Merge ~vpa1977/ubuntu/+source/openjdk-lts:merge-openjdk-11 into ubuntu/+source/openjdk-lts:ubuntu/devel

[Vladimir Petko]

Changes:
  * d/source/lintian.overrides: use openjdk-lts package name.
  * Disable jtreg tests on RISC-V due to the infrastructure issue.
  * Merge changes from openjdk-11 11.0.21+9-1 (LP: #2039754).
    - d/test: update problemlist.
    - d/p: drop exclude-broken-tests.patch.
    - d/p/reproducible-properties-timestamp.diff: use the privileged action
      to read the system property (JDK-8272157, 914278).
    - d/copyright: remove liblcms from excluded files.
    - d/t/jtreg-autopkgtest.{sh,in}: JDK-8232153 - set NSS_DEFAULT_DB_TYPE
      to let sun/security/pkcs11/Secmod/AddTrustedCert.java pass.
    - Build using GCC 13 on development versions.
    - Explicitly configure --without-jtreg with the nocheck profile
    - Handle limited ECC capabilities of NSS on older releases.

PPA: ppa:vpa1977/october-21[1]

Note:
 - merging commented out lines from upstream to simplify future merges.

Testing:
 - jtreg tests (see comment).
 - piuparts test[2][3][5][6][7][8][9][10].

[1] https://launchpad.net/~vpa1977/+archive/ubuntu/october-21
[2] https://bugs.launchpad.net/ubuntu/+source/openjdk-lts/+bug/2039754/+attachment/5714192/+files/openjdk-11-source.log.gz
[3] https://bugs.launchpad.net/ubuntu/+source/openjdk-lts/+bug/2039754/+attachment/5714193/+files/openjdk-11-jre-zero.log.gz
[4] https://bugs.launchpad.net/ubuntu/+source/openjdk-lts/+bug/2039754/+attachment/5714194/+files/openjdk-11-jre-headless.log.gz
[5] https://bugs.launchpad.net/ubuntu/+source/openjdk-lts/+bug/2039754/+attachment/5714195/+files/openjdk-11-jre.log.gz
[6] https://bugs.launchpad.net/ubuntu/+source/openjdk-lts/+bug/2039754/+attachment/5714196/+files/openjdk-11-jdk-headless.log.gz
[7] https://bugs.launchpad.net/ubuntu/+source/openjdk-lts/+bug/2039754/+attachment/5714197/+files/openjdk-11-jdk.log.gz
[8] https://bugs.launchpad.net/ubuntu/+source/openjdk-lts/+bug/2039754/+attachment/5714198/+files/openjdk-11-doc.log.gz
[9] https://bugs.launchpad.net/ubuntu/+source/openjdk-lts/+bug/2039754/+attachment/5714199/+files/openjdk-11-demo.log.gz
[10] https://bugs.launchpad.net/ubuntu/+source/openjdk-lts/+bug/2039754/+attachment/5714200/+files/openjdk-11-dbg.log.gz

[Vladimir Petko (vpa1977)]

Test results:
----------------cut----------------------------------------------
Platform: amd64
--------------- jtreg console summary for hotspot ---------------
Test results: passed: 1,957
[debian/tests/jtreg-autopkgtest.sh] nothing to cleanup
Unable to compare jtreg results: no build jtreport found for hotspot/amd64.
Reason: '/usr/share/doc/openjdk-11-jre-headless//test-amd64/jtreport-hotspot.tar.gz' does not exist.
--------------- jtreg console summary for langtools ---------------
Test results: passed: 3,926
[debian/tests/jtreg-autopkgtest.sh] nothing to cleanup
Unable to compare jtreg results: no build jtreport found for hotspot/amd64.
Reason: '/usr/share/doc/openjdk-11-jre-headless//test-amd64/jtreport-hotspot.tar.gz' does not exist.
--------------- jtreg console summary for jaxp ---------------
Test results: passed: 443
[debian/tests/jtreg-autopkgtest.sh] nothing to cleanup
Unable to compare jtreg results: no build jtreport found for hotspot/amd64.
Reason: '/usr/share/doc/openjdk-11-jre-headless//test-amd64/jtreport-hotspot.tar.gz' does not exist.
--------------- jtreg console summary for jdk ---------------
(xfwm4:455717): dbind-WARNING **: 21:24:00.875: AT-SPI: Error retrieving accessibility bus address: org.freedesktop.DBus.Error.ServiceUnknown: The name org.a11y.Bus was not provided by any .service files
(xfwm4:455717): xfwm4-WARNING **: 21:24:01.544: Another compositing manager is running on screen 0
(xfwm4:455717): xfwm4-WARNING **: 21:24:01.546: Failed to connect to session manager: Failed to connect to the session manager: SESSION_MANAGER environment variable not defined
Test results: passed: 5,347
[debian/tests/jtreg-autopkgtest.sh] nothing to cleanup
Unable to compare jtreg results: no build jtreport found for hotspot/amd64.
Reason: '/usr/share/doc/openjdk-11-jre-headless//test-amd64/jtreport-hotspot.tar.gz' does not exist.
Killed
make[2]: Leaving directory '/<<PKGBUILDDIR>>'
 Command being timed: "/usr/bin/make -f debian/rules -k jtregcheck TEST_SUITES=hotspot langtools jaxp jdk JTREG_OPTIONS="
 User time (seconds): 24601.38
 System time (seconds): 1531.71
 Percent of CPU this job got: 333%
 Elapsed (wall clock) time (h:mm:ss or m:ss): 2:10:45
 Average shared text size (kbytes): 0
 Average unshared data size (kbytes): 0
 Average stack size (kbytes): 0
 Average total size (kbytes): 0
 Maximum resident set size (kbytes): 6547400
 Average resident set size (kbytes): 0
 Major (requiring I/O) page faults: 1288
 Minor (reclaiming a frame) page faults: 343961120
 Voluntary context switches: 47004675
 Involuntary context switches: 29439813
 Swaps: 0
 File system inputs: 2310520
 File system outputs: 68760264
 Socket messages sent: 0
 Socket messages received: 0
 Signals delivered: 0
 Page size (bytes): 4096
 Exit status: 0
--------------- jtreg console summary for hotspot ---------------
Test results: passed: 1,957
[debian/tests/jtreg-autopkgtest.sh] nothing to cleanup
Unable to compare jtreg results: no build jtreport found for hotspot/amd64.
Reason: '/usr/share/doc/openjdk-11-jre-headless//test-amd64/jtreport-hotspot.tar.gz' does not exist.
--------------- jtreg console summary for langtools ---------------
Test results: passed: 3...

[Matthias Klose (doko)]

that looks ok

review: Approve

[Vladimir Petko (vpa1977)]

Upload with the original tarball from Security Proposed: https://launchpad.net/~vpa1977/+archive/ubuntu/october-21-2/+packages

Unmerged commits

4b96b9c... by Vladimir Petko on 2023-10-19

changelog

c859439... by Vladimir Petko on 2023-10-19

  * d/source/lintian-overrides: use openjdk-lts package name.

e8f137c... by Vladimir Petko on 2023-10-19

  * Merge from Debian openjdk-11 11.0.21+9.

b1adfdb... by Vladimir Petko on 2023-10-19

  New upstream version 11.0.21+9

diff --git a/debian/changelog b/debian/changelog
index ff6645d..8cbb4f1 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,29 @@
+openjdk-lts (11.0.21+9-0ubuntu1) noble; urgency=medium
+
+  * OpenJDK 11.0.21 release, build 9.
+    - CVE-2023-22081.
+    - Release notes:
+      https://mail.openjdk.org/pipermail/jdk-updates-dev/2023-October/026351.html
+  * d/source/lintian.overrides: use openjdk-lts package name.
+  * Disable jtreg tests on RISC-V due to the infrastructure issue.
+  * Merge changes from openjdk-11 11.0.21+9-1 (LP: #2039754).
+    - d/test: update problemlist.
+    - d/p: drop exclude-broken-tests.patch.
+    - d/p/reproducible-properties-timestamp.diff: use the privileged action
+      to read the system property (JDK-8272157, 914278).
+    - d/copyright: remove liblcms from excluded files.
+    - d/t/jtreg-autopkgtest.{sh,in}: JDK-8232153 - set NSS_DEFAULT_DB_TYPE
+      to let sun/security/pkcs11/Secmod/AddTrustedCert.java pass.
+
+      [ Matthias Klose ]
+    - Build using GCC 13 on development versions.
+    - Explicitly configure --without-jtreg with the nocheck profile
+
+      [ Pushkar Kulkarni ]
+    - Handle limited ECC capabilities of NSS on older releases.
+
+ -- Vladimir Petko <[e-mail]>  Thu, 26 Oct 2023 16:16:27 +1300
+
 openjdk-lts (11.0.20+8-1ubuntu1) mantic; urgency=high
 
   * OpenJDK 11.0.20 release, build 8.
diff --git a/debian/control b/debian/control
index a596563..d3e52fa 100644
--- a/debian/control
+++ b/debian/control
@@ -10,7 +10,7 @@ Build-Depends: debhelper (>= 11),
   time, strip-nondeterminism, debugedit (>= 4.16),
   jtreg6 (>= 6+1-0~) <!nocheck>, libtestng7-java <!nocheck>, xvfb <!nocheck>, xauth <!nocheck>, xfonts-base <!nocheck>, libgl1-mesa-dri [!x32] <!nocheck>, xfwm4 <!nocheck>, x11-xkb-utils <!nocheck>, dbus-x11 <!nocheck>, libasmtools-java <!nocheck>, googletest <!nocheck>, google-mock <!nocheck>, xvfb  <!nocheck>,
   autoconf, automake, autotools-dev, ant, ant-optional,
-  g++-12 <!cross>,
+  g++-13 <!cross>,
   openjdk-11-jdk-headless:native | openjdk-10-jdk-headless:native,
   libxtst-dev, libxi-dev, libxt-dev, libxaw7-dev, libxrender-dev, libcups2-dev, libasound2-dev, liblcms2-dev, libfreetype6-dev (>= 2.2.1), libxinerama-dev, libkrb5-dev, xsltproc, libpcsclite-dev, libxrandr-dev, libelf-dev, libfontconfig1-dev, libgtk2.0-0 | libgtk-3-0, libharfbuzz-dev,
   libffi-dev,
diff --git a/debian/copyright b/debian/copyright
index 4598ff2..fb2db69 100644
--- a/debian/copyright
+++ b/debian/copyright
@@ -2,8 +2,6 @@ Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/
 Files-Excluded:
   .github/*
   .gitattributes
-  src/java.desktop/share/native/liblcms/cms*.c
-  src/java.desktop/share/native/liblcms/lcms2*.h
   src/java.base/share/native/libzip/zlib/*
   src/java.desktop/share/native/libsplashscreen/giflib/*
   src/java.desktop/share/native/libsplashscreen/libpng/*
diff --git a/debian/patches/exclude-broken-tests.patch b/debian/patches/exclude-broken-tests.patch
deleted file mode 100644
index 2a9983b..0000000
--- a/debian/patches/exclude-broken-tests.patch
+++ /dev/null
@@ -1,121 +0,0 @@
- Description: Disable failing tests
- Disable tests that fail on Ubuntu pending investigation
-Author: Vladimir Petko <[e-mail]>
-Forwarded: not-needed
-Last-Update: 2023-03-24
---- a/test/hotspot/jtreg/ProblemList.txt
-+++ b/test/hotspot/jtreg/ProblemList.txt
-@@ -38,6 +38,26 @@
- #
- #############################################################################
- 
-+# tests that need to be investigated
-+
-+gc/shenandoah/mxbeans/TestChurnNotifications.java#aggressive 0000000 generic-all
-+gc/shenandoah/mxbeans/TestChurnNotifications.java#iu 0000000 generic-all
-+
-+#result: Failed. Execution failed: `main' threw exception: java.io.IOException: Mount point not found
-+# https://bugs.openjdk.org/browse/JDK-8166162
-+
-+runtime/LoadClass/LongBCP.java 8166162 generic-all
-+
-+# Intermittent failures because LingeredApp.class is not found
-+
-+runtime/cds/appcds/jcmd/JCmdTestDynamicDump.java 000000 generic-all
-+runtime/cds/appcds/jcmd/JCmdTestFileSafety.java  000000 generic-all
-+runtime/cds/appcds/jcmd/JCmdTestStaticDump.java  000000 generic-all
-+
-+# Unexpected exit from the test
-+
-+runtime/NMT/SafepointPollingPages.java 000000 generic-all
-+
- # :hotspot_compiler
- 
- compiler/aot/verification/vmflags/TrackedFlagTest.java 8215224 generic-all
---- a/test/langtools/ProblemList.txt
-+++ b/test/langtools/ProblemList.txt
-@@ -23,6 +23,32 @@
- #
- ###########################################################################
- 
-+# Wrong test environment in autopkgtest
-+# java.lang.IllegalStateException: Launching JShell execution engine threw: ERROR: transport error 202: getaddrinfo: failed to parse address
-+
-+jdk/jshell/JdiListeningLocalhostExecutionControlTest.java 0000000 generic-all
-+
-+# tests failing due to disable-doclint-by-default.diff
-+
-+jdk/javadoc/doclet/testSupplementary/TestSupplementary.java 0000000 generic-all
-+jdk/javadoc/doclet/testPackageHtml/TestPackageHtml.java 0000000 generic-all
-+jdk/javadoc/doclet/testSummaryTag/TestSummaryTag.java 0000000 generic-all
-+jdk/javadoc/doclet/testStylesheet/TestStylesheet.java 0000000 generic-all
-+jdk/javadoc/doclet/testSeeTag/TestSeeTag.java 0000000 generic-all
-+jdk/javadoc/doclet/testRelativeLinks/TestRelativeLinks.java 0000000 generic-all
-+jdk/javadoc/doclet/testBadHtml/TestBadHtml.java 0000000 generic-all
-+jdk/javadoc/doclet/testParamTaglet/TestParamTaglet.java 0000000 generic-all
-+jdk/javadoc/doclet/testNonInlineHtmlTagRemoval/TestNonInlineHtmlTagRemoval.java 0000000 generic-all
-+jdk/javadoc/doclet/dupThrowsTags/TestDupThrowsTags.java 0000000 generic-all
-+jdk/javadoc/doclet/testLinkOption/TestLinkOption.java 0000000 generic-all
-+jdk/javadoc/doclet/T6735320/T6735320.java 0000000 generic-all
-+jdk/javadoc/doclet/testValueTag/TestValueTag.java 0000000 generic-all
-+jdk/javadoc/tool/modules/Modules.java 0000000 generic-all
-+jdk/javadoc/doclet/testWarnings/TestWarnings.java 0000000 generic-all
-+jdk/javadoc/doclet/testHtmlTableStyles/TestHtmlTableStyles.java 0000000 generic-all
-+jdk/javadoc/tool/doclint/DocLintTest.java 0000000 generic-all
-+jdk/javadoc/doclet/testBadPackageFileInJar/TestBadPackageFileInJar.java 0000000 generic-all
-+
- ###########################################################################
- #
- # javadoc
---- a/test/jdk/ProblemList.txt
-+++ b/test/jdk/ProblemList.txt
-@@ -110,6 +110,49 @@
- #
- #############################################################################
- 
-+
-+
-+# to investigate
-+# unable to read LD_LIBRARY_PATH env variable
-+
-+tools/jpackage/share/AppLauncherEnvTest.java 0000000 generic-all
-+
-+# java.lang.Exception: Proc abnormal end
-+
-+sun/security/krb5/auto/Cleaners.java 0000000 generic-all
-+
-+# result: Failed. Execution failed: `main' threw exception: java.io.IOException: Mount point not found
-+# https://bugs.openjdk.org/browse/JDK-8166162
-+
-+java/io/File/createTempFile/TargetDirectory.java 8166162 generic-all
-+java/nio/file/Files/CheckPermissions.java 8166162 generic-all
-+java/nio/file/Files/TemporaryFiles.java 8166162 generic-all
-+java/nio/file/Files/Misc.java 8166162 generic-all
-+java/nio/file/Files/CopyAndMove.java 8166162 generic-all
-+java/nio/file/Files/InterruptCopy.java 8166162 generic-all
-+java/nio/file/Files/FileAttributes.java 8166162 generic-all
-+java/nio/file/attribute/BasicFileAttributeView/SetTimesNanos.java 8166162 generic-all
-+java/nio/file/attribute/AclFileAttributeView/Basic.java 8166162 generic-all
-+java/nio/file/attribute/DosFileAttributeView/Basic.java 8166162 generic-all
-+java/nio/file/attribute/PosixFileAttributeView/Basic.java 8166162 generic-all
-+java/nio/file/attribute/UserDefinedFileAttributeView/Basic.java 8166162 generic-all
-+java/nio/file/FileStore/Basic.java 8166162 generic-all
-+java/nio/channels/FileChannel/directio/DirectIOTest.java 8166162 generic-all
-+java/nio/channels/FileChannel/directio/ReadDirect.java 8166162 generic-all
-+java/nio/channels/FileChannel/directio/PreadDirect.java 8166162 generic-all
-+java/nio/channels/FileChannel/directio/PwriteDirect.java 8166162 generic-all
-+java/nio/channels/FileChannel/directio/WriteDirect.java 8166162 generic-all
-+
-+# utf-8 locale is missing on build machine
-+# https://bugs.openjdk.org/browse/JDK-8249079
-+
-+java/lang/invoke/lambda/LambdaFileEncodingSerialization.java 8249079 generic-all
-+
-+# reproducible-properties-timestamp.diff introduce a bug that breaks this test
-+# remove after the patch is dropped
-+
-+java/util/logging/LogManager/Configuration/updateConfiguration/SimpleUpdateConfigWithInputStreamTest.java 000000 generic-all
-+
- ############################################################################
- 
- # jdk_awt
diff --git a/debian/patches/nss-limited-ecc-tests.patch b/debian/patches/nss-limited-ecc-tests.patch
new file mode 100644
index 0000000..7a75015
--- /dev/null
+++ b/debian/patches/nss-limited-ecc-tests.patch
@@ -0,0 +1,48 @@
+--- a/test/jdk/sun/security/pkcs11/PKCS11Test.java
++++ b/test/jdk/sun/security/pkcs11/PKCS11Test.java
+@@ -99,7 +99,7 @@
+     // NSS version info
+     public static enum ECCState { None, Basic, Extended };
+     static double nss_version = -1;
+-    static ECCState nss_ecc_status = ECCState.Extended;
++    static ECCState nss_ecc_status = ECCState.Basic;
+ 
+     // The NSS library we need to search for in getNSSLibDir()
+     // Default is "libsoftokn3.so", listed as "softokn3"
+--- a/test/jdk/sun/security/pkcs11/ec/TestECDH.java
++++ b/test/jdk/sun/security/pkcs11/ec/TestECDH.java
+@@ -124,8 +124,12 @@
+             return;
+         }
+ 
+-        test(p, pub192a, priv192a, pub192b, priv192b, secret192);
+-        test(p, pub163a, priv163a, pub163b, priv163b, secret163);
++        if (getSupportedECParameterSpec("secp192r1", p).isPresent()) {
++            test(p, pub192a, priv192a, pub192b, priv192b, secret192);
++        }
++        if (getSupportedECParameterSpec("sect163r1", p).isPresent()) {
++            test(p, pub163a, priv163a, pub163b, priv163b, secret163);
++        }
+ 
+         if (getSupportedECParameterSpec("brainpoolP256r1", p).isPresent()) {
+             test(p, pubBrainpoolP256r1a, privBrainpoolP256r1a, pubBrainpoolP256r1b, privBrainpoolP256r1b, secretBrainpoolP256r1);
+--- a/test/jdk/sun/security/pkcs11/ec/TestECDSA.java
++++ b/test/jdk/sun/security/pkcs11/ec/TestECDSA.java
+@@ -156,12 +156,14 @@
+             return;
+         }
+ 
+-        if (getNSSECC() != ECCState.Basic) {
++        if (getSupportedECParameterSpec("secp192r1", provider).isPresent()) {
+             test(provider, pub192, priv192, sig192);
++        }
++        if (getSupportedECParameterSpec("sect163r1", provider).isPresent()) {
+             test(provider, pub163, priv163, sig163);
++        }
++        if (getSupportedECParameterSpec("sect571r1", provider).isPresent()) {
+             test(provider, pub571, priv571, sig571);
+-        } else {
+-            System.out.println("ECC Basic only, skipping 192, 163 and 571.");
+         }
+         test(provider, pub521, priv521, sig521);
+ 
diff --git a/debian/patches/reproducible-properties-timestamp.diff b/debian/patches/reproducible-properties-timestamp.diff
index 596c01c..0f2bd72 100644
--- a/debian/patches/reproducible-properties-timestamp.diff
+++ b/debian/patches/reproducible-properties-timestamp.diff
@@ -3,7 +3,17 @@ Author: Emmanuel Bourg <[e-mail]>
 Forwarded: no
 --- a/src/java.base/share/classes/java/util/Properties.java
 +++ b/src/java.base/share/classes/java/util/Properties.java
-@@ -929,7 +929,7 @@
+@@ -53,6 +53,9 @@
+ import sun.nio.cs.UTF_8;
+ import sun.nio.cs.ISO_8859_1;
+
++import java.security.AccessController;
++import java.security.PrivilegedAction;
++
+ /**
+  * The {@code Properties} class represents a persistent set of
+  * properties. The {@code Properties} can be saved to a stream
+@@ -929,7 +932,7 @@
          if (comments != null) {
              writeComments(bw, comments);
          }
@@ -12,7 +22,7 @@ Forwarded: no
          bw.newLine();
          synchronized (this) {
              for (Map.Entry<Object, Object> e : entrySet()) {
-@@ -1579,4 +1579,22 @@
+@@ -1579,4 +1582,27 @@
          }
          this.map = map;
      }
@@ -23,14 +33,19 @@ Forwarded: no
 +     * environment variable is specified. In this case the format used is
 +     * locale and timezone insensitive to ensure the output is reproducible.
 +     */
++    @SuppressWarnings("removal")
 +    private String getFormattedTimestamp() {
-+        if (System.getenv("SOURCE_DATE_EPOCH") == null) {
++        String epoch = AccessController.doPrivileged(new PrivilegedAction<String>(){
++            public String run() { return System.getenv("SOURCE_DATE_EPOCH"); }
++        });
++
++        if (epoch == null) {
 +            return new Date().toString();
 +        } else {
 +            // Use the SOURCE_DATE_EPOCH timestamp and make the format locale/timezone insensitive
 +            java.text.SimpleDateFormat fmt = new java.text.SimpleDateFormat("yyyy-MM-dd HH:mm:ss z", java.util.Locale.ENGLISH);
 +            fmt.setTimeZone(java.util.TimeZone.getTimeZone("UTC"));
-+            Date date = new Date(1000 * Long.parseLong(System.getenv("SOURCE_DATE_EPOCH")));
++            Date date = new Date(1000 * Long.parseLong(epoch));
 +            return fmt.format(date);
 +        }
 +    }
diff --git a/debian/patches/series b/debian/patches/series
index 595607b..d03514a 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -38,4 +38,4 @@ log-generated-classes-test.patch
 update-permission-test.patch
 ldap-timeout-test-use-ip.patch
 test-use-ip-address.patch
-exclude-broken-tests.patch
+nss-limited-ecc-tests.patch
diff --git a/debian/rules b/debian/rules
index 6d80f7b..749a613 100755
--- a/debian/rules
+++ b/debian/rules
@@ -78,6 +78,7 @@ else
 endif
 
 is_upstream_release = yes
+#is_upstream_release =
 
 srcdir		= .
 builddir	= build
@@ -157,7 +158,7 @@ testng_pkg= libtestng7-java
 
 with_check = $(if $(findstring nocheck, $(DEB_BUILD_OPTIONS)),,yes)
 # see Debian #920161
-ifneq (,$(filter $(DEB_HOST_ARCH), alpha))
+ifneq (,$(filter $(DEB_HOST_ARCH), alpha riscv64))
   with_check = disabled running check on $(DEB_HOST_ARCH)
 endif
 # no jtreg backport yet
@@ -335,10 +336,14 @@ else ifneq (,$(filter $(distrel),jammy))
   export CC = $(DEB_HOST_GNU_TYPE)-gcc-11
   export CXX = $(DEB_HOST_GNU_TYPE)-g++-11
   bd_gcc = g++-11 <!cross>,
-else
+else ifneq (,$(filter $(distrel),bookworm lunar))
   export CC = $(DEB_HOST_GNU_TYPE)-gcc-12
   export CXX = $(DEB_HOST_GNU_TYPE)-g++-12
   bd_gcc = g++-12 <!cross>,
+else
+  export CC = $(DEB_HOST_GNU_TYPE)-gcc-13
+  export CXX = $(DEB_HOST_GNU_TYPE)-g++-13
+  bd_gcc = g++-13 <!cross>,
 endif
 
 # until we are able to b-d on gcc-for-host ...
@@ -1878,8 +1883,9 @@ endif
 	dh_builddeb -a $(nodemo) $(nojrez) #$(bd_options)
 
 is_release		= yes
+#is_release		=
 git_project		= jdk11u
-git_tag			= jdk-11.0.20+8
+git_tag			= jdk-11.0.21+9
 package_version		= $(subst jdk-,,$(git_tag))
 package_version		= $(shell echo $(PKGVERSION) | sed 's/-[^-][^-]*$$//')
 ifneq ($(is_release),yes)
diff --git a/debian/source/lintian-overrides b/debian/source/lintian-overrides
index 9cbed57..04c5846 100644
--- a/debian/source/lintian-overrides
+++ b/debian/source/lintian-overrides
@@ -1,2 +1,2 @@
 # parts of the test suite, not installed
-openjdk-11 source: source-is-missing
+openjdk-lts source: source-is-missing
diff --git a/debian/tests/hotspot b/debian/tests/hotspot
index b5a1f87..e937056 100755
--- a/debian/tests/hotspot
+++ b/debian/tests/hotspot
@@ -4,13 +4,8 @@ set -o errtrace
 set -o pipefail
 set -o nounset
 
-problem_list=${AUTOPKGTEST_TMP}/hotspot-problems.txt
-cat test/hotspot/jtreg/ProblemList.txt > ${problem_list}
-
-host_arch="${DEB_HOST_ARCH:-$(dpkg --print-architecture)}"
-if [[ -f debian/tests/problems-${host_arch}.txt ]]; then
-    cat debian/tests/problems-${host_arch}.txt >> ${problem_list}
-fi
+problem_list=${AUTOPKGTEST_TMP}/problems.txt
+debian/tests/write-problems ${problem_list} test/hotspot/jtreg/ProblemList.txt hotspot
 
 native_path=$(pwd)/build/images/test/hotspot/jtreg/native
 debian/tests/jtreg-autopkgtest.sh hotspot \
diff --git a/debian/tests/jaxp b/debian/tests/jaxp
index acdd84f..cad3802 100755
--- a/debian/tests/jaxp
+++ b/debian/tests/jaxp
@@ -4,10 +4,12 @@ set -o errtrace
 set -o pipefail
 set -o nounset
 
+problem_list=${AUTOPKGTEST_TMP}/problems.txt
+debian/tests/write-problems ${problem_list} test/jaxp/ProblemList.txt jaxp
+
 debian/tests/jtreg-autopkgtest.sh jaxp \
-    -exclude:test/jaxp/ProblemList.txt \
+    -exclude:${problem_list} \
     -dir:test/jaxp \
     -k:!stress \
     :tier1 :tier2
-
 debian/tests/jtdiff-autopkgtest.sh jaxp
diff --git a/debian/tests/jdk b/debian/tests/jdk
index 9b0553d..79e1ec0 100755
--- a/debian/tests/jdk
+++ b/debian/tests/jdk
@@ -4,6 +4,7 @@ set -o errtrace
 set -o pipefail
 set -o nounset
 
+
 cleanup() {
     # kill window manager to clean up (rest will exit automatically)
     pid="$(jobs -p)"
@@ -25,13 +26,8 @@ export DISPLAY=:10
 debian/tests/start-xvfb.sh 10 &
 sleep 3
 
-problem_list=${AUTOPKGTEST_TMP}/jdk-problems.txt
-cat test/jdk/ProblemList.txt > ${problem_list}
-
-host_arch="${DEB_HOST_ARCH:-$(dpkg --print-architecture)}"
-if [[ -f debian/tests/problems-${host_arch}.txt ]]; then
-    cat debian/tests/problems-${host_arch}.txt >> ${problem_list}
-fi
+problem_list=${AUTOPKGTEST_TMP}/problems.txt
+debian/tests/write-problems ${problem_list} test/jdk/ProblemList.txt jdk
 
 native_path=$(pwd)/build/images/test/jdk/jtreg/native
 debian/tests/jtreg-autopkgtest.sh jdk \
diff --git a/debian/tests/jtreg-autopkgtest.in b/debian/tests/jtreg-autopkgtest.in
index 1e3e806..747d296 100755
--- a/debian/tests/jtreg-autopkgtest.in
+++ b/debian/tests/jtreg-autopkgtest.in
@@ -32,7 +32,7 @@ fi
 if dpkg --compare-versions ${jtreg_version} ge 4.2; then
   jt_options+=" -conc:auto"
 fi
-  
+
 # check java binary
 if [ ! -x "${JDK_TO_TEST}/bin/java" ]; then
   echo "Error: '${JDK_TO_TEST}/bin/java' is not an executable." >&2
@@ -104,6 +104,9 @@ for i in 0 1 2; do
     -jdk:${JDK_TO_TEST} \
     -vmoption:-Dtest.boot.jdk=${BOOTJDK_HOME} \
     -vmoption:-XX:MaxRAMPercentage=25 \
+    -vmoption:-Duser.home=${AUTOPKGTEST_TMP} \
+    -vmoption:-Djava.io.tmpdir=${AUTOPKGTEST_TMP} \
+    -e:NSS_DEFAULT_DB_TYPE=sql \
     ${on_retry:-} $@ \
       && exit_code=0 || exit_code=$?
 
diff --git a/debian/tests/jtreg-autopkgtest.sh b/debian/tests/jtreg-autopkgtest.sh
index 7e3bfc3..ad0763a 100755
--- a/debian/tests/jtreg-autopkgtest.sh
+++ b/debian/tests/jtreg-autopkgtest.sh
@@ -109,7 +109,10 @@ for i in 0 1 2; do
     -reportDir:"${report_dir}" \
     -jdk:${JDK_TO_TEST} \
     -vmoption:-Dtest.boot.jdk=${BOOTJDK_HOME} \
+    -vmoption:-Duser.home=${AUTOPKGTEST_TMP} \
+    -vmoption:-Djava.io.tmpdir=${AUTOPKGTEST_TMP} \
     -vmoption:-XX:MaxRAMPercentage=25 \
+    -e:NSS_DEFAULT_DB_TYPE=sql \
     ${on_retry:-} $@ \
       && exit_code=0 || exit_code=$?
 
diff --git a/debian/tests/langtools b/debian/tests/langtools
index 9a24522..4db8e24 100755
--- a/debian/tests/langtools
+++ b/debian/tests/langtools
@@ -4,10 +4,12 @@ set -o errtrace
 set -o pipefail
 set -o nounset
 
+problem_list=${AUTOPKGTEST_TMP}/problems.txt
+debian/tests/write-problems ${problem_list} test/langtools/ProblemList.txt langtools
+
 debian/tests/jtreg-autopkgtest.sh langtools \
-    -exclude:test/langtools/ProblemList.txt \
-    -dir:test/langtools \
+  -exclude:${problem_list} \
+  -dir:test/langtools \
     -k:!stress \
     :tier1 :tier2
-
 debian/tests/jtdiff-autopkgtest.sh langtools
diff --git a/debian/tests/problems-armhf.txt b/debian/tests/problems-armhf.txt
index 0df5a72..5557a31 100644
--- a/debian/tests/problems-armhf.txt
+++ b/debian/tests/problems-armhf.txt
@@ -18,5 +18,20 @@ compiler/codecache/MHIntrinsicAllocFailureTest.java
 # this test passes but is very slow in CI, causing timeout
 
 jdk/sun/security/rsa/SignedObjectChain.java 000000 generic-all
+sun/security/rsa/SignedObjectChain.java 000000 generic-all
 sun/security/ec/ed/EdDSATest.java 000000 generic-all
-java/security/SignedObject/Chain.java 000000 generic-all
\ No newline at end of file
+java/security/SignedObject/Chain.java 000000 generic-all
+
+# timeout in SSL connection
+java/net/httpclient/ManyRequestsLegacy.java 000000 generic-all
+# deadlock
+java/util/Random/RandomTestBsi1999.java 000000 generic-all
+
+# runner issue, disk space size exceeds 32 bit integer
+java/io/File/GetXSpace.java 000000 generic-all
+
+# https://bugs.openjdk.org/browse/JDK-8303168
+serviceability/AsyncGetCallTrace/MyPackage/ASGCTBaseTest.java 000000 generic-all
+
+# native stack not implemented
+runtime/jni/nativeStack/TestNativeStack.java 000000 generic-all
diff --git a/debian/tests/problems-hotspot.txt b/debian/tests/problems-hotspot.txt
new file mode 100644
index 0000000..1420b16
--- /dev/null
+++ b/debian/tests/problems-hotspot.txt
@@ -0,0 +1,21 @@
+# tests that need to be investigated
+
+gc/shenandoah/mxbeans/TestChurnNotifications.java#aggressive 0000000 generic-all
+gc/shenandoah/mxbeans/TestChurnNotifications.java#iu 0000000 generic-all
+
+#result: Failed. Execution failed: `main' threw exception: java.io.IOException: Mount point not found
+# https://bugs.openjdk.org/browse/JDK-8166162
+
+runtime/LoadClass/LongBCP.java 8166162 generic-all
+
+# flaky test
+compiler/vectorization/runner/MultipleLoopsTest.java 000000 generic-all
+
+# Intermittent failures because LingeredApp.class is not found
+runtime/cds/appcds/jcmd/JCmdTestDynamicDump.java 000000 generic-all
+runtime/cds/appcds/jcmd/JCmdTestFileSafety.java  000000 generic-all
+runtime/cds/appcds/jcmd/JCmdTestStaticDump.java  000000 generic-all
+
+# Unexpected exit from the test
+runtime/NMT/SafepointPollingPages.java 000000 generic-all
+
diff --git a/debian/tests/problems-i386.txt b/debian/tests/problems-i386.txt
index 10cc71e..e28559c 100644
--- a/debian/tests/problems-i386.txt
+++ b/debian/tests/problems-i386.txt
@@ -13,3 +13,6 @@ gtest/GTestWrapper.java 000000 generic-all
 tools/jlink/JLinkTest.java 000000 generic-all
 
 java/net/httpclient/http2/HpackBinaryTestDriver.java 000000 generic-all
+
+# runner issue, disk space size exceeds 32 bit integer
+java/io/File/GetXSpace.java 000000 generic-all
diff --git a/debian/tests/problems-jdk.txt b/debian/tests/problems-jdk.txt
new file mode 100644
index 0000000..fd5b0ca
--- /dev/null
+++ b/debian/tests/problems-jdk.txt
@@ -0,0 +1,45 @@
+# NSS3 failure when processing SHA3 hashes (needs investigation)
+sun/security/pkcs11/Signature/KeyAndParamCheckForPSS.java 0000000 generic-all
+sun/security/pkcs11/MessageDigest/TestCloning.java 0000000 generic-all
+sun/security/pkcs11/Signature/SignatureTestPSS.java 0000000 generic-all
+
+# https://bugs.openjdk.org/browse/JDK-8312488
+tools/jpackage/share/AppLauncherEnvTest.java 0000000 generic-all
+
+# java.lang.Exception: Proc abnormal end
+sun/security/krb5/auto/Cleaners.java 0000000 generic-all
+
+# result: Failed. Execution failed: `main' threw exception: java.io.IOException: Mount point not found
+# https://bugs.openjdk.org/browse/JDK-8166162
+
+java/io/File/createTempFile/TargetDirectory.java 8166162 generic-all
+java/nio/file/Files/CheckPermissions.java 8166162 generic-all
+java/nio/file/Files/TemporaryFiles.java 8166162 generic-all
+java/nio/file/Files/Misc.java 8166162 generic-all
+java/nio/file/Files/CopyAndMove.java 8166162 generic-all
+java/nio/file/Files/InterruptCopy.java 8166162 generic-all
+java/nio/file/Files/FileAttributes.java 8166162 generic-all
+java/nio/file/attribute/BasicFileAttributeView/SetTimesNanos.java 8166162 generic-all
+java/nio/file/attribute/AclFileAttributeView/Basic.java 8166162 generic-all
+java/nio/file/attribute/DosFileAttributeView/Basic.java 8166162 generic-all
+java/nio/file/attribute/PosixFileAttributeView/Basic.java 8166162 generic-all
+java/nio/file/attribute/UserDefinedFileAttributeView/Basic.java 8166162 generic-all
+java/nio/file/FileStore/Basic.java 8166162 generic-all
+java/nio/channels/FileChannel/directio/DirectIOTest.java 8166162 generic-all
+java/nio/channels/FileChannel/directio/ReadDirect.java 8166162 generic-all
+java/nio/channels/FileChannel/directio/PreadDirect.java 8166162 generic-all
+java/nio/channels/FileChannel/directio/PwriteDirect.java 8166162 generic-all
+java/nio/channels/FileChannel/directio/WriteDirect.java 8166162 generic-all
+
+# utf-8 locale is missing on build machine
+# https://bugs.openjdk.org/browse/JDK-8249079
+
+java/lang/invoke/lambda/LambdaFileEncodingSerialization.java 8249079 generic-all
+
+# disable scoped value (incubating feature) test pending investigation
+
+jdk/incubator/concurrent/ScopedValue/StressStackOverflow.java 000000 generic-all
+java/lang/ScopedValue/StressStackOverflow.java 000000 generic-all
+
+# https://bugs.openjdk.org/browse/JDK-8309214
+sun/security/pkcs11/KeyStore/CertChainRemoval.java 000000 generic-all
diff --git a/debian/tests/problems-langtools.txt b/debian/tests/problems-langtools.txt
new file mode 100644
index 0000000..ea2e999
--- /dev/null
+++ b/debian/tests/problems-langtools.txt
@@ -0,0 +1,24 @@
+# Wrong test environment in autopkgtest
+# java.lang.IllegalStateException: Launching JShell execution engine threw: ERROR: transport error 202: getaddrinfo: failed to parse address
+jdk/jshell/JdiListeningLocalhostExecutionControlTest.java 0000000 generic-all
+
+# tests failing due to disable-doclint-by-default.diff
+
+jdk/javadoc/doclet/testSupplementary/TestSupplementary.java 0000000 generic-all
+jdk/javadoc/doclet/testPackageHtml/TestPackageHtml.java 0000000 generic-all
+jdk/javadoc/doclet/testSummaryTag/TestSummaryTag.java 0000000 generic-all
+jdk/javadoc/doclet/testStylesheet/TestStylesheet.java 0000000 generic-all
+jdk/javadoc/doclet/testSeeTag/TestSeeTag.java 0000000 generic-all
+jdk/javadoc/doclet/testRelativeLinks/TestRelativeLinks.java 0000000 generic-all
+jdk/javadoc/doclet/testBadHtml/TestBadHtml.java 0000000 generic-all
+jdk/javadoc/doclet/testParamTaglet/TestParamTaglet.java 0000000 generic-all
+jdk/javadoc/doclet/testNonInlineHtmlTagRemoval/TestNonInlineHtmlTagRemoval.java 0000000 generic-all
+jdk/javadoc/doclet/dupThrowsTags/TestDupThrowsTags.java 0000000 generic-all
+jdk/javadoc/doclet/testLinkOption/TestLinkOption.java 0000000 generic-all
+jdk/javadoc/doclet/T6735320/T6735320.java 0000000 generic-all
+jdk/javadoc/doclet/testValueTag/TestValueTag.java 0000000 generic-all
+jdk/javadoc/tool/modules/Modules.java 0000000 generic-all
+jdk/javadoc/doclet/testWarnings/TestWarnings.java 0000000 generic-all
+jdk/javadoc/doclet/testHtmlTableStyles/TestHtmlTableStyles.java 0000000 generic-all
+jdk/javadoc/tool/doclint/DocLintTest.java 0000000 generic-all
+jdk/javadoc/doclet/testBadPackageFileInJar/TestBadPackageFileInJar.java 0000000 generic-all
diff --git a/debian/tests/problems-s390x.txt b/debian/tests/problems-s390x.txt
new file mode 100644
index 0000000..9e66dd1
--- /dev/null
+++ b/debian/tests/problems-s390x.txt
@@ -0,0 +1,3 @@
+# https://bugs.openjdk.org/browse/JDK-8309698
+runtime/NMT/VirtualAllocCommitMerge.java 000000 generic-all
+
diff --git a/debian/tests/write-problems b/debian/tests/write-problems
new file mode 100755
index 0000000..434378f
--- /dev/null
+++ b/debian/tests/write-problems
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+problem_list=$1
+upstream_problems=$2
+suite=$3
+
+cat ${upstream_problems} > ${problem_list}
+
+if [[ -f debian/tests/problems-${suite}.txt ]]; then
+	cat debian/tests/problems-${suite}.txt >> ${problem_list}
+fi
+
+distrel=`lsb_release --codename --short`
+if [[ -f debian/tests/problems-${distrel}.txt ]]; then
+	cat debian/tests/problems-${distrel}.txt >> ${problem_list}
+fi
+
+host_arch="${DEB_HOST_ARCH:-$(dpkg --print-architecture)}"
+if [[ -f debian/tests/problems-${host_arch}.txt ]]; then
+	cat debian/tests/problems-${host_arch}.txt >> ${problem_list}
+fi
+
+if [[ -f debian/tests/problems-${distrel}-${host_arch}.txt ]]; then
+	cat debian/tests/problems-${distrel}-${host_arch}.txt >> ${problem_list}
+fi