NixOS/nixpkgs — pull request #5282 by rickynils (2014-12-10 16:21:56+00:00)
Title: openjdk: Read SSL truststore from JAVAX_NET_SSL_TRUSTSTORE

This small patch makes it possible to control java's truststore path through the environment. This makes it possible to add custom CAs that should be allowed by Java. Java users can still use `-Djavax.net.ssl.truststore` to point Java at another truststore, in that case `JAVAX_NET_SSL_TRUSTSTORE` will be overridden.

Something like this can be used to build the truststore (in this example just using the standard `pkgs.cacert` CA-bundle):

```nix
{
environment.variables.JAVAX_NET_SSL_TRUSTSTORE = "${
pkgs.runCommand "cacerts" {} ''
${pkgs.perl}/bin/perl \
${pkgs.path}/pkgs/development/compilers/openjdk/generate-cacerts.pl \
${pkgs.jre}/bin/keytool \
${pkgs.cacert}/etc/ca-bundle.crt
mv cacerts $out
''
}";
}
```

Ideally, the dependency on `pkgs.cacert` should also be removed from `pkgs.openjdk` to avoid rebuilding java each time the standard CA-bundle changes. Something along the example above should then be added to NixOS (however, it would be nice to not depend on `${pkgs.jre}/bin/keytool` to generate that environment variable.