installer: Debian packages cannot be installed together with ca-certificates-java
Because of the dependency of adoptopenjdk-* to ca-certificates-java in debian they are installed at the same time. For some reason both cannot be installed at the same time because ca-certificates-java needs a ready installed java to execute java but ca-certificates-java seems to be installed first so there is no java executable yet.
We have to look how openjdk-8-jre-headless does the magic in the debian package. It seems that the problem is this:
setup_path()
{
for jvm in java-7-openjdk-$arch java-7-openjdk \
oracle-java7-jre-$arch oracle-java7-server-jre-$arch oracle-java7-jdk-$arch \
java-8-openjdk-$arch java-8-openjdk \
oracle-java8-jre-$arch oracle-java8-server-jre-$arch oracle-java8-jdk-$arch \
java-9-openjdk-$arch java-9-openjdk \
oracle-java9-jre-$arch oracle-java9-server-jre-$arch oracle-java9-jdk-$arch \
java-10-openjdk-$arch java-10-openjdk \
oracle-java10-jre-$arch oracle-java10-server-jre-$arch oracle-java10-jdk-$arch \
java-11-openjdk-$arch java-11-openjdk \
oracle-java11-jre-$arch oracle-java11-server-jre-$arch oracle-java11-jdk-$arch \
java-12-openjdk-$arch java-12-openjdk \
oracle-java12-jre-$arch oracle-java12-server-jre-$arch oracle-java12-jdk-$arch \
java-13-openjdk-$arch java-13-openjdk \
oracle-java13-jre-$arch oracle-java13-server-jre-$arch oracle-java13-jdk-$arch \
java-14-openjdk-$arch java-14-openjdk \
oracle-java14-jre-$arch oracle-java14-server-jre-$arch oracle-java14-jdk-$arch \
java-15-openjdk-$arch java-15-openjdk \
oracle-java15-jre-$arch oracle-java15-server-jre-$arch oracle-java15-jdk-$arch \
java-16-openjdk-$arch java-16-openjdk \
oracle-java16-jre-$arch oracle-java16-server-jre-$arch oracle-java16-jdk-$arch \
java-17-openjdk-$arch java-17-openjdk \
oracle-java17-jre-$arch oracle-java17-server-jre-$arch oracle-java17-jdk-$arch; do
if [ -x /usr/lib/jvm/$jvm/bin/java ]; then
export JAVA_HOME=/usr/lib/jvm/$jvm
PATH=$JAVA_HOME/bin:$PATH
break
fi
done
}
I think we could and should patch upstream to include also adoptopenjdk.
But for now i think we have to remove the dependency to ca-certificates-java.
About this issue
- Original URL
- State: closed
- Created 5 years ago
- Reactions: 2
- Comments: 33 (21 by maintainers)
Another observation:
/usr/local/share/ca-certificates/and ranupdate-ca-certificates.curlwas able to connect successfully to one of our internal systems because/etc/ssl/certs/ca-certificates.crtwas adapted./etc/ssl/certs/java/cacertswas adapted as well.java -Djavax.net.ssl.trustStore=/etc/ssl/certs/java/cacerts. Otherwise java will default to/usr/lib/jvm/adoptopenjdk-8-hotspot-amd64/jre/lib/security/cacerts.Good news: This is fixed. 😅 Bad news: The fix is in a holding pattern until Adoptium arrives and I’ve redone the JDK/JRE packages. I don’t want to wrestle with the old infrastructure anymore.
Details: For Debian, there will be a separate package (temporary name:
adoptium-ca-certificates). This replacesca-certificates-javafrom Debian/Ubuntu. It comes without the circular dependency and only depends onca-certificatesandp11-kit. A JRE/JDK isn’t necessary for its operation. It integrates with the system’s certificate store and its cacerts is automatically updated withupdate-ca-certificatesas the Debian JDK./etc/ssl/certs/adoptium/cacertsis going to serve as shared keystore for all Adoptium runtimes and will be symlinked.I did not port the option to use a different keystore password than the default (
changeit) or the option to sideload certificates that aren’t included in the local certificate store/usr/local/share/ca-certificates/. If anybody needs that, please speak up. It’s still possible to disable the automatic update via/etc/default/adoptium-ca-certificates.Red Hat and SUSE flavours won’t need it because their
ca-certificateshas a cacerts included.If anyone wants to follow the development, it’s currently on https://github.com/aahlenst/adoptium-ca-certificates and awaiting it’s permanent home. And this time, we even have a full test suite that ensures everything’s working across the board 🤞
$ docker run --rm -it -v ~/Downloads/adoptopenjdk-8-hotspot_1.8.0\ 212-1_amd64.deb:/tmp/adoptopenjdk-8-hotspot_1.8.0-212-1_amd64.deb debian:stretch-slimThe same thing happens when using
debian:stretchinstead ofdebian:stretch-slim. And just for completeness the same happens onbuster-slimas well.