[Test build] Change script structure; Replace 'jre/lib/security` to fix network problem

.github/workflows/build.yml

@@ -1,4 +1,4 @@
-name: Build JDK for ARM
+name: Build OpenJDK for Android
 
 on: [push]
 
@@ -15,7 +15,7 @@ jobs:
         java-version: 1.8
 
     - name: Build with CI build script
-      run: ./ci_build.sh
+      run: ./ci_build_arch_aarch64.sh
 
     - name: Upload build output
       uses: actions/upload-artifact@v1

buildjdk.sh

@@ -1,7 +1,7 @@
 #!/bin/bash
 set -e
 . setdevkitpath.sh
-export FREETYPE_DIR=`pwd`/freetype-2.6.2/build_android-aarch64
+export FREETYPE_DIR=`pwd`/freetype-2.6.2/build_android-${TARGET_SHORT}
 export CUPS_DIR=`pwd`/cups-2.2.4
 
 # My system's JDK is too old (7.0), so we add an Oracle boot JDK.
@@ -18,14 +18,9 @@ cp -R -f override-jre-files/* openjdk/
 
 cd openjdk
 rm -rf build
-#	--build=x86_64-linux-gnu \
-#	--hostt=aarch64-linux-android \
-#	--with-toolchain-type=clang \
-#	--with-cpu-port=arm64 \
-
 bash ./configure \
 	--enable-option-checking=fatal \
-	--openjdk-target=aarch64-linux-android \
+	--openjdk-target=$TARGET \
 	--disable-warnings-as-errors \
 	--enable-headless-only \
 	--with-jdk-variant=normal \
@@ -43,6 +38,6 @@ if [ "$error_code" -ne 0 ]; then
   exit $error_code
 fi
 
-mkdir -p build/android-aarch64-normal-server-release
+mkdir -p build/android-${TARGET_JDK}-normal-server-release
-cd build/android-aarch64-normal-server-release
+cd build/android-${TARGET_JDK}-normal-server-release
 make JOBS=4 images

buildjdk_x86.sh

@@ -1,28 +0,0 @@
-#!/bin/bash
-set -e
-. setdevkitpath_x86.sh
-export FREETYPE_DIR=`pwd`/freetype-2.6.2-x86/build_android-i686
-export CUPS_DIR=`pwd`/cups-2.2.4
-
-# My system's JDK is too old (7.0), so we add an Oracle boot JDK.
-export PATH=`pwd`/jdk1.8.0_162/bin:$PATH
-
-cd openjdk
-#rm -rf build
-bash ./configure \
-	--enable-option-checking=fatal \
-	--build=x86_64-unknown-linux-gnu \
-	--host=i686-linux-android \
-	--target=i686-linux-android \
-	--disable-warnings-as-errors \
-	--enable-headless-only \
-	--with-jdk-variant=normal \
-	--with-jvm-variants=server \
-	--with-cups-include=$CUPS_DIR \
-	--with-devkit=$ANDROID_DEVKIT \
-	--with-debug-level=release \
-	--with-freetype-lib=$FREETYPE_DIR/lib \
-	--with-freetype-include=$FREETYPE_DIR/include/freetype2
-
-cd build/android-x86-normal-server-release
-make JOBS=4 images

buildlibs.sh

@@ -7,20 +7,11 @@ echo "Building Freetype"
 
 cd freetype-2.6.2
 ./configure \
-	--host=aarch64-linux-android \
+	--host=$TARGET \
-	--prefix=`pwd`/build_android-aarch64 \
+	--prefix=`pwd`/build_android-${TARGET_SHORT} \
 	--without-zlib \
 	--with-png=no \
 	--with-harfbuzz=no
 make -j4
 make install
 
-# cd ..
-# echo "Building CUPS"
-
-# cd cups-2.2.4
-# ./configure CC="gcc -std=c99" \
-# 	--host=aarch64-linux-android \
-# 	--prefix=`pwd`/build_android-aarch64
-# make -j4
-# make install

buildlibs_x86.sh

@@ -1,17 +0,0 @@
-#!/bin/bash
-set -e
-. setdevkitpath_x86.sh
-export PATH=$ANDROID_DEVKIT/bin:$PATH
-
-echo "Building Freetype"
-
-cd freetype-2.6.2-x86
-./configure \
-	--host=i686-linux-android \
-	--prefix=`pwd`/build_android-i686 \
-	--without-zlib \
-	--with-png=no \
-	--with-harfbuzz=no
-
-make -j4
-make install

ci_build_arch_aarch32.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+set -e
+
+export TARGET=arm-linux-androideabi
+export TARGET_SHORT=arm
+export TARGET_JDK=aarch32
+
+./ci_build_global.sh
+

ci_build_arch_aarch64.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+set -e
+
+export TARGET=aarch64-linux-android
+export TARGET_SHORT=arm64
+export TARGET_JDK=aarch64
+
+./ci_build_global.sh
+

ci_build_arch_x86.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+set -e
+
+export TARGET=i686-linux-android
+export TARGET_SHORT=x86
+export TARGET_JDK=x86
+
+./ci_build_global.sh
+

ci_build_arch_x86_64.sh

@@ -0,0 +1,9 @@
+#!/bin/bash
+set -e
+
+export TARGET=x86_64-linux-android
+export TARGET_SHORT=x86_64
+export TARGET_JDK=amd64
+
+./ci_build_global.sh
+

cleanarchbuild.sh

@@ -0,0 +1,5 @@
+#!/bin/bash
+set -e
+
+# TODO or separate work
+

devkit.info.x86_64

@@ -0,0 +1,3 @@
+DEVKIT_NAME="Android X86_64"
+DEVKIT_TOOLCHAIN_PATH="$DEVKIT_ROOT/x86_64-linux-android/bin"
+DEVKIT_SYSROOT="$DEVKIT_ROOT/sysroot"

makejdkwithoutconfigure.sh

@@ -3,12 +3,12 @@
 
 set -e
 . setdevkitpath.sh
-export FREETYPE_DIR=`pwd`/freetype-2.6.2/build_android-arm64
+export FREETYPE_DIR=`pwd`/freetype-2.6.2/build_android-${TARGET_SHORT}
 export CUPS_DIR=`pwd`/cups-2.2.4
 
 # My system's JDK is too old (7.0), so we add an Oracle boot JDK.
 export PATH=`pwd`/jdk-9.0.4/bin:$PATH
 
 cd openjdk
-cd build/android-aarch64-normal-server-release
+cd build/android-${TARGET_JDK}-normal-server-release
 make JOBS=4 images

maketoolchain.sh

@@ -4,7 +4,7 @@ set -e
 . setdevkitpath.sh
   
 $NDK/build/tools/make-standalone-toolchain.sh \
-	--arch=arm64 \
+	--arch=${TARGET_SHORT} \
 	--platform=android-21 \
-	--install-dir=$NDK_HOME/generated-toolchains/android-arm64-toolchain
+	--install-dir=$NDK_HOME/generated-toolchains/android-${TARGET_SHORT}-toolchain
-cp devkit.info.arm64 $NDK_HOME/generated-toolchains/android-arm64-toolchain/
+cp devkit.info.${TARGET_SHORT} $NDK_HOME/generated-toolchains/android-${TARGET_SHORT}-toolchain/

maketoolchain_x86.sh

@@ -1,8 +0,0 @@
-#!/bin/bash
-set -e
-. setdevkitpath_x86.sh
-$NDK/build/tools/make-standalone-toolchain.sh \
-	--arch=x86 \
-	--platform=android-21 \
-	--install-dir=`pwd`/android-ndk-r10e/generated-toolchains/android-x86-toolchain
-cp devkit.info.x86 android-ndk-r10e/generated-toolchains/android-x86-toolchain/

override-jre-files/jdk/src/java.base/share/lib/security/blacklisted.certs

@@ -0,0 +1,20 @@
+Algorithm=SHA-256
+14E6D2764A4B06701C6CBC376A253775F79C782FBCB6C0EE6F99DE4BA1024ADD
+31C8FD37DB9B56E708B03D1F01848B068C6DA66F36FB5D82C008C6040FA3E133
+3946901F46B0071E90D78279E82FABABCA177231A704BE72C5B0E8918566EA66
+450F1B421BB05C8609854884559C323319619E8B06B001EA2DCBB74A23AA3BE2
+4CBBF8256BC9888A8007B2F386940A2E394378B0D903CBB3863C5A6394B889CE
+4FEE0163686ECBD65DB968E7494F55D84B25486D438E9DE558D629D28CD4D176
+5E83124D68D24E8E177E306DF643D5EA99C5A94D6FC34B072F7544A1CABB7C7B
+76A45A496031E4DD2D7ED23E8F6FF97DBDEA980BAAC8B0BA94D7EDB551348645
+8A1BD21661C60015065212CC98B1ABB50DFD14C872A208E66BAE890F25C448AF
+9ED8F9B0E8E42A1656B8E1DD18F42BA42DC06FE52686173BA2FC70E756F207DC
+A686FEE577C88AB664D0787ECDFFF035F4806F3DE418DC9E4D516324FFF02083
+B8686723E415534BC0DBD16326F9486F85B0B0799BF6639334E61DAAE67F36CD
+D24566BF315F4E597D6E381C87119FB4198F5E9E2607F5F4AB362EF7E2E7672F
+D3A936E1A7775A45217C8296A1F22AC5631DCDEC45594099E78EEEBBEDCBA967
+DF21016B00FC54F9FE3BC8B039911BB216E9162FAD2FD14D990AB96E951B49BE
+EC30C9C3065A06BB07DC5B1C6B497F370C1CA65C0F30C08E042BA6BCECC78F2C
+F5B6F88F75D391A4B1EB336F9E201239FB6B1377DB8CFA7B84736216E5AFFFD7
+FC02FD48DB92D4DCE6F11679D38354CF750CFC7F584A520EB90BDE80E241F2BD
+FDEDB5BDFCB67411513A61AEE5CB5B5D7C52AF06028EFC996CC1B05B1D6CEA2B

override-jre-files/jdk/src/java.base/share/lib/security/default.policy

@@ -0,0 +1,211 @@
+//
+// Permissions required by modules stored in a run-time image and loaded
+// by the platform class loader.
+//
+// NOTE that this file is not intended to be modified. If additional
+// permissions need to be granted to the modules in this file, it is
+// recommended that they be configured in a separate policy file or
+// ${java.home}/conf/security/java.policy.
+//
+
+
+grant codeBase "jrt:/java.compiler" {
+    permission java.security.AllPermission;
+};
+
+
+grant codeBase "jrt:/java.net.http" {
+    permission java.lang.RuntimePermission "accessClassInPackage.sun.net";
+    permission java.lang.RuntimePermission "accessClassInPackage.sun.net.util";
+    permission java.lang.RuntimePermission "accessClassInPackage.sun.net.www";
+    permission java.lang.RuntimePermission "accessClassInPackage.jdk.internal.misc";
+    permission java.net.SocketPermission "*","connect,resolve";
+    permission java.net.URLPermission "http:*","*:*";
+    permission java.net.URLPermission "https:*","*:*";
+    permission java.net.URLPermission "ws:*","*:*";
+    permission java.net.URLPermission "wss:*","*:*";
+    permission java.net.URLPermission "socket:*","CONNECT";  // proxy
+    // For request/response body processors, fromFile, asFile
+    permission java.io.FilePermission "<<ALL FILES>>","read,write,delete";
+    permission java.util.PropertyPermission "*","read";
+    permission java.net.NetPermission "getProxySelector";
+};
+
+grant codeBase "jrt:/java.scripting" {
+    permission java.security.AllPermission;
+};
+
+grant codeBase "jrt:/java.security.jgss" {
+    permission java.security.AllPermission;
+};
+
+grant codeBase "jrt:/java.smartcardio" {
+    permission javax.smartcardio.CardPermission "*", "*";
+    permission java.lang.RuntimePermission "loadLibrary.j2pcsc";
+    permission java.lang.RuntimePermission
+                   "accessClassInPackage.sun.security.jca";
+    permission java.lang.RuntimePermission
+                   "accessClassInPackage.sun.security.util";
+    permission java.util.PropertyPermission
+                   "javax.smartcardio.TerminalFactory.DefaultType", "read";
+    permission java.util.PropertyPermission "os.name", "read";
+    permission java.util.PropertyPermission "os.arch", "read";
+    permission java.util.PropertyPermission "sun.arch.data.model", "read";
+    permission java.util.PropertyPermission
+                   "sun.security.smartcardio.library", "read";
+    permission java.util.PropertyPermission
+                   "sun.security.smartcardio.t0GetResponse", "read";
+    permission java.util.PropertyPermission
+                   "sun.security.smartcardio.t1GetResponse", "read";
+    permission java.util.PropertyPermission
+                   "sun.security.smartcardio.t1StripLe", "read";
+    // needed for looking up native PC/SC library
+    permission java.io.FilePermission "<<ALL FILES>>","read";
+    permission java.security.SecurityPermission "putProviderProperty.SunPCSC";
+    permission java.security.SecurityPermission
+                   "clearProviderProperties.SunPCSC";
+    permission java.security.SecurityPermission
+                   "removeProviderProperty.SunPCSC";
+};
+
+grant codeBase "jrt:/java.sql" {
+    permission java.security.AllPermission;
+};
+
+grant codeBase "jrt:/java.sql.rowset" {
+    permission java.security.AllPermission;
+};
+
+
+grant codeBase "jrt:/java.xml.crypto" {
+    permission java.lang.RuntimePermission
+                   "accessClassInPackage.sun.security.util";
+    permission java.util.PropertyPermission "*", "read";
+    permission java.security.SecurityPermission "putProviderProperty.XMLDSig";
+    permission java.security.SecurityPermission
+                   "clearProviderProperties.XMLDSig";
+    permission java.security.SecurityPermission
+                   "removeProviderProperty.XMLDSig";
+    permission java.security.SecurityPermission
+                   "com.sun.org.apache.xml.internal.security.register";
+    permission java.security.SecurityPermission
+                   "getProperty.jdk.xml.dsig.secureValidationPolicy";
+    permission java.lang.RuntimePermission
+                   "accessClassInPackage.com.sun.org.apache.xml.internal.*";
+    permission java.lang.RuntimePermission
+                   "accessClassInPackage.com.sun.org.apache.xpath.internal";
+    permission java.lang.RuntimePermission
+                   "accessClassInPackage.com.sun.org.apache.xpath.internal.*";
+};
+
+
+grant codeBase "jrt:/jdk.accessibility" {
+    permission java.lang.RuntimePermission "accessClassInPackage.sun.awt";
+};
+
+grant codeBase "jrt:/jdk.charsets" {
+    permission java.util.PropertyPermission "os.name", "read";
+    permission java.util.PropertyPermission "sun.nio.cs.map", "read";
+    permission java.lang.RuntimePermission "charsetProvider";
+    permission java.lang.RuntimePermission
+                   "accessClassInPackage.jdk.internal.misc";
+    permission java.lang.RuntimePermission "accessClassInPackage.sun.nio.cs";
+};
+
+grant codeBase "jrt:/jdk.crypto.ec" {
+    permission java.lang.RuntimePermission
+                   "accessClassInPackage.sun.security.*";
+    permission java.lang.RuntimePermission "loadLibrary.sunec";
+    permission java.security.SecurityPermission "putProviderProperty.SunEC";
+    permission java.security.SecurityPermission "clearProviderProperties.SunEC";
+    permission java.security.SecurityPermission "removeProviderProperty.SunEC";
+};
+
+grant codeBase "jrt:/jdk.crypto.cryptoki" {
+    permission java.lang.RuntimePermission
+                   "accessClassInPackage.sun.security.*";
+    permission java.lang.RuntimePermission "accessClassInPackage.sun.nio.ch";
+    permission java.lang.RuntimePermission "loadLibrary.j2pkcs11";
+    permission java.util.PropertyPermission "sun.security.pkcs11.allowSingleThreadedModules", "read";
+    permission java.util.PropertyPermission "os.name", "read";
+    permission java.util.PropertyPermission "os.arch", "read";
+    permission java.util.PropertyPermission "jdk.crypto.KeyAgreement.legacyKDF", "read";
+    permission java.security.SecurityPermission "putProviderProperty.*";
+    permission java.security.SecurityPermission "clearProviderProperties.*";
+    permission java.security.SecurityPermission "removeProviderProperty.*";
+    permission java.security.SecurityPermission
+                   "getProperty.auth.login.defaultCallbackHandler";
+    permission java.security.SecurityPermission "authProvider.*";
+    // Needed for reading PKCS11 config file and NSS library check
+    permission java.io.FilePermission "<<ALL FILES>>", "read";
+};
+
+grant codeBase "jrt:/jdk.desktop" {
+    permission java.lang.RuntimePermission "accessClassInPackage.com.sun.awt";
+};
+
+grant codeBase "jrt:/jdk.dynalink" {
+    permission java.security.AllPermission;
+};
+
+grant codeBase "jrt:/jdk.httpserver" {
+    permission java.security.AllPermission;
+};
+
+grant codeBase "jrt:/jdk.internal.le" {
+    permission java.security.AllPermission;
+};
+
+grant codeBase "jrt:/jdk.internal.vm.compiler" {
+    permission java.security.AllPermission;
+};
+
+grant codeBase "jrt:/jdk.internal.vm.compiler.management" {
+    permission java.lang.RuntimePermission "accessClassInPackage.org.graalvm.compiler.hotspot";
+    permission java.lang.RuntimePermission "accessClassInPackage.jdk.vm.ci.runtime";
+    permission java.lang.RuntimePermission "accessClassInPackage.sun.management.spi";
+    permission java.lang.RuntimePermission "sun.management.spi.PlatformMBeanProvider.subclass";
+};
+
+grant codeBase "jrt:/jdk.jsobject" {
+    permission java.security.AllPermission;
+};
+
+grant codeBase "jrt:/jdk.localedata" {
+    permission java.lang.RuntimePermission "accessClassInPackage.sun.text.*";
+    permission java.lang.RuntimePermission "accessClassInPackage.sun.util.*";
+};
+
+grant codeBase "jrt:/jdk.naming.dns" {
+    permission java.security.AllPermission;
+};
+
+grant codeBase "jrt:/jdk.scripting.nashorn" {
+    permission java.security.AllPermission;
+};
+
+grant codeBase "jrt:/jdk.scripting.nashorn.shell" {
+    permission java.security.AllPermission;
+};
+
+grant codeBase "jrt:/jdk.security.auth" {
+    permission java.security.AllPermission;
+};
+
+grant codeBase "jrt:/jdk.security.jgss" {
+    permission java.security.AllPermission;
+};
+
+grant codeBase "jrt:/jdk.zipfs" {
+    permission java.io.FilePermission "<<ALL FILES>>", "read,write,delete";
+    permission java.lang.RuntimePermission "fileSystemProvider";
+    permission java.util.PropertyPermission "os.name", "read";
+};
+
+// permissions needed by applications using java.desktop module
+grant {
+    permission java.lang.RuntimePermission "accessClassInPackage.com.sun.beans";
+    permission java.lang.RuntimePermission "accessClassInPackage.com.sun.beans.*";
+    permission java.lang.RuntimePermission "accessClassInPackage.com.sun.java.swing.plaf.*";
+    permission java.lang.RuntimePermission "accessClassInPackage.com.apple.*";
+};

reextract_x86.sh

@@ -1,8 +0,0 @@
-#!/bin/bash
-set -e
-mkdir x86tmp || true
-cd x86tmp
-tar xf ../freetype-2.6.2.tar.bz2
-mv freetype-2.6.2 ../freetype-2.6.2-x86
-cd ..
-rmdir x86tmp

removejdkdebuginfo.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
 set -e
 rm -rf jreout || true
-cp -r openjdk/build/android-aarch64-normal-server-release/images/jre jreout
+cp -r openjdk/build/android-${TARGET_JDK}-normal-server-release/images/jre jreout
 find jreout -name "*.diz" | xargs -- rm

setdevkitpath.sh

@@ -2,12 +2,11 @@
 export NDK_HOME=`pwd`/android-ndk-r10e
 
 export NDK=$NDK_HOME
-export ANDROID_DEVKIT=$NDK/generated-toolchains/android-arm64-toolchain
+export ANDROID_DEVKIT=$NDK/generated-toolchains/android-${TARGET_SHORT}-toolchain
 export TOOLCHAIN=$ANDROID_DEVKIT
-export TARGET=aarch64-linux-android
 
-export CPPFLAGS="-I$NDK/platforms/android-21/arch-arm64/usr/include -I/usr/lib"
+export CPPFLAGS="-I$NDK/platforms/android-21/arch-${TARGET_SHORT}/usr/include -I/usr/lib"
-export LDFLAGS="-L$NDK/platforms/android-21/arch-arm64/usr/lib"
+export LDFLAGS="-L$NDK/platforms/android-21/arch-${TARGET_SHORT}/usr/lib"
 
 # Configure and build.
 # Deprecated...

setdevkitpath_x86.sh

@@ -1,31 +0,0 @@
-# Override GitHub Actions env vars
-
-# if [[ -z "$NDK_HOME" ]]; then
-  export NDK_HOME=`pwd`/android-ndk-r10e
-# fi
-
-export NDK=$NDK_HOME
-export ANDROID_DEVKIT=$NDK/generated-toolchains/android-x86-toolchain
-export TOOLCHAIN=$ANDROID_DEVKIT
-export TARGET=i686-linux-android
-
-export CPPFLAGS="-I$NDK/platforms/android-21/arch-x86/usr/include -I/usr/lib"
-export LDFLAGS="-L$NDK/platforms/android-21/arch-x86/usr/lib"
-
-# Configure and build.
-# Deprecated...
-export AR=$TOOLCHAIN/bin/$TARGET-ar
-export AS=$TOOLCHAIN/bin/$TARGET-as
-export CC=$TOOLCHAIN/bin/$TARGET-clang
-export CXX=$TOOLCHAIN/bin/$TARGET-clang++
-export LD=$TOOLCHAIN/bin/$TARGET-ld
-export RANLIB=$TOOLCHAIN/bin/$TARGET-ranlib
-export STRIP=$TOOLCHAIN/bin/$TARGET-strip
-
-# export BUILD_AR=$AR
-# export BUILD_AS=$AS
-# export BUILD_CC=$CC
-# export BUILD_CXX=$CXX
-# export BUILD_LD=$LD
-# export BUILD_RANLIB=$RANLIB
-# export BUILD_STRIP=$STRIP

tarjdk.sh

@@ -1,4 +1,4 @@
 #!/bin/bash
 set -e
 cd jreout
-tar cJf ../jre.tar.xz .
+tar cJf ../jre-${TARGET_SHORT}-`date +%Y%m%d`.tar.xz .