upgrade openjdk8 to fix CVE-2022-21282 CVE-2022-21293 CVE-2022-21294 CVE-2022-21296 CVE-2022-21299 CVE-2022-21305 CVE-2022-21340 CVE-2022-21341 CVE-2022-21360 CVE-2022-21365 (#2420)

* upgrade openjdk8 to fix CVE-2022-21282 CVE-2022-21293 CVE-2022-21294 CVE-2022-21296 CVE-2022-21299 CVE-2022-21305 CVE-2022-21340 CVE-2022-21341 CVE-2022-21360  CVE-2022-21365

* re-add aarch64 spec

* re-add aarch64 spec

* use 1 spec for ARM and AMD

Co-authored-by: nicolas guibourge <[email protected]>

Author: nicogbg

SPECS/LICENSES-AND-NOTICES/LICENSES-MAP.md

@@ -615,7 +615,6 @@
         "oniguruma",
         "OpenIPMI",
         "openjdk8",
-        "openjdk8_aarch64",
         "openldap",
         "openscap",
         "openssh",

SPECS/LICENSES-AND-NOTICES/data/licenses.json

@@ -1,7 +1,7 @@
-diff --git openjdk.orig/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java openjdk/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java
---- openjdk.orig/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java
-+++ openjdk/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java
-@@ -72,7 +72,7 @@
+diff -ru jdk8u-jdk8u332-b02-orig/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java jdk8u-jdk8u332-b02/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java
+--- jdk8u-jdk8u332-b02-orig/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java	2022-02-05 08:34:22.000000000 -0800
++++ jdk8u-jdk8u332-b02/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java	2022-03-01 10:57:41.837189086 -0800
+@@ -68,7 +68,7 @@
       * The preference of the default trusted KeyStore is:
       *    javax.net.ssl.trustStore
       *    jssecacerts
@@ -10,7 +10,7 @@ diff --git openjdk.orig/jdk/src/share/classes/sun/security/ssl/TrustStoreManager
       */
      private static final class TrustStoreDescriptor {
          private static final String fileSep = File.separator;
-@@ -83,6 +83,10 @@
+@@ -79,6 +79,10 @@
                  defaultStorePath + fileSep + "cacerts";
          private static final String jsseDefaultStore =
                  defaultStorePath + fileSep + "jssecacerts";
@@ -21,33 +21,31 @@ diff --git openjdk.orig/jdk/src/share/classes/sun/security/ssl/TrustStoreManager
 
          // the trust store name
          private final String storeName;
-@@ -146,7 +150,8 @@
+@@ -144,7 +148,8 @@
                      long temporaryTime = 0L;
                      if (!"NONE".equals(storePropName)) {
                          String[] fileNames =
 -                                new String[] {storePropName, defaultStore};
-+                                new String[] {storePropName,
++                                new String[] {storePropName, 
 +                                              systemStore, defaultStore};
                          for (String fileName : fileNames) {
                              File f = new File(fileName);
                              if (f.isFile() && f.canRead()) {
-diff --git openjdk.orig/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java openjdk/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java
---- openjdk.orig/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java
-+++ openjdk/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java
-@@ -108,9 +108,14 @@
+diff -ru jdk8u-jdk8u332-b02-orig/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java jdk8u-jdk8u332-b02/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java
+--- jdk8u-jdk8u332-b02-orig/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java	2022-02-05 08:34:22.000000000 -0800
++++ jdk8u-jdk8u332-b02/jdk/src/share/classes/sun/security/tools/KeyStoreUtil.java	2022-03-01 11:01:37.427001700 -0800
+@@ -103,9 +103,14 @@
          throws Exception
      {
          String sep = File.separator;
 -        File file = new File(System.getProperty("java.home") + sep
--                             + "lib" + sep + "security" + sep
--                             + "cacerts");
 +        /* Check system cacerts DB first; /etc/pki/java/cacerts */
 +        File file = new File(sep + "etc" + sep + "pki" + sep
 +                             + "java" + sep + "cacerts");
 +        if (!file.exists()) {
 +            file = new File(System.getProperty("java.home") + sep
-+                            + "lib" + sep + "security" + sep
-+                            + "cacerts");
+                              + "lib" + sep + "security" + sep
+                              + "cacerts");
 +        }
          if (!file.exists()) {
              return null;

SPECS/openjdk8/check-system-ca-certs-292.patch SPECS/openjdk8/check-system-ca-certs-332.patch

@@ -1,5 +1,5 @@
 {
-    "Signatures": {
-        "openjdk-1.8.0.292.tar.gz": "427d7a1d64dcaaab442137752e2f7ddcfad507beabeb277cd1d660eb27fb876f"
-    }
+ "Signatures": {
+  "openjdk-1.8.0.332.tar.gz": "1acb39a0250a1f94eb8ccf2e4357c5681d8e5208e8e870c16042c87077db9902"
+ }
 }

SPECS/openjdk8/generate_source_tarball.sh

@@ -1,21 +1,30 @@
 %define _use_internal_dependency_generator 0
 %global security_hardening none
-%define _jdk_update 292
-%define _jdk_build 10
-Summary:        OpenJDK
+%define _jdk_update 332
+%define _jdk_build 02
+%define _jdk_version 1.8.0
+
+%ifarch x86_64
+%define arch_name amd64
+%define bootstrapjdk %{_libdir}/jvm/OpenJDK-212-b04-bootstrap
+%endif
+%ifarch aarch64
+%define arch_name aarch64
+%define bootstrapjdk %{_libdir}/jvm/OpenJDK-1.8.0.181-bootstrap
+%endif
+
 Name:           openjdk8
-Version:        1.8.0.292
-Release:        2%{?dist}
+Summary:        OpenJDK
+Version:        %{_jdk_version}.%{_jdk_update}
+Release:        1%{?dist}
 License:        ASL 1.1 AND ASL 2.0 AND BSD AND BSD WITH advertising AND GPL+ AND GPLv2 AND GPLv2 WITH exceptions AND IJG AND LGPLv2+ AND MIT AND MPLv2.0 AND Public Domain AND W3C AND zlib
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
 Group:          Development/Tools
 URL:            https://openjdk.java.net
-# Source tarball is generated by AdoptOpenJDK from OpenJDK sources
-#Source0:       https://github.com/AdoptOpenJDK/openjdk-jdk8u/archive/jdk8u292-b10.tar.gz
-Source0:        openjdk-%{version}.tar.gz
+Source0:        https://github.com/adoptium/jdk8u/archive/jdk8u%{_jdk_update}-b%{_jdk_build}.tar.gz#/openjdk-%{version}.tar.gz
 Patch0:         Awt_build_headless_only.patch
-Patch1:         check-system-ca-certs-292.patch
+Patch1:         check-system-ca-certs-332.patch
 BuildRequires:  alsa-lib
 BuildRequires:  alsa-lib-devel
 BuildRequires:  chkconfig
@@ -25,13 +34,16 @@ BuildRequires:  glib-devel
 BuildRequires:  pcre-devel
 BuildRequires:  unzip
 BuildRequires:  which
+BuildRequires:  zip
 BuildRequires:  zlib-devel
 Requires:       chkconfig
 Requires:       openjre8 = %{version}-%{release}
 AutoReqProv:    no
 Obsoletes:      openjdk <= %{version}
 Provides:       java-devel = %{version}-%{release}
-ExclusiveArch:  x86_64
+Provides:       java-%{_jdk_version}-openjdk = %{version}-%{release}
+Provides:       java-%{_jdk_version}-openjdk-headless = %{version}-%{release}
+Provides:       java-%{_jdk_version}-openjdk-devel = %{version}-%{release}
 
 %description
 The OpenJDK package installs java class library and javac java compiler.
@@ -42,6 +54,8 @@ Requires:       chkconfig
 Requires:       libstdc++
 AutoReqProv:    no
 Obsoletes:      openjre <= %{version}
+Provides:       java = %{version}-%{release}
+Provides:       java-headless = %{version}-%{release}
 
 %description	-n openjre8
 It contains the libraries files for Java runtime environment
@@ -74,7 +88,7 @@ Obsoletes:      openjdk-src <= %{version}
 This package provides the runtime library class sources.
 
 %prep -p exit
-%setup -qn openjdk-jdk8u-jdk8u%{_jdk_update}-b%{_jdk_build}
+%setup -qn jdk8u-jdk8u%{_jdk_update}-b%{_jdk_build}
 %patch0 -p1
 %patch1 -p1
 rm jdk/src/solaris/native/sun/awt/CUPSfuncs.c
@@ -90,9 +104,9 @@ export CXXFLAGS=$(echo $CXXFLAGS | sed "s/-Wall//" | sed "s/-Wformat// | sed "s/
 unset JAVA_HOME &&
 ./configur* \
 	--with-target-bits=64 \
-	--with-boot-jdk=%{_libdir}/jvm/OpenJDK-212-b04-bootstrap \
+	--with-boot-jdk=%{bootstrapjdk} \
 	--disable-headful \
-	--with-cacerts-file=%{_libdir}/jvm/OpenJDK-212-b04-bootstrap/jre/lib/security/cacerts \
+	--with-cacerts-file=%{bootstrapjdk}/jre/lib/security/cacerts \
 	--with-extra-cxxflags="-Wno-error -std=gnu++98 -fno-delete-null-pointer-checks -fno-lifetime-dse" \
 	--with-extra-cflags="-std=gnu++98 -fno-delete-null-pointer-checks -Wno-error -fno-lifetime-dse" \
 	--with-freetype-include=%{_includedir}/freetype2 \
@@ -108,7 +122,7 @@ make \
     JAVAC_FLAGS=-g \
     STRIP_POLICY=no_strip \
     DISABLE_HOTSPOT_OS_VERSION_CHECK=ok \
-    CLASSPATH=%{_libdir}/jvm/OpenJDK-212-b04-bootstrap/jre \
+    CLASSPATH=%{bootstrapjdk}/jre \
     POST_STRIP_CMD="" \
     LOG=trace \
     SCTP_WERROR=
@@ -118,13 +132,13 @@ make DESTDIR=%{buildroot} install \
 	BUILD_HEADLESS_ONLY=yes \
 	OPENJDK_TARGET_OS=linux \
 	DISABLE_HOTSPOT_OS_VERSION_CHECK=ok \
-	CLASSPATH=%{_libdir}/jvm/OpenJDK-212-b04-bootstrap/jre
+	CLASSPATH=%{bootstrapjdk}/jre
 
 install -vdm755 %{buildroot}%{_libdir}/jvm/OpenJDK-%{version}
 chown -R root:root %{buildroot}%{_libdir}/jvm/OpenJDK-%{version}
 install -vdm755 %{buildroot}%{_bindir}
-find %{_prefix}/local/jvm/openjdk-1.8.0-internal/jre/lib/amd64 -iname \*.diz -delete
-mv %{_prefix}/local/jvm/openjdk-1.8.0-internal/* %{buildroot}%{_libdir}/jvm/OpenJDK-%{version}/
+find %{_prefix}/local/jvm/openjdk-%{_jdk_version}-internal/jre/lib/%{arch_name} -iname \*.diz -delete
+mv %{_prefix}/local/jvm/openjdk-%{_jdk_version}-internal/* %{buildroot}%{_libdir}/jvm/OpenJDK-%{version}/
 
 %post
 alternatives --install %{_bindir}/javac javac %{_libdir}/jvm/OpenJDK-%{version}/bin/javac 2000 \
@@ -189,8 +203,9 @@ rm -rf %{buildroot}/*
 
 %files
 %defattr(-,root,root)
-%license %{_libdir}/jvm/OpenJDK-%{version}/LICENSE
+%license LICENSE
 %{_libdir}/jvm/OpenJDK-%{version}/ASSEMBLY_EXCEPTION
+%{_libdir}/jvm/OpenJDK-%{version}/LICENSE
 %{_libdir}/jvm/OpenJDK-%{version}/release
 %{_libdir}/jvm/OpenJDK-%{version}/THIRD_PARTY_README
 %{_libdir}/jvm/OpenJDK-%{version}/lib
@@ -243,8 +258,8 @@ rm -rf %{buildroot}/*
 %{_libdir}/jvm/OpenJDK-%{version}/bin/servertool
 %{_libdir}/jvm/OpenJDK-%{version}/bin/tnameserv
 %{_libdir}/jvm/OpenJDK-%{version}/bin/unpack200
-%{_libdir}/jvm/OpenJDK-%{version}/lib/amd64/jli/
-%exclude %{_libdir}/jvm/OpenJDK-%{version}/lib/amd64/*.diz
+%{_libdir}/jvm/OpenJDK-%{version}/lib/%{arch_name}/jli/
+%exclude %{_libdir}/jvm/OpenJDK-%{version}/lib/%{arch_name}/*.diz
 
 %files sample
 %defattr(-,root,root)
@@ -260,8 +275,16 @@ rm -rf %{buildroot}/*
 %{_libdir}/jvm/OpenJDK-%{version}/src.zip
 
 %changelog
-* Mon Aug 30 2021 Bala <[email protected]> - 1.8.0.292-2
-- Provide java-devel
+*   Mon Feb 28 2022 Nicolas Guibourge <[email protected]> - 1.8.0.332-1
+-   Update to 1.8.0.332 to address the below CVEs:
+-   CVE-2022-21248 CVE-2022-21282 CVE-2022-21283 CVE-2022-21293
+-   CVE-2022-21294 CVE-2022-21296 CVE-2022-21299 CVE-2022-21305
+-   CVE-2022-21340 CVE-2022-21341 CVE-2022-21349 CVE-2022-21360
+-   CVE-2022-21365
+-   use 1 spec to build amd64 and arm64 flavor of Openjdk8
+
+*   Mon Aug 30 2021 Bala <[email protected]> - 1.8.0.292-2
+-   Provide java-devel
 
 *   Fri Apr 16 2021 Nick Samson <[email protected]> - 1.8.0.292-1
 -   Update to 8u292 to address CVEs