Bug#1043247: openjdk-21-jdk-headless fails foreign installation during ca-certificates-java.postinst

[Helmut Grohne]

Package: openjdk-21-jdk-headless,ca-certificates-java
Severity: normal
Control: affects -1 + src:openjdk-21
User: debian-cross at lists.debian.org
Usertags: ftcbfs
X-Debbugs-Cc: debian-cross at lists.debian.org

Hi Matthias,

this is a little difficult and I don't see how this is supposed to work,
which is why this bug unfortunately comes without a patch. Can I ask you
to shed some light on how this is supposed to work?

openjdk-21 cannot be cross built at the moment. Its Build-Depends are
theoretically satisfiable, but since it also Build-Depends on
"openjdk-21-jdk-headless <cross>", we need to install the foreign
development kit. Do you confirm that this is really needed? It also has
"openjdk-20-jdk-headless:native | openjdk-21-jdk-headless:native" and I
am wondering whether the native jdk would be sufficient.

Anyway, installing a foreign openjdk-21-jdk-headless fails. The easiest
way to see that is using mmdebstrap:

$ mmdebstrap --variant=essential --architectures=amd64,ppc64el --include=openjdk-21-jdk-headless:ppc64el unstable /dev/null
...
Processing triggers for ca-certificates-java (20230710) ...
/var/lib/dpkg/info/ca-certificates-java.postinst: 115: java: Exec format error
dpkg: error processing package ca-certificates-java (--configure):
 installed ca-certificates-java package post-installation script subprocess returned error exit status 126
...
$

As you can see, that foreign openjdk-21-jdk-headless ends up providing
the java executable an ca-certificates-java assumes it to be executable,
which it is not and thus ca-certificates-java.postinst fails.

If also installing openjdk-21-jdk-headless:amd64, then it ends up
providing the java name and ca-certificates-java.postinst works. I am
not sure which of the packages is at fault here.

Arguably, ca-certificates-java should be depending on a runnable
instance of the jdk, but I don't know how it would express that. Then
maybe default-jre-headless should provide a working java executable for
the native architecture? Or maybe openjdk-21 should also be depending on
the native jdk like this?

    Build-Depends: openjdk-20-jdk-headless:native <!cross> | openjdk-21-jdk-headless:native <!cross>, openjdk-21-jdk-headless:native <cross>

Note that using this approach, we really must duplicate the dependency,
because the alternative is dropped too early.

Hope this makes sense to you

Helmut