On Fri, 23 Oct 2026 17:51:28 +0200, Kurt Miller <[email protected]> wrote: > > [1 <text/plain; utf-8 (quoted-printable)>] > On Oct 23, 2026, at 11:48 AM, Kurt Miller <[email protected]> wrote: > > > > The recent eMudhra compromised certificates issue spurred some > > discussion regarding if the jdk's could share a common cacerts > > file that was built from our /usr/src/lib/libcrypto/cert.pem. > > > > The attached port implements that idea. So that the src tree > > is not required to build this, a copy of > > /usr/src/lib/libcrypto/cert.pem is kept in the files dir and > > requires updating when the file changes in the src tree. > > > > The jdk's then make use of /etc/ssl/jdk-cacerts by symlinking > > to it and having security/jdk-ca-certs as a RUN_DEPEND. > > > > Using /etc/ssl/jdk-cacerts is sufficient to block the use of the > > eMudhra certificates. However, consider the below changes to the > > jdks as WIP. I would combine the use of the common jdk-cacerts with > > the forthcoming updates to the jdk's which include the eMudhra > > certificates in the blocked.certs file. For now I'm looking for > > discussion/review on the approach and if good ok on the > > jdk-ca-certs port. > > And the attachment. > > [2 jdk-ca-certs.tar.gz <application/x-gzip (base64)>]
Briefly tested with updated jdk-25. Works as advertiesd / expected. OK kirill@ -- wbr, Kirill
