buildMavenPackage: use generate-cacerts.pl to populate trust store (#437528)

pkgs/by-name/jr/jre-generate-cacerts/package.nix

@@ -0,0 +1,5 @@
+{
+  writers,
+}:
+
+writers.writePerl "jre-generate-cacerts" { } ./generate-cacerts.pl

pkgs/by-name/ma/maven/build-maven-package.nix

@@ -2,7 +2,9 @@
   lib,
   stdenv,
   jdk,
+  jre-generate-cacerts,
   maven,
+  perl,
   writers,
 }:
 
@@ -60,10 +62,10 @@ let
 
         # handle cacert by populating a trust store on the fly
         if [[ -n "''${NIX_SSL_CERT_FILE-}" ]] && [[ "''${NIX_SSL_CERT_FILE-}" != "/no-cert-file.crt" ]];then
-          keyStoreFile="$(mktemp -d)/keystore"
-          keyStorePwd="$(head -c10 /dev/random | base32)"
-          echo y | ${jdk}/bin/keytool -importcert -file "$NIX_SSL_CERT_FILE" -alias alias -keystore "$keyStoreFile" -storepass "$keyStorePwd"
-          MAVEN_EXTRA_ARGS="$MAVEN_EXTRA_ARGS -Djavax.net.ssl.trustStore=$keyStoreFile -Djavax.net.ssl.trustStorePassword=$keyStorePwd"
+          echo "using ''${NIX_SSL_CERT_FILE-} as trust store"
+          ${jre-generate-cacerts} ${jdk}/lib/openjdk/bin/keytool $NIX_SSL_CERT_FILE
+
+          MAVEN_EXTRA_ARGS="$MAVEN_EXTRA_ARGS -Djavax.net.ssl.trustStore=cacerts -Djavax.net.ssl.trustStorePassword=changeit"
         fi
       ''
       + lib.optionalString buildOffline ''

pkgs/development/compilers/openjdk/generic.nix

@@ -20,7 +20,6 @@
   file,
   which,
   zip,
-  perl,
   zlib,
   cups,
   freetype,
@@ -48,6 +47,7 @@
 
   liberation_ttf,
   cacert,
+  jre-generate-cacerts,
 
   nixpkgs-openjdk-updater,
 
@@ -255,8 +255,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals (!atLeast11) [
     lndir
-    # Certificates generated using perl in `installPhase`
-    perl
   ]
   ++ lib.optionals (!atLeast11 && !stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
     # Certificates generated using keytool in `installPhase`
@@ -555,7 +553,7 @@ stdenv.mkDerivation (finalAttrs: {
     + ''
       cd $jre/lib/openjdk/jre/lib/security
       rm cacerts
-      perl ${./8/generate-cacerts.pl} ${
+      ${jre-generate-cacerts} ${
         if stdenv.buildPlatform.canExecute stdenv.hostPlatform then
           "$jre/lib/openjdk/jre/bin/keytool"
         else