Version: 3.2.0

Security fixes

    S8146490: Direct indirect CRL checks
    S8151921: Improved page resolution
    S8155968: Update command line options
    S8155973, CVE-2016-5542: Tighten jar checks
    S8156794: Extend data sharing
    S8157176: Improved classfile parsing
    S8157739, CVE-2016-5554: Classloader Consistency Checking
    S8157749: Improve handling of DNS error replies
    S8157753: Audio replay enhancement
    S8157759: LCMS Transform Sampling Enhancement
    S8157764: Better handling of interpolation plugins
    S8158302: Handle contextual glyph substitutions
    S8158993, CVE-2016-5568: Service Menu services
    S8159495: Fix index offsets
    S8159503: Amend Annotation Actions
    S8159511: Stack map validation
    S8159515: Improve indy validation
    S8159519, CVE-2016-5573: Reformat JDWP messages
    S8160090: Better signature handling in pack200
    S8160094: Improve pack200 layout
    S8160098: Clean up color profiles
    S8160591, CVE-2016-5582: Improve internal array handling
    S8160838, CVE-2016-5597: Better HTTP service
    PR3206, RH1367357: lcms2: Out-of-bounds read in Type_MLU_Read()

diff --git a/icedtea8-heimdal.patch b/icedtea8-heimdal.patch
new file mode 100644 (file)
index 0000000..0030f69
--- /dev/null
+++ b/icedtea8-heimdal.patch
@@ -0,0 +1,17 @@
+--- icedtea-3.2.0/acinclude.m4.orig    2016-11-10 09:04:36.000000000 +0100
++++ icedtea-3.2.0/acinclude.m4 2016-11-10 09:06:11.000000000 +0100
+@@ -1814,10 +1814,10 @@
+   AC_MSG_RESULT(${ENABLE_SYSTEM_KERBEROS})
+   if test x"${ENABLE_SYSTEM_KERBEROS}" = "xyes"; then
+     dnl Check for krb5 header and library.
+-    PKG_CHECK_MODULES(KRB5, krb5, [KRB5_FOUND=yes], [KRB5_FOUND=no])
+-    if test "x${KRB5_FOUND}" = "xno"; then
+-      AC_MSG_ERROR([Could not find Kerberos; install Kerberos or build with --disable-system-kerberos to use the default cache location.])
+-    fi
++    KRB5_LIBS=`krb5-config --libs`
++    KRB5_CFLAGS=`krb5-config --cflags`
++    AC_SUBST(KRB5_LIBS)
++    AC_SUBST(KRB5_CFLAGS)
+   fi
+   AM_CONDITIONAL(USE_SYSTEM_KERBEROS, test x"${ENABLE_SYSTEM_KERBEROS}" = "xyes")
+   AC_SUBST(ENABLE_SYSTEM_KERBEROS)

diff --git a/icedtea8.spec b/icedtea8.spec
index f6c0b419d0723e9816f276a583f5b6bf031423c5..a486254256e982c69461ca5802bcd568ecd45d0f 100644 (file)
--- a/icedtea8.spec
+++ b/icedtea8.spec
@@ -26,39 +26,41 @@
 # class data version seen with file(1) that this jvm is able to load
 %define                _classdataversion 52.0
 # JDK/JRE version, as returned with `java -version`, '_' replaced with '.'
-%define                _jdkversion 1.8.0.101
+%define                _jdkversion 1.8.0.111
 
 Summary:       OpenJDK and GNU Classpath code
 Summary(pl.UTF-8):     Kod OpenJDK i GNU Classpath
 Name:          icedtea8
-Version:       3.1.0
-Release:       1
+Version:       3.2.0
+Release:       0.1
 License:       GPL v2
 Group:         Development/Languages/Java
 Source0:       http://icedtea.wildebeest.org/download/source/icedtea-%{version}.tar.gz
-# Source0-md5: 7b54dacd18f3adc0d77008d15db2b5c6
+# Source0-md5: c25ceec95f8df5066c617b14f2735227
 Source1:       http://icedtea.wildebeest.org/download/drops/icedtea8/%{version}/openjdk.tar.xz
-# Source1-md5: 1b9b9e9102abfc387acb4d244580fb9a
+# Source1-md5: c7a7681fff0afda6a897b135820a1440
 Source2:       http://icedtea.wildebeest.org/download/drops/icedtea8/%{version}/corba.tar.xz
-# Source2-md5: d697eb0b8df5ee5242768be1678f1684
+# Source2-md5: 19a12dc608da61a6878f4614a91156af
 Source3:       http://icedtea.wildebeest.org/download/drops/icedtea8/%{version}/jaxp.tar.xz
-# Source3-md5: a3cbe28e27ebff38c8475ecae56ad446
+# Source3-md5: 8b1171ec1060517fc1c4eee162c78b33
 Source4:       http://icedtea.wildebeest.org/download/drops/icedtea8/%{version}/jaxws.tar.xz
-# Source4-md5: 92da27a8622b92ee60ca67452f695927
+# Source4-md5: ca6bbcdb0f87399bd0a5481ad55939c8
 Source5:       http://icedtea.wildebeest.org/download/drops/icedtea8/%{version}/jdk.tar.xz
-# Source5-md5: e2143b152be03f3ec66313294606c100
+# Source5-md5: 5f5d90b7036f1e8561f6943308528e80
 Source6:       http://icedtea.wildebeest.org/download/drops/icedtea8/%{version}/langtools.tar.xz
-# Source6-md5: 39c75541d8bbe9be9cfd7f58c0950641
+# Source6-md5: 9d105ca8e4de3936fe1a4916ec30ad7f
 Source7:       http://icedtea.wildebeest.org/download/drops/icedtea8/%{version}/hotspot.tar.xz
-# Source7-md5: d4d70521fee922201c309a64be22b239
+# Source7-md5: cc5f423ed2949ee8a7e25d43f0cb425f
 Source8:       http://icedtea.wildebeest.org/download/drops/icedtea8/%{version}/nashorn.tar.xz
-# Source8-md5: 3c266698f3b192fd5616ce9548d1ead2
+# Source8-md5: 05fa4f0110a5c9c18828a3e359b1adde
 Source10:      make-cacerts.sh
 # 0-99 patches for the IcedTea files
 Patch0:                %{name}-x32-ac.patch
+Patch1:                %{name}-heimdal.patch
 # 100-... patches applied to the extracted sources
 Patch100:      %{name}-libpath.patch
 Patch101:      %{name}-x32.patch
+Patch102:      openjdk-heimdal.patch
 URL:           http://icedtea.classpath.org/wiki/Main_Page
 BuildRequires: alsa-lib-devel
 BuildRequires: ant
@@ -442,6 +444,7 @@ Przykłady dla OpenJDK.
 %prep
 %setup -qn icedtea-%{version}
 %patch0 -p1
+%patch1 -p1
 
 # patches to applied to the extracted sources
 install -d pld-patches
@@ -449,6 +452,7 @@ cp -p %{PATCH100} pld-patches
 %ifarch x32
 cp -p %{PATCH101} pld-patches
 %endif
+cp -p %{PATCH102} pld-patches
 
 # let the build system extract the sources where it wants them
 install -d drops
@@ -459,7 +463,7 @@ ln -s %{SOURCE4} jaxws.tar.xz
 ln -s %{SOURCE5} jdk.tar.xz
 ln -s %{SOURCE6} langtools.tar.xz
 ln -s %{SOURCE7} hotspot.tar.xz
-ln -s %{SOURCE8} nashorn.tar.tar.xz
+ln -s %{SOURCE8} nashorn.tar.xz
 
 %build
 # Make sure we have /proc mounted - otherwise idlc will fail later.
@@ -827,8 +831,10 @@ rm -rf $RPM_BUILD_ROOT
 %attr(755,root,root) %{jredir}/lib/%{jre_arch}/libhprof.so
 %attr(755,root,root) %{jredir}/lib/%{jre_arch}/libinstrument.so
 %attr(755,root,root) %{jredir}/lib/%{jre_arch}/libj2gss.so
+%attr(755,root,root) %{jredir}/lib/%{jre_arch}/libj2krb5.so
 %attr(755,root,root) %{jredir}/lib/%{jre_arch}/libj2pcsc.so
 %attr(755,root,root) %{jredir}/lib/%{jre_arch}/libj2pkcs11.so
+%attr(755,root,root) %{jredir}/lib/%{jre_arch}/libj2sctp.so
 %attr(755,root,root) %{jredir}/lib/%{jre_arch}/libjaas_unix.so
 %attr(755,root,root) %{jredir}/lib/%{jre_arch}/libjava.so
 %attr(755,root,root) %{jredir}/lib/%{jre_arch}/libjavajpeg.so
@@ -848,7 +854,6 @@ rm -rf $RPM_BUILD_ROOT
 %ifnarch x32
 %attr(755,root,root) %{jredir}/lib/%{jre_arch}/libsaproc.so
 %endif
-%attr(755,root,root) %{jredir}/lib/%{jre_arch}/libsctp.so
 %{?with_sunec:%attr(755,root,root) %{jredir}/lib/%{jre_arch}/libsunec.so}
 %attr(755,root,root) %{jredir}/lib/%{jre_arch}/libunpack.so
 %attr(755,root,root) %{jredir}/lib/%{jre_arch}/libverify.so

diff --git a/openjdk-heimdal.patch b/openjdk-heimdal.patch
new file mode 100644 (file)
index 0000000..a14bd2f
--- /dev/null
+++ b/openjdk-heimdal.patch
@@ -0,0 +1,21 @@
+--- openjdk/common/autoconf/libraries.m4.orig  2016-11-10 09:13:39.000000000 +0100
++++ openjdk/common/autoconf/libraries.m4       2016-11-10 09:14:24.000000000 +0100
+@@ -954,12 +954,12 @@
+   AC_MSG_RESULT([$system_krb5])
+ 
+   if test "x${system_krb5}" = "xyes"; then
+-      PKG_CHECK_MODULES(KRB5, krb5, [KRB5_FOUND=yes], [KRB5_FOUND=no])
+-      if test "x${KRB5_FOUND}" = "xyes"; then
+-        USE_EXTERNAL_KRB5=true
+-      else
+-        AC_MSG_ERROR([--enable-system-kerberos specified, but Kerberos not found.])
+-      fi
++      KRB5_LIBS=`krb5-config --libs`
++      KRB5_CFLAGS=`krb5-config --cflags`
++      AC_SUBST(KRB5_LIBS)
++      AC_SUBST(KRB5_CFLAGS)
++      KRB5_FOUND=yes
++      USE_EXTERNAL_KRB5=true
+   else
+       USE_EXTERNAL_KRB5=false
+   fi