[Git][java-team/ca-certificates-java][buster] 4 commits: Fix old entry in d/changelog

[Arnaud Rebillout (@arnaudr)]

Arnaud Rebillout pushed to branch buster at Debian Java Maintainers / ca-certificates-java


Commits:
b53ec649 by Arnaud Rebillout at 2026-08-13T14:24:18+07:00
Fix old entry in d/changelog

These few lines went away during a merge, bring it back, otherwise tools
like dpkg-parsechangelog complain, rightly so:

```
$ dpkg-parsechangelog --all > /dev/null
dpkg-parsechangelog: warning:     debian/changelog(l114): found start of entry where expected more change data or trailer
```

Gbp-Dch: ignore

- - - - -
0f56c13c by Arnaud Rebillout at 2026-08-13T14:24:39+07:00
postinst: no-op if the runtime is GCJ

In previous version of ca-certificates-java (20170929~deb9u3), we didn't
need this check, because:
- ca-certificates-java Depended on openjdk-7-jre-headless
- openjdk-7 alternatives have higher priority than gcj

So even if gcj was installed (note: openjdk and gcj are indeed
co-installable), installing ca-certificates-java would pull in openjdk,
and it's then openjdk (runtime and keytool) that would be used in the
postinst.

Now that we've removed the Depends on openjdk-7-jre-headless (to break a
Dep cycle), it is possible that the postinst script runs while gcj is
installed and openjdk is not. We need to be careful and no-op in that
case, as gcj's keytool and openjdk's keytool are not compatible at all.

Moreover, it seems that compatibility between gcj and
ca-certificates-java is simply not there, eg. gcj's keystore is shipped
at /etc/java/cacerts-gcj by package libgcj-common, and
ca-certificates-java is not aware of that.

More details at:
<https://gitlab.com/freexian/services/deblts-team/extended-lts/-/work_items/331>

- - - - -
8ad71014 by Arnaud Rebillout at 2026-08-14T16:38:43+07:00
Fix execute_after -> override in d/rules

execute_after needs debhelper 13

- - - - -
e6676343 by Arnaud Rebillout at 2026-08-14T16:49:59+07:00
Prepare changelog for release

- - - - -


3 changed files:

- debian/ca-certificates-java.postinst
- debian/changelog
- debian/rules


Changes:

=====================================
debian/ca-certificates-java.postinst
=====================================
@@ -120,6 +120,8 @@ find_pem_files()
 
 update_cacerts()
 {
+	local java_version=
+
 	if [ "$cacerts_updates" != "yes" ] || [ "$CACERT_UPDATES" = "disabled" ]; then
 		echo "Updates of cacerts keystore are disabled."
 		exit 0
@@ -130,10 +132,17 @@ update_cacerts()
 		exit 0
 	fi
 
-	if ! java -version 2> /dev/null; then
+	if ! java_version=$(java -version 2> /dev/null); then
+		[ -n "$java_version" ] && echo "$java_version"
 		echo "Unable to execute Java. Skipping Java certificates setup."
 		exit 0
 	fi
+	[ -n "$java_version" ] && echo "$java_version"
+
+	if echo "$java_version" | grep -iq 'gnu libgcj'; then
+		echo "Unsupported Java runtime. Skipping Java certificates setup."
+		exit 0
+	fi
 
 	if [ -f /var/lib/ca-certificates-java/convert_pkcs12_keystore_to_jks ]; then
 		convert_pkcs12_keystore_to_jks


=====================================
debian/changelog
=====================================
@@ -1,9 +1,16 @@
-ca-certificates-java (20230710~deb12u1~deb11u1~deb10u2) unstable; urgency=medium
+ca-certificates-java (20230710~deb12u1~deb11u1~deb10u2) buster-security; urgency=medium
 
-   * Non-maintainer upload by ELTS team.
-   * Harden conversion of PKCS12 to JKS for easing upgrade from stretch security
+  * Non-maintainer upload by ELTS team.
+
+  [ Bastien Roucariès ]
+  * Harden conversion of PKCS12 to JKS for easing upgrade from stretch security
+
+  [ Arnaud Rebillout ]
+  * Fix the bogus comparison for the keystore magic
+  * postinst: no-op if the runtime is GCJ
+  * Fix execute_after -> override in d/rules
 
- -- Bastien Roucariès <rouca at debian.org>  Fri, 27 Feb 2026 22:58:36 +0100
+ -- Arnaud Rebillout <arnaudr at debian.org>  Mon, 23 Mar 2026 14:35:12 +0700
 
 ca-certificates-java (20230710~deb12u1~deb11u1~deb10u1) buster-security; urgency=medium
 
@@ -117,6 +124,11 @@ ca-certificates-java (20190909+deb11u1) bullseye; urgency=medium
   * Non-maintainer upload.
   * Backport changes from 20230620 in sid.  (Closes: #1039472)
 
+  [ Vladimir Petko ]
+  * d/ca-certificates-java.postinst: Work-around not yet configured jre.
+
+ -- Andreas Beckmann <anbe at debian.org>  Thu, 27 Jul 2023 16:29:03 +0200
+
 ca-certificates-java (20190909) unstable; urgency=medium
 
   * Team upload.
@@ -130,7 +142,11 @@ ca-certificates-java (20190909) unstable; urgency=medium
 
 ca-certificates-java (20190405+deb10u1) buster-security; urgency=medium
 
-[ Vladimir Petko ]
+  [ Andreas Beckmann]
+  * Non-maintainer upload.
+  * Backport changes from 20230620 in sid.  (Closes: #1039472)
+
+  [ Vladimir Petko ]
   * d/ca-certificates-java.postinst: Work-around not yet configured jre.
 
   [ Bastien Roucariès ]


=====================================
debian/rules
=====================================
@@ -30,5 +30,6 @@ endif
 override_dh_installinit:
 	dh_installinit --name=cacerts
 
-execute_after_dh_fixperms:
+override_dh_fixperms:
+	dh_fixperms
 	chmod 0600 debian/ca-certificates-java/etc/default/cacerts



View it on GitLab: https://salsa.debian.org/java-team/ca-certificates-java/-/compare/35bf361cab9f5a1c0d9e9d6596df1501646a9197...e667634337f0af177c57faee60d80015b04672cf

-- 
View it on GitLab: https://salsa.debian.org/java-team/ca-certificates-java/-/compare/35bf361cab9f5a1c0d9e9d6596df1501646a9197...e667634337f0af177c57faee60d80015b04672cf
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-commits/attachments/20260814/7af045d9/attachment.htm>