--- a/ChangeLog	Thu Jul 16 20:15:05 2015 +0100
+++ b/ChangeLog	Fri Jul 17 00:06:58 2015 +0100
@@ -1,3 +1,33 @@
+2015-07-16  Andrew John Hughes  <gnu_andrew@member.fsf.org>
+
+	PR2540: Specify a cacerts file for the OpenJDK
+	build as we do for OpenJDK 8
+	* INSTALL: Document --with-cacerts-file.
+	* Makefile.am:
+	(ICEDTEA_ENV): Pass ALT_CACERTS_FILE to OpenJDK
+	build if specified and valid.
+	(install-data-local): Install the cacerts file.
+	* NEWS: Updated.
+	* acinclude.m4:
+	(IT_WITH_CACERTS_FILE): Allow a cacerts file to
+	be specified, defaulting to
+	${SYSTEM_JDK_DIR}/jre/lib/security/cacerts
+	* configure.ac:
+	Invoke IT_WITH_CACERTS_FILE.
+
+2015-06-16  Andrew John Hughes  <gnu_andrew@member.fsf.org>
+
+	PR2540: Specify a cacerts file for the OpenJDK
+	build as we do for OpenJDK 8
+	* Makefile.am:
+	(JDK_CACERTS_FILE): Added to specify the location
+	of cacerts within the bootstrap JDK.
+	(CACERTS_FILE): Find the regular cacerts file,
+	dereferencing any symlinks which point to it.
+	* configure.ac:
+	Call IT_FIND_TOOL to locate the readlink tool,
+	which is part of coreutils.
+
 2015-07-16  Andrew John Hughes  <gnu_andrew@member.fsf.org>
 
 	PR2539: Libraries in some subdirectories of

--- a/INSTALL	Thu Jul 16 20:15:05 2015 +0100
+++ b/INSTALL	Fri Jul 17 00:06:58 2015 +0100
@@ -207,6 +207,8 @@
 * --disable-downloading: Don't download tarballs if not available; fail instead.
 * --disable-bootstrap-tools: Use javac and javah from langtools, not the bootstrap JDK.
 * --disable-hotspot-test-in-build: Turn off the Queens test. Always turned off for bootstrapping.
+* --with-cacerts-file: Specify the location of a cacerts file, defaulting to
+  ${SYSTEM_JDK_DIR}/jre/lib/security/cacerts
 
 Other options may be supplied which enable or disable new features.
 These are documented fully in the relevant section below.

--- a/Makefile.am	Thu Jul 16 20:15:05 2015 +0100
+++ b/Makefile.am	Fri Jul 17 00:06:58 2015 +0100
@@ -89,6 +89,11 @@
 
 SOURCEPATH_DIRS = $(abs_top_srcdir)/generated:$(OPENJDK_SOURCEPATH_DIRS)
 
+JDK_CACERTS_FILE = @ALT_CACERTS_FILE@
+
+CACERTS_FILE = \
+  `if [ -h $(JDK_CACERTS_FILE) ] ; then $(READLINK) -e $(JDK_CACERTS_FILE) ; else echo $(JDK_CACERTS_FILE); fi`
+
 # Sources used from OpenJDK.
 ICEDTEA_BOOTSTRAP_CLASSES =
 
@@ -673,6 +678,11 @@
        INFINALITY_SUPPORT="true"
 endif
 
+if USE_ALT_CACERTS_FILE
+ICEDTEA_ENV += \
+	ALT_CACERTS_FILE="${CACERTS_FILE}"
+endif
+
 # OpenJDK boot build environment.
 ICEDTEA_ENV_BOOT = $(ICEDTEA_ENV) \
 	BOOTCLASSPATH_CLS_RT="-bootclasspath $(CLS_DIR_BOOT):$(RUNTIME)" \
@@ -3023,6 +3033,8 @@
 	for files in $(BUILD_SDK_DIR)/jre/lib/management/*.template; do \
 	  $(INSTALL_DATA) $${files} $(DESTDIR)${prefix}/jre/lib/management; \
 	done
+	$(INSTALL_DATA) $(BUILD_SDK_DIR)/jre/lib/security/cacerts \
+	  $(DESTDIR)${prefix}/jre/lib/security
 	$(INSTALL_DATA) $(BUILD_SDK_DIR)/jre/lib/security/java.policy \
 	  $(DESTDIR)${prefix}/jre/lib/security
 	$(INSTALL_DATA) $(BUILD_SDK_DIR)/jre/lib/security/java.security \

--- a/NEWS	Thu Jul 16 20:15:05 2015 +0100
+++ b/NEWS	Fri Jul 17 00:06:58 2015 +0100
@@ -336,6 +336,7 @@
   - PR2535: install-data-local needs to check that classes.jsa actually exists
   - PR2537: Desktop files do not allow installation from multiple versions of IcedTea 
   - PR2539: Libraries in some subdirectories of jre/lib/{arch} are not installed
+  - PR2540: Specify a cacerts file for the OpenJDK build as we do for OpenJDK 8
 * AArch64 port
   - Add copyright to aarch64_ad.m4
   - S8069593: Changes to JavaThread::_thread_state must use acquire and release

--- a/acinclude.m4	Thu Jul 16 20:15:05 2015 +0100
+++ b/acinclude.m4	Fri Jul 17 00:06:58 2015 +0100
@@ -3321,3 +3321,35 @@
   AM_CONDITIONAL(DISABLE_HOTSPOT_CHECKSUM, test x"${ENABLE_HOTSPOT_CHECKSUM}" = "xno")
   AC_SUBST(ENABLE_HOTSPOT_CHECKSUM)
 ])
+
+AC_DEFUN_ONCE([IT_WITH_CACERTS_FILE],
+[
+  CACERTS_DEFAULT=${SYSTEM_JDK_DIR}/jre/lib/security/cacerts
+  AC_MSG_CHECKING([whether to copy a certificate authority certificates (cacerts) file])
+  AC_ARG_WITH([cacerts-file],
+              [AS_HELP_STRING([--with-cacerts-file[[=PATH]]],specify the location of the cacerts file)],
+  [
+    ALT_CACERTS_FILE=${withval}
+  ],
+  [ 
+    ALT_CACERTS_FILE="yes"
+  ])
+  AC_MSG_RESULT(${ALT_CACERTS_FILE})
+  if test "x${ALT_CACERTS_FILE}" != "xno"; then
+    if test "x${ALT_CACERTS_FILE}" = "xyes"; then
+      AC_MSG_NOTICE([No cacerts file specified; using ${CACERTS_DEFAULT}])
+      ALT_CACERTS_FILE=${CACERTS_DEFAULT} ;
+    fi
+    AC_MSG_CHECKING([if $ALT_CACERTS_FILE is a valid keystore file])
+    if test -f "${ALT_CACERTS_FILE}" && \
+     ${FILE} ${ALT_CACERTS_FILE} | ${GREP} 'Java KeyStore' >&AS_MESSAGE_LOG_FD 2>&1; then
+      AC_MSG_RESULT([yes])
+    else
+      AC_MSG_RESULT([no])
+      AC_MSG_WARN([No valid cacerts file found; one won't be passed to the OpenJDK build])
+      ALT_CACERTS_FILE="no"
+    fi
+  fi
+  AM_CONDITIONAL(USE_ALT_CACERTS_FILE, test "x${ALT_CACERTS_FILE}" != "xno")
+  AC_SUBST(ALT_CACERTS_FILE)
+])

--- a/configure.ac	Thu Jul 16 20:15:05 2015 +0100
+++ b/configure.ac	Fri Jul 17 00:06:58 2015 +0100
@@ -35,6 +35,7 @@
 IT_FIND_TOOL([UNZIP], [unzip])
 IT_FIND_TOOL([CPIO], [cpio])
 IT_FIND_TOOL([FILE], [file])
+IT_FIND_TOOL([READLINK], [readlink])
 IT_FIND_TOOLS([FASTJAR], [fastjar jar])
 IT_FIND_TOOLS([SED],[gsed sed])
 AC_CHECK_TOOL([LDD], [ldd])
@@ -187,6 +188,7 @@
 IT_WITH_VERSION_SUFFIX
 IT_ENABLE_HG
 IT_WITH_TZDATA_DIR
+IT_WITH_CACERTS_FILE
 
 IT_WITH_PAX
 AC_CONFIG_FILES([pax-mark-vm], [chmod +x pax-mark-vm])