OS X Port Fails to Build

[David Schlosnagle]

On Fri, Jul 1, 2011 at 8:28 PM, John Yeary <johnyeary at gmail.com> wrote:
> -jaf_src-url-bundle:
>     [echo] Downloading from https://java.net/downloads/jax-ws/JDK7/jdk7-jaf-2010_08_19.zip
>      [get] Getting: https://java.net/downloads/jax-ws/JDK7/jdk7-jaf-2010_08_19.zip
>      [get] To: /Users/jyeary/Downloads/OpenJDK/macosx-port/build/macosx-universal/jaxws/drop/bundles/jdk7-jaf-2010_08_19.zip.temp
>      [get] Error getting https://java.net/downloads/jax-ws/JDK7/jdk7-jaf-2010_08_19.zip to /Users/jyeary/Downloads/OpenJDK/macosx-port/build/macosx-universal/jaxws/drop/bundles/jdk7-jaf-2010_08_19.zip.temp
>
> BUILD FAILED
> /Users/jyeary/Downloads/OpenJDK/macosx-port/build/macosx-universal/jaxws/build/xml_generated/build-drop-jaf_src.xml:96: javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty

John,

The JDK you are using as your BOOTDIR likely has an empty cacerts, so
ant cannot download the
https://java.net/downloads/jax-ws/JDK7/jdk7-jaf-2010_08_19.zip file.
There are several ways to solve this problem:

Option 1) Use HTTP rather than HTTPS to download the
jdk7-jaf-2010_08_19.zip. Here's a quick patch for the jaxws repo to do
just that. I'm wondering if this is something that would make sense to
push to macosx-port and even upstream.

  diff --git a/jaxws.properties b/jaxws.properties
  --- a/jaxws.properties
  +++ b/jaxws.properties
  @@ -36,1 +36,1 @@
  -jaf_src.master.bundle.url.base=https://java.net/downloads/jax-ws/JDK7
  +jaf_src.master.bundle.url.base=http://java.net/downloads/jax-ws/JDK7



Option 2) Create a drops directory and manually download the necessary
JAXP and JAX-WS dependencies, and then pass the full path to the
directory via ALT_DROPS_DIR [1]. This has the nice side effect that
you can then run offline builds (ALLOW_DOWNLOADS=false) once your
drops directory is setup. To setup you drop directory:
  cd $YOUR_OPENJDK_REPO
  mkdir drop && \
    cd drop && \
      curl -L -O http://download.java.net/jaxp/1.4.5/jaxp145_01.zip && \
      curl -L -O
http://download.java.net/glassfish/components/jax-ws/openjdk/jdk7/jdk7-jaxws2_2_4-b03-2011_05_27.zip
&& \
      curl -L -O http://java.net/downloads/jax-ws/JDK7/jdk7-jaf-2010_08_19.zip

Then when you're building include the following ALT_DROPS_DIR as a
make argument:
  make \
    ALLOW_DOWNLOADS=false \
    ALT_DROPS_DIR=/full/path/to/your/openjdk/drop \
    ... other options ...


Option 3) Pass the path to a valid trust keystore as a system property
via ANT_OPTS environment variable and set the make flag
ALLOW_DOWNLOADS=true to download the dependencies at build time. For
example, assuming you want to use the cacerts from the Apple JDK 6
[2]:

  APPLE_JAVA_6_HOME=`/usr/libexec/java_home -v 1.6`
  CACERTS_FILE=${APPLE_JAVA_6_HOME}/lib/security/cacerts
  unset LC_ALL LANG CLASSPATH JAVA_HOME LD_LIBRARY_PATH;
  cd $YOUR_OPENJDK_REPO
  env -i \
    PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin:/usr/X11/bin \
    ANT_OPTS="-Djavax.net.ssl.trustStore=${CACERTS_FILE}" \
  make \
    ALLOW_DOWNLOADS=true \
    ... other options ...

Option 4) Use keytool to fix your trust keystore for your boot JDK by
importing the proper trusted certificate authorities so that the
java.net SSL cert can be validated.

Hope that helps. For reference, I've shared my compile.sh that I use
to build macosx-port.

- Dave

[1]: http://hg.openjdk.java.net/jdk7/build/raw-file/tip/README-builds.html#drops
[2]: http://hg.openjdk.java.net/jdk7/build/raw-file/tip/README-builds.html#cacerts
[3]: https://gist.github.com/1059756