How to install java in NixOS

You didn't specify what certfile looks like in the first line. If it's a variable thats populated with a builtins.readFile, you can skip that step and just populate the variable yourself.

$> nixos-option security.pki.certificates
Value:
[ "-----BEGIN CERTIFICATE-----
... edited for brevity .... " ]

Default:
[ ]

Example:
[ "NixOS.org\n=========\n-----BEGIN CERTIFICATE-----\nMIIGUDCCBTigAwIBAgIDD8KWMA0GCSqGSIb3DQEBBQUAMIGMMQswCQYDVQQGEwJJ\nTDEWMBQGA1UEChMNU3RhcnRDb20gTHRkLjErMCkGA1UECxMiU2VjdXJlIERpZ2l0\n...\n-----END CERTIFICATE-----\n" ]

Description:

A list of trusted root certificates in PEM format.

Declared by:
  "/etc/nixos/nixpkgs/nixos/modules/security/ca.nix"

Defined by:
  "/etc/nixos/user.nix

So, setting security.pki.certificates [ "insert certificate here" ]; would eliminate the file dependency and then the configuration is self contained.

Otherwise, if you wanted to keep the content out of the configuration, you'd need to create packaging/a derivation for it and add it to the store.

The issue lay in the xorg entry in buildInputs.

xorg is a collection, not an individual module. So far as I can see, the expectation for buildInputs is that everything in the list be coercible to a string, and apparently modules can be coerced in such a way (presumably to the module name). A list cannot be coerced in such a way.

The reference to nativeBuildInputs presumably indicates that buildInputs gets mushed into nativeBuildInputs.

Here is the text of a derivation that builds but is simply missing some of the libraries that I have not yet included from xorg. I'll replace it with a complete derivation once I have the application completely working.

{ pkgs ? import <nixpkgs> {}
, cairo ? pkgs.cairo
, fetchurl ? pkgs.fetchurl
, glib ? pkgs.glib
, patchelf ? pkgs.patchelf
, stdenv ? pkgs.stdenv
, xorg ? pkgs.xorg
}:
stdenv.mkDerivation rec {
    name = "GoPanda";
    version = "2";
    meta = {
        homepage = "http://pandanet-igs.com/communities/gopanda2";
    };

    src = fetchurl {
        url = "http://pandanet-igs.com/gopanda2/installer/stable/linux-64/gopanda2-linux-64.tar.gz";
        sha256 = "6d0a13e81a4646779331ff182acdbf9fe7982b2659f12a794a50897ea7368e1c";
    };

    phases = [ "unpackPhase" "installPhase" ];
    buildInputs = [
        cairo
        glib
        xorg.libX11
    ];

    libPath = stdenv.lib.makeLibraryPath buildInputs;

    installPhase = ''
        mkdir -p $out/share
        mkdir -p $out/bin
        cp -r locales $out/share
        cp GoPanda2 $out/bin/GoPanda2
        patchelf \
            --set-interpreter $(cat $NIX_CC/nix-support/dynamic-linker) \
            --set-rpath ${libPath} \
            $out/bin/GoPanda2
    '';
}