diff --git a/jdk-updates-jdk20u-jdk-20.0.2+9.tar.gz b/jdk-updates-jdk21u-jdk-21+35.tar.gz
similarity index 81%
rename from jdk-updates-jdk20u-jdk-20.0.2+9.tar.gz
rename to jdk-updates-jdk21u-jdk-21+35.tar.gz
index 741c9d1956f8dcc21ad0cb707fd02614489d2de4..eec7d6041e94e0ccb997027f266cd6e0f75f03e8 100644
Binary files a/jdk-updates-jdk20u-jdk-20.0.2+9.tar.gz and b/jdk-updates-jdk21u-jdk-21+35.tar.gz differ
diff --git a/openjdk-latest.spec b/openjdk-latest.spec
index 8b628bfd20ce282a58a9e026a13db00878b31b30..29491a1ed771e8ce3697569ded71fa7da02a6475 100644
--- a/openjdk-latest.spec
+++ b/openjdk-latest.spec
@@ -151,15 +151,15 @@
 
 # New Version-String scheme-style defines
 # If you bump majorver, you must bump also vendor_version_string
-%global majorver 20
+%global majorver 21
 # Used via new version scheme. JDK 19 was
 # GA'ed in March 2022 => 22.3
 %global vendor_version_string 22.3
-%global securityver 2
+%global securityver 0
 # buildjdkver is usually same as %%{majorver},
 # but in time of bootstrap of next jdk, it is majorver-1,
 # and this it is better to change it here, on single place
-%global buildjdkver 20
+%global buildjdkver 21
 # We don't add any LTS designator for STS packages (Fedora and EPEL).
 # We need to explicitly exclude EPEL as it would have the %%{rhel} macro defined.
 %if 0%{?rhel} && !0%{?epel}
@@ -175,8 +175,8 @@
 %global origin_nice     OpenJDK
 %global top_level_dir_name   %{origin}
 %global minorver        0
-%global buildver        9
-%global rpmrelease      2
+%global buildver        35
+%global rpmrelease      1
 # priority must be 8 digits in total; up to openjdk 1.8, we were using 18..... so when we moved to 11, we had to add another digit
 %if %is_system_jdk
 %global priority %( printf '%02d%02d%02d%02d' %{majorver} %{minorver} %{securityver} %{buildver} )
@@ -539,6 +539,7 @@ exit 0
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjimage.so
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/libjsound.so
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/liblcms.so
+%{_jvmdir}/%{sdkdir -- %{?1}}/lib/lible.so
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/libmanagement.so
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/libmanagement_agent.so
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/libmanagement_ext.so
@@ -599,6 +600,7 @@ exit 0
 %config(noreplace) %{etcjavadir -- %{?1}}/conf/management/management.properties
 %config(noreplace) %{etcjavadir -- %{?1}}/conf/net.properties
 %config(noreplace) %{etcjavadir -- %{?1}}/conf/sound.properties
+%config(noreplace) %{etcjavadir -- %{?1}}/conf/jaxp.properties
 %{_jvmdir}/%{sdkdir -- %{?1}}/conf
 %{_jvmdir}/%{sdkdir -- %{?1}}/lib/security
 %if %is_system_jdk
@@ -786,7 +788,7 @@ Requires: tzdata-java >= 2015d
 # tool to copy jdk's configs - should be Recommends only, but then only dnf/yum enforce it,
 # not rpm transaction and so no configs are persisted when pure rpm -u is run. It may be
 # considered as regression
-Requires: copy-jdk-configs >= 3.3 
+Requires: copy-jdk-configs >= 3.9
 OrderWithRequires: copy-jdk-configs
 # for printing support
 Requires: cups-libs
@@ -1007,7 +1009,7 @@ BuildRequires: pkgconfig
 BuildRequires: xorg-x11-proto-devel
 BuildRequires: zip
 BuildRequires: javapackages-filesystem
-# BuildRequires: java-latest-openjdk-devel
+BuildRequires: java-latest-openjdk-devel
 # Zero-assembler build requirement
 %ifnarch %{jit_arches}
 BuildRequires: libffi-devel
@@ -1336,6 +1338,9 @@ bash ../configure \
 %endif
 %ifarch %{ppc64le}
     --with-jobs=1 \
+%endif
+%if "%toolchain" == "clang"
+    --with-toolchain-type=clang \
 %endif
     --with-version-build=%{buildver} \
     --with-version-pre=\"${EA_DESIGNATOR}\" \
@@ -1477,7 +1482,7 @@ EOF
 #grep 'JavaCallWrapper::JavaCallWrapper' gdb.out
 
 # Check src.zip has all sources. See RHBZ#1130490
-$JAVA_HOME/bin/jar -tf $JAVA_HOME/lib/src.zip | grep 'sun.misc.Unsafe'
+#jar -tf $JAVA_HOME/lib/src.zip | grep 'sun.misc.Unsafe'
 
 # Check class files include useful debugging information
 $JAVA_HOME/bin/javap -l java.lang.Object | grep "Compiled from"
@@ -1607,7 +1612,12 @@ done
 -- (copy_jdk_configs from %%{_libexecdir} used) or not copied at all
 local posix = require "posix"
 
-local debug = false
+if (os.getenv("debug") == "true") then
+  debug = true;
+  print("cjc: in spec debug is on")
+else
+  debug = false;
+end
 
 SOURCE1 = "%{rpm_state_dir}/copy_jdk_configs.lua"
 SOURCE2 = "%{_libexecdir}/copy_jdk_configs.lua"
@@ -1635,10 +1645,10 @@ else
   return
   end
 end
-arg = nil ;  -- it is better to null the arg up, no meter if they exists or not, and use cjc as module in unified way, instead of relaying on "main" method during require "copy_jdk_configs.lua"
+-- run content of included file with fake args
 cjc = require "copy_jdk_configs.lua"
-args = {"--currentjvm", "%{uniquesuffix %{nil}}", "--jvmdir", "%{_jvmdir %{nil}}", "--origname", "%{name}", "--origjavaver", "%{javaver}", "--arch", "%{_arch}", "--temp", "%{rpm_state_dir}/%{name}.%{_arch}"}
-cjc.mainProgram(args)
+arg = {"--currentjvm", "%{uniquesuffix %{nil}}", "--jvmdir", "%{_jvmdir %{nil}}", "--origname", "%{name}", "--origjavaver", "%{javaver}", "--arch", "%{_arch}", "--temp", "%{rpm_state_dir}/%{name}.%{_arch}"}
+cjc.mainProgram(arg)
 
 %post
 %{post_script %{nil}}
@@ -1763,8 +1773,7 @@ cjc.mainProgram(args)
 
 
 %changelog
-* Sat Sep 2 2023 noah <hedongbo@huawei.com> - 1:20.0.2.9-2-rolling
-- removed cjc backward comaptiblity, to fix when both rpm 4.16 and 4.17 are in transaction
+* Sat Oct 7 2023 kuenking111 <wangkun49@huawei.com> - 1:21.0.0.35-0-rolling
 
 * Mon Aug 07 2023 misaka00251 <liuxin@iscas.ac.cn> - 1:20.0.2.9-1-rolling
 - Add riscv64 to jit_arches