Arnaud Rebillout pushed to branch buster at Debian Java Maintainers / ca-certificates-java
Commits: b53ec649 by Arnaud Rebillout at 2026-08-13T14:24:18+07:00 Fix old entry in d/changelog These few lines went away during a merge, bring it back, otherwise tools like dpkg-parsechangelog complain, rightly so: ``` $ dpkg-parsechangelog --all > /dev/null dpkg-parsechangelog: warning: debian/changelog(l114): found start of entry where expected more change data or trailer ``` Gbp-Dch: ignore - - - - - 0f56c13c by Arnaud Rebillout at 2026-08-13T14:24:39+07:00 postinst: no-op if the runtime is GCJ In previous version of ca-certificates-java (20170929~deb9u3), we didn't need this check, because: - ca-certificates-java Depended on openjdk-7-jre-headless - openjdk-7 alternatives have higher priority than gcj So even if gcj was installed (note: openjdk and gcj are indeed co-installable), installing ca-certificates-java would pull in openjdk, and it's then openjdk (runtime and keytool) that would be used in the postinst. Now that we've removed the Depends on openjdk-7-jre-headless (to break a Dep cycle), it is possible that the postinst script runs while gcj is installed and openjdk is not. We need to be careful and no-op in that case, as gcj's keytool and openjdk's keytool are not compatible at all. Moreover, it seems that compatibility between gcj and ca-certificates-java is simply not there, eg. gcj's keystore is shipped at /etc/java/cacerts-gcj by package libgcj-common, and ca-certificates-java is not aware of that. More details at: <https://gitlab.com/freexian/services/deblts-team/extended-lts/-/work_items/331> - - - - - 8ad71014 by Arnaud Rebillout at 2026-08-14T16:38:43+07:00 Fix execute_after -> override in d/rules execute_after needs debhelper 13 - - - - - e6676343 by Arnaud Rebillout at 2026-08-14T16:49:59+07:00 Prepare changelog for release - - - - - 3 changed files: - debian/ca-certificates-java.postinst - debian/changelog - debian/rules Changes: ===================================== debian/ca-certificates-java.postinst ===================================== @@ -120,6 +120,8 @@ find_pem_files() update_cacerts() { + local java_version= + if [ "$cacerts_updates" != "yes" ] || [ "$CACERT_UPDATES" = "disabled" ]; then echo "Updates of cacerts keystore are disabled." exit 0 @@ -130,10 +132,17 @@ update_cacerts() exit 0 fi - if ! java -version 2> /dev/null; then + if ! java_version=$(java -version 2> /dev/null); then + [ -n "$java_version" ] && echo "$java_version" echo "Unable to execute Java. Skipping Java certificates setup." exit 0 fi + [ -n "$java_version" ] && echo "$java_version" + + if echo "$java_version" | grep -iq 'gnu libgcj'; then + echo "Unsupported Java runtime. Skipping Java certificates setup." + exit 0 + fi if [ -f /var/lib/ca-certificates-java/convert_pkcs12_keystore_to_jks ]; then convert_pkcs12_keystore_to_jks ===================================== debian/changelog ===================================== @@ -1,9 +1,16 @@ -ca-certificates-java (20230710~deb12u1~deb11u1~deb10u2) unstable; urgency=medium +ca-certificates-java (20230710~deb12u1~deb11u1~deb10u2) buster-security; urgency=medium - * Non-maintainer upload by ELTS team. - * Harden conversion of PKCS12 to JKS for easing upgrade from stretch security + * Non-maintainer upload by ELTS team. + + [ Bastien Roucariès ] + * Harden conversion of PKCS12 to JKS for easing upgrade from stretch security + + [ Arnaud Rebillout ] + * Fix the bogus comparison for the keystore magic + * postinst: no-op if the runtime is GCJ + * Fix execute_after -> override in d/rules - -- Bastien Roucariès <[email protected]> Fri, 27 Feb 2026 22:58:36 +0100 + -- Arnaud Rebillout <[email protected]> Mon, 23 Mar 2026 14:35:12 +0700 ca-certificates-java (20230710~deb12u1~deb11u1~deb10u1) buster-security; urgency=medium @@ -117,6 +124,11 @@ ca-certificates-java (20190909+deb11u1) bullseye; urgency=medium * Non-maintainer upload. * Backport changes from 20230620 in sid. (Closes: #1039472) + [ Vladimir Petko ] + * d/ca-certificates-java.postinst: Work-around not yet configured jre. + + -- Andreas Beckmann <[email protected]> Thu, 27 Jul 2023 16:29:03 +0200 + ca-certificates-java (20190909) unstable; urgency=medium * Team upload. @@ -130,7 +142,11 @@ ca-certificates-java (20190909) unstable; urgency=medium ca-certificates-java (20190405+deb10u1) buster-security; urgency=medium -[ Vladimir Petko ] + [ Andreas Beckmann] + * Non-maintainer upload. + * Backport changes from 20230620 in sid. (Closes: #1039472) + + [ Vladimir Petko ] * d/ca-certificates-java.postinst: Work-around not yet configured jre. [ Bastien Roucariès ] ===================================== debian/rules ===================================== @@ -30,5 +30,6 @@ endif override_dh_installinit: dh_installinit --name=cacerts -execute_after_dh_fixperms: +override_dh_fixperms: + dh_fixperms chmod 0600 debian/ca-certificates-java/etc/default/cacerts View it on GitLab: https://salsa.debian.org/java-team/ca-certificates-java/-/compare/35bf361cab9f5a1c0d9e9d6596df1501646a9197...e667634337f0af177c57faee60d80015b04672cf -- View it on GitLab: https://salsa.debian.org/java-team/ca-certificates-java/-/compare/35bf361cab9f5a1c0d9e9d6596df1501646a9197...e667634337f0af177c57faee60d80015b04672cf You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help
_______________________________________________ pkg-java-commits mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-java-commits
