New advisiory from Oracle:
https://www.oracle.com/security-alerts/alert-cve-2026-114820.html
https://ops.java/emudhra
So now in addition to blocking the eMudhra certs in blocked.certs
they need to be removed from cacerts as well. The new jdk-ca-certs
port can provide us with the cacerts but that's not easily back
ported to stable.
Before we switch to jdk-ca-certs, this diff takes a copy of the
updated jdk-cacerts and puts in ../files. This interrum step is
so that we have something that can be backported to -stable/.
Both my test program and CheckCerts from the emudra page above
pass with the below diff.
okay?
Index: 11/Makefile
===================================================================
RCS file: /cvs/ports/devel/jdk/11/Makefile,v
diff -u -p -u -r1.76 Makefile
--- 11/Makefile 22 Oct 2026 20:52:12 -0000 1.76
+++ 11/Makefile 26 Oct 2026 00:49:05 -0000
@@ -13,7 +13,7 @@ PKGNAME= jdk-${PACKAGE_VER}
PKGSTEM= jdk-11
EPOCH= 0
-REVISION= 3
+REVISION= 4
DIST_SUBDIR= jdk
DISTNAME= jdk-${VERSION_STR}
@@ -179,6 +179,7 @@ do-install:
${INSTALL_DATA_DIR} ${PREFIX}/${PKGSTEM}
cd ${IMAGEDIR} && tar -cf - * | tar -C ${PREFIX}/${PKGSTEM} -xf -
${INSTALL_DATA} ${JDKFILESDIR}/blocked.certs \
+ ${JDKFILESDIR}/cacerts \
${PREFIX}/${PKGSTEM}/lib/security/
# The bootjdk is the jdk image with some parts deleted
Index: 17/Makefile
===================================================================
RCS file: /cvs/ports/devel/jdk/17/Makefile,v
diff -u -p -u -r1.45 Makefile
--- 17/Makefile 22 Oct 2026 20:52:12 -0000 1.45
+++ 17/Makefile 26 Oct 2026 00:49:05 -0000
@@ -13,7 +13,7 @@ PKGNAME= jdk-${PACKAGE_VER}
PKGSTEM= jdk-17
EPOCH= 0
-REVISION= 1
+REVISION= 2
DIST_SUBDIR= jdk
DISTNAME= jdk-${VERSION_STR}
@@ -160,6 +160,7 @@ do-install:
${INSTALL_DATA_DIR} ${PREFIX}/${PKGSTEM}
cd ${IMAGEDIR} && tar -cf - * | tar -C ${PREFIX}/${PKGSTEM} -xf -
${INSTALL_DATA} ${JDKFILESDIR}/blocked.certs \
+ ${JDKFILESDIR}/cacerts \
${PREFIX}/${PKGSTEM}/lib/security/
# The bootjdk is the jdk image with some parts deleted
Index: 21/Makefile
===================================================================
RCS file: /cvs/ports/devel/jdk/21/Makefile,v
diff -u -p -u -r1.20 Makefile
--- 21/Makefile 22 Oct 2026 20:52:12 -0000 1.20
+++ 21/Makefile 26 Oct 2026 00:49:05 -0000
@@ -13,7 +13,7 @@ PKGNAME= jdk-${PACKAGE_VER}
PKGSTEM= jdk-21
EPOCH= 0
-REVISION= 1
+REVISION= 2
DIST_SUBDIR= jdk
DISTNAME= jdk-${VERSION_STR}
@@ -160,6 +160,7 @@ do-install:
${INSTALL_DATA_DIR} ${PREFIX}/${PKGSTEM}
cd ${IMAGEDIR} && tar -cf - * | tar -C ${PREFIX}/${PKGSTEM} -xf -
${INSTALL_DATA} ${JDKFILESDIR}/blocked.certs \
+ ${JDKFILESDIR}/cacerts \
${PREFIX}/${PKGSTEM}/lib/security/
# The bootjdk is the jdk image with some parts deleted
Index: 25/Makefile
===================================================================
RCS file: /cvs/ports/devel/jdk/25/Makefile,v
diff -u -p -u -r1.13 Makefile
--- 25/Makefile 22 Oct 2026 20:52:12 -0000 1.13
+++ 25/Makefile 26 Oct 2026 00:49:05 -0000
@@ -13,7 +13,7 @@ PKGNAME= jdk-${PACKAGE_VER}
PKGSTEM= jdk-25
EPOCH= 0
-REVISION= 1
+REVISION= 2
DIST_SUBDIR= jdk
DISTNAME= jdk-${VERSION_STR}
@@ -157,6 +157,7 @@ do-install:
${INSTALL_DATA_DIR} ${PREFIX}/${PKGSTEM}
cd ${IMAGEDIR} && tar -cf - * | tar -C ${PREFIX}/${PKGSTEM} -xf -
${INSTALL_DATA} ${JDKFILESDIR}/blocked.certs \
+ ${JDKFILESDIR}/cacerts \
${PREFIX}/${PKGSTEM}/lib/security/
# The bootjdk is the jdk image with some parts deleted
Index: files/cacerts
===================================================================
RCS file: files/cacerts
diff -N files/cacerts
Binary files /dev/null and cacerts differ
