diff --git a/.gitignore b/.gitignore
index ccadde6..2bb3dbc 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/pki-10.8.0-b2.tar.gz
+SOURCES/pki-10.9.0-b2.tar.gz
diff --git a/.pki-core.metadata b/.pki-core.metadata
index 97ae103..0f8efb1 100644
--- a/.pki-core.metadata
+++ b/.pki-core.metadata
@@ -1 +1 @@
-b148d7365729841fc756157d33ee2bd57cbc6cf2 SOURCES/pki-10.8.0-b2.tar.gz
+7a900dcf24422f7756649fbed42b6a033f9204b7 SOURCES/pki-10.9.0-b2.tar.gz
diff --git a/SOURCES/0001-Removed-dependency-on-pytest-runner.patch b/SOURCES/0001-Removed-dependency-on-pytest-runner.patch
new file mode 100644
index 0000000..5d5c1b1
--- /dev/null
+++ b/SOURCES/0001-Removed-dependency-on-pytest-runner.patch
@@ -0,0 +1,23 @@
+From ab8b87af09b26c3c7ec257e0fb8e5ae931153120 Mon Sep 17 00:00:00 2001
+From: "Endi S. Dewata" <edewata@redhat.com>
+Date: Sat, 8 Feb 2020 21:56:41 -0600
+Subject: [PATCH] Removed dependency on pytest-runner
+
+---
+ base/server/healthcheck/setup.py | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/base/server/healthcheck/setup.py b/base/server/healthcheck/setup.py
+index 22db8bd0f..c629e34c0 100644
+--- a/base/server/healthcheck/setup.py
++++ b/base/server/healthcheck/setup.py
+@@ -32,6 +32,5 @@ setup(
+         'Programming Language :: Python :: 3.6',
+     ],
+     python_requires='!=3.0.*,!=3.1.*,!=3.2.*,!=3.3.*,!=3.4.*',
+-    setup_requires=['pytest-runner'],
+     tests_require=['pytest'],
+ )
+-- 
+2.21.0
+
diff --git a/SPECS/pki-core.spec b/SPECS/pki-core.spec
index 41b6a29..cf0485a 100644
--- a/SPECS/pki-core.spec
+++ b/SPECS/pki-core.spec
@@ -10,7 +10,7 @@ URL:              http://www.dogtagpki.org/
 # The entire source code is GPLv2 except for 'pki-tps' which is LGPLv2
 License:          GPLv2 and LGPLv2
 
-Version:          10.8.0
+Version:          10.9.0
 Release:          0.4%{?_timestamp}%{?_commit_id}%{?dist}
 %global           _phase -b2
 
@@ -28,46 +28,22 @@ Source: https://github.com/dogtagpki/pki/archive/v%{version}%{?_phase}/pki-%{ver
 #     <version tag> \
 #     > pki-VERSION-RELEASE.patch
 # Patch: pki-VERSION-RELEASE.patch
+Patch1: 0001-Removed-dependency-on-pytest-runner.patch
 
 ################################################################################
 # NSS
 ################################################################################
 
-%if 0%{?rhel} && 0%{?rhel} <= 7 || 0%{?fedora} && 0%{?fedora} <= 27
-%global nss_default_db_type dbm
-%else
 %global nss_default_db_type sql
-%endif
 
 ################################################################################
 # Python
 ################################################################################
 
-# Python 2 packages
-%if 0%{!?with_python2:1}
-%if 0%{?rhel} && 0%{?rhel} <= 7 || 0%{?fedora} && 0%{?fedora} <= 28
-%global with_python2 1
-%else
-# no python2
-%endif
-%endif
-
-# Python 3 packages
-%if 0%{!?with_python3:1}
-%if 0%{?rhel} && 0%{?rhel} <= 7
-# no python3
-%else
-%global with_python3 1
-%endif
-%endif
-
-# Use Python 3 for all commands?
-%if 0%{!?with_python3_default:1}
-%if 0%{?rhel} && 0%{?rhel} <= 7 || 0%{?fedora} && 0%{?fedora} <= 27
-%global with_python3_default 0
+%if 0%{?rhel}
+%global python_executable /usr/libexec/platform-python
 %else
-%global with_python3_default 1
-%endif
+%global python_executable /usr/bin/python3
 %endif
 
 ################################################################################
@@ -80,13 +56,8 @@ Source: https://github.com/dogtagpki/pki/archive/v%{version}%{?_phase}/pki-%{ver
 # RESTEasy
 ################################################################################
 
-%if 0%{?rhel} && 0%{?rhel} <= 7
-%define jaxrs_api_jar /usr/share/java/resteasy-base/jaxrs-api.jar
-%define resteasy_lib /usr/share/java/resteasy-base
-%else
 %define jaxrs_api_jar /usr/share/java/jboss-jaxrs-2.0-api.jar
 %define resteasy_lib /usr/share/java/resteasy
-%endif
 
 ################################################################################
 # PKI
@@ -114,7 +85,7 @@ Source: https://github.com/dogtagpki/pki/archive/v%{version}%{?_phase}/pki-%{ver
 %define package_option() %bcond_with %1
 %else
 %define package_option() %bcond_without %1
-%endif # with pkgs
+%endif
 
 # Define --with <package> or --without <package> options depending on
 # package selection method.
@@ -134,13 +105,12 @@ Source: https://github.com/dogtagpki/pki/archive/v%{version}%{?_phase}/pki-%{ver
 # package_option console
 # package_option theme
 # package_option meta
+# package_option tests
 # package_option debug
 %global with_debug 1
 
 %if ! %{with debug}
 %define debug_package %{nil}
-
-# with debug
 %endif
 
 # ignore unpackaged files from native 'tpsclient'
@@ -184,24 +154,21 @@ fi;
 BuildRequires:    git
 BuildRequires:    make
 
-BuildRequires:    cmake >= 2.8.9-1
+BuildRequires:    cmake >= 3.0.2
 BuildRequires:    gcc-c++
 BuildRequires:    zip
 BuildRequires:    java-1.8.0-openjdk-devel
 BuildRequires:    redhat-rpm-config
-BuildRequires:    ldapjdk >= 4.21.0
+BuildRequires:    ldapjdk >= 4.22.0
 BuildRequires:    apache-commons-cli
 BuildRequires:    apache-commons-codec
 BuildRequires:    apache-commons-io
 BuildRequires:    apache-commons-lang
+BuildRequires:    apache-commons-net
 BuildRequires:    jakarta-commons-httpclient
 BuildRequires:    glassfish-jaxb-api
 BuildRequires:    slf4j
-%if 0%{?rhel} && 0%{?rhel} <= 7
-# no slf4j-jdk14
-%else
 BuildRequires:    slf4j-jdk14
-%endif
 BuildRequires:    nspr-devel
 BuildRequires:    nss-devel >= 3.36.1
 
@@ -209,37 +176,15 @@ BuildRequires:    openldap-devel
 BuildRequires:    pkgconfig
 BuildRequires:    policycoreutils
 
-%if 0%{?rhel} && 0%{?rhel} <= 7
-BuildRequires:    python-lxml
-BuildRequires:    python-sphinx
-%else
-%if 0%{?fedora} && 0%{?fedora} <= 28
-BuildRequires:    python2-lxml
-BuildRequires:    python2-sphinx
-%else
 BuildRequires:    python3-lxml
 BuildRequires:    python3-sphinx
-%endif
-%endif
 
 BuildRequires:    velocity
 BuildRequires:    xalan-j2
 BuildRequires:    xerces-j2
 
 %if 0%{?rhel}
-%if 0%{?rhel} <= 7
-# 'resteasy-base' is a subset of the complete set of
-# 'resteasy' packages and consists of what is needed to
-# support the PKI Restful interface on certain RHEL platforms
-BuildRequires:    resteasy-base-atom-provider >= 3.0.6-1
-BuildRequires:    resteasy-base-client >= 3.0.6-1
-BuildRequires:    resteasy-base-jaxb-provider >= 3.0.6-1
-BuildRequires:    resteasy-base-jaxrs >= 3.0.6-1
-BuildRequires:    resteasy-base-jaxrs-api >= 3.0.6-1
-BuildRequires:    resteasy-base-jackson-provider >= 3.0.6-1
-%else
 BuildRequires:    resteasy >= 3.0.26
-%endif
 %else
 BuildRequires:    jboss-annotations-1.2-api
 BuildRequires:    jboss-jaxrs-2.0-api
@@ -251,110 +196,34 @@ BuildRequires:    resteasy-core >= 3.0.17-1
 BuildRequires:    resteasy-jackson2-provider >= 3.0.17-1
 %endif
 
-%if 0%{?with_python2}
-%if 0%{?rhel}
-# no pylint
-%else
-BuildRequires:    pylint
-%if 0%{?fedora} && 0%{?fedora} <= 27
-BuildRequires:    python-flake8 >= 2.5.4
-BuildRequires:    pyflakes >= 1.2.3
-%else
-BuildRequires:    python2-flake8 >= 2.5.4
-BuildRequires:    python2-pyflakes >= 1.2.3
-%endif
-%endif
-
-# with_python2
-%endif
-
-%if 0%{?with_python3}
-%if 0%{?rhel}
-# no pylint
-%else
-BuildRequires:    python3-pylint
-BuildRequires:    python3-flake8 >= 2.5.4
-BuildRequires:    python3-pyflakes >= 1.2.3
-%endif
-
-# with_python3
-%endif
-
-%if 0%{?with_python2}
-BuildRequires:    python2
-BuildRequires:    python2-devel
-BuildRequires:    python2-cryptography
-%if 0%{?rhel} && 0%{?rhel} <= 7 || 0%{?fedora} && 0%{?fedora} <= 27
-BuildRequires:    python-nss
-BuildRequires:    python-requests >= 2.6.0
-BuildRequires:    python-six
-BuildRequires:    libselinux-python
-BuildRequires:    policycoreutils-python
-BuildRequires:    python-ldap
-%else
-BuildRequires:    python2-nss
-BuildRequires:    python2-requests >= 2.6.0
-BuildRequires:    python2-six
-BuildRequires:    python2-libselinux
-BuildRequires:    python2-policycoreutils
-BuildRequires:    python2-ldap
-%endif
-%if 0%{?rhel} && 0%{?rhel} <= 7
-# no policycoreutils-python-utils
-%else
-BuildRequires:    policycoreutils-python-utils
-%endif
-
-# with_python2
-%endif
-
-%if 0%{?with_python3}
-BuildRequires:    python3
+BuildRequires:    python3 >= 3.5
 BuildRequires:    python3-devel
+BuildRequires:    python3-setuptools
 BuildRequires:    python3-cryptography
 BuildRequires:    python3-lxml
-%if 0%{?rhel} && 0%{?rhel} <= 7 || 0%{?fedora} && 0%{?fedora} <= 27
-BuildRequires:    python3-pyldap
-# no python3-libselinux
-%else
 BuildRequires:    python3-ldap
 BuildRequires:    python3-libselinux
-%endif
 BuildRequires:    python3-nss
 BuildRequires:    python3-requests >= 2.6.0
 BuildRequires:    python3-six
 
-# with_python3
+%if 0%{?rhel}
+# no python3-pytest-runner
+%else
+BuildRequires:    python3-pytest-runner
 %endif
 
 BuildRequires:    junit
 BuildRequires:    jpackage-utils >= 0:1.7.5-10
-%if 0%{?rhel} && 0%{?rhel} <= 7
-BuildRequires:    jss >= 4.4.0-11
-BuildRequires:    tomcatjss >= 7.2.1-4
-%else
-BuildRequires:    jss >= 4.6.0-4
-BuildRequires:    tomcatjss >= 7.4.1
-%endif
+BuildRequires:    jss >= 4.7.0
+BuildRequires:    tomcatjss >= 7.5.0
 BuildRequires:    systemd-units
 
-%if 0%{?rhel} && 0%{?rhel} <= 7
-BuildRequires:    tomcat >= 7.0.69
-%else
-%if 0%{?fedora} && 0%{?fedora} <= 27
-BuildRequires:    tomcat >= 8.0.49
-%else
-%if 0%{?fedora} && 0%{?fedora} <= 28
-BuildRequires:    tomcat >= 1:8.5.23
-%else
 %if 0%{?rhel}
 BuildRequires:    pki-servlet-engine
 %else
 BuildRequires:    tomcat >= 1:9.0.7
 %endif
-%endif
-%endif
-%endif
 
 # additional build requirements needed to build native 'tpsclient'
 # REMINDER:  Revisit these once 'tpsclient' is rewritten as a Java app
@@ -374,6 +243,13 @@ BuildRequires:    go-md2man
 BuildRequires:    golang-github-cpuguy83-md2man
 %endif
 
+# pki-healthcheck depends on the following library
+%if 0%{?rhel}
+BuildRequires:    ipa-healthcheck-core
+%else
+BuildRequires:    freeipa-healthcheck-core
+%endif
+
 # PKICertImport depends on certutil and openssl
 BuildRequires:    nss-tools
 BuildRequires:    openssl
@@ -424,11 +300,7 @@ Requires:         pki-javadoc = %{version}
 
 # Make certain that this 'meta' package requires the latest version(s)
 # of ALL PKI clients
-%if 0%{?rhel} && 0%{?rhel} <= 7
-Requires:         esc >= 1.1.0
-%else
 Requires:         esc >= 1.1.1
-%endif
 
 # description for top-level package (unless there is a separate meta package)
 %if "%{name}" == "%{vendor_id}-pki"
@@ -460,11 +332,7 @@ Summary:          PKI Symmetric Key Package
 
 Requires:         java-1.8.0-openjdk-headless
 Requires:         jpackage-utils >= 0:1.7.5-10
-%if 0%{?rhel} && 0%{?rhel} <= 7
-Requires:         jss >= 4.4.0-11
-%else
-Requires:         jss >= 4.6.0-4
-%endif
+Requires:         jss >= 4.7.0
 Requires:         nss >= 3.38.0
 
 # Ensure we end up with a useful installation
@@ -486,15 +354,8 @@ BuildArch:        noarch
 
 Requires:         nss >= 3.36.1
 
-%if 0%{?with_python3_default}
-Requires:         python3-pki = %{version}
-Requires(post):   python3-pki = %{version}
-%else
-Requires:         python2-pki = %{version}
-Requires(post):   python2-pki = %{version}
-
-# with_python3_default
-%endif
+Requires:         python3-pki = %{version}-%{release}
+Requires(post):   python3-pki = %{version}-%{release}
 
 # Ensure we end up with a useful installation
 Conflicts:        pki-symkey < %{version}
@@ -506,39 +367,6 @@ Conflicts:        pki-console-theme < %{version}
 The PKI Base Package contains the common and client libraries and utilities
 written in Python.
 
-%if 0%{?with_python2}
-################################################################################
-%package -n       python2-pki
-################################################################################
-
-Summary:          PKI Python 2 Package
-BuildArch:        noarch
-
-Obsoletes:        pki-base-python2 < %{version}
-Provides:         pki-base-python2 = %{version}
-%if 0%{?fedora}
-%{?python_provide:%python_provide python2-pki}
-%endif
-
-Requires:         pki-base = %{version}
-Requires:         python2-cryptography
-%if 0%{?rhel} && 0%{?rhel} <= 7 || 0%{?fedora} && 0%{?fedora} <= 27
-Requires:         python-nss
-Requires:         python-requests >= 2.6.0
-Requires:         python-six
-%else
-Requires:         python2-nss
-Requires:         python2-requests >= 2.6.0
-Requires:         python2-six
-%endif
-
-%description -n   python2-pki
-This package contains PKI client library for Python 2.
-
-# with_python2
-%endif
-
-%if 0%{?with_python3}
 ################################################################################
 %package -n       python3-pki
 ################################################################################
@@ -552,7 +380,8 @@ Provides:         pki-base-python3 = %{version}
 %{?python_provide:%python_provide python3-pki}
 %endif
 
-Requires:         pki-base = %{version}
+Requires:         pki-base = %{version}-%{release}
+Requires:         python3 >= 3.5
 Requires:         python3-cryptography
 Requires:         python3-lxml
 Requires:         python3-nss
@@ -562,9 +391,6 @@ Requires:         python3-six
 %description -n   python3-pki
 This package contains PKI client library for Python 3.
 
-# with_python3 for python3-pki
-%endif
-
 ################################################################################
 %package -n       pki-base-java
 ################################################################################
@@ -578,37 +404,18 @@ Requires:         apache-commons-codec
 Requires:         apache-commons-io
 Requires:         apache-commons-lang
 Requires:         apache-commons-logging
+Requires:         apache-commons-net
 Requires:         jakarta-commons-httpclient
 Requires:         glassfish-jaxb-api
 Requires:         slf4j
-%if 0%{?rhel} && 0%{?rhel} <= 7
-# no slf4j-jdk14
-%else
 Requires:         slf4j-jdk14
-%endif
 Requires:         jpackage-utils >= 0:1.7.5-10
-%if 0%{?rhel} && 0%{?rhel} <= 7
-Requires:         jss >= 4.4.0-11
-%else
-Requires:         jss >= 4.6.0-4
-%endif
-Requires:         ldapjdk >= 4.21.0
-Requires:         pki-base = %{version}
+Requires:         jss >= 4.7.0
+Requires:         ldapjdk >= 4.22.0
+Requires:         pki-base = %{version}-%{release}
 
 %if 0%{?rhel}
-%if 0%{?rhel} <= 7
-# 'resteasy-base' is a subset of the complete set of
-# 'resteasy' packages and consists of what is needed to
-# support the PKI Restful interface on certain RHEL platforms
-Requires:         resteasy-base-atom-provider >= 3.0.6-1
-Requires:         resteasy-base-client >= 3.0.6-1
-Requires:         resteasy-base-jaxb-provider >= 3.0.6-1
-Requires:         resteasy-base-jaxrs >= 3.0.6-1
-Requires:         resteasy-base-jaxrs-api >= 3.0.6-1
-Requires:         resteasy-base-jackson-provider >= 3.0.6-1
-%else
 Requires:         resteasy >= 3.0.26
-%endif
 %else
 Requires:         resteasy-atom-provider >= 3.0.17-1
 Requires:         resteasy-client >= 3.0.17-1
@@ -634,7 +441,7 @@ Summary:          PKI Tools Package
 
 Requires:         openldap-clients
 Requires:         nss-tools >= 3.36.1
-Requires:         pki-base-java = %{version}
+Requires:         pki-base-java = %{version}-%{release}
 Requires:         p11-kit-trust
 
 # PKICertImport depends on certutil and openssl
@@ -662,76 +469,39 @@ Requires:         net-tools
 Requires:         policycoreutils
 Requires:         procps-ng
 Requires:         openldap-clients
-%if 0%{?rhel} && 0%{?rhel} <= 7
-Requires:         openssl >= 1.0.2k-11
-%else
 Requires:         openssl
-%endif
-Requires:         pki-symkey = %{version}
-Requires:         pki-tools = %{version}
+Requires:         pki-symkey = %{version}-%{release}
+Requires:         pki-tools = %{version}-%{release}
 
 Requires:         keyutils
 
-%if 0%{?rhel} && 0%{?rhel} <= 7
-# no policycoreutils-python-utils
-%else
 Requires:         policycoreutils-python-utils
-%endif
 
-%if 0%{?with_python3_default}
-%if 0%{?fedora} && 0%{?fedora} <= 27
-Requires:         python3-pyldap
-%else
 Requires:         python3-ldap
-%endif
 Requires:         python3-lxml
 Requires:         python3-libselinux
 Requires:         python3-policycoreutils
-%else
-%if 0%{?rhel} && 0%{?rhel} <= 7 || 0%{?fedora} && 0%{?fedora} <= 27
-Requires:         python-ldap
-Requires:         python-lxml
-Requires:         libselinux-python
-Requires:         policycoreutils-python
-%else
-Requires:         python2-ldap
-Requires:         python2-lxml
-Requires:         python2-libselinux
-Requires:         python2-policycoreutils
-%endif
-
-# with_python3_default
-%endif
 
 Requires:         selinux-policy-targeted >= 3.13.1-159
 
-%if 0%{?rhel} && 0%{?rhel} <= 7
-Requires:         tomcat >= 7.0.69
-%else
-%if 0%{?fedora} && 0%{?fedora} <= 27
-Requires:         tomcat >= 8.0.49
-%else
-%if 0%{?fedora} && 0%{?fedora} <= 28
-Requires:         tomcat >= 1:8.5.23
-%else
 %if 0%{?rhel}
 Requires:         pki-servlet-engine >= 1:9.0.7
 %else
 Requires:         tomcat >= 1:9.0.7
 %endif
-%endif
-%endif
-%endif
 
 Requires:         velocity
 Requires(post):   systemd-units
 Requires(preun):  systemd-units
 Requires(postun): systemd-units
 Requires(pre):    shadow-utils
-%if 0%{?rhel} && 0%{?rhel} <= 7
-Requires:         tomcatjss >= 7.2.1-4
+Requires:         tomcatjss >= 7.5.0
+
+# pki-healthcheck depends on the following library
+%if 0%{?rhel}
+Requires:         ipa-healthcheck-core
 %else
-Requires:         tomcatjss >= 7.4.1
+Requires:         freeipa-healthcheck-core
 %endif
 
 # https://pagure.io/freeipa/issue/7742
@@ -741,6 +511,13 @@ Conflicts:        ipa-server < 4.7.1
 Conflicts:        freeipa-server < 4.7.1
 %endif
 
+Provides:         bundled(js-backbone) = 1.4.0
+Provides:         bundled(js-bootstrap) = 3.4.1
+Provides:         bundled(js-jquery) = 3.5.1
+Provides:         bundled(js-jquery-i18n-properties) = 1.2.7
+Provides:         bundled(js-patternfly) = 3.59.2
+Provides:         bundled(js-underscore) = 1.9.2
+
 %description -n   pki-server
 The PKI Server Package contains libraries and utilities needed by the
 following PKI subsystems:
@@ -762,7 +539,7 @@ following PKI subsystems:
 Summary:          PKI CA Package
 BuildArch:        noarch
 
-Requires:         pki-server = %{version}
+Requires:         pki-server = %{version}-%{release}
 Requires(post):   systemd-units
 Requires(preun):  systemd-units
 Requires(postun): systemd-units
@@ -787,7 +564,7 @@ where it obtains its own signing certificate from a public CA.
 Summary:          PKI KRA Package
 BuildArch:        noarch
 
-Requires:         pki-server = %{version}
+Requires:         pki-server = %{version}-%{release}
 Requires(post):   systemd-units
 Requires(preun):  systemd-units
 Requires(postun): systemd-units
@@ -1003,6 +780,20 @@ This PKI Console Theme Package contains
 # with theme
 %endif
 
+%if %{with tests}
+################################################################################
+%package -n       pki-tests
+################################################################################
+
+Summary:          PKI Tests
+BuildArch:        noarch
+
+%description -n   pki-tests
+This package contains PKI test suite.
+
+# with tests
+%endif
+
 ################################################################################
 %prep
 ################################################################################
@@ -1037,12 +828,7 @@ cd build
     -DRESTEASY_LIB=%{resteasy_lib} \
     -DNSS_DEFAULT_DB_TYPE=%{nss_default_db_type} \
     -DBUILD_PKI_CORE:BOOL=ON \
-    -DWITH_PYTHON2:BOOL=%{?with_python2:ON}%{!?with_python2:OFF} \
-    -DWITH_PYTHON3:BOOL=%{?with_python3:ON}%{!?with_python3:OFF} \
-%if 0%{?with_python3_default}
-    -DWITH_PYTHON3_DEFAULT:BOOL=ON \
-%endif
-    -DPYTHON_EXECUTABLE=%{__python3} \
+    -DPYTHON_EXECUTABLE=%{python_executable} \
     -DWITH_TEST:BOOL=%{?with_test:ON}%{!?with_test:OFF} \
 %if ! %{with server} && ! %{with ca} && ! %{with kra} && ! %{with ocsp} && ! %{with tks} && ! %{with tps}
     -DWITH_SERVER:BOOL=OFF \
@@ -1052,20 +838,28 @@ cd build
     -DTHEME=%{?with_theme:%{vendor_id}} \
     ..
 
+# Do not use _smp_mflags to preserve build order
+%{__make} \
+    VERBOSE=%{?_verbose} \
+    CMAKE_NO_VERBOSE=1 \
+    DESTDIR=%{buildroot} \
+    INSTALL="install -p" \
+    --no-print-directory \
+    all
+
 ################################################################################
 %install
 ################################################################################
 
 cd build
 
-# Do not use _smp_mflags to preserve build order
 %{__make} \
     VERBOSE=%{?_verbose} \
     CMAKE_NO_VERBOSE=1 \
     DESTDIR=%{buildroot} \
     INSTALL="install -p" \
     --no-print-directory \
-    all install
+    install
 
 %if %{with_test}
 ctest --output-on-failure
@@ -1082,150 +876,16 @@ EOF
 # with meta
 %endif
 
-# Customize system upgrade scripts in /usr/share/pki/upgrade
-%if 0%{?rhel} && 0%{?rhel} <= 7
-
-# merge newer upgrade scripts into 10.3.3 for RHEL
-/bin/rm -rf %{buildroot}%{_datadir}/pki/upgrade/10.3.4
-/bin/rm -rf %{buildroot}%{_datadir}/pki/upgrade/10.3.5
-
-# merge newer upgrade scripts into 10.4.1 for RHEL
-/bin/rm -rf %{buildroot}%{_datadir}/pki/upgrade/10.4.2
-/bin/rm -rf %{buildroot}%{_datadir}/pki/upgrade/10.4.3
-/bin/rm -rf %{buildroot}%{_datadir}/pki/upgrade/10.4.4
-/bin/rm -rf %{buildroot}%{_datadir}/pki/upgrade/10.4.5
-/bin/rm -rf %{buildroot}%{_datadir}/pki/upgrade/10.4.6
-%endif
-
 # Customize client library links in /usr/share/pki/lib
-%if 0%{?rhel} && 0%{?rhel} <= 7
-# no link customization
-%else
-    ln -sf /usr/share/java/jboss-logging/jboss-logging.jar %{buildroot}%{_datadir}/pki/lib/jboss-logging.jar
-    ln -sf /usr/share/java/jboss-annotations-1.2-api/jboss-annotations-api_1.2_spec.jar %{buildroot}%{_datadir}/pki/lib/jboss-annotations-api_1.2_spec.jar
-%endif
+ln -sf /usr/share/java/jboss-logging/jboss-logging.jar %{buildroot}%{_datadir}/pki/lib/jboss-logging.jar
+ln -sf /usr/share/java/jboss-annotations-1.2-api/jboss-annotations-api_1.2_spec.jar %{buildroot}%{_datadir}/pki/lib/jboss-annotations-api_1.2_spec.jar
 
 %if %{with server}
 
-# Customize server upgrade scripts in /usr/share/pki/server/upgrade
-%if 0%{?rhel} && 0%{?rhel} <= 7
-
-# merge newer upgrade scripts into 10.3.3 for RHEL
-mv %{buildroot}%{_datadir}/pki/server/upgrade/10.3.5/01-FixServerLibrary.py \
-   %{buildroot}%{_datadir}/pki/server/upgrade/10.3.3/02-FixServerLibrary.py
-mv %{buildroot}%{_datadir}/pki/server/upgrade/10.3.5/02-FixDeploymentDescriptor.py \
-   %{buildroot}%{_datadir}/pki/server/upgrade/10.3.3/03-FixDeploymentDescriptor.py
-/bin/rm -rf %{buildroot}%{_datadir}/pki/server/upgrade/10.3.4
-/bin/rm -rf %{buildroot}%{_datadir}/pki/server/upgrade/10.3.5
-
-# merge newer upgrade scripts into 10.4.1 for RHEL
-mv %{buildroot}%{_datadir}/pki/server/upgrade/10.4.2/01-AddSessionAuthenticationPlugin.py \
-   %{buildroot}%{_datadir}/pki/server/upgrade/10.4.1/01-AddSessionAuthenticationPlugin.py
-mv %{buildroot}%{_datadir}/pki/server/upgrade/10.4.2/02-AddKRAWrappingParams.py \
-   %{buildroot}%{_datadir}/pki/server/upgrade/10.4.1/02-AddKRAWrappingParams.py
-mv %{buildroot}%{_datadir}/pki/server/upgrade/10.4.6/01-UpdateKeepAliveTimeout.py \
-   %{buildroot}%{_datadir}/pki/server/upgrade/10.4.1/03-UpdateKeepAliveTimeout.py
-/bin/rm -rf %{buildroot}%{_datadir}/pki/server/upgrade/10.4.2
-/bin/rm -rf %{buildroot}%{_datadir}/pki/server/upgrade/10.4.3
-/bin/rm -rf %{buildroot}%{_datadir}/pki/server/upgrade/10.4.4
-/bin/rm -rf %{buildroot}%{_datadir}/pki/server/upgrade/10.4.5
-/bin/rm -rf %{buildroot}%{_datadir}/pki/server/upgrade/10.4.6
-
-# merge newer upgrade script into 10.5.1 for RHEL
-mv %{buildroot}%{_datadir}/pki/server/upgrade/10.5.5/01-AddTPSExternalRegISEtokenParams.py \
-   %{buildroot}%{_datadir}/pki/server/upgrade/10.5.1/01-AddTPSExternalRegISEtokenParams.py
-
-/bin/rm -rf %{buildroot}%{_datadir}/pki/server/upgrade/10.5.5
-
-%endif
-
 # Customize server common library links in /usr/share/pki/server/common/lib
-%if 0%{?fedora} || 0%{?rhel} > 7
-    ln -sf %{jaxrs_api_jar} %{buildroot}%{_datadir}/pki/server/common/lib/jboss-jaxrs-2.0-api.jar
-    ln -sf /usr/share/java/jboss-logging/jboss-logging.jar %{buildroot}%{_datadir}/pki/server/common/lib/jboss-logging.jar
-    ln -sf /usr/share/java/jboss-annotations-1.2-api/jboss-annotations-api_1.2_spec.jar %{buildroot}%{_datadir}/pki/server/common/lib/jboss-annotations-api_1.2_spec.jar
-
-%else
-
-if [ -f /etc/debian_version ]; then
-    ln -sf /usr/share/java/commons-collections3.jar %{buildroot}%{_datadir}/pki/server/common/lib/commons-collections.jar
-    ln -sf /usr/share/java/httpclient.jar %{buildroot}%{_datadir}/pki/server/common/lib/httpclient.jar
-    ln -sf /usr/share/java/httpcore.jar %{buildroot}%{_datadir}/pki/server/common/lib/httpcore.jar
-    ln -sf /usr/share/java/jackson-core-asl.jar %{buildroot}%{_datadir}/pki/server/common/lib/jackson-core-asl.jar
-    ln -sf /usr/share/java/jackson-jaxrs.jar %{buildroot}%{_datadir}/pki/server/common/lib/jackson-jaxrs.jar
-    ln -sf /usr/share/java/jackson-mapper-asl.jar %{buildroot}%{_datadir}/pki/server/common/lib/jackson-mapper-asl.jar
-    ln -sf /usr/share/java/jackson-mrbean.jar %{buildroot}%{_datadir}/pki/server/common/lib/jackson-mrbean.jar
-    ln -sf /usr/share/java/jackson-smile.jar %{buildroot}%{_datadir}/pki/server/common/lib/jackson-smile.jar
-    ln -sf /usr/share/java/jackson-xc.jar %{buildroot}%{_datadir}/pki/server/common/lib/jackson-xc.jar
-    ln -sf /usr/share/java/jss4.jar %{buildroot}%{_datadir}/pki/server/common/lib/jss4.jar
-    ln -sf /usr/share/java/symkey.jar %{buildroot}%{_datadir}/pki/server/common/lib/symkey.jar
-    ln -sf /usr/share/java/xercesImpl.jar %{buildroot}%{_datadir}/pki/server/common/lib/xerces-j2.jar
-    ln -sf /usr/share/java/xml-apis.jar %{buildroot}%{_datadir}/pki/server/common/lib/xml-commons-apis.jar
-    ln -sf /usr/share/java/xml-resolver.jar %{buildroot}%{_datadir}/pki/server/common/lib/xml-commons-resolver.jar
-fi
-
-%endif
-
-# Customize server library links in /usr/share/pki/server/lib
-%if 0%{?rhel} && 0%{?rhel} <= 7
-    rm -f %{buildroot}%{_datadir}/pki/server/lib/slf4j-jdk14.jar
-%endif
-
-%if 0%{?rhel}
-# no pylint
-%else
-
-################################################################################
-echo "Scanning Python code with pylint"
-################################################################################
-
-%if 0%{?with_python3_default}
-%{__python3} ../tools/pylint-build-scan.py rpm --prefix %{buildroot}
-if [ $? -ne 0 ]; then
-    echo "pylint for Python 3 failed. RC: $?"
-    exit 1
-fi
-%else
-%{__python2} ../tools/pylint-build-scan.py rpm --prefix %{buildroot}
-if [ $? -ne 0 ]; then
-    echo "pylint for Python 2 failed. RC: $?"
-    exit 1
-fi
-
-%{__python2} ../tools/pylint-build-scan.py rpm --prefix %{buildroot} -- --py3k
-if [ $? -ne 0 ]; then
-    echo "pylint for Python 2 with --py3k failed. RC: $?"
-    exit 1
-fi
-
-# with_python3_default
-%endif
-
-################################################################################
-echo "Scanning Python code with flake8"
-################################################################################
-
-%if 0%{?with_python2}
-flake8 --config ../tox.ini %{buildroot}
-if [ $? -ne 0 ]; then
-    echo "flake8 for Python 2 failed. RC: $?"
-    exit 1
-fi
-
-# with_python2
-%endif
-
-%if 0%{?with_python3}
-python3-flake8 --config ../tox.ini %{buildroot}
-if [ $? -ne 0 ]; then
-    echo "flake8 for Python 3 failed. RC: $?"
-    exit 1
-fi
-
-# with_python3
-%endif
-
-%endif
+ln -sf %{jaxrs_api_jar} %{buildroot}%{_datadir}/pki/server/common/lib/jboss-jaxrs-2.0-api.jar
+ln -sf /usr/share/java/jboss-logging/jboss-logging.jar %{buildroot}%{_datadir}/pki/server/common/lib/jboss-logging.jar
+ln -sf /usr/share/java/jboss-annotations-1.2-api/jboss-annotations-api_1.2_spec.jar %{buildroot}%{_datadir}/pki/server/common/lib/jboss-annotations-api_1.2_spec.jar
 
 # with server
 %endif
@@ -1253,9 +913,9 @@ then
 
 else
     # On RPM upgrade run system upgrade
-    echo "Upgrading PKI system configuration at `/bin/date`." >> /var/log/pki/pki-upgrade-%{version}.log 2>&1
-    /sbin/pki-upgrade --silent >> /var/log/pki/pki-upgrade-%{version}.log 2>&1
-    echo >> /var/log/pki/pki-upgrade-%{version}.log 2>&1
+    echo "Upgrading PKI system configuration at `/bin/date`." >> /var/log/pki/pki-upgrade-%{version}.log
+    /sbin/pki-upgrade 2>&1 | tee -a /var/log/pki/pki-upgrade-%{version}.log
+    echo >> /var/log/pki/pki-upgrade-%{version}.log
 fi
 
 %postun -n pki-base
@@ -1276,10 +936,6 @@ fi
 ##        from EITHER 'sysVinit' OR previous 'systemd' processes to the new
 ##        PKI deployment process
 
-echo "Upgrading PKI server configuration on `/bin/date`." >> /var/log/pki/pki-server-upgrade-%{version}.log 2>&1
-/sbin/pki-server upgrade --silent >> /var/log/pki/pki-server-upgrade-%{version}.log 2>&1
-echo >> /var/log/pki/pki-server-upgrade-%{version}.log 2>&1
-
 # Reload systemd daemons on upgrade only
 if [ "$1" == "2" ]
 then
@@ -1319,7 +975,7 @@ fi
 %files -n pki-symkey
 ################################################################################
 
-%doc base/symkey/LICENSE
+%license base/symkey/LICENSE
 %{_jnidir}/symkey.jar
 %{_libdir}/symkey/
 
@@ -1327,8 +983,8 @@ fi
 %files -n pki-base
 ################################################################################
 
-%doc base/common/LICENSE
-%doc base/common/LICENSE.LESSER
+%license base/common/LICENSE
+%license base/common/LICENSE.LESSER
 %doc %{_datadir}/doc/pki-base/html
 %dir %{_datadir}/pki
 %{_datadir}/pki/VERSION
@@ -1349,54 +1005,35 @@ fi
 %{_mandir}/man5/pki-logging.5.gz
 %{_mandir}/man8/pki-upgrade.8.gz
 
-%if 0%{?with_python2}
-################################################################################
-%files -n python2-pki
-################################################################################
-
-%doc base/common/LICENSE
-%doc base/common/LICENSE.LESSER
-%if %{with server} && ! %{?with_python3_default}
-%exclude %{python2_sitelib}/pki/server
-%endif
-%{python2_sitelib}/pki
-
-# with_python2
-%endif
-
 ################################################################################
 %files -n pki-base-java
 ################################################################################
 
-%doc base/common/LICENSE
-%doc base/common/LICENSE.LESSER
+%license base/common/LICENSE
+%license base/common/LICENSE.LESSER
 %{_datadir}/pki/examples/java/
 %{_datadir}/pki/lib/*.jar
 %dir %{_javadir}/pki
 %{_javadir}/pki/pki-cmsutil.jar
-%{_javadir}/pki/pki-nsutil.jar
 %{_javadir}/pki/pki-certsrv.jar
 
-%if 0%{?with_python3}
 ################################################################################
 %files -n python3-pki
 ################################################################################
 
-%doc base/common/LICENSE
-%doc base/common/LICENSE.LESSER
-%if %{with server} && %{?with_python3_default}
+%license base/common/LICENSE
+%license base/common/LICENSE.LESSER
+%if %{with server}
 %exclude %{python3_sitelib}/pki/server
 %endif
 %{python3_sitelib}/pki
 
-# with_python3
-%endif
-
 ################################################################################
 %files -n pki-tools
 ################################################################################
 
-%doc base/native-tools/LICENSE base/native-tools/doc/README
+%license base/native-tools/LICENSE
+%doc base/native-tools/doc/README
 %{_bindir}/p7tool
 %{_bindir}/pistool
 %{_bindir}/pki
@@ -1470,8 +1107,8 @@ fi
 %files -n pki-server
 ################################################################################
 
-%doc base/common/THIRD_PARTY_LICENSES
-%doc base/server/LICENSE
+%license base/common/THIRD_PARTY_LICENSES
+%license base/server/LICENSE
 %doc base/server/README
 %attr(755,-,-) %dir %{_sysconfdir}/sysconfig/pki
 %attr(755,-,-) %dir %{_sysconfdir}/sysconfig/pki/tomcat
@@ -1479,13 +1116,11 @@ fi
 %{_sbindir}/pkidestroy
 %{_sbindir}/pki-server
 %{_sbindir}/pki-server-upgrade
-%if 0%{?with_python3_default}
 %{python3_sitelib}/pki/server/
-%else
-%{python2_sitelib}/pki/server/
-
-# with_python3_default
-%endif
+%{_sbindir}/pki-healthcheck
+%{python3_sitelib}/pki/server/healthcheck/
+%{python3_sitelib}/pkihealthcheck-*.egg-info/
+%config(noreplace) %{_sysconfdir}/pki/healthcheck.conf
 
 %{_datadir}/pki/etc/tomcat.conf
 %dir %{_datadir}/pki/deployment
@@ -1510,6 +1145,7 @@ fi
 %{_mandir}/man8/pkidestroy.8.gz
 %{_mandir}/man8/pkispawn.8.gz
 %{_mandir}/man8/pki-server.8.gz
+%{_mandir}/man8/pki-server-acme.8.gz
 %{_mandir}/man8/pki-server-instance.8.gz
 %{_mandir}/man8/pki-server-subsystem.8.gz
 %{_mandir}/man8/pki-server-nuxwdog.8.gz
@@ -1520,6 +1156,7 @@ fi
 %{_mandir}/man8/pki-server-ocsp.8.gz
 %{_mandir}/man8/pki-server-tks.8.gz
 %{_mandir}/man8/pki-server-tps.8.gz
+%{_mandir}/man8/pki-healthcheck.8.gz
 %{_datadir}/pki/setup/
 %{_datadir}/pki/server/
 %{_datadir}/pki/acme/
@@ -1533,7 +1170,7 @@ fi
 %files -n pki-ca
 ################################################################################
 
-%doc base/ca/LICENSE
+%license base/ca/LICENSE
 %{_javadir}/pki/pki-ca.jar
 %dir %{_datadir}/pki/ca
 %{_datadir}/pki/ca/conf/
@@ -1550,7 +1187,7 @@ fi
 %files -n pki-kra
 ################################################################################
 
-%doc base/kra/LICENSE
+%license base/kra/LICENSE
 %{_javadir}/pki/pki-kra.jar
 %dir %{_datadir}/pki/kra
 %{_datadir}/pki/kra/conf/
@@ -1565,7 +1202,7 @@ fi
 %files -n pki-ocsp
 ################################################################################
 
-%doc base/ocsp/LICENSE
+%license base/ocsp/LICENSE
 %{_javadir}/pki/pki-ocsp.jar
 %dir %{_datadir}/pki/ocsp
 %{_datadir}/pki/ocsp/conf/
@@ -1580,7 +1217,7 @@ fi
 %files -n pki-tks
 ################################################################################
 
-%doc base/tks/LICENSE
+%license base/tks/LICENSE
 %{_javadir}/pki/pki-tks.jar
 %dir %{_datadir}/pki/tks
 %{_datadir}/pki/tks/conf/
@@ -1595,7 +1232,7 @@ fi
 %files -n pki-tps
 ################################################################################
 
-%doc base/tps/LICENSE
+%license base/tps/LICENSE
 %{_javadir}/pki/pki-tps.jar
 %dir %{_datadir}/pki/tps
 %{_datadir}/pki/tps/applets/
@@ -1631,7 +1268,7 @@ fi
 %files -n pki-console
 ################################################################################
 
-%doc base/console/LICENSE
+%license base/console/LICENSE
 %{_bindir}/pkiconsole
 %{_javadir}/pki/pki-console.jar
 
@@ -1643,7 +1280,7 @@ fi
 %files -n %{vendor_id}-pki-server-theme
 ################################################################################
 
-%doc themes/%{vendor_id}/common-ui/LICENSE
+%license themes/%{vendor_id}/common-ui/LICENSE
 %dir %{_datadir}/pki
 %{_datadir}/pki/CS_SERVER_VERSION
 %{_datadir}/pki/common-ui/
@@ -1661,14 +1298,55 @@ fi
 %files -n %{vendor_id}-pki-console-theme
 ################################################################################
 
-%doc themes/%{vendor_id}/console-ui/LICENSE
+%license themes/%{vendor_id}/console-ui/LICENSE
 %{_javadir}/pki/pki-console-theme.jar
 
 # with theme
 %endif
 
+%if %{with tests}
+################################################################################
+%files -n pki-tests
+################################################################################
+
+%{_datadir}/pki/tests/
+
+# with tests
+%endif
+
 ################################################################################
 %changelog
+* Thu Jun 25 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.0-0.4
+- Rebased to PKI 10.9.0-b2
+
+* Mon Jun 22 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.0-0.3
+- Rebased to PKI 10.9.0-b1
+
+* Tue May 26 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.9.0-0.1
+- Rebased to PKI 10.9.0-a1
+
+* Tue Mar 03 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.8.3-1
+- Rebased to PKI 10.8.3
+- Bug #1809210 - TPS installation failure on HSM machine
+- Bug #1807421 - Subordinate CA installation failed
+- Bug #1806840 - KRA cloning with HSM failed
+
+* Wed Feb 19 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.8.2-2
+- Bug #1795215 - pkispawn interactive installation failed
+
+* Mon Feb 17 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.8.2-1
+- Rebased to PKI 10.8.2
+- Bug #1802006 - KRA installation failed to create ECC admin cert
+
+* Mon Feb 10 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.8.1-1
+- Rebased to PKI 10.8.1
+
+* Fri Feb 07 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.8.0-1
+- Rebased to PKI 10.8.0
+
+* Thu Jan 16 2020 Red Hat PKI Team <rhcs-maint@redhat.com> 10.8.0-0.5
+- Rebased to PKI 10.8.0-b3
+
 * Fri Dec 13 2019 Red Hat PKI Team <rhcs-maint@redhat.com> 10.8.0-0.4
 - Rebased to PKI 10.8.0-b2