$ git show --format=fuller --patch-with-stat --summary a4f04eab276362b9a1721ad279036ad0e87bf867

commit a4f04eab276362b9a1721ad279036ad0e87bf867
Author:     Crispin Boylan <crisb@mandriva.org>
AuthorDate: Fri Sep 3 23:22:45 2021 +0100
Commit:     Crispin Boylan <crisb@mandriva.org>
CommitDate: Fri Sep 3 23:22:45 2021 +0100

    17.0.0.35 (rc)
---
 .abf.yml                                           |   2 +
 TestCryptoLevel.java                               |  72 +++
 TestECDSA.java                                     |  49 ++
 java-12-buildfix.patch                             |  16 +
 java-12-compile.patch                              |  14 +
 java-17-openjdk.spec                               | 602 +++++++++++++++++++++
 openjdk-13-fix-build.patch                         |  12 +
 openjdk-15-nss-3.57.patch                          |  24 +
 openjdk-16-glibc-2.34.patch                        |  14 +
 ...-support_fedora_rhel_system_crypto_policy.patch |  88 +++
 ...accessible_toolkit_crash_do_not_break_jvm.patch |  16 +
 ...ted_out_nss_cfg_provider_to_java_security.patch |  11 +
 ...44-java_access_bridge_privileged_security.patch |  20 +
 ...libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch |  19 +
 14 files changed, 959 insertions(+)
 create mode 100644 .abf.yml
 create mode 100644 TestCryptoLevel.java
 create mode 100644 TestECDSA.java
 create mode 100644 java-12-buildfix.patch
 create mode 100644 java-12-compile.patch
 create mode 100644 java-17-openjdk.spec
 create mode 100644 openjdk-13-fix-build.patch
 create mode 100644 openjdk-15-nss-3.57.patch
 create mode 100644 openjdk-16-glibc-2.34.patch
 create mode 100644 pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch
 create mode 100644 rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
 create mode 100644 rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
 create mode 100644 rh1648644-java_access_bridge_privileged_security.patch
 create mode 100644 rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch

diff --git a/.abf.yml b/.abf.yml
new file mode 100644
index 0000000..417dea5
--- /dev/null
+++ b/.abf.yml
@@ -0,0 +1,2 @@
+sources:
+  jdk-17.0.0+35.tar.gz: c3ebde044be72b48d0534ed47a8fbb1ef9aa8918
diff --git a/TestCryptoLevel.java b/TestCryptoLevel.java
new file mode 100644
index 0000000..b32b7ae
--- /dev/null
+++ b/TestCryptoLevel.java
@@ -0,0 +1,72 @@
+/* TestCryptoLevel -- Ensure unlimited crypto policy is in use.
+   Copyright (C) 2012 Red Hat, Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.lang.reflect.InvocationTargetException;
+
+import java.security.Permission;
+import java.security.PermissionCollection;
+
+public class TestCryptoLevel
+{
+  public static void main(String[] args)
+    throws NoSuchFieldException, ClassNotFoundException,
+           IllegalAccessException, InvocationTargetException
+  {
+    Class<?> cls = null;
+    Method def = null, exempt = null;
+
+    try
+      {
+        cls = Class.forName("javax.crypto.JceSecurity");
+      }
+    catch (ClassNotFoundException ex)
+      {
+        System.err.println("Running a non-Sun JDK.");
+        System.exit(0);
+      }
+    try
+      {
+        def = cls.getDeclaredMethod("getDefaultPolicy");
+        exempt = cls.getDeclaredMethod("getExemptPolicy");
+      }
+    catch (NoSuchMethodException ex)
+      {
+        System.err.println("Running IcedTea with the original crypto patch.");
+        System.exit(0);
+      }
+    def.setAccessible(true);
+    exempt.setAccessible(true);
+    PermissionCollection defPerms = (PermissionCollection) def.invoke(null);
+    PermissionCollection exemptPerms = (PermissionCollection) exempt.invoke(null);
+    Class<?> apCls = Class.forName("javax.crypto.CryptoAllPermission");
+    Field apField = apCls.getDeclaredField("INSTANCE");
+    apField.setAccessible(true);
+    Permission allPerms = (Permission) apField.get(null);
+    if (defPerms.implies(allPerms) && (exemptPerms == null || exemptPerms.implies(allPerms)))
+      {
+        System.err.println("Running with the unlimited policy.");
+        System.exit(0);
+      }
+    else
+      {
+        System.err.println("WARNING: Running with a restricted crypto policy.");
+        System.exit(-1);
+      }
+  }
+}
diff --git a/TestECDSA.java b/TestECDSA.java
new file mode 100644
index 0000000..6eb9cb2
--- /dev/null
+++ b/TestECDSA.java
@@ -0,0 +1,49 @@
+/* TestECDSA -- Ensure ECDSA signatures are working.
+   Copyright (C) 2016 Red Hat, Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as
+published by the Free Software Foundation, either version 3 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful,
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+import java.math.BigInteger;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.Signature;
+
+/**
+ * @test
+ */
+public class TestECDSA {
+
+    public static void main(String[] args) throws Exception {
+        KeyPairGenerator keyGen = KeyPairGenerator.getInstance("EC");
+        KeyPair key = keyGen.generateKeyPair();
+        
+        byte[] data = "This is a string to sign".getBytes("UTF-8");
+        
+        Signature dsa = Signature.getInstance("NONEwithECDSA");
+        dsa.initSign(key.getPrivate());
+        dsa.update(data);
+        byte[] sig = dsa.sign();
+        System.out.println("Signature: " + new BigInteger(1, sig).toString(16));
+        
+        Signature dsaCheck = Signature.getInstance("NONEwithECDSA");
+        dsaCheck.initVerify(key.getPublic());
+        dsaCheck.update(data);
+        boolean success = dsaCheck.verify(sig);
+        if (!success) {
+            throw new RuntimeException("Test failed. Signature verification error");
+        }
+        System.out.println("Test passed.");
+    }
+}
diff --git a/java-12-buildfix.patch b/java-12-buildfix.patch
new file mode 100644
index 0000000..fd0d392
--- /dev/null
+++ b/java-12-buildfix.patch
@@ -0,0 +1,16 @@
+diff -up openjdk/src/hotspot/share/gc/g1/g1CodeBlobClosure.cpp.omv~ openjdk/src/hotspot/share/gc/g1/g1CodeBlobClosure.cpp
+--- openjdk/src/hotspot/share/gc/g1/g1CodeBlobClosure.cpp.omv~	2019-02-15 23:07:42.313110651 +0100
++++ openjdk/src/hotspot/share/gc/g1/g1CodeBlobClosure.cpp	2019-02-15 23:07:56.346351166 +0100
+@@ -26,6 +26,7 @@
+ #include "code/nmethod.hpp"
+ #include "gc/g1/g1CodeBlobClosure.hpp"
+ #include "gc/g1/g1CollectedHeap.inline.hpp"
++#include "gc/g1/g1OopClosures.inline.hpp"
+ #include "gc/g1/heapRegion.hpp"
+ #include "gc/g1/heapRegionRemSet.hpp"
+ #include "oops/access.inline.hpp"
+@@ -62,4 +63,3 @@ void G1CodeBlobClosure::do_code_blob(Cod
+     }
+   }
+ }
+-
diff --git a/java-12-compile.patch b/java-12-compile.patch
new file mode 100644
index 0000000..4e9f697
--- /dev/null
+++ b/java-12-compile.patch
@@ -0,0 +1,14 @@
+diff -up openjdk/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/pkcs11wrapper.h.omv~ openjdk/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/pkcs11wrapper.h
+--- openjdk/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/pkcs11wrapper.h.omv~	2019-02-14 18:47:55.481557046 +0100
++++ openjdk/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/pkcs11wrapper.h	2019-02-14 18:49:42.450345463 +0100
+@@ -170,8 +170,8 @@
+ #define min(a, b)       (((a) < (b)) ? (a) : (b))
+ #endif
+ 
+-#define ckBBoolToJBoolean(x) ((x == TRUE) ? JNI_TRUE : JNI_FALSE);
+-#define jBooleanToCKBBool(x) ((x == JNI_TRUE) ? TRUE : FALSE);
++#define ckBBoolToJBoolean(x) ((x) ? JNI_TRUE : JNI_FALSE);
++#define jBooleanToCKBBool(x) ((x == JNI_TRUE) ? 1 : 0);
+ 
+ #define ckByteToJByte(x) ((jbyte) x)
+ #define jByteToCKByte(x) ((CK_BYTE) x)
diff --git a/java-17-openjdk.spec b/java-17-openjdk.spec
new file mode 100644
index 0000000..addb40c
--- /dev/null
+++ b/java-17-openjdk.spec
@@ -0,0 +1,602 @@
+# Use gcc instead of clang
+%bcond_without gcc
+%bcond_with system_jdk
+# Without bootstrap, the package BuildRequires
+# rpm-javamacros (which in turn requires this package)
+# so jmod(*) and java(*) Provides: can be generated correctly.
+%bcond_without bootstrap
+# Using rpm's debug package splitter is suboptimal because OpenJDK
+# packages various shared library files inside zip (jmod) packages.
+# Those aren't seen by the splitter and therefore get insanely large.
+# Better to use OpenJDK's own debuginfo splitter here even if it
+# results in somewhat nonstandard locations for debuginfo files.
+# This results in partially empty debug packages (debugsource from
+# rpm, *.debug files from OpenJDK build system)
+%global _empty_manifest_terminate_build 0
+
+# OpenJDK builds a lot of underlinked libraries and tools...
+%global _disable_ld_no_undefined 1
+%global _jvmdir %{_prefix}/lib/jvm
+
+%define major %(echo %{version} |cut -d. -f1)
+%define ver %(echo %{version} |rev |cut -d. -f2- |rev)
+%define minor 35
+#For non-GA releases: %(echo %{version} |rev |cut -d. -f1 |rev)
+# OpenJDK X requires OpenJDK >= X-1 to build -- so we need
+# to determine the previous version to get build dependencies
+# right
+%define oldmajor %(echo $((%{major}-1)))
+
+Name:		java-17-openjdk
+Version:	17.0.0.%{minor}
+Release:	1
+Summary:	Java Runtime Environment (JRE) %{major}
+Group:		Development/Languages
+License:	GPLv2, ASL 1.1, ASL 2.0, LGPLv2.1
+URL:		http://openjdk.java.net/
+Source0:	https://github.com/openjdk/jdk17u/archive/refs/tags/jdk-%{ver}+%{minor}.tar.gz
+# Extra tests
+Source50:	TestCryptoLevel.java
+Source51:	TestECDSA.java
+# Patches from Fedora
+Patch0:		https://src.fedoraproject.org/rpms/java-openjdk/raw/master/f/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
+Patch1:		https://src.fedoraproject.org/rpms/java-openjdk/raw/master/f/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
+Patch2:		https://src.fedoraproject.org/rpms/java-openjdk/raw/master/f/rh1648644-java_access_bridge_privileged_security.patch
+Patch3:		https://src.fedoraproject.org/rpms/java-openjdk/raw/master/f/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
+Patch4:		https://src.fedoraproject.org/rpms/java-openjdk/raw/master/f/pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch
+# Patches from OpenMandriva
+Patch1002:	java-12-compile.patch
+Patch1003:	openjdk-15-nss-3.57.patch
+Patch1004:	openjdk-16-glibc-2.34.patch
+#Patch1005:	openjdk-13-fix-build.patch
+BuildRequires:	autoconf
+BuildRequires:	automake
+BuildRequires:	binutils
+BuildRequires:	cups-devel
+BuildRequires:	desktop-file-utils
+BuildRequires:	fontconfig
+BuildRequires:	xsltproc
+BuildRequires:	zip
+BuildRequires:	pkgconfig(freetype2)
+BuildRequires:	giflib-devel
+BuildRequires:	pkgconfig(alsa)
+BuildRequires:	pkgconfig(gtk+-2.0)
+BuildRequires:	pkgconfig(nss)
+BuildRequires:	pkgconfig(lcms2)
+BuildRequires:	pkgconfig(libjpeg)
+BuildRequires:	pkgconfig(libpng)
+BuildRequires:	pkgconfig(x11)
+BuildRequires:	pkgconfig(xext)
+BuildRequires:	pkgconfig(xi)
+BuildRequires:	pkgconfig(xcomposite)
+BuildRequires:	pkgconfig(xinerama)
+BuildRequires:	pkgconfig(xrandr)
+BuildRequires:	pkgconfig(xrender)
+BuildRequires:	pkgconfig(xt)
+BuildRequires:	pkgconfig(xtst)
+BuildRequires:	pkgconfig(xproto)
+# For testing
+BuildRequires:	gdb
+# For freebl
+BuildRequires:	nss-static-devel
+# Zero-assembler build requirement.
+%ifnarch %{jit_arches}
+BuildRequires:	pkgconfig(libffi)
+%endif
+
+# cacerts build requirement.
+BuildRequires:	openssl
+
+%if %{with system_jdk}
+Provides:	jre-current = %{EVRD}
+Provides:	java-current = %{EVRD}
+%endif
+%if %{with bootstrap}
+# In a bootstrap build, we can't have jmod(*) dependencies
+# because openjdk 12's jmod has no idea how to read openjdk
+# 13's module files.
+BuildRequires:	java-%{oldmajor}-openjdk-devel
+# Let's provide some basics...
+Provides:	jmod(java.base) = %{EVRD}
+%else
+BuildRequires:	rpm-javamacros
+BuildRequires:	java-%{major}-openjdk-devel
+%endif
+
+# For compatibility with JPackage/Fedora/Mageia packaging
+Provides:	java-%{major}-openjdk-headless = 1:%{version}-%{release}
+Provides:	java-openjdk-headless = 1:%{version}-%{release}
+Provides:	java-headless = 1:%{version}-%{release}
+
+%description
+OpenJDK Java runtime and development environment
+
+# Macro for packaging individual jmod files
+%define modpackage()\
+%%package module-%{1}\
+Summary: The Java %{1} module, provided by OpenJDK\
+Group: Development/Languages\
+%%description module-%{1}\
+The Java %{1} module, provided by OpenJDK\
+%%files module-%{1}\
+%{_jvmdir}/java-%{major}-openjdk/jmods/%{1}.jmod \
+%optional %doc %{_jvmdir}/java-%{major}-openjdk/legal/%{1}
+
+%package gui
+Summary:	Graphical user interface libraries for OpenJDK %{major}
+Group:		Development/Languages
+%if %{with system_jdk}
+Provides:	jre-gui-current = %{EVRD}
+Provides:	java-gui-current = %{EVRD}
+%endif
+# We really need to require %{name} = %{EVRD}, but this gets
+# messed up by the compatibility provides below
+# (java-%{major}-openjdk == %{name})
+# So we have to require one of the compatibility provides of
+# the main package instead.
+Requires:	java-%{major}-openjdk-headless = 1:%{version}-%{release}
+# For compatibility with JPackage/Fedora/Mageia packaging
+Provides:	java-%{major}-openjdk = %{EVRD}
+Provides:	java-openjdk = %{EVRD}
+Provides:	java = %{EVRD}
+
+%description gui
+Graphical user interface libraries for OpenJDK %{major}
+
+%package devel
+Summary:	Java Development Kit (JDK) %{major}
+Group:		Development/Languages
+%if %{with system_jdk}
+Provides:	jdk-current = %{EVRD}
+Provides:	java-current-devel = %{EVRD}
+%endif
+Requires:	rpm-javamacros
+Requires:	%{name} = %{EVRD}
+Suggests:	%{name}-gui = %{EVRD}
+# For compatibility with JPackage/Fedora/Mageia packaging
+Provides:	java-openjdk-devel = %{EVRD}
+Provides:	java-devel = %{EVRD}
+
+%description devel
+Java Development Kit (JDK) %{major}
+
+%package source
+Summary:	Source files for the Java class library
+Group:		Development/Languages
+Recommends:	%{name} = %{EVRD}
+
+%description source
+Source files for the Java class library
+
+%package demo
+Summary:	Demo/Example applications for OpenJDK
+Group:		Development/Languages
+
+%description demo
+Demo/Example applications for OpenJDK
+
+%package debug
+Summary:	Debug information for package %{name}
+Group:		Development/Debug
+
+%description debug
+Debug information for package %{name}
+
+%prep
+%autosetup -p1 -n jdk17u-jdk-17-%{minor}
+
+EXTRA_CFLAGS="$(echo %{optflags} -fuse-ld=bfd -Wno-error -fno-delete-null-pointer-checks -Wformat -Wno-cpp |sed -r -e 's|-O[0-9sz]*||;s|-Werror=format-security||g')"
+EXTRA_CXXFLAGS="$EXTRA_CFLAGS"
+%if %{with gcc}
+EXTRA_CFLAGS="$EXTRA_CFLAGS -fno-lifetime-dse"
+EXTRA_CXXFLAGS="$EXTRA_CFLAGS -fno-lifetime-dse"
+%ifarch %{ix86}
+# https://bugs.openjdk.java.net/browse/JDK-8199936
+EXTRA_CFLAGS="$EXTRA_CFLAGS -mincoming-stack-boundary=2"
+EXTRA_CXXFLAGS="$EXTRA_CXXFLAGS -mincoming-stack-boundary=2"
+%endif
+export CC=gcc
+export CXX=g++
+%else
+%ifarch %{ix86}
+# https://bugs.openjdk.java.net/browse/JDK-8199936
+EXTRA_CFLAGS="$EXTRA_CFLAGS -mstack-alignment=16"
+EXTRA_CXXFLAGS="$EXTRA_CXXFLAGS -mstack-alignment=16"
+%endif
+%endif
+
+NUM_PROC="$(getconf _NPROCESSORS_ONLN)"
+[ -z "$NUM_PROC" ] && NUM_PROC=8
+
+mkdir build
+cd build
+
+%if %{with gcc}
+export NM=gcc-nm
+export AR=gcc-ar
+%else
+export NM=llvm-nm
+export AR=llvm-ar
+%endif
+
+if ! bash ../configure \
+	--prefix=%{_prefix} \
+	--libdir=%{_libdir} \
+	--sysconfdir=%{_sysconfdir} \
+	--mandir=%{_mandir} \
+%if %{with gcc}
+	--with-toolchain-type=gcc \
+%else
+	--with-toolchain-type=clang \
+%endif
+	--with-boot-jdk=$(ls -d %{_jvmdir}/java-%{oldmajor}-openjdk-* |head -n1) \
+	--with-vendor-name="OpenMandriva" \
+	--with-vendor-url="http://openmandriva.org/" \
+	--with-vendor-version-string="OpenMandriva-%{version}-%{release}" \
+	--with-debug-level=release \
+	--with-native-debug-symbols=external \
+	--enable-unlimited-crypto \
+	--with-freetype=system \
+	--with-zlib=system \
+	--with-giflib=system \
+	--with-harfbuzz=system \
+	--with-libjpeg=system \
+	--with-libpng=system \
+	--with-lcms=system \
+	--with-stdc++lib=dynamic \
+	--with-extra-cflags="$EXTRA_CFLAGS" \
+	--with-extra-cxxflags="$EXTRA_CXXFLAGS" \
+	--with-extra-ldflags="%{ldflags}" \
+	--with-num-cores="$NUM_PROC" \
+	--with-jobs="$NUM_PROC" \
+%ifarch %{x86_64}
+	--with-jvm-features=zgc \
+%endif
+	--disable-warnings-as-errors; then
+		echo "Configure failed -- see config.log:"
+		cat config.log
+		exit 1
+fi
+
+
+%build
+# YYYYYYYUUUUUCCCCCCCKKKKKK! The build process really needs more than
+# 1024 files open at the same time!
+ulimit -Sn 65536
+
+# With LTO enabled, /tmp (tmpfs) tends to run out of space.
+# Temporary LTO files for openjdk 12 easily take 50+ GB.
+# Hopefully the build directory has more free space.
+mkdir -p compilertemp
+export TMPDIR="$(pwd)/compilertemp"
+
+cd build
+# We intentionally don't use %%make_build - OpenJDK doesn't like -j at all
+make -j1 bootcycle-images all docs
+
+%install
+mkdir -p %{buildroot}%{_jvmdir}
+cp -a build/images/jdk %{buildroot}%{_jvmdir}/java-%{major}-openjdk
+ln -s java-%{major}-openjdk %{buildroot}%{_jvmdir}/jre-%{major}-openjdk
+
+%if %{with system_jdk}
+ln -s java-%{major}-openjdk %{buildroot}%{_jvmdir}/java-openjdk
+ln -s java-%{major}-openjdk %{buildroot}%{_jvmdir}/java
+ln -s java-%{major}-openjdk %{buildroot}%{_jvmdir}/jre-openjdk
+ln -s java-%{major}-openjdk %{buildroot}%{_jvmdir}/jre
+
+mkdir -p %{buildroot}%{_mandir}
+mv %{buildroot}%{_jvmdir}/java-%{major}-openjdk/man/* %{buildroot}%{_mandir}
+rmdir %{buildroot}%{_jvmdir}/java-%{major}-openjdk/man
+
+mkdir -p %{buildroot}%{_sysconfdir}/ld.so.conf.d
+echo %{_jvmdir}/java-%{major}-openjdk/lib >%{buildroot}%{_sysconfdir}/ld.so.conf.d/java.conf
+
+mkdir -p %{buildroot}%{_sysconfdir}/profile.d
+cat >%{buildroot}%{_sysconfdir}/profile.d/90java.sh <<'EOF'
+export JAVA_HOME=%{_jvmdir}/java-%{major}-openjdk
+export PATH=$PATH:$JAVA_HOME/bin
+EOF
+cat >%{buildroot}%{_sysconfdir}/profile.d/90java.csh <<'EOF'
+setenv JAVA_HOME %{_jvmdir}/java-%{major}-openjdk
+setenv PATH ${PATH}:${JAVA_HOME}/bin
+EOF
+chmod +x %{buildroot}%{_sysconfdir}/profile.d/*.*sh
+%endif
+
+%files
+%if %{with system_jdk}
+%dir %{_jvmdir}
+%{_jvmdir}/java
+%{_jvmdir}/java-openjdk
+%{_jvmdir}/jre
+%{_jvmdir}/jre-openjdk
+%endif
+%dir %{_jvmdir}/java-%{major}-openjdk/bin
+%dir %{_jvmdir}/java-%{major}-openjdk/conf
+%dir %{_jvmdir}/java-%{major}-openjdk/jmods
+%{_jvmdir}/java-%{major}-openjdk/jmods/java.base.jmod
+%dir %{_jvmdir}/java-%{major}-openjdk/legal
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/java.base
+%dir %{_jvmdir}/java-%{major}-openjdk/lib
+%config(noreplace) %{_jvmdir}/java-%{major}-openjdk/conf/*
+%{_jvmdir}/java-%{major}-openjdk/release
+%{_jvmdir}/java-%{major}-openjdk/bin/java
+%{_jvmdir}/java-%{major}-openjdk/bin/jpackage
+%{_jvmdir}/java-%{major}-openjdk/bin/keytool
+%{_jvmdir}/java-%{major}-openjdk/bin/rmiregistry
+%{_jvmdir}/java-%{major}-openjdk/lib/classlist
+%{_jvmdir}/java-%{major}-openjdk/lib/ct.sym
+%{_jvmdir}/java-%{major}-openjdk/lib/jexec
+%{_jvmdir}/java-%{major}-openjdk/lib/jfr
+%{_jvmdir}/java-%{major}-openjdk/lib/jrt-fs.jar
+%{_jvmdir}/java-%{major}-openjdk/lib/jspawnhelper
+%{_jvmdir}/java-%{major}-openjdk/lib/jvm.cfg
+%{_jvmdir}/java-%{major}-openjdk/lib/libattach.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libawt.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libawt_headless.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libdt_socket.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libextnet.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libfontmanager.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libinstrument.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libj2gss.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libj2pcsc.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libj2pkcs11.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libjaas.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libjavajpeg.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libjava.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libjdwp.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libjimage.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libjli.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libjsig.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libjsound.so
+%{_jvmdir}/java-%{major}-openjdk/lib/liblcms.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libmanagement_agent.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libmanagement_ext.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libmanagement.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libmlib_image.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libnet.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libnio.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libprefs.so
+%{_jvmdir}/java-%{major}-openjdk/lib/librmi.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libsaproc.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libsctp.so
+%ifarch %{x86_64}
+%{_jvmdir}/java-%{major}-openjdk/lib/libsvml.so
+%endif
+%{_jvmdir}/java-%{major}-openjdk/lib/libsyslookup.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libverify.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libzip.so
+%{_jvmdir}/java-%{major}-openjdk/lib/modules
+%{_jvmdir}/java-%{major}-openjdk/lib/psfontj2d.properties
+%{_jvmdir}/java-%{major}-openjdk/lib/psfont.properties.ja
+%{_jvmdir}/java-%{major}-openjdk/lib/security
+%{_jvmdir}/java-%{major}-openjdk/lib/server
+%{_jvmdir}/java-%{major}-openjdk/lib/tzdb.dat
+%{_jvmdir}/jre-%{major}-openjdk
+%if %{with system_jdk}
+%{_mandir}/man1/java.1*
+%{_mandir}/man1/jpackage.1*
+%{_mandir}/man1/keytool.1*
+%{_mandir}/man1/rmiregistry.1*
+%{_mandir}/man1/jdeprscan.1*
+%{_mandir}/man1/jfr.1*
+%{_mandir}/man1/jhsdb.1*
+%{_mandir}/man1/jlink.1*
+%{_mandir}/man1/jmod.1*
+%{_mandir}/man1/jshell.1*
+%{_sysconfdir}/profile.d/*
+%{_sysconfdir}/ld.so.conf.d/java.conf
+%else
+%dir %{_jvmdir}/java-%{major}-openjdk/man
+%dir %{_jvmdir}/java-%{major}-openjdk/man/man1
+%{_jvmdir}/java-%{major}-openjdk/man/man1/java.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/jpackage.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/keytool.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/rmiregistry.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/jdeprscan.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/jfr.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/jhsdb.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/jlink.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/jmod.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/jshell.1*
+%endif
+
+%files gui
+%{_jvmdir}/java-%{major}-openjdk/lib/libawt_xawt.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libjawt.so
+%{_jvmdir}/java-%{major}-openjdk/lib/libsplashscreen.so
+%{_jvmdir}/java-%{major}-openjdk/jmods/java.desktop.jmod
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/java.desktop
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.unsupported.desktop
+
+%files devel
+%{_jvmdir}/java-%{major}-openjdk/include
+%{_jvmdir}/java-%{major}-openjdk/jmods/jdk.internal.ed.jmod
+%{_jvmdir}/java-%{major}-openjdk/jmods/jdk.internal.jvmstat.jmod
+%{_jvmdir}/java-%{major}-openjdk/jmods/jdk.internal.le.jmod
+%{_jvmdir}/java-%{major}-openjdk/jmods/jdk.internal.opt.jmod
+%{_jvmdir}/java-%{major}-openjdk/jmods/jdk.internal.vm.ci.jmod
+%{_jvmdir}/java-%{major}-openjdk/jmods/jdk.internal.vm.compiler.jmod
+%{_jvmdir}/java-%{major}-openjdk/jmods/jdk.internal.vm.compiler.management.jmod
+%{_jvmdir}/java-%{major}-openjdk/jmods/jdk.internal.jvmstat.jmod
+%{_jvmdir}/java-%{major}-openjdk/bin/jar
+%{_jvmdir}/java-%{major}-openjdk/bin/jarsigner
+%{_jvmdir}/java-%{major}-openjdk/bin/javac
+%{_jvmdir}/java-%{major}-openjdk/bin/javadoc
+%{_jvmdir}/java-%{major}-openjdk/bin/javap
+%{_jvmdir}/java-%{major}-openjdk/bin/jcmd
+%{_jvmdir}/java-%{major}-openjdk/bin/jconsole
+%{_jvmdir}/java-%{major}-openjdk/bin/jdb
+%{_jvmdir}/java-%{major}-openjdk/bin/jdeprscan
+%{_jvmdir}/java-%{major}-openjdk/bin/jdeps
+%{_jvmdir}/java-%{major}-openjdk/bin/jfr
+%{_jvmdir}/java-%{major}-openjdk/bin/jhsdb
+%{_jvmdir}/java-%{major}-openjdk/bin/jimage
+%{_jvmdir}/java-%{major}-openjdk/bin/jinfo
+%{_jvmdir}/java-%{major}-openjdk/bin/jlink
+%{_jvmdir}/java-%{major}-openjdk/bin/jmap
+%{_jvmdir}/java-%{major}-openjdk/bin/jmod
+%{_jvmdir}/java-%{major}-openjdk/bin/jps
+%{_jvmdir}/java-%{major}-openjdk/bin/jrunscript
+%{_jvmdir}/java-%{major}-openjdk/bin/jshell
+%{_jvmdir}/java-%{major}-openjdk/bin/jstack
+%{_jvmdir}/java-%{major}-openjdk/bin/jstat
+%{_jvmdir}/java-%{major}-openjdk/bin/jstatd
+%{_jvmdir}/java-%{major}-openjdk/bin/serialver
+%if %{with system_jdk}
+%{_mandir}/man1/jar.1*
+%{_mandir}/man1/jarsigner.1*
+%{_mandir}/man1/javac.1*
+%{_mandir}/man1/javadoc.1*
+%{_mandir}/man1/javap.1*
+%{_mandir}/man1/jcmd.1*
+%{_mandir}/man1/jconsole.1*
+%{_mandir}/man1/jdb.1*
+%{_mandir}/man1/jdeps.1*
+%{_mandir}/man1/jinfo.1*
+%{_mandir}/man1/jmap.1*
+%{_mandir}/man1/jps.1*
+%{_mandir}/man1/jrunscript.1*
+%{_mandir}/man1/jstack.1*
+%{_mandir}/man1/jstat.1*
+%{_mandir}/man1/jstatd.1*
+%{_mandir}/man1/serialver.1*
+%else
+%{_jvmdir}/java-%{major}-openjdk/man/man1/jar.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/jarsigner.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/javac.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/javadoc.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/javap.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/jcmd.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/jconsole.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/jdb.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/jdeps.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/jinfo.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/jmap.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/jps.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/jrunscript.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/jstack.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/jstat.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/jstatd.1*
+%{_jvmdir}/java-%{major}-openjdk/man/man1/serialver.1*
+%endif
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.accessibility
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.attach
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.charsets
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.compiler
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.crypto.cryptoki
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.crypto.ec
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.dynalink
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.editpad
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.hotspot.agent
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.httpserver
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.incubator.foreign
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.internal.ed
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.internal.jvmstat
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.internal.le
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.internal.opt
+%ifnarch %{ix86} %{arm}
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.internal.vm.ci
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.internal.vm.compiler.management
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.internal.vm.compiler
+%endif
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.jartool
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.javadoc
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.jcmd
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.jconsole
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.jdeps
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.jdi
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.jdwp.agent
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.jfr
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.jlink
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.jshell
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.jsobject
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.jstatd
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.localedata
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.management.agent
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.management.jfr
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.management
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.naming.dns
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.naming.rmi
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.net
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.nio.mapmode
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.sctp
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.security.auth
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.security.jgss
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.unsupported
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.xml.dom
+%doc %{_jvmdir}/java-%{major}-openjdk/legal/jdk.zipfs
+
+%files demo
+%{_jvmdir}/java-%{major}-openjdk/demo
+
+%files source
+%{_jvmdir}/java-%{major}-openjdk/lib/src.zip
+
+%files debug
+%{_jvmdir}/java-%{major}-openjdk/bin/*.debuginfo
+%{_jvmdir}/java-%{major}-openjdk/lib/*.debuginfo
+
+%modpackage java.compiler
+%modpackage java.datatransfer
+%modpackage java.instrument
+%modpackage java.logging
+%modpackage java.management
+%modpackage java.management.rmi
+%modpackage java.naming
+%modpackage java.net.http
+%modpackage java.prefs
+%modpackage java.rmi
+%modpackage java.scripting
+%modpackage java.se
+%modpackage java.security.jgss
+%modpackage java.security.sasl
+%modpackage java.smartcardio
+%modpackage java.sql
+%modpackage java.sql.rowset
+%modpackage java.transaction.xa
+%modpackage java.xml
+%modpackage java.xml.crypto
+
+%modpackage jdk.accessibility
+%modpackage jdk.attach
+%modpackage jdk.charsets
+%modpackage jdk.compiler
+%modpackage jdk.crypto.cryptoki
+%modpackage jdk.crypto.ec
+%modpackage jdk.dynalink
+%modpackage jdk.editpad
+%modpackage jdk.hotspot.agent
+%modpackage jdk.httpserver
+%modpackage jdk.incubator.foreign
+%modpackage jdk.incubator.vector
+%modpackage jdk.jartool
+%modpackage jdk.javadoc
+%modpackage jdk.jcmd
+%modpackage jdk.jconsole
+%modpackage jdk.jdeps
+%modpackage jdk.jdi
+%modpackage jdk.jdwp.agent
+%modpackage jdk.jfr
+%modpackage jdk.jlink
+%modpackage jdk.jpackage
+%modpackage jdk.jshell
+%modpackage jdk.jsobject
+%modpackage jdk.jstatd
+%modpackage jdk.localedata
+%modpackage jdk.management.agent
+%modpackage jdk.management.jfr
+%modpackage jdk.management
+%modpackage jdk.naming.dns
+%modpackage jdk.naming.rmi
+%modpackage jdk.net
+%modpackage jdk.nio.mapmode
+%modpackage jdk.random
+%modpackage jdk.sctp
+%modpackage jdk.security.auth
+%modpackage jdk.security.jgss
+%modpackage jdk.unsupported.desktop
+%modpackage jdk.unsupported
+%modpackage jdk.xml.dom
+%modpackage jdk.zipfs
diff --git a/openjdk-13-fix-build.patch b/openjdk-13-fix-build.patch
new file mode 100644
index 0000000..41c1188
--- /dev/null
+++ b/openjdk-13-fix-build.patch
@@ -0,0 +1,12 @@
+diff -up openjdk/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_convert.c.omv~ openjdk/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_convert.c
+--- openjdk/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_convert.c.omv~	2019-09-21 10:36:54.069646376 +0200
++++ openjdk/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_convert.c	2019-09-21 10:37:15.900024315 +0200
+@@ -1438,7 +1438,7 @@ CK_VOID_PTR jMechParamToCKMechParamPtrSl
+                     (CK_X9_42_DH2_DERIVE_PARAMS_PTR) ckpParamPtr);
+             break;
+         // defined by pkcs11.h but we don't support
+-        case CKM_KEA_DERIVE: // CK_KEA_DERIVE_PARAMS
++        case CKM_KEA_KEY_DERIVE: // CK_KEA_DERIVE_PARAMS
+         case CKM_RC2_CBC: // CK_RC2_CBC_PARAMS
+         case CKM_RC2_MAC_GENERAL: // CK_RC2_MAC_GENERAL_PARAMS
+         case CKM_RC5_ECB: // CK_RC5_PARAMS
diff --git a/openjdk-15-nss-3.57.patch b/openjdk-15-nss-3.57.patch
new file mode 100644
index 0000000..bc9d5e6
--- /dev/null
+++ b/openjdk-15-nss-3.57.patch
@@ -0,0 +1,24 @@
+diff -up openjdk/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_convert.c.omv~ openjdk/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_convert.c
+--- openjdk/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_convert.c.omv~	2020-10-19 16:01:54.532719666 +0200
++++ openjdk/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_convert.c	2020-10-19 16:02:06.560871871 +0200
+@@ -1471,7 +1471,7 @@ CK_VOID_PTR jMechParamToCKMechParamPtrSl
+             ckpParamPtr = jX942Dh2DeriveParamToCKX942Dh2DeriveParamPtr(env, jParam, ckpLength);
+             break;
+         // defined by pkcs11.h but we don't support
+-        case CKM_KEA_DERIVE: // CK_KEA_DERIVE_PARAMS
++        case CKM_KEA_KEY_DERIVE: // CK_KEA_DERIVE_PARAMS
+         case CKM_RC2_CBC: // CK_RC2_CBC_PARAMS
+         case CKM_RC2_MAC_GENERAL: // CK_RC2_MAC_GENERAL_PARAMS
+         case CKM_RC5_ECB: // CK_RC5_PARAMS
+diff -up openjdk/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_util.c.omv~ openjdk/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_util.c
+--- openjdk/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_util.c.omv~	2020-10-19 16:02:41.622315525 +0200
++++ openjdk/src/jdk.crypto.cryptoki/share/native/libj2pkcs11/p11_util.c	2020-10-19 16:06:38.215308758 +0200
+@@ -381,7 +381,7 @@ void freeCKMechanismPtr(CK_MECHANISM_PTR
+                  case CKM_TLS_MAC:
+                  case CKM_AES_CTR:
+                  case CKM_RSA_PKCS_PSS:
+-                 case CKM_CAMELLIA_CTR:
++                 //case CKM_CAMELLIA_CTR: // FIXME gone in nss 3.56 -- does anything replace this?
+                      // params do not contain pointers
+                      break;
+                  default:
diff --git a/openjdk-16-glibc-2.34.patch b/openjdk-16-glibc-2.34.patch
new file mode 100644
index 0000000..b7c4f3c
--- /dev/null
+++ b/openjdk-16-glibc-2.34.patch
@@ -0,0 +1,14 @@
+diff -up openjdk/test/hotspot/jtreg/runtime/StackGuardPages/exeinvoke.c.8~ openjdk/test/hotspot/jtreg/runtime/StackGuardPages/exeinvoke.c
+--- openjdk/test/hotspot/jtreg/runtime/StackGuardPages/exeinvoke.c.8~	2021-08-25 22:18:29.985273769 +0200
++++ openjdk/test/hotspot/jtreg/runtime/StackGuardPages/exeinvoke.c	2021-08-25 22:19:22.321395441 +0200
+@@ -68,7 +68,9 @@ static void handler(int sig, siginfo_t *
+ }
+ 
+ void set_signal_handler() {
+-  static char altstack[SIGSTKSZ];
++  static char *altstack=(char*)NULL;
++
++  if(!altstack) altstack=(char*)malloc(SIGSTKSZ);
+ 
+   stack_t ss = {
+     .ss_size = SIGSTKSZ,
diff --git a/pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch b/pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch
new file mode 100644
index 0000000..4efbe9a
--- /dev/null
+++ b/pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch
@@ -0,0 +1,88 @@
+
+# HG changeset patch
+# User andrew
+# Date 1478057514 0
+# Node ID 1c4d5cb2096ae55106111da200b0bcad304f650c
+# Parent  3d53f19b48384e5252f4ec8891f7a3a82d77af2a
+PR3183: Support Fedora/RHEL system crypto policy
+diff -r 3d53f19b4838 -r 1c4d5cb2096a src/java.base/share/classes/java/security/Security.java
+--- a/src/java.base/share/classes/java/security/Security.java	Wed Oct 26 03:51:39 2016 +0100
++++ b/src/java.base/share/classes/java/security/Security.java	Wed Nov 02 03:31:54 2016 +0000
+@@ -43,6 +43,9 @@
+  * implementation-specific location, which is typically the properties file
+  * {@code conf/security/java.security} in the Java installation directory.
+  *
++ * <p>Additional default values of security properties are read from a
++ * system-specific location, if available.</p>
++ *
+  * @author Benjamin Renaud
+  * @since 1.1
+  */
+@@ -52,6 +55,10 @@
+     private static final Debug sdebug =
+                         Debug.getInstance("properties");
+ 
++    /* System property file*/
++    private static final String SYSTEM_PROPERTIES =
++        "/etc/crypto-policies/back-ends/java.config";
++
+     /* The java.security properties */
+     private static Properties props;
+ 
+@@ -93,6 +100,7 @@
+                 if (sdebug != null) {
+                     sdebug.println("reading security properties file: " +
+                                 propFile);
++                    sdebug.println(props.toString());
+                 }
+             } catch (IOException e) {
+                 if (sdebug != null) {
+@@ -114,6 +122,31 @@
+         }
+ 
+         if ("true".equalsIgnoreCase(props.getProperty
++                ("security.useSystemPropertiesFile"))) {
++
++            // now load the system file, if it exists, so its values
++            // will win if they conflict with the earlier values
++            try (BufferedInputStream bis =
++                 new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
++                props.load(bis);
++                loadedProps = true;
++
++                if (sdebug != null) {
++                    sdebug.println("reading system security properties file " +
++                                   SYSTEM_PROPERTIES);
++                    sdebug.println(props.toString());
++                }
++            } catch (IOException e) {
++                if (sdebug != null) {
++                    sdebug.println
++                        ("unable to load security properties from " +
++                         SYSTEM_PROPERTIES);
++                    e.printStackTrace();
++                }
++            }
++        }
++
++        if ("true".equalsIgnoreCase(props.getProperty
+                 ("security.overridePropertiesFile"))) {
+ 
+             String extraPropFile = System.getProperty
+diff -r 3d53f19b4838 -r 1c4d5cb2096a src/java.base/share/conf/security/java.security
+--- a/src/java.base/share/conf/security/java.security	Wed Oct 26 03:51:39 2016 +0100
++++ b/src/java.base/share/conf/security/java.security	Wed Nov 02 03:31:54 2016 +0000
+@@ -276,6 +276,13 @@
+ security.overridePropertiesFile=true
+ 
+ #
++# Determines whether this properties file will be appended to
++# using the system properties file stored at
++# /etc/crypto-policies/back-ends/java.config
++#
++security.useSystemPropertiesFile=true
++
++#
+ # Determines the default key and trust manager factory algorithms for
+ # the javax.net.ssl package.
+ #
diff --git a/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch b/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
new file mode 100644
index 0000000..3042186
--- /dev/null
+++ b/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
@@ -0,0 +1,16 @@
+diff -r 618ad1237e73 src/java.desktop/share/classes/java/awt/Toolkit.java
+--- a/src/java.desktop/share/classes/java/awt/Toolkit.java	Thu Jun 13 19:37:49 2019 +0200
++++ b/src/java.desktop/share/classes/java/awt/Toolkit.java	Thu Jul 04 10:35:42 2019 +0200
+@@ -595,7 +595,11 @@
+                 toolkit = new HeadlessToolkit(toolkit);
+             }
+             if (!GraphicsEnvironment.isHeadless()) {
+-                loadAssistiveTechnologies();
++                try {
++                    loadAssistiveTechnologies();
++                } catch (AWTError error) {
++                    // ignore silently
++                }
+             }
+         }
+         return toolkit;
diff --git a/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch b/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
new file mode 100644
index 0000000..5ae3b00
--- /dev/null
+++ b/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
@@ -0,0 +1,11 @@
+diff -up openjdk/src/java.base/share/conf/security/java.security.1~ openjdk/src/java.base/share/conf/security/java.security
+--- openjdk/src/java.base/share/conf/security/java.security.1~	2020-10-19 10:54:38.224370673 +0200
++++ openjdk/src/java.base/share/conf/security/java.security	2020-10-19 10:56:08.598815470 +0200
+@@ -78,6 +78,7 @@ security.provider.tbd=SunMSCAPI
+ security.provider.tbd=Apple
+ #endif
+ security.provider.tbd=SunPKCS11
++#security.provider.tbd=SunPKCS11 ${java.home}/lib/security/nss.cfg
+ 
+ #
+ # A list of preferred providers for specific algorithms. These providers will
diff --git a/rh1648644-java_access_bridge_privileged_security.patch b/rh1648644-java_access_bridge_privileged_security.patch
new file mode 100644
index 0000000..53026ad
--- /dev/null
+++ b/rh1648644-java_access_bridge_privileged_security.patch
@@ -0,0 +1,20 @@
+--- openjdk/src/java.base/share/conf/security/java.security
++++ openjdk/src/java.base/share/conf/security/java.security
+@@ -304,6 +304,8 @@
+ #
+ package.access=sun.misc.,\
+                sun.reflect.,\
++               org.GNOME.Accessibility.,\
++               org.GNOME.Bonobo.,\
+ 
+ #
+ # List of comma-separated packages that start with or equal this string
+@@ -316,6 +318,8 @@
+ #
+ package.definition=sun.misc.,\
+                    sun.reflect.,\
++                   org.GNOME.Accessibility.,\
++                   org.GNOME.Bonobo.,\
+ 
+ #
+ # Determines whether this properties file can be appended to
diff --git a/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch b/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
new file mode 100644
index 0000000..1b706a1
--- /dev/null
+++ b/rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk10_and_up.patch
@@ -0,0 +1,19 @@
+Remove uses of FAR in jpeg code
+
+Upstream libjpeg-trubo removed the (empty) FAR macro:
+http://sourceforge.net/p/libjpeg-turbo/code/1312/
+
+Adjust our code to not use the undefined FAR macro anymore.
+
+diff --git a/jdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c b/jdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c
+--- openjdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c
++++ openjdk/src/java.desktop/share/native/libjavajpeg/imageioJPEG.c
+@@ -1385,7 +1385,7 @@
+     /* and fill it in */
+     dst_ptr = icc_data;
+     for (seq_no = first; seq_no < last; seq_no++) {
+-        JOCTET FAR *src_ptr = icc_markers[seq_no]->data + ICC_OVERHEAD_LEN;
++        JOCTET *src_ptr = icc_markers[seq_no]->data + ICC_OVERHEAD_LEN;
+         unsigned int length =
+             icc_markers[seq_no]->data_length - ICC_OVERHEAD_LEN;
+