Binary files 8u302-b08-1/corba.tar.xz and 8u332-ga-1/corba.tar.xz differ
diff -pruN 8u302-b08-1/debian/changelog 8u332-ga-1/debian/changelog
--- 8u302-b08-1/debian/changelog	2021-07-29 18:45:23.000000000 +0000
+++ 8u332-ga-1/debian/changelog	2022-04-24 18:43:30.000000000 +0000
@@ -1,3 +1,130 @@
+openjdk-8 (8u332-ga-1) unstable; urgency=medium
+
+  * Upload to unstable: final tested release
+  * Otherwise, see below for diff from 8u312/8u322
+  * Upload sponsored by ⮡ tarent
+
+ -- Thorsten Glaser <tg@mirbsd.de>  Sun, 24 Apr 2022 20:43:30 +0200
+
+openjdk-8 (8u332~b09-2) experimental; urgency=low
+
+  * Upload to experimental, with arm64 but see below
+  * Security fixes:
+    - JDK-8269938: Enhance XML processing passes redux
+    - JDK-8270504, CVE-2022-21426: Better XPath expression handling
+    - JDK-8272255: Completely handle MIDI files
+    - JDK-8272261: Improve JFR recording file processing
+    - JDK-8272594: Better record of recordings
+    - JDK-8274221: More definite BER encodings
+    - JDK-8275151, CVE-2022-21443: Improved Object Identification
+    - JDK-8277227: Better identification of OIDs
+    - JDK-8277672, CVE-2022-21434: Better invocation handler handling
+    - JDK-8278008, CVE-2022-21476: Improve Santuario processing
+    - JDK-8278356: Improve file creation
+    - JDK-8278449: Improve keychain support
+    - JDK-8278805: Enhance BMP image loading
+    - JDK-8278972, CVE-2022-21496: Improve URL supports
+    - JDK-8281388: Change wrapping of EncryptedPrivateKeyInfo
+  * Other changes: see
+    https://mail.openjdk.java.net/pipermail/jdk8u-dev/2022-April/014839.html
+  * Use stock jdk8u on arm64 instead of aarch64-shenandoah hotspot+GC
+  * Upload sponsored by ⮡ tarent
+
+ -- Thorsten Glaser <tg@mirbsd.de>  Sun, 24 Apr 2022 01:47:18 +0200
+
+openjdk-8 (8u332~b09-1) experimental; urgency=low
+
+  * Upload to experimental
+  * New upstream release but without arm64 as it’s not yet ported
+  * Upload sponsored by ⮡ tarent
+
+ -- Thorsten Glaser <tg@mirbsd.de>  Thu, 21 Apr 2022 23:01:54 +0000
+
+openjdk-8 (8u322-ga-1) unstable; urgency=low
+
+  * Synchronise versions of G++ used with current distro defaults
+  * Switch to github-based download workflow
+  * Refresh patches, d/copyright, packaging
+  * New upstream release
+  * Security fixes:
+    - JDK-8264934, CVE-2022-21248: Enhance cross VM serialization
+    - JDK-8268488: More valuable DerValues
+    - JDK-8268494: Better inlining of inlined interfaces
+    - JDK-8268512: More content for ContentInfo
+    - JDK-8268795: Enhance digests of Jar files
+    - JDK-8268801: Improve PKCS attribute handling
+    - JDK-8268813, CVE-2022-21283: Better String matching
+    - JDK-8269151: Better construction of EncryptedPrivateKeyInfo
+    - JDK-8269944: Better HTTP transport redux
+    - JDK-8270392, CVE-2022-21293: Improve String constructions
+    - JDK-8270416, CVE-2022-21294: Enhance construction of
+      Identity maps
+    - JDK-8270492, CVE-2022-21282: Better resolution of URIs
+    - JDK-8270498, CVE-2022-21296: Improve SAX Parser configuration
+      management
+    - JDK-8270646, CVE-2022-21299: Improved scanning of XML entities
+    - JDK-8271962: Better TrueType font loading
+    - JDK-8271968: Better canonical naming
+    - JDK-8271987: Manifest improved manifest entries
+    - JDK-8272014, CVE-2022-21305: Better array indexing
+    - JDK-8272026, CVE-2022-21340: Verify Jar Verification
+    - JDK-8272236, CVE-2022-21341: Improve serial forms for transport
+    - JDK-8272272: Enhance jcmd communication
+    - JDK-8272462: Enhance image handling
+    - JDK-8273290: Enhance sound handling
+    - JDK-8273748, CVE-2022-21349: Improve Solaris font rendering
+    - JDK-8273756, CVE-2022-21360: Enhance BMP image support
+    - JDK-8273838, CVE-2022-21365: Enhanced BMP processing
+  * Other changes: see
+    https://mail.openjdk.java.net/pipermail/jdk8u-dev/2022-January/014522.html
+  * Upload sponsored by ⮡ tarent
+    in preparation for a quick 8u332 once available
+
+ -- Thorsten Glaser <tg@mirbsd.de>  Thu, 21 Apr 2022 23:06:27 +0200
+
+openjdk-8 (8u312-b07-1) unstable; urgency=medium
+
+  * New upstream release (GA)
+  * Security fixes:
+    - JDK-8130183, CVE-2021-35588: InnerClasses: VM permits wrong
+      Throw ClassFormatError if InnerClasses attribute's
+      inner_class_info_index is 0
+    - JDK-8161016: Strange behavior of URLConnection with proxy
+    - JDK-8163326, CVE-2021-35550: Update the default enabled cipher
+      suites preference
+    - JDK-8254967, CVE-2021-35565: com.sun.net.HttpsServer spins on
+      TLS session close
+    - JDK-8263314: Enhance XML Dsig modes
+    - JDK-8265167, CVE-2021-35556: Richer Text Editors
+    - JDK-8265574: Improve handling of sheets
+    - JDK-8265580, CVE-2021-35559: Enhanced style for RTF kit
+    - JDK-8265776: Improve Stream handling for SSL
+    - JDK-8266097, CVE-2021-35561: Better hashing support
+    - JDK-8266103: Better specified spec values
+    - JDK-8266109: More Resilient Classloading
+    - JDK-8266115: More Manifest Jar Loading
+    - JDK-8266137, CVE-2021-35564: Improve Keystore integrity
+    - JDK-8266689, CVE-2021-35567: More Constrained Delegation
+    - JDK-8267086: ArrayIndexOutOfBoundsException in
+      java.security.KeyFactory.generatePublic
+    - JDK-8267712: Better LDAP reference processing
+    - JDK-8267729, CVE-2021-35578: Improve TLS client handshaking
+    - JDK-8267735, CVE-2021-35586: Better BMP support
+    - JDK-8268193: Improve requests of certificates
+    - JDK-8268199: Correct certificate requests
+    - JDK-8268506: More Manifest Digests
+    - JDK-8269618, CVE-2021-35603: Better session identification
+    - JDK-8269624: Enhance method selection support
+    - JDK-8270398: Enhance canonicalization
+    - JDK-8270404: Better canonicalization
+  * Other changes: see
+    https://mail.openjdk.java.net/pipermail/jdk8u-dev/2021-October/014373.html
+  * Policy 4.6.1, no relevant changes
+  * d/copyright: Apply changes since 8u302
+  * Upload sponsored by ⮡ tarent
+
+ -- Thorsten Glaser <tg@mirbsd.de>  Fri, 05 Nov 2021 23:57:58 +0000
+
 openjdk-8 (8u302-b08-1) unstable; urgency=medium
 
   * New upstream release (GA)
diff -pruN 8u302-b08-1/debian/control 8u332-ga-1/debian/control
--- 8u302-b08-1/debian/control	2021-07-29 18:32:53.000000000 +0000
+++ 8u332-ga-1/debian/control	2022-04-24 18:43:30.000000000 +0000
@@ -8,10 +8,10 @@ Build-Depends: debhelper (>= 9), quilt,
   sharutils, gawk, cpio, pkg-config, procps, wdiff, tzdata,
   xvfb<!nocheck>, xauth<!nocheck>, xfonts-base<!nocheck>, libgl1-mesa-dri [!x32]<!nocheck>, xfwm4<!nocheck>, x11-xkb-utils<!nocheck>, dbus-x11<!nocheck>, jtreg<!nocheck>, testng<!nocheck>, openjdk-8-jre-headless<!nocheck> | default-jre-headless (>= 2:1.8)<!nocheck>, time,
   autoconf (>= 2.69), automake, autotools-dev, ant, ant-optional, fastjar (>= 2:0.96-0ubuntu2),
-  g++-10, libxtst-dev, libxi-dev, libxt-dev, libxaw7-dev, libxrender-dev, libcups2-dev, libasound2-dev, liblcms2-dev, libfreetype6-dev (>= 2.2.1), libxinerama-dev, libkrb5-dev, xsltproc, libpcsclite-dev, libgtk2.0-dev,  libffi-dev,
+  g++-11, libxtst-dev, libxi-dev, libxt-dev, libxaw7-dev, libxrender-dev, libcups2-dev, libasound2-dev, liblcms2-dev, libfreetype6-dev (>= 2.2.1), libxinerama-dev, libkrb5-dev, xsltproc, libpcsclite-dev, libgtk2.0-dev,  libffi-dev,
   zlib1g-dev, libattr1-dev, libpng-dev, libjpeg-dev, libgif-dev, libpulse-dev (>= 0.9.12) [!alpha], systemtap-sdt-dev [!sh4],
   libnss3-dev (>= 2:3.17.1), openjdk-8-jdk-headless <cross>, dpkg-dev (>= 1.17.14),
-Standards-Version: 4.5.1
+Standards-Version: 4.6.0
 Homepage: http://openjdk.java.net/
 VCS-git: https://evolvis.org/anonscm/git/alioth/openjdk-8.git -b master
 VCS-Browser: https://evolvis.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=alioth/openjdk-8.git;a=shortlog;h=refs/heads/master
diff -pruN 8u302-b08-1/debian/control.in 8u332-ga-1/debian/control.in
--- 8u302-b08-1/debian/control.in	2021-07-29 18:29:18.000000000 +0000
+++ 8u332-ga-1/debian/control.in	2021-11-05 23:49:36.000000000 +0000
@@ -11,7 +11,7 @@ Build-Depends: debhelper (>= 9), quilt,
   @bd_gcc@ @bd_openjdk@ @bd_shark@ @bd_zero@
   @bd_syslibs@ @bd_pulsejava@ @bd_systemtap@
   @bd_nss@ @bd_cross@
-Standards-Version: 4.5.1
+Standards-Version: 4.6.0
 Homepage: http://openjdk.java.net/
 VCS-git: https://evolvis.org/anonscm/git/alioth/openjdk-8.git -b master
 VCS-Browser: https://evolvis.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=alioth/openjdk-8.git;a=shortlog;h=refs/heads/master
diff -pruN 8u302-b08-1/debian/copyright 8u332-ga-1/debian/copyright
--- 8u302-b08-1/debian/copyright	2021-07-29 18:45:23.000000000 +0000
+++ 8u332-ga-1/debian/copyright	2022-04-21 23:25:49.000000000 +0000
@@ -41,16 +41,21 @@ Copyright:
 
 OpenJDK:
     Copyright © 1996-2007 Sun Microsystems, Inc.
-    Copyright © 1996-2021 Oracle and/or its affiliates.
+    Copyright © 1996-2022 Oracle and/or its affiliates.
     For third party copyrights see below (copies from the third party readme).
     Portions Copyright © 1993-2014 IBM Corp.
     Portions Copyright © 1997 Eastman Kodak Company.
-    Portions Copyright © 1999-2005 The Apache Software Foundation.
+    Portions Copyright © 1999-2005 The Apache Software Foundation
+      (or licenced to the ASF under CLAs).
     Portions Copyright © 2013–2016 Azul Systems, Inc.
+    Portions Copyright © 2021 Azul, Inc.
     Portions Copyright © 2013–2021 Red Hat, Inc.
+    Portions Copyright © 2016 Google Inc.
     Portions Copyright © 2019 Amazon.com, Inc. or its affiliates.
-    Portions Copyright © 2020 SAP SE.
+    Portions Copyright © 2019 JetBrains s.r.o.
+    Portions Copyright © 2019–2020 SAP SE.
     Portions Copyright © 2021 Huawei Technologies Co., Ltd.
+    Portions Copyright © 2021 Arm Limited.
 
 IcedTea Sound:
     Portions Copyright © 2008-2014 Red Hat, Inc.
@@ -67,7 +72,11 @@ Java Access Bridge:
 
 Packaging:
     Copyright © 2007-2014 Canonical Ltd.
-    Copyright © 2021 mirabilos and ⮡ tarent solutions GmbH
+    Copyright © 2021, 2022 mirabilos and ⮡ tarent solutions GmbH
+
+SipHash:
+    Copyright © Copyright (c) 2012-2014 Daniel J. Bernstein <djb@cr.yp.to>
+    Copyright © 2012-2021 Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
 
 ------------------------------------------------------------------------------
 License:
@@ -3598,6 +3607,83 @@ with JRE 8, JDK 8, and OpenJDK 8.
 
 -------------------------------------------------------------------------------
 
+Copyright (c) OASIS Open 2016-2019. All Rights Reserved.
+
+%% This notice is provided with respect to OASIS PKCS #11 Cryptographic Token
+Interface v3.0,  which may be included with JRE 8, JDK 8, and OpenJDK 8.
+
+--- begin of LICENSE ---
+
+Copyright © OASIS Open 2020. All Rights Reserved.
+
+    All capitalized terms in the following text have the meanings
+assigned to them in the OASIS Intellectual Property Rights Policy (the
+"OASIS IPR Policy"). The full Policy may be found at the OASIS website:
+[http://www.oasis-open.org/policies-guidelines/ipr]
+
+    This document and translations of it may be copied and furnished to
+others, and derivative works that comment on or otherwise explain it or
+assist in its implementation may be prepared, copied, published, and
+distributed, in whole or in part, without restriction of any kind,
+provided that the above copyright notice and this section are included
+on all such copies and derivative works. However, this document itself
+may not be modified in any way, including by removing the copyright
+notice or references to OASIS, except as needed for the purpose of
+developing any document or deliverable produced by an OASIS Technical
+Committee (in which case the rules applicable to copyrights, as set
+forth in the OASIS IPR Policy, must be followed) or as required to
+translate it into languages other than English.
+
+    The limited permissions granted above are perpetual and will not be
+revoked by OASIS or its successors or assigns.
+
+    This document and the information contained herein is provided on an
+"AS IS" basis and OASIS DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED,
+INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
+INFORMATION HEREIN WILL NOT INFRINGE ANY OWNERSHIP RIGHTS OR ANY IMPLIED
+WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. OASIS
+AND ITS MEMBERS WILL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, SPECIAL OR
+CONSEQUENTIAL DAMAGES ARISING OUT OF ANY USE OF THIS DOCUMENT OR ANY
+PART THEREOF.
+
+    [OASIS requests that any OASIS Party or any other party that
+believes it has patent claims that would necessarily be infringed by
+implementations of this OASIS Standards Final Deliverable, to notify
+OASIS TC Administrator and provide an indication of its willingness to
+grant patent licenses to such patent claims in a manner consistent with
+the IPR Mode of the OASIS Technical Committee that produced this
+deliverable.]
+
+    [OASIS invites any party to contact the OASIS TC Administrator if it
+is aware of a claim of ownership of any patent claims that would
+necessarily be infringed by implementations of this OASIS Standards
+Final Deliverable by a patent holder that is not willing to provide a
+license to such patent claims in a manner consistent with the IPR Mode
+of the OASIS Technical Committee that produced this OASIS Standards
+Final Deliverable. OASIS may include such claims on its website, but
+disclaims any obligation to do so.]
+
+    [OASIS takes no position regarding the validity or scope of any
+intellectual property or other rights that might be claimed to pertain
+to the implementation or use of the technology described in this OASIS
+Standards Final Deliverable or the extent to which any license under
+such rights might or might not be available; neither does it represent
+that it has made any effort to identify any such rights. Information on
+OASIS' procedures with respect to rights in any document or deliverable
+produced by an OASIS Technical Committee can be found on the OASIS
+website. Copies of claims of rights made available for publication and
+any assurances of licenses to be made available, or the result of an
+attempt made to obtain a general license or permission for the use of
+such proprietary rights by implementers or users of this OASIS Standards
+Final Deliverable, can be obtained from the OASIS TC Administrator.
+OASIS makes no representation that any information or list of
+intellectual property rights will at any time be complete, or that any
+claims in such list are, in fact, Essential Claims.]
+
+--- end of LICENSE ---
+
+-------------------------------------------------------------------------------
+
 %% This notice is provided with respect to the following which may be
 included with JRE 8, JDK 8, and OpenJDK 8, except where noted:
 
@@ -3614,6 +3700,8 @@ included with JRE 8, JDK 8, and OpenJDK
 These components are licensed under the Apache License, Version 2.0.
 See /usr/share/common-licenses/Apache-2.0
 
+Large parts of JAXP are also Apache 2.0-licenced.
+
 -------------------------------------------------------------------------------
 
 
diff -pruN 8u302-b08-1/debian/JB-demo.overrides.in 8u332-ga-1/debian/JB-demo.overrides.in
--- 8u302-b08-1/debian/JB-demo.overrides.in	2021-05-03 18:16:40.000000000 +0000
+++ 8u332-ga-1/debian/JB-demo.overrides.in	2022-04-22 01:07:41.000000000 +0000
@@ -5,7 +5,6 @@
 @basename@-demo binary: codeless-jar
 
 # not a problem in these specific cases
-@basename@-demo binary: breakout-link
 @basename@-demo binary: duplicate-files
 @basename@-demo binary: repeated-path-segment
 
diff -pruN 8u302-b08-1/debian/JB-jre-headless.overrides.in 8u332-ga-1/debian/JB-jre-headless.overrides.in
--- 8u302-b08-1/debian/JB-jre-headless.overrides.in	2021-05-03 18:16:40.000000000 +0000
+++ 8u332-ga-1/debian/JB-jre-headless.overrides.in	2022-04-22 01:07:45.000000000 +0000
@@ -10,12 +10,13 @@
 # This is correct
 @basename@-jre-headless binary: executable-in-usr-lib
 
-# Not a problem in these specific cases
-@basename@-jre-headless binary: breakout-link
-
 # /usr/lib/jvm/…/lib/…
 @basename@-jre-headless binary: repeated-path-segment
 
 # not documentation
 @basename@-jre-headless binary: package-contains-documentation-outside-usr-share-doc */Xusage.txt
 @basename@-jre-headless binary: package-contains-documentation-outside-usr-share-doc */jvm.hprof.txt
+
+# this is a plugin
+@basename@-jre-headless binary: library-not-linked-against-libc */libjawt.so
+@basename@-jre-headless binary: shared-library-lacks-prerequisites */libjsound.so
diff -pruN 8u302-b08-1/debian/JB-jre.overrides.in 8u332-ga-1/debian/JB-jre.overrides.in
--- 8u302-b08-1/debian/JB-jre.overrides.in	2021-05-03 18:16:40.000000000 +0000
+++ 8u332-ga-1/debian/JB-jre.overrides.in	2022-04-22 01:07:50.000000000 +0000
@@ -4,9 +4,6 @@
 # this is correct
 @basename@-jre binary: executable-in-usr-lib
 
-# not a problem in these specific cases
-@basename@-jre binary: breakout-link
-
 # created by dh_makeshlibs, don’t worry
 @basename@-jre binary: package-has-unnecessary-activation-of-ldconfig-trigger
 
diff -pruN 8u302-b08-1/debian/openjdk-8-jre-headless.NEWS 8u332-ga-1/debian/openjdk-8-jre-headless.NEWS
--- 8u302-b08-1/debian/openjdk-8-jre-headless.NEWS	2021-05-03 18:16:40.000000000 +0000
+++ 8u332-ga-1/debian/openjdk-8-jre-headless.NEWS	2021-11-05 23:57:55.000000000 +0000
@@ -1,3 +1,31 @@
+openjdk-8 (8u312-b07-1) unstable; urgency=medium
+
+  Upstream-provided “Notes on individual issues”:
+
+  core-libs/java.net:
+
+  JDK-8164200: Modified HttpURLConnection behavior w/o suitable proxy
+  ===================================================================
+  The behavior of HttpURLConnection when using a ProxySelector has been
+  modified with this JDK release. HttpURLConnection used to fall back to
+  a DIRECT connection attempt if the configured proxy(s) failed to make
+  a connection. This release introduces a change whereby no DIRECT
+  connection will be attempted in such a scenario. Instead, the
+  HttpURLConnection.connect() method will fail and throw an IOException
+  which occurred from the last proxy tested.
+
+  security-libs/javax.net.ssl:
+
+  JDK-8219551: Updated the Default Enabled Cipher Suites Preference
+  =================================================================
+  The preference of the default enabled cipher suites has been
+  changed. The compatibility impact should be minimal. If needed,
+  applications can customize the enabled cipher suites and the
+  preference. For more details, refer to the SunJSSE provider
+  documentation and the JSSE Reference Guide documentation.
+
+ -- Thorsten Glaser <tg@mirbsd.de>  Fri, 05 Nov 2021 23:57:46 +0000
+
 openjdk-8 (8u282-b08-2) unstable; urgency=medium
 
   Note about support for OpenJDK 8:
diff -pruN 8u302-b08-1/debian/patches/aarch32.diff 8u332-ga-1/debian/patches/aarch32.diff
--- 8u302-b08-1/debian/patches/aarch32.diff	2021-07-29 18:45:23.000000000 +0000
+++ 8u332-ga-1/debian/patches/aarch32.diff	2022-04-21 22:47:31.000000000 +0000
@@ -1,3 +1,11 @@
+Description: “aarch32” patches outside of hotspot/
+ as applicable for Debian
+ .
+ Extra: “aarch32” has no support for C2 (server VM), use client
+Origin: Michael Klose?
+Forwarded: not-needed
+Last-Update: 2022-04-21
+
 --- a/common/autoconf/jdk-options.m4
 +++ b/common/autoconf/jdk-options.m4
 @@ -98,7 +98,11 @@ AC_DEFUN_ONCE([JDKOPT_SETUP_JVM_VARIANTS
diff -pruN 8u302-b08-1/debian/patches/hotspot-ia64.diff 8u332-ga-1/debian/patches/hotspot-ia64.diff
--- 8u302-b08-1/debian/patches/hotspot-ia64.diff	2021-07-29 18:45:23.000000000 +0000
+++ 8u332-ga-1/debian/patches/hotspot-ia64.diff	2022-04-21 23:30:24.000000000 +0000
@@ -1,6 +1,6 @@
 --- a/hotspot/src/share/vm/runtime/os.cpp
 +++ b/hotspot/src/share/vm/runtime/os.cpp
-@@ -1050,7 +1050,7 @@ void os::print_location(outputStream* st
+@@ -1072,7 +1072,7 @@ void os::print_location(outputStream* st
  // if C stack is walkable beyond current frame. The check for fp() is not
  // necessary on Sparc, but it's harmless.
  bool os::is_first_C_frame(frame* fr) {
diff -pruN 8u302-b08-1/debian/patches/system-libpng.diff 8u332-ga-1/debian/patches/system-libpng.diff
--- 8u302-b08-1/debian/patches/system-libpng.diff	2021-07-29 18:45:23.000000000 +0000
+++ 8u332-ga-1/debian/patches/system-libpng.diff	2022-04-21 23:30:14.000000000 +0000
@@ -52,7 +52,7 @@
  
 --- a/common/autoconf/spec.gmk.in
 +++ b/common/autoconf/spec.gmk.in
-@@ -603,6 +603,7 @@ endif
+@@ -604,6 +604,7 @@ endif
  ENABLE_JFR=@ENABLE_JFR@
  ENABLE_INTREE_EC=@ENABLE_INTREE_EC@
  USE_EXTERNAL_LIBJPEG:=@USE_EXTERNAL_LIBJPEG@
diff -pruN 8u302-b08-1/debian/patches/system-pcsclite.diff 8u332-ga-1/debian/patches/system-pcsclite.diff
--- 8u302-b08-1/debian/patches/system-pcsclite.diff	2021-07-29 18:45:23.000000000 +0000
+++ 8u332-ga-1/debian/patches/system-pcsclite.diff	2022-04-21 23:30:14.000000000 +0000
@@ -56,7 +56,7 @@
  
 --- a/common/autoconf/spec.gmk.in
 +++ b/common/autoconf/spec.gmk.in
-@@ -605,6 +605,7 @@ ENABLE_INTREE_EC=@ENABLE_INTREE_EC@
+@@ -606,6 +606,7 @@ ENABLE_INTREE_EC=@ENABLE_INTREE_EC@
  USE_EXTERNAL_LIBJPEG:=@USE_EXTERNAL_LIBJPEG@
  USE_EXTERNAL_LIBPNG:=@USE_EXTERNAL_LIBPNG@
  USE_EXTERNAL_LIBGIF:=@USE_EXTERNAL_LIBGIF@
diff -pruN 8u302-b08-1/debian/refresher.rc 8u332-ga-1/debian/refresher.rc
--- 8u302-b08-1/debian/refresher.rc	1970-01-01 00:00:00.000000000 +0000
+++ 8u332-ga-1/debian/refresher.rc	2022-04-21 21:39:24.000000000 +0000
@@ -0,0 +1,15 @@
+# From MirOS: contrib/hosted/tg/deb/dot.quiltrc,v 1.5 2013/12/31 10:17:32 tg Exp $
+
+QUILT_PATCHES=../debian/patches
+
+# enable options to generate standardised patches
+QUILT_PATCH_OPTS="--reject-format=unified"
+QUILT_DIFF_OPTS=""
+test -n "$QUILTRC_NO_DIFF_P" || \
+    QUILT_DIFF_OPTS="$QUILT_DIFF_OPTS --show-c-function"
+QUILT_DIFF_ARGS="-p ab --no-timestamps --no-index --color=auto"
+QUILT_REFRESH_ARGS="-p ab --no-timestamps --no-index --sort"
+QUILT_PUSH_ARGS="--color=auto"
+QUILT_COLORS="diff_hdr=1;32:diff_add=1;34:diff_rem=1;31:diff_hunk=1;33:diff_ctx=35:diff_cctx=33"
+
+:
diff -pruN 8u302-b08-1/debian/refresher.sh 8u332-ga-1/debian/refresher.sh
--- 8u302-b08-1/debian/refresher.sh	1970-01-01 00:00:00.000000000 +0000
+++ 8u332-ga-1/debian/refresher.sh	2022-04-21 21:39:52.000000000 +0000
@@ -0,0 +1,29 @@
+# call as: debian/rules debian/refresh
+
+set -e
+set -o pipefail
+cd "$(dirname "$0")/.."
+qrc=$PWD/debian/refresher.rc
+arch=amd64
+
+set -x
+for action in "$@"; do
+	case $action {
+	(:)
+		fakeroot debian/rules DEB_HOST_ARCH=$arch clean
+		;;
+	(.)
+		rm stamps/series
+		;;
+	(*)
+		arch=$action
+		debian/rules DEB_HOST_ARCH=$arch stamps/series
+		cd src
+		while quilt --quiltrc "$qrc" push; do
+			quilt --quiltrc "$qrc" refresh
+		done
+		quilt --quiltrc "$qrc" pop -a
+		cd ..
+		;;
+	}
+done
diff -pruN 8u302-b08-1/debian/rules 8u332-ga-1/debian/rules
--- 8u302-b08-1/debian/rules	2021-07-29 18:45:23.000000000 +0000
+++ 8u332-ga-1/debian/rules	2022-04-24 18:43:21.000000000 +0000
@@ -49,11 +49,12 @@ endif
 multiarch_dir = /$(DEB_HOST_MULTIARCH)
 
 hotspot_aarch32_archs = armhf
-hotspot_aarch64_archs = arm64
+#hotspot_aarch64_archs = arm64
+hotspot_aarch64_archs =
 
 hotspot_archs	= amd64 i386 arm64 ppc64 ppc64el sparc64 \
 	$(hotspot_aarch32_archs) kfreebsd-amd64 kfreebsd-i386
-jtreg_archs	= $(hotspot_archs) alpha arm64 armel armhf \
+jtreg_archs	= $(hotspot_archs) alpha armel armhf \
 		  ia64 mips mipsel mips64 mips64el powerpc \
 		  powerpcspe ppc64 ppc64el s390x sh4 x32
 # FIXME: use bootcycle builds for zero archs?
@@ -95,8 +96,23 @@ else
 endif
 jvmver		= 1.8.0
 shortver	= 8
-updatever	:= $(shell echo $(PKGVERSION) | sed -n 's/^$(shortver)u\([0-9]\+\).*/\1/p')
-buildver	:= $(shell echo $(PKGVERSION) | sed -n 's/^$(shortver)[^-]*-\(b[0-9]\+\).*/\1/p')
+
+is_release		=
+is_release		= yes
+gh_project		= jdk8u
+gh_tag			= jdk8u332-ga
+#version_dash_buildnr	= $(subst ${gh_project},,${gh_tag})
+version_dash_buildnr	= 332-b09
+gh_tag_aarch32		= jdk8u332-ga-aarch32-20220422
+#gh_tag_aarch64		= aarch64-shenandoah-jdk8u322-b06
+package_version		= $(subst jdk,,${gh_tag})
+ifneq ($(is_release),yes)
+  package_version	:= $(subst -,~,$(package_version))
+endif
+
+# make sure to set version_dash_buildnr above manually if gh_tag is -ga
+updatever		:= $(firstword $(subst -, ,${version_dash_buildnr}))
+buildver		:= $(lastword $(subst -, ,${version_dash_buildnr}))
 
 ifneq (,$(DEB_HOST_MULTIARCH))
   jdirname	= java-$(shortver)-$(origin)-$(DEB_HOST_ARCH)
@@ -134,6 +150,9 @@ with_check = $(if $(findstring nocheck,
 ifneq (,$(filter $(DEB_HOST_ARCH), armel))
   with_check = disabled running check on $(DEB_HOST_ARCH)
 endif
+ifneq (,$(filter $(distrel),precise))
+  with_check = disabled running check on $(distrel)
+endif
 #with_check = disabled for this build
 
 with_docs = $(if $(findstring nodoc, $(DEB_BUILD_OPTIONS)),,yes)
@@ -165,7 +184,7 @@ ifneq (,$(filter $(DEB_HOST_ARCH),$(hots
   hotspot_version = aarch32
 endif
 
-any_archs = alpha amd64 armel armhf arm64 i386 ia64 mips mipsel mips64 mips64el powerpc powerpcspe ppc64 ppc64el m68k sh4 sparc sparc64 s390x x32 kfreebsd-i386 kfreebsd-amd64
+any_archs = alpha amd64 armel ${hotspot_aarch32_archs} arm64 i386 ia64 mips mipsel mips64 mips64el powerpc powerpcspe ppc64 ppc64el m68k sh4 sparc sparc64 s390x x32 kfreebsd-i386 kfreebsd-amd64
 
 ifneq (,$(filter $(distrel),xenial))
   transitional_jamvm_pkg = yes
@@ -278,9 +297,12 @@ else ifneq (,$(filter $(distrel),buster)
 else ifneq (,$(filter $(distrel),focal))
   export CC = $(DEB_HOST_GNU_TYPE)-gcc-9
   export CXX = $(DEB_HOST_GNU_TYPE)-g++-9
-else
+else ifneq (,$(filter $(distrel),bullseye hirsute))
   export CC = $(DEB_HOST_GNU_TYPE)-gcc-10
   export CXX = $(DEB_HOST_GNU_TYPE)-g++-10
+else
+  export CC = $(DEB_HOST_GNU_TYPE)-gcc-11
+  export CXX = $(DEB_HOST_GNU_TYPE)-g++-11
 endif
 
 ifneq (,$(filter $(DEB_HOST_ARCH), armel armhf))
@@ -673,8 +695,10 @@ else ifneq (,$(filter $(distrel),buster)
   bd_gcc = g++-8,
 else ifneq (,$(filter $(distrel),focal))
   bd_gcc = g++-9,
-else
+else ifneq (,$(filter $(distrel),bullseye hirsute))
   bd_gcc = g++-10,
+else
+  bd_gcc = g++-11,
 endif
 bd_syslibs = zlib1g-dev, libattr1-dev,
 ifneq (,$(filter $(distrel),squeeze lucid))
@@ -754,7 +778,7 @@ dlopen_hl_depends = \
 	libcups2, liblcms2-2,
 ifneq (,$(filter $(distrel),squeeze lucid))
   dlopen_hl_depends += libjpeg62,
-else ifneq (,$(filter $(distrel), jessie stretch buster bullseye sid))
+else ifneq (,$(filter $(distrel), jessie stretch buster bullseye bookworm sid))
   dlopen_hl_depends += libjpeg62-turbo,
 else
   dlopen_hl_depends += libjpeg8,
@@ -1094,11 +1118,13 @@ endif
 	touch $@
 
 patch: stamps/patch
-stamps/patch: stamps/unpack
+stamps/series: stamps/unpack
 	for i in $(DEFAULT_PATCHES); do \
 	  echo $$i; \
 	done > $(srcdir)/series
+	@:>$@
 
+stamps/patch: stamps/series
 	cd $(srcdir) && \
 	  QUILT_PATCHES=../debian/patches quilt --quiltrc - push -a
 	( \
@@ -1983,21 +2009,11 @@ endif
 	NO_PKG_MANGLE=1 \
 	dh_builddeb -a $(nodemo) $(nojrez) #$(bd_options)
 
-is_release		=
-is_release		= yes
-hg_project		= jdk8u
-hg_tag			= jdk8u302-b08
-package_version		= $(subst jdk,,$(hg_tag))
-ifneq ($(is_release),yes)
-  package_version	:= $(subst -,~,$(package_version))
-endif
-hg_url			= https://hg.openjdk.java.net/jdk8u/$(hg_project)
-hg_project_aarch64	= jdk8u-shenandoah
-hg_tag_aarch64		= aarch64-shenandoah-jdk8u302-b08
-hg_url_aarch64		= https://hg.openjdk.java.net/aarch64-port/$(hg_project_aarch64)
-hg_project_aarch32	= jdk8u
-hg_tag_aarch32		= jdk8u302-b08-aarch32-20210726
-hg_url_aarch32		= https://hg.openjdk.java.net/aarch32-port/$(hg_project_aarch32)
+gh_url			= https://github.com/openjdk/${gh_project}/archive/refs/tags/${gh_tag}.tar.gz
+gh_project_aarch32	= aarch32-port-jdk8u
+gh_url_aarch32		= https://github.com/openjdk/${gh_project_aarch32}/archive/refs/tags/${gh_tag_aarch32}.tar.gz
+gh_project_aarch64	= shenandoah-jdk8u
+gh_url_aarch64		= https://github.com/openjdk/${gh_project_aarch64}/archive/refs/tags/${gh_tag_aarch64}.tar.gz
 origdir			= ../openjdk-8-$(package_version).orig
 orig_tarball		= ../openjdk-8_$(package_version).orig.tar.gz
 source_date		:= $(shell dpkg-parsechangelog | sed -n '/^Date: /{s///p;q;}')
@@ -2010,16 +2026,12 @@ do_fetch		= test -s ${origdir}/$(1) || \
 			    fi
 fetch-orig:
 	mkdir -p $(origdir)
-	$(call do_fetch,root.tar.bz2,$(hg_url)/archive/$(hg_tag).tar.bz2)
-	for repo in corba jaxp jaxws langtools hotspot jdk nashorn; do \
-		$(call do_fetch,$$repo.tar.bz2, \
-		    $(hg_url)/$$repo/archive/$(hg_tag).tar.bz2); \
-	done
-	$(call do_fetch,hotspot-aarch64.tar.bz2, \
-	    $(hg_url_aarch64)/hotspot/archive/$(hg_tag_aarch64).tar.bz2)
+	$(call do_fetch,jdk-any.tar.gz,${gh_url})
 ifneq (,$(hotspot_aarch32_archs))
-	$(call do_fetch,hotspot-aarch32.tar.bz2, \
-	    $(hg_url_aarch32)/hotspot/archive/$(hg_tag_aarch32).tar.bz2)
+	$(call do_fetch,jdk-aarch32.tar.gz,${gh_url_aarch32})
+endif
+ifneq (,$(hotspot_aarch64_archs))
+	$(call do_fetch,jdk-aarch64.tar.gz,${gh_url_aarch64})
 endif
 	$(call do_fetch,icedtea-sound.tar.xz, \
 	    http://icedtea.classpath.org/download/source/icedtea-sound-1.0.1.tar.xz)
@@ -2030,6 +2042,52 @@ endif
 	:
 	ls -l $(origdir)
 
+hotspot_variants :=
+ifneq (,$(hotspot_aarch64_archs))
+hotspot_variants += aarch64
+endif
+ifneq (,$(hotspot_aarch32_archs))
+hotspot_variants += aarch32
+endif
+
+munge-orig:
+	set -e; cd ${origdir}; rm -rf xjdk-*; set -x; for x in jdk-*; do \
+		mkdir -p x"$$x"; \
+		tar -xzf "$$x" --strip-components=1 -C x"$$x"; \
+		find x"$$x" -type d -print0 | xargs -0 chmod 755; \
+	done
+	cd ${origdir}/xjdk-any.tar.gz && tar -czf ../hotspot.tar.gz hotspot
+	set -ex; cd ${origdir}; for extra in ${hotspot_variants}; do \
+		cd xjdk-$$extra.tar.gz; \
+		tar -czf ../hotspot-$$extra.tar.gz hotspot; \
+		cd ..; \
+	done
+	rm -r ${origdir}/xjdk-*/hotspot
+ifneq (,$(hotspot_aarch32_archs))
+	# known deltas unnecessary to diff every time
+	cd ${origdir}/xjdk-aarch32.tar.gz && rm -f \
+	    cross-pkg-config cross_configure.sh cross_make.sh
+endif
+	wd=$$(pwd) && cd ${origdir} && for extra in ${hotspot_variants}; do \
+		diff -pruN -x '.hgtags*' -x config.sub \
+		    -x generated-configure.sh \
+		    xjdk-any.tar.gz xjdk-$$extra.tar.gz \
+		    >"$$wd/variant-$$extra.diff"; \
+		test $$? -lt 2 || exit 1; \
+	done
+	set -ex; cd ${origdir}/xjdk-any.tar.gz; for dir in corba jaxp jaxws \
+	    jdk langtools nashorn; do \
+		tar -czf ../$$dir.tar.gz $$dir; \
+		rm -r $$dir; \
+	done
+	cd ${origdir} && tar -czf root.tar.gz xjdk-any.tar.gz && rm -r xjdk-*
+	rm ${origdir}/jdk-*
+	:
+	ls -l ${origdir}
+	: "make sure these diffs contain nothing relevant:"
+	ls -l variant-*.diff
+	: "also DO NOT commit *or* upload them!"
+
 gtar_reproducible=tar --clamp-mtime --mtime="$(source_date)" \
 	--sort=name --owner=0 --group=0 --numeric-owner --format=ustar
 
@@ -2037,12 +2095,13 @@ dfsg-orig:
 	: # remove JSON license from THIRD_PARTY_README; no files shipped
 	set -ex; \
 	for repo in \
-	  root corba jaxp jaxws langtools hotspot jdk nashorn hotspot-aarch64 \
+	  root corba jaxp jaxws langtools hotspot jdk nashorn \
+	  $(if ${hotspot_aarch64_archs}, hotspot-aarch64) \
 	  $(if $(hotspot_aarch32_archs), hotspot-aarch32); \
 	do \
-	  [ -f $(origdir)/$$repo.tar.bz2 ] || continue; \
+	  [ -f $(origdir)/$$repo.tar.gz ] || continue; \
 	  mkdir -p $$repo; \
-	  tar -xf $(origdir)/$$repo.tar.bz2 --strip-components=1 -C $$repo; \
+	  tar -xzf $(origdir)/$$repo.tar.gz --strip-components=1 -C $$repo; \
 	  find $$repo -type d -print0 | xargs -0 chmod 755; \
 	  find $$repo -maxdepth 2 -name THIRD_PARTY_README; \
 	  for f in $$(find $$repo -maxdepth 2 -name THIRD_PARTY_README); do \
@@ -2065,13 +2124,20 @@ dfsg-orig:
 	  find $$repo '!' -perm /111 -print0 | xargs -0 chmod 644; \
 	  ${gtar_reproducible} -cJf $(origdir)/$$repo.tar.xz $$repo; \
 	  rm -rf $$repo; \
-	  rm -f $(origdir)/$$repo.tar.bz2; \
+	  rm -f $(origdir)/$$repo.tar.gz; \
 	done; \
 	find $(origdir) -perm /111 -print0 | xargs -0 chmod 755; \
 	find $(origdir) '!' -perm /111 -print0 | xargs -0 chmod 644; \
 	${gtar_reproducible} -cf - -C .. $$(basename $(origdir)) | \
 	    gzip -n9 >$(orig_tarball)
-get-orig: fetch-orig dfsg-orig
+get-orig: fetch-orig munge-orig dfsg-orig
+
+debian/refresh:
+	mksh debian/refresher.sh : \
+	    $(if ${hotspot_aarch32_archs}, armhf : ) \
+	    $(if ${hotspot_aarch64_archs}, arm64 : ) \
+	    alpha . amd64 :
 
 binary: binary-arch binary-indep
 .PHONY: build build-arch build-indep clean binary-indep binary-arch binary install packaging-files
+.PHONY: get-orig fetch-orig munge-orig dfsg-orig debian/refresh
Binary files 8u302-b08-1/hotspot-aarch32.tar.xz and 8u332-ga-1/hotspot-aarch32.tar.xz differ
Binary files 8u302-b08-1/hotspot-aarch64.tar.xz and 8u332-ga-1/hotspot-aarch64.tar.xz differ
Binary files 8u302-b08-1/hotspot.tar.xz and 8u332-ga-1/hotspot.tar.xz differ
Binary files 8u302-b08-1/jaxp.tar.xz and 8u332-ga-1/jaxp.tar.xz differ
Binary files 8u302-b08-1/jaxws.tar.xz and 8u332-ga-1/jaxws.tar.xz differ
Binary files 8u302-b08-1/jdk.tar.xz and 8u332-ga-1/jdk.tar.xz differ
Binary files 8u302-b08-1/langtools.tar.xz and 8u332-ga-1/langtools.tar.xz differ
Binary files 8u302-b08-1/nashorn.tar.xz and 8u332-ga-1/nashorn.tar.xz differ
Binary files 8u302-b08-1/root.tar.xz and 8u332-ga-1/root.tar.xz differ
