Taking feedback on the prior diff into account, start using jdk-ca-certs to address the latest CVE-2026-114820. The OpenJDK x.x.x.0.3 releases are not avaiable yet so this addresses it in advance. These pass both my EmudhraCheck and CheckCerts from:
https://ops.java/emudhra ok? Index: 11/Makefile =================================================================== RCS file: /cvs/ports/devel/jdk/11/Makefile,v diff -u -p -u -r1.76 Makefile --- 11/Makefile 22 Oct 2026 20:52:12 -0000 1.76 +++ 11/Makefile 26 Oct 2026 13:06:46 -0000 @@ -13,7 +13,7 @@ PKGNAME= jdk-${PACKAGE_VER} PKGSTEM= jdk-11 EPOCH= 0 -REVISION= 3 +REVISION= 4 DIST_SUBDIR= jdk DISTNAME= jdk-${VERSION_STR} @@ -86,6 +86,8 @@ LIB_DEPENDS= converters/libiconv \ graphics/png \ graphics/giflib +RUN_DEPENDS= security/jdk-ca-certs + USE_GMAKE= Yes GMAKE= ${LOCALBASE}/bin/gmake @@ -180,6 +182,8 @@ do-install: cd ${IMAGEDIR} && tar -cf - * | tar -C ${PREFIX}/${PKGSTEM} -xf - ${INSTALL_DATA} ${JDKFILESDIR}/blocked.certs \ ${PREFIX}/${PKGSTEM}/lib/security/ + ln -fs ${SYSCONFDIR}/ssl/jdk-cacerts \ + ${PREFIX}/${PKGSTEM}/lib/security/cacerts # The bootjdk is the jdk image with some parts deleted # and a copy of the system shared libs needed to run it. Index: 17/Makefile =================================================================== RCS file: /cvs/ports/devel/jdk/17/Makefile,v diff -u -p -u -r1.45 Makefile --- 17/Makefile 22 Oct 2026 20:52:12 -0000 1.45 +++ 17/Makefile 26 Oct 2026 13:06:46 -0000 @@ -13,7 +13,7 @@ PKGNAME= jdk-${PACKAGE_VER} PKGSTEM= jdk-17 EPOCH= 0 -REVISION= 1 +REVISION= 2 DIST_SUBDIR= jdk DISTNAME= jdk-${VERSION_STR} @@ -84,6 +84,8 @@ LIB_DEPENDS= converters/libiconv \ graphics/png \ graphics/giflib +RUN_DEPENDS= security/jdk-ca-certs + USE_GMAKE= Yes GMAKE= ${LOCALBASE}/bin/gmake @@ -161,6 +163,8 @@ do-install: cd ${IMAGEDIR} && tar -cf - * | tar -C ${PREFIX}/${PKGSTEM} -xf - ${INSTALL_DATA} ${JDKFILESDIR}/blocked.certs \ ${PREFIX}/${PKGSTEM}/lib/security/ + ln -fs ${SYSCONFDIR}/ssl/jdk-cacerts \ + ${PREFIX}/${PKGSTEM}/lib/security/cacerts # The bootjdk is the jdk image with some parts deleted # and a copy of the system shared libs needed to run it. Index: 21/Makefile =================================================================== RCS file: /cvs/ports/devel/jdk/21/Makefile,v diff -u -p -u -r1.20 Makefile --- 21/Makefile 22 Oct 2026 20:52:12 -0000 1.20 +++ 21/Makefile 26 Oct 2026 13:06:46 -0000 @@ -13,7 +13,7 @@ PKGNAME= jdk-${PACKAGE_VER} PKGSTEM= jdk-21 EPOCH= 0 -REVISION= 1 +REVISION= 2 DIST_SUBDIR= jdk DISTNAME= jdk-${VERSION_STR} @@ -84,6 +84,8 @@ LIB_DEPENDS= converters/libiconv \ graphics/png \ graphics/giflib +RUN_DEPENDS= security/jdk-ca-certs + USE_GMAKE= Yes GMAKE= ${LOCALBASE}/bin/gmake @@ -161,6 +163,8 @@ do-install: cd ${IMAGEDIR} && tar -cf - * | tar -C ${PREFIX}/${PKGSTEM} -xf - ${INSTALL_DATA} ${JDKFILESDIR}/blocked.certs \ ${PREFIX}/${PKGSTEM}/lib/security/ + ln -fs ${SYSCONFDIR}/ssl/jdk-cacerts \ + ${PREFIX}/${PKGSTEM}/lib/security/cacerts # The bootjdk is the jdk image with some parts deleted # and a copy of the system shared libs needed to run it. Index: 25/Makefile =================================================================== RCS file: /cvs/ports/devel/jdk/25/Makefile,v diff -u -p -u -r1.13 Makefile --- 25/Makefile 22 Oct 2026 20:52:12 -0000 1.13 +++ 25/Makefile 26 Oct 2026 13:06:46 -0000 @@ -13,7 +13,7 @@ PKGNAME= jdk-${PACKAGE_VER} PKGSTEM= jdk-25 EPOCH= 0 -REVISION= 1 +REVISION= 2 DIST_SUBDIR= jdk DISTNAME= jdk-${VERSION_STR} @@ -84,6 +84,8 @@ LIB_DEPENDS= converters/libiconv \ graphics/png \ graphics/giflib +RUN_DEPENDS= security/jdk-ca-certs + USE_GMAKE= Yes GMAKE= ${LOCALBASE}/bin/gmake @@ -158,6 +160,8 @@ do-install: cd ${IMAGEDIR} && tar -cf - * | tar -C ${PREFIX}/${PKGSTEM} -xf - ${INSTALL_DATA} ${JDKFILESDIR}/blocked.certs \ ${PREFIX}/${PKGSTEM}/lib/security/ + ln -fs ${SYSCONFDIR}/ssl/jdk-cacerts \ + ${PREFIX}/${PKGSTEM}/lib/security/cacerts # The bootjdk is the jdk image with some parts deleted # and a copy of the system shared libs needed to run it.
