openjdk-8 (8u252-b09-1ubuntu1) focal; urgency=medium

  * Build without atk-wrapper on i386 in focal.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 16 Apr 2020 10:47:49 +0200

openjdk-8 (8u252-b09-1) unstable; urgency=medium

  * Update to OpenJDK 8u252-b09 (GA). Updated aarch32 to 8u252-b08 (no
    hotspot changes between b08 and b09).
  * Security fixes
    - JDK-8223898, CVE-2020-2754: Forward references to Nashorn
    - JDK-8223904, CVE-2020-2755: Improve Nashorn matching
    - JDK-8224541, CVE-2020-2756: Better mapping of serial ENUMs
    - JDK-8224549, CVE-2020-2757: Less Blocking Array Queues
    - JDK-8225603: Enhancement for big integers
    - JDK-8227542: Manifest improved jar headers
    - JDK-8231415, CVE-2020-2773: Better signatures in XML
    - JDK-8233250: Better X11 rendering
    - JDK-8233410: Better Build Scripting
    - JDK-8234027: Better JCEKS key support
    - JDK-8234408, CVE-2020-2781: Improve TLS session handling
    - JDK-8234825, CVE-2020-2800: Better Headings for HTTP Servers
    - JDK-8234841, CVE-2020-2803: Enhance buffering of byte buffers
    - JDK-8235274, CVE-2020-2805: Enhance typing of methods
    - JDK-8236201, CVE-2020-2830: Better Scanner conversions
    - JDK-8238960: linux-i586 builds are inconsistent as the newly build
      jdk is not able to reserve enough space for object heap
  * Other changes
    - JDK-8005819: Support cross-realm MSSFU
    - JDK-8022263: use same Clang warnings on BSD as on Linux
    - JDK-8038631: Create wrapper for awt.Robot with additional functionality
    - JDK-8047212: runtime/ParallelClassLoading/bootstrap/random/inner-complex
      assert(ObjectSynchronizer::verify_objmon_isinpool(inf)) failed: monitor
      is invalid
    - JDK-8055283: Expand ResourceHashtable with C_HEAP allocation, removal and
      some unit tests
    - JDK-8068184: Fix for JDK-8032832 caused a deadlock
    - JDK-8079693: Add support for ECDSA P-384 and P-521 curves to XML Signature
    - JDK-8132130: some docs cleanup
    - JDK-8135318: CMS wrong max_eden_size for check_gc_overhead_limit
    - JDK-8144445: Maximum size checking in Marlin ArrayCache utility methods
      is not optimal
    - JDK-8144446: Automate the Marlin crash test
    - JDK-8144526: Remove Marlin logging use of deleted internal API
    - JDK-8144630: Use PrivilegedAction to create Thread in Marlin RendererStats
    - JDK-8144654: Improve Marlin logging
    - JDK-8144718: Pisces / Marlin Strokers may generate invalid curves with
      huge coordinates and round joins
    - JDK-8166976: TestCipherPBECons has wrong @run line
    - JDK-8167409: Invalid value passed to critical JNI function
    - JDK-8181872: C1: possible overflow when strength reducing integer multiply
       by constant
    - JDK-8187078: -XX:+VerifyOops finds numerous problems when running JPRT
    - JDK-8191227: issues with unsafe handle resolution
    - JDK-8197441: Signature#initSign/initVerify for an invalid
      private/public key fails with ClassCastException for SunPKCS11 provider
    - JDK-8204152: SignedObject throws NullPointerException for null keys with
      an initialized Signature object
    - JDK-8215756: Memory leaks in the AWT on macOS
    - JDK-8216472: (se) Stack overflow during selection operation leads to crash
    - JDK-8219244: NMT: Change ThreadSafepointState's allocation type from
      mtInternal to mtThread
    - JDK-8219597: (bf) Heap buffer state changes could provoke unexpected
      exceptions
    - JDK-8225128: Add exception for expiring DocuSign root to VerifyCACerts
      test
    - JDK-8225130: Add exception for expiring Comodo roots to VerifyCACerts test
    - JDK-8229022: BufferedReader performance can be improved by using
      StringBuilder
    - JDK-8229345: Memory leak due to vtable stubs not being shared on SPARC
    - JDK-8229872: (fs) Increase buffer size used with getmntent
    - JDK-8230235: Rendering HTML with empty img attribute and documentBaseKey
      cause Exception
    - JDK-8231430: C2: Memory stomp in max_array_length() for T_ILLEGAL type
    - JDK-8235744: PIT:
      test/jdk/javax/swing/text/html/TestJLabelWithHTMLText.java times out in
      linux-x64
    - JDK-8235904: Infinite loop when rendering huge lines
    - JDK-8236179: C1 register allocation error with T_ADDRESS
    - JDK-8237368: Problem with NullPointerException in RMI TCPEndpoint.read
    - JDK-8240521: Revert backport of 8231584: Deadlock with
      ClassLoader.findLibrary and System.loadLibrary call
    - JDK-8241296: Segfault in JNIHandleBlock::oops_do()
    - JDK-8241307: Marlin renderer should not be the default in 8u252
  * Build using GCC 9 in unstable. Closes: #944184.

 -- Matthias Klose <doko@ubuntu.com>  Wed, 15 Apr 2020 15:38:21 +0200

openjdk-8 (8u252-b07-1) unstable; urgency=medium

  * Update to 8u252-b07 (early access build).
  * Update ARM32 and AArch64 hotspot to 8u252-b06.
  * Build using GCC 9 in recent releases.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 26 Mar 2020 12:57:56 +0100

openjdk-8 (8u242-b08-1) unstable; urgency=medium

  * Merge changes from 8u242-b08-0ubuntu3 back into Debian
  * Fix nocheck profile (no profile support) for wheezy
  * Version !nocheck default-jre-headless build dependency
    to ensure at least Java 8 there as well; avoids needing to
    install two JREs when building in pre-{stretch,xenial}
  * Update aarch64 to GA jdk8u242-b08, aarch32 to jdk8u242-ga
  * Bump Policy

 -- Thorsten Glaser <tg@mirbsd.de>  Thu, 06 Feb 2020 19:12:24 +0100

openjdk-8 (8u242-b08-0ubuntu3) focal; urgency=medium

  * OpenJDK 8u242-b08 build (release).
    - S8226352, CVE-2020-2590: Improve Kerberos interop capabilities
    - S8228548, CVE-2020-2593: Normalize normalization for all
    - S8224909, CVE-2020-2583: Unlink Set of LinkedHashSets
    - S8229951, CVE-2020-2601: Better Ticket Granting Services
    - S8231422, CVE-2020-2604: Better serial filter handling
    - S8231795, CVE-2020-2659: Enhance datagram socket support
    - S8234037, CVE-2020-2654: Improve Object Identifier Processing
    - S8037550: Update RFC references in javadoc to RFC 5280
    - S8039438: Some tests depend on internal API sun.misc.IOUtils
    - S8044500: Add kinit options and krb5.conf flags that allow users
      to obtain renewable tickets and specify ticket lifetimes
    - S8058290: JAAS Krb5LoginModule has suspect ticket-renewal logic,
      relies on clockskew grace
    - S8080835: Add blocking bulk read to sun.misc.IOUtils
    - S8138978: Examine usages of sun.misc.IOUtils
    - S8139206: Add InputStream readNBytes(int len)
    - S8183591: Incorrect behavior when reading DER value with
      Integer.MAX_VALUE length
    - S8186576: KerberosTicket does not properly handle renewable
      tickets at the end of their lifetime
    - S8186831: Kerberos ignores PA-DATA with a non-null s2kparams
    - S8186884: Test native KDC, Java krb5 lib, and native krb5 lib in
      one test
    - S8193832: Performance of InputStream.readAllBytes() could be improved
    - S8196956: (ch) More channels cleanup
    - S8201627: Kerberos sequence number issues
    - S8215032: Support Kerberos cross-realm referrals (RFC 6806)
    - S8225261: Better method resolutions
    - S8225279: Better XRender interpolation
    - S8226719: Kerberos login to Windows 2000 failed with "Inappropriate
      type of checksum in message"
    - S8227061: KDC.java test behaves incorrectly when AS-REQ contains a
      PAData not PA-ENC-TS-ENC
    - S8227381: GSS login fails with PREAUTH_FAILED
    - S8227437: S4U2proxy cannot continue because server's TGT cannot be found
    - S8227758: More valid PKIX processing
    - S8227816: More Colorful ICC profiles
    - S8230279: Improve Pack200 file reading
    - S8230318: Better trust store usage
    - S8230967: Improve Registry support of clients
    - S8231129: More glyph images
    - S8231139: Improved keystore support
    - S8232381: add result NULL-checking to freetypeScaler.c
    - S8232419: Improve Registry registration
    - S8233944: Make KerberosPrincipal.KRB_NT_ENTERPRISE field package private
    - S8235909: File.exists throws AccessControlException for invalid
      paths when a SecurityManager is installed
    - S8236983: [TESTBUG] Remove pointless catch block in
      test/jdk/sun/security/util/DerValue/BadValue.java
    - S8236984: Add compatibility wrapper for IOUtils.readFully
  * Use the hotspot arch list to select between hotspot and zero as
    the default VM for autopkgtests. This fixes s390x (zero based)
    autopkgtest support.

 -- Tiago Stürmer Daitx <tiago.daitx@ubuntu.com>  Fri, 17 Jan 2020 17:37:33 +0000

openjdk-8 (8u242-b04-1) unstable; urgency=medium

  * Update to 8u242-b04 (early access build).

 -- Matthias Klose <doko@ubuntu.com>  Mon, 06 Jan 2020 20:59:40 +0100

openjdk-8 (8u232-b09-1) unstable; urgency=high

  * Update to OpenJDK 8u232-b09 (GA). Updated aarch32 to 8u232-b09.
  * Security fixes:
    - S8167646: Better invalid FilePermission.
    - S8213429, CVE-2019-2933: Windows file handling redux.
    - S8218573, CVE-2019-2945: Better socket support.
    - S8218877: Help transform transformers.
    - S8220186: Improve use of font temporary files.
    - S8220302, CVE-2019-2949: Better Kerberos ccache handling.
    - S8221497: Optional Panes in Swing.
    - S8221858, CVE-2019-2958: Build Better Processes.
    - S8222684, CVE-2019-2964: Better support for patterns.
    - S8222690, CVE-2019-2962: Better Glyph Images.
    - S8223163: Better pattern recognition.
    - S8223505, CVE-2019-2973: Better pattern compilation.
    - S8223518, CVE-2019-2975: Unexpected exception in jjs.
    - S8223892, CVE-2019-2978: Improved handling of jar files.
    - S8224025: Fix for JDK-8220302 is not complete.
    - S8224532, CVE-2019-2981: Better Path supports.
    - S8224915, CVE-2019-2983: Better serial attributes.
    - S8225286, CVE-2019-2987: Better rendering of native glyphs.
    - S8225292, CVE-2019-2988: Better Graphics2D drawing.
    - S8225298, CVE-2019-2989: Improve TLS connection support.
    - S8225597, CVE-2019-2992: Enhance font glyph mapping.
    - S8226765, CVE-2019-2999: Commentary on Javadoc comments.
    - S8227129: Better ligature for subtables.
    - S8227601: Better collection of references.
    - S8228825, CVE-2019-2894: Enhance ECDSA operations.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 17 Oct 2019 22:41:19 +0200

openjdk-8 (8u232-b07-2) unstable; urgency=medium

  * Update to 8u232-b07 (early access build).

  [ Matthias Klose ]
  * Refresh patches.
  * openjdk-8-jdk-headless: Add Breaks/Replaces for moved clhsdb binary.
    LP: #1845873.
  * debian/tests/control: Depend on g++ instead of build-essential or libc6-dev.
  * Bump standards vesion.

  [ Tiago Stürmer Daitx ]
  * Improve and fix build tests and autopkgtests:
    - Update debian/tests/hotspot,jdk,langtools to ignore
      jtreg-autopkgtest.sh return code.
    - Create debian/tests/jtdiff-autopkgtest.in as it depends
      on debian/rules variables.
    - debian/control.in, debian/control: add default-jre-headless
      to Build-Depends with a nocheck clause as jtreg requires
      a JRE in /usr/lib/jvm/default-java.
    - debian/tests/control:
      + Add zip and unzip test dependencies required by jdk's
        test/sun/security/tools/jarsigner/diffend.sh and
        test/sun/security/tools/jarsigner/emptymanifest.sh.
      + Depend on default-jre-headless so jtreg will use the
        JRE from /usr/lib/jvm/default-java.
    - debian/tests/jtdiff-autopkgtest.sh:
      + Fail only if an actual regression is detected.
      + Add the super-diff comparison from jtdiff.
      + Save failed jtr files for all runs.
    - debian/tests/jtreg-autopkgtest.sh:
      + Enable retry of failed tests to trim out flaky tests.
      + Fix unbound variable.
      + Keep .jtr files from failed tests only.
    - debian/patches/jdk-problem-list.diff: ignore failing tests
      that require more investigation.
    - debian/rules:
      + Preserve all JTreport directories in the test output
        directory.
      + Use JDK_DIR instead of JDK_TO_TEST for autopkgtest
        generation.
      + Package all .jtr files from JTwork as jtreg-autopkgtest.sh
        makes sure it contains only failed tests.
  * debian/tests/jdk: add our custom debian/tests/jdk-problem-list.txt to the
    exclusion list.
  * debian/tests/jdk-problem-list.txt: custom exclusion rules for jdk tests
    that fail to run during a build or autopkgtest run.
  * debian/rules: remove debian/patches/jdk-problem-list.diff.
  * debian/patches/jdk-problem-list.diff: jtreg allows for extra exclusion
    files thus there's no need to patch upstream's exclusion list.
  * debian/tests/control: mark all autopkgtests as flaky.
  * debian/tests/hotspot-archs: generated by debian/rules, contains a list of
    archs that supports a hotspot vm.
  * debian/tests/jdk: run only when the host arch is a hotspot vm - allow
    override through an environment variable.
  * debian/rules: update gen-autopkgtests to echo supported hotspot archs.

 -- Matthias Klose <doko@ubuntu.com>  Tue, 01 Oct 2019 13:49:35 +0200

openjdk-8 (8u232-b04-1) experimental; urgency=medium

  * Update to 8u232-b04 (early access build).
  * Refresh patches.

 -- Matthias Klose <doko@ubuntu.com>  Fri, 06 Sep 2019 18:03:11 +0200

openjdk-8 (8u222-b10-1) unstable; urgency=high

  * Update to 8u222-b10 (except for AArch32, updated to b08).
    - Security fixes:
      - S8191073: JpegImageReader throws IndexOutOfBoundsException when
        trying to read image data from tables-only image.
      - S8208698, CVE-2019-2745: Improved ECC Implementation.
      - S8212328, CVE-2019-2762: Exceptional throw cases.
      - S8213431, CVE-2019-2766: Improve file protocol handling.
      - S8213432, CVE-2019-2769: Better copies of CopiesList.
      - S8216381, CVE-2019-2786: More limited privilege usage.
      - S8217563: Improve realm maintenance.
      - S8218863: Better endpoint checks.
      - S8218873: Improve JSSE endpoint checking.
      - S8218876, CVE-2019-7317: Improve PNG support options.
      - S8219018: Adjust positions of glyphs.
      - S8219020: Table alternate substitutions.
      - S8219775: Certificate validation improvements.
      - S8220192: Better outlook for SecureRandom.
      - S8220517: Enhanced GIF support.
      - S8221518, CVE-2019-2816: Normalize normalization.
      - S8223511, CVE-2019-2842: Extended AES support.

  [ Matthias Klose ]
  * Bump standards version.

  [ Tiago Stürmer Daitx ]
  * Backport fix for S8223511 for AArch32.

 -- Matthias Klose <doko@ubuntu.com>  Thu, 18 Jul 2019 18:57:23 +0200

# For older changelog entries, run 'apt-get changelog openjdk-8-doc'
