", "validity.number.of.days");
+@@ -559,6 +561,8 @@
+ protectedPath = true;
+ } else if (collator.compare(flags, "-srcprotected") == 0) {
+ srcprotectedPath = true;
++ } else if (collator.compare(flags, "-systemlineendings") == 0) {
++ systemLineEndings = true;
+ } else {
+ System.err.println(rb.getString("Illegal.option.") + flags);
+ tinyHelp();
+@@ -1463,7 +1467,7 @@
+
+ // Sign the request and base-64 encode it
+ request.encodeAndSign(subject, signature);
+- request.print(out);
++ request.print(out, systemLineEndings);
+
+ checkWeak(rb.getString("the.generated.certificate.request"), request);
+ }
+@@ -4540,4 +4544,3 @@
+ return new Pair<>(a,b);
+ }
+ }
+-
+diff --git a/src/share/classes/sun/security/tools/keytool/Resources.java b/src/share/classes/sun/security/tools/keytool/Resources.java
+--- openjdk/jdk/src/share/classes/sun/security/tools/keytool/Resources.java
++++ openjdk/jdk/src/share/classes/sun/security/tools/keytool/Resources.java
+@@ -168,6 +168,8 @@
+ "keystore password"}, //-storepass
+ {"keystore.type",
+ "keystore type"}, //-storetype
++ {"system.line.endings",
++ "use system line endings rather than CRLF to terminate output"}, //-systemlineendings
+ {"trust.certificates.from.cacerts",
+ "trust certificates from cacerts"}, //-trustcacerts
+ {"verbose.output",
diff --git a/SOURCES/pr3083-rh1346460-for_ssl_debug_return_null_instead_of_exception_when_theres_no_ecc_provider.patch b/SOURCES/pr3083-rh1346460-for_ssl_debug_return_null_instead_of_exception_when_theres_no_ecc_provider.patch
new file mode 100644
index 0000000..b52c087
--- /dev/null
+++ b/SOURCES/pr3083-rh1346460-for_ssl_debug_return_null_instead_of_exception_when_theres_no_ecc_provider.patch
@@ -0,0 +1,164 @@
+# HG changeset patch
+# User andrew
+# Date 1467652889 -3600
+# Mon Jul 04 18:21:29 2016 +0100
+# Node ID a4541d1d8609cadb08d3e31b40b9184ff32dd6c3
+# Parent bc6eab2038c603afb2eb2b4644f3b900c8fd0c46
+PR3083, RH1346460: Regression in SSL debug output without an ECC provider
+Summary: Return null rather than throwing an exception when there's no ECC provider.
+
+diff --git openjdk.orig/jdk/src/share/classes/sun/security/ec/ECKeyPairGenerator.java openjdk/jdk/src/share/classes/sun/security/ec/ECKeyPairGenerator.java
+--- openjdk.orig/jdk/src/share/classes/sun/security/ec/ECKeyPairGenerator.java
++++ openjdk/jdk/src/share/classes/sun/security/ec/ECKeyPairGenerator.java
+@@ -121,7 +121,7 @@
+ private static void ensureCurveIsSupported(ECParameterSpec ecSpec)
+ throws InvalidAlgorithmParameterException {
+
+- AlgorithmParameters ecParams = ECUtil.getECParameters(null);
++ AlgorithmParameters ecParams = ECUtil.getECParameters(null, true);
+ byte[] encodedParams;
+ try {
+ ecParams.init(ecSpec);
+diff --git openjdk.orig/jdk/src/share/classes/sun/security/util/Debug.java openjdk/jdk/src/share/classes/sun/security/util/Debug.java
+--- openjdk.orig/jdk/src/share/classes/sun/security/util/Debug.java
++++ openjdk/jdk/src/share/classes/sun/security/util/Debug.java
+@@ -73,6 +73,7 @@
+ System.err.println("certpath PKIX CertPathBuilder and");
+ System.err.println(" CertPathValidator debugging");
+ System.err.println("combiner SubjectDomainCombiner debugging");
++ System.err.println("ecc Elliptic Curve Cryptography debugging");
+ System.err.println("gssloginconfig");
+ System.err.println(" GSS LoginConfigImpl debugging");
+ System.err.println("configfile JAAS ConfigFile loading");
+diff --git openjdk.orig/jdk/src/share/classes/sun/security/util/ECUtil.java openjdk/jdk/src/share/classes/sun/security/util/ECUtil.java
+--- openjdk.orig/jdk/src/share/classes/sun/security/util/ECUtil.java
++++ openjdk/jdk/src/share/classes/sun/security/util/ECUtil.java
+@@ -41,6 +41,9 @@
+
+ public class ECUtil {
+
++ /* Are we debugging ? */
++ private static final Debug debug = Debug.getInstance("ecc");
++
+ // Used by SunPKCS11 and SunJSSE.
+ public static ECPoint decodePoint(byte[] data, EllipticCurve curve)
+ throws IOException {
+@@ -90,6 +93,10 @@
+ }
+
+ public static AlgorithmParameters getECParameters(Provider p) {
++ return getECParameters(p, false);
++ }
++
++ public static AlgorithmParameters getECParameters(Provider p, boolean throwException) {
+ try {
+ if (p != null) {
+ return AlgorithmParameters.getInstance("EC", p);
+@@ -97,13 +104,21 @@
+
+ return AlgorithmParameters.getInstance("EC");
+ } catch (NoSuchAlgorithmException nsae) {
+- throw new RuntimeException(nsae);
++ if (throwException) {
++ throw new RuntimeException(nsae);
++ } else {
++ // ECC provider is optional so just return null
++ if (debug != null) {
++ debug.println("Provider unavailable: " + nsae);
++ }
++ return null;
++ }
+ }
+ }
+
+ public static byte[] encodeECParameterSpec(Provider p,
+ ECParameterSpec spec) {
+- AlgorithmParameters parameters = getECParameters(p);
++ AlgorithmParameters parameters = getECParameters(p, true);
+
+ try {
+ parameters.init(spec);
+@@ -122,11 +137,16 @@
+ public static ECParameterSpec getECParameterSpec(Provider p,
+ ECParameterSpec spec) {
+ AlgorithmParameters parameters = getECParameters(p);
++ if (parameters == null)
++ return null;
+
+ try {
+ parameters.init(spec);
+ return parameters.getParameterSpec(ECParameterSpec.class);
+ } catch (InvalidParameterSpecException ipse) {
++ if (debug != null) {
++ debug.println("Invalid parameter specification: " + ipse);
++ }
+ return null;
+ }
+ }
+@@ -135,34 +155,49 @@
+ byte[] params)
+ throws IOException {
+ AlgorithmParameters parameters = getECParameters(p);
++ if (parameters == null)
++ return null;
+
+ parameters.init(params);
+
+ try {
+ return parameters.getParameterSpec(ECParameterSpec.class);
+ } catch (InvalidParameterSpecException ipse) {
++ if (debug != null) {
++ debug.println("Invalid parameter specification: " + ipse);
++ }
+ return null;
+ }
+ }
+
+ public static ECParameterSpec getECParameterSpec(Provider p, String name) {
+ AlgorithmParameters parameters = getECParameters(p);
++ if (parameters == null)
++ return null;
+
+ try {
+ parameters.init(new ECGenParameterSpec(name));
+ return parameters.getParameterSpec(ECParameterSpec.class);
+ } catch (InvalidParameterSpecException ipse) {
++ if (debug != null) {
++ debug.println("Invalid parameter specification: " + ipse);
++ }
+ return null;
+ }
+ }
+
+ public static ECParameterSpec getECParameterSpec(Provider p, int keySize) {
+ AlgorithmParameters parameters = getECParameters(p);
++ if (parameters == null)
++ return null;
+
+ try {
+ parameters.init(new ECKeySizeParameterSpec(keySize));
+ return parameters.getParameterSpec(ECParameterSpec.class);
+ } catch (InvalidParameterSpecException ipse) {
++ if (debug != null) {
++ debug.println("Invalid parameter specification: " + ipse);
++ }
+ return null;
+ }
+
+@@ -171,11 +206,16 @@
+ public static String getCurveName(Provider p, ECParameterSpec spec) {
+ ECGenParameterSpec nameSpec;
+ AlgorithmParameters parameters = getECParameters(p);
++ if (parameters == null)
++ return null;
+
+ try {
+ parameters.init(spec);
+ nameSpec = parameters.getParameterSpec(ECGenParameterSpec.class);
+ } catch (InvalidParameterSpecException ipse) {
++ if (debug != null) {
++ debug.println("Invalid parameter specification: " + ipse);
++ }
+ return null;
+ }
+
diff --git a/SOURCES/pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch b/SOURCES/pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch
new file mode 100644
index 0000000..5a619b4
--- /dev/null
+++ b/SOURCES/pr3183-rh1340845-support_fedora_rhel_system_crypto_policy.patch
@@ -0,0 +1,158 @@
+
+# HG changeset patch
+# User andrew
+# Date 1478057514 0
+# Node ID 1c4d5cb2096ae55106111da200b0bcad304f650c
+# Parent 3d53f19b48384e5252f4ec8891f7a3a82d77af2a
+PR3183: Support Fedora/RHEL system crypto policy
+
+diff -r 3d53f19b4838 -r 1c4d5cb2096a src/share/classes/java/security/Security.java
+--- openjdk/jdk/src/share/classes/java/security/Security.java Wed Oct 26 03:51:39 2016 +0100
++++ openjdk/jdk/src/share/classes/java/security/Security.java Wed Nov 02 03:31:54 2016 +0000
+@@ -43,6 +43,9 @@
+ * implementation-specific location, which is typically the properties file
+ * {@code lib/security/java.security} in the Java installation directory.
+ *
++ * Additional default values of security properties are read from a
++ * system-specific location, if available.
++ *
+ * @author Benjamin Renaud
+ */
+
+@@ -52,6 +55,10 @@
+ private static final Debug sdebug =
+ Debug.getInstance("properties");
+
++ /* System property file*/
++ private static final String SYSTEM_PROPERTIES =
++ "/etc/crypto-policies/back-ends/java.config";
++
+ /* The java.security properties */
+ private static Properties props;
+
+@@ -93,6 +100,7 @@
+ if (sdebug != null) {
+ sdebug.println("reading security properties file: " +
+ propFile);
++ sdebug.println(props.toString());
+ }
+ } catch (IOException e) {
+ if (sdebug != null) {
+@@ -114,6 +122,31 @@
+ }
+
+ if ("true".equalsIgnoreCase(props.getProperty
++ ("security.useSystemPropertiesFile"))) {
++
++ // now load the system file, if it exists, so its values
++ // will win if they conflict with the earlier values
++ try (BufferedInputStream bis =
++ new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
++ props.load(bis);
++ loadedProps = true;
++
++ if (sdebug != null) {
++ sdebug.println("reading system security properties file " +
++ SYSTEM_PROPERTIES);
++ sdebug.println(props.toString());
++ }
++ } catch (IOException e) {
++ if (sdebug != null) {
++ sdebug.println
++ ("unable to load security properties from " +
++ SYSTEM_PROPERTIES);
++ e.printStackTrace();
++ }
++ }
++ }
++
++ if ("true".equalsIgnoreCase(props.getProperty
+ ("security.overridePropertiesFile"))) {
+
+ String extraPropFile = System.getProperty
+diff -r 3d53f19b4838 -r 1c4d5cb2096a src/share/lib/security/java.security-aix
+--- openjdk/jdk/src/share/lib/security/java.security-aix Wed Oct 26 03:51:39 2016 +0100
++++ openjdk/jdk/src/share/lib/security/java.security-aix Wed Nov 02 03:31:54 2016 +0000
+@@ -276,6 +276,13 @@
+ security.overridePropertiesFile=true
+
+ #
++# Determines whether this properties file will be appended to
++# using the system properties file stored at
++# /etc/crypto-policies/back-ends/java.config
++#
++security.useSystemPropertiesFile=false
++
++#
+ # Determines the default key and trust manager factory algorithms for
+ # the javax.net.ssl package.
+ #
+diff -r 3d53f19b4838 -r 1c4d5cb2096a src/share/lib/security/java.security-linux
+--- openjdk/jdk/src/share/lib/security/java.security-linux Wed Oct 26 03:51:39 2016 +0100
++++ openjdk/jdk/src/share/lib/security/java.security-linux Wed Nov 02 03:31:54 2016 +0000
+@@ -276,6 +276,13 @@
+ security.overridePropertiesFile=true
+
+ #
++# Determines whether this properties file will be appended to
++# using the system properties file stored at
++# /etc/crypto-policies/back-ends/java.config
++#
++security.useSystemPropertiesFile=true
++
++#
+ # Determines the default key and trust manager factory algorithms for
+ # the javax.net.ssl package.
+ #
+diff -r 3d53f19b4838 -r 1c4d5cb2096a src/share/lib/security/java.security-macosx
+--- openjdk/jdk/src/share/lib/security/java.security-macosx Wed Oct 26 03:51:39 2016 +0100
++++ openjdk/jdk/src/share/lib/security/java.security-macosx Wed Nov 02 03:31:54 2016 +0000
+@@ -279,6 +279,13 @@
+ security.overridePropertiesFile=true
+
+ #
++# Determines whether this properties file will be appended to
++# using the system properties file stored at
++# /etc/crypto-policies/back-ends/java.config
++#
++security.useSystemPropertiesFile=false
++
++#
+ # Determines the default key and trust manager factory algorithms for
+ # the javax.net.ssl package.
+ #
+diff -r 3d53f19b4838 -r 1c4d5cb2096a src/share/lib/security/java.security-solaris
+--- openjdk/jdk/src/share/lib/security/java.security-solaris Wed Oct 26 03:51:39 2016 +0100
++++ openjdk/jdk/src/share/lib/security/java.security-solaris Wed Nov 02 03:31:54 2016 +0000
+@@ -278,6 +278,13 @@
+ security.overridePropertiesFile=true
+
+ #
++# Determines whether this properties file will be appended to
++# using the system properties file stored at
++# /etc/crypto-policies/back-ends/java.config
++#
++security.useSystemPropertiesFile=false
++
++#
+ # Determines the default key and trust manager factory algorithms for
+ # the javax.net.ssl package.
+ #
+diff -r 3d53f19b4838 -r 1c4d5cb2096a src/share/lib/security/java.security-windows
+--- openjdk/jdk/src/share/lib/security/java.security-windows Wed Oct 26 03:51:39 2016 +0100
++++ openjdk/jdk/src/share/lib/security/java.security-windows Wed Nov 02 03:31:54 2016 +0000
+@@ -279,6 +279,13 @@
+ security.overridePropertiesFile=true
+
+ #
++# Determines whether this properties file will be appended to
++# using the system properties file stored at
++# /etc/crypto-policies/back-ends/java.config
++#
++security.useSystemPropertiesFile=false
++
++#
+ # Determines the default key and trust manager factory algorithms for
+ # the javax.net.ssl package.
+ #
+
diff --git a/SOURCES/pr3519-fix_further_functions_with_a_missing_return_value.patch b/SOURCES/pr3519-fix_further_functions_with_a_missing_return_value.patch
new file mode 100644
index 0000000..51ca7f1
--- /dev/null
+++ b/SOURCES/pr3519-fix_further_functions_with_a_missing_return_value.patch
@@ -0,0 +1,19 @@
+# HG changeset patch
+# User andrew
+# Date 1518669922 0
+# Thu Feb 15 04:45:22 2018 +0000
+# Node ID adaf109718c10888cce5b6e73af7f3e15a7ab0db
+# Parent 3ade0115344b77e6d00462044e0cf68722685bfe
+PR3519: Fix further functions with a missing return value.
+
+diff --git openjdk.orig/hotspot/src/cpu/aarch64/vm/c1_LIRAssembler_aarch64.cpp openjdk/hotspot/src/cpu/aarch64/vm/c1_LIRAssembler_aarch64.cpp
+--- openjdk.orig/hotspot/src/cpu/aarch64/vm/c1_LIRAssembler_aarch64.cpp
++++ openjdk/hotspot/src/cpu/aarch64/vm/c1_LIRAssembler_aarch64.cpp
+@@ -205,6 +205,7 @@
+ return Address(base, tmp, Address::lsl(addr->scale()));
+ }
+ }
++ return Address();
+ }
+
+ Address LIR_Assembler::as_Address_hi(LIR_Address* addr) {
diff --git a/SOURCES/pr3593-s390_use_z_format_specifier_for_size_t_arguments_as_size_t_not_equals_to_int.patch b/SOURCES/pr3593-s390_use_z_format_specifier_for_size_t_arguments_as_size_t_not_equals_to_int.patch
new file mode 100644
index 0000000..2700f3c
--- /dev/null
+++ b/SOURCES/pr3593-s390_use_z_format_specifier_for_size_t_arguments_as_size_t_not_equals_to_int.patch
@@ -0,0 +1,143 @@
+diff --git openjdk.orig/hotspot/src/share/vm/asm/codeBuffer.cpp openjdk/hotspot/src/share/vm/asm/codeBuffer.cpp
+--- openjdk.orig/hotspot/src/share/vm/asm/codeBuffer.cpp
++++ openjdk/hotspot/src/share/vm/asm/codeBuffer.cpp
+@@ -977,7 +977,7 @@
+ for (int n = (int) CodeBuffer::SECT_FIRST; n < (int) CodeBuffer::SECT_LIMIT; n++) {
+ CodeSection* sect = code_section(n);
+ if (!sect->is_allocated() || sect->is_empty()) continue;
+- xtty->print_cr("",
++ xtty->print_cr("",
+ n, sect->limit() - sect->start(), sect->limit() - sect->end());
+ }
+ xtty->print_cr("");
+diff --git openjdk.orig/hotspot/src/share/vm/code/codeCache.cpp openjdk/hotspot/src/share/vm/code/codeCache.cpp
+--- openjdk.orig/hotspot/src/share/vm/code/codeCache.cpp
++++ openjdk/hotspot/src/share/vm/code/codeCache.cpp
+@@ -192,7 +192,7 @@
+ }
+ if (PrintCodeCacheExtension) {
+ ResourceMark rm;
+- tty->print_cr("code cache extended to [" INTPTR_FORMAT ", " INTPTR_FORMAT "] (" SSIZE_FORMAT " bytes)",
++ tty->print_cr("code cache extended to [" INTPTR_FORMAT ", " INTPTR_FORMAT "] (" INTX_FORMAT " bytes)",
+ (intptr_t)_heap->low_boundary(), (intptr_t)_heap->high(),
+ (address)_heap->high() - (address)_heap->low_boundary());
+ }
+diff --git openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupTable.cpp openjdk/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupTable.cpp
+--- openjdk.orig/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupTable.cpp
++++ openjdk/hotspot/src/share/vm/gc_implementation/g1/g1StringDedupTable.cpp
+@@ -598,7 +598,7 @@
+ " [Table]\n"
+ " [Memory Usage: " G1_STRDEDUP_BYTES_FORMAT_NS "]\n"
+ " [Size: " SIZE_FORMAT ", Min: " SIZE_FORMAT ", Max: " SIZE_FORMAT "]\n"
+- " [Entries: " UINTX_FORMAT ", Load: " G1_STRDEDUP_PERCENT_FORMAT_NS ", Cached: " UINTX_FORMAT ", Added: " UINTX_FORMAT ", Removed: " UINTX_FORMAT "]\n"
++ " [Entries: " UINTX_FORMAT ", Load: " G1_STRDEDUP_PERCENT_FORMAT_NS ", Cached: " SIZE_FORMAT ", Added: " UINTX_FORMAT ", Removed: " UINTX_FORMAT "]\n"
+ " [Resize Count: " UINTX_FORMAT ", Shrink Threshold: " UINTX_FORMAT "(" G1_STRDEDUP_PERCENT_FORMAT_NS "), Grow Threshold: " UINTX_FORMAT "(" G1_STRDEDUP_PERCENT_FORMAT_NS ")]\n"
+ " [Rehash Count: " UINTX_FORMAT ", Rehash Threshold: " UINTX_FORMAT ", Hash Seed: 0x%x]\n"
+ " [Age Threshold: " UINTX_FORMAT "]",
+diff --git openjdk.orig/hotspot/src/share/vm/memory/blockOffsetTable.cpp openjdk/hotspot/src/share/vm/memory/blockOffsetTable.cpp
+--- openjdk.orig/hotspot/src/share/vm/memory/blockOffsetTable.cpp
++++ openjdk/hotspot/src/share/vm/memory/blockOffsetTable.cpp
+@@ -57,7 +57,7 @@
+ gclog_or_tty->print_cr("BlockOffsetSharedArray::BlockOffsetSharedArray: ");
+ gclog_or_tty->print_cr(" "
+ " rs.base(): " INTPTR_FORMAT
+- " rs.size(): " INTPTR_FORMAT
++ " rs.size(): " SIZE_FORMAT
+ " rs end(): " INTPTR_FORMAT,
+ p2i(rs.base()), rs.size(), p2i(rs.base() + rs.size()));
+ gclog_or_tty->print_cr(" "
+diff --git openjdk.orig/hotspot/src/share/vm/memory/collectorPolicy.cpp openjdk/hotspot/src/share/vm/memory/collectorPolicy.cpp
+--- openjdk.orig/hotspot/src/share/vm/memory/collectorPolicy.cpp
++++ openjdk/hotspot/src/share/vm/memory/collectorPolicy.cpp
+@@ -1055,7 +1055,8 @@
+ size_t expected = msp.scale_by_NewRatio_aligned(initial_heap_size);
+ assert(msp.initial_gen0_size() == expected, err_msg("%zu != %zu", msp.initial_gen0_size(), expected));
+ assert(FLAG_IS_ERGO(NewSize) && NewSize == expected,
+- err_msg("NewSize should have been set ergonomically to %zu, but was %zu", expected, NewSize));
++ err_msg("NewSize should have been set ergonomically to " SIZE_FORMAT ", but was " UINTX_FORMAT,
++ expected, NewSize));
+ }
+
+ private:
+diff --git openjdk.orig/hotspot/src/share/vm/runtime/arguments.cpp openjdk/hotspot/src/share/vm/runtime/arguments.cpp
+--- openjdk.orig/hotspot/src/share/vm/runtime/arguments.cpp
++++ openjdk/hotspot/src/share/vm/runtime/arguments.cpp
+@@ -1291,14 +1291,14 @@
+ }
+ if (PrintGCDetails && Verbose) {
+ // Too early to use gclog_or_tty
+- tty->print_cr("CMS ergo set MaxNewSize: " SIZE_FORMAT, MaxNewSize);
++ tty->print_cr("CMS ergo set MaxNewSize: " UINTX_FORMAT, MaxNewSize);
+ }
+
+ // Code along this path potentially sets NewSize and OldSize
+ if (PrintGCDetails && Verbose) {
+ // Too early to use gclog_or_tty
+- tty->print_cr("CMS set min_heap_size: " SIZE_FORMAT
+- " initial_heap_size: " SIZE_FORMAT
++ tty->print_cr("CMS set min_heap_size: " UINTX_FORMAT
++ " initial_heap_size: " UINTX_FORMAT
+ " max_heap: " SIZE_FORMAT,
+ min_heap_size(), InitialHeapSize, max_heap);
+ }
+@@ -1314,7 +1314,7 @@
+ FLAG_SET_ERGO(uintx, NewSize, MIN2(preferred_max_new_size, (size_t)NewSize));
+ if (PrintGCDetails && Verbose) {
+ // Too early to use gclog_or_tty
+- tty->print_cr("CMS ergo set NewSize: " SIZE_FORMAT, NewSize);
++ tty->print_cr("CMS ergo set NewSize: " UINTX_FORMAT, NewSize);
+ }
+ }
+ // Unless explicitly requested otherwise, size old gen
+@@ -1324,7 +1324,7 @@
+ FLAG_SET_ERGO(uintx, OldSize, MIN2((size_t)(NewRatio*NewSize), max_heap - NewSize));
+ if (PrintGCDetails && Verbose) {
+ // Too early to use gclog_or_tty
+- tty->print_cr("CMS ergo set OldSize: " SIZE_FORMAT, OldSize);
++ tty->print_cr("CMS ergo set OldSize: " UINTX_FORMAT, OldSize);
+ }
+ }
+ }
+@@ -2043,7 +2043,7 @@
+
+ if (PrintGCDetails && Verbose) {
+ // Cannot use gclog_or_tty yet.
+- tty->print_cr(" Initial heap size " SIZE_FORMAT, (uintx)reasonable_initial);
++ tty->print_cr(" Initial heap size " SIZE_FORMAT, (size_t)reasonable_initial);
+ }
+ FLAG_SET_ERGO(uintx, InitialHeapSize, (uintx)reasonable_initial);
+ }
+@@ -2053,7 +2053,7 @@
+ set_min_heap_size(MIN2((uintx)reasonable_minimum, InitialHeapSize));
+ if (PrintGCDetails && Verbose) {
+ // Cannot use gclog_or_tty yet.
+- tty->print_cr(" Minimum heap size " SIZE_FORMAT, min_heap_size());
++ tty->print_cr(" Minimum heap size " UINTX_FORMAT, min_heap_size());
+ }
+ }
+ }
+diff --git openjdk.orig/hotspot/src/share/vm/utilities/globalDefinitions.hpp openjdk/hotspot/src/share/vm/utilities/globalDefinitions.hpp
+--- openjdk.orig/hotspot/src/share/vm/utilities/globalDefinitions.hpp
++++ openjdk/hotspot/src/share/vm/utilities/globalDefinitions.hpp
+@@ -1389,12 +1389,21 @@
+
+ #define INTPTR_FORMAT_W(width) "%" #width PRIxPTR
+
++#if defined(S390) && !defined(_LP64)
++#define SSIZE_FORMAT "%z" PRIdPTR
++#define SIZE_FORMAT "%z" PRIuPTR
++#define SIZE_FORMAT_HEX "0x%z" PRIxPTR
++#define SSIZE_FORMAT_W(width) "%" #width "z" PRIdPTR
++#define SIZE_FORMAT_W(width) "%" #width "z" PRIuPTR
++#define SIZE_FORMAT_HEX_W(width) "0x%" #width "z" PRIxPTR
++#else // !S390
+ #define SSIZE_FORMAT "%" PRIdPTR
+ #define SIZE_FORMAT "%" PRIuPTR
+ #define SIZE_FORMAT_HEX "0x%" PRIxPTR
+ #define SSIZE_FORMAT_W(width) "%" #width PRIdPTR
+ #define SIZE_FORMAT_W(width) "%" #width PRIuPTR
+ #define SIZE_FORMAT_HEX_W(width) "0x%" #width PRIxPTR
++#endif // S390
+
+ #define INTX_FORMAT "%" PRIdPTR
+ #define UINTX_FORMAT "%" PRIuPTR
diff --git a/SOURCES/pr3601-fix_additional_Wreturn_type_issues_introduced_by_8061651_for_prims_jvm_cpp.patch b/SOURCES/pr3601-fix_additional_Wreturn_type_issues_introduced_by_8061651_for_prims_jvm_cpp.patch
new file mode 100644
index 0000000..d1e9576
--- /dev/null
+++ b/SOURCES/pr3601-fix_additional_Wreturn_type_issues_introduced_by_8061651_for_prims_jvm_cpp.patch
@@ -0,0 +1,38 @@
+# HG changeset patch
+# User andrew
+# Date 1529475043 -3600
+# Wed Jun 20 07:10:43 2018 +0100
+# Node ID f6341f4635dacb56678264d29a88cd052b74036b
+# Parent 30520d5018b509b0ae68f5fcc9a5c540e3e5b2de
+PR3601: Fix additional -Wreturn-type issues introduced by 8061651
+
+diff --git openjdk.orig/hotspot/src/share/vm/prims/jvm.cpp openjdk/hotspot/src/share/vm/prims/jvm.cpp
+--- openjdk.orig/hotspot/src/share/vm/prims/jvm.cpp
++++ openjdk/hotspot/src/share/vm/prims/jvm.cpp
+@@ -835,7 +835,7 @@
+ JVM_ENTRY(jboolean, JVM_KnownToNotExist(JNIEnv *env, jobject loader, const char *classname))
+ JVMWrapper("JVM_KnownToNotExist");
+ #if INCLUDE_CDS
+- return ClassLoaderExt::known_to_not_exist(env, loader, classname, CHECK_(false));
++ return ClassLoaderExt::known_to_not_exist(env, loader, classname, THREAD);
+ #else
+ return false;
+ #endif
+@@ -845,7 +845,7 @@
+ JVM_ENTRY(jobjectArray, JVM_GetResourceLookupCacheURLs(JNIEnv *env, jobject loader))
+ JVMWrapper("JVM_GetResourceLookupCacheURLs");
+ #if INCLUDE_CDS
+- return ClassLoaderExt::get_lookup_cache_urls(env, loader, CHECK_NULL);
++ return ClassLoaderExt::get_lookup_cache_urls(env, loader, THREAD);
+ #else
+ return NULL;
+ #endif
+@@ -855,7 +855,7 @@
+ JVM_ENTRY(jintArray, JVM_GetResourceLookupCache(JNIEnv *env, jobject loader, const char *resource_name))
+ JVMWrapper("JVM_GetResourceLookupCache");
+ #if INCLUDE_CDS
+- return ClassLoaderExt::get_lookup_cache(env, loader, resource_name, CHECK_NULL);
++ return ClassLoaderExt::get_lookup_cache(env, loader, resource_name, THREAD);
+ #else
+ return NULL;
+ #endif
diff --git a/SOURCES/pr3655-toggle_system_crypto_policy.patch b/SOURCES/pr3655-toggle_system_crypto_policy.patch
new file mode 100644
index 0000000..abfac45
--- /dev/null
+++ b/SOURCES/pr3655-toggle_system_crypto_policy.patch
@@ -0,0 +1,78 @@
+# HG changeset patch
+# User andrew
+# Date 1545198926 0
+# Wed Dec 19 05:55:26 2018 +0000
+# Node ID f2cbd688824c128db7fa848c8732fb0ab3507776
+# Parent 81f07f6d1f8b7b51b136d3974c61bc8bb513770c
+PR3655: Allow use of system crypto policy to be disabled by the user
+Summary: Read user overrides first so security.useSystemPropertiesFile can be disabled and add -Djava.security.disableSystemPropertiesFile
+
+diff --git a/src/share/classes/javopenjdk.orig/jdk/security/Security.java openjdk/jdk/src/share/classes/java/security/Security.java
+--- openjdk.orig/jdk/src/share/classes/java/security/Security.java
++++ openjdk/jdk/src/share/classes/java/security/Security.java
+@@ -122,31 +122,6 @@
+ }
+
+ if ("true".equalsIgnoreCase(props.getProperty
+- ("security.useSystemPropertiesFile"))) {
+-
+- // now load the system file, if it exists, so its values
+- // will win if they conflict with the earlier values
+- try (BufferedInputStream bis =
+- new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
+- props.load(bis);
+- loadedProps = true;
+-
+- if (sdebug != null) {
+- sdebug.println("reading system security properties file " +
+- SYSTEM_PROPERTIES);
+- sdebug.println(props.toString());
+- }
+- } catch (IOException e) {
+- if (sdebug != null) {
+- sdebug.println
+- ("unable to load security properties from " +
+- SYSTEM_PROPERTIES);
+- e.printStackTrace();
+- }
+- }
+- }
+-
+- if ("true".equalsIgnoreCase(props.getProperty
+ ("security.overridePropertiesFile"))) {
+
+ String extraPropFile = System.getProperty
+@@ -212,6 +187,33 @@
+ }
+ }
+
++ String disableSystemProps = System.getProperty("java.security.disableSystemPropertiesFile");
++ if (disableSystemProps == null &&
++ "true".equalsIgnoreCase(props.getProperty
++ ("security.useSystemPropertiesFile"))) {
++
++ // now load the system file, if it exists, so its values
++ // will win if they conflict with the earlier values
++ try (BufferedInputStream bis =
++ new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
++ props.load(bis);
++ loadedProps = true;
++
++ if (sdebug != null) {
++ sdebug.println("reading system security properties file " +
++ SYSTEM_PROPERTIES);
++ sdebug.println(props.toString());
++ }
++ } catch (IOException e) {
++ if (sdebug != null) {
++ sdebug.println
++ ("unable to load security properties from " +
++ SYSTEM_PROPERTIES);
++ e.printStackTrace();
++ }
++ }
++ }
++
+ if (!loadedProps) {
+ initializeStatic();
+ if (sdebug != null) {
diff --git a/SOURCES/repackReproduciblePolycies.sh b/SOURCES/repackReproduciblePolycies.sh
new file mode 100644
index 0000000..f356bd3
--- /dev/null
+++ b/SOURCES/repackReproduciblePolycies.sh
@@ -0,0 +1,44 @@
+#!/bin/sh
+set -e
+# https://bugzilla.redhat.com/show_bug.cgi?id=1142153
+M=META-INF/MANIFEST.MF
+#P=/usr/lib/jvm/java/jre/lib/security/policy
+P=$1/lib/security/policy
+ERRORS=0
+ for type in unlimited limited ; do
+for f in local_policy.jar US_export_policy.jar ; do
+ORIG=$P/$type/$f
+echo "processing $f ($ORIG)"
+if [ ! -f $ORIG ]; then
+ echo "File not found! $ORIG"
+ let ERRORS=$ERRORS+1
+ continue
+fi
+d=`mktemp -d`
+NW=$d/$f
+ pushd $d
+ jar xf $ORIG
+ cat $M
+# sed -i "s/Created-By.*/Created-By: 1.7.0/g" $M
+ sed -i "s/Created-By.*/Created-By: $2/g" $M
+ cat $M
+ find . -exec touch -t 201401010000 {} +
+ zip -rX $f *
+ popd
+ echo "replacing $ORIG"
+ touch -t 201401010000 $ORIG
+ md5sum $ORIG
+ sha256sum $ORIG
+ echo "by $NW"
+ md5sum $NW
+ sha256sum $NW
+ touch -t 201401010000 $NW
+ cp $NW $ORIG
+ md5sum $ORIG
+ sha256sum $ORIG
+ touch -t 201401010000 $ORIG
+ rm -rfv $d
+done
+ done
+
+exit $ERRORS
diff --git a/SOURCES/rh1163501-increase_2048_bit_dh_upper_bound_fedora_infrastructure_in_dhparametergenerator.patch b/SOURCES/rh1163501-increase_2048_bit_dh_upper_bound_fedora_infrastructure_in_dhparametergenerator.patch
new file mode 100644
index 0000000..d9cbac4
--- /dev/null
+++ b/SOURCES/rh1163501-increase_2048_bit_dh_upper_bound_fedora_infrastructure_in_dhparametergenerator.patch
@@ -0,0 +1,66 @@
+diff --git a/src/share/classes/com/sun/crypto/provider/DHParameterGenerator.java b/src/share/classes/com/sun/crypto/provider/DHParameterGenerator.java
+--- openjdk/jdk/src/share/classes/com/sun/crypto/provider/DHParameterGenerator.java
++++ openjdk/jdk/src/share/classes/com/sun/crypto/provider/DHParameterGenerator.java
+@@ -1,5 +1,6 @@
+ /*
+ * Copyright (c) 1997, 2017, Oracle and/or its affiliates. All rights reserved.
++ * Copyright (c) 2014 Red Hat Inc.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+@@ -61,13 +62,13 @@
+
+ private static void checkKeySize(int keysize)
+ throws InvalidParameterException {
+- boolean supported = ((keysize == 2048) || (keysize == 3072) ||
++ boolean supported = ((keysize == 2048) || (keysize == 3072) || (keysize == 4096) ||
+ ((keysize >= 512) && (keysize <= 1024) && ((keysize & 0x3F) == 0)));
+
+ if (!supported) {
+ throw new InvalidParameterException(
+ "DH key size must be multiple of 64 and range " +
+- "from 512 to 1024 (inclusive), or 2048, 3072. " +
++ "from 512 to 1024 (inclusive), or 2048, 3072, 4096. " +
+ "The specific key size " + keysize + " is not supported");
+ }
+ }
+diff --git a/test/com/sun/crypto/provider/KeyAgreement/TestExponentSize.java b/test/com/sun/crypto/provider/KeyAgreement/TestExponentSize.java
+--- openjdk/jdk/test/com/sun/crypto/provider/KeyAgreement/TestExponentSize.java
++++ openjdk/jdk/test/com/sun/crypto/provider/KeyAgreement/TestExponentSize.java
+@@ -1,5 +1,6 @@
+ /*
+ * Copyright (c) 2005, 2017, Oracle and/or its affiliates. All rights reserved.
++ * Copyright (c) 2014 Red Hat Inc.
+ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+ *
+ * This code is free software; you can redistribute it and/or modify it
+@@ -58,7 +59,7 @@
+ */
+ private enum Sizes {
+ two56(256), three84(384), five12(512), seven68(768), ten24(1024),
+- twenty48(2048);
++ twenty48(2048), forty96(4096);
+
+ private final int intSize;
+ private final BigInteger bigIntValue;
+@@ -130,6 +131,19 @@
+ kp = kpg.generateKeyPair();
+ checkKeyPair(kp, Sizes.twenty48, Sizes.five12);
+
++ kpg.initialize(Sizes.forty96.getIntSize());
++ kp = kpg.generateKeyPair();
++ checkKeyPair(kp, Sizes.forty96, Sizes.twenty48);
++
++ publicKey = (DHPublicKey)kp.getPublic();
++ p = publicKey.getParams().getP();
++ g = publicKey.getParams().getG();
++
++ // test w/ all values specified
++ kpg.initialize(new DHParameterSpec(p, g, Sizes.ten24.getIntSize()));
++ kp = kpg.generateKeyPair();
++ checkKeyPair(kp, Sizes.forty96, Sizes.ten24);
++
+ System.out.println("OK");
+ }
+
+
diff --git a/SOURCES/rh1566890-CVE_2018_3639-speculative_store_bypass.patch b/SOURCES/rh1566890-CVE_2018_3639-speculative_store_bypass.patch
new file mode 100644
index 0000000..d8f3a5a
--- /dev/null
+++ b/SOURCES/rh1566890-CVE_2018_3639-speculative_store_bypass.patch
@@ -0,0 +1,44 @@
+diff --git openjdk.orig/hotspot/src/os/linux/vm/os_linux.cpp openjdk/hotspot/src/os/linux/vm/os_linux.cpp
+--- openjdk.orig/hotspot/src/os/linux/vm/os_linux.cpp
++++ openjdk/hotspot/src/os/linux/vm/os_linux.cpp
+@@ -103,6 +103,8 @@
+ # include
+ # include
+
++#include
++
+ PRAGMA_FORMAT_MUTE_WARNINGS_FOR_GCC
+
+ #ifndef _GNU_SOURCE
+@@ -4997,6 +4999,31 @@
+ }
+ }
+
++/* Per task speculation control */
++#ifndef PR_GET_SPECULATION_CTRL
++#define PR_GET_SPECULATION_CTRL 52
++#endif
++#ifndef PR_SET_SPECULATION_CTRL
++#define PR_SET_SPECULATION_CTRL 53
++#endif
++/* Speculation control variants */
++# undef PR_SPEC_STORE_BYPASS
++# define PR_SPEC_STORE_BYPASS 0
++/* Return and control values for PR_SET/GET_SPECULATION_CTRL */
++# undef PR_SPEC_NOT_AFFECTED
++# undef PR_SPEC_PRCTL
++# undef PR_SPEC_ENABLE
++# undef PR_SPEC_DISABLE
++# define PR_SPEC_NOT_AFFECTED 0
++# define PR_SPEC_PRCTL (1UL << 0)
++# define PR_SPEC_ENABLE (1UL << 1)
++# define PR_SPEC_DISABLE (1UL << 2)
++
++static void set_speculation() __attribute__((constructor));
++static void set_speculation() {
++ prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0);
++}
++
+ // this is called _before_ most of the global arguments have been parsed
+ void os::init(void) {
+ char dummy; /* used to get a guess on initial stack address */
diff --git a/SOURCES/rh1566890-CVE_2018_3639-speculative_store_bypass_toggle.patch b/SOURCES/rh1566890-CVE_2018_3639-speculative_store_bypass_toggle.patch
new file mode 100644
index 0000000..94ef9d4
--- /dev/null
+++ b/SOURCES/rh1566890-CVE_2018_3639-speculative_store_bypass_toggle.patch
@@ -0,0 +1,54 @@
+diff --git openjdk.orig/hotspot/src/os/linux/vm/os_linux.cpp openjdk/hotspot/src/os/linux/vm/os_linux.cpp
+--- openjdk.orig/hotspot/src/os/linux/vm/os_linux.cpp
++++ openjdk/hotspot/src/os/linux/vm/os_linux.cpp
+@@ -5001,26 +5001,43 @@
+
+ /* Per task speculation control */
+ #ifndef PR_GET_SPECULATION_CTRL
+-#define PR_GET_SPECULATION_CTRL 52
++# define PR_GET_SPECULATION_CTRL 52
+ #endif
+ #ifndef PR_SET_SPECULATION_CTRL
+-#define PR_SET_SPECULATION_CTRL 53
++# define PR_SET_SPECULATION_CTRL 53
+ #endif
+ /* Speculation control variants */
+-# undef PR_SPEC_STORE_BYPASS
++#ifndef PR_SPEC_STORE_BYPASS
+ # define PR_SPEC_STORE_BYPASS 0
++#endif
+ /* Return and control values for PR_SET/GET_SPECULATION_CTRL */
+-# undef PR_SPEC_NOT_AFFECTED
+-# undef PR_SPEC_PRCTL
+-# undef PR_SPEC_ENABLE
+-# undef PR_SPEC_DISABLE
++
++#ifndef PR_SPEC_NOT_AFFECTED
+ # define PR_SPEC_NOT_AFFECTED 0
++#endif
++#ifndef PR_SPEC_PRCTL
+ # define PR_SPEC_PRCTL (1UL << 0)
++#endif
++#ifndef PR_SPEC_ENABLE
+ # define PR_SPEC_ENABLE (1UL << 1)
++#endif
++#ifndef PR_SPEC_DISABLE
+ # define PR_SPEC_DISABLE (1UL << 2)
++#endif
++#ifndef PR_SPEC_FORCE_DISABLE
++# define PR_SPEC_FORCE_DISABLE (1UL << 3)
++#endif
++#ifndef PR_SPEC_DISABLE_NOEXEC
++# define PR_SPEC_DISABLE_NOEXEC (1UL << 4)
++#endif
+
+ static void set_speculation() __attribute__((constructor));
+ static void set_speculation() {
++ if ( prctl(PR_SET_SPECULATION_CTRL,
++ PR_SPEC_STORE_BYPASS,
++ PR_SPEC_DISABLE_NOEXEC, 0, 0) == 0 ) {
++ return;
++ }
+ prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0);
+ }
+
diff --git a/SOURCES/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch b/SOURCES/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
new file mode 100644
index 0000000..bddd702
--- /dev/null
+++ b/SOURCES/rh1648242-accessible_toolkit_crash_do_not_break_jvm.patch
@@ -0,0 +1,16 @@
+diff -uNr openjdk-orig/jdk/src/share/classes/java/awt/Toolkit.java jdk8/jdk/src/share/classes/java/awt/Toolkit.java
+--- openjdk-orig/jdk/src/share/classes/java/awt/Toolkit.java 2009-01-23 11:59:47.000000000 -0500
++++ jdk8/jdk/src/share/classes/java/awt/Toolkit.java 2009-01-23 12:05:20.000000000 -0500
+@@ -883,7 +883,11 @@
+ return null;
+ }
+ });
+- loadAssistiveTechnologies();
++ try {
++ loadAssistiveTechnologies();
++ } catch ( AWTError error) {
++ // ignore silently
++ }
+ }
+ return toolkit;
+ }
diff --git a/SOURCES/rh1648246-always_instruct_vm_to_assume_multiple_processors_are_available.patch b/SOURCES/rh1648246-always_instruct_vm_to_assume_multiple_processors_are_available.patch
new file mode 100644
index 0000000..b0a874d
--- /dev/null
+++ b/SOURCES/rh1648246-always_instruct_vm_to_assume_multiple_processors_are_available.patch
@@ -0,0 +1,12 @@
+diff --git a/src/share/vm/runtime/globals.hpp b/src/share/vm/runtime/globals.hpp
+--- openjdk/hotspot/src/share/vm/runtime/globals.hpp
++++ openjdk/hotspot/src/share/vm/runtime/globals.hpp
+@@ -530,7 +530,7 @@
+ lp64_product(intx, ObjectAlignmentInBytes, 8, \
+ "Default object alignment in bytes, 8 is minimum") \
+ \
+- product(bool, AssumeMP, false, \
++ product(bool, AssumeMP, true, \
+ "Instruct the VM to assume multiple processors are available") \
+ \
+ /* UseMembar is theoretically a temp flag used for memory barrier \
diff --git a/SOURCES/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch b/SOURCES/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
new file mode 100644
index 0000000..febd87e
--- /dev/null
+++ b/SOURCES/rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
@@ -0,0 +1,11 @@
+diff -r 5b86f66575b7 src/share/lib/security/java.security-linux
+--- openjdk/jdk/src/share/lib/security/java.security-linux Tue May 16 13:29:05 2017 -0700
++++ openjdk/jdk/src/share/lib/security/java.security-linux Tue Jun 06 14:05:12 2017 +0200
+@@ -74,6 +74,7 @@
+ security.provider.7=com.sun.security.sasl.Provider
+ security.provider.8=org.jcp.xml.dsig.internal.dom.XMLDSigRI
+ security.provider.9=sun.security.smartcardio.SunPCSC
++#security.provider.10=sun.security.pkcs11.SunPKCS11 ${java.home}/lib/security/nss.cfg
+
+ #
+ # Sun Provider SecureRandom seed source.
diff --git a/SOURCES/rh1648644-java_access_bridge_privileged_security.patch b/SOURCES/rh1648644-java_access_bridge_privileged_security.patch
new file mode 100644
index 0000000..538468a
--- /dev/null
+++ b/SOURCES/rh1648644-java_access_bridge_privileged_security.patch
@@ -0,0 +1,24 @@
+--- jdk8/jdk/src/share/lib/security/java.security-linux.orig
++++ jdk8/jdk/src/share/lib/security/java.security-linux
+@@ -223,7 +223,9 @@
+ jdk.nashorn.internal.,\
+ jdk.nashorn.tools.,\
+ jdk.xml.internal.,\
+- com.sun.activation.registries.
++ com.sun.activation.registries.,\
++ org.GNOME.Accessibility.,\
++ org.GNOME.Bonobo.
+
+ #
+ # List of comma-separated packages that start with or equal this string
+@@ -273,7 +275,9 @@
+ jdk.nashorn.internal.,\
+ jdk.nashorn.tools.,\
+ jdk.xml.internal.,\
+- com.sun.activation.registries.
++ com.sun.activation.registries.,\
++ org.GNOME.Accessibility.,\
++ org.GNOME.Bonobo.
+
+ #
+ # Determines whether this properties file can be appended to
diff --git a/SOURCES/rh1649664-awt2dlibraries_compiled_with_no_strict_overflow.patch b/SOURCES/rh1649664-awt2dlibraries_compiled_with_no_strict_overflow.patch
new file mode 100644
index 0000000..e319492
--- /dev/null
+++ b/SOURCES/rh1649664-awt2dlibraries_compiled_with_no_strict_overflow.patch
@@ -0,0 +1,16 @@
+diff --git openjdk.orig/jdk/make/lib/Awt2dLibraries.gmk openjdk/jdk/make/lib/Awt2dLibraries.gmk
+--- openjdk.orig/jdk/make/lib/Awt2dLibraries.gmk
++++ openjdk/jdk/make/lib/Awt2dLibraries.gmk
+@@ -891,6 +891,12 @@
+ BUILD_LIBFONTMANAGER_ExtensionSubtables.cpp_CXXFLAGS := -fno-strict-aliasing
+ endif
+
++# Turn off strict overflow with GCC for IndicRearrangementProcessor.cpp
++ifeq ($(OPENJDK_TARGET_OS), linux)
++ BUILD_LIBFONTMANAGER_IndicRearrangementProcessor.cpp_CXXFLAGS := -fno-strict-overflow
++ BUILD_LIBFONTMANAGER_IndicRearrangementProcessor2.cpp_CXXFLAGS := -fno-strict-overflow
++endif
++
+ # LDFLAGS clarification:
+ # Filter relevant linker flags disallowing unresolved symbols as we cannot
+ # build-time decide to which library to link against (libawt_headless or
diff --git a/SOURCES/rh1655466-global_crypto_and_fips.patch b/SOURCES/rh1655466-global_crypto_and_fips.patch
new file mode 100644
index 0000000..7987abb
--- /dev/null
+++ b/SOURCES/rh1655466-global_crypto_and_fips.patch
@@ -0,0 +1,208 @@
+diff --git a/src/share/classes/javopenjdk.orig/jdk/security/Security.java openjdk/jdk/src/share/classes/java/security/Security.java
+--- openjdk.orig/jdk/src/share/classes/java/security/Security.java
++++ openjdk/jdk/src/share/classes/java/security/Security.java
+@@ -191,27 +191,7 @@
+ if (disableSystemProps == null &&
+ "true".equalsIgnoreCase(props.getProperty
+ ("security.useSystemPropertiesFile"))) {
+-
+- // now load the system file, if it exists, so its values
+- // will win if they conflict with the earlier values
+- try (BufferedInputStream bis =
+- new BufferedInputStream(new FileInputStream(SYSTEM_PROPERTIES))) {
+- props.load(bis);
+- loadedProps = true;
+-
+- if (sdebug != null) {
+- sdebug.println("reading system security properties file " +
+- SYSTEM_PROPERTIES);
+- sdebug.println(props.toString());
+- }
+- } catch (IOException e) {
+- if (sdebug != null) {
+- sdebug.println
+- ("unable to load security properties from " +
+- SYSTEM_PROPERTIES);
+- e.printStackTrace();
+- }
+- }
++ loadedProps = loadedProps && SystemConfigurator.configure(props);
+ }
+
+ if (!loadedProps) {
+diff --git a/src/share/classes/javopenjdk.orig/jdk/security/SystemConfigurator.java openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
+new file mode 100644
+--- /dev/null
++++ openjdk/jdk/src/share/classes/java/security/SystemConfigurator.java
+@@ -0,0 +1,153 @@
++/*
++ * Copyright (c) 2019, Red Hat, Inc.
++ *
++ * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
++ *
++ * This code is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License version 2 only, as
++ * published by the Free Software Foundation.
++ *
++ * This code is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * version 2 for more details (a copy is included in the LICENSE file that
++ * accompanied this code).
++ *
++ * You should have received a copy of the GNU General Public License version
++ * 2 along with this work; if not, write to the Free Software Foundation,
++ * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
++ *
++ * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
++ * or visit www.oracle.com if you need additional information or have any
++ * questions.
++ */
++
++package java.security;
++
++import java.io.BufferedInputStream;
++import java.io.FileInputStream;
++import java.io.IOException;
++
++import java.nio.file.Files;
++import java.nio.file.FileSystems;
++import java.nio.file.Path;
++
++import java.util.Iterator;
++import java.util.Map.Entry;
++import java.util.Properties;
++import java.util.function.Consumer;
++import java.util.regex.Matcher;
++import java.util.regex.Pattern;
++
++import sun.security.util.Debug;
++
++/**
++ * Internal class to align OpenJDK with global crypto-policies.
++ * Called from java.security.Security class initialization,
++ * during startup.
++ *
++ */
++
++class SystemConfigurator {
++
++ private static final Debug sdebug =
++ Debug.getInstance("properties");
++
++ private static final String CRYPTO_POLICIES_BASE_DIR =
++ "/etc/crypto-policies";
++
++ private static final String CRYPTO_POLICIES_JAVA_CONFIG =
++ CRYPTO_POLICIES_BASE_DIR + "/back-ends/java.config";
++
++ private static final String CRYPTO_POLICIES_CONFIG =
++ CRYPTO_POLICIES_BASE_DIR + "/config";
++
++ private static final class SecurityProviderInfo {
++ int number;
++ String key;
++ String value;
++ SecurityProviderInfo(int number, String key, String value) {
++ this.number = number;
++ this.key = key;
++ this.value = value;
++ }
++ }
++
++ /*
++ * Invoked when java.security.Security class is initialized, if
++ * java.security.disableSystemPropertiesFile property is not set and
++ * security.useSystemPropertiesFile is true.
++ */
++ static boolean configure(Properties props) {
++ boolean loadedProps = false;
++
++ try (BufferedInputStream bis =
++ new BufferedInputStream(
++ new FileInputStream(CRYPTO_POLICIES_JAVA_CONFIG))) {
++ props.load(bis);
++ loadedProps = true;
++ if (sdebug != null) {
++ sdebug.println("reading system security properties file " +
++ CRYPTO_POLICIES_JAVA_CONFIG);
++ sdebug.println(props.toString());
++ }
++ } catch (IOException e) {
++ if (sdebug != null) {
++ sdebug.println("unable to load security properties from " +
++ CRYPTO_POLICIES_JAVA_CONFIG);
++ e.printStackTrace();
++ }
++ }
++
++ try {
++ if (enableFips()) {
++ if (sdebug != null) { sdebug.println("FIPS mode detected"); }
++ loadedProps = false;
++ // Remove all security providers
++ Iterator> i = props.entrySet().iterator();
++ while (i.hasNext()) {
++ Entry