--- /dev/null
+#!/usr/bin/perl
+
+# Copyright (C) 2007, 2008 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+# GNU General Public License for more details.
+
+# generate-cacerts.pl generates a JKS keystore named 'cacerts' from
+# OpenSSL's certificate bundle using OpenJDK's keytool.
+
+# First extract each of OpenSSL's bundled certificates into its own
+# aliased filename.
+
+# Downloaded from http://cvs.fedoraproject.org/viewvc/rpms/ca-certificates/F-12/generate-cacerts.pl?revision=1.2
+# Check and prevention of duplicate aliases added by Vlastimil Babka <caster@gentoo.org>
+
+$file = $ARGV[1];
+open(CERTS, $file);
+@certs = <CERTS>;
+close(CERTS);
+
+$pem_file_count = 0;
+$in_cert_block = 0;
+$write_current_cert = 1;
+foreach $cert (@certs)
+{
+ if ($cert =~ /Issuer: /)
+ {
+ $_ = $cert;
+ if ($cert =~ /personal-freemail/)
+ {
+ $cert_alias = "thawtepersonalfreemailca";
+ }
+ elsif ($cert =~ /personal-basic/)
+ {
+ $cert_alias = "thawtepersonalbasicca";
+ }
+ elsif ($cert =~ /personal-premium/)
+ {
+ $cert_alias = "thawtepersonalpremiumca";
+ }
+ elsif ($cert =~ /server-certs/)
+ {
+ $cert_alias = "thawteserverca";
+ }
+ elsif ($cert =~ /premium-server/)
+ {
+ $cert_alias = "thawtepremiumserverca";
+ }
+ elsif ($cert =~ /Class 1 Public Primary Certification Authority$/)
+ {
+ $cert_alias = "verisignclass1ca";
+ }
+ elsif ($cert =~ /Class 1 Public Primary Certification Authority - G2/)
+ {
+ $cert_alias = "verisignclass1g2ca";
+ }
+ elsif ($cert =~
+ /VeriSign Class 1 Public Primary Certification Authority - G3/)
+ {
+ $cert_alias = "verisignclass1g3ca";
+ }
+ elsif ($cert =~ /Class 2 Public Primary Certification Authority$/)
+ {
+ $cert_alias = "verisignclass2ca";
+ }
+ elsif ($cert =~ /Class 2 Public Primary Certification Authority - G2/)
+ {
+ $cert_alias = "verisignclass2g2ca";
+ }
+ elsif ($cert =~
+ /VeriSign Class 2 Public Primary Certification Authority - G3/)
+ {
+ $cert_alias = "verisignclass2g3ca";
+ }
+ elsif ($cert =~ /Class 3 Public Primary Certification Authority$/)
+ {
+ $cert_alias = "verisignclass3ca";
+ }
+ # Version 1 of Class 3 Public Primary Certification Authority
+ # - G2 is added. Version 3 is excluded. See below.
+ elsif ($cert =~
+ /VeriSign Class 3 Public Primary Certification Authority - G3/)
+ {
+ $cert_alias = "verisignclass3g3ca";
+ }
+ elsif ($cert =~
+ /RSA Data Security.*Secure Server Certification Authority/)
+ {
+ $cert_alias = "verisignserverca";
+ }
+ elsif ($cert =~ /GTE CyberTrust Global Root/)
+ {
+ $cert_alias = "gtecybertrustglobalca";
+ }
+ elsif ($cert =~ /Baltimore CyberTrust Root/)
+ {
+ $cert_alias = "baltimorecybertrustca";
+ }
+ elsif ($cert =~ /www.entrust.net\/Client_CA_Info\/CPS/)
+ {
+ $cert_alias = "entrustclientca";
+ }
+ elsif ($cert =~ /www.entrust.net\/GCCA_CPS/)
+ {
+ $cert_alias = "entrustglobalclientca";
+ }
+ elsif ($cert =~ /www.entrust.net\/CPS_2048/)
+ {
+ $cert_alias = "entrust2048ca";
+ }
+ elsif ($cert =~ /www.entrust.net\/CPS /)
+ {
+ $cert_alias = "entrustsslca";
+ }
+ elsif ($cert =~ /www.entrust.net\/SSL_CPS/)
+ {
+ $cert_alias = "entrustgsslca";
+ }
+ elsif ($cert =~ /The Go Daddy Group/)
+ {
+ $cert_alias = "godaddyclass2ca";
+ }
+ elsif ($cert =~ /Starfield Class 2 Certification Authority/)
+ {
+ $cert_alias = "starfieldclass2ca";
+ }
+ elsif ($cert =~ /ValiCert Class 2 Policy Validation Authority/)
+ {
+ $cert_alias = "valicertclass2ca";
+ }
+ elsif ($cert =~ /GeoTrust Global CA$/)
+ {
+ $cert_alias = "geotrustglobalca";
+ }
+ elsif ($cert =~ /Equifax Secure Certificate Authority/)
+ {
+ $cert_alias = "equifaxsecureca";
+ }
+ elsif ($cert =~ /Equifax Secure eBusiness CA-1/)
+ {
+ $cert_alias = "equifaxsecureebusinessca1";
+ }
+ elsif ($cert =~ /Equifax Secure eBusiness CA-2/)
+ {
+ $cert_alias = "equifaxsecureebusinessca2";
+ }
+ elsif ($cert =~ /Equifax Secure Global eBusiness CA-1/)
+ {
+ $cert_alias = "equifaxsecureglobalebusinessca1";
+ }
+ elsif ($cert =~ /Sonera Class1 CA/)
+ {
+ $cert_alias = "soneraclass1ca";
+ }
+ elsif ($cert =~ /Sonera Class2 CA/)
+ {
+ $cert_alias = "soneraclass2ca";
+ }
+ elsif ($cert =~ /AAA Certificate Services/)
+ {
+ $cert_alias = "comodoaaaca";
+ }
+ elsif ($cert =~ /AddTrust Class 1 CA Root/)
+ {
+ $cert_alias = "addtrustclass1ca";
+ }
+ elsif ($cert =~ /AddTrust External CA Root/)
+ {
+ $cert_alias = "addtrustexternalca";
+ }
+ elsif ($cert =~ /AddTrust Qualified CA Root/)
+ {
+ $cert_alias = "addtrustqualifiedca";
+ }
+ elsif ($cert =~ /UTN-USERFirst-Hardware/)
+ {
+ $cert_alias = "utnuserfirsthardwareca";
+ }
+ elsif ($cert =~ /UTN-USERFirst-Client Authentication and Email/)
+ {
+ $cert_alias = "utnuserfirstclientauthemailca";
+ }
+ elsif ($cert =~ /UTN - DATACorp SGC/)
+ {
+ $cert_alias = "utndatacorpsgcca";
+ }
+ elsif ($cert =~ /UTN-USERFirst-Object/)
+ {
+ $cert_alias = "utnuserfirstobjectca";
+ }
+ elsif ($cert =~ /America Online Root Certification Authority 1/)
+ {
+ $cert_alias = "aolrootca1";
+ }
+ elsif ($cert =~ /DigiCert Assured ID Root CA/)
+ {
+ $cert_alias = "digicertassuredidrootca";
+ }
+ elsif ($cert =~ /DigiCert Global Root CA/)
+ {
+ $cert_alias = "digicertglobalrootca";
+ }
+ elsif ($cert =~ /DigiCert High Assurance EV Root CA/)
+ {
+ $cert_alias = "digicerthighassuranceevrootca";
+ }
+ elsif ($cert =~ /GlobalSign Root CA$/)
+ {
+ $cert_alias = "globalsignca";
+ }
+ elsif ($cert =~ /GlobalSign Root CA - R2/)
+ {
+ $cert_alias = "globalsignr2ca";
+ }
+ elsif ($cert =~ /Elektronik.*Kas.*2005/)
+ {
+ $cert_alias = "extra-elektronikkas2005";
+ }
+ elsif ($cert =~ /Elektronik/)
+ {
+ $cert_alias = "extra-elektronik2005";
+ }
+ # Mozilla does not provide these certificates:
+ # baltimorecodesigningca
+ # gtecybertrust5ca
+ # trustcenterclass2caii
+ # trustcenterclass4caii
+ # trustcenteruniversalcai
+ else
+ {
+ # Generate an alias using the OU and CN attributes of the
+ # Issuer field if both are present, otherwise use only the
+ # CN attribute. The Issuer field must have either the OU
+ # or the CN attribute.
+ $_ = $cert;
+ if ($cert =~ /OU=/)
+ {
+ s/Issuer:.*?OU=//;
+ # Remove other occurrences of OU=.
+ s/OU=.*CN=//;
+ # Remove CN= if there were not other occurrences of OU=.
+ s/CN=//;
+ s/\/emailAddress.*//;
+ s/Certificate Authority/ca/g;
+ s/Certification Authority/ca/g;
+ }
+ elsif ($cert =~ /CN=/)
+ {
+ s/Issuer:.*CN=//;
+ s/\/emailAddress.*//;
+ s/Certificate Authority/ca/g;
+ s/Certification Authority/ca/g;
+ }
+ s/\W//g;
+ tr/A-Z/a-z/;
+ $cert_alias = "extra-$_";
+
+ }
+ while (-e "$cert_alias.pem")
+ {
+ $cert_alias = "$cert_alias" . "_";
+ }
+ }
+ # When it attempts to parse:
+ #
+ # Class 3 Public Primary Certification Authority - G2, Version 3
+ #
+ # keytool says:
+ #
+ # #2: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
+ # Unparseable AuthorityInfoAccess extension due to
+ # java.io.IOException: Invalid encoding of URI
+ #
+ # If we do not exclude this file
+ # openjdk/jdk/test/lib/security/cacerts/VerifyCACerts.java fails
+ # on this cert, printing:
+ #
+ # Couldn't verify: java.security.SignatureException: Signature
+ # does not match.
+ #
+ elsif ($cert =~
+ /A6:0F:34:C8:62:6C:81:F6:8B:F7:7D:A9:F6:67:58:8A:90:3F:7D:36/)
+ {
+ $write_current_cert = 0;
+ $pem_file_count--;
+ }
+ elsif ($cert eq "-----BEGIN CERTIFICATE-----\n")
+ {
+ if ($in_cert_block != 0)
+ {
+ die "$file is malformed.";
+ }
+ $in_cert_block = 1;
+ if ($write_current_cert == 1)
+ {
+ $pem_file_count++;
+ if (-e "$cert_alias.pem")
+ {
+ print "$cert_alias";
+ die "already exists"
+ }
+ open(PEM, ">$cert_alias.pem");
+ print PEM $cert;
+ }
+ }
+ elsif ($cert eq "-----END CERTIFICATE-----\n")
+ {
+ $in_cert_block = 0;
+ if ($write_current_cert == 1)
+ {
+ print PEM $cert;
+ close(PEM);
+ }
+ $write_current_cert = 1
+ }
+ else
+ {
+ if ($in_cert_block == 1 && $write_current_cert == 1)
+ {
+ print PEM $cert;
+ }
+ }
+}
+
+# Check that the correct number of .pem files were produced.
+@pem_files = <*.pem>;
+if (@pem_files != $pem_file_count)
+{
+ print "$pem_file_count";
+ die "Number of .pem files produced does not match".
+ " number of certs read from $file.";
+}
+
+# Now store each cert in the 'cacerts' file using keytool.
+$certs_written_count = 0;
+foreach $pem_file (@pem_files)
+{
+ system "$ARGV[0] -noprompt -import".
+ " -alias `basename $pem_file .pem`".
+ " -keystore cacerts -storepass 'changeit' -file $pem_file";
+ unlink($pem_file);
+ $certs_written_count++;
+}
+
+# Check that the correct number of certs were added to the keystore.
+if ($certs_written_count != $pem_file_count)
+{
+ die "Number of certs added to keystore does not match".
+ " number of certs read from $file.";
+}
--- /dev/null
+# Copyright 1999-2019 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=6
+
+inherit check-reqs eapi7-ver flag-o-matic java-pkg-2 java-vm-2 multiprocessing pax-utils toolchain-funcs
+
+MY_PV=$(ver_rs 1 'u' 2 '-' ${PV//p/b})
+
+BASE_URI="https://hg.${PN}.java.net/jdk8u/jdk8u"
+
+DESCRIPTION="Open source implementation of the Java programming language"
+HOMEPAGE="https://openjdk.java.net"
+SRC_URI="
+ ${BASE_URI}/archive/jdk${MY_PV}.tar.bz2 -> ${P}.tar.bz2
+ ${BASE_URI}/corba/archive/jdk${MY_PV}.tar.bz2 -> ${PN}-corba-${PV}.tar.bz2
+ ${BASE_URI}/hotspot/archive/jdk${MY_PV}.tar.bz2 -> ${PN}-hotspot-${PV}.tar.bz2
+ ${BASE_URI}/jaxp/archive/jdk${MY_PV}.tar.bz2 -> ${PN}-jaxp-${PV}.tar.bz2
+ ${BASE_URI}/jaxws/archive/jdk${MY_PV}.tar.bz2 -> ${PN}-jaxws-${PV}.tar.bz2
+ ${BASE_URI}/jdk/archive/jdk${MY_PV}.tar.bz2 -> ${PN}-jdk-${PV}.tar.bz2
+ ${BASE_URI}/langtools/archive/jdk${MY_PV}.tar.bz2 -> ${PN}-langtools-${PV}.tar.bz2
+ ${BASE_URI}/nashorn/archive/jdk${MY_PV}.tar.bz2 -> ${PN}-nashorn-${PV}.tar.bz2
+"
+
+LICENSE="GPL-2"
+SLOT="$(ver_cut 1)"
+KEYWORDS="~amd64 ~arm64 ~ppc64 ~x86"
+IUSE="alsa debug cups doc examples gentoo-vm headless-awt +jbootstrap nsplugin +pch selinux source +webstart"
+
+CDEPEND="
+ media-libs/freetype:2=
+ sys-libs/zlib
+ alsa? ( media-libs/alsa-lib )
+ !headless-awt? (
+ media-libs/giflib:0/7
+ x11-libs/libX11
+ x11-libs/libXext
+ x11-libs/libXi
+ x11-libs/libXrender
+ x11-libs/libXt
+ x11-libs/libXtst
+ )
+"
+
+RDEPEND="
+ ${CDEPEND}
+ cups? ( net-print/cups )
+ selinux? ( sec-policy/selinux-java )
+"
+
+# cups headers requied to build, runtime dep is optional
+DEPEND="
+ ${CDEPEND}
+ net-print/cups
+ app-arch/zip
+ app-misc/ca-certificates
+ dev-lang/perl
+ dev-libs/openssl:0
+ media-libs/alsa-lib
+ !headless-awt? (
+ x11-base/xorg-proto
+ )
+ || (
+ dev-java/openjdk-bin:${SLOT}
+ dev-java/icedtea-bin:${SLOT}
+ dev-java/openjdk:${SLOT}
+ dev-java/icedtea:${SLOT}
+ )
+"
+
+PDEPEND="webstart? ( >=dev-java/icedtea-web-1.6.1:0 )
+ nsplugin? ( >=dev-java/icedtea-web-1.6.1:0[nsplugin] )"
+
+S="${WORKDIR}/jdk${SLOT}u-jdk${MY_PV}"
+
+# The space required to build varies wildly depending on USE flags,
+# ranging from 2GB to 16GB. This function is certainly not exact but
+# should be close enough to be useful.
+openjdk_check_requirements() {
+ local M
+ M=2048
+ M=$(( $(usex debug 3 1) * $M ))
+ M=$(( $(usex jbootstrap 2 1) * $M ))
+ M=$(( $(usex doc 320 0) + $(usex source 128 0) + 192 + $M ))
+
+ CHECKREQS_DISK_BUILD=${M}M check-reqs_pkg_${EBUILD_PHASE}
+}
+
+pkg_pretend() {
+ openjdk_check_requirements
+}
+
+pkg_setup() {
+ openjdk_check_requirements
+ java-vm-2_pkg_setup
+
+ JAVA_PKG_WANT_BUILD_VM="openjdk-${SLOT} openjdk-bin-${SLOT} icedtea-${SLOT} icedtea-bin-${SLOT}"
+ JAVA_PKG_WANT_SOURCE="${SLOT}"
+ JAVA_PKG_WANT_TARGET="${SLOT}"
+
+ # The nastiness below is necessary while the gentoo-vm USE flag is
+ # masked. First we call java-pkg-2_pkg_setup if it looks like the
+ # flag was unmasked against one of the possible build VMs. If not,
+ # we try finding one of them in their expected locations. This would
+ # have been slightly less messy if openjdk-bin had been installed to
+ # /opt/${PN}-${SLOT} or if there was a mechanism to install a VM env
+ # file but disable it so that it would not normally be selectable.
+
+ local vm
+ for vm in ${JAVA_PKG_WANT_BUILD_VM}; do
+ if [[ -d ${EPREFIX}/usr/lib/jvm/${vm} ]]; then
+ java-pkg-2_pkg_setup
+ return
+ fi
+ done
+
+ if has_version --host-root dev-java/openjdk:${SLOT}; then
+ export JDK_HOME=${EPREFIX}/usr/$(get_libdir)/openjdk-${SLOT}
+ else
+ JDK_HOME=$(best_version --host-root dev-java/openjdk-bin:${SLOT})
+ [[ -n ${JDK_HOME} ]] || die "Build VM not found!"
+ JDK_HOME=${JDK_HOME#*/}
+ JDK_HOME=${EPREFIX}/opt/${JDK_HOME%-r*}
+ export JDK_HOME
+ fi
+}
+
+src_prepare() {
+ default
+ chmod +x configure || die
+ local repo
+ for repo in corba hotspot jdk jaxp jaxws langtools nashorn; do
+ ln -s ../"${repo}-jdk${MY_PV}" "${repo}" || die
+ done
+}
+
+src_configure() {
+ # general build info found here:
+ #https://hg.openjdk.java.net/jdk8/jdk8/raw-file/tip/README-builds.html
+
+ # Work around stack alignment issue, bug #647954.
+ use x86 && append-flags -mincoming-stack-boundary=2
+
+ append-flags -Wno-error
+
+ local myconf=(
+ --disable-ccache
+ --enable-unlimited-crypto
+ --with-boot-jdk="${JDK_HOME}"
+ --with-extra-cflags="${CFLAGS}"
+ --with-extra-cxxflags="${CXXFLAGS}"
+ --with-extra-ldflags="${LDFLAGS}"
+ --with-giflib=system
+ --with-jtreg=no
+ --with-jobs=1
+ --with-num-cores=1
+ --with-update-version="$(ver_cut 2)"
+ --with-build-number="$(ver_cut 4)"
+ --with-milestone="gentoo"
+ --with-zlib=system
+ --with-native-debug-symbols=$(usex debug internal none)
+ $(usex headless-awt --disable-headful '')
+ )
+
+ # PaX breaks pch, bug #601016
+ if use pch && ! host-is-pax; then
+ myconf+=( --enable-precompiled-headers )
+ else
+ myconf+=( --disable-precompiled-headers )
+ fi
+
+ (
+ unset JAVA JAVAC XARGS
+ CFLAGS= CXXFLAGS= LDFLAGS= \
+ CONFIG_SITE=/dev/null \
+ econf "${myconf[@]}"
+ )
+}
+
+src_compile() {
+ emake -j1 LOG=debug JOBS=$(makeopts_jobs)\
+ $(usex jbootstrap bootcycle-images images) $(usex doc docs '')
+}
+
+src_install() {
+ local dest="/usr/$(get_libdir)/${PN}-${SLOT}"
+ local ddest="${ED}${dest#/}"
+
+ cd "${S}"/build/*-release/images/j2sdk-image || die
+
+ if ! use alsa; then
+ rm -v jre/lib/$(get_system_arch)/libjsoundalsa.* || die
+ fi
+
+ if ! use examples ; then
+ rm -vr demo/ || die
+ fi
+
+ if ! use source ; then
+ rm -v src.zip || die
+ fi
+
+ dodir "${dest}"
+ cp -pPR * "${ddest}" || die
+
+ einfo "Generating cacerts file from certificates in ${EPREFIX}/usr/share/ca-certificates/"
+ mkdir "${T}/certgen" && cd "${T}/certgen" || die
+ cp "${FILESDIR}/generate-cacerts.pl" . && chmod +x generate-cacerts.pl || die
+ for c in "${EPREFIX}"/usr/share/ca-certificates/*/*.crt; do
+ openssl x509 -text -in "${c}" >> all.crt || die
+ done
+ ./generate-cacerts.pl "${ddest}/bin/keytool" all.crt || die
+ cp -vRP cacerts "${ddest}/jre/lib/security/" || die
+ chmod 644 "${ddest}/jre/lib/security/cacerts" || die
+
+ use gentoo-vm && java-vm_install-env "${FILESDIR}"/${PN}-${SLOT}.env.sh
+ java-vm_set-pax-markings "${ddest}"
+ java-vm_revdep-mask
+ java-vm_sandbox-predict /dev/random /proc/self/coredump_filter
+
+ if use doc ; then
+ insinto /usr/share/doc/${PF}/html
+ doins -r "${S}"/build/*-release/docs/*
+ fi
+}
+
+pkg_postinst() {
+ java-vm-2_pkg_postinst
+
+ if use gentoo-vm ; then
+ ewarn "WARNING! You have enabled the gentoo-vm USE flag, making this JDK"
+ ewarn "recognised by the system. This will almost certainly break things."
+ else
+ ewarn "The experimental gentoo-vm USE flag has not been enabled so this JDK"
+ ewarn "will not be recognised by the system. For example, simply calling"
+ ewarn "\"java\" will launch a different JVM. This is necessary until Gentoo"
+ ewarn "fully supports Java ${SLOT}. This JDK must therefore be invoked using its"
+ ewarn "absolute location under ${EPREFIX}/usr/$(get_libdir)/${PN}-${SLOT}."
+ fi
+}
projects / gentoo.git / commitdiff