[Pkg-electronics-devel] Bug#1099511: newest releases of bc* java libraries cause arduino to fail to start

[Jonas Smedegaard]

Package: libbcpkix-java,libbcprov-java,libbcutil-java,libbcpg-java,arduino
Severity: grave

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On an up-to-date amd64 Debian unstable system as of today, arduino fails
to start like this:

 arduino
Picked up JAVA_TOOL_OPTIONS:
WARNING: A restricted method in java.lang.System has been called
WARNING: java.lang.System::loadLibrary has been called by processing.app.Platform in an unnamed module (file:/usr/share/arduino/lib/arduino-core.jar)
WARNING: Use --enable-native-access=ALL-UNNAMED to avoid a warning for callers in this module
WARNING: Restricted methods will be blocked in a future release unless native access is enabled

java.lang.NoClassDefFoundError: org/bouncycastle/asn1/cryptlib/CryptlibObjectIdentifiers
	at org.bouncycastle.openpgp.PGPUtil$2.<init>(Unknown Source)
	at org.bouncycastle.openpgp.PGPUtil.<clinit>(Unknown Source)
	at cc.arduino.contributions.GPGDetachedSignatureVerifier.readPublicKey(GPGDetachedSignatureVerifier.java:99)
	at cc.arduino.contributions.GPGDetachedSignatureVerifier.readPublicKey(GPGDetachedSignatureVerifier.java:92)
	at cc.arduino.contributions.GPGDetachedSignatureVerifier.verify(GPGDetachedSignatureVerifier.java:73)
	at cc.arduino.contributions.SignatureVerifier.isSigned(SignatureVerifier.java:46)
	at cc.arduino.contributions.packages.ContributionsIndexer.parseIndex(ContributionsIndexer.java:92)
	at processing.app.BaseNoGui.initPackages(BaseNoGui.java:483)
	at processing.app.Base.<init>(Base.java:263)
	at processing.app.Base.main(Base.java:141)
Caused by: java.lang.ClassNotFoundException: org.bouncycastle.asn1.cryptlib.CryptlibObjectIdentifiers
	at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:580)
	at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:490)
	... 10 more

Downgrading the packages libbcpkix-java, libbcprov-java, libbcutil-java
and libbcpg-java from their current 1.80-2 to 1.72-2 mkes arduino start
again.

 - Jonas


-----BEGIN PGP SIGNATURE-----

wsG7BAEBCgBvBYJnxsltCRAsfDFGwaABIUcUAAAAAAAeACBzYWx0QG5vdGF0aW9u
cy5zZXF1b2lhLXBncC5vcmfOB+kq63AgobZLDRLP4oAL8T5wzD/5J+Tp5IFLay20
3xYhBJ/j6cNmkaaf9TzGhCx8MUbBoAEhAAC4sA//SikLipZxa9wC7CnwR15zLD26
NBVS7BlkLXNI1LKhV3QGJ+pq0Zgmu6kWU/8oIgSRXlfSk1kh+bUrufpFmSU3hZvA
sqrKJNvNVvOf8nC+dmOHBZP4tFYON4XmUERpwEDpQYa1CWFIOuygK9guFZo21z/Q
EzFN8Nb7R7yTirQfI6kYN5ccUtpyiO++R7QQr8fVqABWX0jNmPhJp3/YiqOC56zQ
1Zg3ly8Yzr3vFq13c6fVJwO57RyWHyeeL+Sa8T7GRlaSl8lo5/Ll+tM8mDQjKvB2
ArhnA2lrtt81/gpIRgeIrJ2jwTomzBvoYC8ONnPco+lu77kzNf4gBtFLHt46JRMD
K+/+lnN2JIgLA00f9CSWZonM3vvSc7sAHM6ErbsJcC/fn88xdw3CCQI5xSETWKHj
8w+jQQ4kV2o46KEJNNJQTXRWygxkioLju28XXl8mQDs0VRIA1o9OUts/9cfR/BPA
bN7MmdO56pPRiAEjOfz279TJYcAljXhioyV+HrhDME3bIBpeamBaqYA/Z3Eev9Ae
ioedysWxkel4OaV/+RzFF3gNERYK8VvbtctKzKKoVUJuMaePNtD0vcGU21rnLI+5
USdhqQbBjM9SkOUaHOnwFF8/nvzCCEZLSOGFAYHRiRQmdiZW/qScT1iKfYKVoJ90
LvQ8re4UV+wSpyEFl50=
=ucmU
-----END PGP SIGNATURE-----