import java-11-openjdk-11.0.11.0.9-0.el8_3

.gitignore

-SOURCES/jdk-updates-jdk11u-jdk-11.0.10+9-4curve.tar.xz
+SOURCES/jdk-updates-jdk11u-jdk-11.0.11+9-4curve.tar.xz
 SOURCES/tapsets-icedtea-3.15.0.tar.xz

.java-11-openjdk.metadata

-8fb81cb2ae37ec04bfc0e3651257a9f9756786a6 SOURCES/jdk-updates-jdk11u-jdk-11.0.10+9-4curve.tar.xz
+a339f6e108c16a23c47504565b602a6fc395bf2e SOURCES/jdk-updates-jdk11u-jdk-11.0.11+9-4curve.tar.xz
 7ae2cba67467825b2c2a5fec7aea041865023002 SOURCES/tapsets-icedtea-3.15.0.tar.xz

SOURCES/remove-intree-libraries.sh

 #!/bin/sh
 
+# Arguments: <JDK TREE> <MINIMAL|FULL>
+TREE=${1}
+TYPE=${2}
+
 ZIP_SRC=src/java.base/share/native/libzip/zlib/
 JPEG_SRC=src/java.desktop/share/native/libjavajpeg/
 GIF_SRC=src/java.desktop/share/native/libsplashscreen/giflib/
 PNG_SRC=src/java.desktop/share/native/libsplashscreen/libpng/
 LCMS_SRC=src/java.desktop/share/native/liblcms/
 
-cd openjdk
+if test "x${TREE}" = "x"; then
+    echo "$0 <JDK_TREE> (MINIMAL|FULL)";
+    exit 1;
+fi
+
+if test "x${TYPE}" = "x"; then
+    TYPE=minimal;
+fi
+
+if test "x${TYPE}" != "xminimal" -a "x${TYPE}" != "xfull"; then
+    echo "Type must be minimal or full";
+    exit 2;
+fi
+
+echo "Removing in-tree libraries from ${TREE}"
+echo "Cleansing operation: ${TYPE}";
+
+cd ${TREE}
 
 echo "Removing built-in libs (they will be linked)"
 
+# On full runs, allow for zlib having already been deleted by minimal
 echo "Removing zlib"
-if [ ! -d ${ZIP_SRC} ]; then
+if [ "x${TYPE}" = "xminimal" -a ! -d ${ZIP_SRC} ]; then
 	echo "${ZIP_SRC} does not exist. Refusing to proceed."
 	exit 1
 fi	
 rm -rvf ${ZIP_SRC}
 
+# Minimal is limited to just zlib so finish here
+if test "x${TYPE}" = "xminimal"; then
+    echo "Finished.";
+    exit 0;
+fi
+
 echo "Removing libjpeg"
-if [ ! -f ${JPEG_SRC}/jdhuff.c ]; then # some file that sound definitely exist
+if [ ! -f ${JPEG_SRC}/jdhuff.c ]; then # some file that should definitely exist
 	echo "${JPEG_SRC} does not contain jpeg sources. Refusing to proceed."
 	exit 1
 fi	

SOURCES/rh1868740-cryptoki_access_to_sunjce.patch

-diff -r eba0f976c468 -r 1fceafb49be5 src/java.base/share/classes/module-info.java
---- openjdk/src/java.base/share/classes/module-info.java	Thu Jul 30 15:05:22 2020 +0200
-+++ openjdk/src/java.base/share/classes/module-info.java	Thu Aug 13 15:17:59 2020 +0200
-@@ -132,6 +132,8 @@
-     // additional qualified exports may be inserted at build time
-     // see make/gensrc/GenModuleInfo.gmk
- 
-+    exports com.sun.crypto.provider to
-+        jdk.crypto.cryptoki;
-     exports com.sun.security.ntlm to
-         java.security.sasl;
-     exports jdk.internal to

SOURCES/rh1868754-pkcs11_cancel_on_failure.patch

-diff -r e10f558e1df5 openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Cipher.java
---- openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Cipher.java	Mon Aug 31 16:12:32 2020 +0100
-+++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Cipher.java	Mon Aug 31 15:17:50 2020 -0300
-@@ -628,7 +628,7 @@
-                 throw (ShortBufferException)
-                         (new ShortBufferException().initCause(e));
-             }
--            reset(false);
-+            reset(true);
-             throw new ProviderException("update() failed", e);
-         }
-     }
-@@ -746,7 +746,7 @@
-                 throw (ShortBufferException)
-                         (new ShortBufferException().initCause(e));
-             }
--            reset(false);
-+            reset(true);
-             throw new ProviderException("update() failed", e);
-         }
-     }

SOURCES/rh1883849-cryptoki_access_to_sunjce_with_security_manager.patch

-# HG changeset patch
-# User Zdenek Zambersky <zzambers@redhat.com>
-# Date 1601403587 -7200
-#      Tue Sep 29 20:19:47 2020 +0200
-# Node ID f77ac813eee61b2e9616b2d71a2c5372d0cbd158
-# Parent  d484fdfcc7d5c21812de8a0712236d077b0f2dde
-Fixed default policy for jdk.crypto.cryptoki
-
-diff -r d484fdfcc7d5 -r f77ac813eee6 src/java.base/share/lib/security/default.policy
---- openjdk.orig/src/java.base/share/lib/security/default.policy	Wed Sep 02 07:36:15 2020 +0200
-+++ openjdk/src/java.base/share/lib/security/default.policy	Tue Sep 29 20:19:47 2020 +0200
-@@ -124,6 +124,8 @@
- grant codeBase "jrt:/jdk.crypto.cryptoki" {
-     permission java.lang.RuntimePermission
-                    "accessClassInPackage.sun.security.*";
-+    permission java.lang.RuntimePermission
-+                   "accessClassInPackage.com.sun.crypto.provider";
-     permission java.lang.RuntimePermission "accessClassInPackage.sun.nio.ch";
-     permission java.lang.RuntimePermission "loadLibrary.j2pkcs11";
-     permission java.util.PropertyPermission "sun.security.pkcs11.allowSingleThreadedModules", "read";
-# HG changeset patch
-# User Zdenek Zambersky <zzambers@redhat.com>
-# Date 1601419086 -7200
-#      Wed Sep 30 00:38:06 2020 +0200
-# Node ID 02c8b154f728be3dd06239a98519d654e2127186
-# Parent  f77ac813eee61b2e9616b2d71a2c5372d0cbd158
-P11Util: Create provider in priviledged block
-
-diff -r f77ac813eee6 -r 02c8b154f728 src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Util.java
---- openjdk.orig/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Util.java	Tue Sep 29 20:19:47 2020 +0200
-+++ openjdk/src/jdk.crypto.cryptoki/share/classes/sun/security/pkcs11/P11Util.java	Wed Sep 30 00:38:06 2020 +0200
-@@ -87,14 +87,20 @@
-         }
-         p = Security.getProvider(providerName);
-         if (p == null) {
--            try {
--                @SuppressWarnings("deprecation")
--                Object o = Class.forName(className).newInstance();
--                p = (Provider)o;
--            } catch (Exception e) {
--                throw new ProviderException
--                        ("Could not find provider " + providerName, e);
--            }
-+            p = AccessController.doPrivileged(
-+                new PrivilegedAction<Provider>() {
-+                    public Provider run() {
-+                        try {
-+                            @SuppressWarnings("deprecation")
-+                            Object o = Class.forName(className).newInstance();
-+                            return (Provider) o;
-+                        } catch (Exception e) {
-+                            throw new ProviderException
-+                                ("Could not find provider " + providerName, e);
-+                        }
-+                    }
-+                }
-+            );
-         }
-         return p;
-     }

SPECS/java-11-openjdk.spec

@@ -19,9 +19,16 @@
 %bcond_without slowdebug
 # Enable release builds by default on relevant arches.
 %bcond_without release
+# Enable static library builds by default.
+%bcond_without staticlibs
 
 # Workaround for stripping of debug symbols from static libraries
+%if %{with staticlibs}
 %define __brp_strip_static_archive %{nil}
+%global include_staticlibs 1
+%else
+%global include_staticlibs 0
+%endif
 
 # The -g flag says to use strip -g instead of full strip on DSOs or EXEs.
 # This fixes detailed NMT and other tools which need minimal debug info.
@@ -35,10 +42,14 @@
 # (initiated in https://bugzilla.redhat.com/show_bug.cgi?id=1482192)
 %global debug_suffix_unquoted -slowdebug
 %global fastdebug_suffix_unquoted -fastdebug
+%global main_suffix_unquoted -main
+%global staticlibs_suffix_unquoted -staticlibs
 # quoted one for shell operations
 %global debug_suffix "%{debug_suffix_unquoted}"
 %global fastdebug_suffix "%{fastdebug_suffix_unquoted}"
 %global normal_suffix ""
+%global main_suffix "%{main_suffix_unquoted}"
+%global staticlibs_suffix "%{staticlibs_suffix_unquoted}"
 
 %global debug_warning This package is unoptimised with full debugging. Install only as needed and remove ASAP.
 %global fastdebug_warning This package is optimised with full debugging. Install only as needed and remove ASAP.
@@ -145,6 +156,8 @@
 %else
 %global include_fastdebug_build 0
 %endif
+%else
+%global include_fastdebug_build 0
 %endif
 
 %if %{include_debug_build}
@@ -165,6 +178,12 @@
 # Test slowdebug first as it provides the best diagnostics
 %global rev_build_loop  %{slowdebug_build} %{fastdebug_build} %{normal_build}
 
+%if %{include_staticlibs}
+%global staticlibs_loop %{staticlibs_suffix}
+%else
+%global staticlibs_loop %{nil}
+%endif
+
 %ifarch %{bootstrap_arches}
 %global bootstrap_build 1
 %else
@@ -172,12 +191,20 @@
 %endif
 
 %if %{bootstrap_build}
-%global release_targets bootcycle-images static-libs-image docs-zip
+%global release_targets bootcycle-images docs-zip
 %else
-%global release_targets images docs-zip static-libs-image
+%global release_targets images docs-zip
 %endif
 # No docs nor bootcycle for debug builds
-%global debug_targets images static-libs-image
+%global debug_targets images
+
+%if %{include_staticlibs}
+# Extra target for producing the static-libraries. Separate from
+# other targets since this target is configured to use in-tree
+# AWT dependencies: lcms, libjpeg, libpng, libharfbuzz, giflib
+# and possibly others
+%global static_libs_target static-libs-image
+%endif
 
 
 # Filter out flags from the optflags macro that cause problems with the OpenJDK build
@@ -264,7 +291,7 @@
 # New Version-String scheme-style defines
 %global featurever 11
 %global interimver 0
-%global updatever 10
+%global updatever 11
 %global patchver 0
 # If you bump featurever, you must bump also vendor_version_string
 # Used via new version scheme. JDK 11 was
@@ -285,7 +312,7 @@
 
 # Define vendor information used by OpenJDK
 %global oj_vendor Red Hat, Inc.
-%global oj_vendor_url "https://www.redhat.com/"
+%global oj_vendor_url https://www.redhat.com/
 # Define what url should JVM offer in case of a crash report
 # order may be important, epel may have rhel declared
 %if 0%{?epel}
@@ -310,8 +337,9 @@
 %global origin          openjdk
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{origin}
+%global top_level_dir_name_backup %{top_level_dir_name}-backup
 %global buildver        9
-%global rpmrelease      4
+%global rpmrelease      0
 #%%global tagsuffix     %%{nil}
 # Priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
@@ -360,7 +388,7 @@
 %global jdkimage                jdk
 %global static_libs_image       static-libs
 # output dir stub
-%define buildoutputdir() %{expand:openjdk/build%{?1}}
+%define buildoutputdir() %{expand:build/jdk11.build%{?1}}
 # we can copy the javadoc to not arched dir, or make it not noarch
 %define uniquejavadocdir()    %{expand:%{fullversion}.%{_arch}%{?1}}
 # main id and dir of this jdk
@@ -971,8 +999,8 @@ Requires: ca-certificates
 # Require javapackages-filesystem for ownership of /usr/lib/jvm/ and macros
 Requires: javapackages-filesystem
 # Require zone-info data provided by tzdata-java sub-package
-# 2020b required as of JDK-8254177 in October CPU
-Requires: tzdata-java >= 2020b
+# 2021a required as of JDK-8260356 in April 2021 CPU
+Requires: tzdata-java >= 2021a
 # for support of kernel stream control
 # libsctp.so.1 is being `dlopen`ed on demand
 Requires: lksctp-tools%{?_isa}
@@ -1191,10 +1219,6 @@ Patch1001: rh1655466-global_crypto_and_fips.patch
 Patch1002: rh1818909-fips_default_keystore_type.patch
 # RH1860986: Disable TLSv1.3 with the NSS-FIPS provider until PKCS#11 v3.0 support is available
 Patch1004: rh1860986-disable_tlsv1.3_in_fips_mode.patch
-# RH1868740: FIPS: IllegalAccessException by pkcs11 provider
-Patch1005: rh1868740-cryptoki_access_to_sunjce.patch
-# RH1883849: FIPS: IllegalAccessException by pkcs11 provider with security manager on
-Patch1006: rh1883849-cryptoki_access_to_sunjce_with_security_manager.patch
 # RH1915071: Always initialise JavaSecuritySystemConfiguratorAccess
 Patch1007: rh1915071-always_initialise_configurator_access.patch
 
@@ -1220,8 +1244,6 @@ Patch3:    rh649512-remove_uses_of_far_in_jpeg_libjpeg_turbo_1_4_compat_for_jdk1
 Patch4: pr3694-rh1340845-support_fedora_rhel_system_crypto_policy.patch
 # PR3695: Allow use of system crypto policy to be disabled by the user
 Patch7: pr3695-toggle_system_crypto_policy.patch
-# RH1868754: FIPS: Ciphers remain in broken state (unusable), after being supplied with wrongly sized buffer
-Patch11: rh1868754-pkcs11_cancel_on_failure.patch
 
 #############################################
 #
@@ -1270,8 +1292,8 @@ BuildRequires: java-%{buildjdkver}-openjdk-devel
 %ifnarch %{jit_arches}
 BuildRequires: libffi-devel
 %endif
-# 2020b required as of JDK-8254177 in October CPU
-BuildRequires: tzdata-java >= 2020b
+# 2021a required as of JDK-8260356 in April 2021 CPU
+BuildRequires: tzdata-java >= 2021a
 # Earlier versions have a bug in tree vectorization on PPC
 BuildRequires: gcc >= 4.8.3-8
 
@@ -1378,6 +1400,8 @@ The %{origin_nice} %{featurever} development tools.
 %{fastdebug_warning}
 %endif
 
+%if %{include_staticlibs}
+
 %if %{include_normal_build}
 %package static-libs
 Summary: %{origin_nice} %{featurever} libraries for static linking
@@ -1410,6 +1434,9 @@ The %{origin_nice} %{featurever} libraries for static linking.
 %{fastdebug_warning}
 %endif
 
+# staticlibs
+%endif
+
 %if %{include_normal_build}
 %package jmods
 Summary: JMods for %{origin_nice} %{featurever}
@@ -1584,16 +1611,16 @@ if [ $prioritylength -ne 8 ] ; then
 fi
 
 # OpenJDK patches
+# Remove libraries that are linked by both static and dynamic builds
+sh %{SOURCE12} %{top_level_dir_name}
 
-# Remove libraries that are linked
-sh %{SOURCE12}
+# Patch the JDK
 pushd %{top_level_dir_name}
 %patch1 -p1
 %patch2 -p1
 %patch3 -p1
 %patch4 -p1
 %patch7 -p1
-%patch11 -p1
 popd # openjdk
 
 %patch1000
@@ -1602,8 +1629,6 @@ popd # openjdk
 %patch1002
 %patch1003
 %patch1004
-%patch1005
-%patch1006
 %patch1007
 
 # Extract systemtap tapsets
@@ -1696,13 +1721,34 @@ else
   debugbuild=`echo $suffix  | sed "s/-//g"`
 fi
 
-# Variable used in hs_err hook on build failures
-top_dir_abs_path=$(pwd)/%{top_level_dir_name}
+for loop in %{main_suffix} %{staticlibs_loop} ; do
+
+if test "x${loop}" = "x%{main_suffix}" ; then
+    # Copy the source tree so we can remove all in-tree libraries
+    cp -a %{top_level_dir_name} %{top_level_dir_name_backup}
+    # Remove all libraries that are linked
+    sh %{SOURCE12} %{top_level_dir_name} full
+    # Variable used by configure and hs_err hook on build failures
+    link_opt="system"
+    # Debug builds don't need same targets as release for
+    # build speed-up
+    maketargets="%{release_targets}"
+    if echo $debugbuild | grep -q "debug" ; then
+	maketargets="%{debug_targets}"
+    fi
+else
+    # Variable used by configure and hs_err hook on build failures
+    link_opt="bundled"
+    # Static library cycle only builds the static libraries
+    maketargets="%{static_libs_target}"
+fi
 
-mkdir -p %{buildoutputdir -- $suffix}
-pushd %{buildoutputdir -- $suffix}
+top_dir_abs_src_path=$(pwd)/%{top_level_dir_name}
+top_dir_abs_build_path=$(pwd)/%{buildoutputdir -- ${suffix}${loop}}
+mkdir -p ${top_dir_abs_build_path}
+pushd ${top_dir_abs_build_path}
 
-bash ../configure \
+bash ${top_dir_abs_src_path}/configure \
 %ifnarch %{jit_arches}
     --with-jvm-variants=zero \
 %endif
@@ -1722,11 +1768,11 @@ bash ../configure \
     --with-native-debug-symbols=internal \
     --enable-unlimited-crypto \
     --with-zlib=system \
-    --with-libjpeg=system \
-    --with-giflib=system \
-    --with-libpng=system \
-    --with-lcms=system \
-    --with-harfbuzz=system \
+    --with-libjpeg=${link_opt} \
+    --with-giflib=${link_opt} \
+    --with-libpng=${link_opt} \
+    --with-lcms=${link_opt} \
+    --with-harfbuzz=${link_opt} \
     --with-stdc++lib=dynamic \
     --with-extra-cxxflags="$EXTRA_CPP_FLAGS" \
     --with-extra-cflags="$EXTRA_CFLAGS" \
@@ -1737,33 +1783,37 @@ bash ../configure \
     --with-jvm-features="%{shenandoah_feature},%{zgc_feature}" \
     --disable-warnings-as-errors
 
-# Debug builds don't need same targets as release for
-# build speed-up
-maketargets="%{release_targets}"
-if echo $debugbuild | grep -q "debug" ; then
-  maketargets="%{debug_targets}"
-fi
 make \
     JAVAC_FLAGS=-g \
     LOG=trace \
     WARNINGS_ARE_ERRORS="-Wno-error" \
     CFLAGS_WARNINGS_ARE_ERRORS="-Wno-error" \
-    $maketargets || ( pwd; find $top_dir_abs_path -name "hs_err_pid*.log" | xargs cat && false )
+    $maketargets || ( pwd; find ${top_dir_abs_src_path} ${top_dir_abs_build_path} -name "hs_err_pid*.log" | xargs cat && false )
+
+popd >& /dev/null
+
+# Restore original source tree if we modified it by removing full in-tree sources
+if [ -d %{top_level_dir_name_backup} ] ; then
+    rm -rf %{top_level_dir_name}
+    mv %{top_level_dir_name_backup} %{top_level_dir_name}
+fi
+
+done # end of main / staticlibs loop
+
+top_dir_abs_main_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{main_suffix}}
 
 # the build (erroneously) removes read permissions from some jars
 # this is a regression in OpenJDK 7 (our compiler):
 # http://icedtea.classpath.org/bugzilla/show_bug.cgi?id=1437
-find images/%{jdkimage} -iname '*.jar' -exec chmod ugo+r {} \;
+find ${top_dir_abs_main_build_path}/images/%{jdkimage} -iname '*.jar' -exec chmod ugo+r {} \;
 
 # Build screws up permissions on binaries
 # https://bugs.openjdk.java.net/browse/JDK-8173610
-find images/%{jdkimage} -iname '*.so' -exec chmod +x {} \;
-find images/%{jdkimage}/bin/ -exec chmod +x {} \;
-
-popd >& /dev/null
+find ${top_dir_abs_main_build_path}/images/%{jdkimage} -iname '*.so' -exec chmod +x {} \;
+find ${top_dir_abs_main_build_path}/images/%{jdkimage}/bin/ -exec chmod +x {} \;
 
 # Install nss.cfg right away as we will be using the JRE above
-export JAVA_HOME=$(pwd)/%{buildoutputdir -- $suffix}/images/%{jdkimage}
+export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage}
 
 # Install nss.cfg right away as we will be using the JRE above
 install -m 644 nss.cfg $JAVA_HOME/conf/security/
@@ -1783,14 +1833,19 @@ cat man/man1/java.1 >> man/man1/%{alt_java_name}.1
 popd
 
 # build cycles
-done
+done # end of release / debug cycle loop
 
 %check
 
 # We test debug first as it will give better diagnostics on a crash
 for suffix in %{rev_build_loop} ; do
 
-export JAVA_HOME=$(pwd)/%{buildoutputdir -- $suffix}/images/%{jdkimage}
+top_dir_abs_main_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{main_suffix}}
+%if %{include_staticlibs}
+top_dir_abs_staticlibs_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{staticlibs_loop}}
+%endif
+
+export JAVA_HOME=${top_dir_abs_main_build_path}/images/%{jdkimage}
 
 #check Shenandoah is enabled
 %if %{use_shenandoah_hotspot}
@@ -1807,7 +1862,7 @@ $JAVA_HOME/bin/java $(echo $(basename %{SOURCE14})|sed "s|\.java||")
 
 # Check correct vendor values have been set
 $JAVA_HOME/bin/javac -d . %{SOURCE16}
-$JAVA_HOME/bin/java $(echo $(basename %{SOURCE16})|sed "s|\.java||") "%{oj_vendor}" %{oj_vendor_url} %{oj_vendor_bug_url}
+$JAVA_HOME/bin/java $(echo $(basename %{SOURCE16})|sed "s|\.java||") "%{oj_vendor}" "%{oj_vendor_url}" "%{oj_vendor_bug_url}"
 
 # Check java launcher has no SSB mitigation
 if ! nm $JAVA_HOME/bin/java | grep set_speculation ; then true ; else false; fi
@@ -1819,10 +1874,12 @@ nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation
 if ! nm $JAVA_HOME/bin/%{alt_java_name} | grep set_speculation ; then true ; else false; fi
 %endif
 
+%if %{include_staticlibs}
 # Check debug symbols in static libraries (smoke test)
-export STATIC_LIBS_HOME=$(pwd)/%{buildoutputdir -- $suffix}/images/%{static_libs_image}
+export STATIC_LIBS_HOME=${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image}
 readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep w_remainder.c
 readelf --debug-dump $STATIC_LIBS_HOME/lib/libfdlibm.a | grep e_remainder.c
+%endif
 
 # Check debug symbols are present and can identify code
 find "$JAVA_HOME" -iname '*.so' -print0 | while read -d $'\0' lib
@@ -1908,12 +1965,17 @@ STRIP_KEEP_SYMTAB=libjvm*
 
 for suffix in %{build_loop} ; do
 
+top_dir_abs_main_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{main_suffix}}
+%if %{include_staticlibs}
+top_dir_abs_staticlibs_build_path=$(pwd)/%{buildoutputdir -- ${suffix}%{staticlibs_loop}}
+%endif
+jdk_image=${top_dir_abs_main_build_path}/images/%{jdkimage}
+
 # Install the jdk
 mkdir -p $RPM_BUILD_ROOT%{_jvmdir}
-cp -a %{buildoutputdir -- $suffix}/images/%{jdkimage} \
-  $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}
+cp -a ${jdk_image} $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}
 
-pushd %{buildoutputdir $suffix}/images/%{jdkimage}
+pushd ${jdk_image}
 
 %if %{with_systemtap}
   # Install systemtap support files
@@ -1957,18 +2019,19 @@ pushd %{buildoutputdir $suffix}/images/%{jdkimage}
 
 popd
 # Install static libs artefacts
+%if %{include_staticlibs}
 mkdir -p $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/lib/static/linux-%{archinstall}/glibc
-cp -a %{buildoutputdir -- $suffix}/images/%{static_libs_image}/lib/*.a \
+cp -a ${top_dir_abs_staticlibs_build_path}/images/%{static_libs_image}/lib/*.a \
   $RPM_BUILD_ROOT%{_jvmdir}/%{sdkdir -- $suffix}/lib/static/linux-%{archinstall}/glibc
-
+%endif
 
 if ! echo $suffix | grep -q "debug" ; then
   # Install Javadoc documentation
   install -d -m 755 $RPM_BUILD_ROOT%{_javadocdir}
-  cp -a %{buildoutputdir $suffix}/images/docs $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir $suffix}
+  cp -a ${top_dir_abs_main_build_path}/images/docs $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}
   built_doc_archive=jdk-%{filever}%{ea_designator_zip}+%{buildver}%{lts_designator_zip}-docs.zip
-  cp -a %{buildoutputdir -- $suffix}/bundles/${built_doc_archive} \
-     $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip || ls -l %{buildoutputdir -- $suffix}/bundles/
+  cp -a ${top_dir_abs_main_build_path}/bundles/${built_doc_archive} \
+     $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip || ls -l ${top_dir_abs_main_build_path}/bundles/
 fi
 
 # Install release notes
@@ -2194,8 +2257,10 @@ end
 %files devel
 %{files_devel %{nil}}
 
+%if %{include_staticlibs}
 %files static-libs
 %{files_static_libs %{nil}}
+%endif
 
 %files jmods
 %{files_jmods %{nil}}
@@ -2226,8 +2291,10 @@ end
 %files devel-slowdebug
 %{files_devel -- %{debug_suffix_unquoted}}
 
+%if %{include_staticlibs}
 %files static-libs-slowdebug
 %{files_static_libs -- %{debug_suffix_unquoted}}
+%endif
 
 %files jmods-slowdebug
 %{files_jmods -- %{debug_suffix_unquoted}}
@@ -2250,8 +2317,10 @@ end
 %files devel-fastdebug
 %{files_devel -- %{fastdebug_suffix_unquoted}}
 
+%if %{include_staticlibs}
 %files static-libs-fastdebug
 %{files_static_libs -- %{fastdebug_suffix_unquoted}}
+%endif
 
 %files jmods-fastdebug
 %{files_jmods -- %{fastdebug_suffix_unquoted}}
@@ -2265,6 +2334,28 @@ end
 %endif
 
 %changelog
+* Thu Apr 15 2021 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.11.0.9-0
+- Update to jdk-11.0.11.0+9
+- Update release notes to 11.0.11.0+9
+- Require tzdata 2020f to match upstream change JDK-8259048
+- Require tzdata 2021a to match upstream change JDK-8260356
+- Remove RH1868754 patch as this is now resolved upstream by JDK-8258833
+- Remove RH1868740 & RH1883849 patches as these are now resolved by JDK-8259319
+- This tarball is embargoed until 2021-04-20 @ 1pm PT.
+- Resolves: rhbz#1938201
+
+* Thu Apr 15 2021 Jayashree Huttanagoudar <jhuttana@redhat.com> - 1:11.0.11.0.9-0
+- Fix issue where CheckVendor.java test erroneously passes when it should fail.
+- Add proper quoting so '&' is not treated as a special character by the shell.
+- Fixed not-including fastdebug build in case of --without fastdebug
+- Resolves: rhbz#1938201
+
+* Mon Feb 22 2021 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.9-5
+- Perform static library build on a separate source tree with bundled image libraries
+- Make static library build optional
+- Based on initial work by Severin Gehwolf
+- Resolves: rhbz#1930513
+
 * Mon Jan 18 2021 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.10.0.9-4
 - Fix accidental use of $ instead of % for variable reference.
 - Resolves: rhbz#1908972