[Git][java-team/ca-certificates-java][stretch] 3 commits: Minor fixes and updates

[Bastien Roucariès (@rouca)]

Bastien Roucariès pushed to branch stretch at Debian Java Maintainers / ca-certificates-java


Commits:
59ebf2c6 by Arnaud Rebillout at 2026-02-24T14:28:50+01:00
Minor fixes and updates

- - - - -
e1f445c0 by Bastien Roucariès at 2026-02-24T20:40:50+01:00
Harden conversion from pkcs12 to jks

- - - - -
196d637a by Bastien Roucariès at 2026-02-25T15:20:00+01:00
Fix some nitpick reported by arnaudr

co-author: Arnaud Rebillout <arnaudr at debian.org>

- - - - -


3 changed files:

- debian/ca-certificates-java.postinst
- debian/changelog
- debian/salsa-ci.yml


Changes:

=====================================
debian/ca-certificates-java.postinst
=====================================
@@ -26,9 +26,68 @@ check_proc()
     fi
 }
 
+check_cacerts_store_format()
+{
+    local file="$1"
+    local pass="$2"
+    local output=
+    local type=
+    local status=
+
+    output=$(keytool -list -keystore "$file" -storepass "$pass" 2>&1)
+    status=$?
+    if [ $status -ne 0 ] ; then
+        echo "ERROR: keytool probing '$file' failed (exit code $status)" >&2
+        echo "$output" | head >&2
+        return $status
+    fi
+
+    local type
+    type=$(
+        printf "%s\n" "$output" |
+        tr '[:upper:]' '[:lower:]' |
+        sed -n '
+        /^[[:space:]]*keystore[[:space:]]*type[[:space:]]*:/ {
+            s/^[[:space:]]*keystore[[:space:]]*type[[:space:]]*:[[:space:]]*//;
+            s/^[[:space:]]*//;
+            s/[[:space:]]*$//;
+            p
+        }
+        '
+    )
+
+    if [ -z "$type" ]; then
+        echo "ERROR: keytool probing '$file' failed to find keystore type" >&2
+        return 1
+    fi
+
+    echo "$type"
+    return 0
+}
+
 convert_pkcs12_keystore_to_jks()
 {
+    local type
+
     check_proc
+    if ! type=$(check_cacerts_store_format /etc/ssl/certs/java/cacerts "$storepass"); then
+        exit $?
+    fi
+
+    case "$type" in
+    jks)
+        # here we race
+        return 0
+        ;;
+    pkcs12)
+        # continue
+        ;;
+    *)
+        echo "failed to convert PKCS12 keystore to JKS, unknown /etc/ssl/certs/java/cacerts format '$type'" >&2
+        exit 1
+        ;;
+    esac
+
     if ! keytool -importkeystore \
                  -srckeystore /etc/ssl/certs/java/cacerts \
                  -destkeystore /etc/ssl/certs/java/cacerts.dpkg-new \


=====================================
debian/changelog
=====================================
@@ -123,7 +123,7 @@ ca-certificates-java (20190909) unstable; urgency=medium
 
 ca-certificates-java (20190405+deb10u1) buster-security; urgency=medium
 
-[ Vladimir Petko ]
+  [ Vladimir Petko ]
   * d/ca-certificates-java.postinst: Work-around not yet configured jre.
 
   [ Bastien Roucariès ]
@@ -215,7 +215,6 @@ ca-certificates-java (20170929~deb9u1) stretch; urgency=medium
 
  -- Andreas Beckmann <anbe at debian.org>  Mon, 11 Feb 2019 13:14:23 +0100
 
-
 ca-certificates-java (20170929) unstable; urgency=low
 
   [ Gianfranco Costamagna ]


=====================================
debian/salsa-ci.yml
=====================================
@@ -1,2 +1,2 @@
 include:
-  - https://salsa.debian.org/lts-team/pipeline/raw/master/recipes/buster.yml
+  - https://salsa.debian.org/lts-team/pipeline/raw/master/recipes/stretch.yml



View it on GitLab: https://salsa.debian.org/java-team/ca-certificates-java/-/compare/e260ebd6b96cff89dbbed858b182243dc7e77cf1...196d637a02f388a3389e7f30537ec4783be42672

-- 
View it on GitLab: https://salsa.debian.org/java-team/ca-certificates-java/-/compare/e260ebd6b96cff89dbbed858b182243dc7e77cf1...196d637a02f388a3389e7f30537ec4783be42672
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/pkg-java-commits/attachments/20260225/450285e3/attachment.htm>