After installing Java, what should I set JAVA_HOME to?

After installing Java, what should I set JAVA_HOME to?

[Zachary Kanfer]

[-- Attachment #1: Type: text/plain, Size: 1763 bytes --]

I've installed the java compiler (see the manifest file at [1] the end of
this email). I'm able to compile Java files directly, which is great.

But I started the gradle quickstart guide
<https://docs.gradle.org/current/userguide/tutorial_java_projects.html>,
and I've started running into problems. Right now I have $JAVA_HOME set to
/home/zck/.guix-profile/, but I am suspecting that is not right. When I run
`./gradlew clean`, I get the following error:

    zck@zck-laptop:~/code/gradle-test$ ./gradlew clean
    Downloading https://services.gradle.org/distributions/gradle-3.0-bin.zip

    Exception in thread "main" javax.net.ssl.SSLException:
java.lang.RuntimeException: Unexpected error:
java.security.InvalidAlgorithmParameterException:
the trustAnchors parameter must be non-empty

(further stacktrace elided)

When I run `sudo ./gradlew clean`, it works fine. My suspicion is that it's
related to $JAVA_HOME being symlinked to something not owned by my current
user (/home/zck/.guix-profile is a symlink to
/var/guix/profiles/per-user/zck/guix-profile/, which is a symlink to
/var/guix/profiles/per-user/zck/guix-profile-20-link/, which is a symlink
to /gnu/store/c483gnpwwcmcwdbdba25q3c7x1g79mzm-profile/, which is owned by
root/guixbuild, although this directory has permissions to read and execute
for all users).

Further supporting my suspicion that JAVA_HOME shouldn't be the guix
profile is that I would think either guix or java should manage the
directory, but not both.

So my question is: what's going on here? What do I need to change to be
able to run gradle as my current user? Thanks.

[1] The manifest file to install javac is:

(use-package-modules java)

(packages->manifest
 (list ;;java
       icedtea
       (list icedtea "jdk")))

[-- Attachment #2: Type: text/html, Size: 2148 bytes --]

Re: After installing Java, what should I set JAVA_HOME to?

[Chris Marusich]

[-- Attachment #1: Type: text/plain, Size: 1212 bytes --]

Hi Zachary,

Zachary Kanfer <zkanfer@gmail.com> writes:

> But I started the gradle quickstart guide, and I've started running
> into problems. Right now I have $JAVA_HOME set to
> /home/zck/.guix-profile/, but I am suspecting that is not right. When
> I run `./gradlew clean`, I get the following error:
>
> zck@zck-laptop:~/code/gradle-test$ ./gradlew clean
> Downloading
> https://services.gradle.org/distributions/gradle-3.0-bin.zip
>
> Exception in thread "main" javax.net.ssl.SSLException:
> java.lang.RuntimeException: Unexpected error:
> java.security.InvalidAlgorithmParameterException: the trustAnchors
> parameter must be non-empty
>
> (further stacktrace elided)

Perhaps Java cannot find/access the truststore (or can access it but
found nothing in it)?  Do you know what trust store is being used?
Where is it, and what are its permissions?

> Further supporting my suspicion that JAVA_HOME shouldn't be the guix
> profile is that I would think either guix or java should manage the
> directory, but not both.

I think a bigger question here is why do you need to use Gradle directly
to build your project?  What's stopping you from using Guix to do it?

-- 
Chris

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 818 bytes --]

Re: After installing Java, what should I set JAVA_HOME to?

[Zachary Kanfer]

[-- Attachment #1: Type: text/plain, Size: 1848 bytes --]

I don't want to use Guix to build my project because I'm developing it. So,
for example, I want to run tests often, and that uses Gradle. I want to
integrate a build into my editor. I want to make a Guix manifest that can
set up a machine for other people to use, and they don't want to use Guix
for day-to-day development.

I am not sure what trust store is being used. I'm also not sure how to
check what trust store is being used.

So when using Guix, what should $JAVA_HOME be set to? Has anyone else done
a Java setup using Guix?

On Nov 2, 2016 2:18 AM, "Chris Marusich" <cmmarusich@gmail.com> wrote:

> Hi Zachary,
>
> Zachary Kanfer <zkanfer@gmail.com> writes:
>
> > But I started the gradle quickstart guide, and I've started running
> > into problems. Right now I have $JAVA_HOME set to
> > /home/zck/.guix-profile/, but I am suspecting that is not right. When
> > I run `./gradlew clean`, I get the following error:
> >
> > zck@zck-laptop:~/code/gradle-test$ ./gradlew clean
> > Downloading
> > https://services.gradle.org/distributions/gradle-3.0-bin.zip
> >
> > Exception in thread "main" javax.net.ssl.SSLException:
> > java.lang.RuntimeException: Unexpected error:
> > java.security.InvalidAlgorithmParameterException: the trustAnchors
> > parameter must be non-empty
> >
> > (further stacktrace elided)
>
> Perhaps Java cannot find/access the truststore (or can access it but
> found nothing in it)?  Do you know what trust store is being used?
> Where is it, and what are its permissions?
>
> > Further supporting my suspicion that JAVA_HOME shouldn't be the guix
> > profile is that I would think either guix or java should manage the
> > directory, but not both.
>
> I think a bigger question here is why do you need to use Gradle directly
> to build your project?  What's stopping you from using Guix to do it?
>
> --
> Chris
>

[-- Attachment #2: Type: text/html, Size: 2565 bytes --]

Re: After installing Java, what should I set JAVA_HOME to?

[Ludovic Courtès]

Hello,

Zachary Kanfer <zkanfer@gmail.com> skribis:

> I don't want to use Guix to build my project because I'm developing it. So,
> for example, I want to run tests often, and that uses Gradle. I want to
> integrate a build into my editor. I want to make a Guix manifest that can
> set up a machine for other people to use, and they don't want to use Guix
> for day-to-day development.
>
> I am not sure what trust store is being used. I'm also not sure how to
> check what trust store is being used.
>
> So when using Guix, what should $JAVA_HOME be set to? Has anyone else done
> a Java setup using Guix?

I don’t use Java so can’t really help, but in commit
f21403e2b6f5a9491937a0cc9f31fc113998ce5e, Ricardo modified icedtea-6 so
that it generates its “keystore” from the certificates in ‘nss-certs’.

Could that be related?

HTH,
Ludo’.

Re: After installing Java, what should I set JAVA_HOME to?

[Ricardo Wurmus]

Zachary Kanfer <zkanfer@gmail.com> writes:

> I am not sure what trust store is being used. I'm also not sure how to
> check what trust store is being used.

You can get more debug information by adding the following option to
your invocation of “java”:

    -Djavax.net.debug=ssl

You can override the trust store with

    -Djavax.net.ssl.trustStore=/path/to/jdk/lib/security/cacerts

~~ Ricardo

Re: After installing Java, what should I set JAVA_HOME to?

[Chris Marusich]

[-- Attachment #1: Type: text/plain, Size: 1796 bytes --]

Zachary Kanfer <zkanfer@gmail.com> writes:

> I don't want to use Guix to build my project because I'm developing
> it. So, for example, I want to run tests often, and that uses
> Gradle. I want to integrate a build into my editor. I want to make a
> Guix manifest that can set up a machine for other people to use, and
> they don't want to use Guix for day-to-day development.

I see.  I know that some people have been using Guix for local
development [1] [2], so I thought that maybe you could use Guix for
local development in this case, too.  If it isn't possible, then I
wonder what we would need to change or add to make it possible?

> So when using Guix, what should $JAVA_HOME be set to? Has anyone else done a Java setup using Guix?

I haven't tried local Java development with Guix, so I don't know much
about how it ought to be done.  There don't seem to be many Java
packages in Guix yet, so I suspect a lot of machinery that we need might
not be there.

I tried installing java-junit in a temporary profile with 'guix package
-p test-profile -i java-junit', and 'guix package -p test-profile
--search-paths' doesn't recommend any search paths...  It seems that it
just installed a JAR file, so the way you'd set up the CLASSPATH for
local development seems unclear to me.  In your case, I don't really
know what you'd want to set JAVA_HOME to, either, if anything.

Anyway, in the meantime, I hope you can figure out how to get Gradle
working with the Guix-installed Java.  If you do, please let me know;
I'm interested in learning more about how one would do Java development
with Guix.

[1] https://lists.gnu.org/archive/html/guix-devel/2016-05/msg00736.html
[2] https://lists.gnu.org/archive/html/guix-devel/2016-07/msg01738.html

-- 
Chris

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 818 bytes --]

Re: After installing Java, what should I set JAVA_HOME to?

[Hartmut Goebel]

Hi Zachary,

Am 09.11.2016 um 08:01 schrieb Chris Marusich:
> Anyway, in the meantime, I hope you can figure out how to get Gradle
> working with the Guix-installed Java.  If you do, please let me know;
> I'm interested in learning more about how one would do Java development
> with Guix.

If you are working on gradle, you may be interested in this thread and
esp. in the last message:
<https://lists.gnu.org/archive/html/guix-devel/2016-09/msg00990.html>

-- 
Regards
Hartmut Goebel

| Hartmut Goebel          | h.goebel@crazy-compilers.com               |
| www.crazy-compilers.com | compilers which you thought are impossible |

Re: After installing Java, what should I set JAVA_HOME to?

[Zachary Kanfer]

[-- Attachment #1: Type: text/plain, Size: 3621 bytes --]

I want Guix to be widely adopted, because I think it's a really cool piece
of software that deserves more support. To that end, I want to write about
how high switching costs "use Guix for everything" has, and how much I
think Guix adoption will be harmed by this advice.

Guix is an alternative package manager. That is, it competes with package
managers like aptitude, yum, etc. So people are going to have to switch
from these package managers. And I'm hearing that not only do I have the
required complexity of understanding a new package manager, but unlike
other package managers, I need to change my entire way of using the
installed packages.

This is like inventing a new recipe, and requiring that all diners at your
restaurant eschew forks while eating the meal.

Having to switch the way I *use* installed packages is a /significant/
downside to using Guix. If Guix could be used to install packages in an OS,
and then Guix did not require new ways of using the packages, it would be
easy to convince others to use it: "here's a file specifying everything you
need to set your machine up, then use it like you're used to". But
"everything you do needs to change" is an impossible sell, for example, for
me at work.

I'm running into the same problem running a clojure project with leiningen.
Note that for both things I've tried to do, "use Guix for building
everything" means that I can no longer follow any tutorial I find, since
the tutorials I'm using are Gradle and Clojure tutorials. I hope to figure
this out and report back, but I'm not especially optimistic, because I know
that my problems will be entirely fixed with `apt-get install java`, and I
have little idea what's really going on.

Thanks.

On Nov 9, 2016 2:01 AM, "Chris Marusich" <cmmarusich@gmail.com> wrote:

> Zachary Kanfer <zkanfer@gmail.com> writes:
>
> > I don't want to use Guix to build my project because I'm developing
> > it. So, for example, I want to run tests often, and that uses
> > Gradle. I want to integrate a build into my editor. I want to make a
> > Guix manifest that can set up a machine for other people to use, and
> > they don't want to use Guix for day-to-day development.
>
> I see.  I know that some people have been using Guix for local
> development [1] [2], so I thought that maybe you could use Guix for
> local development in this case, too.  If it isn't possible, then I
> wonder what we would need to change or add to make it possible?
>
> > So when using Guix, what should $JAVA_HOME be set to? Has anyone else
> done a Java setup using Guix?
>
> I haven't tried local Java development with Guix, so I don't know much
> about how it ought to be done.  There don't seem to be many Java
> packages in Guix yet, so I suspect a lot of machinery that we need might
> not be there.
>
> I tried installing java-junit in a temporary profile with 'guix package
> -p test-profile -i java-junit', and 'guix package -p test-profile
> --search-paths' doesn't recommend any search paths...  It seems that it
> just installed a JAR file, so the way you'd set up the CLASSPATH for
> local development seems unclear to me.  In your case, I don't really
> know what you'd want to set JAVA_HOME to, either, if anything.
>
> Anyway, in the meantime, I hope you can figure out how to get Gradle
> working with the Guix-installed Java.  If you do, please let me know;
> I'm interested in learning more about how one would do Java development
> with Guix.
>
> [1] https://lists.gnu.org/archive/html/guix-devel/2016-05/msg00736.html
> [2] https://lists.gnu.org/archive/html/guix-devel/2016-07/msg01738.html
>
> --
> Chris
>

[-- Attachment #2: Type: text/html, Size: 4621 bytes --]

Re: After installing Java, what should I set JAVA_HOME to?

[Ricardo Wurmus]

Zachary Kanfer <zkanfer@gmail.com> writes:

> I want Guix to be widely adopted, because I think it's a really cool piece
> of software that deserves more support. To that end, I want to write about
> how high switching costs "use Guix for everything" has, and how much I
> think Guix adoption will be harmed by this advice.

Java is a bit of a special case for Guix.  We build *everything* from
source and that’s something the Java world seems to have agreed not to
do.  This means that there aren’t many Java packages in Guix at this
point and getting Java stuff to work is messy.

Right now I would not use Guix to develop Java things (I’m saying this
as the person who packaged the OpenJDK and various Java libraries for
Guix).  It takes a lot of effort to bootstrap Maven from source and I
don’t know of any other distribution that has even attempted to do
this.  (Maven relies on Maven and usually comes with a bootstrapped
binary to facilitate building Maven.)

That said, I had no problems *using* the Java toolchain for compiling
Java code or for running pre-compiled code from third-party jars.

-- 
Ricardo

GPG: BCA6 89B6 3655 3801 C3C6  2150 197A 5888 235F ACAC
http://elephly.net

Re: After installing Java, what should I set JAVA_HOME to?

[zloster]

[-- Attachment #1: Type: text/plain, Size: 2136 bytes --]


On 28.11.2016 10:45, Ricardo Wurmus wrote:

> Zachary Kanfer <zkanfer@gmail.com> writes:
>
>> I want Guix to be widely adopted, because I think it's a really cool piece
>> of software that deserves more support. To that end, I want to write about
>> how high switching costs "use Guix for everything" has, and how much I
>> think Guix adoption will be harmed by this advice.

Hi,

I've tried to describe what kind of problem mr. Kanfer is hitting here: 
https://lists.gnu.org/archive/html/help-guix/2016-11/msg00035.html I've 
also described a possible workaround.

I'll try to add some more explanation.

> That said, I had no problems *using* the Java toolchain for compiling
> Java code or for running pre-compiled code from third-party jars.
>
Here I'll try again to demonstrate the problem (the big screenshot 
below). On the left I'm starting with installed packages:
guix package --list-installed
There is icedtea-3.1.0
I call `java -version` and everything is OK.
I call `which java` to get the location of java executable. It's in my 
profile.
On the right I'm listing /lib/security/java.security file.
There is a line starting with `security.provider.9` and it tells the JVM 
to go to ${java.home}/lib/security/nss.cfg for NSS configuration and 
there is NO `nss.cfg` in the same directory. This is the problem.
The value of ${java.home} is `.home` which I believe doesn't exist (on 
the right last lines).
On the right I also check the two directories in the store where 
`nss.cfg` file exists. It is in two directories which contain the 
JRE(Java Runtime Environment) portion of the JDK. Their 
`jre/lib/security/java.security` files again contain 
`security.provider.9=sun.security.pkcs11.SunPKCS11 
${java.home}/lib/security/nss.cfg but in this case they have a `nss.cfg` 
in the same directory and it is pointing to NSS installations in the store.

With this configuration `mvn` and the other tools that need to perform 
cryptography operations will fail. My case was binary distribution of 
Tomcat failing to start with similar exception about SSL. With the 
described workaround I was able to start Tomcat.

My GuixSD

[-- Attachment #2.1: Type: text/html, Size: 3115 bytes --]

[-- Attachment #2.2: 2016-11-29-164530_1920x1080_scrot.png --]
[-- Type: image/png, Size: 92486 bytes --]

Re: After installing Java, what should I set JAVA_HOME to?

[Ricardo Wurmus]

zloster <more@edno.moe> writes:

> There is icedtea-3.1.0

That’s the problem: icedtea 3.1.0 cannot build the keystore, which is
why this build phase has been removed.

IcedTea (the free software build system for OpenJDK) doesn’t come with a
keystore by default and doesn’t try to generate it, so what we do in
Guix is to add a build phase in which a “cacerts” file is built from the
NSS certificate store and saved to “$jdk/jre/lib/security” and
“$jre/lib/security”.

For 3.1.0 this phase fails for unknown reasons, so I removed it.  This
means that 3.1.0 doesn’t have SSL support out of the box.  The two
previous versions however do, so if you want to avoid custom hacks I
encourage you to install 2.6.7:

    guix package -i icedtea@2.6

-- 
Ricardo

GPG: BCA6 89B6 3655 3801 C3C6  2150 197A 5888 235F ACAC
http://elephly.net

Re: After installing Java, what should I set JAVA_HOME to?

[Ludovic Courtès]

Hello Zachary,

Zachary Kanfer <zkanfer@gmail.com> skribis:

> This is like inventing a new recipe, and requiring that all diners at your
> restaurant eschew forks while eating the meal.
>
> Having to switch the way I *use* installed packages is a /significant/
> downside to using Guix.

I think we all agree here that Guix shouldn’t force you to use a
different kind of fork.  ;-)

In general, using a package installed with Guix doesn’t involve any
changes, apart from extra settings if you’re using Guix on a “foreign
distros”¹.

I don’t understand the Java situation well enough, but if there’s
something that forces you to “use a different kind of fork”, then it’s
either a bug or missing documentation in Guix.  That is, you should
definitely be able to use Gradle if that is what you want to do.

Now, I understand that there’s no Gradle package in Guix yet, Ricardo’s
email discusses this issue.

Thanks,
Ludo’.

¹ https://www.gnu.org/software/guix/manual/html_node/Application-Setup.html

Re: After installing Java, what should I set JAVA_HOME to?

[Hartmut Goebel]

Hi,

as Ricardo already wrote, bootstrapping Java packages from source is a
nightmare since gradle requires itself for building. And it requires a
lot of other Java packages which again require gradle for building. This
Gordian Knot can be cut by someone brave and knowledgeable about the
.pom files or whatever is the Java-way for describing the build-process.

I tried doing some work on this and gave up.

Am 28.11.2016 um 06:15 schrieb Zachary Kanfer:
> means that I can no longer follow any tutorial I find, since the
> tutorials I'm using are Gradle and Clojure tutorials

When using gradle for building your software, you should be able to
follow the tutorial. Yo only need to install gradle itself from (what
they call) "source.

-- 
Regards
Hartmut Goebel

| Hartmut Goebel          | h.goebel@crazy-compilers.com               |
| www.crazy-compilers.com | compilers which you thought are impossible |

Re: After installing Java, what should I set JAVA_HOME to?

[Chris Marusich]

[-- Attachment #1: Type: text/plain, Size: 1550 bytes --]

Hi Zachary,

Zachary Kanfer <zkanfer@gmail.com> writes:

> I want Guix to be widely adopted, because I think it's a really cool
> piece of software that deserves more support. To that end, I want to
> write about how high switching costs "use Guix for everything" has,
> and how much I think Guix adoption will be harmed by this advice.

I agree with Ludo' when he says that "Guix shouldn't’t force you to use a
different kind of fork."  You ought to be able to install Java using
Guix, install Gradle using some other mechanism, and then use the Java
from Guix to build Gradle projects.  This is a reasonable thing to want
to do, especially since so much Java support is missing from Guix today.

However, in the long term, I believe the day will come when Guix can be
used to manage all (or at least most) of the stuff that something like
Gradle does today.  I hope that on that day, instead of using an
alternative like Gradle, we'll be able to develop our Java projects
using Guix, build them using Guix, and deploy them using Guix.  Java
developers will be able to enjoy all the benefits of Guix.  But unless
people contribute in this area, that day won't come quickly.  That's why
I asked you in my original email: "What's stopping you from using Guix
to do it [to build your project]?"  I wasn't criticizing you for using
Gradle; I was inviting you to help us figure out where the remaining
gaps are and how we can fill them in.

In the end, were you able to get Java from Guix working with Gradle?

-- 
Chris

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 818 bytes --]

Re: After installing Java, what should I set JAVA_HOME to?

[Ricardo Wurmus]

Zachary Kanfer <zkanfer@gmail.com> writes:

> But I started the gradle quickstart guide
> <https://docs.gradle.org/current/userguide/tutorial_java_projects.html>,
> and I've started running into problems. Right now I have $JAVA_HOME set to
> /home/zck/.guix-profile/, but I am suspecting that is not right. When I run
> `./gradlew clean`, I get the following error:
>
>     zck@zck-laptop:~/code/gradle-test$ ./gradlew clean
>     Downloading https://services.gradle.org/distributions/gradle-3.0-bin.zip
>
>     Exception in thread "main" javax.net.ssl.SSLException:
> java.lang.RuntimeException: Unexpected error:
> java.security.InvalidAlgorithmParameterException:
> the trustAnchors parameter must be non-empty

[…]

> [1] The manifest file to install javac is:
>
> (use-package-modules java)
>
> (packages->manifest
>  (list ;;java
>        icedtea
>        (list icedtea "jdk")))

You only need “(list icedtea "jdk")” here.  The “jdk” output of the
“icedtea” package includes the JRE, which is the only thing you get with
the standard output of “icedtea”.

Versions 6 and 7 of “icedtea” come with a build phase to generate a
keystore.  I’m using this successfully with “jgit”, which has to
validate SSL certs.

As to the value of JAVA_HOME: I only ever set it in Guix package
expressions, where it is set to the directory name of the store item for
the “jdk” output.

~~ Ricardo

Re: After installing Java, what should I set JAVA_HOME to?

[Radoslav Petrov]

[-- Attachment #1: Type: text/plain, Size: 4084 bytes --]

Hi, all. Apologises for the bad formatting but I wasn't member of the 
mailing list when this message was sent.
|    Downloading 
https://services.gradle.org/distributions/gradle-3.0-bin.zip
|
|    Exception in thread "main" javax.net.ssl.SSLException: 
java.lang.RuntimeException: Unexpected error: 
|java.security.InvalidAlgorithmParameterException: the trustAnchors 
parameter must be non-empty
|(further stacktrace elided)

| When I run `sudo ./gradlew clean`, it works fine. My suspicion is that 
it's related to $JAVA_HOME being symlinked to  something not owned by my 
current user (/home/zck/.guix-profile is a symlink to 
/var/guix/profiles/per-user/zck/guix-profile/, | which is a symlink to 
/var/guix/profiles/per-user/zck/guix-profile-20-link/, which is a 
symlink to /gnu/store/c483gnpwwcmcwdbdba25q3c7x1g79mzm-profile/, which 
is owned by root/guixbuild, although this directory has permissions to 
read and execute for all users).
|
| Further supporting my suspicion that JAVA_HOME shouldn't be the guix 
profile is that I would think either guix or java should manage the 
directory, but not both.
|
|So my question is: what's going on here? What do I need to change to be 
able to run gradle as my current user? Thanks.

Two weeks ago I was playing with GuixSD and decided to try to run Apache 
Tomcat on it. I've downloaded the Linux binary archive and installed 
icedtea3 JDK (Java 8). I've hit the same problem described above: Java 
is available and able to compile/run various code, but Tomcat was 
throwing exceptions and was not able to start.
After some trials, errors and reading I've found the problem:
   IcedTea is configured to use NSS service for handling the 
cryptography operations. The default install/config of the IcedTea in 
Guix configures "jdk_base_dir/jre/lib/security/nss.cfg" file correctly. 
Mine looks like this:

name = NSS

nssLibraryDirectory = /gnu/store/p2d98rbmb5sl7xgca8rf96k6zq51cww6-nss-3.27.1/lib/nss

nssDbMode = noDb

attributes = compatibility

handleStartupErrors = ignoreMultipleInitialisation

However this settings to take effect the JDK needs one more setting in 
another file: "jdk_base_dir/jre/lib/security/java.security" i.e. the 
same directory as "nss.cfg". Read the comments in the begging of the 
file to get a glimpse of what is configured there. If you look VERY 
closely around "List of providers and their security settings" you will 
see this:

security.provider.9=sun.security.pkcs11.SunPKCS11*${java.home}/lib/security/nss.cfg *

This file exists(I'm not sure about this - I think I've found some file 
without the setting) in Guix but doesn't have the correct location of 
the NSS library set.
My workaround was to manually override the JDK security settings by 
creating "nss.cfg" and "java.security" files in Tomcat "tomcat_base/bin" 
dir and point them to the correct locations. Here is the JDK cmd option 
(setting it through /bin/setenv.sh):

  -Djava.security.properties=java.security

The contents of the custom "java.security" are copied from the original 
file. Only the line for the "nss.cfg" is changed:

security.provider.9=sun.security.pkcs11.SunPKCS11 nss.cfg

The contents of the custom "nss.cfg"

name=NSS

nssLibraryDirectory=/var/guix/profiles/per-user/zloster/guix-profile/lib/nss

nssDbMode=noDb

attributes=compatibility

Most probably this is not the most appropriate way to configure the 
JDK/NSS relation in Guix but for a workaround it is fine.

Here is a screenshot of Tomcat running (glorious moment for me:) ): 
https://www.edno.moe/image-share/2016-11-11-210342_1920x1080_scrot.png

About a proper fix: IMO iced3 JDK Guix definition needs to process 
"java.security" file for the SunPKCS11 provider to override the 
JAVA_HOME definition with the file in the current version/dir/instance 
of the Guix package (I'm not sure for the correct term). But this have 
to be done on each update/upgrade of NSS package. So I'm not so sure 
about the proper way to fix this packaging problem.

-- 
Поздрави,       | Best regards,
Радослав Петров | Radoslav Petrov


[-- Attachment #2: Type: text/html, Size: 5043 bytes --]

Re: After installing Java, what should I set JAVA_HOME to?

[Chris Marusich]

[-- Attachment #1: Type: text/plain, Size: 996 bytes --]

Radoslav Petrov <more@edno.moe> writes:

> About a proper fix: IMO iced3 JDK Guix definition needs to process
> "java.security" file for the SunPKCS11 provider to override the
> JAVA_HOME definition with the file in the current version/dir/instance
> of the Guix package (I'm not sure for the correct term). But this have
> to be done on each update/upgrade of NSS package. So I'm not so sure
> about the proper way to fix this packaging problem.

This sounds right to me.  If I'm hearing you correctly, there is a
configuration file in the output of the icedtea package which needs to
be updated whenever the nss package is updated.  I believe the correct
way to accomplish that is to use "static composition" or "late static
composition" [1].  I'm sure a convenient mechanism for this exists in
Guix, but since I haven't done it myself, I'm not sure of the details.

[1] See section 7.1.1 in Eelco Dolstra's thesis:
http://nixos.org/%7Eeelco/pubs/phd-thesis.pdf

-- 
Chris

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 818 bytes --]

Re: After installing Java, what should I set JAVA_HOME to?

[Ludovic Courtès]

Chris Marusich <cmmarusich@gmail.com> skribis:

> Radoslav Petrov <more@edno.moe> writes:
>
>> About a proper fix: IMO iced3 JDK Guix definition needs to process
>> "java.security" file for the SunPKCS11 provider to override the
>> JAVA_HOME definition with the file in the current version/dir/instance
>> of the Guix package (I'm not sure for the correct term). But this have
>> to be done on each update/upgrade of NSS package. So I'm not so sure
>> about the proper way to fix this packaging problem.
>
> This sounds right to me.  If I'm hearing you correctly, there is a
> configuration file in the output of the icedtea package which needs to
> be updated whenever the nss package is updated.  I believe the correct
> way to accomplish that is to use "static composition" or "late static
> composition" [1].  I'm sure a convenient mechanism for this exists in
> Guix, but since I haven't done it myself, I'm not sure of the details.
>
> [1] See section 7.1.1 in Eelco Dolstra's thesis:
> http://nixos.org/%7Eeelco/pubs/phd-thesis.pdf

‘wrap-program’ in (guix build utils) roughly correspond to what’s
described as “late static composition” in Eelco’s thesis.

Ludo’.

Re: After installing Java, what should I set JAVA_HOME to?

[Ricardo Wurmus]

Chris Marusich <cmmarusich@gmail.com> writes:

> Radoslav Petrov <more@edno.moe> writes:
>
>> About a proper fix: IMO iced3 JDK Guix definition needs to process
>> "java.security" file for the SunPKCS11 provider to override the
>> JAVA_HOME definition with the file in the current version/dir/instance
>> of the Guix package (I'm not sure for the correct term). But this have
>> to be done on each update/upgrade of NSS package. So I'm not so sure
>> about the proper way to fix this packaging problem.
>
> This sounds right to me.  If I'm hearing you correctly, there is a
> configuration file in the output of the icedtea package which needs to
> be updated whenever the nss package is updated.  I believe the correct
> way to accomplish that is to use "static composition" or "late static
> composition" [1].  I'm sure a convenient mechanism for this exists in
> Guix, but since I haven't done it myself, I'm not sure of the details.
>
> [1] See section 7.1.1 in Eelco Dolstra's thesis:
> http://nixos.org/%7Eeelco/pubs/phd-thesis.pdf

We are already genarting the keystore for IcedTea.  It just fails for
IcedTea 3, which is why it’s disabled there.  IcedTea 2 should work just
fine.

-- 
Ricardo

GPG: BCA6 89B6 3655 3801 C3C6  2150 197A 5888 235F ACAC
http://elephly.net