OS X Port Fails to Build

David Schlosnagle schlosna at gmail.com
Fri Jul 1 23:49:34 PDT 2011

On Fri, Jul 1, 2011 at 8:28 PM, John Yeary <johnyeary at gmail.com> wrote:
> -jaf_src-url-bundle:
>     [echo] Downloading from https://java.net/downloads/jax-ws/JDK7/jdk7-jaf-2010_08_19.zip
>      [get] Getting: https://java.net/downloads/jax-ws/JDK7/jdk7-jaf-2010_08_19.zip
>      [get] To: /Users/jyeary/Downloads/OpenJDK/macosx-port/build/macosx-universal/jaxws/drop/bundles/jdk7-jaf-2010_08_19.zip.temp
>      [get] Error getting https://java.net/downloads/jax-ws/JDK7/jdk7-jaf-2010_08_19.zip to /Users/jyeary/Downloads/OpenJDK/macosx-port/build/macosx-universal/jaxws/drop/bundles/jdk7-jaf-2010_08_19.zip.temp
> /Users/jyeary/Downloads/OpenJDK/macosx-port/build/macosx-universal/jaxws/build/xml_generated/build-drop-jaf_src.xml:96: javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty


The JDK you are using as your BOOTDIR likely has an empty cacerts, so
ant cannot download the
https://java.net/downloads/jax-ws/JDK7/jdk7-jaf-2010_08_19.zip file.
There are several ways to solve this problem:

Option 1) Use HTTP rather than HTTPS to download the
jdk7-jaf-2010_08_19.zip. Here's a quick patch for the jaxws repo to do
just that. I'm wondering if this is something that would make sense to
push to macosx-port and even upstream.

  diff --git a/jaxws.properties b/jaxws.properties
  --- a/jaxws.properties
  +++ b/jaxws.properties
  @@ -36,1 +36,1 @@

Option 2) Create a drops directory and manually download the necessary
JAXP and JAX-WS dependencies, and then pass the full path to the
directory via ALT_DROPS_DIR [1]. This has the nice side effect that
you can then run offline builds (ALLOW_DOWNLOADS=false) once your
drops directory is setup. To setup you drop directory:
  mkdir drop && \
    cd drop && \
      curl -L -O http://download.java.net/jaxp/1.4.5/jaxp145_01.zip && \
      curl -L -O
&& \
      curl -L -O http://java.net/downloads/jax-ws/JDK7/jdk7-jaf-2010_08_19.zip

Then when you're building include the following ALT_DROPS_DIR as a
make argument:
  make \
    ALT_DROPS_DIR=/full/path/to/your/openjdk/drop \
    ... other options ...

Option 3) Pass the path to a valid trust keystore as a system property
via ANT_OPTS environment variable and set the make flag
ALLOW_DOWNLOADS=true to download the dependencies at build time. For
example, assuming you want to use the cacerts from the Apple JDK 6

  APPLE_JAVA_6_HOME=`/usr/libexec/java_home -v 1.6`
  env -i \
    PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin:/usr/X11/bin \
    ANT_OPTS="-Djavax.net.ssl.trustStore=${CACERTS_FILE}" \
  make \
    ... other options ...

Option 4) Use keytool to fix your trust keystore for your boot JDK by
importing the proper trusted certificate authorities so that the
java.net SSL cert can be validated.

Hope that helps. For reference, I've shared my compile.sh that I use
to build macosx-port.

- Dave

[1]: http://hg.openjdk.java.net/jdk7/build/raw-file/tip/README-builds.html#drops
[2]: http://hg.openjdk.java.net/jdk7/build/raw-file/tip/README-builds.html#cacerts
[3]: https://gist.github.com/1059756

More information about the macosx-port-dev mailing list