Re: [Q] 9.1 amd64 openJDK11 error on certificates

[Mike Pumford <mpumford%mudcovered.org.uk@localhost>]

On 25/10/2020 07:56, Michael van Elst wrote:
> ts1000%rad2know.net@localhost (ts1000) writes:
>
> > But that first step is not working on netBSD-9.1 amd64
> > I tried with pkgin, as well as building openjdk11 from source.
> > Error is the same.
>
> > I also installed, with pkgin,
> > ca-certificates-20200601
> > mozilla-rootcerts-1.0.20200529nb1
>
> The mozilla certificates aren't used by Java. You probably have to
> import them with keytool or similar.
That's true they are not. Java 8 builds its own cert store when it 
builds. Looking at my Java 11 pkgsrc build from last week it appears to 
import the mozilla root certs into its keystore as part of the build 
process.

However at the end of the build process the openjdk8 package installs 
the certificate in the install phase but the openjdk11 package does not!

No I know that some NetBSD people are against auto cert install but 
given the pain of doing it for java it should probably be at least a 
package option and in the absence of an option it seems to me that 
mimicing openjdk8 and installing the certs is a good idea.

I'd be strongly against not installing the certs on openjdk8 as that 
would mean I'd have to manually fix that up every time I did a package 
update.

Mike