user/openjdk8: new package

13 files changed, 1401 insertions, 0 deletions

diff --git a/user/openjdk8/APKBUILD b/user/openjdk8/APKBUILD
new file mode 100644
index 000000000..2ed565def
--- /dev/null
+++ b/user/openjdk8/APKBUILD
@@ -0,0 +1,309 @@
+# Maintainer: A. Wilcox <awilfox@adelielinux.org>
+pkgname=openjdk8
+_icedteaver=3.11.0
+# pkgver is <JDK version>.<JDK update>.<JDK build>
+# Check https://icedtea.classpath.org/wiki/Main_Page when updating
+pkgver=8.201.08
+pkgrel=0
+pkgdesc="Libre Java development kit for Java 8"
+url="https://icedtea.classpath.org/"
+arch="all"
+license="GPL-2.0-only"
+depends="$pkgname-jre java-cacerts"
+options="sover-namecheck"
+makedepends="bash findutils libarchive-tools zip file util-linux libxslt
+	autoconf automake linux-headers sed xz coreutils
+	openjdk7 ca-certificates libjpeg-turbo-dev cmd:which
+	nss-dev nss-static cups-dev giflib-dev libpng-dev libxt-dev
+	lcms2-dev libxp-dev libxtst-dev libxinerama-dev zlib-dev
+	libxrender-dev alsa-lib-dev freetype-dev fontconfig-dev
+	gtk+2.0-dev krb5-dev attr-dev pcsc-lite-dev lksctp-tools-dev
+	libxcomposite-dev"
+
+case $CARCH in
+x86|pmmx)	_jarch=i386;;
+x86_64)		_jarch=amd64;;
+arm*)		_jarch=aarch32;;
+ppc64)		_jarch=ppc64
+		export CFLAGS="$CFLAGS -DABI_ELFv2";;
+*)		_jarch="$CARCH";;
+esac
+
+_bootstrap_java_home="/usr/lib/jvm/java-1.7-openjdk"
+_java_home="/usr/lib/jvm/java-1.8-openjdk"
+_jrelib="$_java_home/jre/lib/$_jarch"
+
+# Exclude xawt from ldpath to avoid duplicate provides for libmawt.so
+# (also in headless). in future this should be a virtual provides.
+ldpath="$_jrelib:$_jrelib/native_threads:$_jrelib/headless:$_jrelib/server:$_jrelib/jli"
+sonameprefix="$pkgname:"
+
+subpackages="$pkgname-dbg $pkgname-jre-lib:jrelib:noarch $pkgname-jre $pkgname-jre-base:jrebase
+	$pkgname-doc $pkgname-demos"
+
+_dropsver=$_icedteaver
+_dropsurl="https://icedtea.classpath.org/download/drops/icedtea8/$_dropsver"
+
+source="https://icedtea.classpath.org/download/source/icedtea-$_icedteaver.tar.xz
+	openjdk-$_dropsver.tar.xz::$_dropsurl/openjdk.tar.xz
+	corba-$_dropsver.tar.xz::$_dropsurl/corba.tar.xz
+	jaxp-$_dropsver.tar.xz::$_dropsurl/jaxp.tar.xz
+	jaxws-$_dropsver.tar.xz::$_dropsurl/jaxws.tar.xz
+	jdk-$_dropsver.tar.xz::$_dropsurl/jdk.tar.xz
+	langtools-$_dropsver.tar.xz::$_dropsurl/langtools.tar.xz
+	hotspot-$_dropsver.tar.xz::$_dropsurl/hotspot.tar.xz
+	nashorn-$_dropsver.tar.xz::$_dropsurl/nashorn.tar.xz
+
+	icedtea-hotspot-musl.patch
+	icedtea-hotspot-musl-ppc.patch
+	icedtea-hotspot-noagent-musl.patch
+	icedtea-jdk-execinfo.patch
+	icedtea-jdk-fix-ipv6-init.patch
+	icedtea-jdk-fix-libjvm-load.patch
+	icedtea-jdk-musl.patch
+	icedtea-jdk-includes.patch
+	icedtea-jdk-getmntent-buffer.patch
+	icedtea-autoconf-config.patch
+	icedtea-jdk-tls-nist-curves.patch
+	remove-gawk.patch
+	"
+builddir="$srcdir/icedtea-$_icedteaver"
+
+# secfixes:
+#   8.201.08-r0:
+#     - CVE-2019-2422
+#     - CVE-2019-2426
+#     - CVE-2018-11212
+#   8.191.12-r0:
+#     - CVE-2018-3136
+#     - CVE-2018-3139
+#     - CVE-2018-3149
+#     - CVE-2018-3169
+#     - CVE-2018-3180
+#     - CVE-2018-3183
+#     - CVE-2018-3214
+#     - CVE-2018-13785
+#     - CVE-2018-16435
+#   8.181.13-r0:
+#     - CVE-2018-2938
+#     - CVE-2018-2940
+#     - CVE-2018-2952
+#     - CVE-2018-2973
+#     - CVE-2018-3639
+
+unpack() {
+	if [ -z "$force" ]; then
+		verify
+		initdcheck
+	fi
+	mkdir -p "$srcdir"
+	msg "Unpacking sources..."
+	tar -C "$srcdir" -Jxf icedtea-$_icedteaver.tar.xz
+}
+
+prepare() {
+	cd "$builddir"
+
+	local ver_u=$(sed -En 's/^\s*JDK_UPDATE_VERSION\s*=\s*(\S+).*/\1/p' acinclude.m4)
+	local ver_b=$(sed -En 's/^\s*BUILD_VERSION\s*=\s*b(\S+).*/\1/p' acinclude.m4)
+	[ "${pkgver#*.}" = "$ver_u.$ver_b" ] \
+		|| die "Version mismatch, source is 8.$ver_u.$ver_b, but abuild defines $pkgver!"
+
+	# Busybox sha256 does not support longopts.
+	sed -e "s/--check/-c/g" -i Makefile.am
+
+	local patch; for patch in $source; do
+		case $patch in
+		icedtea-*.patch)
+			cp ../$patch patches
+			;;
+		*.patch)
+			msg "Applying patch $patch"
+			patch -p1 -i "$srcdir"/$patch
+			;;
+		esac
+	done
+
+	./autogen.sh
+}
+
+build() {
+	export JAVA_HOME="$_bootstrap_java_home"
+	export PATH="$JAVA_HOME/bin:$PATH"
+
+	if [ -z "$JOBS" ]; then
+		export JOBS=$(printf '%s\n' "$MAKEFLAGS" | sed -n -e 's/.*-j\([0-9]\+\).*/\1/p')
+	fi
+
+	DISTRIBUTION_PATCHES=""
+	local patch; for patch in $source; do
+		case $patch in
+		icedtea-*.patch)
+			DISTRIBUTION_PATCHES="$DISTRIBUTION_PATCHES patches/$patch"
+			;;
+		esac
+	done
+	export DISTRIBUTION_PATCHES
+	echo "icedtea patches: $DISTRIBUTION_PATCHES"
+
+	cd "$builddir"
+	bash ./configure \
+		--build=$CBUILD \
+		--host=$CHOST \
+		--prefix="$_java_home" \
+		--sysconfdir=/etc \
+		--mandir=/usr/share/man \
+		--infodir=/usr/share/info \
+		--localstatedir=/var \
+		--disable-dependency-tracking \
+		--disable-downloading \
+		--disable-precompiled-headers \
+		--with-parallel-jobs=${JOBS:-2} \
+		--with-hotspot-build=default \
+		--with-openjdk-src-zip="$srcdir/openjdk-$_dropsver.tar.xz" \
+		--with-hotspot-src-zip="$srcdir/hotspot-$_dropsver.tar.xz" \
+		--with-corba-src-zip="$srcdir/corba-$_dropsver.tar.xz" \
+		--with-jaxp-src-zip="$srcdir/jaxp-$_dropsver.tar.xz" \
+		--with-jaxws-src-zip="$srcdir/jaxws-$_dropsver.tar.xz" \
+		--with-jdk-src-zip="$srcdir/jdk-$_dropsver.tar.xz" \
+		--with-langtools-src-zip="$srcdir/langtools-$_dropsver.tar.xz" \
+		--with-nashorn-src-zip="$srcdir/nashorn-$_dropsver.tar.xz" \
+		--with-pax=paxmark \
+		--with-jdk-home="$_bootstrap_java_home" \
+		--with-pkgversion="Alpine ${pkgver}-r${pkgrel}" \
+		--enable-nss \
+		--enable-non-nss-curves
+	make
+}
+
+# TODO: Run tests or at least try to compile and run hello world.
+check() {
+	cd "$builddir"/openjdk.build/images/j2sdk-image
+
+	./bin/java -version
+}
+
+package() {
+	cd "$builddir"
+
+	mkdir -p "$pkgdir"/$_java_home
+
+	cp -a openjdk.build/images/j2sdk-image/* "$pkgdir"/$_java_home/
+	rm "$pkgdir"/$_java_home/src.zip
+
+	# This archive contains absolute paths from the build environment,
+	# so it does not work on the target system. User can generate it
+	# running `java -Xshare:dump`.
+	rm -f "$pkgdir"/$_jrelib/server/classes.jsa
+
+	# pax mark again (due to fakeroot xattr handling bug)
+	./pax-mark-vm "$pkgdir"/$_java_home true
+
+	# symlink to shared java cacerts store
+	rm -f "$pkgdir"/$_java_home/jre/lib/security/cacerts
+	ln -sf /etc/ssl/certs/java/cacerts \
+		"$pkgdir"/$_java_home/jre/lib/security/cacerts
+}
+
+jrelib() {
+	pkgdesc="OpenJDK 8 Java Runtime (class libraries)"
+	depends=""
+
+	local file dir
+	for file in jre/lib/images \
+			jre/lib/*.jar \
+			jre/lib/security \
+			jre/lib/ext/*.jar \
+			jre/lib/cmm \
+			jre/ASSEMBLY_EXCEPTION \
+			jre/THIRD_PARTY_README \
+			jre/LICENSE; do
+
+		dir=${file%/*}
+		mkdir -p "$subpkgdir"/$_java_home/$dir
+		mv "$pkgdir"/$_java_home/$file "$subpkgdir"/$_java_home/$dir
+	done
+}
+
+jre() {
+	pkgdesc="OpenJDK 8 Java Runtime"
+	local file dir
+
+	mkdir -p "$subpkgdir"
+	for file in jre/bin/policytool \
+			bin/appletviewer \
+			bin/policytool \
+			jre/lib/$_jarch/libawt_xawt.so \
+			jre/lib/$_jarch/libfontmanager.so \
+			jre/lib/$_jarch/libjawt.so \
+			jre/lib/$_jarch/libjsoundalsa.so \
+			jre/lib/$_jarch/libsplashscreen.so; do
+
+		dir=${file%/*}
+		mkdir -p "$subpkgdir"/$_java_home/$dir
+		mv "$pkgdir"/$_java_home/$file "$subpkgdir"/$_java_home/$dir
+	done
+
+	# Pax mark again (due to fakeroot xattr handling bug).
+	"$builddir"/pax-mark-vm "$subpkgdir"/$_java_home true
+}
+
+jrebase() {
+	pkgdesc="OpenJDK 8 Java Runtime (no GUI support)"
+	depends="$pkgname-jre-lib java-common java-cacerts"
+
+	mkdir -p "$subpkgdir"/$_java_home/bin \
+		"$subpkgdir"/$_java_home/lib/$_jarch
+
+	mv "$pkgdir"/$_java_home/lib/$_jarch/jli \
+		"$subpkgdir"/$_java_home/lib/$_jarch/
+
+	local file; for file in java orbd rmid servertool unpack200 keytool \
+			pack200 rmiregistry tnameserv; do
+		mv "$pkgdir"/$_java_home/bin/$file "$subpkgdir"/$_java_home/bin/
+	done
+
+	# Rest of the jre subdir (which were not taken by -jre subpkg).
+	mv "$pkgdir"/$_java_home/jre "$subpkgdir"/$_java_home/
+
+	# Pax mark again (due to fakeroot xattr handling bug).
+	"$builddir"/pax-mark-vm "$subpkgdir"/$_java_home true
+}
+
+doc() {
+	default_doc
+
+	mkdir -p "$subpkgdir"/$_java_home/
+	mv "$pkgdir"/$_java_home/man "$subpkgdir"/$_java_home/
+}
+
+demos() {
+	pkgdesc="OpenJDK 8 Java Demos and Samples"
+	depends="$pkgname"
+
+	mkdir -p "$subpkgdir"/$_java_home/
+	mv "$pkgdir"/$_java_home/demo "$pkgdir"/$_java_home/sample \
+		"$subpkgdir"/$_java_home/
+}
+
+sha512sums="a71c9318d49077f8ae27f5c3e0b61df0709eded241f557c886f6b93aa98c13ad78f713d1286da286989bf62866dfff7538ad783eb804a705a160cbc096dea851  icedtea-3.11.0.tar.xz
+fc3faa7d7b9531f10c40241d89c36854043921f6f1a0851f284bcab36fc54fb0bb8cf8365dd4b2fb22b3ee8ddb8ed4a79e0807f79cb95b4b00f164993f1acc0b  openjdk-3.11.0.tar.xz
+9b8a44dda0bbfba8dc0d659e0fabf22e84b9931518e4b199a238faa103cbc4ed814c97f0f38f0aed263846b46fc7eab4500ba9759503373083e12cb8b5b364b5  corba-3.11.0.tar.xz
+9eba0f6ada2ae8adc1791a91ceb4fba9bd06aee0626cd1b4310ff16c7c8006045fed5fb7f109e490395b70695be4e6bfd6f1f5cbcdb095fb17abf123012a03de  jaxp-3.11.0.tar.xz
+ce5f0c2aced1af59f002dc9dc6cba4b9332167e9e019a3040267901ef7f325e05b8c99ed1f276b88ddb4e43cdd1b0c456e0c4dc2222ae6b3800c0502ffa840de  jaxws-3.11.0.tar.xz
+411508ed91f14ae1c51ea54de72a943db222ff572f3991631fe1a1fa97f9bb42da1e01ca98893f7236b4b44bae2917fc3f8622d7f94a085be30d437451acd272  jdk-3.11.0.tar.xz
+363c376848870c6c28415967561c4b151f1256c38a315fabc69c90425f5255224182045349a00c9433db52c416b7ebffedaa4825c980460541a3f9338adbaa5e  langtools-3.11.0.tar.xz
+13fa35f4a4fe01b3da4efb8476c0cb3482a36596eb422f2ad958a4c51efc286962ac3123a75853e84c4db477ac064a0fd3ee5e03f1ea0ec4f7e2c8ac07aa2d0e  hotspot-3.11.0.tar.xz
+2b46a8599d530a351522420cae8ac780cd2e64a6d7adbff87397a178f12f0a992bccd0f56435582dbd10be2157d4a4540c41b3dca488566162eed680102e58a9  nashorn-3.11.0.tar.xz
+c0776ff52e11a353fee29419319cd9e1fc4e5bb922832547616e8499fd52852a935a6a6fb93b49a67ab7b3fd2f7a63320f917e354cc7123220139e80694a7b5a  icedtea-hotspot-musl.patch
+e5cf4d70f96fc1e72ae8b97a887adb96092ff36584711cbb8de9d9fa9e859cb8731d638838de0d9591239fc44ffe5c74422d1842bd9f10a0c00dff1627bdeeef  icedtea-hotspot-musl-ppc.patch
+19459dbb922f5a71cd15b53199481498626a783c24f91d2544d55b7dddd2cdb34a64bbf0226b99548612dd1743af01b3f9ff32c30abbbc90ce727ca2dbbbd1f9  icedtea-hotspot-noagent-musl.patch
+f6365cfafafa008bd6c1bf0ccec01a63f8a39bd1a8bc87baa492a27234d47793ba02d455e5667a873ef50148df3baaf6a8421e2da0b15faac675867da714dd5f  icedtea-jdk-execinfo.patch
+48533f87fc2cf29d26b259be0df51087d2fe5b252e72d00c6ea2f4add7b0fb113141718c116279c5905e03f64a1118082e719393786811367cf4d472b5d36774  icedtea-jdk-fix-ipv6-init.patch
+b135991c76b0db8fa7c363e0903624668e11eda7b54a943035c214aa4d7fc8c3e8110ed200edcec82792f3c9393150a9bd628625ddf7f3e55720ff163fbbb471  icedtea-jdk-fix-libjvm-load.patch
+1fbc32ddc528c7c0099dbc1e48f88d29dccf55e7b8997793aa1d3d8408003a1223d898cca4248e1a12d343d3feec5144f875e6cdac8460d763c73ab3ad7e49f9  icedtea-jdk-musl.patch
+e8d9f1b867bf4fc84aa00d1237b264bcf503b1ed5f34735e14b0b747a728953fe0051a5af69ed058d377fbf65d8be1ed9e38fe5fc6edb2d50b31f34bf3ba91dc  icedtea-jdk-includes.patch
+7e6fa46b10c630517bfa46943858aea1d032c12d32ba3fcb7a2143ae1e896c34fa4cb8f925af80cb19f8e29149b835aa054adfd30ebb00539f6c78588d6f5211  icedtea-jdk-getmntent-buffer.patch
+662d662d0a7a84be2978e921317589f212f3ba3b7629527ba0f1140b5ac4c1024893e0ed176211688ed1a4505968c4befc841ed57ffcdbb9d355c2cb0571b167  icedtea-autoconf-config.patch
+9ea7ac942baf29cc619bc2e1acd59201b9f6d38f39a517b495d7613aec746459200c81afb57c5fcdcb856f6bc8b33f7566c8593fed07e5c73f43e08f1072d458  icedtea-jdk-tls-nist-curves.patch
+b0f6d07c6a949acdc8b4a25bf924f134f468e162f01dd440fd4ca80769fb84a0a54210f93efbe88012404fe3db6701aad31cdbc772bc054ad69021c37db5538c  remove-gawk.patch"
diff --git a/user/openjdk8/icedtea-autoconf-config.patch b/user/openjdk8/icedtea-autoconf-config.patch
new file mode 100644
index 000000000..9b75def87
--- /dev/null
+++ b/user/openjdk8/icedtea-autoconf-config.patch
@@ -0,0 +1,114 @@
+OpenJDK contains very outdated autoconf-config.guess and autoconf-config.sub
+that don't handle triplet with -musl. It also contains wrapper scripts
+config.guess and config.sub that we don't need at all.
+
+This patch modifies these wrapper scripts to just include up-to-date
+config.guess and config.sub from the icedtea tarball.
+
+--- openjdk.orig/common/autoconf/build-aux/config.guess
++++ openjdk/common/autoconf/build-aux/config.guess
+@@ -28,62 +28,4 @@
+ # and fix the broken property, if needed.
+ 
+ DIR=`dirname $0`
+-OUT=`. $DIR/autoconf-config.guess`
+-
+-# Test and fix solaris on x86_64
+-echo $OUT | grep i386-pc-solaris > /dev/null 2> /dev/null
+-if test $? = 0; then
+-  # isainfo -n returns either i386 or amd64
+-  REAL_CPU=`isainfo -n`
+-  OUT=$REAL_CPU`echo $OUT | sed -e 's/[^-]*//'`
+-fi
+-
+-# Test and fix solaris on sparcv9
+-echo $OUT | grep sparc-sun-solaris > /dev/null 2> /dev/null
+-if test $? = 0; then
+-  # isainfo -n returns either sparc or sparcv9
+-  REAL_CPU=`isainfo -n`
+-  OUT=$REAL_CPU`echo $OUT | sed -e 's/[^-]*//'`
+-fi
+-
+-# Test and fix cygwin on x86_64
+-echo $OUT | grep 86-pc-cygwin > /dev/null 2> /dev/null
+-if test $? != 0; then
+-  echo $OUT | grep 86-pc-mingw > /dev/null 2> /dev/null
+-fi
+-if test $? = 0; then
+-  case `echo $PROCESSOR_IDENTIFIER | cut -f1 -d' '` in
+-    intel64|Intel64|INTEL64|em64t|EM64T|amd64|AMD64|8664|x86_64)
+-      REAL_CPU=x86_64
+-      OUT=$REAL_CPU`echo $OUT | sed -e 's/[^-]*//'`
+-      ;;
+-  esac
+-fi
+-
+-# Test and fix architecture string on AIX
+-# On AIX 'config.guess' returns 'powerpc' as architecture but 'powerpc' is
+-# implicitely handled as 32-bit architecture in 'platform.m4' so we check
+-# for the kernel mode rewrite it to 'powerpc64' if we'Re running in 64-bit mode.
+-# The check could also be done with `/usr/sbin/prtconf | grep "Kernel Type" | grep "64-bit"`
+-echo $OUT | grep powerpc-ibm-aix > /dev/null 2> /dev/null
+-if test $? = 0; then
+-  if [ -x /bin/getconf ] ; then
+-    KERNEL_BITMODE=`getconf KERNEL_BITMODE`
+-    if  [ "$KERNEL_BITMODE" = "32" ]; then
+-      KERNEL_BITMODE=""
+-    fi
+-  fi
+-  OUT=powerpc$KERNEL_BITMODE`echo $OUT | sed -e 's/[^-]*//'`
+-fi
+-
+-# Test and fix little endian PowerPC64.
+-# TODO: should be handled by autoconf-config.guess. 
+-if [ "x$OUT" = x ]; then
+-  if [ `uname -m` = ppc64le ]; then
+-    if [ `uname -s` = Linux ]; then
+-      OUT=powerpc64le-unknown-linux-gnu
+-    fi
+-  fi
+-fi
+-
+-echo $OUT
++. $DIR/../../../../config.guess
+--- openjdk.orig/common/autoconf/build-aux/config.sub
++++ openjdk/common/autoconf/build-aux/config.sub
+@@ -28,37 +28,4 @@
+ # wrap it and fix the broken property, if needed.
+ 
+ DIR=`dirname $0`
+-
+-# First, filter out everything that doesn't begin with "aarch64-"
+-if ! echo $* | grep '^aarch64-' >/dev/null ; then
+-    . $DIR/autoconf-config.sub "$@"
+-    # autoconf-config.sub exits, so we never reach here, but just in
+-    # case we do:
+-    exit
+-fi
+-
+-while test $# -gt 0 ; do
+-    case $1 in 
+-        -- )   # Stop option processing
+-            shift; break ;;
+-        aarch64-* )
+-            config=`echo $1 | sed 's/^aarch64-/arm-/'`
+-            sub_args="$sub_args $config"
+-            shift; ;;
+-        - )    # Use stdin as input.
+-            sub_args="$sub_args $1"
+-            shift; break ;;
+-        * )
+-            sub_args="$sub_args $1"
+-            shift; ;;
+-    esac
+-done
+-
+-result=`. $DIR/autoconf-config.sub $sub_args "$@"`
+-exitcode=$?
+-
+-result=`echo $result | sed "s/^arm-/aarch64-/"`
+-
+-echo $result
+-exit $exitcode
+-
++. $DIR/../../../../config.sub "$@"
diff --git a/user/openjdk8/icedtea-hotspot-musl-ppc.patch b/user/openjdk8/icedtea-hotspot-musl-ppc.patch
new file mode 100644
index 000000000..eca684884
--- /dev/null
+++ b/user/openjdk8/icedtea-hotspot-musl-ppc.patch
@@ -0,0 +1,169 @@
+--- openjdk.orig/hotspot/src/os_cpu/linux_ppc/vm/os_linux_ppc.cpp
++++ openjdk/hotspot/src/os_cpu/linux_ppc/vm/os_linux_ppc.cpp
+@@ -110,11 +110,19 @@
+   //   it because the volatile registers are not needed to make setcontext() work.
+   //   Hopefully it was zero'd out beforehand.
+   guarantee(uc->uc_mcontext.regs != NULL, "only use ucontext_get_pc in sigaction context");
++#if defined(__GLIBC__) || defined(__UCLIBC__)
+   return (address)uc->uc_mcontext.regs->nip;
++#else // Musl
++  return (address)uc->uc_mcontext.gp_regs[32];
++#endif
+ }
+ 
+ intptr_t* os::Linux::ucontext_get_sp(ucontext_t * uc) {
++#if defined(__GLIBC__) || defined(__UCLIBC__)
+   return (intptr_t*)uc->uc_mcontext.regs->gpr[1/*REG_SP*/];
++#else // Musl
++  return (intptr_t*)uc->uc_mcontext.gp_regs[1/*REG_SP*/];
++#endif
+ }
+ 
+ intptr_t* os::Linux::ucontext_get_fp(ucontext_t * uc) {
+@@ -213,7 +221,11 @@
+   if (uc) {
+     address const pc = os::Linux::ucontext_get_pc(uc);
+     if (pc && StubRoutines::is_safefetch_fault(pc)) {
++#if defined(__GLIBC__) || defined(__UCLIBC__)
+       uc->uc_mcontext.regs->nip = (unsigned long)StubRoutines::continuation_for_safefetch_fault(pc);
++#else // Musl
++      uc->uc_mcontext.gp_regs[32] = (unsigned long)StubRoutines::continuation_for_safefetch_fault(pc);
++#endif
+       return true;
+     }
+   }
+@@ -364,7 +376,11 @@
+           // continue at the next instruction after the faulting read. Returning
+           // garbage from this read is ok.
+           thread->set_pending_unsafe_access_error();
++#if defined(__GLIBC__) || defined(__UCLIBC__)
+           uc->uc_mcontext.regs->nip = ((unsigned long)pc) + 4;
++#else // Musl
++          uc->uc_mcontext.gp_regs[32] = ((unsigned long)pc) + 4;
++#endif
+           return true;
+         }
+       }
+@@ -383,7 +399,11 @@
+         // continue at the next instruction after the faulting read. Returning
+         // garbage from this read is ok.
+         thread->set_pending_unsafe_access_error();
++#if defined(__GLIBC__) || defined(__UCLIBC__)
+         uc->uc_mcontext.regs->nip = ((unsigned long)pc) + 4;
++#else // Musl
++        uc->uc_mcontext.gp_regs[32] = ((unsigned long)pc) + 4;
++#endif
+         return true;
+       }
+     }
+@@ -406,7 +426,11 @@
+   if (stub != NULL) {
+     // Save all thread context in case we need to restore it.
+     if (thread != NULL) thread->set_saved_exception_pc(pc);
++#if defined(__GLIBC__) || defined(__UCLIBC__)
+     uc->uc_mcontext.regs->nip = (unsigned long)stub;
++#else
++    uc->uc_mcontext.gp_regs[32] = (unsigned long)stub;
++#endif
+     return true;
+   }
+ 
+@@ -564,6 +588,7 @@
+   ucontext_t* uc = (ucontext_t*)context;
+ 
+   st->print_cr("Registers:");
++#if defined(__GLIBC__) || defined(__UCLIBC__)
+   st->print("pc =" INTPTR_FORMAT "  ", uc->uc_mcontext.regs->nip);
+   st->print("lr =" INTPTR_FORMAT "  ", uc->uc_mcontext.regs->link);
+   st->print("ctr=" INTPTR_FORMAT "  ", uc->uc_mcontext.regs->ctr);
+@@ -572,8 +597,18 @@
+     st->print("r%-2d=" INTPTR_FORMAT "  ", i, uc->uc_mcontext.regs->gpr[i]);
+     if (i % 3 == 2) st->cr();
+   }
++#else // Musl
++  st->print("pc =" INTPTR_FORMAT "  ", uc->uc_mcontext.gp_regs[32]);
++  st->print("lr =" INTPTR_FORMAT "  ", uc->uc_mcontext.gp_regs[36]);
++  st->print("ctr=" INTPTR_FORMAT "  ", uc->uc_mcontext.gp_regs[35]);
+   st->cr();
++  for (int i = 0; i < 32; i++) {
++    st->print("r%-2d=" INTPTR_FORMAT "  ", i, uc->uc_mcontext.gp_regs[i]);
++    if (i % 3 == 2) st->cr();
++  }
++#endif
+   st->cr();
++  st->cr();
+ 
+   intptr_t *sp = (intptr_t *)os::Linux::ucontext_get_sp(uc);
+   st->print_cr("Top of Stack: (sp=" PTR_FORMAT ")", p2i(sp));
+@@ -600,7 +635,11 @@
+   // this is only for the "general purpose" registers
+   for (int i = 0; i < 32; i++) {
+     st->print("r%-2d=", i);
++#if defined(__GLIBC__) || defined(__UCLIBC__)
+     print_location(st, uc->uc_mcontext.regs->gpr[i]);
++#else // Musl
++    print_location(st, uc->uc_mcontext.gp_regs[i]);
++#endif
+   }
+   st->cr();
+ }
+--- openjdk.orig/hotspot.orig/src/cpu/ppc/vm/macroAssembler_ppc.cpp
++++ openjdk/hotspot/src/cpu/ppc/vm/macroAssembler_ppc.cpp
+@@ -1242,7 +1242,11 @@
+   // the safepoing polling page.
+   ucontext_t* uc = (ucontext_t*) ucontext;
+   // Set polling address.
++#if defined(__GLIBC__) || defined(__UCLIBC__)
+   address addr = (address)uc->uc_mcontext.regs->gpr[ra] + (ssize_t)ds;
++#else // Musl
++  address addr = (address)uc->uc_mcontext.gp_regs[ra] + (ssize_t)ds;
++#endif
+   if (polling_address_ptr != NULL) {
+     *polling_address_ptr = addr;
+   }
+@@ -1263,15 +1267,24 @@
+     int rb = inv_rb_field(instruction);
+ 
+     // look up content of ra and rb in ucontext
++#if defined(__GLIBC__) || defined(__UCLIBC__)
+     address ra_val=(address)uc->uc_mcontext.regs->gpr[ra];
+     long rb_val=(long)uc->uc_mcontext.regs->gpr[rb];
++#else // Musl
++    address ra_val=(address)uc->uc_mcontext.gp_regs[ra];
++    long rb_val=(long)uc->uc_mcontext.gp_regs[rb];
++#endif
+     return os::is_memory_serialize_page(thread, ra_val+rb_val);
+   } else if (is_stw(instruction) || is_stwu(instruction)) {
+     int ra = inv_ra_field(instruction);
+     int d1 = inv_d1_field(instruction);
+ 
+     // look up content of ra in ucontext
++#if defined(__GLIBC__) || defined(__UCLIBC__)
+     address ra_val=(address)uc->uc_mcontext.regs->gpr[ra];
++#else // Musl
++    address ra_val=(address)uc->uc_mcontext.gp_regs[ra];
++#endif
+     return os::is_memory_serialize_page(thread, ra_val+d1);
+   } else {
+     return false;
+@@ -1334,11 +1347,20 @@
+       || (is_stdu(instruction) && rs == 1)) {
+     int ds = inv_ds_field(instruction);
+     // return banged address
++#if defined(__GLIBC__) || defined(__UCLIBC__)
+     return ds+(address)uc->uc_mcontext.regs->gpr[ra];
++#else // Musl
++    return ds+(address)uc->uc_mcontext.gp_regs[ra];
++#endif
+   } else if (is_stdux(instruction) && rs == 1) {
+     int rb = inv_rb_field(instruction);
++#if defined(__GLIBC__) || defined(__UCLIBC__)
+     address sp = (address)uc->uc_mcontext.regs->gpr[1];
+     long rb_val = (long)uc->uc_mcontext.regs->gpr[rb];
++#else // Musl
++    address sp = (address)uc->uc_mcontext.gp_regs[1];
++    long rb_val = (long)uc->uc_mcontext.gp_regs[rb];
++#endif
+     return ra != 1 || rb_val >= 0 ? NULL         // not a stack bang
+                                   : sp + rb_val; // banged address
+   }
diff --git a/user/openjdk8/icedtea-hotspot-musl.patch b/user/openjdk8/icedtea-hotspot-musl.patch
new file mode 100644
index 000000000..6cfb3e606
--- /dev/null
+++ b/user/openjdk8/icedtea-hotspot-musl.patch
@@ -0,0 +1,135 @@
+diff --git icedtea/hotspot/src/os/linux/vm/jvm_linux.cpp icedtea/hotspot/src/os/linux/vm/jvm_linux.cpp
+index ba84788..c22281f 100644
+--- openjdk/hotspot/src/os/linux/vm/jvm_linux.cpp
++++ openjdk/hotspot/src/os/linux/vm/jvm_linux.cpp
+@@ -154,7 +154,9 @@ struct siglabel siglabels[] = {
+ #ifdef SIGSTKFLT
+   "STKFLT",     SIGSTKFLT,      /* Stack fault.  */
+ #endif
++#ifdef SIGCLD
+   "CLD",        SIGCLD,         /* Same as SIGCHLD (System V).  */
++#endif
+   "CHLD",       SIGCHLD,        /* Child status has changed (POSIX).  */
+   "CONT",       SIGCONT,        /* Continue (POSIX).  */
+   "STOP",       SIGSTOP,        /* Stop, unblockable (POSIX).  */
+diff --git icedtea/hotspot/src/os/linux/vm/os_linux.cpp icedtea/hotspot/src/os/linux/vm/os_linux.cpp
+index 89ba0ff..e84837a 100644
+--- openjdk/hotspot/src/os/linux/vm/os_linux.cpp
++++ openjdk/hotspot/src/os/linux/vm/os_linux.cpp
+@@ -94,7 +94,6 @@
+ # include <string.h>
+ # include <syscall.h>
+ # include <sys/sysinfo.h>
+-# include <gnu/libc-version.h>
+ # include <sys/ipc.h>
+ # include <sys/shm.h>
+ # include <link.h>
+@@ -530,6 +529,13 @@ void os::Linux::hotspot_sigmask(Thread* thread) {
+ // detecting pthread library
+ 
+ void os::Linux::libpthread_init() {
++#if 1
++  // Hard code musl compatible settings
++  os::Linux::set_glibc_version("glibc 2.9");
++  os::Linux::set_libpthread_version("NPTL");
++  os::Linux::set_is_NPTL();
++  os::Linux::set_is_floating_stack();
++#else
+   // Save glibc and pthread version strings. Note that _CS_GNU_LIBC_VERSION
+   // and _CS_GNU_LIBPTHREAD_VERSION are supported in glibc >= 2.3.2. Use a
+   // generic name for earlier versions.
+@@ -588,6 +594,7 @@ void os::Linux::libpthread_init() {
+   if (os::Linux::is_NPTL() || os::Linux::supports_variable_stack_size()) {
+      os::Linux::set_is_floating_stack();
+   }
++#endif
+ }
+ 
+ /////////////////////////////////////////////////////////////////////////////
+@@ -2834,6 +2841,11 @@ extern "C" JNIEXPORT void numa_warn(int number, char *where, ...) { }
+ extern "C" JNIEXPORT void numa_error(char *where) { }
+ extern "C" JNIEXPORT int fork1() { return fork(); }
+ 
++static void *dlvsym(void *handle, const char *name, const char *ver)
++{
++  return dlsym(handle, name);
++}
++
+ // Handle request to load libnuma symbol version 1.1 (API v1). If it fails
+ // load symbol from base version instead.
+ void* os::Linux::libnuma_dlsym(void* handle, const char *name) {
+diff --git openjdk/hotspot/src/os/linux/vm/os_linux.inline.hpp openjdk/hotspot/src/os/linux/vm/os_linux.inline.hpp
+index 10d56d8..b9b2b77 100644
+--- openjdk/hotspot/src/os/linux/vm/os_linux.inline.hpp
++++ openjdk/hotspot/src/os/linux/vm/os_linux.inline.hpp
+@@ -33,7 +33,7 @@
+ 
+ #include <unistd.h>
+ #include <sys/socket.h>
+-#include <sys/poll.h>
++#include <poll.h>
+ #include <netdb.h>
+ 
+ inline void* os::thread_local_storage_at(int index) {
+diff --git openjdk/hotspot/src/os_cpu/linux_aarch64/vm/os_linux_aarch64.cpp openjdk/hotspot/src/os_cpu/linux_aarch64/vm/os_linux_aarch64.cpp
+index d2c10e0..20f657f 100644
+--- openjdk/hotspot/src/os_cpu/linux_aarch64/vm/os_linux_aarch64.cpp
++++ openjdk/hotspot/src/os_cpu/linux_aarch64/vm/os_linux_aarch64.cpp
+@@ -75,7 +75,7 @@
+ # include <pwd.h>
+ # include <poll.h>
+ # include <ucontext.h>
+-# include <fpu_control.h>
++# include <linux/types.h>  /* provides __u64 */
+ 
+ #ifdef BUILTIN_SIM
+ #define REG_SP REG_RSP
+diff --git openjdk/hotspot/src/os_cpu/linux_x86/vm/os_linux_x86.cpp openjdk/hotspot/src/os_cpu/linux_x86/vm/os_linux_x86.cpp
+index 38388cb..2505ba8 100644
+--- openjdk/hotspot/src/os_cpu/linux_x86/vm/os_linux_x86.cpp
++++ openjdk/hotspot/src/os_cpu/linux_x86/vm/os_linux_x86.cpp
+@@ -72,7 +72,6 @@
+ # include <pwd.h>
+ # include <poll.h>
+ # include <ucontext.h>
+-# include <fpu_control.h>
+ 
+ #ifdef AMD64
+ #define REG_SP REG_RSP
+@@ -544,6 +543,9 @@ JVM_handle_linux_signal(int sig,
+   return true; // Mute compiler
+ }
+ 
++#define _FPU_GETCW(cw) __asm__ __volatile__ ("fnstcw %0" : "=m" (*&cw))
++#define _FPU_SETCW(cw) __asm__ __volatile__ ("fldcw %0" : : "m" (*&cw))
++
+ void os::Linux::init_thread_fpu_state(void) {
+ #ifndef AMD64
+   // set fpu to 53 bit precision
+diff --git openjdk/hotspot/src/os_cpu/linux_x86/vm/threadLS_linux_x86.hpp openjdk/hotspot/src/os_cpu/linux_x86/vm/threadLS_linux_x86.hpp
+index f3f2f26..6b50cfa 100644
+--- openjdk/hotspot/src/os_cpu/linux_x86/vm/threadLS_linux_x86.hpp
++++ openjdk/hotspot/src/os_cpu/linux_x86/vm/threadLS_linux_x86.hpp
+@@ -32,7 +32,9 @@
+   // map stack pointer to thread pointer - see notes in threadLS_linux_x86.cpp
+   #define SP_BITLENGTH  32
+   #define PAGE_SHIFT    12
++  #ifndef PAGE_SIZE
+   #define PAGE_SIZE     (1UL << PAGE_SHIFT)
++  #endif
+   static Thread* _sp_map[1UL << (SP_BITLENGTH - PAGE_SHIFT)];
+ 
+ public:
+diff --git openjdk/hotspot/src/share/vm/utilities/globalDefinitions_gcc.hpp openjdk/hotspot/src/share/vm/utilities/globalDefinitions_gcc.hpp
+index efa0b4e..6df2302 100644
+--- openjdk/hotspot/src/share/vm/utilities/globalDefinitions_gcc.hpp
++++ openjdk/hotspot/src/share/vm/utilities/globalDefinitions_gcc.hpp
+@@ -235,7 +235,7 @@ inline int g_isnan(double f) { return isnand(f); }
+ #elif defined(__APPLE__)
+ inline int g_isnan(double f) { return isnan(f); }
+ #elif defined(LINUX) || defined(_ALLBSD_SOURCE)
+-inline int g_isnan(float  f) { return isnanf(f); }
++inline int g_isnan(float  f) { return isnan(f); }
+ inline int g_isnan(double f) { return isnan(f); }
+ #else
+ #error "missing platform-specific definition here"
diff --git a/user/openjdk8/icedtea-hotspot-noagent-musl.patch b/user/openjdk8/icedtea-hotspot-noagent-musl.patch
new file mode 100644
index 000000000..25bdb1c5a
--- /dev/null
+++ b/user/openjdk8/icedtea-hotspot-noagent-musl.patch
@@ -0,0 +1,79 @@
+--- openjdk.orig/common/autoconf/configure
++++ openjdk/common/autoconf/configure
+@@ -103,7 +103,7 @@
+ }
+ 
+ # Check for local changes
+-check_hg_updates
++run_autogen_or_fail
+ 
+ if test -e $conf_custom_script_dir/generated-configure.sh; then
+   # Test if open configure is newer than custom configure, if so, custom needs to
+--- openjdk.orig/common/autoconf/jdk-options.m4
++++ openjdk/common/autoconf/jdk-options.m4
+@@ -159,7 +159,7 @@
+   AC_SUBST(JVM_VARIANT_ZEROSHARK)
+   AC_SUBST(JVM_VARIANT_CORE)
+ 
+-  INCLUDE_SA=true
++  AC_CHECK_HEADER(thread_db.h,INCLUDE_SA=true,INCLUDE_SA=false)
+   if test "x$JVM_VARIANT_ZERO" = xtrue ; then
+     INCLUDE_SA=false
+   fi
+--- openjdk.orig/hotspot/make/linux/makefiles/defs.make
++++ openjdk/hotspot/make/linux/makefiles/defs.make
+@@ -305,6 +305,9 @@
+ 
+ # Serviceability Binaries
+ # No SA Support for PPC, IA64, ARM or zero
++# or if thread_db.h missing (musl)
++
++ifneq ($(wildcard /usr/include/thread_db.h),)
+ ADD_SA_BINARIES/x86   = $(EXPORT_JRE_LIB_ARCH_DIR)/libsaproc.$(LIBRARY_SUFFIX) \
+                         $(EXPORT_LIB_DIR)/sa-jdi.jar
+ ADD_SA_BINARIES/sparc = $(EXPORT_JRE_LIB_ARCH_DIR)/libsaproc.$(LIBRARY_SUFFIX) \
+@@ -322,6 +322,11 @@
+     endif
+   endif
+ endif
++else
++ADD_SA_BINARIES/x86     =
++ADD_SA_BINARIES/sparc   =
++ADD_SA_BINARIES/aarch64 =
++endif
+ ADD_SA_BINARIES/ppc   =
+ ADD_SA_BINARIES/ia64  =
+ ADD_SA_BINARIES/arm   =
+--- openjdk.orig/hotspot/make/linux/makefiles/sa.make
++++ openjdk/hotspot/make/linux/makefiles/sa.make
+@@ -59,9 +59,11 @@
+ 
+ # if $(AGENT_DIR) does not exist, we don't build SA
+ # also, we don't build SA on Itanium or zero.
++# check for thread_db.h too (musl does not have it).
+ 
+ all: 
+-	if [ -d $(AGENT_DIR) -a "$(SRCARCH)" != "ia64" \
++	if [ -d $(AGENT_DIR) -a -f /usr/include/thread_db.h \
++             -a "$(SRCARCH)" != "ia64" \
+              -a "$(SRCARCH)" != "zero" ] ; then \
+ 	   $(MAKE) -f sa.make $(GENERATED)/sa-jdi.jar; \
+ 	fi
+--- openjdk.orig/hotspot/make/linux/makefiles/saproc.make
++++ openjdk/hotspot/make/linux/makefiles/saproc.make
+@@ -61,12 +61,15 @@
+ 
+ # if $(AGENT_DIR) does not exist, we don't build SA
+ # also, we don't build SA on Itanium or zero.
++# check for thread_db.h too (musl does not have it).
+ 
++ifneq ($(wildcard /usr/include/thread_db.h),)
+ ifneq ($(wildcard $(AGENT_DIR)),)
+ ifneq ($(filter-out ia64 zero,$(SRCARCH)),)
+   BUILDLIBSAPROC = $(LIBSAPROC)
+ endif
+ endif
++endif
+ 
+ ifneq ($(ALT_SASRCDIR),)
+ ALT_SAINCDIR=-I$(ALT_SASRCDIR) -DALT_SASRCDIR
diff --git a/user/openjdk8/icedtea-jdk-execinfo.patch b/user/openjdk8/icedtea-jdk-execinfo.patch
new file mode 100644
index 000000000..e4ae562c5
--- /dev/null
+++ b/user/openjdk8/icedtea-jdk-execinfo.patch
@@ -0,0 +1,20 @@
+--- openjdk.orig/jdk/src/solaris/native/sun/xawt/XToolkit.c
++++ openjdk/jdk/src/solaris/native/sun/xawt/XToolkit.c
+@@ -27,7 +27,7 @@
+ #include <X11/Xutil.h>
+ #include <X11/Xos.h>
+ #include <X11/Xatom.h>
+-#ifdef __linux__
++#if defined(__linux__) && defined(__GLIBC__) && ! defined(__UCLIBC__)
+ #include <execinfo.h>
+ #endif
+ 
+@@ -689,7 +689,7 @@
+     return ret;
+ }
+ 
+-#ifdef __linux__
++#if defined(__linux__) && defined(__GLIBC__) && ! defined(__UCLIBC__)
+ void print_stack(void)
+ {
+   void *array[10];
diff --git a/user/openjdk8/icedtea-jdk-fix-ipv6-init.patch b/user/openjdk8/icedtea-jdk-fix-ipv6-init.patch
new file mode 100644
index 000000000..11f3bf6dd
--- /dev/null
+++ b/user/openjdk8/icedtea-jdk-fix-ipv6-init.patch
@@ -0,0 +1,42 @@
+--- openjdk/jdk/src/solaris/native/java/net/net_util_md.c.orig
++++ openjdk/jdk/src/solaris/native/java/net/net_util_md.c
+@@ -561,7 +561,7 @@
+ 
+ static struct localinterface *localifs = 0;
+ static int localifsSize = 0;    /* size of array */
+-static int nifs = 0;            /* number of entries used in array */
++static int nifs = -1;            /* number of entries used in array */
+ 
+ /* not thread safe: make sure called once from one thread */
+ 
+@@ -573,6 +573,10 @@
+     int index, x1, x2, x3;
+     unsigned int u0,u1,u2,u3,u4,u5,u6,u7,u8,u9,ua,ub,uc,ud,ue,uf;
+ 
++    if (nifs >= 0)
++	return ;
++    nifs = 0;
++
+     if ((f = fopen("/proc/net/if_inet6", "r")) == NULL) {
+         return ;
+     }
+@@ -601,7 +605,7 @@
+             localifs = (struct localinterface *) realloc (
+                         localifs, sizeof (struct localinterface)* (localifsSize+5));
+             if (localifs == 0) {
+-                nifs = 0;
++                nifs = -1;
+                 fclose (f);
+                 return;
+             }
+@@ -624,9 +628,7 @@
+ static int getLocalScopeID (char *addr) {
+     struct localinterface *lif;
+     int i;
+-    if (localifs == 0) {
+-        initLocalIfs();
+-    }
++    initLocalIfs();
+     for (i=0, lif=localifs; i<nifs; i++, lif++) {
+         if (memcmp (addr, lif->localaddr, 16) == 0) {
+             return lif->index;
diff --git a/user/openjdk8/icedtea-jdk-fix-libjvm-load.patch b/user/openjdk8/icedtea-jdk-fix-libjvm-load.patch
new file mode 100644
index 000000000..d0a090ea5
--- /dev/null
+++ b/user/openjdk8/icedtea-jdk-fix-libjvm-load.patch
@@ -0,0 +1,14 @@
+musl needs LD_LIBRARY_PATH set because when .so is opened with dlopen(/abs/path)
+it does not qualify for providing symbols for NEEDED dependency.
+
+--- openjdk.orig/jdk/src/solaris/bin/java_md_solinux.c
++++ openjdk/jdk/src/solaris/bin/java_md_solinux.c
+@@ -291,6 +291,8 @@
+     char *dmllp = NULL;
+     char *p; /* a utility pointer */
+ 
++    return JNI_TRUE;
++
+ #ifdef AIX
+     /* We always have to set the LIBPATH on AIX because ld doesn't support $ORIGIN. */
+     return JNI_TRUE;
diff --git a/user/openjdk8/icedtea-jdk-getmntent-buffer.patch b/user/openjdk8/icedtea-jdk-getmntent-buffer.patch
new file mode 100644
index 000000000..075a9d423
--- /dev/null
+++ b/user/openjdk8/icedtea-jdk-getmntent-buffer.patch
@@ -0,0 +1,88 @@
+Give a much bigger buffer to getmntent_r.
+
+https://bugs.alpinelinux.org/issues/7093
+
+diff --git a/openjdk/jdk/src/solaris/native/sun/nio/fs/LinuxNativeDispatcher.c b/openjdk/jdk/src/solaris/native/sun/nio/fs/LinuxNativeDispatcher.c
+index c8500db..d0b85d6 100644
+--- openjdk/jdk/src/solaris/native/sun/nio/fs/LinuxNativeDispatcher.c
++++ openjdk/jdk/src/solaris/native/sun/nio/fs/LinuxNativeDispatcher.c
+@@ -33,6 +33,7 @@
+ #include <dlfcn.h>
+ #include <errno.h>
+ #include <mntent.h>
++#include <limits.h>
+ 
+ #include "sun_nio_fs_LinuxNativeDispatcher.h"
+ 
+@@ -173,8 +174,8 @@ Java_sun_nio_fs_LinuxNativeDispatcher_getmntent(JNIEnv* env, jclass this,
+     jlong value, jobject entry)
+ {
+     struct mntent ent;
+-    char buf[1024];
+-    int buflen = sizeof(buf);
++    char *buf = NULL;
++    const size_t buflen = PATH_MAX * 4;
+     struct mntent* m;
+     FILE* fp = jlong_to_ptr(value);
+     jsize len;
+@@ -183,10 +184,17 @@ Java_sun_nio_fs_LinuxNativeDispatcher_getmntent(JNIEnv* env, jclass this,
+     char* dir;
+     char* fstype;
+     char* options;
++    jint res = -1;
+ 
+-    m = getmntent_r(fp, &ent, (char*)&buf, buflen);
+-    if (m == NULL)
++    buf = malloc(buflen);
++    if (buf == NULL) {
++        JNU_ThrowOutOfMemoryError(env, "native heap");
+         return -1;
++    }
++    m = getmntent_r(fp, &ent, buf, buflen);
++    if (m == NULL)
++        goto out;
++
+     name = m->mnt_fsname;
+     dir = m->mnt_dir;
+     fstype = m->mnt_type;
+@@ -195,32 +203,35 @@ Java_sun_nio_fs_LinuxNativeDispatcher_getmntent(JNIEnv* env, jclass this,
+     len = strlen(name);
+     bytes = (*env)->NewByteArray(env, len);
+     if (bytes == NULL)
+-        return -1;
++        goto out;
+     (*env)->SetByteArrayRegion(env, bytes, 0, len, (jbyte*)name);
+     (*env)->SetObjectField(env, entry, entry_name, bytes);
+ 
+     len = strlen(dir);
+     bytes = (*env)->NewByteArray(env, len);
+     if (bytes == NULL)
+-        return -1;
++        goto out;
+     (*env)->SetByteArrayRegion(env, bytes, 0, len, (jbyte*)dir);
+     (*env)->SetObjectField(env, entry, entry_dir, bytes);
+ 
+     len = strlen(fstype);
+     bytes = (*env)->NewByteArray(env, len);
+     if (bytes == NULL)
+-        return -1;
++        goto out;
+     (*env)->SetByteArrayRegion(env, bytes, 0, len, (jbyte*)fstype);
+     (*env)->SetObjectField(env, entry, entry_fstype, bytes);
+ 
+     len = strlen(options);
+     bytes = (*env)->NewByteArray(env, len);
+     if (bytes == NULL)
+-        return -1;
++        goto out;
+     (*env)->SetByteArrayRegion(env, bytes, 0, len, (jbyte*)options);
+     (*env)->SetObjectField(env, entry, entry_options, bytes);
+ 
+-    return 0;
++    res = 0;
++out:
++    free(buf);
++    return res;
+ }
+ 
+ JNIEXPORT void JNICALL
diff --git a/user/openjdk8/icedtea-jdk-includes.patch b/user/openjdk8/icedtea-jdk-includes.patch
new file mode 100644
index 000000000..6443a1973
--- /dev/null
+++ b/user/openjdk8/icedtea-jdk-includes.patch
@@ -0,0 +1,154 @@
+--- openjdk.orig/jdk/src/aix/native/java/net/aix_close.c
++++ openjdk/jdk/src/aix/native/java/net/aix_close.c
+@@ -62,7 +62,7 @@
+ #include <unistd.h>
+ #include <errno.h>
+ 
+-#include <sys/poll.h>
++#include <poll.h>
+ 
+ /*
+  * Stack allocated by thread when doing blocking operation
+--- openjdk.orig/jdk/src/aix/native/sun/nio/ch/AixNativeThread.c
++++ openjdk/jdk/src/aix/native/sun/nio/ch/AixNativeThread.c
+@@ -32,7 +32,7 @@
+ #include "sun_nio_ch_NativeThread.h"
+ 
+ #include <pthread.h>
+-#include <sys/signal.h>
++#include <signal.h>
+ 
+ /* Also defined in src/aix/native/java/net/aix_close.c */
+ #define INTERRUPT_SIGNAL (SIGRTMAX - 1)
+--- openjdk.orig/jdk/src/aix/native/sun/nio/ch/AixPollPort.c
++++ openjdk/jdk/src/aix/native/sun/nio/ch/AixPollPort.c
+@@ -34,7 +34,7 @@
+ #include <unistd.h>
+ #include <sys/types.h>
+ #include <sys/socket.h>
+-#include <sys/poll.h>
++#include <poll.h>
+ #include <sys/pollset.h>
+ #include <fcntl.h>
+ #include <stddef.h>
+--- openjdk.orig/jdk/src/macosx/javavm/export/jvm_md.h
++++ openjdk/jdk/src/macosx/javavm/export/jvm_md.h
+@@ -60,7 +60,7 @@
+ #include <sys/stat.h>
+ #include <fcntl.h>
+ #include <errno.h>
+-#include <sys/signal.h>
++#include <signal.h>
+ 
+ /* O Flags */
+ 
+--- openjdk.orig/jdk/src/solaris/javavm/export/jvm_md.h
++++ openjdk/jdk/src/solaris/javavm/export/jvm_md.h
+@@ -65,7 +65,7 @@
+ #include <sys/stat.h>
+ #include <fcntl.h>
+ #include <errno.h>
+-#include <sys/signal.h>
++#include <signal.h>
+ 
+ /* O Flags */
+ 
+--- openjdk.orig/jdk/src/solaris/native/java/net/PlainSocketImpl.c
++++ openjdk/jdk/src/solaris/native/java/net/PlainSocketImpl.c
+@@ -28,7 +28,7 @@
+ #include <sys/types.h>
+ #include <sys/socket.h>
+ #if defined(__linux__) && !defined(USE_SELECT)
+-#include <sys/poll.h>
++#include <poll.h>
+ #endif
+ #include <netinet/tcp.h>        /* Defines TCP_NODELAY, needed for 2.6 */
+ #include <netinet/in.h>
+--- openjdk.orig/jdk/src/solaris/native/java/net/bsd_close.c
++++ openjdk/jdk/src/solaris/native/java/net/bsd_close.c
+@@ -36,7 +36,7 @@
+ #include <sys/uio.h>
+ #include <unistd.h>
+ #include <errno.h>
+-#include <sys/poll.h>
++#include <poll.h>
+ 
+ /*
+  * Stack allocated by thread when doing blocking operation
+--- openjdk.orig/jdk/src/solaris/native/java/net/linux_close.c
++++ openjdk/jdk/src/solaris/native/java/net/linux_close.c
+@@ -34,7 +34,7 @@
+ #include <sys/uio.h>
+ #include <unistd.h>
+ #include <errno.h>
+-#include <sys/poll.h>
++#include <poll.h>
+ 
+ /*
+  * Stack allocated by thread when doing blocking operation
+--- openjdk.orig/jdk/src/solaris/native/java/net/net_util_md.h
++++ openjdk/jdk/src/solaris/native/java/net/net_util_md.h
+@@ -33,7 +33,7 @@
+ #include <unistd.h>
+
+ #ifndef USE_SELECT
+-#include <sys/poll.h>
++#include <poll.h>
+ #endif
+
+ int NET_Timeout(int s, long timeout);
+--- openjdk.orig/jdk/src/solaris/native/sun/nio/ch/DevPollArrayWrapper.c
++++ openjdk/jdk/src/solaris/native/sun/nio/ch/DevPollArrayWrapper.c
+@@ -28,7 +28,7 @@
+ #include "jvm.h"
+ #include "jlong.h"
+ #include "sun_nio_ch_DevPollArrayWrapper.h"
+-#include <sys/poll.h>
++#include <poll.h>
+ #include <unistd.h>
+ #include <sys/time.h>
+ 
+--- openjdk.orig/jdk/src/solaris/native/sun/nio/ch/NativeThread.c
++++ openjdk/jdk/src/solaris/native/sun/nio/ch/NativeThread.c
+@@ -34,7 +34,7 @@
+ 
+ #ifdef __linux__
+   #include <pthread.h>
+-  #include <sys/signal.h>
++  #include <signal.h>
+   /* Also defined in net/linux_close.c */
+   #define INTERRUPT_SIGNAL (SIGRTMAX - 2)
+ #elif __solaris__
+--- openjdk.orig/jdk/src/solaris/native/sun/nio/ch/Net.c
++++ openjdk/jdk/src/solaris/native/sun/nio/ch/Net.c
+@@ -23,7 +23,7 @@
+  * questions.
+  */
+ 
+-#include <sys/poll.h>
++#include <poll.h>
+ #include <sys/types.h>
+ #include <sys/socket.h>
+ #include <string.h>
+--- openjdk.orig/jdk/src/solaris/native/sun/nio/fs/LinuxWatchService.c
++++ openjdk/jdk/src/solaris/native/sun/nio/fs/LinuxWatchService.c
+@@ -32,7 +32,7 @@
+ #include <dlfcn.h>
+ #include <sys/types.h>
+ #include <sys/socket.h>
+-#include <sys/poll.h>
++#include <poll.h>
+ #include <sys/inotify.h>
+ 
+ #include "sun_nio_fs_LinuxWatchService.h"
+--- openjdk.orig/jdk/src/solaris/transport/socket/socket_md.c
++++ openjdk/jdk/src/solaris/transport/socket/socket_md.c
+@@ -37,7 +37,7 @@
+ #include <thread.h>
+ #else
+ #include <pthread.h>
+-#include <sys/poll.h>
++#include <poll.h>
+ #endif
+ 
+ #include "socket_md.h"
diff --git a/user/openjdk8/icedtea-jdk-musl.patch b/user/openjdk8/icedtea-jdk-musl.patch
new file mode 100644
index 000000000..97946ba42
--- /dev/null
+++ b/user/openjdk8/icedtea-jdk-musl.patch
@@ -0,0 +1,105 @@
+diff -ru openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp
+--- openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp	2017-01-25 04:22:03.000000000 +0000
++++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.cpp	2017-02-06 11:23:47.041165210 +0000
+@@ -46,6 +46,8 @@
+ 
+ #include "zip.h"
+ 
++#define uchar unsigned char
++
+ #ifdef NO_ZLIB
+ 
+ inline bool jar::deflate_bytes(bytes& head, bytes& tail) {
+diff -ru openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h
+--- openjdk.orig/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h	2017-01-25 04:22:03.000000000 +0000
++++ openjdk/jdk/src/share/native/com/sun/java/util/jar/pack/zip.h	2017-02-06 11:23:47.047832009 +0000
+@@ -23,9 +23,7 @@
+  * questions.
+  */
+ 
+-#define ushort unsigned short
+-#define uint   unsigned int
+-#define uchar  unsigned char
++#include <sys/types.h>
+ 
+ struct unpacker;
+ 
+diff -ru openjdk.orig/jdk/src/share/native/sun/awt/medialib/mlib_types.h openjdk/jdk/src/share/native/sun/awt/medialib/mlib_types.h
+--- openjdk.orig/jdk/src/share/native/sun/awt/medialib/mlib_types.h	2017-01-25 04:22:03.000000000 +0000
++++ openjdk/jdk/src/share/native/sun/awt/medialib/mlib_types.h	2017-02-06 11:23:47.047832009 +0000
+@@ -27,6 +27,7 @@
+ #ifndef MLIB_TYPES_H
+ #define MLIB_TYPES_H
+ 
++#include <stddef.h>			/* for NULL */
+ #include <limits.h>
+ #if defined(_MSC_VER)
+ #include <float.h>                      /* for FLT_MAX and DBL_MAX */
+diff -ru openjdk.orig/jdk/src/solaris/native/java/net/Inet4AddressImpl.c openjdk/jdk/src/solaris/native/java/net/Inet4AddressImpl.c
+--- openjdk.orig/jdk/src/solaris/native/java/net/Inet4AddressImpl.c	2017-01-25 04:22:03.000000000 +0000
++++ openjdk/jdk/src/solaris/native/java/net/Inet4AddressImpl.c	2017-02-06 11:23:47.047832009 +0000
+@@ -47,7 +47,7 @@
+ 
+ #include "java_net_Inet4AddressImpl.h"
+ 
+-#if defined(__GLIBC__) || (defined(__FreeBSD__) && (__FreeBSD_version >= 601104))
++#if defined(__linux__) || (defined(__FreeBSD__) && (__FreeBSD_version >= 601104))
+ #define HAS_GLIBC_GETHOSTBY_R   1
+ #endif
+ 
+diff -ru openjdk.orig/jdk/src/solaris/native/java/net/PlainDatagramSocketImpl.c openjdk/jdk/src/solaris/native/java/net/PlainDatagramSocketImpl.c
+--- openjdk.orig/jdk/src/solaris/native/java/net/PlainDatagramSocketImpl.c	2017-01-25 04:22:03.000000000 +0000
++++ openjdk/jdk/src/solaris/native/java/net/PlainDatagramSocketImpl.c	2017-02-06 11:23:47.047832009 +0000
+@@ -41,7 +41,6 @@
+ #endif
+ #ifdef __linux__
+ #include <unistd.h>
+-#include <sys/sysctl.h>
+ #include <sys/utsname.h>
+ #include <netinet/ip.h>
+ 
+diff -ru openjdk.orig/jdk/src/solaris/native/java/net/PlainSocketImpl.c openjdk/jdk/src/solaris/native/java/net/PlainSocketImpl.c
+--- openjdk.orig/jdk/src/solaris/native/java/net/PlainSocketImpl.c	2017-01-25 04:22:03.000000000 +0000
++++ openjdk/jdk/src/solaris/native/java/net/PlainSocketImpl.c	2017-02-06 11:23:47.047832009 +0000
+@@ -43,7 +43,6 @@
+ #endif
+ #ifdef __linux__
+ #include <unistd.h>
+-#include <sys/sysctl.h>
+ #endif
+ 
+ #include "jvm.h"
+diff -ru openjdk.orig/jdk/src/solaris/native/java/net/linux_close.c openjdk/jdk/src/solaris/native/java/net/linux_close.c
+--- openjdk.orig/jdk/src/solaris/native/java/net/linux_close.c	2017-01-25 04:22:03.000000000 +0000
++++ openjdk/jdk/src/solaris/native/java/net/linux_close.c	2017-02-06 11:23:47.047832009 +0000
+@@ -56,7 +56,7 @@
+ /*
+  * Signal to unblock thread
+  */
+-static int sigWakeup = (__SIGRTMAX - 2);
++static int sigWakeup;
+ 
+ /*
+  * The fd table and the number of file descriptors
+@@ -95,6 +95,9 @@
+     /*
+      * Setup the signal handler
+      */
++#ifndef __AIX
++    sigWakeup = SIGRTMAX - 2;
++#endif
+     sa.sa_handler = sig_wakeup;
+     sa.sa_flags   = 0;
+     sigemptyset(&sa.sa_mask);
+diff -ru openjdk.orig/jdk/src/solaris/native/sun/nio/ch/NativeThread.c openjdk/jdk/src/solaris/native/sun/nio/ch/NativeThread.c
+--- openjdk.orig/jdk/src/solaris/native/sun/nio/ch/NativeThread.c	2017-01-25 04:22:03.000000000 +0000
++++ openjdk/jdk/src/solaris/native/sun/nio/ch/NativeThread.c	2017-02-06 11:23:47.051165409 +0000
+@@ -36,7 +36,7 @@
+   #include <pthread.h>
+   #include <sys/signal.h>
+   /* Also defined in net/linux_close.c */
+-  #define INTERRUPT_SIGNAL (__SIGRTMAX - 2)
++  #define INTERRUPT_SIGNAL (SIGRTMAX - 2)
+ #elif __solaris__
+   #include <thread.h>
+   #include <signal.h>
diff --git a/user/openjdk8/icedtea-jdk-tls-nist-curves.patch b/user/openjdk8/icedtea-jdk-tls-nist-curves.patch
new file mode 100644
index 000000000..75fb3af8c
--- /dev/null
+++ b/user/openjdk8/icedtea-jdk-tls-nist-curves.patch
@@ -0,0 +1,47 @@
+Bug #7404 TLS negotiation error in OpenJDK 8 u131
+
+Fixes an OpenJDK 8 regression discovered in docker-library/openjdk#115
+on Alpine Linux 3.5 (u121) and 3.6 (u131) that causes TLS negotiation
+errors for some clients.
+
+Root cause appears to be OpenJDK announcing support for NIST curves the
+underlying NSS library does doesn't. This patch limits OpenJDK's
+announcement to elliptic curves 23 (secp256r1), 24 (secp384r1), and 25
+(secp521r1).
+
+Related issues:
+
+* https://github.com/docker-library/openjdk/issues/115
+* https://bugs.alpinelinux.org/issues/7404
+* https://access.redhat.com/discussions/2339811
+* https://bugzilla.redhat.com/show_bug.cgi?id=1022017
+* https://bugzilla.redhat.com/show_bug.cgi?id=1348525
+
+--- openjdk.orig/jdk/src/share/classes/sun/security/ssl/EllipticCurvesExtension.java	2017-05-08 20:03:50.000000000 -0700
++++ openjdk/jdk/src/share/classes/sun/security/ssl/EllipticCurvesExtension.java	2017-06-14 13:37:00.000000000 -0700
+@@ -168,21 +168,10 @@
+                     "contains no supported elliptic curves");
+             }
+         } else {        // default curves
+-            int[] ids;
+-            if (requireFips) {
+-                ids = new int[] {
+-                    // only NIST curves in FIPS mode
+-                    23, 24, 25, 9, 10, 11, 12, 13, 14,
+-                };
+-            } else {
+-                ids = new int[] {
+-                    // NIST curves first
+-                    23, 24, 25, 9, 10, 11, 12, 13, 14,
+-                    // non-NIST curves
+-                    22,
+-                };
+-            }
+-
++            int[] ids = new int[] {
++                // NSS currently only supports these three NIST curves
++                23, 24, 25
++            };
+             idList = new ArrayList<>(ids.length);
+             for (int curveId : ids) {
+                 if (isAvailableCurve(curveId)) {
diff --git a/user/openjdk8/remove-gawk.patch b/user/openjdk8/remove-gawk.patch
new file mode 100644
index 000000000..f0731bab4
--- /dev/null
+++ b/user/openjdk8/remove-gawk.patch
@@ -0,0 +1,125 @@
+--- icedtea-2.6.16/configure.old	2019-01-01 20:11:07.846602426 +0000
++++ icedtea-2.6.16/configure	2019-02-27 00:23:41.230000000 +0000
+@@ -6881,108 +6881,7 @@
+   LDD="$ac_cv_prog_LDD"
+ fi
+ 
+-if test -n "$ac_tool_prefix"; then
+-  # Extract the first word of "${ac_tool_prefix}gawk", so it can be a program name with args.
+-set dummy ${ac_tool_prefix}gawk; ac_word=$2
+-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+-$as_echo_n "checking for $ac_word... " >&6; }
+-if ${ac_cv_path_GAWK+:} false; then :
+-  $as_echo_n "(cached) " >&6
+-else
+-  case $GAWK in
+-  [\\/]* | ?:[\\/]*)
+-  ac_cv_path_GAWK="$GAWK" # Let the user override the test with a path.
+-  ;;
+-  *)
+-  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+-for as_dir in $PATH
+-do
+-  IFS=$as_save_IFS
+-  test -z "$as_dir" && as_dir=.
+-    for ac_exec_ext in '' $ac_executable_extensions; do
+-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+-    ac_cv_path_GAWK="$as_dir/$ac_word$ac_exec_ext"
+-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+-    break 2
+-  fi
+-done
+-  done
+-IFS=$as_save_IFS
+-
+-  ;;
+-esac
+-fi
+-GAWK=$ac_cv_path_GAWK
+-if test -n "$GAWK"; then
+-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $GAWK" >&5
+-$as_echo "$GAWK" >&6; }
+-else
+-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+-$as_echo "no" >&6; }
+-fi
+-
+-
+-fi
+-if test -z "$ac_cv_path_GAWK"; then
+-  ac_pt_GAWK=$GAWK
+-  # Extract the first word of "gawk", so it can be a program name with args.
+-set dummy gawk; ac_word=$2
+-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+-$as_echo_n "checking for $ac_word... " >&6; }
+-if ${ac_cv_path_ac_pt_GAWK+:} false; then :
+-  $as_echo_n "(cached) " >&6
+-else
+-  case $ac_pt_GAWK in
+-  [\\/]* | ?:[\\/]*)
+-  ac_cv_path_ac_pt_GAWK="$ac_pt_GAWK" # Let the user override the test with a path.
+-  ;;
+-  *)
+-  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+-for as_dir in $PATH
+-do
+-  IFS=$as_save_IFS
+-  test -z "$as_dir" && as_dir=.
+-    for ac_exec_ext in '' $ac_executable_extensions; do
+-  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+-    ac_cv_path_ac_pt_GAWK="$as_dir/$ac_word$ac_exec_ext"
+-    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+-    break 2
+-  fi
+-done
+-  done
+-IFS=$as_save_IFS
+-
+-  ;;
+-esac
+-fi
+-ac_pt_GAWK=$ac_cv_path_ac_pt_GAWK
+-if test -n "$ac_pt_GAWK"; then
+-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_pt_GAWK" >&5
+-$as_echo "$ac_pt_GAWK" >&6; }
+-else
+-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+-$as_echo "no" >&6; }
+-fi
+-
+-  if test "x$ac_pt_GAWK" = x; then
+-    GAWK=""
+-  else
+-    case $cross_compiling:$ac_tool_warned in
+-yes:)
+-{ $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using cross tools not prefixed with host triplet" >&5
+-$as_echo "$as_me: WARNING: using cross tools not prefixed with host triplet" >&2;}
+-ac_tool_warned=yes ;;
+-esac
+-    GAWK=$ac_pt_GAWK
+-  fi
+-else
+-  GAWK="$ac_cv_path_GAWK"
+-fi
+-
+- if test x"$GAWK" = x ; then
+-   as_fn_error $? "The following program was not found on the PATH: gawk" "$LINENO" 5
+- fi
+-
++GAWK="$AWK"
+ 
+ if test -n "$ac_tool_prefix"; then
+   # Extract the first word of "${ac_tool_prefix}perl", so it can be a program name with args.
+--- icedtea-2.6.16/configure.ac.old	2019-01-01 20:09:39.139994680 +0000
++++ icedtea-2.6.16/configure.ac	2019-02-27 00:25:01.960000000 +0000
+@@ -39,9 +39,7 @@
+ IT_FIND_TOOLS([FASTJAR], [fastjar jar])
+ IT_FIND_TOOLS([SED],[gsed sed])
+ AC_CHECK_TOOL([LDD], [ldd])
+-dnl OpenJDK's README-builds.html lists gawk as a build dependency so we
+-dnl check for it explicitly rather than using AC_PROG_AWK.
+-IT_FIND_TOOL([GAWK], [gawk])
++IT_FIND_TOOL([GAWK], [awk])
+ IT_FIND_TOOL([WHICH], [which])
+ IT_FIND_TOOL([PERL], [perl])
+