ok
On 2026/10/26 13:15, Kurt Miller wrote:
> Taking feedback on the prior diff into account, start using jdk-ca-certs
> to address the latest CVE-2026-114820. The OpenJDK x.x.x.0.3 releases
> are not avaiable yet so this addresses it in advance. These pass both
> my EmudhraCheck and CheckCerts from:
>
> https://ops.java/emudhra
>
> ok?
>
> Index: 11/Makefile
> ===================================================================
> RCS file: /cvs/ports/devel/jdk/11/Makefile,v
> diff -u -p -u -r1.76 Makefile
> --- 11/Makefile 22 Oct 2026 20:52:12 -0000 1.76
> +++ 11/Makefile 26 Oct 2026 13:06:46 -0000
> @@ -13,7 +13,7 @@ PKGNAME= jdk-${PACKAGE_VER}
> PKGSTEM= jdk-11
> EPOCH= 0
>
> -REVISION= 3
> +REVISION= 4
>
> DIST_SUBDIR= jdk
> DISTNAME= jdk-${VERSION_STR}
> @@ -86,6 +86,8 @@ LIB_DEPENDS= converters/libiconv \
> graphics/png \
> graphics/giflib
>
> +RUN_DEPENDS= security/jdk-ca-certs
> +
> USE_GMAKE= Yes
> GMAKE= ${LOCALBASE}/bin/gmake
>
> @@ -180,6 +182,8 @@ do-install:
> cd ${IMAGEDIR} && tar -cf - * | tar -C ${PREFIX}/${PKGSTEM} -xf -
> ${INSTALL_DATA} ${JDKFILESDIR}/blocked.certs \
> ${PREFIX}/${PKGSTEM}/lib/security/
> + ln -fs ${SYSCONFDIR}/ssl/jdk-cacerts \
> + ${PREFIX}/${PKGSTEM}/lib/security/cacerts
>
> # The bootjdk is the jdk image with some parts deleted
> # and a copy of the system shared libs needed to run it.
> Index: 17/Makefile
> ===================================================================
> RCS file: /cvs/ports/devel/jdk/17/Makefile,v
> diff -u -p -u -r1.45 Makefile
> --- 17/Makefile 22 Oct 2026 20:52:12 -0000 1.45
> +++ 17/Makefile 26 Oct 2026 13:06:46 -0000
> @@ -13,7 +13,7 @@ PKGNAME= jdk-${PACKAGE_VER}
> PKGSTEM= jdk-17
> EPOCH= 0
>
> -REVISION= 1
> +REVISION= 2
>
> DIST_SUBDIR= jdk
> DISTNAME= jdk-${VERSION_STR}
> @@ -84,6 +84,8 @@ LIB_DEPENDS= converters/libiconv \
> graphics/png \
> graphics/giflib
>
> +RUN_DEPENDS= security/jdk-ca-certs
> +
> USE_GMAKE= Yes
> GMAKE= ${LOCALBASE}/bin/gmake
>
> @@ -161,6 +163,8 @@ do-install:
> cd ${IMAGEDIR} && tar -cf - * | tar -C ${PREFIX}/${PKGSTEM} -xf -
> ${INSTALL_DATA} ${JDKFILESDIR}/blocked.certs \
> ${PREFIX}/${PKGSTEM}/lib/security/
> + ln -fs ${SYSCONFDIR}/ssl/jdk-cacerts \
> + ${PREFIX}/${PKGSTEM}/lib/security/cacerts
>
> # The bootjdk is the jdk image with some parts deleted
> # and a copy of the system shared libs needed to run it.
> Index: 21/Makefile
> ===================================================================
> RCS file: /cvs/ports/devel/jdk/21/Makefile,v
> diff -u -p -u -r1.20 Makefile
> --- 21/Makefile 22 Oct 2026 20:52:12 -0000 1.20
> +++ 21/Makefile 26 Oct 2026 13:06:46 -0000
> @@ -13,7 +13,7 @@ PKGNAME= jdk-${PACKAGE_VER}
> PKGSTEM= jdk-21
> EPOCH= 0
>
> -REVISION= 1
> +REVISION= 2
>
> DIST_SUBDIR= jdk
> DISTNAME= jdk-${VERSION_STR}
> @@ -84,6 +84,8 @@ LIB_DEPENDS= converters/libiconv \
> graphics/png \
> graphics/giflib
>
> +RUN_DEPENDS= security/jdk-ca-certs
> +
> USE_GMAKE= Yes
> GMAKE= ${LOCALBASE}/bin/gmake
>
> @@ -161,6 +163,8 @@ do-install:
> cd ${IMAGEDIR} && tar -cf - * | tar -C ${PREFIX}/${PKGSTEM} -xf -
> ${INSTALL_DATA} ${JDKFILESDIR}/blocked.certs \
> ${PREFIX}/${PKGSTEM}/lib/security/
> + ln -fs ${SYSCONFDIR}/ssl/jdk-cacerts \
> + ${PREFIX}/${PKGSTEM}/lib/security/cacerts
>
> # The bootjdk is the jdk image with some parts deleted
> # and a copy of the system shared libs needed to run it.
> Index: 25/Makefile
> ===================================================================
> RCS file: /cvs/ports/devel/jdk/25/Makefile,v
> diff -u -p -u -r1.13 Makefile
> --- 25/Makefile 22 Oct 2026 20:52:12 -0000 1.13
> +++ 25/Makefile 26 Oct 2026 13:06:46 -0000
> @@ -13,7 +13,7 @@ PKGNAME= jdk-${PACKAGE_VER}
> PKGSTEM= jdk-25
> EPOCH= 0
>
> -REVISION= 1
> +REVISION= 2
>
> DIST_SUBDIR= jdk
> DISTNAME= jdk-${VERSION_STR}
> @@ -84,6 +84,8 @@ LIB_DEPENDS= converters/libiconv \
> graphics/png \
> graphics/giflib
>
> +RUN_DEPENDS= security/jdk-ca-certs
> +
> USE_GMAKE= Yes
> GMAKE= ${LOCALBASE}/bin/gmake
>
> @@ -158,6 +160,8 @@ do-install:
> cd ${IMAGEDIR} && tar -cf - * | tar -C ${PREFIX}/${PKGSTEM} -xf -
> ${INSTALL_DATA} ${JDKFILESDIR}/blocked.certs \
> ${PREFIX}/${PKGSTEM}/lib/security/
> + ln -fs ${SYSCONFDIR}/ssl/jdk-cacerts \
> + ${PREFIX}/${PKGSTEM}/lib/security/cacerts
>
> # The bootjdk is the jdk image with some parts deleted
> # and a copy of the system shared libs needed to run it.
