Allow passing '--jvm' to GU, or do that by default

[ddimtirov]

What happened?

I'm trying to use this GraalVM plugin behind firewall, and my caching proxy is using the company CA root. If we use gu as --native (the default), it always uses the default cacerts, and fails to download the native-image.

For more details, see oracle/graal#2585

What did you want to happen?

I'd like my build to run gu --jvm install native-image, which would pick up the JAVA_TOOL_OPTIONS and use the correct CA roots.

It can be configurable, or default behavior.

[ddimtirov]

For anybody having the same problem, here is a workaround by intercepting the extractGraalTooling task:

tasks.named('extractGraalTooling') { t ->
    doFirst { // touch file, so the task will not try to install it
        def out = (t.outputDirectory as DirectoryProperty ).get().asFile.canonicalPath
        file("$out/bin/native-image").with { File ni ->
            ni.parentFile.mkdirs()
            ni.text = ""
        }
    }
    doLast { // patch the cacerts and install native-image ourselves passing '--jvm'
        def defaultCacerts = System.getProperty("java.home") + "/lib/security/cacerts"
        def cacerts = System.getProperty("javax.net.ssl.trustStore", defaultCacerts)
        def out = (t.outputDirectory as DirectoryProperty ).get().asFile.canonicalPath
        file("$out//jre/lib/security/cacerts").bytes=file(cacerts).bytes
        project.exec {
            executable "$out/bin/gu"
            args "--jvm", "install", "--no-progress", "--force", "--replace", "native-image"
        }
    }
}

To implement it cleanly it also requires to separate the extraction from the install of native-image, so we can add a separate task copying cacerts in between them.

[hemapunniakotti]

@ddimtirov I am facing a similar issue...

$gu install native-image
Downloading: Component catalog from www.graalvm.org
Processing Component: Native Image
Downloading: Component native-image: Native Image from github.com
I/O error occurred: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target..

I am trying install it mac through commandline. Where can I find the extractGraalTooling task file to make this change ?

[ddimtirov]

It is part of the Gradle plugin to which this issue belongs. If you are only using "gu" on the command line, it is not relevant to you (despite getting the same error message).