# Altering package (oraclejdk11) installation fails

**URL:** https://discourse.nixos.org/t/altering-package-oraclejdk11-installation-fails/46164
**Category:** Help
**Created:** [May 29, 2024, 12:36pm UTC](https://discourse.nixos.org/t/altering-package-oraclejdk11-installation-fails/46164 "2024-05-29T12:36:15Z")
**Posts on this page:** 1
**Showing post:** 2

<div class="post-metadata">

### Author: ![mvb](https://discourse.nixos.org/letter_avatar_proxy/v4/letter/m/34f0e0/32.png) [@mvb](https://discourse.nixos.org/u/mvb)
#### Post date: [May 29, 2024, 2:01pm UTC](https://discourse.nixos.org/t/altering-package-oraclejdk11-installation-fails/46164/2 "2024-05-29T14:01:04Z")

</div>

I found a solution. I’m not sure it’s a good one.

I turned around the order of the `installPhase`, doing my custom logic first now, and in the archive directory as opposed to the `$out$` dir. That seems to make more sense.

And I don’t refer to the `keytool` coming from the archive anymore. Instead, I use the keytool from the official `oraclejdk11`. I’m not particularly happy about this, because this only works because I’m _only_ modifying a package that already exists - I shouldn’t have to rely on that. Also, I’m not sure why `oraclejdk11` is even available on my system, without it being installed. Is that only because it’s still hanging around somewhere from a previous install? Or is this supposed to always work? Why, if so?

Here’s how it actually works. Please comment

```nix
{ pkgs ? import <nixpkgs> {}, ... }:

let
  # Define the source for the custom certificate
  cert1 = pkgs.fetchurl {
    url = "http://cert1.crt"; # Replace with the actual path or URL to the certificate file
    sha256 = "91a3b1962b..."; # Replace with the actual SHA-256 hash of the certificate file
  };
  cert2 = pkgs.fetchurl {
    url = "http://cert2.crt";
    sha256 = "fbaef2da...";
  };

  # Override the official Oracle JDK derivation
  customOracleJdk = pkgs.oraclejdk11.overrideAttrs (oldAttrs: {
    installPhase = ''
      # Debugging executable
      ${pkgs.oraclejdk11}/bin/keytool > $out/output_of_keytool.txt; // this works!
      
      # Import the custom certificates
      ${pkgs.oraclejdk11}/bin/keytool -noprompt -trustcacerts -import -alias cert1 \
        -storepass changeit -keystore lib/security/cacerts -file ${cert1};
      ${pkgs.oraclejdk11}/bin/keytool -noprompt -trustcacerts -import -alias cert2 \
        -storepass changeit -keystore lib/security/cacerts -file ${cert2};
    '' + oldAttrs.installPhase;
  });
in
  customOracleJdk

```

for context, this is saved to a file like `custom-jdk-11.nix` and I import it into my `configuration.nix` like

```nix
environment.systemPackages = with pkgs; [
  ...
  (import ./custom-jdk-11.nix { inherit pkgs; })
];

```

```auto

```

---

_[View the full topic](https://discourse.nixos.org/t/altering-package-oraclejdk11-installation-fails/46164)._