Merge ~vpa1977/ubuntu/+source/openjdk-lts:01_security_release_base into ubuntu/+source/openjdk-lts:ubuntu/devel

[Vladimir Petko]

Please do not merge, this merge proposal is a part in the series [1][2][3]:

Summary of changes:
 - import new upstream release
 - refresh patches

PPA: ppa:vpa1977/openjdk-11-april[4]

Testing:
 - package builds successfully

[1] https://code.launchpad.net/~vpa1977/ubuntu/+source/openjdk-lts/+git/openjdk-lts/+merge/442078
[2] https://code.launchpad.net/~vpa1977/ubuntu/+source/openjdk-lts/+git/openjdk-lts/+merge/442081
[3] https://code.launchpad.net/~vpa1977/ubuntu/+source/openjdk-lts/+git/openjdk-lts/+merge/442082
[4] https://launchpad.net/~vpa1977/+archive/ubuntu/openjdk-11-april

[Graham Inggs (ginggs)]

review: Approve

diff --git a/debian/changelog b/debian/changelog
index 9ab7e64..60120cf 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,14 @@
+openjdk-lts (11.0.19+7~us1-0ubuntu1) UNRELEASED; urgency=medium
+
+  * OpenJDK 11.0.19 release, build 7.
+    - CVE-2023-21930, CVE-2023-21967, CVE-2023-21954, CVE-2023-21939,
+      CVE-2023-21938, CVE-2023-21968, CVE-2023-21937.
+    - Release notes:
+      TODO: waiting for announcement
+    - d/p/*: refresh patches.
+
+ -- Vladimir Petko <[e-mail]>  Thu, 20 Apr 2023 14:25:28 +1200
+
 openjdk-lts (11.0.18+10-0ubuntu5) lunar; urgency=medium
 
   * d/control: add jtreg6 dependencies, regenerate control.
diff --git a/debian/patches/8199220.diff b/debian/patches/8199220.diff
index b92cdee..bc7be6b 100644
--- a/debian/patches/8199220.diff
+++ b/debian/patches/8199220.diff
@@ -9,7 +9,7 @@ Reviewed-by: dholmes, stuefe, eosterlund, glaubitz, coleenp
 
 --- a/src/hotspot/share/utilities/debug.hpp
 +++ b/src/hotspot/share/utilities/debug.hpp
-@@ -202,6 +202,7 @@ void warning(const char* format, ...) AT
+@@ -202,6 +202,7 @@
  // use of an array type.
  
  template<bool x> struct STATIC_ASSERT_FAILURE;
diff --git a/debian/patches/Don-t-optimize-fdlibm-fork-for-Zero-on-linux-sparc-Z.patch b/debian/patches/Don-t-optimize-fdlibm-fork-for-Zero-on-linux-sparc-Z.patch
index d80f413..6f1d7ee 100644
--- a/debian/patches/Don-t-optimize-fdlibm-fork-for-Zero-on-linux-sparc-Z.patch
+++ b/debian/patches/Don-t-optimize-fdlibm-fork-for-Zero-on-linux-sparc-Z.patch
@@ -9,7 +9,7 @@ Subject: [PATCH] Don't optimize fdlibm-fork for Zero on linux-sparc (Zero)
 
 --- a/make/hotspot/lib/JvmOverrideFiles.gmk
 +++ b/make/hotspot/lib/JvmOverrideFiles.gmk
-@@ -48,6 +48,15 @@ LIBJVM_FDLIBM_COPY_OPT_FLAG := $(CXX_O_F
+@@ -48,6 +48,15 @@
  # by using -ffp-contract=off on GCC/Clang platforms.
  ifneq ($(FDLIBM_CFLAGS), )
    LIBJVM_FDLIBM_COPY_OPT_FLAG := $(CXX_O_FLAG_NORM)
@@ -24,4 +24,4 @@ Subject: [PATCH] Don't optimize fdlibm-fork for Zero on linux-sparc (Zero)
 +  endif
  endif
  
- ifeq ($(OPENJDK_TARGET_OS), linux)
+ ifeq ($(call isTargetOs, linux), true)
diff --git a/debian/patches/atk-wrapper-security.diff b/debian/patches/atk-wrapper-security.diff
index b12072d..a4e5333 100644
--- a/debian/patches/atk-wrapper-security.diff
+++ b/debian/patches/atk-wrapper-security.diff
@@ -1,8 +1,6 @@
-Index: b/src/java.base/share/conf/security/java.security
-===================================================================
 --- a/src/java.base/share/conf/security/java.security
 +++ b/src/java.base/share/conf/security/java.security
-@@ -316,6 +316,7 @@ keystore.type.compat=true
+@@ -316,6 +316,7 @@
  #
  package.access=sun.misc.,\
                 sun.reflect.,\
diff --git a/debian/patches/default-jvm-cfg.diff b/debian/patches/default-jvm-cfg.diff
index dd2df79..342ce80 100644
--- a/debian/patches/default-jvm-cfg.diff
+++ b/debian/patches/default-jvm-cfg.diff
@@ -1,6 +1,6 @@
 --- a/src/java.base/share/native/libjli/java.c
 +++ b/src/java.base/share/native/libjli/java.c
-@@ -2067,7 +2067,7 @@ jint
+@@ -2067,7 +2067,7 @@
  ReadKnownVMs(const char *jvmCfgName, jboolean speculative)
  {
      FILE *jvmCfg;
@@ -9,7 +9,7 @@
      int cnt = 0;
      int lineno = 0;
      jlong start = 0, end = 0;
-@@ -2082,6 +2082,11 @@ ReadKnownVMs(const char *jvmCfgName, jbo
+@@ -2082,6 +2082,11 @@
  
      jvmCfg = fopen(jvmCfgName, "r");
      if (jvmCfg == NULL) {
diff --git a/debian/patches/disable-doclint-by-default.diff b/debian/patches/disable-doclint-by-default.diff
index 9813ca8..6f4a737 100644
--- a/debian/patches/disable-doclint-by-default.diff
+++ b/debian/patches/disable-doclint-by-default.diff
@@ -1,8 +1,6 @@
-Index: b/src/jdk.javadoc/share/classes/jdk/javadoc/internal/doclets/toolkit/WorkArounds.java
-===================================================================
 --- a/src/jdk.javadoc/share/classes/jdk/javadoc/internal/doclets/toolkit/WorkArounds.java
 +++ b/src/jdk.javadoc/share/classes/jdk/javadoc/internal/doclets/toolkit/WorkArounds.java
-@@ -126,7 +126,7 @@ public class WorkArounds {
+@@ -126,7 +126,7 @@
          }
  
          if (!msgOptionSeen) {
diff --git a/debian/patches/dnd-files.diff b/debian/patches/dnd-files.diff
index bbc7b9e..0e6b09b 100644
--- a/debian/patches/dnd-files.diff
+++ b/debian/patches/dnd-files.diff
@@ -1,8 +1,6 @@
-Index: b/src/java.desktop/unix/classes/sun/awt/X11/XDataTransferer.java
-===================================================================
 --- a/src/java.desktop/unix/classes/sun/awt/X11/XDataTransferer.java
 +++ b/src/java.desktop/unix/classes/sun/awt/X11/XDataTransferer.java
-@@ -273,14 +273,14 @@ public class XDataTransferer extends Dat
+@@ -273,14 +273,14 @@
               BufferedReader reader = new BufferedReader(isr)) {
              String line;
              ArrayList<URI> uriList = new ArrayList<>();
diff --git a/debian/patches/hotspot-libpath.diff b/debian/patches/hotspot-libpath.diff
index caf7616..62690e7 100644
--- a/debian/patches/hotspot-libpath.diff
+++ b/debian/patches/hotspot-libpath.diff
@@ -28,15 +28,15 @@
  #define SYS_EXT_DIR     "/usr/java/packages"
 --- a/make/hotspot/lib/CompileJvm.gmk
 +++ b/make/hotspot/lib/CompileJvm.gmk
-@@ -131,6 +131,11 @@
-   endif
- endif
+@@ -84,6 +84,11 @@
+ ################################################################################
+ # Platform specific setup
  
 +DEB_MULTIARCH := $(shell dpkg-architecture -qDEB_HOST_MULTIARCH 2>/dev/null || true)
 +ifneq (,$(DEB_MULTIARCH))
-+JVM_CFLAGS += -DDEB_MULTIARCH="\"$(DEB_MULTIARCH)\""
++  JVM_CFLAGS += -DDEB_MULTIARCH="\"$(DEB_MULTIARCH)\""
 +endif
 +
- ifeq ($(OPENJDK_TARGET_OS), windows)
-   ifeq ($(OPENJDK_TARGET_CPU_BITS), 64)
-     RC_DESC := 64-Bit$(SPACE)
+ # ARM source selection
+ 
+ ifeq ($(call And, $(call isTargetOs, linux) $(call isTargetCpu, arm)), true)
diff --git a/debian/patches/icc_loading_with_symlink.diff b/debian/patches/icc_loading_with_symlink.diff
index 8cb7140..664e0ab 100644
--- a/debian/patches/icc_loading_with_symlink.diff
+++ b/debian/patches/icc_loading_with_symlink.diff
@@ -1,6 +1,6 @@
 --- a/src/java.desktop/share/classes/java/awt/color/ICC_Profile.java
 +++ b/src/java.desktop/share/classes/java/awt/color/ICC_Profile.java
-@@ -1753,9 +1753,6 @@ public class ICC_Profile implements Seri
+@@ -1753,9 +1753,6 @@
                      dir = st.nextToken();
                          fullPath = dir + File.separatorChar + fileName;
                      f = new File(fullPath);
@@ -10,7 +10,7 @@
                  }
              }
  
-@@ -1795,26 +1792,6 @@ public class ICC_Profile implements Seri
+@@ -1795,26 +1792,6 @@
      }
  
      /**
diff --git a/debian/patches/icedtea-override-redirect-compiz.diff b/debian/patches/icedtea-override-redirect-compiz.diff
index 64f31a6..fe5da60 100644
--- a/debian/patches/icedtea-override-redirect-compiz.diff
+++ b/debian/patches/icedtea-override-redirect-compiz.diff
@@ -1,8 +1,6 @@
-Index: b/src/java.desktop/unix/classes/sun/awt/X11/XWindowPeer.java
-===================================================================
 --- a/src/java.desktop/unix/classes/sun/awt/X11/XWindowPeer.java
 +++ b/src/java.desktop/unix/classes/sun/awt/X11/XWindowPeer.java
-@@ -1260,6 +1260,7 @@ class XWindowPeer extends XPanelPeer imp
+@@ -1260,6 +1260,7 @@
  
      boolean isOverrideRedirect() {
          return XWM.getWMID() == XWM.OPENLOOK_WM ||
diff --git a/debian/patches/jdk-getAccessibleValue.diff b/debian/patches/jdk-getAccessibleValue.diff
index 80b6907..e1daf8f 100644
--- a/debian/patches/jdk-getAccessibleValue.diff
+++ b/debian/patches/jdk-getAccessibleValue.diff
@@ -1,6 +1,6 @@
 --- a/src/java.desktop/share/classes/javax/swing/JTree.java
 +++ b/src/java.desktop/share/classes/javax/swing/JTree.java
-@@ -5063,7 +5063,7 @@ public class JTree extends JComponent im
+@@ -5063,7 +5063,7 @@
              public AccessibleSelection getAccessibleSelection() {
                  AccessibleContext ac = getCurrentAccessibleContext();
                  if (ac != null && isLeaf) {
@@ -9,7 +9,7 @@
                  } else {
                      return this;
                  }
-@@ -5078,7 +5078,7 @@ public class JTree extends JComponent im
+@@ -5078,7 +5078,7 @@
              public AccessibleText getAccessibleText() {
                  AccessibleContext ac = getCurrentAccessibleContext();
                  if (ac != null) {
@@ -18,7 +18,7 @@
                  } else {
                      return null;
                  }
-@@ -5093,7 +5093,7 @@ public class JTree extends JComponent im
+@@ -5093,7 +5093,7 @@
              public AccessibleValue getAccessibleValue() {
                  AccessibleContext ac = getCurrentAccessibleContext();
                  if (ac != null) {
@@ -29,7 +29,7 @@
                  }
 --- a/src/java.desktop/share/classes/javax/swing/table/JTableHeader.java
 +++ b/src/java.desktop/share/classes/javax/swing/table/JTableHeader.java
-@@ -1114,7 +1114,12 @@ public class JTableHeader extends JCompo
+@@ -1114,7 +1114,12 @@
              }
  
              public AccessibleAction getAccessibleAction() {
@@ -43,7 +43,7 @@
              }
  
             /**
-@@ -1130,15 +1135,30 @@ public class JTableHeader extends JCompo
+@@ -1130,15 +1135,30 @@
              }
  
              public AccessibleSelection getAccessibleSelection() {
@@ -79,7 +79,7 @@
  
 --- a/src/java.desktop/share/classes/javax/swing/JTable.java
 +++ b/src/java.desktop/share/classes/javax/swing/JTable.java
-@@ -9165,7 +9165,12 @@ public class JTable extends JComponent i
+@@ -9165,7 +9165,12 @@
               * @return the <code>AccessibleAction</code>, or <code>null</code>
               */
              public AccessibleAction getAccessibleAction() {
@@ -93,7 +93,7 @@
              }
  
              /**
-@@ -9187,7 +9192,12 @@ public class JTable extends JComponent i
+@@ -9187,7 +9192,12 @@
               *    <code>null</code>
               */
              public AccessibleSelection getAccessibleSelection() {
@@ -107,7 +107,7 @@
              }
  
              /**
-@@ -9197,7 +9207,12 @@ public class JTable extends JComponent i
+@@ -9197,7 +9207,12 @@
               * @return the <code>AccessibleText</code>, or <code>null</code>
               */
              public AccessibleText getAccessibleText() {
@@ -121,7 +121,7 @@
              }
  
              /**
-@@ -9207,7 +9222,12 @@ public class JTable extends JComponent i
+@@ -9207,7 +9222,12 @@
               * @return the <code>AccessibleValue</code>, or <code>null</code>
               */
              public AccessibleValue getAccessibleValue() {
@@ -137,7 +137,7 @@
  
 --- a/src/jdk.accessibility/windows/classes/com/sun/java/accessibility/internal/AccessBridge.java
 +++ b/src/jdk.accessibility/windows/classes/com/sun/java/accessibility/internal/AccessBridge.java
-@@ -6549,7 +6549,7 @@ final public class AccessBridge {
+@@ -6549,7 +6549,7 @@
          public AccessibleSelection getAccessibleSelection() {
              AccessibleContext ac = getCurrentAccessibleContext();
              if (ac != null && isLeaf) {
@@ -146,7 +146,7 @@
              } else {
                  return this;
              }
-@@ -6564,7 +6564,7 @@ final public class AccessBridge {
+@@ -6564,7 +6564,7 @@
          public AccessibleText getAccessibleText() {
              AccessibleContext ac = getCurrentAccessibleContext();
              if (ac != null) {
@@ -155,7 +155,7 @@
              } else {
                  return null;
              }
-@@ -6579,7 +6579,7 @@ final public class AccessBridge {
+@@ -6579,7 +6579,7 @@
          public AccessibleValue getAccessibleValue() {
              AccessibleContext ac = getCurrentAccessibleContext();
              if (ac != null) {
diff --git a/debian/patches/jdk-i18n-pt_BR.diff b/debian/patches/jdk-i18n-pt_BR.diff
index 7c561f2..fde9fd8 100644
--- a/debian/patches/jdk-i18n-pt_BR.diff
+++ b/debian/patches/jdk-i18n-pt_BR.diff
@@ -1,8 +1,6 @@
-Index: b/src/java.desktop/share/classes/sun/awt/resources/awt_pt_BR.properties
-===================================================================
 --- a/src/java.desktop/share/classes/sun/awt/resources/awt_pt_BR.properties
 +++ b/src/java.desktop/share/classes/sun/awt/resources/awt_pt_BR.properties
-@@ -13,7 +13,7 @@ AWT.altGraph=Alt Graph
+@@ -13,7 +13,7 @@
  # Key names
  AWT.enter=Enter
  AWT.backSpace=Backspace
diff --git a/debian/patches/jexec.diff b/debian/patches/jexec.diff
index 8f56d30..c160b90 100644
--- a/debian/patches/jexec.diff
+++ b/debian/patches/jexec.diff
@@ -1,6 +1,6 @@
 --- a/src/java.base/unix/native/launcher/jexec.c
 +++ b/src/java.base/unix/native/launcher/jexec.c
-@@ -168,9 +168,10 @@ int main(int argc, const char * argv[])
+@@ -168,9 +168,10 @@
  
      /* Get the path to the java binary, which is in a known position relative
       * to our current position, which is in argv[0]. */
@@ -14,17 +14,17 @@
          errorExit(errno, BAD_ARG_MSG);
 --- a/make/launcher/Launcher-java.base.gmk
 +++ b/make/launcher/Launcher-java.base.gmk
-@@ -57,6 +57,9 @@ $(eval $(call SetupBuildLauncher, keytoo
+@@ -57,6 +57,9 @@
  ################################################################################
  
- ifeq ($(OPENJDK_TARGET_OS), linux)
+ ifeq ($(call isTargetOs, linux), true)
 +  ifeq (,$(DEBIAN_JDK_BASE_DIR))
 +    $(error DEBIAN_JDK_BASE_DIR must be defined for jexec build)
 +  endif
    $(eval $(call SetupJdkExecutable, BUILD_JEXEC, \
        NAME := jexec, \
        SRC := $(TOPDIR)/src/$(MODULE)/unix/native/launcher, \
-@@ -64,7 +67,7 @@ ifeq ($(OPENJDK_TARGET_OS), linux)
+@@ -64,7 +67,7 @@
        OPTIMIZATION := LOW, \
        CFLAGS := $(CFLAGS_JDKEXE) \
            -I$(TOPDIR)/src/$(MODULE)/share/native/libjli, \
diff --git a/debian/patches/keep-gtk2-as-default.patch b/debian/patches/keep-gtk2-as-default.patch
index 6ed0131..7db75dc 100644
--- a/debian/patches/keep-gtk2-as-default.patch
+++ b/debian/patches/keep-gtk2-as-default.patch
@@ -25,9 +25,8 @@ This patch header follows DEP-3: http://dep.debian.net/deps/dep3/
 8198649: Switch AWT/Swing's default GTK version to 3
 Reviewed-by: psadhukhan, kaddepalli
 
-diff -r 79f6a4dc221e -r 3e3696a308e1 src/java.desktop/unix/native/libawt_xawt/awt/gtk_interface.c
---- a/src/java.desktop/unix/native/libawt_xawt/awt/gtk_interface.c	Mon Mar 19 10:46:31 2018 -0700
-+++ b/src/java.desktop/unix/native/libawt_xawt/awt/gtk_interface.c	Mon Mar 19 11:29:50 2018 -0700
+--- a/src/java.desktop/unix/native/libawt_xawt/awt/gtk_interface.c
++++ b/src/java.desktop/unix/native/libawt_xawt/awt/gtk_interface.c
 @@ -45,18 +45,18 @@
  
  static GtkLib gtk_libs[] = {
@@ -54,4 +53,3 @@ diff -r 79f6a4dc221e -r 3e3696a308e1 src/java.desktop/unix/native/libawt_xawt/aw
      }
  };
  
-
diff --git a/debian/patches/ldap-timeout-test-use-ip.patch b/debian/patches/ldap-timeout-test-use-ip.patch
index 3e40bd7..fd61a86 100644
--- a/debian/patches/ldap-timeout-test-use-ip.patch
+++ b/debian/patches/ldap-timeout-test-use-ip.patch
@@ -14,6 +14,6 @@ Last-Update: 2023-03-27
 +        // there should not be a LDAP provider on multicast address, but
 +        // network stack should be able to send to it
 +        env.put(Context.PROVIDER_URL, "ldap://224.0.0.0:1234");
-
+ 
          try {
              futures.add(executorService.submit(() -> { attemptConnect(env); return null; }));
diff --git a/debian/patches/libpcsclite-dlopen.diff b/debian/patches/libpcsclite-dlopen.diff
index 39261af..06781b2 100644
--- a/debian/patches/libpcsclite-dlopen.diff
+++ b/debian/patches/libpcsclite-dlopen.diff
@@ -1,8 +1,6 @@
-Index: b/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java
-===================================================================
 --- a/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java
 +++ b/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC.java
-@@ -48,6 +48,7 @@ class PlatformPCSC {
+@@ -48,6 +48,7 @@
  
      private final static String PROP_NAME = "sun.security.smartcardio.library";
  
@@ -10,7 +8,7 @@ Index: b/src/java.smartcardio/unix/classes/sun/security/smartcardio/PlatformPCSC
      private final static String LIB1 = "/usr/$LIBISA/libpcsclite.so";
      private final static String LIB2 = "/usr/local/$LIBISA/libpcsclite.so";
      private final static String PCSC_FRAMEWORK = "/System/Library/Frameworks/PCSC.framework/Versions/Current/PCSC";
-@@ -104,22 +105,9 @@ class PlatformPCSC {
+@@ -104,22 +105,9 @@
          if (lib.length() != 0) {
              return lib;
          }
diff --git a/debian/patches/log-generated-classes-test.patch b/debian/patches/log-generated-classes-test.patch
index 849de17..6914651 100644
--- a/debian/patches/log-generated-classes-test.patch
+++ b/debian/patches/log-generated-classes-test.patch
@@ -7,7 +7,7 @@ Forwarded: not-needed
 Last-Update: 2023-03-27
 --- a/test/jdk/java/lang/invoke/lambda/LogGeneratedClassesTest.java
 +++ b/test/jdk/java/lang/invoke/lambda/LogGeneratedClassesTest.java
-@@ -195,14 +195,21 @@
+@@ -191,14 +191,21 @@
  
      @Test
      public void testDumpDirNotWritable() throws IOException {
diff --git a/debian/patches/multiple-pkcs11-library-init.diff b/debian/patches/multiple-pkcs11-library-init.diff
index aec9f96..bd2322b 100644
--- a/debian/patches/multiple-pkcs11-library-init.diff
+++ b/debian/patches/multiple-pkcs11-library-init.diff
@@ -15,7 +15,7 @@ Allow multiple PKCS11 library initialisation to be a non-critical error.
  
      // same as allowSingleThreadedModules but controlled via a system property
      // and applied to all providers. if set to false, no SunPKCS11 instances
-@@ -1026,6 +1027,8 @@
+@@ -1030,6 +1031,8 @@
              handleStartupErrors = ERR_IGNORE_LIB;
          } else if (val.equals("halt")) {
              handleStartupErrors = ERR_HALT;
diff --git a/debian/patches/reproducible-build-user.diff b/debian/patches/reproducible-build-user.diff
index 60c7a7b..6732df5 100644
--- a/debian/patches/reproducible-build-user.diff
+++ b/debian/patches/reproducible-build-user.diff
@@ -3,12 +3,12 @@ Author: Emmanuel Bourg <[e-mail]>
 Forwarded: no
 --- a/make/autoconf/basic.m4
 +++ b/make/autoconf/basic.m4
-@@ -100,7 +100,7 @@ AC_DEFUN_ONCE([BASIC_SETUP_PATHS],
-
+@@ -100,7 +100,7 @@
+ 
    # Setup username (for use in adhoc version strings etc)
    # Outer [ ] to quote m4.
 -  [ USERNAME=`$ECHO "$USER" | $TR -d -c '[a-z][A-Z][0-9]'` ]
 +  [ USERNAME="unknown" ]
    AC_SUBST(USERNAME)
  ])
-
+ 
diff --git a/debian/patches/reproducible-character-data.diff b/debian/patches/reproducible-character-data.diff
index 93412a0..c029535 100644
--- a/debian/patches/reproducible-character-data.diff
+++ b/debian/patches/reproducible-character-data.diff
@@ -3,7 +3,7 @@ Author: Emmanuel Bourg <[e-mail]>
 Forwarded: no
 --- a/make/jdk/src/classes/build/tools/generatecharacter/GenerateCharacter.java
 +++ b/make/jdk/src/classes/build/tools/generatecharacter/GenerateCharacter.java
-@@ -693,7 +693,7 @@ OUTER:  for (int i = 0; i < n; i += m) {
+@@ -693,7 +693,7 @@
          PrintWriter out = new PrintWriter(new BufferedWriter(new FileWriter(theOutputFileName)));
          out.println(commentStart +
              " This file was generated AUTOMATICALLY from a template file " +
@@ -12,7 +12,7 @@ Forwarded: no
          int marklen = commandMarker.length();
          LOOP: while(true) {
              try {
-@@ -1819,7 +1819,8 @@ OUTER:  for (int i = 0; i < n; i += m) {
+@@ -1819,7 +1819,8 @@
          }
          commentStart = (Csyntax ? "/*" : "//");
          commentEnd = (Csyntax ? " */" : "");
@@ -20,5 +20,5 @@ Forwarded: no
 +        commandLineDescription = desc.toString().replace("\\", "\\\\")
 +            .replace(System.getProperty("user.dir").replace("make/gensrc", ""), "");
      }
-
+ 
      private static void searchBins(long[] map, int binsOccupied) throws Exception {
diff --git a/debian/patches/reproducible-copyright-headers.diff b/debian/patches/reproducible-copyright-headers.diff
index 6a91c5a..020e3bf 100644
--- a/debian/patches/reproducible-copyright-headers.diff
+++ b/debian/patches/reproducible-copyright-headers.diff
@@ -11,7 +11,7 @@ Forwarded: no
  import java.util.GregorianCalendar;
  import java.util.Locale;
  import java.util.TimeZone;
-@@ -150,8 +151,14 @@ class CopyrightHeaders {
+@@ -150,8 +151,14 @@
      }
  
      private static int getYear() {
@@ -30,7 +30,7 @@ Forwarded: no
      // no instantiation
 --- a/make/jdk/src/classes/build/tools/generatelsrequivmaps/EquivMapsGenerator.java
 +++ b/make/jdk/src/classes/build/tools/generatelsrequivmaps/EquivMapsGenerator.java
-@@ -34,9 +34,13 @@ import java.time.ZoneId;
+@@ -34,9 +34,13 @@
  import java.time.ZonedDateTime;
  import java.util.ArrayList;
  import java.util.Arrays;
@@ -44,7 +44,7 @@ Forwarded: no
  import java.util.TreeMap;
  import java.util.stream.Collectors;
  
-@@ -246,8 +250,15 @@ public class EquivMapsGenerator {
+@@ -246,8 +250,15 @@
          + "}";
  
      private static String getOpenJDKCopyright() {
diff --git a/debian/patches/reproducible-module-info.diff b/debian/patches/reproducible-module-info.diff
index 8c85fb1..487acf0 100644
--- a/debian/patches/reproducible-module-info.diff
+++ b/debian/patches/reproducible-module-info.diff
@@ -3,7 +3,7 @@ Author: Emmanuel Bourg <[e-mail]>
 Forwarded: no
 --- a/make/jdk/src/classes/build/tools/module/GenModuleInfoSource.java
 +++ b/make/jdk/src/classes/build/tools/module/GenModuleInfoSource.java
-@@ -154,9 +154,10 @@ public class GenModuleInfoSource {
+@@ -154,9 +154,10 @@
                  if (l.trim().startsWith("module ")) {
                      if (debug) {
                          // print URI rather than file path to avoid escape
diff --git a/debian/patches/riscv64.diff b/debian/patches/riscv64.diff
index 218aa5d..1ec5fd8 100644
--- a/debian/patches/riscv64.diff
+++ b/debian/patches/riscv64.diff
@@ -21,7 +21,7 @@ Reviewed-by: aph, erikj, ehelin, ihse
 +fi
 +
  DIR=`dirname $0`
- OUT=`. $DIR/autoconf-config.guess`
+ OUT=`. $DIR/autoconf-config.guess 2> /dev/null`
  
 --- a/make/autoconf/build-aux/config.sub
 +++ b/make/autoconf/build-aux/config.sub
diff --git a/debian/patches/s390x-thread-stack-size.diff b/debian/patches/s390x-thread-stack-size.diff
index 6308b10..d7dddb9 100644
--- a/debian/patches/s390x-thread-stack-size.diff
+++ b/debian/patches/s390x-thread-stack-size.diff
@@ -14,17 +14,17 @@
  #endif // _LP64
 --- a/make/autoconf/boot-jdk.m4
 +++ b/make/autoconf/boot-jdk.m4
-@@ -459,6 +459,9 @@ AC_DEFUN_ONCE([BOOTJDK_SETUP_BOOT_JDK_ARGUMENTS],
+@@ -459,6 +459,9 @@
    fi
    UTIL_ADD_JVM_ARG_IF_OK([-Xmx${JVM_MAX_HEAP}M],boot_jdk_jvmargs_big,[$JAVA])
    UTIL_ADD_JVM_ARG_IF_OK([-XX:ThreadStackSize=$STACK_SIZE],boot_jdk_jvmargs_big,[$JAVA])
 +  if test "$VAR_CPU" = s390x; then
 +    UTIL_ADD_JVM_ARG_IF_OK([-Xss1600k],boot_jdk_jvmargs_big,[$JAVA])
 +  fi
-
+ 
    AC_MSG_RESULT([$boot_jdk_jvmargs_big])
-
-@@ -488,6 +491,9 @@ AC_DEFUN_ONCE([BOOTJDK_SETUP_BOOT_JDK_ARGUMENTS],
+ 
+@@ -488,6 +491,9 @@
    UTIL_ADD_JVM_ARG_IF_OK([-XX:+UseSerialGC],boot_jdk_jvmargs_small,[$JAVA])
    UTIL_ADD_JVM_ARG_IF_OK([-Xms32M],boot_jdk_jvmargs_small,[$JAVA])
    UTIL_ADD_JVM_ARG_IF_OK([-Xmx512M],boot_jdk_jvmargs_small,[$JAVA])
@@ -32,11 +32,11 @@
 +    UTIL_ADD_JVM_ARG_IF_OK([-Xss1600k],boot_jdk_jvmargs_small,[$JAVA])
 +  fi
    UTIL_ADD_JVM_ARG_IF_OK([-XX:TieredStopAtLevel=1],boot_jdk_jvmargs_small,[$JAVA])
-
+ 
    AC_MSG_RESULT([$boot_jdk_jvmargs_small])
 --- a/make/autoconf/build-performance.m4
 +++ b/make/autoconf/build-performance.m4
-@@ -443,6 +443,9 @@ AC_DEFUN_ONCE([BPERF_SETUP_SMART_JAVAC],
+@@ -443,6 +443,9 @@
      MX_VALUE=512
    fi
    UTIL_ADD_JVM_ARG_IF_OK([-Xms${MS_VALUE}M -Xmx${MX_VALUE}M],SJAVAC_SERVER_JAVA_FLAGS,[$SJAVAC_SERVER_JAVA])
@@ -44,5 +44,5 @@
 +    UTIL_ADD_JVM_ARG_IF_OK([-Xss1600k],SJAVAC_SERVER_JAVA_FLAGS,[$SJAVAC_SERVER_JAVA])
 +  fi
    AC_SUBST(SJAVAC_SERVER_JAVA_FLAGS)
-
+ 
    AC_ARG_ENABLE([sjavac], [AS_HELP_STRING([--enable-sjavac],
diff --git a/debian/patches/system-pcsclite.diff b/debian/patches/system-pcsclite.diff
index 09b4ad8..5b6df31 100644
--- a/debian/patches/system-pcsclite.diff
+++ b/debian/patches/system-pcsclite.diff
@@ -52,7 +52,7 @@
 +])
 --- a/make/autoconf/spec.gmk.in
 +++ b/make/autoconf/spec.gmk.in
-@@ -776,6 +776,7 @@
+@@ -780,6 +780,7 @@
  ENABLE_INTREE_EC:=@ENABLE_INTREE_EC@
  USE_EXTERNAL_LIBJPEG:=@USE_EXTERNAL_LIBJPEG@
  USE_EXTERNAL_LIBGIF:=@USE_EXTERNAL_LIBGIF@
diff --git a/debian/patches/test-use-ip-address.patch b/debian/patches/test-use-ip-address.patch
index 02acac7..dbe0843 100644
--- a/debian/patches/test-use-ip-address.patch
+++ b/debian/patches/test-use-ip-address.patch
@@ -17,7 +17,7 @@ Last-Update: 2023-03-27
              NetworkInterface inf = NetworkInterface.getByInetAddress(addr);
 --- a/test/jdk/java/net/InetAddress/getOriginalHostName.java
 +++ b/test/jdk/java/net/InetAddress/getOriginalHostName.java
-@@ -39,7 +39,7 @@
+@@ -40,7 +40,7 @@
          SharedSecrets.getJavaNetInetAddressAccess();
  
      public static void main(String[] args) throws Exception {
diff --git a/debian/patches/update-assertion-for-armhf.patch b/debian/patches/update-assertion-for-armhf.patch
index 582974c..0860a73 100644
--- a/debian/patches/update-assertion-for-armhf.patch
+++ b/debian/patches/update-assertion-for-armhf.patch
@@ -5,7 +5,7 @@ Author: Vladimir Petko <[e-mail]>
 Bug: https://bugs.openjdk.org/browse/JDK-8305480
 --- a/test/hotspot/jtreg/runtime/NMT/VirtualAllocCommitMerge.java
 +++ b/test/hotspot/jtreg/runtime/NMT/VirtualAllocCommitMerge.java
-@@ -320,6 +320,6 @@
+@@ -321,6 +321,6 @@
      public static void checkCommitted(OutputAnalyzer output, long addr, long size, String sizeString) {
          output.shouldMatch("\\[0x[0]*" + Long.toHexString(addr) + " - 0x[0]*"
                             + Long.toHexString(addr + size)
diff --git a/debian/patches/update-permission-test.patch b/debian/patches/update-permission-test.patch
index d1437d5..f7a503c 100644
--- a/debian/patches/update-permission-test.patch
+++ b/debian/patches/update-permission-test.patch
@@ -4,7 +4,7 @@ Author: Vladimir Petko <[e-mail]>
 Last-Update: 2023-03-24
 --- a/test/jdk/java/lang/ProcessHandle/PermissionTest.java
 +++ b/test/jdk/java/lang/ProcessHandle/PermissionTest.java
-@@ -219,6 +219,7 @@
+@@ -216,6 +216,7 @@
          permissions.add(new PropertyPermission("testng.mode.dryrun", "read"));
          permissions.add(new PropertyPermission("testng.report.xml.name", "read"));
          permissions.add(new PropertyPermission("testng.timezone", "read"));
@@ -14,7 +14,7 @@ Last-Update: 2023-03-24
      }
 --- a/test/jdk/java/sql/testng/util/TestPolicy.java
 +++ b/test/jdk/java/sql/testng/util/TestPolicy.java
-@@ -114,6 +114,8 @@
+@@ -113,6 +113,8 @@
          permissions.add(new PropertyPermission("testng.mode.dryrun", "read"));
          permissions.add(new PropertyPermission("testng.report.xml.name", "read"));
          permissions.add(new PropertyPermission("testng.timezone", "read"));
diff --git a/doc/building.html b/doc/building.html
index 7d6f18c..842e7fa 100644
--- a/doc/building.html
+++ b/doc/building.html
@@ -1,19 +1,24 @@
 <!DOCTYPE html>
-<html>
+<html xmlns="http://www.w3.org/1999/xhtml" lang="" xml:lang="">
 <head>
-  <meta charset="utf-8">
-  <meta name="generator" content="pandoc">
-  <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes">
+  <meta charset="utf-8" />
+  <meta name="generator" content="pandoc" />
+  <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" />
   <title>Building the JDK</title>
-  <style type="text/css">code{white-space: pre;}</style>
-  <link rel="stylesheet" href="../make/data/docs-resources/resources/jdk-default.css">
+  <style type="text/css">
+      code{white-space: pre-wrap;}
+      span.smallcaps{font-variant: small-caps;}
+      span.underline{text-decoration: underline;}
+      div.column{display: inline-block; vertical-align: top; width: 50%;}
+  </style>
+  <link rel="stylesheet" href="../make/data/docs-resources/resources/jdk-default.css" />
   <!--[if lt IE 9]>
     <script src="//cdnjs.cloudflare.com/ajax/libs/html5shiv/3.7.3/html5shiv-printshiv.min.js"></script>
   <![endif]-->
   <style type="text/css">pre, code, tt { color: #1d6ae5; }</style>
 </head>
 <body>
-<header>
+<header id="title-block-header">
 <h1 class="title">Building the JDK</h1>
 </header>
 <nav id="TOC">
@@ -67,6 +72,9 @@
 <li><a href="#make-control-variables">Make Control Variables</a></li>
 </ul></li>
 <li><a href="#running-tests">Running Tests</a></li>
+<li><a href="#signing">Signing</a><ul>
+<li><a href="#macos-1">macOS</a></li>
+</ul></li>
 <li><a href="#cross-compiling">Cross-compiling</a><ul>
 <li><a href="#cross-compiling-the-easy-way-with-openjdk-devkits">Cross compiling the easy way with OpenJDK devkits</a></li>
 <li><a href="#boot-jdk-and-build-jdk">Boot JDK and Build JDK</a></li>
@@ -234,30 +242,30 @@
 <table>
 <thead>
 <tr class="header">
-<th style="text-align: left;">Operating system</th>
-<th style="text-align: left;">Supported toolchain</th>
+<th>Operating system</th>
+<th>Supported toolchain</th>
 </tr>
 </thead>
 <tbody>
 <tr class="odd">
-<td style="text-align: left;">Linux</td>
-<td style="text-align: left;">gcc, clang</td>
+<td>Linux</td>
+<td>gcc, clang</td>
 </tr>
 <tr class="even">
-<td style="text-align: left;">macOS</td>
-<td style="text-align: left;">Apple Xcode (using clang)</td>
+<td>macOS</td>
+<td>Apple Xcode (using clang)</td>
 </tr>
 <tr class="odd">
-<td style="text-align: left;">Solaris</td>
-<td style="text-align: left;">Oracle Solaris Studio</td>
+<td>Solaris</td>
+<td>Oracle Solaris Studio</td>
 </tr>
 <tr class="even">
-<td style="text-align: left;">AIX</td>
-<td style="text-align: left;">IBM XL C/C++</td>
+<td>AIX</td>
+<td>IBM XL C/C++</td>
 </tr>
 <tr class="odd">
-<td style="text-align: left;">Windows</td>
-<td style="text-align: left;">Microsoft Visual Studio</td>
+<td>Windows</td>
+<td>Microsoft Visual Studio</td>
 </tr>
 </tbody>
 </table>
@@ -265,26 +273,26 @@
 <table>
 <thead>
 <tr class="header">
-<th style="text-align: left;">Operating system</th>
-<th style="text-align: left;">Toolchain version</th>
+<th>Operating system</th>
+<th>Toolchain version</th>
 </tr>
 </thead>
 <tbody>
 <tr class="odd">
-<td style="text-align: left;">Linux</td>
-<td style="text-align: left;">gcc 7.3.0</td>
+<td>Linux</td>
+<td>gcc 7.3.0</td>
 </tr>
 <tr class="even">
-<td style="text-align: left;">macOS</td>
-<td style="text-align: left;">Apple Xcode 9.4 (using clang 9.1.0)</td>
+<td>macOS</td>
+<td>Apple Xcode 9.4 (using clang 9.1.0)</td>
 </tr>
 <tr class="odd">
-<td style="text-align: left;">Solaris</td>
-<td style="text-align: left;">Oracle Solaris Studio 12.4 (with compiler version 5.13)</td>
+<td>Solaris</td>
+<td>Oracle Solaris Studio 12.4 (with compiler version 5.13)</td>
 </tr>
 <tr class="even">
-<td style="text-align: left;">Windows</td>
-<td style="text-align: left;">Microsoft Visual Studio 2017 update 15.9.16</td>
+<td>Windows</td>
+<td>Microsoft Visual Studio 2017 update 15.9.16</td>
 </tr>
 </tbody>
 </table>
@@ -297,9 +305,13 @@
 <p>To use clang instead of gcc on Linux, use <code>--with-toolchain-type=clang</code>.</p>
 <h3 id="apple-xcode">Apple Xcode</h3>
 <p>The oldest supported version of Xcode is 8.</p>
-<p>You will need the Xcode command lines developers tools to be able to build the JDK. (Actually, <em>only</em> the command lines tools are needed, not the IDE.) The simplest way to install these is to run:</p>
+<p>You will need the Xcode command line developer tools to be able to build the JDK. (Actually, <em>only</em> the command line tools are needed, not the IDE.) The simplest way to install these is to run:</p>
 <pre><code>xcode-select --install</code></pre>
-<p>It is advisable to keep an older version of Xcode for building the JDK when updating Xcode. This <a href="http://iosdevelopertips.com/xcode/install-multiple-versions-of-xcode.html">blog page</a> has good suggestions on managing multiple Xcode versions. To use a specific version of Xcode, use <code>xcode-select -s</code> before running <code>configure</code>, or use <code>--with-toolchain-path</code> to point to the version of Xcode to use, e.g. <code>configure --with-toolchain-path=/Applications/Xcode8.app/Contents/Developer/usr/bin</code></p>
+<p>When updating Xcode, it is advisable to keep an older version for building the JDK. To use a specific version of Xcode you have multiple options:</p>
+<ul>
+<li>Use <code>xcode-select -s</code> before running <code>configure</code>, e.g. <code>xcode-select -s /Applications/Xcode13.1.app</code>. The drawback is that the setting is system wide and you may have to revert it after an OpenJDK build.</li>
+<li>Use configure option <code>--with-xcode-path</code>, e.g. <code>configure --with-xcode-path=/Applications/Xcode13.1.app</code> This allows using a specific Xcode version for an OpenJDK build, independently of the active Xcode version by <code>xcode-select</code>.</li>
+</ul>
 <p>If you have recently (inadvertently) updated your OS and/or Xcode version, and the JDK can no longer be built, please see the section on <a href="#problems-with-the-build-environment">Problems with the Build Environment</a>, and <a href="#getting-help">Getting Help</a> to find out if there are any recent, non-merged patches available for this update.</p>
 <h3 id="oracle-solaris-studio">Oracle Solaris Studio</h3>
 <p>The minimum accepted version of the Solaris Studio compilers is 5.13 (corresponding to Solaris Studio 12.4). Older versions will not be accepted by configure.</p>
@@ -362,8 +374,8 @@ CC: Sun C++ 5.13 SunOS_i386 151846-10 2015/10/30</code></pre>
 <h3 id="microsoft-visual-studio">Microsoft Visual Studio</h3>
 <p>The minimum accepted version of Visual Studio is 2010. Older versions will not be accepted by <code>configure</code>. The maximum accepted version of Visual Studio is 2019. Versions older than 2017 are unlikely to continue working for long.</p>
 <p>If you have multiple versions of Visual Studio installed, <code>configure</code> will by default pick the latest. You can request a specific version to be used by setting <code>--with-toolchain-version</code>, e.g. <code>--with-toolchain-version=2015</code>.</p>
-<p>If you have Visual Studio installed but <code>configure</code> fails to detect it, it may be because of <a href="#spaces-in-path">spaces in path</a>.</p>
 <p>If you get <code>LINK: fatal error LNK1123: failure during conversion to COFF: file invalid</code> when building using Visual Studio 2010, you have encountered <a href="http://support.microsoft.com/kb/2757355">KB2757355</a>, a bug triggered by a specific installation order. However, the solution suggested by the KB article does not always resolve the problem. See <a href="https://stackoverflow.com/questions/10888391">this stackoverflow discussion</a> for other suggestions.</p>
+<p>If you have Visual Studio installed but <code>configure</code> fails to detect it, it may be because of <a href="#spaces-in-path">spaces in path</a>.</p>
 <h3 id="ibm-xl-cc">IBM XL C/C++</h3>
 <p>The regular builds by SAP is using version 12.1, described as <code>IBM XL C/C++ for AIX, V12.1 (5765-J02, 5725-C72) Version: 12.01.0000.0017</code>.</p>
 <p>See the <a href="http://cr.openjdk.java.net/~simonis/ppc-aix-port">OpenJDK PowerPC Port Status Page</a> for details.</p>
@@ -403,7 +415,7 @@ CC: Sun C++ 5.13 SunOS_i386 151846-10 2015/10/30</code></pre>
 <ul>
 <li>To install on an apt-based Linux, try running <code>sudo apt-get install libx11-dev libxext-dev libxrender-dev libxtst-dev libxt-dev</code>.</li>
 <li>To install on an rpm-based Linux, try running <code>sudo yum install libXtst-devel libXt-devel libXrender-devel libXi-devel</code>.</li>
-<li>To install on Alpine Linux, try running <code>sudo apk add libx11-dev libxext-dev libxrender-dev libxtst-dev libxt-dev</code>.</li>
+<li>To install on Alpine Linux, try running <code>sudo apk add libx11-dev libxext-dev libxrender-dev libxrandr-dev libxtst-dev libxt-dev</code>.</li>
 <li>To install on Solaris, try running <code>pkg install x11/header/x11-protocols x11/library/libice x11/library/libpthread-stubs x11/library/libsm x11/library/libx11 x11/library/libxau x11/library/libxcb x11/library/libxdmcp x11/library/libxevie x11/library/libxext x11/library/libxrender x11/library/libxscrnsaver x11/library/libxtst x11/library/toolkit/libxt</code>.</li>
 </ul>
 <p>Use <code>--with-x=&lt;path&gt;</code> if <code>configure</code> does not properly locate your X11 files.</p>
@@ -553,7 +565,7 @@ CC: Sun C++ 5.13 SunOS_i386 151846-10 2015/10/30</code></pre>
 <li><code>CONF</code> and <code>CONF_NAME</code> - Selecting the configuration(s) to use. See <a href="#using-multiple-configurations">Using Multiple Configurations</a></li>
 </ul>
 <h4 id="test-make-control-variables">Test Make Control Variables</h4>
-<p>These make control variables only make sense when running tests. Please see <a href="testing.html">Testing the JDK</a> for details.</p>
+<p>These make control variables only make sense when running tests. Please see <strong>Testing the JDK</strong> (<a href="testing.html">html</a>, <a href="testing.md">markdown</a>) for details.</p>
 <ul>
 <li><code>TEST</code></li>
 <li><code>TEST_JOBS</code></li>
@@ -573,7 +585,13 @@ CC: Sun C++ 5.13 SunOS_i386 151846-10 2015/10/30</code></pre>
 <p>The <a href="https://wiki.openjdk.java.net/display/Adoption">Adoption Group</a> provides recent builds of jtreg <a href="https://adopt-openjdk.ci.cloudbees.com/job/jtreg/lastSuccessfulBuild/artifact">here</a>. Download the latest <code>.tar.gz</code> file, unpack it, and point <code>--with-jtreg</code> to the <code>jtreg</code> directory that you just unpacked.</p>
 <p>To execute the most basic tests (tier 1), use:</p>
 <pre><code>make run-test-tier1</code></pre>
-<p>For more details on how to run tests, please see the <a href="testing.html">Testing the JDK</a> document.</p>
+<p>For more details on how to run tests, please see <strong>Testing the JDK</strong> (<a href="testing.html">html</a>, <a href="testing.md">markdown</a>).</p>
+<h2 id="signing">Signing</h2>
+<h3 id="macos-1">macOS</h3>
+<p>Modern versions of macOS require applications to be signed and notarizied before distribution. See Apple's documentation for more background on what this means and how it works. To help support this, the JDK build can be configured to automatically sign all native binaries, and the JDK bundle, with all the options needed for successful notarization, as well as all the entitlements required by the JDK. To enable <code>hardened</code> signing, use configure parameter <code>--with-macosx-codesign=hardened</code> and configure the signing identity you wish to use with <code>--with-macosx-codesign-identity=&lt;identity&gt;</code>. The identity refers to a signing identity from Apple that needs to be preinstalled on the build host.</p>
+<p>When not signing for distribution with the hardened option, the JDK build will still attempt to perform <code>adhoc</code> signing to add the special entitlement <code>com.apple.security.get-task-allow</code> to each binary. This entitlement is required to be able to dump core files from a process. Note that adding this entitlement makes the build invalid for notarization, so it is only added when signing in <code>debug</code> mode. To explicitly enable this kind of adhoc signing, use configure parameter <code>--with-macosx-codesign=debug</code>. It will be enabled by default in most cases.</p>
+<p>It's also possible to completely disable any explicit codesign operations done by the JDK build using the configure parameter <code>--without-macosx-codesign</code>. The exact behavior then depends on the architecture. For macOS on x64, it (at least at the time of this writing) results in completely unsigned binaries that should still work fine for development and debugging purposes. On aarch64, the Xcode linker will apply a default &quot;adhoc&quot; signing, without any entitlements. Such a build does not allow dumping core files.</p>
+<p>The default mode &quot;auto&quot; will try for <code>hardened</code> signing if the debug level is <code>release</code> and either the default identity or the specified identity is valid. If hardened isn't possible, then <code>debug</code> signing is chosen if it works. If nothing works, the codesign build step is disabled.</p>
 <h2 id="cross-compiling">Cross-compiling</h2>
 <p>Cross-compiling means using one platform (the <em>build</em> platform) to generate output that can ran on another platform (the <em>target</em> platform).</p>
 <p>The typical reason for cross-compiling is that the build is performed on a more powerful desktop computer, but the resulting binaries will be able to run on a different, typically low-performing system. Most of the complications that arise when building for embedded is due to this separation of <em>build</em> and <em>target</em> systems.</p>
@@ -645,11 +663,13 @@ x86_64-linux-gnu-to-ppc64le-linux-gnu</code></pre>
 <p>Note that alsa is needed even if you only want to build a headless JDK.</p>
 <ul>
 <li><p>Go to <a href="https://www.debian.org/distrib/packages">Debian Package Search</a> and search for the <code>libasound2</code> and <code>libasound2-dev</code> packages for your <em>target</em> system. Download them to /tmp.</p></li>
-<li><p>Install the libraries into the cross-compilation toolchain. For instance:</p>
+<li>Install the libraries into the cross-compilation toolchain. For instance:</li>
+</ul>
 <pre><code>cd /tools/gcc-linaro-arm-linux-gnueabihf-raspbian-2012.09-20120921_linux/arm-linux-gnueabihf/libc
 dpkg-deb -x /tmp/libasound2_1.0.25-4_armhf.deb .
-dpkg-deb -x /tmp/libasound2-dev_1.0.25-4_armhf.deb .</code></pre></li>
-<li><p>If alsa is not properly detected by <code>configure</code>, you can point it out by <code>--with-alsa</code>.</p></li>
+dpkg-deb -x /tmp/libasound2-dev_1.0.25-4_armhf.deb .</code></pre>
+<ul>
+<li>If alsa is not properly detected by <code>configure</code>, you can point it out by <code>--with-alsa</code>.</li>
 </ul>
 <h4 id="x11-1">X11</h4>
 <p>You will need X11 libraries suitable for your <em>target</em> system. For most cases, using Debian's pre-built libraries work fine.</p>
diff --git a/doc/building.md b/doc/building.md
index 55cd791..60d4d73 100644
--- a/doc/building.md
+++ b/doc/building.md
@@ -291,13 +291,13 @@ be able to run on the target platform. In theory, toolchain and operating
 system should be independent factors, but in practice there's more or less a
 one-to-one correlation between target operating system and toolchain.
 
- Operating system   Supported toolchain
- ------------------ -------------------------
- Linux              gcc, clang
- macOS              Apple Xcode (using clang)
- Solaris            Oracle Solaris Studio
- AIX                IBM XL C/C++
- Windows            Microsoft Visual Studio
+| Operating system   | Supported toolchain       |
+| ------------------ | ------------------------- |
+| Linux              | gcc, clang                |
+| macOS              | Apple Xcode (using clang) |
+| Solaris            | Oracle Solaris Studio     |
+| AIX                | IBM XL C/C++              |
+| Windows            | Microsoft Visual Studio   |
 
 Please see the individual sections on the toolchains for version
 recommendations. As a reference, these versions of the toolchains are used, at
@@ -306,12 +306,12 @@ possible to compile the JDK with both older and newer versions, but the closer
 you stay to this list, the more likely you are to compile successfully without
 issues.
 
- Operating system   Toolchain version
- ------------------ -------------------------------------------------------
- Linux              gcc 7.3.0
- macOS              Apple Xcode 9.4 (using clang 9.1.0)
- Solaris            Oracle Solaris Studio 12.4 (with compiler version 5.13)
- Windows            Microsoft Visual Studio 2017 update 15.9.16
+| Operating system   | Toolchain version                                       |
+| ------------------ | ------------------------------------------------------- |
+| Linux              | gcc 7.3.0                                               |
+| macOS              | Apple Xcode 9.4 (using clang 9.1.0)                     |
+| Solaris            | Oracle Solaris Studio 12.4 (with compiler version 5.13) |
+| Windows            | Microsoft Visual Studio 2017 update 15.9.16             |
 
 ### gcc
 
@@ -334,20 +334,20 @@ To use clang instead of gcc on Linux, use `--with-toolchain-type=clang`.
 
 The oldest supported version of Xcode is 8.
 
-You will need the Xcode command lines developers tools to be able to build
-the JDK. (Actually, *only* the command lines tools are needed, not the IDE.)
+You will need the Xcode command line developer tools to be able to build
+the JDK. (Actually, *only* the command line tools are needed, not the IDE.)
 The simplest way to install these is to run:
 ```
 xcode-select --install
 ```
 
-It is advisable to keep an older version of Xcode for building the JDK when
-updating Xcode. This [blog page](
-http://iosdevelopertips.com/xcode/install-multiple-versions-of-xcode.html) has
-good suggestions on managing multiple Xcode versions. To use a specific version
-of Xcode, use `xcode-select -s` before running `configure`, or use
-`--with-toolchain-path` to point to the version of Xcode to use, e.g.
-`configure --with-toolchain-path=/Applications/Xcode8.app/Contents/Developer/usr/bin`
+When updating Xcode, it is advisable to keep an older version for building the JDK.
+To use a specific version of Xcode you have multiple options:
+
+  * Use `xcode-select -s` before running `configure`, e.g. `xcode-select -s /Applications/Xcode13.1.app`. The drawback is that the setting
+    is system wide and you may have to revert it after an OpenJDK build.
+  * Use configure option `--with-xcode-path`, e.g. `configure --with-xcode-path=/Applications/Xcode13.1.app`
+    This allows using a specific Xcode version for an OpenJDK build, independently of the active Xcode version by `xcode-select`.
 
 If you have recently (inadvertently) updated your OS and/or Xcode version, and
 the JDK can no longer be built, please see the section on [Problems with the
@@ -835,7 +835,7 @@ configuration, as opposed to the "configure time" configuration.
 #### Test Make Control Variables
 
 These make control variables only make sense when running tests. Please see
-[Testing the JDK](testing.html) for details.
+**Testing the JDK** ([html](testing.html), [markdown](testing.md)) for details.
 
   * `TEST`
   * `TEST_JOBS`
@@ -873,8 +873,44 @@ To execute the most basic tests (tier 1), use:
 make run-test-tier1
 ```
 
-For more details on how to run tests, please see the [Testing
-the JDK](testing.html) document.
+For more details on how to run tests, please see **Testing the JDK**
+([html](testing.html), [markdown](testing.md)).
+
+## Signing
+
+### macOS
+
+Modern versions of macOS require applications to be signed and notarizied before
+distribution. See Apple's documentation for more background on what this means
+and how it works. To help support this, the JDK build can be configured to
+automatically sign all native binaries, and the JDK bundle, with all the options
+needed for successful notarization, as well as all the entitlements required by
+the JDK. To enable `hardened` signing, use configure parameter
+`--with-macosx-codesign=hardened` and configure the signing identity you wish to
+use with `--with-macosx-codesign-identity=<identity>`. The identity refers to a
+signing identity from Apple that needs to be preinstalled on the build host.
+
+When not signing for distribution with the hardened option, the JDK build will
+still attempt to perform `adhoc` signing to add the special entitlement
+`com.apple.security.get-task-allow` to each binary. This entitlement is required
+to be able to dump core files from a process. Note that adding this entitlement
+makes the build invalid for notarization, so it is only added when signing in
+`debug` mode. To explicitly enable this kind of adhoc signing, use configure
+parameter `--with-macosx-codesign=debug`. It will be enabled by default in most
+cases.
+
+It's also possible to completely disable any explicit codesign operations done
+by the JDK build using the configure parameter `--without-macosx-codesign`.
+The exact behavior then depends on the architecture. For macOS on x64, it (at
+least at the time of this writing) results in completely unsigned binaries that
+should still work fine for development and debugging purposes. On aarch64, the
+Xcode linker will apply a default "adhoc" signing, without any entitlements.
+Such a build does not allow dumping core files.
+
+The default mode "auto" will try for `hardened` signing if the debug level is
+`release` and either the default identity or the specified identity is valid.
+If hardened isn't possible, then `debug` signing is chosen if it works. If
+nothing works, the codesign build step is disabled.
 
 ## Cross-compiling
 
diff --git a/doc/testing.html b/doc/testing.html
index 5943753..96f7408 100644
--- a/doc/testing.html
+++ b/doc/testing.html
@@ -45,7 +45,7 @@
 </nav>
 <h2 id="using-the-run-test-framework">Using the run-test framework</h2>
 <p>This new way of running tests is developer-centric. It assumes that you have built a JDK locally and want to test it. Running common test targets is simple, and more complex ad-hoc combination of tests is possible. The user interface is forgiving, and clearly report errors it cannot resolve.</p>
-<p>The main target “run-test” uses the jdk-image as the tested product. There is also an alternate target “exploded-run-test” that uses the exploded image instead. Not all tests will run successfully on the exploded image, but using this target can greatly improve rebuild times for certain workflows.</p>
+<p>The main target &quot;run-test&quot; uses the jdk-image as the tested product. There is also an alternate target &quot;exploded-run-test&quot; that uses the exploded image instead. Not all tests will run successfully on the exploded image, but using this target can greatly improve rebuild times for certain workflows.</p>
 <p>Some example command-lines:</p>
 <pre><code>$ make run-test-tier1
 $ make run-test-jdk_lang JTREG=&quot;JOBS=8&quot;
@@ -55,7 +55,7 @@ $ make run-test TEST=&quot;hotspot:hotspot_gc&quot; JTREG=&quot;JOBS=1;TIMEOUT=8
 $ make run-test TEST=&quot;jtreg:test/hotspot:hotspot_gc test/hotspot/jtreg/native_sanity/JniVersion.java&quot;
 $ make exploded-run-test TEST=tier2</code></pre>
 <h3 id="configuration">Configuration</h3>
-<p>To be able to run JTReg tests, <code>configure</code> needs to know where to find the JTReg test framework. If it is not picked up automatically by configure, use the <code>--with-jtreg=&lt;path to jtreg home&gt;</code> option to point to the JTReg framework. Note that this option should point to the JTReg home, i.e. the top directory, containing <code>lib/jtreg.jar</code> etc. (An alternative is to set the <code>JT_HOME</code> environment variable to point to the JTReg home before running <code>configure</code>.)</p>
+<p>To be able to run JTReg tests, <code>configure</code> needs to know where to find the JTReg test framework. If it is not picked up automatically by configure, use the <code>--with-jtreg=&lt;path to jtreg home&gt;</code> option to point to the JTReg framework. Note that this option should point to the JTReg home, i.e. the top directory, containing <code>lib/jtreg.jar</code> etc. (An alternative is to set the <code>JT_HOME</code> environment variable to point to the JTReg home before running <code>configure</code>.)</p>
 <h2 id="test-selection">Test selection</h2>
 <p>All functionality is available using the run-test make target. In this use case, the test or tests to be executed is controlled using the <code>TEST</code> variable. To speed up subsequent test runs with no source code changes, run-test-only can be used instead, which do not depend on the source and test image build.</p>
 <p>For some common top-level tests, direct make targets have been generated. This includes all JTReg test groups, the hotspot gtest, and custom tests (if present). This means that <code>make run-test-tier1</code> is equivalent to <code>make run-test TEST=&quot;tier1&quot;</code>, but the latter is more tab-completion friendly. For more complex test runs, the <code>run-test TEST=&quot;x&quot;</code> solution needs to be used.</p>
@@ -82,7 +82,7 @@ $ make exploded-run-test TEST=tier2</code></pre>
 <h3 id="gtest">Gtest</h3>
 <p>Since the Hotspot Gtest suite is so quick, the default is to run all tests. This is specified by just <code>gtest</code>, or as a fully qualified test descriptor <code>gtest:all</code>.</p>
 <p>If you want, you can single out an individual test or a group of tests, for instance <code>gtest:LogDecorations</code> or <code>gtest:LogDecorations.level_test_vm</code>. This can be particularly useful if you want to run a shaky test repeatedly.</p>
-<p>For Gtest, there is a separate test suite for each JVM variant. The JVM variant is defined by adding <code>/&lt;variant&gt;</code> to the test descriptor, e.g. <code>gtest:Log/client</code>. If you specify no variant, gtest will run once for each JVM variant present (e.g. server, client). So if you only have the server JVM present, then <code>gtest:all</code> will be equivalent to <code>gtest:all/server</code>.</p>
+<p>For Gtest, there is a separate test suite for each JVM variant. The JVM variant is defined by adding <code>/&lt;variant&gt;</code> to the test descriptor, e.g. <code>gtest:Log/client</code>. If you specify no variant, gtest will run once for each JVM variant present (e.g. server, client). So if you only have the server JVM present, then <code>gtest:all</code> will be equivalent to <code>gtest:all/server</code>.</p>
 <h2 id="test-results-and-summary">Test results and summary</h2>
 <p>At the end of the test run, a summary of all tests run will be presented. This will have a consistent look, regardless of what test suites were used. This is a sample summary:</p>
 <pre><code>==============================
@@ -97,16 +97,16 @@ TEST FAILURE</code></pre>
 <p>Tests where the number of TOTAL tests does not equal the number of PASSed tests will be considered a test failure. These are marked with the <code>&gt;&gt; ... &lt;&lt;</code> marker for easy identification.</p>
 <p>The classification of non-passed tests differs a bit between test suites. In the summary, ERROR is used as a catch-all for tests that neither passed nor are classified as failed by the framework. This might indicate test framework error, timeout or other problems.</p>
 <p>In case of test failures, <code>make run-test</code> will exit with a non-zero exit value.</p>
-<p>All tests have their result stored in <code>build/$BUILD/test-results/$TEST_ID</code>, where TEST_ID is a path-safe conversion from the fully qualified test descriptor, e.g. for <code>jtreg:jdk/test:tier1</code> the TEST_ID is <code>jtreg_jdk_test_tier1</code>. This path is also printed in the log at the end of the test run.</p>
+<p>All tests have their result stored in <code>build/$BUILD/test-results/$TEST_ID</code>, where TEST_ID is a path-safe conversion from the fully qualified test descriptor, e.g. for <code>jtreg:jdk/test:tier1</code> the TEST_ID is <code>jtreg_jdk_test_tier1</code>. This path is also printed in the log at the end of the test run.</p>
 <p>Additional work data is stored in <code>build/$BUILD/test-support/$TEST_ID</code>. For some frameworks, this directory might contain information that is useful in determining the cause of a failed test.</p>
 <h2 id="test-suite-control">Test suite control</h2>
 <p>It is possible to control various aspects of the test suites using make control variables.</p>
 <p>These variables use a keyword=value approach to allow multiple values to be set. So, for instance, <code>JTREG=&quot;JOBS=1;TIMEOUT=8&quot;</code> will set the JTReg concurrency level to 1 and the timeout factor to 8. This is equivalent to setting <code>JTREG_JOBS=1 JTREG_TIMEOUT=8</code>, but using the keyword format means that the <code>JTREG</code> variable is parsed and verified for correctness, so <code>JTREG=&quot;TMIEOUT=8&quot;</code> would give an error, while <code>JTREG_TMIEOUT=8</code> would just pass unnoticed.</p>
 <p>To separate multiple keyword=value pairs, use <code>;</code> (semicolon). Since the shell normally eats <code>;</code>, the recommended usage is to write the assignment inside qoutes, e.g. <code>JTREG=&quot;...;...&quot;</code>. This will also make sure spaces are preserved, as in <code>JTREG=&quot;VM_OPTIONS=-XshowSettings -Xlog:gc+ref=debug&quot;</code>.</p>
-<p>(Other ways are possible, e.g. using backslash: <code>JTREG=JOBS=1\;TIMEOUT=8</code>. Also, as a special technique, the string <code>%20</code> will be replaced with space for certain options, e.g. <code>JTREG=VM_OPTIONS=-XshowSettings%20-Xlog:gc+ref=debug</code>. This can be useful if you have layers of scripts and have trouble getting proper quoting of command line arguments through.)</p>
+<p>(Other ways are possible, e.g. using backslash: <code>JTREG=JOBS=1\;TIMEOUT=8</code>. Also, as a special technique, the string <code>%20</code> will be replaced with space for certain options, e.g. <code>JTREG=VM_OPTIONS=-XshowSettings%20-Xlog:gc+ref=debug</code>. This can be useful if you have layers of scripts and have trouble getting proper quoting of command line arguments through.)</p>
 <p>As far as possible, the names of the keywords have been standardized between test suites.</p>
 <h3 id="general-keywords-test_opts">General keywords (TEST_OPTS)</h3>
-<p>Some keywords are valid across different test suites. If you want to run tests from multiple test suites, or just don’t want to care which test suite specific control variable to use, then you can use the general TEST_OPTS control variable.</p>
+<p>Some keywords are valid across different test suites. If you want to run tests from multiple test suites, or just don't want to care which test suite specific control variable to use, then you can use the general TEST_OPTS control variable.</p>
 <p>There are also some keywords that applies globally to the test runner system, not to any specific test suites. These are also available as TEST_OPTS keywords.</p>
 <h4 id="jobs">JOBS</h4>
 <p>Currently only applies to JTReg.</p>
@@ -179,11 +179,11 @@ TEST FAILURE</code></pre>
 <p>Some Client UI tests use key sequences which may be reserved by the operating system. Usually that causes the test failure. So it is highly recommended to disable system key shortcuts prior testing. The steps to access and disable system key shortcuts for various platforms are provided below.</p>
 <h4 id="macos">MacOS</h4>
 <p>Choose Apple menu; System Preferences, click Keyboard, then click Shortcuts; select or deselect desired shortcut.</p>
-<p>For example, test/jdk/javax/swing/TooltipManager/JMenuItemToolTipKeyBindingsTest/JMenuItemToolTipKeyBindingsTest.java fails on MacOS because it uses <code>CTRL + F1</code> key sequence to show or hide tooltip message but the key combination is reserved by the operating system. To run the test correctly the default global key shortcut should be disabled using the steps described above, and then deselect “Turn keyboard access on or off” option which is responsible for <code>CTRL + F1</code> combination.</p>
+<p>For example, test/jdk/javax/swing/TooltipManager/JMenuItemToolTipKeyBindingsTest/JMenuItemToolTipKeyBindingsTest.java fails on MacOS because it uses <code>CTRL + F1</code> key sequence to show or hide tooltip message but the key combination is reserved by the operating system. To run the test correctly the default global key shortcut should be disabled using the steps described above, and then deselect &quot;Turn keyboard access on or off&quot; option which is responsible for <code>CTRL + F1</code> combination.</p>
 <h4 id="linux">Linux</h4>
 <p>Open the Activities overview and start typing Settings; Choose Settings, click Devices, then click Keyboard; set or override desired shortcut.</p>
 <h4 id="windows">Windows</h4>
-<p>Type <code>gpedit</code> in the Search and then click Edit group policy; navigate to User Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; File Explorer; in the right-side pane look for “Turn off Windows key hotkeys” and double click on it; enable or disable hotkeys.</p>
+<p>Type <code>gpedit</code> in the Search and then click Edit group policy; navigate to User Configuration -&gt; Administrative Templates -&gt; Windows Components -&gt; File Explorer; in the right-side pane look for &quot;Turn off Windows key hotkeys&quot; and double click on it; enable or disable hotkeys.</p>
 <p>Note: restart is required to make the settings take effect.</p>
 </body>
 </html>
diff --git a/make/Bundles.gmk b/make/Bundles.gmk
index 56d7dc8..81a1688 100644
--- a/make/Bundles.gmk
+++ b/make/Bundles.gmk
@@ -36,7 +36,7 @@ DOCS_TARGETS :=
 # On Windows tar frequently complains that "file changed as we read it" for
 # some random source files. This seems to be cause by anti virus scanners and
 # is most likely safe to ignore. When it happens, tar returns '1'.
-ifeq ($(OPENJDK_BUILD_OS), windows)
+ifeq ($(call isBuildOs, windows), true)
   TAR_IGNORE_EXIT_VALUE := || test "$$$$?" = "1"
 endif
 
@@ -156,7 +156,7 @@ endef
 
 # On Macosx, we bundle up the macosx specific images which already have the
 # correct base directories.
-ifeq ($(OPENJDK_TARGET_OS)-$(DEBUG_LEVEL), macosx-release)
+ifeq ($(call isTargetOs, macosx)+$(DEBUG_LEVEL), true+release)
   JDK_IMAGE_DIR := $(JDK_MACOSX_BUNDLE_DIR)
   JRE_IMAGE_DIR := $(JRE_MACOSX_BUNDLE_DIR)
   JDK_IMAGE_HOMEDIR := $(JDK_MACOSX_CONTENTS_DIR)/Home
@@ -208,7 +208,7 @@ ifneq ($(filter product-bundles% legacy-bundles, $(MAKECMDGOALS)), )
 
   # Create special filter rules when dealing with unzipped .dSYM directories on
   # macosx
-  ifeq ($(OPENJDK_TARGET_OS), macosx)
+  ifeq ($(call isTargetOs, macosx), true)
     ifeq ($(ZIP_EXTERNAL_DEBUG_SYMBOLS), false)
       JDK_SYMBOLS_EXCLUDE_PATTERN := $(addprefix %, \
           $(call containing, .dSYM/, $(patsubst $(JDK_IMAGE_DIR)/%, %, \
@@ -288,16 +288,7 @@ ifneq ($(filter product-bundles% legacy-bundles, $(MAKECMDGOALS)), )
       $(SYMBOLS_EXCLUDE_PATTERN), \
       $(ALL_JRE_FILES))
 
-  # On Macosx release builds, when there is a code signing certificate available,
-  # the final bundle layout can be signed.
-  SIGN_BUNDLE := false
-  ifeq ($(OPENJDK_TARGET_OS)-$(DEBUG_LEVEL), macosx-release)
-    ifneq ($(CODESIGN), )
-      SIGN_BUNDLE := true
-    endif
-  endif
-
-  ifeq ($(SIGN_BUNDLE), true)
+  ifeq ($(MACOSX_CODESIGN_MODE), hardened)
     # Macosx release build and code signing available.
 
     ################################################################################
diff --git a/make/CompileDemos.gmk b/make/CompileDemos.gmk
index 64ecf48..74c54ce 100644
--- a/make/CompileDemos.gmk
+++ b/make/CompileDemos.gmk
@@ -234,7 +234,7 @@ $(SUPPORT_OUTPUTDIR)/demos/image/nbproject/%: $(DEMO_SHARE_SRC)/nbproject/%
 	$(call install-file)
 	$(CHMOD) -f ug+w $@
 
-ifeq ($(OPENJDK_TARGET_OS), solaris)
+ifeq ($(call isTargetOs, solaris), true)
   TARGETS += $(patsubst $(DEMO_SHARE_SRC)/nbproject/%, \
     $(SUPPORT_OUTPUTDIR)/demos/image/nbproject/%, \
     $(call FindFiles, $(DEMO_SHARE_SRC)/nbproject))
diff --git a/make/CompileJavaModules.gmk b/make/CompileJavaModules.gmk
index 40c7e06..46fb9b4 100644
--- a/make/CompileJavaModules.gmk
+++ b/make/CompileJavaModules.gmk
@@ -51,21 +51,18 @@ java.base_EXCLUDES += java/lang/doc-files
 # data files and shouldn't go in the product
 java.base_EXCLUDE_FILES += sun/text/resources/BreakIteratorRules.java
 
-ifneq ($(OPENJDK_TARGET_OS), solaris)
+ifeq ($(call isTargetOs, solaris), false)
   java.base_EXCLUDE_FILES += \
       SolarisLoginModule.java \
       SolarisSystem.java \
       #
 endif
 
-ifeq ($(filter $(OPENJDK_TARGET_OS), solaris macosx aix), )
-  #
-  # only solaris, macosx and aix
-  #
+ifeq ($(call isTargetOs, solaris macosx aix), false)
   java.base_EXCLUDE_FILES += sun/nio/fs/PollingWatchService.java
 endif
 
-ifeq ($(OPENJDK_TARGET_OS), windows)
+ifeq ($(call isTargetOs, windows), true)
   java.base_EXCLUDE_FILES += \
       sun/nio/ch/SimpleAsynchronousFileChannelImpl.java \
       #
@@ -124,7 +121,7 @@ java.desktop_EXCLUDE_FILES += \
     .template \
     #
 
-ifeq ($(OPENJDK_TARGET_OS), macosx)
+ifeq ($(call isTargetOs, macosx), true)
   # exclude all X11 on Mac.
   java.desktop_EXCLUDES += \
       sun/awt/X11 \
@@ -186,7 +183,7 @@ else
       sun/awt/X11/XwcTextItem.java
 endif
 
-ifeq ($(OPENJDK_TARGET_OS), windows)
+ifeq ($(call isTargetOs, windows), true)
   java.desktop_EXCLUDES += com/sun/java/swing/plaf/gtk
 endif
 
@@ -194,8 +191,7 @@ ifdef BUILD_HEADLESS_ONLY
   java.desktop_EXCLUDES += sun/applet
 endif
 
-# Used on windows and macosx
-ifeq ($(filter $(OPENJDK_TARGET_OS), windows macosx), )
+ifeq ($(call isTargetOs, windows macosx), false)
   java.desktop_EXCLUDE_FILES += sun/awt/AWTCharset.java
 endif
 
@@ -374,11 +370,11 @@ SCTP_IMPL_CLASSES = \
     $(TOPDIR)/src/jdk.sctp/unix/classes/sun/nio/ch/sctp/SendFailed.java \
     $(TOPDIR)/src/jdk.sctp/unix/classes/sun/nio/ch/sctp/Shutdown.java
 
-ifeq ($(OPENJDK_TARGET_OS), macosx)
+ifeq ($(call isTargetOs, macosx), true)
   jdk.sctp_EXCLUDE_FILES += $(SCTP_IMPL_CLASSES)
 endif
 
-ifeq ($(OPENJDK_TARGET_OS),aix)
+ifeq ($(call isTargetOs, aix), true)
   jdk.sctp_EXCLUDE_FILES += $(SCTP_IMPL_CLASSES)
 endif
 
diff --git a/make/CopyImportModules.gmk b/make/CopyImportModules.gmk
index e71d29c..34baaf9 100644
--- a/make/CopyImportModules.gmk
+++ b/make/CopyImportModules.gmk
@@ -38,7 +38,7 @@ CONF_DIR := $(wildcard $(addsuffix /$(MODULE), $(IMPORT_MODULES_CONF)))
 $(call FillFindCache, $(LIBS_DIR) $(CMDS_DIR) $(CONF_DIR))
 
 ifneq ($(LIBS_DIR), )
-  ifeq ($(OPENJDK_TARGET_OS), windows)
+  ifeq ($(call isTargetOs, windows), true)
     TO_BIN_FILTER := %$(SHARED_LIBRARY_SUFFIX) %.diz %.pdb %.map
 
     $(eval $(call SetupCopyFiles, COPY_LIBS_TO_BIN, \
diff --git a/make/CreateJmods.gmk b/make/CreateJmods.gmk
index de068ec..f0e152b 100644
--- a/make/CreateJmods.gmk
+++ b/make/CreateJmods.gmk
@@ -165,7 +165,7 @@ ifeq ($(MODULE), java.base)
     endif
   endif
 else # not java.base
-  ifeq ($(OPENJDK_TARGET_OS), windows)
+  ifeq ($(call isTargetOs, windows), true)
     # Only java.base needs to include the MSVC*_DLLs. Make sure no other module
     # tries to include them (typically imported ones).
     ifneq ($(MSVCR_DLL), )
diff --git a/make/Images.gmk b/make/Images.gmk
index 524f76d..2c9f0b8 100644
--- a/make/Images.gmk
+++ b/make/Images.gmk
@@ -255,7 +255,7 @@ ifneq ($(filter jdk, $(MAKECMDGOALS)), )
       )
 
   ifeq ($(ZIP_EXTERNAL_DEBUG_SYMBOLS), true)
-    ifeq ($(OPENJDK_TARGET_OS), macosx)
+    ifeq ($(call isTargetOs, macosx), true)
       DEMO_FILES := $(call not-containing, .dSYM, $(DEMO_FILES))
     else
       DEMO_FILES := $(filter-out %.debuginfo %.pdb %.map, $(DEMO_FILES))
@@ -296,7 +296,7 @@ ALL_JDK_MODULES := $(JDK_MODULES)
 ALL_JRE_MODULES := $(sort $(JRE_MODULES), $(foreach m, $(JRE_MODULES), \
     $(call FindTransitiveDepsForModule, $m)))
 
-ifeq ($(OPENJDK_TARGET_OS), windows)
+ifeq ($(call isTargetOs, windows), true)
   LIBS_TARGET_SUBDIR := bin
 else
   LIBS_TARGET_SUBDIR := lib
@@ -316,7 +316,7 @@ else
   DEBUGINFO_SUFFIXES := .debuginfo .pdb .map
   # On Macosx, if debug symbols have not been zipped, find all files inside *.dSYM
   # dirs.
-  ifeq ($(OPENJDK_TARGET_OS), macosx)
+  ifeq ($(call isTargetOs, macosx), true)
     $(call FillFindCache, \
         $(SUPPORT_OUTPUTDIR)/modules_libs $(SUPPORT_OUTPUTDIR)/modules_cmds)
     FindDebuginfoFiles = \
diff --git a/make/Init.gmk b/make/Init.gmk
index 6897c34..3ed4678 100644
--- a/make/Init.gmk
+++ b/make/Init.gmk
@@ -226,6 +226,9 @@ else # HAS_SPEC=true
   # Parse COMPARE_BUILD (for makefile development)
   $(eval $(call ParseCompareBuild))
 
+  # Setup reproducible build environment
+  $(eval $(call SetupReproducibleBuild))
+
   # If no LOG= was given on command line, but we have a non-standard default
   # value, use that instead and re-parse log level.
   ifeq ($(LOG), )
diff --git a/make/InitSupport.gmk b/make/InitSupport.gmk
index baefc89..df175a1 100644
--- a/make/InitSupport.gmk
+++ b/make/InitSupport.gmk
@@ -303,6 +303,15 @@ else # $(HAS_SPEC)=true
     topdir=$(TOPDIR)
   endif
 
+  # Setup the build environment to match the requested specification on
+  # level of reproducible builds
+  define SetupReproducibleBuild
+    ifeq ($$(SOURCE_DATE), updated)
+      SOURCE_DATE := $$(shell $$(DATE) +"%s")
+    endif
+    export SOURCE_DATE_EPOCH := $$(SOURCE_DATE)
+  endef
+
   # Parse COMPARE_BUILD into COMPARE_BUILD_*
   # Syntax: COMPARE_BUILD=CONF=<configure options>:PATCH=<patch file>:
   #         MAKE=<make targets>:COMP_OPTS=<compare script options>:
@@ -479,7 +488,7 @@ else # $(HAS_SPEC)=true
 	    $(TOUCH) $(SJAVAC_SERVER_DIR)/server.port.stop; true
   endef
 
-  ifeq ($(OPENJDK_BUILD_OS), windows)
+  ifeq ($(call isBuildOs, windows), true)
     # On windows we need to synchronize with the javac server to be able to
     # move or remove the build output directory. Since we have no proper
     # synchronization process, wait for a while and hope it helps. This is only
diff --git a/make/MacBundles.gmk b/make/MacBundles.gmk
index 5a5394d..45d0c78 100644
--- a/make/MacBundles.gmk
+++ b/make/MacBundles.gmk
@@ -30,7 +30,7 @@ include TextFileProcessing.gmk
 default: bundles
 
 # Only macosx has bundles defined.
-ifeq ($(OPENJDK_TARGET_OS), macosx)
+ifeq ($(call isTargetOs, macosx), true)
 
   bundles: jre-bundle jdk-bundle
 
diff --git a/make/Main.gmk b/make/Main.gmk
index 6b4b0ac..5a48954 100644
--- a/make/Main.gmk
+++ b/make/Main.gmk
@@ -1123,7 +1123,7 @@ ifneq ($(CREATE_BUILDJDK), true)
   endif
 endif
 
-ifeq ($(OPENJDK_TARGET_OS), macosx)
+ifeq ($(call isTargetOs, macosx), true)
   product-images: mac-jdk-bundle
 
   legacy-images: mac-legacy-jre-bundle
diff --git a/make/ModuleWrapper.gmk b/make/ModuleWrapper.gmk
index 5f9c5fc..54bf26e 100644
--- a/make/ModuleWrapper.gmk
+++ b/make/ModuleWrapper.gmk
@@ -42,7 +42,7 @@ TARGETS :=
 include $(MAKEFILE_PREFIX)-$(MODULE).gmk
 
 # Setup copy rules from the modules directories to the jdk image directory.
-ifeq ($(OPENJDK_TARGET_OS), windows)
+ifeq ($(call isTargetOs, windows), true)
   TO_BIN_FILTER := %$(SHARED_LIBRARY_SUFFIX) %.diz %.pdb %.map
 
   $(eval $(call SetupCopyFiles, COPY_LIBS_TO_BIN, \
diff --git a/make/RunTests.gmk b/make/RunTests.gmk
index 0c998c2..1c9778e 100644
--- a/make/RunTests.gmk
+++ b/make/RunTests.gmk
@@ -61,7 +61,7 @@ define SetTestOpt
 endef
 
 # Setup _NT_SYMBOL_PATH on Windows, which points to our pdb files.
-ifeq ($(OPENJDK_TARGET_OS), windows)
+ifeq ($(call isTargetOs, windows), true)
   ifndef _NT_SYMBOL_PATH
     SYMBOL_PATH := $(call PathList, $(sort $(patsubst %/, %, $(dir $(wildcard \
         $(addprefix $(SYMBOLS_IMAGE_DIR)/bin/, *.pdb */*.pdb))))))
@@ -200,7 +200,7 @@ TEST_JOBS_FACTOR_MACHINE ?= 1
 
 ifeq ($(TEST_JOBS), 0)
   CORES_DIVIDER := 2
-  ifeq ($(OPENJDK_TARGET_CPU_ARCH), sparc)
+  ifeq ($(call isTargetCpuArch, sparc), true)
     # For smaller SPARC machines we see reasonable scaling of throughput up to
     # cpus/4 without affecting test reliability. On the bigger machines, cpus/4
     # causes intermittent timeouts.
@@ -632,7 +632,7 @@ define SetupRunJtregTestBody
   $1_JTREG_MAX_RAM_PERCENTAGE := $$(shell $(AWK) 'BEGIN { print 25 / $$($1_JTREG_JOBS); }')
 
   # SPARC is in general slower per core so need to scale up timeouts a bit.
-  ifeq ($(OPENJDK_TARGET_CPU_ARCH), sparc)
+  ifeq ($(call isTargetCpuArch, sparc), true)
     JTREG_TIMEOUT_FACTOR ?= 8
   else
     JTREG_TIMEOUT_FACTOR ?= 4
@@ -673,7 +673,7 @@ define SetupRunJtregTestBody
   $1_JTREG_BASIC_OPTIONS += -e:JDK8_HOME=$$(BOOT_JDK)
   # If running on Windows, propagate the _NT_SYMBOL_PATH to enable
   # symbol lookup in hserr files
-  ifeq ($$(OPENJDK_TARGET_OS), windows)
+  ifeq ($$(call isTargetOs, windows), true)
     $1_JTREG_BASIC_OPTIONS += -e:_NT_SYMBOL_PATH
   endif
 
diff --git a/make/TestImage.gmk b/make/TestImage.gmk
index d5ef69f..552dce0 100644
--- a/make/TestImage.gmk
+++ b/make/TestImage.gmk
@@ -37,8 +37,8 @@ FIXPATH_ECHO := $(FIXPATH) $(call FixPath, $(ECHO))
 $(BUILD_INFO_PROPERTIES):
 	$(call MakeTargetDir)
 	$(ECHO) "# Build info properties for JDK tests" > $@
-	$(ECHO) "build.workspace.root=$(call FixPath, $(WORKSPACE_ROOT))" >> $@
-	$(ECHO) "build.output.root=$(call FixPath, $(OUTPUTDIR))" >> $@
+	$(ECHO) 'build.workspace.root=$(call FixPath, $(WORKSPACE_ROOT))' >> $@
+	$(ECHO) 'build.output.root=$(call FixPath, $(OUTPUTDIR))' >> $@
 
 prepare-test-image: $(BUILD_INFO_PROPERTIES)
 	$(call MakeDir, $(TEST_IMAGE_DIR))
diff --git a/make/ZipSecurity.gmk b/make/ZipSecurity.gmk
index ba56641..cbe1e21 100644
--- a/make/ZipSecurity.gmk
+++ b/make/ZipSecurity.gmk
@@ -70,7 +70,7 @@ TARGETS += $(IMAGES_OUTPUTDIR)/sec-bin.zip
 #
 # Windows specific binary security packages.
 #
-ifeq ($(OPENJDK_TARGET_OS), windows)
+ifeq ($(call isTargetOs, windows), true)
   # sec-windows-bin.zip is used by builds where the corresponding sources are not available
   $(eval $(call SetupZipArchive,BUILD_SEC_WINDOWS_BIN_ZIP, \
       SRC := $(JDK_OUTPUTDIR), \
@@ -80,7 +80,7 @@ ifeq ($(OPENJDK_TARGET_OS), windows)
   TARGETS += $(IMAGES_OUTPUTDIR)/sec-windows-bin.zip
 
   # JGSS files contain the native Kerberos library
-  ifeq ($(OPENJDK_TARGET_CPU), x86_64)
+  ifeq ($(call isTargetCpu, x86_64), true)
     JGSS_ZIP_NAME = jgss-windows-x64-bin.zip
   else
     JGSS_ZIP_NAME = jgss-windows-i586-bin.zip
diff --git a/make/ZipSource.gmk b/make/ZipSource.gmk
index b4aabda..ff29a05 100644
--- a/make/ZipSource.gmk
+++ b/make/ZipSource.gmk
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2014, 2019, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2014, 2022, Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -31,6 +31,7 @@ include JavaCompilation.gmk
 include Modules.gmk
 
 SRC_ZIP_WORK_DIR := $(SUPPORT_OUTPUTDIR)/src
+$(if $(filter $(TOPDIR)/%, $(SUPPORT_OUTPUTDIR)), $(eval SRC_ZIP_BASE := $(TOPDIR)), $(eval SRC_ZIP_BASE := $(SUPPORT_OUTPUTDIR)))
 
 # Hook to include the corresponding custom file, if present.
 $(eval $(call IncludeCustomExtension, ZipSource.gmk))
@@ -51,10 +52,10 @@ ALL_MODULES := $(FindAllModules)
 # again to create src.zip.
 $(foreach m, $(ALL_MODULES), \
   $(foreach d, $(call FindModuleSrcDirs, $m) $(call ExtraSrcDirs, $m), \
-    $(eval $d_TARGET := $(SRC_ZIP_WORK_DIR)/$(patsubst $(TOPDIR)/%,%,$d)/$m) \
+    $(eval $d_TARGET := $(SRC_ZIP_WORK_DIR)/$(patsubst $(TOPDIR)/%,%,$(patsubst $(SUPPORT_OUTPUTDIR)/%,%,$d))/$m) \
     $(if $(SRC_GENERATED), , \
       $(eval $$($d_TARGET): $d ; \
-          $$(if $(filter $(TOPDIR)/%, $d), $$(link-file-relative), $$(link-file-absolute)) \
+          $$(if $(filter $(SRC_ZIP_BASE)/%, $d), $$(link-file-relative), $$(link-file-absolute)) \
       ) \
     ) \
     $(eval SRC_ZIP_SRCS += $$($d_TARGET)) \
diff --git a/make/autoconf/basic.m4 b/make/autoconf/basic.m4
index a3a4e13..dc02d44 100644
--- a/make/autoconf/basic.m4
+++ b/make/autoconf/basic.m4
@@ -220,6 +220,18 @@ AC_DEFUN_ONCE([BASIC_SETUP_DEVKIT],
       [UTIL_PREPEND_TO_PATH([TOOLCHAIN_PATH],$with_toolchain_path)]
   )
 
+  AC_ARG_WITH([xcode-path], [AS_HELP_STRING([--with-xcode-path],
+      [set up toolchain on Mac OS using a path to an Xcode installation])])
+
+  if test "x$with_xcode_path" != x; then
+    if test "x$OPENJDK_BUILD_OS" = "xmacosx"; then
+      UTIL_PREPEND_TO_PATH([TOOLCHAIN_PATH],
+          $with_xcode_path/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/bin:$with_xcode_path/Contents/Developer/usr/bin)
+    else
+      AC_MSG_WARN([Option --with-xcode-path is only valid on Mac OS, ignoring.])
+    fi
+  fi
+
   AC_ARG_WITH([extra-path], [AS_HELP_STRING([--with-extra-path],
       [prepend these directories to the default path])],
       [UTIL_PREPEND_TO_PATH([EXTRA_PATH],$with_extra_path)]
@@ -230,7 +242,7 @@ AC_DEFUN_ONCE([BASIC_SETUP_DEVKIT],
     # If not, detect if Xcode is installed by running xcodebuild -version
     # if no Xcode installed, xcodebuild exits with 1
     # if Xcode is installed, even if xcode-select is misconfigured, then it exits with 0
-    if test "x$DEVKIT_ROOT" != x || /usr/bin/xcodebuild -version >/dev/null 2>&1; then
+    if test "x$DEVKIT_ROOT" != x || test "x$TOOLCHAIN_PATH" != x || /usr/bin/xcodebuild -version >/dev/null 2>&1; then
       # We need to use xcodebuild in the toolchain dir provided by the user
       UTIL_LOOKUP_PROGS(XCODEBUILD, xcodebuild, $TOOLCHAIN_PATH)
       if test x$XCODEBUILD = x; then
diff --git a/make/autoconf/basic_tools.m4 b/make/autoconf/basic_tools.m4
index c39b87d..c3c48f8 100644
--- a/make/autoconf/basic_tools.m4
+++ b/make/autoconf/basic_tools.m4
@@ -156,25 +156,23 @@ AC_DEFUN([BASIC_CHECK_MAKE_VERSION],
 AC_DEFUN([BASIC_CHECK_MAKE_OUTPUT_SYNC],
 [
   # Check if make supports the output sync option and if so, setup using it.
-  AC_MSG_CHECKING([if make --output-sync is supported])
-  if $MAKE --version -O > /dev/null 2>&1; then
-    OUTPUT_SYNC_SUPPORTED=true
-    AC_MSG_RESULT([yes])
-    AC_MSG_CHECKING([for output-sync value])
-    AC_ARG_WITH([output-sync], [AS_HELP_STRING([--with-output-sync],
-      [set make output sync type if supported by make. @<:@recurse@:>@])],
-      [OUTPUT_SYNC=$with_output_sync])
-    if test "x$OUTPUT_SYNC" = "x"; then
-      OUTPUT_SYNC=none
-    fi
-    AC_MSG_RESULT([$OUTPUT_SYNC])
-    if ! $MAKE --version -O$OUTPUT_SYNC > /dev/null 2>&1; then
-      AC_MSG_ERROR([Make did not the support the value $OUTPUT_SYNC as output sync type.])
-    fi
-  else
-    OUTPUT_SYNC_SUPPORTED=false
-    AC_MSG_RESULT([no])
-  fi
+  UTIL_ARG_WITH(NAME: output-sync, TYPE: literal,
+      VALID_VALUES: [none recurse line target], DEFAULT: none,
+      OPTIONAL: true, ENABLED_DEFAULT: true,
+      ENABLED_RESULT: OUTPUT_SYNC_SUPPORTED,
+      CHECKING_MSG: [for make --output-sync value],
+      DESC: [set make --output-sync type if supported by make],
+      CHECK_AVAILABLE:
+      [
+        AC_MSG_CHECKING([if make --output-sync is supported])
+        if ! $MAKE --version -O > /dev/null 2>&1; then
+          AC_MSG_RESULT([no])
+          AVAILABLE=false
+        else
+          AC_MSG_RESULT([yes])
+        fi
+      ]
+  )
   AC_SUBST(OUTPUT_SYNC_SUPPORTED)
   AC_SUBST(OUTPUT_SYNC)
 ])
@@ -371,43 +369,6 @@ AC_DEFUN_ONCE([BASIC_SETUP_COMPLEX_TOOLS],
     UTIL_REQUIRE_PROGS(MIG, mig)
     UTIL_REQUIRE_PROGS(XATTR, xattr)
     UTIL_LOOKUP_PROGS(CODESIGN, codesign)
-
-    if test "x$CODESIGN" != "x"; then
-      # Check for user provided code signing identity.
-      # If no identity was provided, fall back to "openjdk_codesign".
-      AC_ARG_WITH([macosx-codesign-identity], [AS_HELP_STRING([--with-macosx-codesign-identity],
-        [specify the code signing identity])],
-        [MACOSX_CODESIGN_IDENTITY=$with_macosx_codesign_identity],
-        [MACOSX_CODESIGN_IDENTITY=openjdk_codesign]
-      )
-
-      AC_SUBST(MACOSX_CODESIGN_IDENTITY)
-
-      # Verify that the codesign certificate is present
-      AC_MSG_CHECKING([if codesign certificate is present])
-      $RM codesign-testfile
-      $TOUCH codesign-testfile
-      $CODESIGN -s "$MACOSX_CODESIGN_IDENTITY" codesign-testfile 2>&AS_MESSAGE_LOG_FD \
-          >&AS_MESSAGE_LOG_FD || CODESIGN=
-      $RM codesign-testfile
-      if test "x$CODESIGN" = x; then
-        AC_MSG_RESULT([no])
-      else
-        AC_MSG_RESULT([yes])
-        # Verify that the codesign has --option runtime
-        AC_MSG_CHECKING([if codesign has --option runtime])
-        $RM codesign-testfile
-        $TOUCH codesign-testfile
-        $CODESIGN --option runtime -s "$MACOSX_CODESIGN_IDENTITY" codesign-testfile \
-            2>&AS_MESSAGE_LOG_FD >&AS_MESSAGE_LOG_FD || CODESIGN=
-        $RM codesign-testfile
-        if test "x$CODESIGN" = x; then
-          AC_MSG_ERROR([codesign does not have --option runtime. macOS 10.13.6 and above is required.])
-        else
-          AC_MSG_RESULT([yes])
-        fi
-      fi
-    fi
     UTIL_REQUIRE_PROGS(SETFILE, SetFile)
   elif test "x$OPENJDK_TARGET_OS" = "xsolaris"; then
     UTIL_REQUIRE_PROGS(ELFEDIT, elfedit)
diff --git a/make/autoconf/build-aux/config.guess b/make/autoconf/build-aux/config.guess
index 7a31eb2..a88a9ad 100644
--- a/make/autoconf/build-aux/config.guess
+++ b/make/autoconf/build-aux/config.guess
@@ -29,7 +29,40 @@
 # and fix the broken property, if needed.
 
 DIR=`dirname $0`
-OUT=`. $DIR/autoconf-config.guess`
+OUT=`. $DIR/autoconf-config.guess 2> /dev/null`
+
+# Handle some cases that autoconf-config.guess is not capable of
+if [ "x$OUT" = x ]; then
+  if [ `uname -s` = Linux ]; then
+    # Test and fix little endian MIPS.
+    if [ `uname -m` = mipsel ]; then
+      OUT=mipsel-unknown-linux-gnu
+    elif [ `uname -m` = mips64el ]; then
+      OUT=mips64el-unknown-linux-gnu
+    # Test and fix little endian PowerPC64.
+    elif [ `uname -m` = ppc64le ]; then
+      OUT=powerpc64le-unknown-linux-gnu
+    # Test and fix LoongArch64.
+    elif [ `uname -m` = loongarch64 ]; then
+      OUT=loongarch64-unknown-linux-gnu
+    # Test and fix RISC-V.
+    elif [ `uname -m` = riscv64 ]; then
+      OUT=riscv64-unknown-linux-gnu
+    fi
+  # Test and fix cygwin machine arch .x86_64
+  elif [[ `uname -s` = CYGWIN* ]]; then
+    if [ `uname -m` = ".x86_64" ]; then
+      OUT=x86_64-unknown-cygwin
+    fi
+  fi
+
+  if [ "x$OUT" = x ]; then
+    # Run autoconf-config.guess again to get the error message.
+    . $DIR/autoconf-config.guess > /dev/null
+  else
+    printf "guessed by custom config.guess... " >&2
+  fi
+fi
 
 # Test and fix solaris on x86_64
 echo $OUT | grep i386-pc-solaris > /dev/null 2> /dev/null
@@ -88,36 +121,6 @@ if test $? = 0; then
   OUT=powerpc$KERNEL_BITMODE`echo $OUT | sed -e 's/[^-]*//'`
 fi
 
-# Test and fix little endian PowerPC64.
-# TODO: should be handled by autoconf-config.guess.
-if [ "x$OUT" = x ]; then
-  if [ `uname -m` = ppc64le ]; then
-    if [ `uname -s` = Linux ]; then
-      OUT=powerpc64le-unknown-linux-gnu
-    fi
-  fi
-fi
-
-# Test and fix little endian MIPS.
-if [ "x$OUT" = x ]; then
-  if [ `uname -s` = Linux ]; then
-    if [ `uname -m` = mipsel ]; then
-      OUT=mipsel-unknown-linux-gnu
-    elif [ `uname -m` = mips64el ]; then
-      OUT=mips64el-unknown-linux-gnu
-    fi
-  fi
-fi
-
-# Test and fix LoongArch64.
-if [ "x$OUT" = x ]; then
-  if [ `uname -s` = Linux ]; then
-    if [ `uname -m` = loongarch64 ]; then
-      OUT=loongarch64-unknown-linux-gnu
-    fi
-  fi
-fi
-
 # Test and fix cpu on macos-aarch64, uname -p reports arm, buildsys expects aarch64
 echo $OUT | grep arm-apple-darwin > /dev/null 2> /dev/null
 if test $? = 0; then
diff --git a/make/autoconf/configure.ac b/make/autoconf/configure.ac
index c015f73..a2c0c1a 100644
--- a/make/autoconf/configure.ac
+++ b/make/autoconf/configure.ac
@@ -195,7 +195,8 @@ FLAGS_POST_TOOLCHAIN
 PLATFORM_SETUP_OPENJDK_TARGET_BITS
 PLATFORM_SETUP_OPENJDK_TARGET_ENDIANNESS
 
-# Configure flags for the tools
+# Configure flags for the tools. Need to know if we should build reproducible.
+JDKOPT_SETUP_REPRODUCIBLE_BUILD
 FLAGS_SETUP_FLAGS
 
 # Setup debug symbols (need objcopy from the toolchain for that)
@@ -235,6 +236,8 @@ JDKOPT_ENABLE_DISABLE_FAILURE_HANDLER
 JDKOPT_ENABLE_DISABLE_GENERATE_CLASSLIST
 JDKOPT_EXCLUDE_TRANSLATIONS
 JDKOPT_ENABLE_DISABLE_MANPAGES
+JDKOPT_SETUP_REPRODUCIBLE_BUILD
+JDKOPT_SETUP_MACOSX_SIGNING
 
 ###############################################################################
 #
diff --git a/make/autoconf/flags-cflags.m4 b/make/autoconf/flags-cflags.m4
index 49a7c68..3c5ba9c 100644
--- a/make/autoconf/flags-cflags.m4
+++ b/make/autoconf/flags-cflags.m4
@@ -813,6 +813,18 @@ AC_DEFUN([FLAGS_SETUP_CFLAGS_CPU_DEP],
     $1_WARNING_CFLAGS_JVM="-Wno-format-zero-length -Wtype-limits -Wuninitialized"
   fi
 
+  if test "x$TOOLCHAIN_TYPE" = xmicrosoft && test "x$ENABLE_REPRODUCIBLE_BUILD" = xtrue; then
+    # Enabling deterministic creates warnings if __DATE__ or __TIME__ are
+    # used, and since we are, silence that warning.
+    REPRODUCIBLE_CFLAGS="-experimental:deterministic -wd5048"
+    FLAGS_COMPILER_CHECK_ARGUMENTS(ARGUMENT: [${REPRODUCIBLE_CFLAGS}],
+        PREFIX: $3,
+        IF_FALSE: [
+            REPRODUCIBLE_CFLAGS=
+        ]
+    )
+  fi
+
   # Prevent the __FILE__ macro from generating absolute paths into the built
   # binaries. Depending on toolchain, different mitigations are possible.
   # * GCC and Clang of new enough versions have -fmacro-prefix-map.
@@ -831,6 +843,27 @@ AC_DEFUN([FLAGS_SETUP_CFLAGS_CPU_DEP],
               FILE_MACRO_CFLAGS=
           ]
       )
+    elif test "x$TOOLCHAIN_TYPE" = xmicrosoft &&
+        test "x$ENABLE_REPRODUCIBLE_BUILD" = xtrue; then
+      # There is a known issue with the pathmap if the mapping is made to the
+      # empty string. Add a minimal string "s" as prefix to work around this.
+      # PATHMAP_FLAGS is also added to LDFLAGS in flags-ldflags.m4.
+      PATHMAP_FLAGS="-pathmap:${WORKSPACE_ROOT}=s"
+      FILE_MACRO_CFLAGS="$PATHMAP_FLAGS"
+      FLAGS_COMPILER_CHECK_ARGUMENTS(ARGUMENT: [${FILE_MACRO_CFLAGS}],
+          PREFIX: $3,
+          IF_FALSE: [
+              PATHMAP_FLAGS=
+              FILE_MACRO_CFLAGS=
+          ]
+      )
+    fi
+
+    AC_MSG_CHECKING([how to prevent absolute paths in output])
+    if test "x$FILE_MACRO_CFLAGS" != x; then
+      AC_MSG_RESULT([using compiler options])
+    else
+      AC_MSG_RESULT([using relative paths])
     fi
   fi
   AC_SUBST(FILE_MACRO_CFLAGS)
@@ -839,12 +872,13 @@ AC_DEFUN([FLAGS_SETUP_CFLAGS_CPU_DEP],
   CFLAGS_JVM_COMMON="$ALWAYS_CFLAGS_JVM $ALWAYS_DEFINES_JVM \
       $TOOLCHAIN_CFLAGS_JVM ${$1_TOOLCHAIN_CFLAGS_JVM} \
       $OS_CFLAGS $OS_CFLAGS_JVM $CFLAGS_OS_DEF_JVM $DEBUG_CFLAGS_JVM \
-      $WARNING_CFLAGS $WARNING_CFLAGS_JVM $JVM_PICFLAG $FILE_MACRO_CFLAGS"
+      $WARNING_CFLAGS $WARNING_CFLAGS_JVM $JVM_PICFLAG $FILE_MACRO_CFLAGS \
+      $REPRODUCIBLE_CFLAGS"
 
   CFLAGS_JDK_COMMON="$ALWAYS_CFLAGS_JDK $ALWAYS_DEFINES_JDK $TOOLCHAIN_CFLAGS_JDK \
       $OS_CFLAGS $CFLAGS_OS_DEF_JDK $DEBUG_CFLAGS_JDK $DEBUG_OPTIONS_FLAGS_JDK \
       $WARNING_CFLAGS $WARNING_CFLAGS_JDK $DEBUG_SYMBOLS_CFLAGS_JDK \
-      $FILE_MACRO_CFLAGS"
+      $FILE_MACRO_CFLAGS $REPRODUCIBLE_CFLAGS"
 
   # Use ${$2EXTRA_CFLAGS} to block EXTRA_CFLAGS to be added to build flags.
   # (Currently we don't have any OPENJDK_BUILD_EXTRA_CFLAGS, but that might
diff --git a/make/autoconf/flags-ldflags.m4 b/make/autoconf/flags-ldflags.m4
index 7d511ca..2202bb6 100644
--- a/make/autoconf/flags-ldflags.m4
+++ b/make/autoconf/flags-ldflags.m4
@@ -147,9 +147,17 @@ AC_DEFUN([FLAGS_SETUP_LDFLAGS_HELPER],
     fi
   fi
 
+  if test "x$ENABLE_REPRODUCIBLE_BUILD" = "xtrue"; then
+    if test "x$TOOLCHAIN_TYPE" = xmicrosoft; then
+      REPRODUCIBLE_LDFLAGS="-experimental:deterministic"
+    fi
+  fi
+
   if test "x$ALLOW_ABSOLUTE_PATHS_IN_OUTPUT" = "xfalse"; then
     if test "x$TOOLCHAIN_TYPE" = xmicrosoft; then
       BASIC_LDFLAGS="$BASIC_LDFLAGS -pdbaltpath:%_PDB%"
+      # PATHMAP_FLAGS is setup in flags-cflags.m4.
+      FILE_MACRO_LDFLAGS="${PATHMAP_FLAGS}"
     fi
   fi
 
@@ -211,13 +219,15 @@ AC_DEFUN([FLAGS_SETUP_LDFLAGS_CPU_DEP],
   LDFLAGS_JDK_COMMON="$BASIC_LDFLAGS $BASIC_LDFLAGS_JDK_ONLY \
       $OS_LDFLAGS $DEBUGLEVEL_LDFLAGS_JDK_ONLY ${$2EXTRA_LDFLAGS}"
   $2LDFLAGS_JDKLIB="$LDFLAGS_JDK_COMMON $BASIC_LDFLAGS_JDK_LIB_ONLY \
-      ${$1_LDFLAGS_JDK_LIBPATH} $SHARED_LIBRARY_FLAGS"
+      ${$1_LDFLAGS_JDK_LIBPATH} $SHARED_LIBRARY_FLAGS \
+      $REPRODUCIBLE_LDFLAGS $FILE_MACRO_LDFLAGS"
   $2LDFLAGS_JDKEXE="$LDFLAGS_JDK_COMMON $EXECUTABLE_LDFLAGS \
-      ${$1_CPU_EXECUTABLE_LDFLAGS}"
+      ${$1_CPU_EXECUTABLE_LDFLAGS} $REPRODUCIBLE_LDFLAGS $FILE_MACRO_LDFLAGS"
 
   $2JVM_LDFLAGS="$BASIC_LDFLAGS $BASIC_LDFLAGS_JVM_ONLY $OS_LDFLAGS $OS_LDFLAGS_JVM_ONLY \
       $DEBUGLEVEL_LDFLAGS $DEBUGLEVEL_LDFLAGS_JVM_ONLY $BASIC_LDFLAGS_ONLYCXX \
-      ${$1_CPU_LDFLAGS} ${$1_CPU_LDFLAGS_JVM_ONLY} ${$2EXTRA_LDFLAGS}"
+      ${$1_CPU_LDFLAGS} ${$1_CPU_LDFLAGS_JVM_ONLY} ${$2EXTRA_LDFLAGS} \
+      $REPRODUCIBLE_LDFLAGS $FILE_MACRO_LDFLAGS"
 
   AC_SUBST($2LDFLAGS_JDKLIB)
   AC_SUBST($2LDFLAGS_JDKEXE)
diff --git a/make/autoconf/flags.m4 b/make/autoconf/flags.m4
index a5b4afd..5a3ea96 100644
--- a/make/autoconf/flags.m4
+++ b/make/autoconf/flags.m4
@@ -506,14 +506,14 @@ UTIL_DEFUN_NAMED([FLAGS_CXX_COMPILER_CHECK_ARGUMENTS],
 UTIL_DEFUN_NAMED([FLAGS_COMPILER_CHECK_ARGUMENTS],
     [*ARGUMENT IF_TRUE IF_FALSE PREFIX], [$@],
 [
-  FLAGS_C_COMPILER_CHECK_ARGUMENTS(ARGUMENT: [ARG_ARGUMENT],
+  FLAGS_C_COMPILER_CHECK_ARGUMENTS(ARGUMENT: ARG_ARGUMENT,
       IF_TRUE: [C_COMP_SUPPORTS="yes"],
       IF_FALSE: [C_COMP_SUPPORTS="no"],
-      PREFIX: [ARG_PREFIX])
-  FLAGS_CXX_COMPILER_CHECK_ARGUMENTS(ARGUMENT: [ARG_ARGUMENT],
+      PREFIX: ARG_PREFIX)
+  FLAGS_CXX_COMPILER_CHECK_ARGUMENTS(ARGUMENT: ARG_ARGUMENT,
       IF_TRUE: [CXX_COMP_SUPPORTS="yes"],
       IF_FALSE: [CXX_COMP_SUPPORTS="no"],
-      PREFIX: [ARG_PREFIX])
+      PREFIX: ARG_PREFIX)
 
   AC_MSG_CHECKING([if both ARG_PREFIX[CC] and ARG_PREFIX[CXX] support "ARG_ARGUMENT"])
   supports=no
diff --git a/make/autoconf/jdk-options.m4 b/make/autoconf/jdk-options.m4
index 43a7b56..e67ffd4 100644
--- a/make/autoconf/jdk-options.m4
+++ b/make/autoconf/jdk-options.m4
@@ -683,3 +683,178 @@ AC_DEFUN([JDKOPT_ALLOW_ABSOLUTE_PATHS_IN_OUTPUT],
 
   AC_SUBST(ALLOW_ABSOLUTE_PATHS_IN_OUTPUT)
 ])
+
+################################################################################
+#
+# Check and set options related to reproducible builds.
+#
+AC_DEFUN_ONCE([JDKOPT_SETUP_REPRODUCIBLE_BUILD],
+[
+  AC_ARG_WITH([source-date], [AS_HELP_STRING([--with-source-date],
+      [how to set SOURCE_DATE_EPOCH ('updated', 'current', 'version' a timestamp or an ISO-8601 date) @<:@updated@:>@])],
+      [with_source_date_present=true], [with_source_date_present=false])
+
+  AC_MSG_CHECKING([what source date to use])
+
+  if test "x$with_source_date" = xyes; then
+    AC_MSG_ERROR([--with-source-date must have a value])
+  elif test "x$with_source_date" = xupdated || test "x$with_source_date" = x; then
+    # Tell the makefiles to update at each build
+    SOURCE_DATE=updated
+    AC_MSG_RESULT([determined at build time, from 'updated'])
+  elif test "x$with_source_date" = xcurrent; then
+    # Set the current time
+    SOURCE_DATE=$($DATE +"%s")
+    AC_MSG_RESULT([$SOURCE_DATE, from 'current'])
+  elif test "x$with_source_date" = xversion; then
+    # Use the date from version-numbers
+    UTIL_GET_EPOCH_TIMESTAMP(SOURCE_DATE, $DEFAULT_VERSION_DATE)
+    if test "x$SOURCE_DATE" = x; then
+      AC_MSG_RESULT([unavailable])
+      AC_MSG_ERROR([Cannot convert DEFAULT_VERSION_DATE to timestamp])
+    fi
+    AC_MSG_RESULT([$SOURCE_DATE, from 'version'])
+  else
+    # It's a timestamp, an ISO-8601 date, or an invalid string
+    # Additional [] needed to keep m4 from mangling shell constructs.
+    if [ [[ "$with_source_date" =~ ^[0-9][0-9]*$ ]] ] ; then
+      SOURCE_DATE=$with_source_date
+      AC_MSG_RESULT([$SOURCE_DATE, from timestamp on command line])
+    else
+      UTIL_GET_EPOCH_TIMESTAMP(SOURCE_DATE, $with_source_date)
+      if test "x$SOURCE_DATE" != x; then
+        AC_MSG_RESULT([$SOURCE_DATE, from ISO-8601 date on command line])
+      else
+        AC_MSG_RESULT([unavailable])
+        AC_MSG_ERROR([Cannot parse date string "$with_source_date"])
+      fi
+    fi
+  fi
+
+  REPRODUCIBLE_BUILD_DEFAULT=$with_source_date_present
+
+  if test "x$OPENJDK_BUILD_OS" = xwindows && \
+      test "x$ALLOW_ABSOLUTE_PATHS_IN_OUTPUT" = xfalse; then
+    # To support banning absolute paths on Windows, we must use the -pathmap
+    # method, which requires reproducible builds.
+    REPRODUCIBLE_BUILD_DEFAULT=true
+  fi
+
+  UTIL_ARG_ENABLE(NAME: reproducible-build, DEFAULT: $REPRODUCIBLE_BUILD_DEFAULT,
+      RESULT: ENABLE_REPRODUCIBLE_BUILD,
+      DESC: [enable reproducible builds (not yet fully functional)],
+      DEFAULT_DESC: [enabled if --with-source-date is given or on Windows without absolute paths])
+
+  if test "x$OPENJDK_BUILD_OS" = xwindows && \
+      test "x$ALLOW_ABSOLUTE_PATHS_IN_OUTPUT" = xfalse && \
+      test "x$ENABLE_REPRODUCIBLE_BUILD" = xfalse; then
+    AC_MSG_NOTICE([On Windows it is not possible to combine  --disable-reproducible-builds])
+    AC_MSG_NOTICE([with --disable-absolute-paths-in-output.])
+    AC_MSG_ERROR([Cannot continue])
+  fi
+
+  AC_SUBST(SOURCE_DATE)
+  AC_SUBST(ENABLE_REPRODUCIBLE_BUILD)
+])
+
+################################################################################
+#
+# Setup signing on macOS. This can either be setup to sign with a real identity
+# and enabling the hardened runtime, or it can simply add the debug entitlement
+# com.apple.security.get-task-allow without actually signing any binaries. The
+# latter is needed to be able to debug processes and dump core files on modern
+# versions of macOS. It can also be skipped completely.
+#
+# Check if codesign will run with the given parameters
+# $1: Parameters to run with
+# $2: Checking message
+# Sets CODESIGN_SUCCESS=true/false
+AC_DEFUN([JDKOPT_CHECK_CODESIGN_PARAMS],
+[
+  PARAMS="$1"
+  MESSAGE="$2"
+  CODESIGN_TESTFILE="$CONFIGURESUPPORT_OUTPUTDIR/codesign-testfile"
+  $RM "$CODESIGN_TESTFILE"
+  $TOUCH "$CODESIGN_TESTFILE"
+  CODESIGN_SUCCESS=false
+  $CODESIGN $PARAMS "$CODESIGN_TESTFILE" 2>&AS_MESSAGE_LOG_FD \
+      >&AS_MESSAGE_LOG_FD && CODESIGN_SUCCESS=true
+  $RM "$CODESIGN_TESTFILE"
+  AC_MSG_CHECKING([$MESSAGE])
+  if test "x$CODESIGN_SUCCESS" = "xtrue"; then
+    AC_MSG_RESULT([yes])
+  else
+    AC_MSG_RESULT([no])
+  fi
+])
+
+AC_DEFUN([JDKOPT_CHECK_CODESIGN_HARDENED],
+[
+  JDKOPT_CHECK_CODESIGN_PARAMS([-s "$MACOSX_CODESIGN_IDENTITY" --option runtime],
+      [if codesign with hardened runtime is possible])
+])
+
+AC_DEFUN([JDKOPT_CHECK_CODESIGN_DEBUG],
+[
+  JDKOPT_CHECK_CODESIGN_PARAMS([-s -], [if debug mode codesign is possible])
+])
+
+AC_DEFUN([JDKOPT_SETUP_MACOSX_SIGNING],
+[
+  ENABLE_CODESIGN=false
+  if test "x$OPENJDK_TARGET_OS" = "xmacosx" && test "x$CODESIGN" != "x"; then
+
+    UTIL_ARG_WITH(NAME: macosx-codesign, TYPE: literal, OPTIONAL: true,
+        VALID_VALUES: [hardened debug auto], DEFAULT: auto,
+        ENABLED_DEFAULT: true,
+        CHECKING_MSG: [for macosx code signing mode],
+        DESC: [set the macosx code signing mode (hardened, debug, auto)]
+    )
+
+    MACOSX_CODESIGN_MODE=disabled
+    if test "x$MACOSX_CODESIGN_ENABLED" = "xtrue"; then
+
+      # Check for user provided code signing identity.
+      UTIL_ARG_WITH(NAME: macosx-codesign-identity, TYPE: string,
+          DEFAULT: openjdk_codesign, CHECK_VALUE: UTIL_CHECK_STRING_NON_EMPTY,
+          DESC: [specify the macosx code signing identity],
+          CHECKING_MSG: [for macosx code signing identity]
+      )
+      AC_SUBST(MACOSX_CODESIGN_IDENTITY)
+
+      if test "x$MACOSX_CODESIGN" = "xauto"; then
+        # Only try to default to hardened signing on release builds
+        if test "x$DEBUG_LEVEL" = "xrelease"; then
+          JDKOPT_CHECK_CODESIGN_HARDENED
+          if test "x$CODESIGN_SUCCESS" = "xtrue"; then
+            MACOSX_CODESIGN_MODE=hardened
+          fi
+        fi
+        if test "x$MACOSX_CODESIGN_MODE" = "xdisabled"; then
+          JDKOPT_CHECK_CODESIGN_DEBUG
+          if test "x$CODESIGN_SUCCESS" = "xtrue"; then
+            MACOSX_CODESIGN_MODE=debug
+          fi
+        fi
+        AC_MSG_CHECKING([for macosx code signing mode])
+        AC_MSG_RESULT([$MACOSX_CODESIGN_MODE])
+      elif test "x$MACOSX_CODESIGN" = "xhardened"; then
+        JDKOPT_CHECK_CODESIGN_HARDENED
+        if test "x$CODESIGN_SUCCESS" = "xfalse"; then
+          AC_MSG_ERROR([Signing with hardened runtime is not possible])
+        fi
+        MACOSX_CODESIGN_MODE=hardened
+      elif test "x$MACOSX_CODESIGN" = "xdebug"; then
+        JDKOPT_CHECK_CODESIGN_DEBUG
+        if test "x$CODESIGN_SUCCESS" = "xfalse"; then
+          AC_MSG_ERROR([Signing in debug mode is not possible])
+        fi
+        MACOSX_CODESIGN_MODE=debug
+      else
+        AC_MSG_ERROR([unknown value for --with-macosx-codesign: $MACOSX_CODESIGN])
+      fi
+    fi
+    AC_SUBST(MACOSX_CODESIGN_IDENTITY)
+    AC_SUBST(MACOSX_CODESIGN_MODE)
+  fi
+])
diff --git a/make/autoconf/jdk-version.m4 b/make/autoconf/jdk-version.m4
index 2620b01..f0d1edf 100644
--- a/make/autoconf/jdk-version.m4
+++ b/make/autoconf/jdk-version.m4
@@ -36,7 +36,7 @@
 AC_DEFUN([JDKVER_CHECK_AND_SET_NUMBER],
 [
   # Additional [] needed to keep m4 from mangling shell constructs.
-  if [ ! [[ "$2" =~ ^0*([1-9][0-9]*)|(0)$ ]] ] ; then
+  if [ ! [[ "$2" =~ ^0*([1-9][0-9]*)$|^0*(0)$ ]] ] ; then
     AC_MSG_ERROR(["$2" is not a valid numerical value for $1])
   fi
   # Extract the version number without leading zeros.
diff --git a/make/autoconf/lib-x11.m4 b/make/autoconf/lib-x11.m4
index d862c02..6ba668e 100644
--- a/make/autoconf/lib-x11.m4
+++ b/make/autoconf/lib-x11.m4
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2011, 2018, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2011, 2022, Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -103,22 +103,28 @@ AC_DEFUN_ONCE([LIB_SETUP_X11],
     OLD_CFLAGS="$CFLAGS"
     CFLAGS="$CFLAGS $SYSROOT_CFLAGS $X_CFLAGS"
 
-    HEADERS_TO_CHECK="X11/extensions/shape.h X11/extensions/Xrender.h X11/extensions/XTest.h X11/Intrinsic.h"
-    # There is no Xrandr extension on AIX
     if test "x$OPENJDK_TARGET_OS" != xaix; then
-      HEADERS_TO_CHECK="$HEADERS_TO_CHECK X11/extensions/Xrandr.h"
+      AC_CHECK_HEADERS([X11/extensions/shape.h X11/extensions/Xrender.h X11/extensions/XTest.h X11/Intrinsic.h X11/extensions/Xrandr.h],
+          [X11_HEADERS_OK=yes],
+          [X11_HEADERS_OK=no; break],
+          [
+            # include <X11/Xlib.h>
+            # include <X11/Xutil.h>
+          ]
+      )
+    else
+      # There is no Xrandr extension on AIX. Code is duplicated to avoid autoconf
+      # 2.71+ warning "AC_CHECK_HEADERS: you should use literals"
+      AC_CHECK_HEADERS([X11/extensions/shape.h X11/extensions/Xrender.h X11/extensions/XTest.h X11/Intrinsic.h],
+          [X11_HEADERS_OK=yes],
+          [X11_HEADERS_OK=no; break],
+          [
+            # include <X11/Xlib.h>
+            # include <X11/Xutil.h>
+          ]
+      )
     fi
 
-    # Need to include Xlib.h and Xutil.h to avoid "present but cannot be compiled" warnings on Solaris 10
-    AC_CHECK_HEADERS([$HEADERS_TO_CHECK],
-        [X11_HEADERS_OK=yes],
-        [X11_HEADERS_OK=no; break],
-        [
-          # include <X11/Xlib.h>
-          # include <X11/Xutil.h>
-        ]
-    )
-
     if test "x$X11_HEADERS_OK" = xno; then
       HELP_MSG_MISSING_DEPENDENCY([x11])
       AC_MSG_ERROR([Could not find all X11 headers (shape.h Xrender.h Xrandr.h XTest.h Intrinsic.h). $HELP_MSG])
diff --git a/make/autoconf/spec.gmk.in b/make/autoconf/spec.gmk.in
index 1746be3..3787b12 100644
--- a/make/autoconf/spec.gmk.in
+++ b/make/autoconf/spec.gmk.in
@@ -126,6 +126,9 @@ RELEASE_FILE_OS_NAME:=@RELEASE_FILE_OS_NAME@
 RELEASE_FILE_OS_ARCH:=@RELEASE_FILE_OS_ARCH@
 RELEASE_FILE_LIBC:=@RELEASE_FILE_LIBC@
 
+SOURCE_DATE := @SOURCE_DATE@
+ENABLE_REPRODUCIBLE_BUILD := @ENABLE_REPRODUCIBLE_BUILD@
+
 LIBM:=@LIBM@
 LIBDL:=@LIBDL@
 
@@ -419,7 +422,8 @@ MACOSX_VERSION_MIN=@MACOSX_VERSION_MIN@
 # The highest allowed version of macosx
 MACOSX_VERSION_MAX=@MACOSX_VERSION_MAX@
 
-# The macosx code signing identity to use
+# The macosx code signing configuration
+MACOSX_CODESIGN_MODE:=@MACOSX_CODESIGN_MODE@
 MACOSX_CODESIGN_IDENTITY=@MACOSX_CODESIGN_IDENTITY@
 
 # Toolchain type: gcc, clang, solstudio, lxc, microsoft...
diff --git a/make/autoconf/util.m4 b/make/autoconf/util.m4
index c768e42..7be5d52 100644
--- a/make/autoconf/util.m4
+++ b/make/autoconf/util.m4
@@ -52,7 +52,7 @@ m4_include([util_paths.m4])
 AC_DEFUN([UTIL_DEFUN_NAMED],
 [
   AC_DEFUN($1, [
-    m4_foreach(arg, m4_split($2), [
+    m4_foreach([arg], m4_split(m4_normalize($2)), [
       m4_if(m4_bregexp(arg, [^\*]), -1,
         [
           m4_set_add(legal_named_args, arg)
@@ -64,12 +64,18 @@ AC_DEFUN([UTIL_DEFUN_NAMED],
       )
     ])
 
-    m4_foreach([arg], [$3], [
-      m4_define(arg_name, m4_substr(arg, 0, m4_bregexp(arg, [: ])))
-      m4_set_contains(legal_named_args, arg_name, [],[AC_MSG_ERROR([Internal error: arg_name is not a valid named argument to [$1]. Valid arguments are 'm4_set_contents(legal_named_args, [ ])'.])])
+    # Delicate quoting and unquoting sequence to ensure the actual value is passed along unchanged
+    # For details on how this works, see https://git.openjdk.org/jdk/pull/11458#discussion_r1038173051
+    # WARNING: Proceed at the risk of your own sanity, getting this to work has made me completely
+    # incapable of feeling love or any other positive emotion
+    # ~Julian
+    m4_foreach([arg], m4_dquote(m4_dquote_elt($3)), [
+      m4_if(m4_index(arg, [: ]), -1, [m4_define([arg], m4_dquote(m4_bpatsubst(m4_dquote(arg), [:], [: ])))])
+      m4_define(arg_name, m4_substr(arg, 0, m4_index(arg, [: ])))
+      m4_set_contains(legal_named_args, arg_name, [],[AC_MSG_ERROR([Internal error: m4_if(arg_name, , arg, arg_name) is not a valid named argument to [$1]. Valid arguments are 'm4_set_contents(defined_args, [ ]) m4_set_contents(legal_named_args, [ ])'.])])
       m4_set_remove(required_named_args, arg_name)
       m4_set_remove(legal_named_args, arg_name)
-      m4_pushdef([ARG_][]arg_name, m4_substr(arg, m4_incr(m4_incr(m4_bregexp(arg, [: ])))))
+      m4_pushdef([ARG_][]arg_name, m4_bpatsubst(m4_bpatsubst(m4_dquote(m4_dquote(arg)), arg_name[: ]), [^\s*]))
       m4_set_add(defined_args, arg_name)
       m4_undefine([arg_name])
     ])
@@ -95,6 +101,83 @@ AC_DEFUN([UTIL_DEFUN_NAMED],
 ])
 
 ###############################################################################
+# Assert that a programmatic condition holds. If not, exit with an error message.
+# Check that a shell expression gives return code 0
+#
+# $1: The shell expression to evaluate
+# $2: A message to describe the expression in case of failure
+# $2: An message to print in case of failure [optional]
+#
+AC_DEFUN([UTIL_ASSERT_SHELL_TEST],
+[
+  ASSERTION_MSG="m4_normalize([$3])"
+  if $1; then
+    $ECHO Assertion failed: $2
+    if test "x$3" != x; then
+      $ECHO Assertion message: "$3"
+    fi
+    exit 1
+  fi
+])
+
+
+###############################################################################
+# Assert that a programmatic condition holds. If not, exit with an error message.
+# Check that two strings are equal.
+#
+# $1: The actual string found
+# $2: The expected string
+# $3: An message to print in case of failure [optional]
+#
+AC_DEFUN([UTIL_ASSERT_STRING_EQUALS],
+[
+  UTIL_ASSERT_SHELL_TEST(
+      [test "x[$1]" != "x[$2]"],
+      [Actual value '[$1]' \("[$1]"\) did not match expected value '[$2]' \("[$2]"\)],
+      $3)
+])
+
+###############################################################################
+# Assert that a programmatic condition holds. If not, exit with an error message.
+# Check that two strings not are equal.
+#
+# $1: The actual string found
+# $2: The expected string
+# $3: An message to print in case of failure [optional]
+#
+AC_DEFUN([UTIL_ASSERT_STRING_NOT_EQUALS],
+[
+  UTIL_ASSERT_SHELL_TEST(
+      [test "x[$1]" = "x[$2]"],
+      [Actual value '[$1]' \("[$1]"\) unexpectedly matched '[$2]' \("[$2]"\)],
+      $3)
+])
+
+###############################################################################
+# Assert that a programmatic condition holds. If not, exit with an error message.
+# Check that the given expression evaluates to the string 'true'
+#
+# $1: The expression to evaluate
+# $2: An message to print in case of failure [optional]
+#
+AC_DEFUN([UTIL_ASSERT_TRUE],
+[
+  UTIL_ASSERT_STRING_EQUALS($1, true, $3)
+])
+
+###############################################################################
+# Assert that a programmatic condition holds. If not, exit with an error message.
+# Check that the given expression does not evaluate to the string 'true'
+#
+# $1: The expression to evaluate
+# $2: An message to print in case of failure [optional]
+#
+AC_DEFUN([UTIL_ASSERT_NOT_TRUE],
+[
+  UTIL_ASSERT_STRING_NOT_EQUALS($1, true, $3)
+])
+
+###############################################################################
 # Check if a list of space-separated words are selected only from a list of
 # space-separated legal words. Typical use is to see if a user-specified
 # set of words is selected from a set of legal words.
@@ -149,6 +232,29 @@ AC_DEFUN([UTIL_GET_MATCHING_VALUES],
 ])
 
 ###############################################################################
+# Converts an ISO-8601 date/time string to a unix epoch timestamp. If no
+# suitable conversion method was found, an empty string is returned.
+#
+# Sets the specified variable to the resulting list.
+#
+# $1: result variable name
+# $2: input date/time string
+AC_DEFUN([UTIL_GET_EPOCH_TIMESTAMP],
+[
+  timestamp=$($DATE --utc --date=$2 +"%s" 2> /dev/null)
+  if test "x$timestamp" = x; then
+    # GNU date format did not work, try BSD date options
+    timestamp=$($DATE -j -f "%F %T" "$2" "+%s" 2> /dev/null)
+    if test "x$timestamp" = x; then
+      # Perhaps the time was missing
+      timestamp=$($DATE -j -f "%F %T" "$2 00:00:00" "+%s" 2> /dev/null)
+      # If this did not work, we give up and return the empty string
+    fi
+  fi
+  $1=$timestamp
+])
+
+###############################################################################
 # Sort a space-separated list, and remove duplicates.
 #
 # Sets the specified variable to the resulting list.
@@ -226,3 +332,493 @@ AC_DEFUN([UTIL_ALIASED_ARG_ENABLE],
     translit(patsubst($2, --), -, _)="$[enable_]translit($1, -, _)"
   ])
 ])
+
+###############################################################################
+# Creates a command-line option using the --enable-* pattern. Will return a
+# value of 'true' or 'false' in the RESULT variable, depending on whether the
+# option was enabled or not by the user. The option can not be turned on if it
+# is not available, as specified by AVAILABLE and/or CHECK_AVAILABLE.
+#
+# Arguments:
+#   NAME: The base name of this option (i.e. what follows --enable-). Required.
+#   RESULT: The name of the variable to set to the result. Defaults to
+#     <NAME in uppercase>_ENABLED.
+#   DEFAULT: The default value for this option. Can be true, false or auto.
+#     Defaults to true.
+#   AVAILABLE: If true, this option is allowed to be selected. Defaults to true.
+#   DESC: A description of this option. Defaults to a generic and unhelpful
+#     string.
+#   DEFAULT_DESC: A message describing the default value, for the help. Defaults
+#     to the literal value of DEFAULT.
+#   CHECKING_MSG: The message to present to user when checking this option.
+#     Defaults to a generic message.
+#   CHECK_AVAILABLE: An optional code block to execute to determine if the
+#     option should be available. Must set AVAILABLE to 'false' if not.
+#   IF_GIVEN:  An optional code block to execute if the option was given on the
+#     command line (regardless of the value).
+#   IF_NOT_GIVEN:  An optional code block to execute if the option was not given
+#     on the command line (regardless of the value).
+#   IF_ENABLED:  An optional code block to execute if the option is turned on.
+#   IF_DISABLED:  An optional code block to execute if the option is turned off.
+#
+UTIL_DEFUN_NAMED([UTIL_ARG_ENABLE],
+    [*NAME RESULT DEFAULT AVAILABLE DESC DEFAULT_DESC CHECKING_MSG
+    CHECK_AVAILABLE IF_GIVEN IF_NOT_GIVEN IF_ENABLED IF_DISABLED], [$@],
+[
+  ##########################
+  # Part 1: Set up m4 macros
+  ##########################
+
+  # If DEFAULT is not specified, set it to 'true'.
+  m4_define([ARG_DEFAULT], m4_if(ARG_DEFAULT, , true, ARG_DEFAULT))
+
+  # If AVAILABLE is not specified, set it to 'true'.
+  m4_define([ARG_AVAILABLE], m4_if(ARG_AVAILABLE, , true, ARG_AVAILABLE))
+
+  # If DEFAULT_DESC is not specified, calculate it from DEFAULT.
+  m4_define([ARG_DEFAULT_DESC], m4_if(ARG_DEFAULT_DESC, , m4_if(ARG_DEFAULT, true, enabled, m4_if(ARG_DEFAULT, false, disabled, ARG_DEFAULT)), ARG_DEFAULT_DESC))
+
+  # If RESULT is not specified, set it to 'ARG_NAME[_ENABLED]'.
+  m4_define([ARG_RESULT], m4_if(ARG_RESULT, , m4_translit(ARG_NAME, [a-z-], [A-Z_])[_ENABLED], ARG_RESULT))
+  # Construct shell variable names for the option
+  m4_define(ARG_OPTION, [enable_]m4_translit(ARG_NAME, [-], [_]))
+  m4_define(ARG_GIVEN, m4_translit(ARG_NAME, [a-z-], [A-Z_])[_GIVEN])
+
+  # If DESC is not specified, set it to a generic description.
+  m4_define([ARG_DESC], m4_if(m4_quote(ARG_DESC), , [[Enable the ARG_NAME feature]], [m4_normalize(ARG_DESC)]))
+
+  # If CHECKING_MSG is not specified, set it to a generic description.
+  m4_define([ARG_CHECKING_MSG], m4_if(m4_quote(ARG_CHECKING_MSG), , [[for --enable-ARG_NAME]], [m4_normalize(ARG_CHECKING_MSG)]))
+
+  # If the code blocks are not given, set them to the empty statements to avoid
+  # tripping up bash.
+  m4_if(ARG_CHECK_AVAILABLE, , [m4_define([ARG_CHECK_AVAILABLE], [:])])
+  m4_if(ARG_IF_GIVEN, , [m4_define([ARG_IF_GIVEN], [:])])
+  m4_if(ARG_IF_NOT_GIVEN, , [m4_define([ARG_IF_NOT_GIVEN], [:])])
+  m4_if(ARG_IF_ENABLED, , [m4_define([ARG_IF_ENABLED], [:])])
+  m4_if(ARG_IF_DISABLED, , [m4_define([ARG_IF_DISABLED], [:])])
+
+  ##########################
+  # Part 2: Set up autoconf shell code
+  ##########################
+
+  # Check that DEFAULT has a valid value
+  if test "[x]ARG_DEFAULT" != xtrue && test "[x]ARG_DEFAULT" != xfalse && \
+      test "[x]ARG_DEFAULT" != xauto ; then
+    AC_MSG_ERROR([Internal error: Argument DEFAULT to [UTIL_ARG_ENABLE] can only be true, false or auto, was: 'ARG_DEFAULT'])
+  fi
+
+  # Check that AVAILABLE has a valid value
+  if test "[x]ARG_AVAILABLE" != xtrue && test "[x]ARG_AVAILABLE" != xfalse; then
+    AC_MSG_ERROR([Internal error: Argument AVAILABLE to [UTIL_ARG_ENABLE] can only be true or false, was: 'ARG_AVAILABLE'])
+  fi
+
+  AC_ARG_ENABLE(ARG_NAME, AS_HELP_STRING([--enable-]ARG_NAME,
+      [ARG_DESC [ARG_DEFAULT_DESC]]), [ARG_GIVEN=true], [ARG_GIVEN=false])
+
+  # Check if the option is available
+  AVAILABLE=ARG_AVAILABLE
+  # Run the available check block (if any), which can overwrite AVAILABLE.
+  ARG_CHECK_AVAILABLE
+
+  # Check if the option should be turned on
+  AC_MSG_CHECKING(ARG_CHECKING_MSG)
+  if test x$ARG_GIVEN = xfalse; then
+    if test ARG_DEFAULT = auto; then
+      # If not given, and default is auto, set it to true iff it's available.
+      ARG_RESULT=$AVAILABLE
+      REASON="from default 'auto'"
+    else
+      ARG_RESULT=ARG_DEFAULT
+      REASON="default"
+    fi
+  else
+    if test x$ARG_OPTION = xyes; then
+      ARG_RESULT=true
+      REASON="from command line"
+    elif test x$ARG_OPTION = xno; then
+      ARG_RESULT=false
+      REASON="from command line"
+    elif test x$ARG_OPTION = xauto; then
+      if test ARG_DEFAULT = auto; then
+        # If both given and default is auto, set it to true iff it's available.
+        ARG_RESULT=$AVAILABLE
+      else
+        ARG_RESULT=ARG_DEFAULT
+      fi
+      REASON="from command line 'auto'"
+    else
+      AC_MSG_ERROR([Option [--enable-]ARG_NAME can only be 'yes', 'no' or 'auto'])
+    fi
+  fi
+
+  if test x$ARG_RESULT = xtrue; then
+    AC_MSG_RESULT([enabled, $REASON])
+    if test x$AVAILABLE = xfalse; then
+      AC_MSG_ERROR([Option [--enable-]ARG_NAME is not available])
+    fi
+  else
+    AC_MSG_RESULT([disabled, $REASON])
+  fi
+
+  # Execute result payloads, if present
+  if test x$ARG_GIVEN = xtrue; then
+    ARG_IF_GIVEN
+  else
+    ARG_IF_NOT_GIVEN
+  fi
+
+  if test x$ARG_RESULT = xtrue; then
+    ARG_IF_ENABLED
+  else
+    ARG_IF_DISABLED
+  fi
+])
+
+###############################################################################
+# Helper functions for ARG_WITH, to validate different types of argument
+
+# Dispatcher to call the correct UTIL_CHECK_TYPE_* function depending on the ARG_TYPE
+AC_DEFUN([UTIL_CHECK_TYPE],
+[
+  UTIL_CHECK_TYPE_$1($2)
+])
+
+AC_DEFUN([UTIL_CHECK_TYPE_string],
+[
+  # All strings always passes
+])
+
+AC_DEFUN([UTIL_CHECK_TYPE_integer],
+[
+  # Check that the argument is an integer
+  # Additional [] needed to keep m4 from mangling shell constructs.
+  [ if [[ ! "$1" =~ ^[0-9]+$ ]] ; then ]
+    FAILURE="Not an integer: $1"
+  fi
+])
+
+AC_DEFUN([UTIL_CHECK_TYPE_file],
+[
+  # Check that the argument is an existing file
+  if test ! -f "$1" ; then
+    FAILURE="File $1 does not exist or is not readable"
+  fi
+])
+
+AC_DEFUN([UTIL_CHECK_TYPE_directory],
+[
+  # Check that the argument is an existing directory
+  if test ! -d "$1" ; then
+    FAILURE="Directory $1 does not exist or is not readable"
+  fi
+
+  if test "[x]ARG_CHECK_FOR_FILES" != x; then
+    for file in ARG_CHECK_FOR_FILES; do
+      found_files=$($ECHO $(ls $1/$file 2> /dev/null))
+      if test "x$found_files" = x; then
+        FAILURE="Directory $1 does not contain $file"
+        break
+      elif ! test -e "$found_files"; then
+        FAILURE="Directory $1 contains multiple $file: $found_files"
+        break
+      fi
+    done
+  fi
+])
+
+AC_DEFUN([UTIL_CHECK_TYPE_literal],
+[
+  # Check if it contains a space between non-space characters
+  # Additional [] needed to keep m4 from mangling shell constructs.
+  [ if [[ "$1" =~ [^' ']' '+[^' '] ]] ; then ]
+    FAILURE="Multiple words: $1"
+  fi
+
+  # Check that the selected variants are valid
+  UTIL_GET_NON_MATCHING_VALUES(invalid_value, $1, \
+      ARG_VALID_VALUES)
+  if test "x$invalid_value" != x; then
+    FAILURE="Invalid value: $invalid_value. Valid values are: ARG_VALID_VALUES"
+  fi
+])
+
+AC_DEFUN([UTIL_CHECK_TYPE_multivalue],
+[
+  # We accept either space or comma as separator, but use space internally
+  values=`$ECHO $1 | $SED -e 's/,/ /g'`
+
+  # Check that the selected variants are valid
+  UTIL_GET_NON_MATCHING_VALUES(invalid_value, $values, \
+      ARG_VALID_VALUES)
+  if test "x$invalid_value" != x; then
+    FAILURE="Invalid value(s): $invalid_value. Valid values are: ARG_VALID_VALUES"
+  fi
+
+  # Update to version without comma
+  ARG_RESULT=$($ECHO $values)
+])
+
+AC_DEFUN([UTIL_CHECK_TYPE_features],
+[
+  # We accept either space or comma as separator, but use space internally
+  feature_list=`$ECHO $1 | $SED -e 's/,/ /g'`
+  features_enabled=`$ECHO $feature_list | \
+    $AWK '{ for (i=1; i<=NF; i++) if (!match($i, /^-.*/)) printf("%s ", $i) }'`
+  features_disabled=`$ECHO $feature_list | \
+    $AWK '{ for (i=1; i<=NF; i++) if (match($i, /^-.*/)) printf("%s ", substr($i, 2))}'`
+
+  # Check that the selected features are valid
+  UTIL_GET_NON_MATCHING_VALUES(invalid_features, $features_enabled \
+        $features_disabled, ARG_VALID_VALUES)
+  if test "x$invalid_features" != x; then
+    FAILURE="Invalid feature(s): $invalid_features. Valid values are: ARG_VALID_VALUES"
+  fi
+
+  # Update to version without comma
+  ARG_RESULT=$($ECHO $feature_list)
+])
+
+###############################################################################
+# Creates a command-line option using the --with-* pattern. Will return a
+# string in the RESULT variable with the option provided by the user, or the
+# empty string if the --with-* option was not given. The option can not be given
+# if it is not available, as specified by AVAILABLE and/or CHECK_AVAILABLE.
+#
+# Arguments:
+#   NAME: The base name of this option (i.e. what follows --with-). Required.
+#   TYPE: The type of the value. Can be one of "string", "integer", "file",
+#     "directory", "literal", "multivalue" or "features". Required.
+#   DEFAULT: The default value for this option. Can be any valid string.
+#     Required.
+#   OPTIONAL: If this feature can be disabled. Defaults to false. If true,
+#     the feature can be disabled using --without-FOO, --with-FOO=no, or
+#     --with-FOO=. Check the ENABLED_RESULT variable for the enabled/disabled
+#     state.
+#   RESULT: The name of the variable to set to the result. Defaults to
+#     <NAME in uppercase>. Set to empty if ENABLED_RESULT is false.
+#   ENABLED_DEFAULT: If the value is enabled by default. Defaults to false. Only
+#     relevant if OPTIONAL is true.
+#   ENABLED_RESULT: The name of the variable to set to the enabled/disabled
+#     result state. Defaults to <NAME in uppercase>_ENABLED.
+#   AVAILABLE: If true, this option is allowed to be selected. Defaults to true.
+#   DESC: A description of this option. Defaults to a generic and unhelpful
+#     string.
+#   DEFAULT_DESC: A message describing the default value, for the help. Defaults
+#     to the literal value of DEFAULT, or "<none>" if DEFAULT is empty.
+#   CHECKING_MSG: The message to present to user when checking this option.
+#     Defaults to a generic message.
+#   CHECK_AVAILABLE: An optional code block to execute to determine if the
+#     option should be available. Must set AVAILABLE to 'false' if not.
+#   VALID_VALUES: A list of literals that are the allowed values. Only valid if
+#     TYPE is "literal", "multivalue" or "features".
+#   CHECK_VALUE: An optional code block to execute to determine if the value
+#     is correct. Must set FAILURE to a non-empty string if not. This string
+#     will be displayed. The value is given in $RESULT.
+#   CHECK_FOR_FILES: A list of files to verify the presence for. Only valid if
+#     TYPE is "directory". Paths are relative the directory given as value.
+#     Wildcards are accepted. Exactly one matching file must be found, for each
+#     listed file, or FAILURE is set.
+#   IF_AUTO: An optional code block to execute if the value is "auto", either by
+#     default or given by the command line. Must set RESULT to the calculated
+#     value.
+#   IF_GIVEN:  An optional code block to execute if the option was given on the
+#     command line (regardless of the value).
+#   IF_NOT_GIVEN:  An optional code block to execute if the option was not given
+#     on the command line (regardless of the value).
+#
+UTIL_DEFUN_NAMED([UTIL_ARG_WITH],
+    [*NAME *TYPE *DEFAULT OPTIONAL RESULT ENABLED_DEFAULT ENABLED_RESULT
+    AVAILABLE DESC DEFAULT_DESC CHECKING_MSG CHECK_AVAILABLE VALID_VALUES
+    CHECK_VALUE CHECK_FOR_FILES IF_AUTO IF_GIVEN IF_NOT_GIVEN], [$@],
+[
+  ##########################
+  # Part 1: Set up m4 macros
+  ##########################
+
+  # If ENABLED_DEFAULT is not specified, set it to 'false'.
+  m4_define([ARG_ENABLED_DEFAULT], m4_if(ARG_ENABLED_DEFAULT, , false, ARG_ENABLED_DEFAULT))
+
+  # If AVAILABLE is not specified, set it to 'true'.
+  m4_define([ARG_AVAILABLE], m4_if(ARG_AVAILABLE, , true, ARG_AVAILABLE))
+
+  # If OPTIONAL is not specified, set it to 'false'.
+  m4_define([ARG_OPTIONAL], m4_if(ARG_OPTIONAL, , false, ARG_OPTIONAL))
+
+  # If DEFAULT_DESC is not specified, calculate it from DEFAULT.
+  m4_define([ARG_DEFAULT_DESC], m4_if(ARG_DEFAULT_DESC, , m4_if(ARG_DEFAULT, , <none>, ARG_DEFAULT), ARG_DEFAULT_DESC))
+
+  # If RESULT is not specified, set it to 'ARG_NAME'.
+  m4_define([ARG_RESULT], m4_if(ARG_RESULT, , m4_translit(ARG_NAME, [a-z-], [A-Z_]), ARG_RESULT))
+
+  # If ENABLED_RESULT is not specified, set it to 'ARG_NAME[_ENABLED]'.
+  m4_define([ARG_ENABLED_RESULT], m4_if(ARG_ENABLED_RESULT, , m4_translit(ARG_NAME, [a-z-], [A-Z_])[_ENABLED], ARG_ENABLED_RESULT))
+
+  # Construct shell variable names for the option
+  m4_define(ARG_OPTION, [with_]m4_translit(ARG_NAME, [-], [_]))
+  m4_define(ARG_GIVEN, m4_translit(ARG_NAME, [a-z-], [A-Z_])[_GIVEN])
+
+  # If DESC is not specified, set it to a generic description.
+  m4_define([ARG_DESC], m4_if(m4_quote(ARG_DESC), , [[Give a value for the ARG_NAME feature]], [m4_normalize(ARG_DESC)]))
+
+  # If CHECKING_MSG is not specified, set it to a generic description.
+  m4_define([ARG_CHECKING_MSG], m4_if(m4_quote(ARG_CHECKING_MSG), , [[for --with-ARG_NAME]], [m4_normalize(ARG_CHECKING_MSG)]))
+
+  m4_define([ARG_HAS_AUTO_BLOCK], m4_if(ARG_IF_AUTO, , false, true))
+
+  # If the code blocks are not given, set them to the empty statements to avoid
+  # tripping up bash.
+  m4_if(ARG_CHECK_AVAILABLE, , [m4_define([ARG_CHECK_AVAILABLE], [:])])
+  m4_if(ARG_CHECK_VALUE, , [m4_define([ARG_CHECK_VALUE], [:])])
+  m4_if(ARG_CHECK_FOR_FILES, , [m4_define([ARG_CHECK_FOR_FILES], [:])])
+  m4_if(ARG_IF_AUTO, , [m4_define([ARG_IF_AUTO], [:])])
+  m4_if(ARG_IF_GIVEN, , [m4_define([ARG_IF_GIVEN], [:])])
+  m4_if(ARG_IF_NOT_GIVEN, , [m4_define([ARG_IF_NOT_GIVEN], [:])])
+
+  ##########################
+  # Part 2: Set up autoconf shell code
+  ##########################
+
+  # Check that OPTIONAL has a valid value
+  if test "[x]ARG_OPTIONAL" != xtrue && test "[x]ARG_OPTIONAL" != xfalse ; then
+    AC_MSG_ERROR([Internal error: Argument OPTIONAL to [UTIL_ARG_WITH] can only be true or false, was: 'ARG_OPTIONAL'])
+  fi
+
+  # Check that ENABLED_DEFAULT has a valid value
+  if test "[x]ARG_ENABLED_DEFAULT" != xtrue && test "[x]ARG_ENABLED_DEFAULT" != xfalse ; then
+    AC_MSG_ERROR([Internal error: Argument ENABLED_DEFAULT to [UTIL_ARG_WITH] can only be true or false, was: 'ARG_ENABLED_DEFAULT'])
+  fi
+
+  # Check that AVAILABLE has a valid value
+  if test "[x]ARG_AVAILABLE" != xtrue && test "[x]ARG_AVAILABLE" != xfalse; then
+    AC_MSG_ERROR([Internal error: Argument AVAILABLE to [UTIL_ARG_WITH] can only be true or false, was: 'ARG_AVAILABLE'])
+  fi
+
+  # Check that TYPE has a valid value
+  # Need to assign since we can't expand ARG TYPE inside the m4 quoted if statement
+  TEST_TYPE="ARG_TYPE"
+  # Additional [] needed to keep m4 from mangling shell constructs.
+  [ if [[ ! "$TEST_TYPE" =~ ^(string|integer|file|directory|literal|multivalue|features)$ ]] ; then ]
+    AC_MSG_ERROR([Internal error: Argument TYPE to [UTIL_ARG_WITH] must be a valid type, was: 'ARG_TYPE'])
+  fi
+
+  AC_ARG_WITH(ARG_NAME, AS_HELP_STRING([--with-]ARG_NAME,
+      [ARG_DESC [ARG_DEFAULT_DESC]]), [ARG_GIVEN=true], [ARG_GIVEN=false])
+
+  # Check if the option is available
+  AVAILABLE=ARG_AVAILABLE
+  # Run the available check block (if any), which can overwrite AVAILABLE.
+  ARG_CHECK_AVAILABLE
+
+  # Check if the option should be turned on
+  AC_MSG_CHECKING(ARG_CHECKING_MSG)
+
+  if test x$AVAILABLE = xfalse; then
+    ARG_RESULT="$ARG_OPTION"
+    ARG_ENABLED_RESULT=false
+    REASON="not available"
+  else
+    if test x$ARG_GIVEN = xfalse; then
+      ARG_RESULT="ARG_DEFAULT"
+      if test "[x]ARG_OPTIONAL" = xtrue; then
+        ARG_ENABLED_RESULT=ARG_ENABLED_DEFAULT
+      else
+        ARG_ENABLED_RESULT=true
+      fi
+      REASON="default"
+
+    else # ARG_GIVEN is true
+      # Special treatment of "yes" and "no" for "--with-ARG" and "--without-ARG"
+      if test "x$ARG_OPTION" = xyes || test "x$ARG_OPTION" = xno || test "x$ARG_OPTION" = x ; then
+        if test "[x]ARG_OPTIONAL" = xfalse; then
+          if test "x$ARG_OPTION" = x; then
+            # If not optional, the empty string is a valid value
+            ARG_RESULT=""
+            ARG_ENABLED_RESULT=true
+            REASON="from command line"
+          else
+            AC_MSG_RESULT([invalid])
+            AC_MSG_ERROR([Option [--with-]ARG_NAME must have a specified value])
+          fi
+        else
+          if test "x$ARG_OPTION" = xyes; then
+            ARG_RESULT="ARG_DEFAULT"
+            ARG_ENABLED_RESULT=true
+            REASON="default as enabled from command line"
+          else
+            # For optional values, both --without-FOO and --with-FOO= disables
+            ARG_RESULT=""
+            ARG_ENABLED_RESULT=false
+            REASON="from command line"
+          fi
+        fi
+      else
+        # The most common case -- the user gives a value for the option.
+        ARG_RESULT="$ARG_OPTION"
+        ARG_ENABLED_RESULT=true
+        REASON="from command line"
+      fi
+    fi
+  fi
+
+  if test "x$ARG_ENABLED_RESULT" = xfalse; then
+    if test "x$REASON" = "xnot available"; then
+      AC_MSG_RESULT([<invalid>, $REASON])
+      if test "x$ARG_RESULT" != "x" && test "x$ARG_RESULT" != "xno" ; then
+        AC_MSG_WARN([Option [--with-]ARG_NAME is not available for this configuration])
+      fi
+    else
+      AC_MSG_RESULT([<disabled>, $REASON])
+    fi
+    ARG_RESULT=""
+  else
+    if test [x]ARG_HAS_AUTO_BLOCK = xtrue && test "x$ARG_RESULT" = xauto; then
+      # Execute "auto" payload
+      ARG_IF_AUTO
+
+      ARG_RESULT="$RESULT"
+      REASON="$REASON (calculated from 'auto')"
+    fi
+
+    if test "x$ARG_RESULT" = x; then
+      AC_MSG_RESULT([<none>, $REASON])
+    else
+      AC_MSG_RESULT([$ARG_RESULT, $REASON])
+    fi
+  fi
+
+  # Verify value
+  # First use our dispatcher to verify that type requirements are satisfied
+  UTIL_CHECK_TYPE(ARG_TYPE, $ARG_RESULT)
+
+  if test "x$FAILURE" = x; then
+    # Execute custom verification payload, if present
+    RESULT="$ARG_RESULT"
+
+    ARG_CHECK_VALUE
+
+    ARG_RESULT="$RESULT"
+  fi
+
+  if test "x$FAILURE" != x; then
+    AC_MSG_NOTICE([Invalid value for [--with-]ARG_NAME: "$ARG_RESULT"])
+    AC_MSG_NOTICE([$FAILURE])
+    AC_MSG_ERROR([Cannot continue])
+  fi
+
+  # Execute result payloads, if present
+  if test x$ARG_GIVEN = xtrue; then
+    ARG_IF_GIVEN
+  else
+    ARG_IF_NOT_GIVEN
+  fi
+])
+
+###############################################################################
+# Helper functions for CHECK_VALUE in ARG_WITH.
+AC_DEFUN([UTIL_CHECK_STRING_NON_EMPTY],
+[
+  if test "x$RESULT" = "x"; then
+    FAILURE="Value cannot be empty"
+  fi
+])
diff --git a/make/autoconf/version-numbers b/make/autoconf/version-numbers
index 83fe092..64bc19b 100644
--- a/make/autoconf/version-numbers
+++ b/make/autoconf/version-numbers
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2011, 2020, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2011, 2023, Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -28,12 +28,12 @@
 
 DEFAULT_VERSION_FEATURE=11
 DEFAULT_VERSION_INTERIM=0
-DEFAULT_VERSION_UPDATE=18
+DEFAULT_VERSION_UPDATE=19
 DEFAULT_VERSION_PATCH=0
 DEFAULT_VERSION_EXTRA1=0
 DEFAULT_VERSION_EXTRA2=0
 DEFAULT_VERSION_EXTRA3=0
-DEFAULT_VERSION_DATE=2023-01-17
+DEFAULT_VERSION_DATE=2023-04-18
 DEFAULT_VERSION_CLASSFILE_MAJOR=55  # "`$EXPR $DEFAULT_VERSION_FEATURE + 44`"
 DEFAULT_VERSION_CLASSFILE_MINOR=0
 DEFAULT_ACCEPTABLE_BOOT_VERSIONS="10 11"
diff --git a/make/common/CopyFiles.gmk b/make/common/CopyFiles.gmk
 new file mode 100644
index 0000000..ac2ef69
--- /dev/null
+++ b/make/common/CopyFiles.gmk
@@ -0,0 +1,112 @@
+#
+# Copyright (c) 2011, 2019, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+ifeq (,$(_MAKEBASE_GMK))
+  $(error You must include MakeBase.gmk prior to including CopyFiles.gmk)
+endif
+
+################################################################################
+#
+# Code for handling the SetupCopyFiles macro.
+#
+################################################################################
+
+define AddFileToCopy
+  # Helper macro for SetupCopyFiles
+  # 1 : Source file
+  # 2 : Dest file
+  # 3 : Variable to add targets to
+  # 4 : Macro to call for copy operation
+  # 5 : Action text to log
+  $2: $1
+	$$(call LogInfo, $(strip $5) $$(patsubst $(OUTPUTDIR)/%,%,$$(call DecodeSpace, $$@)))
+	$$($$(strip $4))
+
+  $3 += $2
+  $3_SOURCES += $1
+endef
+
+# Returns the value of the first argument
+identity = \
+    $(strip $1)
+
+# Setup make rules for copying files, with an option to do more complex
+# processing instead of copying.
+#
+# Parameter 1 is the name of the rule. This name is used as variable prefix,
+# and the targets generated are listed in a variable by that name.
+#
+# The list of all source files is returned in $1_SOURCES.
+#
+# Remaining parameters are named arguments. These include:
+#   SRC     : Source root dir (defaults to dir of first file)
+#   DEST    : Dest root dir
+#   FILES   : List of files to copy with absolute paths, or path relative to SRC.
+#             Must be in SRC.
+#   FLATTEN : Set to flatten the directory structure in the DEST dir.
+#   MACRO   : Optionally override the default macro used for making the copy.
+#             Default is 'install-file'
+#   NAME_MACRO : Optionally supply a macro that rewrites the target file name
+#                based on the source file name
+#   LOG_ACTION : Optionally specify a different action text for log messages
+SetupCopyFiles = $(NamedParamsMacroTemplate)
+define SetupCopyFilesBody
+
+  ifeq ($$($1_MACRO), )
+    $1_MACRO := install-file
+  endif
+
+  # Default SRC to the dir of the first file.
+  ifeq ($$($1_SRC), )
+    $1_SRC := $$(dir $$(firstword $$($1_FILES)))
+  endif
+
+  ifeq ($$($1_NAME_MACRO), )
+    $1_NAME_MACRO := identity
+  endif
+
+  ifeq ($$($1_LOG_ACTION), )
+    $1_LOG_ACTION := Copying
+  endif
+
+  # Remove any trailing slash from SRC and DEST
+  $1_SRC := $$(patsubst %/,%,$$($1_SRC))
+  $1_DEST := $$(patsubst %/,%,$$($1_DEST))
+
+  # Need to wrap arguments in DoubleDollar because of the eval nested inside an
+  # eval macro body.
+  $$(foreach f, $$(patsubst $$($1_SRC)/%,%,$$($1_FILES)), \
+    $$(eval $$(call AddFileToCopy, \
+        $$(call DoubleDollar, $$($1_SRC)/$$f), \
+        $$(call DoubleDollar, \
+            $$($1_DEST)/$$(call $$(strip $$($1_NAME_MACRO)),$$(if $$($1_FLATTEN),$$(notdir $$f),$$f)) \
+        ), \
+        $1, \
+        $$($1_MACRO), \
+        $$($1_LOG_ACTION) \
+    )) \
+  )
+
+endef
diff --git a/make/common/FindTests.gmk b/make/common/FindTests.gmk
index 35a9e20..283f93e 100644
--- a/make/common/FindTests.gmk
+++ b/make/common/FindTests.gmk
@@ -53,6 +53,7 @@ define FindJtregGroupsBody
         -e 's/^groups\w*=//p' $1/TEST.ROOT)
     $1_JTREG_GROUP_FILES := $$(addprefix $1/, $$($1_JTREG_GROUP_FILENAMES))
     $1_JTREG_TEST_GROUPS := $$(strip $$(shell $$(SED) -n \
+        -e 's/^\#.*//g' \
         -e 's/\([^ ]*\)\w*=.*/\1/gp' $$(wildcard $$($1_JTREG_GROUP_FILES)) \
         | $$(SORT) -u))
   endif
diff --git a/make/common/MakeBase.gmk b/make/common/MakeBase.gmk
index a96edc2..dd81ba3 100644
--- a/make/common/MakeBase.gmk
+++ b/make/common/MakeBase.gmk
@@ -1,5 +1,5 @@
 #
-# Copyright (c) 2011, 2018, Oracle and/or its affiliates. All rights reserved.
+# Copyright (c) 2011, 2019, Oracle and/or its affiliates. All rights reserved.
 # DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 #
 # This code is free software; you can redistribute it and/or modify it
@@ -75,17 +75,17 @@ ifeq (4.0, $(firstword $(sort 4.0 $(MAKE_VERSION))))
   RWILDCARD_WORKS := true
 endif
 
-##############################
-# Functions
-##############################
 
-### Debug functions
+# For convenience, MakeBase.gmk continues to include these separate files, at
+# least for now.
 
-# Prints the name and value of a variable
-PrintVar = \
-    $(info $(strip $1) >$($(strip $1))<)
+include $(TOPDIR)/make/common/Utils.gmk
+include $(TOPDIR)/make/common/MakeIO.gmk
+include $(TOPDIR)/make/common/CopyFiles.gmk
 
-### Functions for timers
+################################################################################
+# Functions for timers
+################################################################################
 
 # Store the build times in this directory.
 BUILDTIMESDIR=$(OUTPUTDIR)/make-support/build-times
@@ -122,227 +122,6 @@ define TargetExit
 endef
 
 ################################################################################
-# This macro translates $ into \$ to protect the $ from expansion in the shell.
-# To make this macro resilient against already escaped strings, first remove
-# any present escapes before escaping so that no double escapes are added.
-EscapeDollar = $(subst $$,\$$,$(subst \$$,$$,$(strip $1)))
-
-################################################################################
-# This macro works just like EscapeDollar above, but for #.
-EscapeHash = $(subst \#,\\\#,$(subst \\\#,\#,$(strip $1)))
-
-################################################################################
-# This macro translates $ into $$ to protect the string from make itself.
-DoubleDollar = $(subst $$,$$$$,$(strip $1))
-
-################################################################################
-# ListPathsSafely can be used to print command parameters to a file. This is
-# typically done if the command line lenght risk being too long for the
-# OS/shell. In later make versions, the file function can be used for this
-# purpose. For earlier versions, a more complex implementation is provided.
-#
-# The function ListPathsSafely can be called either directly or, more commonly
-# from a recipe line. If called from a recipe, it will be executed in the
-# evaluation phase of that recipe, which means that it will write to the file
-# before any other line in the recipe has been run.
-ifeq ($(HAS_FILE_FUNCTION), true)
-  # Param 1 - Name of variable containing paths/arguments to output
-  # Param 2 - File to print to
-  # Param 3 - Set to true to append to file instead of overwriting
-  define ListPathsSafely
-    $$(call MakeDir, $$(dir $$(strip $2)))
-    $$(file $$(if $$(filter true, $$(strip $3)),>>,>) \
-        $$(strip $2),$$(subst $$(SPACE),$$(NEWLINE),$$(strip $$($$(strip $1)))))
-  endef
-
-else # HAS_FILE_FUNCTION = false
-
-  $(eval compress_paths = \
-      $(strip $(shell $(CAT) $(TOPDIR)/make/common/support/ListPathsSafely-pre-compress.incl)))
-  compress_paths += \
-      $(subst $(TOPDIR),X97, \
-      $(subst $(OUTPUTDIR),X98, \
-      $(subst X,X00, \
-      $(subst $(SPACE),\n,$(strip $1)))))
-  $(eval compress_paths += \
-      $(strip $(shell $(CAT) $(TOPDIR)/make/common/support/ListPathsSafely-post-compress.incl)))
-
-  decompress_paths=$(SED) -f $(TOPDIR)/make/common/support/ListPathsSafely-uncompress.sed \
-      -e 's|X99|\\n|g' \
-      -e 's|X98|$(OUTPUTDIR)|g' -e 's|X97|$(TOPDIR)|g' \
-      -e 's|X00|X|g'
-
-  ListPathsSafely_IfPrintf = \
-      $(if $(word $3,$($(strip $1))), \
-          $(shell $(PRINTF) -- "$(strip $(call EscapeDollar, \
-              $(call compress_paths, $(wordlist $3,$4,$($(strip $1))))))\n" \
-              | $(decompress_paths) >> $2))
-
-  # Param 1 - Name of variable containing paths/arguments to output
-  # Param 2 - File to print to
-  # Param 3 - Set to true to append to file instead of overwriting
-  define ListPathsSafely
-    ifneq (,$$(word 30001,$$($$(strip $1))))
-      $$(error Cannot list safely more than 30000 paths. $1 has $$(words $$($$(strip $1))) paths!)
-    endif
-    $$(call MakeDir, $$(dir $2))
-    ifneq ($$(strip $3), true)
-      $$(shell $(RM) $$(strip $2))
-    endif
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,1,250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,251,500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,501,750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,751,1000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,1001,1250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,1251,1500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,1501,1750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,1751,2000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,2001,2250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,2251,2500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,2501,2750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,2751,3000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,3001,3250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,3251,3500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,3501,3750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,3751,4000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,4001,4250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,4251,4500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,4501,4750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,4751,5000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,5001,5250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,5251,5500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,5501,5750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,5751,6000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,6001,6250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,6251,6500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,6501,6750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,6751,7000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,7001,7250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,7251,7500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,7501,7750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,7751,8000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,8001,8250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,8251,8500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,8501,8750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,8751,9000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,9001,9250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,9251,9500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,9501,9750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,9751,10000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,10001,10250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,10251,10500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,10501,10750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,10751,11000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,11001,11250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,11251,11500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,11501,11750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,11751,12000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,12001,12250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,12251,12500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,12501,12750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,12751,13000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,13001,13250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,13251,13500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,13501,13750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,13751,14000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,14001,14250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,14251,14500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,14501,14750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,14751,15000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,15001,15250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,15251,15500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,15501,15750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,15751,16000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,16001,16250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,16251,16500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,16501,16750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,16751,17000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,17001,17250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,17251,17500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,17501,17750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,17751,18000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,18001,18250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,18251,18500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,18501,18750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,18751,19000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,19001,19250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,19251,19500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,19501,19750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,19751,20000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,20001,20250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,20251,20500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,20501,20750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,20751,21000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,21001,21250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,21251,21500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,21501,21750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,21751,22000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,22001,22250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,22251,22500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,22501,22750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,22751,23000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,23001,23250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,23251,23500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,23501,23750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,23751,24000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,24001,24250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,24251,24500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,24501,24750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,24751,25000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,25001,25250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,25251,25500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,25501,25750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,25751,26000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,26001,26250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,26251,26500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,26501,26750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,26751,27000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,27001,27250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,27251,27500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,27501,27750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,27751,28000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,28001,28250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,28251,28500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,28501,28750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,28751,29000)
-
-    $$(call ListPathsSafely_IfPrintf,$1,$2,29001,29250)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,29251,29500)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,29501,29750)
-    $$(call ListPathsSafely_IfPrintf,$1,$2,29751,30000)
-  endef
-endif # HAS_FILE_FUNCTION
-
-################################################################################
 
 # A file containing a way to uniquely identify the source code revision that
 # the build was created from
@@ -414,21 +193,6 @@ endef
 $(eval $(call SetupLogging))
 
 ################################################################################
-# Creates a sequence of increasing numbers (inclusive).
-# Param 1 - starting number
-# Param 2 - ending number
-sequence = \
-    $(wordlist $1, $2, $(strip \
-        $(eval SEQUENCE_COUNT :=) \
-        $(call _sequence-do,$(strip $2))))
-
-_sequence-do = \
-    $(if $(word $1, $(SEQUENCE_COUNT)),, \
-      $(eval SEQUENCE_COUNT += .) \
-      $(words $(SEQUENCE_COUNT)) \
-      $(call _sequence-do,$1))
-
-################################################################################
 
 MAX_PARAMS := 36
 PARAM_SEQUENCE := $(call sequence, 2, $(MAX_PARAMS))
@@ -470,16 +234,6 @@ define NamedParamsMacroTemplate
 endef
 
 ################################################################################
-# Replace question marks with space in string. This macro needs to be called on
-# files from FindFiles in case any of them contains space in their file name,
-# since FindFiles replaces space with ?.
-# Param 1 - String to replace in
-DecodeSpace = \
-    $(subst ?,$(SPACE),$(strip $1))
-EncodeSpace = \
-    $(subst $(SPACE),?,$(strip $1))
-
-################################################################################
 # Make directory without forking mkdir if not needed.
 #
 # If a directory with an encoded space is provided, the wildcard function
@@ -507,16 +261,9 @@ MakeTargetDir = \
     $(call MakeDir, $(dir $(call EncodeSpace, $@)))
 
 ################################################################################
-# Assign a variable only if it is empty
-# Param 1 - Variable to assign
-# Param 2 - Value to assign
-SetIfEmpty = \
-    $(if $($(strip $1)),,$(eval $(strip $1) := $2))
-
-################################################################################
 # All install-file and related macros automatically call DecodeSpace when needed.
 
-ifeq ($(OPENJDK_TARGET_OS),solaris)
+ifeq ($(call isTargetOs, solaris), true)
   # On Solaris, if the target is a symlink and exists, cp won't overwrite.
   # Cp has to operate in recursive mode to allow for -P flag, to preserve soft links. If the
   # name of the target file differs from the source file, rename after copy.
@@ -542,7 +289,7 @@ ifeq ($(OPENJDK_TARGET_OS),solaris)
 	  $(CP) -f '$(call DecodeSpace, $<)' '$(call DecodeSpace, $@)'; \
 	fi
   endef
-else ifeq ($(OPENJDK_TARGET_OS),macosx)
+else ifeq ($(call isTargetOs, macosx), true)
   # On mac, extended attributes sometimes creep into the source files, which may later
   # cause the creation of ._* files which confuses testing. Clear these with xattr if
   # set. Some files get their write permissions removed after being copied to the
@@ -581,113 +328,40 @@ define install-file-nolink
 endef
 
 ################################################################################
-# Take two paths and return the path of the last common directory.
-# Ex: /foo/bar/baz, /foo/bar/banan -> /foo/bar
-#     foo/bar/baz, /foo/bar -> <empty>
-#
-# The x prefix is used to preserve the presence of the initial slash
-#
-# $1 - Path to compare
-# $2 - Other path to compare
-FindCommonPathPrefix = \
-    $(patsubst x%,%,$(subst $(SPACE),/,$(strip \
-        $(call FindCommonPathPrefixHelper, \
-            $(subst /,$(SPACE),x$(strip $1)), $(subst /,$(SPACE),x$(strip $2))) \
-    )))
-
-FindCommonPathPrefixHelper = \
-    $(if $(call equals, $(firstword $1), $(firstword $2)), \
-      $(firstword $1) \
-      $(call FindCommonPathPrefixHelper, \
-          $(wordlist 2, $(words $1), $1), $(wordlist 2, $(words $2), $2) \
-      ) \
-    )
-
-# Convert a partial path into as many directory levels of ../, removing
-# leading and following /.
-# Ex: foo/bar/baz/ -> ../../..
-#     foo/bar -> ../..
-#     /foo -> ..
-DirToDotDot = \
-    $(subst $(SPACE),/,$(foreach d, $(subst /,$(SPACE),$1),..))
-
-# Computes the relative path from a directory to a file
-# $1 - File to compute the relative path to
-# $2 - Directory to compute the relative path from
-RelativePath = \
-    $(eval $1_prefix := $(call FindCommonPathPrefix, $1, $2)) \
-    $(eval $1_dotdots := $(call DirToDotDot, $(patsubst $($(strip $1)_prefix)%, %, $2))) \
-    $(eval $1_dotdots := $(if $($(strip $1)_dotdots),$($(strip $1)_dotdots),.)) \
-    $(eval $1_suffix := $(patsubst $($(strip $1)_prefix)/%, %, $1)) \
-    $($(strip $1)_dotdots)/$($(strip $1)_suffix)
-
-################################################################################
 # link-file-* works similarly to install-file but creates a symlink instead.
 # There are two versions, either creating a relative or an absolute link. Be
 # careful when using this on Windows since the symlink created is only valid in
 # the unix emulation environment.
-define link-file-relative
+# In msys2 we use mklink /J because its ln would perform a deep copy of the target.
+# This inhibits performance and can lead to issues with long paths. With mklink /J
+# relative linking does not work, so we handle the link as absolute path.
+ifeq ($(OPENJDK_BUILD_OS_ENV), windows.msys2)
+  define link-file-relative
+	$(call MakeTargetDir)
+	$(RM) '$(call DecodeSpace, $@)'
+	cmd //c "mklink /J $(call FixPath, $(call DecodeSpace, $@)) $(call FixPath, $(call DecodeSpace, $<))"
+  endef
+else
+  define link-file-relative
 	$(call MakeTargetDir)
 	$(RM) '$(call DecodeSpace, $@)'
 	$(LN) -s '$(call DecodeSpace, $(call RelativePath, $<, $(@D)))' '$(call DecodeSpace, $@)'
-endef
+  endef
+endif
 
-define link-file-absolute
+ifeq ($(OPENJDK_BUILD_OS_ENV), windows.msys2)
+  define link-file-absolute
+	$(call MakeTargetDir)
+	$(RM) '$(call DecodeSpace, $@)'
+	cmd //c "mklink /J $(call FixPath, $(call DecodeSpace, $@)) $(call FixPath, $(call DecodeSpace, $<))"
+  endef
+else
+  define link-file-absolute
 	$(call MakeTargetDir)
 	$(RM) '$(call DecodeSpace, $@)'
 	$(LN) -s '$(call DecodeSpace, $<)' '$(call DecodeSpace, $@)'
-endef
-
-################################################################################
-# Filter out duplicate sub strings while preserving order. Keeps the first occurance.
-uniq = \
-    $(strip $(if $1,$(firstword $1) $(call uniq,$(filter-out $(firstword $1),$1))))
-
-# Returns all whitespace-separated words in $2 where at least one of the
-# whitespace-separated words in $1 is a substring.
-containing = \
-    $(strip \
-        $(foreach v,$(strip $2),\
-          $(call uniq,$(foreach p,$(strip $1),$(if $(findstring $p,$v),$v)))))
-
-# Returns all whitespace-separated words in $2 where none of the
-# whitespace-separated words in $1 is a substring.
-not-containing = \
-    $(strip $(filter-out $(call containing,$1,$2),$2))
-
-# Return a list of all string elements that are duplicated in $1.
-dups = \
-    $(strip $(foreach v, $(sort $1), $(if $(filter-out 1, \
-        $(words $(filter $v, $1))), $v)))
-
-# String equals
-equals = \
-    $(and $(findstring $(strip $1),$(strip $2)),\
-        $(findstring $(strip $2),$(strip $1)))
-
-# Remove a whole list of prefixes
-# $1 - List of prefixes
-# $2 - List of elements to process
-remove-prefixes = \
-    $(strip $(if $1,$(patsubst $(firstword $1)%,%,\
-      $(call remove-prefixes,$(filter-out $(firstword $1),$1),$2)),$2))
-
-# Convert the string given to upper case, without any $(shell)
-# Inspired by http://lists.gnu.org/archive/html/help-make/2013-09/msg00009.html
-uppercase_table := a,A b,B c,C d,D e,E f,F g,G h,H i,I j,J k,K l,L m,M n,N o,O \
-    p,P q,Q r,R s,S t,T u,U v,V w,W x,X y,Y z,Z
-
-uppercase_internal = \
-  $(if $(strip $1), $$(subst $(firstword $1), $(call uppercase_internal, \
-      $(wordlist 2, $(words $1), $1), $2)), $2)
-
-# Convert a string to upper case. Works only on a-z.
-# $1 - The string to convert
-uppercase = \
-  $(strip \
-    $(eval uppercase_result := $(call uppercase_internal, $(uppercase_table), $1)) \
-    $(uppercase_result) \
-  )
+  endef
+endif
 
 ################################################################################
 
@@ -804,144 +478,6 @@ else
 endif
 
 ################################################################################
-
-define AddFileToCopy
-  # Helper macro for SetupCopyFiles
-  # 1 : Source file
-  # 2 : Dest file
-  # 3 : Variable to add targets to
-  # 4 : Macro to call for copy operation
-  # 5 : Action text to log
-  $2: $1
-	$$(call LogInfo, $(strip $5) $$(patsubst $(OUTPUTDIR)/%,%,$$(call DecodeSpace, $$@)))
-	$$($$(strip $4))
-
-  $3 += $2
-  $3_SOURCES += $1
-endef
-
-# Returns the value of the first argument
-identity = \
-    $(strip $1)
-
-# Setup make rules for copying files, with an option to do more complex
-# processing instead of copying.
-#
-# Parameter 1 is the name of the rule. This name is used as variable prefix,
-# and the targets generated are listed in a variable by that name.
-#
-# The list of all source files is returned in $1_SOURCES.
-#
-# Remaining parameters are named arguments. These include:
-#   SRC     : Source root dir (defaults to dir of first file)
-#   DEST    : Dest root dir
-#   FILES   : List of files to copy with absolute paths, or path relative to SRC.
-#             Must be in SRC.
-#   FLATTEN : Set to flatten the directory structure in the DEST dir.
-#   MACRO   : Optionally override the default macro used for making the copy.
-#             Default is 'install-file'
-#   NAME_MACRO : Optionally supply a macro that rewrites the target file name
-#                based on the source file name
-#   LOG_ACTION : Optionally specify a different action text for log messages
-SetupCopyFiles = $(NamedParamsMacroTemplate)
-define SetupCopyFilesBody
-
-  ifeq ($$($1_MACRO), )
-    $1_MACRO := install-file
-  endif
-
-  # Default SRC to the dir of the first file.
-  ifeq ($$($1_SRC), )
-    $1_SRC := $$(dir $$(firstword $$($1_FILES)))
-  endif
-
-  ifeq ($$($1_NAME_MACRO), )
-    $1_NAME_MACRO := identity
-  endif
-
-  ifeq ($$($1_LOG_ACTION), )
-    $1_LOG_ACTION := Copying
-  endif
-
-  # Remove any trailing slash from SRC and DEST
-  $1_SRC := $$(patsubst %/,%,$$($1_SRC))
-  $1_DEST := $$(patsubst %/,%,$$($1_DEST))
-
-  # Need to wrap arguments in DoubleDollar because of the eval nested inside an
-  # eval macro body.
-  $$(foreach f, $$(patsubst $$($1_SRC)/%,%,$$($1_FILES)), \
-    $$(eval $$(call AddFileToCopy, \
-        $$(call DoubleDollar, $$($1_SRC)/$$f), \
-        $$(call DoubleDollar, \
-            $$($1_DEST)/$$(call $$(strip $$($1_NAME_MACRO)),$$(if $$($1_FLATTEN),$$(notdir $$f),$$f)) \
-        ), \
-        $1, \
-        $$($1_MACRO), \
-        $$($1_LOG_ACTION) \
-    )) \
-  )
-
-endef
-
-################################################################################
-# Parse a multiple-keyword variable, like FOO="KEYWORD1=val1;KEYWORD2=val2;..."
-# These will be converted into a series of variables like FOO_KEYWORD1=val1,
-# FOO_KEYWORD2=val2, etc. Unknown keywords will cause an error.
-#
-# Parameter 1 is the name of the rule, and is also the name of the variable.
-#
-# Remaining parameters are named arguments. These include:
-#   SINGLE_KEYWORDS   A list of valid keywords with single string values
-#   STRING_KEYWORDS   A list of valid keywords, processed as string. This means
-#       that '%20' will be replaced by ' ' to allow for multi-word strings.
-#
-ParseKeywordVariable = $(NamedParamsMacroTemplate)
-define ParseKeywordVariableBody
-  ifneq ($$($1), )
-    # To preserve spaces, substitute them with a hopefully unique pattern
-    # before splitting and then re-substitute spaces back.
-    $1_MANGLED := $$(subst $$(SPACE),||||,$$($1))
-    $$(foreach mangled_part, $$(subst ;, , $$($1_MANGLED)), \
-      $$(eval mangled_part_eval := $$(call DoubleDollar, $$(mangled_part))) \
-      $$(eval part := $$$$(subst ||||,$$$$(SPACE),$$$$(mangled_part_eval))) \
-      $$(eval $1_NO_MATCH := true) \
-      $$(foreach keyword, $$($1_SINGLE_KEYWORDS), \
-        $$(eval keyword_eval := $$(call DoubleDollar, $$(keyword))) \
-        $$(if $$(filter $$(keyword)=%, $$(part)), \
-          $$(eval $(strip $1)_$$$$(keyword_eval) := $$$$(strip $$$$(patsubst $$$$(keyword_eval)=%, %, $$$$(part)))) \
-          $$(eval $1_NO_MATCH := ) \
-        ) \
-      ) \
-      $$(foreach keyword, $$($1_STRING_KEYWORDS), \
-        $$(eval keyword_eval := $$(call DoubleDollar, $$(keyword))) \
-        $$(if $$(filter $$(keyword)=%, $$(part)), \
-          $$(eval $(strip $1)_$$$$(keyword_eval) := $$$$(strip $$$$(subst %20, , $$$$(patsubst $$$$(keyword_eval)=%, %, $$$$(part))))) \
-          $$(eval $1_NO_MATCH := ) \
-        ) \
-      ) \
-      $$(if $$($1_NO_MATCH), \
-        $$(if $$(filter $$(part), $$($1_SINGLE_KEYWORDS) $$($1_STRING_KEYWORDS)), \
-          $$(info Keyword $$(part) for $1 needs to be assigned a value.) \
-        , \
-          $$(info $$(part) is not a valid keyword for $1.) \
-          $$(info Valid keywords: $$($1_SINGLE_KEYWORDS) $$($1_STRING_KEYWORDS).) \
-        ) \
-        $$(error Cannot continue) \
-      ) \
-    )
-  endif
-endef
-
-################################################################################
-# ShellQuote
-#
-# Quotes a string with single quotes and replaces single quotes with '\'' so
-# that the contents survives being given to the shell.
-
-ShellQuote = \
-    $(SQUOTE)$(subst $(SQUOTE),$(SQUOTE)\$(SQUOTE)$(SQUOTE),$(strip $1))$(SQUOTE)
-
-################################################################################
 # FixPath
 #
 # On Windows, converts a path from cygwin/unix style (e.g. /bin/foo) into
@@ -951,7 +487,7 @@ ShellQuote = \
 # list.
 # This is normally not needed since we use the FIXPATH prefix for command lines,
 # but might be needed in certain circumstances.
-ifeq ($(OPENJDK_TARGET_OS), windows)
+ifeq ($(call isTargetOs, windows), true)
   FixPath = \
     $(strip $(subst \,\\, $(shell $(FIXPATH_BASE) print $(patsubst $(FIXPATH), , $1))))
 else
@@ -960,35 +496,6 @@ else
 endif
 
 ################################################################################
-# Write to and read from file
-
-# Param 1 - File to read
-ReadFile = \
-    $(shell $(CAT) $1)
-
-# Param 1 - Text to write
-# Param 2 - File to write to
-ifeq ($(HAS_FILE_FUNCTION), true)
-  WriteFile = \
-      $(file >$2,$(strip $1))
-else
-  # Use printf to get consistent behavior on all platforms.
-  WriteFile = \
-      $(shell $(PRINTF) "%s" $(call ShellQuote, $1) > $2)
-endif
-
-# Param 1 - Text to write
-# Param 2 - File to write to
-ifeq ($(HAS_FILE_FUNCTION), true)
-  AppendFile = \
-      $(file >>$2,$(strip $1))
-else
-  # Use printf to get consistent behavior on all platforms.
-  AppendFile = \
-      $(shell $(PRINTF) "%s" $(call ShellQuote, $1) >> $2)
-endif
-
-################################################################################
 # DependOnVariable
 #
 # This macro takes a variable name and puts the value in a file only if the
@@ -1075,75 +582,6 @@ ExecuteWithLog = \
       exit $(DOLLAR)exitcode ) )
 
 ################################################################################
-# Find lib dir for module
-# Param 1 - module name
-FindLibDirForModule = \
-    $(SUPPORT_OUTPUTDIR)/modules_libs/$(strip $1)
-
-################################################################################
-# Find executable dir for module
-# Param 1 - module name
-FindExecutableDirForModule = \
-    $(SUPPORT_OUTPUTDIR)/modules_cmds/$(strip $1)
-
-################################################################################
-# Return a string suitable for use after a -classpath or --module-path option. It
-# will be correct and safe to use on all platforms. Arguments are given as space
-# separate classpath entries. Safe for multiple nested calls.
-# param 1 : A space separated list of classpath entries
-# The surrounding strip is needed to keep additional whitespace out
-PathList = \
-  "$(subst $(SPACE),:,$(strip $(subst $(DQUOTE),,$1)))"
-
-################################################################################
-# Check if a specified hotspot variant is being built, or at least one of a
-# list of variants. Will return 'true' or 'false'.
-# $1 - the variant to test for
-check-jvm-variant = \
-  $(strip \
-    $(if $(filter-out $(VALID_JVM_VARIANTS), $1), \
-      $(error Internal error: Invalid variant tested: $1)) \
-    $(if $(filter $1, $(JVM_VARIANTS)), true, false))
-
-################################################################################
-# Converts a space separated list to a comma separated list.
-#
-# Replacing double-comma with a single comma is to workaround the issue with
-# some version of make on windows that doesn't substitute spaces with one comma
-# properly.
-CommaList = \
-  $(strip \
-      $(subst $(COMMA)$(COMMA),$(COMMA),$(subst $(SPACE),$(COMMA),$(strip $1))) \
-  )
-
-################################################################################
-# Converts a space separated list to a colon separated list.
-#
-# Replacing double-colon with a single colon is to workaround the issue with
-# some version of make on windows that doesn't substitute spaces with one colon
-# properly.
-ColonList = \
-  $(strip \
-      $(subst ::,:,$(subst $(SPACE),:,$(strip $1))) \
-  )
-
-################################################################################
-# Given a list of files, filters out locale specific files for translations
-# that should be excluded from this build.
-# $1 - The list of files to filter
-# $2 - The suffix of the files that should be considered (.java or .properties)
-FilterExcludedTranslations = \
-  $(strip $(if $(EXCLUDE_TRANSLATIONS), \
-    $(filter-out \
-        $(foreach suffix, $2, \
-          $(addprefix %_, $(addsuffix $(suffix), $(EXCLUDE_TRANSLATIONS))) \
-        ), \
-        $1 \
-    ), \
-    $1 \
-  ))
-
-################################################################################
 
 # Hook to include the corresponding custom file, if present.
 $(eval $(call IncludeCustomExtension, common/MakeBase.gmk))
diff --git a/make/common/MakeIO.gmk b/make/common/MakeIO.gmk
 new file mode 100644
index 0000000..342e4f5
--- /dev/null
+++ b/make/common/MakeIO.gmk
@@ -0,0 +1,272 @@
+#
+# Copyright (c) 2011, 2019, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+ifeq (,$(_MAKEBASE_GMK))
+  $(error You must include MakeBase.gmk prior to including MakeIO.gmk)
+endif
+
+################################################################################
+#
+# Functions for dealing with reading and writing from makefiles. Prior to GNU
+# Make 4.0, this was tricky business.
+#
+################################################################################
+
+
+################################################################################
+# ListPathsSafely can be used to print command parameters to a file. This is
+# typically done if the command line lenght risk being too long for the
+# OS/shell. In later make versions, the file function can be used for this
+# purpose. For earlier versions, a more complex implementation is provided.
+#
+# The function ListPathsSafely can be called either directly or, more commonly
+# from a recipe line. If called from a recipe, it will be executed in the
+# evaluation phase of that recipe, which means that it will write to the file
+# before any other line in the recipe has been run.
+ifeq ($(HAS_FILE_FUNCTION), true)
+  # Param 1 - Name of variable containing paths/arguments to output
+  # Param 2 - File to print to
+  # Param 3 - Set to true to append to file instead of overwriting
+  define ListPathsSafely
+    $$(call MakeDir, $$(dir $$(strip $2)))
+    $$(file $$(if $$(filter true, $$(strip $3)),>>,>) \
+        $$(strip $2),$$(subst $$(SPACE),$$(NEWLINE),$$(strip $$($$(strip $1)))))
+  endef
+
+else # HAS_FILE_FUNCTION = false
+
+  $(eval compress_paths = \
+      $(strip $(shell $(CAT) $(TOPDIR)/make/common/support/ListPathsSafely-pre-compress.incl)))
+  compress_paths += \
+      $(subst $(TOPDIR),X97, \
+      $(subst $(OUTPUTDIR),X98, \
+      $(subst X,X00, \
+      $(subst $(SPACE),\n,$(strip $1)))))
+  $(eval compress_paths += \
+      $(strip $(shell $(CAT) $(TOPDIR)/make/common/support/ListPathsSafely-post-compress.incl)))
+
+  decompress_paths=$(SED) -f $(TOPDIR)/make/common/support/ListPathsSafely-uncompress.sed \
+      -e 's|X99|\\n|g' \
+      -e 's|X98|$(OUTPUTDIR)|g' -e 's|X97|$(TOPDIR)|g' \
+      -e 's|X00|X|g'
+
+  ListPathsSafely_IfPrintf = \
+      $(if $(word $3,$($(strip $1))), \
+          $(shell $(PRINTF) -- "$(strip $(call EscapeDollar, \
+              $(call compress_paths, $(wordlist $3,$4,$($(strip $1))))))\n" \
+              | $(decompress_paths) >> $2))
+
+  # Param 1 - Name of variable containing paths/arguments to output
+  # Param 2 - File to print to
+  # Param 3 - Set to true to append to file instead of overwriting
+  define ListPathsSafely
+    ifneq (,$$(word 30001,$$($$(strip $1))))
+      $$(error Cannot list safely more than 30000 paths. $1 has $$(words $$($$(strip $1))) paths!)
+    endif
+    $$(call MakeDir, $$(dir $2))
+    ifneq ($$(strip $3), true)
+      $$(shell $(RM) $$(strip $2))
+    endif
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,1,250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,251,500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,501,750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,751,1000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,1001,1250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,1251,1500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,1501,1750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,1751,2000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,2001,2250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,2251,2500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,2501,2750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,2751,3000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,3001,3250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,3251,3500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,3501,3750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,3751,4000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,4001,4250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,4251,4500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,4501,4750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,4751,5000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,5001,5250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,5251,5500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,5501,5750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,5751,6000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,6001,6250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,6251,6500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,6501,6750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,6751,7000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,7001,7250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,7251,7500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,7501,7750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,7751,8000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,8001,8250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,8251,8500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,8501,8750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,8751,9000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,9001,9250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,9251,9500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,9501,9750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,9751,10000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,10001,10250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,10251,10500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,10501,10750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,10751,11000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,11001,11250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,11251,11500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,11501,11750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,11751,12000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,12001,12250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,12251,12500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,12501,12750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,12751,13000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,13001,13250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,13251,13500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,13501,13750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,13751,14000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,14001,14250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,14251,14500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,14501,14750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,14751,15000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,15001,15250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,15251,15500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,15501,15750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,15751,16000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,16001,16250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,16251,16500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,16501,16750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,16751,17000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,17001,17250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,17251,17500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,17501,17750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,17751,18000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,18001,18250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,18251,18500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,18501,18750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,18751,19000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,19001,19250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,19251,19500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,19501,19750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,19751,20000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,20001,20250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,20251,20500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,20501,20750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,20751,21000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,21001,21250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,21251,21500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,21501,21750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,21751,22000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,22001,22250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,22251,22500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,22501,22750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,22751,23000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,23001,23250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,23251,23500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,23501,23750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,23751,24000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,24001,24250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,24251,24500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,24501,24750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,24751,25000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,25001,25250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,25251,25500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,25501,25750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,25751,26000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,26001,26250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,26251,26500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,26501,26750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,26751,27000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,27001,27250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,27251,27500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,27501,27750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,27751,28000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,28001,28250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,28251,28500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,28501,28750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,28751,29000)
+
+    $$(call ListPathsSafely_IfPrintf,$1,$2,29001,29250)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,29251,29500)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,29501,29750)
+    $$(call ListPathsSafely_IfPrintf,$1,$2,29751,30000)
+  endef
+endif # HAS_FILE_FUNCTION
+
+################################################################################
+# Write to and read from file
+
+# Param 1 - File to read
+ReadFile = \
+    $(shell $(CAT) $1)
+
+# Param 1 - Text to write
+# Param 2 - File to write to
+ifeq ($(HAS_FILE_FUNCTION), true)
+  WriteFile = \
+      $(file >$2,$(strip $1))
+else
+  # Use printf to get consistent behavior on all platforms.
+  WriteFile = \
+      $(shell $(PRINTF) "%s" $(call ShellQuote, $1) > $2)
+endif
+
+# Param 1 - Text to write
+# Param 2 - File to write to
+ifeq ($(HAS_FILE_FUNCTION), true)
+  AppendFile = \
+      $(file >>$2,$(strip $1))
+else
+  # Use printf to get consistent behavior on all platforms.
+  AppendFile = \
+      $(shell $(PRINTF) "%s" $(call ShellQuote, $1) >> $2)
+endif
diff --git a/make/common/Modules.gmk b/make/common/Modules.gmk
index 41533e5..4f846c7 100644
--- a/make/common/Modules.gmk
+++ b/make/common/Modules.gmk
@@ -118,11 +118,11 @@ PLATFORM_MODULES += \
     jdk.zipfs \
     #
 
-ifeq ($(OPENJDK_TARGET_OS), windows)
+ifeq ($(call isTargetOs, windows), true)
   PLATFORM_MODULES += jdk.crypto.mscapi
 endif
 
-ifeq ($(OPENJDK_TARGET_OS), solaris)
+ifeq ($(call isTargetOs, solaris), true)
   PLATFORM_MODULES += jdk.crypto.ucrypto
 endif
 
diff --git a/make/common/NativeCompilation.gmk b/make/common/NativeCompilation.gmk
index bc297fb..6189810 100644
--- a/make/common/NativeCompilation.gmk
+++ b/make/common/NativeCompilation.gmk
@@ -283,10 +283,15 @@ endif
 # specialized file is found, returns the default file.
 # $1 Executable to find entitlements file for.
 ENTITLEMENTS_DIR := $(TOPDIR)/make/data/macosxsigning
-DEFAULT_ENTITLEMENTS_FILE := $(ENTITLEMENTS_DIR)/default.plist
+ifeq ($(MACOSX_CODESIGN_MODE), debug)
+  CODESIGN_PLIST_SUFFIX := -debug
+else
+  CODESIGN_PLIST_SUFFIX :=
+endif
+DEFAULT_ENTITLEMENTS_FILE := $(ENTITLEMENTS_DIR)/default$(CODESIGN_PLIST_SUFFIX).plist
 
 GetEntitlementsFile = \
-    $(foreach f, $(ENTITLEMENTS_DIR)/$(strip $(notdir $1)).plist, \
+    $(foreach f, $(ENTITLEMENTS_DIR)/$(strip $(notdir $1))$(CODESIGN_PLIST_SUFFIX).plist, \
       $(if $(wildcard $f), $f, $(DEFAULT_ENTITLEMENTS_FILE)) \
     )
 
@@ -909,7 +914,7 @@ define SetupNativeCompilationBody
 	$(TOUCH) $$@
 
   # On windows we need to create a resource file
-  ifeq ($(OPENJDK_TARGET_OS), windows)
+  ifeq ($(call isTargetOs, windows), true)
     ifneq ($$($1_VERSIONINFO_RESOURCE), )
       $1_RES := $$($1_OBJECT_DIR)/$$($1_BASENAME).res
       $1_RES_DEPS_FILE := $$($1_RES).d
@@ -950,7 +955,7 @@ define SetupNativeCompilationBody
 
   ifneq ($(DISABLE_MAPFILES), true)
     $1_REAL_MAPFILE := $$($1_MAPFILE)
-    ifneq ($(OPENJDK_TARGET_OS), windows)
+    ifeq ($(call isTargetOs, windows), false)
       ifneq ($$($1_REORDER), )
         $1_REAL_MAPFILE := $$($1_OBJECT_DIR)/mapfile
 
@@ -984,7 +989,7 @@ define SetupNativeCompilationBody
       # Only copy debug symbols for dynamic libraries and programs.
       ifneq ($$($1_TYPE), STATIC_LIBRARY)
         # Generate debuginfo files.
-        ifeq ($(OPENJDK_TARGET_OS), windows)
+        ifeq ($(call isTargetOs, windows), true)
           $1_EXTRA_LDFLAGS += -debug "-pdb:$$($1_OUTPUT_DIR)/$$($1_NOSUFFIX).pdb" \
               "-map:$$($1_OUTPUT_DIR)/$$($1_NOSUFFIX).map"
           ifeq ($(SHIP_DEBUG_SYMBOLS), public)
@@ -993,7 +998,7 @@ define SetupNativeCompilationBody
           $1_DEBUGINFO_FILES := $$($1_OUTPUT_DIR)/$$($1_NOSUFFIX).pdb \
               $$($1_OUTPUT_DIR)/$$($1_NOSUFFIX).map
 
-        else ifneq ($(findstring $(OPENJDK_TARGET_OS), linux solaris), )
+        else ifeq ($(call isTargetOs, linux solaris), true)
           $1_DEBUGINFO_FILES := $$($1_OUTPUT_DIR)/$$($1_NOSUFFIX).debuginfo
           # Setup the command line creating debuginfo files, to be run after linking.
           # It cannot be run separately since it updates the original target file
@@ -1009,13 +1014,13 @@ define SetupNativeCompilationBody
           $1_DEBUGINFO_FILES := $$($1_OUTPUT_DIR)/$$($1_NOSUFFIX).debuginfo 
           $1_CREATE_DEBUGINFO_CMDS := $(CP) $$($1_TARGET) $$($1_DEBUGINFO_FILES)
 
-        else ifeq ($(OPENJDK_TARGET_OS), macosx)
+        else ifeq ($(call isTargetOs, macosx), true)
           $1_DEBUGINFO_FILES := \
               $$($1_OUTPUT_DIR)/$$($1_BASENAME).dSYM/Contents/Info.plist \
               $$($1_OUTPUT_DIR)/$$($1_BASENAME).dSYM/Contents/Resources/DWARF/$$($1_BASENAME)
           $1_CREATE_DEBUGINFO_CMDS := \
               $(DSYMUTIL) --out $$($1_OUTPUT_DIR)/$$($1_BASENAME).dSYM $$($1_TARGET)
-        endif # OPENJDK_TARGET_OS
+        endif
 
         # Since the link rule creates more than one file that we want to track,
         # we have to use some tricks to get make to cooperate. To properly
@@ -1101,7 +1106,7 @@ define SetupNativeCompilationBody
       endif
     endif
 
-    ifeq ($(OPENJDK_TARGET_OS), windows)
+    ifeq ($(call isTargetOs, windows), true)
       ifeq ($$($1_EMBED_MANIFEST), true)
         $1_EXTRA_LDFLAGS += -manifest:embed
       endif
@@ -1181,7 +1186,7 @@ define SetupNativeCompilationBody
                 # Keep as much as possible on one execution line for best performance
                 # on Windows
 		$$(call LogInfo, Linking $$($1_BASENAME))
-                ifeq ($(OPENJDK_TARGET_OS), windows)
+                ifeq ($(call isTargetOs, windows), true)
 		  $$(call ExecuteWithLog, $$($1_OBJECT_DIR)/$$($1_SAFE_NAME)_link, \
 		      $$($1_LD) $$($1_LDFLAGS) $$($1_EXTRA_LDFLAGS) $$($1_SYSROOT_LDFLAGS) \
 		          $(LD_OUT_OPTION)$$($1_TARGET) $$($1_LD_OBJ_ARG) $$($1_RES) $$(GLOBAL_LIBS) \
@@ -1199,16 +1204,17 @@ define SetupNativeCompilationBody
 		  $$($1_CREATE_DEBUGINFO_CMDS)
 		  $$($1_STRIP_CMD)
                 endif
-                ifeq ($(OPENJDK_TARGET_OS), windows)
+                ifeq ($(call isTargetOs, windows), true)
                   ifneq ($$($1_MANIFEST), )
 		    $$($1_MT) -nologo -manifest $$($1_MANIFEST) -identity:"$$($1_NAME).exe, version=$$($1_MANIFEST_VERSION)" -outputresource:$$@;#1
                   endif
                 endif
-                # This only works if the openjdk_codesign identity is present on the system. Let
-                # silently fail otherwise.
-                ifneq ($(CODESIGN), )
+                # On macosx, optionally run codesign on every binary
+                ifeq ($(MACOSX_CODESIGN_MODE), hardened)
 		  $(CODESIGN) -f -s "$(MACOSX_CODESIGN_IDENTITY)" --timestamp --options runtime \
 		      --entitlements $$(call GetEntitlementsFile, $$@) $$@
+                else ifeq ($(MACOSX_CODESIGN_MODE), debug)
+		  $(CODESIGN) -f -s - --entitlements $$(call GetEntitlementsFile, $$@) $$@
                 endif
   endif
 
diff --git a/make/common/Utils.gmk b/make/common/Utils.gmk
 new file mode 100644
index 0000000..acb6a30
--- /dev/null
+++ b/make/common/Utils.gmk
@@ -0,0 +1,365 @@
+#
+# Copyright (c) 2011, 2019, Oracle and/or its affiliates. All rights reserved.
+# DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
+#
+# This code is free software; you can redistribute it and/or modify it
+# under the terms of the GNU General Public License version 2 only, as
+# published by the Free Software Foundation.  Oracle designates this
+# particular file as subject to the "Classpath" exception as provided
+# by Oracle in the LICENSE file that accompanied this code.
+#
+# This code is distributed in the hope that it will be useful, but WITHOUT
+# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+# FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
+# version 2 for more details (a copy is included in the LICENSE file that
+# accompanied this code).
+#
+# You should have received a copy of the GNU General Public License version
+# 2 along with this work; if not, write to the Free Software Foundation,
+# Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+#
+# Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
+# or visit www.oracle.com if you need additional information or have any
+# questions.
+#
+
+ifeq (,$(_MAKEBASE_GMK))
+  $(error You must include MakeBase.gmk prior to including Utils.gmk)
+endif
+
+################################################################################
+#
+# Common utility functions
+#
+################################################################################
+
+### Debug functions
+
+# Prints the name and value of a variable
+PrintVar = \
+    $(info $(strip $1) >$($(strip $1))<)
+
+################################################################################
+# This macro translates $ into \$ to protect the $ from expansion in the shell.
+# To make this macro resilient against already escaped strings, first remove
+# any present escapes before escaping so that no double escapes are added.
+EscapeDollar = $(subst $$,\$$,$(subst \$$,$$,$(strip $1)))
+
+################################################################################
+# This macro works just like EscapeDollar above, but for #.
+EscapeHash = $(subst \#,\\\#,$(subst \\\#,\#,$(strip $1)))
+
+################################################################################
+# This macro translates $ into $$ to protect the string from make itself.
+DoubleDollar = $(subst $$,$$$$,$(strip $1))
+
+################################################################################
+# Creates a sequence of increasing numbers (inclusive).
+# Param 1 - starting number
+# Param 2 - ending number
+sequence = \
+    $(wordlist $1, $2, $(strip \
+        $(eval SEQUENCE_COUNT :=) \
+        $(call _sequence-do,$(strip $2))))
+
+_sequence-do = \
+    $(if $(word $1, $(SEQUENCE_COUNT)),, \
+      $(eval SEQUENCE_COUNT += .) \
+      $(words $(SEQUENCE_COUNT)) \
+      $(call _sequence-do,$1))
+
+################################################################################
+# Replace question marks with space in string. This macro needs to be called on
+# files from FindFiles in case any of them contains space in their file name,
+# since FindFiles replaces space with ?.
+# Param 1 - String to replace in
+DecodeSpace = \
+    $(subst ?,$(SPACE),$(strip $1))
+EncodeSpace = \
+    $(subst $(SPACE),?,$(strip $1))
+
+################################################################################
+# Assign a variable only if it is empty
+# Param 1 - Variable to assign
+# Param 2 - Value to assign
+SetIfEmpty = \
+    $(if $($(strip $1)),,$(eval $(strip $1) := $2))
+
+################################################################################
+# Take two paths and return the path of the last common directory.
+# Ex: /foo/bar/baz, /foo/bar/banan -> /foo/bar
+#     foo/bar/baz, /foo/bar -> <empty>
+#
+# The x prefix is used to preserve the presence of the initial slash
+#
+# $1 - Path to compare
+# $2 - Other path to compare
+FindCommonPathPrefix = \
+    $(patsubst x%,%,$(subst $(SPACE),/,$(strip \
+        $(call FindCommonPathPrefixHelper, \
+            $(subst /,$(SPACE),x$(strip $1)), $(subst /,$(SPACE),x$(strip $2))) \
+    )))
+
+FindCommonPathPrefixHelper = \
+    $(if $(call equals, $(firstword $1), $(firstword $2)), \
+      $(firstword $1) \
+      $(call FindCommonPathPrefixHelper, \
+          $(wordlist 2, $(words $1), $1), $(wordlist 2, $(words $2), $2) \
+      ) \
+    )
+
+# Convert a partial path into as many directory levels of ../, removing
+# leading and following /.
+# Ex: foo/bar/baz/ -> ../../..
+#     foo/bar -> ../..
+#     /foo -> ..
+DirToDotDot = \
+    $(subst $(SPACE),/,$(foreach d, $(subst /,$(SPACE),$1),..))
+
+# Computes the relative path from a directory to a file
+# $1 - File to compute the relative path to
+# $2 - Directory to compute the relative path from
+RelativePath = \
+    $(eval $1_prefix := $(call FindCommonPathPrefix, $1, $2)) \
+    $(eval $1_dotdots := $(call DirToDotDot, $(patsubst $($(strip $1)_prefix)%, %, $2))) \
+    $(eval $1_dotdots := $(if $($(strip $1)_dotdots),$($(strip $1)_dotdots),.)) \
+    $(eval $1_suffix := $(patsubst $($(strip $1)_prefix)/%, %, $1)) \
+    $($(strip $1)_dotdots)/$($(strip $1)_suffix)
+
+################################################################################
+# Filter out duplicate sub strings while preserving order. Keeps the first occurance.
+uniq = \
+    $(strip $(if $1,$(firstword $1) $(call uniq,$(filter-out $(firstword $1),$1))))
+
+# Returns all whitespace-separated words in $2 where at least one of the
+# whitespace-separated words in $1 is a substring.
+containing = \
+    $(strip \
+        $(foreach v,$(strip $2),\
+          $(call uniq,$(foreach p,$(strip $1),$(if $(findstring $p,$v),$v)))))
+
+# Returns all whitespace-separated words in $2 where none of the
+# whitespace-separated words in $1 is a substring.
+not-containing = \
+    $(strip $(filter-out $(call containing,$1,$2),$2))
+
+# Return a list of all string elements that are duplicated in $1.
+dups = \
+    $(strip $(foreach v, $(sort $1), $(if $(filter-out 1, \
+        $(words $(filter $v, $1))), $v)))
+
+# String equals
+equals = \
+    $(and $(findstring $(strip $1),$(strip $2)),\
+        $(findstring $(strip $2),$(strip $1)))
+
+# Remove a whole list of prefixes
+# $1 - List of prefixes
+# $2 - List of elements to process
+remove-prefixes = \
+    $(strip $(if $1,$(patsubst $(firstword $1)%,%,\
+      $(call remove-prefixes,$(filter-out $(firstword $1),$1),$2)),$2))
+
+# Convert the string given to upper case, without any $(shell)
+# Inspired by http://lists.gnu.org/archive/html/help-make/2013-09/msg00009.html
+uppercase_table := a,A b,B c,C d,D e,E f,F g,G h,H i,I j,J k,K l,L m,M n,N o,O \
+    p,P q,Q r,R s,S t,T u,U v,V w,W x,X y,Y z,Z
+
+uppercase_internal = \
+  $(if $(strip $1), $$(subst $(firstword $1), $(call uppercase_internal, \
+      $(wordlist 2, $(words $1), $1), $2)), $2)
+
+# Convert a string to upper case. Works only on a-z.
+# $1 - The string to convert
+uppercase = \
+  $(strip \
+    $(eval uppercase_result := $(call uppercase_internal, $(uppercase_table), $1)) \
+    $(uppercase_result) \
+  )
+
+################################################################################
+# Boolean operators.
+
+# Return the word "true" if all the boolean words given as argument is "true",
+# and returns "false" otherwise. Boolean words must be "true" or "false". It is
+# an error to supply a non-boolean word. An empty string is considered "true".
+And = \
+  $(strip $(if $(filter-out true false, $1), $(error Non-boolean values: $1)) \
+  $(if $(strip $(filter-out true, $1)), false, true))
+
+# Return the word "false" if all the boolean words given as argument is "false",
+# and returns "true" otherwise. Boolean words must be "true" or "false". It is
+# an error to supply a non-boolean word.  An empty string is considered "false".
+Or = \
+  $(strip $(if $(filter-out true false, $1), $(error Non-boolean values: $1)) \
+  $(if $(strip $(filter-out false, $1)), true, false))
+
+################################################################################
+# Parse a multiple-keyword variable, like FOO="KEYWORD1=val1;KEYWORD2=val2;..."
+# These will be converted into a series of variables like FOO_KEYWORD1=val1,
+# FOO_KEYWORD2=val2, etc. Unknown keywords will cause an error.
+#
+# Parameter 1 is the name of the rule, and is also the name of the variable.
+#
+# Remaining parameters are named arguments. These include:
+#   SINGLE_KEYWORDS   A list of valid keywords with single string values
+#   STRING_KEYWORDS   A list of valid keywords, processed as string. This means
+#       that '%20' will be replaced by ' ' to allow for multi-word strings.
+#
+ParseKeywordVariable = $(NamedParamsMacroTemplate)
+define ParseKeywordVariableBody
+  ifneq ($$($1), )
+    # To preserve spaces, substitute them with a hopefully unique pattern
+    # before splitting and then re-substitute spaces back.
+    $1_MANGLED := $$(subst $$(SPACE),||||,$$($1))
+    $$(foreach mangled_part, $$(subst ;, , $$($1_MANGLED)), \
+      $$(eval mangled_part_eval := $$(call DoubleDollar, $$(mangled_part))) \
+      $$(eval part := $$$$(subst ||||,$$$$(SPACE),$$$$(mangled_part_eval))) \
+      $$(eval $1_NO_MATCH := true) \
+      $$(foreach keyword, $$($1_SINGLE_KEYWORDS), \
+        $$(eval keyword_eval := $$(call DoubleDollar, $$(keyword))) \
+        $$(if $$(filter $$(keyword)=%, $$(part)), \
+          $$(eval $(strip $1)_$$$$(keyword_eval) := $$$$(strip $$$$(patsubst $$$$(keyword_eval)=%, %, $$$$(part)))) \
+          $$(eval $1_NO_MATCH := ) \
+        ) \
+      ) \
+      $$(foreach keyword, $$($1_STRING_KEYWORDS), \
+        $$(eval keyword_eval := $$(call DoubleDollar, $$(keyword))) \
+        $$(if $$(filter $$(keyword)=%, $$(part)), \
+          $$(eval $(strip $1)_$$$$(keyword_eval) := $$$$(strip $$$$(subst %20, , $$$$(patsubst $$$$(keyword_eval)=%, %, $$$$(part))))) \
+          $$(eval $1_NO_MATCH := ) \
+        ) \
+      ) \
+      $$(if $$($1_NO_MATCH), \
+        $$(if $$(filter $$(part), $$($1_SINGLE_KEYWORDS) $$($1_STRING_KEYWORDS)), \
+          $$(info Keyword $$(part) for $1 needs to be assigned a value.) \
+        , \
+          $$(info $$(part) is not a valid keyword for $1.) \
+          $$(info Valid keywords: $$($1_SINGLE_KEYWORDS) $$($1_STRING_KEYWORDS).) \
+        ) \
+        $$(error Cannot continue) \
+      ) \
+    )
+  endif
+endef
+
+################################################################################
+# ShellQuote
+#
+# Quotes a string with single quotes and replaces single quotes with '\'' so
+# that the contents survives being given to the shell.
+ShellQuote = \
+    $(SQUOTE)$(subst $(SQUOTE),$(SQUOTE)\$(SQUOTE)$(SQUOTE),$(strip $1))$(SQUOTE)
+
+################################################################################
+# Find lib dir for module
+# Param 1 - module name
+FindLibDirForModule = \
+    $(SUPPORT_OUTPUTDIR)/modules_libs/$(strip $1)
+
+################################################################################
+# Find executable dir for module
+# Param 1 - module name
+FindExecutableDirForModule = \
+    $(SUPPORT_OUTPUTDIR)/modules_cmds/$(strip $1)
+
+################################################################################
+# Return a string suitable for use after a -classpath or --module-path option. It
+# will be correct and safe to use on all platforms. Arguments are given as space
+# separate classpath entries. Safe for multiple nested calls.
+# param 1 : A space separated list of classpath entries
+# The surrounding strip is needed to keep additional whitespace out
+PathList = \
+  "$(subst $(SPACE),:,$(strip $(subst $(DQUOTE),,$1)))"
+
+################################################################################
+# Check if a specified hotspot variant is being built, or at least one of a
+# list of variants. Will return 'true' or 'false'.
+# $1 - the variant to test for
+check-jvm-variant = \
+  $(strip \
+    $(if $(filter-out $(VALID_JVM_VARIANTS), $1), \
+      $(error Internal error: Invalid variant tested: $1)) \
+    $(if $(filter $1, $(JVM_VARIANTS)), true, false))
+
+################################################################################
+# Check if our build or target conforms to certain restrictions. This set of
+# functions all work in similar ways, testing the property that the name
+# implies, so e.g. isTargetCpu test the CPU of the target system.
+#
+# $1 - A property, or a space separated list of properties to test for.
+#
+# Returns true if the actual property matches one of the properties in the list,
+# and false otherwise.
+#
+# Examples: $(call isTargetOs, linux solaris) will return true when executed
+# on either linux or solaris, and false otherwise.
+# $(call isBuildCpuArch, x86) will return true iff the build CPU Arch is x86.
+
+isTargetOs = \
+  $(strip $(if $(filter $(OPENJDK_TARGET_OS), $1), true, false))
+
+isTargetOsType = \
+  $(strip $(if $(filter $(OPENJDK_TARGET_OS_TYPE), $1), true, false))
+
+isTargetCpu = \
+  $(strip $(if $(filter $(OPENJDK_TARGET_CPU), $1), true, false))
+
+isTargetCpuArch = \
+  $(strip $(if $(filter $(OPENJDK_TARGET_CPU_ARCH), $1), true, false))
+
+isTargetCpuBits = \
+  $(strip $(if $(filter $(OPENJDK_TARGET_CPU_BITS), $1), true, false))
+
+isBuildOs = \
+  $(strip $(if $(filter $(OPENJDK_BUILD_OS), $1), true, false))
+
+isBuildOsType = \
+  $(strip $(if $(filter $(OPENJDK_BUILD_OS_TYPE), $1), true, false))
+
+isBuildOsEnv = \
+  $(strip $(if $(filter $(OPENJDK_BUILD_OS_ENV), $1), true, false))
+
+isBuildCpu = \
+  $(strip $(if $(filter $(OPENJDK_BUILD_CPU), $1), true, false))
+
+isBuildCpuArch = \
+  $(strip $(if $(filter $(OPENJDK_BUILD_CPU_ARCH), $1), true, false))
+
+################################################################################
+# Converts a space separated list to a comma separated list.
+#
+# Replacing double-comma with a single comma is to workaround the issue with
+# some version of make on windows that doesn't substitute spaces with one comma
+# properly.
+CommaList = \
+  $(strip \
+      $(subst $(COMMA)$(COMMA),$(COMMA),$(subst $(SPACE),$(COMMA),$(strip $1))) \
+  )
+
+################################################################################
+# Converts a space separated list to a colon separated list.
+#
+# Replacing double-colon with a single colon is to workaround the issue with
+# some version of make on windows that doesn't substitute spaces with one colon
+# properly.
+ColonList = \
+  $(strip \
+      $(subst ::,:,$(subst $(SPACE),:,$(strip $1))) \
+  )
+
+################################################################################
+# Given a list of files, filters out locale specific files for translations
+# that should be excluded from this build.
+# $1 - The list of files to filter
+# $2 - The suffix of the files that should be considered (.java or .properties)
+FilterExcludedTranslations = \
+  $(strip $(if $(EXCLUDE_TRANSLATIONS), \
+    $(filter-out \
+        $(foreach suffix, $2, \
+          $(addprefix %_, $(addsuffix $(suffix), $(EXCLUDE_TRANSLATIONS))) \
+        ), \
+        $1 \
+    ), \
+    $1 \
+  ))
diff --git a/make/conf/test-dependencies b/make/conf/github-actions.conf
 similarity index 65%
 rename from make/conf/test-dependencies
 rename to make/conf/github-actions.conf
index 0b6c913..40dd3b5 100644
--- a/make/conf/test-dependencies
+++ b/make/conf/github-actions.conf
@@ -23,21 +23,19 @@
 # questions.
 #
 
-# Versions and download locations for dependencies used by pre-submit testing.
+# Versions and download locations for dependencies used by GitHub Actions (GHA)
 
-BOOT_JDK_VERSION=11
-JTREG_VERSION=6
-JTREG_BUILD=1
 GTEST_VERSION=1.8.1
+JTREG_VERSION=6.1+3
 
-LINUX_X64_BOOT_JDK_FILENAME=openjdk-11.0.14.1_linux-x64_bin.tar.gz
-LINUX_X64_BOOT_JDK_URL=https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.14.1%2B1/OpenJDK11U-jdk_x64_linux_hotspot_11.0.14.1_1.tar.gz
-LINUX_X64_BOOT_JDK_SHA256=43fb84f8063ad9bf6b6d694a67b8f64c8827552b920ec5ce794dfe5602edffe7
+LINUX_X64_BOOT_JDK_EXT=tar.gz
+LINUX_X64_BOOT_JDK_URL=https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.18%2B10/OpenJDK11U-jdk_x64_linux_hotspot_11.0.18_10.tar.gz
+LINUX_X64_BOOT_JDK_SHA256=4a29efda1d702b8ff38e554cf932051f40ec70006caed5c4857a8cbc7a0b7db7
 
-WINDOWS_X64_BOOT_JDK_FILENAME=openjdk-11.0.14.1_windows-x64_bin.zip
-WINDOWS_X64_BOOT_JDK_URL=https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.14.1%2B1/OpenJDK11U-jdk_x64_windows_hotspot_11.0.14.1_1.zip
-WINDOWS_X64_BOOT_JDK_SHA256=3e7da701aa92e441418299714f0ed6db10c3bb1e2db625c35a2c2cd9cc619731
+WINDOWS_X64_BOOT_JDK_EXT=zip
+WINDOWS_X64_BOOT_JDK_URL=https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.18%2B10/OpenJDK11U-jdk_x64_windows_hotspot_11.0.18_10.zip
+WINDOWS_X64_BOOT_JDK_SHA256=0cfa5991a8e372b3f8eacacbb2a336663ead0cc6ec9c9ab6cd53206602fb0062
 
-MACOS_X64_BOOT_JDK_FILENAME=openjdk-11.0.14.1_osx-x64_bin.tar.gz
-MACOS_X64_BOOT_JDK_URL=https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.14.1%2B1/OpenJDK11U-jdk_x64_mac_hotspot_11.0.14.1_1.tar.gz
-MACOS_X64_BOOT_JDK_SHA256=8c69808f5d9d209b195575e979de0e43cdf5d0f1acec1853a569601fe2c1f743
+MACOS_X64_BOOT_JDK_EXT=tar.gz
+MACOS_X64_BOOT_JDK_URL=https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.18%2B10/OpenJDK11U-jdk_x64_mac_hotspot_11.0.18_10.tar.gz
+MACOS_X64_BOOT_JDK_SHA256=75d79315d7265cc4b89fd9e844161ff90798bc6482ace8c1ac75f862a5b3b565
diff --git a/make/copy/Copy-java.base.gmk b/make/copy/Copy-java.base.gmk
index 4734d3f..8fb59d2 100644
--- a/make/copy/Copy-java.base.gmk
+++ b/make/copy/Copy-java.base.gmk
@@ -31,7 +31,7 @@ $(eval $(call IncludeCustomExtension, copy/Copy-java.base.gmk))
 
 ################################################################################
 
-ifneq ($(findstring $(OPENJDK_TARGET_OS), windows aix),)
+ifeq ($(call isTargetOs, windows aix), true)
 
   TZMAPPINGS_SRC := $(TOPDIR)/src/java.base/$(OPENJDK_TARGET_OS)/conf
 
@@ -89,7 +89,7 @@ endif
 ################################################################################
 # In jvm.cfg, the first listed KNOWN variant is the default. On most build
 # configurations, that is the server variant.
-ifeq ($(OPENJDK_TARGET_OS)-$(OPENJDK_TARGET_CPU), windows-x86)
+ifeq ($(call And, $(call isTargetOs, windows) $(call isTargetCpu, x86)), true)
   DEFAULT_CFG_VARIANT ?= client
 endif
 DEFAULT_CFG_VARIANT ?= server
@@ -151,7 +151,7 @@ DEF_POLICY_DST := $(LIB_DST_DIR)/security/default.policy
 DEF_POLICY_SRC_LIST := $(DEF_POLICY_SRC)
 DEF_POLICY_SRC_LIST += $(CUSTOM_POLICY_SRC_LIST)
 
-ifneq ($(filter $(OPENJDK_TARGET_OS), windows solaris), )
+ifeq ($(call isTargetOs, windows solaris), true)
   DEF_POLICY_SRC_LIST += $(TOPDIR)/src/java.base/$(OPENJDK_TARGET_OS)/lib/security/default.policy
 endif
 
@@ -191,7 +191,7 @@ $(eval $(call SetupCopyFiles, COPY_NET_PROPERTIES, \
 
 TARGETS += $(COPY_NET_PROPERTIES)
 
-ifeq ($(OPENJDK_TARGET_OS), solaris)
+ifeq ($(call isTargetOs, solaris), true)
   $(eval $(call SetupCopyFiles, COPY_SDP_CONF, \
       FILES := $(TOPDIR)/src/java.base/$(OPENJDK_TARGET_OS_TYPE)/conf/sdp/sdp.conf.template, \
       DEST := $(CONF_DST_DIR)/sdp, \
diff --git a/make/copy/Copy-jdk.crypto.cryptoki.gmk b/make/copy/Copy-jdk.crypto.cryptoki.gmk
index 7965c56..f5d1632 100644
--- a/make/copy/Copy-jdk.crypto.cryptoki.gmk
+++ b/make/copy/Copy-jdk.crypto.cryptoki.gmk
@@ -27,7 +27,7 @@ include CopyCommon.gmk
 
 ################################################################################
 
-ifeq ($(OPENJDK_TARGET_OS), solaris)
+ifeq ($(call isTargetOs, solaris), true)
 
   SUNPKCS11_CFG_SRC := \
       $(TOPDIR)/src/jdk.crypto.cryptoki/solaris/conf/security/sunpkcs11-solaris.cfg
diff --git a/make/copy/Copy-jdk.crypto.ucrypto.gmk b/make/copy/Copy-jdk.crypto.ucrypto.gmk
index 0007e44..a9320e8 100644
--- a/make/copy/Copy-jdk.crypto.ucrypto.gmk
+++ b/make/copy/Copy-jdk.crypto.ucrypto.gmk
@@ -27,7 +27,7 @@ include CopyCommon.gmk
 
 ################################################################################
 
-ifeq ($(OPENJDK_TARGET_OS), solaris)
+ifeq ($(call isTargetOs, solaris), true)
 
   UCRYPTO_CFG_SRC := $(TOPDIR)/src/jdk.crypto.ucrypto/solaris/conf/security/ucrypto-solaris.cfg
   UCRYPTO_CFG_DST := $(CONF_DST_DIR)/security/ucrypto-solaris.cfg
diff --git a/make/data/cacerts/certignaca b/make/data/cacerts/certignaca
 new file mode 100644
index 0000000..9e50633
--- /dev/null
+++ b/make/data/cacerts/certignaca
@@ -0,0 +1,29 @@
+Owner: CN=Certigna, O=Dhimyotis, C=FR
+Issuer: CN=Certigna, O=Dhimyotis, C=FR
+Serial number: fedce3010fc948ff
+Valid from: Fri Jun 29 15:13:05 GMT 2007 until: Tue Jun 29 15:13:05 GMT 2027
+Signature algorithm name: SHA1withRSA
+Subject Public Key Algorithm: 2048-bit RSA key
+Version: 3
+-----BEGIN CERTIFICATE-----
+MIIDqDCCApCgAwIBAgIJAP7c4wEPyUj/MA0GCSqGSIb3DQEBBQUAMDQxCzAJBgNV
+BAYTAkZSMRIwEAYDVQQKDAlEaGlteW90aXMxETAPBgNVBAMMCENlcnRpZ25hMB4X
+DTA3MDYyOTE1MTMwNVoXDTI3MDYyOTE1MTMwNVowNDELMAkGA1UEBhMCRlIxEjAQ
+BgNVBAoMCURoaW15b3RpczERMA8GA1UEAwwIQ2VydGlnbmEwggEiMA0GCSqGSIb3
+DQEBAQUAA4IBDwAwggEKAoIBAQDIaPHJ1tazNHUmgh7stL7qXOEm7RFHYeGifBZ4
+QCHkYJ5ayGPhxLGWkv8YbWkj4Sti993iNi+RB7lIzw7sebYs5zRLcAglozyHGxny
+gQcPOJAZ0xH+hrTy0V4eHpbNgGzOOzGTtvKg0KmVEn2lmsxryIRWijOp5yIVUxbw
+zBfsV1/pogqYCd7jX5xv3EjjhQsVWqa6n6xI4wmy9/Qy3l40vhx4XUJbzg4ij02Q
+130yGLMLLGq/jj8UEYkgDncUtT2UCIf3JR7VsmAA7G8qKCVuKj4YYxclPz5EIBb2
+JsglrgVKtOdjLPOMFlN+XPsRGgjBRmKfIrjxwo1p3Po6WAbfAgMBAAGjgbwwgbkw
+DwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUGu3+QTmQtCRZvgHyUtVF9lo53BEw
+ZAYDVR0jBF0wW4AUGu3+QTmQtCRZvgHyUtVF9lo53BGhOKQ2MDQxCzAJBgNVBAYT
+AkZSMRIwEAYDVQQKDAlEaGlteW90aXMxETAPBgNVBAMMCENlcnRpZ25hggkA/tzj
+AQ/JSP8wDgYDVR0PAQH/BAQDAgEGMBEGCWCGSAGG+EIBAQQEAwIABzANBgkqhkiG
+9w0BAQUFAAOCAQEAhQMeknH2Qq/ho2Ge6/PAD/Kl1NqV5ta+aDY9fm4fTIrv0Q8h
+bV6lUmPOEvjvKtpv6zf+EwLHyzs+ImvaYS5/1HI93TDhHkxAGYwP15zRgzB7mFnc
+fca5DClMoTOi62c6ZYTTluLtdkVwj7Ur3vkj1kluPBS1xp81HlDQwY9qcEQCYsuu
+HWhBp6pX6FOqB9IG9tUUBguRA3UsbHK1YZWaDYu5Def131TN3ubY1gkIl2PlwS6w
+t0QmwCbAr1UwnjvVNioZBPRcHv/PLLf/0P2HQBHVESO7SMAhqaQoLf0V+LBOK/Qw
+WyH8EZE0vkHve52Xdf+XlcCWWC/qu0bXu+TZLg==
+-----END CERTIFICATE-----
diff --git a/make/data/lsrdata/language-subtag-registry.txt b/make/data/lsrdata/language-subtag-registry.txt
index 3ce374c..92e0a26 100644
--- a/make/data/lsrdata/language-subtag-registry.txt
+++ b/make/data/lsrdata/language-subtag-registry.txt
@@ -1,4 +1,4 @@
-File-Date: 2021-05-11
+File-Date: 2022-08-08
 %%
 Type: language
 Subtag: aa
@@ -2146,9 +2146,16 @@ Added: 2009-07-29
 Macrolanguage: ar
 %%
 Type: language
+Subtag: ajs
+Description: Algerian Jewish Sign Language
+Added: 2022-02-25
+%%
+Type: language
 Subtag: ajt
 Description: Judeo-Tunisian Arabic
 Added: 2009-07-29
+Deprecated: 2022-02-25
+Preferred-Value: aeb
 Macrolanguage: jrb
 %%
 Type: language
@@ -5772,6 +5779,11 @@ Added: 2009-07-29
 Deprecated: 2020-03-28
 %%
 Type: language
+Subtag: bpc
+Description: Mbuk
+Added: 2022-02-25
+%%
+Type: language
 Subtag: bpd
 Description: Banda-Banda
 Added: 2009-07-29
@@ -6016,6 +6028,7 @@ Added: 2005-10-16
 %%
 Type: language
 Subtag: brb
+Description: Brao
 Description: Lave
 Added: 2009-07-29
 %%
@@ -8155,6 +8168,11 @@ Added: 2020-03-28
 Macrolanguage: zh
 %%
 Type: language
+Subtag: cnq
+Description: Chung
+Added: 2022-02-25
+%%
+Type: language
 Subtag: cnr
 Description: Montenegrin
 Added: 2018-01-23
@@ -8757,6 +8775,8 @@ Subtag: cug
 Description: Chungmboko
 Description: Cung
 Added: 2009-07-29
+Deprecated: 2022-02-25
+Comments: see bpc, cnq
 %%
 Type: language
 Subtag: cuh
@@ -10176,6 +10196,11 @@ Description: Tadaksahak
 Added: 2009-07-29
 %%
 Type: language
+Subtag: dsz
+Description: Mardin Sign Language
+Added: 2022-02-25
+%%
+Type: language
 Subtag: dta
 Description: Daur
 Added: 2009-07-29
@@ -10602,6 +10627,11 @@ Description: Emilian
 Added: 2009-07-29
 %%
 Type: language
+Subtag: egm
+Description: Benamanga
+Added: 2022-02-25
+%%
+Type: language
 Subtag: ego
 Description: Eggon
 Added: 2009-07-29
@@ -10913,7 +10943,7 @@ Added: 2009-07-29
 %%
 Type: language
 Subtag: env
-Description: Enwan (Edu State)
+Description: Enwan (Edo State)
 Added: 2009-07-29
 %%
 Type: language
@@ -11329,6 +11359,7 @@ Added: 2009-07-29
 Type: language
 Subtag: fit
 Description: Tornedalen Finnish
+Description: Meänkieli
 Added: 2009-07-29
 %%
 Type: language
@@ -12838,6 +12869,11 @@ Description: Gavar
 Added: 2009-07-29
 %%
 Type: language
+Subtag: gov
+Description: Goo
+Added: 2022-02-25
+%%
+Type: language
 Subtag: gow
 Description: Gorowa
 Added: 2009-07-29
@@ -14941,6 +14977,11 @@ Description: Marsian
 Added: 2009-07-29
 %%
 Type: language
+Subtag: imt
+Description: Imotong
+Added: 2022-02-25
+%%
+Type: language
 Subtag: imy
 Description: Milyan
 Added: 2009-07-29
@@ -19458,6 +19499,8 @@ Type: language
 Subtag: lak
 Description: Laka (Nigeria)
 Added: 2009-07-29
+Deprecated: 2022-02-25
+Preferred-Value: ksp
 %%
 Type: language
 Subtag: lal
@@ -19953,6 +19996,11 @@ Description: Opuuo
 Added: 2009-07-29
 %%
 Type: language
+Subtag: lgo
+Description: Lango (South Sudan)
+Added: 2022-02-25
+%%
+Type: language
 Subtag: lgq
 Description: Logba
 Added: 2009-07-29
@@ -20552,6 +20600,8 @@ Type: language
 Subtag: lno
 Description: Lango (South Sudan)
 Added: 2009-07-29
+Deprecated: 2022-02-25
+Comments: see imt, lgo, lqr, oie
 %%
 Type: language
 Subtag: lns
@@ -20724,6 +20774,11 @@ Description: Lopit
 Added: 2009-07-29
 %%
 Type: language
+Subtag: lqr
+Description: Logir
+Added: 2022-02-25
+%%
+Type: language
 Subtag: lra
 Description: Rara Bakati'
 Added: 2009-07-29
@@ -20809,6 +20864,12 @@ Description: Langue des Signes Burundaise
 Added: 2021-02-20
 %%
 Type: language
+Subtag: lsc
+Description: Albarradas Sign Language
+Description: Lengua de señas Albarradas
+Added: 2022-02-25
+%%
+Type: language
 Subtag: lsd
 Description: Lishana Deni
 Added: 2009-07-29
@@ -20883,6 +20944,13 @@ Description: Sivia Sign Language
 Added: 2019-04-16
 %%
 Type: language
+Subtag: lsw
+Description: Seychelles Sign Language
+Description: Lalang Siny Seselwa
+Description: Langue des Signes Seychelloise
+Added: 2022-02-25
+%%
+Type: language
 Subtag: lsy
 Description: Mauritian Sign Language
 Added: 2010-03-11
@@ -26779,6 +26847,11 @@ Description: Nawaru
 Added: 2009-07-29
 %%
 Type: language
+Subtag: nww
+Description: Ndwewe
+Added: 2022-02-25
+%%
+Type: language
 Subtag: nwx
 Description: Middle Newar
 Added: 2009-07-29
@@ -27201,6 +27274,11 @@ Description: Oirata
 Added: 2009-07-29
 %%
 Type: language
+Subtag: oie
+Description: Okolie
+Added: 2022-02-25
+%%
+Type: language
 Subtag: oin
 Description: Inebu One
 Added: 2009-07-29
@@ -28472,6 +28550,11 @@ Added: 2005-10-16
 Scope: collection
 %%
 Type: language
+Subtag: phj
+Description: Pahari
+Added: 2022-02-25
+%%
+Type: language
 Subtag: phk
 Description: Phake
 Added: 2009-07-29
@@ -28572,6 +28655,7 @@ Type: language
 Subtag: pii
 Description: Pini
 Added: 2009-07-29
+Deprecated: 2022-02-25
 %%
 Type: language
 Subtag: pij
@@ -29419,6 +29503,7 @@ Added: 2009-07-29
 %%
 Type: language
 Subtag: psc
+Description: Iranian Sign Language
 Description: Persian Sign Language
 Added: 2009-07-29
 %%
@@ -29772,7 +29857,13 @@ Description: Pyen
 Added: 2009-07-29
 %%
 Type: language
+Subtag: pzh
+Description: Pazeh
+Added: 2022-02-25
+%%
+Type: language
 Subtag: pzn
+Description: Jejara Naga
 Description: Para Naga
 Added: 2009-07-29
 %%
@@ -30394,6 +30485,11 @@ Description: Riang (India)
 Added: 2009-07-29
 %%
 Type: language
+Subtag: rib
+Description: Bribri Sign Language
+Added: 2022-02-25
+%%
+Type: language
 Subtag: rie
 Description: Rien
 Added: 2009-07-29
@@ -30627,6 +30723,11 @@ Added: 2009-07-29
 Deprecated: 2016-05-30
 %%
 Type: language
+Subtag: rnb
+Description: Brunca Sign Language
+Added: 2022-02-25
+%%
+Type: language
 Subtag: rnd
 Description: Ruund
 Added: 2009-07-29
@@ -30770,6 +30871,12 @@ Added: 2009-07-29
 Deprecated: 2017-02-23
 %%
 Type: language
+Subtag: rsk
+Description: Ruthenian
+Description: Rusyn
+Added: 2022-02-25
+%%
+Type: language
 Subtag: rsl
 Description: Russian Sign Language
 Added: 2009-07-29
@@ -30780,6 +30887,11 @@ Description: Miriwoong Sign Language
 Added: 2016-05-30
 %%
 Type: language
+Subtag: rsn
+Description: Rwandan Sign Language
+Added: 2022-02-25
+%%
+Type: language
 Subtag: rtc
 Description: Rungtu Chin
 Added: 2012-08-12
@@ -32276,6 +32388,8 @@ Type: language
 Subtag: smd
 Description: Sama
 Added: 2009-07-29
+Deprecated: 2022-02-25
+Preferred-Value: kmb
 %%
 Type: language
 Subtag: smf
@@ -32382,6 +32496,8 @@ Type: language
 Subtag: snb
 Description: Sebuyau
 Added: 2009-07-29
+Deprecated: 2022-02-25
+Preferred-Value: iba
 %%
 Type: language
 Subtag: snc
@@ -35199,6 +35315,11 @@ Description: Tojolabal
 Added: 2009-07-29
 %%
 Type: language
+Subtag: tok
+Description: Toki Pona
+Added: 2022-02-25
+%%
+Type: language
 Subtag: tol
 Description: Tolowa
 Added: 2009-07-29
@@ -35541,6 +35662,8 @@ Added: 2009-07-29
 %%
 Type: language
 Subtag: trv
+Description: Sediq
+Description: Seediq
 Description: Taroko
 Added: 2009-07-29
 %%
@@ -36432,6 +36555,11 @@ Description: Ughele
 Added: 2009-07-29
 %%
 Type: language
+Subtag: ugh
+Description: Kubachi
+Added: 2022-02-25
+%%
+Type: language
 Subtag: ugn
 Description: Ugandan Sign Language
 Added: 2009-07-29
@@ -36742,6 +36870,11 @@ Deprecated: 2015-02-12
 Preferred-Value: ema
 %%
 Type: language
+Subtag: uon
+Description: Kulon
+Added: 2022-02-25
+%%
+Type: language
 Subtag: upi
 Description: Umeda
 Added: 2009-07-29
@@ -36944,6 +37077,8 @@ Type: language
 Subtag: uun
 Description: Kulon-Pazeh
 Added: 2009-07-29
+Deprecated: 2022-02-25
+Comments: see pzh, uon
 %%
 Type: language
 Subtag: uur
@@ -37714,6 +37849,11 @@ Description: Wadikali
 Added: 2013-09-10
 %%
 Type: language
+Subtag: wdt
+Description: Wendat
+Added: 2022-02-25
+%%
+Type: language
 Subtag: wdu
 Description: Wadjigu
 Added: 2009-07-29
@@ -38348,6 +38488,7 @@ Type: language
 Subtag: wrd
 Description: Warduji
 Added: 2009-07-29
+Deprecated: 2022-02-25
 %%
 Type: language
 Subtag: wrg
@@ -38613,6 +38754,8 @@ Type: language
 Subtag: wya
 Description: Wyandot
 Added: 2009-07-29
+Deprecated: 2022-02-25
+Comments: see wdt, wyn
 %%
 Type: language
 Subtag: wyb
@@ -38630,6 +38773,11 @@ Description: Wymysorys
 Added: 2009-07-29
 %%
 Type: language
+Subtag: wyn
+Description: Wyandot
+Added: 2022-02-25
+%%
+Type: language
 Subtag: wyr
 Description: Wayoró
 Added: 2009-07-29
@@ -38936,6 +39084,11 @@ Description: Kwandu
 Added: 2017-02-23
 %%
 Type: language
+Subtag: xdq
+Description: Kaitag
+Added: 2022-02-25
+%%
+Type: language
 Subtag: xdy
 Description: Malayic Dayak
 Added: 2009-07-29
@@ -39079,6 +39232,11 @@ Added: 2009-07-29
 Macrolanguage: lah
 %%
 Type: language
+Subtag: xhm
+Description: Middle Khmer (1400 to 1850 CE)
+Added: 2022-02-25
+%%
+Type: language
 Subtag: xhr
 Description: Hernican
 Added: 2009-07-29
@@ -39215,6 +39373,7 @@ Added: 2009-07-29
 %%
 Type: language
 Subtag: xkk
+Description: Kachok
 Description: Kaco'
 Added: 2009-07-29
 %%
@@ -39469,6 +39628,7 @@ Macrolanguage: mg
 %%
 Type: language
 Subtag: xmx
+Description: Salawati
 Description: Maden
 Added: 2009-07-29
 %%
@@ -41728,6 +41888,12 @@ Added: 2009-07-29
 Macrolanguage: zap
 %%
 Type: language
+Subtag: zcd
+Description: Las Delicias Zapotec
+Added: 2022-02-25
+Macrolanguage: zap
+%%
+Type: language
 Subtag: zch
 Description: Central Hongshuihe Zhuang
 Added: 2009-07-29
@@ -42700,6 +42866,13 @@ Prefix: ar
 Macrolanguage: ar
 %%
 Type: extlang
+Subtag: ajs
+Description: Algerian Jewish Sign Language
+Added: 2022-02-25
+Preferred-Value: ajs
+Prefix: sgn
+%%
+Type: extlang
 Subtag: apc
 Description: North Levantine Arabic
 Added: 2009-07-29
@@ -43104,6 +43277,13 @@ Preferred-Value: dsl
 Prefix: sgn
 %%
 Type: extlang
+Subtag: dsz
+Description: Mardin Sign Language