[PATCH] jdk7u85-b01 retro-active security patch review

Thu Aug 20 01:27:14 UTC 2015

We have a new release of IcedTea [0] and a new OpenJDK 7 release, u85-b01,
to go with it. This is made from the current state of the OpenJDK 7u
repositories plus backports of the new security fixes included in 8u51.

Release tarballs for u85-b01 will follow.

Changes since u80-b32:
  - S7124253: [macosx] Flavor change notification not coming
  - S8007219: [macosx] Frame size reverts meaning of maximized attribute if frame size close to display
  - S8013581: [macosx] Key Bindings break with awt GraphicsEnvironment setFullScreenWindow
  - S8014464: Update jcheck for OpenJDK 7
  - S8020210: [macosx] JVM crashes in CWrapper$NSWindow.screen(long)
  - S8027058: sun/management/jmxremote/bootstrap/RmiBootstrapTest.sh Failed to initialize connector
  - S8027561: [macosx] Cleanup "may not respond to selector" warnings in native code
  - S8028617: Dvorak keyboard mapping not honored when ctrl key pressed
  - S8029868: Fix KSS issues in sun.lwawt.macosx
  - S8042205: javax/management/monitor/*: some tests didn't  get all the notifications
  - S8043201: Deprecate RC4 in SunJSSE provider
  - S8043202: Prohibit RC4 cipher suites
  - S8046817: JDK 8 schemagen tool does not generate xsd files for enum types
  - S8048194: GSSContext.acceptSecContext fails when a supported mech is not initiator preferred
  - S8048214: Linker error when compiling G1SATBCardTableModRefBS after include order changes
  - S8064546: CipherInputStream throws BadPaddingException if stream is not fully read
  - S8065764: javax/management/monitor/CounterMonitorTest.java hangs
  - S8066952: [TEST-BUG] javax/management/monitor/CounterMonitorTest.java hangs
  - S8067694: Improved certification checking
  - S8068674: Increment minor version of HSx for 7u85 and initialize the build number
  - S8071668: [macosx] Clipboard does not work with 3rd parties Clipboard Managers
  - S8071715: Tune font layout engine
  - S8071731: Better scaling for C1
  - S8072490: Better font morphing redux
  - S8072887: Better font handling improvements
  - S8073334: Improved font substitutions
  - S8073357: schema1.xsd has wrong content. Sequence of the enum values has been changed
  - S8073385: Bad error message on parsing illegal character in XML attribute
  - S8073773: Presume path preparedness
  - S8073894: Getting to the root of certificate chains
  - S8074098: 2D_Font/Bug8067699 test fails with SIGBUS crash on Solaris Sparc
  - S8074297: substring in XSLT returns wrong character if string contains supplementary chars
  - S8074312: Enable hotspot builds on 4.x Linux kernels
  - S8074330: Set font anchors more solidly
  - S8074335: Substitute for substitution formats
  - S8074865: General crypto resilience changes
  - S8074871: Adjust device table handling
  - S8075374: Responding to OCSP responses
  - S8075378: JNDI DnsClient Exception Handling
  - S8075575: com/sun/security/auth/login/ConfigFile/InconsistentError.java failed in certain env.
  - S8075576: com/sun/security/auth/module/KeyStoreLoginModule/OptionTest.java failed in certain env.
  - S8075667: (tz) Support tzdata2015b
  - S8075738: Better multi-JVM sharing
  - S8075833: Straighter Elliptic Curves
  - S8075838: Method for typing MethodTypes
  - S8075853: Proxy for MBean proxies
  - S8076290: JCK test api/xsl/conf/string/string17 starts failing after JDK-8074297
  - S8076328: Enforce key exchange constraints
  - S8076376: Enhance IIOP operations
  - S8076397: Better MBean connections
  - S8076401: Serialize OIS data
  - S8076405: Improve serial serialization
  - S8076409: Reinforce RMI framework
  - S8077520: Morph tables into improved form
  - S8077685: (tz) Support tzdata2015d
  - S8078348: sun/security/pkcs11/sslecc/ClientJSSEServerJSSE.java fails with BindException
  - S8078439: SPNEGO auth fails if client proposes MS krb5 OID
  - S8078529: Increment the build value to b02 for hs24.85 in 7u85
  - S8078562: Add modified dates
  - S8078666: JVM fastdebug build compiled with GCC 5 asserts with "widen increases"
  - S8080318: jdk7u85 l10n resource file translation update
  - S8081386: Test sun/management/jmxremote/bootstrap/RmiSslBootstrapTest.sh test has RC4 dependencies
  - S8081622: Increment the build value to b03 for hs24.85 in 7u85
  - S8081775: two lib/testlibrary tests are failing with "Error. failed to clean up files after test" with jtreg 4.1 b12
  - S8133966: Allow OpenJDK to build on PaX-enabled kernels
  - S8133967: Fix build where PAX_COMMAND is not specified
  - S8133968: Revert 8014464 on OpenJDK 7
  - S8133970: Only apply PaX-marking when needed by a running PaX kernel
  - S8133990: Revert introduction of lambda expression in sun.lwawt.macosx.LWCToolkit
  - S8133991: Fix mistake in 8075374 backport
  - S8133993: [TEST_BUG] Make CipherInputStreamExceptions compile on OpenJDK 7

Webrevs for the new changes:

http://cr.openjdk.java.net/~andrew/openjdk7/20150714/root/
http://cr.openjdk.java.net/~andrew/openjdk7/20150714/corba/
http://cr.openjdk.java.net/~andrew/openjdk7/20150714/jaxp/
http://cr.openjdk.java.net/~andrew/openjdk7/20150714/jaxws/
http://cr.openjdk.java.net/~andrew/openjdk7/20150714/hotspot/
http://cr.openjdk.java.net/~andrew/openjdk7/20150714/jdk/
http://cr.openjdk.java.net/~andrew/openjdk7/20150714/langtools/

Once approved, I'll push these to the OpenJDK 7u repository.

[0] http://bitly.com/it20601

Thanks,
-- 
Andrew :)

Senior Free Java Software Engineer
Red Hat, Inc. (http://www.redhat.com)

PGP Key: ed25519/35964222 (hkp://keys.gnupg.net)
Fingerprint = 5132 579D D154 0ED2 3E04  C5A0 CFDA 0F9B 3596 4222

PGP Key: rsa4096/248BDC07 (hkp://keys.gnupg.net)
Fingerprint = EC5A 1F5E C0AD 1D15 8F1F  8F91 3B96 A578 248B DC07