push sheeet

pkgs/development/compilers/openjdk/11/patches/currency-date-range-jdk10.patch

@@ -0,0 +1,13 @@
+--- ./make/jdk/src/classes/build/tools/generatecurrencydata/GenerateCurrencyData.java
++++ ./make/jdk/src/classes/build/tools/generatecurrencydata/GenerateCurrencyData.java
+@@ -281,8 +281,8 @@
+             checkCurrencyCode(newCurrency);
+             String timeString = currencyInfo.substring(4, length - 4);
+             long time = format.parse(timeString).getTime();
+-            if (Math.abs(time - System.currentTimeMillis()) > ((long) 10) * 365 * 24 * 60 * 60 * 1000) {
+-                throw new RuntimeException("time is more than 10 years from present: " + time);
++            if (Math.abs(time - System.currentTimeMillis()) > ((long) 20) * 365 * 24 * 60 * 60 * 1000) {
++                throw new RuntimeException("time is more than 20 years from present: " + time);
+             }
+             specialCaseCutOverTimes[specialCaseCount] = time;
+             specialCaseOldCurrencies[specialCaseCount] = oldCurrency;

pkgs/development/compilers/openjdk/11/patches/fix-java-home-jdk10.patch

@@ -0,0 +1,14 @@
+--- a/src/hotspot/os/linux/os_linux.cpp	2017-07-04 23:09:02.533972226 -0400
++++ b/src/hotspot/os/linux/os_linux.cpp	2017-07-04 23:07:52.118338845 -0400
+@@ -2270,8 +2270,5 @@
+   assert(ret, "cannot locate libjvm");
+   char *rp = NULL;
+   if (ret && dli_fname[0] != '\0') {
+-    rp = os::Posix::realpath(dli_fname, buf, buflen);
+-  }
+-  if (rp == NULL) {
+-    return;
++    snprintf(buf, buflen, "%s", dli_fname);
+   }
+
+   if (Arguments::sun_java_launcher_is_altjvm()) {

pkgs/development/compilers/openjdk/11/patches/fix-library-path-jdk11.patch

@@ -0,0 +1,55 @@
+From 83f97773ea99fe2191a49e551ea43d51c9a765cd Mon Sep 17 00:00:00 2001
+Subject: [PATCH] strip some hard-coded default paths for libs and extensions
+
+---
+ src/hotspot/os/linux/os_linux.cpp | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/src/hotspot/os/linux/os_linux.cpp b/src/hotspot/os/linux/os_linux.cpp
+index 476b1c2175..2695ed2301 100644
+--- a/src/hotspot/os/linux/os_linux.cpp
++++ b/src/hotspot/os/linux/os_linux.cpp
+@@ -417,20 +417,20 @@ void os::init_system_properties_values() {
+   //        ...
+   //        7: The default directories, normally /lib and /usr/lib.
+ #if defined(AMD64) || (defined(_LP64) && defined(SPARC)) || defined(PPC64) || defined(S390)
+-  #define DEFAULT_LIBPATH "/usr/lib64:/lib64:/lib:/usr/lib"
++  #define DEFAULT_LIBPATH ""
+ #else
+ #if defined(AARCH64)
+   // Use 32-bit locations first for AARCH64 (a 64-bit architecture), since some systems
+   // might not adhere to the FHS and it would be a change in behaviour if we used
+   // DEFAULT_LIBPATH of other 64-bit architectures which prefer the 64-bit paths.
+-  #define DEFAULT_LIBPATH "/lib:/usr/lib:/usr/lib64:/lib64"
++  #define DEFAULT_LIBPATH ""
+ #else
+-  #define DEFAULT_LIBPATH "/lib:/usr/lib"
++  #define DEFAULT_LIBPATH ""
+ #endif // AARCH64
+ #endif
+ 
+ // Base path of extensions installed on the system.
+-#define SYS_EXT_DIR     "/usr/java/packages"
++#define SYS_EXT_DIR     ""
+ #define EXTENSIONS_DIR  "/lib/ext"
+ 
+   // Buffer that fits several sprintfs.
+@@ -490,13 +490,13 @@ void os::init_system_properties_values() {
+                                                      strlen(v) + 1 +
+                                                      sizeof(SYS_EXT_DIR) + sizeof("/lib/") + sizeof(DEFAULT_LIBPATH) + 1,
+                                                      mtInternal);
+-    sprintf(ld_library_path, "%s%s" SYS_EXT_DIR "/lib:" DEFAULT_LIBPATH, v, v_colon);
++    sprintf(ld_library_path, "%s", v);
+     Arguments::set_library_path(ld_library_path);
+     FREE_C_HEAP_ARRAY(char, ld_library_path);
+   }
+ 
+   // Extensions directories.
+-  sprintf(buf, "%s" EXTENSIONS_DIR ":" SYS_EXT_DIR EXTENSIONS_DIR, Arguments::get_java_home());
++  sprintf(buf, "%s" EXTENSIONS_DIR, Arguments::get_java_home());
+   Arguments::set_ext_dirs(buf);
+ 
+   FREE_C_HEAP_ARRAY(char, buf);
+--
+2.35.1
+

pkgs/development/compilers/openjdk/11/patches/increase-javadoc-heap.patch

@@ -0,0 +1,12 @@
+--- a/make/Docs.gmk       2019-07-24 13:07:37.013405090 -0400
++++ b/make/Docs.gmk       2019-07-24 13:07:28.406550535 -0400
+@@ -274,7 +274,7 @@
+   $1_INDIRECT_EXPORTS := $$(call FindTransitiveIndirectDepsForModules, $$($1_MODULES))
+   $1_ALL_MODULES := $$(sort $$($1_MODULES) $$($1_INDIRECT_EXPORTS))
+ 
+-  $1_JAVA_ARGS := -Dextlink.spec.version=$$(VERSION_SPECIFICATION)
++  $1_JAVA_ARGS := -Dextlink.spec.version=$$(VERSION_SPECIFICATION) -Xmx1G
+ 
+   ifeq ($$(ENABLE_FULL_DOCS), true)
+     # Tell the ModuleGraph taglet to generate html links to soon-to-be-created
+

pkgs/development/compilers/openjdk/11/patches/read-truststore-from-env-jdk10.patch

@@ -0,0 +1,30 @@
+--- a/src/java.base/share/classes/sun/security/ssl/TrustStoreManager.java	2017-06-26 21:48:25.000000000 -0400
++++ b/src/java.base/share/classes/sun/security/ssl/TrustStoreManager.java	2017-07-05 20:45:57.491295030 -0400
+@@ -71,6 +71,7 @@
+      *
+      * The preference of the default trusted KeyStore is:
+      *    javax.net.ssl.trustStore
++     *    system environment variable JAVAX_NET_SSL_TRUSTSTORE
+      *    jssecacerts
+      *    cacerts
+      */
+@@ -132,7 +133,8 @@
+                 public TrustStoreDescriptor run() {
+                     // Get the system properties for trust store.
+                     String storePropName = System.getProperty(
+-                            "javax.net.ssl.trustStore", jsseDefaultStore);
++                            "javax.net.ssl.trustStore",
++                            System.getenv("JAVAX_NET_SSL_TRUSTSTORE"));
+                     String storePropType = System.getProperty(
+                             "javax.net.ssl.trustStoreType",
+                             KeyStore.getDefaultType());
+@@ -144,6 +146,9 @@
+                     String temporaryName = "";
+                     File temporaryFile = null;
+                     long temporaryTime = 0L;
++                    if (storePropName == null) {
++                        storePropName = jsseDefaultStore;
++                    }
+                     if (!"NONE".equals(storePropName)) {
+                         String[] fileNames =
+                                 new String[] {storePropName, defaultStore};

pkgs/development/compilers/openjdk/11/patches/swing-use-gtk-jdk10.patch

@@ -0,0 +1,24 @@
+--- a/src/java.desktop/share/classes/javax/swing/UIManager.java
++++ b/src/java.desktop/share/classes/javax/swing/UIManager.java
+@@ -607,11 +607,9 @@
+         if (osType == OSInfo.OSType.WINDOWS) {
+             return "com.sun.java.swing.plaf.windows.WindowsLookAndFeel";
+         } else {
+-            String desktop = AccessController.doPrivileged(new GetPropertyAction("sun.desktop"));
+             Toolkit toolkit = Toolkit.getDefaultToolkit();
+-            if ("gnome".equals(desktop) &&
+-                    toolkit instanceof SunToolkit &&
+-                    ((SunToolkit) toolkit).isNativeGTKAvailable()) {
++            if (toolkit instanceof SunToolkit &&
++                    ((SunToolkit) toolkit).isNativeGTKAvailable()) {
+                 // May be set on Linux and Solaris boxs.
+                 return "com.sun.java.swing.plaf.gtk.GTKLookAndFeel";
+             }
+@@ -1341,7 +1339,7 @@
+             lafName = (String) lafData.remove("defaultlaf");
+         }
+         if (lafName == null) {
+-            lafName = getCrossPlatformLookAndFeelClassName();
++            lafName = getSystemLookAndFeelClassName();
+         }
+         lafName = swingProps.getProperty(defaultLAFKey, lafName);

pkgs/development/compilers/openjdk/11/source.json

@@ -0,0 +1,6 @@
+{
+  "hash": "sha256-yJljuO6jflh6kbe4ipflPiNDbKvKyA4grMAFu4UCM+Y=",
+  "owner": "openjdk",
+  "repo": "jdk11u",
+  "rev": "refs/tags/jdk-11.0.28+6"
+}

pkgs/development/compilers/openjdk/17/patches/fix-library-path-jdk17.patch

@@ -0,0 +1,61 @@
+diff --git a/src/hotspot/os/linux/os_linux.cpp b/src/hotspot/os/linux/os_linux.cpp
+index 7c951cee51..bcc61ff43d 100644
+--- a/src/hotspot/os/linux/os_linux.cpp
++++ b/src/hotspot/os/linux/os_linux.cpp
+@@ -416,18 +416,8 @@
+   //        1: ...
+   //        ...
+   //        7: The default directories, normally /lib and /usr/lib.
+-#ifndef OVERRIDE_LIBPATH
+-  #if defined(_LP64)
+-    #define DEFAULT_LIBPATH "/usr/lib64:/lib64:/lib:/usr/lib"
+-  #else
+-    #define DEFAULT_LIBPATH "/lib:/usr/lib"
+-  #endif
+-#else
+-  #define DEFAULT_LIBPATH OVERRIDE_LIBPATH
+-#endif
+ 
+ // Base path of extensions installed on the system.
+-#define SYS_EXT_DIR     "/usr/java/packages"
+ #define EXTENSIONS_DIR  "/lib/ext"
+ 
+   // Buffer that fits several snprintfs.
+@@ -435,7 +425,7 @@
+   // by the nulls included by the sizeof operator.
+   const size_t bufsize =
+     MAX2((size_t)MAXPATHLEN,  // For dll_dir & friends.
+-         (size_t)MAXPATHLEN + sizeof(EXTENSIONS_DIR) + sizeof(SYS_EXT_DIR) + sizeof(EXTENSIONS_DIR)); // extensions dir
++         (size_t)MAXPATHLEN + sizeof(EXTENSIONS_DIR) + sizeof(EXTENSIONS_DIR)); // extensions dir
+   char *buf = NEW_C_HEAP_ARRAY(char, bufsize, mtInternal);
+ 
+   // sysclasspath, java_home, dll_dir
+@@ -482,24 +472,20 @@
+     // should always exist (until the legacy problem cited above is
+     // addressed).
+     const char *v = ::getenv("LD_LIBRARY_PATH");
+-    const char *v_colon = ":";
+-    if (v == NULL) { v = ""; v_colon = ""; }
+-    // That's +1 for the colon and +1 for the trailing '\0'.
+-    size_t pathsize = strlen(v) + 1 + sizeof(SYS_EXT_DIR) + sizeof("/lib/") + sizeof(DEFAULT_LIBPATH) + 1;
++    if (v == NULL) { v = ""; }
++    size_t pathsize = strlen(v) + 1;
+     char *ld_library_path = NEW_C_HEAP_ARRAY(char, pathsize, mtInternal);
+-    os::snprintf_checked(ld_library_path, pathsize, "%s%s" SYS_EXT_DIR "/lib:" DEFAULT_LIBPATH, v, v_colon);
++    os::snprintf_checked(ld_library_path, pathsize, "%s", v);
+     Arguments::set_library_path(ld_library_path);
+     FREE_C_HEAP_ARRAY(char, ld_library_path);
+   }
+ 
+   // Extensions directories.
+-  os::snprintf_checked(buf, bufsize, "%s" EXTENSIONS_DIR ":" SYS_EXT_DIR EXTENSIONS_DIR, Arguments::get_java_home());
++  os::snprintf_checked(buf, bufsize, "%s" EXTENSIONS_DIR, Arguments::get_java_home());
+   Arguments::set_ext_dirs(buf);
+ 
+   FREE_C_HEAP_ARRAY(char, buf);
+ 
+-#undef DEFAULT_LIBPATH
+-#undef SYS_EXT_DIR
+ #undef EXTENSIONS_DIR
+ }
+ 

pkgs/development/compilers/openjdk/17/patches/ignore-LegalNoticeFilePlugin-jdk17.patch

@@ -0,0 +1,21 @@
+--- a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/plugins/LegalNoticeFilePlugin.java
++++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/plugins/LegalNoticeFilePlugin.java
+@@ -112,18 +112,6 @@
+             .filter(e -> Arrays.equals(e.contentBytes(), entry.contentBytes()))
+             .findFirst();
+         if (!otarget.isPresent()) {
+-            if (errorIfNotSameContent) {
+-                // all legal notices of the same file name are expected
+-                // to contain the same content
+-                Optional<ResourcePoolEntry> ores =
+-                    entries.stream().filter(e -> e.linkedTarget() == null)
+-                           .findAny();
+-
+-                if (ores.isPresent()) {
+-                    throw new PluginException(ores.get().path() + " " +
+-                        entry.path() + " contain different content");
+-                }
+-            }
+             entries.add(entry);
+         } else {
+             entries.add(ResourcePoolEntry.createSymLink(entry.path(),

pkgs/development/compilers/openjdk/17/patches/increase-javadoc-heap-jdk13.patch

@@ -0,0 +1,12 @@
+diff -uw -r a/make/Docs.gmk b/make/Docs.gmk
+--- a/make/Docs.gmk	2019-10-09 08:05:43.107349180 -0400
++++ b/make/Docs.gmk	2019-10-09 08:09:29.330118790 -0400
+@@ -277,7 +277,7 @@
+   $1_ALL_MODULES := $$(sort $$($1_MODULES) $$($1_INDIRECT_EXPORTS))
+ 
+   $1_JAVA_ARGS := -Dextlink.spec.version=$$(VERSION_SPECIFICATION) \
+-	-Djspec.version=$$(VERSION_SPECIFICATION)
++	-Djspec.version=$$(VERSION_SPECIFICATION) -Xmx1G
+ 
+   ifeq ($$(ENABLE_FULL_DOCS), true)
+     # Tell the ModuleGraph taglet to generate html links to soon-to-be-created

pkgs/development/compilers/openjdk/17/patches/swing-use-gtk-jdk13.patch

@@ -0,0 +1,22 @@
+--- a/src/java.desktop/share/classes/javax/swing/UIManager.java	2019-08-08 01:05:04.000000000 -0400
++++ b/src/java.desktop/share/classes/javax/swing/UIManager.java	2019-10-09 08:20:31.791606748 -0400
+@@ -660,9 +660,8 @@
+             Toolkit toolkit = Toolkit.getDefaultToolkit();
+             if (toolkit instanceof SunToolkit) {
+                 SunToolkit suntk = (SunToolkit)toolkit;
+-                String desktop = suntk.getDesktop();
+                 boolean gtkAvailable = suntk.isNativeGTKAvailable();
+-                if ("gnome".equals(desktop) && gtkAvailable) {
++                if (gtkAvailable) {
+                     return "com.sun.java.swing.plaf.gtk.GTKLookAndFeel";
+                 }
+             }
+@@ -1397,7 +1396,7 @@
+             lafName = lafData.remove("defaultlaf");
+         }
+         if (lafName == null) {
+-            lafName = getCrossPlatformLookAndFeelClassName();
++            lafName = getSystemLookAndFeelClassName();
+         }
+         lafName = swingProps.getProperty(defaultLAFKey, lafName);
+ 

pkgs/development/compilers/openjdk/17/source.json

@@ -0,0 +1,6 @@
+{
+  "hash": "sha256-YN9mPfi3oMGjeRIren2cdWWySpYXsIcOnP29Zh3ym8c=",
+  "owner": "openjdk",
+  "repo": "jdk17u",
+  "rev": "refs/tags/jdk-17.0.16+8"
+}

pkgs/development/compilers/openjdk/21/patches/fix-java-home-jdk21.patch

@@ -0,0 +1,14 @@
+--- a/src/hotspot/os/linux/os_linux.cpp	2017-07-04 23:09:02.533972226 -0400
++++ b/src/hotspot/os/linux/os_linux.cpp	2017-07-04 23:07:52.118338845 -0400
+@@ -2270,8 +2270,5 @@
+   assert(ret, "cannot locate libjvm");
+   char *rp = nullptr;
+   if (ret && dli_fname[0] != '\0') {
+-    rp = os::Posix::realpath(dli_fname, buf, buflen);
+-  }
+-  if (rp == nullptr) {
+-    return;
++    snprintf(buf, buflen, "%s", dli_fname);
+   }
+
+   if (Arguments::sun_java_launcher_is_altjvm()) {

pkgs/development/compilers/openjdk/21/patches/ignore-LegalNoticeFilePlugin-jdk18.patch

@@ -0,0 +1,21 @@
+--- a/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/plugins/LegalNoticeFilePlugin.java
++++ b/src/jdk.jlink/share/classes/jdk/tools/jlink/internal/plugins/LegalNoticeFilePlugin.java
+@@ -112,18 +112,6 @@
+             .filter(e -> Arrays.equals(e.contentBytes(), entry.contentBytes()))
+             .findFirst();
+         if (otarget.isEmpty()) {
+-            if (errorIfNotSameContent) {
+-                // all legal notices of the same file name are expected
+-                // to contain the same content
+-                Optional<ResourcePoolEntry> ores =
+-                    entries.stream().filter(e -> e.linkedTarget() == null)
+-                           .findAny();
+-
+-                if (ores.isPresent()) {
+-                    throw new PluginException(ores.get().path() + " " +
+-                        entry.path() + " contain different content");
+-                }
+-            }
+             entries.add(entry);
+         } else {
+             entries.add(ResourcePoolEntry.createSymLink(entry.path(),

pkgs/development/compilers/openjdk/21/source.json

@@ -0,0 +1,6 @@
+{
+  "hash": "sha256-8wUwxjhAGIp1bzny2e86vPH9q4vw1kLDoTjO7FrJbx4=",
+  "owner": "openjdk",
+  "repo": "jdk21u",
+  "rev": "refs/tags/jdk-21.0.8+9"
+}

pkgs/development/compilers/openjdk/23/source.json

@@ -0,0 +1,6 @@
+{
+  "hash": "sha256-zlL2DV6iOfV3hgq/Ci95gTwVrhcvz5MWsg4/+O2ntE8=",
+  "owner": "openjdk",
+  "repo": "jdk23u",
+  "rev": "refs/tags/jdk-23.0.2+7"
+}

pkgs/development/compilers/openjdk/25/patches/fix-java-home-jdk25.patch

@@ -0,0 +1,13 @@
+--- a/src/hotspot/os/linux/os_linux.cpp	2025-04-08 14:43:06.765198522 +0200
++++ b/src/hotspot/os/linux/os_linux.cpp	2025-04-08 14:43:27.890301990 +0200
+@@ -2758,9 +2758,7 @@
+   assert(ret, "cannot locate libjvm");
+   char *rp = nullptr;
+   if (ret && dli_fname[0] != '\0') {
+-    rp = os::realpath(dli_fname, buf, buflen);
+-  }
+-  if (rp == nullptr) {
++    snprintf(buf, buflen, "%s", dli_fname);
+     return;
+   }
+ 

pkgs/development/compilers/openjdk/25/patches/make-4.4.1.patch

@@ -0,0 +1,25 @@
+diff --git a/make/PreInit.gmk b/make/PreInit.gmk
+index 3df44308dd..490d7c24e9 100644
+--- a/make/PreInit.gmk
++++ b/make/PreInit.gmk
+@@ -60,13 +60,19 @@
+ # Extract non-global targets that require a spec file.
+ CALLED_SPEC_TARGETS := $(filter-out $(ALL_GLOBAL_TARGETS), $(CALLED_TARGETS))
+ 
++# GNU make-4.4 (and later) include not just single-letter form of the
++# options MAKEFILES but also long for and even some of the arguments.
++# Skip long form and use only short form:
++#     MAKEFLAGS=' --debug=basic -- LOG=trace ...'
++MAKEFLAGS_SINGLE_LETTER := $(firstword -$(MAKEFLAGS))
++
+ # If we have only global targets, or if we are called with -qp (assuming an
+ # external part, e.g. bash completion, is trying to understand our targets),
+ # we will skip SPEC location and the sanity checks.
+ ifeq ($(CALLED_SPEC_TARGETS), )
+   SKIP_SPEC := true
+ endif
+-ifeq ($(findstring p, $(MAKEFLAGS))$(findstring q, $(MAKEFLAGS)), pq)
++ifeq ($(findstring p, $(MAKEFLAGS_SINGLE_LETTER))$(findstring q, $(MAKEFLAGS_SINGLE_LETTER)), pq)
+   SKIP_SPEC := true
+ endif
+ 

pkgs/development/compilers/openjdk/25/patches/read-truststore-from-env-jdk25.patch

@@ -0,0 +1,30 @@
+--- a/src/java.base/share/classes/sun/security/ssl/TrustStoreManager.java	2017-06-26 21:48:25.000000000 -0400
++++ b/src/java.base/share/classes/sun/security/ssl/TrustStoreManager.java	2017-07-05 20:45:57.491295030 -0400
+@@ -71,6 +71,7 @@
+      *
+      * The preference of the default trusted KeyStore is:
+      *    javax.net.ssl.trustStore
++     *    system environment variable JAVAX_NET_SSL_TRUSTSTORE
+      *    jssecacerts
+      *    cacerts
+      */
+@@ -125,7 +126,8 @@
+         static TrustStoreDescriptor run() {
+             // Get the system properties for trust store.
+             String storePropName = System.getProperty(
+-                    "javax.net.ssl.trustStore", jsseDefaultStore);
++                    "javax.net.ssl.trustStore",
++                    System.getenv("JAVAX_NET_SSL_TRUSTSTORE"));
+             String storePropType = System.getProperty(
+                     "javax.net.ssl.trustStoreType",
+                     KeyStore.getDefaultType());
+@@ -137,6 +139,9 @@
+             String temporaryName = "";
+             File temporaryFile = null;
+             long temporaryTime = 0L;
++            if (storePropName == null) {
++                storePropName = jsseDefaultStore;
++            }
+             if (!"NONE".equals(storePropName)) {
+                 String[] fileNames =
+                         new String[] {storePropName, defaultStore};

pkgs/development/compilers/openjdk/25/source.json

@@ -0,0 +1,6 @@
+{
+  "hash": "sha256-5kQ7xPyWGk/weVYVVNEFPUF1HspfisqcPHA+DM6Q35c=",
+  "owner": "openjdk",
+  "repo": "jdk25u",
+  "rev": "refs/tags/jdk-25+36"
+}

pkgs/development/compilers/openjdk/8/patches/currency-date-range-jdk8.patch

@@ -0,0 +1,14 @@
+diff -Naur openjdk-7u65-b32-upstream/jdk/make/tools/src/build/tools/generatecurrencydata/GenerateCurrencyData.java openjdk-7u65-b32/jdk/make/tools/src/build/tools/generatecurrencydata/GenerateCurrencyData.java
+--- openjdk-7u65-b32-upstream/jdk/make/src/classes/build/tools/generatecurrencydata/GenerateCurrencyData.java	2014-07-17 05:42:14.000000000 -0430
++++ openjdk-7u65-b32/jdk/make/src/classes/build/tools/generatecurrencydata/GenerateCurrencyData.java	2014-12-30 10:15:50.327905933 -0430
+@@ -281,8 +281,8 @@
+             checkCurrencyCode(newCurrency);
+             String timeString = currencyInfo.substring(4, length - 4);
+             long time = format.parse(timeString).getTime();
+-            if (Math.abs(time - System.currentTimeMillis()) > ((long) 10) * 365 * 24 * 60 * 60 * 1000) {
+-                throw new RuntimeException("time is more than 10 years from present: " + time);
++            if (Math.abs(time - System.currentTimeMillis()) > ((long) 20) * 365 * 24 * 60 * 60 * 1000) {
++                throw new RuntimeException("time is more than 20 years from present: " + time);
+             }
+             specialCaseCutOverTimes[specialCaseCount] = time;
+             specialCaseOldCurrencies[specialCaseCount] = oldCurrency;

pkgs/development/compilers/openjdk/8/patches/fix-java-home-jdk8.patch

@@ -0,0 +1,15 @@
+--- a/hotspot/src/os/linux/vm/os_linux.cpp  2015-02-04 21:14:39.000000000 +0100
++++ b/hotspot/src/os/linux/vm/os_linux.cpp  2015-05-19 16:17:29.960107613 +0200
+@@ -2304,10 +2304,8 @@
+   assert(ret, "cannot locate libjvm");
+   char *rp = NULL;
+   if (ret && dli_fname[0] != '\0') {
+-    rp = realpath(dli_fname, buf);
++    snprintf(buf, buflen, "%s", dli_fname);
+   }
+-  if (rp == NULL)
+-    return;
+
+   if (Arguments::created_by_gamma_launcher()) {
+     // Support for the gamma launcher.  Typical value for buf is
+

pkgs/development/compilers/openjdk/8/patches/fix-library-path-jdk8.patch

@@ -0,0 +1,37 @@
+diff --git a/hotspot/src/os/linux/vm/os_linux.cpp b/hotspot/src/os/linux/vm/os_linux.cpp
+index c477851c1b..ff5e28d95b 100644
+--- a/hotspot/src/os/linux/vm/os_linux.cpp
++++ b/hotspot/src/os/linux/vm/os_linux.cpp
+@@ -368,13 +368,13 @@ void os::init_system_properties_values() {
+ //        ...
+ //        7: The default directories, normally /lib and /usr/lib.
+ #if defined(AMD64) || defined(_LP64) && (defined(SPARC) || defined(PPC) || defined(S390))
+-#define DEFAULT_LIBPATH "/usr/lib64:/lib64:/lib:/usr/lib"
++#define DEFAULT_LIBPATH ""
+ #else
+-#define DEFAULT_LIBPATH "/lib:/usr/lib"
++#define DEFAULT_LIBPATH ""
+ #endif
+ 
+ // Base path of extensions installed on the system.
+-#define SYS_EXT_DIR     "/usr/java/packages"
++#define SYS_EXT_DIR     ""
+ #define EXTENSIONS_DIR  "/lib/ext"
+ #define ENDORSED_DIR    "/lib/endorsed"
+ 
+@@ -437,13 +437,13 @@ void os::init_system_properties_values() {
+                                                      strlen(v) + 1 +
+                                                      sizeof(SYS_EXT_DIR) + sizeof("/lib/") + strlen(cpu_arch) + sizeof(DEFAULT_LIBPATH) + 1,
+                                                      mtInternal);
+-    sprintf(ld_library_path, "%s%s" SYS_EXT_DIR "/lib/%s:" DEFAULT_LIBPATH, v, v_colon, cpu_arch);
++    sprintf(ld_library_path, "%s", v);
+     Arguments::set_library_path(ld_library_path);
+     FREE_C_HEAP_ARRAY(char, ld_library_path, mtInternal);
+   }
+ 
+   // Extensions directories.
+-  sprintf(buf, "%s" EXTENSIONS_DIR ":" SYS_EXT_DIR EXTENSIONS_DIR, Arguments::get_java_home());
++  sprintf(buf, "%s" EXTENSIONS_DIR, Arguments::get_java_home());
+   Arguments::set_ext_dirs(buf);
+ 
+   // Endorsed standards default directory.

pkgs/development/compilers/openjdk/8/patches/read-truststore-from-env-jdk8.patch

@@ -0,0 +1,30 @@
+--- a/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java	2017-06-26 21:48:25.000000000 -0400
++++ b/jdk/src/share/classes/sun/security/ssl/TrustStoreManager.java	2017-07-05 20:45:57.491295030 -0400
+@@ -71,6 +71,7 @@
+      *
+      * The preference of the default trusted KeyStore is:
+      *    javax.net.ssl.trustStore
++     *    system environment variable JAVAX_NET_SSL_TRUSTSTORE
+      *    jssecacerts
+      *    cacerts
+      */
+@@ -132,7 +133,8 @@
+                 public TrustStoreDescriptor run() {
+                     // Get the system properties for trust store.
+                     String storePropName = System.getProperty(
+-                            "javax.net.ssl.trustStore", jsseDefaultStore);
++                            "javax.net.ssl.trustStore",
++                            System.getenv("JAVAX_NET_SSL_TRUSTSTORE"));
+                     String storePropType = System.getProperty(
+                             "javax.net.ssl.trustStoreType",
+                             KeyStore.getDefaultType());
+@@ -144,6 +146,9 @@
+                     String temporaryName = "";
+                     File temporaryFile = null;
+                     long temporaryTime = 0L;
++                    if (storePropName == null) {
++                        storePropName = jsseDefaultStore;
++                    }
+                     if (!"NONE".equals(storePropName)) {
+                         String[] fileNames =
+                                 new String[] {storePropName, defaultStore};

pkgs/development/compilers/openjdk/8/patches/swing-use-gtk-jdk8.patch

@@ -0,0 +1,26 @@
+diff -ru3 a/jdk/src/share/classes/javax/swing/UIManager.java b/jdk/src/share/classes/javax/swing/UIManager.java
+--- a/jdk/src/share/classes/javax/swing/UIManager.java	2016-07-26 00:41:37.000000000 +0300
++++ b/jdk/src/share/classes/javax/swing/UIManager.java	2016-10-02 22:46:01.890071761 +0300
+@@ -607,11 +607,9 @@
+         if (osType == OSInfo.OSType.WINDOWS) {
+             return "com.sun.java.swing.plaf.windows.WindowsLookAndFeel";
+         } else {
+-            String desktop = AccessController.doPrivileged(new GetPropertyAction("sun.desktop"));
+             Toolkit toolkit = Toolkit.getDefaultToolkit();
+-            if ("gnome".equals(desktop) &&
+-                    toolkit instanceof SunToolkit &&
+-                    ((SunToolkit) toolkit).isNativeGTKAvailable()) {
++            if (toolkit instanceof SunToolkit &&
++                    ((SunToolkit) toolkit).isNativeGTKAvailable()) {
+                 // May be set on Linux and Solaris boxs.
+                 return "com.sun.java.swing.plaf.gtk.GTKLookAndFeel";
+             }
+@@ -1341,7 +1339,7 @@
+             lafName = (String) lafData.remove("defaultlaf");
+         }
+         if (lafName == null) {
+-            lafName = getCrossPlatformLookAndFeelClassName();
++            lafName = getSystemLookAndFeelClassName();
+         }
+         lafName = swingProps.getProperty(defaultLAFKey, lafName);
+ 

pkgs/development/compilers/openjdk/8/source.json

@@ -0,0 +1,6 @@
+{
+  "hash": "sha256-CQZKhDojo+a4vZsIzRM/KoUfR17LedQYBWCRJxDFJUM=",
+  "owner": "openjdk",
+  "repo": "jdk8u",
+  "rev": "refs/tags/jdk8u462-b08"
+}

pkgs/development/compilers/openjdk/generic.nix

@@ -0,0 +1,636 @@
+{
+  featureVersion,
+
+  lib,
+  stdenv,
+
+  fetchurl,
+  fetchpatch,
+
+  buildPackages,
+  autoPatchelfHook,
+  pkg-config,
+  autoconf,
+  lndir,
+  unzip,
+  ensureNewerSourcesForZipFilesHook,
+  pandoc,
+
+  cpio,
+  file,
+  which,
+  zip,
+  zlib,
+  cups,
+  freetype,
+  harfbuzz,
+  alsa-lib,
+  libjpeg,
+  giflib,
+  libpng,
+  lcms2,
+  libX11,
+  libICE,
+  libXext,
+  libXrender,
+  libXtst,
+  libXt,
+  libXi,
+  libXinerama,
+  libXcursor,
+  libXrandr,
+  fontconfig,
+
+  setJavaClassPath,
+
+  versionCheckHook,
+
+  liberation_ttf,
+  cacert,
+  jre-generate-cacerts,
+
+  nixpkgs-openjdk-updater,
+
+  # TODO(@sternenseemann): gtk3 fails to evaluate in pkgsCross.ghcjs.buildPackages
+  # which should be fixable, this is a no-rebuild workaround for GHC.
+  headless ? lib.versionAtLeast featureVersion "21" && stdenv.targetPlatform.isGhcjs,
+
+  enableJavaFX ? false,
+  openjfx17,
+  openjfx21,
+  openjfx23,
+  openjfx25,
+  openjfx_jdk ?
+    {
+      "17" = openjfx17;
+      "21" = openjfx21;
+      "23" = openjfx23;
+      "25" = openjfx25;
+    }
+    .${featureVersion} or (throw "JavaFX is not supported on OpenJDK ${featureVersion}"),
+
+  enableGtk ? true,
+  gtk3,
+  gtk2,
+  glib,
+
+  temurin-bin-8,
+  temurin-bin-11,
+  temurin-bin-17,
+  temurin-bin-21,
+  temurin-bin-23,
+  temurin-bin-25,
+  jdk-bootstrap ?
+    {
+      "8" = temurin-bin-8.__spliced.buildBuild or temurin-bin-8;
+      "11" = temurin-bin-11.__spliced.buildBuild or temurin-bin-11;
+      "17" = temurin-bin-17.__spliced.buildBuild or temurin-bin-17;
+      "21" = temurin-bin-21.__spliced.buildBuild or temurin-bin-21;
+      "23" = temurin-bin-23.__spliced.buildBuild or temurin-bin-23;
+      "25" = temurin-bin-25.__spliced.buildBuild or temurin-bin-25;
+    }
+    .${featureVersion},
+}:
+
+let
+  sourceFile = ./. + "/${featureVersion}/source.json";
+  source = nixpkgs-openjdk-updater.openjdkSource {
+    inherit sourceFile;
+    featureVersionPrefix = tagPrefix + featureVersion;
+  };
+
+  atLeast11 = lib.versionAtLeast featureVersion "11";
+  atLeast17 = lib.versionAtLeast featureVersion "17";
+  atLeast21 = lib.versionAtLeast featureVersion "21";
+  atLeast23 = lib.versionAtLeast featureVersion "23";
+  atLeast25 = lib.versionAtLeast featureVersion "25";
+
+  tagPrefix = if atLeast11 then "jdk-" else "jdk";
+  version = lib.removePrefix "refs/tags/${tagPrefix}" source.src.rev;
+  versionSplit = builtins.match (if atLeast11 then "(.+)+(.+)" else "(.+)-b(.+)") version;
+  versionBuild = lib.elemAt versionSplit 1;
+
+  # The JRE 8 libraries are in directories that depend on the CPU.
+  architecture =
+    if atLeast11 then
+      ""
+    else
+      {
+        i686-linux = "i386";
+        x86_64-linux = "amd64";
+        aarch64-linux = "aarch64";
+        powerpc64le-linux = "ppc64le";
+      }
+      .${stdenv.system} or (throw "Unsupported platform ${stdenv.system}");
+
+  jdk-bootstrap' = jdk-bootstrap.override {
+    # when building a headless jdk, also bootstrap it with a headless jdk
+    gtkSupport = !headless;
+  };
+in
+
+assert lib.assertMsg (lib.pathExists sourceFile)
+  "OpenJDK ${featureVersion} is not a supported version";
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "openjdk" + lib.optionalString headless "-headless";
+  inherit version;
+
+  outputs = [
+    "out"
+  ]
+  ++ lib.optionals (!atLeast11) [
+    "jre"
+  ];
+
+  inherit (source) src;
+
+  patches = [
+    (
+      if atLeast25 then
+        ./25/patches/fix-java-home-jdk25.patch
+      else if atLeast21 then
+        ./21/patches/fix-java-home-jdk21.patch
+      else if atLeast11 then
+        ./11/patches/fix-java-home-jdk10.patch
+      else
+        ./8/patches/fix-java-home-jdk8.patch
+    )
+    (
+      if atLeast25 then
+        ./25/patches/read-truststore-from-env-jdk25.patch
+      else if atLeast11 then
+        ./11/patches/read-truststore-from-env-jdk10.patch
+      else
+        ./8/patches/read-truststore-from-env-jdk8.patch
+    )
+  ]
+  ++ lib.optionals (!atLeast23) [
+    (
+      if atLeast11 then
+        ./11/patches/currency-date-range-jdk10.patch
+      else
+        ./8/patches/currency-date-range-jdk8.patch
+    )
+  ]
+  ++ lib.optionals atLeast11 [
+    (
+      if atLeast17 then
+        ./17/patches/increase-javadoc-heap-jdk13.patch
+      else
+        ./11/patches/increase-javadoc-heap.patch
+    )
+  ]
+  ++ lib.optionals atLeast17 [
+    (
+      if atLeast21 then
+        ./21/patches/ignore-LegalNoticeFilePlugin-jdk18.patch
+      else
+        ./17/patches/ignore-LegalNoticeFilePlugin-jdk17.patch
+    )
+  ]
+  ++ lib.optionals (!atLeast21) [
+    (
+      if atLeast17 then
+        ./17/patches/fix-library-path-jdk17.patch
+      else if atLeast11 then
+        ./11/patches/fix-library-path-jdk11.patch
+      else
+        ./8/patches/fix-library-path-jdk8.patch
+    )
+  ]
+  ++ lib.optionals (atLeast17 && !atLeast23) [
+    # -Wformat etc. are stricter in newer gccs, per
+    # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79677
+    # so grab the work-around from
+    # https://src.fedoraproject.org/rpms/java-openjdk/pull-request/24
+    (fetchurl {
+      url = "https://src.fedoraproject.org/rpms/java-openjdk/raw/06c001c7d87f2e9fe4fedeef2d993bcd5d7afa2a/f/rh1673833-remove_removal_of_wformat_during_test_compilation.patch";
+      sha256 = "082lmc30x64x583vqq00c8y0wqih3y4r0mp1c4bqq36l22qv6b6r";
+    })
+  ]
+  ++ lib.optionals (featureVersion == "17") [
+    # Patch borrowed from Alpine to fix build errors with musl libc and recent gcc.
+    # This is applied anywhere to prevent patchrot.
+    (fetchurl {
+      url = "https://git.alpinelinux.org/aports/plain/community/openjdk17/FixNullPtrCast.patch?id=41e78a067953e0b13d062d632bae6c4f8028d91c";
+      sha256 = "sha256-LzmSew51+DyqqGyyMw2fbXeBluCiCYsS1nCjt9hX6zo=";
+    })
+  ]
+  ++ lib.optionals (atLeast11 && !atLeast25) [
+    # Fix build for gnumake-4.4.1:
+    #   https://github.com/openjdk/jdk/pull/12992
+    (fetchpatch {
+      name = "gnumake-4.4.1";
+      url = "https://github.com/openjdk/jdk/commit/9341d135b855cc208d48e47d30cd90aafa354c36.patch";
+      hash = "sha256-Qcm3ZmGCOYLZcskNjj7DYR85R4v07vYvvavrVOYL8vg=";
+    })
+  ]
+  ++ lib.optionals atLeast25 [
+    ./25/patches/make-4.4.1.patch
+  ]
+  ++ lib.optionals (!headless && enableGtk) [
+    (
+      if atLeast17 then
+        ./17/patches/swing-use-gtk-jdk13.patch
+      else if atLeast11 then
+        ./11/patches/swing-use-gtk-jdk10.patch
+      else
+        ./8/patches/swing-use-gtk-jdk8.patch
+    )
+  ];
+
+  strictDeps = true;
+
+  depsBuildBuild = [ buildPackages.stdenv.cc ];
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    pkg-config
+    unzip
+    zip
+    which
+    # Probably for BUILD_CC but not sure, not in closure.
+    zlib
+  ]
+  ++ lib.optionals atLeast11 [
+    autoconf
+  ]
+  ++ lib.optionals (!atLeast11) [
+    lndir
+  ]
+  ++ lib.optionals (!atLeast11 && !stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    # Certificates generated using keytool in `installPhase`
+    buildPackages.jdk8
+  ]
+  ++ lib.optionals atLeast21 [
+    ensureNewerSourcesForZipFilesHook
+  ]
+  ++ lib.optionals atLeast25 [
+    pandoc
+  ];
+
+  buildInputs = [
+    # TODO: Many of these should likely be in `nativeBuildInputs`.
+    cpio
+    # `-lmagic` in NIX_LDFLAGS
+    file
+    cups
+    freetype
+    alsa-lib
+    libjpeg
+    giflib
+    libX11
+    libICE
+    libXext
+    libXrender
+    libXtst
+    libXt
+    libXi
+    libXinerama
+    libXcursor
+    libXrandr
+    fontconfig
+  ]
+  ++ lib.optionals (atLeast11 && !atLeast21) [
+    harfbuzz
+  ]
+  ++ lib.optionals atLeast11 [
+    libpng
+    zlib # duplicate
+    lcms2
+  ]
+  ++ lib.optionals (!headless && enableGtk) [
+    (if atLeast11 then gtk3 else gtk2)
+    glib
+  ];
+
+  propagatedBuildInputs = [ setJavaClassPath ];
+
+  nativeInstallCheckInputs = lib.optionals atLeast23 [
+    versionCheckHook
+  ];
+
+  # JDK's build system attempts to specifically detect
+  # and special-case WSL, and we don't want it to do that,
+  # so pass the correct platform names explicitly
+  configurePlatforms = lib.optionals atLeast17 [
+    "build"
+    "host"
+  ];
+
+  # https://openjdk.org/groups/build/doc/building.html
+  configureFlags = [
+    # https://github.com/openjdk/jdk/blob/471f112bca715d04304cbe35c6ed63df8c7b7fee/make/autoconf/util_paths.m4#L315
+    # Ignoring value of READELF from the environment. Use command line variables instead.
+    "READELF=${stdenv.cc.targetPrefix}readelf"
+    "AR=${stdenv.cc.targetPrefix}ar"
+    "STRIP=${stdenv.cc.targetPrefix}strip"
+    "NM=${stdenv.cc.targetPrefix}nm"
+    "OBJDUMP=${stdenv.cc.targetPrefix}objdump"
+    "OBJCOPY=${stdenv.cc.targetPrefix}objcopy"
+    "--with-boot-jdk=${jdk-bootstrap'.home}"
+    "--enable-unlimited-crypto"
+    "--with-native-debug-symbols=internal"
+    "--with-stdc++lib=dynamic"
+    "--with-zlib=system"
+    "--with-giflib=system"
+  ]
+  ++ (
+    if atLeast23 then
+      [
+        "--with-version-string=${version}"
+        "--with-vendor-version-string=(nix)"
+      ]
+    else if atLeast11 then
+      lib.optionals atLeast17 [
+        "--with-version-build=${versionBuild}"
+        "--with-version-opt=nixos"
+      ]
+      ++ [
+        "--with-version-pre="
+      ]
+    else
+      [
+        "--with-update-version=${lib.removePrefix "${featureVersion}u" (lib.elemAt versionSplit 0)}"
+        "--with-build-number=${versionBuild}"
+        "--with-milestone=fcs"
+      ]
+  )
+  ++ lib.optionals (!atLeast21) (
+    if atLeast11 then
+      [
+        "--with-freetype=system"
+        "--with-harfbuzz=system"
+      ]
+    else
+      [
+        "--disable-freetype-bundling"
+      ]
+  )
+  ++ lib.optionals atLeast11 [
+    "--with-libjpeg=system"
+    "--with-libpng=system"
+    "--with-lcms=system"
+  ]
+  ++ lib.optionals (featureVersion == "11") [
+    "--disable-warnings-as-errors"
+  ]
+  # OpenJDK 11 cannot be built by recent versions of Clang, as far as I can tell (see
+  # https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=260319). Known to
+  # compile with LLVM 12.
+  ++ lib.optionals (atLeast11 && stdenv.cc.isClang) [
+    "--with-toolchain-type=clang"
+    # Explicitly tell Clang to compile C++ files as C++, see
+    # https://github.com/NixOS/nixpkgs/issues/150655#issuecomment-1935304859
+    "--with-extra-cxxflags=-xc++"
+  ]
+  # This probably shouldn’t apply to OpenJDK 21; see
+  # b7e68243306833845cbf92e2ea1e0cf782481a51 which removed it for
+  # versions 15 through 20.
+  ++ lib.optional (
+    (featureVersion == "11" || featureVersion == "21") && stdenv.hostPlatform.isx86_64
+  ) "--with-jvm-features=zgc"
+  ++ lib.optional headless (if atLeast11 then "--enable-headless-only" else "--disable-headful")
+  ++ lib.optional (!headless && enableJavaFX) "--with-import-modules=${openjfx_jdk}";
+
+  buildFlags = if atLeast17 then [ "images" ] else [ "all" ];
+
+  separateDebugInfo = true;
+  __structuredAttrs = true;
+
+  # -j flag is explicitly rejected by the build system:
+  #     Error: 'make -jN' is not supported, use 'make JOBS=N'
+  # Note: it does not make build sequential. Build system
+  # still runs in parallel.
+  enableParallelBuilding = false;
+
+  preConfigure =
+    # Set number of jobs to use when building.
+    ''
+      configureFlags+=("--with-jobs=''${NIX_BUILD_CORES}")
+    '';
+
+  env = {
+    NIX_CFLAGS_COMPILE =
+      if atLeast17 then
+        "-Wno-error"
+      else if atLeast11 then
+        # Workaround for
+        # `cc1plus: error: '-Wformat-security' ignored without '-Wformat' [-Werror=format-security]`
+        # when building jtreg
+        "-Wformat"
+      else
+        lib.concatStringsSep " " (
+          [
+            # glibc 2.24 deprecated readdir_r so we need this
+            # See https://www.mail-archive.com/openembedded-devel@lists.openembedded.org/msg49006.html
+            "-Wno-error=deprecated-declarations"
+          ]
+          ++ lib.optionals stdenv.cc.isGNU [
+            # https://bugzilla.redhat.com/show_bug.cgi?id=1306558
+            # https://github.com/JetBrains/jdk8u/commit/eaa5e0711a43d64874111254d74893fa299d5716
+            "-fno-lifetime-dse"
+            "-fno-delete-null-pointer-checks"
+            "-std=gnu++98"
+            "-Wno-error"
+          ]
+          ++ [
+            # error by default in GCC 14
+            "-Wno-error=int-conversion"
+            "-Wno-error=incompatible-pointer-types"
+          ]
+        );
+
+    NIX_LDFLAGS = lib.concatStringsSep " " (
+      lib.optionals (!headless) [
+        "-lfontconfig"
+        "-lcups"
+        "-lXinerama"
+        "-lXrandr"
+        "-lmagic"
+      ]
+      ++ lib.optionals (!headless && enableGtk) [
+        (if atLeast11 then "-lgtk-3" else "-lgtk-x11-2.0")
+        "-lgio-2.0"
+      ]
+    );
+  }
+  // lib.optionalAttrs (!atLeast11) {
+    # OpenJDK 8 Hotspot cares about the host(!) version otherwise
+    DISABLE_HOTSPOT_OS_VERSION_CHECK = "ok";
+  };
+
+  versionCheckProgram = lib.optionalString atLeast23 "${placeholder "out"}/bin/java";
+
+  # Fails with "No rule to make target 'y'."
+  doCheck = false;
+
+  doInstallCheck = atLeast23;
+
+  postPatch = ''
+    chmod +x configure
+    patchShebangs --build configure
+  ''
+  + lib.optionalString atLeast25 ''
+    chmod +x make/scripts/*.{template,sh,pl}
+    patchShebangs --build make/scripts
+  '';
+
+  installPhase = ''
+    mkdir -p $out/lib
+    mv build/*/images/${if atLeast11 then "jdk" else "j2sdk-image"} $out/lib/openjdk
+  ''
+  # Remove some broken manpages.
+  + ''
+    rm -rf $out/lib/openjdk/man/ja*
+  ''
+  # Mirror some stuff in top-level.
+  + ''
+    mkdir -p $out/share
+    ln -s $out/lib/openjdk/bin $out/bin
+    ln -s $out/lib/openjdk/include $out/include
+    ln -s $out/lib/openjdk/man $out/share/man
+  ''
+  # IDEs use the provided src.zip to navigate the Java codebase (https://github.com/NixOS/nixpkgs/pull/95081)
+  + lib.optionalString atLeast11 ''
+    ln -s $out/lib/openjdk/lib/src.zip $out/lib/src.zip
+  ''
+  # jni.h expects jni_md.h to be in the header search path.
+  + ''
+    ln -s $out/include/linux/*_md.h $out/include/
+  ''
+  # Remove crap from the installation.
+  + (
+    ''
+      rm -rf $out/lib/openjdk/demo
+    ''
+    + lib.optionalString (!atLeast11) ''
+      rm -rf $out/lib/openjdk/sample
+    ''
+    + lib.optionalString headless (
+      if atLeast11 then
+        ''
+          rm $out/lib/openjdk/lib/{libjsound,libfontmanager}.so
+        ''
+      else
+        ''
+          rm $out/lib/openjdk/jre/lib/${architecture}/{libjsound,libjsoundalsa,libsplashscreen,libfontmanager}.so
+          rm $out/lib/openjdk/jre/bin/policytool
+          rm $out/lib/openjdk/bin/{policytool,appletviewer}
+        ''
+    )
+  )
+  + lib.optionalString (!atLeast11) (
+    # Move the JRE to a separate output
+    ''
+      mkdir -p $jre/lib/openjdk
+      mv $out/lib/openjdk/jre $jre/lib/openjdk/jre
+      mkdir $out/lib/openjdk/jre
+      lndir $jre/lib/openjdk/jre $out/lib/openjdk/jre
+
+      ln -s $jre/lib/openjdk/jre $out/jre
+      ln -s $jre/lib/openjdk/jre/bin $jre/bin
+    ''
+    # Make sure cmm/*.pf are not symlinks:
+    # https://youtrack.jetbrains.com/issue/IDEA-147272
+    + ''
+      rm -rf $out/lib/openjdk/jre/lib/cmm
+      ln -s {$jre,$out}/lib/openjdk/jre/lib/cmm
+    ''
+    # Setup fallback fonts
+    + lib.optionalString (!headless) ''
+      mkdir -p $jre/lib/openjdk/jre/lib/fonts
+      ln -s ${liberation_ttf}/share/fonts/truetype $jre/lib/openjdk/jre/lib/fonts/fallback
+    ''
+    # Remove duplicate binaries.
+    + ''
+      for i in $(ls $out/lib/openjdk/bin); do
+        if [ "$i" = java ]; then continue; fi
+        if cmp -s $out/lib/openjdk/bin/$i $jre/lib/openjdk/jre/bin/$i; then
+          ln -sfn $jre/lib/openjdk/jre/bin/$i $out/lib/openjdk/bin/$i
+        fi
+      done
+    ''
+    # Generate certificates.
+    + ''
+      cd $jre/lib/openjdk/jre/lib/security
+      rm cacerts
+      ${jre-generate-cacerts} ${
+        if stdenv.buildPlatform.canExecute stdenv.hostPlatform then
+          "$jre/lib/openjdk/jre/bin/keytool"
+        else
+          "keytool"
+      } ${cacert}/etc/ssl/certs/ca-bundle.crt
+    ''
+  );
+
+  preFixup =
+    # Set JAVA_HOME automatically.
+    ''
+      mkdir -p $out/nix-support
+      cat <<EOF > $out/nix-support/setup-hook
+      if [ -z "\''${JAVA_HOME-}" ]; then export JAVA_HOME=$out/lib/openjdk; fi
+      EOF
+    ''
+    # Propagate the setJavaClassPath setup hook from the JRE so that
+    # any package that depends on the JRE has $CLASSPATH set up
+    # properly.
+    + lib.optionalString (!atLeast11) ''
+      mkdir -p $jre/nix-support
+      printWords "${setJavaClassPath}" > $jre/nix-support/propagated-build-inputs
+    '';
+
+  # If binaries in the jre output have RPATH dependencies on libraries from the out output, Nix will
+  # detect a cyclic reference and abort the build.
+  # To fix that, we need to patch the binaries from each output in separate auto-patchelf executions.
+  dontAutoPatchelf = true;
+  postFixup = ''
+    autoPatchelf -- $out
+  ''
+  + lib.optionalString (!atLeast11) ''
+    autoPatchelf -- $jre
+  '';
+
+  disallowedReferences = [ jdk-bootstrap' ];
+
+  passthru = {
+    home = "${finalAttrs.finalPackage}/lib/openjdk";
+    # Shouldn't this be `jdk-bootstrap = jdk-bootstrap'`?
+    inherit jdk-bootstrap;
+    inherit (source) updateScript;
+  }
+  // (if atLeast11 then { inherit gtk3; } else { inherit gtk2; })
+  // lib.optionalAttrs (!atLeast23) {
+    inherit architecture;
+  };
+
+  meta = {
+    description = "Open-source Java Development Kit";
+    homepage = "https://openjdk.java.net/";
+    license = lib.licenses.gpl2Only;
+    maintainers = with lib.maintainers; [
+      edwtjo
+      infinidoge
+    ];
+    teams = [ lib.teams.java ];
+    mainProgram = "java";
+    platforms = [
+      "i686-linux"
+      "x86_64-linux"
+      "aarch64-linux"
+    ]
+    ++ lib.optionals atLeast11 [
+      "armv7l-linux"
+      "armv6l-linux"
+      "powerpc64le-linux"
+    ]
+    ++ lib.optionals atLeast17 [
+      "riscv64-linux"
+    ];
+    # OpenJDK 8 was broken for musl at 2024-01-17. Tracking issue:
+    # https://github.com/NixOS/nixpkgs/issues/281618
+    # error: ‘isnanf’ was not declared in this scope
+    broken = !atLeast11 && stdenv.hostPlatform.isMusl;
+  };
+})

pkgs/development/compilers/openjdk/jre.nix

@@ -0,0 +1,49 @@
+{
+  stdenv,
+  jdk,
+  jdkOnBuild, # must provide jlink
+  lib,
+  callPackage,
+  modules ? [ "java.base" ],
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "${jdk.pname}-minimal-jre";
+  version = jdk.version;
+
+  nativeBuildInputs = [ jdkOnBuild ];
+  buildInputs = [ jdk ];
+  strictDeps = true;
+
+  dontUnpack = true;
+
+  # Strip more heavily than the default '-S', since if you're
+  # using this derivation you probably care about this.
+  stripDebugFlags = [ "--strip-unneeded" ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    jlink --module-path ${jdk}/lib/openjdk/jmods --add-modules ${lib.concatStringsSep "," modules} --output $out
+
+    runHook postBuild
+  '';
+
+  dontInstall = true;
+
+  passthru = {
+    home = "${finalAttrs.finalPackage}";
+    tests = {
+      jre_minimal-hello = callPackage ./tests/test_jre_minimal.nix { };
+      jre_minimal-hello-logging = callPackage ./tests/test_jre_minimal_with_logging.nix { };
+    };
+  };
+
+  meta = jdk.meta // {
+    description = "Minimal JRE for OpenJDK ${jdk.version}";
+    longDescription = ''
+      This is a minimal JRE built from OpenJDK, containing only the specified modules.
+      It is suitable for running Java applications that do not require the full JDK.
+    '';
+  };
+})

pkgs/development/compilers/openjdk/tests/hello-logging.nix

@@ -0,0 +1,48 @@
+{
+  jdk,
+  jre,
+  pkgs,
+}:
+
+# 'Hello world' Java application derivation for use in tests
+let
+  source = pkgs.writeTextDir "src/Hello.java" ''
+    import java.util.logging.Logger;
+    import java.util.logging.Level;
+
+    class Hello {
+      static Logger logger = Logger.getLogger(Hello.class.getName());
+
+      public static void main(String[] args) {
+        logger.log(Level.INFO, "Hello, world!");
+      }
+    }
+  '';
+in
+pkgs.stdenv.mkDerivation {
+  pname = "hello";
+  version = "1.0.0";
+
+  src = source;
+
+  buildPhase = ''
+    runHook preBuild
+    ${jdk}/bin/javac src/Hello.java
+    runHook postBuild
+  '';
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib
+    cp src/Hello.class $out/lib
+
+    mkdir -p $out/bin
+    cat >$out/bin/hello <<EOF;
+    #!/usr/bin/env sh
+    ${jre}/bin/java -cp $out/lib Hello
+    EOF
+    chmod a+x $out/bin/hello
+
+    runHook postInstall
+  '';
+}

pkgs/development/compilers/openjdk/tests/hello.nix

@@ -0,0 +1,43 @@
+{
+  jdk,
+  jre,
+  pkgs,
+}:
+
+# 'Hello world' Java application derivation for use in tests
+let
+  source = pkgs.writeTextDir "src/Hello.java" ''
+    class Hello {
+      public static void main(String[] args) {
+        System.out.println("Hello, world!");
+      }
+    }
+  '';
+in
+pkgs.stdenv.mkDerivation {
+  pname = "hello";
+  version = "1.0.0";
+
+  src = source;
+
+  buildPhase = ''
+    runHook preBuild
+    ${jdk}/bin/javac src/Hello.java
+    runHook postBuild
+  '';
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib
+    cp src/Hello.class $out/lib
+
+    mkdir -p $out/bin
+    cat >$out/bin/hello <<EOF;
+    #!/usr/bin/env sh
+    ${jre}/bin/java -cp $out/lib Hello
+    EOF
+    chmod a+x $out/bin/hello
+
+    runHook postInstall
+  '';
+}

pkgs/development/compilers/openjdk/tests/test_jre_minimal.nix

@@ -0,0 +1,17 @@
+{
+  runCommand,
+  callPackage,
+  jdk,
+  jre_minimal,
+}:
+
+let
+  hello = callPackage ./hello.nix {
+    jdk = jdk;
+    jre = jre_minimal;
+  };
+in
+runCommand "test" { } ''
+  ${hello}/bin/hello | grep "Hello, world!"
+  touch $out
+''

pkgs/development/compilers/openjdk/tests/test_jre_minimal_with_logging.nix

@@ -0,0 +1,22 @@
+{
+  runCommand,
+  callPackage,
+  jdk,
+  jre_minimal,
+}:
+
+let
+  hello-logging = callPackage ./hello-logging.nix {
+    jdk = jdk;
+    jre = jre_minimal.override {
+      modules = [
+        "java.base"
+        "java.logging"
+      ];
+    };
+  };
+in
+runCommand "test" { } ''
+  ${hello-logging}/bin/hello &>/dev/stdout | grep "Hello, world!"
+  touch $out
+''