Bug#1030129: ca-certificates-java - Fails to install with OpenJDK 21: Error loading java.security file

[Bastian Blank]

Package: ca-certificates-java
Version: 20230103
Severity: serious

ca-certificates-java fails to install with all dependencies fullfilled:

| Setting up ca-certificates-java (20230103) ...
| Exception in thread "main" java.lang.InternalError: Error loading java.security file
| at java.base/java.security.Security.initialize(Security.java:105)
| at java.base/java.security.Security.lambda$static$0(Security.java:84)
| at java.base/java.security.AccessController.doPrivileged(AccessController.java:319)
| at java.base/java.security.Security.<clinit>(Security.java:83)
| at java.base/sun.security.jca.ProviderList.<init>(ProviderList.java:179)
| at java.base/sun.security.jca.ProviderList$2.run(ProviderList.java:96)
| at java.base/sun.security.jca.ProviderList$2.run(ProviderList.java:94)
| at java.base/java.security.AccessController.doPrivileged(AccessController.java:319)
| at java.base/sun.security.jca.ProviderList.fromSecurityProperties(ProviderList.java:93)
| at java.base/sun.security.jca.Providers.<clinit>(Providers.java:55)
| at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:156)
| at java.base/java.security.cert.CertificateFactory.getInstance(CertificateFactory.java:193)
| at org.debian.security.KeyStoreHandler.<init>(KeyStoreHandler.java:50)
| at org.debian.security.UpdateCertificates.<init>(UpdateCertificates.java:65)
| at org.debian.security.UpdateCertificates.main(UpdateCertificates.java:51)
| dpkg: error processing package ca-certificates-java (--configure):
| installed ca-certificates-java package post-installation script subprocess returned error exit status 1
| dpkg: dependency problems prevent configuration of openjdk-21-jre-headless:arm64:
| openjdk-21-jre-headless:arm64 depends on ca-certificates-java (>= 20190405~); however:
| Package ca-certificates-java is not configured yet.
|
| dpkg: error processing package openjdk-21-jre-headless:arm64 (--configure):
| dependency problems - leaving unconfigured
| dpkg: dependency problems prevent configuration of openjdk-21-jre:arm64:
| openjdk-21-jre:arm64 depends on openjdk-21-jre-headless (= 21~7ea-1); however:
| Package openjdk-21-jre-headless:arm64 is not configured yet.
|
| dpkg: error processing package openjdk-21-jre:arm64 (--configure):
| dependency problems - leaving unconfigured
| dpkg: dependency problems prevent configuration of openjdk-21-jdk-headless:arm64:
| openjdk-21-jdk-headless:arm64 depends on openjdk-21-jre-headless (= 21~7ea-1); however:
| Package openjdk-21-jre-headless:arm64 is not configured yet.
|
| dpkg: error processing package openjdk-21-jdk-headless:arm64 (--configure):
| dependency problems - leaving unconfigured
| dpkg: dependency problems prevent configuration of openjdk-21-jdk:arm64:
| openjdk-21-jdk:arm64 depends on openjdk-21-jre (= 21~7ea-1); however:
| Package openjdk-21-jre:arm64 is not configured yet.
| openjdk-21-jdk:arm64 depends on openjdk-21-jdk-headless (= 21~7ea-1); however:
| Package openjdk-21-jdk-headless:arm64 is not configured yet.
|
| dpkg: error processing package openjdk-21-jdk:arm64 (--configure):
| dependency problems - leaving unconfigured

[Sebastiaan Couwenberg]

On Tue, 31 Jan 2023 13:56:42 +0100 Bastian Blank <wa...@debian.org> wrote:
> | dpkg: error processing package openjdk-21-jdk:arm64 (--configure):
> | dependency problems - leaving unconfigured

It also fails to install with openjdk-17:

Setting up ca-certificates-java (20230103) ...
Exception in thread "main" java.lang.InternalError: Error loading
java.security file

at java.base/java.security.Security.initialize(Security.java:106)
at java.base/java.security.Security$1.run(Security.java:84)
at java.base/java.security.Security$1.run(Security.java:82)
at
java.base/java.security.AccessController.doPrivileged(AccessController.java:318)
at java.base/java.security.Security.<clinit>(Security.java:82)
at
java.base/sun.security.jca.ProviderList.<init>(ProviderList.java:178)

at
java.base/sun.security.jca.ProviderList$2.run(ProviderList.java:96)
at
java.base/sun.security.jca.ProviderList$2.run(ProviderList.java:94)
at

java.base/java.security.AccessController.doPrivileged(AccessController.java:318)

at
java.base/sun.security.jca.ProviderList.fromSecurityProperties(ProviderList.java:93)
at java.base/sun.security.jca.Providers.<clinit>(Providers.java:55)
at
java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:156)
at
java.base/java.security.cert.CertificateFactory.getInstance(CertificateFactory.java:193)
at
org.debian.security.KeyStoreHandler.<init>(KeyStoreHandler.java:50)
at
org.debian.security.UpdateCertificates.<init>(UpdateCertificates.java:65)
at
org.debian.security.UpdateCertificates.main(UpdateCertificates.java:51)
dpkg: error processing package ca-certificates-java (--configure):
installed ca-certificates-java package post-installation script
subprocess returned error exit status 1

Setting up liblwp-protocol-https-perl (6.10-1) ...
Setting up default-jre-headless (2:1.17-74) ...
Setting up libwww-perl (6.70-1) ...
Setting up ant (1.10.13-1) ...

dpkg: dependency problems prevent configuration of

openjdk-17-jre-headless:amd64:
openjdk-17-jre-headless:amd64 depends on ca-certificates-java (>=

20190405~); however:
Package ca-certificates-java is not configured yet.

dpkg: error processing package openjdk-17-jre-headless:amd64 (--configure):

dependency problems - leaving unconfigured

Setting up libxml-parser-perl (2.46-4) ...
dpkg: dependency problems prevent configuration of openjdk-17-jre:amd64:
openjdk-17-jre:amd64 depends on openjdk-17-jre-headless (=
17.0.7+7-1); however:
Package openjdk-17-jre-headless:amd64 is not configured yet.

dpkg: error processing package openjdk-17-jre:amd64 (--configure):

dependency problems - leaving unconfigured

dpkg: dependency problems prevent configuration of default-jre:
default-jre depends on openjdk-17-jre; however:
Package openjdk-17-jre:amd64 is not configured yet.

dpkg: error processing package default-jre (--configure):

dependency problems - leaving unconfigured

dpkg: dependency problems prevent configuration of openjdk-17-jdk:amd64:
openjdk-17-jdk:amd64 depends on openjdk-17-jre (= 17.0.7+7-1); however:
Package openjdk-17-jre:amd64 is not configured yet.

dpkg: error processing package openjdk-17-jdk:amd64 (--configure):

dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of

openjdk-17-jdk-headless:amd64:
openjdk-17-jdk-headless:amd64 depends on openjdk-17-jre-headless (=
17.0.7+7-1); however:
Package openjdk-17-jre-headless:amd64 is not configured yet.

dpkg: error processing package openjdk-17-jdk-headless:amd64 (--configure):

dependency problems - leaving unconfigured

Setting up libxml-sax-expat-perl (0.51-2) ...
update-perl-sax-parsers: Registering Perl SAX parser XML::SAX::Expat
with priority 50...
update-perl-sax-parsers: Updating overall Perl SAX parser modules info
file...
Replacing config file /etc/perl/XML/SAX/ParserDetails.ini with new version
dpkg: dependency problems prevent configuration of default-jdk:
default-jdk depends on default-jre (= 2:1.17-74); however:
Package default-jre is not configured yet.
default-jdk depends on openjdk-17-jdk; however:
Package openjdk-17-jdk:amd64 is not configured yet.

dpkg: error processing package default-jdk (--configure):

dependency problems - leaving unconfigured

dpkg: dependency problems prevent configuration of default-jdk-headless:
default-jdk-headless depends on openjdk-17-jdk-headless; however:
Package openjdk-17-jdk-headless:amd64 is not configured yet.

dpkg: error processing package default-jdk-headless (--configure):

dependency problems - leaving unconfigured

Processing triggers for libc-bin (2.36-9) ...
Processing triggers for sgml-base (1.31) ...
Setting up docbook-xsl (1.79.2+dfsg-2) ...
Setting up sgml-data (2.0.11+nmu1) ...
Setting up docbook2x (0.8.8-17+b1) ...
Processing triggers for sgml-base (1.31) ...
Setting up docbook-xml (4.5-12) ...
Processing triggers for ca-certificates (20230311) ...
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.
Processing triggers for php8.2-cli (8.2.7-1) ...
Processing triggers for libgdk-pixbuf-2.0-0:amd64 (2.42.10+dfsg-1+b1) ...
Processing triggers for sgml-base (1.31) ...
Errors were encountered while processing:
ca-certificates-java
openjdk-17-jre-headless:amd64
openjdk-17-jre:amd64
default-jre
openjdk-17-jdk:amd64
openjdk-17-jdk-headless:amd64
default-jdk
default-jdk-headless
E: Sub-process /usr/bin/dpkg returned an error code (1)

Setting up ca-certificates-java (20230103) ...
Exception in thread "main" java.lang.InternalError: Error loading
java.security file

at java.base/java.security.Security.initialize(Security.java:106)
at java.base/java.security.Security$1.run(Security.java:84)
at java.base/java.security.Security$1.run(Security.java:82)
at
java.base/java.security.AccessController.doPrivileged(AccessController.java:318)
at java.base/java.security.Security.<clinit>(Security.java:82)
at
java.base/sun.security.jca.ProviderList.<init>(ProviderList.java:178)

at
java.base/sun.security.jca.ProviderList$2.run(ProviderList.java:96)
at
java.base/sun.security.jca.ProviderList$2.run(ProviderList.java:94)
at

java.base/java.security.AccessController.doPrivileged(AccessController.java:318)

at
java.base/sun.security.jca.ProviderList.fromSecurityProperties(ProviderList.java:93)
at java.base/sun.security.jca.Providers.<clinit>(Providers.java:55)
at
java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:156)
at
java.base/java.security.cert.CertificateFactory.getInstance(CertificateFactory.java:193)
at
org.debian.security.KeyStoreHandler.<init>(KeyStoreHandler.java:50)
at
org.debian.security.UpdateCertificates.<init>(UpdateCertificates.java:65)
at
org.debian.security.UpdateCertificates.main(UpdateCertificates.java:51)
dpkg: error processing package ca-certificates-java (--configure):
installed ca-certificates-java package post-installation script
subprocess returned error exit status 1
dpkg: dependency problems prevent configuration of

openjdk-17-jre-headless:amd64:
openjdk-17-jre-headless:amd64 depends on ca-certificates-java (>=

20190405~); however:
Package ca-certificates-java is not configured yet.

dpkg: error processing package openjdk-17-jre-headless:amd64 (--configure):

dependency problems - leaving unconfigured

dpkg: dependency problems prevent configuration of openjdk-17-jre:amd64:
openjdk-17-jre:amd64 depends on openjdk-17-jre-headless (=
17.0.7+7-1); however:
Package openjdk-17-jre-headless:amd64 is not configured yet.

dpkg: error processing package openjdk-17-jre:amd64 (--configure):

dependency problems - leaving unconfigured

dpkg: dependency problems prevent configuration of default-jre:
default-jre depends on openjdk-17-jre; however:
Package openjdk-17-jre:amd64 is not configured yet.

dpkg: error processing package default-jre (--configure):

dependency problems - leaving unconfigured

dpkg: dependency problems prevent configuration of openjdk-17-jdk:amd64:
openjdk-17-jdk:amd64 depends on openjdk-17-jre (= 17.0.7+7-1); however:
Package openjdk-17-jre:amd64 is not configured yet.

dpkg: error processing package openjdk-17-jdk:amd64 (--configure):

dependency problems - leaving unconfigured
dpkg: dependency problems prevent configuration of

openjdk-17-jdk-headless:amd64:
openjdk-17-jdk-headless:amd64 depends on openjdk-17-jre-headless (=
17.0.7+7-1); however:
Package openjdk-17-jre-headless:amd64 is not configured yet.

dpkg: error processing package openjdk-17-jdk-headless:amd64 (--configure):

dependency problems - leaving unconfigured

dpkg: dependency problems prevent configuration of default-jdk:
default-jdk depends on default-jre (= 2:1.17-74); however:
Package default-jre is not configured yet.
default-jdk depends on openjdk-17-jdk; however:
Package openjdk-17-jdk:amd64 is not configured yet.

dpkg: error processing package default-jdk (--configure):

dependency problems - leaving unconfigured

dpkg: dependency problems prevent configuration of default-jdk-headless:
default-jdk-headless depends on openjdk-17-jdk-headless; however:
Package openjdk-17-jdk-headless:amd64 is not configured yet.

dpkg: error processing package default-jdk-headless (--configure):

dependency problems - leaving unconfigured

Errors were encountered while processing:
ca-certificates-java
openjdk-17-jre-headless:amd64
openjdk-17-jre:amd64
default-jre
openjdk-17-jdk:amd64
openjdk-17-jdk-headless:amd64
default-jdk
default-jdk-headless

The above is from the mapserver build dependencies when openjdk-21-jre
is added to Build-Conflicts.

Kind Regards,

Bas

--
GPG Key ID: 4096R/6750F10AE88D4AF1
Fingerprint: 8182 DE41 7056 408D 6146 50D1 6750 F10A E88D 4AF1

[tony mancill]

I am not able to reproduce the failure in a clean unstable
schroot with either openjdk-17 or openjdk-21 yet - for example:

$ sudo sbuild-createchroot --no-deb-src --chroot-mode=schroot --chroot-prefix=test --include=default-jdk unstable /data/chroot/test-amd64-sbuild

$ schroot -c test-amd64-sbuild -u root --directory /tmp /bin/bash

(test-amd64-sbuild)root@lark:/tmp# dpkg -l | grep -E 'openjdk|ca-cert|default-jdk'
ii ca-certificates 20230311 all Common CA certificates
ii ca-certificates-java 20230103 all Common CA certificates (JKS keystore)
ii default-jdk 2:1.17-74 amd64 Standard Java or Java compatible Development Kit
ii default-jdk-headless 2:1.17-74 amd64 Standard Java or Java compatible Development Kit (headless)
ii openjdk-17-jdk:amd64 17.0.7+7-1 amd64 OpenJDK Development Kit (JDK)
ii openjdk-17-jdk-headless:amd64 17.0.7+7-1 amd64 OpenJDK Development Kit (JDK) (headless)
ii openjdk-17-jre:amd64 17.0.7+7-1 amd64 OpenJDK Java runtime, using Hotspot JIT
ii openjdk-17-jre-headless:amd64 17.0.7+7-1 amd64 OpenJDK Java runtime, using Hotspot JIT (headless)

Maybe some environmental difference is causing the failure. Could it be
that the java.security file has been modified on the systems where the
failure is occurring? (Just a guess...) If so, could someone share the
file from a system where the bug manifests?

Thanks,
tony

[Sebastiaan Couwenberg]

On 6/13/23 05:22, tony mancill wrote:
> I am not able to reproduce the failure in a clean unstable
> schroot with either openjdk-17 or openjdk-21 yet - for example:

I also had trouble reproducing the issue in a sid cowbuilder chroot.

This worked for me:

apt install ca-certificates-java default-jdk openjdk-21-jdk

Just building osmpbf also triggered the issue yesterday, but now

apt build-dep osmpbf

succeeds like it does for other Java packages. This suggests a race
condition or apt package ordering issue.

[Forest]

The fixed version has been in Testing for over a week now. Does another step
remain in order to get it into Stable or Backports?

This is blocking the installation of the java runtime on Bookworm systems
(unless, presumably, they upgraded from Bullseye and already had it).

[Dan Mick]

Are there any plans to backport this? Is the bug in a state that allows
it to show up as an action item for the maintainers?

[grin]

Is this bug fixed in recently uploaded 20230620~deb12u1? Or are we waiting for 20230710 backport?

(Sidenote: found this bug because Ceph cannot build their release. [https://docs.ceph.com/en/latest/releases/reef/])

Peter