[Git][java-team/ca-certificates-java][stretch] 6 commits: Fix old entry in d/changelog
Arnaud Rebillout (@arnaudr)
gitlab at salsa.debian.org
Fri Aug 14 17:03:37 BST 2026
Arnaud Rebillout pushed to branch stretch at Debian Java Maintainers / ca-certificates-java
Commits:
62681c91 by Arnaud Rebillout at 2026-08-13T14:40:34+07:00
Fix old entry in d/changelog
These few lines went away during a merge, bring it back, otherwise tools
like dpkg-parsechangelog complain, rightly so:
```
$ dpkg-parsechangelog --all > /dev/null
dpkg-parsechangelog: warning: debian/changelog(l114): found start of entry where expected more change data or trailer
```
Gbp-Dch: ignore
- - - - -
52eaa2cd by Arnaud Rebillout at 2026-08-13T14:40:57+07:00
postinst: no-op if the runtime is GCJ
In previous version of ca-certificates-java (20170929~deb9u3), we didn't
need this check, because:
- ca-certificates-java Depended on openjdk-7-jre-headless
- openjdk-7 alternatives have higher priority than gcj
So even if gcj was installed (note: openjdk and gcj are indeed
co-installable), installing ca-certificates-java would pull in openjdk,
and it's then openjdk (runtime and keytool) that would be used in the
postinst.
Now that we've removed the Depends on openjdk-7-jre-headless (to break a
Dep cycle), it is possible that the postinst script runs while gcj is
installed and openjdk is not. We need to be careful and no-op in that
case, as gcj's keytool and openjdk's keytool are not compatible at all.
Moreover, it seems that compatibility between gcj and
ca-certificates-java is simply not there, eg. gcj's keystore is shipped
at /etc/java/cacerts-gcj by package libgcj-common, and
ca-certificates-java is not aware of that.
More details at:
<https://gitlab.com/freexian/services/deblts-team/extended-lts/-/work_items/331>
- - - - -
d7b3ff11 by Arnaud Rebillout at 2026-08-13T14:40:57+07:00
tests: Add can-install-openjdk-after-gcj
- - - - -
5ddd07b2 by Arnaud Rebillout at 2026-08-13T14:40:57+07:00
tests: Support gcj in can-install-jre
- - - - -
2015881f by Arnaud Rebillout at 2026-08-14T16:49:33+07:00
Fix execute_after -> override in d/rules
execute_after needs debhelper 13
- - - - -
60b6e4e7 by Arnaud Rebillout at 2026-08-14T16:50:03+07:00
Prepare changelog for release
- - - - -
6 changed files:
- debian/ca-certificates-java.postinst
- debian/changelog
- debian/rules
- debian/tests/can-install-jre
- + debian/tests/can-install-openjdk-after-gcj
- debian/tests/control
Changes:
=====================================
debian/ca-certificates-java.postinst
=====================================
@@ -120,6 +120,8 @@ find_pem_files()
update_cacerts()
{
+ local java_version=
+
if [ "$cacerts_updates" != "yes" ] || [ "$CACERT_UPDATES" = "disabled" ]; then
echo "Updates of cacerts keystore are disabled."
exit 0
@@ -130,10 +132,17 @@ update_cacerts()
exit 0
fi
- if ! java -version 2> /dev/null; then
+ if ! java_version=$(java -version 2> /dev/null); then
+ [ -n "$java_version" ] && echo "$java_version"
echo "Unable to execute Java. Skipping Java certificates setup."
exit 0
fi
+ [ -n "$java_version" ] && echo "$java_version"
+
+ if echo "$java_version" | grep -iq 'gnu libgcj'; then
+ echo "Unsupported Java runtime. Skipping Java certificates setup."
+ exit 0
+ fi
if [ -f /var/lib/ca-certificates-java/convert_pkcs12_keystore_to_jks ]; then
convert_pkcs12_keystore_to_jks
=====================================
debian/changelog
=====================================
@@ -1,11 +1,21 @@
-ca-certificates-java (20230710~deb12u1~deb11u1~deb10u1~deb9u1) stretch-security; urgency=medium
+ca-certificates-java (20230710~deb12u1~deb11u1~deb10u2~deb9u1) stretch-security; urgency=medium
* Non-maintainer upload by ELTS team.
+
+ [ Bastien Roucaries ]
* Backport in order to solve circular JRE dependency
(Closes: #1041419, #1037478, #929685)
* Do not try to run foreign architecture java. Closes: #1043247.
+ * Harden conversion from pkcs12 to jks
+
+ [ Arnaud Rebillout ]
+ * Fix the bogus comparison for the keystore magic
+ * postinst: no-op if the runtime is GCJ
+ * tests: Add can-install-openjdk-after-gcj
+ * tests: Support gcj in can-install-jre
+ * Fix execute_after -> override in d/rules
- -- Bastien Roucariès <rouca at debian.org> Sat, 14 Feb 2026 13:16:10 +0100
+ -- Arnaud Rebillout <arnaudr at debian.org> Mon, 23 Mar 2026 14:48:29 +0700
ca-certificates-java (20230710~deb12u1) bookworm; urgency=medium
@@ -110,6 +120,11 @@ ca-certificates-java (20190909+deb11u1) bullseye; urgency=medium
* Non-maintainer upload.
* Backport changes from 20230620 in sid. (Closes: #1039472)
+ [ Vladimir Petko ]
+ * d/ca-certificates-java.postinst: Work-around not yet configured jre.
+
+ -- Andreas Beckmann <anbe at debian.org> Thu, 27 Jul 2023 16:29:03 +0200
+
ca-certificates-java (20190909) unstable; urgency=medium
* Team upload.
@@ -123,6 +138,10 @@ ca-certificates-java (20190909) unstable; urgency=medium
ca-certificates-java (20190405+deb10u1) buster-security; urgency=medium
+ [ Andreas Beckmann]
+ * Non-maintainer upload.
+ * Backport changes from 20230620 in sid. (Closes: #1039472)
+
[ Vladimir Petko ]
* d/ca-certificates-java.postinst: Work-around not yet configured jre.
=====================================
debian/rules
=====================================
@@ -30,5 +30,6 @@ endif
override_dh_installinit:
dh_installinit --name=cacerts
-execute_after_dh_fixperms:
+override_dh_fixperms:
+ dh_fixperms
chmod 0600 debian/ca-certificates-java/etc/default/cacerts
=====================================
debian/tests/can-install-jre
=====================================
@@ -23,10 +23,18 @@ do
apt-get install -y ${version} 2>&1 | tee ${output}
# THEN installation is successfull
# AND certificates are updated
+# EXCEPT for gcj
+ if [[ ${version} =~ ^gcj-(6-)?jre-headless$ ]]; then
+ if [[ $(grep -l "Adding debian:Amazon_Root_CA_1.pem" ${output}) ]]; then
+ echo "Certificates were imported !!!"
+ exit 255
+ fi
+ else
if [[ $(grep -L "Adding debian:Amazon_Root_CA_1.pem" ${output}) ]]; then
echo "Certificates were not imported !!!"
exit 255
fi
+ fi
rm $output
# purge in order to remove keytstore
apt-get purge -y ca-certificates-java ${version}
=====================================
debian/tests/can-install-openjdk-after-gcj
=====================================
@@ -0,0 +1,35 @@
+#!/bin/bash
+
+set -e
+
+KEYSTORE_PATH=/etc/ssl/certs/java/cacerts
+
+check_no_ks() {
+ if [ -e $KEYSTORE_PATH ]; then
+ echo "Keystore exists at $KEYSTORE_PATH, this is not expected"
+ exit 1
+ fi
+}
+
+check_ks_type() {
+ local expected=$1
+ local output=
+ local ks_type=
+
+ output=$(keytool -list -keystore $KEYSTORE_PATH -storepass changeit)
+ ks_type=$(echo "$output" | sed -n 's/^key *store type: //Ip' | tr '[:upper:]' '[:lower:]')
+
+ if [[ $ks_type != $expected ]]; then
+ echo "Wrong keystore type, expected '$expected', got '$ks_type'"
+ echo "Full output below:"
+ echo "$output"
+ exit 1
+ fi
+}
+
+apt-get install -y gcj-6-jre-headless
+apt-get install -y ca-certificates-java
+check_no_ks
+
+apt-get install -y openjdk-8-jre-headless
+check_ks_type jks
=====================================
debian/tests/control
=====================================
@@ -2,7 +2,7 @@ Tests: can-convert-keystore
Depends: apt-utils, bash, default-jre-headless
Restrictions: needs-root
-Tests: can-install-jre, can-install-multiple-jdks, can-install-libreoffice
+Tests: can-install-jre, can-install-multiple-jdks, can-install-libreoffice, can-install-openjdk-after-gcj
# No depends, this is a test for a clean install
Depends: apt-utils, bash
Restrictions: needs-root, allow-stderr, breaks-testbed
View it on GitLab: https://salsa.debian.org/java-team/ca-certificates-java/-/compare/d42d328c357c8ec6001183a39bddeef11f717e6a...60b6e4e7cedf7db97957f652e0184240f6dd09ea
--
View it on GitLab: https://salsa.debian.org/java-team/ca-certificates-java/-/compare/d42d328c357c8ec6001183a39bddeef11f717e6a...60b6e4e7cedf7db97957f652e0184240f6dd09ea
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-commits/attachments/20260814/03a6d4bc/attachment.htm>
More information about the pkg-java-commits
mailing list