ putService(new ProviderService(this, "Signature", ++ "SHA3-224withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA3_224inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA3-256withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA3_256inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA3-384withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA3_384inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA3-512withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA3_512inP1363Format")); ++ ++ /* ++ * Key Pair Generator engine ++ */ ++ putService(new ProviderService(this, "KeyPairGenerator", ++ "EC", "sun.security.ec.ECKeyPairGenerator", ++ List.of("EllipticCurve"), ATTRS)); ++ ++ /* ++ * Key Agreement engine ++ */ ++ putService(new ProviderService(this, "KeyAgreement", ++ "ECDH", "sun.security.ec.ECDHKeyAgreement", null, ATTRS)); ++ } + } + + private void putXDHEntries() { +@@ -344,23 +350,25 @@ public final class SunEC extends Provider { + "X448", "sun.security.ec.XDHKeyFactory.X448", + ATTRS)); + +- putService(new ProviderService(this, "KeyPairGenerator", +- "XDH", "sun.security.ec.XDHKeyPairGenerator", null, ATTRS)); +- putService(new ProviderServiceA(this, "KeyPairGenerator", +- "X25519", "sun.security.ec.XDHKeyPairGenerator.X25519", +- ATTRS)); +- putService(new ProviderServiceA(this, "KeyPairGenerator", +- "X448", "sun.security.ec.XDHKeyPairGenerator.X448", +- ATTRS)); +- +- putService(new ProviderService(this, "KeyAgreement", +- "XDH", "sun.security.ec.XDHKeyAgreement", null, ATTRS)); +- putService(new ProviderServiceA(this, "KeyAgreement", +- "X25519", "sun.security.ec.XDHKeyAgreement.X25519", +- ATTRS)); +- putService(new ProviderServiceA(this, "KeyAgreement", +- "X448", "sun.security.ec.XDHKeyAgreement.X448", +- ATTRS)); ++ if (!systemFipsEnabled) { ++ putService(new ProviderService(this, "KeyPairGenerator", ++ "XDH", "sun.security.ec.XDHKeyPairGenerator", null, ATTRS)); ++ putService(new ProviderServiceA(this, "KeyPairGenerator", ++ "X25519", "sun.security.ec.XDHKeyPairGenerator.X25519", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "KeyPairGenerator", ++ "X448", "sun.security.ec.XDHKeyPairGenerator.X448", ++ ATTRS)); ++ ++ putService(new ProviderService(this, "KeyAgreement", ++ "XDH", "sun.security.ec.XDHKeyAgreement", null, ATTRS)); ++ putService(new ProviderServiceA(this, "KeyAgreement", ++ "X25519", "sun.security.ec.XDHKeyAgreement.X25519", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "KeyAgreement", ++ "X448", "sun.security.ec.XDHKeyAgreement.X448", ++ ATTRS)); ++ } + } + + private void putEdDSAEntries() { +@@ -375,21 +383,23 @@ public final class SunEC extends Provider { + putService(new ProviderServiceA(this, "KeyFactory", + "Ed448", "sun.security.ec.ed.EdDSAKeyFactory.Ed448", ATTRS)); + +- putService(new ProviderService(this, "KeyPairGenerator", +- "EdDSA", "sun.security.ec.ed.EdDSAKeyPairGenerator", null, ATTRS)); +- putService(new ProviderServiceA(this, "KeyPairGenerator", +- "Ed25519", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed25519", +- ATTRS)); +- putService(new ProviderServiceA(this, "KeyPairGenerator", +- "Ed448", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed448", +- ATTRS)); +- +- putService(new ProviderService(this, "Signature", +- "EdDSA", "sun.security.ec.ed.EdDSASignature", null, ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "Ed25519", "sun.security.ec.ed.EdDSASignature.Ed25519", ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "Ed448", "sun.security.ec.ed.EdDSASignature.Ed448", ATTRS)); ++ if (!systemFipsEnabled) { ++ putService(new ProviderService(this, "KeyPairGenerator", ++ "EdDSA", "sun.security.ec.ed.EdDSAKeyPairGenerator", null, ATTRS)); ++ putService(new ProviderServiceA(this, "KeyPairGenerator", ++ "Ed25519", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed25519", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "KeyPairGenerator", ++ "Ed448", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed448", ++ ATTRS)); ++ ++ putService(new ProviderService(this, "Signature", ++ "EdDSA", "sun.security.ec.ed.EdDSASignature", null, ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "Ed25519", "sun.security.ec.ed.EdDSASignature.Ed25519", ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "Ed448", "sun.security.ec.ed.EdDSASignature.Ed448", ATTRS)); ++ } + + } + } diff --git a/rh1996182-extend_security_policy.patch b/rh1996182-extend_security_policy.patch new file mode 100644 index 0000000..7622622 --- /dev/null +++ b/rh1996182-extend_security_policy.patch @@ -0,0 +1,18 @@ +commit bfd7c5dae9c15266799cb885b8c60199217b65b9 +Author: Andrew Hughes <gnu.andrew(a)redhat.com> +Date: Mon Aug 30 16:14:14 2021 +0100 + + RH1996182: Extend default security policy to allow SunPKCS11 access to jdk.internal.access + +diff --git openjdk.orig/src/java.base/share/lib/security/default.policy openjdk/src/java.base/share/lib/security/default.policy +index 8356e56367b..23925f048be 100644 +--- openjdk.orig/src/java.base/share/lib/security/default.policy ++++ openjdk/src/java.base/share/lib/security/default.policy +@@ -128,6 +128,7 @@ grant codeBase "jrt:/jdk.crypto.ec" { + grant codeBase "jrt:/jdk.crypto.cryptoki" { + permission java.lang.RuntimePermission + "accessClassInPackage.com.sun.crypto.provider"; ++ permission java.lang.RuntimePermission "accessClassInPackage.jdk.internal.access"; + permission java.lang.RuntimePermission "accessClassInPackage.jdk.internal.misc"; + permission java.lang.RuntimePermission + "accessClassInPackage.sun.security.*"; diff --git a/rh1996182-login_to_nss_software_token.patch b/rh1996182-login_to_nss_software_token.patch new file mode 100644 index 0000000..475c521 --- /dev/null +++ b/rh1996182-login_to_nss_software_token.patch @@ -0,0 +1,65 @@ +commit 93c9f6330bf2b4405c789bf893a5256c3f4a4923 +Author: Martin Balao <mbalao(a)redhat.com> +Date: Sat Aug 28 00:35:44 2021 +0100 + + RH1996182: Login to the NSS Software Token in FIPS Mode + +diff --git openjdk.orig/src/java.base/share/classes/module-info.java openjdk/src/java.base/share/classes/module-info.java +index 39e69362458..aeb5fc2eb46 100644 +--- openjdk.orig/src/java.base/share/classes/module-info.java ++++ openjdk/src/java.base/share/classes/module-info.java +@@ -151,6 +151,7 @@ module java.base { + java.management, + java.naming, + java.rmi, ++ jdk.crypto.cryptoki, + jdk.crypto.ec, + jdk.jartool, + jdk.jlink, +diff --git openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java +index 112b639aa96..5d3963ea893 100644 +--- openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java ++++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java +@@ -42,6 +42,7 @@ import javax.security.auth.callback.PasswordCallback; + + import com.sun.crypto.provider.ChaCha20Poly1305Parameters; + ++import jdk.internal.access.SharedSecrets; + import jdk.internal.misc.InnocuousThread; + import sun.security.util.Debug; + import sun.security.util.ResourcesMgr; +@@ -62,6 +63,9 @@ import static sun.security.pkcs11.wrapper.PKCS11Exception.*; + */ + public final class SunPKCS11 extends AuthProvider { + ++ private static final boolean systemFipsEnabled = SharedSecrets ++ .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled(); ++ + private static final long serialVersionUID = -1354835039035306505L; + + static final Debug debug = Debug.getInstance("sunpkcs11"); +@@ -379,6 +383,24 @@ public final class SunPKCS11 extends AuthProvider { + if (nssModule != null) { + nssModule.setProvider(this); + } ++ if (systemFipsEnabled) { ++ // The NSS Software Token in FIPS 140-2 mode requires a user ++ // login for most operations. See sftk_fipsCheck. The NSS DB ++ // (/etc/pki/nssdb) PIN is empty. ++ Session session = null; ++ try { ++ session = token.getOpSession(); ++ p11.C_Login(session.id(), CKU_USER, new char[] {}); ++ } catch (PKCS11Exception p11e) { ++ if (debug != null) { ++ debug.println("Error during token login: " + ++ p11e.getMessage()); ++ } ++ throw p11e; ++ } finally { ++ token.releaseSession(session); ++ } ++ } + } catch (Exception e) { + if (config.getHandleStartupErrors() == Config.ERR_IGNORE_ALL) { + throw new UnsupportedOperationException diff --git a/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch b/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch new file mode 100644 index 0000000..1b706a1 --- /dev/null +++ b/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch @@ -0,0 +1,19 @@ +Remove uses of FAR in jpeg code + +Upstream libjpeg-trubo removed the (empty) FAR macro: +http://sourceforge.net/p/libjpeg-turbo/code/1312/ + +Adjust our code to not use the undefined FAR macro anymore. + +diff --git a/jdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c b/jdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c +--- openjdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c ++++ openjdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c +@@ -1385,7 +1385,7 @@ + /* and fill it in */ + dst_ptr = icc_data; + for (seq_no = first; seq_no < last; seq_no++) { +- JOCTET FAR *src_ptr = icc_markers[seq_no]->data + ICC_OVERHEAD_LEN; ++ JOCTET *src_ptr = icc_markers[seq_no]->data + ICC_OVERHEAD_LEN; + unsigned int length = + icc_markers[seq_no]->data_length - ICC_OVERHEAD_LEN; + diff --git a/sources b/sources new file mode 100644 index 0000000..dadd1ed --- /dev/null +++ b/sources @@ -0,0 +1,2 @@ +SHA512 (openjdk-jdk17u-jdk-17.0.1+12.tar.xz) = d9503de1001e42657ddb2600e1141d4169e333f0592ce3ad3c4ce14f817ca73a6bf6fb867e15930150c7b55e8fd4c4cd73d43984979e721df481a9ac7919580c +SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30

2 years, 5 months

1
0
0 / 0

Architecture specific change in rpms/java-17-openjdk.git

by githook-noreply＠fedoraproject.org

The package rpms/java-17-openjdk.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/java-17-openjdk.git/commit/?id=f3.... Change: +%ifnarch s390x Thanks. Full change: ============ commit 7ae5d5bd64a15e2e84d785dc56b5fb9e62ea113a Author: Andrew John Hughes <gnu_andrew(a)member.fsf.org> Date: Fri Nov 5 22:46:45 2021 +0000 Handle Fedora in distro conditionals that currently only pertain to RHEL. diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec index bd2d867..00a6c16 100644 --- a/java-17-openjdk.spec +++ b/java-17-openjdk.spec @@ -298,7 +298,7 @@ %global top_level_dir_name %{origin} %global top_level_dir_name_backup %{top_level_dir_name}-backup %global buildver 12 -%global rpmrelease 8 +%global rpmrelease 9 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit %if %is_system_jdk # Using 10 digits may overflow the int used for priority, so we combine the patch and build versions @@ -937,7 +937,8 @@ Requires: libXcomposite%{?_isa} Requires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release} OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release} # for java-X-openjdk package's desktop binding -%if 0%{?rhel} >= 8 +# Where recommendations are available, recommend Gtk+ for the Swing look and feel +%if 0%{?rhel} >= 8 || 0%{?fedora} > 0 Recommends: gtk3%{?_isa} %endif @@ -978,8 +979,11 @@ Requires: cups-libs Requires(post): %{alternatives_requires} # Postun requires alternatives to uninstall tool alternatives Requires(postun): %{alternatives_requires} -# for optional support of kernel stream control, card reader and printing bindings +# Where suggestions are available, recommend the sctp and pcsc libraries +# for optional support of kernel stream control and card reader +%if 0%{?rhel} >= 8 || 0%{?fedora} > 0 Suggests: lksctp-tools%{?_isa}, pcsc-lite-libs%{?_isa} +%endif # Standard JPackage base provides Provides: jre-%{javaver}-%{origin}-headless%{?1} = %{epoch}:%{version}-%{release} @@ -1091,7 +1095,8 @@ Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist} Epoch: 1 Summary: %{origin_nice} %{featurever} Runtime Environment -%if 0%{?rhel} <= 8 +# Groups are only used up to RHEL 8 and on Fedora versions prior to F30 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1254,7 +1259,7 @@ The %{origin_nice} %{featurever} runtime environment. %if %{include_debug_build} %package slowdebug Summary: %{origin_nice} %{featurever} Runtime Environment %{debug_on} -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1267,7 +1272,7 @@ The %{origin_nice} %{featurever} runtime environment. %if %{include_fastdebug_build} %package fastdebug Summary: %{origin_nice} %{featurever} Runtime Environment %{fastdebug_on} -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1280,7 +1285,7 @@ The %{origin_nice} %{featurever} runtime environment. %if %{include_normal_build} %package headless Summary: %{origin_nice} %{featurever} Headless Runtime Environment -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1293,7 +1298,9 @@ The %{origin_nice} %{featurever} runtime environment without audio and video sup %if %{include_debug_build} %package headless-slowdebug Summary: %{origin_nice} %{featurever} Runtime Environment %{debug_on} +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages +%endif %{java_headless_rpo -- %{debug_suffix_unquoted}} @@ -1305,7 +1312,9 @@ The %{origin_nice} %{featurever} runtime environment without audio and video sup %if %{include_fastdebug_build} %package headless-fastdebug Summary: %{origin_nice} %{featurever} Runtime Environment %{fastdebug_on} +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages +%endif %{java_headless_rpo -- %{fastdebug_suffix_unquoted}} @@ -1317,7 +1326,7 @@ The %{origin_nice} %{featurever} runtime environment without audio and video sup %if %{include_normal_build} %package devel Summary: %{origin_nice} %{featurever} Development Environment -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1330,7 +1339,7 @@ The %{origin_nice} %{featurever} development tools. %if %{include_debug_build} %package devel-slowdebug Summary: %{origin_nice} %{featurever} Development Environment %{debug_on} -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1344,7 +1353,9 @@ The %{origin_nice} %{featurever} development tools. %if %{include_fastdebug_build} %package devel-fastdebug Summary: %{origin_nice} %{featurever} Development Environment %{fastdebug_on} +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Tools +%endif %{java_devel_rpo -- %{fastdebug_suffix_unquoted}} @@ -1393,7 +1404,7 @@ The %{origin_nice} %{featurever} libraries for static linking. %if %{include_normal_build} %package jmods Summary: JMods for %{origin_nice} %{featurever} -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1406,7 +1417,7 @@ The JMods for %{origin_nice} %{featurever}. %if %{include_debug_build} %package jmods-slowdebug Summary: JMods for %{origin_nice} %{featurever} %{debug_on} -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1420,7 +1431,9 @@ The JMods for %{origin_nice} %{featurever}. %if %{include_fastdebug_build} %package jmods-fastdebug Summary: JMods for %{origin_nice} %{featurever} %{fastdebug_on} +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Tools +%endif %{java_jmods_rpo -- %{fastdebug_suffix_unquoted}} @@ -1432,7 +1445,7 @@ The JMods for %{origin_nice} %{featurever}. %if %{include_normal_build} %package demo Summary: %{origin_nice} %{featurever} Demos -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1445,7 +1458,7 @@ The %{origin_nice} %{featurever} demos. %if %{include_debug_build} %package demo-slowdebug Summary: %{origin_nice} %{featurever} Demos %{debug_on} -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1459,7 +1472,9 @@ The %{origin_nice} %{featurever} demos. %if %{include_fastdebug_build} %package demo-fastdebug Summary: %{origin_nice} %{featurever} Demos %{fastdebug_on} +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages +%endif %{java_demo_rpo -- %{fastdebug_suffix_unquoted}} @@ -1471,7 +1486,7 @@ The %{origin_nice} %{featurever} demos. %if %{include_normal_build} %package src Summary: %{origin_nice} %{featurever} Source Bundle -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1485,7 +1500,7 @@ class library source code for use by IDE indexers and debuggers. %if %{include_debug_build} %package src-slowdebug Summary: %{origin_nice} %{featurever} Source Bundle %{for_debug} -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages %endif @@ -1499,7 +1514,9 @@ The %{compatiblename}-src-slowdebug sub-package contains the complete %{origin_n %if %{include_fastdebug_build} %package src-fastdebug Summary: %{origin_nice} %{featurever} Source Bundle %{for_fastdebug} +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Development/Languages +%endif %{java_src_rpo -- %{fastdebug_suffix_unquoted}} @@ -1511,7 +1528,7 @@ The %{compatiblename}-src-fastdebug sub-package contains the complete %{origin_n %if %{include_normal_build} %package javadoc Summary: %{origin_nice} %{featurever} API documentation -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Documentation %endif Requires: javapackages-filesystem @@ -1526,7 +1543,7 @@ The %{origin_nice} %{featurever} API documentation. %if %{include_normal_build} %package javadoc-zip Summary: %{origin_nice} %{featurever} API documentation compressed in a single archive -%if 0%{?rhel} <= 8 +%if (0%{?rhel} > 0 && 0%{?rhel} <= 8) || (0%{?fedora} >= 0 && 0%{?fedora} < 30) Group: Documentation %endif Requires: javapackages-filesystem @@ -2355,6 +2372,8 @@ cjc.mainProgram(args) %endif %changelog -* Thu Nov 18 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.0.0.35-8 -- inital import +* Mov Nov 29 2021 Andrew Hughes <gnu.andrew(a)redhat.com> - 1:17.0.1.0.12-9 +- Handle Fedora in distro conditionals that currently only pertain to RHEL. +* Thu Nov 18 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.0.0.35-8 +-- inital import commit 108126b081dcb467cb7d10d3e9a6e1aa84e1ed0a Author: Jiri Vanek <jvanek(a)redhat.com> Date: Tue Dec 7 15:52:30 2021 +0100 Added missing files from latest and 11 diff --git a/.gitignore b/.gitignore index cd592ed..1cf80ea 100644 --- a/.gitignore +++ b/.gitignore @@ -1,2 +1,22 @@ +/jdk-jdk12-jdk-12+33.tar.xz +/systemtap_3.2_tapsets_hg-icedtea8-9d464368e06d.tar.xz +/jdk-updates-jdk12u-jdk-12.0.1+12.tar.xz +/jdk-jdk13-jdk-13+27.tar.xz +/jdk-jdk13-jdk-13+28.tar.xz +/jdk-jdk13-jdk-13+33.tar.xz +/jdk-updates-jdk13u-jdk-13.0.1+9.tar.xz +/jdk-updates-jdk13u-jdk-13.0.2+8.tar.xz +/jdk-jdk14-jdk-14+36.tar.xz +/jdk-updates-jdk14u-jdk-14.0.1+7.tar.xz +/jdk-updates-jdk14u-jdk-14.0.2+12.tar.xz +/jdk-jdk15-jdk-15+36.tar.xz +/jdk-updates-jdk15u-jdk-15.0.1+9.tar.xz +/tapsets-icedtea-3.15.0.tar.xz +/jdk-updates-jdk15u-jdk-15.0.2+7.tar.xz +/openjdk-jdk16-jdk-16+36.tar.xz +/openjdk-jdk16u-jdk-16.0.1+9.tar.xz +/openjdk-jdk17-jdk-17+26.tar.xz +/openjdk-jdk17-jdk-17+33.tar.xz +/openjdk-jdk17-jdk-17+35.tar.xz /openjdk-jdk17u-jdk-17.0.1+12.tar.xz /tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz diff --git a/README.md b/README.md index b11f5d3..079e78c 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,10 @@ -# java-17-openjdk +Package of LTS OpenJDK 17 +OpenJDK have release cadence of 6 months. but 3/4 of them are Short Term Supported for 6 months only. -The java-17-openjdk package +JDK17 is last LTS release of Java platform. It is bringing many cool improvements - http://openjdk.java.net/projects/jdk/17/ and is landing to your Fedora. Where it will be maintained for several years. You will always be allowed to install Used LTSs in build root, and alongside via alternatives. + +See announcement: http://mail.openjdk.java.net/pipermail/discuss/2017-September/004281.html +See java SIG plans: https://jvanek.fedorapeople.org/devconf/2018/changesInjavaReleaseProcess.pdf + +https://fedoraproject.org/wiki/Changes/Java17 +https://fedoraproject.org/wiki/Changes/java-11-openjdk-TechPreview diff --git a/generate_source_tarball.sh b/generate_source_tarball.sh new file mode 100755 index 0000000..1a019ff --- /dev/null +++ b/generate_source_tarball.sh @@ -0,0 +1,156 @@ +#!/bin/bash +# Generates the 'source tarball' for JDK projects. +# +# Example: +# When used from local repo set REPO_ROOT pointing to file:// with your repo +# If your local repo follows upstream forests conventions, it may be enough to set OPENJDK_URL +# If you want to use a local copy of patch PR3788, set the path to it in the PR3788 variable +# +# In any case you have to set PROJECT_NAME REPO_NAME and VERSION. eg: +# PROJECT_NAME=openjdk +# REPO_NAME=jdk16 +# VERSION=HEAD +# or to eg prepare systemtap: +# icedtea7's jstack and other tapsets +# VERSION=6327cf1cea9e +# REPO_NAME=icedtea7-2.6 +# PROJECT_NAME=release +# OPENJDK_URL=http://icedtea.classpath.org/hg/ +# TO_COMPRESS="*/tapset" +# +# They are used to create correct name and are used in construction of sources url (unless REPO_ROOT is set) + +# This script creates a single source tarball out of the repository +# based on the given tag and removes code not allowed in fedora/rhel. For +# consistency, the source tarball will always contain 'openjdk' as the top +# level folder, name is created, based on parameter +# + +if [ ! "x$PR3823" = "x" ] ; then + if [ ! -f "$PR3823" ] ; then + echo "You have specified PR3823 as $PR3823 but it does not exist. Exiting" + exit 1 + fi +fi + +set -e + +OPENJDK_URL_DEFAULT=https://github.com +COMPRESSION_DEFAULT=xz + +if [ "x$1" = "xhelp" ] ; then + echo -e "Behaviour may be specified by setting the following variables:\n" + echo "VERSION - the version of the specified OpenJDK project" + echo "PROJECT_NAME -- the name of the OpenJDK project being archived (optional; only needed by defaults)" + echo "REPO_NAME - the name of the OpenJDK repository (optional; only needed by defaults)" + echo "OPENJDK_URL - the URL to retrieve code from (optional; defaults to ${OPENJDK_URL_DEFAULT})" + echo "COMPRESSION - the compression type to use (optional; defaults to ${COMPRESSION_DEFAULT})" + echo "FILE_NAME_ROOT - name of the archive, minus extensions (optional; defaults to PROJECT_NAME-REPO_NAME-VERSION)" + echo "TO_COMPRESS - what part of clone to pack (default is openjdk)" + echo "PR3823 - the path to the PR3823 patch to apply (optional; downloaded if unavailable)" + exit 1; +fi + + +if [ "x$VERSION" = "x" ] ; then + echo "No VERSION specified" + exit -2 +fi +echo "Version: ${VERSION}" + +# REPO_NAME is only needed when we default on REPO_ROOT and FILE_NAME_ROOT +if [ "x$FILE_NAME_ROOT" = "x" -o "x$REPO_ROOT" = "x" ] ; then + if [ "x$PROJECT_NAME" = "x" ] ; then + echo "No PROJECT_NAME specified" + exit -1 + fi + echo "Project name: ${PROJECT_NAME}" + if [ "x$REPO_NAME" = "x" ] ; then + echo "No REPO_NAME specified" + exit -3 + fi + echo "Repository name: ${REPO_NAME}" +fi + +if [ "x$OPENJDK_URL" = "x" ] ; then + OPENJDK_URL=${OPENJDK_URL_DEFAULT} + echo "No OpenJDK URL specified; defaulting to ${OPENJDK_URL}" +else + echo "OpenJDK URL: ${OPENJDK_URL}" +fi + +if [ "x$COMPRESSION" = "x" ] ; then + # rhel 5 needs tar.gz + COMPRESSION=${COMPRESSION_DEFAULT} +fi +echo "Creating a tar.${COMPRESSION} archive" + +if [ "x$FILE_NAME_ROOT" = "x" ] ; then + FILE_NAME_ROOT=${PROJECT_NAME}-${REPO_NAME}-${VERSION} + echo "No file name root specified; default to ${FILE_NAME_ROOT}" +fi +if [ "x$REPO_ROOT" = "x" ] ; then + REPO_ROOT="${OPENJDK_URL}/${PROJECT_NAME}/${REPO_NAME}.git" + echo "No repository root specified; default to ${REPO_ROOT}" +fi; + +if [ "x$TO_COMPRESS" = "x" ] ; then + TO_COMPRESS="openjdk" + echo "No to be compressed targets specified, ; default to ${TO_COMPRESS}" +fi; + +if [ -d ${FILE_NAME_ROOT} ] ; then + echo "exists exists exists exists exists exists exists " + echo "reusing reusing reusing reusing reusing reusing " + echo ${FILE_NAME_ROOT} +else + mkdir "${FILE_NAME_ROOT}" + pushd "${FILE_NAME_ROOT}" + echo "Cloning ${VERSION} root repository from ${REPO_ROOT}" + git clone -b ${VERSION} ${REPO_ROOT} openjdk + popd +fi +pushd "${FILE_NAME_ROOT}" + if [ -d openjdk/src ]; then + pushd openjdk + echo "Removing EC source code we don't build" + CRYPTO_PATH=src/jdk.crypto.ec/share/native/libsunec/impl + rm -vf ${CRYPTO_PATH}/ec2.h + rm -vf ${CRYPTO_PATH}/ec2_163.c + rm -vf ${CRYPTO_PATH}/ec2_193.c + rm -vf ${CRYPTO_PATH}/ec2_233.c + rm -vf ${CRYPTO_PATH}/ec2_aff.c + rm -vf ${CRYPTO_PATH}/ec2_mont.c + rm -vf ${CRYPTO_PATH}/ecp_192.c + rm -vf ${CRYPTO_PATH}/ecp_224.c + + echo "Syncing EC list with NSS" + if [ "x$PR3823" = "x" ] ; then + # originally for 8: + # get PR3823.patch (from http://icedtea.classpath.org/hg/icedtea16) from most correct tag + # Do not push it or publish it (see https://icedtea.classpath.org/bugzilla/show_bug.cgi?id=3823) + echo "PR3823 not found. Downloading..." + wget https://icedtea.classpath.org/hg/icedtea16/raw-file/tip/patches/pr3823.patch + echo "Applying ${PWD}/pr3823.patch" + patch -Np1 < pr3823.patch + rm pr3823.patch + else + echo "Applying ${PR3823}" + patch -Np1 < $PR3823 + fi; + find . -name '*.orig' -exec rm -vf '{}' ';' + popd + fi + + echo "Compressing remaining forest" + if [ "X$COMPRESSION" = "Xxz" ] ; then + SWITCH=cJf + else + SWITCH=czf + fi + tar --exclude-vcs -$SWITCH ${FILE_NAME_ROOT}.tar.${COMPRESSION} $TO_COMPRESS + mv ${FILE_NAME_ROOT}.tar.${COMPRESSION} .. +popd +echo "Done. You may want to remove the uncompressed version - $FILE_NAME_ROOT." + + diff --git a/icedtea_sync.sh b/icedtea_sync.sh new file mode 100755 index 0000000..e5c54f3 --- /dev/null +++ b/icedtea_sync.sh @@ -0,0 +1,192 @@ +#!/bin/bash + +# Copyright (C) 2019 Red Hat, Inc. +# Written by Andrew John Hughes <gnu.andrew(a)redhat.com>. +# +# This program is free software: you can redistribute it and/or modify +# it under the terms of the GNU Affero General Public License as +# published by the Free Software Foundation, either version 3 of the +# License, or (at your option) any later version. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU Affero General Public License for more details. +# +# You should have received a copy of the GNU Affero General Public License +# along with this program. If not, see <http://www.gnu.org/licenses/>. + +ICEDTEA_USE_VCS=true + +ICEDTEA_VERSION=3.15.0 +ICEDTEA_URL=https://icedtea.classpath.org/download/source +ICEDTEA_SIGNING_KEY=CFDA0F9B35964222 + +ICEDTEA_HG_URL=https://icedtea.classpath.org/hg/icedtea11 + +set -e + +RPM_DIR=${PWD} +if [ ! -f ${RPM_DIR}/jconsole.desktop.in ] ; then + echo "Not in RPM source tree."; + exit 1; +fi + +if test "x${TMPDIR}" = "x"; then + TMPDIR=/tmp; +fi +WORKDIR=${TMPDIR}/it.sync + +echo "Using working directory ${WORKDIR}" +mkdir ${WORKDIR} +pushd ${WORKDIR} + +if test "x${WGET}" = "x"; then + WGET=$(which wget); + if test "x${WGET}" = "x"; then + echo "wget not found"; + exit 1; + fi +fi + +if test "x${TAR}" = "x"; then + TAR=$(which tar) + if test "x${TAR}" = "x"; then + echo "tar not found"; + exit 2; + fi +fi + +echo "Dependencies:"; +echo -e "\tWGET: ${WGET}"; +echo -e "\tTAR: ${TAR}\n"; + +if test "x${ICEDTEA_USE_VCS}" = "xtrue"; then + echo "Mode: Using VCS"; + + if test "x${GREP}" = "x"; then + GREP=$(which grep); + if test "x${GREP}" = "x"; then + echo "grep not found"; + exit 3; + fi + fi + + if test "x${CUT}" = "x"; then + CUT=$(which cut); + if test "x${CUT}" = "x"; then + echo "cut not found"; + exit 4; + fi + fi + + if test "x${TR}" = "x"; then + TR=$(which tr); + if test "x${TR}" = "x"; then + echo "tr not found"; + exit 5; + fi + fi + + if test "x${HG}" = "x"; then + HG=$(which hg); + if test "x${HG}" = "x"; then + echo "hg not found"; + exit 6; + fi + fi + + echo "Dependencies:"; + echo -e "\tGREP: ${GREP}"; + echo -e "\tCUT: ${CUT}"; + echo -e "\tTR: ${TR}"; + echo -e "\tHG: ${HG}"; + + echo "Checking out repository from VCS..."; + ${HG} clone ${ICEDTEA_HG_URL} icedtea + + echo "Obtaining version from configure.ac..."; + ROOT_VER=$(${GREP} '^AC_INIT' icedtea/configure.ac|${CUT} -d ',' -f 2|${TR} -d '[][:space:]') + echo "Root version from configure: ${ROOT_VER}"; + + VCS_REV=$(${HG} log -R icedtea --template '{node|short}' -r tip) + echo "VCS revision: ${VCS_REV}"; + + ICEDTEA_VERSION="${ROOT_VER}-${VCS_REV}" + echo "Creating icedtea-${ICEDTEA_VERSION}"; + mkdir icedtea-${ICEDTEA_VERSION} + echo "Copying required files from checkout to icedtea-${ICEDTEA_VERSION}"; + # Commented out for now as IcedTea 6's jconsole.desktop.in is outdated + #cp -a icedtea/jconsole.desktop.in ../icedtea-${ICEDTEA_VERSION} + cp -a ${RPM_DIR}/jconsole.desktop.in icedtea-${ICEDTEA_VERSION} + cp -a icedtea/tapset icedtea-${ICEDTEA_VERSION} + + rm -rf icedtea +else + echo "Mode: Using tarball"; + + if test "x${ICEDTEA_VERSION}" = "x"; then + echo "No IcedTea version specified for tarball download."; + exit 3; + fi + + if test "x${CHECKSUM}" = "x"; then + CHECKSUM=$(which sha256sum) + if test "x${CHECKSUM}" = "x"; then + echo "sha256sum not found"; + exit 4; + fi + fi + + if test "x${PGP}" = "x"; then + PGP=$(which gpg) + if test "x${PGP}" = "x"; then + echo "gpg not found"; + exit 5; + fi + fi + + echo "Dependencies:"; + echo -e "\tCHECKSUM: ${CHECKSUM}"; + echo -e "\tPGP: ${PGP}\n"; + + echo "Checking for IcedTea signing key ${ICEDTEA_SIGNING_KEY}..."; + if ! gpg --list-keys ${ICEDTEA_SIGNING_KEY}; then + echo "IcedTea signing key ${ICEDTEA_SIGNING_KEY} not installed."; + exit 6; + fi + + echo "Downloading IcedTea release tarball..."; + ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz + echo "Downloading IcedTea tarball signature..."; + ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.tar.xz.sig + echo "Downloading IcedTea tarball checksums..."; + ${WGET} -v ${ICEDTEA_URL}/icedtea-${ICEDTEA_VERSION}.sha256 + + echo "Verifying checksums..."; + ${CHECKSUM} --check --ignore-missing icedtea-${ICEDTEA_VERSION}.sha256 + + echo "Checking signature..."; + ${PGP} --verify icedtea-${ICEDTEA_VERSION}.tar.xz.sig + + echo "Extracting files..."; + ${TAR} xJf icedtea-${ICEDTEA_VERSION}.tar.xz \ + icedtea-${ICEDTEA_VERSION}/tapset \ + icedtea-${ICEDTEA_VERSION}/jconsole.desktop.in + + rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz + rm -vf icedtea-${ICEDTEA_VERSION}.tar.xz.sig + rm -vf icedtea-${ICEDTEA_VERSION}.sha256 +fi + +echo "Replacing desktop files..."; +mv -v icedtea-${ICEDTEA_VERSION}/jconsole.desktop.in ${RPM_DIR} + +echo "Creating new tapset tarball..."; +mv -v icedtea-${ICEDTEA_VERSION} openjdk +${TAR} cJf ${RPM_DIR}/tapsets-icedtea-${ICEDTEA_VERSION}.tar.xz openjdk + +rm -rvf openjdk + +popd +rm -rf ${WORKDIR} commit f32499609c2a8c0f4e91ecefab86feddf7585cc3 Author: Jiri Vanek <jvanek(a)redhat.com> Date: Tue Dec 7 15:45:09 2021 +0100 Initial load diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..cd592ed --- /dev/null +++ b/.gitignore @@ -0,0 +1,2 @@ +/openjdk-jdk17u-jdk-17.0.1+12.tar.xz +/tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz diff --git a/NEWS b/NEWS new file mode 100644 index 0000000..9d37ff9 --- /dev/null +++ b/NEWS @@ -0,0 +1,619 @@ +Key: + +JDK-X - https://bugs.openjdk.java.net/browse/JDK-X +CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY + +New in release OpenJDK 17.0.1 (2021-10-19): +=========================================== +Live versions of these release notes can be found at: + * https://builds.shipilev.net/backports-monitor/release-notes-17.0.1.txt + +* Security fixes + - JDK-8263314: Enhance XML Dsig modes + - JDK-8265167, CVE-2021-35556: Richer Text Editors + - JDK-8265574: Improve handling of sheets + - JDK-8265580, CVE-2021-35559: Enhanced style for RTF kit + - JDK-8265776: Improve Stream handling for SSL + - JDK-8266097, CVE-2021-35561: Better hashing support + - JDK-8266103: Better specified spec values + - JDK-8266109: More Resilient Classloading + - JDK-8266115: More Manifest Jar Loading + - JDK-8266137, CVE-2021-35564: Improve Keystore integrity + - JDK-8266689, CVE-2021-35567: More Constrained Delegation + - JDK-8267086: ArrayIndexOutOfBoundsException in java.security.KeyFactory.generatePublic + - JDK-8267712: Better LDAP reference processing + - JDK-8267729, CVE-2021-35578: Improve TLS client handshaking + - JDK-8267735, CVE-2021-35586: Better BMP support + - JDK-8268193: Improve requests of certificates + - JDK-8268199: Correct certificate requests + - JDK-8268205: Enhance DTLS client handshake + - JDK-8268500: Better specified ParameterSpecs + - JDK-8268506: More Manifest Digests + - JDK-8269618, CVE-2021-35603: Better session identification + - JDK-8269624: Enhance method selection support + - JDK-8270398: Enhance canonicalization + - JDK-8270404: Better canonicalization +* Other changes + - JDK-8225082: Remove IdenTrust certificate that is expiring in September 2021 + - JDK-8243543: jtreg test security/infra/java/security/cert/CertPathValidator/certification/BuypassCA.java fails + - JDK-8248899: security/infra/java/security/cert/CertPathValidator/certification/QuoVadisCA.java fails, Certificate has been revoked + - JDK-8261088: Repeatable annotations without @Target cannot have containers that target module declarations + - JDK-8262731: [macOS] Exception from "Printable.print" is swallowed during "PrinterJob.print" + - JDK-8263531: Remove unused buffer int + - JDK-8266182: Automate manual steps listed in the test jdk/sun/security/pkcs12/ParamsTest.java + - JDK-8267625: AARCH64: typo in LIR_Assembler::emit_profile_type + - JDK-8267666: Add option to jcmd GC.heap_dump to use existing file + - JDK-8268019: C2: assert(no_dead_loop) failed: dead loop detected + - JDK-8268261: C2: assert(n != __null) failed: Bad immediate dominator info. + - JDK-8268427: Improve AlgorithmConstraints:checkAlgorithm performance + - JDK-8268963: [IR Framework] Some default regexes matching on PrintOptoAssembly in IRNode.java do not work on all platforms + - JDK-8269297: Bump version numbers for JDK 17.0.1 + - JDK-8269478: Shenandoah: gc/shenandoah/mxbeans tests should be more resilient + - JDK-8269574: C2: Avoid redundant uncommon traps in GraphKit::builtin_throw() for JVMTI exception events + - JDK-8269763: The JEditorPane is blank after JDK-8265167 + - JDK-8269851: OperatingSystemMXBean getProcessCpuLoad reports incorrect process cpu usage in containers + - JDK-8269882: stack-use-after-scope in NewObjectA + - JDK-8269897: Shenandoah: Resolve UNKNOWN access strength, where possible + - JDK-8269934: RunThese24H.java failed with EXCEPTION_ACCESS_VIOLATION in java_lang_Thread::get_thread_status + - JDK-8269993: [Test]: java/net/httpclient/DigestEchoClientSSL.java contains redundant @run tags + - JDK-8270094: Shenandoah: Provide human-readable labels for test configurations + - JDK-8270096: Shenandoah: Optimize gc/shenandoah/TestRefprocSanity.java for interpreter mode + - JDK-8270098: ZGC: ZBarrierSetC2::clone_at_expansion fails with "Guard against surprises" assert + - JDK-8270137: Kerberos Credential Retrieval from Cache not Working in Cross-Realm Setup + - JDK-8270280: security/infra/java/security/cert/CertPathValidator/certification/LetsEncryptCA.java OCSP response error + - JDK-8270344: Session resumption errors + - JDK-8271203: C2: assert(iff->Opcode() == Op_If || iff->Opcode() == Op_CountedLoopEnd || iff->Opcode() == Op_RangeCheck) failed: Check this code when new subtype is added + - JDK-8271276: C2: Wrong JVM state used for receiver null check + - JDK-8271335: Updating RE Configs for BUILD REQUEST 17.0.1+4 + - JDK-8271589: fatal error with variable shift count integer rotate operation. + - JDK-8271723: Unproblemlist runtime/InvocationTests/invokevirtualTests.java + - JDK-8271730: Client authentication using RSASSA-PSS fails after correct certificate requests + - JDK-8271925: ZGC: Arraycopy stub passes invalid oop to load barrier + - JDK-8272124: Cgroup v1 initialization causes NullPointerException when cgroup path contains colon + - JDK-8272131: PhaseMacroExpand::generate_slow_arraycopy crash when clone null CallProjections.fallthrough_ioproj + - JDK-8272326: java/util/Random/RandomTestMoments.java had two Gaussian fails + - JDK-8272332: --with-harfbuzz=system doesn't add -lharfbuzz after JDK-8255790 + - JDK-8272472: StackGuardPages test doesn't build with glibc 2.34 + - JDK-8272581: sun/security/pkcs11/Provider/MultipleLogins.sh fails after JDK-8266182 + - JDK-8272602: [macos] not all KEY_PRESSED events sent when control modifier is used + - JDK-8272700: [macos] Build failure with Xcode 13.0 after JDK-8264848 + - JDK-8272708: [Test]: Cleanup: test/jdk/security/infra/java/security/cert/CertPathValidator/certification/BuypassCA.java no longer needs ocspEnabled + - JDK-8272806: [macOS] "Apple AWT Internal Exception" when input method is changed + - JDK-8273358: macOS Monterey does not have the font Times needed by Serif + +Notes on individual issues: +=========================== + +security-libs/java.security: + +JDK-8271434: Removed IdenTrust Root Certificate +=============================================== +The following root certificate from IdenTrust has been removed from +the `cacerts` keystore: + +Alias Name: identrustdstx3 [jdk] +Distinguished Name: CN=DST Root CA X3, O=Digital Signature Trust Co. + +New in release OpenJDK 17.0.0 (2021-09-14): +=========================================== +The full list of changes in the interim releases from 11u to 17u can be found at: + * https://builds.shipilev.net/backports-monitor/release-notes-12.txt + * https://builds.shipilev.net/backports-monitor/release-notes-13.txt + * https://builds.shipilev.net/backports-monitor/release-notes-14.txt + * https://builds.shipilev.net/backports-monitor/release-notes-15.txt + * https://builds.shipilev.net/backports-monitor/release-notes-16.txt + * https://builds.shipilev.net/backports-monitor/release-notes-17.txt + +Major changes are listed below. Some changes may have been backported +to earlier releases following their first appearance in OpenJDK 12 +through to 17. + +NEW FEATURES +============ + +Language Features +================= + +Switch Expressions +================== +https://openjdk.java.net/jeps/325 +https://openjdk.java.net/jeps/354 +https://openjdk.java.net/jeps/361 + +Extend the `switch` statement so that it can be used as either a +statement or an expression, and that both forms can use either a +"traditional" or "simplified" scoping and control flow behavior. Both +forms can use either traditional `case ... :` labels (with fall +through) or new `case ... ->` labels (with no fall through), with a +further new statement for yielding a value from a `switch` +expression. These changes will simplify everyday coding, and also +prepare the way for the use of pattern matching in `switch`. + +This was a preview feature (http://openjdk.java.net/jeps/12) in +OpenJDK 12 & 13 and became final in OpenJDK 14. + +Text Blocks +=========== +https://openjdk.java.net/jeps/355 +https://openjdk.java.net/jeps/368 +https://openjdk.java.net/jeps/378 + +Add text blocks to the Java language. A text block is a multi-line +string literal that avoids the need for most escape sequences, +automatically formats the string in a predictable way, and gives the +developer control over format when desired. + +This was a preview feature (http://openjdk.java.net/jeps/12) in +OpenJDK 13 & 14 and became final in OpenJDK 15. + +Pattern Matching for instanceof +=============================== +https://openjdk.java.net/jeps/305 +https://openjdk.java.net/jeps/375 +https://openjdk.java.net/jeps/394 +http://cr.openjdk.java.net/~briangoetz/amber/pattern-match.html + +Enhance the Java programming language with pattern matching for the +`instanceof` operator. Pattern matching allows common logic in a +program, namely the conditional extraction of components from objects, +to be expressed more concisely and safely. + +This was a preview feature (http://openjdk.java.net/jeps/12) in +OpenJDK 14 & 15 and became final in OpenJDK 16. + +Records +======= +https://openjdk.java.net/jeps/359 +https://openjdk.java.net/jeps/384 +https://openjdk.java.net/jeps/395 + +Enhance the Java programming language with records. Records provide a +compact syntax for declaring classes which are transparent holders for +shallowly immutable data. + +This was a preview feature (http://openjdk.java.net/jeps/12) in +OpenJDK 14 & 15 and became final in OpenJDK 16. + +Sealed Classes +============== +https://openjdk.java.net/jeps/360 +https://openjdk.java.net/jeps/397 +https://openjdk.java.net/jeps/409 +https://cr.openjdk.java.net/~briangoetz/amber/datum.html + +Enhance the Java programming language with sealed classes and +interfaces. Sealed classes and interfaces restrict which other classes +or interfaces may extend or implement them. + +This was a preview feature (http://openjdk.java.net/jeps/12) in +OpenJDK 15 & 16 and became final in OpenJDK 17. + +Restore Always-Strict Floating-Point Semantics +============================================== +https://openjdk.java.net/jeps/306 + +Make floating-point operations consistently strict, rather than have +both strict floating-point semantics (`strictfp`) and subtly different +default floating-point semantics. This will restore the original +floating-point semantics to the language and VM, matching the +semantics before the introduction of strict and default floating-point +modes in Java SE 1.2. + +Pattern Matching for switch +=========================== +https://openjdk.java.net/jeps/406 + +Enhance the Java programming language with pattern matching for +`switch` expressions and statements, along with extensions to the +language of patterns. Extending pattern matching to `switch` allows an +expression to be tested against a number of patterns, each with a +specific action, so that complex data-oriented queries can be +expressed concisely and safely. + +This is a preview feature (http://openjdk.java.net/jeps/12) in OpenJDK +17. + +Library Features +================ + +JVM Constants API +================= +https://openjdk.java.net/jeps/334 + +Introduce an API to model nominal descriptions of key class-file and +run-time artifacts, in particular constants that are loadable from the +constant pool. + +Reimplement the Legacy Socket API +================================= +https://openjdk.java.net/jeps/353 + +Replace the underlying implementation used by the `java.net.Socket` +and `java.net.ServerSocket` APIs with a simpler and more modern +implementation that is easy to maintain and debug. The new +implementation will be easy to adapt to work with user-mode threads, +a.k.a. fibers, currently being explored in Project Loom +(https://openjdk.java.net/projects/loom). + +JFR Event Streaming +=================== +https://openjdk.java.net/jeps/349 + +Expose JDK Flight Recorder data for continuous monitoring. + +Non-Volatile Mapped Byte Buffers +================================ +https://openjdk.java.net/jeps/352 + +Add new JDK-specific file mapping modes so that the `FileChannel` API +can be used to create `MappedByteBuffer` instances that refer to +non-volatile memory. + +Helpful NullPointerExceptions +============================= +https://openjdk.java.net/jeps/358 + +Improve the usability of `NullPointerException`s generated by the JVM +by describing precisely which variable was `null`. + +Foreign-Memory Access API +========================= +https://openjdk.java.net/jeps/370 +https://openjdk.java.net/jeps/383 +https://openjdk.java.net/jeps/393 + +Introduce an API to allow Java programs to safely and efficiently +access foreign memory outside of the Java heap. + +This was a incubation feature (https://openjdk.java.net/jeps/11) in +OpenJDK 14, 15 & 16, now superseded by the Foreign Function & Memory +API in OpenJDK 17 (see below). + +Edwards-Curve Digital Signature Algorithm (EdDSA) +================================================= +https://openjdk.java.net/jeps/339 + +Implement cryptographic signatures using the Edwards-Curve Digital +Signature Algorithm (EdDSA) as described by RFC 8032 +(https://tools.ietf.org/html/rfc8032). + +Hidden Classes +============== +https://openjdk.java.net/jeps/371 + +Introduce hidden classes, which are classes that cannot be used +directly by the bytecode of other classes. Hidden classes are intended +for use by frameworks that generate classes at run time and use them +indirectly, via reflection. A hidden class may be defined as a member +of an access control nest (https://openjdk.java.net/jeps/181), and may +be unloaded independently of other classes. + +Reimplement the Legacy DatagramSocket API +========================================= +https://openjdk.java.net/jeps/373 + +Replace the underlying implementations of the +`java.net.DatagramSocket` and `java.net.MulticastSocket` APIs with +simpler and more modern implementations that are easy to maintain and +debug. The new implementations will be easy to adapt to work with +virtual threads, currently being explored in Project Loom +(https://openjdk.java.net/projects/loom). This is a follow-on to JEP +353 (see above), which already reimplemented the legacy Socket API. + +Vector API +========== +https://openjdk.java.net/jeps/338 +https://openjdk.java.net/jeps/414 + +Provide an initial iteration of an incubator module, +`jdk.incubator.vector`, to express vector computations that reliably +compile at runtime to optimal vector hardware instructions on +supported CPU architectures and thus achieve superior performance to +equivalent scalar computations. + +This is an incubation feature (https://openjdk.java.net/jeps/11) +introduced in OpenJDK 16. + +Unix-Domain Socket Channels +=========================== +https://openjdk.java.net/jeps/380 + +Add Unix-domain (`AF_UNIX`) socket support to the socket channel and +server-socket channel APIs in the `java.nio.channels` package. Extend +the inherited channel mechanism to support Unix-domain socket channels +and server socket channels. + +Foreign Linker API (Incubator) +============================== +https://openjdk.java.net/jeps/389 + +Introduce an API that offers statically-typed, pure-Java access to +native code. This API, together with the Foreign-Memory API (see +above), will considerably simplify the otherwise error-prone process +of binding to a native library. + +This was an incubation feature (https://openjdk.java.net/jeps/11) +introduced in OpenJDK 16, now superseded by the Foreign Function & +Memory API in OpenJDK 17 (see below). + +Strongly Encapsulate JDK Internals by Default +============================================= +https://openjdk.java.net/jeps/396 +https://openjdk.java.net/jeps/403 + +Strongly encapsulate all internal elements of the JDK by default, +except for critical internal APIs such as `sun.misc.Unsafe`. It will +no longer be possible to relax the strong encapsulation of internal +elements via a single command-line option, as was possible in OpenJDK +9 through 16. + +Enhanced Pseudo-Random Number Generators +======================================== +https://openjdk.java.net/jeps/356 + +Provide new interface types and implementations for pseudo-random +number generators (PRNGs), including jumpable PRNGs and an additional +class of splittable PRNG algorithms (LXM). + +Foreign Function & Memory API +============================= +https://openjdk.java.net/jeps/412 + +Introduce an API by which Java programs can interoperate with code and +data outside of the Java runtime. By efficiently invoking foreign +functions (i.e., code outside the JVM), and by safely accessing +foreign memory (i.e., memory not managed by the JVM), the API enables +Java programs to call native libraries and process native data without +the brittleness and danger of JNI. + +This API is an incubation feature (https://openjdk.java.net/jeps/11) +introduced in OpenJDK 17, and is an evolution of the Foreign Memory +Access API (OpenJDK 14 through 16) and Foreign Linker API (OpenJDK +16) (see above). + +Context-Specific Deserialization Filters +======================================== +https://openjdk.java.net/jeps/415 + +Allow applications to configure context-specific and +dynamically-selected deserialization filters via a JVM-wide filter +factory that is invoked to select a filter for each individual +deserialization operation. + +Tools +===== + +Packaging Tool +============== +https://openjdk.java.net/jeps/343 +https://openjdk.java.net/jeps/392 + +Provide the `jpackage` tool, for packaging self-contained Java +applications. + +JVM Features +============ + +Shenandoah: A Low-Pause-Time Garbage Collector +============================================== +https://openjdk.java.net/jeps/189 +https://openjdk.java.net/jeps/379 + +Add a new garbage collection (GC) algorithm named Shenandoah which +reduces GC pause times by doing evacuation work concurrently with the +running Java threads. Pause times with Shenandoah are independent of +heap size, meaning you will have the same consistent pause times +whether your heap is 200 MB or 200 GB. + +Shenandoah has been provided in Red Hat builds of OpenJDK 8 since +8u131 in April 2017 and in all 11u builds. + +Upstream, it was introduced in OpenJDK 12 as an experimental feature +and became a production feature in OpenJDK 15. It was backported to +OpenJDK 11 with the 11.0.9 release in October 2020. + +Abortable Mixed Collections for G1 +================================== +https://openjdk.java.net/jeps/344 + +Make G1 mixed collections abortable if they might exceed the pause +target. + +Promptly Return Unused Committed Memory from G1 +=============================================== +https://openjdk.java.net/jeps/346 + +Enhance the G1 garbage collector to automatically return Java heap +memory to the operating system when idle. + +Dynamic CDS Archives +==================== +https://openjdk.java.net/jeps/310 +https://openjdk.java.net/jeps/350 + +Extend application class-data sharing to allow the dynamic archiving +of classes at the end of Java application execution. The archived +classes will include all loaded application classes and library +classes that are not present in the default, base-layer CDS archive. + +ZGC: Uncommit Unused Memory (Experimental) +========================================== +https://openjdk.java.net/jeps/351 + +Enhance ZGC to return unused heap memory to the operating system. + +NUMA-Aware Memory Allocation for G1 +=================================== +https://openjdk.java.net/jeps/345 + +Improve G1 performance on large machines by implementing NUMA-aware +memory allocation. + +ZGC on macOS (Experimental) +=========================== +https://openjdk.java.net/jeps/364 + +Port the ZGC garbage collector to macOS. + +ZGC on Windows (Experimental) +============================= +https://openjdk.java.net/jeps/365 + +Port the ZGC garbage collector to Windows. + +ZGC: A Scalable Low-Latency Garbage Collector (Production) +========================================================== +https://openjdk.java.net/jeps/377 + +Change the Z Garbage Collector from an experimental feature into a +product feature. + +ZGC: Concurrent Thread-Stack Processing +======================================= +https://openjdk.java.net/jeps/376 + +Move ZGC thread-stack processing from safepoints to a concurrent +phase. + +Elastic Metaspace +================= +https://openjdk.java.net/jeps/387 + +Return unused HotSpot class-metadata (i.e., metaspace) memory to the +operating system more promptly, reduce metaspace footprint, and +simplify the metaspace code in order to reduce maintenance costs. + +Ports +===== + +Alpine Linux Port +================= +https://openjdk.java.net/jeps/386 + +Port the JDK to Alpine Linux, and to other Linux distributions that +use musl as their primary C library, on both the x64 and AArch64 +architectures, + +Windows/AArch64 Port +==================== +https://openjdk.java.net/jeps/388 + +Port the JDK to Windows/AArch64. + +New macOS Rendering Pipeline +============================ +https://openjdk.java.net/jeps/382 + +Implement a Java 2D internal rendering pipeline for macOS using the +Apple Metal API as alternative to the existing pipeline, which uses +the deprecated Apple OpenGL API. + +macOS/AArch64 Port +================== +https://openjdk.java.net/jeps/391 + +Port the JDK to macOS/AArch64. + +DEPRECATIONS +============ + +Deprecate the ParallelScavenge + SerialOld GC Combination +========================================================= +https://openjdk.java.net/jeps/366 + +Deprecate the combination of the Parallel Scavenge and Serial Old +garbage collection algorithms. + +Deprecate and Disable Biased Locking +==================================== +https://openjdk.java.net/jeps/374 + +Disable biased locking by default, and deprecate all related +command-line options. + +Warnings for Value-Based Classes +================================ +https://openjdk.java.net/jeps/390 + +Designate the primitive wrapper classes as value-based and deprecate +their constructors for removal, prompting new deprecation +warnings. Provide warnings about improper attempts to synchronize on +instances of any value-based classes in the Java Platform. + +Deprecate the Applet API for Removal +==================================== +https://openjdk.java.net/jeps/398 + +Deprecate the Applet API for removal. It is essentially irrelevant +since all web-browser vendors have either removed support for Java +browser plug-ins or announced plans to do so. + +Deprecate the Security Manager for Removal +========================================== +https://openjdk.java.net/jeps/411 + +Deprecate the Security Manager for removal in a future release. The +Security Manager dates from Java 1.0. It has not been the primary +means of securing client-side Java code for many years, and it has +rarely been used to secure server-side code. To move Java forward, we +intend to deprecate the Security Manager for removal in concert with +the legacy Applet API (see above). . + +REMOVALS +======== + +Remove the Concurrent Mark Sweep (CMS) Garbage Collector +======================================================== +https://openjdk.java.net/jeps/363 + +Remove the Concurrent Mark Sweep (CMS) garbage collector. + +Remove the Pack200 Tools and API +================================ +https://openjdk.java.net/jeps/336 +https://openjdk.java.net/jeps/367 + +Remove the `pack200` and `unpack200` tools, and the `Pack200` API in +the `java.util.jar` package. These tools and API were deprecated for +removal in OpenJDK 11 with the express intent to remove them in a +future release. + +Remove the Nashorn JavaScript Engine +==================================== +https://openjdk.java.net/jeps/372 + +Remove the Nashorn JavaScript script engine and APIs, and the `jjs` +tool. The engine, the APIs, and the tool were deprecated for removal +in OpenJDK 11 with the express intent to remove them in a future +release. + +Remove the Solaris and SPARC Ports +================================== +https://openjdk.java.net/jeps/362 +https://openjdk.java.net/jeps/381 + +Remove the source code and build support for the Solaris/SPARC, +Solaris/x64, and Linux/SPARC ports. These ports were deprecated for +removal in OpenJDK 14 (JEP 362) and removed in OpenJDK 15 (JEP 381). + +Remove RMI Activation +===================== +https://openjdk.java.net/jeps/385 +https://openjdk.java.net/jeps/407 +https://docs.oracle.com/en/java/javase/14/docs/specs/rmi/activation.html + +Remove the Remote Method Invocation (RMI) Activation mechanism, while +preserving the rest of RMI. RMI Activation is an obsolete part of RMI +that has been optional since OpenJDK 8 and was deprecated in OpenJDK +15. + +Remove the Experimental AOT and JIT Compiler +============================================ +https://openjdk.java.net/jeps/410 + +Remove the experimental Java-based ahead-of-time (AOT) and +just-in-time (JIT) compiler. This compiler has seen little use since +its introduction and the effort required to maintain it is +significant. Retain the experimental Java-level JVM compiler +interface (JVMCI) so that developers can continue to use +externally-built versions of the compiler for JIT compilation. diff --git a/TestCryptoLevel.java b/TestCryptoLevel.java new file mode 100644 index 0000000..b32b7ae --- /dev/null +++ b/TestCryptoLevel.java @@ -0,0 +1,72 @@ +/* TestCryptoLevel -- Ensure unlimited crypto policy is in use. + Copyright (C) 2012 Red Hat, Inc. + +This program is free software: you can redistribute it and/or modify +it under the terms of the GNU Affero General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. + +This program is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU Affero General Public License for more details. + +You should have received a copy of the GNU Affero General Public License +along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +import java.lang.reflect.Field; +import java.lang.reflect.Method; +import java.lang.reflect.InvocationTargetException; + +import java.security.Permission; +import java.security.PermissionCollection; + +public class TestCryptoLevel +{ + public static void main(String[] args) + throws NoSuchFieldException, ClassNotFoundException, + IllegalAccessException, InvocationTargetException + { + Class<?> cls = null; + Method def = null, exempt = null; + + try + { + cls = Class.forName("javax.crypto.JceSecurity"); + } + catch (ClassNotFoundException ex) + { + System.err.println("Running a non-Sun JDK."); + System.exit(0); + } + try + { + def = cls.getDeclaredMethod("getDefaultPolicy"); + exempt = cls.getDeclaredMethod("getExemptPolicy"); + } + catch (NoSuchMethodException ex) + { + System.err.println("Running IcedTea with the original crypto patch."); + System.exit(0); + } + def.setAccessible(true); + exempt.setAccessible(true); + PermissionCollection defPerms = (PermissionCollection) def.invoke(null); + PermissionCollection exemptPerms = (PermissionCollection) exempt.invoke(null); + Class<?> apCls = Class.forName("javax.crypto.CryptoAllPermission"); + Field apField = apCls.getDeclaredField("INSTANCE"); + apField.setAccessible(true); + Permission allPerms = (Permission) apField.get(null); + if (defPerms.implies(allPerms) && (exemptPerms == null || exemptPerms.implies(allPerms))) + { + System.err.println("Running with the unlimited policy."); + System.exit(0); + } + else + { + System.err.println("WARNING: Running with a restricted crypto policy."); + System.exit(-1); + } + } +} diff --git a/TestECDSA.java b/TestECDSA.java new file mode 100644 index 0000000..6eb9cb2 --- /dev/null +++ b/TestECDSA.java @@ -0,0 +1,49 @@ +/* TestECDSA -- Ensure ECDSA signatures are working. + Copyright (C) 2016 Red Hat, Inc. + +This program is free software: you can redistribute it and/or modify +it under the terms of the GNU Affero General Public License as +published by the Free Software Foundation, either version 3 of the +License, or (at your option) any later version. + +This program is distributed in the hope that it will be useful, +but WITHOUT ANY WARRANTY; without even the implied warranty of +MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +GNU Affero General Public License for more details. + +You should have received a copy of the GNU Affero General Public License +along with this program. If not, see <http://www.gnu.org/licenses/>. +*/ + +import java.math.BigInteger; +import java.security.KeyPair; +import java.security.KeyPairGenerator; +import java.security.Signature; + +/** + * @test + */ +public class TestECDSA { + + public static void main(String[] args) throws Exception { + KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC"); + KeyPair key = keyGen.generateKeyPair(); + + byte[] data = "This is a string to sign".getBytes("UTF-8"); + + Signature dsa = Signature.getInstance("NONEwithECDSA"); + dsa.initSign(key.getPrivate()); + dsa.update(data); + byte[] sig = dsa.sign(); + System.out.println("Signature: " + new BigInteger(1, sig).toString(16)); + + Signature dsaCheck = Signature.getInstance("NONEwithECDSA"); + dsaCheck.initVerify(key.getPublic()); + dsaCheck.update(data); + boolean success = dsaCheck.verify(sig); + if (!success) { + throw new RuntimeException("Test failed. Signature verification error"); + } + System.out.println("Test passed."); + } +} diff --git a/TestSecurityProperties.java b/TestSecurityProperties.java new file mode 100644 index 0000000..06a0b07 --- /dev/null +++ b/TestSecurityProperties.java @@ -0,0 +1,43 @@ +import java.io.File; +import java.io.FileInputStream; +import java.security.Security; +import java.util.Properties; + +public class TestSecurityProperties { + // JDK 11 + private static final String JDK_PROPS_FILE_JDK_11 = System.getProperty("java.home") + "/conf/security/java.security"; + // JDK 8 + private static final String JDK_PROPS_FILE_JDK_8 = System.getProperty("java.home") + "/lib/security/java.security"; + + public static void main(String[] args) { + Properties jdkProps = new Properties(); + loadProperties(jdkProps); + for (Object key: jdkProps.keySet()) { + String sKey = (String)key; + String securityVal = Security.getProperty(sKey); + String jdkSecVal = jdkProps.getProperty(sKey); + if (!securityVal.equals(jdkSecVal)) { + String msg = "Expected value '" + jdkSecVal + "' for key '" + + sKey + "'" + " but got value '" + securityVal + "'"; + throw new RuntimeException("Test failed! " + msg); + } else { + System.out.println("DEBUG: " + sKey + " = " + jdkSecVal + " as expected."); + } + } + System.out.println("TestSecurityProperties PASSED!"); + } + + private static void loadProperties(Properties props) { + String javaVersion = System.getProperty("java.version"); + System.out.println("Debug: Java version is " + javaVersion); + String propsFile = JDK_PROPS_FILE_JDK_11; + if (javaVersion.startsWith("1.8.0")) { + propsFile = JDK_PROPS_FILE_JDK_8; + } + try (FileInputStream fin = new FileInputStream(new File(propsFile))) { + props.load(fin); + } catch (Exception e) { + throw new RuntimeException("Test failed!", e); + } + } +} diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec new file mode 100644 index 0000000..bd2d867 --- /dev/null +++ b/java-17-openjdk.spec @@ -0,0 +1,2360 @@ +# RPM conditionals so as to be able to dynamically produce +# slowdebug/release builds. See: +# http://rpm.org/user_doc/conditional_builds.html +# +# Examples: +# +# Produce release, fastdebug *and* slowdebug builds on x86_64 (default): +# $ rpmbuild -ba java-17-openjdk.spec +# +# Produce only release builds (no debug builds) on x86_64: +# $ rpmbuild -ba java-17-openjdk.spec --without slowdebug --without fastdebug +# +# Only produce a release build on x86_64: +# $ fedpkg mockbuild --without slowdebug --without fastdebug + +# Enable fastdebug builds by default on relevant arches. +%bcond_without fastdebug +# Enable slowdebug builds by default on relevant arches. +%bcond_without slowdebug +# Enable release builds by default on relevant arches. +%bcond_without release +# Enable static library builds by default. +%bcond_without staticlibs + +# Workaround for stripping of debug symbols from static libraries +%if %{with staticlibs} +%define __brp_strip_static_archive %{nil} +%global include_staticlibs 1 +%else +%global include_staticlibs 0 +%endif + +# The -g flag says to use strip -g instead of full strip on DSOs or EXEs. +# This fixes detailed NMT and other tools which need minimal debug info. +# See: https://bugzilla.redhat.com/show_bug.cgi?id=1520879 +%global _find_debuginfo_opts -g + +# With LTO flags enabled, debuginfo checks fail for some reason. Disable +# LTO for a passing build. This really needs to be looked at. +%define _lto_cflags %{nil} + +# note: parametrized macros are order-sensitive (unlike not-parametrized) even with normal macros +# also necessary when passing it as parameter to other macros. If not macro, then it is considered a switch +# see the difference between global and define: +# See https://github.com/rpm-software-management/rpm/issues/127 to comments at "pmatilai commented on Aug 18, 2017" +# (initiated in https://bugzilla.redhat.com/show_bug.cgi?id=1482192) +%global debug_suffix_unquoted -slowdebug +%global fastdebug_suffix_unquoted -fastdebug +%global main_suffix_unquoted -main +%global staticlibs_suffix_unquoted -staticlibs +# quoted one for shell operations +%global debug_suffix "%{debug_suffix_unquoted}" +%global fastdebug_suffix "%{fastdebug_suffix_unquoted}" +%global normal_suffix "" +%global main_suffix "%{main_suffix_unquoted}" +%global staticlibs_suffix "%{staticlibs_suffix_unquoted}" + +%global debug_warning This package is unoptimised with full debugging. Install only as needed and remove ASAP. +%global fastdebug_warning This package is optimised with full debugging. Install only as needed and remove ASAP. +%global debug_on unoptimised with full debugging on +%global fastdebug_on optimised with full debugging on +%global for_fastdebug for packages with debugging on and optimisation +%global for_debug for packages with debugging on and no optimisation + +%if %{with release} +%global include_normal_build 1 +%else +%global include_normal_build 0 +%endif + +%if %{include_normal_build} +%global normal_build %{normal_suffix} +%else +%global normal_build %{nil} +%endif + +# We have hardcoded list of files, which is appearing in alternatives, and in files +# in alternatives those are slaves and master, very often triplicated by man pages +# in files all masters and slaves are ghosted +# the ghosts are here to allow installation via query like `dnf install /usr/bin/java` +# you can list those files, with appropriate sections: cat *.spec | grep -e --install -e --slave -e post_ -e alternatives +# TODO - fix those hardcoded lists via single list +# Those files must *NOT* be ghosted for *slowdebug* packages +# FIXME - if you are moving jshell or jlink or similar, always modify all three sections +# you can check via headless and devels: +# rpm -ql --noghost java-11-openjdk-headless-11.0.1.13-8.fc29.x86_64.rpm | grep bin +# == rpm -ql java-11-openjdk-headless-slowdebug-11.0.1.13-8.fc29.x86_64.rpm | grep bin +# != rpm -ql java-11-openjdk-headless-11.0.1.13-8.fc29.x86_64.rpm | grep bin +# similarly for other %%{_jvmdir}/{jre,java} and %%{_javadocdir}/{java,java-zip} +%define is_release_build() %( if [ "%{?1}" == "%{debug_suffix_unquoted}" -o "%{?1}" == "%{fastdebug_suffix_unquoted}" ]; then echo "0" ; else echo "1"; fi ) + +# while JDK is a techpreview(is_system_jdk=0), some provides are turned off. Once jdk stops to be an techpreview, move it to 1 +# as sytem JDK, we mean any JDK which can run whole system java stack without issues (like bytecode issues, module issues, dependencies...) +%global is_system_jdk 0 + +%global aarch64 aarch64 arm64 armv8 +# we need to distinguish between big and little endian PPC64 +%global ppc64le ppc64le +%global ppc64be ppc64 ppc64p7 +# Set of architectures which support multiple ABIs +%global multilib_arches %{power64} sparc64 x86_64 +# Set of architectures for which we build debug builds +%global debug_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} s390x +# Set of architectures with a Just-In-Time (JIT) compiler +%global jit_arches %{debug_arches} %{arm} +# Set of architectures which run a full bootstrap cycle +%global bootstrap_arches %{jit_arches} +# Set of architectures which support SystemTap tapsets +%global systemtap_arches %{jit_arches} +# Set of architectures with a Ahead-Of-Time (AOT) compiler +%global aot_arches x86_64 %{aarch64} +%global fastdebug_arches x86_64 ppc64le aarch64 +# Set of architectures which support the serviceability agent +%global sa_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} %{arm} +# Set of architectures which support class data sharing +# See https://bugzilla.redhat.com/show_bug.cgi?id=513605 +# MetaspaceShared::generate_vtable_methods is not implemented for the PPC JIT +%global share_arches %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{arm} s390x +# Set of architectures for which we build the Shenandoah garbage collector +%global shenandoah_arches x86_64 %{aarch64} +# Set of architectures for which we build the Z garbage collector +%global zgc_arches x86_64 +# Set of architectures for which alt-java has SSB mitigation +%global ssbd_arches x86_64 +# Set of architectures for which java has short vector math library (libsvml.so) +%global svml_arches x86_64 + +# By default, we build a debug build during main build on JIT architectures +%if %{with slowdebug} +%ifarch %{debug_arches} +%global include_debug_build 1 +%else +%global include_debug_build 0 +%endif +%else +%global include_debug_build 0 +%endif + +# On certain architectures, we compile the Shenandoah GC +%ifarch %{shenandoah_arches} +%global use_shenandoah_hotspot 1 +%else +%global use_shenandoah_hotspot 0 +%endif + +# By default, we build a fastdebug build during main build only on fastdebug architectures +%if %{with fastdebug} +%ifarch %{fastdebug_arches} +%global include_fastdebug_build 1 +%else +%global include_fastdebug_build 0 +%endif +%else +%global include_fastdebug_build 0 +%endif + +%if %{include_debug_build} +%global slowdebug_build %{debug_suffix} +%else +%global slowdebug_build %{nil} +%endif + +%if %{include_fastdebug_build} +%global fastdebug_build %{fastdebug_suffix} +%else +%global fastdebug_build %{nil} +%endif + +# If you disable both builds, then the build fails +# Build and test slowdebug first as it provides the best diagnostics +%global build_loop %{slowdebug_build} %{fastdebug_build} %{normal_build} + +%if %{include_staticlibs} +%global staticlibs_loop %{staticlibs_suffix} +%else +%global staticlibs_loop %{nil} +%endif + +%ifarch %{bootstrap_arches} +%global bootstrap_build true +%else +%global bootstrap_build false +%endif + +%if %{include_staticlibs} +# Extra target for producing the static-libraries. Separate from +# other targets since this target is configured to use in-tree +# AWT dependencies: lcms, libjpeg, libpng, libharfbuzz, giflib +# and possibly others +%global static_libs_target static-libs-image +%else +%global static_libs_target %{nil} +%endif + +# RPM JDK builds keep the debug symbols internal, to be later stripped by RPM +%global debug_symbols internal + +# unlike portables,the rpms have to use static_libs_target very dynamically +%global bootstrap_targets images +%global release_targets images docs-zip +# No docs nor bootcycle for debug builds +%global debug_targets images + + +# Filter out flags from the optflags macro that cause problems with the OpenJDK build +# We filter out -O flags so that the optimization of HotSpot is not lowered from O3 to O2 +# We filter out -Wall which will otherwise cause HotSpot to produce hundreds of thousands of warnings (100+mb logs) +# We replace it with -Wformat (required by -Werror=format-security) and -Wno-cpp to avoid FORTIFY_SOURCE warnings +# We filter out -fexceptions as the HotSpot build explicitly does -fno-exceptions and it's otherwise the default for C++ +%global ourflags %(echo %optflags | sed -e 's|-Wall|-Wformat -Wno-cpp|' | sed -r -e 's|-O[0-9]*||') +%global ourcppflags %(echo %ourflags | sed -e 's|-fexceptions||') +%global ourldflags %{__global_ldflags} + +# With disabled nss is NSS deactivated, so NSS_LIBDIR can contain the wrong path +# the initialization must be here. Later the pkg-config have buggy behavior +# looks like openjdk RPM specific bug +# Always set this so the nss.cfg file is not broken +%global NSS_LIBDIR %(pkg-config --variable=libdir nss) + +# In some cases, the arch used by the JDK does +# not match _arch. +# Also, in some cases, the machine name used by SystemTap +# does not match that given by _build_cpu +%ifarch x86_64 +%global archinstall amd64 +%endif +%ifarch ppc +%global archinstall ppc +%endif +%ifarch %{ppc64be} +%global archinstall ppc64 +%endif +%ifarch %{ppc64le} +%global archinstall ppc64le +%endif +%ifarch %{ix86} +%global archinstall i686 +%endif +%ifarch ia64 +%global archinstall ia64 +%endif +%ifarch s390 +%global archinstall s390 +%endif +%ifarch s390x +%global archinstall s390x +%endif +%ifarch %{arm} +%global archinstall arm +%endif +%ifarch %{aarch64} +%global archinstall aarch64 +%endif +# 32 bit sparc, optimized for v9 +%ifarch sparcv9 +%global archinstall sparc +%endif +# 64 bit sparc +%ifarch sparc64 +%global archinstall sparcv9 +%endif +%ifnarch %{jit_arches} +%global archinstall %{_arch} +%endif + + + +%ifarch %{systemtap_arches} +%global with_systemtap 1 +%else +%global with_systemtap 0 +%endif + +# New Version-String scheme-style defines +%global featurever 17 +%global interimver 0 +%global updatever 1 +%global patchver 0 +# If you bump featurever, you must also bump vendor_version_string +# Used via new version scheme. JDK 17 was +# GA'ed in September 2021 => 21.9 +%global vendor_version_string 21.9 +# buildjdkver is usually same as %%{featurever}, +# but in time of bootstrap of next jdk, it is featurever-1, +# and this it is better to change it here, on single place +%global buildjdkver 17 +# We don't add any LTS designator for STS packages (this package). +# Neither for Fedora nor EPEL which would have %%{rhel} macro defined. + %global lts_designator "" + %global lts_designator_zip "" + +# Define IcedTea version used for SystemTap tapsets and desktop file +%global icedteaver 6.0.0pre00-c848b93a8598 + +# Standard JPackage naming and versioning defines +%global origin openjdk +%global origin_nice OpenJDK +%global top_level_dir_name %{origin} +%global top_level_dir_name_backup %{top_level_dir_name}-backup +%global buildver 12 +%global rpmrelease 8 +# Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit +%if %is_system_jdk +# Using 10 digits may overflow the int used for priority, so we combine the patch and build versions +# It is very unlikely we will ever have a patch version > 4 or a build version > 20, so we combine as (patch * 20) + build. +# This means 11.0.9.0+11 would have had a priority of 11000911 as before +# A 11.0.9.1+1 would have had a priority of 11000921 (20 * 1 + 1), thus ensuring it is bigger than 11.0.9.0+11 +%global combiver $( expr 20 '*' %{patchver} + %{buildver} ) +%global priority %( printf '%02d%02d%02d%02d' %{featurever} %{interimver} %{updatever} %{combiver} ) +%else +# for techpreview, using 1, so slowdebugs can have 0 +%global priority %( printf '%08d' 1 ) +%endif +%global newjavaver %{featurever}.%{interimver}.%{updatever}.%{patchver} +%global javaver %{featurever} + +# Strip up to 6 trailing zeros in newjavaver, as the JDK does, to get the correct version used in filenames +%global filever %(svn=%{newjavaver}; for i in 1 2 3 4 5 6 ; do svn=${svn%%.0} ; done; echo ${svn}) + +# Define milestone (EA for pre-releases, GA for releases) +# Release will be (where N is usually a number starting at 1): +# - 0.N%%{?extraver}%%{?dist} for EA releases, +# - N%%{?extraver}{?dist} for GA releases +%global is_ga 1 +%if %{is_ga} +%global build_type GA +%global expected_ea_designator "" +%global ea_designator_zip "" +%global extraver %{nil} +%global eaprefix %{nil} +%else +%global build_type EA +%global expected_ea_designator ea +%global ea_designator_zip -%{expected_ea_designator} +%global extraver .%{expected_ea_designator} +%global eaprefix 0. +%endif + +# Define what url should JVM offer in case of a crash report +# order may be important, epel may have rhel declared +%if 0%{?epel} +%global bugs https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora%20EPEL&component... +%else +%if 0%{?fedora} +# Does not work for rawhide, keeps the version field empty +%global bugs https://bugzilla.redhat.com/enter_bug.cgi?product=Fedora&component=%{name... +%else +%if 0%{?rhel} +%global bugs https://bugzilla.redhat.com/enter_bug.cgi?product=Red%20Hat%20Enterprise%... +%else +%global bugs https://bugzilla.redhat.com/enter_bug.cgi +%endif +%endif +%endif + +# parametrized macros are order-sensitive +%global compatiblename java-%{featurever}-%{origin} +%global fullversion %{compatiblename}-%{version}-%{release} +# images directories from upstream build +%global jdkimage jdk +%global static_libs_image static-libs +# output dir stub +%define buildoutputdir() %{expand:build/jdk%{featurever}.build%{?1}} +# we can copy the javadoc to not arched dir, or make it not noarch +%define uniquejavadocdir() %{expand:%{fullversion}.%{_arch}%{?1}} +# main id and dir of this jdk +%define uniquesuffix() %{expand:%{fullversion}.%{_arch}%{?1}} + +################################################################# +# fix for https://bugzilla.redhat.com/show_bug.cgi?id=1111349 +# https://bugzilla.redhat.com/show_bug.cgi?id=1590796#c14 +# https://bugzilla.redhat.com/show_bug.cgi?id=1655938 +%global _privatelibs libsplashscreen[.]so.*|libawt_xawt[.]so.*|libjli[.]so.*|libattach[.]so.*|libawt[.]so.*|libextnet[.]so.*|libawt_headless[.]so.*|libdt_socket[.]so.*|libfontmanager[.]so.*|libinstrument[.]so.*|libj2gss[.]so.*|libj2pcsc[.]so.*|libj2pkcs11[.]so.*|libjaas[.]so.*|libjavajpeg[.]so.*|libjdwp[.]so.*|libjimage[.]so.*|libjsound[.]so.*|liblcms[.]so.*|libmanagement[.]so.*|libmanagement_agent[.]so.*|libmanagement_ext[.]so.*|libmlib_image[.]so.*|libnet[.]so.*|libnio[.]so.*|libprefs[.]so.*|librmi[.]so.*|libsaproc[.]so.*|libsctp[.]so.*|libsystemconf[.]so.*|libzip[.]so.* +%global _publiclibs libjawt[.]so.*|libjava[.]so.*|libjvm[.]so.*|libverify[.]so.*|libjsig[.]so.* +%if %is_system_jdk +%global __provides_exclude ^(%{_privatelibs})$ +%global __requires_exclude ^(%{_privatelibs})$ +# Never generate lib-style provides/requires for any debug packages +%global __provides_exclude_from ^.*/%{uniquesuffix -- %{debug_suffix_unquoted}}/.*$ +%global __requires_exclude_from ^.*/%{uniquesuffix -- %{debug_suffix_unquoted}}/.*$ +%global __provides_exclude_from ^.*/%{uniquesuffix -- %{fastdebug_suffix_unquoted}}/.*$ +%global __requires_exclude_from ^.*/%{uniquesuffix -- %{fastdebug_suffix_unquoted}}/.*$ +%else +# Don't generate provides/requires for JDK provided shared libraries at all. +%global __provides_exclude ^(%{_privatelibs}|%{_publiclibs})$ +%global __requires_exclude ^(%{_privatelibs}|%{_publiclibs})$ +%endif + + +%global etcjavasubdir %{_sysconfdir}/java/java-%{javaver}-%{origin} +%define etcjavadir() %{expand:%{etcjavasubdir}/%{uniquesuffix -- %{?1}}} +# Standard JPackage directories and symbolic links. +%define sdkdir() %{expand:%{uniquesuffix -- %{?1}}} +%define jrelnk() %{expand:jre-%{javaver}-%{origin}-%{version}-%{release}.%{_arch}%{?1}} + +%define sdkbindir() %{expand:%{_jvmdir}/%{sdkdir -- %{?1}}/bin} +%define jrebindir() %{expand:%{_jvmdir}/%{sdkdir -- %{?1}}/bin} + +%global alt_java_name alt-java + +%global rpm_state_dir %{_localstatedir}/lib/rpm-state/ + +# For flatpack builds hard-code /usr/sbin/alternatives, +# otherwise use %%{_sbindir} relative path. +%if 0%{?flatpak} +%global alternatives_requires /usr/sbin/alternatives +%else +%global alternatives_requires %{_sbindir}/alternatives +%endif + +%if %{with_systemtap} +# Where to install systemtap tapset (links) +# We would like these to be in a package specific sub-dir, +# but currently systemtap doesn't support that, so we have to +# use the root tapset dir for now. To distinguish between 64 +# and 32 bit architectures we place the tapsets under the arch +# specific dir (note that systemtap will only pickup the tapset +# for the primary arch for now). Systemtap uses the machine name +# aka build_cpu as architecture specific directory name. +%global tapsetroot /usr/share/systemtap +%global tapsetdirttapset %{tapsetroot}/tapset/ +%global tapsetdir %{tapsetdirttapset}/%{_build_cpu} +%endif + +# not-duplicated scriptlets for normal/debug packages +%global update_desktop_icons /usr/bin/gtk-update-icon-cache %{_datadir}/icons/hicolor &>/dev/null || : + + +%define post_script() %{expand: +update-desktop-database %{_datadir}/applications &> /dev/null || : +/bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || : +exit 0 +} + +%define alternatives_java_install() %{expand: +PRIORITY=%{priority} +if [ "%{?1}" == %{debug_suffix} ]; then + let PRIORITY=PRIORITY-1 +fi + +ext=.gz +alternatives \\ + --install %{_bindir}/java java %{jrebindir -- %{?1}}/java $PRIORITY --family %{name}.%{_arch} \\ + --slave %{_jvmdir}/jre jre %{_jvmdir}/%{sdkdir -- %{?1}} \\ + --slave %{_bindir}/%{alt_java_name} %{alt_java_name} %{jrebindir -- %{?1}}/%{alt_java_name} \\ + --slave %{_bindir}/keytool keytool %{jrebindir -- %{?1}}/keytool \\ + --slave %{_bindir}/rmiregistry rmiregistry %{jrebindir -- %{?1}}/rmiregistry \\ + --slave %{_mandir}/man1/java.1$ext java.1$ext \\ + %{_mandir}/man1/java-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/%{alt_java_name}.1$ext %{alt_java_name}.1$ext \\ + %{_mandir}/man1/%{alt_java_name}-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/keytool.1$ext keytool.1$ext \\ + %{_mandir}/man1/keytool-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/rmiregistry.1$ext rmiregistry.1$ext \\ + %{_mandir}/man1/rmiregistry-%{uniquesuffix -- %{?1}}.1$ext + +for X in %{origin} %{javaver} ; do + alternatives --install %{_jvmdir}/jre-"$X" jre_"$X" %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family %{name}.%{_arch} +done + +alternatives --install %{_jvmdir}/jre-%{javaver}-%{origin} jre_%{javaver}_%{origin} %{_jvmdir}/%{jrelnk -- %{?1}} $PRIORITY --family %{name}.%{_arch} +} + +%define post_headless() %{expand: +%ifarch %{share_arches} +%{jrebindir -- %{?1}}/java -Xshare:dump >/dev/null 2>/dev/null +%endif + +update-desktop-database %{_datadir}/applications &> /dev/null || : +/bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || : + +# see pretrans where this file is declared +# also see that pretrans is only for non-debug +if [ ! "%{?1}" == %{debug_suffix} ]; then + if [ -f %{_libexecdir}/copy_jdk_configs_fixFiles.sh ] ; then + sh %{_libexecdir}/copy_jdk_configs_fixFiles.sh %{rpm_state_dir}/%{name}.%{_arch} %{_jvmdir}/%{sdkdir -- %{?1}} + fi +fi + +exit 0 +} + +%define postun_script() %{expand: +update-desktop-database %{_datadir}/applications &> /dev/null || : +if [ $1 -eq 0 ] ; then + /bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null + %{update_desktop_icons} +fi +exit 0 +} + + +%define postun_headless() %{expand: + alternatives --remove java %{jrebindir -- %{?1}}/java + alternatives --remove jre_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} + alternatives --remove jre_%{javaver} %{_jvmdir}/%{sdkdir -- %{?1}} + alternatives --remove jre_%{javaver}_%{origin} %{_jvmdir}/%{jrelnk -- %{?1}} +} + +%define posttrans_script() %{expand: +%{update_desktop_icons} +} + + +%define alternatives_javac_install() %{expand: +PRIORITY=%{priority} +if [ "%{?1}" == %{debug_suffix} ]; then + let PRIORITY=PRIORITY-1 +fi + +ext=.gz +alternatives \\ + --install %{_bindir}/javac javac %{sdkbindir -- %{?1}}/javac $PRIORITY --family %{name}.%{_arch} \\ + --slave %{_jvmdir}/java java_sdk %{_jvmdir}/%{sdkdir -- %{?1}} \\ + --slave %{_bindir}/jlink jlink %{sdkbindir -- %{?1}}/jlink \\ + --slave %{_bindir}/jmod jmod %{sdkbindir -- %{?1}}/jmod \\ +%ifarch %{sa_arches} + --slave %{_bindir}/jhsdb jhsdb %{sdkbindir -- %{?1}}/jhsdb \\ +%endif + --slave %{_bindir}/jar jar %{sdkbindir -- %{?1}}/jar \\ + --slave %{_bindir}/jarsigner jarsigner %{sdkbindir -- %{?1}}/jarsigner \\ + --slave %{_bindir}/javadoc javadoc %{sdkbindir -- %{?1}}/javadoc \\ + --slave %{_bindir}/javap javap %{sdkbindir -- %{?1}}/javap \\ + --slave %{_bindir}/jcmd jcmd %{sdkbindir -- %{?1}}/jcmd \\ + --slave %{_bindir}/jconsole jconsole %{sdkbindir -- %{?1}}/jconsole \\ + --slave %{_bindir}/jdb jdb %{sdkbindir -- %{?1}}/jdb \\ + --slave %{_bindir}/jdeps jdeps %{sdkbindir -- %{?1}}/jdeps \\ + --slave %{_bindir}/jdeprscan jdeprscan %{sdkbindir -- %{?1}}/jdeprscan \\ + --slave %{_bindir}/jfr jfr %{sdkbindir -- %{?1}}/jfr \\ + --slave %{_bindir}/jimage jimage %{sdkbindir -- %{?1}}/jimage \\ + --slave %{_bindir}/jinfo jinfo %{sdkbindir -- %{?1}}/jinfo \\ + --slave %{_bindir}/jmap jmap %{sdkbindir -- %{?1}}/jmap \\ + --slave %{_bindir}/jps jps %{sdkbindir -- %{?1}}/jps \\ + --slave %{_bindir}/jpackage jpackage %{sdkbindir -- %{?1}}/jpackage \\ + --slave %{_bindir}/jrunscript jrunscript %{sdkbindir -- %{?1}}/jrunscript \\ + --slave %{_bindir}/jshell jshell %{sdkbindir -- %{?1}}/jshell \\ + --slave %{_bindir}/jstack jstack %{sdkbindir -- %{?1}}/jstack \\ + --slave %{_bindir}/jstat jstat %{sdkbindir -- %{?1}}/jstat \\ + --slave %{_bindir}/jstatd jstatd %{sdkbindir -- %{?1}}/jstatd \\ + --slave %{_bindir}/serialver serialver %{sdkbindir -- %{?1}}/serialver \\ + --slave %{_mandir}/man1/jar.1$ext jar.1$ext \\ + %{_mandir}/man1/jar-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jarsigner.1$ext jarsigner.1$ext \\ + %{_mandir}/man1/jarsigner-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/javac.1$ext javac.1$ext \\ + %{_mandir}/man1/javac-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/javadoc.1$ext javadoc.1$ext \\ + %{_mandir}/man1/javadoc-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/javap.1$ext javap.1$ext \\ + %{_mandir}/man1/javap-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jcmd.1$ext jcmd.1$ext \\ + %{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jconsole.1$ext jconsole.1$ext \\ + %{_mandir}/man1/jconsole-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jdb.1$ext jdb.1$ext \\ + %{_mandir}/man1/jdb-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jdeps.1$ext jdeps.1$ext \\ + %{_mandir}/man1/jdeps-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jinfo.1$ext jinfo.1$ext \\ + %{_mandir}/man1/jinfo-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jmap.1$ext jmap.1$ext \\ + %{_mandir}/man1/jmap-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jps.1$ext jps.1$ext \\ + %{_mandir}/man1/jps-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jpackage.1$ext jpackage.1$ext \\ + %{_mandir}/man1/jpackage-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jrunscript.1$ext jrunscript.1$ext \\ + %{_mandir}/man1/jrunscript-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jstack.1$ext jstack.1$ext \\ + %{_mandir}/man1/jstack-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jstat.1$ext jstat.1$ext \\ + %{_mandir}/man1/jstat-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/jstatd.1$ext jstatd.1$ext \\ + %{_mandir}/man1/jstatd-%{uniquesuffix -- %{?1}}.1$ext \\ + --slave %{_mandir}/man1/serialver.1$ext serialver.1$ext \\ + %{_mandir}/man1/serialver-%{uniquesuffix -- %{?1}}.1$ext \\ + +for X in %{origin} %{javaver} ; do + alternatives \\ + --install %{_jvmdir}/java-"$X" java_sdk_"$X" %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family %{name}.%{_arch} +done + +update-alternatives --install %{_jvmdir}/java-%{javaver}-%{origin} java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} $PRIORITY --family %{name}.%{_arch} +} + +%define post_devel() %{expand: +update-desktop-database %{_datadir}/applications &> /dev/null || : +/bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null || : + +exit 0 +} + +%define postun_devel() %{expand: + alternatives --remove javac %{sdkbindir -- %{?1}}/javac + alternatives --remove java_sdk_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} + alternatives --remove java_sdk_%{javaver} %{_jvmdir}/%{sdkdir -- %{?1}} + alternatives --remove java_sdk_%{javaver}_%{origin} %{_jvmdir}/%{sdkdir -- %{?1}} + +update-desktop-database %{_datadir}/applications &> /dev/null || : + +if [ $1 -eq 0 ] ; then + /bin/touch --no-create %{_datadir}/icons/hicolor &>/dev/null + %{update_desktop_icons} +fi +exit 0 +} + +%define posttrans_devel() %{expand: +%{alternatives_javac_install -- %{?1}} +%{update_desktop_icons} +} + +%define alternatives_javadoc_install() %{expand: +PRIORITY=%{priority} +if [ "%{?1}" == %{debug_suffix} ]; then + let PRIORITY=PRIORITY-1 +fi + +alternatives \\ + --install %{_javadocdir}/java javadocdir %{_javadocdir}/%{uniquejavadocdir -- %{?1}}/api \\ + $PRIORITY --family %{name} +exit 0 +} + +%define postun_javadoc() %{expand: + alternatives --remove javadocdir %{_javadocdir}/%{uniquejavadocdir -- %{?1}}/api +exit 0 +} + +%define alternatives_javadoczip_install() %{expand: +PRIORITY=%{priority} +if [ "%{?1}" == %{debug_suffix} ]; then + let PRIORITY=PRIORITY-1 +fi + +alternatives \\ + --install %{_javadocdir}/java-zip javadoczip %{_javadocdir}/%{uniquejavadocdir -- %{?1}}.zip \\ + $PRIORITY --family %{name} +exit 0 +} + +%define postun_javadoc_zip() %{expand: + alternatives --remove javadoczip %{_javadocdir}/%{uniquejavadocdir -- %{?1}}.zip +exit 0 +} + +%define files_jre() %{expand: +%{_datadir}/icons/hicolor/*x*/apps/java-%{javaver}-%{origin}.png +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsplashscreen.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libawt_xawt.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjawt.so +} + + +%define files_jre_headless() %{expand: +%license %{_jvmdir}/%{sdkdir -- %{?1}}/legal +%doc %{_defaultdocdir}/%{uniquejavadocdir -- %{?1}}/NEWS +%dir %{_sysconfdir}/.java/.systemPrefs +%dir %{_sysconfdir}/.java +%dir %{_jvmdir}/%{sdkdir -- %{?1}} +%{_jvmdir}/%{sdkdir -- %{?1}}/release +%{_jvmdir}/%{jrelnk -- %{?1}} +%dir %{_jvmdir}/%{sdkdir -- %{?1}}/bin +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/java +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/%{alt_java_name} +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/keytool +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/rmiregistry +%dir %{_jvmdir}/%{sdkdir -- %{?1}}/lib +%ifarch %{jit_arches} +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/classlist +%endif +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/jexec +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/jspawnhelper +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/jrt-fs.jar +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/modules +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/psfont.properties.ja +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/psfontj2d.properties +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/tzdb.dat +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjli.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/jvm.cfg +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libattach.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libawt.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libextnet.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjsig.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libawt_headless.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libdt_socket.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libfontmanager.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libinstrument.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libj2gss.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libj2pcsc.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libj2pkcs11.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjaas.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjava.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjavajpeg.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjdwp.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjimage.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjsound.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/liblcms.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libmanagement.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libmanagement_agent.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libmanagement_ext.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libmlib_image.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libnet.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libnio.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libprefs.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/librmi.so +# Some architectures don't have the serviceability agent +%ifarch %{sa_arches} +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsaproc.so +%endif +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsctp.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsystemconf.so +%ifarch %{svml_arches} +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsvml.so +%endif +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libsyslookup.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libverify.so +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/libzip.so +%dir %{_jvmdir}/%{sdkdir -- %{?1}}/lib/jfr +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/jfr/default.jfc +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/jfr/profile.jfc +%{_mandir}/man1/java-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/%{alt_java_name}-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/keytool-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/rmiregistry-%{uniquesuffix -- %{?1}}.1* +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/server/ +%ifarch %{share_arches} +%attr(444, root, root) %ghost %{_jvmdir}/%{sdkdir -- %{?1}}/lib/server/classes.jsa +%endif +%dir %{etcjavasubdir} +%dir %{etcjavadir -- %{?1}} +%dir %{etcjavadir -- %{?1}}/lib +%dir %{etcjavadir -- %{?1}}/lib/security +%{etcjavadir -- %{?1}}/lib/security/cacerts +%dir %{etcjavadir -- %{?1}}/conf +%dir %{etcjavadir -- %{?1}}/conf/sdp +%dir %{etcjavadir -- %{?1}}/conf/management +%dir %{etcjavadir -- %{?1}}/conf/security +%dir %{etcjavadir -- %{?1}}/conf/security/policy +%dir %{etcjavadir -- %{?1}}/conf/security/policy/limited +%dir %{etcjavadir -- %{?1}}/conf/security/policy/unlimited +%config(noreplace) %{etcjavadir -- %{?1}}/lib/security/default.policy +%config(noreplace) %{etcjavadir -- %{?1}}/lib/security/blocked.certs +%config(noreplace) %{etcjavadir -- %{?1}}/lib/security/public_suffix_list.dat +%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/policy/limited/exempt_local.policy +%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/policy/limited/default_local.policy +%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/policy/limited/default_US_export.policy +%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/policy/unlimited/default_local.policy +%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/policy/unlimited/default_US_export.policy + %{etcjavadir -- %{?1}}/conf/security/policy/README.txt +%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/java.policy +%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/java.security +%config(noreplace) %{etcjavadir -- %{?1}}/conf/logging.properties +%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/nss.cfg +%config(noreplace) %{etcjavadir -- %{?1}}/conf/security/nss.fips.cfg +%config(noreplace) %{etcjavadir -- %{?1}}/conf/management/jmxremote.access +# This is a config template, thus not config-noreplace +%config %{etcjavadir -- %{?1}}/conf/management/jmxremote.password.template +%config %{etcjavadir -- %{?1}}/conf/sdp/sdp.conf.template +%config(noreplace) %{etcjavadir -- %{?1}}/conf/management/management.properties +%config(noreplace) %{etcjavadir -- %{?1}}/conf/net.properties +%config(noreplace) %{etcjavadir -- %{?1}}/conf/sound.properties +%{_jvmdir}/%{sdkdir -- %{?1}}/conf +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/security +%if %is_system_jdk +%if %{is_release_build -- %{?1}} +%ghost %{_bindir}/java +%ghost %{_bindir}/%{alt_java_name} +%ghost %{_jvmdir}/jre +%ghost %{_bindir}/keytool +%ghost %{_bindir}/pack200 +%ghost %{_bindir}/rmid +%ghost %{_bindir}/rmiregistry +%ghost %{_bindir}/unpack200 +%ghost %{_jvmdir}/jre-%{origin} +%ghost %{_jvmdir}/jre-%{javaver} +%ghost %{_jvmdir}/jre-%{javaver}-%{origin} +%endif +%endif +# https://bugzilla.redhat.com/show_bug.cgi?id=1820172 +# https://docs.fedoraproject.org/en-US/packaging-guidelines/Directory_Repla... +%ghost %{_jvmdir}/%{sdkdir -- %{?1}}/conf.rpmmoved +%ghost %{_jvmdir}/%{sdkdir -- %{?1}}/lib/security.rpmmoved +} + +%define files_devel() %{expand: +%dir %{_jvmdir}/%{sdkdir -- %{?1}}/bin +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jar +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jarsigner +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/javac +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/javadoc +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/javap +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jconsole +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jcmd +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jdb +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jdeps +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jdeprscan +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jfr +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jimage +# Some architectures don't have the serviceability agent +%ifarch %{sa_arches} +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jhsdb +%{_mandir}/man1/jhsdb-%{uniquesuffix -- %{?1}}.1.gz +%endif +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jinfo +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jlink +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jmap +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jmod +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jps +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jpackage +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jrunscript +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jshell +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jstack +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jstat +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/jstatd +%{_jvmdir}/%{sdkdir -- %{?1}}/bin/serialver +%{_jvmdir}/%{sdkdir -- %{?1}}/include +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/ct.sym +%if %{with_systemtap} +%{_jvmdir}/%{sdkdir -- %{?1}}/tapset +%endif +%{_datadir}/applications/*jconsole%{?1}.desktop +%{_mandir}/man1/jar-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jarsigner-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/javac-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/javadoc-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/javap-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jconsole-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jcmd-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jdb-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jdeps-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jinfo-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jmap-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jps-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jpackage-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jrunscript-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jstack-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jstat-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jstatd-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/serialver-%{uniquesuffix -- %{?1}}.1* +%{_mandir}/man1/jdeprscan-%{uniquesuffix -- %{?1}}.1.gz +%{_mandir}/man1/jlink-%{uniquesuffix -- %{?1}}.1.gz +%{_mandir}/man1/jmod-%{uniquesuffix -- %{?1}}.1.gz +%{_mandir}/man1/jshell-%{uniquesuffix -- %{?1}}.1.gz +%{_mandir}/man1/jfr-%{uniquesuffix -- %{?1}}.1.gz + +%if %{with_systemtap} +%dir %{tapsetroot} +%dir %{tapsetdirttapset} +%dir %{tapsetdir} +%{tapsetdir}/*%{_arch}%{?1}.stp +%endif +%if %is_system_jdk +%if %{is_release_build -- %{?1}} +%ghost %{_bindir}/javac +%ghost %{_jvmdir}/java +%ghost %{_jvmdir}/%{alt_java_name} +%ghost %{_bindir}/jlink +%ghost %{_bindir}/jmod +%ghost %{_bindir}/jhsdb +%ghost %{_bindir}/jar +%ghost %{_bindir}/jarsigner +%ghost %{_bindir}/javadoc +%ghost %{_bindir}/javap +%ghost %{_bindir}/jcmd +%ghost %{_bindir}/jconsole +%ghost %{_bindir}/jdb +%ghost %{_bindir}/jdeps +%ghost %{_bindir}/jdeprscan +%ghost %{_bindir}/jimage +%ghost %{_bindir}/jinfo +%ghost %{_bindir}/jmap +%ghost %{_bindir}/jps +%ghost %{_bindir}/jrunscript +%ghost %{_bindir}/jshell +%ghost %{_bindir}/jstack +%ghost %{_bindir}/jstat +%ghost %{_bindir}/jstatd +%ghost %{_bindir}/serialver +%ghost %{_jvmdir}/java-%{origin} +%ghost %{_jvmdir}/java-%{javaver} +%ghost %{_jvmdir}/java-%{javaver}-%{origin} +%endif +%endif +} + +%define files_jmods() %{expand: +%{_jvmdir}/%{sdkdir -- %{?1}}/jmods +} + +%define files_demo() %{expand: +%license %{_jvmdir}/%{sdkdir -- %{?1}}/legal +%{_jvmdir}/%{sdkdir -- %{?1}}/demo +%{_jvmdir}/%{sdkdir -- %{?1}}/sample +} + +%define files_src() %{expand: +%license %{_jvmdir}/%{sdkdir -- %{?1}}/legal +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/src.zip +} + +%define files_static_libs() %{expand: +%dir %{_jvmdir}/%{sdkdir -- %{?1}}/lib/static +%dir %{_jvmdir}/%{sdkdir -- %{?1}}/lib/static/linux-%{archinstall} +%dir %{_jvmdir}/%{sdkdir -- %{?1}}/lib/static/linux-%{archinstall}/glibc +%{_jvmdir}/%{sdkdir -- %{?1}}/lib/static/linux-%{archinstall}/glibc/lib*.a +} + +%define files_javadoc() %{expand: +%doc %{_javadocdir}/%{uniquejavadocdir -- %{?1}} +%license %{_jvmdir}/%{sdkdir -- %{?1}}/legal +%if %is_system_jdk +%if %{is_release_build -- %{?1}} +%ghost %{_javadocdir}/java +%endif +%endif +} + +%define files_javadoc_zip() %{expand: +%doc %{_javadocdir}/%{uniquejavadocdir -- %{?1}}.zip +%license %{_jvmdir}/%{sdkdir -- %{?1}}/legal +%if %is_system_jdk +%if %{is_release_build -- %{?1}} +%ghost %{_javadocdir}/java-zip +%endif +%endif +} + +# not-duplicated requires/provides/obsoletes for normal/debug packages +%define java_rpo() %{expand: +Requires: fontconfig%{?_isa} +Requires: xorg-x11-fonts-Type1 +# Require libXcomposite explicitly since it's only dynamically loaded +# at runtime. Fixes screenshot issues. See JDK-8150954. +Requires: libXcomposite%{?_isa} +# Requires rest of java +Requires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release} +OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release} +# for java-X-openjdk package's desktop binding +%if 0%{?rhel} >= 8 +Recommends: gtk3%{?_isa} +%endif + +Provides: java-%{javaver}-%{origin}%{?1} = %{epoch}:%{version}-%{release} + +# Standard JPackage base provides +Provides: jre-%{javaver}%{?1} = %{epoch}:%{version}-%{release} +Provides: jre-%{javaver}-%{origin}%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{javaver}%{?1} = %{epoch}:%{version}-%{release} +%if %is_system_jdk +Provides: java-%{origin}%{?1} = %{epoch}:%{version}-%{release} +Provides: jre-%{origin}%{?1} = %{epoch}:%{version}-%{release} +Provides: java%{?1} = %{epoch}:%{version}-%{release} +Provides: jre%{?1} = %{epoch}:%{version}-%{release} +%endif +} + +%define java_headless_rpo() %{expand: +# Require /etc/pki/java/cacerts +Requires: ca-certificates +# Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros +Requires: javapackages-filesystem +# Require zone-info data provided by tzdata-java sub-package +Requires: tzdata-java >= 2015d +# for support of kernel stream control +# libsctp.so.1 is being `dlopen`ed on demand +Requires: lksctp-tools%{?_isa} +%if ! 0%{?flatpak} +# tool to copy jdk's configs - should be Recommends only, but then only dnf/yum enforce it, +# not rpm transaction and so no configs are persisted when pure rpm -u is run. It may be +# considered as regression +Requires: copy-jdk-configs >= 4.0 +OrderWithRequires: copy-jdk-configs +%endif +# for printing support +Requires: cups-libs +# Post requires alternatives to install tool alternatives +Requires(post): %{alternatives_requires} +# Postun requires alternatives to uninstall tool alternatives +Requires(postun): %{alternatives_requires} +# for optional support of kernel stream control, card reader and printing bindings +Suggests: lksctp-tools%{?_isa}, pcsc-lite-libs%{?_isa} + +# Standard JPackage base provides +Provides: jre-%{javaver}-%{origin}-headless%{?1} = %{epoch}:%{version}-%{release} +Provides: jre-%{javaver}-headless%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{javaver}-%{origin}-headless%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{javaver}-headless%{?1} = %{epoch}:%{version}-%{release} +%if %is_system_jdk +Provides: java-%{origin}-headless%{?1} = %{epoch}:%{version}-%{release} +Provides: jre-%{origin}-headless%{?1} = %{epoch}:%{version}-%{release} +Provides: jre-headless%{?1} = %{epoch}:%{version}-%{release} +Provides: java-headless%{?1} = %{epoch}:%{version}-%{release} +%endif +} + +%define java_devel_rpo() %{expand: +# Requires base package +Requires: %{name}%{?1}%{?_isa} = %{epoch}:%{version}-%{release} +OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release} +# Post requires alternatives to install tool alternatives +Requires(post): %{alternatives_requires} +# Postun requires alternatives to uninstall tool alternatives +Requires(postun): %{alternatives_requires} + +# Standard JPackage devel provides +Provides: java-sdk-%{javaver}-%{origin}%{?1} = %{epoch}:%{version}-%{release} +Provides: java-sdk-%{javaver}%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{javaver}-devel%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{javaver}-%{origin}-devel%{?1} = %{epoch}:%{version}-%{release} +%if %is_system_jdk +Provides: java-devel-%{origin}%{?1} = %{epoch}:%{version}-%{release} +Provides: java-sdk-%{origin}%{?1} = %{epoch}:%{version}-%{release} +Provides: java-devel%{?1} = %{epoch}:%{version}-%{release} +Provides: java-sdk%{?1} = %{epoch}:%{version}-%{release} +%endif +} + +%define java_static_libs_rpo() %{expand: +Requires: %{name}-devel%{?1}%{?_isa} = %{epoch}:%{version}-%{release} +OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release} +} + +%define java_jmods_rpo() %{expand: +# Requires devel package +# as jmods are bytecode, they should be OK without any _isa +Requires: %{name}-devel%{?1} = %{epoch}:%{version}-%{release} +OrderWithRequires: %{name}-headless%{?1} = %{epoch}:%{version}-%{release} + +Provides: java-%{javaver}-jmods%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{javaver}-%{origin}-jmods%{?1} = %{epoch}:%{version}-%{release} +%if %is_system_jdk +Provides: java-jmods%{?1} = %{epoch}:%{version}-%{release} +%endif +} + +%define java_demo_rpo() %{expand: +Requires: %{name}%{?1}%{?_isa} = %{epoch}:%{version}-%{release} +OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release} + +Provides: java-%{javaver}-demo%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{javaver}-%{origin}-demo%{?1} = %{epoch}:%{version}-%{release} +%if %is_system_jdk +Provides: java-demo%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{origin}-demo%{?1} = %{epoch}:%{version}-%{release} +%endif +} + +%define java_javadoc_rpo() %{expand: +OrderWithRequires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release} +# Post requires alternatives to install javadoc alternative +Requires(post): %{alternatives_requires} +# Postun requires alternatives to uninstall javadoc alternative +Requires(postun): %{alternatives_requires} + +# Standard JPackage javadoc provides +Provides: java-%{javaver}-javadoc%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{javaver}-%{origin}-javadoc%{?1} = %{epoch}:%{version}-%{release} +%if %is_system_jdk +Provides: java-javadoc%{?1} = %{epoch}:%{version}-%{release} +%endif +} + +%define java_src_rpo() %{expand: +Requires: %{name}-headless%{?1}%{?_isa} = %{epoch}:%{version}-%{release} + +# Standard JPackage sources provides +Provides: java-%{javaver}-src%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{javaver}-%{origin}-src%{?1} = %{epoch}:%{version}-%{release} +%if %is_system_jdk +Provides: java-src%{?1} = %{epoch}:%{version}-%{release} +Provides: java-%{origin}-src%{?1} = %{epoch}:%{version}-%{release} +%endif +} + +# Prevent brp-java-repack-jars from being run +%global __jar_repack 0 + +Name: java-17-%{origin} +Version: %{newjavaver}.%{buildver} +Release: %{?eaprefix}%{rpmrelease}%{?extraver}%{?dist} +# java-1.5.0-ibm from jpackage.org set Epoch to 1 for unknown reasons +# and this change was brought into RHEL-4. java-1.5.0-ibm packages +# also included the epoch in their virtual provides. This created a +# situation where in-the-wild java-1.5.0-ibm packages provided "java = +# 1:1.5.0". In RPM terms, "1.6.0 < 1:1.5.0" since 1.6.0 is +# interpreted as 0:1.6.0. So the "java >= 1.6.0" requirement would be +# satisfied by the 1:1.5.0 packages. Thus we need to set the epoch in +# JDK package >= 1.6.0 to 1, and packages referring to JDK virtual +# provides >= 1.6.0 must specify the epoch, "java >= 1:1.6.0". + +Epoch: 1 +Summary: %{origin_nice} %{featurever} Runtime Environment +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +# HotSpot code is licensed under GPLv2 +# JDK library code is licensed under GPLv2 with the Classpath exception +# The Apache license is used in code taken from Apache projects (primarily xalan & xerces) +# DOM levels 2 & 3 and the XML digital signature schemas are licensed under the W3C Software License +# The JSR166 concurrency code is in the public domain +# The BSD and MIT licenses are used for a number of third-party libraries (see ADDITIONAL_LICENSE_INFO) +# The OpenJDK source tree includes: +# - JPEG library (IJG), zlib & libpng (zlib), giflib (MIT), harfbuzz (ISC), +# - freetype (FTL), jline (BSD) and LCMS (MIT) +# - jquery (MIT), jdk.crypto.cryptoki PKCS 11 wrapper (RSA) +# - public_suffix_list.dat from publicsuffix.org (MPLv2.0) +# The test code includes copies of NSS under the Mozilla Public License v2.0 +# The PCSClite headers are under a BSD with advertising license +# The elliptic curve cryptography (ECC) source code is licensed under the LGPLv2.1 or any later version +License: ASL 1.1 and ASL 2.0 and BSD and BSD with advertising and GPL+ and GPLv2 and GPLv2 with exceptions and IJG and LGPLv2+ and MIT and MPLv2.0 and Public Domain and W3C and zlib and ISC and FTL and RSA +URL: http://openjdk.java.net/ + + +# to regenerate source0 (jdk) run update_package.sh +# update_package.sh contains hard-coded repos, revisions, tags, and projects to regenerate the source archives +Source0: openjdk-jdk%{featurever}u-jdk-%{filever}+%{buildver}%{?tagsuffix:-%{tagsuffix}}.tar.xz + +# Use 'icedtea_sync.sh' to update the following +# They are based on code contained in the IcedTea project (6.x). +# Systemtap tapsets. Zipped up to keep it small. +Source8: tapsets-icedtea-%{icedteaver}.tar.xz + +# Desktop files. Adapted from IcedTea +Source9: jconsole.desktop.in + +# Release notes +Source10: NEWS + +# nss configuration file +Source11: nss.cfg.in + +# Removed libraries that we link instead +Source12: remove-intree-libraries.sh + +# Ensure we aren't using the limited crypto policy +Source13: TestCryptoLevel.java + +# Ensure ECDSA is working +Source14: TestECDSA.java + +# Verify system crypto (policy) can be disabled via a property +Source15: TestSecurityProperties.java + +# nss fips configuration file +Source17: nss.fips.cfg.in + +############################################ +# +# RPM/distribution specific patches +# +############################################ + +# NSS via SunPKCS11 Provider (disabled comment +# due to memory leak). +Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch +# RH1750419: enable build of speculative store bypass hardened alt-java (CVE-2018-3639) +Patch600: rh1750419-redhat_alt_java.patch + +# Ignore AWTError when assistive technologies are loaded +Patch1: rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch +# Restrict access to java-atk-wrapper classes +Patch2: rh1648644-java_access_bridge_privileged_security.patch +Patch3: rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch +# Follow system wide crypto policy RHBZ#1249083 +Patch4: pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch +# PR3695: Allow use of system crypto policy to be disabled by the user +Patch5: pr3695-toggle_system_crypto_policy.patch +# Depend on pcs-lite-libs instead of pcs-lite-devel as this is only in optional repo +Patch6: rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch + +# FIPS support patches +# RH1655466: Support RHEL FIPS mode using SunPKCS11 provider +Patch1001: rh1655466-global_crypto_and_fips.patch +# RH1818909: No ciphersuites availale for SSLSocket in FIPS mode +Patch1002: rh1818909-fips_default_keystore_type.patch +# RH1860986: Disable TLSv1.3 with the NSS-FIPS provider until PKCS#11 v3.0 support is available +Patch1004: rh1860986-disable_tlsv1.3_in_fips_mode.patch +# RH1915071: Always initialise JavaSecuritySystemConfiguratorAccess +Patch1007: rh1915071-always_initialise_configurator_access.patch +# RH1929465: Improve system FIPS detection +Patch1008: rh1929465-improve_system_FIPS_detection.patch +Patch1011: rh1929465-dont_define_unused_throwioexception.patch +# RH1995150: Disable non-FIPS crypto in SUN and SunEC security providers +Patch1009: rh1995150-disable_non-fips_crypto.patch +# RH1996182: Login to the NSS software token in FIPS mode +Patch1010: rh1996182-login_to_nss_software_token.patch +Patch1012: rh1996182-extend_security_policy.patch +# RH1991003: Allow plain key import unless com.redhat.fips.plainKeySupport is set to false +Patch1013: rh1991003-enable_fips_keys_import.patch + +############################################# +# +# OpenJDK patches in need of upstreaming +# +############################################# +# JDK-8276572: Fake libsyslookup.so library causes tooling issues +Patch2000: jdk8276572-fake_libsyslookup_causes_tooling_issues.patch + + +BuildRequires: autoconf +BuildRequires: automake +BuildRequires: alsa-lib-devel +BuildRequires: binutils +BuildRequires: cups-devel +BuildRequires: desktop-file-utils +# elfutils only are OK for build without AOT +BuildRequires: elfutils-devel +BuildRequires: fontconfig-devel +BuildRequires: freetype-devel +BuildRequires: giflib-devel +BuildRequires: gcc-c++ +BuildRequires: gdb +BuildRequires: harfbuzz-devel +BuildRequires: lcms2-devel +BuildRequires: libjpeg-devel +BuildRequires: libpng-devel +BuildRequires: libxslt +BuildRequires: libX11-devel +BuildRequires: libXi-devel +BuildRequires: libXinerama-devel +BuildRequires: libXrandr-devel +BuildRequires: libXrender-devel +BuildRequires: libXt-devel +BuildRequires: libXtst-devel +# Requirements for setting up the nss.cfg and FIPS support +BuildRequires: nss-devel >= 3.53 +BuildRequires: pkgconfig +BuildRequires: xorg-x11-proto-devel +BuildRequires: zip +BuildRequires: javapackages-filesystem +BuildRequires: java-latest-openjdk-devel +# Zero-assembler build requirement +%ifnarch %{jit_arches} +BuildRequires: libffi-devel +%endif +BuildRequires: tzdata-java >= 2015d +# Earlier versions have a bug in tree vectorization on PPC +BuildRequires: gcc >= 4.8.3-8 + +%if %{with_systemtap} +BuildRequires: systemtap-sdt-devel +%endif +BuildRequires: make + +# this is always built, also during debug-only build +# when it is built in debug-only this package is just placeholder +%{java_rpo %{nil}} + +%description +The %{origin_nice} %{featurever} runtime environment. + +%if %{include_debug_build} +%package slowdebug +Summary: %{origin_nice} %{featurever} Runtime Environment %{debug_on} +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_rpo -- %{debug_suffix_unquoted}} +%description slowdebug +The %{origin_nice} %{featurever} runtime environment. +%{debug_warning} +%endif + +%if %{include_fastdebug_build} +%package fastdebug +Summary: %{origin_nice} %{featurever} Runtime Environment %{fastdebug_on} +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_rpo -- %{fastdebug_suffix_unquoted}} +%description fastdebug +The %{origin_nice} %{featurever} runtime environment. +%{fastdebug_warning} +%endif + +%if %{include_normal_build} +%package headless +Summary: %{origin_nice} %{featurever} Headless Runtime Environment +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_headless_rpo %{nil}} + +%description headless +The %{origin_nice} %{featurever} runtime environment without audio and video support. +%endif + +%if %{include_debug_build} +%package headless-slowdebug +Summary: %{origin_nice} %{featurever} Runtime Environment %{debug_on} +Group: Development/Languages + +%{java_headless_rpo -- %{debug_suffix_unquoted}} + +%description headless-slowdebug +The %{origin_nice} %{featurever} runtime environment without audio and video support. +%{debug_warning} +%endif + +%if %{include_fastdebug_build} +%package headless-fastdebug +Summary: %{origin_nice} %{featurever} Runtime Environment %{fastdebug_on} +Group: Development/Languages + +%{java_headless_rpo -- %{fastdebug_suffix_unquoted}} + +%description headless-fastdebug +The %{origin_nice} %{featurever} runtime environment without audio and video support. +%{fastdebug_warning} +%endif + +%if %{include_normal_build} +%package devel +Summary: %{origin_nice} %{featurever} Development Environment +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_devel_rpo %{nil}} + +%description devel +The %{origin_nice} %{featurever} development tools. +%endif + +%if %{include_debug_build} +%package devel-slowdebug +Summary: %{origin_nice} %{featurever} Development Environment %{debug_on} +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_devel_rpo -- %{debug_suffix_unquoted}} + +%description devel-slowdebug +The %{origin_nice} %{featurever} development tools. +%{debug_warning} +%endif + +%if %{include_fastdebug_build} +%package devel-fastdebug +Summary: %{origin_nice} %{featurever} Development Environment %{fastdebug_on} +Group: Development/Tools + +%{java_devel_rpo -- %{fastdebug_suffix_unquoted}} + +%description devel-fastdebug +The %{origin_nice} %{featurever} development tools . +%{fastdebug_warning} +%endif + +%if %{include_staticlibs} + +%if %{include_normal_build} +%package static-libs +Summary: %{origin_nice} %{featurever} libraries for static linking + +%{java_static_libs_rpo %{nil}} + +%description static-libs +The %{origin_nice} %{featurever} libraries for static linking. +%endif + +%if %{include_debug_build} +%package static-libs-slowdebug +Summary: %{origin_nice} %{featurever} libraries for static linking %{debug_on} + +%{java_static_libs_rpo -- %{debug_suffix_unquoted}} + +%description static-libs-slowdebug +The %{origin_nice} %{featurever} libraries for static linking. +%{debug_warning} +%endif + +%if %{include_fastdebug_build} +%package static-libs-fastdebug +Summary: %{origin_nice} %{featurever} libraries for static linking %{fastdebug_on} + +%{java_static_libs_rpo -- %{fastdebug_suffix_unquoted}} + +%description static-libs-fastdebug +The %{origin_nice} %{featurever} libraries for static linking. +%{fastdebug_warning} +%endif + +# staticlibs +%endif + +%if %{include_normal_build} +%package jmods +Summary: JMods for %{origin_nice} %{featurever} +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_jmods_rpo %{nil}} + +%description jmods +The JMods for %{origin_nice} %{featurever}. +%endif + +%if %{include_debug_build} +%package jmods-slowdebug +Summary: JMods for %{origin_nice} %{featurever} %{debug_on} +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_jmods_rpo -- %{debug_suffix_unquoted}} + +%description jmods-slowdebug +The JMods for %{origin_nice} %{featurever}. +%{debug_warning} +%endif + +%if %{include_fastdebug_build} +%package jmods-fastdebug +Summary: JMods for %{origin_nice} %{featurever} %{fastdebug_on} +Group: Development/Tools + +%{java_jmods_rpo -- %{fastdebug_suffix_unquoted}} + +%description jmods-fastdebug +The JMods for %{origin_nice} %{featurever}. +%{fastdebug_warning} +%endif + +%if %{include_normal_build} +%package demo +Summary: %{origin_nice} %{featurever} Demos +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_demo_rpo %{nil}} + +%description demo +The %{origin_nice} %{featurever} demos. +%endif + +%if %{include_debug_build} +%package demo-slowdebug +Summary: %{origin_nice} %{featurever} Demos %{debug_on} +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_demo_rpo -- %{debug_suffix_unquoted}} + +%description demo-slowdebug +The %{origin_nice} %{featurever} demos. +%{debug_warning} +%endif + +%if %{include_fastdebug_build} +%package demo-fastdebug +Summary: %{origin_nice} %{featurever} Demos %{fastdebug_on} +Group: Development/Languages + +%{java_demo_rpo -- %{fastdebug_suffix_unquoted}} + +%description demo-fastdebug +The %{origin_nice} %{featurever} demos. +%{fastdebug_warning} +%endif + +%if %{include_normal_build} +%package src +Summary: %{origin_nice} %{featurever} Source Bundle +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_src_rpo %{nil}} + +%description src +The %{compatiblename}-src sub-package contains the complete %{origin_nice} %{featurever} +class library source code for use by IDE indexers and debuggers. +%endif + +%if %{include_debug_build} +%package src-slowdebug +Summary: %{origin_nice} %{featurever} Source Bundle %{for_debug} +%if 0%{?rhel} <= 8 +Group: Development/Languages +%endif + +%{java_src_rpo -- %{debug_suffix_unquoted}} + +%description src-slowdebug +The %{compatiblename}-src-slowdebug sub-package contains the complete %{origin_nice} %{featurever} + class library source code for use by IDE indexers and debuggers, %{for_debug}. +%endif + +%if %{include_fastdebug_build} +%package src-fastdebug +Summary: %{origin_nice} %{featurever} Source Bundle %{for_fastdebug} +Group: Development/Languages + +%{java_src_rpo -- %{fastdebug_suffix_unquoted}} + +%description src-fastdebug +The %{compatiblename}-src-fastdebug sub-package contains the complete %{origin_nice} %{featurever} + class library source code for use by IDE indexers and debuggers, %{for_fastdebug}. +%endif + +%if %{include_normal_build} +%package javadoc +Summary: %{origin_nice} %{featurever} API documentation +%if 0%{?rhel} <= 8 +Group: Documentation +%endif +Requires: javapackages-filesystem +Obsoletes: javadoc-slowdebug < 1:13.0.0.33-1.rolling + +%{java_javadoc_rpo %{nil}} + +%description javadoc +The %{origin_nice} %{featurever} API documentation. +%endif + +%if %{include_normal_build} +%package javadoc-zip +Summary: %{origin_nice} %{featurever} API documentation compressed in a single archive +%if 0%{?rhel} <= 8 +Group: Documentation +%endif +Requires: javapackages-filesystem +Obsoletes: javadoc-zip-slowdebug < 1:13.0.0.33-1.rolling + +%{java_javadoc_rpo %{nil}} + +%description javadoc-zip +The %{origin_nice} %{featurever} API documentation compressed in a single archive. +%endif + +%prep +if [ %{include_normal_build} -eq 0 -o %{include_normal_build} -eq 1 ] ; then + echo "include_normal_build is %{include_normal_build}" +else + echo "include_normal_build is %{include_normal_build}, that is invalid. Use 1 for yes or 0 for no" + exit 11 +fi +if [ %{include_debug_build} -eq 0 -o %{include_debug_build} -eq 1 ] ; then + echo "include_debug_build is %{include_debug_build}" +else + echo "include_debug_build is %{include_debug_build}, that is invalid. Use 1 for yes or 0 for no" + exit 12 +fi +if [ %{include_fastdebug_build} -eq 0 -o %{include_fastdebug_build} -eq 1 ] ; then + echo "include_fastdebug_build is %{include_fastdebug_build}" +else + echo "include_fastdebug_build is %{include_fastdebug_build}, that is invalid. Use 1 for yes or 0 for no" + exit 13 +fi +if [ %{include_debug_build} -eq 0 -a %{include_normal_build} -eq 0 -a %{include_fastdebug_build} -eq 0 ] ; then + echo "You have disabled all builds (normal,fastdebug,slowdebug). That is a no go." + exit 14 +fi +%setup -q -c -n %{uniquesuffix ""} -T -a 0 +# https://bugzilla.redhat.com/show_bug.cgi?id=1189084 +prioritylength=`expr length %{priority}` +if [ $prioritylength -ne 8 ] ; then + echo "priority must be 8 digits in total, violated" + exit 14 +fi + +# OpenJDK patches +# Remove libraries that are linked by both static and dynamic builds +sh %{SOURCE12} %{top_level_dir_name} + +# Patch the JDK +pushd %{top_level_dir_name} +%patch1 -p1 +%patch2 -p1 +%patch3 -p1 +%patch4 -p1 +%patch5 -p1 +%patch6 -p1 +popd # openjdk + +%patch1000 +%patch600 +%patch1001 +%patch1002 +%patch1004 +%patch1007 +%patch1008 +%patch1009 +%patch1010 +%patch1011 +%patch1012 +%patch1013 +%patch2000 + +# Extract systemtap tapsets +%if %{with_systemtap} +tar --strip-components=1 -x -I xz -f %{SOURCE8} +%if %{include_debug_build} +cp -r tapset tapset%{debug_suffix} +%endif +%if %{include_fastdebug_build} +cp -r tapset tapset%{fastdebug_suffix} +%endif + +for suffix in %{build_loop} ; do + for file in "tapset"$suffix/*.in; do + OUTPUT_FILE=`echo $file | sed -e "s:\.stp\.in$:-%{version}-%{release}.%{_arch}.stp:g"` + sed -e "s:@ABS_SERVER_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/server/libjvm.so:g" $file > $file.1 + sed -e "s:@JAVA_SPEC_VER@:%{javaver}:g" $file.1 > $file.2 +# TODO find out which architectures other than i686 have a client vm +%ifarch %{ix86} + sed -e "s:@ABS_CLIENT_LIBJVM_SO@:%{_jvmdir}/%{sdkdir -- $suffix}/lib/client/libjvm.so:g" $file.2 > $OUTPUT_FILE +%else + sed -e "/@ABS_CLIENT_LIBJVM_SO@/d" $file.2 > $OUTPUT_FILE +%endif + sed -i -e "s:@ABS_JAVA_HOME_DIR@:%{_jvmdir}/%{sdkdir -- $suffix}:g" $OUTPUT_FILE + sed -i -e "s:@INSTALL_ARCH_DIR@:%{archinstall}:g" $OUTPUT_FILE + sed -i -e "s:@prefix@:%{_jvmdir}/%{sdkdir -- $suffix}/:g" $OUTPUT_FILE + done +done +# systemtap tapsets ends +%endif + +# Prepare desktop files +# The _X_ syntax indicates variables that are replaced by make upstream +# The @X@ syntax indicates variables that are replaced by configure upstream +for suffix in %{build_loop} ; do +for file in %{SOURCE9}; do + FILE=`basename $file | sed -e s:\.in$::g` + EXT="${FILE##*.}" + NAME="${FILE%.*}" + OUTPUT_FILE=$NAME$suffix.$EXT + sed -e "s:_SDKBINDIR_:%{sdkbindir -- $suffix}:g" $file > $OUTPUT_FILE + sed -i -e "s:@target_cpu@:%{_arch}:g" $OUTPUT_FILE + sed -i -e "s:@OPENJDK_VER@:%{version}-%{release}.%{_arch}$suffix:g" $OUTPUT_FILE + sed -i -e "s:@JAVA_VER@:%{javaver}:g" $OUTPUT_FILE + sed -i -e "s:@JAVA_VENDOR@:%{origin}:g" $OUTPUT_FILE +done +done + +# Setup nss.cfg +sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE11} > nss.cfg + +# Setup nss.fips.cfg +sed -e "s:@NSS_LIBDIR@:%{NSS_LIBDIR}:g" %{SOURCE17} > nss.fips.cfg + +%build +# How many CPU's do we have? +export NUM_PROC=%(/usr/bin/getconf _NPROCESSORS_ONLN 2> /dev/null || :) +export NUM_PROC=${NUM_PROC:-1} +%if 0%{?_smp_ncpus_max} +# Honor %%_smp_ncpus_max +[ ${NUM_PROC} -gt %{?_smp_ncpus_max} ] && export NUM_PROC=%{?_smp_ncpus_max} +%endif + +%ifarch s390x sparc64 alpha %{power64} %{aarch64} +export ARCH_DATA_MODEL=64 +%endif +%ifarch alpha +export CFLAGS="$CFLAGS -mieee" +%endif + +# We use ourcppflags because the OpenJDK build seems to +# pass EXTRA_CFLAGS to the HotSpot C++ compiler... +# Explicitly set the C++ standard as the default has changed on GCC >= 6 +EXTRA_CFLAGS="%ourcppflags" +EXTRA_CPP_FLAGS="%ourcppflags" + +%ifarch %{power64} ppc +# fix rpmlint warnings +EXTRA_CFLAGS="$EXTRA_CFLAGS -fno-strict-aliasing" +%endif +export EXTRA_CFLAGS + +function buildjdk() { + local outputdir=${1} + local buildjdk=${2} + local maketargets="${3}" + local debuglevel=${4} + local link_opt=${5} + + local top_dir_abs_src_path=$(pwd)/%{top_level_dir_name} + local top_dir_abs_build_path=$(pwd)/${outputdir} + + # The OpenJDK version file includes the current + # upstream version information. For some reason, + # configure does not automatically use the + # default pre-version supplied there (despite + # what the file claims), so we pass it manually + # to configure + VERSION_FILE=${top_dir_abs_src_path}/make/conf/version-numbers.conf + if [ -f ${VERSION_FILE} ] ; then + EA_DESIGNATOR=$(grep '^DEFAULT_PROMOTED_VERSION_PRE' ${VERSION_FILE} | cut -d '=' -f 2) + else + echo "Could not find OpenJDK version file."; + exit 16 + fi + if [ "x${EA_DESIGNATOR}" != "x%{expected_ea_designator}" ] ; then + echo "Spec file is configured for a %{build_type} build, but upstream version-pre setting is ${EA_DESIGNATOR}"; + exit 17 + fi + + echo "Using output directory: ${outputdir}"; + echo "Checking build JDK ${buildjdk} is operational..." + ${buildjdk}/bin/java -version + echo "Using make targets: ${maketargets}" + echo "Using debuglevel: ${debuglevel}" + echo "Using link_opt: ${link_opt}" + echo "Building %{newjavaver}-%{buildver}, pre=${EA_DESIGNATOR}, opt=%{lts_designator}" + + mkdir -p ${outputdir} + pushd ${outputdir} + + bash ${top_dir_abs_src_path}/configure \ +%ifnarch %{jit_arches} + --with-jvm-variants=zero \ +%endif +%ifarch %{ppc64le} + --with-jobs=1 \ +%endif + --with-version-build=%{buildver} \ + --with-version-pre="${EA_DESIGNATOR}" \ + --with-version-opt=%{lts_designator} \ + --with-vendor-version-string="%{vendor_version_string}" \ + --with-vendor-name="Red Hat, Inc." \ + --with-vendor-url="https://www.redhat.com/" \ + --with-vendor-bug-url="%{bugs}" \ + --with-vendor-vm-bug-url="%{bugs}" \ + --with-boot-jdk=${buildjdk} \ + --with-debug-level=${debuglevel} \ + --with-native-debug-symbols="%{debug_symbols}" \ + --enable-sysconf-nss \ + --enable-unlimited-crypto \ + --with-zlib=system \ + --with-libjpeg=${link_opt} \ + --with-giflib=${link_opt} \ + --with-libpng=${link_opt} \ + --with-lcms=${link_opt} \ + --with-harfbuzz=${link_opt} \ + --with-stdc++lib=dynamic \ + --with-extra-cxxflags="$EXTRA_CPP_FLAGS" \ + --with-extra-cflags="$EXTRA_CFLAGS" \ + --with-extra-ldflags="%{ourldflags}" \ + --with-num-cores="$NUM_PROC" \ + --with-source-date="${SOURCE_DATE_EPOCH}" \ + --disable-javac-server \ +%ifarch %{zgc_arches} + --with-jvm-features=zgc \ +%endif + --disable-warnings-as-errors + + cat spec.gmk + + make \ + LOG=trace \ + WARNINGS_ARE_ERRORS="-Wno-error" \ + CFLAGS_WARNINGS_ARE_ERRORS="-Wno-error" \ + $maketargets || ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name "hs_err_pid*.log" | xargs cat && false ) + + popd +} + +function installjdk() { + local imagepath=${1} + + # the build (erroneously) removes read permissions from some jars + # this is a regression in OpenJDK 7 (our compiler): + # http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=1437 + find ${imagepath} -iname '*.jar' -exec chmod ugo+r {} \; + + # Build screws up permissions on binaries + # https://bugs.openjdk.java.net/browse/JDK-8173610 + find ${imagepath} -iname '*.so' -exec chmod +x {} \; + find ${imagepath}/bin/ -exec chmod +x {} \; + + # Install nss.cfg right away as we will be using the JRE above + install -m 644 nss.cfg ${imagepath}/conf/security/ + + # Install nss.fips.cfg: NSS configuration for global FIPS mode (crypto-policies) + install -m 644 nss.fips.cfg ${imagepath}/conf/security/ + + # Use system-wide tzdata + rm ${imagepath}/lib/tzdb.dat + ln -s %{_datadir}/javazi-1.8/tzdb.dat ${imagepath}/lib/tzdb.dat + + # Create fake alt-java as a placeholder for future alt-java + pushd ${imagepath} + # add alt-java man page + echo "Hardened java binary recommended for launching untrusted code from the Web e.g. javaws" > man/man1/%{alt_java_name}.1 + cat man/man1/java.1 >> man/man1/%{alt_java_name}.1 + popd +} + +for suffix in %{build_loop} ; do + + if [ "x$suffix" = "x" ] ; then + debugbuild=release + else + # change --something to something + debugbuild=`echo $suffix | sed "s/-//g"` + fi + + systemjdk=/usr/lib/jvm/java-%{buildjdkver}-openjdk + + for loop in %{main_suffix} %{staticlibs_loop} ; do + + builddir=%{buildoutputdir -- ${suffix}${loop}} + bootbuilddir=boot${builddir} + + if test "x${loop}" = "x%{main_suffix}" ; then + # Copy the source tree so we can remove all in-tree libraries + cp -a %{top_level_dir_name} %{top_level_dir_name_backup} + # Remove all libraries that are linked + sh %{SOURCE12} %{top_level_dir_name} full + # Use system libraries + link_opt="system" + # Debug builds don't need same targets as release for + # build speed-up. We also avoid bootstrapping these + # slower builds. + if echo $debugbuild | grep -q "debug" ; then + maketargets="%{debug_targets}" + run_bootstrap=false + else + maketargets="%{release_targets}" + run_bootstrap=%{bootstrap_build} + fi + if ${run_bootstrap} ; then + buildjdk ${bootbuilddir} ${systemjdk} "%{bootstrap_targets}" ${debugbuild} ${link_opt} + buildjdk ${builddir} $(pwd)/${bootbuilddir}/images/%{jdkimage} "${maketargets}" ${debugbuild} ${link_opt} + rm -rf ${bootbuilddir} + else + buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} + fi + # Restore original source tree we modified by removing full in-tree sources + rm -rf %{top_level_dir_name} + mv %{top_level_dir_name_backup} %{top_level_dir_name} + else + # Use bundled libraries for building statically + link_opt="bundled" + # Static library cycle only builds the static libraries + maketargets="%{static_libs_target}" + # Always just do the one build for the static libraries + buildjdk ${builddir} ${systemjdk} "${maketargets}" ${debugbuild} ${link_opt} + fi + + done # end of main / staticlibs loop + + # Final setup on the main image + top_dir_abs_main_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{main_suffix}} + installjdk ${top_dir_abs_main_build_path}/images/%{jdkimage} + +# build cycles +done # end of release / debug cycle loop + +%check + +# We test debug first as it will give better diagnostics on a crash +for suffix in %{build_loop} ; do + +top_dir_abs_main_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{main_suffix}} +%if %{include_staticlibs} +top_dir_abs_staticlibs_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{staticlibs_loop}} +%endif + +export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage} + +#check Shenandoah is enabled +%if %{use_shenandoah_hotspot} +$JAVA_HOME//bin/java -XX:+UnlockExperimentalVMOptions -XX:+UseShenandoahGC -version +%endif + +# Check unlimited policy has been used +$JAVA_HOME/bin/javac -d . %{SOURCE13} +$JAVA_HOME/bin/java --add-opens java.base/javax.crypto=ALL-UNNAMED TestCryptoLevel + +# Check ECC is working +$JAVA_HOME/bin/javac -d . %{SOURCE14} +$JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||") + +# Check system crypto (policy) can be disabled +$JAVA_HOME/bin/javac -d . %{SOURCE15} +$JAVA_HOME/bin/java -Djava.security.disableSystemPropertiesFile=true $(echo $(basename %{SOURCE15})|sed "s|\.java||") + +# Check java launcher has no SSB mitigation +if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi + +# Check alt-java launcher has SSB mitigation on supported architectures +%ifarch %{ssbd_arches} +nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation +%else +if ! nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation ; then true ; else false; fi +%endif + +%if %{include_staticlibs} +# Check debug symbols in static libraries (smoke test) +export STATIC_LIBS_HOME=${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image} +readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep w_remainder.c +readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep e_remainder.c +%endif + +so_suffix="so" +# Check debug symbols are present and can identify code +find "$JAVA_HOME" -iname "*.$so_suffix" -print0 | while read -d $'\0' lib +do + if [ -f "$lib" ] ; then + echo "Testing $lib for debug symbols" + # All these tests rely on RPM failing the build if the exit code of any set + # of piped commands is non-zero. + + # Test for .debug_* sections in the shared object. This is the main test + # Stripped objects will not contain these + eu-readelf -S "$lib" | grep "] .debug_" + test $(eu-readelf -S "$lib" | grep -E "\]\ .debug_(info|abbrev)" | wc --lines) == 2 + + # Test FILE symbols. These will most likely be removed by anything that + # manipulates symbol tables because it's generally useless. So a nice test + # that nothing has messed with symbols + old_IFS="$IFS" + IFS=$'\n' + for line in $(eu-readelf -s "$lib" | grep "00000000 0 FILE LOCAL DEFAULT") + do + # We expect to see .cpp files, except for architectures like aarch64 and + # s390 where we expect .o and .oS files + echo "$line" | grep -E "ABS ((.*/)?[-_a-zA-Z0-9]+\.(c|cc|cpp|cxx|o|oS))?$" + done + IFS="$old_IFS" + + # If this is the JVM, look for javaCalls.(cpp|o) in FILEs, for extra sanity checking + if [ "`basename $lib`" = "libjvm.so" ]; then + eu-readelf -s "$lib" | \ + grep -E "00000000 0 FILE LOCAL DEFAULT ABS javaCalls.(cpp|o)$" + fi + + # Test that there are no .gnu_debuglink sections pointing to another + # debuginfo file. There shouldn't be any debuginfo files, so the link makes + # no sense either + eu-readelf -S "$lib" | grep 'gnu' + if eu-readelf -S "$lib" | grep '] .gnu_debuglink' | grep PROGBITS; then + echo "bad .gnu_debuglink section." + eu-readelf -x .gnu_debuglink "$lib" + false + fi + fi +done + +# Make sure gdb can do a backtrace based on line numbers on libjvm.so +# javaCalls.cpp:58 should map to: +# http://hg.openjdk.java.net/jdk8u/jdk8u/hotspot/file/ff3b27e6bcc2/src/shar... +# Using line number 1 might cause build problems. See: +# https://bugzilla.redhat.com/show_bug.cgi?id=1539664 +# https://bugzilla.redhat.com/show_bug.cgi?id=1538767 +gdb -q "$JAVA_HOME/bin/java" <<EOF | tee gdb.out +handle SIGSEGV pass nostop noprint +handle SIGILL pass nostop noprint +set breakpoint pending on +break javaCalls.cpp:1 +commands 1 +backtrace +quit +end +run -version +EOF +%if 0%{?fedora} > 0 +# This fails on s390x for some reason. Disable for now. See: +# https://koji.fedoraproject.org/koji/taskinfo?taskID=41499227 +%ifnarch s390x +grep 'JavaCallWrapper::JavaCallWrapper' gdb.out +%endif +%endif + +# Check src.zip has all sources. See RHBZ#1130490 +$JAVA_HOME/bin/jar -tf $JAVA_HOME/lib/src.zip | grep 'sun.misc.Unsafe' + +# Check class files include useful debugging information +$JAVA_HOME/bin/javap -l java.lang.Object | grep "Compiled from" +$JAVA_HOME/bin/javap -l java.lang.Object | grep LineNumberTable +$JAVA_HOME/bin/javap -l java.lang.Object | grep LocalVariableTable + +# Check generated class files include useful debugging information +$JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep "Compiled from" +$JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep LineNumberTable +$JAVA_HOME/bin/javap -l java.nio.ByteBuffer | grep LocalVariableTable + +# build cycles check +done + +%install +STRIP_KEEP_SYMTAB=libjvm* + +for suffix in %{build_loop} ; do + +top_dir_abs_main_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{main_suffix}} +%if %{include_staticlibs} +top_dir_abs_staticlibs_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{staticlibs_loop}} +%endif +jdk_image=${top_dir_abs_main_build_path}/images/%{jdkimage} + +# Install the jdk +mkdir -p $RPM_BUILD_ROOT%{_jvmdir} +cp -a ${jdk_image} $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix} + +pushd ${jdk_image} + +%if %{with_systemtap} + # Install systemtap support files + install -dm 755 $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset + # note, that uniquesuffix is in BUILD dir in this case + cp -a $RPM_BUILD_DIR/%{uniquesuffix ""}/tapset$suffix/*.stp $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset/ + pushd $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/tapset/ + tapsetFiles=`ls *.stp` + popd + install -d -m 755 $RPM_BUILD_ROOT%{tapsetdir} + for name in $tapsetFiles ; do + targetName=`echo $name | sed "s/.stp/$suffix.stp/"` + ln -sf %{_jvmdir}/%{sdkdir -- $suffix}/tapset/$name $RPM_BUILD_ROOT%{tapsetdir}/$targetName + done +%endif + + # Remove empty cacerts database + rm -f $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/lib/security/cacerts + # Install cacerts symlink needed by some apps which hard-code the path + pushd $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/lib/security + ln -sf /etc/pki/java/cacerts . + popd + + # Install version-ed symlinks + pushd $RPM_BUILD_ROOT%{_jvmdir} + ln -sf %{sdkdir -- $suffix} %{jrelnk -- $suffix} + popd + + # Install man pages + install -d -m 755 $RPM_BUILD_ROOT%{_mandir}/man1 + for manpage in man/man1/* + do + # Convert man pages to UTF8 encoding + iconv -f ISO_8859-1 -t UTF8 $manpage -o $manpage.tmp + mv -f $manpage.tmp $manpage + install -m 644 -p $manpage $RPM_BUILD_ROOT%{_mandir}/man1/$(basename \ + $manpage .1)-%{uniquesuffix -- $suffix}.1 + done + # Remove man pages from jdk image + rm -rf $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/man + +popd +# Install static libs artefacts +%if %{include_staticlibs} +mkdir -p $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/lib/static/linux-%{archinstall}/glibc +cp -a ${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image}/lib/*.a \ + $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/lib/static/linux-%{archinstall}/glibc +%endif + +if ! echo $suffix | grep -q "debug" ; then + # Install Javadoc documentation + install -d -m 755 $RPM_BUILD_ROOT%{_javadocdir} + cp -a ${top_dir_abs_main_build_path}/images/docs $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix} + built_doc_archive=jdk-%{filever}%{ea_designator_zip}+%{buildver}%{lts_designator_zip}-docs.zip + cp -a ${top_dir_abs_main_build_path}/bundles/${built_doc_archive} \ + $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip || ls -l ${top_dir_abs_main_build_path}/bundles/ +fi + +# Install release notes +commondocdir=${RPM_BUILD_ROOT}%{_defaultdocdir}/%{uniquejavadocdir -- $suffix} +install -d -m 755 ${commondocdir} +cp -a %{SOURCE10} ${commondocdir} + +# Install icons and menu entries +for s in 16 24 32 48 ; do + install -D -p -m 644 \ + %{top_level_dir_name}/src/java.desktop/unix/classes/sun/awt/X11/java-icon${s}.png \ + $RPM_BUILD_ROOT%{_datadir}/icons/hicolor/${s}x${s}/apps/java-%{javaver}-%{origin}.png +done + +# Install desktop files +install -d -m 755 $RPM_BUILD_ROOT%{_datadir}/{applications,pixmaps} +for e in jconsole$suffix ; do + desktop-file-install --vendor=%{uniquesuffix -- $suffix} --mode=644 \ + --dir=$RPM_BUILD_ROOT%{_datadir}/applications $e.desktop +done + +# Install /etc/.java/.systemPrefs/ directory +# See https://bugzilla.redhat.com/show_bug.cgi?id=741821 +mkdir -p $RPM_BUILD_ROOT%{_sysconfdir}/.java/.systemPrefs + +# copy samples next to demos; samples are mostly js files +cp -r %{top_level_dir_name}/src/sample $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix}/ + + +# moving config files to /etc +mkdir -p $RPM_BUILD_ROOT/%{etcjavadir -- $suffix} +mkdir -p $RPM_BUILD_ROOT/%{etcjavadir -- $suffix}/lib +mv $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix}/conf/ $RPM_BUILD_ROOT/%{etcjavadir -- $suffix} +mv $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix}/lib/security $RPM_BUILD_ROOT/%{etcjavadir -- $suffix}/lib +pushd $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix} + ln -s %{etcjavadir -- $suffix}/conf ./conf +popd +pushd $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix}/lib + ln -s %{etcjavadir -- $suffix}/lib/security ./security +popd +# end moving files to /etc + +# stabilize permissions +find $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix}/ -name "*.so" -exec chmod 755 {} \; ; +find $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix}/ -type d -exec chmod 755 {} \; ; +find $RPM_BUILD_ROOT/%{_jvmdir}/%{sdkdir -- $suffix}/legal -type f -exec chmod 644 {} \; ; + +# end, dual install +done + +%if %{include_normal_build} +# intentionally only for non-debug +%pretrans headless -p <lua> +-- see https://bugzilla.redhat.com/show_bug.cgi?id=1038092 for whole issue +-- see https://bugzilla.redhat.com/show_bug.cgi?id=1290388 for pretrans over pre +-- if copy-jdk-configs is in transaction, it installs in pretrans to temp +-- if copy_jdk_configs is in temp, then it means that copy-jdk-configs is in transaction and so is +-- preferred over one in %%{_libexecdir}. If it is not in transaction, then depends +-- whether copy-jdk-configs is installed or not. If so, then configs are copied +-- (copy_jdk_configs from %%{_libexecdir} used) or not copied at all +local posix = require "posix" + +if (os.getenv("debug") == "true") then + debug = true; + print("cjc: in spec debug is on") +else + debug = false; +end + +SOURCE1 = "%{rpm_state_dir}/copy_jdk_configs.lua" +SOURCE2 = "%{_libexecdir}/copy_jdk_configs.lua" + +local stat1 = posix.stat(SOURCE1, "type"); +local stat2 = posix.stat(SOURCE2, "type"); + + if (stat1 ~= nil) then + if (debug) then + print(SOURCE1 .." exists - copy-jdk-configs in transaction, using this one.") + end; + package.path = package.path .. ";" .. SOURCE1 +else + if (stat2 ~= nil) then + if (debug) then + print(SOURCE2 .." exists - copy-jdk-configs already installed and NOT in transaction. Using.") + end; + package.path = package.path .. ";" .. SOURCE2 + else + if (debug) then + print(SOURCE1 .." does NOT exists") + print(SOURCE2 .." does NOT exists") + print("No config files will be copied") + end + return + end +end +arg = nil ; -- it is better to null the arg up, no meter if they exists or not, and use cjc as module in unified way, instead of relaying on "main" method during require "copy_jdk_configs.lua" +cjc = require "copy_jdk_configs.lua" +args = {"--currentjvm", "%{uniquesuffix %{nil}}", "--jvmdir", "%{_jvmdir %{nil}}", "--origname", "%{name}", "--origjavaver", "%{javaver}", "--arch", "%{_arch}", "--temp", "%{rpm_state_dir}/%{name}.%{_arch}"} +cjc.mainProgram(args) + +%post +%{post_script %{nil}} + +%post headless +%{post_headless %{nil}} + +%postun +%{postun_script %{nil}} + +%postun headless +%{postun_headless %{nil}} + +%posttrans +%{posttrans_script %{nil}} + +%posttrans headless +%{alternatives_java_install %{nil}} + +%post devel +%{post_devel %{nil}} + +%postun devel +%{postun_devel %{nil}} + +%posttrans devel +%{posttrans_devel %{nil}} + +%posttrans javadoc +%{alternatives_javadoc_install %{nil}} + +%postun javadoc +%{postun_javadoc %{nil}} + +%posttrans javadoc-zip +%{alternatives_javadoczip_install %{nil}} + +%postun javadoc-zip +%{postun_javadoc_zip %{nil}} +%endif + +%if %{include_debug_build} +%post slowdebug +%{post_script -- %{debug_suffix_unquoted}} + +%post headless-slowdebug +%{post_headless -- %{debug_suffix_unquoted}} + +%posttrans headless-slowdebug +%{alternatives_java_install -- %{debug_suffix_unquoted}} + +%postun slowdebug +%{postun_script -- %{debug_suffix_unquoted}} + +%postun headless-slowdebug +%{postun_headless -- %{debug_suffix_unquoted}} + +%posttrans slowdebug +%{posttrans_script -- %{debug_suffix_unquoted}} + +%post devel-slowdebug +%{post_devel -- %{debug_suffix_unquoted}} + +%postun devel-slowdebug +%{postun_devel -- %{debug_suffix_unquoted}} + +%posttrans devel-slowdebug +%{posttrans_devel -- %{debug_suffix_unquoted}} +%endif + +%if %{include_fastdebug_build} +%post fastdebug +%{post_script -- %{fastdebug_suffix_unquoted}} + +%post headless-fastdebug +%{post_headless -- %{fastdebug_suffix_unquoted}} + +%postun fastdebug +%{postun_script -- %{fastdebug_suffix_unquoted}} + +%postun headless-fastdebug +%{postun_headless -- %{fastdebug_suffix_unquoted}} + +%posttrans fastdebug +%{posttrans_script -- %{fastdebug_suffix_unquoted}} + +%posttrans headless-fastdebug +%{alternatives_java_install -- %{fastdebug_suffix_unquoted}} + +%post devel-fastdebug +%{post_devel -- %{fastdebug_suffix_unquoted}} + +%postun devel-fastdebug +%{postun_devel -- %{fastdebug_suffix_unquoted}} + +%posttrans devel-fastdebug +%{posttrans_devel -- %{fastdebug_suffix_unquoted}} + +%endif + +%if %{include_normal_build} +%files +# main package builds always +%{files_jre %{nil}} +%else +%files +# placeholder +%endif + + +%if %{include_normal_build} +%files headless +# important note, see https://bugzilla.redhat.com/show_bug.cgi?id=1038092 for whole issue +# all config/noreplace files (and more) have to be declared in pretrans. See pretrans +%{files_jre_headless %{nil}} + +%files devel +%{files_devel %{nil}} + +%if %{include_staticlibs} +%files static-libs +%{files_static_libs %{nil}} +%endif + +%files jmods +%{files_jmods %{nil}} + +%files demo +%{files_demo %{nil}} + +%files src +%{files_src %{nil}} + +%files javadoc +%{files_javadoc %{nil}} + +# This puts a huge documentation file in /usr/share +# It is now architecture-dependent, as eg. AOT and Graal are now x86_64 only +# same for debug variant +%files javadoc-zip +%{files_javadoc_zip %{nil}} +%endif + +%if %{include_debug_build} +%files slowdebug +%{files_jre -- %{debug_suffix_unquoted}} + +%files headless-slowdebug +%{files_jre_headless -- %{debug_suffix_unquoted}} + +%files devel-slowdebug +%{files_devel -- %{debug_suffix_unquoted}} + +%if %{include_staticlibs} +%files static-libs-slowdebug +%{files_static_libs -- %{debug_suffix_unquoted}} +%endif + +%files jmods-slowdebug +%{files_jmods -- %{debug_suffix_unquoted}} + +%files demo-slowdebug +%{files_demo -- %{debug_suffix_unquoted}} + +%files src-slowdebug +%{files_src -- %{debug_suffix_unquoted}} +%endif + +%if %{include_fastdebug_build} +%files fastdebug +%{files_jre -- %{fastdebug_suffix_unquoted}} + +%files headless-fastdebug +%{files_jre_headless -- %{fastdebug_suffix_unquoted}} + +%files devel-fastdebug +%{files_devel -- %{fastdebug_suffix_unquoted}} + +%if %{include_staticlibs} +%files static-libs-fastdebug +%{files_static_libs -- %{fastdebug_suffix_unquoted}} +%endif + +%files jmods-fastdebug +%{files_jmods -- %{fastdebug_suffix_unquoted}} + +%files demo-fastdebug +%{files_demo -- %{fastdebug_suffix_unquoted}} + +%files src-fastdebug +%{files_src -- %{fastdebug_suffix_unquoted}} + +%endif + +%changelog +* Thu Nov 18 2021 Jiri Vanek <jvanek(a)redhat.com> - 1:17.0.0.0.35-8 +- inital import + diff --git a/jconsole.desktop.in b/jconsole.desktop.in new file mode 100644 index 0000000..8a3b04d --- /dev/null +++ b/jconsole.desktop.in @@ -0,0 +1,10 @@ +[Desktop Entry] +Name=OpenJDK @JAVA_VER@ for @target_cpu@ Monitoring & Management Console (@OPENJDK_VER@) +Comment=Monitor and manage OpenJDK applications +Exec=_SDKBINDIR_/jconsole +Icon=java-@JAVA_VER@-@JAVA_VENDOR@ +Terminal=false +Type=Application +StartupWMClass=sun-tools-jconsole-JConsole +Categories=Development;Profiling;Java; +Version=1.0 diff --git a/jdk8276572-fake_libsyslookup_causes_tooling_issues.patch b/jdk8276572-fake_libsyslookup_causes_tooling_issues.patch new file mode 100644 index 0000000..dee144b --- /dev/null +++ b/jdk8276572-fake_libsyslookup_causes_tooling_issues.patch @@ -0,0 +1,21 @@ +commit a4724332098cd8bff44ee27e9190fd28fa5c1865 +Author: Andrew John Hughes <andrew(a)openjdk.org> +Date: Fri Nov 5 21:05:42 2021 +0000 + + 8276572: Fake libsyslookup.so library causes tooling issues + + Reviewed-by: shade, mcimadamore + +diff --git openjdk.orig/src/jdk.incubator.foreign/share/native/libsyslookup/syslookup.c openjdk/src/jdk.incubator.foreign/share/native/libsyslookup/syslookup.c +index fdf99866786..b1f543bfdb7 100644 +--- openjdk.orig/src/jdk.incubator.foreign/share/native/libsyslookup/syslookup.c ++++ openjdk/src/jdk.incubator.foreign/share/native/libsyslookup/syslookup.c +@@ -26,3 +26,8 @@ + // Note: the include below is not strictly required, as dependencies will be pulled using linker flags. + // Adding at least one #include removes unwanted warnings on some platforms. + #include <stdlib.h> ++ ++// Simple dummy function so this library appears as a normal library to tooling. ++char* syslookup() { ++ return "syslookup"; ++} diff --git a/nss.cfg.in b/nss.cfg.in new file mode 100644 index 0000000..377a39c --- /dev/null +++ b/nss.cfg.in @@ -0,0 +1,5 @@ +name = NSS +nssLibraryDirectory = @NSS_LIBDIR@ +nssDbMode = noDb +attributes = compatibility +handleStartupErrors = ignoreMultipleInitialisation diff --git a/nss.fips.cfg.in b/nss.fips.cfg.in new file mode 100644 index 0000000..1aff153 --- /dev/null +++ b/nss.fips.cfg.in @@ -0,0 +1,6 @@ +name = NSS-FIPS +nssLibraryDirectory = @NSS_LIBDIR@ +nssSecmodDirectory = sql:/etc/pki/nssdb +nssDbMode = readOnly +nssModule = fips + diff --git a/pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch b/pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch new file mode 100644 index 0000000..4efbe9a --- /dev/null +++ b/pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch @@ -0,0 +1,88 @@ + +# HG changeset patch +# User andrew +# Date 1478057514 0 +# Node ID 1c4d5cb2096ae55106111da200b0bcad304f650c +# Parent 3d53f19b48384e5252f4ec8891f7a3a82d77af2a +PR3183: Support Fedora/RHEL system crypto policy +diff -r 3d53f19b4838 -r 1c4d5cb2096a src/java.base/share/classes/java/security/Security.java +--- a/src/java.base/share/classes/java/security/Security.java Wed Oct 26 03:51:39 2016 +0100 ++++ b/src/java.base/share/classes/java/security/Security.java Wed Nov 02 03:31:54 2016 +0000 +@@ -43,6 +43,9 @@ + * implementation-specific location, which is typically the properties file + * {@code conf/security/java.security} in the Java installation directory. + * ++ * <p>Additional default values of security properties are read from a ++ * system-specific location, if available.</p> ++ * + * @author Benjamin Renaud + * @since 1.1 + */ +@@ -52,6 +55,10 @@ + private static final Debug sdebug = + Debug.getInstance("properties"); + ++ /* System property file*/ ++ private static final String SYSTEM_PROPERTIES = ++ "/etc/crypto-policies/back-ends/java.config"; ++ + /* The java.security properties */ + private static Properties props; + +@@ -93,6 +100,7 @@ + if (sdebug != null) { + sdebug.println("reading security properties file: " + + propFile); ++ sdebug.println(props.toString()); + } + } catch (IOException e) { + if (sdebug != null) { +@@ -114,6 +122,31 @@ + } + + if ("true".equalsIgnoreCase(props.getProperty ++ ("security.useSystemPropertiesFile"))) { ++ ++ // now load the system file, if it exists, so its values ++ // will win if they conflict with the earlier values ++ try (BufferedInputStream bis = ++ new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) { ++ props.load(bis); ++ loadedProps = true; ++ ++ if (sdebug != null) { ++ sdebug.println("reading system security properties file " + ++ SYSTEM_PROPERTIES); ++ sdebug.println(props.toString()); ++ } ++ } catch (IOException e) { ++ if (sdebug != null) { ++ sdebug.println ++ ("unable to load security properties from " + ++ SYSTEM_PROPERTIES); ++ e.printStackTrace(); ++ } ++ } ++ } ++ ++ if ("true".equalsIgnoreCase(props.getProperty + ("security.overridePropertiesFile"))) { + + String extraPropFile = System.getProperty +diff -r 3d53f19b4838 -r 1c4d5cb2096a src/java.base/share/conf/security/java.security +--- a/src/java.base/share/conf/security/java.security Wed Oct 26 03:51:39 2016 +0100 ++++ b/src/java.base/share/conf/security/java.security Wed Nov 02 03:31:54 2016 +0000 +@@ -276,6 +276,13 @@ + security.overridePropertiesFile=true + + # ++# Determines whether this properties file will be appended to ++# using the system properties file stored at ++# /etc/crypto-policies/back-ends/java.config ++# ++security.useSystemPropertiesFile=true ++ ++# + # Determines the default key and trust manager factory algorithms for + # the javax.net.ssl package. + # diff --git a/pr3695-toggle_system_crypto_policy.patch b/pr3695-toggle_system_crypto_policy.patch new file mode 100644 index 0000000..3799237 --- /dev/null +++ b/pr3695-toggle_system_crypto_policy.patch @@ -0,0 +1,78 @@ +# HG changeset patch +# User andrew +# Date 1545198926 0 +# Wed Dec 19 05:55:26 2018 +0000 +# Node ID f2cbd688824c128db7fa848c8732fb0ab3507776 +# Parent 81f07f6d1f8b7b51b136d3974c61bc8bb513770c +PR3695: Allow use of system crypto policy to be disabled by the user +Summary: Read user overrides first so security.useSystemPropertiesFile can be disabled and add -Djava.security.disableSystemPropertiesFile + +diff --git a/src/java.base/share/classes/java/security/Security.java b/src/java.base/share/classes/java/security/Security.java +--- a/src/java.base/share/classes/java/security/Security.java ++++ b/src/java.base/share/classes/java/security/Security.java +@@ -125,31 +125,6 @@ + } + + if ("true".equalsIgnoreCase(props.getProperty +- ("security.useSystemPropertiesFile"))) { +- +- // now load the system file, if it exists, so its values +- // will win if they conflict with the earlier values +- try (BufferedInputStream bis = +- new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) { +- props.load(bis); +- loadedProps = true; +- +- if (sdebug != null) { +- sdebug.println("reading system security properties file " + +- SYSTEM_PROPERTIES); +- sdebug.println(props.toString()); +- } +- } catch (IOException e) { +- if (sdebug != null) { +- sdebug.println +- ("unable to load security properties from " + +- SYSTEM_PROPERTIES); +- e.printStackTrace(); +- } +- } +- } +- +- if ("true".equalsIgnoreCase(props.getProperty + ("security.overridePropertiesFile"))) { + + String extraPropFile = System.getProperty +@@ -215,6 +190,33 @@ + } + } + ++ String disableSystemProps = System.getProperty("java.security.disableSystemPropertiesFile"); ++ if (disableSystemProps == null && ++ "true".equalsIgnoreCase(props.getProperty ++ ("security.useSystemPropertiesFile"))) { ++ ++ // now load the system file, if it exists, so its values ++ // will win if they conflict with the earlier values ++ try (BufferedInputStream bis = ++ new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) { ++ props.load(bis); ++ loadedProps = true; ++ ++ if (sdebug != null) { ++ sdebug.println("reading system security properties file " + ++ SYSTEM_PROPERTIES); ++ sdebug.println(props.toString()); ++ } ++ } catch (IOException e) { ++ if (sdebug != null) { ++ sdebug.println ++ ("unable to load security properties from " + ++ SYSTEM_PROPERTIES); ++ e.printStackTrace(); ++ } ++ } ++ } ++ + if (!loadedProps) { + initializeStatic(); + if (sdebug != null) { diff --git a/remove-intree-libraries.sh b/remove-intree-libraries.sh new file mode 100644 index 0000000..e999c7e --- /dev/null +++ b/remove-intree-libraries.sh @@ -0,0 +1,157 @@ +#!/bin/sh + +# Arguments: <JDK TREE> <MINIMAL|FULL> +TREE=${1} +TYPE=${2} + +ZIP_SRC=src/java.base/share/native/libzip/zlib/ +JPEG_SRC=src/java.desktop/share/native/libjavajpeg/ +GIF_SRC=src/java.desktop/share/native/libsplashscreen/giflib/ +PNG_SRC=src/java.desktop/share/native/libsplashscreen/libpng/ +LCMS_SRC=src/java.desktop/share/native/liblcms/ + +if test "x${TREE}" = "x"; then + echo "$0 <JDK_TREE> (MINIMAL|FULL)"; + exit 1; +fi + +if test "x${TYPE}" = "x"; then + TYPE=minimal; +fi + +if test "x${TYPE}" != "xminimal" -a "x${TYPE}" != "xfull"; then + echo "Type must be minimal or full"; + exit 2; +fi + +echo "Removing in-tree libraries from ${TREE}" +echo "Cleansing operation: ${TYPE}"; + +cd ${TREE} + +echo "Removing built-in libs (they will be linked)" + +# On full runs, allow for zlib having already been deleted by minimal +echo "Removing zlib" +if [ "x${TYPE}" = "xminimal" -a ! -d ${ZIP_SRC} ]; then + echo "${ZIP_SRC} does not exist. Refusing to proceed." + exit 1 +fi +rm -rvf ${ZIP_SRC} + +# Minimal is limited to just zlib so finish here +if test "x${TYPE}" = "xminimal"; then + echo "Finished."; + exit 0; +fi + +echo "Removing libjpeg" +if [ ! -f ${JPEG_SRC}/jdhuff.c ]; then # some file that should definitely exist + echo "${JPEG_SRC} does not contain jpeg sources. Refusing to proceed." + exit 1 +fi + +rm -vf ${JPEG_SRC}/jcomapi.c +rm -vf ${JPEG_SRC}/jdapimin.c +rm -vf ${JPEG_SRC}/jdapistd.c +rm -vf ${JPEG_SRC}/jdcoefct.c +rm -vf ${JPEG_SRC}/jdcolor.c +rm -vf ${JPEG_SRC}/jdct.h +rm -vf ${JPEG_SRC}/jddctmgr.c +rm -vf ${JPEG_SRC}/jdhuff.c +rm -vf ${JPEG_SRC}/jdhuff.h +rm -vf ${JPEG_SRC}/jdinput.c +rm -vf ${JPEG_SRC}/jdmainct.c +rm -vf ${JPEG_SRC}/jdmarker.c +rm -vf ${JPEG_SRC}/jdmaster.c +rm -vf ${JPEG_SRC}/jdmerge.c +rm -vf ${JPEG_SRC}/jdphuff.c +rm -vf ${JPEG_SRC}/jdpostct.c +rm -vf ${JPEG_SRC}/jdsample.c +rm -vf ${JPEG_SRC}/jerror.c +rm -vf ${JPEG_SRC}/jerror.h +rm -vf ${JPEG_SRC}/jidctflt.c +rm -vf ${JPEG_SRC}/jidctfst.c +rm -vf ${JPEG_SRC}/jidctint.c +rm -vf ${JPEG_SRC}/jidctred.c +rm -vf ${JPEG_SRC}/jinclude.h +rm -vf ${JPEG_SRC}/jmemmgr.c +rm -vf ${JPEG_SRC}/jmemsys.h +rm -vf ${JPEG_SRC}/jmemnobs.c +rm -vf ${JPEG_SRC}/jmorecfg.h +rm -vf ${JPEG_SRC}/jpegint.h +rm -vf ${JPEG_SRC}/jpeglib.h +rm -vf ${JPEG_SRC}/jquant1.c +rm -vf ${JPEG_SRC}/jquant2.c +rm -vf ${JPEG_SRC}/jutils.c +rm -vf ${JPEG_SRC}/jcapimin.c +rm -vf ${JPEG_SRC}/jcapistd.c +rm -vf ${JPEG_SRC}/jccoefct.c +rm -vf ${JPEG_SRC}/jccolor.c +rm -vf ${JPEG_SRC}/jcdctmgr.c +rm -vf ${JPEG_SRC}/jchuff.c +rm -vf ${JPEG_SRC}/jchuff.h +rm -vf ${JPEG_SRC}/jcinit.c +rm -vf ${JPEG_SRC}/jconfig.h +rm -vf ${JPEG_SRC}/jcmainct.c +rm -vf ${JPEG_SRC}/jcmarker.c +rm -vf ${JPEG_SRC}/jcmaster.c +rm -vf ${JPEG_SRC}/jcparam.c +rm -vf ${JPEG_SRC}/jcphuff.c +rm -vf ${JPEG_SRC}/jcprepct.c +rm -vf ${JPEG_SRC}/jcsample.c +rm -vf ${JPEG_SRC}/jctrans.c +rm -vf ${JPEG_SRC}/jdtrans.c +rm -vf ${JPEG_SRC}/jfdctflt.c +rm -vf ${JPEG_SRC}/jfdctfst.c +rm -vf ${JPEG_SRC}/jfdctint.c +rm -vf ${JPEG_SRC}/jversion.h +rm -vf ${JPEG_SRC}/README + +echo "Removing giflib" +if [ ! -d ${GIF_SRC} ]; then + echo "${GIF_SRC} does not exist. Refusing to proceed." + exit 1 +fi +rm -rvf ${GIF_SRC} + +echo "Removing libpng" +if [ ! -d ${PNG_SRC} ]; then + echo "${PNG_SRC} does not exist. Refusing to proceed." + exit 1 +fi +rm -rvf ${PNG_SRC} + +echo "Removing lcms" +if [ ! -d ${LCMS_SRC} ]; then + echo "${LCMS_SRC} does not exist. Refusing to proceed." + exit 1 +fi +rm -vf ${LCMS_SRC}/cmscam02.c +rm -vf ${LCMS_SRC}/cmscgats.c +rm -vf ${LCMS_SRC}/cmscnvrt.c +rm -vf ${LCMS_SRC}/cmserr.c +rm -vf ${LCMS_SRC}/cmsgamma.c +rm -vf ${LCMS_SRC}/cmsgmt.c +rm -vf ${LCMS_SRC}/cmshalf.c +rm -vf ${LCMS_SRC}/cmsintrp.c +rm -vf ${LCMS_SRC}/cmsio0.c +rm -vf ${LCMS_SRC}/cmsio1.c +rm -vf ${LCMS_SRC}/cmslut.c +rm -vf ${LCMS_SRC}/cmsmd5.c +rm -vf ${LCMS_SRC}/cmsmtrx.c +rm -vf ${LCMS_SRC}/cmsnamed.c +rm -vf ${LCMS_SRC}/cmsopt.c +rm -vf ${LCMS_SRC}/cmspack.c +rm -vf ${LCMS_SRC}/cmspcs.c +rm -vf ${LCMS_SRC}/cmsplugin.c +rm -vf ${LCMS_SRC}/cmsps2.c +rm -vf ${LCMS_SRC}/cmssamp.c +rm -vf ${LCMS_SRC}/cmssm.c +rm -vf ${LCMS_SRC}/cmstypes.c +rm -vf ${LCMS_SRC}/cmsvirt.c +rm -vf ${LCMS_SRC}/cmswtpnt.c +rm -vf ${LCMS_SRC}/cmsxform.c +rm -vf ${LCMS_SRC}/lcms2.h +rm -vf ${LCMS_SRC}/lcms2_internal.h +rm -vf ${LCMS_SRC}/lcms2_plugin.h diff --git a/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch b/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch new file mode 100644 index 0000000..3042186 --- /dev/null +++ b/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch @@ -0,0 +1,16 @@ +diff -r 618ad1237e73 src/java.desktop/share/classes/java/awt/Toolkit.java +--- a/src/java.desktop/share/classes/java/awt/Toolkit.java Thu Jun 13 19:37:49 2019 +0200 ++++ b/src/java.desktop/share/classes/java/awt/Toolkit.java Thu Jul 04 10:35:42 2019 +0200 +@@ -595,7 +595,11 @@ + toolkit = new HeadlessToolkit(toolkit); + } + if (!GraphicsEnvironment.isHeadless()) { +- loadAssistiveTechnologies(); ++ try { ++ loadAssistiveTechnologies(); ++ } catch (AWTError error) { ++ // ignore silently ++ } + } + } + return toolkit; diff --git a/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch b/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch new file mode 100644 index 0000000..7be1fae --- /dev/null +++ b/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch @@ -0,0 +1,12 @@ +diff --git openjdk/src/java.base/share/conf/security/java.security openjdk/src/java.base/share/conf/security/java.security +index 534bdae5a16..2df2b59cbf6 100644 +--- openjdk/src/java.base/share/conf/security/java.security ++++ openjdk/src/java.base/share/conf/security/java.security +@@ -78,6 +78,7 @@ security.provider.tbd=SunMSCAPI + security.provider.tbd=Apple + #endif + security.provider.tbd=SunPKCS11 ++#security.provider.tbd=SunPKCS11 ${java.home}/lib/security/nss.cfg + + # + # A list of preferred providers for specific algorithms. These providers will diff --git a/rh1648644-java_access_bridge_privileged_security.patch b/rh1648644-java_access_bridge_privileged_security.patch new file mode 100644 index 0000000..53026ad --- /dev/null +++ b/rh1648644-java_access_bridge_privileged_security.patch @@ -0,0 +1,20 @@ +--- openjdk/src/java.base/share/conf/security/java.security ++++ openjdk/src/java.base/share/conf/security/java.security +@@ -304,6 +304,8 @@ + # + package.access=sun.misc.,\ + sun.reflect.,\ ++ org.GNOME.Accessibility.,\ ++ org.GNOME.Bonobo.,\ + + # + # List of comma-separated packages that start with or equal this string +@@ -316,6 +318,8 @@ + # + package.definition=sun.misc.,\ + sun.reflect.,\ ++ org.GNOME.Accessibility.,\ ++ org.GNOME.Bonobo.,\ + + # + # Determines whether this properties file can be appended to diff --git a/rh1655466-global_crypto_and_fips.patch b/rh1655466-global_crypto_and_fips.patch new file mode 100644 index 0000000..80cd91c --- /dev/null +++ b/rh1655466-global_crypto_and_fips.patch @@ -0,0 +1,205 @@ +diff --git a/src/java.base/share/classes/javopenjdk.orig///security/Security.java openjdk///src/java.base/share/classes/java/security/Security.java +--- openjdk.orig/src/java.base/share/classes/java/security/Security.java ++++ openjdk/src/java.base/share/classes/java/security/Security.java +@@ -196,26 +196,8 @@ + if (disableSystemProps == null && + "true".equalsIgnoreCase(props.getProperty + ("security.useSystemPropertiesFile"))) { +- +- // now load the system file, if it exists, so its values +- // will win if they conflict with the earlier values +- try (BufferedInputStream bis = +- new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) { +- props.load(bis); ++ if (SystemConfigurator.configure(props)) { + loadedProps = true; +- +- if (sdebug != null) { +- sdebug.println("reading system security properties file " + +- SYSTEM_PROPERTIES); +- sdebug.println(props.toString()); +- } +- } catch (IOException e) { +- if (sdebug != null) { +- sdebug.println +- ("unable to load security properties from " + +- SYSTEM_PROPERTIES); +- e.printStackTrace(); +- } + } + } + +diff --git a/src/java.base/share/classes/javopenjdk.orig///security/SystemConfigurator.java openjdk///src/java.base/share/classes/java/security/SystemConfigurator.java +new file mode 100644 +--- /dev/null ++++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java +@@ -0,0 +1,151 @@ ++/* ++ * Copyright (c) 2019, Red Hat, Inc. ++ * ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++package java.security; ++ ++import java.io.BufferedInputStream; ++import java.io.FileInputStream; ++import java.io.IOException; ++ ++import java.nio.file.Files; ++import java.nio.file.Path; ++ ++import java.util.Iterator; ++import java.util.Map.Entry; ++import java.util.Properties; ++import java.util.function.Consumer; ++import java.util.regex.Matcher; ++import java.util.regex.Pattern; ++ ++import sun.security.util.Debug; ++ ++/** ++ * Internal class to align OpenJDK with global crypto-policies. ++ * Called from java.security.Security class initialization, ++ * during startup. ++ * ++ */ ++ ++class SystemConfigurator { ++ ++ private static final Debug sdebug = ++ Debug.getInstance("properties"); ++ ++ private static final String CRYPTO_POLICIES_BASE_DIR = ++ "/etc/crypto-policies"; ++ ++ private static final String CRYPTO_POLICIES_JAVA_CONFIG = ++ CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config"; ++ ++ private static final String CRYPTO_POLICIES_CONFIG = ++ CRYPTO_POLICIES_BASE_DIR + "/config"; ++ ++ private static final class SecurityProviderInfo { ++ int number; ++ String key; ++ String value; ++ SecurityProviderInfo(int number, String key, String value) { ++ this.number = number; ++ this.key = key; ++ this.value = value; ++ } ++ } ++ ++ /* ++ * Invoked when java.security.Security class is initialized, if ++ * java.security.disableSystemPropertiesFile property is not set and ++ * security.useSystemPropertiesFile is true. ++ */ ++ static boolean configure(Properties props) { ++ boolean loadedProps = false; ++ ++ try (BufferedInputStream bis = ++ new BufferedInputStream( ++ new FileInputStream(CRYPTO_POLICIES_JAVA_CONFIG))) { ++ props.load(bis); ++ loadedProps = true; ++ if (sdebug != null) { ++ sdebug.println("reading system security properties file " + ++ CRYPTO_POLICIES_JAVA_CONFIG); ++ sdebug.println(props.toString()); ++ } ++ } catch (IOException e) { ++ if (sdebug != null) { ++ sdebug.println("unable to load security properties from " + ++ CRYPTO_POLICIES_JAVA_CONFIG); ++ e.printStackTrace(); ++ } ++ } ++ ++ try { ++ if (enableFips()) { ++ if (sdebug != null) { sdebug.println("FIPS mode detected"); } ++ loadedProps = false; ++ // Remove all security providers ++ Iterator<Entry<Object, Object>> i = props.entrySet().iterator(); ++ while (i.hasNext()) { ++ Entry<Object, Object> e = i.next(); ++ if (((String) e.getKey()).startsWith("security.provider")) { ++ if (sdebug != null) { sdebug.println("Removing provider: " + e); } ++ i.remove(); ++ } ++ } ++ // Add FIPS security providers ++ String fipsProviderValue = null; ++ for (int n = 1; ++ (fipsProviderValue = (String) props.get("fips.provider." + n)) != null; n++) { ++ String fipsProviderKey = "security.provider." + n; ++ if (sdebug != null) { ++ sdebug.println("Adding provider " + n + ": " + ++ fipsProviderKey + "=" + fipsProviderValue); ++ } ++ props.put(fipsProviderKey, fipsProviderValue); ++ } ++ loadedProps = true; ++ } ++ } catch (Exception e) { ++ if (sdebug != null) { ++ sdebug.println("unable to load FIPS configuration"); ++ e.printStackTrace(); ++ } ++ } ++ return loadedProps; ++ } ++ ++ /* ++ * FIPS is enabled only if crypto-policies are set to "FIPS" ++ * and the com.redhat.fips property is true. ++ */ ++ private static boolean enableFips() throws Exception { ++ boolean fipsEnabled = Boolean.valueOf(System.getProperty("com.redhat.fips", "true")); ++ if (fipsEnabled) { ++ String cryptoPoliciesConfig = new String(Files.readAllBytes(Path.of(CRYPTO_POLICIES_CONFIG))); ++ if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); } ++ Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE); ++ return pattern.matcher(cryptoPoliciesConfig).find(); ++ } else { ++ return false; ++ } ++ } ++} +diff --git openjdk.orig///src/java.base/share/conf/security/java.security openjdk///src/java.base/share/conf/security/java.security +--- openjdk.orig/src/java.base/share/conf/security/java.security ++++ openjdk/src/java.base/share/conf/security/java.security +@@ -87,6 +87,14 @@ + #security.provider.tbd=SunPKCS11 ${java.home}/lib/security/nss.cfg + + # ++# Security providers used when global crypto-policies are set to FIPS. ++# ++fips.provider.1=SunPKCS11 ${java.home}/conf/security/nss.fips.cfg ++fips.provider.2=SUN ++fips.provider.3=SunEC ++fips.provider.4=SunJSSE ++ ++# + # A list of preferred providers for specific algorithms. These providers will + # be searched for matching algorithms before the list of registered providers. + # Entries containing errors (parsing, etc) will be ignored. Use the diff --git a/rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch b/rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch new file mode 100644 index 0000000..5e2b254 --- /dev/null +++ b/rh1684077-openjdk_should_depend_on_pcsc-lite-libs_instead_of_pcsc-lite-devel.patch @@ -0,0 +1,13 @@ +--- openjdk/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java 2013-03-01 10:48:12.038189968 +0100 ++++ openjdk/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java 2013-03-01 10:48:11.913188505 +0100 +@@ -48,8 +48,8 @@ + + private final static String PROP_NAME = "sun.security.smartcardio.library"; + +- private final static String LIB1 = "/usr/$LIBISA/libpcsclite.so"; +- private final static String LIB2 = "/usr/local/$LIBISA/libpcsclite.so"; ++ private final static String LIB1 = "/usr/$LIBISA/libpcsclite.so.1"; ++ private final static String LIB2 = "/usr/local/$LIBISA/libpcsclite.so.1"; + private final static String PCSC_FRAMEWORK = "/System/Library/Frameworks/PCSC.framework/Versions/Current/PCSC"; + + PlatformPCSC() { diff --git a/rh1750419-redhat_alt_java.patch b/rh1750419-redhat_alt_java.patch new file mode 100644 index 0000000..88f5e5a --- /dev/null +++ b/rh1750419-redhat_alt_java.patch @@ -0,0 +1,117 @@ +diff --git openjdk.orig/make/modules/java.base/Launcher.gmk openjdk/make/modules/java.base/Launcher.gmk +index 700ddefda49..2882de68eb2 100644 +--- openjdk.orig/make/modules/java.base/Launcher.gmk ++++ openjdk/make/modules/java.base/Launcher.gmk +@@ -41,6 +41,14 @@ $(eval $(call SetupBuildLauncher, java, \ + OPTIMIZATION := HIGH, \ + )) + ++#Wno-error=cpp is present to allow commented warning in ifdef part of main.c ++$(eval $(call SetupBuildLauncher, alt-java, \ ++ CFLAGS := -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES -DREDHAT_ALT_JAVA -Wno-error=cpp, \ ++ EXTRA_RCFLAGS := $(JAVA_RCFLAGS), \ ++ VERSION_INFO_RESOURCE := $(JAVA_VERSION_INFO_RESOURCE), \ ++ OPTIMIZATION := HIGH, \ ++)) ++ + ifeq ($(call isTargetOs, windows), true) + $(eval $(call SetupBuildLauncher, javaw, \ + CFLAGS := -DJAVAW -DEXPAND_CLASSPATH_WILDCARDS -DENABLE_ARG_FILES, \ +diff --git openjdk.orig/src/java.base/share/native/launcher/alt_main.h openjdk/src/java.base/share/native/launcher/alt_main.h +new file mode 100644 +index 00000000000..697df2898ac +--- /dev/null ++++ openjdk/src/java.base/share/native/launcher/alt_main.h +@@ -0,0 +1,73 @@ ++/* ++ * Copyright (c) 2019, Red Hat, Inc. All rights reserved. ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. Oracle designates this ++ * particular file as subject to the "Classpath" exception as provided ++ * by Oracle in the LICENSE file that accompanied this code. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++#ifdef REDHAT_ALT_JAVA ++ ++#include <sys/prctl.h> ++ ++ ++/* Per task speculation control */ ++#ifndef PR_GET_SPECULATION_CTRL ++# define PR_GET_SPECULATION_CTRL 52 ++#endif ++#ifndef PR_SET_SPECULATION_CTRL ++# define PR_SET_SPECULATION_CTRL 53 ++#endif ++/* Speculation control variants */ ++#ifndef PR_SPEC_STORE_BYPASS ++# define PR_SPEC_STORE_BYPASS 0 ++#endif ++/* Return and control values for PR_SET/GET_SPECULATION_CTRL */ ++ ++#ifndef PR_SPEC_NOT_AFFECTED ++# define PR_SPEC_NOT_AFFECTED 0 ++#endif ++#ifndef PR_SPEC_PRCTL ++# define PR_SPEC_PRCTL (1UL << 0) ++#endif ++#ifndef PR_SPEC_ENABLE ++# define PR_SPEC_ENABLE (1UL << 1) ++#endif ++#ifndef PR_SPEC_DISABLE ++# define PR_SPEC_DISABLE (1UL << 2) ++#endif ++#ifndef PR_SPEC_FORCE_DISABLE ++# define PR_SPEC_FORCE_DISABLE (1UL << 3) ++#endif ++#ifndef PR_SPEC_DISABLE_NOEXEC ++# define PR_SPEC_DISABLE_NOEXEC (1UL << 4) ++#endif ++ ++static void set_speculation() __attribute__((constructor)); ++static void set_speculation() { ++ if ( prctl(PR_SET_SPECULATION_CTRL, ++ PR_SPEC_STORE_BYPASS, ++ PR_SPEC_DISABLE_NOEXEC, 0, 0) == 0 ) { ++ return; ++ } ++ prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0); ++} ++ ++#endif // REDHAT_ALT_JAVA +diff --git openjdk.orig/src/java.base/share/native/launcher/main.c openjdk/src/java.base/share/native/launcher/main.c +index b734fe2ba78..79dc8307650 100644 +--- openjdk.orig/src/java.base/share/native/launcher/main.c ++++ openjdk/src/java.base/share/native/launcher/main.c +@@ -34,6 +34,14 @@ + #include "jli_util.h" + #include "jni.h" + ++#ifdef REDHAT_ALT_JAVA ++#if defined(__linux__) && defined(__x86_64__) ++#include "alt_main.h" ++#else ++#warning alt-java requested but SSB mitigation not available on this platform. ++#endif ++#endif ++ + #ifdef _MSC_VER + #if _MSC_VER > 1400 && _MSC_VER < 1600 + diff --git a/rh1818909-fips_default_keystore_type.patch b/rh1818909-fips_default_keystore_type.patch new file mode 100644 index 0000000..ff34f3e --- /dev/null +++ b/rh1818909-fips_default_keystore_type.patch @@ -0,0 +1,52 @@ +diff -r 6efbd7b35a10 src/share/classes/java/security/SystemConfigurator.java +--- openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java Thu Jan 23 18:22:31 2020 -0300 ++++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java Mon Mar 02 19:20:17 2020 -0300 +@@ -123,6 +123,33 @@ + } + props.put(fipsProviderKey, fipsProviderValue); + } ++ // Add other security properties ++ String keystoreTypeValue = (String) props.get("fips.keystore.type"); ++ if (keystoreTypeValue != null) { ++ String nonFipsKeystoreType = props.getProperty("keystore.type"); ++ props.put("keystore.type", keystoreTypeValue); ++ if (keystoreTypeValue.equals("PKCS11")) { ++ // If keystore.type is PKCS11, javax.net.ssl.keyStore ++ // must be "NONE". See JDK-8238264. ++ System.setProperty("javax.net.ssl.keyStore", "NONE"); ++ } ++ if (System.getProperty("javax.net.ssl.trustStoreType") == null) { ++ // If no trustStoreType has been set, use the ++ // previous keystore.type under FIPS mode. In ++ // a default configuration, the Trust Store will ++ // be 'cacerts' (JKS type). ++ System.setProperty("javax.net.ssl.trustStoreType", ++ nonFipsKeystoreType); ++ } ++ if (sdebug != null) { ++ sdebug.println("FIPS mode default keystore.type = " + ++ keystoreTypeValue); ++ sdebug.println("FIPS mode javax.net.ssl.keyStore = " + ++ System.getProperty("javax.net.ssl.keyStore", "")); ++ sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " + ++ System.getProperty("javax.net.ssl.trustStoreType", "")); ++ } ++ } + loadedProps = true; + } + } catch (Exception e) { +diff -r 6efbd7b35a10 src/share/lib/security/java.security-linux +--- openjdk.orig/src/java.base/share/conf/security/java.security Thu Jan 23 18:22:31 2020 -0300 ++++ openjdk/src/java.base/share/conf/security/java.security Mon Mar 02 19:20:17 2020 -0300 +@@ -299,6 +299,11 @@ + keystore.type=pkcs12 + + # ++# Default keystore type used when global crypto-policies are set to FIPS. ++# ++fips.keystore.type=PKCS11 ++ ++# + # Controls compatibility mode for JKS and PKCS12 keystore types. + # + # When set to 'true', both JKS and PKCS12 keystore types support loading diff --git a/rh1860986-disable_tlsv1.3_in_fips_mode.patch b/rh1860986-disable_tlsv1.3_in_fips_mode.patch new file mode 100644 index 0000000..8dcd9a8 --- /dev/null +++ b/rh1860986-disable_tlsv1.3_in_fips_mode.patch @@ -0,0 +1,318 @@ +diff --git openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java +index f9baf8c9742..60fa75cab45 100644 +--- openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java ++++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java +@@ -1,11 +1,13 @@ + /* +- * Copyright (c) 2019, Red Hat, Inc. ++ * Copyright (c) 2019, 2020, Red Hat, Inc. + * + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * + * This code is free software; you can redistribute it and/or modify it + * under the terms of the GNU General Public License version 2 only, as +- * published by the Free Software Foundation. ++ * published by the Free Software Foundation. Oracle designates this ++ * particular file as subject to the "Classpath" exception as provided ++ * by Oracle in the LICENSE file that accompanied this code. + * + * This code is distributed in the hope that it will be useful, but WITHOUT + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or +@@ -34,10 +36,10 @@ import java.nio.file.Path; + import java.util.Iterator; + import java.util.Map.Entry; + import java.util.Properties; +-import java.util.function.Consumer; +-import java.util.regex.Matcher; + import java.util.regex.Pattern; + ++import jdk.internal.access.JavaSecuritySystemConfiguratorAccess; ++import jdk.internal.access.SharedSecrets; + import sun.security.util.Debug; + + /** +@@ -47,7 +49,7 @@ import sun.security.util.Debug; + * + */ + +-class SystemConfigurator { ++final class SystemConfigurator { + + private static final Debug sdebug = + Debug.getInstance("properties"); +@@ -61,15 +63,16 @@ class SystemConfigurator { + private static final String CRYPTO_POLICIES_CONFIG = + CRYPTO_POLICIES_BASE_DIR + "/config"; + +- private static final class SecurityProviderInfo { +- int number; +- String key; +- String value; +- SecurityProviderInfo(int number, String key, String value) { +- this.number = number; +- this.key = key; +- this.value = value; +- } ++ private static boolean systemFipsEnabled = false; ++ ++ static { ++ SharedSecrets.setJavaSecuritySystemConfiguratorAccess( ++ new JavaSecuritySystemConfiguratorAccess() { ++ @Override ++ public boolean isSystemFipsEnabled() { ++ return SystemConfigurator.isSystemFipsEnabled(); ++ } ++ }); + } + + /* +@@ -128,9 +131,9 @@ class SystemConfigurator { + String nonFipsKeystoreType = props.getProperty("keystore.type"); + props.put("keystore.type", keystoreTypeValue); + if (keystoreTypeValue.equals("PKCS11")) { +- // If keystore.type is PKCS11, javax.net.ssl.keyStore +- // must be "NONE". See JDK-8238264. +- System.setProperty("javax.net.ssl.keyStore", "NONE"); ++ // If keystore.type is PKCS11, javax.net.ssl.keyStore ++ // must be "NONE". See JDK-8238264. ++ System.setProperty("javax.net.ssl.keyStore", "NONE"); + } + if (System.getProperty("javax.net.ssl.trustStoreType") == null) { + // If no trustStoreType has been set, use the +@@ -144,12 +147,13 @@ class SystemConfigurator { + sdebug.println("FIPS mode default keystore.type = " + + keystoreTypeValue); + sdebug.println("FIPS mode javax.net.ssl.keyStore = " + +- System.getProperty("javax.net.ssl.keyStore", "")); ++ System.getProperty("javax.net.ssl.keyStore", "")); + sdebug.println("FIPS mode javax.net.ssl.trustStoreType = " + + System.getProperty("javax.net.ssl.trustStoreType", "")); + } + } + loadedProps = true; ++ systemFipsEnabled = true; + } + } catch (Exception e) { + if (sdebug != null) { +@@ -160,13 +164,30 @@ class SystemConfigurator { + return loadedProps; + } + ++ /** ++ * Returns whether or not global system FIPS alignment is enabled. ++ * ++ * Value is always 'false' before java.security.Security class is ++ * initialized. ++ * ++ * Call from out of this package through SharedSecrets: ++ * SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ * .isSystemFipsEnabled(); ++ * ++ * @return a boolean value indicating whether or not global ++ * system FIPS alignment is enabled. ++ */ ++ static boolean isSystemFipsEnabled() { ++ return systemFipsEnabled; ++ } ++ + /* + * FIPS is enabled only if crypto-policies are set to "FIPS" + * and the com.redhat.fips property is true. + */ + private static boolean enableFips() throws Exception { +- boolean fipsEnabled = Boolean.valueOf(System.getProperty("com.redhat.fips", "true")); +- if (fipsEnabled) { ++ boolean shouldEnable = Boolean.valueOf(System.getProperty("com.redhat.fips", "true")); ++ if (shouldEnable) { + String cryptoPoliciesConfig = new String(Files.readAllBytes(Path.of(CRYPTO_POLICIES_CONFIG))); + if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); } + Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE); +diff --git openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java +new file mode 100644 +index 00000000000..a31e93ec02e +--- /dev/null ++++ openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java +@@ -0,0 +1,30 @@ ++/* ++ * Copyright (c) 2020, Red Hat, Inc. ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. Oracle designates this ++ * particular file as subject to the "Classpath" exception as provided ++ * by Oracle in the LICENSE file that accompanied this code. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++package jdk.internal.access; ++ ++public interface JavaSecuritySystemConfiguratorAccess { ++ boolean isSystemFipsEnabled(); ++} +diff --git openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java +index f6d3638c3dd..5a2c9eb0c46 100644 +--- openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java ++++ openjdk/src/java.base/share/classes/jdk/internal/access/SharedSecrets.java +@@ -81,6 +81,7 @@ public class SharedSecrets { + private static JavaSecuritySpecAccess javaSecuritySpecAccess; + private static JavaxCryptoSealedObjectAccess javaxCryptoSealedObjectAccess; + private static JavaxCryptoSpecAccess javaxCryptoSpecAccess; ++ private static JavaSecuritySystemConfiguratorAccess javaSecuritySystemConfiguratorAccess; + + public static void setJavaUtilCollectionAccess(JavaUtilCollectionAccess juca) { + javaUtilCollectionAccess = juca; +@@ -442,4 +443,12 @@ public class SharedSecrets { + MethodHandles.lookup().ensureInitialized(c); + } catch (IllegalAccessException e) {} + } ++ ++ public static void setJavaSecuritySystemConfiguratorAccess(JavaSecuritySystemConfiguratorAccess jssca) { ++ javaSecuritySystemConfiguratorAccess = jssca; ++ } ++ ++ public static JavaSecuritySystemConfiguratorAccess getJavaSecuritySystemConfiguratorAccess() { ++ return javaSecuritySystemConfiguratorAccess; ++ } + } +diff --git openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java +index 6ffdfeda18d..775b185fb06 100644 +--- openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java ++++ openjdk/src/java.base/share/classes/sun/security/ssl/SSLContextImpl.java +@@ -32,6 +32,7 @@ import java.security.cert.*; + import java.util.*; + import java.util.concurrent.locks.ReentrantLock; + import javax.net.ssl.*; ++import jdk.internal.access.SharedSecrets; + import sun.security.action.GetPropertyAction; + import sun.security.provider.certpath.AlgorithmChecker; + import sun.security.validator.Validator; +@@ -536,22 +537,40 @@ public abstract class SSLContextImpl extends SSLContextSpi { + private static final List<CipherSuite> serverDefaultCipherSuites; + + static { +- supportedProtocols = Arrays.asList( +- ProtocolVersion.TLS13, +- ProtocolVersion.TLS12, +- ProtocolVersion.TLS11, +- ProtocolVersion.TLS10, +- ProtocolVersion.SSL30, +- ProtocolVersion.SSL20Hello +- ); +- +- serverDefaultProtocols = getAvailableProtocols( +- new ProtocolVersion[] { +- ProtocolVersion.TLS13, +- ProtocolVersion.TLS12, +- ProtocolVersion.TLS11, +- ProtocolVersion.TLS10 +- }); ++ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ .isSystemFipsEnabled()) { ++ // RH1860986: TLSv1.3 key derivation not supported with ++ // the Security Providers available in system FIPS mode. ++ supportedProtocols = Arrays.asList( ++ ProtocolVersion.TLS12, ++ ProtocolVersion.TLS11, ++ ProtocolVersion.TLS10 ++ ); ++ ++ serverDefaultProtocols = getAvailableProtocols( ++ new ProtocolVersion[] { ++ ProtocolVersion.TLS12, ++ ProtocolVersion.TLS11, ++ ProtocolVersion.TLS10 ++ }); ++ } else { ++ supportedProtocols = Arrays.asList( ++ ProtocolVersion.TLS13, ++ ProtocolVersion.TLS12, ++ ProtocolVersion.TLS11, ++ ProtocolVersion.TLS10, ++ ProtocolVersion.SSL30, ++ ProtocolVersion.SSL20Hello ++ ); ++ ++ serverDefaultProtocols = getAvailableProtocols( ++ new ProtocolVersion[] { ++ ProtocolVersion.TLS13, ++ ProtocolVersion.TLS12, ++ ProtocolVersion.TLS11, ++ ProtocolVersion.TLS10 ++ }); ++ } + + supportedCipherSuites = getApplicableSupportedCipherSuites( + supportedProtocols); +@@ -842,12 +861,23 @@ public abstract class SSLContextImpl extends SSLContextSpi { + ProtocolVersion[] candidates; + if (refactored.isEmpty()) { + // Client and server use the same default protocols. +- candidates = new ProtocolVersion[] { +- ProtocolVersion.TLS13, +- ProtocolVersion.TLS12, +- ProtocolVersion.TLS11, +- ProtocolVersion.TLS10 +- }; ++ if (SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ .isSystemFipsEnabled()) { ++ // RH1860986: TLSv1.3 key derivation not supported with ++ // the Security Providers available in system FIPS mode. ++ candidates = new ProtocolVersion[] { ++ ProtocolVersion.TLS12, ++ ProtocolVersion.TLS11, ++ ProtocolVersion.TLS10 ++ }; ++ } else { ++ candidates = new ProtocolVersion[] { ++ ProtocolVersion.TLS13, ++ ProtocolVersion.TLS12, ++ ProtocolVersion.TLS11, ++ ProtocolVersion.TLS10 ++ }; ++ } + } else { + // Use the customized TLS protocols. + candidates = +diff --git openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java +index 894e26dfad8..8b16378b96b 100644 +--- openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java ++++ openjdk/src/java.base/share/classes/sun/security/ssl/SunJSSE.java +@@ -27,6 +27,8 @@ package sun.security.ssl; + + import java.security.*; + import java.util.*; ++ ++import jdk.internal.access.SharedSecrets; + import static sun.security.util.SecurityConstants.PROVIDER_VER; + + /** +@@ -102,8 +104,13 @@ public class SunJSSE extends java.security.Provider { + "sun.security.ssl.SSLContextImpl$TLS11Context", null, null); + ps("SSLContext", "TLSv1.2", + "sun.security.ssl.SSLContextImpl$TLS12Context", null, null); +- ps("SSLContext", "TLSv1.3", +- "sun.security.ssl.SSLContextImpl$TLS13Context", null, null); ++ if (!SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ .isSystemFipsEnabled()) { ++ // RH1860986: TLSv1.3 key derivation not supported with ++ // the Security Providers available in system FIPS mode. ++ ps("SSLContext", "TLSv1.3", ++ "sun.security.ssl.SSLContextImpl$TLS13Context", null, null); ++ } + ps("SSLContext", "TLS", + "sun.security.ssl.SSLContextImpl$TLSContext", + List.of("SSL"), null); diff --git a/rh1915071-always_initialise_configurator_access.patch b/rh1915071-always_initialise_configurator_access.patch new file mode 100644 index 0000000..513fbbf --- /dev/null +++ b/rh1915071-always_initialise_configurator_access.patch @@ -0,0 +1,70 @@ +diff --git openjdk/src/java.base/share/classes/java/security/Security.java openjdk/src/java.base/share/classes/java/security/Security.java +index f1633afb627..ce32c939253 100644 +--- openjdk/src/java.base/share/classes/java/security/Security.java ++++ openjdk/src/java.base/share/classes/java/security/Security.java +@@ -32,6 +32,7 @@ import java.net.URL; + + import jdk.internal.event.EventHelper; + import jdk.internal.event.SecurityPropertyModificationEvent; ++import jdk.internal.access.JavaSecuritySystemConfiguratorAccess; + import jdk.internal.access.SharedSecrets; + import jdk.internal.util.StaticProperty; + import sun.security.util.Debug; +@@ -74,6 +75,15 @@ public final class Security { + } + + static { ++ // Initialise here as used by code with system properties disabled ++ SharedSecrets.setJavaSecuritySystemConfiguratorAccess( ++ new JavaSecuritySystemConfiguratorAccess() { ++ @Override ++ public boolean isSystemFipsEnabled() { ++ return SystemConfigurator.isSystemFipsEnabled(); ++ } ++ }); ++ + // doPrivileged here because there are multiple + // things in initialize that might require privs. + // (the FileInputStream call and the File.exists call, +@@ -194,9 +204,8 @@ public final class Security { + } + + String disableSystemProps = System.getProperty("java.security.disableSystemPropertiesFile"); +- if (disableSystemProps == null && +- "true".equalsIgnoreCase(props.getProperty +- ("security.useSystemPropertiesFile"))) { ++ if ((disableSystemProps == null || "false".equalsIgnoreCase(disableSystemProps)) && ++ "true".equalsIgnoreCase(props.getProperty("security.useSystemPropertiesFile"))) { + if (SystemConfigurator.configure(props)) { + loadedProps = true; + } +diff --git openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java +index 60fa75cab45..10b54aa4ce4 100644 +--- openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java ++++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java +@@ -38,8 +38,6 @@ import java.util.Map.Entry; + import java.util.Properties; + import java.util.regex.Pattern; + +-import jdk.internal.access.JavaSecuritySystemConfiguratorAccess; +-import jdk.internal.access.SharedSecrets; + import sun.security.util.Debug; + + /** +@@ -65,16 +63,6 @@ final class SystemConfigurator { + + private static boolean systemFipsEnabled = false; + +- static { +- SharedSecrets.setJavaSecuritySystemConfiguratorAccess( +- new JavaSecuritySystemConfiguratorAccess() { +- @Override +- public boolean isSystemFipsEnabled() { +- return SystemConfigurator.isSystemFipsEnabled(); +- } +- }); +- } +- + /* + * Invoked when java.security.Security class is initialized, if + * java.security.disableSystemPropertiesFile property is not set and diff --git a/rh1929465-dont_define_unused_throwioexception.patch b/rh1929465-dont_define_unused_throwioexception.patch new file mode 100644 index 0000000..eba090f --- /dev/null +++ b/rh1929465-dont_define_unused_throwioexception.patch @@ -0,0 +1,69 @@ +commit 90e344e7d4987af610fa0054c92d18fe1c2edd41 +Author: Andrew Hughes <gnu.andrew(a)redhat.com> +Date: Sat Aug 28 01:15:28 2021 +0100 + + RH1929465: Don't define unused throwIOException function when using NSS detection + +diff --git openjdk.orig/src/java.base/linux/native/libsystemconf/systemconf.c openjdk/src/java.base/linux/native/libsystemconf/systemconf.c +index 6f4656bfcb6..38919d6bb0f 100644 +--- openjdk.orig/src/java.base/linux/native/libsystemconf/systemconf.c ++++ openjdk/src/java.base/linux/native/libsystemconf/systemconf.c +@@ -34,14 +34,34 @@ + + #include "java_security_SystemConfigurator.h" + +-#define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled" + #define MSG_MAX_SIZE 96 + + static jmethodID debugPrintlnMethodID = NULL; + static jobject debugObj = NULL; + +-static void throwIOException(JNIEnv *env, const char *msg); +-static void dbgPrint(JNIEnv *env, const char* msg); ++// Only used when NSS is unavailable and FIPS_ENABLED_PATH is read ++#ifndef SYSCONF_NSS ++ ++#define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled" ++ ++static void throwIOException(JNIEnv *env, const char *msg) ++{ ++ jclass cls = (*env)->FindClass(env, "java/io/IOException"); ++ if (cls != 0) ++ (*env)->ThrowNew(env, cls, msg); ++} ++ ++#endif ++ ++static void dbgPrint(JNIEnv *env, const char* msg) ++{ ++ jstring jMsg; ++ if (debugObj != NULL) { ++ jMsg = (*env)->NewStringUTF(env, msg); ++ CHECK_NULL(jMsg); ++ (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg); ++ } ++} + + /* + * Class: java_security_SystemConfigurator +@@ -149,20 +169,3 @@ JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEn + + #endif // SYSCONF_NSS + } +- +-static void throwIOException(JNIEnv *env, const char *msg) +-{ +- jclass cls = (*env)->FindClass(env, "java/io/IOException"); +- if (cls != 0) +- (*env)->ThrowNew(env, cls, msg); +-} +- +-static void dbgPrint(JNIEnv *env, const char* msg) +-{ +- jstring jMsg; +- if (debugObj != NULL) { +- jMsg = (*env)->NewStringUTF(env, msg); +- CHECK_NULL(jMsg); +- (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg); +- } +-} diff --git a/rh1929465-improve_system_FIPS_detection.patch b/rh1929465-improve_system_FIPS_detection.patch new file mode 100644 index 0000000..4dfd1d4 --- /dev/null +++ b/rh1929465-improve_system_FIPS_detection.patch @@ -0,0 +1,428 @@ +diff --git openjdk/make/autoconf/lib-sysconf.m4 openjdk/make/autoconf/lib-sysconf.m4 +new file mode 100644 +index 00000000000..b2b1c1787da +--- /dev/null ++++ openjdk/make/autoconf/lib-sysconf.m4 +@@ -0,0 +1,84 @@ ++# ++# Copyright (c) 2021, Red Hat, Inc. ++# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++# ++# This code is free software; you can redistribute it and/or modify it ++# under the terms of the GNU General Public License version 2 only, as ++# published by the Free Software Foundation. Oracle designates this ++# particular file as subject to the "Classpath" exception as provided ++# by Oracle in the LICENSE file that accompanied this code. ++# ++# This code is distributed in the hope that it will be useful, but WITHOUT ++# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++# FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++# version 2 for more details (a copy is included in the LICENSE file that ++# accompanied this code). ++# ++# You should have received a copy of the GNU General Public License version ++# 2 along with this work; if not, write to the Free Software Foundation, ++# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++# ++# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++# or visit www.oracle.com if you need additional information or have any ++# questions. ++# ++ ++################################################################################ ++# Setup system configuration libraries ++################################################################################ ++AC_DEFUN_ONCE([LIB_SETUP_SYSCONF_LIBS], ++[ ++ ############################################################################### ++ # ++ # Check for the NSS library ++ # ++ ++ AC_MSG_CHECKING([whether to use the system NSS library with the System Configurator (libsysconf)]) ++ ++ # default is not available ++ DEFAULT_SYSCONF_NSS=no ++ ++ AC_ARG_ENABLE([sysconf-nss], [AS_HELP_STRING([--enable-sysconf-nss], ++ [build the System Configurator (libsysconf) using the system NSS library if available @<:@disabled@:>@])], ++ [ ++ case "${enableval}" in ++ yes) ++ sysconf_nss=yes ++ ;; ++ *) ++ sysconf_nss=no ++ ;; ++ esac ++ ], ++ [ ++ sysconf_nss=${DEFAULT_SYSCONF_NSS} ++ ]) ++ AC_MSG_RESULT([$sysconf_nss]) ++ ++ USE_SYSCONF_NSS=false ++ if test "x${sysconf_nss}" = "xyes"; then ++ PKG_CHECK_MODULES(NSS, nss >= 3.53, [NSS_FOUND=yes], [NSS_FOUND=no]) ++ if test "x${NSS_FOUND}" = "xyes"; then ++ AC_MSG_CHECKING([for system FIPS support in NSS]) ++ saved_libs="${LIBS}" ++ saved_cflags="${CFLAGS}" ++ CFLAGS="${CFLAGS} ${NSS_CFLAGS}" ++ LIBS="${LIBS} ${NSS_LIBS}" ++ AC_LANG_PUSH([C]) ++ AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include <nss3/pk11pub.h>]], ++ [[SECMOD_GetSystemFIPSEnabled()]])], ++ [AC_MSG_RESULT([yes])], ++ [AC_MSG_RESULT([no]) ++ AC_MSG_ERROR([System NSS FIPS detection unavailable])]) ++ AC_LANG_POP([C]) ++ CFLAGS="${saved_cflags}" ++ LIBS="${saved_libs}" ++ USE_SYSCONF_NSS=true ++ else ++ dnl NSS 3.53 is the one that introduces the SECMOD_GetSystemFIPSEnabled API ++ dnl in nss3/pk11pub.h. ++ AC_MSG_ERROR([--enable-sysconf-nss specified, but NSS 3.53 or above not found.]) ++ fi ++ fi ++ AC_SUBST(USE_SYSCONF_NSS) ++]) +diff --git openjdk/make/autoconf/libraries.m4 openjdk/make/autoconf/libraries.m4 +index a65d91ee974..a8f054c1397 100644 +--- openjdk/make/autoconf/libraries.m4 ++++ openjdk/make/autoconf/libraries.m4 +@@ -33,6 +33,7 @@ m4_include([lib-std.m4]) + m4_include([lib-x11.m4]) + m4_include([lib-fontconfig.m4]) + m4_include([lib-tests.m4]) ++m4_include([lib-sysconf.m4]) + + ################################################################################ + # Determine which libraries are needed for this configuration +@@ -104,6 +105,7 @@ AC_DEFUN_ONCE([LIB_SETUP_LIBRARIES], + LIB_SETUP_BUNDLED_LIBS + LIB_SETUP_MISC_LIBS + LIB_TESTS_SETUP_GTEST ++ LIB_SETUP_SYSCONF_LIBS + + BASIC_JDKLIB_LIBS="" + if test "x$TOOLCHAIN_TYPE" != xmicrosoft; then +diff --git openjdk/make/autoconf/spec.gmk.in openjdk/make/autoconf/spec.gmk.in +index 29445c8c24f..9b1b512a34a 100644 +--- openjdk/make/autoconf/spec.gmk.in ++++ openjdk/make/autoconf/spec.gmk.in +@@ -834,6 +834,10 @@ INSTALL_SYSCONFDIR=@sysconfdir@ + # Libraries + # + ++USE_SYSCONF_NSS:=@USE_SYSCONF_NSS@ ++NSS_LIBS:=@NSS_LIBS@ ++NSS_CFLAGS:=@NSS_CFLAGS@ ++ + USE_EXTERNAL_LCMS:=@USE_EXTERNAL_LCMS@ + LCMS_CFLAGS:=@LCMS_CFLAGS@ + LCMS_LIBS:=@LCMS_LIBS@ +diff --git openjdk/make/modules/java.base/Lib.gmk openjdk/make/modules/java.base/Lib.gmk +index 5658ff342e5..cb7a56852f7 100644 +--- openjdk/make/modules/java.base/Lib.gmk ++++ openjdk/make/modules/java.base/Lib.gmk +@@ -167,6 +167,31 @@ ifeq ($(call isTargetOsType, unix), true) + endif + endif + ++################################################################################ ++# Create the systemconf library ++ ++LIBSYSTEMCONF_CFLAGS := ++LIBSYSTEMCONF_CXXFLAGS := ++ ++ifeq ($(USE_SYSCONF_NSS), true) ++ LIBSYSTEMCONF_CFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS ++ LIBSYSTEMCONF_CXXFLAGS += $(NSS_CFLAGS) -DSYSCONF_NSS ++endif ++ ++ifeq ($(OPENJDK_BUILD_OS), linux) ++ $(eval $(call SetupJdkLibrary, BUILD_LIBSYSTEMCONF, \ ++ NAME := systemconf, \ ++ OPTIMIZATION := LOW, \ ++ CFLAGS := $(CFLAGS_JDKLIB) $(LIBSYSTEMCONF_CFLAGS), \ ++ CXXFLAGS := $(CXXFLAGS_JDKLIB) $(LIBSYSTEMCONF_CXXFLAGS), \ ++ LDFLAGS := $(LDFLAGS_JDKLIB) \ ++ $(call SET_SHARED_LIBRARY_ORIGIN), \ ++ LIBS_unix := $(LIBDL) $(NSS_LIBS), \ ++ )) ++ ++ TARGETS += $(BUILD_LIBSYSTEMCONF) ++endif ++ + ################################################################################ + # Create the symbols file for static builds. + +diff --git openjdk/src/java.base/linux/native/libsystemconf/systemconf.c openjdk/src/java.base/linux/native/libsystemconf/systemconf.c +new file mode 100644 +index 00000000000..6f4656bfcb6 +--- /dev/null ++++ openjdk/src/java.base/linux/native/libsystemconf/systemconf.c +@@ -0,0 +1,168 @@ ++/* ++ * Copyright (c) 2021, Red Hat, Inc. ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. Oracle designates this ++ * particular file as subject to the "Classpath" exception as provided ++ * by Oracle in the LICENSE file that accompanied this code. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++#include <dlfcn.h> ++#include <jni.h> ++#include <jni_util.h> ++#include <stdio.h> ++ ++#ifdef SYSCONF_NSS ++#include <nss3/pk11pub.h> ++#endif //SYSCONF_NSS ++ ++#include "java_security_SystemConfigurator.h" ++ ++#define FIPS_ENABLED_PATH "/proc/sys/crypto/fips_enabled" ++#define MSG_MAX_SIZE 96 ++ ++static jmethodID debugPrintlnMethodID = NULL; ++static jobject debugObj = NULL; ++ ++static void throwIOException(JNIEnv *env, const char *msg); ++static void dbgPrint(JNIEnv *env, const char* msg); ++ ++/* ++ * Class: java_security_SystemConfigurator ++ * Method: JNI_OnLoad ++ */ ++JNIEXPORT jint JNICALL DEF_JNI_OnLoad(JavaVM *vm, void *reserved) ++{ ++ JNIEnv *env; ++ jclass sysConfCls, debugCls; ++ jfieldID sdebugFld; ++ ++ if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) { ++ return JNI_EVERSION; /* JNI version not supported */ ++ } ++ ++ sysConfCls = (*env)->FindClass(env,"java/security/SystemConfigurator"); ++ if (sysConfCls == NULL) { ++ printf("libsystemconf: SystemConfigurator class not found\n"); ++ return JNI_ERR; ++ } ++ sdebugFld = (*env)->GetStaticFieldID(env, sysConfCls, ++ "sdebug", "Lsun/security/util/Debug;"); ++ if (sdebugFld == NULL) { ++ printf("libsystemconf: SystemConfigurator::sdebug field not found\n"); ++ return JNI_ERR; ++ } ++ debugObj = (*env)->GetStaticObjectField(env, sysConfCls, sdebugFld); ++ if (debugObj != NULL) { ++ debugCls = (*env)->FindClass(env,"sun/security/util/Debug"); ++ if (debugCls == NULL) { ++ printf("libsystemconf: Debug class not found\n"); ++ return JNI_ERR; ++ } ++ debugPrintlnMethodID = (*env)->GetMethodID(env, debugCls, ++ "println", "(Ljava/lang/String;)V"); ++ if (debugPrintlnMethodID == NULL) { ++ printf("libsystemconf: Debug::println(String) method not found\n"); ++ return JNI_ERR; ++ } ++ debugObj = (*env)->NewGlobalRef(env, debugObj); ++ } ++ ++ return (*env)->GetVersion(env); ++} ++ ++/* ++ * Class: java_security_SystemConfigurator ++ * Method: JNI_OnUnload ++ */ ++JNIEXPORT void JNICALL DEF_JNI_OnUnload(JavaVM *vm, void *reserved) ++{ ++ JNIEnv *env; ++ ++ if (debugObj != NULL) { ++ if ((*vm)->GetEnv(vm, (void**) &env, JNI_VERSION_1_2) != JNI_OK) { ++ return; /* Should not happen */ ++ } ++ (*env)->DeleteGlobalRef(env, debugObj); ++ } ++} ++ ++JNIEXPORT jboolean JNICALL Java_java_security_SystemConfigurator_getSystemFIPSEnabled ++ (JNIEnv *env, jclass cls) ++{ ++ int fips_enabled; ++ char msg[MSG_MAX_SIZE]; ++ int msg_bytes; ++ ++#ifdef SYSCONF_NSS ++ ++ dbgPrint(env, "getSystemFIPSEnabled: calling SECMOD_GetSystemFIPSEnabled"); ++ fips_enabled = SECMOD_GetSystemFIPSEnabled(); ++ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \ ++ " SECMOD_GetSystemFIPSEnabled returned 0x%x", fips_enabled); ++ if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) { ++ dbgPrint(env, msg); ++ } else { ++ dbgPrint(env, "getSystemFIPSEnabled: cannot render" \ ++ " SECMOD_GetSystemFIPSEnabled return value"); ++ } ++ return (fips_enabled == 1 ? JNI_TRUE : JNI_FALSE); ++ ++#else // SYSCONF_NSS ++ ++ FILE *fe; ++ ++ dbgPrint(env, "getSystemFIPSEnabled: reading " FIPS_ENABLED_PATH); ++ if ((fe = fopen(FIPS_ENABLED_PATH, "r")) == NULL) { ++ throwIOException(env, "Cannot open " FIPS_ENABLED_PATH); ++ } ++ fips_enabled = fgetc(fe); ++ fclose(fe); ++ if (fips_enabled == EOF) { ++ throwIOException(env, "Cannot read " FIPS_ENABLED_PATH); ++ } ++ msg_bytes = snprintf(msg, MSG_MAX_SIZE, "getSystemFIPSEnabled:" \ ++ " read character is '%c'", fips_enabled); ++ if (msg_bytes > 0 && msg_bytes < MSG_MAX_SIZE) { ++ dbgPrint(env, msg); ++ } else { ++ dbgPrint(env, "getSystemFIPSEnabled: cannot render" \ ++ " read character"); ++ } ++ return (fips_enabled == '1' ? JNI_TRUE : JNI_FALSE); ++ ++#endif // SYSCONF_NSS ++} ++ ++static void throwIOException(JNIEnv *env, const char *msg) ++{ ++ jclass cls = (*env)->FindClass(env, "java/io/IOException"); ++ if (cls != 0) ++ (*env)->ThrowNew(env, cls, msg); ++} ++ ++static void dbgPrint(JNIEnv *env, const char* msg) ++{ ++ jstring jMsg; ++ if (debugObj != NULL) { ++ jMsg = (*env)->NewStringUTF(env, msg); ++ CHECK_NULL(jMsg); ++ (*env)->CallVoidMethod(env, debugObj, debugPrintlnMethodID, jMsg); ++ } ++} +diff --git openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java +index 10b54aa4ce4..6aa1419dfd0 100644 +--- openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java ++++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2019, 2020, Red Hat, Inc. ++ * Copyright (c) 2019, 2021, Red Hat, Inc. + * + * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. + * +@@ -30,13 +30,9 @@ import java.io.BufferedInputStream; + import java.io.FileInputStream; + import java.io.IOException; + +-import java.nio.file.Files; +-import java.nio.file.Path; +- + import java.util.Iterator; + import java.util.Map.Entry; + import java.util.Properties; +-import java.util.regex.Pattern; + + import sun.security.util.Debug; + +@@ -58,11 +54,23 @@ final class SystemConfigurator { + private static final String CRYPTO_POLICIES_JAVA_CONFIG = + CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config"; + +- private static final String CRYPTO_POLICIES_CONFIG = +- CRYPTO_POLICIES_BASE_DIR + "/config"; +- + private static boolean systemFipsEnabled = false; + ++ private static final String SYSTEMCONF_NATIVE_LIB = "systemconf"; ++ ++ private static native boolean getSystemFIPSEnabled() ++ throws IOException; ++ ++ static { ++ @SuppressWarnings("removal") ++ var dummy = AccessController.doPrivileged(new PrivilegedAction<Void>() { ++ public Void run() { ++ System.loadLibrary(SYSTEMCONF_NATIVE_LIB); ++ return null; ++ } ++ }); ++ } ++ + /* + * Invoked when java.security.Security class is initialized, if + * java.security.disableSystemPropertiesFile property is not set and +@@ -170,16 +178,34 @@ final class SystemConfigurator { + } + + /* +- * FIPS is enabled only if crypto-policies are set to "FIPS" +- * and the com.redhat.fips property is true. ++ * OpenJDK FIPS mode will be enabled only if the com.redhat.fips ++ * system property is true (default) and the system is in FIPS mode. ++ * ++ * There are 2 possible ways in which OpenJDK detects that the system ++ * is in FIPS mode: 1) if the NSS SECMOD_GetSystemFIPSEnabled API is ++ * available at OpenJDK's built-time, it is called; 2) otherwise, the ++ * /proc/sys/crypto/fips_enabled file is read. + */ + private static boolean enableFips() throws Exception { + boolean shouldEnable = Boolean.valueOf(System.getProperty("com.redhat.fips", "true")); + if (shouldEnable) { +- String cryptoPoliciesConfig = new String(Files.readAllBytes(Path.of(CRYPTO_POLICIES_CONFIG))); +- if (sdebug != null) { sdebug.println("Crypto config:\n" + cryptoPoliciesConfig); } +- Pattern pattern = Pattern.compile("^FIPS$", Pattern.MULTILINE); +- return pattern.matcher(cryptoPoliciesConfig).find(); ++ if (sdebug != null) { ++ sdebug.println("Calling getSystemFIPSEnabled (libsystemconf)..."); ++ } ++ try { ++ shouldEnable = getSystemFIPSEnabled(); ++ if (sdebug != null) { ++ sdebug.println("Call to getSystemFIPSEnabled (libsystemconf) returned: " ++ + shouldEnable); ++ } ++ return shouldEnable; ++ } catch (IOException e) { ++ if (sdebug != null) { ++ sdebug.println("Call to getSystemFIPSEnabled (libsystemconf) failed:"); ++ sdebug.println(e.getMessage()); ++ } ++ throw e; ++ } + } else { + return false; + } diff --git a/rh1991003-enable_fips_keys_import.patch b/rh1991003-enable_fips_keys_import.patch new file mode 100644 index 0000000..79d2743 --- /dev/null +++ b/rh1991003-enable_fips_keys_import.patch @@ -0,0 +1,579 @@ +commit abcd0954643eddbf826d96291d44a143038ab750 +Author: Martin Balao <mbalao(a)redhat.com> +Date: Sun Oct 10 18:14:01 2021 +0100 + + RH1991003: Enable the import of plain keys into the NSS software token. + + This can be individually disabled using -Dcom.redhat.fips.plainKeySupport=false + +diff --git openjdk.orig/src/java.base/share/classes/java/security/Security.java openjdk/src/java.base/share/classes/java/security/Security.java +index ce32c939253..dc7020ce668 100644 +--- openjdk.orig/src/java.base/share/classes/java/security/Security.java ++++ openjdk/src/java.base/share/classes/java/security/Security.java +@@ -82,6 +82,10 @@ public final class Security { + public boolean isSystemFipsEnabled() { + return SystemConfigurator.isSystemFipsEnabled(); + } ++ @Override ++ public boolean isPlainKeySupportEnabled() { ++ return SystemConfigurator.isPlainKeySupportEnabled(); ++ } + }); + + // doPrivileged here because there are multiple +diff --git openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java +index 6aa1419dfd0..ecab722848e 100644 +--- openjdk.orig/src/java.base/share/classes/java/security/SystemConfigurator.java ++++ openjdk/src/java.base/share/classes/java/security/SystemConfigurator.java +@@ -55,6 +55,7 @@ final class SystemConfigurator { + CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config"; + + private static boolean systemFipsEnabled = false; ++ private static boolean plainKeySupportEnabled = false; + + private static final String SYSTEMCONF_NATIVE_LIB = "systemconf"; + +@@ -150,6 +151,16 @@ final class SystemConfigurator { + } + loadedProps = true; + systemFipsEnabled = true; ++ String plainKeySupport = System.getProperty("com.redhat.fips.plainKeySupport", ++ "true"); ++ plainKeySupportEnabled = !"false".equals(plainKeySupport); ++ if (sdebug != null) { ++ if (plainKeySupportEnabled) { ++ sdebug.println("FIPS support enabled with plain key support"); ++ } else { ++ sdebug.println("FIPS support enabled without plain key support"); ++ } ++ } + } + } catch (Exception e) { + if (sdebug != null) { +@@ -177,6 +188,19 @@ final class SystemConfigurator { + return systemFipsEnabled; + } + ++ /** ++ * Returns {@code true} if system FIPS alignment is enabled ++ * and plain key support is allowed. Plain key support is ++ * enabled by default but can be disabled with ++ * {@code -Dcom.redhat.fips.plainKeySupport=false}. ++ * ++ * @return a boolean indicating whether plain key support ++ * should be enabled. ++ */ ++ static boolean isPlainKeySupportEnabled() { ++ return plainKeySupportEnabled; ++ } ++ + /* + * OpenJDK FIPS mode will be enabled only if the com.redhat.fips + * system property is true (default) and the system is in FIPS mode. +diff --git openjdk.orig/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java +index a31e93ec02e..3f3caac64dc 100644 +--- openjdk.orig/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java ++++ openjdk/src/java.base/share/classes/jdk/internal/access/JavaSecuritySystemConfiguratorAccess.java +@@ -27,4 +27,5 @@ package jdk.internal.access; + + public interface JavaSecuritySystemConfiguratorAccess { + boolean isSystemFipsEnabled(); ++ boolean isPlainKeySupportEnabled(); + } +diff --git openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java +new file mode 100644 +index 00000000000..bee3a1e1537 +--- /dev/null ++++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/FIPSKeyImporter.java +@@ -0,0 +1,291 @@ ++/* ++ * Copyright (c) 2021, Red Hat, Inc. ++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. ++ * ++ * This code is free software; you can redistribute it and/or modify it ++ * under the terms of the GNU General Public License version 2 only, as ++ * published by the Free Software Foundation. Oracle designates this ++ * particular file as subject to the "Classpath" exception as provided ++ * by Oracle in the LICENSE file that accompanied this code. ++ * ++ * This code is distributed in the hope that it will be useful, but WITHOUT ++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or ++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License ++ * version 2 for more details (a copy is included in the LICENSE file that ++ * accompanied this code). ++ * ++ * You should have received a copy of the GNU General Public License version ++ * 2 along with this work; if not, write to the Free Software Foundation, ++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA. ++ * ++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA ++ * or visit www.oracle.com if you need additional information or have any ++ * questions. ++ */ ++ ++package sun.security.pkcs11; ++ ++import java.math.BigInteger; ++import java.security.KeyFactory; ++import java.security.Provider; ++import java.security.Security; ++import java.util.HashMap; ++import java.util.Map; ++import java.util.concurrent.locks.ReentrantLock; ++ ++import javax.crypto.Cipher; ++import javax.crypto.spec.DHPrivateKeySpec; ++import javax.crypto.spec.IvParameterSpec; ++ ++import sun.security.jca.JCAUtil; ++import sun.security.pkcs11.TemplateManager; ++import sun.security.pkcs11.wrapper.CK_ATTRIBUTE; ++import sun.security.pkcs11.wrapper.CK_MECHANISM; ++import static sun.security.pkcs11.wrapper.PKCS11Constants.*; ++import static sun.security.pkcs11.wrapper.PKCS11Exception.*; ++import sun.security.pkcs11.wrapper.PKCS11Exception; ++import sun.security.rsa.RSAUtil.KeyType; ++import sun.security.util.Debug; ++import sun.security.util.ECUtil; ++ ++final class FIPSKeyImporter { ++ ++ private static final Debug debug = ++ Debug.getInstance("sunpkcs11"); ++ ++ private static P11Key importerKey = null; ++ private static final ReentrantLock importerKeyLock = new ReentrantLock(); ++ private static CK_MECHANISM importerKeyMechanism = null; ++ private static Cipher importerCipher = null; ++ ++ private static Provider sunECProvider = null; ++ private static final ReentrantLock sunECProviderLock = new ReentrantLock(); ++ ++ private static KeyFactory DHKF = null; ++ private static final ReentrantLock DHKFLock = new ReentrantLock(); ++ ++ static Long importKey(SunPKCS11 sunPKCS11, long hSession, CK_ATTRIBUTE[] attributes) ++ throws PKCS11Exception { ++ long keyID = -1; ++ Token token = sunPKCS11.getToken(); ++ if (debug != null) { ++ debug.println("Private or Secret key will be imported in" + ++ " system FIPS mode."); ++ } ++ if (importerKey == null) { ++ importerKeyLock.lock(); ++ try { ++ if (importerKey == null) { ++ if (importerKeyMechanism == null) { ++ // Importer Key creation has not been tried yet. Try it. ++ createImporterKey(token); ++ } ++ if (importerKey == null || importerCipher == null) { ++ if (debug != null) { ++ debug.println("Importer Key could not be" + ++ " generated."); ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR); ++ } ++ if (debug != null) { ++ debug.println("Importer Key successfully" + ++ " generated."); ++ } ++ } ++ } finally { ++ importerKeyLock.unlock(); ++ } ++ } ++ long importerKeyID = importerKey.getKeyID(); ++ try { ++ byte[] keyBytes = null; ++ byte[] encKeyBytes = null; ++ long keyClass = 0L; ++ long keyType = 0L; ++ Map<Long, CK_ATTRIBUTE> attrsMap = new HashMap<>(); ++ for (CK_ATTRIBUTE attr : attributes) { ++ if (attr.type == CKA_CLASS) { ++ keyClass = attr.getLong(); ++ } else if (attr.type == CKA_KEY_TYPE) { ++ keyType = attr.getLong(); ++ } ++ attrsMap.put(attr.type, attr); ++ } ++ BigInteger v = null; ++ if (keyClass == CKO_PRIVATE_KEY) { ++ if (keyType == CKK_RSA) { ++ if (debug != null) { ++ debug.println("Importing an RSA private key..."); ++ } ++ keyBytes = sun.security.rsa.RSAPrivateCrtKeyImpl.newKey( ++ KeyType.RSA, ++ null, ++ ((v = attrsMap.get(CKA_MODULUS).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PUBLIC_EXPONENT).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PRIVATE_EXPONENT).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PRIME_1).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PRIME_2).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_EXPONENT_1).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_EXPONENT_2).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_COEFFICIENT).getBigInteger()) != null) ++ ? v : BigInteger.ZERO ++ ).getEncoded(); ++ } else if (keyType == CKK_DSA) { ++ if (debug != null) { ++ debug.println("Importing a DSA private key..."); ++ } ++ keyBytes = new sun.security.provider.DSAPrivateKey( ++ ((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PRIME).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_SUBPRIME).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_BASE).getBigInteger()) != null) ++ ? v : BigInteger.ZERO ++ ).getEncoded(); ++ if (token.config.getNssNetscapeDbWorkaround() && ++ attrsMap.get(CKA_NETSCAPE_DB) == null) { ++ attrsMap.put(CKA_NETSCAPE_DB, ++ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO)); ++ } ++ } else if (keyType == CKK_EC) { ++ if (debug != null) { ++ debug.println("Importing an EC private key..."); ++ } ++ if (sunECProvider == null) { ++ sunECProviderLock.lock(); ++ try { ++ if (sunECProvider == null) { ++ sunECProvider = Security.getProvider("SunEC"); ++ } ++ } finally { ++ sunECProviderLock.unlock(); ++ } ++ } ++ keyBytes = ECUtil.generateECPrivateKey( ++ ((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ECUtil.getECParameterSpec(sunECProvider, ++ attrsMap.get(CKA_EC_PARAMS).getByteArray())) ++ .getEncoded(); ++ if (token.config.getNssNetscapeDbWorkaround() && ++ attrsMap.get(CKA_NETSCAPE_DB) == null) { ++ attrsMap.put(CKA_NETSCAPE_DB, ++ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO)); ++ } ++ } else if (keyType == CKK_DH) { ++ if (debug != null) { ++ debug.println("Importing a Diffie-Hellman private key..."); ++ } ++ if (DHKF == null) { ++ DHKFLock.lock(); ++ try { ++ if (DHKF == null) { ++ DHKF = KeyFactory.getInstance( ++ "DH", P11Util.getSunJceProvider()); ++ } ++ } finally { ++ DHKFLock.unlock(); ++ } ++ } ++ DHPrivateKeySpec spec = new DHPrivateKeySpec ++ (((v = attrsMap.get(CKA_VALUE).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_PRIME).getBigInteger()) != null) ++ ? v : BigInteger.ZERO, ++ ((v = attrsMap.get(CKA_BASE).getBigInteger()) != null) ++ ? v : BigInteger.ZERO); ++ keyBytes = DHKF.generatePrivate(spec).getEncoded(); ++ if (token.config.getNssNetscapeDbWorkaround() && ++ attrsMap.get(CKA_NETSCAPE_DB) == null) { ++ attrsMap.put(CKA_NETSCAPE_DB, ++ new CK_ATTRIBUTE(CKA_NETSCAPE_DB, BigInteger.ZERO)); ++ } ++ } else { ++ if (debug != null) { ++ debug.println("Unrecognized private key type."); ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR); ++ } ++ } else if (keyClass == CKO_SECRET_KEY) { ++ if (debug != null) { ++ debug.println("Importing a secret key..."); ++ } ++ keyBytes = attrsMap.get(CKA_VALUE).getByteArray(); ++ } ++ if (keyBytes == null || keyBytes.length == 0) { ++ if (debug != null) { ++ debug.println("Private or secret key plain bytes could" + ++ " not be obtained. Import failed."); ++ } ++ throw new PKCS11Exception(CKR_GENERAL_ERROR); ++ } ++ importerCipher.init(Cipher.ENCRYPT_MODE, importerKey, ++ new IvParameterSpec((byte[])importerKeyMechanism.pParameter), ++ null); ++ attributes = new CK_ATTRIBUTE[attrsMap.size()]; ++ attrsMap.values().toArray(attributes); ++ encKeyBytes = importerCipher.doFinal(keyBytes); ++ attributes = token.getAttributes(TemplateManager.O_IMPORT, ++ keyClass, keyType, attributes); ++ keyID = token.p11.C_UnwrapKey(hSession, ++ importerKeyMechanism, importerKeyID, encKeyBytes, attributes); ++ if (debug != null) { ++ debug.println("Imported key ID: " + keyID); ++ } ++ } catch (Throwable t) { ++ throw new PKCS11Exception(CKR_GENERAL_ERROR); ++ } finally { ++ importerKey.releaseKeyID(); ++ } ++ return Long.valueOf(keyID); ++ } ++ ++ private static void createImporterKey(Token token) { ++ if (debug != null) { ++ debug.println("Generating Importer Key..."); ++ } ++ byte[] iv = new byte[16]; ++ JCAUtil.getSecureRandom().nextBytes(iv); ++ importerKeyMechanism = new CK_MECHANISM(CKM_AES_CBC_PAD, iv); ++ try { ++ CK_ATTRIBUTE[] attributes = token.getAttributes(TemplateManager.O_GENERATE, ++ CKO_SECRET_KEY, CKK_AES, new CK_ATTRIBUTE[] { ++ new CK_ATTRIBUTE(CKA_CLASS, CKO_SECRET_KEY), ++ new CK_ATTRIBUTE(CKA_VALUE_LEN, 256 >> 3)}); ++ Session s = null; ++ try { ++ s = token.getObjSession(); ++ long keyID = token.p11.C_GenerateKey( ++ s.id(), new CK_MECHANISM(CKM_AES_KEY_GEN), ++ attributes); ++ if (debug != null) { ++ debug.println("Importer Key ID: " + keyID); ++ } ++ importerKey = (P11Key)P11Key.secretKey(s, keyID, "AES", ++ 256 >> 3, null); ++ } catch (PKCS11Exception e) { ++ // best effort ++ } finally { ++ token.releaseSession(s); ++ } ++ if (importerKey != null) { ++ importerCipher = Cipher.getInstance("AES/CBC/PKCS5Padding"); ++ } ++ } catch (Throwable t) { ++ // best effort ++ importerKey = null; ++ importerCipher = null; ++ // importerKeyMechanism value is kept initialized to indicate that ++ // Importer Key creation has been tried and failed. ++ } ++ } ++} +diff --git openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java +index 5d3963ea893..42c72b393fd 100644 +--- openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java ++++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java +@@ -26,6 +26,9 @@ + package sun.security.pkcs11; + + import java.io.*; ++import java.lang.invoke.MethodHandle; ++import java.lang.invoke.MethodHandles; ++import java.lang.invoke.MethodType; + import java.util.*; + + import java.security.*; +@@ -66,6 +69,26 @@ public final class SunPKCS11 extends AuthProvider { + private static final boolean systemFipsEnabled = SharedSecrets + .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled(); + ++ private static final boolean plainKeySupportEnabled = SharedSecrets ++ .getJavaSecuritySystemConfiguratorAccess().isPlainKeySupportEnabled(); ++ ++ private static final MethodHandle fipsImportKey; ++ static { ++ MethodHandle fipsImportKeyTmp = null; ++ if (plainKeySupportEnabled) { ++ try { ++ fipsImportKeyTmp = MethodHandles.lookup().findStatic( ++ FIPSKeyImporter.class, "importKey", ++ MethodType.methodType(Long.class, SunPKCS11.class, ++ long.class, CK_ATTRIBUTE[].class)); ++ } catch (Throwable t) { ++ throw new SecurityException("FIPS key importer initialization" + ++ " failed", t); ++ } ++ } ++ fipsImportKey = fipsImportKeyTmp; ++ } ++ + private static final long serialVersionUID = -1354835039035306505L; + + static final Debug debug = Debug.getInstance("sunpkcs11"); +@@ -324,10 +347,15 @@ public final class SunPKCS11 extends AuthProvider { + // request multithreaded access first + initArgs.flags = CKF_OS_LOCKING_OK; + PKCS11 tmpPKCS11; ++ MethodHandle fipsKeyImporter = null; ++ if (plainKeySupportEnabled) { ++ fipsKeyImporter = MethodHandles.insertArguments( ++ fipsImportKey, 0, this); ++ } + try { + tmpPKCS11 = PKCS11.getInstance( + library, functionList, initArgs, +- config.getOmitInitialize()); ++ config.getOmitInitialize(), fipsKeyImporter); + } catch (PKCS11Exception e) { + if (debug != null) { + debug.println("Multi-threaded initialization failed: " + e); +@@ -343,7 +371,7 @@ public final class SunPKCS11 extends AuthProvider { + initArgs.flags = 0; + } + tmpPKCS11 = PKCS11.getInstance(library, +- functionList, initArgs, config.getOmitInitialize()); ++ functionList, initArgs, config.getOmitInitialize(), fipsKeyImporter); + } + p11 = tmpPKCS11; + +diff --git openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java +index 5c0aacd1a67..4d80145cb91 100644 +--- openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java ++++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11.java +@@ -49,6 +49,7 @@ package sun.security.pkcs11.wrapper; + + import java.io.File; + import java.io.IOException; ++import java.lang.invoke.MethodHandle; + import java.util.*; + + import java.security.AccessController; +@@ -152,16 +153,28 @@ public class PKCS11 { + + public static synchronized PKCS11 getInstance(String pkcs11ModulePath, + String functionList, CK_C_INITIALIZE_ARGS pInitArgs, +- boolean omitInitialize) throws IOException, PKCS11Exception { ++ boolean omitInitialize, MethodHandle fipsKeyImporter) ++ throws IOException, PKCS11Exception { + // we may only call C_Initialize once per native .so/.dll + // so keep a cache using the (non-canonicalized!) path + PKCS11 pkcs11 = moduleMap.get(pkcs11ModulePath); + if (pkcs11 == null) { ++ boolean nssFipsMode = fipsKeyImporter != null; + if ((pInitArgs != null) + && ((pInitArgs.flags & CKF_OS_LOCKING_OK) != 0)) { +- pkcs11 = new PKCS11(pkcs11ModulePath, functionList); ++ if (nssFipsMode) { ++ pkcs11 = new FIPSPKCS11(pkcs11ModulePath, functionList, ++ fipsKeyImporter); ++ } else { ++ pkcs11 = new PKCS11(pkcs11ModulePath, functionList); ++ } + } else { +- pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList); ++ if (nssFipsMode) { ++ pkcs11 = new SynchronizedFIPSPKCS11(pkcs11ModulePath, ++ functionList, fipsKeyImporter); ++ } else { ++ pkcs11 = new SynchronizedPKCS11(pkcs11ModulePath, functionList); ++ } + } + if (omitInitialize == false) { + try { +@@ -1911,4 +1924,69 @@ static class SynchronizedPKCS11 extends PKCS11 { + super.C_GenerateRandom(hSession, randomData); + } + } ++ ++// PKCS11 subclass that allows using plain private or secret keys in ++// FIPS-configured NSS Software Tokens. Only used when System FIPS ++// is enabled. ++static class FIPSPKCS11 extends PKCS11 { ++ private MethodHandle fipsKeyImporter; ++ FIPSPKCS11(String pkcs11ModulePath, String functionListName, ++ MethodHandle fipsKeyImporter) throws IOException { ++ super(pkcs11ModulePath, functionListName); ++ this.fipsKeyImporter = fipsKeyImporter; ++ } ++ ++ public synchronized long C_CreateObject(long hSession, ++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception { ++ // Creating sensitive key objects from plain key material in a ++ // FIPS-configured NSS Software Token is not allowed. We apply ++ // a key-unwrapping scheme to achieve so. ++ if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) { ++ try { ++ return ((Long)fipsKeyImporter.invoke(hSession, pTemplate)) ++ .longValue(); ++ } catch (Throwable t) { ++ throw new PKCS11Exception(CKR_GENERAL_ERROR); ++ } ++ } ++ return super.C_CreateObject(hSession, pTemplate); ++ } ++} ++ ++// FIPSPKCS11 synchronized counterpart. ++static class SynchronizedFIPSPKCS11 extends SynchronizedPKCS11 { ++ private MethodHandle fipsKeyImporter; ++ SynchronizedFIPSPKCS11(String pkcs11ModulePath, String functionListName, ++ MethodHandle fipsKeyImporter) throws IOException { ++ super(pkcs11ModulePath, functionListName); ++ this.fipsKeyImporter = fipsKeyImporter; ++ } ++ ++ public synchronized long C_CreateObject(long hSession, ++ CK_ATTRIBUTE[] pTemplate) throws PKCS11Exception { ++ // See FIPSPKCS11::C_CreateObject. ++ if (FIPSPKCS11Helper.isSensitiveObject(pTemplate)) { ++ try { ++ return ((Long)fipsKeyImporter.invoke(hSession, pTemplate)) ++ .longValue(); ++ } catch (Throwable t) { ++ throw new PKCS11Exception(CKR_GENERAL_ERROR); ++ } ++ } ++ return super.C_CreateObject(hSession, pTemplate); ++ } ++} ++ ++private static class FIPSPKCS11Helper { ++ static boolean isSensitiveObject(CK_ATTRIBUTE[] pTemplate) { ++ for (CK_ATTRIBUTE attr : pTemplate) { ++ if (attr.type == CKA_CLASS && ++ (attr.getLong() == CKO_PRIVATE_KEY || ++ attr.getLong() == CKO_SECRET_KEY)) { ++ return true; ++ } ++ } ++ return false; ++ } ++} + } +diff --git openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java +index e2d6d371bec..dc5e7eefdd3 100644 +--- openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java ++++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/wrapper/PKCS11Exception.java +@@ -219,6 +219,14 @@ public class PKCS11Exception extends Exception { + return "0x" + Functions.toFullHexString((int)errorCode); + } + ++ /** ++ * Constructor taking the error code (the CKR_* constants in PKCS#11) with ++ * no extra info for the error message. ++ */ ++ public PKCS11Exception(long errorCode) { ++ this(errorCode, null); ++ } ++ + /** + * Constructor taking the error code (the CKR_* constants in PKCS#11) and + * extra info for error message. diff --git a/rh1995150-disable_non-fips_crypto.patch b/rh1995150-disable_non-fips_crypto.patch new file mode 100644 index 0000000..b3d0ae7 --- /dev/null +++ b/rh1995150-disable_non-fips_crypto.patch @@ -0,0 +1,596 @@ +diff --git openjdk/src/java.base/share/classes/module-info.java openjdk/src/java.base/share/classes/module-info.java +index 9d4a794de1a..39e69362458 100644 +--- openjdk/src/java.base/share/classes/module-info.java ++++ openjdk/src/java.base/share/classes/module-info.java +@@ -151,6 +151,7 @@ module java.base { + java.management, + java.naming, + java.rmi, ++ jdk.crypto.ec, + jdk.jartool, + jdk.jlink, + jdk.net, +diff --git openjdk/src/java.base/share/classes/sun/security/provider/SunEntries.java openjdk/src/java.base/share/classes/sun/security/provider/SunEntries.java +index 912cad59714..c5e13c98bd9 100644 +--- openjdk/src/java.base/share/classes/sun/security/provider/SunEntries.java ++++ openjdk/src/java.base/share/classes/sun/security/provider/SunEntries.java +@@ -30,6 +30,7 @@ import java.net.*; + import java.util.*; + import java.security.*; + ++import jdk.internal.access.SharedSecrets; + import jdk.internal.util.StaticProperty; + import sun.security.action.GetPropertyAction; + import sun.security.util.SecurityProviderConstants; +@@ -83,6 +84,10 @@ import static sun.security.util.SecurityProviderConstants.getAliases; + + public final class SunEntries { + ++ private static final boolean systemFipsEnabled = ++ SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ .isSystemFipsEnabled(); ++ + // the default algo used by SecureRandom class for new SecureRandom() calls + public static final String DEF_SECURE_RANDOM_ALGO; + +@@ -94,147 +99,149 @@ public final class SunEntries { + // common attribute map + HashMap<String, String> attrs = new HashMap<>(3); + +- /* +- * SecureRandom engines +- */ +- attrs.put("ThreadSafe", "true"); +- if (NativePRNG.isAvailable()) { +- add(p, "SecureRandom", "NativePRNG", +- "sun.security.provider.NativePRNG", attrs); +- } +- if (NativePRNG.Blocking.isAvailable()) { +- add(p, "SecureRandom", "NativePRNGBlocking", +- "sun.security.provider.NativePRNG$Blocking", attrs); +- } +- if (NativePRNG.NonBlocking.isAvailable()) { +- add(p, "SecureRandom", "NativePRNGNonBlocking", +- "sun.security.provider.NativePRNG$NonBlocking", attrs); ++ if (!systemFipsEnabled) { ++ /* ++ * SecureRandom engines ++ */ ++ attrs.put("ThreadSafe", "true"); ++ if (NativePRNG.isAvailable()) { ++ add(p, "SecureRandom", "NativePRNG", ++ "sun.security.provider.NativePRNG", attrs); ++ } ++ if (NativePRNG.Blocking.isAvailable()) { ++ add(p, "SecureRandom", "NativePRNGBlocking", ++ "sun.security.provider.NativePRNG$Blocking", attrs); ++ } ++ if (NativePRNG.NonBlocking.isAvailable()) { ++ add(p, "SecureRandom", "NativePRNGNonBlocking", ++ "sun.security.provider.NativePRNG$NonBlocking", attrs); ++ } ++ attrs.put("ImplementedIn", "Software"); ++ add(p, "SecureRandom", "DRBG", "sun.security.provider.DRBG", attrs); ++ add(p, "SecureRandom", "SHA1PRNG", ++ "sun.security.provider.SecureRandom", attrs); ++ ++ /* ++ * Signature engines ++ */ ++ attrs.clear(); ++ String dsaKeyClasses = "java.security.interfaces.DSAPublicKey" + ++ "|java.security.interfaces.DSAPrivateKey"; ++ attrs.put("SupportedKeyClasses", dsaKeyClasses); ++ attrs.put("ImplementedIn", "Software"); ++ ++ attrs.put("KeySize", "1024"); // for NONE and SHA1 DSA signatures ++ ++ addWithAlias(p, "Signature", "SHA1withDSA", ++ "sun.security.provider.DSA$SHA1withDSA", attrs); ++ addWithAlias(p, "Signature", "NONEwithDSA", ++ "sun.security.provider.DSA$RawDSA", attrs); ++ ++ // for DSA signatures with 224/256-bit digests ++ attrs.put("KeySize", "2048"); ++ ++ addWithAlias(p, "Signature", "SHA224withDSA", ++ "sun.security.provider.DSA$SHA224withDSA", attrs); ++ addWithAlias(p, "Signature", "SHA256withDSA", ++ "sun.security.provider.DSA$SHA256withDSA", attrs); ++ ++ addWithAlias(p, "Signature", "SHA3-224withDSA", ++ "sun.security.provider.DSA$SHA3_224withDSA", attrs); ++ addWithAlias(p, "Signature", "SHA3-256withDSA", ++ "sun.security.provider.DSA$SHA3_256withDSA", attrs); ++ ++ attrs.put("KeySize", "3072"); // for DSA sig using 384/512-bit digests ++ ++ addWithAlias(p, "Signature", "SHA384withDSA", ++ "sun.security.provider.DSA$SHA384withDSA", attrs); ++ addWithAlias(p, "Signature", "SHA512withDSA", ++ "sun.security.provider.DSA$SHA512withDSA", attrs); ++ addWithAlias(p, "Signature", "SHA3-384withDSA", ++ "sun.security.provider.DSA$SHA3_384withDSA", attrs); ++ addWithAlias(p, "Signature", "SHA3-512withDSA", ++ "sun.security.provider.DSA$SHA3_512withDSA", attrs); ++ ++ attrs.remove("KeySize"); ++ ++ add(p, "Signature", "SHA1withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA1withDSAinP1363Format"); ++ add(p, "Signature", "NONEwithDSAinP1363Format", ++ "sun.security.provider.DSA$RawDSAinP1363Format"); ++ add(p, "Signature", "SHA224withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA224withDSAinP1363Format"); ++ add(p, "Signature", "SHA256withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA256withDSAinP1363Format"); ++ add(p, "Signature", "SHA384withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA384withDSAinP1363Format"); ++ add(p, "Signature", "SHA512withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA512withDSAinP1363Format"); ++ add(p, "Signature", "SHA3-224withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA3_224withDSAinP1363Format"); ++ add(p, "Signature", "SHA3-256withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA3_256withDSAinP1363Format"); ++ add(p, "Signature", "SHA3-384withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA3_384withDSAinP1363Format"); ++ add(p, "Signature", "SHA3-512withDSAinP1363Format", ++ "sun.security.provider.DSA$SHA3_512withDSAinP1363Format"); ++ /* ++ * Key Pair Generator engines ++ */ ++ attrs.clear(); ++ attrs.put("ImplementedIn", "Software"); ++ attrs.put("KeySize", "2048"); // for DSA KPG and APG only ++ ++ String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$"; ++ dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current"); ++ addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs); ++ ++ /* ++ * Algorithm Parameter Generator engines ++ */ ++ addWithAlias(p, "AlgorithmParameterGenerator", "DSA", ++ "sun.security.provider.DSAParameterGenerator", attrs); ++ attrs.remove("KeySize"); ++ ++ /* ++ * Algorithm Parameter engines ++ */ ++ addWithAlias(p, "AlgorithmParameters", "DSA", ++ "sun.security.provider.DSAParameters", attrs); ++ ++ /* ++ * Key factories ++ */ ++ addWithAlias(p, "KeyFactory", "DSA", ++ "sun.security.provider.DSAKeyFactory", attrs); ++ ++ /* ++ * Digest engines ++ */ ++ add(p, "MessageDigest", "MD2", "sun.security.provider.MD2", attrs); ++ add(p, "MessageDigest", "MD5", "sun.security.provider.MD5", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-1", "sun.security.provider.SHA", ++ attrs); ++ ++ addWithAlias(p, "MessageDigest", "SHA-224", ++ "sun.security.provider.SHA2$SHA224", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-256", ++ "sun.security.provider.SHA2$SHA256", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-384", ++ "sun.security.provider.SHA5$SHA384", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-512", ++ "sun.security.provider.SHA5$SHA512", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-512/224", ++ "sun.security.provider.SHA5$SHA512_224", attrs); ++ addWithAlias(p, "MessageDigest", "SHA-512/256", ++ "sun.security.provider.SHA5$SHA512_256", attrs); ++ addWithAlias(p, "MessageDigest", "SHA3-224", ++ "sun.security.provider.SHA3$SHA224", attrs); ++ addWithAlias(p, "MessageDigest", "SHA3-256", ++ "sun.security.provider.SHA3$SHA256", attrs); ++ addWithAlias(p, "MessageDigest", "SHA3-384", ++ "sun.security.provider.SHA3$SHA384", attrs); ++ addWithAlias(p, "MessageDigest", "SHA3-512", ++ "sun.security.provider.SHA3$SHA512", attrs); + } +- attrs.put("ImplementedIn", "Software"); +- add(p, "SecureRandom", "DRBG", "sun.security.provider.DRBG", attrs); +- add(p, "SecureRandom", "SHA1PRNG", +- "sun.security.provider.SecureRandom", attrs); +- +- /* +- * Signature engines +- */ +- attrs.clear(); +- String dsaKeyClasses = "java.security.interfaces.DSAPublicKey" + +- "|java.security.interfaces.DSAPrivateKey"; +- attrs.put("SupportedKeyClasses", dsaKeyClasses); +- attrs.put("ImplementedIn", "Software"); +- +- attrs.put("KeySize", "1024"); // for NONE and SHA1 DSA signatures +- +- addWithAlias(p, "Signature", "SHA1withDSA", +- "sun.security.provider.DSA$SHA1withDSA", attrs); +- addWithAlias(p, "Signature", "NONEwithDSA", +- "sun.security.provider.DSA$RawDSA", attrs); +- +- // for DSA signatures with 224/256-bit digests +- attrs.put("KeySize", "2048"); +- +- addWithAlias(p, "Signature", "SHA224withDSA", +- "sun.security.provider.DSA$SHA224withDSA", attrs); +- addWithAlias(p, "Signature", "SHA256withDSA", +- "sun.security.provider.DSA$SHA256withDSA", attrs); +- +- addWithAlias(p, "Signature", "SHA3-224withDSA", +- "sun.security.provider.DSA$SHA3_224withDSA", attrs); +- addWithAlias(p, "Signature", "SHA3-256withDSA", +- "sun.security.provider.DSA$SHA3_256withDSA", attrs); +- +- attrs.put("KeySize", "3072"); // for DSA sig using 384/512-bit digests +- +- addWithAlias(p, "Signature", "SHA384withDSA", +- "sun.security.provider.DSA$SHA384withDSA", attrs); +- addWithAlias(p, "Signature", "SHA512withDSA", +- "sun.security.provider.DSA$SHA512withDSA", attrs); +- addWithAlias(p, "Signature", "SHA3-384withDSA", +- "sun.security.provider.DSA$SHA3_384withDSA", attrs); +- addWithAlias(p, "Signature", "SHA3-512withDSA", +- "sun.security.provider.DSA$SHA3_512withDSA", attrs); +- +- attrs.remove("KeySize"); +- +- add(p, "Signature", "SHA1withDSAinP1363Format", +- "sun.security.provider.DSA$SHA1withDSAinP1363Format"); +- add(p, "Signature", "NONEwithDSAinP1363Format", +- "sun.security.provider.DSA$RawDSAinP1363Format"); +- add(p, "Signature", "SHA224withDSAinP1363Format", +- "sun.security.provider.DSA$SHA224withDSAinP1363Format"); +- add(p, "Signature", "SHA256withDSAinP1363Format", +- "sun.security.provider.DSA$SHA256withDSAinP1363Format"); +- add(p, "Signature", "SHA384withDSAinP1363Format", +- "sun.security.provider.DSA$SHA384withDSAinP1363Format"); +- add(p, "Signature", "SHA512withDSAinP1363Format", +- "sun.security.provider.DSA$SHA512withDSAinP1363Format"); +- add(p, "Signature", "SHA3-224withDSAinP1363Format", +- "sun.security.provider.DSA$SHA3_224withDSAinP1363Format"); +- add(p, "Signature", "SHA3-256withDSAinP1363Format", +- "sun.security.provider.DSA$SHA3_256withDSAinP1363Format"); +- add(p, "Signature", "SHA3-384withDSAinP1363Format", +- "sun.security.provider.DSA$SHA3_384withDSAinP1363Format"); +- add(p, "Signature", "SHA3-512withDSAinP1363Format", +- "sun.security.provider.DSA$SHA3_512withDSAinP1363Format"); +- /* +- * Key Pair Generator engines +- */ +- attrs.clear(); +- attrs.put("ImplementedIn", "Software"); +- attrs.put("KeySize", "2048"); // for DSA KPG and APG only +- +- String dsaKPGImplClass = "sun.security.provider.DSAKeyPairGenerator$"; +- dsaKPGImplClass += (useLegacyDSA? "Legacy" : "Current"); +- addWithAlias(p, "KeyPairGenerator", "DSA", dsaKPGImplClass, attrs); +- +- /* +- * Algorithm Parameter Generator engines +- */ +- addWithAlias(p, "AlgorithmParameterGenerator", "DSA", +- "sun.security.provider.DSAParameterGenerator", attrs); +- attrs.remove("KeySize"); +- +- /* +- * Algorithm Parameter engines +- */ +- addWithAlias(p, "AlgorithmParameters", "DSA", +- "sun.security.provider.DSAParameters", attrs); +- +- /* +- * Key factories +- */ +- addWithAlias(p, "KeyFactory", "DSA", +- "sun.security.provider.DSAKeyFactory", attrs); +- +- /* +- * Digest engines +- */ +- add(p, "MessageDigest", "MD2", "sun.security.provider.MD2", attrs); +- add(p, "MessageDigest", "MD5", "sun.security.provider.MD5", attrs); +- addWithAlias(p, "MessageDigest", "SHA-1", "sun.security.provider.SHA", +- attrs); +- +- addWithAlias(p, "MessageDigest", "SHA-224", +- "sun.security.provider.SHA2$SHA224", attrs); +- addWithAlias(p, "MessageDigest", "SHA-256", +- "sun.security.provider.SHA2$SHA256", attrs); +- addWithAlias(p, "MessageDigest", "SHA-384", +- "sun.security.provider.SHA5$SHA384", attrs); +- addWithAlias(p, "MessageDigest", "SHA-512", +- "sun.security.provider.SHA5$SHA512", attrs); +- addWithAlias(p, "MessageDigest", "SHA-512/224", +- "sun.security.provider.SHA5$SHA512_224", attrs); +- addWithAlias(p, "MessageDigest", "SHA-512/256", +- "sun.security.provider.SHA5$SHA512_256", attrs); +- addWithAlias(p, "MessageDigest", "SHA3-224", +- "sun.security.provider.SHA3$SHA224", attrs); +- addWithAlias(p, "MessageDigest", "SHA3-256", +- "sun.security.provider.SHA3$SHA256", attrs); +- addWithAlias(p, "MessageDigest", "SHA3-384", +- "sun.security.provider.SHA3$SHA384", attrs); +- addWithAlias(p, "MessageDigest", "SHA3-512", +- "sun.security.provider.SHA3$SHA512", attrs); + + /* + * Certificates +diff --git openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java +index 8c9e4f9dbe6..9eeb3013e0d 100644 +--- openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java ++++ openjdk/src/jdk.crypto.ec/share/classes/sun/security/ec/SunEC.java +@@ -38,6 +38,7 @@ import java.util.HashMap; + import java.util.Iterator; + import java.util.List; + ++import jdk.internal.access.SharedSecrets; + import sun.security.ec.ed.EdDSAAlgorithmParameters; + import sun.security.ec.ed.EdDSAKeyFactory; + import sun.security.ec.ed.EdDSAKeyPairGenerator; +@@ -56,6 +57,10 @@ public final class SunEC extends Provider { + + private static final long serialVersionUID = -2279741672933606418L; + ++ private static final boolean systemFipsEnabled = ++ SharedSecrets.getJavaSecuritySystemConfiguratorAccess() ++ .isSystemFipsEnabled(); ++ + private static class ProviderServiceA extends ProviderService { + ProviderServiceA(Provider p, String type, String algo, String cn, + HashMap<String, String> attrs) { +@@ -249,85 +254,86 @@ public final class SunEC extends Provider { + + putXDHEntries(); + putEdDSAEntries(); +- +- /* +- * Signature engines +- */ +- putService(new ProviderService(this, "Signature", +- "NONEwithECDSA", "sun.security.ec.ECDSASignature$Raw", +- null, ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA1withECDSA", "sun.security.ec.ECDSASignature$SHA1", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA224withECDSA", "sun.security.ec.ECDSASignature$SHA224", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA256withECDSA", "sun.security.ec.ECDSASignature$SHA256", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA384withECDSA", "sun.security.ec.ECDSASignature$SHA384", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA512withECDSA", "sun.security.ec.ECDSASignature$SHA512", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA3-224withECDSA", "sun.security.ec.ECDSASignature$SHA3_224", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA3-256withECDSA", "sun.security.ec.ECDSASignature$SHA3_256", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA3-384withECDSA", "sun.security.ec.ECDSASignature$SHA3_384", +- ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "SHA3-512withECDSA", "sun.security.ec.ECDSASignature$SHA3_512", +- ATTRS)); +- +- putService(new ProviderService(this, "Signature", +- "NONEwithECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$RawinP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA1withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA1inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA224withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA224inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA256withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA256inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA384withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA384inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA512withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA512inP1363Format")); +- +- putService(new ProviderService(this, "Signature", +- "SHA3-224withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA3_224inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA3-256withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA3_256inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA3-384withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA3_384inP1363Format")); +- putService(new ProviderService(this, "Signature", +- "SHA3-512withECDSAinP1363Format", +- "sun.security.ec.ECDSASignature$SHA3_512inP1363Format")); +- +- /* +- * Key Pair Generator engine +- */ +- putService(new ProviderService(this, "KeyPairGenerator", +- "EC", "sun.security.ec.ECKeyPairGenerator", +- List.of("EllipticCurve"), ATTRS)); +- +- /* +- * Key Agreement engine +- */ +- putService(new ProviderService(this, "KeyAgreement", +- "ECDH", "sun.security.ec.ECDHKeyAgreement", null, ATTRS)); ++ if (!systemFipsEnabled) { ++ /* ++ * Signature engines ++ */ ++ putService(new ProviderService(this, "Signature", ++ "NONEwithECDSA", "sun.security.ec.ECDSASignature$Raw", ++ null, ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA1withECDSA", "sun.security.ec.ECDSASignature$SHA1", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA224withECDSA", "sun.security.ec.ECDSASignature$SHA224", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA256withECDSA", "sun.security.ec.ECDSASignature$SHA256", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA384withECDSA", "sun.security.ec.ECDSASignature$SHA384", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA512withECDSA", "sun.security.ec.ECDSASignature$SHA512", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA3-224withECDSA", "sun.security.ec.ECDSASignature$SHA3_224", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA3-256withECDSA", "sun.security.ec.ECDSASignature$SHA3_256", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA3-384withECDSA", "sun.security.ec.ECDSASignature$SHA3_384", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "SHA3-512withECDSA", "sun.security.ec.ECDSASignature$SHA3_512", ++ ATTRS)); ++ ++ putService(new ProviderService(this, "Signature", ++ "NONEwithECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$RawinP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA1withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA1inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA224withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA224inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA256withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA256inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA384withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA384inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA512withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA512inP1363Format")); ++ ++ putService(new ProviderService(this, "Signature", ++ "SHA3-224withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA3_224inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA3-256withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA3_256inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA3-384withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA3_384inP1363Format")); ++ putService(new ProviderService(this, "Signature", ++ "SHA3-512withECDSAinP1363Format", ++ "sun.security.ec.ECDSASignature$SHA3_512inP1363Format")); ++ ++ /* ++ * Key Pair Generator engine ++ */ ++ putService(new ProviderService(this, "KeyPairGenerator", ++ "EC", "sun.security.ec.ECKeyPairGenerator", ++ List.of("EllipticCurve"), ATTRS)); ++ ++ /* ++ * Key Agreement engine ++ */ ++ putService(new ProviderService(this, "KeyAgreement", ++ "ECDH", "sun.security.ec.ECDHKeyAgreement", null, ATTRS)); ++ } + } + + private void putXDHEntries() { +@@ -344,23 +350,25 @@ public final class SunEC extends Provider { + "X448", "sun.security.ec.XDHKeyFactory.X448", + ATTRS)); + +- putService(new ProviderService(this, "KeyPairGenerator", +- "XDH", "sun.security.ec.XDHKeyPairGenerator", null, ATTRS)); +- putService(new ProviderServiceA(this, "KeyPairGenerator", +- "X25519", "sun.security.ec.XDHKeyPairGenerator.X25519", +- ATTRS)); +- putService(new ProviderServiceA(this, "KeyPairGenerator", +- "X448", "sun.security.ec.XDHKeyPairGenerator.X448", +- ATTRS)); +- +- putService(new ProviderService(this, "KeyAgreement", +- "XDH", "sun.security.ec.XDHKeyAgreement", null, ATTRS)); +- putService(new ProviderServiceA(this, "KeyAgreement", +- "X25519", "sun.security.ec.XDHKeyAgreement.X25519", +- ATTRS)); +- putService(new ProviderServiceA(this, "KeyAgreement", +- "X448", "sun.security.ec.XDHKeyAgreement.X448", +- ATTRS)); ++ if (!systemFipsEnabled) { ++ putService(new ProviderService(this, "KeyPairGenerator", ++ "XDH", "sun.security.ec.XDHKeyPairGenerator", null, ATTRS)); ++ putService(new ProviderServiceA(this, "KeyPairGenerator", ++ "X25519", "sun.security.ec.XDHKeyPairGenerator.X25519", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "KeyPairGenerator", ++ "X448", "sun.security.ec.XDHKeyPairGenerator.X448", ++ ATTRS)); ++ ++ putService(new ProviderService(this, "KeyAgreement", ++ "XDH", "sun.security.ec.XDHKeyAgreement", null, ATTRS)); ++ putService(new ProviderServiceA(this, "KeyAgreement", ++ "X25519", "sun.security.ec.XDHKeyAgreement.X25519", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "KeyAgreement", ++ "X448", "sun.security.ec.XDHKeyAgreement.X448", ++ ATTRS)); ++ } + } + + private void putEdDSAEntries() { +@@ -375,21 +383,23 @@ public final class SunEC extends Provider { + putService(new ProviderServiceA(this, "KeyFactory", + "Ed448", "sun.security.ec.ed.EdDSAKeyFactory.Ed448", ATTRS)); + +- putService(new ProviderService(this, "KeyPairGenerator", +- "EdDSA", "sun.security.ec.ed.EdDSAKeyPairGenerator", null, ATTRS)); +- putService(new ProviderServiceA(this, "KeyPairGenerator", +- "Ed25519", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed25519", +- ATTRS)); +- putService(new ProviderServiceA(this, "KeyPairGenerator", +- "Ed448", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed448", +- ATTRS)); +- +- putService(new ProviderService(this, "Signature", +- "EdDSA", "sun.security.ec.ed.EdDSASignature", null, ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "Ed25519", "sun.security.ec.ed.EdDSASignature.Ed25519", ATTRS)); +- putService(new ProviderServiceA(this, "Signature", +- "Ed448", "sun.security.ec.ed.EdDSASignature.Ed448", ATTRS)); ++ if (!systemFipsEnabled) { ++ putService(new ProviderService(this, "KeyPairGenerator", ++ "EdDSA", "sun.security.ec.ed.EdDSAKeyPairGenerator", null, ATTRS)); ++ putService(new ProviderServiceA(this, "KeyPairGenerator", ++ "Ed25519", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed25519", ++ ATTRS)); ++ putService(new ProviderServiceA(this, "KeyPairGenerator", ++ "Ed448", "sun.security.ec.ed.EdDSAKeyPairGenerator.Ed448", ++ ATTRS)); ++ ++ putService(new ProviderService(this, "Signature", ++ "EdDSA", "sun.security.ec.ed.EdDSASignature", null, ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "Ed25519", "sun.security.ec.ed.EdDSASignature.Ed25519", ATTRS)); ++ putService(new ProviderServiceA(this, "Signature", ++ "Ed448", "sun.security.ec.ed.EdDSASignature.Ed448", ATTRS)); ++ } + + } + } diff --git a/rh1996182-extend_security_policy.patch b/rh1996182-extend_security_policy.patch new file mode 100644 index 0000000..7622622 --- /dev/null +++ b/rh1996182-extend_security_policy.patch @@ -0,0 +1,18 @@ +commit bfd7c5dae9c15266799cb885b8c60199217b65b9 +Author: Andrew Hughes <gnu.andrew(a)redhat.com> +Date: Mon Aug 30 16:14:14 2021 +0100 + + RH1996182: Extend default security policy to allow SunPKCS11 access to jdk.internal.access + +diff --git openjdk.orig/src/java.base/share/lib/security/default.policy openjdk/src/java.base/share/lib/security/default.policy +index 8356e56367b..23925f048be 100644 +--- openjdk.orig/src/java.base/share/lib/security/default.policy ++++ openjdk/src/java.base/share/lib/security/default.policy +@@ -128,6 +128,7 @@ grant codeBase "jrt:/jdk.crypto.ec" { + grant codeBase "jrt:/jdk.crypto.cryptoki" { + permission java.lang.RuntimePermission + "accessClassInPackage.com.sun.crypto.provider"; ++ permission java.lang.RuntimePermission "accessClassInPackage.jdk.internal.access"; + permission java.lang.RuntimePermission "accessClassInPackage.jdk.internal.misc"; + permission java.lang.RuntimePermission + "accessClassInPackage.sun.security.*"; diff --git a/rh1996182-login_to_nss_software_token.patch b/rh1996182-login_to_nss_software_token.patch new file mode 100644 index 0000000..475c521 --- /dev/null +++ b/rh1996182-login_to_nss_software_token.patch @@ -0,0 +1,65 @@ +commit 93c9f6330bf2b4405c789bf893a5256c3f4a4923 +Author: Martin Balao <mbalao(a)redhat.com> +Date: Sat Aug 28 00:35:44 2021 +0100 + + RH1996182: Login to the NSS Software Token in FIPS Mode + +diff --git openjdk.orig/src/java.base/share/classes/module-info.java openjdk/src/java.base/share/classes/module-info.java +index 39e69362458..aeb5fc2eb46 100644 +--- openjdk.orig/src/java.base/share/classes/module-info.java ++++ openjdk/src/java.base/share/classes/module-info.java +@@ -151,6 +151,7 @@ module java.base { + java.management, + java.naming, + java.rmi, ++ jdk.crypto.cryptoki, + jdk.crypto.ec, + jdk.jartool, + jdk.jlink, +diff --git openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java +index 112b639aa96..5d3963ea893 100644 +--- openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java ++++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/SunPKCS11.java +@@ -42,6 +42,7 @@ import javax.security.auth.callback.PasswordCallback; + + import com.sun.crypto.provider.ChaCha20Poly1305Parameters; + ++import jdk.internal.access.SharedSecrets; + import jdk.internal.misc.InnocuousThread; + import sun.security.util.Debug; + import sun.security.util.ResourcesMgr; +@@ -62,6 +63,9 @@ import static sun.security.pkcs11.wrapper.PKCS11Exception.*; + */ + public final class SunPKCS11 extends AuthProvider { + ++ private static final boolean systemFipsEnabled = SharedSecrets ++ .getJavaSecuritySystemConfiguratorAccess().isSystemFipsEnabled(); ++ + private static final long serialVersionUID = -1354835039035306505L; + + static final Debug debug = Debug.getInstance("sunpkcs11"); +@@ -379,6 +383,24 @@ public final class SunPKCS11 extends AuthProvider { + if (nssModule != null) { + nssModule.setProvider(this); + } ++ if (systemFipsEnabled) { ++ // The NSS Software Token in FIPS 140-2 mode requires a user ++ // login for most operations. See sftk_fipsCheck. The NSS DB ++ // (/etc/pki/nssdb) PIN is empty. ++ Session session = null; ++ try { ++ session = token.getOpSession(); ++ p11.C_Login(session.id(), CKU_USER, new char[] {}); ++ } catch (PKCS11Exception p11e) { ++ if (debug != null) { ++ debug.println("Error during token login: " + ++ p11e.getMessage()); ++ } ++ throw p11e; ++ } finally { ++ token.releaseSession(session); ++ } ++ } + } catch (Exception e) { + if (config.getHandleStartupErrors() == Config.ERR_IGNORE_ALL) { + throw new UnsupportedOperationException diff --git a/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch b/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch new file mode 100644 index 0000000..1b706a1 --- /dev/null +++ b/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch @@ -0,0 +1,19 @@ +Remove uses of FAR in jpeg code + +Upstream libjpeg-trubo removed the (empty) FAR macro: +http://sourceforge.net/p/libjpeg-turbo/code/1312/ + +Adjust our code to not use the undefined FAR macro anymore. + +diff --git a/jdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c b/jdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c +--- openjdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c ++++ openjdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c +@@ -1385,7 +1385,7 @@ + /* and fill it in */ + dst_ptr = icc_data; + for (seq_no = first; seq_no < last; seq_no++) { +- JOCTET FAR *src_ptr = icc_markers[seq_no]->data + ICC_OVERHEAD_LEN; ++ JOCTET *src_ptr = icc_markers[seq_no]->data + ICC_OVERHEAD_LEN; + unsigned int length = + icc_markers[seq_no]->data_length - ICC_OVERHEAD_LEN; + diff --git a/sources b/sources new file mode 100644 index 0000000..dadd1ed --- /dev/null +++ b/sources @@ -0,0 +1,2 @@ +SHA512 (openjdk-jdk17u-jdk-17.0.1+12.tar.xz) = d9503de1001e42657ddb2600e1141d4169e333f0592ce3ad3c4ce14f817ca73a6bf6fb867e15930150c7b55e8fd4c4cd73d43984979e721df481a9ac7919580c +SHA512 (tapsets-icedtea-6.0.0pre00-c848b93a8598.tar.xz) = 97d026212363b3c83f6a04100ad7f6fdde833d16579717f8756e2b8c2eb70e144a41a330cb9ccde9c3badd37a2d54fdf4650a950ec21d8b686d545ecb2a64d30

2 years, 5 months

1
0
0 / 0

Architecture specific change in rpms/rust-html-escape.git

by githook-noreply＠fedoraproject.org

The package rpms/rust-html-escape.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/rust-html-escape.git/commit/?id=1.... Change: +ExclusiveArch: %{rust_arches} Thanks. Full change: ============ commit 17c131cffb719ab8ed1ce80a3150217b193dd429 Author: Aleksei Bavshin <alebastr(a)fedoraproject.org> Date: Mon Dec 6 00:19:15 2021 -0800 Initial import (#2028890) diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..0140e79 --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +/results_*/ +/*.src.rpm +/html-escape-0.2.9.crate diff --git a/rust-html-escape.spec b/rust-html-escape.spec new file mode 100644 index 0000000..2866e28 --- /dev/null +++ b/rust-html-escape.spec @@ -0,0 +1,84 @@ +# Generated by rust2rpm 20 +%bcond_without check +%global debug_package %{nil} + +%global crate html-escape + +Name: rust-%{crate} +Version: 0.2.9 +Release: %autorelease +Summary: Library for escaping special characters and unescaping HTML entities in HTML + +# Upstream license specification: MIT +License: MIT +URL: https://crates.io/crates/html-escape +Source: %{crates_source} + +ExclusiveArch: %{rust_arches} + +BuildRequires: rust-packaging + +%global _description %{expand: +This library is for encoding/escaping special characters in HTML and +decoding/unescaping HTML entities as well.} + +%description %{_description} + +%package devel +Summary: %{summary} +BuildArch: noarch + +%description devel %{_description} + +This package contains library source intended for building other packages which +use the "%{crate}" crate. + +%files devel +%license LICENSE +%doc README.md +%{cargo_registry}/%{crate}-%{version_no_tilde}/ + +%package -n %{name}+default-devel +Summary: %{summary} +BuildArch: noarch + +%description -n %{name}+default-devel %{_description} + +This package contains library source intended for building other packages which +use the "default" feature of the "%{crate}" crate. + +%files -n %{name}+default-devel +%ghost %{cargo_registry}/%{crate}-%{version_no_tilde}/Cargo.toml + +%package -n %{name}+std-devel +Summary: %{summary} +BuildArch: noarch + +%description -n %{name}+std-devel %{_description} + +This package contains library source intended for building other packages which +use the "std" feature of the "%{crate}" crate. + +%files -n %{name}+std-devel +%ghost %{cargo_registry}/%{crate}-%{version_no_tilde}/Cargo.toml + +%prep +%autosetup -n %{crate}-%{version_no_tilde} -p1 +%cargo_prep + +%generate_buildrequires +%cargo_generate_buildrequires + +%build +%cargo_build + +%install +%cargo_install + +%if %{with check} +%check +%cargo_test +%endif + +%changelog +%autochangelog diff --git a/sources b/sources new file mode 100644 index 0000000..6b75d71 --- /dev/null +++ b/sources @@ -0,0 +1 @@ +SHA512 (html-escape-0.2.9.crate) = 9e3a306255bddea265c365ae0c50ebf3635e31a2b74b366be40a34a158c2a3af58859bff2d234fe1322050c3ff78236a62d76a588f5b08480e25a6eb5abf0a3b

2 years, 5 months

1
0
0 / 0

Architecture specific change in rpms/rust-smallbitvec.git

by githook-noreply＠fedoraproject.org

The package rpms/rust-smallbitvec.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/rust-smallbitvec.git/commit/?id=0.... Change: +ExclusiveArch: %{rust_arches} Thanks. Full change: ============ commit 05051276e852b01d1dbcece597d7ddf407dedc27 Author: Aleksei Bavshin <alebastr(a)fedoraproject.org> Date: Mon Dec 6 00:19:03 2021 -0800 Initial import (#2028889) diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..98f53b1 --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +/results_*/ +/*.src.rpm +/smallbitvec-2.5.1.crate diff --git a/rust-smallbitvec.spec b/rust-smallbitvec.spec new file mode 100644 index 0000000..fe9e29a --- /dev/null +++ b/rust-smallbitvec.spec @@ -0,0 +1,74 @@ +# Generated by rust2rpm 20 +%bcond_without check +%global debug_package %{nil} + +%global crate smallbitvec + +Name: rust-%{crate} +Version: 2.5.1 +Release: %autorelease +Summary: Bit vector optimized for size and inline storage + +# Upstream license specification: MIT / Apache-2.0 +License: MIT or ASL 2.0 +URL: https://crates.io/crates/smallbitvec +Source: %{crates_source} +# Initial patched metadata +# - Drop unused (benchmark only) dependencies +Patch0: smallbitvec-fix-metadata.diff + +ExclusiveArch: %{rust_arches} + +BuildRequires: rust-packaging + +%global _description %{expand: +Bit vector optimized for size and inline storage.} + +%description %{_description} + +%package devel +Summary: %{summary} +BuildArch: noarch + +%description devel %{_description} + +This package contains library source intended for building other packages which +use the "%{crate}" crate. + +%files devel +%license LICENSE-APACHE LICENSE-MIT +%doc README.md +%{cargo_registry}/%{crate}-%{version_no_tilde}/ + +%package -n %{name}+default-devel +Summary: %{summary} +BuildArch: noarch + +%description -n %{name}+default-devel %{_description} + +This package contains library source intended for building other packages which +use the "default" feature of the "%{crate}" crate. + +%files -n %{name}+default-devel +%ghost %{cargo_registry}/%{crate}-%{version_no_tilde}/Cargo.toml + +%prep +%autosetup -n %{crate}-%{version_no_tilde} -p1 +%cargo_prep + +%generate_buildrequires +%cargo_generate_buildrequires + +%build +%cargo_build + +%install +%cargo_install + +%if %{with check} +%check +%cargo_test +%endif + +%changelog +%autochangelog diff --git a/smallbitvec-fix-metadata.diff b/smallbitvec-fix-metadata.diff new file mode 100644 index 0000000..03ea6fc --- /dev/null +++ b/smallbitvec-fix-metadata.diff @@ -0,0 +1,11 @@ +--- smallbitvec-2.5.1/Cargo.toml 1970-01-01T00:00:00+00:00 ++++ smallbitvec-2.5.1/Cargo.toml 2021-12-02T18:41:08.150980+00:00 +@@ -21,8 +21,3 @@ + categories = ["data-structures"] + license = "MIT / Apache-2.0" + repository = "https://github.com/servo/smallbitvec" +-[dev-dependencies.bit-vec] +-version = "0.4.4" +- +-[dev-dependencies.rand] +-version = "0.4.2" diff --git a/sources b/sources new file mode 100644 index 0000000..02c088d --- /dev/null +++ b/sources @@ -0,0 +1 @@ +SHA512 (smallbitvec-2.5.1.crate) = 348e30ef6982b6d50a398db9f19ccb9a14e5ce239dd33771366575c332396df91a2f6384e9afa13538daad5c726170518b19b367c97d9bd9f46b120b88e4ae47

2 years, 5 months

1
0
0 / 0

Architecture specific change in rpms/rust-html-escape.git

by githook-noreply＠fedoraproject.org

The package rpms/rust-html-escape.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/rust-html-escape.git/commit/?id=1.... Change: +ExclusiveArch: %{rust_arches} Thanks. Full change: ============ commit 17c131cffb719ab8ed1ce80a3150217b193dd429 Author: Aleksei Bavshin <alebastr(a)fedoraproject.org> Date: Mon Dec 6 00:19:15 2021 -0800 Initial import (#2028890) diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..0140e79 --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +/results_*/ +/*.src.rpm +/html-escape-0.2.9.crate diff --git a/rust-html-escape.spec b/rust-html-escape.spec new file mode 100644 index 0000000..2866e28 --- /dev/null +++ b/rust-html-escape.spec @@ -0,0 +1,84 @@ +# Generated by rust2rpm 20 +%bcond_without check +%global debug_package %{nil} + +%global crate html-escape + +Name: rust-%{crate} +Version: 0.2.9 +Release: %autorelease +Summary: Library for escaping special characters and unescaping HTML entities in HTML + +# Upstream license specification: MIT +License: MIT +URL: https://crates.io/crates/html-escape +Source: %{crates_source} + +ExclusiveArch: %{rust_arches} + +BuildRequires: rust-packaging + +%global _description %{expand: +This library is for encoding/escaping special characters in HTML and +decoding/unescaping HTML entities as well.} + +%description %{_description} + +%package devel +Summary: %{summary} +BuildArch: noarch + +%description devel %{_description} + +This package contains library source intended for building other packages which +use the "%{crate}" crate. + +%files devel +%license LICENSE +%doc README.md +%{cargo_registry}/%{crate}-%{version_no_tilde}/ + +%package -n %{name}+default-devel +Summary: %{summary} +BuildArch: noarch + +%description -n %{name}+default-devel %{_description} + +This package contains library source intended for building other packages which +use the "default" feature of the "%{crate}" crate. + +%files -n %{name}+default-devel +%ghost %{cargo_registry}/%{crate}-%{version_no_tilde}/Cargo.toml + +%package -n %{name}+std-devel +Summary: %{summary} +BuildArch: noarch + +%description -n %{name}+std-devel %{_description} + +This package contains library source intended for building other packages which +use the "std" feature of the "%{crate}" crate. + +%files -n %{name}+std-devel +%ghost %{cargo_registry}/%{crate}-%{version_no_tilde}/Cargo.toml + +%prep +%autosetup -n %{crate}-%{version_no_tilde} -p1 +%cargo_prep + +%generate_buildrequires +%cargo_generate_buildrequires + +%build +%cargo_build + +%install +%cargo_install + +%if %{with check} +%check +%cargo_test +%endif + +%changelog +%autochangelog diff --git a/sources b/sources new file mode 100644 index 0000000..6b75d71 --- /dev/null +++ b/sources @@ -0,0 +1 @@ +SHA512 (html-escape-0.2.9.crate) = 9e3a306255bddea265c365ae0c50ebf3635e31a2b74b366be40a34a158c2a3af58859bff2d234fe1322050c3ff78236a62d76a588f5b08480e25a6eb5abf0a3b

2 years, 5 months

1
0
0 / 0

Architecture specific change in rpms/rust-smallbitvec.git

by githook-noreply＠fedoraproject.org

The package rpms/rust-smallbitvec.git has added or updated architecture specific content in its spec file (ExclusiveArch/ExcludeArch or %ifarch/%ifnarch) in commit(s): https://src.fedoraproject.org/cgit/rpms/rust-smallbitvec.git/commit/?id=0.... Change: +ExclusiveArch: %{rust_arches} Thanks. Full change: ============ commit 05051276e852b01d1dbcece597d7ddf407dedc27 Author: Aleksei Bavshin <alebastr(a)fedoraproject.org> Date: Mon Dec 6 00:19:03 2021 -0800 Initial import (#2028889) diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..98f53b1 --- /dev/null +++ b/.gitignore @@ -0,0 +1,3 @@ +/results_*/ +/*.src.rpm +/smallbitvec-2.5.1.crate diff --git a/rust-smallbitvec.spec b/rust-smallbitvec.spec new file mode 100644 index 0000000..fe9e29a --- /dev/null +++ b/rust-smallbitvec.spec @@ -0,0 +1,74 @@ +# Generated by rust2rpm 20 +%bcond_without check +%global debug_package %{nil} + +%global crate smallbitvec + +Name: rust-%{crate} +Version: 2.5.1 +Release: %autorelease +Summary: Bit vector optimized for size and inline storage + +# Upstream license specification: MIT / Apache-2.0 +License: MIT or ASL 2.0 +URL: https://crates.io/crates/smallbitvec +Source: %{crates_source} +# Initial patched metadata +# - Drop unused (benchmark only) dependencies +Patch0: smallbitvec-fix-metadata.diff + +ExclusiveArch: %{rust_arches} + +BuildRequires: rust-packaging + +%global _description %{expand: +Bit vector optimized for size and inline storage.} + +%description %{_description} + +%package devel +Summary: %{summary} +BuildArch: noarch + +%description devel %{_description} + +This package contains library source intended for building other packages which +use the "%{crate}" crate. + +%files devel +%license LICENSE-APACHE LICENSE-MIT +%doc README.md +%{cargo_registry}/%{crate}-%{version_no_tilde}/ + +%package -n %{name}+default-devel +Summary: %{summary} +BuildArch: noarch + +%description -n %{name}+default-devel %{_description} + +This package contains library source intended for building other packages which +use the "default" feature of the "%{crate}" crate. + +%files -n %{name}+default-devel +%ghost %{cargo_registry}/%{crate}-%{version_no_tilde}/Cargo.toml + +%prep +%autosetup -n %{crate}-%{version_no_tilde} -p1 +%cargo_prep + +%generate_buildrequires +%cargo_generate_buildrequires + +%build +%cargo_build + +%install +%cargo_install + +%if %{with check} +%check +%cargo_test +%endif + +%changelog +%autochangelog diff --git a/smallbitvec-fix-metadata.diff b/smallbitvec-fix-metadata.diff new file mode 100644 index 0000000..03ea6fc --- /dev/null +++ b/smallbitvec-fix-metadata.diff @@ -0,0 +1,11 @@ +--- smallbitvec-2.5.1/Cargo.toml 1970-01-01T00:00:00+00:00 ++++ smallbitvec-2.5.1/Cargo.toml 2021-12-02T18:41:08.150980+00:00 +@@ -21,8 +21,3 @@ + categories = ["data-structures"] + license = "MIT / Apache-2.0" + repository = "https://github.com/servo/smallbitvec" +-[dev-dependencies.bit-vec] +-version = "0.4.4" +- +-[dev-dependencies.rand] +-version = "0.4.2" diff --git a/sources b/sources new file mode 100644 index 0000000..02c088d --- /dev/null +++ b/sources @@ -0,0 +1 @@ +SHA512 (smallbitvec-2.5.1.crate) = 348e30ef6982b6d50a398db9f19ccb9a14e5ce239dd33771366575c332396df91a2f6384e9afa13538daad5c726170518b19b367c97d9bd9f46b120b88e4ae47

2 years, 5 months

1
0
0 / 0

[Report] Packages Restricting Arches

by root

New package excluding arches (10) ============================ - fluent-bit ExclusiveArch: x86_64 aarch64 - llhttp ExclusiveArch: %{nodejs_arches} - rust-cargo-edit ExclusiveArch: %{rust_arches} - rust-combine ExclusiveArch: %{rust_arches} - rust-env_proxy ExclusiveArch: %{rust_arches} - rust-html-escape ExclusiveArch: %{rust_arches} - rust-rand_isaac0.2 ExclusiveArch: %{rust_arches} - rust-smallbitvec ExclusiveArch: %{rust_arches} - rust-subprocess ExclusiveArch: %{rust_arches} - rust-toml_edit ExclusiveArch: %{rust_arches} Package no longer excluding arches (2) ================================== - gdata-sharp - rust-nickel List of packages currently excluding arches (2283) =========================================== - 0ad ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ppc64le - 90-Second-Portraits ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc64le - GoldenCheetah ExclusiveArch: %{qt5_qtwebengine_arches} - GtkAda ExclusiveArch: %{GPRbuild_arches} - GtkAda3 ExclusiveArch: %{GPRbuild_arches} - OpenColorIO ExclusiveArch: x86_64 ppc64le - OpenImageIO ExclusiveArch: x86_64 ppc64le - OpenMolcas ExclusiveArch: x86_64 aarch64 ppc64le s390x - PragmARC ExclusiveArch: %{GPRbuild_arches} - R-V8 ExclusiveArch: %{nodejs_arches} - RdRand ExclusiveArch: %{ix86} x86_64 - RediSearch ExclusiveArch: x86_64 - SLOF ExclusiveArch: ppc64le - YafaRay ExclusiveArch: %{ix86} x86_64 - aboot ExclusiveArch: alpha - accel-config ExclusiveArch: %{ix86} x86_64 - acpid ExclusiveArch: ia64 x86_64 %{ix86} %{arm} aarch64 - ahven ExclusiveArch: %{GPRbuild_arches} - algobox ExclusiveArch: %{qt5_qtwebengine_arches} - alleyoop ExclusiveArch: %{ix86} x86_64 ppc ppc64 ppc64le s390x %{arm} aarch64 - american-fuzzy-lop ExclusiveArch: %{ix86} x86_64 s390x - anet ExclusiveArch: %{GPRbuild_arches} - anki ExclusiveArch: %{qt5_qtwebengine_arches} noarch - apmd ExclusiveArch: %{ix86} - appstream-generator ExclusiveArch: %{ldc_arches} - arm-trusted-firmware ExclusiveArch: aarch64 - aunit ExclusiveArch: %GPRbuild_arches - avgtime ExclusiveArch: %{ldc_arches} - aws ExclusiveArch: %GPRbuild_arches - bcal ExclusiveArch: x86_64 aarch64 ia64 ppc64 ppc64le s390x - bcc ExclusiveArch: x86_64 %{power64} aarch64 s390x armv7hl - bcm283x-firmware ExclusiveArch: %{arm} aarch64 - berusky2 ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 %{mips} - biosdevname ExclusiveArch: %{ix86} x86_64 - blender ExclusiveArch: x86_64 aarch64 ppc64le s390x - bless ExclusiveArch: %mono_arches - bpftrace ExclusiveArch: x86_64 %{power64} aarch64 s390x - calamares ExclusiveArch: %{ix86} x86_64 aarch64 - calibre ExclusiveArch: %{qt5_qtwebengine_arches} - ccdciel ExclusiveArch: %{fpc_arches} - cdcollect ExclusiveArch: %{mono_arches} - ceph ExclusiveArch: x86_64 aarch64 ppc64le s390x - chromium ExclusiveArch: x86_64 i686 ExclusiveArch: x86_64 aarch64 ExclusiveArch: x86_64 i686 aarch64 - cjdns ExclusiveArch: %{nodejs_arches} - clevis-pin-tpm2 ExclusiveArch: %{rust_arches} - cmospwd ExclusiveArch: %{ix86} x86_64 - cmrt ExclusiveArch: %{ix86} x86_64 ia64 - coffee-script ExclusiveArch: %{nodejs_arches} noarch - colorful ExclusiveArch: %{fpc_arches} - cpu-x ExclusiveArch: i686 x86_64 - cpufetch ExclusiveArch: %{arm} aarch64 x86_64 ppc ppc64 ppc64le - cpuid ExclusiveArch: %{ix86} x86_64 - cqrlog ExclusiveArch: %{fpc_arches} - crash ExclusiveArch: %{ix86} ia64 x86_64 ppc ppc64 s390 s390x %{arm} aarch64 ppc64le - crash-gcore-command ExclusiveArch: aarch64 ppc64le x86_64 - crash-trace-command ExclusiveArch: aarch64 ppc64le s390x x86_64 - cri-tools ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm}} - criu ExclusiveArch: x86_64 %{arm} ppc64le aarch64 s390x - cryptlib ExclusiveArch: x86_64 %{ix86} aarch64 ppc64 ppc64le - cryptobone ExclusiveArch: x86_64 %{ix86} ppc64 ppc64le aarch64 - csslint ExclusiveArch: %{nodejs_arches} noarch - daq ExclusiveArch: x86_64 aarch64 - darktable ExclusiveArch: x86_64 aarch64 ExclusiveArch: x86_64 ppc64le - dbus-parsec ExclusiveArch: %{rust_arches} - dbus-sharp ExclusiveArch: %mono_arches - dbus-sharp-glib ExclusiveArch: %mono_arches - dbxtool ExclusiveArch: i386 x86_64 aarch64 - deepin-daemon ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm}} - deepin-desktop-schemas ExclusiveArch: %{go_arches} - dlm ExclusiveArch: i686 x86_64 - dmidecode ExclusiveArch: %{ix86} x86_64 ia64 aarch64 - dmtcp ExclusiveArch: x86_64 - docker-distribution ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - dolphin-emu ExclusiveArch: x86_64 aarch64 - dotnet-build-reference-packages ExclusiveArch: aarch64 x86_64 ExclusiveArch: x86_64 - dotnet3.1 ExclusiveArch: aarch64 x86_64 ExclusiveArch: x86_64 - dotnet5.0 ExclusiveArch: aarch64 x86_64 ExclusiveArch: x86_64 - dotnet5.0-build-reference-packages ExclusiveArch: aarch64 x86_64 ExclusiveArch: x86_64 - doublecmd ExclusiveArch: %{ix86} x86_64 - dpdk ExclusiveArch: x86_64 i686 aarch64 ppc64le - dxvk-native ExclusiveArch: %{ix86} x86_64 - dyninst ExclusiveArch: %{ix86} x86_64 ppc64le aarch64 - e3 ExclusiveArch: %{ix86} x86_64 - eclipse-swt ExclusiveArch: s390x x86_64 aarch64 ppc64le - edk2 ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ExclusiveArch: x86_64 aarch64 - efibootmgr ExclusiveArch: %{efi} - efifs ExclusiveArch: %{efi} - efitools ExclusiveArch: %{efi} - efivar ExclusiveArch: %{efi} - elk ExclusiveArch: x86_64 %{ix86} ExclusiveArch: x86_64 %{ix86} aarch64 %{arm} %{power64} - emacs-slime ExclusiveArch: %{arm} %{ix86} x86_64 ppc sparcv9 aarch64 - enki ExclusiveArch: %{qt5_qtwebengine_arches} noarch - envytools ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - eric ExclusiveArch: %{qt5_qtwebengine_arches} noarch - eth-tools ExclusiveArch: x86_64 - extlinux-bootloader ExclusiveArch: %{arm} aarch64 - fasttrack ExclusiveArch: %{qt5_qtwebengine_arches} - fcitx-libpinyin ExclusiveArch: %{qt5_qtwebengine_arches} - fedora-dockerfiles ExclusiveArch: %{go_arches} - fes ExclusiveArch: %{ix86} x86_64 - fkill-cli ExclusiveArch: %{nodejs_arches} noarch - florist ExclusiveArch: %{GPRbuild_arches} - fluent-bit ExclusiveArch: x86_64 aarch64 - fpc ExclusiveArch: %{arm} aarch64 %{ix86} x86_64 ppc64le - frescobaldi ExclusiveArch: %{qt5_qtwebengine_arches} - frysk ExclusiveArch: %{ix86} x86_64 ppc64 - fwts ExclusiveArch: x86_64 %{arm} aarch64 s390x riscv64 %{power64} - fwupd-efi ExclusiveArch: x86_64 aarch64 - fx ExclusiveArch: %{nodejs_arches} noarch - fx-completion ExclusiveArch: %{nodejs_arches} noarch - ga ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ppc64le - gbrainy ExclusiveArch: %mono_arches - gdb-exploitable ExclusiveArch: x86_64 i386 ExclusiveArch: x86_64 noarch - gearhead1 ExclusiveArch: %{fpc_arches} - gela-asis ExclusiveArch: %GPRbuild_arches - ghdl ExclusiveArch: %{GNAT_arches} - ghostwriter ExclusiveArch: %{qt5_qtwebengine_arches} - gio-sharp ExclusiveArch: %mono_arches - gir-to-d ExclusiveArch: %{ldc_arches} - git-octopus ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm}} - gitqlient ExclusiveArch: %{qt5_qtwebengine_arches} - giver ExclusiveArch: %{mono_arches} - gkeyfile-sharp ExclusiveArch: %mono_arches - glibc32 ExclusiveArch: x86_64 - glibd ExclusiveArch: %{ldc_arches} - gmqcc ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - gnatcoll ExclusiveArch: %{GPRbuild_arches} - gnatcoll-bindings ExclusiveArch: %{GPRbuild_arches} - gnatcoll-db ExclusiveArch: %{GPRbuild_arches} - gnome-boxes ExclusiveArch: x86_64 - gnome-desktop-sharp ExclusiveArch: %mono_arches - gnome-do ExclusiveArch: %mono_arches - gnome-keyring-sharp ExclusiveArch: %mono_arches - gnome-rdp ExclusiveArch: %{mono_arches} - gnome-sharp ExclusiveArch: %mono_arches - gnome-subtitles ExclusiveArch: %mono_arches - gnu-efi ExclusiveArch: %{efi} - go-bindata ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - go-compilers ExclusiveArch: %{go_arches} - go-rpm-macros ExclusiveArch: %{golang_arches} %{gccgo_arches} - godep ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - golang ExclusiveArch: %{golang_arches} - gomtree ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - gotun ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} ExclusiveArch: x86_64 - goverlay ExclusiveArch: %{fpc_arches} - gprbuild ExclusiveArch: %{GPRbuild_arches} %{bootstrap_arch} - gprolog ExclusiveArch: x86_64 %{ix86} ppc alpha - grafana ExclusiveArch: %{grafana_arches} - grafana-pcp ExclusiveArch: %{grafanapcp_arches} - gtk-sharp-beans ExclusiveArch: %mono_arches - gtk-sharp2 ExclusiveArch: %mono_arches - gtk-sharp3 ExclusiveArch: %{mono_arches} - gtkd ExclusiveArch: %{ldc_arches} - gudev-sharp ExclusiveArch: %mono_arches - guestfs-tools ExclusiveArch: %{kernel_arches} - hedgewars ExclusiveArch: %{fpc_arches} - hsakmt ExclusiveArch: x86_64 aarch64 - hyena ExclusiveArch: %{mono_arches} - hyperscan ExclusiveArch: x86_64 - hyperv-daemons ExclusiveArch: i686 x86_64 - i3status-rs ExclusiveArch: %{rust_arches} - icaro ExclusiveArch: %{ix86} x86_64 noarch - imvirt ExclusiveArch: %{ix86} x86_64 ia64 - indistarter ExclusiveArch: %{fpc_arches} - infinipath-psm ExclusiveArch: x86_64 - intel-cmt-cat ExclusiveArch: x86_64 i686 i586 ExclusiveArch: x86_64 i686 i586 - intel-gmmlib ExclusiveArch: x86_64 i686 - intel-ipp-crypto-mb ExclusiveArch: x86_64 ExclusiveArch: x86_64 - intel-ipsec-mb ExclusiveArch: x86_64 ExclusiveArch: x86_64 - intel-mediasdk ExclusiveArch: x86_64 - intel-undervolt ExclusiveArch: i386 x86_64 - ioport ExclusiveArch: %{ix86} x86_64 - ipmctl ExclusiveArch: x86_64 - ispc ExclusiveArch: x86_64 aarch64 - iucode-tool ExclusiveArch: %{ix86} x86_64 - iyfct ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc64le - java-1.8.0-openjdk-aarch32 ExclusiveArch: %{arm} - jigawatts ExclusiveArch: x86_64 %{arm} ppc64le aarch64 s390x - kchmviewer ExclusiveArch: %{qt5_qtwebengine_arches} - keepass ExclusiveArch: %{mono_arches} - kernel ExclusiveArch: noarch x86_64 s390x %{arm} aarch64 ppc64le ExclusiveArch: noarch i386 i686 x86_64 s390x %{arm} aarch64 ppc64le - keyring-ima-signer ExclusiveArch: %{rust_arches} - kf5-akonadi-search ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-audiocd-kio ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-kalarmcal ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-kblog ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-kcalendarcore ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-kcalendarutils ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-kitinerary ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-ktnef ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - kf5-libkdcraw ExclusiveArch: x86_64 ppc64le %{arm} - kicad ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ppc64le - kiwix-desktop ExclusiveArch: %{qt5_qtwebengine_arches} - klee ExclusiveArch: x86_64 - knot-resolver ExclusiveArch: %{ix86} x86_64 ExclusiveArch: %{arm} aarch64 %{ix86} x86_64 - knotes ExclusiveArch: x86_64 %{arm} - kompose ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 s390x - kubernetes ExclusiveArch: x86_64 aarch64 ppc64le s390x %{arm} - lazarus ExclusiveArch: %{fpc_arches} - lazpaint ExclusiveArch: %{fpc_arches} - ldc ExclusiveArch: %{ldc_arches} - libbsr ExclusiveArch: %{power64} - libclc ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 %{power64} s390x - libcxl ExclusiveArch: %{power64} - libdfp ExclusiveArch: ppc ppc64 ppc64le s390 s390x x86_64 - libdispatch ExclusiveArch: x86_64 aarch64 - libguestfs ExclusiveArch: %{kernel_arches} - libica ExclusiveArch: s390 s390x - libipt ExclusiveArch: %{ix86} x86_64 ExclusiveArch: %{ix86} x86_64 - libkgapi ExclusiveArch: x86_64 ppc64le aarch64 %{arm} - libnxz ExclusiveArch: ppc64le - libocxl ExclusiveArch: ppc64le - libpmemobj-cpp ExclusiveArch: x86_64 ppc64le - libpsm2 ExclusiveArch: x86_64 - libquentier ExclusiveArch: %{qt5_qtwebengine_arches} - libretro-desmume2015 ExclusiveArch: i686 x86_64 - librtas ExclusiveArch: %{power64} - libservicelog ExclusiveArch: ppc %{power64} - libsmbios ExclusiveArch: x86_64 %{ix86} - libunwind ExclusiveArch: %{arm} aarch64 hppa ia64 mips ppc %{power64} s390x %{ix86} x86_64 - libva-intel-hybrid-driver ExclusiveArch: %{ix86} x86_64 ia64 - libvma ExclusiveArch: x86_64 ppc64le ppc64 aarch64 - libvmi ExclusiveArch: x86_64 - libvpd ExclusiveArch: %{power64} - libxsmm ExclusiveArch: x86_64 - libzfcphbaapi ExclusiveArch: s390 s390x - lightdm ExclusiveArch: x86_64 ppc64le - llhttp ExclusiveArch: %{nodejs_arches} - log4net ExclusiveArch: %mono_arches - lrmi ExclusiveArch: %{ix86} - lsvpd ExclusiveArch: %{power64} - luajit ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} aarch64 - luxcorerender ExclusiveArch: x86_64 - mactel-boot ExclusiveArch: x86_64 - manifest-tool ExclusiveArch: x86_64 aarch64 ppc64le s390x - marked ExclusiveArch: %{nodejs_arches} noarch ExclusiveArch: %{ix86} x86_64 %{arm} noarch - matreshka ExclusiveArch: %GPRbuild_arches - maxima ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc sparcv9 ExclusiveArch: %{ix86} x86_64 ppc sparcv9 - mbpfan ExclusiveArch: x86_64 - mcelog ExclusiveArch: i686 x86_64 - mdevctl ExclusiveArch: %{rust_arches} - mediaconch ExclusiveArch: %{qt5_qtwebengine_arches} - mellowplayer ExclusiveArch: %{qt5_qtwebengine_arches} - memkind ExclusiveArch: x86_64 ppc64 ppc64le s390x aarch64 - memtest86+ ExclusiveArch: %{ix86} x86_64 - mesos ExclusiveArch: x86_64 - microcode_ctl ExclusiveArch: %{ix86} x86_64 - micropython ExclusiveArch: %{arm} %{ix86} x86_64 - mine_detector ExclusiveArch: %{GPRbuild_arches} - minetest ExclusiveArch: %{ix86} x86_64 ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} aarch64 - mingw-libidn2 ExclusiveArch: %{ix86} x86_64 %{arm} - mingw-wine-gecko ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - mirrorlist-server ExclusiveArch: %{rust_arches} - mkbootdisk ExclusiveArch: %{ix86} sparc sparc64 x86_64 - mod_mono ExclusiveArch: %mono_arches - module-build-service ExclusiveArch: %{ix86} x86_64 noarch - mokutil ExclusiveArch: %{ix86} x86_64 aarch64 %{arm} - mono ExclusiveArch: %mono_arches - mono-addins ExclusiveArch: %mono_arches - mono-basic ExclusiveArch: %{mono_arches} - mono-bouncycastle ExclusiveArch: %mono_arches - mono-cecil ExclusiveArch: %mono_arches - mono-cecil-flowanalysis ExclusiveArch: %mono_arches - mono-reflection ExclusiveArch: %mono_arches - mono-tools ExclusiveArch: %mono_arches - mono-zeroconf ExclusiveArch: %mono_arches - monobristol ExclusiveArch: %{mono_arches} - monodevelop ExclusiveArch: %mono_arches - monodevelop-debugger-gdb ExclusiveArch: %{mono_arches} - monosim ExclusiveArch: %mono_arches - mrrescue ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc64le - msr-tools ExclusiveArch: %{ix86} x86_64 - mustache-d ExclusiveArch: %{ldc_arches} - mysql-connector-net ExclusiveArch: %{mono_arches} - nant ExclusiveArch: %mono_arches - nativejit ExclusiveArch: x86_64 - nbc ExclusiveArch: %{fpc_arches} - nbdkit ExclusiveArch: x86_64 - ndesk-dbus ExclusiveArch: %{mono_arches} - ndesk-dbus-glib ExclusiveArch: %{mono_arches} - newsflash ExclusiveArch: %{rust_arches} - newtonsoft-json ExclusiveArch: %{mono_arches} - nispor ExclusiveArch: %{rust_arches} - nodejs ExclusiveArch: %{nodejs_arches} - nodejs-acorn-object-spread ExclusiveArch: %{nodejs_arches} noarch ExclusiveArch: %{ix86} x86_64 %{arm} noarch - nodejs-backbone ExclusiveArch: %{nodejs_arches} noarch - nodejs-bash-language-server ExclusiveArch: %{nodejs_arches} noarch - nodejs-buble ExclusiveArch: %{nodejs_arches} noarch - nodejs-colors ExclusiveArch: %{nodejs_arches} noarch - nodejs-generic-pool ExclusiveArch: %{nodejs_arches} noarch - nodejs-linefix ExclusiveArch: %{nodejs_arches} noarch ExclusiveArch: %{ix86} x86_64 %{arm} noarch - nodejs-nodemon ExclusiveArch: %{nodejs_arches} noarch - nodejs-packaging ExclusiveArch: %{nodejs_arches} noarch - nodejs-replace-require-self ExclusiveArch: %{nodejs_arches} noarch - nodejs-supervisor ExclusiveArch: %{nodejs_arches} noarch - nodejs-svgo ExclusiveArch: %{nodejs_arches} noarch - nodejs-tape ExclusiveArch: %{nodejs_arches} noarch - nodejs-typescript ExclusiveArch: %{nodejs_arches} noarch - nodejs-underscore ExclusiveArch: %{nodejs_arches} noarch ExclusiveArch: %{ix86} x86_64 %{arm} noarch - notify-sharp ExclusiveArch: %{mono_arches} - notify-sharp3 ExclusiveArch: %{mono_arches} - npm-name-cli ExclusiveArch: %{nodejs_arches} noarch - nuget ExclusiveArch: %{mono_arches} - numatop ExclusiveArch: x86_64 ppc64le - nunit ExclusiveArch: %{mono_arches} - nunit2 ExclusiveArch: %{mono_arches} - nvml ExclusiveArch: x86_64 ppc64le - nwchem ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ppc64le - obs-service-rust2rpm ExclusiveArch: %{rust_arches} noarch - oci-kvm-hook ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm}} - oci-seccomp-bpf-hook ExclusiveArch: x86_64 %%{power64} aarch64 s390x armv7hl - oci-umount ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ppc64le s390x %{mips} - oidn ExclusiveArch: x86_64 - olpc-kbdshim ExclusiveArch: %{ix86} %{arm} - olpc-utils ExclusiveArch: %{ix86} %{arm} - onednn ExclusiveArch: x86_64 aarch64 ppc64le s390x - onedrive ExclusiveArch: %{ldc_arches} - opae ExclusiveArch: x86_64 - opal-prd ExclusiveArch: ppc64le - open-vm-tools ExclusiveArch: x86_64 ExclusiveArch: %{ix86} x86_64 aarch64 - openblas ExclusiveArch: %{openblas_arches} - openjfx ExclusiveArch: x86_64 - openjfx8 ExclusiveArch: x86_64 - openlibm ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 %{power64} - openni ExclusiveArch: %{ix86} x86_64 %{arm} - openni-primesense ExclusiveArch: %{ix86} x86_64 %{arm} - openshadinglanguage ExclusiveArch: x86_64 aarch64 ppc64le s390x - openssl-ibmca ExclusiveArch: s390 s390x - origin ExclusiveArch: %{go_arches} ExclusiveArch: x86_64 aarch64 ppc64le s390x - orion ExclusiveArch: %{qt5_qtwebengine_arches} - orthorobot ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc64le - pacemaker ExclusiveArch: aarch64 i686 ppc64le s390x x86_64 %{arm} ExclusiveArch: aarch64 i686 ppc64le s390x x86_64 - paflib ExclusiveArch: ppc %{power64} - parsec ExclusiveArch: %{rust_arches} - parsec-tool ExclusiveArch: %{rust_arches} - pcc ExclusiveArch: %{ix86} x86_64 - pcm ExclusiveArch: %{ix86} x86_64 - pcmciautils ExclusiveArch: %{ix86} x86_64 ia64 ppc ppc64 %{arm} - pdbg ExclusiveArch: ppc64le - pdfmod ExclusiveArch: %mono_arches - perl-Dumbbench ExclusiveArch: %{ix86} x86_64 noarch - perl-Parse-DMIDecode ExclusiveArch: %{ix86} x86_64 ia64 aarch64 - pesign ExclusiveArch: %{ix86} x86_64 ia64 aarch64 %{arm} - pesign-test-app ExclusiveArch: x86_64 - pinta ExclusiveArch: %mono_arches - pioneer ExclusiveArch: %{ix86} x86_64 - playonlinux ExclusiveArch: %{arm} aarch64 %{ix86} x86_64 - pmdk-convert ExclusiveArch: x86_64 - pmemkv ExclusiveArch: x86_64 - podman ExclusiveArch: %{golang_arches} - poppler-sharp ExclusiveArch: %mono_arches - popub ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - powerpc-utils ExclusiveArch: ppc %{power64} - ppc64-diag ExclusiveArch: ppc %{power64} - pveclib ExclusiveArch: ppc %{power64} - pvs-sbcl ExclusiveArch: %{ix86} x86_64 ppc sparcv9 - pyqtwebengine ExclusiveArch: %{qt5_qtwebengine_arches} - python-cryptography ExclusiveArch: %{rust_arches} - python-etcd ExclusiveArch: noarch %{ix86} x86_64 %{arm} aarch64 ppc64le s390x - python-healpy ExclusiveArch: aarch64 ppc64 ppc64le x86_64 s390x - python-javabridge ExclusiveArch: i686 x86_64 - python-openoffice ExclusiveArch: noarch x86_64 - python-pymoc ExclusiveArch: aarch64 ppc64 ppc64le x86_64 s390x - python-setuptools-rust ExclusiveArch: %{rust_arches} - q4wine ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - qatzip ExclusiveArch: x86_64 - qcint ExclusiveArch: x86_64 - qclib ExclusiveArch: s390 s390x - qemu-sanity-check ExclusiveArch: %{kernel_arches} - qevercloud ExclusiveArch: %{qt5_qtwebengine_arches} - qmapshack ExclusiveArch: %{qt5_qtwebengine_arches} - qt4pas ExclusiveArch: %{fpc_arches} - qt5-qtwebengine ExclusiveArch: %{qt5_qtwebengine_arches} - quantum-espresso ExclusiveArch: x86_64 %{ix86} aarch64 %{power64} - quentier ExclusiveArch: %{qt5_qtwebengine_arches} - rear ExclusiveArch: %ix86 x86_64 ppc ppc64 ppc64le ia64 - reg ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 aarch64 %{arm}} - renderdoc ExclusiveArch: x86_64 - reptyr ExclusiveArch: %{ix86} x86_64 %{arm} - rescene ExclusiveArch: %{mono_arches} - restool ExclusiveArch: aarch64 - restsharp ExclusiveArch: %{mono_arches} - rhythmbox-alternative-toolbar ExclusiveArch: %{ix86} %{arm} x86_64 ppc64 ppc64le - rocm-runtime ExclusiveArch: x86_64 aarch64 - rocminfo ExclusiveArch: x86_64 aarch64 - rpg-cli ExclusiveArch: %{rust_arches} - rpm-ostree ExclusiveArch: %{rust_arches} - rr ExclusiveArch: %{ix86} x86_64 aarch64 - rssguard ExclusiveArch: %{qt5_qtwebengine_arches} - rubygem-childprocess ExclusiveArch: %{ix86} x86_64 noarch - runc ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ppc64le %{mips} s390x - rust ExclusiveArch: %{rust_arches} - rust-Inflector ExclusiveArch: %{rust_arches} - rust-ab_glyph ExclusiveArch: %{rust_arches} - rust-ab_glyph_rasterizer ExclusiveArch: %{rust_arches} - rust-abomonation ExclusiveArch: %{rust_arches} - rust-actix ExclusiveArch: %{rust_arches} - rust-actix-macros ExclusiveArch: %{rust_arches} - rust-actix-rt ExclusiveArch: %{rust_arches} - rust-actix-threadpool ExclusiveArch: %{rust_arches} - rust-actix_derive ExclusiveArch: %{rust_arches} - rust-addr2line ExclusiveArch: %{rust_arches} - rust-adler ExclusiveArch: %{rust_arches} - rust-adler32 ExclusiveArch: %{rust_arches} - rust-aead ExclusiveArch: %{rust_arches} - rust-aes ExclusiveArch: %{rust_arches} - rust-aes-gcm ExclusiveArch: %{rust_arches} - rust-afterburn ExclusiveArch: %{rust_arches} - rust-ahash ExclusiveArch: %{rust_arches} - rust-ahash0.4 ExclusiveArch: %{rust_arches} - rust-aho-corasick ExclusiveArch: %{rust_arches} - rust-alacritty ExclusiveArch: %{rust_arches} - rust-alacritty_config_derive ExclusiveArch: %{rust_arches} - rust-alacritty_terminal ExclusiveArch: %{rust_arches} - rust-alga ExclusiveArch: %{rust_arches} - rust-alga_derive ExclusiveArch: %{rust_arches} - rust-aliasable ExclusiveArch: %{rust_arches} - rust-alloc-no-stdlib ExclusiveArch: %{rust_arches} - rust-alloc-stdlib ExclusiveArch: %{rust_arches} - rust-alsa ExclusiveArch: %{rust_arches} - rust-alsa-sys ExclusiveArch: %{rust_arches} - rust-ambient-authority ExclusiveArch: %{rust_arches} - rust-ammonia ExclusiveArch: %{rust_arches} - rust-andrew ExclusiveArch: %{rust_arches} - rust-ansi_colours ExclusiveArch: %{rust_arches} - rust-ansi_term ExclusiveArch: %{rust_arches} - rust-ansi_term0.11 ExclusiveArch: %{rust_arches} - rust-antidote ExclusiveArch: %{rust_arches} - rust-anyhow ExclusiveArch: %{rust_arches} - rust-aom-sys ExclusiveArch: %{rust_arches} - rust-app_dirs ExclusiveArch: %{rust_arches} - rust-approx ExclusiveArch: %{rust_arches} - rust-ar ExclusiveArch: %{rust_arches} - rust-arbitrary ExclusiveArch: %{rust_arches} - rust-arbitrary0.4 ExclusiveArch: %{rust_arches} - rust-arc-swap ExclusiveArch: %{rust_arches} - rust-arg_enum_proc_macro ExclusiveArch: %{rust_arches} - rust-argh ExclusiveArch: %{rust_arches} - rust-argh_derive ExclusiveArch: %{rust_arches} - rust-argh_shared ExclusiveArch: %{rust_arches} - rust-argparse ExclusiveArch: %{rust_arches} - rust-array-init ExclusiveArch: %{rust_arches} - rust-arrayref ExclusiveArch: %{rust_arches} - rust-arrayvec ExclusiveArch: %{rust_arches} - rust-arrayvec0.5 ExclusiveArch: %{rust_arches} - rust-article_scraper ExclusiveArch: %{rust_arches} - rust-ascii ExclusiveArch: %{rust_arches} - rust-ascii-canvas ExclusiveArch: %{rust_arches} - rust-askalono ExclusiveArch: %{rust_arches} - rust-askalono-cli ExclusiveArch: %{rust_arches} - rust-askama ExclusiveArch: %{rust_arches} - rust-askama_derive ExclusiveArch: %{rust_arches} - rust-askama_escape ExclusiveArch: %{rust_arches} - rust-askama_shared ExclusiveArch: %{rust_arches} - rust-asn1 ExclusiveArch: %{rust_arches} - rust-asn1_derive ExclusiveArch: %{rust_arches} - rust-assert-impl ExclusiveArch: %{rust_arches} - rust-assert-json-diff ExclusiveArch: %{rust_arches} - rust-assert_approx_eq ExclusiveArch: %{rust_arches} - rust-assert_cli ExclusiveArch: %{rust_arches} - rust-assert_cmd ExclusiveArch: %{rust_arches} - rust-assert_fs ExclusiveArch: %{rust_arches} - rust-assert_matches ExclusiveArch: %{rust_arches} - rust-assign ExclusiveArch: %{rust_arches} - rust-async-attributes ExclusiveArch: %{rust_arches} - rust-async-channel ExclusiveArch: %{rust_arches} - rust-async-compression ExclusiveArch: %{rust_arches} - rust-async-executor ExclusiveArch: %{rust_arches} - rust-async-global-executor ExclusiveArch: %{rust_arches} - rust-async-io ExclusiveArch: %{rust_arches} - rust-async-lock ExclusiveArch: %{rust_arches} - rust-async-mutex ExclusiveArch: %{rust_arches} - rust-async-process ExclusiveArch: %{rust_arches} - rust-async-std ExclusiveArch: %{rust_arches} - rust-async-stream ExclusiveArch: %{rust_arches} - rust-async-stream-impl ExclusiveArch: %{rust_arches} - rust-async-task ExclusiveArch: %{rust_arches} - rust-async-trait ExclusiveArch: %{rust_arches} - rust-asyncgit ExclusiveArch: %{rust_arches} - rust-atk ExclusiveArch: %{rust_arches} - rust-atk-sys ExclusiveArch: %{rust_arches} - rust-atom ExclusiveArch: %{rust_arches} - rust-atomic-waker ExclusiveArch: %{rust_arches} - rust-attohttpc ExclusiveArch: %{rust_arches} - rust-atty ExclusiveArch: %{rust_arches} - rust-autocfg ExclusiveArch: %{rust_arches} - rust-automod ExclusiveArch: %{rust_arches} - rust-av-metrics ExclusiveArch: %{rust_arches} - rust-average ExclusiveArch: %{rust_arches} - rust-aws-nitro-enclaves-cose ExclusiveArch: %{rust_arches} - rust-az ExclusiveArch: %{rust_arches} - rust-backtrace ExclusiveArch: %{rust_arches} - rust-base100 ExclusiveArch: %{rust_arches} - rust-base64 ExclusiveArch: %{rust_arches} - rust-base64-0.10 ExclusiveArch: %{rust_arches} - rust-base64-0.11 ExclusiveArch: %{rust_arches} - rust-base64_0.12 ExclusiveArch: %{rust_arches} - rust-bat ExclusiveArch: %{rust_arches} - rust-battery ExclusiveArch: %{rust_arches} - rust-beef ExclusiveArch: %{rust_arches} - rust-below ExclusiveArch: %{rust_arches} - rust-below-common ExclusiveArch: %{rust_arches} - rust-below-config ExclusiveArch: %{rust_arches} - rust-below-dump ExclusiveArch: %{rust_arches} - rust-below-model ExclusiveArch: %{rust_arches} - rust-below-render ExclusiveArch: %{rust_arches} - rust-below-store ExclusiveArch: %{rust_arches} - rust-below-view ExclusiveArch: %{rust_arches} - rust-below_derive ExclusiveArch: %{rust_arches} - rust-bencher ExclusiveArch: %{rust_arches} - rust-benfred-read-process-memory ExclusiveArch: %{rust_arches} - rust-bincode ExclusiveArch: %{rust_arches} - rust-bincode0.8 ExclusiveArch: %{rust_arches} - rust-bindgen ExclusiveArch: %{rust_arches} - rust-binfarce ExclusiveArch: %{rust_arches} - rust-biscuit ExclusiveArch: %{rust_arches} - rust-bit-set ExclusiveArch: %{rust_arches} - rust-bit-vec ExclusiveArch: %{rust_arches} - rust-bitfield ExclusiveArch: %{rust_arches} - rust-bitflags ExclusiveArch: %{rust_arches} - rust-bitmaps ExclusiveArch: %{rust_arches} - rust-bitreader ExclusiveArch: %{rust_arches} - rust-bitstream-io ExclusiveArch: %{rust_arches} - rust-bitvec ExclusiveArch: %{rust_arches} - rust-blake2 ExclusiveArch: %{rust_arches} - rust-blobby ExclusiveArch: %{rust_arches} - rust-blobby0.1 ExclusiveArch: %{rust_arches} - rust-block-buffer ExclusiveArch: %{rust_arches} - rust-block-modes ExclusiveArch: %{rust_arches} - rust-block-padding ExclusiveArch: %{rust_arches} - rust-blocking ExclusiveArch: %{rust_arches} - rust-blsctl ExclusiveArch: %{rust_arches} - rust-bodhi ExclusiveArch: %{rust_arches} - rust-bodhi-cli ExclusiveArch: %{rust_arches} - rust-bootupd ExclusiveArch: x86_64 aarch64 - rust-box_drawing ExclusiveArch: %{rust_arches} - rust-boxfnonce ExclusiveArch: %{rust_arches} - rust-brotli ExclusiveArch: %{rust_arches} - rust-brotli-decompressor ExclusiveArch: %{rust_arches} - rust-bstr ExclusiveArch: %{rust_arches} - rust-btrd ExclusiveArch: %{rust_arches} - rust-buf_redux ExclusiveArch: %{rust_arches} - rust-buffered-reader ExclusiveArch: %{rust_arches} - rust-bufsize ExclusiveArch: %{rust_arches} - rust-bufstream ExclusiveArch: %{rust_arches} - rust-bugreport ExclusiveArch: %{rust_arches} - rust-build-env ExclusiveArch: %{rust_arches} - rust-build_const ExclusiveArch: %{rust_arches} - rust-bumpalo ExclusiveArch: %{rust_arches} - rust-byte-unit ExclusiveArch: %{rust_arches} - rust-byte-unit3 ExclusiveArch: %{rust_arches} - rust-bytecheck ExclusiveArch: %{rust_arches} - rust-bytecheck_derive ExclusiveArch: %{rust_arches} - rust-bytecount ExclusiveArch: %{rust_arches} - rust-bytelines ExclusiveArch: %{rust_arches} - rust-bytemuck ExclusiveArch: %{rust_arches} - rust-bytemuck_derive ExclusiveArch: %{rust_arches} - rust-byteorder ExclusiveArch: %{rust_arches} - rust-bytes ExclusiveArch: %{rust_arches} - rust-bytes0.4 ExclusiveArch: %{rust_arches} - rust-bytes0.5 ExclusiveArch: %{rust_arches} - rust-bytesize ExclusiveArch: %{rust_arches} - rust-bzip2 ExclusiveArch: %{rust_arches} - rust-bzip2-sys ExclusiveArch: %{rust_arches} - rust-cache-padded ExclusiveArch: %{rust_arches} - rust-cairo-rs ExclusiveArch: %{rust_arches} - rust-cairo-sys-rs ExclusiveArch: %{rust_arches} - rust-calloop ExclusiveArch: %{rust_arches} - rust-calloop0.6 ExclusiveArch: %{rust_arches} - rust-camino ExclusiveArch: %{rust_arches} - rust-cap-primitives ExclusiveArch: %{rust_arches} - rust-cap-rand ExclusiveArch: %{rust_arches} - rust-cap-std ExclusiveArch: %{rust_arches} - rust-capnp ExclusiveArch: %{rust_arches} - rust-capnp-futures ExclusiveArch: %{rust_arches} - rust-capnp-rpc ExclusiveArch: %{rust_arches} - rust-caps ExclusiveArch: %{rust_arches} - rust-cargo ExclusiveArch: %{rust_arches} - rust-cargo-bloat ExclusiveArch: %{rust_arches} - rust-cargo-c ExclusiveArch: %{rust_arches} - rust-cargo-edit ExclusiveArch: %{rust_arches} - rust-cargo-husky ExclusiveArch: %{rust_arches} - rust-cargo-insta ExclusiveArch: %{rust_arches} - rust-cargo-platform ExclusiveArch: %{rust_arches} - rust-cargo-readme ExclusiveArch: %{rust_arches} - rust-cargo-util ExclusiveArch: %{rust_arches} - rust-cargo_metadata ExclusiveArch: %{rust_arches} - rust-cascade ExclusiveArch: %{rust_arches} - rust-case ExclusiveArch: %{rust_arches} - rust-cassowary ExclusiveArch: %{rust_arches} - rust-cast ExclusiveArch: %{rust_arches} - rust-cbindgen ExclusiveArch: %{rust_arches} - rust-cc ExclusiveArch: %{rust_arches} - rust-cedarwood ExclusiveArch: %{rust_arches} - rust-cexpr ExclusiveArch: %{rust_arches} - rust-cfg-expr ExclusiveArch: %{rust_arches} - rust-cfg-if ExclusiveArch: %{rust_arches} - rust-cfg-if0.1 ExclusiveArch: %{rust_arches} - rust-cgmath ExclusiveArch: %{rust_arches} - rust-cgroupfs ExclusiveArch: %{rust_arches} - rust-chainerror ExclusiveArch: %{rust_arches} - rust-charset ExclusiveArch: %{rust_arches} - rust-chbs ExclusiveArch: %{rust_arches} - rust-checked_int_cast ExclusiveArch: %{rust_arches} - rust-chlorine ExclusiveArch: %{rust_arches} - rust-choosier ExclusiveArch: %{rust_arches} - rust-chrono ExclusiveArch: %{rust_arches} - rust-chrono-humanize ExclusiveArch: %{rust_arches} - rust-chrono-tz ExclusiveArch: %{rust_arches} - rust-chunked_transfer ExclusiveArch: %{rust_arches} - rust-cipher ExclusiveArch: %{rust_arches} - rust-clang-ast ExclusiveArch: %{rust_arches} - rust-clang-sys ExclusiveArch: %{rust_arches} - rust-clap ExclusiveArch: %{rust_arches} - rust-clap-verbosity-flag ExclusiveArch: %{rust_arches} - rust-clap2 ExclusiveArch: %{rust_arches} - rust-clap_derive ExclusiveArch: %{rust_arches} - rust-clap_generate ExclusiveArch: %{rust_arches} - rust-clap_generate_fig ExclusiveArch: %{rust_arches} - rust-claxon ExclusiveArch: %{rust_arches} - rust-clicolors-control ExclusiveArch: %{rust_arches} - rust-clipboard ExclusiveArch: %{rust_arches} - rust-clircle ExclusiveArch: %{rust_arches} - rust-cloudflare-zlib ExclusiveArch: x86_64 aarch64 - rust-cloudflare-zlib-sys ExclusiveArch: x86_64 aarch64 - rust-cmake ExclusiveArch: %{rust_arches} - rust-codespan-reporting ExclusiveArch: %{rust_arches} - rust-codicon ExclusiveArch: %{rust_arches} - rust-color-backtrace ExclusiveArch: %{rust_arches} - rust-color_quant ExclusiveArch: %{rust_arches} - rust-colored ExclusiveArch: %{rust_arches} - rust-colored1 ExclusiveArch: %{rust_arches} - rust-colored_json ExclusiveArch: %{rust_arches} - rust-colorful ExclusiveArch: %{rust_arches} - rust-combine ExclusiveArch: %{rust_arches} - rust-comfy-table ExclusiveArch: %{rust_arches} - rust-compiletest_rs ExclusiveArch: %{rust_arches} - rust-compress-tools ExclusiveArch: %{rust_arches} - rust-comrak ExclusiveArch: %{rust_arches} - rust-concurrent-queue ExclusiveArch: %{rust_arches} - rust-configparser ExclusiveArch: %{rust_arches} - rust-confy ExclusiveArch: %{rust_arches} - rust-console ExclusiveArch: %{rust_arches} - rust-console0.11 ExclusiveArch: %{rust_arches} - rust-console0.12 ExclusiveArch: %{rust_arches} - rust-console0.13 ExclusiveArch: %{rust_arches} - rust-console0.9 ExclusiveArch: %{rust_arches} - rust-console_error_panic_hook ExclusiveArch: %{rust_arches} - rust-const-cstr ExclusiveArch: %{rust_arches} - rust-const-random ExclusiveArch: %{rust_arches} - rust-const-random-macro ExclusiveArch: %{rust_arches} - rust-const_fn ExclusiveArch: %{rust_arches} - rust-constant_time_eq ExclusiveArch: %{rust_arches} - rust-content_inspector ExclusiveArch: %{rust_arches} - rust-conv ExclusiveArch: %{rust_arches} - rust-convert_case ExclusiveArch: %{rust_arches} - rust-cookie ExclusiveArch: %{rust_arches} - rust-cookie_store ExclusiveArch: %{rust_arches} - rust-copydeps ExclusiveArch: %{rust_arches} - rust-copyless ExclusiveArch: %{rust_arches} - rust-copypasta ExclusiveArch: %{rust_arches} - rust-cordic ExclusiveArch: %{rust_arches} - rust-coreos-installer ExclusiveArch: %{rust_arches} - rust-counted-array ExclusiveArch: %{rust_arches} - rust-cpal ExclusiveArch: %{rust_arches} - rust-cpio ExclusiveArch: %{rust_arches} - rust-cpp_demangle ExclusiveArch: %{rust_arches} - rust-cpufeatures ExclusiveArch: %{rust_arches} - rust-cpython ExclusiveArch: %{rust_arches} - rust-cranelift-bforest ExclusiveArch: %{rust_arches} - rust-cranelift-codegen ExclusiveArch: %{rust_arches} - rust-cranelift-codegen-meta ExclusiveArch: %{rust_arches} - rust-cranelift-codegen-shared ExclusiveArch: %{rust_arches} - rust-cranelift-entity ExclusiveArch: %{rust_arches} - rust-cranelift-frontend ExclusiveArch: %{rust_arches} - rust-cranelift-native ExclusiveArch: %{rust_arches} - rust-cranelift-wasm ExclusiveArch: %{rust_arches} - rust-crates-io ExclusiveArch: %{rust_arches} - rust-crc ExclusiveArch: %{rust_arches} - rust-crc-any ExclusiveArch: %{rust_arches} - rust-crc-core ExclusiveArch: %{rust_arches} - rust-crc32fast ExclusiveArch: %{rust_arches} - rust-criterion ExclusiveArch: %{rust_arches} - rust-criterion-plot ExclusiveArch: %{rust_arches} - rust-crossbeam ExclusiveArch: %{rust_arches} - rust-crossbeam-channel ExclusiveArch: %{rust_arches} - rust-crossbeam-channel0.4 ExclusiveArch: %{rust_arches} - rust-crossbeam-deque ExclusiveArch: %{rust_arches} - rust-crossbeam-deque0.7 ExclusiveArch: %{rust_arches} - rust-crossbeam-epoch ExclusiveArch: %{rust_arches} - rust-crossbeam-epoch0.8 ExclusiveArch: %{rust_arches} - rust-crossbeam-queue ExclusiveArch: %{rust_arches} - rust-crossbeam-queue0.2 ExclusiveArch: %{rust_arches} - rust-crossbeam-utils ExclusiveArch: %{rust_arches} - rust-crossbeam-utils0.7 ExclusiveArch: %{rust_arches} - rust-crossbeam0.7 ExclusiveArch: %{rust_arches} - rust-crossfont ExclusiveArch: %{rust_arches} - rust-crossterm ExclusiveArch: %{rust_arches} - rust-crossterm0.17 ExclusiveArch: %{rust_arches} - rust-crossterm0.19 ExclusiveArch: %{rust_arches} - rust-crosstermion ExclusiveArch: %{rust_arches} - rust-crunchy ExclusiveArch: %{rust_arches} - rust-crypto-hash ExclusiveArch: %{rust_arches} - rust-crypto-mac ExclusiveArch: %{rust_arches} - rust-crypto-mac0.8 ExclusiveArch: %{rust_arches} - rust-cryptoki ExclusiveArch: %{rust_arches} - rust-cryptoki-sys ExclusiveArch: %{rust_arches} - rust-cryptovec ExclusiveArch: %{rust_arches} - rust-cssparser ExclusiveArch: %{rust_arches} - rust-cssparser-macros ExclusiveArch: %{rust_arches} - rust-cstr-argument ExclusiveArch: %{rust_arches} - rust-csv ExclusiveArch: %{rust_arches} - rust-csv-core ExclusiveArch: %{rust_arches} - rust-ct-logs ExclusiveArch: %{rust_arches} - rust-ctor ExclusiveArch: %{rust_arches} - rust-ctr ExclusiveArch: %{rust_arches} - rust-ctrlc ExclusiveArch: %{rust_arches} - rust-cty ExclusiveArch: %{rust_arches} - rust-curl ExclusiveArch: %{rust_arches} - rust-curl-sys ExclusiveArch: %{rust_arches} - rust-cursive ExclusiveArch: %{rust_arches} - rust-cursive-tabs ExclusiveArch: %{rust_arches} - rust-cursive_buffered_backend ExclusiveArch: %{rust_arches} - rust-cursive_core ExclusiveArch: %{rust_arches} - rust-curve25519-dalek ExclusiveArch: %{rust_arches} - rust-custom_derive ExclusiveArch: %{rust_arches} - rust-cxx ExclusiveArch: %{rust_arches} - rust-cxx-build ExclusiveArch: %{rust_arches} - rust-cxx-gen ExclusiveArch: %{rust_arches} - rust-cxxbridge-flags ExclusiveArch: %{rust_arches} - rust-cxxbridge-macro ExclusiveArch: %{rust_arches} - rust-darling ExclusiveArch: %{rust_arches} - rust-darling_core ExclusiveArch: %{rust_arches} - rust-darling_macro ExclusiveArch: %{rust_arches} - rust-dashmap ExclusiveArch: %{rust_arches} - rust-data-encoding ExclusiveArch: %{rust_arches} - rust-data-url ExclusiveArch: %{rust_arches} - rust-datetime ExclusiveArch: %{rust_arches} - rust-dav1d-sys ExclusiveArch: %{rust_arches} - rust-dbus ExclusiveArch: %{rust_arches} - rust-dbus-codegen ExclusiveArch: %{rust_arches} - rust-dbus-crossroads ExclusiveArch: %{rust_arches} - rust-dbus-tokio ExclusiveArch: %{rust_arches} - rust-dbus-tree ExclusiveArch: %{rust_arches} - rust-dbus0.8 ExclusiveArch: %{rust_arches} - rust-debug-helper ExclusiveArch: %{rust_arches} - rust-decimal ExclusiveArch: %{rust_arches} - rust-defer-drop ExclusiveArch: %{rust_arches} - rust-deflate ExclusiveArch: %{rust_arches} - rust-defmac ExclusiveArch: %{rust_arches} - rust-delta_e ExclusiveArch: %{rust_arches} - rust-derivative ExclusiveArch: %{rust_arches} - rust-derive-new ExclusiveArch: %{rust_arches} - rust-derive_arbitrary ExclusiveArch: %{rust_arches} - rust-derive_arbitrary0.4 ExclusiveArch: %{rust_arches} - rust-derive_builder ExclusiveArch: %{rust_arches} - rust-derive_builder0.9 ExclusiveArch: %{rust_arches} - rust-derive_builder_core ExclusiveArch: %{rust_arches} - rust-derive_builder_core0.9 ExclusiveArch: %{rust_arches} - rust-derive_builder_macro ExclusiveArch: %{rust_arches} - rust-derive_more ExclusiveArch: %{rust_arches} - rust-des ExclusiveArch: %{rust_arches} - rust-desed ExclusiveArch: %{rust_arches} - rust-deunicode ExclusiveArch: %{rust_arches} - rust-devicemapper ExclusiveArch: %{rust_arches} - rust-devicemapper-sys ExclusiveArch: %{rust_arches} - rust-dialoguer ExclusiveArch: %{rust_arches} - rust-diesel ExclusiveArch: %{rust_arches} - rust-diesel_derives ExclusiveArch: %{rust_arches} - rust-diesel_migrations ExclusiveArch: %{rust_arches} - rust-diff ExclusiveArch: %{rust_arches} - rust-difference ExclusiveArch: %{rust_arches} - rust-difflib ExclusiveArch: %{rust_arches} - rust-diffus ExclusiveArch: %{rust_arches} - rust-diffus-derive ExclusiveArch: %{rust_arches} - rust-digest ExclusiveArch: %{rust_arches} - rust-directories ExclusiveArch: %{rust_arches} - rust-directories-next ExclusiveArch: %{rust_arches} - rust-dirs ExclusiveArch: %{rust_arches} - rust-dirs-next ExclusiveArch: %{rust_arches} - rust-dirs-sys ExclusiveArch: %{rust_arches} - rust-dirs-sys-next ExclusiveArch: %{rust_arches} - rust-dirs2 ExclusiveArch: %{rust_arches} - rust-dirs3 ExclusiveArch: %{rust_arches} - rust-diskonaut ExclusiveArch: %{rust_arches} - rust-displaydoc ExclusiveArch: %{rust_arches} - rust-dissimilar ExclusiveArch: %{rust_arches} - rust-dlib ExclusiveArch: %{rust_arches} - rust-dlib0.4 ExclusiveArch: %{rust_arches} - rust-dlv-list ExclusiveArch: %{rust_arches} - rust-dns-lookup ExclusiveArch: %{rust_arches} - rust-dns-parser ExclusiveArch: %{rust_arches} - rust-doc-comment ExclusiveArch: %{rust_arches} - rust-docmatic ExclusiveArch: %{rust_arches} - rust-docopt ExclusiveArch: %{rust_arches} - rust-dotenv ExclusiveArch: %{rust_arches} - rust-downcast ExclusiveArch: %{rust_arches} - rust-downcast-rs ExclusiveArch: %{rust_arches} - rust-drg ExclusiveArch: %{rust_arches} - rust-dtoa ExclusiveArch: %{rust_arches} - rust-dtoa-short ExclusiveArch: %{rust_arches} - rust-dua-cli ExclusiveArch: %{rust_arches} - rust-duct ExclusiveArch: %{rust_arches} - rust-dummy ExclusiveArch: %{rust_arches} - rust-dunce ExclusiveArch: %{rust_arches} - rust-dutree ExclusiveArch: %{rust_arches} - rust-dyn-clone ExclusiveArch: %{rust_arches} - rust-easy-cast ExclusiveArch: %{rust_arches} - rust-easy-parallel ExclusiveArch: %{rust_arches} - rust-edit ExclusiveArch: %{rust_arches} - rust-edit-distance ExclusiveArch: %{rust_arches} - rust-either ExclusiveArch: %{rust_arches} - rust-elasticlunr-rs ExclusiveArch: %{rust_arches} - rust-elf ExclusiveArch: %{rust_arches} - rust-elfcat ExclusiveArch: %{rust_arches} - rust-ena ExclusiveArch: %{rust_arches} - rust-encode_unicode ExclusiveArch: %{rust_arches} - rust-encoding ExclusiveArch: %{rust_arches} - rust-encoding-index-japanese ExclusiveArch: %{rust_arches} - rust-encoding-index-korean ExclusiveArch: %{rust_arches} - rust-encoding-index-simpchinese ExclusiveArch: %{rust_arches} - rust-encoding-index-singlebyte ExclusiveArch: %{rust_arches} - rust-encoding-index-tradchinese ExclusiveArch: %{rust_arches} - rust-encoding_index_tests ExclusiveArch: %{rust_arches} - rust-encoding_rs ExclusiveArch: %{rust_arches} - rust-encoding_rs_io ExclusiveArch: %{rust_arches} - rust-endian-type ExclusiveArch: %{rust_arches} - rust-entities ExclusiveArch: %{rust_arches} - rust-enum-as-inner ExclusiveArch: %{rust_arches} - rust-enum-iterator ExclusiveArch: %{rust_arches} - rust-enum-iterator-derive ExclusiveArch: %{rust_arches} - rust-enum-map ExclusiveArch: %{rust_arches} - rust-enum-map-derive ExclusiveArch: %{rust_arches} - rust-enum-repr ExclusiveArch: %{rust_arches} - rust-enum_primitive ExclusiveArch: %{rust_arches} - rust-enumflags2 ExclusiveArch: %{rust_arches} - rust-enumflags2_derive ExclusiveArch: %{rust_arches} - rust-enumset ExclusiveArch: %{rust_arches} - rust-enumset_derive ExclusiveArch: %{rust_arches} - rust-env_logger ExclusiveArch: %{rust_arches} - rust-env_logger0.4 ExclusiveArch: %{rust_arches} - rust-env_logger0.5 ExclusiveArch: %{rust_arches} - rust-env_logger0.6 ExclusiveArch: %{rust_arches} - rust-env_logger0.7 ExclusiveArch: %{rust_arches} - rust-env_logger0.8 ExclusiveArch: %{rust_arches} - rust-env_proxy ExclusiveArch: %{rust_arches} - rust-environment ExclusiveArch: %{rust_arches} - rust-envsubst ExclusiveArch: %{rust_arches} - rust-epoll ExclusiveArch: %{rust_arches} - rust-erased-serde ExclusiveArch: %{rust_arches} - rust-err-derive ExclusiveArch: %{rust_arches} - rust-errln ExclusiveArch: %{rust_arches} - rust-errno ExclusiveArch: %{rust_arches} - rust-error-chain ExclusiveArch: %{rust_arches} - rust-escaper ExclusiveArch: %{rust_arches} - rust-escargot ExclusiveArch: %{rust_arches} - rust-euclid ExclusiveArch: %{rust_arches} - rust-event-listener ExclusiveArch: %{rust_arches} - rust-exa ExclusiveArch: %{rust_arches} - rust-executable-path ExclusiveArch: %{rust_arches} - rust-exitcode ExclusiveArch: %{rust_arches} - rust-exitfailure ExclusiveArch: %{rust_arches} - rust-expat-sys ExclusiveArch: %{rust_arches} - rust-extend ExclusiveArch: %{rust_arches} - rust-extprim ExclusiveArch: %{rust_arches} - rust-extprim_literals_macros ExclusiveArch: %{rust_arches} - rust-faccess ExclusiveArch: %{rust_arches} - rust-fail ExclusiveArch: %{rust_arches} - rust-failure ExclusiveArch: %{rust_arches} - rust-failure-tools ExclusiveArch: %{rust_arches} - rust-failure_derive ExclusiveArch: %{rust_arches} - rust-fake ExclusiveArch: %{rust_arches} - rust-fake-simd ExclusiveArch: %{rust_arches} - rust-fallible-iterator ExclusiveArch: %{rust_arches} - rust-fallible-streaming-iterator ExclusiveArch: %{rust_arches} - rust-fallible_collections ExclusiveArch: %{rust_arches} - rust-fancy-regex ExclusiveArch: %{rust_arches} - rust-fastrand ExclusiveArch: %{rust_arches} - rust-fb_procfs ExclusiveArch: %{rust_arches} - rust-fbthrift_codegen_includer_proc_macro ExclusiveArch: %{rust_arches} - rust-fd-find ExclusiveArch: %{rust_arches} - rust-fd-lock ExclusiveArch: %{rust_arches} - rust-fdlimit ExclusiveArch: %{rust_arches} - rust-fedora ExclusiveArch: %{rust_arches} - rust-fedora-coreos-pinger ExclusiveArch: %{rust_arches} - rust-fedora-update-feedback ExclusiveArch: %{rust_arches} - rust-feed-rs ExclusiveArch: %{rust_arches} - rust-feedbin_api ExclusiveArch: %{rust_arches} - rust-feedly_api ExclusiveArch: %{rust_arches} - rust-femme ExclusiveArch: %{rust_arches} - rust-fern ExclusiveArch: %{rust_arches} - rust-fever_api ExclusiveArch: %{rust_arches} - rust-ffsend ExclusiveArch: %{rust_arches} - rust-ffsend-api ExclusiveArch: %{rust_arches} - rust-field-offset ExclusiveArch: %{rust_arches} - rust-file-per-thread-logger ExclusiveArch: %{rust_arches} - rust-filedescriptor ExclusiveArch: %{rust_arches} - rust-filesize ExclusiveArch: %{rust_arches} - rust-filetime ExclusiveArch: %{rust_arches} - rust-filetreelist ExclusiveArch: %{rust_arches} - rust-find-crate ExclusiveArch: %{rust_arches} - rust-fixed ExclusiveArch: %{rust_arches} - rust-fixedbitset ExclusiveArch: %{rust_arches} - rust-flate2 ExclusiveArch: %{rust_arches} - rust-float-cmp ExclusiveArch: %{rust_arches} - rust-float-ord ExclusiveArch: %{rust_arches} - rust-fluent ExclusiveArch: %{rust_arches} - rust-fluent-bundle ExclusiveArch: %{rust_arches} - rust-fluent-langneg ExclusiveArch: %{rust_arches} - rust-fluent-syntax ExclusiveArch: %{rust_arches} - rust-fn-error-context ExclusiveArch: %{rust_arches} - rust-fnv ExclusiveArch: %{rust_arches} - rust-font-kit ExclusiveArch: %{rust_arches} - rust-foreign-types ExclusiveArch: %{rust_arches} - rust-foreign-types-macros ExclusiveArch: %{rust_arches} - rust-foreign-types-shared ExclusiveArch: %{rust_arches} - rust-foreign-types-shared0.1 ExclusiveArch: %{rust_arches} - rust-foreign-types0.3 ExclusiveArch: %{rust_arches} - rust-form_urlencoded ExclusiveArch: %{rust_arches} - rust-fragile ExclusiveArch: %{rust_arches} - rust-freetype ExclusiveArch: %{rust_arches} - rust-freetype-rs ExclusiveArch: %{rust_arches} - rust-freetype-sys ExclusiveArch: %{rust_arches} - rust-fs-set-times ExclusiveArch: %{rust_arches} - rust-fs2 ExclusiveArch: %{rust_arches} - rust-fs_extra ExclusiveArch: %{rust_arches} - rust-funty ExclusiveArch: %{rust_arches} - rust-futf ExclusiveArch: %{rust_arches} - rust-futures ExclusiveArch: %{rust_arches} - rust-futures-channel ExclusiveArch: %{rust_arches} - rust-futures-core ExclusiveArch: %{rust_arches} - rust-futures-cpupool ExclusiveArch: %{rust_arches} - rust-futures-executor ExclusiveArch: %{rust_arches} - rust-futures-io ExclusiveArch: %{rust_arches} - rust-futures-lite ExclusiveArch: %{rust_arches} - rust-futures-macro ExclusiveArch: %{rust_arches} - rust-futures-sink ExclusiveArch: %{rust_arches} - rust-futures-task ExclusiveArch: %{rust_arches} - rust-futures-test ExclusiveArch: %{rust_arches} - rust-futures-timer ExclusiveArch: %{rust_arches} - rust-futures-util ExclusiveArch: %{rust_arches} - rust-futures0.1 ExclusiveArch: %{rust_arches} - rust-fuzzy-matcher ExclusiveArch: %{rust_arches} - rust-fxhash ExclusiveArch: %{rust_arches} - rust-gdk ExclusiveArch: %{rust_arches} - rust-gdk-pixbuf ExclusiveArch: %{rust_arches} - rust-gdk-pixbuf-sys ExclusiveArch: %{rust_arches} - rust-gdk-sys ExclusiveArch: %{rust_arches} - rust-gdk4 ExclusiveArch: %{rust_arches} - rust-gdk4-sys ExclusiveArch: %{rust_arches} - rust-generic-array ExclusiveArch: %{rust_arches} - rust-generic-array0.12 ExclusiveArch: %{rust_arches} - rust-genmesh ExclusiveArch: %{rust_arches} - rust-getch ExclusiveArch: %{rust_arches} - rust-gethostname ExclusiveArch: %{rust_arches} - rust-getopts ExclusiveArch: %{rust_arches} - rust-getrandom ExclusiveArch: %{rust_arches} - rust-getrandom0.1 ExclusiveArch: %{rust_arches} - rust-getset ExclusiveArch: %{rust_arches} - rust-gettext-rs ExclusiveArch: %{rust_arches} - rust-gettext-sys ExclusiveArch: %{rust_arches} - rust-ghash ExclusiveArch: %{rust_arches} - rust-ghost ExclusiveArch: %{rust_arches} - rust-gif ExclusiveArch: %{rust_arches} - rust-gimli ExclusiveArch: %{rust_arches} - rust-gio ExclusiveArch: %{rust_arches} - rust-gio-sys ExclusiveArch: %{rust_arches} - rust-gir-format-check ExclusiveArch: %{rust_arches} - rust-git-delta ExclusiveArch: %{rust_arches} - rust-git-version ExclusiveArch: %{rust_arches} - rust-git-version-macro ExclusiveArch: %{rust_arches} - rust-git2 ExclusiveArch: %{rust_arches} - rust-git2-curl ExclusiveArch: %{rust_arches} - rust-gitui ExclusiveArch: %{rust_arches} - rust-gl_generator ExclusiveArch: %{rust_arches} - rust-glam ExclusiveArch: %{rust_arches} - rust-glib ExclusiveArch: %{rust_arches} - rust-glib-macros ExclusiveArch: %{rust_arches} - rust-glib-sys ExclusiveArch: %{rust_arches} - rust-glob ExclusiveArch: %{rust_arches} - rust-globset ExclusiveArch: %{rust_arches} - rust-globwalk ExclusiveArch: %{rust_arches} - rust-glutin ExclusiveArch: %{rust_arches} - rust-glutin_egl_sys ExclusiveArch: %{rust_arches} - rust-glutin_glx_sys ExclusiveArch: %{rust_arches} - rust-gobject-sys ExclusiveArch: %{rust_arches} - rust-goblin ExclusiveArch: %{rust_arches} - rust-gptman ExclusiveArch: %{rust_arches} - rust-graphene-rs ExclusiveArch: %{rust_arches} - rust-graphene-sys ExclusiveArch: %{rust_arches} - rust-grep ExclusiveArch: %{rust_arches} - rust-grep-cli ExclusiveArch: %{rust_arches} - rust-grep-matcher ExclusiveArch: %{rust_arches} - rust-grep-pcre2 ExclusiveArch: %{rust_arches} - rust-grep-printer ExclusiveArch: %{rust_arches} - rust-grep-regex ExclusiveArch: %{rust_arches} - rust-grep-searcher ExclusiveArch: %{rust_arches} - rust-groupable ExclusiveArch: %{rust_arches} - rust-gsk4 ExclusiveArch: %{rust_arches} - rust-gsk4-sys ExclusiveArch: %{rust_arches} - rust-gstreamer ExclusiveArch: %{rust_arches} - rust-gstreamer-audio ExclusiveArch: %{rust_arches} - rust-gstreamer-audio-sys ExclusiveArch: %{rust_arches} - rust-gstreamer-base ExclusiveArch: %{rust_arches} - rust-gstreamer-base-sys ExclusiveArch: %{rust_arches} - rust-gstreamer-editing-services ExclusiveArch: %{rust_arches} - rust-gstreamer-editing-services-sys ExclusiveArch: %{rust_arches} - rust-gstreamer-pbutils ExclusiveArch: %{rust_arches} - rust-gstreamer-pbutils-sys ExclusiveArch: %{rust_arches} - rust-gstreamer-player ExclusiveArch: %{rust_arches} - rust-gstreamer-player-sys ExclusiveArch: %{rust_arches} - rust-gstreamer-sys ExclusiveArch: %{rust_arches} - rust-gstreamer-video ExclusiveArch: %{rust_arches} - rust-gstreamer-video-sys ExclusiveArch: %{rust_arches} - rust-gtk ExclusiveArch: %{rust_arches} - rust-gtk-sys ExclusiveArch: %{rust_arches} - rust-gtk3-macros ExclusiveArch: %{rust_arches} - rust-gtk4 ExclusiveArch: %{rust_arches} - rust-gtk4-macros ExclusiveArch: %{rust_arches} - rust-gtk4-sys ExclusiveArch: %{rust_arches} - rust-gzip-header ExclusiveArch: %{rust_arches} - rust-h2 ExclusiveArch: %{rust_arches} - rust-h2_0.2 ExclusiveArch: %{rust_arches} - rust-half ExclusiveArch: %{rust_arches} - rust-hamcrest2 ExclusiveArch: %{rust_arches} - rust-handlebars ExclusiveArch: %{rust_arches} - rust-hashbrown ExclusiveArch: %{rust_arches} - rust-hashbrown0.9 ExclusiveArch: %{rust_arches} - rust-hashlink ExclusiveArch: %{rust_arches} - rust-headers ExclusiveArch: %{rust_arches} - rust-headers-core ExclusiveArch: %{rust_arches} - rust-headers-derive ExclusiveArch: %{rust_arches} - rust-heapsize ExclusiveArch: %{rust_arches} - rust-heatseeker ExclusiveArch: %{rust_arches} - rust-heck ExclusiveArch: %{rust_arches} - rust-hex ExclusiveArch: %{rust_arches} - rust-hex-literal ExclusiveArch: %{rust_arches} - rust-hex-literal-impl ExclusiveArch: %{rust_arches} - rust-hex-literal0.2 ExclusiveArch: %{rust_arches} - rust-hexyl ExclusiveArch: %{rust_arches} - rust-hidapi ExclusiveArch: %{rust_arches} - rust-hkdf ExclusiveArch: %{rust_arches} - rust-hmac ExclusiveArch: %{rust_arches} - rust-home ExclusiveArch: %{rust_arches} - rust-horrorshow ExclusiveArch: %{rust_arches} - rust-hostname ExclusiveArch: %{rust_arches} - rust-hostname-validator ExclusiveArch: %{rust_arches} - rust-hound ExclusiveArch: %{rust_arches} - rust-html-escape ExclusiveArch: %{rust_arches} - rust-html2pango ExclusiveArch: %{rust_arches} - rust-html5ever ExclusiveArch: %{rust_arches} - rust-http ExclusiveArch: %{rust_arches} - rust-http-body ExclusiveArch: %{rust_arches} - rust-http-body0.3 ExclusiveArch: %{rust_arches} - rust-http0.1 ExclusiveArch: %{rust_arches} - rust-httparse ExclusiveArch: %{rust_arches} - rust-httpdate ExclusiveArch: %{rust_arches} - rust-human-panic ExclusiveArch: %{rust_arches} - rust-human-sort ExclusiveArch: %{rust_arches} - rust-humansize ExclusiveArch: %{rust_arches} - rust-humantime ExclusiveArch: %{rust_arches} - rust-humantime-serde ExclusiveArch: %{rust_arches} - rust-humantime1 ExclusiveArch: %{rust_arches} - rust-hyper ExclusiveArch: %{rust_arches} - rust-hyper-native-tls ExclusiveArch: %{rust_arches} - rust-hyper-rustls ExclusiveArch: %{rust_arches} - rust-hyper-staticfile ExclusiveArch: %{rust_arches} - rust-hyper-tls ExclusiveArch: %{rust_arches} - rust-hyper-tls0.4 ExclusiveArch: %{rust_arches} - rust-hyper0.10 ExclusiveArch: %{rust_arches} - rust-hyper0.13 ExclusiveArch: %{rust_arches} - rust-hyperfine ExclusiveArch: %{rust_arches} - rust-i18n-config ExclusiveArch: %{rust_arches} - rust-i18n-embed ExclusiveArch: %{rust_arches} - rust-i18n-embed-fl ExclusiveArch: %{rust_arches} - rust-i18n-embed-impl ExclusiveArch: %{rust_arches} - rust-i3ipc ExclusiveArch: %{rust_arches} - rust-iai ExclusiveArch: %{rust_arches} - rust-ident_case ExclusiveArch: %{rust_arches} - rust-idna ExclusiveArch: %{rust_arches} - rust-idna0.1 ExclusiveArch: %{rust_arches} - rust-ignore ExclusiveArch: %{rust_arches} - rust-im-rc ExclusiveArch: %{rust_arches} - rust-image ExclusiveArch: %{rust_arches} - rust-image-roll ExclusiveArch: %{rust_arches} - rust-imgref ExclusiveArch: %{rust_arches} - rust-imgui ExclusiveArch: %{rust_arches} - rust-imgui-sys ExclusiveArch: %{rust_arches} - rust-imgui-winit-support ExclusiveArch: %{rust_arches} - rust-indexmap ExclusiveArch: %{rust_arches} - rust-indicatif ExclusiveArch: %{rust_arches} - rust-indoc ExclusiveArch: %{rust_arches} - rust-inferno ExclusiveArch: %{rust_arches} - rust-inflate ExclusiveArch: %{rust_arches} - rust-inotify ExclusiveArch: %{rust_arches} - rust-inotify-sys ExclusiveArch: %{rust_arches} - rust-input_buffer ExclusiveArch: %{rust_arches} - rust-insta ExclusiveArch: %{rust_arches} - rust-instant ExclusiveArch: %{rust_arches} - rust-interpolate_name ExclusiveArch: %{rust_arches} - rust-intervaltree ExclusiveArch: %{rust_arches} - rust-intl-memoizer ExclusiveArch: %{rust_arches} - rust-intl_pluralrules ExclusiveArch: %{rust_arches} - rust-invalidstring ExclusiveArch: %{rust_arches} - rust-inventory ExclusiveArch: %{rust_arches} - rust-inventory-impl ExclusiveArch: %{rust_arches} - rust-io-extras ExclusiveArch: %{rust_arches} - rust-io-lifetimes ExclusiveArch: %{rust_arches} - rust-ioctl-rs ExclusiveArch: %{rust_arches} - rust-iocuddle ExclusiveArch: %{rust_arches} - rust-iovec ExclusiveArch: %{rust_arches} - rust-ipnet ExclusiveArch: %{rust_arches} - rust-ipnetwork ExclusiveArch: %{rust_arches} - rust-iptables ExclusiveArch: %{rust_arches} - rust-iron ExclusiveArch: %{rust_arches} - rust-iso8601 ExclusiveArch: %{rust_arches} - rust-iter-read ExclusiveArch: %{rust_arches} - rust-itertools ExclusiveArch: %{rust_arches} - rust-itertools-num ExclusiveArch: %{rust_arches} - rust-itertools0.8 ExclusiveArch: %{rust_arches} - rust-itertools0.9 ExclusiveArch: %{rust_arches} - rust-itoa ExclusiveArch: %{rust_arches} - rust-ivf ExclusiveArch: %{rust_arches} - rust-javascriptcore-rs ExclusiveArch: %{rust_arches} - rust-javascriptcore-rs-sys ExclusiveArch: %{rust_arches} - rust-jetscii ExclusiveArch: %{rust_arches} - rust-jieba-rs ExclusiveArch: %{rust_arches} - rust-jobserver ExclusiveArch: %{rust_arches} - rust-jpeg-decoder ExclusiveArch: %{rust_arches} - rust-jql ExclusiveArch: %{rust_arches} - rust-js-sys ExclusiveArch: %{rust_arches} - rust-js_int ExclusiveArch: %{rust_arches} - rust-json ExclusiveArch: %{rust_arches} - rust-just ExclusiveArch: %{rust_arches} - rust-jwalk ExclusiveArch: %{rust_arches} - rust-k9 ExclusiveArch: %{rust_arches} - rust-keccak ExclusiveArch: %{rust_arches} - rust-khronos_api ExclusiveArch: %{rust_arches} - rust-kv-log-macro ExclusiveArch: %{rust_arches} - rust-lab ExclusiveArch: %{rust_arches} - rust-lalrpop ExclusiveArch: %{rust_arches} - rust-lalrpop-util ExclusiveArch: %{rust_arches} - rust-language-tags ExclusiveArch: %{rust_arches} - rust-lazy-init ExclusiveArch: %{rust_arches} - rust-lazy_static ExclusiveArch: %{rust_arches} - rust-lazycell ExclusiveArch: %{rust_arches} - rust-leb128 ExclusiveArch: %{rust_arches} - rust-lewton ExclusiveArch: %{rust_arches} - rust-lexical-core ExclusiveArch: %{rust_arches} - rust-lexiclean ExclusiveArch: %{rust_arches} - rust-libblkid-rs ExclusiveArch: %{rust_arches} - rust-libblkid-rs-sys ExclusiveArch: %{rust_arches} - rust-libbpf-cargo ExclusiveArch: %{rust_arches} - rust-libbpf-rs ExclusiveArch: %{rust_arches} - rust-libbpf-sys ExclusiveArch: %{rust_arches} - rust-libc ExclusiveArch: %{rust_arches} - rust-libcryptsetup-rs ExclusiveArch: %{rust_arches} - rust-libcryptsetup-rs-sys ExclusiveArch: %{rust_arches} - rust-libdbus-sys ExclusiveArch: %{rust_arches} - rust-libdeflate-sys ExclusiveArch: %{rust_arches} - rust-libdeflater ExclusiveArch: %{rust_arches} - rust-libflate ExclusiveArch: %{rust_arches} - rust-libflate_lz77 ExclusiveArch: %{rust_arches} - rust-libgit2-sys ExclusiveArch: %{rust_arches} - rust-libhandy ExclusiveArch: %{rust_arches} - rust-libhandy-sys ExclusiveArch: %{rust_arches} - rust-libloading ExclusiveArch: %{rust_arches} - rust-libloading0.6 ExclusiveArch: %{rust_arches} - rust-libm ExclusiveArch: %{rust_arches} - rust-libmount ExclusiveArch: %{rust_arches} - rust-libnotcurses-sys ExclusiveArch: %{rust_arches} - rust-liboverdrop ExclusiveArch: %{rust_arches} - rust-libpulse-binding ExclusiveArch: %{rust_arches} - rust-libpulse-sys ExclusiveArch: %{rust_arches} - rust-libslirp ExclusiveArch: %{rust_arches} - rust-libslirp-sys ExclusiveArch: %{rust_arches} - rust-libsqlite3-sys ExclusiveArch: %{rust_arches} - rust-libssh2-sys ExclusiveArch: %{rust_arches} - rust-libsystemd ExclusiveArch: %{rust_arches} - rust-libsystemd-sys ExclusiveArch: %{rust_arches} - rust-libudev ExclusiveArch: %{rust_arches} - rust-libudev-sys ExclusiveArch: %{rust_arches} - rust-libwebp ExclusiveArch: %{rust_arches} - rust-libwebp-sys2 ExclusiveArch: %{rust_arches} - rust-libxml ExclusiveArch: %{rust_arches} - rust-libz-sys ExclusiveArch: %{rust_arches} - rust-line-wrap ExclusiveArch: %{rust_arches} - rust-link-cplusplus ExclusiveArch: %{rust_arches} - rust-linked-hash-map ExclusiveArch: %{rust_arches} - rust-linkify ExclusiveArch: %{rust_arches} - rust-linreg ExclusiveArch: %{rust_arches} - rust-linux-raw-sys ExclusiveArch: %{rust_arches} - rust-linux_proc ExclusiveArch: %{rust_arches} - rust-lipsum ExclusiveArch: %{rust_arches} - rust-listenfd ExclusiveArch: %{rust_arches} - rust-lmdb ExclusiveArch: %{rust_arches} - rust-lmdb-sys ExclusiveArch: %{rust_arches} - rust-locale ExclusiveArch: %{rust_arches} - rust-locale_config ExclusiveArch: %{rust_arches} - rust-lock_api ExclusiveArch: %{rust_arches} - rust-lockfree ExclusiveArch: %{rust_arches} - rust-log ExclusiveArch: %{rust_arches} - rust-log-mdc ExclusiveArch: %{rust_arches} - rust-log-panics ExclusiveArch: %{rust_arches} - rust-log0.3 ExclusiveArch: %{rust_arches} - rust-log4rs ExclusiveArch: %{rust_arches} - rust-loggerv ExclusiveArch: %{rust_arches} - rust-loopdev ExclusiveArch: %{rust_arches} - rust-lru-cache ExclusiveArch: %{rust_arches} - rust-lscolors ExclusiveArch: %{rust_arches} - rust-lsd ExclusiveArch: %{rust_arches} - rust-lzma-sys ExclusiveArch: %{rust_arches} - rust-lzw ExclusiveArch: %{rust_arches} - rust-mac ExclusiveArch: %{rust_arches} - rust-macro-attr ExclusiveArch: %{rust_arches} - rust-macroquad_macro ExclusiveArch: %{rust_arches} - rust-magic-crypt ExclusiveArch: %{rust_arches} - rust-maildir ExclusiveArch: %{rust_arches} - rust-mailparse ExclusiveArch: %{rust_arches} - rust-man ExclusiveArch: %{rust_arches} - rust-maplit ExclusiveArch: %{rust_arches} - rust-markup5ever ExclusiveArch: %{rust_arches} - rust-markup5ever_rcdom ExclusiveArch: %{rust_arches} - rust-match_cfg ExclusiveArch: %{rust_arches} - rust-matches ExclusiveArch: %{rust_arches} - rust-matrixcompare ExclusiveArch: %{rust_arches} - rust-matrixcompare-core ExclusiveArch: %{rust_arches} - rust-matrixcompare-mock ExclusiveArch: %{rust_arches} - rust-matrixmultiply ExclusiveArch: %{rust_arches} - rust-maxminddb ExclusiveArch: %{rust_arches} - rust-maybe-owned ExclusiveArch: %{rust_arches} - rust-maybe-uninit ExclusiveArch: %{rust_arches} - rust-mbox ExclusiveArch: %{rust_arches} - rust-mbrman ExclusiveArch: %{rust_arches} - rust-md-5 ExclusiveArch: %{rust_arches} - rust-md5 ExclusiveArch: %{rust_arches} - rust-mdl ExclusiveArch: %{rust_arches} - rust-memchr ExclusiveArch: %{rust_arches} - rust-memmap ExclusiveArch: %{rust_arches} - rust-memmap2 ExclusiveArch: %{rust_arches} - rust-memmap2_0.1 ExclusiveArch: %{rust_arches} - rust-memoffset ExclusiveArch: %{rust_arches} - rust-memoffset0.5 ExclusiveArch: %{rust_arches} - rust-memsec ExclusiveArch: %{rust_arches} - rust-migrations_internals ExclusiveArch: %{rust_arches} - rust-migrations_macros ExclusiveArch: %{rust_arches} - rust-mime ExclusiveArch: %{rust_arches} - rust-mime0.2 ExclusiveArch: %{rust_arches} - rust-mime_guess ExclusiveArch: %{rust_arches} - rust-mime_guess1 ExclusiveArch: %{rust_arches} - rust-miniflux_api ExclusiveArch: %{rust_arches} - rust-minify-html ExclusiveArch: %{rust_arches} - rust-minimal-lexical ExclusiveArch: %{rust_arches} - rust-minimp3 ExclusiveArch: %{rust_arches} - rust-minimp3-sys ExclusiveArch: %{rust_arches} - rust-miniz-sys ExclusiveArch: %{rust_arches} - rust-miniz_oxide ExclusiveArch: %{rust_arches} - rust-miniz_oxide0.3 ExclusiveArch: %{rust_arches} - rust-miniz_oxide_c_api ExclusiveArch: %{rust_arches} - rust-mint ExclusiveArch: %{rust_arches} - rust-mio ExclusiveArch: %{rust_arches} - rust-mio-extras ExclusiveArch: %{rust_arches} - rust-mio-uds ExclusiveArch: %{rust_arches} - rust-mio0.6 ExclusiveArch: %{rust_arches} - rust-mktemp ExclusiveArch: %{rust_arches} - rust-mnt ExclusiveArch: %{rust_arches} - rust-mockall ExclusiveArch: %{rust_arches} - rust-mockall_derive ExclusiveArch: %{rust_arches} - rust-mockall_double ExclusiveArch: %{rust_arches} - rust-mockito ExclusiveArch: %{rust_arches} - rust-modifier ExclusiveArch: %{rust_arches} - rust-more-asserts ExclusiveArch: %{rust_arches} - rust-mp4parse ExclusiveArch: %{rust_arches} - rust-msgbox ExclusiveArch: %{rust_arches} - rust-muldiv ExclusiveArch: %{rust_arches} - rust-multimap ExclusiveArch: %{rust_arches} - rust-multipart ExclusiveArch: %{rust_arches} - rust-mustache ExclusiveArch: %{rust_arches} - rust-nalgebra ExclusiveArch: %{rust_arches} - rust-nalgebra-macros ExclusiveArch: %{rust_arches} - rust-nasm-rs ExclusiveArch: %{rust_arches} - rust-native-tls ExclusiveArch: %{rust_arches} - rust-natord ExclusiveArch: %{rust_arches} - rust-navi ExclusiveArch: %{rust_arches} - rust-nb-connect ExclusiveArch: %{rust_arches} - rust-ncurses ExclusiveArch: %{rust_arches} - rust-net2 ExclusiveArch: %{rust_arches} - rust-netlink-packet-core ExclusiveArch: %{rust_arches} - rust-netlink-packet-route ExclusiveArch: %{rust_arches} - rust-netlink-packet-utils ExclusiveArch: %{rust_arches} - rust-netlink-proto ExclusiveArch: %{rust_arches} - rust-netlink-sys ExclusiveArch: %{rust_arches} - rust-netmap_sys ExclusiveArch: %{rust_arches} - rust-nettle ExclusiveArch: %{rust_arches} - rust-nettle-sys ExclusiveArch: %{rust_arches} - rust-new_debug_unreachable ExclusiveArch: %{rust_arches} - rust-news-flash ExclusiveArch: %{rust_arches} - rust-newsblur_api ExclusiveArch: %{rust_arches} - rust-newtype_derive ExclusiveArch: %{rust_arches} - rust-nibble_vec ExclusiveArch: %{rust_arches} - rust-nix ExclusiveArch: %{rust_arches} - rust-nix0.14 ExclusiveArch: %{rust_arches} - rust-nix0.17 ExclusiveArch: %{rust_arches} - rust-nix0.18 ExclusiveArch: %{rust_arches} - rust-nix0.20 ExclusiveArch: %{rust_arches} - rust-no-panic ExclusiveArch: %{rust_arches} - rust-nodrop ExclusiveArch: %{rust_arches} - rust-nom ExclusiveArch: %{rust_arches} - rust-nom4 ExclusiveArch: %{rust_arches} - rust-nom5 ExclusiveArch: %{rust_arches} - rust-nom6 ExclusiveArch: %{rust_arches} - rust-noop_proc_macro ExclusiveArch: %{rust_arches} - rust-normalize-line-endings ExclusiveArch: %{rust_arches} - rust-notify ExclusiveArch: %{rust_arches} - rust-notify-rust ExclusiveArch: %{rust_arches} - rust-num ExclusiveArch: %{rust_arches} - rust-num-bigint ExclusiveArch: %{rust_arches} - rust-num-bigint-dig ExclusiveArch: %{rust_arches} - rust-num-bigint0.3 ExclusiveArch: %{rust_arches} - rust-num-complex ExclusiveArch: %{rust_arches} - rust-num-complex0.3 ExclusiveArch: %{rust_arches} - rust-num-derive ExclusiveArch: %{rust_arches} - rust-num-format ExclusiveArch: %{rust_arches} - rust-num-integer ExclusiveArch: %{rust_arches} - rust-num-iter ExclusiveArch: %{rust_arches} - rust-num-rational ExclusiveArch: %{rust_arches} - rust-num-rational0.3 ExclusiveArch: %{rust_arches} - rust-num-traits ExclusiveArch: %{rust_arches} - rust-num-traits0.1 ExclusiveArch: %{rust_arches} - rust-num0.3 ExclusiveArch: %{rust_arches} - rust-num_cpus ExclusiveArch: %{rust_arches} - rust-num_enum ExclusiveArch: %{rust_arches} - rust-num_enum_derive ExclusiveArch: %{rust_arches} - rust-number_prefix ExclusiveArch: %{rust_arches} - rust-numtoa ExclusiveArch: %{rust_arches} - rust-oauth2 ExclusiveArch: %{rust_arches} - rust-obfstr ExclusiveArch: %{rust_arches} - rust-obj ExclusiveArch: %{rust_arches} - rust-object ExclusiveArch: %{rust_arches} - rust-odds ExclusiveArch: %{rust_arches} - rust-ogg ExclusiveArch: %{rust_arches} - rust-oid ExclusiveArch: %{rust_arches} - rust-once_cell ExclusiveArch: %{rust_arches} - rust-onig ExclusiveArch: %{rust_arches} - rust-onig_sys ExclusiveArch: %{rust_arches} - rust-oorandom ExclusiveArch: %{rust_arches} - rust-opaque-debug ExclusiveArch: %{rust_arches} - rust-open ExclusiveArch: %{rust_arches} - rust-open1 ExclusiveArch: %{rust_arches} - rust-openat ExclusiveArch: %{rust_arches} - rust-openat-ext ExclusiveArch: %{rust_arches} - rust-opener ExclusiveArch: %{rust_arches} - rust-openssh-keys ExclusiveArch: %{rust_arches} - rust-openssl ExclusiveArch: %{rust_arches} - rust-openssl-probe ExclusiveArch: %{rust_arches} - rust-openssl-sys ExclusiveArch: %{rust_arches} - rust-opml ExclusiveArch: %{rust_arches} - rust-ord_subset ExclusiveArch: %{rust_arches} - rust-ordered-float ExclusiveArch: %{rust_arches} - rust-ordered-multimap ExclusiveArch: %{rust_arches} - rust-os_info ExclusiveArch: %{rust_arches} - rust-os_pipe ExclusiveArch: %{rust_arches} - rust-os_str_bytes ExclusiveArch: %{rust_arches} - rust-os_type ExclusiveArch: %{rust_arches} - rust-osmesa-sys ExclusiveArch: %{rust_arches} - rust-osstrtools ExclusiveArch: %{rust_arches} - rust-ostree ExclusiveArch: %{rust_arches} - rust-ostree-sys ExclusiveArch: %{rust_arches} - rust-ouroboros ExclusiveArch: %{rust_arches} - rust-ouroboros_macro ExclusiveArch: %{rust_arches} - rust-owned-alloc ExclusiveArch: %{rust_arches} - rust-owned_ttf_parser ExclusiveArch: %{rust_arches} - rust-owning_ref ExclusiveArch: %{rust_arches} - rust-oxipng ExclusiveArch: %{rust_arches} - rust-packaging ExclusiveArch: %{rust_arches} - rust-pad ExclusiveArch: %{rust_arches} - rust-page_size ExclusiveArch: %{rust_arches} - rust-pager ExclusiveArch: %{rust_arches} - rust-palette ExclusiveArch: %{rust_arches} - rust-palette_derive ExclusiveArch: %{rust_arches} - rust-pam ExclusiveArch: %{rust_arches} - rust-pam-client ExclusiveArch: %{rust_arches} - rust-pam-sys ExclusiveArch: %{rust_arches} - rust-pancurses ExclusiveArch: %{rust_arches} - rust-pango ExclusiveArch: %{rust_arches} - rust-pango-sys ExclusiveArch: %{rust_arches} - rust-pangocairo ExclusiveArch: %{rust_arches} - rust-pangocairo-sys ExclusiveArch: %{rust_arches} - rust-parity-wasm ExclusiveArch: %{rust_arches} - rust-parking ExclusiveArch: %{rust_arches} - rust-parking_lot ExclusiveArch: %{rust_arches} - rust-parking_lot_core ExclusiveArch: %{rust_arches} - rust-parse-zoneinfo ExclusiveArch: %{rust_arches} - rust-parse_cfg ExclusiveArch: %{rust_arches} - rust-parsec-client ExclusiveArch: %{rust_arches} - rust-parsec-interface ExclusiveArch: %{rust_arches} - rust-partial-io ExclusiveArch: %{rust_arches} - rust-partition-identity ExclusiveArch: %{rust_arches} - rust-paste ExclusiveArch: %{rust_arches} - rust-path-absolutize ExclusiveArch: %{rust_arches} - rust-path-dedot ExclusiveArch: %{rust_arches} - rust-path-slash ExclusiveArch: %{rust_arches} - rust-pathdiff ExclusiveArch: %{rust_arches} - rust-pathfinder_geometry ExclusiveArch: %{rust_arches} - rust-pathfinder_simd ExclusiveArch: %{rust_arches} - rust-pbr ExclusiveArch: %{rust_arches} - rust-pcap ExclusiveArch: %{rust_arches} - rust-pcre2 ExclusiveArch: %{rust_arches} - rust-pcre2-sys ExclusiveArch: %{rust_arches} - rust-peeking_take_while ExclusiveArch: %{rust_arches} - rust-peg ExclusiveArch: %{rust_arches} - rust-peg-macros ExclusiveArch: %{rust_arches} - rust-peg-runtime ExclusiveArch: %{rust_arches} - rust-peg0.5 ExclusiveArch: %{rust_arches} - rust-pem ExclusiveArch: %{rust_arches} - rust-pem0.8 ExclusiveArch: %{rust_arches} - rust-percent-encoding ExclusiveArch: %{rust_arches} - rust-percent-encoding1 ExclusiveArch: %{rust_arches} - rust-peresil ExclusiveArch: %{rust_arches} - rust-permutate ExclusiveArch: %{rust_arches} - rust-permutohedron ExclusiveArch: %{rust_arches} - rust-pest ExclusiveArch: %{rust_arches} - rust-pest_derive ExclusiveArch: %{rust_arches} - rust-pest_generator ExclusiveArch: %{rust_arches} - rust-pest_meta ExclusiveArch: %{rust_arches} - rust-petgraph ExclusiveArch: %{rust_arches} - rust-phf ExclusiveArch: %{rust_arches} - rust-phf0.7 ExclusiveArch: %{rust_arches} - rust-phf_codegen ExclusiveArch: %{rust_arches} - rust-phf_codegen0.7 ExclusiveArch: %{rust_arches} - rust-phf_generator ExclusiveArch: %{rust_arches} - rust-phf_generator0.7 ExclusiveArch: %{rust_arches} - rust-phf_macros ExclusiveArch: %{rust_arches} - rust-phf_macros0.7 ExclusiveArch: %{rust_arches} - rust-phf_shared ExclusiveArch: %{rust_arches} - rust-phf_shared0.7 ExclusiveArch: %{rust_arches} - rust-picky-asn1 ExclusiveArch: %{rust_arches} - rust-picky-asn1-der ExclusiveArch: %{rust_arches} - rust-picky-asn1-x509 ExclusiveArch: %{rust_arches} - rust-pico-args ExclusiveArch: %{rust_arches} - rust-pid ExclusiveArch: %{rust_arches} - rust-pin-project ExclusiveArch: %{rust_arches} - rust-pin-project-internal ExclusiveArch: %{rust_arches} - rust-pin-project-internal0.4 ExclusiveArch: %{rust_arches} - rust-pin-project-lite ExclusiveArch: %{rust_arches} - rust-pin-project-lite0.1 ExclusiveArch: %{rust_arches} - rust-pin-project0.4 ExclusiveArch: %{rust_arches} - rust-pin-utils ExclusiveArch: %{rust_arches} - rust-pipe ExclusiveArch: %{rust_arches} - rust-piper ExclusiveArch: %{rust_arches} - rust-pkcs11 ExclusiveArch: %{rust_arches} - rust-pkg-config ExclusiveArch: %{rust_arches} - rust-plain ExclusiveArch: %{rust_arches} - rust-pleaser ExclusiveArch: %{rust_arches} - rust-plist ExclusiveArch: %{rust_arches} - rust-plotlib ExclusiveArch: %{rust_arches} - rust-plotters ExclusiveArch: %{rust_arches} - rust-plotters-backend ExclusiveArch: %{rust_arches} - rust-plotters-bitmap ExclusiveArch: %{rust_arches} - rust-plotters-svg ExclusiveArch: %{rust_arches} - rust-plugin ExclusiveArch: %{rust_arches} - rust-pnet_base ExclusiveArch: %{rust_arches} - rust-pnet_datalink ExclusiveArch: %{rust_arches} - rust-pnet_sys ExclusiveArch: %{rust_arches} - rust-png ExclusiveArch: %{rust_arches} - rust-podio ExclusiveArch: %{rust_arches} - rust-polling ExclusiveArch: %{rust_arches} - rust-polyval ExclusiveArch: %{rust_arches} - rust-pom ExclusiveArch: %{rust_arches} - rust-pommes ExclusiveArch: %{rust_arches} - rust-posish ExclusiveArch: %{rust_arches} - rust-ppv-lite86 ExclusiveArch: %{rust_arches} - rust-pq-sys ExclusiveArch: %{rust_arches} - rust-precomputed-hash ExclusiveArch: %{rust_arches} - rust-predicates ExclusiveArch: %{rust_arches} - rust-predicates-core ExclusiveArch: %{rust_arches} - rust-predicates-tree ExclusiveArch: %{rust_arches} - rust-predicates1 ExclusiveArch: %{rust_arches} - rust-pretty-git-prompt ExclusiveArch: %{rust_arches} - rust-pretty-hex ExclusiveArch: %{rust_arches} - rust-pretty_assertions ExclusiveArch: %{rust_arches} - rust-pretty_assertions0.6 ExclusiveArch: %{rust_arches} - rust-pretty_env_logger ExclusiveArch: %{rust_arches} - rust-prettytable-rs ExclusiveArch: %{rust_arches} - rust-proc-macro-crate ExclusiveArch: %{rust_arches} - rust-proc-macro-crate0.1 ExclusiveArch: %{rust_arches} - rust-proc-macro-error ExclusiveArch: %{rust_arches} - rust-proc-macro-error-attr ExclusiveArch: %{rust_arches} - rust-proc-macro-hack ExclusiveArch: %{rust_arches} - rust-proc-macro2 ExclusiveArch: %{rust_arches} - rust-proc-macro2-0.4 ExclusiveArch: %{rust_arches} - rust-proc-maps ExclusiveArch: %{rust_arches} - rust-proc-mounts ExclusiveArch: %{rust_arches} - rust-proc-quote-impl ExclusiveArch: %{rust_arches} - rust-procedural-masquerade ExclusiveArch: %{rust_arches} - rust-process_control ExclusiveArch: %{rust_arches} - rust-process_path ExclusiveArch: %{rust_arches} - rust-procfs ExclusiveArch: %{rust_arches} - rust-procs ExclusiveArch: %{rust_arches} - rust-progress-streams ExclusiveArch: %{rust_arches} - rust-prometheus ExclusiveArch: %{rust_arches} - rust-proptest ExclusiveArch: %{rust_arches} - rust-proptest-derive ExclusiveArch: %{rust_arches} - rust-proptest0.10 ExclusiveArch: %{rust_arches} - rust-prost ExclusiveArch: %{rust_arches} - rust-prost-build ExclusiveArch: %{rust_arches} - rust-prost-derive ExclusiveArch: %{rust_arches} - rust-prost-types ExclusiveArch: %{rust_arches} - rust-protobuf ExclusiveArch: %{rust_arches} - rust-protobuf-codegen ExclusiveArch: %{rust_arches} - rust-protobuf-codegen-pure ExclusiveArch: %{rust_arches} - rust-protoc ExclusiveArch: %{rust_arches} - rust-protoc-rust ExclusiveArch: %{rust_arches} - rust-psa-crypto ExclusiveArch: %{rust_arches} - rust-psa-crypto-sys ExclusiveArch: %{rust_arches} - rust-psd ExclusiveArch: %{rust_arches} - rust-psm ExclusiveArch: %{rust_arches} - rust-ptr_meta ExclusiveArch: %{rust_arches} - rust-ptr_meta_derive ExclusiveArch: %{rust_arches} - rust-publicsuffix ExclusiveArch: %{rust_arches} - rust-pulldown-cmark ExclusiveArch: %{rust_arches} - rust-pulse ExclusiveArch: %{rust_arches} - rust-pure-rust-locales ExclusiveArch: %{rust_arches} - rust-pyo3 ExclusiveArch: %{rust_arches} - rust-pyo3-build-config ExclusiveArch: %{rust_arches} - rust-pyo3-macros ExclusiveArch: %{rust_arches} - rust-pyo3-macros-backend ExclusiveArch: %{rust_arches} - rust-python-launcher ExclusiveArch: %{rust_arches} - rust-python3-sys ExclusiveArch: %{rust_arches} - rust-qr2term ExclusiveArch: %{rust_arches} - rust-qrcode ExclusiveArch: %{rust_arches} - rust-qstring ExclusiveArch: %{rust_arches} - rust-quad-rand ExclusiveArch: %{rust_arches} - rust-quantiles ExclusiveArch: %{rust_arches} - rust-quick-error ExclusiveArch: %{rust_arches} - rust-quick-error1 ExclusiveArch: %{rust_arches} - rust-quick-xml ExclusiveArch: %{rust_arches} - rust-quick-xml0.20 ExclusiveArch: %{rust_arches} - rust-quickcheck ExclusiveArch: %{rust_arches} - rust-quickcheck0.6 ExclusiveArch: %{rust_arches} - rust-quickcheck0.9 ExclusiveArch: %{rust_arches} - rust-quickcheck_macros ExclusiveArch: %{rust_arches} - rust-quickersort ExclusiveArch: %{rust_arches} - rust-quote ExclusiveArch: %{rust_arches} - rust-quote0.3 ExclusiveArch: %{rust_arches} - rust-quote0.6 ExclusiveArch: %{rust_arches} - rust-quoted_printable ExclusiveArch: %{rust_arches} - rust-r2d2 ExclusiveArch: %{rust_arches} - rust-radium ExclusiveArch: %{rust_arches} - rust-radix64 ExclusiveArch: %{rust_arches} - rust-radix_trie ExclusiveArch: %{rust_arches} - rust-rand ExclusiveArch: %{rust_arches} - rust-rand0.4 ExclusiveArch: %{rust_arches} - rust-rand0.5 ExclusiveArch: %{rust_arches} - rust-rand0.6 ExclusiveArch: %{rust_arches} - rust-rand0.7 ExclusiveArch: %{rust_arches} - rust-rand_chacha ExclusiveArch: %{rust_arches} - rust-rand_chacha0.1 ExclusiveArch: %{rust_arches} - rust-rand_chacha0.2 ExclusiveArch: %{rust_arches} - rust-rand_core ExclusiveArch: %{rust_arches} - rust-rand_core0.3 ExclusiveArch: %{rust_arches} - rust-rand_core0.4 ExclusiveArch: %{rust_arches} - rust-rand_core0.5 ExclusiveArch: %{rust_arches} - rust-rand_distr ExclusiveArch: %{rust_arches} - rust-rand_hc ExclusiveArch: %{rust_arches} - rust-rand_hc0.1 ExclusiveArch: %{rust_arches} - rust-rand_isaac ExclusiveArch: %{rust_arches} - rust-rand_isaac0.1 ExclusiveArch: %{rust_arches} - rust-rand_isaac0.2 ExclusiveArch: %{rust_arches} - rust-rand_jitter ExclusiveArch: %{rust_arches} - rust-rand_jitter0.1 ExclusiveArch: %{rust_arches} - rust-rand_os ExclusiveArch: %{rust_arches} - rust-rand_os0.1 ExclusiveArch: %{rust_arches} - rust-rand_pcg ExclusiveArch: %{rust_arches} - rust-rand_pcg0.1 ExclusiveArch: %{rust_arches} - rust-rand_pcg0.2 ExclusiveArch: %{rust_arches} - rust-rand_xorshift ExclusiveArch: %{rust_arches} - rust-rand_xorshift0.1 ExclusiveArch: %{rust_arches} - rust-rand_xorshift0.2 ExclusiveArch: %{rust_arches} - rust-rand_xoshiro ExclusiveArch: %{rust_arches} - rust-random-fast-rng ExclusiveArch: %{rust_arches} - rust-random-trait ExclusiveArch: %{rust_arches} - rust-randomize ExclusiveArch: %{rust_arches} - rust-rav1e ExclusiveArch: %{rust_arches} - rust-raw-window-handle ExclusiveArch: %{rust_arches} - rust-rawpointer ExclusiveArch: %{rust_arches} - rust-rawslice ExclusiveArch: %{rust_arches} - rust-rayon ExclusiveArch: %{rust_arches} - rust-rayon-core ExclusiveArch: %{rust_arches} - rust-rbspy ExclusiveArch: %{rust_arches} - rust-rbspy-ruby-structs ExclusiveArch: %{rust_arches} - rust-rbspy-testdata ExclusiveArch: %{rust_arches} - rust-rd-agent ExclusiveArch: %{rust_arches} - rust-rd-agent-intf ExclusiveArch: %{rust_arches} - rust-rd-hashd ExclusiveArch: %{rust_arches} - rust-rd-hashd-intf ExclusiveArch: %{rust_arches} - rust-rd-util ExclusiveArch: %{rust_arches} - rust-read-process-memory ExclusiveArch: %{rust_arches} - rust-read_input ExclusiveArch: %{rust_arches} - rust-readability-fork ExclusiveArch: %{rust_arches} - rust-readwrite ExclusiveArch: %{rust_arches} - rust-recycler ExclusiveArch: %{rust_arches} - rust-ref-cast ExclusiveArch: %{rust_arches} - rust-ref-cast-impl ExclusiveArch: %{rust_arches} - rust-regalloc ExclusiveArch: %{rust_arches} - rust-regex ExclusiveArch: %{rust_arches} - rust-regex-automata ExclusiveArch: %{rust_arches} - rust-regex-syntax ExclusiveArch: %{rust_arches} - rust-region ExclusiveArch: %{rust_arches} - rust-relative-path ExclusiveArch: %{rust_arches} - rust-relay ExclusiveArch: %{rust_arches} - rust-remoteprocess ExclusiveArch: %{rust_arches} - rust-remove_dir_all ExclusiveArch: %{rust_arches} - rust-rend ExclusiveArch: %{rust_arches} - rust-rental ExclusiveArch: %{rust_arches} - rust-rental-impl ExclusiveArch: %{rust_arches} - rust-reqwest ExclusiveArch: %{rust_arches} - rust-reqwest0.10 ExclusiveArch: %{rust_arches} - rust-resctl-bench ExclusiveArch: %{rust_arches} - rust-resctl-bench-intf ExclusiveArch: %{rust_arches} - rust-resctl-demo ExclusiveArch: %{rust_arches} - rust-resize ExclusiveArch: %{rust_arches} - rust-resolv-conf ExclusiveArch: %{rust_arches} - rust-restson ExclusiveArch: %{rust_arches} - rust-retry ExclusiveArch: %{rust_arches} - rust-rgb ExclusiveArch: %{rust_arches} - rust-ring ExclusiveArch: %{rust_arches} - rust-ripgrep ExclusiveArch: %{rust_arches} - rust-rkyv ExclusiveArch: %{rust_arches} - rust-rkyv_derive ExclusiveArch: %{rust_arches} - rust-rle-decode-fast ExclusiveArch: %{rust_arches} - rust-rmp ExclusiveArch: %{rust_arches} - rust-rmp-serde ExclusiveArch: %{rust_arches} - rust-rodio ExclusiveArch: %{rust_arches} - rust-roff ExclusiveArch: %{rust_arches} - rust-ron ExclusiveArch: %{rust_arches} - rust-roxmltree ExclusiveArch: %{rust_arches} - rust-rpassword ExclusiveArch: %{rust_arches} - rust-rpick ExclusiveArch: %{rust_arches} - rust-rsa ExclusiveArch: %{rust_arches} - rust-rspec ExclusiveArch: %{rust_arches} - rust-rtnetlink ExclusiveArch: %{rust_arches} - rust-rudo ExclusiveArch: %{rust_arches} - rust-ruma ExclusiveArch: %{rust_arches} - rust-ruma-api ExclusiveArch: %{rust_arches} - rust-ruma-api-macros ExclusiveArch: %{rust_arches} - rust-ruma-appservice-api ExclusiveArch: %{rust_arches} - rust-ruma-client-api ExclusiveArch: %{rust_arches} - rust-ruma-common ExclusiveArch: %{rust_arches} - rust-ruma-events ExclusiveArch: %{rust_arches} - rust-ruma-events-macros ExclusiveArch: %{rust_arches} - rust-ruma-federation-api ExclusiveArch: %{rust_arches} - rust-ruma-identifiers ExclusiveArch: %{rust_arches} - rust-ruma-identifiers-macros ExclusiveArch: %{rust_arches} - rust-ruma-identifiers-validation ExclusiveArch: %{rust_arches} - rust-ruma-identity-service-api ExclusiveArch: %{rust_arches} - rust-ruma-push-gateway-api ExclusiveArch: %{rust_arches} - rust-ruma-serde ExclusiveArch: %{rust_arches} - rust-ruma-serde-macros ExclusiveArch: %{rust_arches} - rust-ruma-signatures ExclusiveArch: %{rust_arches} - rust-rusqlite ExclusiveArch: %{rust_arches} - rust-rust-embed ExclusiveArch: %{rust_arches} - rust-rust-embed-impl ExclusiveArch: %{rust_arches} - rust-rust-embed-utils ExclusiveArch: %{rust_arches} - rust-rust-ini ExclusiveArch: %{rust_arches} - rust-rust-stemmers ExclusiveArch: %{rust_arches} - rust-rust_decimal ExclusiveArch: %{rust_arches} - rust-rust_hawktracer ExclusiveArch: %{rust_arches} - rust-rust_hawktracer_normal_macro ExclusiveArch: %{rust_arches} - rust-rust_hawktracer_proc_macro ExclusiveArch: %{rust_arches} - rust-rust_hawktracer_sys ExclusiveArch: %{rust_arches} - rust-rustbus ExclusiveArch: %{rust_arches} - rust-rustbus_derive ExclusiveArch: %{rust_arches} - rust-rustc-demangle ExclusiveArch: %{rust_arches} - rust-rustc-hash ExclusiveArch: %{rust_arches} - rust-rustc-serialize ExclusiveArch: %{rust_arches} - rust-rustc-test ExclusiveArch: %{rust_arches} - rust-rustc_tools_util ExclusiveArch: %{rust_arches} - rust-rustc_version ExclusiveArch: %{rust_arches} - rust-rustc_version0.3 ExclusiveArch: %{rust_arches} - rust-rustdoc-stripper ExclusiveArch: %{rust_arches} - rust-rustfilt ExclusiveArch: %{rust_arches} - rust-rustfix ExclusiveArch: %{rust_arches} - rust-rustio ExclusiveArch: %{rust_arches} - rust-rustix ExclusiveArch: %{rust_arches} - rust-rustls ExclusiveArch: %{rust_arches} - rust-rustls-native-certs ExclusiveArch: %{rust_arches} - rust-rusttype ExclusiveArch: %{rust_arches} - rust-rustversion ExclusiveArch: %{rust_arches} - rust-rusty-fork ExclusiveArch: %{rust_arches} - rust-rustyline ExclusiveArch: %{rust_arches} - rust-rustyline-derive ExclusiveArch: %{rust_arches} - rust-ryu ExclusiveArch: %{rust_arches} - rust-safe-transmute ExclusiveArch: %{rust_arches} - rust-safe_arch ExclusiveArch: %{rust_arches} - rust-safemem ExclusiveArch: %{rust_arches} - rust-same-file ExclusiveArch: %{rust_arches} - rust-sapp-kms ExclusiveArch: %{rust_arches} - rust-sapp-linux ExclusiveArch: %{rust_arches} - rust-sass-rs ExclusiveArch: %{rust_arches} - rust-sass-sys ExclusiveArch: %{rust_arches} - rust-scan_fmt ExclusiveArch: %{rust_arches} - rust-scheduled-thread-pool ExclusiveArch: %{rust_arches} - rust-scoped-tls ExclusiveArch: %{rust_arches} - rust-scoped-tls-hkt ExclusiveArch: %{rust_arches} - rust-scoped_threadpool ExclusiveArch: %{rust_arches} - rust-scopeguard ExclusiveArch: %{rust_arches} - rust-scopetime ExclusiveArch: %{rust_arches} - rust-scratch ExclusiveArch: %{rust_arches} - rust-scroll ExclusiveArch: %{rust_arches} - rust-scroll_derive ExclusiveArch: %{rust_arches} - rust-sct ExclusiveArch: %{rust_arches} - rust-sd ExclusiveArch: %{rust_arches} - rust-sd-notify ExclusiveArch: %{rust_arches} - rust-seahash ExclusiveArch: %{rust_arches} - rust-seahash3 ExclusiveArch: %{rust_arches} - rust-secrecy ExclusiveArch: %{rust_arches} - rust-secret-service ExclusiveArch: %{rust_arches} - rust-self_cell ExclusiveArch: %{rust_arches} - rust-semver ExclusiveArch: %{rust_arches} - rust-semver-parser ExclusiveArch: %{rust_arches} - rust-semver-parser0.9 ExclusiveArch: %{rust_arches} - rust-semver0.11 ExclusiveArch: %{rust_arches} - rust-sequoia-autocrypt ExclusiveArch: %{rust_arches} - rust-sequoia-ipc ExclusiveArch: %{rust_arches} - rust-sequoia-keyring-linter ExclusiveArch: %{rust_arches} - rust-sequoia-net ExclusiveArch: %{rust_arches} - rust-sequoia-octopus-librnp ExclusiveArch: %{rust_arches} - rust-sequoia-openpgp ExclusiveArch: %{rust_arches} - rust-sequoia-sop ExclusiveArch: %{rust_arches} - rust-sequoia-sq ExclusiveArch: %{rust_arches} - rust-sequoia-sqv ExclusiveArch: %{rust_arches} - rust-serde ExclusiveArch: %{rust_arches} - rust-serde-big-array ExclusiveArch: %{rust_arches} - rust-serde-pickle ExclusiveArch: %{rust_arches} - rust-serde-value ExclusiveArch: %{rust_arches} - rust-serde-xml-rs ExclusiveArch: %{rust_arches} - rust-serde_bser ExclusiveArch: %{rust_arches} - rust-serde_bytes ExclusiveArch: %{rust_arches} - rust-serde_cbor ExclusiveArch: %{rust_arches} - rust-serde_derive ExclusiveArch: %{rust_arches} - rust-serde_fmt ExclusiveArch: %{rust_arches} - rust-serde_ignored ExclusiveArch: %{rust_arches} - rust-serde_json ExclusiveArch: %{rust_arches} - rust-serde_repr ExclusiveArch: %{rust_arches} - rust-serde_stacker ExclusiveArch: %{rust_arches} - rust-serde_test ExclusiveArch: %{rust_arches} - rust-serde_url_params ExclusiveArch: %{rust_arches} - rust-serde_urlencoded ExclusiveArch: %{rust_arches} - rust-serde_urlencoded0.6 ExclusiveArch: %{rust_arches} - rust-serde_with ExclusiveArch: %{rust_arches} - rust-serde_with_macros ExclusiveArch: %{rust_arches} - rust-serde_yaml ExclusiveArch: %{rust_arches} - rust-serial-core ExclusiveArch: %{rust_arches} - rust-serial_test ExclusiveArch: %{rust_arches} - rust-serial_test_derive ExclusiveArch: %{rust_arches} - rust-servo-fontconfig ExclusiveArch: %{rust_arches} - rust-servo-fontconfig-sys ExclusiveArch: %{rust_arches} - rust-sev ExclusiveArch: %{rust_arches} - rust-sevctl ExclusiveArch: %{rust_arches} - rust-sha-1 ExclusiveArch: %{rust_arches} - rust-sha1 ExclusiveArch: %{rust_arches} - rust-sha1collisiondetection ExclusiveArch: %{rust_arches} - rust-sha2 ExclusiveArch: %{rust_arches} - rust-sha3 ExclusiveArch: %{rust_arches} - rust-shadow-rs ExclusiveArch: %{rust_arches} - rust-shared_child ExclusiveArch: %{rust_arches} - rust-shared_library ExclusiveArch: %{rust_arches} - rust-shell-escape ExclusiveArch: %{rust_arches} - rust-shell-words ExclusiveArch: %{rust_arches} - rust-shellexpand ExclusiveArch: %{rust_arches} - rust-shellwords ExclusiveArch: %{rust_arches} - rust-shlex ExclusiveArch: %{rust_arches} - rust-signal-hook ExclusiveArch: %{rust_arches} - rust-signal-hook-mio ExclusiveArch: %{rust_arches} - rust-signal-hook-registry ExclusiveArch: %{rust_arches} - rust-signal-hook0.1 ExclusiveArch: %{rust_arches} - rust-signature ExclusiveArch: x86_64 aarch64 - rust-silver ExclusiveArch: %{rust_arches} - rust-simba ExclusiveArch: %{rust_arches} - rust-simd_helpers ExclusiveArch: %{rust_arches} - rust-simdutf8 ExclusiveArch: %{rust_arches} - rust-similar ExclusiveArch: %{rust_arches} - rust-similar-asserts ExclusiveArch: %{rust_arches} - rust-simple-error ExclusiveArch: %{rust_arches} - rust-simple_asn1 ExclusiveArch: %{rust_arches} - rust-simple_logger ExclusiveArch: %{rust_arches} - rust-simplelog ExclusiveArch: %{rust_arches} - rust-siphasher ExclusiveArch: %{rust_arches} - rust-size ExclusiveArch: %{rust_arches} - rust-sized-chunks ExclusiveArch: %{rust_arches} - rust-skeptic ExclusiveArch: %{rust_arches} - rust-skim ExclusiveArch: %{rust_arches} - rust-slab ExclusiveArch: %{rust_arches} - rust-slice-deque ExclusiveArch: %{rust_arches} - rust-slog ExclusiveArch: %{rust_arches} - rust-slog-async ExclusiveArch: %{rust_arches} - rust-slog-scope ExclusiveArch: %{rust_arches} - rust-slog-term ExclusiveArch: %{rust_arches} - rust-slotmap ExclusiveArch: %{rust_arches} - rust-slug ExclusiveArch: %{rust_arches} - rust-sluice ExclusiveArch: %{rust_arches} - rust-smallbitvec ExclusiveArch: %{rust_arches} - rust-smallstr ExclusiveArch: %{rust_arches} - rust-smallvec ExclusiveArch: %{rust_arches} - rust-smart-default ExclusiveArch: %{rust_arches} - rust-smawk ExclusiveArch: %{rust_arches} - rust-smithay-client-toolkit ExclusiveArch: %{rust_arches} - rust-smithay-client-toolkit0.12 ExclusiveArch: %{rust_arches} - rust-smithay-clipboard ExclusiveArch: %{rust_arches} - rust-snafu ExclusiveArch: %{rust_arches} - rust-snafu-derive ExclusiveArch: %{rust_arches} - rust-snake_case ExclusiveArch: %{rust_arches} - rust-socket2 ExclusiveArch: %{rust_arches} - rust-socket2_0.3 ExclusiveArch: %{rust_arches} - rust-sop ExclusiveArch: %{rust_arches} - rust-soup-sys ExclusiveArch: %{rust_arches} - rust-spin ExclusiveArch: %{rust_arches} - rust-spin_on ExclusiveArch: %{rust_arches} - rust-spinning_top ExclusiveArch: %{rust_arches} - rust-spmc ExclusiveArch: %{rust_arches} - rust-ssh-key-dir ExclusiveArch: %{rust_arches} - rust-stable_deref_trait ExclusiveArch: %{rust_arches} - rust-stacker ExclusiveArch: %{rust_arches} - rust-standback ExclusiveArch: %{rust_arches} - rust-starship ExclusiveArch: %{rust_arches} - rust-starship_module_config_derive ExclusiveArch: %{rust_arches} - rust-static_assertions ExclusiveArch: %{rust_arches} - rust-statistical ExclusiveArch: %{rust_arches} - rust-statrs ExclusiveArch: %{rust_arches} - rust-stb_truetype ExclusiveArch: %{rust_arches} - rust-stderrlog ExclusiveArch: %{rust_arches} - rust-str_stack ExclusiveArch: %{rust_arches} - rust-stratisd_proc_macros ExclusiveArch: %{rust_arches} - rust-streaming-stats ExclusiveArch: %{rust_arches} - rust-streebog ExclusiveArch: %{rust_arches} - rust-string ExclusiveArch: %{rust_arches} - rust-string_cache ExclusiveArch: %{rust_arches} - rust-string_cache_codegen ExclusiveArch: %{rust_arches} - rust-string_cache_shared ExclusiveArch: %{rust_arches} - rust-strings ExclusiveArch: %{rust_arches} - rust-strip-ansi-escapes ExclusiveArch: %{rust_arches} - rust-strong-xml ExclusiveArch: %{rust_arches} - rust-strong-xml-derive ExclusiveArch: %{rust_arches} - rust-strsim ExclusiveArch: %{rust_arches} - rust-structopt ExclusiveArch: %{rust_arches} - rust-structopt-derive ExclusiveArch: %{rust_arches} - rust-structopt-derive0.2 ExclusiveArch: %{rust_arches} - rust-structopt0.2 ExclusiveArch: %{rust_arches} - rust-strum ExclusiveArch: %{rust_arches} - rust-strum_macros ExclusiveArch: %{rust_arches} - rust-subprocess ExclusiveArch: %{rust_arches} - rust-subtle ExclusiveArch: %{rust_arches} - rust-sudo_plugin ExclusiveArch: %{rust_arches} - rust-sudo_plugin-sys ExclusiveArch: %{rust_arches} - rust-sval ExclusiveArch: %{rust_arches} - rust-sval_derive ExclusiveArch: %{rust_arches} - rust-sval_json ExclusiveArch: %{rust_arches} - rust-svg ExclusiveArch: %{rust_arches} - rust-svg_metadata ExclusiveArch: %{rust_arches} - rust-svgfilters ExclusiveArch: %{rust_arches} - rust-svgtypes ExclusiveArch: %{rust_arches} - rust-sxd-document ExclusiveArch: %{rust_arches} - rust-syn ExclusiveArch: %{rust_arches} - rust-syn0.15 ExclusiveArch: %{rust_arches} - rust-synom ExclusiveArch: %{rust_arches} - rust-synstructure ExclusiveArch: %{rust_arches} - rust-syntect ExclusiveArch: %{rust_arches} - rust-sys-info ExclusiveArch: %{rust_arches} - rust-sysctl ExclusiveArch: %{rust_arches} - rust-sysinfo ExclusiveArch: %{rust_arches} - rust-syslog ExclusiveArch: %{rust_arches} - rust-system-deps ExclusiveArch: %{rust_arches} - rust-system76_ectool ExclusiveArch: %{rust_arches} - rust-systemd ExclusiveArch: %{rust_arches} - rust-tabular ExclusiveArch: %{rust_arches} - rust-tabwriter ExclusiveArch: %{rust_arches} - rust-take ExclusiveArch: %{rust_arches} - rust-take_mut ExclusiveArch: %{rust_arches} - rust-takeable ExclusiveArch: %{rust_arches} - rust-takeable-option ExclusiveArch: %{rust_arches} - rust-tap ExclusiveArch: %{rust_arches} - rust-tar ExclusiveArch: %{rust_arches} - rust-target ExclusiveArch: %{rust_arches} - rust-target-lexicon ExclusiveArch: %{rust_arches} - rust-tealdeer ExclusiveArch: %{rust_arches} - rust-teloxide ExclusiveArch: %{rust_arches} - rust-teloxide-macros ExclusiveArch: %{rust_arches} - rust-tempdir ExclusiveArch: %{rust_arches} - rust-tempfile ExclusiveArch: %{rust_arches} - rust-temptree ExclusiveArch: %{rust_arches} - rust-tendril ExclusiveArch: %{rust_arches} - rust-tera ExclusiveArch: %{rust_arches} - rust-term ExclusiveArch: %{rust_arches} - rust-term0.6 ExclusiveArch: %{rust_arches} - rust-term_grid ExclusiveArch: %{rust_arches} - rust-term_size ExclusiveArch: %{rust_arches} - rust-termcolor ExclusiveArch: %{rust_arches} - rust-terminal_size ExclusiveArch: %{rust_arches} - rust-terminfo ExclusiveArch: %{rust_arches} - rust-termion ExclusiveArch: %{rust_arches} - rust-termios ExclusiveArch: %{rust_arches} - rust-test-assembler ExclusiveArch: %{rust_arches} - rust-test-case ExclusiveArch: %{rust_arches} - rust-tester ExclusiveArch: %{rust_arches} - rust-testing_logger ExclusiveArch: %{rust_arches} - rust-textwrap ExclusiveArch: %{rust_arches} - rust-textwrap0.11 ExclusiveArch: %{rust_arches} - rust-textwrap0.12 ExclusiveArch: %{rust_arches} - rust-thiserror ExclusiveArch: %{rust_arches} - rust-thiserror-impl ExclusiveArch: %{rust_arches} - rust-thread-id ExclusiveArch: %{rust_arches} - rust-thread-tree ExclusiveArch: %{rust_arches} - rust-thread_local ExclusiveArch: %{rust_arches} - rust-threadpool ExclusiveArch: %{rust_arches} - rust-tiff ExclusiveArch: %{rust_arches} - rust-tiger ExclusiveArch: %{rust_arches} - rust-time ExclusiveArch: %{rust_arches} - rust-time-macros ExclusiveArch: %{rust_arches} - rust-time-macros-impl ExclusiveArch: %{rust_arches} - rust-time-macros0.1 ExclusiveArch: %{rust_arches} - rust-time0.1 ExclusiveArch: %{rust_arches} - rust-time0.2 ExclusiveArch: %{rust_arches} - rust-timebomb ExclusiveArch: %{rust_arches} - rust-timer ExclusiveArch: %{rust_arches} - rust-timerfd ExclusiveArch: %{rust_arches} - rust-tiny-keccak ExclusiveArch: %{rust_arches} - rust-tiny_http ExclusiveArch: %{rust_arches} - rust-tiny_http0.6 ExclusiveArch: %{rust_arches} - rust-tinyfiledialogs ExclusiveArch: %{rust_arches} - rust-tinystr ExclusiveArch: %{rust_arches} - rust-tinytemplate ExclusiveArch: %{rust_arches} - rust-tinyvec ExclusiveArch: %{rust_arches} - rust-tinyvec_macros ExclusiveArch: %{rust_arches} - rust-tokei ExclusiveArch: %{rust_arches} - rust-tokio ExclusiveArch: %{rust_arches} - rust-tokio-codec ExclusiveArch: %{rust_arches} - rust-tokio-core ExclusiveArch: %{rust_arches} - rust-tokio-current-thread ExclusiveArch: %{rust_arches} - rust-tokio-executor ExclusiveArch: %{rust_arches} - rust-tokio-fs ExclusiveArch: %{rust_arches} - rust-tokio-io ExclusiveArch: %{rust_arches} - rust-tokio-macros ExclusiveArch: %{rust_arches} - rust-tokio-macros0.2 ExclusiveArch: %{rust_arches} - rust-tokio-mock-task ExclusiveArch: %{rust_arches} - rust-tokio-native-tls ExclusiveArch: %{rust_arches} - rust-tokio-openssl ExclusiveArch: %{rust_arches} - rust-tokio-openssl0.4 ExclusiveArch: %{rust_arches} - rust-tokio-reactor ExclusiveArch: %{rust_arches} - rust-tokio-rustls ExclusiveArch: %{rust_arches} - rust-tokio-socks ExclusiveArch: %{rust_arches} - rust-tokio-socks0.3 ExclusiveArch: %{rust_arches} - rust-tokio-stream ExclusiveArch: %{rust_arches} - rust-tokio-sync ExclusiveArch: %{rust_arches} - rust-tokio-tcp ExclusiveArch: %{rust_arches} - rust-tokio-test ExclusiveArch: %{rust_arches} - rust-tokio-threadpool ExclusiveArch: %{rust_arches} - rust-tokio-timer ExclusiveArch: %{rust_arches} - rust-tokio-tls ExclusiveArch: %{rust_arches} - rust-tokio-tls0.2 ExclusiveArch: %{rust_arches} - rust-tokio-tungstenite ExclusiveArch: %{rust_arches} - rust-tokio-udp ExclusiveArch: %{rust_arches} - rust-tokio-uds ExclusiveArch: %{rust_arches} - rust-tokio-util ExclusiveArch: %{rust_arches} - rust-tokio-util0.3 ExclusiveArch: %{rust_arches} - rust-tokio0.1 ExclusiveArch: %{rust_arches} - rust-tokio0.2 ExclusiveArch: %{rust_arches} - rust-toml ExclusiveArch: %{rust_arches} - rust-toml0.4 ExclusiveArch: %{rust_arches} - rust-toml_edit ExclusiveArch: %{rust_arches} - rust-tower-layer ExclusiveArch: %{rust_arches} - rust-tower-service ExclusiveArch: %{rust_arches} - rust-tower-test ExclusiveArch: %{rust_arches} - rust-tower-util ExclusiveArch: %{rust_arches} - rust-tpm2-policy ExclusiveArch: %{rust_arches} - rust-tracing ExclusiveArch: %{rust_arches} - rust-tracing-attributes ExclusiveArch: %{rust_arches} - rust-tracing-core ExclusiveArch: %{rust_arches} - rust-tracing-futures ExclusiveArch: %{rust_arches} - rust-traitobject ExclusiveArch: %{rust_arches} - rust-trash ExclusiveArch: %{rust_arches} - rust-treebitmap ExclusiveArch: %{rust_arches} - rust-treeline ExclusiveArch: %{rust_arches} - rust-trust-dns-https ExclusiveArch: %{rust_arches} - rust-trust-dns-native-tls ExclusiveArch: %{rust_arches} - rust-trust-dns-native-tls0.19 ExclusiveArch: %{rust_arches} - rust-trust-dns-openssl ExclusiveArch: %{rust_arches} - rust-trust-dns-openssl0.19 ExclusiveArch: %{rust_arches} - rust-trust-dns-proto ExclusiveArch: %{rust_arches} - rust-trust-dns-proto0.19 ExclusiveArch: %{rust_arches} - rust-trust-dns-resolver ExclusiveArch: %{rust_arches} - rust-trust-dns-resolver0.19 ExclusiveArch: %{rust_arches} - rust-trust-dns-rustls ExclusiveArch: %{rust_arches} - rust-try-lock ExclusiveArch: %{rust_arches} - rust-trybuild ExclusiveArch: %{rust_arches} - rust-tss-esapi ExclusiveArch: %{rust_arches} - rust-tss-esapi-sys ExclusiveArch: %{rust_arches} - rust-ttf-parser ExclusiveArch: %{rust_arches} - rust-tui ExclusiveArch: %{rust_arches} - rust-tui-react ExclusiveArch: %{rust_arches} - rust-tui0.11 ExclusiveArch: %{rust_arches} - rust-tui0.9 ExclusiveArch: %{rust_arches} - rust-tuikit ExclusiveArch: %{rust_arches} - rust-tungstenite ExclusiveArch: %{rust_arches} - rust-twoway ExclusiveArch: %{rust_arches} - rust-type-map ExclusiveArch: %{rust_arches} - rust-typeable ExclusiveArch: %{rust_arches} - rust-typed-arena ExclusiveArch: %{rust_arches} - rust-typemap ExclusiveArch: %{rust_arches} - rust-typenum ExclusiveArch: %{rust_arches} - rust-typetag ExclusiveArch: %{rust_arches} - rust-typetag-impl ExclusiveArch: %{rust_arches} - rust-tzfile ExclusiveArch: %{rust_arches} - rust-ucd-parse ExclusiveArch: %{rust_arches} - rust-ucd-trie ExclusiveArch: %{rust_arches} - rust-ucd-util ExclusiveArch: %{rust_arches} - rust-unchecked-index ExclusiveArch: %{rust_arches} - rust-unescape ExclusiveArch: %{rust_arches} - rust-unic-char-property ExclusiveArch: %{rust_arches} - rust-unic-char-range ExclusiveArch: %{rust_arches} - rust-unic-common ExclusiveArch: %{rust_arches} - rust-unic-langid ExclusiveArch: %{rust_arches} - rust-unic-langid-impl ExclusiveArch: %{rust_arches} - rust-unic-langid-macros ExclusiveArch: %{rust_arches} - rust-unic-langid-macros-impl ExclusiveArch: %{rust_arches} - rust-unic-locale ExclusiveArch: %{rust_arches} - rust-unic-locale-impl ExclusiveArch: %{rust_arches} - rust-unic-locale-macros ExclusiveArch: %{rust_arches} - rust-unic-locale-macros-impl ExclusiveArch: %{rust_arches} - rust-unic-segment ExclusiveArch: %{rust_arches} - rust-unic-ucd-category ExclusiveArch: %{rust_arches} - rust-unic-ucd-common ExclusiveArch: %{rust_arches} - rust-unic-ucd-segment ExclusiveArch: %{rust_arches} - rust-unic-ucd-version ExclusiveArch: %{rust_arches} - rust-unicase ExclusiveArch: %{rust_arches} - rust-unicase1 ExclusiveArch: %{rust_arches} - rust-unicode-bidi ExclusiveArch: %{rust_arches} - rust-unicode-linebreak ExclusiveArch: %{rust_arches} - rust-unicode-normalization ExclusiveArch: %{rust_arches} - rust-unicode-segmentation ExclusiveArch: %{rust_arches} - rust-unicode-truncate ExclusiveArch: %{rust_arches} - rust-unicode-width ExclusiveArch: %{rust_arches} - rust-unicode-xid ExclusiveArch: %{rust_arches} - rust-unicode-xid0.1 ExclusiveArch: %{rust_arches} - rust-unicode_categories ExclusiveArch: %{rust_arches} - rust-unindent ExclusiveArch: %{rust_arches} - rust-universal-hash ExclusiveArch: %{rust_arches} - rust-unix_socket ExclusiveArch: %{rust_arches} - rust-unreachable ExclusiveArch: %{rust_arches} - rust-unsafe-any ExclusiveArch: %{rust_arches} - rust-unsafe-io ExclusiveArch: %{rust_arches} - rust-untrusted ExclusiveArch: %{rust_arches} - rust-uom ExclusiveArch: %{rust_arches} - rust-url ExclusiveArch: %{rust_arches} - rust-url1 ExclusiveArch: %{rust_arches} - rust-url_serde ExclusiveArch: %{rust_arches} - rust-urlencoding ExclusiveArch: %{rust_arches} - rust-urlocator ExclusiveArch: %{rust_arches} - rust-urlshortener ExclusiveArch: %{rust_arches} - rust-users ExclusiveArch: %{rust_arches} - rust-users0.10 ExclusiveArch: %{rust_arches} - rust-utf-8 ExclusiveArch: %{rust_arches} - rust-utf8-cstr ExclusiveArch: %{rust_arches} - rust-utf8-ranges ExclusiveArch: %{rust_arches} - rust-utf8-width ExclusiveArch: %{rust_arches} - rust-utf8parse ExclusiveArch: %{rust_arches} - rust-uuid ExclusiveArch: %{rust_arches} - rust-uuid0.7 ExclusiveArch: %{rust_arches} - rust-v_frame ExclusiveArch: %{rust_arches} - rust-value-bag ExclusiveArch: %{rust_arches} - rust-varlink ExclusiveArch: %{rust_arches} - rust-varlink-cli ExclusiveArch: %{rust_arches} - rust-varlink_generator ExclusiveArch: %{rust_arches} - rust-varlink_parser ExclusiveArch: %{rust_arches} - rust-varlink_stdinterfaces ExclusiveArch: %{rust_arches} - rust-vcpkg ExclusiveArch: %{rust_arches} - rust-vec_map ExclusiveArch: %{rust_arches} - rust-vergen ExclusiveArch: %{rust_arches} - rust-vergen3 ExclusiveArch: %{rust_arches} - rust-version ExclusiveArch: %{rust_arches} - rust-version-compare ExclusiveArch: %{rust_arches} - rust-version-sync ExclusiveArch: %{rust_arches} - rust-version-sync0.8 ExclusiveArch: %{rust_arches} - rust-version_check ExclusiveArch: %{rust_arches} - rust-versions ExclusiveArch: %{rust_arches} - rust-virtio-bindings ExclusiveArch: x86_64 aarch64 ppc64le - rust-vm-memory ExclusiveArch: x86_64 aarch64 ppc64le - rust-vmm-sys-util ExclusiveArch: x86_64 aarch64 ppc64le - rust-vmw_backdoor ExclusiveArch: %{rust_arches} - rust-void ExclusiveArch: %{rust_arches} - rust-vsprintf ExclusiveArch: %{rust_arches} - rust-vte ExclusiveArch: %{rust_arches} - rust-vte_generate_state_changes ExclusiveArch: %{rust_arches} - rust-wait-timeout ExclusiveArch: %{rust_arches} - rust-waker-fn ExclusiveArch: %{rust_arches} - rust-walkdir ExclusiveArch: %{rust_arches} - rust-want ExclusiveArch: %{rust_arches} - rust-warp ExclusiveArch: %{rust_arches} - rust-wasm-bindgen ExclusiveArch: %{rust_arches} - rust-wasm-bindgen-backend ExclusiveArch: %{rust_arches} - rust-wasm-bindgen-futures ExclusiveArch: %{rust_arches} - rust-wasm-bindgen-macro ExclusiveArch: %{rust_arches} - rust-wasm-bindgen-macro-support ExclusiveArch: %{rust_arches} - rust-wasm-bindgen-shared ExclusiveArch: %{rust_arches} - rust-wasm-bindgen-test ExclusiveArch: %{rust_arches} - rust-wasm-bindgen-test-macro ExclusiveArch: %{rust_arches} - rust-wasmer_enumset ExclusiveArch: %{rust_arches} - rust-wasmer_enumset_derive ExclusiveArch: %{rust_arches} - rust-wasmparser ExclusiveArch: %{rust_arches} - rust-wasmtime-cache ExclusiveArch: %{rust_arches} - rust-wasmtime-environ ExclusiveArch: %{rust_arches} - rust-wasmtime-fiber ExclusiveArch: %{rust_arches} - rust-wasmtime-types ExclusiveArch: %{rust_arches} - rust-wast ExclusiveArch: %{rust_arches} - rust-wat ExclusiveArch: %{rust_arches} - rust-watchman_client ExclusiveArch: %{rust_arches} - rust-wayland-client ExclusiveArch: %{rust_arches} - rust-wayland-commons ExclusiveArch: %{rust_arches} - rust-wayland-cursor ExclusiveArch: %{rust_arches} - rust-wayland-egl ExclusiveArch: %{rust_arches} - rust-wayland-protocols ExclusiveArch: %{rust_arches} - rust-wayland-scanner ExclusiveArch: %{rust_arches} - rust-wayland-server ExclusiveArch: %{rust_arches} - rust-wayland-sys ExclusiveArch: %{rust_arches} - rust-web-sys ExclusiveArch: %{rust_arches} - rust-webbrowser ExclusiveArch: %{rust_arches} - rust-webkit2gtk ExclusiveArch: %{rust_arches} - rust-webkit2gtk-sys ExclusiveArch: %{rust_arches} - rust-webpki ExclusiveArch: %{rust_arches} - rust-webpki-roots ExclusiveArch: %{rust_arches} - rust-websocket ExclusiveArch: %{rust_arches} - rust-websocket-base ExclusiveArch: %{rust_arches} - rust-weezl ExclusiveArch: %{rust_arches} - rust-which ExclusiveArch: %{rust_arches} - rust-wide ExclusiveArch: %{rust_arches} - rust-wild ExclusiveArch: %{rust_arches} - rust-wildmatch ExclusiveArch: %{rust_arches} - rust-winit ExclusiveArch: %{rust_arches} - rust-witx ExclusiveArch: %{rust_arches} - rust-ws ExclusiveArch: %{rust_arches} - rust-wyz ExclusiveArch: %{rust_arches} - rust-x11 ExclusiveArch: %{rust_arches} - rust-x11-clipboard ExclusiveArch: %{rust_arches} - rust-x11-dl ExclusiveArch: %{rust_arches} - rust-xattr ExclusiveArch: %{rust_arches} - rust-xcb ExclusiveArch: %{rust_arches} - rust-xcursor ExclusiveArch: %{rust_arches} - rust-xdg ExclusiveArch: %{rust_arches} - rust-xi-unicode ExclusiveArch: %{rust_arches} - rust-xkbcommon ExclusiveArch: %{rust_arches} - rust-xml-rs ExclusiveArch: %{rust_arches} - rust-xml5ever ExclusiveArch: %{rust_arches} - rust-xmlparser ExclusiveArch: %{rust_arches} - rust-xmltree ExclusiveArch: %{rust_arches} - rust-xmlwriter ExclusiveArch: %{rust_arches} - rust-xz2 ExclusiveArch: %{rust_arches} - rust-y4m ExclusiveArch: %{rust_arches} - rust-yaml-rust ExclusiveArch: %{rust_arches} - rust-yaml-rust0.3 ExclusiveArch: %{rust_arches} - rust-ybaas ExclusiveArch: %{rust_arches} - rust-yubibomb ExclusiveArch: %{rust_arches} - rust-zbase32 ExclusiveArch: %{rust_arches} - rust-zbus ExclusiveArch: %{rust_arches} - rust-zbus_macros ExclusiveArch: %{rust_arches} - rust-zcomponents ExclusiveArch: %{rust_arches} - rust-zeroize ExclusiveArch: %{rust_arches} - rust-zeroize_derive ExclusiveArch: %{rust_arches} - rust-zincati ExclusiveArch: %{rust_arches} - rust-zip ExclusiveArch: %{rust_arches} - rust-zmq-sys ExclusiveArch: %{rust_arches} - rust-zoneinfo_compiled ExclusiveArch: %{rust_arches} - rust-zopfli ExclusiveArch: %{rust_arches} - rust-zoxide ExclusiveArch: %{rust_arches} - rust-zram-generator ExclusiveArch: %{rust_arches} - rust-zstd ExclusiveArch: %{rust_arches} - rust-zstd-safe ExclusiveArch: %{rust_arches} - rust-zstd-sys ExclusiveArch: %{rust_arches} - rust-zvariant ExclusiveArch: %{rust_arches} - rust-zvariant_derive ExclusiveArch: %{rust_arches} - s390utils ExclusiveArch: s390 s390x - safetyblanket ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc64le - sagemath ExclusiveArch: aarch64 %{ix86} x86_64 ppc sparcv9 - sbcl ExclusiveArch: %{arm} %{ix86} x86_64 ppc sparcv9 aarch64 - sbd ExclusiveArch: i686 x86_64 s390x aarch64 ppc64le - sbsigntools ExclusiveArch: x86_64 aarch64 %{arm} %{ix86} - sdsl-lite ExclusiveArch: %{power64} x86_64 aarch64 - seabios ExclusiveArch: x86_64 - seadrive-gui ExclusiveArch: %{qt5_qtwebengine_arches} - seafile-client ExclusiveArch: %{qt5_qtwebengine_arches} - seamonkey ExclusiveArch: x86_64 - seqan3 ExclusiveArch: %{power64} x86_64 aarch64 - servicelog ExclusiveArch: ppc %{power64} - sgabios ExclusiveArch: %{ix86} x86_64 - sharpfont ExclusiveArch: %mono_arches - sharpziplib ExclusiveArch: %{mono_arches} - shim ExclusiveArch: %{efi} - shim-unsigned-aarch64 ExclusiveArch: aarch64 - shim-unsigned-x64 ExclusiveArch: x86_64 - sigul ExclusiveArch: x86_64 - skopeo ExclusiveArch: %{go_arches} - skychart ExclusiveArch: %{fpc_arches} - snapd ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ppc64le s390x - soup-sharp ExclusiveArch: %{mono_arches} - sparkleshare ExclusiveArch: %{mono_arches} - spicctrl ExclusiveArch: %{ix86} x86_64 - spice ExclusiveArch: x86_64 ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - springlobby ExclusiveArch: %{ix86} x86_64 - squeekboard ExclusiveArch: %{rust_arches} - startdde ExclusiveArch: %{?go_arches:%{go_arches}}%{!?go_arches:%{ix86} x86_64 %{arm}} - statsd ExclusiveArch: %{nodejs_arches} noarch - stratis-cli ExclusiveArch: %{rust_arches} noarch - stratisd ExclusiveArch: %{rust_arches} ExclusiveArch: ${rust_arches} - stripesnoop ExclusiveArch: %{ix86} x86_64 - supercollider ExclusiveArch: %{qt5_qtwebengine_arches} - supermin ExclusiveArch: %{kernel_arches} - svt-av1 ExclusiveArch: x86_64 - svt-vp9 ExclusiveArch: x86_64 - swift-lang ExclusiveArch: x86_64 aarch64 - sysbench ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} aarch64 ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} aarch64 ppc64le s390x - syslinux ExclusiveArch: %{ix86} x86_64 ExclusiveArch: %{ix86} x86_64 - system76-keyboard-configurator ExclusiveArch: %{rust_arches} - taglib-sharp ExclusiveArch: %{mono_arches} - tarantool ExclusiveArch: %{ix86} x86_64 - tboot ExclusiveArch: %{ix86} x86_64 - tdlib ExclusiveArch: x86_64 - templates_parser ExclusiveArch: %GPRbuild_arches - ternimal ExclusiveArch: %{rust_arches} - testcloud ExclusiveArch: %{kernel_arches} noarch - themonospot-base ExclusiveArch: %mono_arches - themonospot-console ExclusiveArch: %mono_arches - themonospot-gui-gtk ExclusiveArch: %mono_arches - themonospot-plugin-avi ExclusiveArch: %mono_arches - themonospot-plugin-mkv ExclusiveArch: %mono_arches - thermald ExclusiveArch: %{ix86} x86_64 - tilix ExclusiveArch: %{ldc_arches} - tmux-top ExclusiveArch: %{go_arches} - tomboy ExclusiveArch: %{mono_arches} - topojson-client ExclusiveArch: %{nodejs_arches} noarch - topojson-server ExclusiveArch: %{nodejs_arches} noarch - topojson-simplify ExclusiveArch: %{nodejs_arches} noarch - torbrowser-launcher ExclusiveArch: %{ix86} x86_64 - tuned-profiles-nfv-host-bin ExclusiveArch: %{ix86} x86_64 - uClibc ExclusiveArch: %{arm} %{ix86} x86_64 %{mips} - ucx ExclusiveArch: aarch64 ppc64le x86_64 - uglify-js ExclusiveArch: %{nodejs_arches} noarch - unetbootin ExclusiveArch: %{ix86} x86_64 - ursa-major ExclusiveArch: noarch aarch64 ppc64le s390x x86_64 - usd ExclusiveArch: aarch64 x86_64 - v8-314 ExclusiveArch: %{ix86} x86_64 %{arm} mips mipsel ppc ppc64 - valgrind ExclusiveArch: %{ix86} x86_64 ppc ppc64 ppc64le s390x armv7hl aarch64 - vboot-utils ExclusiveArch: %{arm} aarch64 %{ix86} x86_64 - vim-go ExclusiveArch: %{?golang_arches}%{!?golang_arches:%{ix86} x86_64 %{arm}} - virt-p2v ExclusiveArch: x86_64 - virt-v2v ExclusiveArch: x86_64 - virtualbox-guest-additions ExclusiveArch: i686 x86_64 - vkd3d ExclusiveArch: %{ix86} x86_64 %{arm} ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - vmaf ExclusiveArch: x86_64 - vmemcache ExclusiveArch: x86_64 ppc64 ppc64le s390x aarch64 - vrq ExclusiveArch: %{ix86} x86_64 - warsow ExclusiveArch: %{ix86} x86_64 %{arm} - warsow-data ExclusiveArch: %{ix86} x86_64 %{arm} noarch ExclusiveArch: %{ix86} x86_64 %{arm} - webkit2-sharp ExclusiveArch: %mono_arches - wine ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 ExclusiveArch: %{ix86} %{arm} - wine-dxvk ExclusiveArch: %{ix86} x86_64 - winetricks ExclusiveArch: %{ix86} x86_64 %{arm} aarch64 - wxMaxima ExclusiveArch: %{arm} %{ix86} x86_64 aarch64 ppc sparcv9 - x2goclient ExclusiveArch: x86_64 - xe-guest-utilities-latest ExclusiveArch: %{ix86} x86_64 - xen ExclusiveArch: %{ix86} x86_64 armv7hl aarch64 - xmlada ExclusiveArch: %{GPRbuild_arches} - xorg-x11-drv-armsoc ExclusiveArch: %{arm} aarch64 - xorg-x11-drv-intel ExclusiveArch: %{ix86} x86_64 - xorg-x11-drv-openchrome ExclusiveArch: %{ix86} x86_64 - xorg-x11-drv-vesa ExclusiveArch: %{ix86} x86_64 - xorg-x11-drv-vmware ExclusiveArch: %{ix86} x86_64 ia64 - xsp ExclusiveArch: %mono_arches - yarnpkg ExclusiveArch: %{nodejs_arches} noarch - zeal ExclusiveArch: %{qt5_qtwebengine_arches} - zeromq-ada ExclusiveArch: %{GPRbuild_arches} - zig ExclusiveArch: %{zig_arches} - zlib-ada ExclusiveArch: %{GPRbuild_arches} - zlib-ng ExclusiveArch: aarch64 i686 ppc64le s390x x86_64 - zola ExclusiveArch: %{rust_arches}

2 years, 5 months

1
0
0 / 0

2024

2023

2022

2021

2020

2019

2018

2017

Arch-excludes December 2021