The recent eMudhra compromised certificates issue spurred some
discussion regarding if the jdk's could share a common cacerts
file that was built from our /usr/src/lib/libcrypto/cert.pem.
The attached port implements that idea. So that the src tree
is not required to build this, a copy of
/usr/src/lib/libcrypto/cert.pem is kept in the files dir and
requires updating when the file changes in the src tree.
The jdk's then make use of /etc/ssl/jdk-cacerts by symlinking
to it and having security/jdk-ca-certs as a RUN_DEPEND.
Using /etc/ssl/jdk-cacerts is sufficient to block the use of the
eMudhra certificates. However, consider the below changes to the
jdks as WIP. I would combine the use of the common jdk-cacerts with
the forthcoming updates to the jdk's which include the eMudhra
certificates in the blocked.certs file. For now I'm looking for
discussion/review on the approach and if good ok on the
jdk-ca-certs port.
Index: 11/Makefile
===================================================================
RCS file: /cvs/ports/devel/jdk/11/Makefile,v
diff -u -p -u -r1.76 Makefile
--- 11/Makefile 22 Oct 2026 20:52:12 -0000 1.76
+++ 11/Makefile 23 Oct 2026 15:38:27 -0000
@@ -13,7 +13,7 @@ PKGNAME= jdk-${PACKAGE_VER}
PKGSTEM= jdk-11
EPOCH= 0
-REVISION= 3
+REVISION= 4
DIST_SUBDIR= jdk
DISTNAME= jdk-${VERSION_STR}
@@ -86,6 +86,8 @@ LIB_DEPENDS= converters/libiconv \
graphics/png \
graphics/giflib
+RUN_DEPENDS= security/jdk-ca-certs
+
USE_GMAKE= Yes
GMAKE= ${LOCALBASE}/bin/gmake
@@ -157,7 +159,6 @@ JVMARCH= ${MACHINE_ARCH:S/i386/x86/:S/am
BUILDDIR= ${WRKDIST}/build/bsd-${JVMARCH}-normal-server-release
IMAGEDIR= ${BUILDDIR}/images/jdk
WRKTMP= ${WRKDIR}/tmp
-JDKFILESDIR= ${.CURDIR}/../files
post-extract:
sed -i "s|#!/bin/bash|#!\${LOCALBASE}/bin/bash|" ${WRKDIST}/configure
@@ -176,10 +177,13 @@ post-build:
.endif
do-install:
- ${INSTALL_DATA_DIR} ${PREFIX}/${PKGSTEM}
+ ${INSTALL_DATA_DIR} ${PREFIX}/${PKGSTEM} \
+ ${WRKINST}/${SYSCONFDIR}/ssl
cd ${IMAGEDIR} && tar -cf - * | tar -C ${PREFIX}/${PKGSTEM} -xf -
- ${INSTALL_DATA} ${JDKFILESDIR}/blocked.certs \
- ${PREFIX}/${PKGSTEM}/lib/security/
+ touch ${WRKINST}/${SYSCONFDIR}/ssl/jdk-cacerts
+ rm ${PREFIX}/${PKGSTEM}/lib/security/cacerts
+ ln -s ${SYSCONFDIR}/ssl/jdk-cacerts \
+ ${PREFIX}/${PKGSTEM}/lib/security/cacerts
# The bootjdk is the jdk image with some parts deleted
# and a copy of the system shared libs needed to run it.
Index: 17/Makefile
===================================================================
RCS file: /cvs/ports/devel/jdk/17/Makefile,v
diff -u -p -u -r1.45 Makefile
--- 17/Makefile 22 Oct 2026 20:52:12 -0000 1.45
+++ 17/Makefile 23 Oct 2026 15:38:27 -0000
@@ -13,7 +13,7 @@ PKGNAME= jdk-${PACKAGE_VER}
PKGSTEM= jdk-17
EPOCH= 0
-REVISION= 1
+REVISION= 2
DIST_SUBDIR= jdk
DISTNAME= jdk-${VERSION_STR}
@@ -84,6 +84,8 @@ LIB_DEPENDS= converters/libiconv \
graphics/png \
graphics/giflib
+RUN_DEPENDS= security/jdk-ca-certs
+
USE_GMAKE= Yes
GMAKE= ${LOCALBASE}/bin/gmake
@@ -138,7 +140,6 @@ JVMARCH= ${MACHINE_ARCH:S/i386/x86/:S/am
BUILDDIR= ${WRKDIST}/build/bsd-${JVMARCH}-server-release
IMAGEDIR= ${BUILDDIR}/images/jdk
WRKTMP= ${WRKDIR}/tmp
-JDKFILESDIR= ${.CURDIR}/../files
post-extract:
sed -i "s|#!/bin/bash|#!\${LOCALBASE}/bin/bash|" ${WRKDIST}/configure
@@ -157,10 +158,13 @@ post-build:
.endif
do-install:
- ${INSTALL_DATA_DIR} ${PREFIX}/${PKGSTEM}
+ ${INSTALL_DATA_DIR} ${PREFIX}/${PKGSTEM} \
+ ${WRKINST}/${SYSCONFDIR}/ssl
cd ${IMAGEDIR} && tar -cf - * | tar -C ${PREFIX}/${PKGSTEM} -xf -
- ${INSTALL_DATA} ${JDKFILESDIR}/blocked.certs \
- ${PREFIX}/${PKGSTEM}/lib/security/
+ touch ${WRKINST}/${SYSCONFDIR}/ssl/jdk-cacerts
+ rm ${PREFIX}/${PKGSTEM}/lib/security/cacerts
+ ln -s ${SYSCONFDIR}/ssl/jdk-cacerts \
+ ${PREFIX}/${PKGSTEM}/lib/security/cacerts
# The bootjdk is the jdk image with some parts deleted
# and a copy of the system shared libs needed to run it.
Index: 21/Makefile
===================================================================
RCS file: /cvs/ports/devel/jdk/21/Makefile,v
diff -u -p -u -r1.20 Makefile
--- 21/Makefile 22 Oct 2026 20:52:12 -0000 1.20
+++ 21/Makefile 23 Oct 2026 15:38:27 -0000
@@ -13,7 +13,7 @@ PKGNAME= jdk-${PACKAGE_VER}
PKGSTEM= jdk-21
EPOCH= 0
-REVISION= 1
+REVISION= 2
DIST_SUBDIR= jdk
DISTNAME= jdk-${VERSION_STR}
@@ -84,6 +84,8 @@ LIB_DEPENDS= converters/libiconv \
graphics/png \
graphics/giflib
+RUN_DEPENDS= security/jdk-ca-certs
+
USE_GMAKE= Yes
GMAKE= ${LOCALBASE}/bin/gmake
@@ -138,7 +140,6 @@ JVMARCH= ${MACHINE_ARCH:S/i386/x86/:S/am
BUILDDIR= ${WRKDIST}/build/bsd-${JVMARCH}-server-release
IMAGEDIR= ${BUILDDIR}/images/jdk
WRKTMP= ${WRKDIR}/tmp
-JDKFILESDIR= ${.CURDIR}/../files
post-extract:
sed -i "s|#!/bin/bash|#!\${LOCALBASE}/bin/bash|" ${WRKDIST}/configure
@@ -157,10 +158,13 @@ post-build:
.endif
do-install:
- ${INSTALL_DATA_DIR} ${PREFIX}/${PKGSTEM}
+ ${INSTALL_DATA_DIR} ${PREFIX}/${PKGSTEM} \
+ ${WRKINST}/${SYSCONFDIR}/ssl
cd ${IMAGEDIR} && tar -cf - * | tar -C ${PREFIX}/${PKGSTEM} -xf -
- ${INSTALL_DATA} ${JDKFILESDIR}/blocked.certs \
- ${PREFIX}/${PKGSTEM}/lib/security/
+ touch ${WRKINST}/${SYSCONFDIR}/ssl/jdk-cacerts
+ rm ${PREFIX}/${PKGSTEM}/lib/security/cacerts
+ ln -s ${SYSCONFDIR}/ssl/jdk-cacerts \
+ ${PREFIX}/${PKGSTEM}/lib/security/cacerts
# The bootjdk is the jdk image with some parts deleted
# and a copy of the system shared libs needed to run it.
Index: 25/Makefile
===================================================================
RCS file: /cvs/ports/devel/jdk/25/Makefile,v
diff -u -p -u -r1.13 Makefile
--- 25/Makefile 22 Oct 2026 20:52:12 -0000 1.13
+++ 25/Makefile 23 Oct 2026 15:38:27 -0000
@@ -13,7 +13,7 @@ PKGNAME= jdk-${PACKAGE_VER}
PKGSTEM= jdk-25
EPOCH= 0
-REVISION= 1
+REVISION= 2
DIST_SUBDIR= jdk
DISTNAME= jdk-${VERSION_STR}
@@ -84,6 +84,8 @@ LIB_DEPENDS= converters/libiconv \
graphics/png \
graphics/giflib
+RUN_DEPENDS= security/jdk-ca-certs
+
USE_GMAKE= Yes
GMAKE= ${LOCALBASE}/bin/gmake
@@ -133,7 +135,6 @@ JVMARCH= ${MACHINE_ARCH:S/amd64/x86_64/}
BUILDDIR= ${WRKDIST}/build/bsd-${JVMARCH}-server-release
IMAGEDIR= ${BUILDDIR}/images/jdk
WRKTMP= ${WRKDIR}/tmp
-JDKFILESDIR= ${.CURDIR}/../files
post-extract:
sed -i "s|#!/bin/bash|#!\${LOCALBASE}/bin/bash|" ${WRKDIST}/configure
@@ -154,10 +155,13 @@ post-build:
.endif
do-install:
- ${INSTALL_DATA_DIR} ${PREFIX}/${PKGSTEM}
+ ${INSTALL_DATA_DIR} ${PREFIX}/${PKGSTEM} \
+ ${WRKINST}/${SYSCONFDIR}/ssl
cd ${IMAGEDIR} && tar -cf - * | tar -C ${PREFIX}/${PKGSTEM} -xf -
- ${INSTALL_DATA} ${JDKFILESDIR}/blocked.certs \
- ${PREFIX}/${PKGSTEM}/lib/security/
+ touch ${WRKINST}/${SYSCONFDIR}/ssl/jdk-cacerts
+ rm ${PREFIX}/${PKGSTEM}/lib/security/cacerts
+ ln -s ${SYSCONFDIR}/ssl/jdk-cacerts \
+ ${PREFIX}/${PKGSTEM}/lib/security/cacerts
# The bootjdk is the jdk image with some parts deleted
# and a copy of the system shared libs needed to run it.
