Merge branch 'master' into fix_AddBuildNumber

README.md

@@ -169,6 +169,9 @@ if using docker, keep the container after the build.
 --make-exploded-image
 creates an exploded image (useful for codesigning jmods). Use --assemble-exploded-image once you have signed the jmods to complete the packaging steps.
 
+--custom-cacerts <true|false>
+If true (default), a custom cacerts file will be generated based on Mozilla's list of CA certificates (see folder security/). If false, the file shipped by OpenJDK will be used. 
+
 -n, --no-colour
 disable colour output.
 
@@ -212,8 +215,7 @@ For reference, OpenJDK version numbers look like 1.8.0_162-b12 (for Java 8) or
 This is typically used in conjunction with -b.
 
 --use-jep319-certs
-Use certs defined in JEP319 in Java 8/9. This will increase the volume of traffic downloaded, however will
-provide an upto date ca cert list.
+Use certs defined in JEP319 in Java 8/9. Deprecated, has no effect.
 
 -v, --version
 specify the OpenJDK version to build e.g. jdk8u.  Left for backwards compatibility.

build-farm/platform-specific-configurations/mac.sh

@@ -57,7 +57,7 @@ then
   # Login to KeyChain
   # shellcheck disable=SC2046
   # shellcheck disable=SC2006
-  security unlock-keychain -p `cat ~/.password`
+  security unlock-keychain -p `cat ~/.password` login.keychain-db
   export BUILD_ARGS="${BUILD_ARGS} --codesign-identity 'Developer ID Application: London Jamocha Community CIC'"
 fi
 

configureBuild.sh

@@ -157,6 +157,8 @@ setRepository() {
     suffix="SAP/SapMachine"
   elif [[ "${BUILD_CONFIG[BUILD_VARIANT]}" == "${BUILD_VARIANT_CORRETTO}" ]]; then
     suffix="corretto/corretto-${BUILD_CONFIG[OPENJDK_CORE_VERSION]:3}"
+  elif [[ "${BUILD_CONFIG[BUILD_VARIANT]}" == "${BUILD_VARIANT_DRAGONWELL}" ]]; then
+    suffix="alibaba/dragonwell${BUILD_CONFIG[OPENJDK_CORE_VERSION]/jdk/}"
   elif [ "${BUILD_CONFIG[OPENJDK_CORE_VERSION]}" == "${JDK8_CORE_VERSION}" ] && [ "${BUILD_CONFIG[OS_ARCHITECTURE]}" == "armv7l" ]; then
     suffix="adoptopenjdk/openjdk-aarch32-jdk8u";
   elif [ "${BUILD_CONFIG[OPENJDK_CORE_VERSION]}" == "${JDK8_CORE_VERSION}" ] && [ "${BUILD_CONFIG[OS_ARCHITECTURE]}" == "aarch64" ]; then

docker/dockerfile-generator.sh

@@ -243,6 +243,7 @@ printDockerJDKs() {
     printJDK $((JDK_VERSION-1))
     echo "RUN ln -sf /usr/lib/jvm/jdk$((JDK_VERSION-1))/bin/java /usr/bin/java" >> $DOCKERFILE_PATH
     echo "RUN ln -sf /usr/lib/jvm/jdk$((JDK_VERSION-1))/bin/javac /usr/bin/javac" >> $DOCKERFILE_PATH
+    echo "RUN ln -sf /usr/lib/jvm/jdk$((JDK_VERSION-1))/bin/keytool /usr/bin/keytool" >> $DOCKERFILE_PATH
   fi
 
   # Build 'jdk' with the most recent GA release
@@ -254,6 +255,7 @@ printDockerJDKs() {
     printJDK ${JDK_GA}
     echo "RUN ln -sf /usr/lib/jvm/jdk${JDK_GA}/bin/java /usr/bin/java" >> $DOCKERFILE_PATH
     echo "RUN ln -sf /usr/lib/jvm/jdk${JDK_GA}/bin/javac /usr/bin/javac" >> $DOCKERFILE_PATH
+    echo "RUN ln -sf /usr/lib/jvm/jdk${JDK_GA}/bin/keytool /usr/bin/keytool" >> $DOCKERFILE_PATH
   fi
 
   # if JDK_VERSION is 9, another jdk8 doesn't need to be extracted
@@ -274,6 +276,7 @@ RUN sh -c \"mkdir -p /usr/lib/jvm/jdk$JDKVersion && wget 'https://api.adoptopenj
 printCopyFolders(){
   echo "
 COPY sbin /openjdk/sbin
+COPY security /openjdk/security
 COPY workspace/config /openjdk/config
 COPY pipelines /openjdk/pipelines" >> $DOCKERFILE_PATH
 }

makejdk-any-platform.1

@@ -166,8 +166,7 @@ For reference, OpenJDK version numbers look like 1.8.0_162-b12 (for Java 8) or
 This is typically used in conjunction with \fB<-b>\fR.
 .TP
 .BR \-\-use-jep319-certs
-Use certs defined in JEP319 in Java 8/9. This will increase the volume of traffic
-downloaded, however will provide an uptodate ca cert list.
+Use certs defined in JEP319 in Java 8/9. Deprecated, has no effect.
 .TP
 .BR \-v ", " \-\-version " " \fI<version>\fR
 specify the OpenJDK version to build e.g. jdk8u.  Left for backwards compatibility.

pipelines/build/common/openjdk_build_pipeline.groovy

@@ -88,6 +88,7 @@ class Build {
         switch (buildConfig.VARIANT) {
             case "openj9": variant = "j9"; break
             case "corretto": variant = "corretto"; break
+            case "dragonwell": variant = "dragonwell"; break;
             default: variant = "hs"
         }
 
@@ -118,6 +119,8 @@ class Build {
             jdkBranch = 'openj9'
         } else if (buildConfig.VARIANT == "hotspot"){
             jdkBranch = 'dev'
+        } else if (buildConfig.VARIANT == "dragonwell") {
+            jdkBranch = 'master'
         } else {
             context.error("Unrecognized build variant '${buildConfig.VARIANT}' ")
             throw new Exception()
@@ -135,8 +138,10 @@ class Build {
             suffix="corretto/corretto-${javaNumber}"
         } else if (buildConfig.VARIANT == "openj9") {
             suffix = "ibmruntimes/openj9-openjdk-jdk${javaNumber}"
-        } else if (buildConfig.VARIANT == "hotspot"){
+        } else if (buildConfig.VARIANT == "hotspot") {
             suffix = "adoptopenjdk/openjdk-${buildConfig.JAVA_TO_BUILD}"
+        } else if (buildConfig.VARIANT == "dragonwell") {
+            suffix = "alibaba/dragonwell${javaNumber}"
         } else {
             context.error("Unrecognized build variant '${buildConfig.VARIANT}' ")
             throw new Exception()

pipelines/build/dockerFiles/dragonwell.dockerfile

@@ -0,0 +1,12 @@
+ARG image
+
+FROM $image
+
+RUN \
+    # Dragonewell 8 requires a dragonwell 8 BootJDK
+    mkdir -p /opt/dragonwell; \
+    wget https://github.com/alibaba/dragonwell8/releases/download/dragonwell-8.4.4_jdk8u262-ga/Alibaba_Dragonwell_8.4.4-GA_Linux_x64.tar.gz; \
+    tar -xf Alibaba_Dragonwell_8.4.4-GA_Linux_x64.tar.gz -C /opt/; \
+    mv /opt/jdk8u262-b10 /opt/dragonwell8
+
+ENV JDK7_BOOT_DIR="/opt/dragonwell8"

pipelines/jobs/configurations/jdk11u.groovy

@@ -9,7 +9,8 @@ targetConfigurations = [
         "x64Linux"    : [
                 "hotspot",
                 "openj9",
-                "corretto"
+                "corretto",
+                "dragonwell"
         ],
         "x64Windows"  : [
                 "hotspot",

pipelines/jobs/configurations/jdk11u_pipeline_config.groovy

@@ -35,7 +35,8 @@ class Config11 {
                         "openj9"      : '--enable-jitserver --enable-dtrace=auto',
                         "hotspot"     : '--enable-dtrace=auto',
                         "corretto"    : '--enable-dtrace=auto',
-                        "SapMachine"  : '--enable-dtrace=auto'
+                        "SapMachine"  : '--enable-dtrace=auto',
+                        "dragonwell"  : '--enable-dtrace=auto --enable-unlimited-crypto  --with-jvm-variants=server --with-zlib=system --with-jvm-features=zgc'
                 ]
         ],
 

pipelines/jobs/configurations/jdk8u.groovy

@@ -6,7 +6,8 @@ targetConfigurations = [
         "x64Linux"      : [
                 "hotspot",
                 "openj9",
-                "corretto"
+                "corretto",
+                "dragonwell"
         ],
         "x32Windows"    : [
                 "hotspot",

pipelines/jobs/configurations/jdk8u_pipeline_config.groovy

@@ -25,11 +25,13 @@ class Config8 {
                 arch                : 'x64',
                 dockerImage         : 'adoptopenjdk/centos6_build_image',
                 dockerFile: [
-                        openj9  : 'pipelines/build/dockerFiles/cuda.dockerfile'
+                        openj9  : 'pipelines/build/dockerFiles/cuda.dockerfile',
+                        dragonwell: 'pipelines/build/dockerFiles/dragonwell.dockerfile'
                 ],
                 test                : ['sanity.openjdk', 'sanity.system', 'extended.system', 'sanity.perf', 'sanity.external', 'special.functional', 'special.openjdk'],
                 configureArgs       : [
-                        "openj9"      : '--enable-jitserver'
+                        "openj9"      : '--enable-jitserver',
+                        "dragonwell"  : '--enable-jfr --enable-unlimited-crypto --with-jvm-variants=server  --with-zlib=system',
                 ]
         ],
 

sbin/build.sh

@@ -150,7 +150,9 @@ getOpenJdkVersion() {
     fi
   else
     version=${BUILD_CONFIG[TAG]:-$(getFirstTagFromOpenJDKGitRepo)}
-
+    if [ "${BUILD_CONFIG[BUILD_VARIANT]}" == "${BUILD_VARIANT_DRAGONWELL}" ]; then
+      version=$(echo $version | cut -d'_' -f 2)
+    fi
     # TODO remove pending #1016
     version=${version%_adopt}
     version=${version#aarch64-shenandoah-}
@@ -361,6 +363,11 @@ configureCommandParameters()
   echo "Configuring jvm variants if provided"
   addConfigureArgIfValueIsNotEmpty "--with-jvm-variants=" "${BUILD_CONFIG[JVM_VARIANT]}"
 
+  if [ "${BUILD_CONFIG[CUSTOM_CACERTS]}" != "false" ] ; then
+    echo "Configure custom cacerts file security/cacerts"
+    addConfigureArgIfValueIsNotEmpty "--with-cacerts-file=" "$SCRIPT_DIR/../security/cacerts"
+  fi
+
   # Now we add any configure arguments the user has specified on the command line.
   CONFIGURE_ARGS="${CONFIGURE_ARGS} ${BUILD_CONFIG[USER_SUPPLIED_CONFIGURE_ARGS]}"
 

sbin/common/config_init.sh

@@ -47,6 +47,7 @@ CONTAINER_NAME
 COPY_MACOSX_FREE_FONT_LIB_FOR_JDK_FLAG
 COPY_MACOSX_FREE_FONT_LIB_FOR_JRE_FLAG
 COPY_TO_HOST
+CUSTOM_CACERTS
 DEBUG_DOCKER
 DEBUG_IMAGE_PATH
 DISABLE_ADOPT_BRANCH_SAFETY
@@ -207,6 +208,9 @@ function parseConfigurationArguments() {
         "--assemble-exploded-image" )
         BUILD_CONFIG[ASSEMBLE_EXPLODED_IMAGE]=true;;
 
+        "--custom-cacerts" )
+        BUILD_CONFIG[CUSTOM_CACERTS]="$1"; shift;;
+
         "--codesign-identity" )
         BUILD_CONFIG[MACOSX_CODESIGN_IDENTITY]="$1"; shift;;
 
@@ -250,7 +254,7 @@ function parseConfigurationArguments() {
         BUILD_CONFIG[FREETYPE]=false;;
 
         "--help" | "-h" )
-        man ./makejdk-any-platform.1;;
+        man ./makejdk-any-platform.1 && exit 0;;
 
         "--ignore-container" | "-i" )
         BUILD_CONFIG[REUSE_CONTAINER]=false;;
@@ -328,6 +332,8 @@ function setBranch() {
   local branch="dev"
   if [ "${BUILD_CONFIG[BUILD_VARIANT]}" == "${BUILD_VARIANT_OPENJ9}" ]; then
     branch="openj9";
+  elif [ "${BUILD_CONFIG[BUILD_VARIANT]}" == "${BUILD_VARIANT_DRAGONWELL}" ]; then
+    branch="master";
   elif [ "${BUILD_CONFIG[BUILD_VARIANT]}" == "${BUILD_VARIANT_CORRETTO}" ]; then
     branch="develop";
   fi
@@ -467,6 +473,9 @@ function configDefaults() {
   BUILD_CONFIG[USER_SUPPLIED_CONFIGURE_ARGS]=${BUILD_CONFIG[USER_SUPPLIED_CONFIGURE_ARGS]:-""}
   BUILD_CONFIG[USER_SUPPLIED_MAKE_ARGS]=${BUILD_CONFIG[USER_SUPPLIED_MAKE_ARGS]:-""}
 
+  # Whether to use AdoptOpenJDK's cacerts file (true) or use the file provided by OpenJDK (false)
+  BUILD_CONFIG[CUSTOM_CACERTS]=${BUILD_CONFIG[CUSTOM_CACERTS]:-"true"}
+
   BUILD_CONFIG[DOCKER]=${BUILD_CONFIG[DOCKER]:-"docker"}
 
   BUILD_CONFIG[TMP_SPACE_BUILD]=${BUILD_CONFIG[TMP_SPACE_BUILD]:-false}

sbin/common/constants.sh

@@ -39,6 +39,7 @@ export BUILD_VARIANT_HOTSPOT="hotspot"
 export BUILD_VARIANT_OPENJ9="openj9"
 export BUILD_VARIANT_CORRETTO="corretto"
 export BUILD_VARIANT_SAP="SapMachine"
+export BUILD_VARIANT_DRAGONWELL="dragonwell"
 
 export GIT_TAGS_TO_SEARCH=100
 

sbin/prepareWorkspace.sh

@@ -53,7 +53,11 @@ checkoutAndCloneOpenJDKGitRepo() {
     # eg. origin https://github.com/adoptopenjdk/openjdk-jdk11u (fetch)
     # eg. origin https://github.com/adoptopenjdk/openjdk-jdk (fetch)
     # eg. origin git@github.com:adoptopenjdk/openjdk-jdk.git (fetch)
-    git --git-dir "${BUILD_CONFIG[OPENJDK_SOURCE_DIR]}/.git" remote -v | grep "origin.*fetch" | grep "${BUILD_CONFIG[OPENJDK_CORE_VERSION]}" | grep "${BUILD_CONFIG[REPOSITORY]}.git\|${BUILD_CONFIG[REPOSITORY]}\s"
+    if [ "${BUILD_CONFIG[BUILD_VARIANT]}" == "${BUILD_VARIANT_DRAGONWELL}" ]; then
+      git --git-dir "${BUILD_CONFIG[OPENJDK_SOURCE_DIR]}/.git" remote -v | grep "origin.*fetch"
+    else
+      git --git-dir "${BUILD_CONFIG[OPENJDK_SOURCE_DIR]}/.git" remote -v | grep "origin.*fetch" | grep "${BUILD_CONFIG[OPENJDK_CORE_VERSION]}" | grep "${BUILD_CONFIG[REPOSITORY]}.git\|${BUILD_CONFIG[REPOSITORY]}\s"
+    fi
     local isValidGitRepo=$?
     set -e
 
@@ -102,6 +106,7 @@ checkoutAndCloneOpenJDKGitRepo() {
   git clean -ffdx
 
   updateOpenj9Sources
+  updateDragonwellSources
 
   createSourceTagFile
 
@@ -256,6 +261,14 @@ updateOpenj9Sources() {
   fi
 }
 
+updateDragonwellSources() {
+  if [[ "${BUILD_CONFIG[BUILD_VARIANT]}" == "${BUILD_VARIANT_DRAGONWELL}" ]] && [[ "${BUILD_CONFIG[OPENJDK_CORE_VERSION]}" == "${JDK8_CORE_VERSION}" ]]; then
+    cd "${BUILD_CONFIG[WORKSPACE_DIR]}/${BUILD_CONFIG[WORKING_DIR]}/${BUILD_CONFIG[OPENJDK_SOURCE_DIR]}" || return
+    bash get_source_dragonwell.sh --site github
+    cd "${BUILD_CONFIG[WORKSPACE_DIR]}"
+  fi
+}
+
 # Clone the git repo
 cloneOpenJDKGitRepo() {
   setGitCloneArguments
@@ -492,44 +505,15 @@ checkingAndDownloadingFreeType() {
   fi
 }
 
-# Download our security certificates
-downloadCerts() {
-  local caLink="$1"
+# Generates cacerts file
+prepareCacerts() {
+    echo "Generating cacerts from Mozilla's bundle"
 
-  mkdir -p "security"
-  # Temporary fudge as curl on my windows boxes is exiting with RC=127
-  if [[ "$OSTYPE" == "cygwin" ]] || [[ "$OSTYPE" == "msys" ]]; then
-    wget -O "./security/cacerts" "${caLink}"
-  else
-    curl -L -o "./security/cacerts" "${caLink}"
-  fi
-}
-
-# Certificate Authority Certs (CA Certs)
-checkingAndDownloadCaCerts() {
-  cd "${BUILD_CONFIG[WORKSPACE_DIR]}/${BUILD_CONFIG[WORKING_DIR]}" || exit
-
-  echo "Retrieving cacerts file if needed"
-  # Ensure it's the latest we pull in
-  rm -rf "cacerts_area"
-  mkdir "cacerts_area" || exit
-  cd "cacerts_area" || exit
-
-  if [ "${BUILD_CONFIG[BUILD_VARIANT]}" == "${BUILD_VARIANT_CORRETTO}" ]; then
-    local caLink="https://github.com/corretto/corretto-8/blob/preview-release/cacerts?raw=true"
-    downloadCerts "$caLink"
-  elif [ "${BUILD_CONFIG[USE_JEP319_CERTS]}" != "true" ]; then
-    git init
-    git remote add origin -f "${BUILD_CONFIG[OPENJDK_BUILD_REPO_URI]}"
-    git config core.sparsecheckout true
-    echo "security/*" >>.git/info/sparse-checkout
-    git pull origin "${BUILD_CONFIG[OPENJDK_BUILD_REPO_BRANCH]}"
-  fi
-
-  cd "${BUILD_CONFIG[WORKSPACE_DIR]}/${BUILD_CONFIG[WORKING_DIR]}" || exit
+    cd "$SCRIPT_DIR/../security"
+    ./mk-cacerts.sh --keytool "${BUILD_CONFIG[JDK_BOOT_DIR]}/bin/keytool"
 }
 
-# Download all of the dependencies for OpenJDK (Alsa, FreeType, CACerts et al)
+# Download all of the dependencies for OpenJDK (Alsa, FreeType, etc.)
 downloadingRequiredDependencies() {
   if [[ "${BUILD_CONFIG[CLEAN_LIBS]}" == "true" ]]; then
     rm -rf "${BUILD_CONFIG[WORKSPACE_DIR]}/libs/freetype" || true
@@ -569,10 +553,6 @@ downloadingRequiredDependencies() {
   else
     echo "Skipping Freetype"
   fi
-
-  echo "Checking and download CaCerts dependency"
-  checkingAndDownloadCaCerts
-
 }
 
 function moveTmpToWorkspaceLocation() {
@@ -658,5 +638,6 @@ function configureWorkspace() {
     relocateToTmpIfNeeded
     checkoutAndCloneOpenJDKGitRepo
     applyPatches
+    prepareCacerts
   fi
 }

security/.gitignore

@@ -0,0 +1,3 @@
+ca-bundle.crt
+cacerts
+certs/