The fact that this depends on OpenSSL 4.0 annoyed me enough that I decided to whip up a small conversion utility that does the same job as the complicated openssl incantation.
https://github.com/botovq/jdk-ca-certs The utility uses libcrypto to deserialize the certs and bundles the boringssl-specific CBS/CBB to construct the jdk-cacerts bundle. The resulting file is byte-identical, so no version or revision bump. Index: Makefile =================================================================== RCS file: /cvs/ports/security/jdk-ca-certs/Makefile,v diff -u -p -r1.1.1.1 Makefile --- Makefile 24 Oct 2026 14:34:23 -0000 1.1.1.1 +++ Makefile 24 Oct 2026 22:09:26 -0000 @@ -8,22 +8,20 @@ COMMENT= common certificate authority ce VER= 1.0 PKGNAME= jdk-ca-certs-${VER} +GH_ACCOUNT= botovq +GH_PROJECT= jdk-ca-certs +GH_TAGNAME= v0.0.2 + CATEGORIES= security java -# generated file from cert.pem +# ISC PERMIT_PACKAGE= Yes -BUILD_DEPENDS= security/openssl/4.0 - -NO_BUILD = Yes NO_TEST = Yes do-install: ${INSTALL_DATA_DIR} ${PREFIX}/share/examples - eopenssl40 pkcs12 -export -in ${FILESDIR}/cert.pem \ - -out ${PREFIX}/share/examples/jdk-cacerts \ - -jdktrust anyExtendedKeyUsage \ - -certpbe NONE -nomac -nokeys \ - -passout pass: + ${WRKSRC}/jdk-ca-certs ${FILESDIR}/cert.pem \ + ${PREFIX}/share/examples/jdk-cacerts .include <bsd.port.mk> Index: distinfo =================================================================== RCS file: distinfo diff -N distinfo --- /dev/null 1 Jan 1970 00:00:00 -0000 +++ distinfo 24 Oct 2026 22:00:56 -0000 @@ -0,0 +1,2 @@ +SHA256 (jdk-ca-certs-0.0.2.tar.gz) = 8nZnX2Rt7NxI7km/0/t5Cn3tAjSR7gRXvFu1p+6XdJk= +SIZE (jdk-ca-certs-0.0.2.tar.gz) = 15821
