Dear Maintainers, Attached is a patch that builds upon the minimal change approach proposed by Thorsten Glaser [1].
Summary of changes: - remove JRE dependency from ca-certificates-java - rely on a trigger being called after postinstall script execution - require openjdk-jre-X-headless to trigger updates of ca-certificates-java - fix -cacert option which broken certificate updates for machines with the default Java 8 (#1015771) This patch can not be applied directly as Breaks: section needs to be updated to Debian versions. OpenJDK packages need to be updated to trigger ca-certificates-java, see attached openjdk-8.diff. If this approach is acceptable I will attach patches or open salsa merge requests for other openjdk packages. Best Regards, Vladimir. [1] https://lists.debian.org/debian-java/2023/02/msg00061.html
ca-certificates-java.debdiff
Description: Binary data
--- a/debian/JB-jre-headless.postinst.in
+++ b/debian/JB-jre-headless.postinst.in
@@ -127,6 +126,10 @@ configure)
fi
fi
+ # Now that java is fully registered and configured,
+ # call update-ca-certificates-java
+ dpkg-trigger update-ca-certificates-java
+
;;
esac
