nathan/nixpkgs
1
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2026-10-30 16:10:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

corretto: generate cacerts from cacert

Browse Source 
Assisted-by: Claude Code (Claude Fable 5.1)
Assisted-by: Claude Code (Claude Opus 5.5)
This commit is contained in:
Rafael Irgolic
2026-10-21 19:15:36 +00:00
parent 8915027df7
commit e3f41e9b3c
1 changed files with 19 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
pkgs/development/compilers/corretto/mk-corretto.nix
View File

@@ -8,6 +8,8 @@
fetchurl,
stdenv,
gradle,
cacert,
jre-generate-cacerts,
nixpkgs-openjdk-updater,
extraConfig ? [ ],
rsync,
@@ -123,12 +125,26 @@ jdk.overrideAttrs (
# openjdk/generic.nix) while giving Corretto's flags precedence.
# Note that the OpenJdK flags contain "--with-boot-jdk=..."!
substituteInPlace build.gradle --replace-fail "correttoCommonFlags = [" "correttoCommonFlags = [${jdk_configure_flags} ,"
# Finally, *append* nix-corretto-version specific flags.
gradleFlagsArray+=(-Pcorretto.extra_config="${extra_config}")
# Finally, *append* our flags. build.gradle places corretto.extra_config
# after Corretto's own flags, so our --with-cacerts-file (see preBuild)
# overrides Corretto's, and the nix-corretto-version specific flags in
# extra_config come last and can override ours.
gradleFlagsArray+=(-Pcorretto.extra_config="--with-cacerts-file=$NIX_BUILD_TOP/cacerts-gen/cacerts ${extra_config}")
'';
# since we dontConfigure, we must run this manually
preBuild = "gradleConfigureHook";
# dontConfigure also skips OpenJDK's preConfigure, so build
# lib/security/cacerts from cacert here, the same way it does.
preBuild = ''
gradleConfigureHook
mkdir "$NIX_BUILD_TOP/cacerts-gen"
(
cd "$NIX_BUILD_TOP/cacerts-gen"
JAVA_TOOL_OPTIONS="-Dkeystore.pkcs12.certProtectionAlgorithm=NONE -Dkeystore.pkcs12.macAlgorithm=NONE" \
${jre-generate-cacerts} ${jdk.home}/bin/keytool ${cacert}/etc/ssl/certs/ca-bundle.crt
)
'';
# The Linux installer is placed at linux/universal/tar whereas the MacOS
# one is at mac/tar.