From 55ef7dad4220c0c77c089eed79200dd52e52a4f7 Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Wed, 27 Aug 2025 16:51:24 +0300
Subject: [PATCH] buildMavenPackage: use generate-cacerts.pl to populate trust
 store
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In some cases, NIX_SSL_CERT_FILE may point to variation of cacerts,
see https://github.com/NixOS/nixpkgs/issues/435467 for examples.

`keytool` is not happy with all certs in there, and requires some
special care.

Re-use the tooling we have to populate openjdk 8 with its
trust store, instead of our naïve approach.

The nixpkgs linter doesn't allow us to simply refer to the .pl file from
inside the openjdk directory, and re-exposing it only from the openjdk8
derivation as a passthru is also a bit annoying.

As suggested in PR review, expose the perl script via pkgs and use it
both for build-maven-package and the openjdk8 build.

Fixes #435467.
---
 .../jr/jre-generate-cacerts}/generate-cacerts.pl       |  0
 pkgs/by-name/jr/jre-generate-cacerts/package.nix       |  5 +++++
 pkgs/by-name/ma/maven/build-maven-package.nix          | 10 ++++++----
 pkgs/development/compilers/openjdk/generic.nix         |  6 ++----
 4 files changed, 13 insertions(+), 8 deletions(-)
 rename pkgs/{development/compilers/openjdk/8 => by-name/jr/jre-generate-cacerts}/generate-cacerts.pl (100%)
 create mode 100644 pkgs/by-name/jr/jre-generate-cacerts/package.nix

diff --git a/pkgs/development/compilers/openjdk/8/generate-cacerts.pl b/pkgs/by-name/jr/jre-generate-cacerts/generate-cacerts.pl
similarity index 100%
rename from pkgs/development/compilers/openjdk/8/generate-cacerts.pl
rename to pkgs/by-name/jr/jre-generate-cacerts/generate-cacerts.pl
diff --git a/pkgs/by-name/jr/jre-generate-cacerts/package.nix b/pkgs/by-name/jr/jre-generate-cacerts/package.nix
new file mode 100644
index 000000000000..7dd696a6d544
--- /dev/null
+++ b/pkgs/by-name/jr/jre-generate-cacerts/package.nix
@@ -0,0 +1,5 @@
+{
+  writers,
+}:
+
+writers.writePerl "jre-generate-cacerts" { } ./generate-cacerts.pl
diff --git a/pkgs/by-name/ma/maven/build-maven-package.nix b/pkgs/by-name/ma/maven/build-maven-package.nix
index 4ed6380752fd..6b4aa51d8de5 100644
--- a/pkgs/by-name/ma/maven/build-maven-package.nix
+++ b/pkgs/by-name/ma/maven/build-maven-package.nix
@@ -2,7 +2,9 @@
   lib,
   stdenv,
   jdk,
+  jre-generate-cacerts,
   maven,
+  perl,
   writers,
 }:
 
@@ -60,10 +62,10 @@ let
 
         # handle cacert by populating a trust store on the fly
         if [[ -n "''${NIX_SSL_CERT_FILE-}" ]] && [[ "''${NIX_SSL_CERT_FILE-}" != "/no-cert-file.crt" ]];then
-          keyStoreFile="$(mktemp -d)/keystore"
-          keyStorePwd="$(head -c10 /dev/random | base32)"
-          echo y | ${jdk}/bin/keytool -importcert -file "$NIX_SSL_CERT_FILE" -alias alias -keystore "$keyStoreFile" -storepass "$keyStorePwd"
-          MAVEN_EXTRA_ARGS="$MAVEN_EXTRA_ARGS -Djavax.net.ssl.trustStore=$keyStoreFile -Djavax.net.ssl.trustStorePassword=$keyStorePwd"
+          echo "using ''${NIX_SSL_CERT_FILE-} as trust store"
+          ${jre-generate-cacerts} ${jdk}/lib/openjdk/bin/keytool $NIX_SSL_CERT_FILE
+
+          MAVEN_EXTRA_ARGS="$MAVEN_EXTRA_ARGS -Djavax.net.ssl.trustStore=cacerts -Djavax.net.ssl.trustStorePassword=changeit"
         fi
       ''
       + lib.optionalString buildOffline ''
diff --git a/pkgs/development/compilers/openjdk/generic.nix b/pkgs/development/compilers/openjdk/generic.nix
index 3588d94e690d..ccc2790499be 100644
--- a/pkgs/development/compilers/openjdk/generic.nix
+++ b/pkgs/development/compilers/openjdk/generic.nix
@@ -20,7 +20,6 @@
   file,
   which,
   zip,
-  perl,
   zlib,
   cups,
   freetype,
@@ -48,6 +47,7 @@
 
   liberation_ttf,
   cacert,
+  jre-generate-cacerts,
 
   nixpkgs-openjdk-updater,
 
@@ -255,8 +255,6 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals (!atLeast11) [
     lndir
-    # Certificates generated using perl in `installPhase`
-    perl
   ]
   ++ lib.optionals (!atLeast11 && !stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
     # Certificates generated using keytool in `installPhase`
@@ -555,7 +553,7 @@ stdenv.mkDerivation (finalAttrs: {
     + ''
       cd $jre/lib/openjdk/jre/lib/security
       rm cacerts
-      perl ${./8/generate-cacerts.pl} ${
+      ${jre-generate-cacerts} ${
         if stdenv.buildPlatform.canExecute stdenv.hostPlatform then
           "$jre/lib/openjdk/jre/bin/keytool"
         else