From 36a6eeecf1bdaf0a6cbbf67404aba5886b21f9bc Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Fri, 27 Jun 2025 21:32:14 +0300
Subject: [PATCH] fetchedMavenDeps: honor NIX_SSL_CERT_FILE

Java doesn't honor NIX_SSL_CERT_FILE out of the box, but instead uses
its own concept of a key store.

If we see the environment variable being set, we can create a new key
store with all certs in that file and pass it to the JVM.

(cherry picked from commit cd931bff240f5dd9425ab5680bca4357f329820d)
---
 pkgs/by-name/ma/maven/build-maven-package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/ma/maven/build-maven-package.nix b/pkgs/by-name/ma/maven/build-maven-package.nix
index 644c50020264..4ed6380752fd 100644
--- a/pkgs/by-name/ma/maven/build-maven-package.nix
+++ b/pkgs/by-name/ma/maven/build-maven-package.nix
@@ -57,6 +57,14 @@ let
           ${writeProxySettings} $mvnSettingsFile
           MAVEN_EXTRA_ARGS="-s=$mvnSettingsFile"
         fi
+
+        # handle cacert by populating a trust store on the fly
+        if [[ -n "''${NIX_SSL_CERT_FILE-}" ]] && [[ "''${NIX_SSL_CERT_FILE-}" != "/no-cert-file.crt" ]];then
+          keyStoreFile="$(mktemp -d)/keystore"
+          keyStorePwd="$(head -c10 /dev/random | base32)"
+          echo y | ${jdk}/bin/keytool -importcert -file "$NIX_SSL_CERT_FILE" -alias alias -keystore "$keyStoreFile" -storepass "$keyStorePwd"
+          MAVEN_EXTRA_ARGS="$MAVEN_EXTRA_ARGS -Djavax.net.ssl.trustStore=$keyStoreFile -Djavax.net.ssl.trustStorePassword=$keyStorePwd"
+        fi
       ''
       + lib.optionalString buildOffline ''
         mvn $MAVEN_EXTRA_ARGS de.qaware.maven:go-offline-maven-plugin:1.2.8:resolve-dependencies -Dmaven.repo.local=$out/.m2 ${mvnDepsParameters}