openjdk17: use p11-kit directly instead of make-ca

srcpkgs/openjdk17/template

@@ -32,7 +32,7 @@ make_build_args="images static-libs-image $(vopt_if docs docs)"
 make_install_args="INSTALL_PREFIX=\"${DESTDIR}/usr/lib\""
 make_check_target="test-hotspot-gtest"
 hostmakedepends="pkg-config automake autoconf cpio tar unzip zip ca-certificates
- openssl zlib-devel which make-ca"
+ openssl zlib-devel which p11-kit"
 makedepends="libXrender-devel libXtst-devel libXt-devel libXrandr-devel
  giflib-devel libjpeg-turbo-devel cups-devel freetype-devel alsa-lib-devel
  fontconfig-devel zlib-devel lcms2-devel"
@@ -132,10 +132,7 @@ post_install() {
 	mv ${DESTDIR}/usr/lib/jvm/openjdk-${_base_version} ${DESTDIR}/$_jdk_home
 	vcopy build/*-release/images/static-libs/lib $_jdk_home
 	vmkdir $_jdk_home/lib/security
-	make-ca -g -f --destdir "${PWD}/ca" -k "${DESTDIR}/$_jdk_home/bin/keytool"
-	mv ./ca/etc/pki/tls/java/cacerts ${DESTDIR}/$_jdk_home/lib/security/
-	chmod -R ugo+rw ./ca
-	rm -rf ./ca
+	trust extract --overwrite --filter=ca-anchors --format=java-cacerts --purpose server-auth "${DESTDIR}/${_jdk_home}/lib/security/cacerts"
 }
 
 subpackages="openjdk17-static-libs openjdk17-src openjdk17-jre openjdk17-doc openjdk17-jmods"