aahlenst
commented
5 years ago Sorry, I don't follow. How does the problem manifest?
When I try to install adoptopenjdk-11-hotspot_11.0.2+9-1_amd64.deb, it is installed before ca-certificates-java and the keystore /etc/ssl/certs/java/cacerts is filled with certificates afterwards:
root@768cffbd84c4:/tmp# dpkg --list | grep java
root@768cffbd84c4:/tmp# apt install -y ./adoptopenjdk-11-hotspot_11.0.2+9-1_amd64.deb
Reading package lists... Done
Building dependency tree
Reading state information... Done
Note, selecting 'adoptopenjdk-11-hotspot' instead of './adoptopenjdk-11-hotspot_11.0.2+9-1_amd64.deb'
The following additional packages will be installed:
ca-certificates-java java-common libasound2 libasound2-data libbsd0 libnspr4 libnss3 libsqlite3-0 libx11-6
libx11-data libxau6 libxcb1 libxdmcp6 libxext6 libxi6 libxrender1 libxtst6 multiarch-support x11-common
Suggested packages:
default-jre libasound2-plugins alsa-utils
The following NEW packages will be installed:
adoptopenjdk-11-hotspot ca-certificates-java java-common libasound2 libasound2-data libbsd0 libnspr4 libnss3
libsqlite3-0 libx11-6 libx11-data libxau6 libxcb1 libxdmcp6 libxext6 libxi6 libxrender1 libxtst6 multiarch-support
x11-common
0 upgraded, 20 newly installed, 0 to remove and 0 not upgraded.
[cut]
update-alternatives: using /usr/lib/jvm/adoptopenjdk-11-hotspot-amd64/lib/jexec to provide /usr/bin/jexec (jexec) in auto mode
Setting up ca-certificates-java (20180516ubuntu1~18.04.1) ...
head: cannot open '/etc/ssl/certs/java/cacerts' for reading: No such file or directory
Adding debian:QuoVadis_Root_CA_3_G3.pem
Adding debian:Staat_der_Nederlanden_Root_CA_-_G2.pem
[ cut]
root@768cffbd84c4:/tmp# dpkg --list | grep java
ii ca-certificates-java 20180516ubuntu1~18.04.1 all Common CA certificates (JKS keystore)
ii java-common 0.68ubuntu1~18.04.1 all Base package for Java runtimes
root@768cffbd84c4:/tmp# keytool -list -keystore /etc/ssl/certs/java/cacerts
Enter keystore password:
***************** WARNING WARNING WARNING *****************
* The integrity of the information stored in your keystore *
* has NOT been verified! In order to verify its integrity, *
* you must provide your keystore password. *
***************** WARNING WARNING WARNING *****************
Keystore type: JKS
Keystore provider: SUN
Your keystore contains 133 entries
debian:affirmtrust_premium_ecc.pem, May 6, 2019, trustedCertEntry,
Certificate fingerprint (SHA-256): BD:71:FD:F6:DA:97:E4:CF:62:D1:64:7A:DD:25:81:B0:7D:79:AD:F8:39:7E:B4:EC:BA:9C:5E:84:88:82:14:23
[cut]Just for completeness:
root@768cffbd84c4:/tmp# cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.2 LTS"
mfriedenhagen
nudgegoonies
douph1
gdams
JakubVanek
Because of the dependency of adoptopenjdk-* to ca-certificates-java in debian they are installed at the same time. For some reason both cannot be installed at the same time because ca-certificates-java needs a ready installed java to execute java but ca-certificates-java seems to be installed first so there is no java executable yet.
We have to look how openjdk-8-jre-headless does the magic in the debian package. It seems that the problem is this:
I think we could and should patch upstream to include also adoptopenjdk.
But for now i think we have to remove the dependency to ca-certificates-java.