diff --git a/.gitignore b/.gitignore
index 34497c3..b705f93 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,2 +1,2 @@
-SOURCES/shenandoah-jdk11-shenandoah-jdk-11.0.8+6-4curve.tar.xz
+SOURCES/shenandoah-jdk11-shenandoah-jdk-11.0.8+10-4curve.tar.xz
 SOURCES/tapsets-icedtea-3.15.0.tar.xz
diff --git a/.java-11-openjdk.metadata b/.java-11-openjdk.metadata
index bf680fc..6163a15 100644
--- a/.java-11-openjdk.metadata
+++ b/.java-11-openjdk.metadata
@@ -1,2 +1,2 @@
-675c2ab8b8793ab87d0cf9b77b2196b71f4afbca SOURCES/shenandoah-jdk11-shenandoah-jdk-11.0.8+6-4curve.tar.xz
+96b0432148cbf9743ef57d6645600dbcc5c25bb0 SOURCES/shenandoah-jdk11-shenandoah-jdk-11.0.8+10-4curve.tar.xz
 7ae2cba67467825b2c2a5fec7aea041865023002 SOURCES/tapsets-icedtea-3.15.0.tar.xz
diff --git a/SOURCES/NEWS b/SOURCES/NEWS
index 6a269f1..426a78c 100644
--- a/SOURCES/NEWS
+++ b/SOURCES/NEWS
@@ -3,6 +3,386 @@ Key:
 JDK-X  - https://bugs.openjdk.java.net/browse/JDK-X
 CVE-XXXX-YYYY: https://cve.mitre.org/cgi-bin/cvename.cgi?name=XXXX-YYYY
 
+New in release OpenJDK 11.0.8 (2020-07-14):
+===========================================
+Live versions of these release notes can be found at:
+  * https://bitly.com/oj1108
+  * https://builds.shipilev.net/backports-monitor/release-notes-11.0.8.txt
+
+* Security fixes
+  - JDK-8230613: Better ASCII conversions
+  - JDK-8231800: Better listing of arrays
+  - JDK-8232014: Expand DTD support
+  - JDK-8233234: Better Zip Naming
+  - JDK-8233239, CVE-2020-14562: Enhance TIFF support
+  - JDK-8233255: Better Swing Buttons
+  - JDK-8234032: Improve basic calendar services
+  - JDK-8234042: Better factory production of certificates
+  - JDK-8234418: Better parsing with CertificateFactory
+  - JDK-8234836: Improve serialization handling
+  - JDK-8236191: Enhance OID processing
+  - JDK-8236867, CVE-2020-14573: Enhance Graal interface handling
+  - JDK-8237117, CVE-2020-14556: Better ForkJoinPool behavior
+  - JDK-8237592, CVE-2020-14577: Enhance certificate verification
+  - JDK-8238002, CVE-2020-14581: Better matrix operations
+  - JDK-8238013: Enhance String writing
+  - JDK-8238804: Enhance key handling process
+  - JDK-8238842: AIOOBE in GIFImageReader.initializeStringTable
+  - JDK-8238843: Enhanced font handing
+  - JDK-8238920, CVE-2020-14583: Better Buffer support
+  - JDK-8238925: Enhance WAV file playback
+  - JDK-8240119, CVE-2020-14593: Less Affine Transformations
+  - JDK-8240482: Improved WAV file playback
+  - JDK-8241379: Update JCEKS support
+  - JDK-8241522: Manifest improved jar headers redux
+  - JDK-8242136, CVE-2020-14621: Better XML namespace handling
+* Other changes
+  - JDK-6933331: (d3d/ogl) java.lang.IllegalStateException: Buffers have not been created
+  - JDK-7124307: JSpinner and changing value by mouse
+  - JDK-8022574: remove HaltNode code after uncommon trap calls
+  - JDK-8039082: [TEST_BUG] Test java/awt/dnd/BadSerializationTest/BadSerializationTest.java fails
+  - JDK-8040630: Popup menus and tooltips flicker with previous popup contents when first shown
+  - JDK-8044365: (dc) MulticastSendReceiveTests.java failing with ENOMEM when joining group (OS X 10.9)
+  - JDK-8048215: [TESTBUG] java/lang/management/ManagementFactory/ThreadMXBeanProxy.java Expected non-null LockInfo
+  - JDK-8051349: nsk/jvmti/scenarios/sampling/SP06/sp06t003 fails in nightly
+  - JDK-8080353: JShell: Better error message on attempting to add default method
+  - JDK-8139876: Exclude hanging nsk/stress/stack from execution with deoptimization enabled
+  - JDK-8146090: java/lang/ref/ReachabilityFenceTest.java fails with -XX:+DeoptimizeALot
+  - JDK-8153430: jdk regression test MletParserLocaleTest, ParserInfiniteLoopTest reduce default timeout
+  - JDK-8156207: Resource allocated BitMaps are often cleared unnecessarily
+  - JDK-8159740: JShell: corralled declarations do not have correct source to wrapper mapping
+  - JDK-8175984: ICC_Profile has un-needed, not-empty finalize method
+  - JDK-8176359: Frame#setMaximizedbounds not working properly in multi screen environments
+  - JDK-8183369: RFC unconformity of HttpURLConnection with proxy
+  - JDK-8187078: -XX:+VerifyOops finds numerous problems when running JPRT
+  - JDK-8191169: java/net/Authenticator/B4769350.java failed intermittently
+  - JDK-8191930: [Graal] emits unparseable XML into compile log
+  - JDK-8193879: Java debugger hangs on method invocation
+  - JDK-8196019: java/awt/Window/Grab/GrabTest.java fails on Windows
+  - JDK-8196181: sun/java2d/GdiRendering/InsetClipping.java fails
+  - JDK-8198000: java/awt/List/EmptyListEventTest/EmptyListEventTest.java debug assert on Windows
+  - JDK-8198001: java/awt/Menu/WrongParentAfterRemoveMenu/WrongParentAfterRemoveMenu.java debug assert on Windows
+  - JDK-8198339: Test javax/swing/border/Test6981576.java is unstable
+  - JDK-8200701: jdk/jshell/ExceptionsTest.java fails on Windows, after JDK-8198801
+  - JDK-8203264: JNI exception pending in PlainDatagramSocketImpl.c:740
+  - JDK-8203672: JNI exception pending in PlainSocketImpl.c
+  - JDK-8203673: JNI exception pending in DualStackPlainDatagramSocketImpl.c:398
+  - JDK-8204834: Fix confusing "allocate" naming in OopStorage
+  - JDK-8205399: Set node color on pinned HashMap.TreeNode deletion
+  - JDK-8205653: test/jdk/sun/management/jmxremote/bootstrap/RmiRegistrySslTest.java and RmiSslBootstrapTest.sh fail with handshake_failure
+  - JDK-8206179: com/sun/management/OperatingSystemMXBean/GetCommittedVirtualMemorySize.java fails with Committed virtual memory size illegal value
+  - JDK-8207334: VM times out in VM_HandshakeAllThreads::doit() with RunThese30M
+  - JDK-8208277: Code cache heap (-XX:ReservedCodeCacheSize) doesn't work with 1GB LargePages
+  - JDK-8209113: Use WeakReference for lastFontStrike for created Fonts
+  - JDK-8209333: Socket reset issue for TLS 1.3 socket close
+  - JDK-8209439: C2 library_call can potentially ignore Math.pow intrinsic or use null pointer
+  - JDK-8209534: [TESTBUG]runtime/appcds/cacheObject/ArchivedModuleCompareTest.java fails with EnableJVMCI.
+  - JDK-8210147: adjust some WSAGetLastError usages in windows network coding
+  - JDK-8210284: "assert((av & 0x00000001) == 0) failed: unsupported V8" on Solaris 11.4
+  - JDK-8210303: VM_HandshakeAllThreads fails assert with "failed: blocked and not walkable"
+  - JDK-8210515: [TESTBUG]CheckArchivedModuleApp.java needs to check if EnableJVMCI is set.
+  - JDK-8210788: Javadoc for Thread.join(long, int) should specify that it waits forever when both arguments are zero
+  - JDK-8211301: [macos] support full window content options
+  - JDK-8211332: Space for stub routines (code_size2) is too small on new Skylake CPUs
+  - JDK-8211339: NPE during SSL handshake caused by HostnameChecker
+  - JDK-8211392: compiler/profiling/spectrapredefineclass_classloaders/Launcher.java times out in JDK12 CI
+  - JDK-8211743: [AOT] crash in ScopeDesc::decode_body() when JVMTI walks AOT frames
+  - JDK-8212154: [TESTBUG] CheckArchivedModuleApp fails with NPE when JVMCI is absent
+  - JDK-8212167: JShell : Stack trace of exception has wrong line number
+  - JDK-8212933: Thread-SMR: requesting a VM operation whilst holding a ThreadsListHandle can cause deadlocks
+  - JDK-8212986: Make Visual Studio compiler check less strict
+  - JDK-8213250: CDS archive creation aborts due to metaspace object allocation failure
+  - JDK-8213516: jck test api/javax_accessibility/AccessibleState/fields.html fails intermittent
+  - JDK-8213947: ARM32: failed check_simd should set UsePopCountInstruction to false
+  - JDK-8214418: half-closed SSLEngine status may cause application dead loop
+  - JDK-8214440: ldap over a TLS connection negotiate failed with "javax.net.ssl.SSLPeerUnverifiedException: hostname of the server '' does not match the hostname in the server's certificate"
+  - JDK-8214444: Wrong strncat limits in dfa.cpp
+  - JDK-8214481: freetype path does not disable TrueType hinting with AA+FM hints
+  - JDK-8214571: -Xdoclint of array serialField gives "error: array type not allowed here"
+  - JDK-8214856: Errors with JSZip in web console after upgrade to 3.1.5
+  - JDK-8214862: assert(proj != __null) at compile.cpp:3251
+  - JDK-8215369: Jcstress pollute /var/tmp with temporary files.
+  - JDK-8215551: Missing case label in nmethod::reloc_string_for()
+  - JDK-8215555: TieredCompilation C2 threads can excessively block handshakes
+  - JDK-8215711: Missing key_share extension for (EC)DHE key exchange should alert missing_extension
+  - JDK-8216151: [Graal] Module jdk.internal.vm.compiler.management has not been granted accessClassInPackage.org.graalvm.compiler.debug
+  - JDK-8216154: C4819 warnings at HotSpot sources on Windows
+  - JDK-8216541: CompiledICHolders of VM locked unloaded nmethods are released too late
+  - JDK-8217230: assert(t == t_no_spec) failure in NodeHash::check_no_speculative_types()
+  - JDK-8217404: --with-jvm-features doesn't work when multiple features are explicitly disabled
+  - JDK-8217447: Develop flag TraceICs is broken
+  - JDK-8217606: LdapContext#reconnect always opens a new connection
+  - JDK-8218807: Compilation database (compile_commands.json) may contain obsolete items
+  - JDK-8219214: Infinite Loop in CodeSection::dump()
+  - JDK-8219904: ClassCastException when calling FlightRecorderMXBean#getRecordings()
+  - JDK-8219991: New fix of the deadlock in sun.security.ssl.SSLSocketImpl
+  - JDK-8221121: applications/microbenchmarks are encountering crashes in tier5
+  - JDK-8221445: FastSysexMessage constructor crashes MIDI receiption thread
+  - JDK-8221482: Initialize VMRegImpl::regName[] earlier to prevent assert during PrintStubCode
+  - JDK-8221741: ClassCastException can happen when fontconfig.properties is used
+  - JDK-8221823: Requested JDialog width is ignored
+  - JDK-8223108: Test java/awt/EventQueue/NonComponentSourcePost.java is unstable
+  - JDK-8223935: PIT: java/awt/font/WindowsIndicFonts.java fails on windows10
+  - JDK-8224109: Text spaced incorrectly by drawString under rotation with fractional metric
+  - JDK-8224632: testbug: java/awt/dnd/RemoveDropTargetCrashTest/RemoveDropTargetCrashTest.java fails on MacOS
+  - JDK-8224793: os::die() does not honor CreateCoredumpOnCrash option
+  - JDK-8224847: gc/stress/TestReclaimStringsLeaksMemory.java fails with reserved greater than expected
+  - JDK-8224931: disable JAOTC invokedynamic support until 8223533 is fixed
+  - JDK-8224997: ChaCha20-Poly1305 TLS cipher suite decryption throws ShortBufferException
+  - JDK-8225068: Remove DocuSign root certificate that is expiring in May 2020
+  - JDK-8225069: Remove Comodo root certificate that is expiring in May 2020
+  - JDK-8225126: Test SetBoundsPaintTest.html faild on Windows when desktop is scaled
+  - JDK-8225325: Add tests for redefining a class' private method during resolution of the bootstrap specifier
+  - JDK-8225622: [AOT] runtime/SharedArchiveFile/TestInterpreterMethodEntries.java crashed with AOTed java.base
+  - JDK-8225653: Provide more information when hitting SIGILL from HaltNode
+  - JDK-8225783: Incorrect use of binary operators on booleans in type.cpp
+  - JDK-8225789: Empty method parameter type should generate ClassFormatError
+  - JDK-8226198: use of & instead of && in LibraryCallKit::arraycopy_restore_alloc_state
+  - JDK-8226253: JAWS reports wrong number of radio buttons when buttons are hidden.
+  - JDK-8226653: [accessibility] Can edit text cell correctly, but Accessibility Tool reads nothing about editor
+  - JDK-8226806: [macOS 10.14] Methods of Java Robot should be called from appropriate thread
+  - JDK-8226879: Memory leak in Type::hashcons
+  - JDK-8227632: Incorrect PrintCompilation message: made not compilable on levels 0 1 2 3 4
+  - JDK-8228407: JVM crashes with shared archive file mismatch
+  - JDK-8228482: fix xlc16/xlclang comparison of distinct pointer types and string literal conversion warnings
+  - JDK-8228757: Fail fast if the handshake type is unknown
+  - JDK-8229158: make UseSwitchProfiling non-experimental or false by-default
+  - JDK-8229421: The logic of java/net/ipv6tests/TcpTest.java is flawed
+  - JDK-8229855: C2 fails with assert(false) failed: bad AD file
+  - JDK-8230591: AArch64: Missing intrinsics for Math.ceil, floor, rint
+  - JDK-8231118: ARM32: Math tests failures
+  - JDK-8231213: Migrate SimpleDateFormatConstTest to JDK Repo
+  - JDK-8231243: [TESTBUG] CustomFont.java cannot find font file
+  - JDK-8231438: [macOS] Dark mode for the desktop is not supported
+  - JDK-8231550: C2: ShouldNotReachHere() in verify_strip_mined_scheduling
+  - JDK-8231564: setMaximizedBounds is broken with large display scale and multiple monitors
+  - JDK-8231572: Use -lobjc instead of -fobjc-link-runtime in libosxsecurity
+  - JDK-8231631: sun/net/ftp/FtpURLConnectionLeak.java fails intermittently with NPE
+  - JDK-8231671: Fix copyright headers in hotspot (missing comma after year)
+  - JDK-8231720: Some perf regressions after 8225653
+  - JDK-8231779: crash HeapWord*ParallelScavengeHeap::failed_mem_allocate
+  - JDK-8231863: Crash if classpath is read from @argument file and the main gets option argument
+  - JDK-8232080: jlink plugins for vendor information and run-time options
+  - JDK-8232106: [x86] C2: SIGILL due to usage of SSSE3 instructions on processors which don't support it
+  - JDK-8232134: Change to Visual Studio 2017 15.9.16 for building on Windows at Oracle
+  - JDK-8232226: [macos 10.15] test/jdk/java/awt/color/EqualityTest/EqualityTest.java may fail
+  - JDK-8232357: Compare version info of Santuario to legal notice
+  - JDK-8232572: Add hooks for custom output dir in Bundles.gmk
+  - JDK-8232634: Problem List ICMColorDataTest.java
+  - JDK-8232748: Build static versions of certain JDK libraries
+  - JDK-8232846: ProcessHandle.Info command with non-English shows question marks
+  - JDK-8233033: C2 produces wrong result while unswitching a loop due to lost control dependencies
+  - JDK-8233137: runtime/ErrorHandling/VeryEarlyAssertTest.java fails after 8232080
+  - JDK-8233197: Invert JvmtiExport::post_vm_initialized() and Jfr:on_vm_start() start-up order for correct option parsing
+  - JDK-8233291: [TESTBUG] tools/jlink/plugins/VendorInfoPluginsTest.java fails with debug or non-server VMs
+  - JDK-8233364: Fix undefined behavior in Canonicalizer::do_ShiftOp
+  - JDK-8233573: Toolkit.getScreenInsets(GraphicsConfiguration) may throw ClassCastException
+  - JDK-8233608: Minimal build broken after JDK-8233494
+  - JDK-8233621: Mismatch in jsse.enableMFLNExtension property name
+  - JDK-8233696: [TESTBUG]Some jtreg tests fail when CAPS_LOCK is ON
+  - JDK-8233707: systemScale.cpp could not compile with VS2019
+  - JDK-8233801: GCMEmptyIv.java test fails on Solaris 11.4
+  - JDK-8233880: Support compilers with multi-digit major version numbers
+  - JDK-8233920: MethodHandles::tryFinally generates illegal bytecode for long/double return type
+  - JDK-8234137: The "AutoTestOnTop.java" test may run external applications
+  - JDK-8234146: compiler/jsr292/ContinuousCallSiteTargetChange.java times out on SPARC
+  - JDK-8234184: [TESTBUG] java/awt/Mouse/EnterExitEvents/ModalDialogEnterExitEventsTest.java fails in Windows
+  - JDK-8234270: [REDO] JDK-8204128 NMT might report incorrect numbers for Compiler area
+  - JDK-8234332: [TESTBUG] java/awt/Focus/DisposedWindow/DisposeDialogNotActivateOwnerTest/DisposeDialogNotActivateOwnerTest.java fails on linux-x64 nightly
+  - JDK-8234398: Replace ID2D1Factory::GetDesktopDpi with GetDeviceCaps
+  - JDK-8234522: [macos] Crash with use of native file dialog
+  - JDK-8234691: Potential double-free in ParallelSPCleanupTask constructor
+  - JDK-8234696: tools/jlink/plugins/VendorInfoPluginsTest.java times out
+  - JDK-8234727: sun/security/ssl/X509TrustManagerImpl tests support TLSv1.3
+  - JDK-8234728: Some security tests should support TLSv1.3
+  - JDK-8234779: Provide idiom for declaring classes noncopyable
+  - JDK-8234968: check calloc rv in libinstrument InvocationAdapter
+  - JDK-8235153: [TESTBUG] [macos 10.15] java/awt/Graphics/DrawImageBG/SystemBgColorTest.java fails
+  - JDK-8235183: Remove the "HACK CODE" in comment
+  - JDK-8235263: Revert TLS 1.3 change that wrapped IOExceptions
+  - JDK-8235311: Tag mismatch may alert bad_record_mac
+  - JDK-8235332: TestInstanceCloneAsLoadsStores.java fails with -XX:+StressGCM
+  - JDK-8235452: Strip mined loop verification fails with assert(is_OuterStripMinedLoop()) failed: invalid node class
+  - JDK-8235584: UseProfiledLoopPredicate fails with assert(_phase->get_loop(c) == loop) failed: have to be in the same loop
+  - JDK-8235620: Broken merge between JDK-8006406 and JDK-8003559
+  - JDK-8235638: NPE in LWWindowPeer.getOnscreenGraphics()
+  - JDK-8235686: Add more custom hooks in Bundles.gmk
+  - JDK-8235739: Rare NPE at WComponentPeer.getGraphics()
+  - JDK-8235762: JVM crash in SWPointer during C2 compilation
+  - JDK-8235834: IBM-943 charset encoder needs updating
+  - JDK-8235874: The ordering of Cipher Suites is not maintained provided through jdk.tls.client.cipherSuites and jdk.tls.server.cipherSuites system property.
+  - JDK-8235908: omit ThreadPriorityPolicy warning when value is set from image
+  - JDK-8235984: C2: assert(out->in(PhiNode::Region) == head || out->in(PhiNode::Region) == slow_head) failed: phi must be either part of the slow or the fast loop
+  - JDK-8236211: [Graal] compiler/graalunit/GraphTest.java is skipped in all testing
+  - JDK-8236470: Deal with ECDSA using ecdsa-with-SHA2 plus hash algorithm as AlgorithmId
+  - JDK-8236545: Compilation error in mach5 java/awt/FileDialog/MacOSGoToFolderCrash.java
+  - JDK-8236700: Upgrading JSZip from v3.1.5 to v3.2.2
+  - JDK-8236759: ShouldNotReachHere in PhaseIdealLoop::verify_strip_mined_scheduling
+  - JDK-8236897: Fix the copyright header for pkcs11gcm2.h
+  - JDK-8236921: Add build target to produce a JDK image suitable for a Graal/SVM build
+  - JDK-8236953: [macos] JavaFX SwingNode is not rendered on macOS
+  - JDK-8236996: Incorrect Roboto font rendering on Windows with subpixel antialiasing
+  - JDK-8237045: JVM uses excessive memory with -XX:+EnableJVMCI -XX:JVMCICounterSize=2147483648
+  - JDK-8237055: [TESTBUG] compiler/c2/TestJumpTable.java fails with release VMs
+  - JDK-8237086: assert(is_MachReturn()) running CTW with fix for JDK-8231291
+  - JDK-8237192: Generate stripped/public pdbs on Windows for jdk images
+  - JDK-8237396: JvmtiTagMap::weak_oops_do() should not trigger barriers
+  - JDK-8237474: Default SSLEngine should create in server role
+  - JDK-8237859: C2: Crash when loads float above range check
+  - JDK-8237951: CTW: C2 compilation fails with "malformed control flow"
+  - JDK-8237962: give better error output for invalid OCSP response intervals in CertPathValidator checks
+  - JDK-8238190: [JVMCI] Fix single implementor speculation for diamond shapes.
+  - JDK-8238356: CodeHeap::blob_count() overestimates the number of blobs
+  - JDK-8238452: Keytool generates wrong expiration date if validity is set to 2050/01/01
+  - JDK-8238555: Allow Initialization of SunPKCS11 with NSS when there are external FIPS modules in the NSSDB
+  - JDK-8238575: DragSourceEvent.getLocation() returns wrong value on HiDPI screens (Windows)
+  - JDK-8238676: jni crashes on accessing it from process exit hook
+  - JDK-8238721: Add failing client jtreg tests to the Problem List
+  - JDK-8238738: AudioSystem.getMixerInfo() takes about 30 sec to report a gone audio device
+  - JDK-8238756: C2: assert(((n) == __null || !VerifyIterativeGVN || !((n)->is_dead()))) failed: can not use dead node
+  - JDK-8238765: PhaseCFG::schedule_pinned_nodes cannot handle precedence edges from unmatched CFG nodes correctly
+  - JDK-8238898: Missing hash characters for header on license file
+  - JDK-8238942: Rendering artifacts with LCD text and fractional metrics
+  - JDK-8238985: [TESTBUG] The arrow image is blue instead of green
+  - JDK-8239000: handle ContendedPaddingWidth in vm_version_ppc
+  - JDK-8239055: Wrong implementation of VMState.hasListener
+  - JDK-8239091: Reversed arguments in call to strstr in freetype "debug" code.
+  - JDK-8239142: C2's UseUniqueSubclasses optimization is broken for array accesses
+  - JDK-8239224: libproc_impl.c previous_thr may be used uninitialized warning
+  - JDK-8239351: Give more meaningful InternalError messages in Deflater.c
+  - JDK-8239365: ProcessBuilder test modifications for AIX execution
+  - JDK-8239456: vtable stub generation: assert failure (code size estimate)
+  - JDK-8239457: call ReleaseStringUTFChars before early returns in Java_sun_security_pkcs11_wrapper_PKCS11_connect
+  - JDK-8239462: jdk.hotspot.agent misses some ReleaseStringUTFChars calls in case of early returns
+  - JDK-8239557: [TESTBUG] VeryEarlyAssertTest.java validating "END." marker at lastline is not always true
+  - JDK-8239787: AArch64: String.indexOf may incorrectly handle empty strings
+  - JDK-8239792: Bump update version for OpenJDK: jdk-11.0.8
+  - JDK-8239798: SSLSocket closes socket both socket endpoints on a SocketTimeoutException
+  - JDK-8239819: XToolkit: Misread of screen information memory
+  - JDK-8239852: java/util/concurrent tests fail with -XX:+VerifyGraphEdges: assert(!VerifyGraphEdges) failed: verification should have failed
+  - JDK-8239893: Windows handle Leak when starting processes using ProcessBuilder
+  - JDK-8239915: Zero VM crashes when handling dynamic constant
+  - JDK-8239931: [win][x86] vtable stub generation: assert failure (code size estimate) follow-up
+  - JDK-8239976: Put JDK-8239965 on the ProblemList.txt
+  - JDK-8240073: Fix 'test-make' build target in 11u
+  - JDK-8240197: Cannot start JVM when $JAVA_HOME includes CJK characters
+  - JDK-8240202: A few client tests leave mouse buttons pressed
+  - JDK-8240220: IdealLoopTree::dump_head predicate printing is broken
+  - JDK-8240223: Use consistent predicate order in and with PhaseIdealLoop::find_predicate
+  - JDK-8240227: Loop predicates should be copied to unswitched loops
+  - JDK-8240286: [TESTBUG] Test command error in hotspot/jtreg/compiler/loopopts/superword/SumRedAbsNeg_Float.java
+  - JDK-8240518: Incorrect JNU_ReleaseStringPlatformChars in Windows Print
+  - JDK-8240529: CheckUnhandledOops breaks NULL check in Modules::define_module
+  - JDK-8240576: JVM crashes after transformation in C2 IdealLoopTree::merge_many_backedges
+  - JDK-8240603: Windows 32bit compile error after 8238676
+  - JDK-8240629: argfiles parsing broken for argfiles with comment cross 4096 bytes chunk
+  - JDK-8240711: TestJstatdPort.java failed due to "ExportException: Port already in use:"
+  - JDK-8240786: [TESTBUG] The test java/awt/Window/GetScreenLocation/GetScreenLocationTest.java fails on HiDPI screen
+  - JDK-8240824: enhance print_full_memory_info on Linux by THP related information
+  - JDK-8240827: Downport SSLSocketImpl.java from "8221882: Use fiber-friendly java.util.concurrent.locks in JSSE"
+  - JDK-8240905: assert(mem == (Node*)1 || mem == mem2) failed: multiple Memories being matched at once?
+  - JDK-8240972: macOS codesign fail on macOS 10.13.5 or older
+  - JDK-8241445: Fix copyright in test/jdk/tools/launcher/ArgFileSyntax.java
+  - JDK-8241458: [JVMCI] add mark value to expose CodeOffsets::Frame_Complete
+  - JDK-8241464: [11u] Backport: make rehashing be a needed guaranteed safepoint cleanup action
+  - JDK-8241556: Memory leak if -XX:CompileCommand is set
+  - JDK-8241568: (fs) UserPrincipalLookupService.lookupXXX failure with IOE "Operation not permitted"
+  - JDK-8241586: compiler/cpuflags/TestAESIntrinsicsOnUnsupportedConfig.java fails on aarch64
+  - JDK-8241638: launcher time metrics always report 1 on Linux when _JAVA_LAUNCHER_DEBUG set
+  - JDK-8241660: Add virtualization information output to hs_err file on macOS
+  - JDK-8241808: [TESTBUG] The JDK-8039467 bug appeared on macOS
+  - JDK-8241888: Mirror jdk.security.allowNonCaAnchor system property with a security one
+  - JDK-8241900: Loop unswitching may cause dependence on null check to be lost
+  - JDK-8241948: enhance list of environment variables printed in hs_err file
+  - JDK-8241996: on linux set full relro in the linker flags
+  - JDK-8242108: Performance regression after fix for JDK-8229496
+  - JDK-8242141: New System Properties to configure the TLS signature schemes
+  - JDK-8242154: Backport parts of JDK-4947890 to OpenJDK 11u
+  - JDK-8242174: [macos] The NestedModelessDialogTest test make the macOS unstable
+  - JDK-8242239: [Graal] javax/management/generified/GenericTest.java fails: FAILED: queryMBeans sets same
+  - JDK-8242294: JSSE Client does not throw SSLException when an alert occurs during handshaking
+  - JDK-8242379: [TESTBUG] compiler/loopopts/TestLoopUnswitchingLostCastDependency.java fails with release VMs
+  - JDK-8242470: Update Xerces to Version 2.12.1
+  - JDK-8242498: Invalid "sun.awt.TimedWindowEvent" object leads to JVM crash
+  - JDK-8242541: Small charset issues (ISO8859-16, x-eucJP-Open, x-IBM834 and x-IBM949C)
+  - JDK-8242626: enhance posix print_rlimit_info
+  - JDK-8243059: Build fails when --with-vendor-name contains a comma
+  - JDK-8243539: Copyright info (Year) should be updated for fix of 8241638
+  - JDK-8243541: (tz) Upgrade time-zone data to tzdata2020a
+  - JDK-8244407: JVM crashes after transformation in C2 IdealLoopTree::split_fall_in
+  - JDK-8244520: problemlist java/awt/font/Rotate/RotatedFontTest.java on linux
+  - JDK-8244777: ClassLoaderStats VM Op uses constant hash value
+  - JDK-8244853: The static build of libextnet is missing the JNI_OnLoad_extnet function
+  - JDK-8244951: Missing entitlements for hardened runtime
+  - JDK-8245047: [PPC64] C2: ReverseBytes + Load always match to unordered Load (acquire semantics missing)
+  - JDK-8245649: Revert 8245397 backport of 8230591
+  - JDK-8246031: SSLSocket.getSession() doesn't close connection for timeout/ interrupts
+  - JDK-8246613: Choose the default SecureRandom algo based on registration ordering
+  - JDK-8248505: Unexpected NoSuchAlgorithmException when using secure random impl from BCFIPS provider
+
+Notes on individual issues:
+===========================
+
+security-libs/java.security:
+
+JDK-8244167: Removal of Comodo Root CA Certificate
+==================================================
+The following expired Comodo root CA certificate was removed from the `cacerts` keystore: +
+alias name "addtrustclass1ca [jdk]"
+
+Distinguished Name: CN=AddTrust Class 1 CA Root, OU=AddTrust TTP Network, O=AddTrust AB, C=SE
+
+JDK-8244166: Removal of DocuSign Root CA Certificate
+====================================================
+The following expired DocuSign root CA certificate was removed from the `cacerts` keystore: +
+alias name "keynectisrootca [jdk]"
+
+Distinguished Name: CN=KEYNECTIS ROOT CA, OU=ROOT, O=KEYNECTIS, C=FR
+
+security-libs/javax.crypto:pkcs11:
+
+JDK-8240191: Allow SunPKCS11 initialization with NSS when external FIPS modules are present in the Security Modules Database
+============================================================================================================================
+The SunPKCS11 security provider can now be initialized with NSS when
+FIPS-enabled external modules are configured in the Security Modules
+Database (NSSDB). Prior to this change, the SunPKCS11 provider would
+throw a RuntimeException with the message: "FIPS flag set for
+non-internal module" when such a library was configured for NSS in
+non-FIPS mode.
+
+This change allows the JDK to work properly with recent NSS releases
+in GNU/Linux operating systems when the system-wide FIPS policy is
+turned on.
+
+Further information can be found in JDK-8238555.
+
+security-libs/javax.net.ssl:
+
+JDK-8245077: Default SSLEngine Should Create in Server Role
+===========================================================
+In JDK 11 and later, `javax.net.ssl.SSLEngine` by default used client
+mode when handshaking.  As a result, the set of default enabled
+protocols may differ to what is expected. `SSLEngine` would usually be
+used in server mode. From this JDK release onwards, `SSLEngine` will
+default to server mode. The
+`javax.net.ssl.SSLEngine.setUseClientMode(boolean mode)` method may
+be used to configure the mode.
+
+JDK-8242147: New System Properties to Configure the TLS Signature Schemes
+=========================================================================
+
+Two new System Properties are added to customize the TLS signature
+schemes in JDK.  `jdk.tls.client.SignatureSchemes` is added for TLS
+client side, and `jdk.tls.server.SignatureSchemes` is added for server
+side.
+
+Each System Property contains a comma-separated list of supported
+signature scheme names specifying the signature schemes that could be
+used for the TLS connections.
+
+The names are described in the "Signature Schemes" section of the
+*Java Security Standard Algorithm Names Specification*.
+
 New in release OpenJDK 11.0.7 (2020-04-14):
 ===========================================
 Live versions of these release notes can be found at:
diff --git a/SOURCES/rh1842572-rsa_default_for_keytool.patch b/SOURCES/rh1842572-rsa_default_for_keytool.patch
new file mode 100644
index 0000000..db74cdc
--- /dev/null
+++ b/SOURCES/rh1842572-rsa_default_for_keytool.patch
@@ -0,0 +1,12 @@
+diff --git openjdk.orig/src/java.base/share/classes/sun/security/tools/keytool/Main.java openjdk/src/java.base/share/classes/sun/security/tools/keytool/Main.java
+--- openjdk.orig/src/java.base/share/classes/sun/security/tools/keytool/Main.java
++++ openjdk/src/java.base/share/classes/sun/security/tools/keytool/Main.java
+@@ -1122,7 +1122,7 @@
+             }
+         } else if (command == GENKEYPAIR) {
+             if (keyAlgName == null) {
+-                keyAlgName = "DSA";
++                keyAlgName = "RSA";
+             }
+             doGenKeyPair(alias, dname, keyAlgName, keysize, sigAlgName);
+             kssave = true;
diff --git a/SPECS/java-11-openjdk.spec b/SPECS/java-11-openjdk.spec
index 4d1c0d0..d1b9b3a 100644
--- a/SPECS/java-11-openjdk.spec
+++ b/SPECS/java-11-openjdk.spec
@@ -4,18 +4,17 @@
 #
 # Examples:
 #
-# Produce release *and* slowdebug builds on x86_64 (default):
-# $ rpmbuild -ba java-1.8.0-openjdk.spec
+# Produce release, fastdebug *and* slowdebug builds on x86_64 (default):
+# $ rpmbuild -ba java-11-openjdk.spec
 #
-# Produce only release builds (no slowdebug builds) on x86_64:
-# $ rpmbuild -ba java-1.8.0-openjdk.spec --without slowdebug
+# Produce only release builds (no debug builds) on x86_64:
+# $ rpmbuild -ba java-11-openjdk.spec --without slowdebug --without fastdebug
 #
 # Only produce a release build on x86_64:
-# $ fedpkg mockbuild --without slowdebug
-#
-# Only produce a debug build on x86_64:
-# $ fedpkg local --without release
+# $ rhpkg mockbuild --without slowdebug --without fastdebug
 #
+# Enable fastdebug builds by default on relevant arches.
+%bcond_without fastdebug
 # Enable slowdebug builds by default on relevant arches.
 %bcond_without slowdebug
 # Enable release builds by default on relevant arches.
@@ -35,13 +34,16 @@
 # See https://github.com/rpm-software-management/rpm/issues/127 to comments at  "pmatilai commented on Aug 18, 2017"
 # (initiated in https://bugzilla.redhat.com/show_bug.cgi?id=1482192)
 %global debug_suffix_unquoted -slowdebug
+%global fastdebug_suffix_unquoted -fastdebug
 # quoted one for shell operations
 %global debug_suffix "%{debug_suffix_unquoted}"
+%global fastdebug_suffix "%{fastdebug_suffix_unquoted}"
 %global normal_suffix ""
 
-# if you want only debug build but providing java build only normal build but set normalbuild_parameter
-%global debug_warning This package has full debug on. Install only in need and remove asap.
+%global debug_warning This package is unoptimised with full debugging. Install only as needed and remove ASAP.
 %global debug_on with full debug on
+%global fastdebug_warning This package is optimised with full debugging. Install only as needed and remove ASAP.
+%global for_fastdebug_on with minimal debug on
 %global for_debug for packages with debug on
 
 %if %{with release}
@@ -51,9 +53,9 @@
 %endif
 
 %if %{include_normal_build}
-%global build_loop1 %{normal_suffix}
+%global normal_build %{normal_suffix}
 %else
-%global build_loop1 %{nil}
+%global normal_build %{nil}
 %endif
 
 # We have hardcoded list of files, which  is appearing in alternatives, and in files
@@ -62,8 +64,8 @@
 # the ghosts are here to allow installation via query like `dnf install /usr/bin/java`
 # you can list those files, with appropriate sections: cat *.spec | grep -e --install -e --slave -e post_ 
 # TODO - fix those hardcoded lists via single list
-# those files ,must *NOT* be ghosted for *slowdebug* packages
-# FIXME - if you are moving jshell or jlink or simialr, always modify all three sections
+# Those files must *NOT* be ghosted for *slowdebug* packages
+# FIXME - if you are moving jshell or jlink or similar, always modify all three sections
 # you can check via headless and devels:
 #    rpm -ql --noghost java-11-openjdk-headless-11.0.1.13-8.fc29.x86_64.rpm  | grep bin
 # == rpm -ql           java-11-openjdk-headless-slowdebug-11.0.1.13-8.fc29.x86_64.rpm  | grep bin
@@ -82,6 +84,7 @@
 %global multilib_arches %{power64} sparc64 x86_64
 %global jit_arches      %{ix86} x86_64 sparcv9 sparc64 %{aarch64} %{power64} %{arm} s390x
 %global aot_arches      x86_64 %{aarch64}
+%global fastdebug_arches x86_64
 
 # By default, we build a debug build during main build on JIT architectures
 %if %{with slowdebug}
@@ -105,17 +108,32 @@
 %global use_shenandoah_hotspot 0
 %endif
 
+# By default, we build a fastdebug build during main build only on fastdebug architectures
+%if %{with fastdebug}
+%ifarch %{fastdebug_arches}
+%global include_fastdebug_build 1
+%else
+%global include_fastdebug_build 0
+%endif
+%endif
+
 %if %{include_debug_build}
-%global build_loop2 %{debug_suffix}
+%global slowdebug_build %{debug_suffix}
+%else
+%global slowdebug_build %{nil}
+%endif
+
+%if %{include_fastdebug_build}
+%global fastdebug_build %{fastdebug_suffix}
 %else
-%global build_loop2 %{nil}
+%global fastdebug_build %{nil}
 %endif
 
-# if you disable both builds, then the build fails
-%global build_loop  %{build_loop1} %{build_loop2}
-# note: that order: normal_suffix debug_suffix, in case of both enabled
-# is expected in one single case at the end of the build
-%global rev_build_loop  %{build_loop2} %{build_loop1}
+# If you disable both builds, then the build fails
+# Note that the debug build requires the normal build for docs
+%global build_loop %{normal_build} %{fastdebug_build} %{slowdebug_build}
+# Test slowdebug first as it provides the best diagnostics
+%global rev_build_loop  %{slowdebug_build} %{fastdebug_build} %{normal_build}
 
 %ifarch %{jit_arches}
 %global bootstrap_build 1
@@ -240,7 +258,7 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{origin}
 %global minorver        0
-%global buildver        6
+%global buildver        10
 %global rpmrelease      1
 #%%global tagsuffix     %%{nil}
 # priority must be 8 digits in total; untill openjdk 1.8 we were using 18..... so when moving to 11 we had to add another digit
@@ -258,7 +276,7 @@
 # Release will be (where N is usually a number starting at 1):
 # - 0.N%%{?extraver}%%{?dist} for EA releases,
 # - N%%{?extraver}{?dist} for GA releases
-%global is_ga           0
+%global is_ga           1
 %if %{is_ga}
 %global ea_designator ""
 %global ea_designator_zip ""
@@ -312,6 +330,8 @@
 %define sdkbindir()     %{expand:%{_jvmdir}/%{sdkdir -- %{?1}}/bin}
 %define jrebindir()     %{expand:%{_jvmdir}/%{sdkdir -- %{?1}}/bin}
 
+%global alt_java_name     alt-java
+
 %global rpm_state_dir %{_localstatedir}/lib/rpm-state/
 
 %if %{with_systemtap}
@@ -357,6 +377,7 @@ ext=.gz
 alternatives \\
   --install %{_bindir}/java java %{jrebindir -- %{?1}}/java $PRIORITY  --family %{name}.%{_arch} \\
   --slave %{_jvmdir}/jre jre %{_jvmdir}/%{sdkdir -- %{?1}} \\
+  --slave %{_bindir}/%{alt_java_name} %{alt_java_name} %{jrebindir -- %{?1}}/%{alt_java_name} \\
   --slave %{_bindir}/jjs jjs %{jrebindir -- %{?1}}/jjs \\
   --slave %{_bindir}/keytool keytool %{jrebindir -- %{?1}}/keytool \\
   --slave %{_bindir}/pack200 pack200 %{jrebindir -- %{?1}}/pack200 \\
@@ -365,6 +386,8 @@ alternatives \\
   --slave %{_bindir}/unpack200 unpack200 %{jrebindir -- %{?1}}/unpack200 \\
   --slave %{_mandir}/man1/java.1$ext java.1$ext \\
   %{_mandir}/man1/java-%{uniquesuffix -- %{?1}}.1$ext \\
+  --slave %{_mandir}/man1/%{alt_java_name}.1$ext %{alt_java_name}.1$ext \\
+  %{_mandir}/man1/%{alt_java_name}-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/jjs.1$ext jjs.1$ext \\
   %{_mandir}/man1/jjs-%{uniquesuffix -- %{?1}}.1$ext \\
   --slave %{_mandir}/man1/keytool.1$ext keytool.1$ext \\
@@ -585,6 +608,7 @@ exit 0
 %{_jvmdir}/%{jrelnk -- %{?1}}
 %dir %{_jvmdir}/%{sdkdir -- %{?1}}/bin
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/java
+%{_jvmdir}/%{sdkdir -- %{?1}}/bin/%{alt_java_name}
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/jjs
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/keytool
 %{_jvmdir}/%{sdkdir -- %{?1}}/bin/pack200
@@ -646,6 +670,7 @@ exit 0
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/jfr/default.jfc
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/jfr/profile.jfc
 %{_mandir}/man1/java-%{uniquesuffix -- %{?1}}.1*
+%{_mandir}/man1/%{alt_java_name}-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/jjs-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/keytool-%{uniquesuffix -- %{?1}}.1*
 %{_mandir}/man1/pack200-%{uniquesuffix -- %{?1}}.1*
@@ -694,6 +719,7 @@ exit 0
 %if %is_system_jdk
 %if %{is_release_build -- %{?1}}
 %ghost %{_bindir}/java
+%ghost %{_bindir}/%{alt_java_name}
 %ghost %{_jvmdir}/jre
 # https://bugzilla.redhat.com/show_bug.cgi?id=1312019
 %ghost %{_bindir}/jjs
@@ -707,6 +733,10 @@ exit 0
 %ghost %{_jvmdir}/jre-%{javaver}-%{origin}
 %endif
 %endif
+# https://bugzilla.redhat.com/show_bug.cgi?id=1820172
+# https://docs.fedoraproject.org/en-US/packaging-guidelines/Directory_Replacement/
+%ghost %{_jvmdir}/%{sdkdir -- %{?1}}/conf.rpmmoved
+%ghost %{_jvmdir}/%{sdkdir -- %{?1}}/lib/security.rpmmoved
 }
 
 %define files_devel() %{expand:
@@ -778,6 +808,7 @@ exit 0
 %if %{is_release_build -- %{?1}}
 %ghost %{_bindir}/javac
 %ghost %{_jvmdir}/java
+%ghost %{_jvmdir}/%{alt_java_name}
 %ghost %{_bindir}/jaotc
 %ghost %{_bindir}/jlink
 %ghost %{_bindir}/jmod
@@ -1105,6 +1136,8 @@ Patch1000: rh1648249-add_commented_out_nss_cfg_provider_to_java_security.patch
 Patch1001: rh1655466-global_crypto_and_fips.patch
 # RH1818909: No ciphersuites availale for SSLSocket in FIPS mode
 Patch1002: rh1818909-fips_default_keystore_type.patch
+# RH1582504: Use RSA as default for keytool, as DSA is disabled in all crypto policies except LEGACY
+Patch1003: rh1842572-rsa_default_for_keytool.patch
 
 #############################################
 #
@@ -1202,6 +1235,17 @@ The %{origin_nice} runtime environment.
 %{debug_warning}
 %endif
 
+%if %{include_fastdebug_build}
+%package fastdebug
+Summary: %{origin_nice} Runtime Environment %{majorver} %{fastdebug_on}
+Group:   Development/Languages
+
+%{java_rpo -- %{fastdebug_suffix_unquoted}}
+%description fastdebug
+The %{origin_nice} runtime environment.
+%{fastdebug_warning}
+%endif
+
 %if %{include_normal_build}
 %package headless
 Summary: %{origin_nice} Headless Runtime Environment %{majorver}
@@ -1225,6 +1269,18 @@ The %{origin_nice} runtime environment %{majorver} without audio and video suppo
 %{debug_warning}
 %endif
 
+%if %{include_fastdebug_build}
+%package headless-fastdebug
+Summary: %{origin_nice} Runtime Environment %{fastdebug_on}
+Group:   Development/Languages
+
+%{java_headless_rpo -- %{fastdebug_suffix_unquoted}}
+
+%description headless-fastdebug
+The %{origin_nice} runtime environment %{majorver} without audio and video support.
+%{fastdebug_warning}
+%endif
+
 %if %{include_normal_build}
 %package devel
 Summary: %{origin_nice} Development Environment %{majorver}
@@ -1248,6 +1304,18 @@ The %{origin_nice} development tools %{majorver}.
 %{debug_warning}
 %endif
 
+%if %{include_fastdebug_build}
+%package devel-fastdebug
+Summary: %{origin_nice} Development Environment %{majorver} %{fastdebug_on}
+Group:   Development/Tools
+
+%{java_devel_rpo -- %{fastdebug_suffix_unquoted}}
+
+%description devel-fastdebug
+The %{origin_nice} development tools %{majorver}.
+%{fastdebug_warning}
+%endif
+
 %if %{include_normal_build}
 %package static-libs
 Summary: %{origin_nice} libraries for static linking %{majorver}
@@ -1269,6 +1337,17 @@ The %{origin_nice} libraries for static linking %{majorver}.
 %{debug_warning}
 %endif
 
+%if %{include_fastdebug_build}
+%package static-libs-fastdebug
+Summary: %{origin_nice} libraries for static linking %{majorver} %{fastdebug_on}
+
+%{java_static_libs_rpo -- %{fastdebug_suffix_unquoted}}
+
+%description static-libs-fastdebug
+The %{origin_nice} libraries for static linking %{majorver}.
+%{fastdebug_warning}
+%endif
+
 %if %{include_normal_build}
 %package jmods
 Summary: JMods for %{origin_nice} %{majorver}
@@ -1292,6 +1371,18 @@ The JMods for %{origin_nice} %{majorver}.
 %{debug_warning}
 %endif
 
+%if %{include_fastdebug_build}
+%package jmods-fastdebug
+Summary: JMods for %{origin_nice} %{majorver} %{fastdebug_on}
+Group:   Development/Tools
+
+%{java_jmods_rpo -- %{fastdebug_suffix_unquoted}}
+
+%description jmods-fastdebug
+The JMods for %{origin_nice} %{majorver}.
+%{fastdebug_warning}
+%endif
+
 %if %{include_normal_build}
 %package demo
 Summary: %{origin_nice} Demos %{majorver}
@@ -1315,6 +1406,18 @@ The %{origin_nice} demos %{majorver}.
 %{debug_warning}
 %endif
 
+%if %{include_fastdebug_build}
+%package demo-fastdebug
+Summary: %{origin_nice} Demos %{majorver} %{fastdebug_on}
+Group:   Development/Languages
+
+%{java_demo_rpo -- %{fastdebug_suffix_unquoted}}
+
+%description demo-fastdebug
+The %{origin_nice} demos %{majorver}.
+%{fastdebug_warning}
+%endif
+
 %if %{include_normal_build}
 %package src
 Summary: %{origin_nice} Source Bundle %{majorver}
@@ -1339,6 +1442,18 @@ The java-%{origin}-src-slowdebug sub-package contains the complete %{origin_nice
  class library source code for use by IDE indexers and debuggers. Debugging %{for_debug}.
 %endif
 
+%if %{include_fastdebug_build}
+%package src-fastdebug
+Summary: %{origin_nice} Source Bundle %{majorver} %{for_fastdebug}
+Group:   Development/Languages
+
+%{java_src_rpo -- %{fastdebug_suffix_unquoted}}
+
+%description src-fastdebug
+The java-%{origin}-src-fastdebug sub-package contains the complete %{origin_nice} %{majorver}
+ class library source code for use by IDE indexers and debuggers. Debugging %{for_fastdebug}.
+%endif
+
 %if %{include_normal_build}
 %package javadoc
 Summary: %{origin_nice} %{majorver} API documentation
@@ -1350,11 +1465,9 @@ Obsoletes: javadoc-debug
 
 %description javadoc
 The %{origin_nice} %{majorver} API documentation.
-%endif
 
-%if %{include_normal_build}
 %package javadoc-zip
-Summary: %{origin_nice} %{majorver} API documentation compressed in single archive
+Summary: %{origin_nice} %{majorver} API documentation compressed in a single archive
 Group:   Documentation
 Requires: javapackages-filesystem
 Obsoletes: javadoc-zip-debug
@@ -1362,7 +1475,7 @@ Obsoletes: javadoc-zip-debug
 %{java_javadoc_rpo %{nil}}
 
 %description javadoc-zip
-The %{origin_nice} %{majorver} API documentation compressed in single archive.
+The %{origin_nice} %{majorver} API documentation compressed in a single archive.
 %endif
 
 %prep
@@ -1377,19 +1490,29 @@ The %{origin_nice} %{majorver} API documentation compressed in single archive.
 if [ %{include_normal_build} -eq 0 -o  %{include_normal_build} -eq 1 ] ; then
   echo "include_normal_build is %{include_normal_build}"
 else
-  echo "include_normal_build is %{include_normal_build}, thats invalid. Use 1 for yes or 0 for no"
+  echo "include_normal_build is %{include_normal_build}, that is invalid. Use 1 for yes or 0 for no"
   exit 11
 fi
 if [ %{include_debug_build} -eq 0 -o  %{include_debug_build} -eq 1 ] ; then
   echo "include_debug_build is %{include_debug_build}"
 else
-  echo "include_debug_build is %{include_debug_build}, thats invalid. Use 1 for yes or 0 for no"
+  echo "include_debug_build is %{include_debug_build}, that is invalid. Use 1 for yes or 0 for no"
   exit 12
 fi
-if [ %{include_debug_build} -eq 0 -a  %{include_normal_build} -eq 0 ] ; then
-  echo "You have disabled both include_debug_build and include_normal_build. That is a no go."
+if [ %{include_fastdebug_build} -eq 0 -o  %{include_fastdebug_build} -eq 1 ] ; then
+  echo "include_fastdebug_build is %{include_fastdebug_build}"
+else
+  echo "include_fastdebug_build is %{include_fastdebug_build}, that is invalid. Use 1 for yes or 0 for no"
   exit 13
 fi
+if [ %{include_debug_build} -eq 0 -a  %{include_normal_build} -eq 0 -a  %{include_fastdebug_build} -eq 0 ] ; then
+  echo "You have disabled all builds (normal,fastdebug,slowdebug). That is a no go."
+  exit 14
+fi
+if [ %{include_normal_build} -eq 0 ] ; then
+  echo "You have disabled the normal build, but this is required to provide docs for the debug build."
+  exit 15
+fi
 %setup -q -c -n %{uniquesuffix ""} -T -a 0
 # https://bugzilla.redhat.com/show_bug.cgi?id=1189084
 prioritylength=`expr length %{priority}`
@@ -1415,6 +1538,7 @@ popd # openjdk
 %patch1000
 %patch1001
 %patch1002
+%patch1003
 
 # Extract systemtap tapsets
 %if %{with_systemtap}
@@ -1422,6 +1546,9 @@ tar --strip-components=1 -x -I xz -f %{SOURCE8}
 %if %{include_debug_build}
 cp -r tapset tapset%{debug_suffix}
 %endif
+%if %{include_fastdebug_build}
+cp -r tapset tapset%{fastdebug_suffix}
+%endif
 
 
 for suffix in %{build_loop} ; do
@@ -1579,6 +1706,14 @@ install -m 644 nss.fips.cfg $JAVA_HOME/conf/security/
 rm $JAVA_HOME/lib/tzdb.dat
 ln -s %{_datadir}/javazi-1.8/tzdb.dat $JAVA_HOME/lib/tzdb.dat
 
+# Create fake alt-java as a placeholder for future alt-java
+pushd ${JAVA_HOME}
+cp -a bin/java bin/%{alt_java_name}
+# add alt-java man page
+echo "Hardened java binary recommended for launching untrusted code from the Web e.g. javaws" > man/man1/%{alt_java_name}.1
+cat man/man1/java.1 >> man/man1/%{alt_java_name}.1
+popd
+
 # build cycles
 done
 
@@ -1725,7 +1860,6 @@ pushd %{buildoutputdir $suffix}/images/%{jdkimage}
     ln -sf %{sdkdir -- $suffix} %{jrelnk -- $suffix}
   popd
 
-
   # Install man pages
   install -d -m 755 $RPM_BUILD_ROOT%{_mandir}/man1
   for manpage in man/man1/*
@@ -1749,7 +1883,8 @@ if ! echo $suffix | grep -q "debug" ; then
   # Install Javadoc documentation
   install -d -m 755 $RPM_BUILD_ROOT%{_javadocdir}
   cp -a %{buildoutputdir $suffix}/images/docs $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir $suffix}
-  cp -a %{buildoutputdir -- $suffix}/bundles/jdk-%{newjavaver}%{ea_designator_zip}+%{buildver}%{lts_designator_zip}-docs.zip $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip
+  built_doc_archive=jdk-%{newjavaver}%{ea_designator_zip}+%{buildver}%{lts_designator_zip}-docs.zip
+  cp -a %{buildoutputdir -- $suffix}/bundles/${built_doc_archive} $RPM_BUILD_ROOT%{_javadocdir}/%{uniquejavadocdir -- $suffix}.zip
 fi
 
 # Install release notes
@@ -1842,6 +1977,28 @@ end
 -- run content of included file with fake args
 arg = {"--currentjvm", "%{uniquesuffix %{nil}}", "--jvmdir", "%{_jvmdir %{nil}}", "--origname", "%{name}", "--origjavaver", "%{javaver}", "--arch", "%{_arch}", "--temp", "%{rpm_state_dir}/%{name}.%{_arch}"}
 require "copy_jdk_configs.lua"
+-- the returns from copy_jdk_configs.lua should not affect this 'main', so it shodl run under all circumstances, except fatal error
+-- https://bugzilla.redhat.com/show_bug.cgi?id=1820172
+-- https://docs.fedoraproject.org/en-US/packaging-guidelines/Directory_Replacement/
+-- Define the path to directory being replaced below.
+-- DO NOT add a trailing slash at the end.
+path1 = "%{_jvmdir}/%{sdkdir -- %{nil}}/conf"
+path2 = "%{_jvmdir}/%{sdkdir -- %{nil}}/lib/security"
+array = {path1, path2}
+for index, path in pairs(array) do
+  st = posix.stat(path)
+  if st and st.type == "directory" then
+    status = os.rename(path, path .. ".rpmmoved")
+    if not status then
+      suffix = 0
+      while not status do
+        suffix = suffix + 1
+        status = os.rename(path .. ".rpmmoved", path .. ".rpmmoved." .. suffix)
+      end
+      os.rename(path, path .. ".rpmmoved")
+    end
+  end
+end
 
 %post
 %{post_script %{nil}}
@@ -1907,6 +2064,33 @@ require "copy_jdk_configs.lua"
 
 %endif
 
+%if %{include_fastdebug_build}
+%post fastdebug
+%{post_script -- %{fastdebug_suffix_unquoted}}
+
+%post headless-fastdebug
+%{post_headless -- %{fastdebug_suffix_unquoted}}
+
+%postun fastdebug
+%{postun_script -- %{fastdebug_suffix_unquoted}}
+
+%postun headless-fastdebug
+%{postun_headless -- %{fastdebug_suffix_unquoted}}
+
+%posttrans fastdebug
+%{posttrans_script -- %{fastdebug_suffix_unquoted}}
+
+%post devel-fastdebug
+%{post_devel -- %{fastdebug_suffix_unquoted}}
+
+%postun devel-fastdebug
+%{postun_devel -- %{fastdebug_suffix_unquoted}}
+
+%posttrans  devel-fastdebug
+%{posttrans_devel -- %{fastdebug_suffix_unquoted}}
+
+%endif
+
 %if %{include_normal_build}
 %files
 # main package builds always
@@ -1941,9 +2125,8 @@ require "copy_jdk_configs.lua"
 %files javadoc
 %{files_javadoc %{nil}}
 
-# this puts huge file to /usr/share
-# unluckily ti is really a documentation file
-# and unluckily it really is architecture-dependent, as eg. aot and grail are now x86_64 only
+# This puts a huge documentation file in /usr/share
+# It is now architecture-dependent, as eg. AOT and Graal are now x86_64 only
 # same for debug variant
 %files javadoc-zip
 %{files_javadoc_zip %{nil}}
@@ -1973,7 +2156,74 @@ require "copy_jdk_configs.lua"
 
 %endif
 
+%if %{include_fastdebug_build}
+%files fastdebug
+%{files_jre -- %{fastdebug_suffix_unquoted}}
+
+%files headless-fastdebug
+%{files_jre_headless -- %{fastdebug_suffix_unquoted}}
+
+%files devel-fastdebug
+%{files_devel -- %{fastdebug_suffix_unquoted}}
+
+%files static-libs-fastdebug
+%{files_static_libs -- %{fastdebug_suffix_unquoted}}
+
+%files jmods-fastdebug
+%{files_jmods -- %{fastdebug_suffix_unquoted}}
+
+%files demo-fastdebug
+%{files_demo -- %{fastdebug_suffix_unquoted}}
+
+%files src-fastdebug
+%{files_src -- %{fastdebug_suffix_unquoted}}
+
+%endif
+
 %changelog
+* Sat Jul 11 2020 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.10-1
+- Update to shenandoah-jdk-11.0.8+10 (GA)
+- Switch to GA mode for final release.
+- Update release notes with last minute fix (JDK-8248505).
+- Resolves: rhbz#1838811
+
+* Fri Jul 10 2020 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.9-0.1.ea
+- Update to shenandoah-jdk-11.0.8+9 (EA)
+- Update release notes for 11.0.8 release.
+- Resolves: rhbz#1838811
+
+* Tue Jun 30 2020 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.8-0.1.ea
+- Update to shenandoah-jdk-11.0.8+8 (EA)
+- Resolves: rhbz#1838811
+
+* Mon Jun 29 2020 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.7-0.4.ea
+- Add support for fastdebug builds on x86_64 only.
+- Resolves: rhbz#1836068
+
+* Sun Jun 28 2020 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.7-0.3.ea
+- Use RSA as default for keytool, as DSA is disabled in all crypto policies except LEGACY
+- Resolves: rhbz#1842572
+
+* Wed Jun 24 2020 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.7-0.2.ea
+- java-11-openjdk doesn't have a JRE tree, so don't try and copy alt-java there...
+- Resolves: rhbz#1838811
+
+* Wed Jun 24 2020 Jiri Vanek <jvanek@redhat.com> - 1:11.0.8.7-0.2.ea
+- Create a copy of java as alt-java with alternatives and man pages
+- Resolves: rhbz#1838811
+
+* Tue Jun 23 2020 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.7-0.1.ea
+- Update to shenandoah-jdk-11.0.8+7 (EA)
+- Resolves: rhbz#1838811
+
+* Mon Jun 22 2020 Jiri Vanek <jvanek@redhat.com> - 1:11.0.8.6-0.3.ea
+- Symlink hunk moved behind the main copy logic, to be more user-friendly with multiple installs
+- Resolves: rhbz#1820172
+
+* Mon Jun 22 2020 Jiri Vanek <jvanek@redhat.com> - 1:11.0.8.6-0.2.ea
+- Added scriplet to handle dir-> symling change when updating el7->el8
+- Resolves: rhbz#182017
+
 * Thu Jun 18 2020 Andrew Hughes <gnu.andrew@redhat.com> - 1:11.0.8.6-0.1.ea
 - Update to shenandoah-jdk-11.0.8+6 (EA)
 - Resolves: rhbz#1838811
@@ -2528,7 +2778,7 @@ require "copy_jdk_configs.lua"
 - renamed zip javadoc
 
 * Tue Apr 10 2018 Severin Gehwolf <sgehwolf@redhat.com> - 1:10.0.0.46-12
-- Enable basic EC ciphers test in %check.
+- Enable basic EC ciphers test in %%check.
 
 * Tue Apr 10 2018 Severin Gehwolf <sgehwolf@redhat.com> - 1:10.0.0.46-11
 - Port Martin Balao's JDK 9 patch for system NSS support to JDK 10.