JDK 8 already builds its cacerts from cacert. JDK 11 and later shipped
the CA list that comes with the OpenJDK source. That list does not get
the cacert updates, for example the removal of distrusted roots.
Generate the keystore with the bootstrap keytool before configure and
give it to --with-cacerts-file. The file goes into the java.base jmod,
so jlink images such as jre_minimal also use it.
Write a PKCS12 store without a password, like upstream. The JDK opens
cacerts without a password, so it cannot read certificates that a
password protects.
Assisted-by: Claude Code (claude-opus-5)
(cherry picked from commit b1e20b25b1)
Since 1.98.0 the darwin tarball links LLVM dynamically and ships an unversioned
libLLVM.dylib (rust-lang/rust#157205).
This shadows our nixpkgs-built libLLVM.dylib when we run our own toolchain,
leading to missing symbols.
Rename the dylib that upstream ships to avoid the shadowing, similar to what
upstream already does for linux.
(cherry picked from commit 5b4742e823)
LLVM 22 dropped the `__has_include(<sys/auxv.h>)` guards from the
AArch64 LSE-atomics and FMV feature detection in compiler-rt's builtins
(llvm/llvm-project#161751, released in 22.1.0). The no-libc variant of
compiler-rt, which libcxx and the libc++ clang wrappers are built with,
has no libc headers, so lib/builtins/cpu_model/aarch64.c fails with
fatal error: 'sys/auxv.h' file not found
and llvmPackages_22.{compiler-rt-no-libc,libcxx,libcxxClang,clangUseLLVM}
cannot be built on aarch64-linux; the same holds for llvmPackages_23 and
llvmPackages_git. Hydra has no aarch64-linux build of any of these jobs,
while the llvmPackages_21 ones build.
Restore the LLVM 21 behaviour for the no-libc build: guard both
`#elif defined(__linux__)` branches with `__has_include(<sys/auxv.h>)`,
so LSE detection is skipped and __aarch64_have_lse_atomics stays false
without a libc, as it did in 21. The FMV branch is already compiled out
in this configuration by COMPILER_RT_DISABLE_AARCH64_FMV (ded560caff).
The substitution applies unchanged to 22.1.8, 23.1.0 and the git
snapshot.
Only compiler-rt-no-libc and what is built on top of it change, and only
on aarch64-linux: compiler-rt (with libc), clang, libllvm, lld and the
stdenv keep their derivations, and nothing changes on x86_64-linux. The
gate includes isLinux because Darwin builds compiler-rt-no-libc without
a libc as well but never takes the __linux__ branches; without it every
llvmPackages_{22,23} derivation on aarch64-darwin would rebuild for no
effect.
Fixes#495155.
Assisted-by: Claude Code (Claude Fable 5.1)
(cherry picked from commit 8c59070cfe)
