Xenial installation race condtion ** Description changed:
[Impact] ca-certificates-java implementation historically relied on openjdk-jre- headless package being able to work without being configured (e.g. 20190909ubuntu1.1), which may result in installation failure see LP: #2019908. ca-certificates-java 20230103 added hard dependency on openjdk package which caused a looping trigger. LP: #2019908 provided a fix for immediate problem - missing java.security file, but did not address the underlying issue - attempt to use the unconfigured package. The fix deployed to resolve this bug (LP: #2003750) removed dependency on openjdk package and ensured that certificate synchronisation by ca- certificates-java is performed only after openjdk jre is configured. This change will not need any future fixes in case of openjdk changes. In order to avoid issues such as LP: #2019908 in the future openjdk security releases, the fix for LP: #2003750 should be deployed to the - supported releases (kinetic, jammy, focal, bionic). + supported releases (kinetic, jammy, focal, bionic, xenial). + Xenial contains only openjdk-8 which is not currently affected by LP: + #2019908, but has installation race condition (see attachment). [Test Plan] [Where problems could occur] - This version of ca-certificates-java relies on openjdk package explicitly calling this trigger in ca-certificates-java. All supported openjdk packages (8,11,17,20,21) are updated to have this behaviour. + This version of ca-certificates-java relies on openjdk package explicitly calling this trigger in ca-certificates-java. All supported openjdk packages (8,11,17,20,21) are updated to have this behaviour. Unsupported packages (any other openjdk version) that are still present in the archive: - - openjdk-18 (jammy, kinetic), - - openjdk-16 (focal) - - openjdk-13 (focal) - + - openjdk-18 (jammy, kinetic), + - openjdk-16 (focal) + - openjdk-13 (focal) [Original Report] ca-certificates-java 20230103 fails to install in LibreOffice autopkgtests environment ... Setting up libebook1.2-dev:arm64 (3.46.3-1) ... dpkg: cycle found while processing triggers: chain of packages whose triggers are or may be responsible: ca-certificates-java -> ca-certificates-java packages' pending triggers which are or may be unresolvable: ca-certificates-java: /usr/lib/jvm dpkg: error processing package ca-certificates-java (--configure): triggers looping, abandoned Setting up junit4 (4.13.2-3) ... Setting up openjdk-17-jre:arm64 (17.0.6+10-0ubuntu1) ... Setting up maven-repo-helper (1.11) ... Setting up default-jre (2:1.17-74) ... Setting up openjdk-17-jdk-headless:arm64 (17.0.6+10-0ubuntu1) ... update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jar to provide /usr/bin/jar (jar) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jarsigner to provide /usr/bin/jarsigner (jarsigner) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/javac to provide /usr/bin/javac (javac) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/javadoc to provide /usr/bin/javadoc (javadoc) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/javap to provide /usr/bin/javap (javap) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jcmd to provide /usr/bin/jcmd (jcmd) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jdb to provide /usr/bin/jdb (jdb) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jdeprscan to provide /usr/bin/jdeprscan (jdeprscan) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jdeps to provide /usr/bin/jdeps (jdeps) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jfr to provide /usr/bin/jfr (jfr) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jimage to provide /usr/bin/jimage (jimage) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jinfo to provide /usr/bin/jinfo (jinfo) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jlink to provide /usr/bin/jlink (jlink) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jmap to provide /usr/bin/jmap (jmap) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jmod to provide /usr/bin/jmod (jmod) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jps to provide /usr/bin/jps (jps) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jrunscript to provide /usr/bin/jrunscript (jrunscript) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jshell to provide /usr/bin/jshell (jshell) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jstack to provide /usr/bin/jstack (jstack) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jstat to provide /usr/bin/jstat (jstat) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jstatd to provide /usr/bin/jstatd (jstatd) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/serialver to provide /usr/bin/serialver (serialver) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jhsdb to provide /usr/bin/jhsdb (jhsdb) in auto mode ... See attachment for full log of test case. ** Attachment added: "install.txt" https://bugs.launchpad.net/ubuntu/+source/ca-certificates-java/+bug/2003750/+attachment/5675499/+files/install.txt ** Description changed: [Impact] ca-certificates-java implementation historically relied on openjdk-jre- headless package being able to work without being configured (e.g. 20190909ubuntu1.1), which may result in installation failure see LP: #2019908. ca-certificates-java 20230103 added hard dependency on openjdk package which caused a looping trigger. LP: #2019908 provided a fix for immediate problem - missing java.security file, but did not address the underlying issue - attempt to use the unconfigured package. The fix deployed to resolve this bug (LP: #2003750) removed dependency on openjdk package and ensured that certificate synchronisation by ca- certificates-java is performed only after openjdk jre is configured. This change will not need any future fixes in case of openjdk changes. In order to avoid issues such as LP: #2019908 in the future openjdk security releases, the fix for LP: #2003750 should be deployed to the supported releases (kinetic, jammy, focal, bionic, xenial). Xenial contains only openjdk-8 which is not currently affected by LP: #2019908, but has installation race condition (see attachment). [Test Plan] + autopkgtests should pass. + + - Test package install in lxc container and ensure that race condition + is reproduced for each release - ca-certificates java are configured + before openjdk + + ----------------------cut------------------------------------ + for release in xenial bionic focal jammy kinetic; do + echo !!!!!!!!!!!!!!${release}!!!!!!!!!!!!!!!!!!!! + lxc launch images:ubuntu/${release} lp2019908 + lxc exec lp2019908 -- apt install software-properties-common + lxc exec lp2019908 -- add-apt-repository ppa:vpa1977/ca-certificates-java-patch + lxc exec lp2019908 -- apt-get update + lxc exec lp2019908 -- apt-get -y install openjdk-17-jre-headless + lxc stop lp2019908 + lxc delete lp2019908 + echo !!!!!!TEST DONE for ${release}!!!!!!!!! + done + ----------------------cut------------------------------------ + [Where problems could occur] - This version of ca-certificates-java relies on openjdk package explicitly calling this trigger in ca-certificates-java. All supported openjdk packages (8,11,17,20,21) are updated to have this behaviour. + This version of ca-certificates-java relies on openjdk package + explicitly calling this trigger in ca-certificates-java. All supported + openjdk packages (8,11,17,20,21) are updated to have this behaviour. + Unsupported 19 was also updated. + Unsupported packages (any other openjdk version) that are still present in the archive: - openjdk-18 (jammy, kinetic), - openjdk-16 (focal) - openjdk-13 (focal) + - openjdk-9 (xenial) + + We can update those packages in order to avoid issues. [Original Report] ca-certificates-java 20230103 fails to install in LibreOffice autopkgtests environment ... Setting up libebook1.2-dev:arm64 (3.46.3-1) ... dpkg: cycle found while processing triggers: chain of packages whose triggers are or may be responsible: ca-certificates-java -> ca-certificates-java packages' pending triggers which are or may be unresolvable: ca-certificates-java: /usr/lib/jvm dpkg: error processing package ca-certificates-java (--configure): triggers looping, abandoned Setting up junit4 (4.13.2-3) ... Setting up openjdk-17-jre:arm64 (17.0.6+10-0ubuntu1) ... Setting up maven-repo-helper (1.11) ... Setting up default-jre (2:1.17-74) ... Setting up openjdk-17-jdk-headless:arm64 (17.0.6+10-0ubuntu1) ... update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jar to provide /usr/bin/jar (jar) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jarsigner to provide /usr/bin/jarsigner (jarsigner) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/javac to provide /usr/bin/javac (javac) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/javadoc to provide /usr/bin/javadoc (javadoc) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/javap to provide /usr/bin/javap (javap) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jcmd to provide /usr/bin/jcmd (jcmd) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jdb to provide /usr/bin/jdb (jdb) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jdeprscan to provide /usr/bin/jdeprscan (jdeprscan) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jdeps to provide /usr/bin/jdeps (jdeps) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jfr to provide /usr/bin/jfr (jfr) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jimage to provide /usr/bin/jimage (jimage) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jinfo to provide /usr/bin/jinfo (jinfo) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jlink to provide /usr/bin/jlink (jlink) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jmap to provide /usr/bin/jmap (jmap) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jmod to provide /usr/bin/jmod (jmod) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jps to provide /usr/bin/jps (jps) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jrunscript to provide /usr/bin/jrunscript (jrunscript) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jshell to provide /usr/bin/jshell (jshell) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jstack to provide /usr/bin/jstack (jstack) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jstat to provide /usr/bin/jstat (jstat) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jstatd to provide /usr/bin/jstatd (jstatd) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/serialver to provide /usr/bin/serialver (serialver) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jhsdb to provide /usr/bin/jhsdb (jhsdb) in auto mode ... See attachment for full log of test case. -- You received this bug notification because you are a member of OpenJDK, which is subscribed to ca-certificates-java in Ubuntu. https://bugs.launchpad.net/bugs/2003750 Title: Unable to install libreoffice due to openjdk-jre-headless/ca- certificates-java installation failure [original: Fails to configure in autopkgtest] Status in ca-certificates-java package in Ubuntu: Fix Released Bug description: [Impact] ca-certificates-java implementation historically relied on openjdk- jre-headless package being able to work without being configured (e.g. 20190909ubuntu1.1), which may result in installation failure see LP: #2019908. ca-certificates-java 20230103 added hard dependency on openjdk package which caused a looping trigger. LP: #2019908 provided a fix for immediate problem - missing java.security file, but did not address the underlying issue - attempt to use the unconfigured package. The fix deployed to resolve this bug (LP: #2003750) removed dependency on openjdk package and ensured that certificate synchronisation by ca- certificates-java is performed only after openjdk jre is configured. This change will not need any future fixes in case of openjdk changes. In order to avoid issues such as LP: #2019908 in the future openjdk security releases, the fix for LP: #2003750 should be deployed to the supported releases (kinetic, jammy, focal, bionic, xenial). Xenial contains only openjdk-8 which is not currently affected by LP: #2019908, but has installation race condition (see attachment). [Test Plan] autopkgtests should pass. - Test package install in lxc container and ensure that race condition is reproduced for each release - ca-certificates java are configured before openjdk ----------------------cut------------------------------------ for release in xenial bionic focal jammy kinetic; do echo !!!!!!!!!!!!!!${release}!!!!!!!!!!!!!!!!!!!! lxc launch images:ubuntu/${release} lp2019908 lxc exec lp2019908 -- apt install software-properties-common lxc exec lp2019908 -- add-apt-repository ppa:vpa1977/ca-certificates-java-patch lxc exec lp2019908 -- apt-get update lxc exec lp2019908 -- apt-get -y install openjdk-17-jre-headless lxc stop lp2019908 lxc delete lp2019908 echo !!!!!!TEST DONE for ${release}!!!!!!!!! done ----------------------cut------------------------------------ [Where problems could occur] This version of ca-certificates-java relies on openjdk package explicitly calling this trigger in ca-certificates-java. All supported openjdk packages (8,11,17,20,21) are updated to have this behaviour. Unsupported 19 was also updated. Unsupported packages (any other openjdk version) that are still present in the archive: - openjdk-18 (jammy, kinetic), - openjdk-16 (focal) - openjdk-13 (focal) - openjdk-9 (xenial) We can update those packages in order to avoid issues. [Original Report] ca-certificates-java 20230103 fails to install in LibreOffice autopkgtests environment ... Setting up libebook1.2-dev:arm64 (3.46.3-1) ... dpkg: cycle found while processing triggers: chain of packages whose triggers are or may be responsible: ca-certificates-java -> ca-certificates-java packages' pending triggers which are or may be unresolvable: ca-certificates-java: /usr/lib/jvm dpkg: error processing package ca-certificates-java (--configure): triggers looping, abandoned Setting up junit4 (4.13.2-3) ... Setting up openjdk-17-jre:arm64 (17.0.6+10-0ubuntu1) ... Setting up maven-repo-helper (1.11) ... Setting up default-jre (2:1.17-74) ... Setting up openjdk-17-jdk-headless:arm64 (17.0.6+10-0ubuntu1) ... update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jar to provide /usr/bin/jar (jar) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jarsigner to provide /usr/bin/jarsigner (jarsigner) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/javac to provide /usr/bin/javac (javac) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/javadoc to provide /usr/bin/javadoc (javadoc) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/javap to provide /usr/bin/javap (javap) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jcmd to provide /usr/bin/jcmd (jcmd) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jdb to provide /usr/bin/jdb (jdb) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jdeprscan to provide /usr/bin/jdeprscan (jdeprscan) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jdeps to provide /usr/bin/jdeps (jdeps) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jfr to provide /usr/bin/jfr (jfr) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jimage to provide /usr/bin/jimage (jimage) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jinfo to provide /usr/bin/jinfo (jinfo) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jlink to provide /usr/bin/jlink (jlink) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jmap to provide /usr/bin/jmap (jmap) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jmod to provide /usr/bin/jmod (jmod) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jps to provide /usr/bin/jps (jps) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jrunscript to provide /usr/bin/jrunscript (jrunscript) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jshell to provide /usr/bin/jshell (jshell) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jstack to provide /usr/bin/jstack (jstack) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jstat to provide /usr/bin/jstat (jstat) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jstatd to provide /usr/bin/jstatd (jstatd) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/serialver to provide /usr/bin/serialver (serialver) in auto mode update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jhsdb to provide /usr/bin/jhsdb (jhsdb) in auto mode ... See attachment for full log of test case. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/ca-certificates-java/+bug/2003750/+subscriptions _______________________________________________ Mailing list: https://launchpad.net/~openjdk Post to : openjdk@lists.launchpad.net Unsubscribe : https://launchpad.net/~openjdk More help : https://help.launchpad.net/ListHelp
