I'm seeing errors in some experimental TaskCluster jobs that boil down to a missing cacerts file in the tooltool-distributed Java toolchain. The issue is that the packaged cacerts file (jre/lib/security/cacerts) symlinks into ../../*/../etc/pki/java/cacerts, and the relative symlink is wrong after unpacking.

We have a script to generate this, which I could fix to hard-copy the cacerts file out of the system; or to link absolutely to /etc/pki/java/cacerts (better); but the whole thing is pretty fragile. dustin: How do I invoke the script in TaskCluster? (https://dxr.mozilla.org/mozilla-central/source/testing/taskcluster/scripts/misc/repackage-jdk-centos.sh is the script.)

When I wrote it, things were still a little young in taskcluster-land to run that script automatically. But Ted later set up https://dxr.mozilla.org/mozilla-central/source/testing/docker/desktop-build/bin/checkout-script.sh so you should be able to run a task with something like `["bash", "-c" "bin/checkout-script.sh && ./repackage-jdk-centos.sh"]` as the command, with SCRIPT_PATH set correctly. I'd start with an existing linux build task like https://tools.taskcluster.net/task-inspector/#GKpWpoSISJig2G3QXSYPyA/ and choose "Edit and re-create", then adjust the command and the environment variables. You could also pretty easily run the script locally. The important thing is that it's in tree so the next person to need to tweak the tarball has a solid foundation; that it's actually run in automation isn't critical.

I took a piece of Bug 1252928 and landed it as this ticket.