Bug#955530: Bug#: tomcat9: ipa-server-install fails due to servlet crash

[Timo Aaltonen]

On 7.4.2020 9.15, Timo Aaltonen wrote:
> On 5.4.2020 17.37, Emmanuel Bourg wrote:
>> Le 02/04/2020 à 05:30, Timo Aaltonen a écrit :
>>
>>> ipa-server-install (from freeipa-server) started failing within the last few weeks,
>>> I don't know exactly when but it's a regression in sid, Ubuntu focal is still fine.
>>>
>>> Redhat folks said this would've been due to openjdk-8-jre being built with gcc10, but the latest
>>> version isn't anymore, and I've tried older versions from snapsho.d.o and they didn't help.
>>> I've also tried downgrading dogtag-pki but that didn't help either.
>>>
>>> 2020-04-01 14:35:35 [main] SEVERE: Unable to start CMS engine: null
>>> java.lang.NullPointerException
>>>         at com.netscape.ca.CRLIssuingPoint.initConfig(CRLIssuingPoint.java:764)
>>>         at com.netscape.ca.CRLIssuingPoint.init(CRLIssuingPoint.java:497)
>>>         at com.netscape.ca.CertificateAuthority.initCRL(CertificateAuthority.java:2304)
>>>         at com.netscape.ca.CertificateAuthority.init(CertificateAuthority.java:633)
>>>         at com.netscape.cmscore.apps.CMSEngine.initSubsystem(CMSEngine.java:824)
>>>         at com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:799)
>>>         at com.netscape.cmscore.apps.CMSEngine.initSubsystems(CMSEngine.java:791)
>>>         at com.netscape.cmscore.apps.CMSEngine.init(CMSEngine.java:468)
>>>         at com.netscape.cms.servlet.base.CMSStartServlet.init(CMSStartServlet.java:113)
>>>         at javax.servlet.GenericServlet.init(GenericServlet.java:158)
>>
>> Hi Timo,
>>
>> Why do you think this is related to tomcat9?
> 
> It was the first thing that came to mind, looking at the trace. But it's
> more likely in jdk8. Fedora has this patch:
> 
> https://src.fedoraproject.org/rpms/java-1.8.0-openjdk/raw/master/f/jdk8241296-jnihandleblock_segfault.patch
> 
> added after they switched to gcc10.. I know our jdk8 is now built with
> gcc9, but perhaps that causes incompatibilities elsewhere? Anyway, I'm
> going to test that patch if it helps.

Nevermind, this was actually caused by the certmonger update which is
bizarre but true..

-- 
t