openjdk-darwin: use a sensible crypto policy

We should really move to a source build of openjdk on Darwin, but that's tricky so for now we continue to hack around it and do stuff like this, even though crypto export polices are stupid and make no sense. No, I'm not bitter at all that I need to do this 😩
NixOS · Mar 15, 2017 · 0cfa1b0 · 0cfa1b0
1 parent 376d960
commit 0cfa1b0
Showing 1 changed file with 10 additions and 1 deletion.
diff --git a/pkgs/development/compilers/openjdk-darwin/8.nix b/pkgs/development/compilers/openjdk-darwin/8.nix
@@ -1,10 +1,16 @@
 { stdenv, fetchurl, unzip, setJavaClassPath, freetype }:
 let
+  jce-policies = fetchurl {
+    # Ugh, unversioned URLs... I hope this doesn't change often enough to cause pain before we move to a Darwin source build of OpenJDK!
+    url    = "http://cdn.azul.com/zcek/bin/ZuluJCEPolicies.zip";
+    sha256 = "0nk7m0lgcbsvldq2wbfni2pzq8h818523z912i7v8hdcij5s48c0";
+  };
+
   jdk = stdenv.mkDerivation {
     name = "zulu1.8.0_66-8.11.0.1";
 
     src = fetchurl {
-      url = http://cdn.azulsystems.com/zulu/bin/zulu1.8.0_66-8.11.0.1-macosx.zip;
+      url = "http://cdn.azulsystems.com/zulu/bin/zulu1.8.0_66-8.11.0.1-macosx.zip";
       sha256 = "0pvbpb3vf0509xm2x1rh0p0w4wmx50zf15604p28z1k8ai1a23sz";
       curlOpts = "-H Referer:https://www.azul.com/downloads/zulu/zulu-linux/";
     };
@@ -15,6 +21,9 @@ let
       mkdir -p $out
       mv * $out
 
+      unzip ${jce-policies}
+      mv -f ZuluJCEPolicies/*.jar $out/jre/lib/security/
+
       # jni.h expects jni_md.h to be in the header search path.
       ln -s $out/include/darwin/*_md.h $out/include/
     '';