Bug#767272: ca-certificates-java: Removed certificates still in cacerts after activate update-ca-certificates-fresh trigger

[Stephen Byrne]

Package: ca-certificates-java
Version: 20140324
Severity: normal

Dear Maintainer,

I created a ca-certificates-local package using the example in /usr/share/doc
/ca-certificates/examples/ca-certificates-local/ (from the ca-certificates
package). When my ca-certificates-local package is installed, the activate
update-ca-certificates-fresh trigger causes update-ca-certificates to run /etc
/ca-certificates/update.d/jks-keystore, which adds my certificate to
/etc/ssl/certs/java/cacerts. When I remove or purge ca-certificates-local, the
certificate is not removed from /etc/ssl/certs/java/cacerts, even though it is
no longer in /usr/share/local/ca-certificates nor /etc/ssl/certs.



-- System Information:
Debian Release: jessie/sid
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 3.16-3-amd64 (SMP w/4 CPU cores)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash

Versions of packages ca-certificates-java depends on:
ii  ca-certificates                                  20141019
ii  libnss3                                          2:3.17.2-1
ii  openjdk-6-jre-headless [java6-runtime-headless]  6b33-1.13.5-1
ii  openjdk-7-jre-headless [java6-runtime-headless]  7u71-2.5.3-1
ii  openjdk-8-jre-headless [java6-runtime-headless]  8u40~b09-1
ii  oracle-java8-jdk [java6-runtime-headless]        8u5

ca-certificates-java recommends no packages.

ca-certificates-java suggests no packages.

-- Configuration Files:
/etc/default/cacerts [Errno 13] Permission denied: u'/etc/default/cacerts'

-- no debconf information