--- a/ChangeLog	Thu Jul 28 03:55:52 2016 +0100
+++ b/ChangeLog	Thu Jul 28 16:04:20 2016 +0100
@@ -1,3 +1,17 @@
+2016-07-28  Andrew John Hughes  <gnu.andrew@member.fsf.org>
+
+	S7175845, PR1437, RH1207129: 'jar uf' changes file
+	permissions unexpectedly
+	* Makefile.am:
+	(icedtea): Correct permissions of sa-jdi.jar and
+	resources.jar if PR1437 was present in the bootstrap
+	JDK.
+	(icedtea-debug): Likewise.
+	(icedtea-boot): Likewise.
+	* acinclude.m4:
+	(IT_FIND_JAR): Check for PR1437 in the bootstrap
+	jar program and define PR1437_PRESENT if it exhibits.
+
 2016-04-23  Andrew John Hughes  <gnu_andrew@member.fsf.org>
 
 	PR2900: Don't use WithSeed versions of NSS

--- a/Makefile.am	Thu Jul 28 03:55:52 2016 +0100
+++ b/Makefile.am	Thu Jul 28 16:04:20 2016 +0100
@@ -2050,6 +2050,14 @@
 if ENABLE_JAMVM
 	printf -- '-jamvm ALIASED_TO -server\n' >> $(BUILD_JRE_ARCH_DIR)/jvm.cfg
 endif
+# Fix permissions on JARs updated during build if PR1437 bug is present
+if PR1437_PRESENT
+	if [ -e $(BUILD_SDK_DIR)/lib/sa-jdi.jar ] ; then \
+	  chmod g+r,o+r $(BUILD_SDK_DIR)/lib/sa-jdi.jar ; \
+	fi
+	chmod g+r,o+r $(BUILD_JRE_DIR)/lib/resources.jar
+	chmod g+r,o+r $(BUILD_SDK_DIR)/jre/lib/resources.jar
+endif
 	@echo "IcedTea is served:" $(BUILD_SDK_DIR)
 	mkdir -p stamps
 	touch $@
@@ -2194,6 +2202,14 @@
 if ENABLE_JAMVM
 	printf -- '-jamvm ALIASED_TO -server\n' >> $(BUILD_DEBUG_JRE_ARCH_DIR)/jvm.cfg
 endif
+# Fix permissions on JARs updated during build if PR1437 bug is present
+if PR1437_PRESENT
+	if [ -e $(BUILD_DEBUG_SDK_DIR)/lib/sa-jdi.jar ] ; then \
+	  chmod g+r,o+r $(BUILD_DEBUG_SDK_DIR)/lib/sa-jdi.jar ; \
+	fi
+	chmod g+r,o+r $(BUILD_DEBUG_JRE_DIR)/lib/resources.jar
+	chmod g+r,o+r $(BUILD_DEBUG_SDK_DIR)/jre/lib/resources.jar
+endif
 	@echo "IcedTea (debug build) is served:" $(BUILD_DEBUG_SDK_DIR)
 	mkdir -p stamps
 	touch $@
@@ -2344,6 +2360,14 @@
 	  -C openjdk-boot \
 	  $(ICEDTEA_BUILD_TARGET)
 	$(abs_top_builddir)/pax-mark-vm $(BUILD_BOOT_SDK_DIR)
+# Fix permissions on JARs updated during build if PR1437 bug is present
+if PR1437_PRESENT
+	if [ -e $(BUILD_BOOT_SDK_DIR)/lib/sa-jdi.jar ] ; then \
+	  chmod g+r,o+r $(BUILD_BOOT_SDK_DIR)/lib/sa-jdi.jar ; \
+	fi
+	chmod g+r,o+r $(BUILD_BOOT_JRE_DIR)/lib/resources.jar
+	chmod g+r,o+r $(BUILD_BOOT_SDK_DIR)/jre/lib/resources.jar
+endif
 	@echo "Bootstrapped IcedTea is served:" $(BUILD_BOOT_SDK_DIR)
 	mkdir -p stamps
 	touch $@

--- a/acinclude.m4	Thu Jul 28 03:55:52 2016 +0100
+++ b/acinclude.m4	Thu Jul 28 16:04:20 2016 +0100
@@ -475,11 +475,25 @@
     JAR_KNOWS_J_OPTIONS=
     AC_MSG_RESULT(no)
   fi
-  rm -f _config.txt _config.jar
+  AC_MSG_CHECKING([whether jar uf fails to retain permissions (PR1437)])
+  origperms=$(ls -l _config.jar | cut -d ' ' -f 1)
+  echo "Original permissions: ${origperms}" >&AS_MESSAGE_LOG_FD
+  touch _config2.txt
+  $JAR uf _config.jar _config2.txt >&AS_MESSAGE_LOG_FD 2>&1
+  newperms=$(ls -l _config.jar | cut -d ' ' -f 1)
+  echo "New permissions: ${newperms}" >&AS_MESSAGE_LOG_FD
+  if test "x$origperms" != "x$newperms"; then
+    pr1437_present=yes
+  else
+    pr1437_present=no
+  fi
+  AC_MSG_RESULT([$pr1437_present])
+  rm -f _config.txt _config2.txt _config.jar
   AC_SUBST(JAR)
   AC_SUBST(JAR_KNOWS_ATFILE)
   AC_SUBST(JAR_ACCEPTS_STDIN_LIST)
   AC_SUBST(JAR_KNOWS_J_OPTIONS)
+  AM_CONDITIONAL(PR1437_PRESENT, test "x${pr1437_present}" = "xyes")
 ])
 
 AC_DEFUN([IT_FIND_RMIC],