Merge pull request #39 from alibaba/wip_dragonwell_standard_squash_br…

…anch

Merge branch 'standard' into wip_dragonwell_standard_merge_branch

.github/actions/config/action.yml

@@ -42,5 +42,5 @@ runs:
       run: |
         # Extract value from configuration file
         value="$(grep -h ${{ inputs.var }}= make/conf/github-actions.conf | cut -d '=' -f 2-)"
-        echo "::set-output name=value::$value"
+        echo "value=$value" >> $GITHUB_OUTPUT
       shell: bash

.github/actions/do-build/action.yml

@@ -61,7 +61,7 @@ runs:
               $build_dir/make-support/failure-summary.log \
               $build_dir/make-support/failure-logs/* \
               failure-logs/ 2> /dev/null || true
-          echo '::set-output name=failure::true'
+          echo 'failure=true' >> $GITHUB_OUTPUT
         fi
       shell: bash
 

.github/actions/get-bootjdk/action.yml

@@ -42,7 +42,7 @@ runs:
       run: |
         # Convert platform name to upper case
         platform_prefix="$(echo ${{ inputs.platform }} | tr [a-z-] [A-Z_])"
-        echo "::set-output name=value::$platform_prefix"
+        echo "value=$platform_prefix" >> $GITHUB_OUTPUT
       shell: bash
 
     - name: 'Get URL configuration'
@@ -105,5 +105,5 @@ runs:
       id: path-name
       run: |
         # Export the path
-        echo '::set-output name=path::bootjdk/jdk'
+        echo 'path=bootjdk/jdk' >> $GITHUB_OUTPUT
       shell: bash

.github/actions/get-bundles/action.yml

@@ -103,7 +103,7 @@ runs:
           tests_dir="$(cygpath $tests_dir)"
         fi
 
-        echo "::set-output name=jdk::$jdk_dir"
-        echo "::set-output name=symbols::$symbols_dir"
-        echo "::set-output name=tests::$tests_dir"
+        echo "jdk=$jdk_dir" >> $GITHUB_OUTPUT
+        echo "symbols=$symbols_dir" >> $GITHUB_OUTPUT
+        echo "tests=$tests_dir" >> $GITHUB_OUTPUT
       shell: bash

.github/actions/get-gtest/action.yml

@@ -50,5 +50,5 @@ runs:
       id: path-name
       run: |
         # Export the path
-        echo '::set-output name=path::gtest'
+        echo 'path=gtest' >> $GITHUB_OUTPUT
       shell: bash

.github/actions/get-jtreg/action.yml

@@ -68,5 +68,5 @@ runs:
       id: path-name
       run: |
         # Export the path
-        echo '::set-output name=path::jtreg/installed'
+        echo 'path=jtreg/installed' >> $GITHUB_OUTPUT
       shell: bash

.github/actions/upload-bundles/action.yml

@@ -62,9 +62,9 @@ runs:
         fi
 
         if [[ "$jdk_bundle_zip$jdk_bundle_tar_gz$symbols_bundle$tests_bundle" != "" ]]; then
-          echo '::set-output name=bundles-found::true'
+          echo 'bundles-found=true' >> $GITHUB_OUTPUT
         else
-          echo '::set-output name=bundles-found::false'
+          echo 'bundles-found=false' >> $GITHUB_OUTPUT
         fi
       shell: bash
 

.github/scripts/gen-test-summary.sh

@@ -25,6 +25,7 @@
 #
 
 GITHUB_STEP_SUMMARY="$1"
+GITHUB_OUTPUT="$2"
 
 test_suite_name=$(cat build/run-test-prebuilt/test-support/test-last-ids.txt)
 results_dir=build/run-test-prebuilt/test-results/$test_suite_name/text
@@ -41,12 +42,12 @@ error_count=$(echo $errors | wc -w || true)
 
 if [[ "$failures" = "" && "$errors" = "" ]]; then
   # We know something went wrong, but not what
-  echo '::set-output name=error-message::Unspecified test suite failure. Please see log for job for details.'
+  echo 'error-message=Unspecified test suite failure. Please see log for job for details.' >> $GITHUB_OUTPUT
   exit 0
 fi
 
-echo '::set-output name=failure::true'
-echo "::set-output name=error-message::Test run reported $failure_count test failure(s) and $error_count error(s). See summary for details."
+echo 'failure=true' >> $GITHUB_OUTPUT
+echo "error-message=Test run reported $failure_count test failure(s) and $error_count error(s). See summary for details." >> $GITHUB_OUTPUT
 
 echo '### :boom: Test failures summary' >> $GITHUB_STEP_SUMMARY
 

.github/workflows/build-linux.yml

@@ -89,7 +89,7 @@ jobs:
         run: |
           # Set a proper suffix for packages if using a different architecture
           if [[ '${{ inputs.apt-architecture }}' != '' ]]; then
-            echo '::set-output name=suffix:::${{ inputs.apt-architecture }}'
+            echo 'suffix=:${{ inputs.apt-architecture }}' >> $GITHUB_OUTPUT
           fi
 
       # Upgrading apt to solve libc6 installation bugs, see JDK-8260460.

.github/workflows/main.yml

@@ -104,14 +104,14 @@ jobs:
             echo 'false'
           }
 
-          echo "::set-output name=linux-x64::$(check_platform linux-x64 linux x64)"
-          echo "::set-output name=linux-x86::$(check_platform linux-x86 linux x86)"
-          echo "::set-output name=linux-x64-variants::$(check_platform linux-x64-variants variants)"
-          echo "::set-output name=linux-cross-compile::$(check_platform linux-cross-compile cross-compile)"
-          echo "::set-output name=macos-x64::$(check_platform macos-x64 macos x64)"
-          echo "::set-output name=macos-aarch64::$(check_platform macos-aarch64 macos aarch64)"
-          echo "::set-output name=windows-x64::$(check_platform windows-x64 windows x64)"
-          echo "::set-output name=windows-aarch64::$(check_platform windows-aarch64 windows aarch64)"
+          echo "linux-x64=$(check_platform linux-x64 linux x64)" >> $GITHUB_OUTPUT
+          echo "linux-x86=$(check_platform linux-x86 linux x86)" >> $GITHUB_OUTPUT
+          echo "linux-x64-variants=$(check_platform linux-x64-variants variants)" >> $GITHUB_OUTPUT
+          echo "linux-cross-compile=$(check_platform linux-cross-compile cross-compile)" >> $GITHUB_OUTPUT
+          echo "macos-x64=$(check_platform macos-x64 macos x64)" >> $GITHUB_OUTPUT
+          echo "macos-aarch64=$(check_platform macos-aarch64 macos aarch64)" >> $GITHUB_OUTPUT
+          echo "windows-x64=$(check_platform windows-x64 windows x64)" >> $GITHUB_OUTPUT
+          echo "windows-aarch64=$(check_platform windows-aarch64 windows aarch64)" >> $GITHUB_OUTPUT
 
   ###
   ### Build jobs

.github/workflows/test.yml

@@ -138,9 +138,9 @@ jobs:
           # We need a minimal PATH on Windows
           # Set PATH to "", so just GITHUB_PATH is included
           if [[ '${{ runner.os }}' == 'Windows' ]]; then
-            echo "::set-output name=value::"
+            echo "value=" >> $GITHUB_OUTPUT
           else
-            echo "::set-output name=value::$PATH"
+            echo "value=$PATH" >> $GITHUB_OUTPUT
           fi
 
       - name: 'Run tests'
@@ -154,7 +154,7 @@ jobs:
           SYMBOLS_IMAGE_DIR=${{ steps.bundles.outputs.symbols-path }}
           TEST_IMAGE_DIR=${{ steps.bundles.outputs.tests-path }}
           JTREG='JAVA_OPTIONS=-XX:-CreateCoredumpOnCrash;VERBOSE=fail,error,time;KEYWORDS=!headful'
-          && bash ./.github/scripts/gen-test-summary.sh "$GITHUB_STEP_SUMMARY"
+          && bash ./.github/scripts/gen-test-summary.sh "$GITHUB_STEP_SUMMARY" "$GITHUB_OUTPUT"
         env:
           PATH: ${{ steps.path.outputs.value }}
 
@@ -187,7 +187,7 @@ jobs:
           fi
 
           artifact_name="results-${{ inputs.platform }}-$(echo ${{ matrix.test-name }} | tr '/ ' '__')"
-          echo "::set-output name=artifact-name::$artifact_name"
+          echo "artifact-name=$artifact_name" >> $GITHUB_OUTPUT
         if: always()
 
       - name: 'Upload test results'

.gitignore

@@ -16,3 +16,5 @@ NashornProfile.txt
 **/JTreport/**
 **/JTwork/**
 /src/utils/LogCompilation/target/
+/.project/
+/.settings/

.jcheck/conf

@@ -1,7 +1,7 @@
 [general]
 project=jdk-updates
 jbs=JDK
-version=17.0.5
+version=17.0.6
 
 [checks]
 error=author,committer,reviewers,merge,issues,executable,symlink,message,hg-tag,whitespace,problemlists

doc/building.html

@@ -70,6 +70,9 @@ <h1 class="title">Building the JDK</h1>
 <li><a href="#make-control-variables">Make Control Variables</a></li>
 </ul></li>
 <li><a href="#running-tests">Running Tests</a></li>
+<li><a href="#signing">Signing</a><ul>
+<li><a href="#macos-1">macOS</a></li>
+</ul></li>
 <li><a href="#cross-compiling">Cross-compiling</a><ul>
 <li><a href="#cross-compiling-the-easy-way-with-openjdk-devkits">Cross compiling the easy way with OpenJDK devkits</a></li>
 <li><a href="#boot-jdk-and-build-jdk">Boot JDK and Build JDK</a></li>
@@ -488,7 +491,7 @@ <h4 id="general-make-control-variables">General Make Control Variables</h4>
 <li><code>CONF</code> and <code>CONF_NAME</code> - Selecting the configuration(s) to use. See <a href="#using-multiple-configurations">Using Multiple Configurations</a></li>
 </ul>
 <h4 id="test-make-control-variables">Test Make Control Variables</h4>
-<p>These make control variables only make sense when running tests. Please see <a href="testing.html">Testing the JDK</a> for details.</p>
+<p>These make control variables only make sense when running tests. Please see <strong>Testing the JDK</strong> (<a href="testing.html">html</a>, <a href="testing.md">markdown</a>) for details.</p>
 <ul>
 <li><code>TEST</code></li>
 <li><code>TEST_JOBS</code></li>
@@ -514,7 +517,13 @@ <h2 id="running-tests">Running Tests</h2>
 </ul>
 <p>To execute the most basic tests (tier 1), use:</p>
 <pre><code>make run-test-tier1</code></pre>
-<p>For more details on how to run tests, please see the <a href="testing.html">Testing the JDK</a> document.</p>
+<p>For more details on how to run tests, please see <strong>Testing the JDK</strong> (<a href="testing.html">html</a>, <a href="testing.md">markdown</a>).</p>
+<h2 id="signing">Signing</h2>
+<h3 id="macos-1">macOS</h3>
+<p>Modern versions of macOS require applications to be signed and notarizied before distribution. See Apple's documentation for more background on what this means and how it works. To help support this, the JDK build can be configured to automatically sign all native binaries, and the JDK bundle, with all the options needed for successful notarization, as well as all the entitlements required by the JDK. To enable <code>hardened</code> signing, use configure parameter <code>--with-macosx-codesign=hardened</code> and configure the signing identity you wish to use with <code>--with-macosx-codesign-identity=&lt;identity&gt;</code>. The identity refers to a signing identity from Apple that needs to be preinstalled on the build host.</p>
+<p>When not signing for distribution with the hardened option, the JDK build will still attempt to perform <code>adhoc</code> signing to add the special entitlement <code>com.apple.security.get-task-allow</code> to each binary. This entitlement is required to be able to dump core files from a process. Note that adding this entitlement makes the build invalid for notarization, so it is only added when signing in <code>debug</code> mode. To explicitly enable this kind of adhoc signing, use configure parameter <code>--with-macosx-codesign=debug</code>. It will be enabled by default in most cases.</p>
+<p>It's also possible to completely disable any explicit codesign operations done by the JDK build using the configure parameter <code>--without-macosx-codesign</code>. The exact behavior then depends on the architecture. For macOS on x64, it (at least at the time of this writing) results in completely unsigned binaries that should still work fine for development and debugging purposes. On aarch64, the Xcode linker will apply a default &quot;adhoc&quot; signing, without any entitlements. Such a build does not allow dumping core files.</p>
+<p>The default mode &quot;auto&quot; will try for <code>hardened</code> signing if the debug level is <code>release</code> and either the default identity or the specified identity is valid. If hardened isn't possible, then <code>debug</code> signing is chosen if it works. If nothing works, the codesign build step is disabled.</p>
 <h2 id="cross-compiling">Cross-compiling</h2>
 <p>Cross-compiling means using one platform (the <em>build</em> platform) to generate output that can ran on another platform (the <em>target</em> platform).</p>
 <p>The typical reason for cross-compiling is that the build is performed on a more powerful desktop computer, but the resulting binaries will be able to run on a different, typically low-performing system. Most of the complications that arise when building for embedded is due to this separation of <em>build</em> and <em>target</em> systems.</p>

doc/building.md

@@ -818,7 +818,7 @@ configuration, as opposed to the "configure time" configuration.
 #### Test Make Control Variables
 
 These make control variables only make sense when running tests. Please see
-[Testing the JDK](testing.html) for details.
+**Testing the JDK** ([html](testing.html), [markdown](testing.md)) for details.
 
   * `TEST`
   * `TEST_JOBS`
@@ -865,8 +865,44 @@ To execute the most basic tests (tier 1), use:
 make run-test-tier1
 ```
 
-For more details on how to run tests, please see the [Testing
-the JDK](testing.html) document.
+For more details on how to run tests, please see **Testing the JDK**
+([html](testing.html), [markdown](testing.md)).
+
+## Signing
+
+### macOS
+
+Modern versions of macOS require applications to be signed and notarizied before
+distribution. See Apple's documentation for more background on what this means
+and how it works. To help support this, the JDK build can be configured to
+automatically sign all native binaries, and the JDK bundle, with all the options
+needed for successful notarization, as well as all the entitlements required by
+the JDK. To enable `hardened` signing, use configure parameter
+`--with-macosx-codesign=hardened` and configure the signing identity you wish to
+use with `--with-macosx-codesign-identity=<identity>`. The identity refers to a
+signing identity from Apple that needs to be preinstalled on the build host.
+
+When not signing for distribution with the hardened option, the JDK build will
+still attempt to perform `adhoc` signing to add the special entitlement
+`com.apple.security.get-task-allow` to each binary. This entitlement is required
+to be able to dump core files from a process. Note that adding this entitlement
+makes the build invalid for notarization, so it is only added when signing in
+`debug` mode. To explicitly enable this kind of adhoc signing, use configure
+parameter `--with-macosx-codesign=debug`. It will be enabled by default in most
+cases.
+
+It's also possible to completely disable any explicit codesign operations done
+by the JDK build using the configure parameter `--without-macosx-codesign`.
+The exact behavior then depends on the architecture. For macOS on x64, it (at
+least at the time of this writing) results in completely unsigned binaries that
+should still work fine for development and debugging purposes. On aarch64, the
+Xcode linker will apply a default "adhoc" signing, without any entitlements.
+Such a build does not allow dumping core files.
+
+The default mode "auto" will try for `hardened` signing if the debug level is
+`release` and either the default identity or the specified identity is valid.
+If hardened isn't possible, then `debug` signing is chosen if it works. If
+nothing works, the codesign build step is disabled.
 
 ## Cross-compiling
 

make/Bundles.gmk

@@ -278,16 +278,7 @@ ifneq ($(filter product-bundles% legacy-bundles, $(MAKECMDGOALS)), )
       $(SYMBOLS_EXCLUDE_PATTERN), \
       $(ALL_JRE_FILES))
 
-  # On Macosx release builds, when there is a code signing certificate available,
-  # the final bundle layout can be signed.
-  SIGN_BUNDLE := false
-  ifeq ($(call isTargetOs, macosx)+$(DEBUG_LEVEL), true+release)
-    ifneq ($(CODESIGN), )
-      SIGN_BUNDLE := true
-    endif
-  endif
-
-  ifeq ($(SIGN_BUNDLE), true)
+  ifeq ($(MACOSX_CODESIGN_MODE), hardened)
     # Macosx release build and code signing available.
 
     ################################################################################

make/autoconf/basic_tools.m4

@@ -160,25 +160,23 @@ AC_DEFUN([BASIC_CHECK_MAKE_VERSION],
 AC_DEFUN([BASIC_CHECK_MAKE_OUTPUT_SYNC],
 [
   # Check if make supports the output sync option and if so, setup using it.
-  AC_MSG_CHECKING([if make --output-sync is supported])
-  if $MAKE --version -O > /dev/null 2>&1; then
-    OUTPUT_SYNC_SUPPORTED=true
-    AC_MSG_RESULT([yes])
-    AC_MSG_CHECKING([for output-sync value])
-    AC_ARG_WITH([output-sync], [AS_HELP_STRING([--with-output-sync],
-      [set make output sync type if supported by make. @<:@recurse@:>@])],
-      [OUTPUT_SYNC=$with_output_sync])
-    if test "x$OUTPUT_SYNC" = "x"; then
-      OUTPUT_SYNC=none
-    fi
-    AC_MSG_RESULT([$OUTPUT_SYNC])
-    if ! $MAKE --version -O$OUTPUT_SYNC > /dev/null 2>&1; then
-      AC_MSG_ERROR([Make did not the support the value $OUTPUT_SYNC as output sync type.])
-    fi
-  else
-    OUTPUT_SYNC_SUPPORTED=false
-    AC_MSG_RESULT([no])
-  fi
+  UTIL_ARG_WITH(NAME: output-sync, TYPE: literal,
+      VALID_VALUES: [none recurse line target], DEFAULT: recurse,
+      OPTIONAL: true, ENABLED_DEFAULT: true,
+      ENABLED_RESULT: OUTPUT_SYNC_SUPPORTED,
+      CHECKING_MSG: [for make --output-sync value],
+      DESC: [set make --output-sync type if supported by make],
+      CHECK_AVAILABLE:
+      [
+        AC_MSG_CHECKING([if make --output-sync is supported])
+        if ! $MAKE --version -O > /dev/null 2>&1; then
+          AC_MSG_RESULT([no])
+          AVAILABLE=false
+        else
+          AC_MSG_RESULT([yes])
+        fi
+      ]
+  )
   AC_SUBST(OUTPUT_SYNC_SUPPORTED)
   AC_SUBST(OUTPUT_SYNC)
 ])
@@ -378,43 +376,6 @@ AC_DEFUN_ONCE([BASIC_SETUP_COMPLEX_TOOLS],
     UTIL_REQUIRE_PROGS(MIG, mig)
     UTIL_REQUIRE_PROGS(XATTR, xattr)
     UTIL_LOOKUP_PROGS(CODESIGN, codesign)
-
-    if test "x$CODESIGN" != "x"; then
-      # Check for user provided code signing identity.
-      # If no identity was provided, fall back to "openjdk_codesign".
-      AC_ARG_WITH([macosx-codesign-identity], [AS_HELP_STRING([--with-macosx-codesign-identity],
-        [specify the code signing identity])],
-        [MACOSX_CODESIGN_IDENTITY=$with_macosx_codesign_identity],
-        [MACOSX_CODESIGN_IDENTITY=openjdk_codesign]
-      )
-
-      AC_SUBST(MACOSX_CODESIGN_IDENTITY)
-
-      # Verify that the codesign certificate is present
-      AC_MSG_CHECKING([if codesign certificate is present])
-      $RM codesign-testfile
-      $TOUCH codesign-testfile
-      $CODESIGN -s "$MACOSX_CODESIGN_IDENTITY" codesign-testfile 2>&AS_MESSAGE_LOG_FD \
-          >&AS_MESSAGE_LOG_FD || CODESIGN=
-      $RM codesign-testfile
-      if test "x$CODESIGN" = x; then
-        AC_MSG_RESULT([no])
-      else
-        AC_MSG_RESULT([yes])
-        # Verify that the codesign has --option runtime
-        AC_MSG_CHECKING([if codesign has --option runtime])
-        $RM codesign-testfile
-        $TOUCH codesign-testfile
-        $CODESIGN --option runtime -s "$MACOSX_CODESIGN_IDENTITY" codesign-testfile \
-            2>&AS_MESSAGE_LOG_FD >&AS_MESSAGE_LOG_FD || CODESIGN=
-        $RM codesign-testfile
-        if test "x$CODESIGN" = x; then
-          AC_MSG_ERROR([codesign does not have --option runtime. macOS 10.13.6 and above is required.])
-        else
-          AC_MSG_RESULT([yes])
-        fi
-      fi
-    fi
     UTIL_REQUIRE_PROGS(SETFILE, SetFile)
   fi
   if ! test "x$OPENJDK_TARGET_OS" = "xwindows"; then

make/autoconf/compare.sh.in

@@ -40,6 +40,7 @@ export AWK="@AWK@"
 export BASH="@BASH@"
 export CAT="@CAT@"
 export CMP="@CMP@"
+export CODESIGN="@CODESIGN@"
 export CP="@CP@"
 export CUT="@CUT@"
 export DIFF="@DIFF@"

make/autoconf/configure.ac

@@ -249,6 +249,7 @@ JDKOPT_EXCLUDE_TRANSLATIONS
 JDKOPT_ENABLE_DISABLE_MANPAGES
 JDKOPT_ENABLE_DISABLE_CDS_ARCHIVE
 JDKOPT_ENABLE_DISABLE_COMPATIBLE_CDS_ALIGNMENT
+JDKOPT_SETUP_MACOSX_SIGNING
 
 ###############################################################################
 #