On Oct 24, 2026, at 6:17 PM, Theo Buehler <[email protected]> wrote:
>
> The fact that this depends on OpenSSL 4.0 annoyed me enough that I
> decided to whip up a small conversion utility that does the same job
> as the complicated openssl incantation.
>
> https://github.com/botovq/jdk-ca-certs
>
> The utility uses libcrypto to deserialize the certs and bundles the
> boringssl-specific CBS/CBB to construct the jdk-cacerts bundle.
>
> The resulting file is byte-identical, so no version or revision bump.
>
Nice! ok kurt@
> Index: Makefile
> ===================================================================
> RCS file: /cvs/ports/security/jdk-ca-certs/Makefile,v
> diff -u -p -r1.1.1.1 Makefile
> --- Makefile 24 Oct 2026 14:34:23 -0000 1.1.1.1
> +++ Makefile 24 Oct 2026 22:09:26 -0000
> @@ -8,22 +8,20 @@ COMMENT= common certificate authority ce
> VER= 1.0
> PKGNAME= jdk-ca-certs-${VER}
>
> +GH_ACCOUNT= botovq
> +GH_PROJECT= jdk-ca-certs
> +GH_TAGNAME= v0.0.2
> +
> CATEGORIES= security java
>
> -# generated file from cert.pem
> +# ISC
> PERMIT_PACKAGE= Yes
>
> -BUILD_DEPENDS= security/openssl/4.0
> -
> -NO_BUILD = Yes
> NO_TEST = Yes
>
> do-install:
> ${INSTALL_DATA_DIR} ${PREFIX}/share/examples
> - eopenssl40 pkcs12 -export -in ${FILESDIR}/cert.pem \
> - -out ${PREFIX}/share/examples/jdk-cacerts \
> - -jdktrust anyExtendedKeyUsage \
> - -certpbe NONE -nomac -nokeys \
> - -passout pass:
> + ${WRKSRC}/jdk-ca-certs ${FILESDIR}/cert.pem \
> + ${PREFIX}/share/examples/jdk-cacerts
>
> .include <bsd.port.mk>
> Index: distinfo
> ===================================================================
> RCS file: distinfo
> diff -N distinfo
> --- /dev/null 1 Jan 1970 00:00:00 -0000
> +++ distinfo 24 Oct 2026 22:00:56 -0000
> @@ -0,0 +1,2 @@
> +SHA256 (jdk-ca-certs-0.0.2.tar.gz) =
> 8nZnX2Rt7NxI7km/0/t5Cn3tAjSR7gRXvFu1p+6XdJk=
> +SIZE (jdk-ca-certs-0.0.2.tar.gz) = 15821
