This bug was fixed in the package ca-certificates-java -
20240118ubuntu0.24.04.1
---------------
ca-certificates-java (20240118ubuntu0.24.04.1) noble-security; urgency=medium
* debian/ca-certificates-java.postinst: reconcile package-managed aliases
in /etc/ssl/certs/java/cacerts on upgrade from 20240118. The
ca-certificates postinst shipped in noble applied certificate changes
without running the /etc/ca-certificates/update.d hooks, so the
deferred update fed this package an empty change list and the keystore
stopped receiving updates; it still trusts CAs that were removed from
the system trust store since then, including the eMudhra root
(LP: #2061817, Debian #1069251). Stale debian:-prefixed aliases are
removed and current system/local CAs are re-imported. Non-debian:
aliases are untouched.
* Depend on the fixed ca-certificates version so future updates reach the
trigger-safe Java hook.
-- Vyom Yadav <[email protected]> Mon, 02 Nov 2026 13:36:02
-0600
** Changed in: ca-certificates-java (Ubuntu Jammy)
Status: New => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2061817
Title:
[regression][security] ca-certificates.postinst does not feed
adds/removes to hooks
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ca-certificates/+bug/2061817/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
