Bug#1038635: ca-certificates-java: post-inst fails on bullseye when installed as openjdk dependency

[Mark Carroll]

Package: ca-certificates-java
Version: 20190909
Severity: important
X-Debbugs-Cc: mtbc at ixod.org

Dear Maintainer,

If I do,

$ docker run -it debian:bullseye
# apt-get update
# apt-get install openjdk-17-jre-headless

then the installation fails with,

Setting up ca-certificates-java (20190909) ...
head: cannot open '/etc/ssl/certs/java/cacerts' for reading: No such file or directory
Exception in thread "main" java.lang.InternalError: Error loading java.security file
	at java.base/java.security.Security.initialize(Security.java:106)
	at java.base/java.security.Security$1.run(Security.java:84)
	at java.base/java.security.Security$1.run(Security.java:82)
	at java.base/java.security.AccessController.doPrivileged(AccessController.java:318)
	at java.base/java.security.Security.<clinit>(Security.java:82)
	at java.base/sun.security.jca.ProviderList.<init>(ProviderList.java:178)
	at java.base/sun.security.jca.ProviderList$2.run(ProviderList.java:96)
	at java.base/sun.security.jca.ProviderList$2.run(ProviderList.java:94)
	at java.base/java.security.AccessController.doPrivileged(AccessController.java:318)
	at java.base/sun.security.jca.ProviderList.fromSecurityProperties(ProviderList.java:93)
	at java.base/sun.security.jca.Providers.<clinit>(Providers.java:55)
	at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:156)
	at java.base/java.security.cert.CertificateFactory.getInstance(CertificateFactory.java:193)
	at org.debian.security.KeyStoreHandler.<init>(KeyStoreHandler.java:50)
	at org.debian.security.UpdateCertificates.<init>(UpdateCertificates.java:65)
	at org.debian.security.UpdateCertificates.main(UpdateCertificates.java:51)
dpkg: error processing package ca-certificates-java (--configure):
 installed ca-certificates-java package post-installation script subprocess returned error exit status 1

It works fine if I install ca-certificates-java before attempting to
install openjdk-17-jre-headless.

I wonder if this bug is somehow related to #999377.

Cheers,
Mark


-- System Information:
Debian Release: 11.7
  APT prefers oldstable-updates
  APT policy: (500, 'oldstable-updates'), (500, 'oldstable-security'), (500, 'oldstable')
Architecture: amd64 (x86_64)

Kernel: Linux 6.2.6-76060206-generic (SMP w/16 CPU threads; PREEMPT)
Kernel taint flags: TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=C, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /bin/dash
Init: unable to detect

Versions of packages ca-certificates-java depends on:
ii  ca-certificates                                   20210119
ii  libnss3                                           2:3.61-1+deb11u3
ii  openjdk-17-jre-headless [java8-runtime-headless]  17.0.7+7-1~deb11u1

ca-certificates-java recommends no packages.

ca-certificates-java suggests no packages.

-- no debconf information