Merge ~vpa1977/ubuntu/+source/ca-certificates-java:dpkg-trigger into ubuntu/+source/ca-certificates-java:ubuntu/devel

[Vladimir Petko]

NOTE: Please do not merge this until all OpenJDK package updates are performed. This package breaks existing OpenJDK packages.

This change depends on openjdk-jre-headless triggering certificate updates in the postinst script. Prerequisite updates:
 - openjdk-8 [1] (merged)
 - openjdk-lts [2] (merged)
 - openjdk-17 [3] (merged)
 - openjdk-18 [4] (merged)
 - openjdk-19 [5] (merged)
 - openjdk-20 [6] (merged)
 - openjdk-21 [7] (merged)
Summary of changes:

  * Resolve circular JRE dependency (LP: #2003750, LP: #1999103, LP: #2004061)
    - debian/ca-certificates-java.postinst: remove setup_path, remove
      update_cacerts from "configure" stage.
    - debian/ca-certificates-java.postinst: do "fresh" update if cacerts file is not found. Certificates are refreshed only in response to the trigger activated by OpenJDK packages.
    - debian/ca-certificates-java.postinst: fix cacert enumeration command for Java 8.
    - debian/control: remove JRE dependency.
    - debian/control: add Breaks condition.
    - debian/tests: add smoke tests.
    - debian/ca-certificates-java.triggers: remove file trigger /usr/jvm.

PPA: ppa:vpa1977/ca-certificates-java-dpkg [8]

Steps to test:
   autopackage tests should pass

Autopackage test results:
autopkgtest [08:33:54]: @@@@@@@@@@@@@@@@@@@@ summary
can-convert-keystore PASS
can-install-jre PASS
can-install-multiple-jdks PASS
can-install-libreoffice PASS

[1] https://code.launchpad.net/~vpa1977/ubuntu/+source/openjdk-8/+git/openjdk-8/+merge/438158
[2] https://code.launchpad.net/~vpa1977/ubuntu/+source/openjdk-lts/+git/openjdk-lts/+merge/438159
[3] https://code.launchpad.net/~vpa1977/ubuntu/+source/openjdk-17/+git/openjdk-17/+merge/438151
[4] https://code.launchpad.net/~vpa1977/ubuntu/+source/openjdk-18/+git/openjdk-18/+merge/438160
[5] https://code.launchpad.net/~vpa1977/ubuntu/+source/openjdk-19/+git/openjdk-19/+merge/438187
[6] https://code.launchpad.net/~vpa1977/ubuntu/+source/openjdk-20/+git/openjdk-20/+merge/438161
[7] https://code.launchpad.net/~vpa1977/ubuntu/+source/openjdk-21/+git/openjdk-21/+merge/438162
[8] https://launchpad.net/~vpa1977/+archive/ubuntu/ca-certificates-java-dpkg

[Steve Langasek (vorlon)]

> This package breaks existing OpenJDK packages.

Well currently debian/control lists the Breaks but they are commented out! Provided we actually land the Breaks: correctly, we don't have to wait for all openjdk updates before landing this (though it will make each of those JREs uninstallable in -proposed and break builds of anything build-depending on them, so we should make sure *default*-jre is sorted before landing this.)

[Vladimir Petko (vpa1977)]

> Well currently debian/control lists the Breaks but they are commented out!
> Provided we actually land the Breaks: correctly, we don't have to wait for all
> openjdk updates before landing this (though it will make each of those JREs
> uninstallable in -proposed and break builds of anything build-depending on
> them, so we should make sure *default*-jre is sorted before landing this.)

I will wait for the ppa to finish building OpenJDK 18 and will uncomment the Breaks section.
We will have to land all the JDKs first so that they could build themselves from unbroken build.

[Steve Langasek (vorlon)]

review: Needs Fixing

[Vladimir Petko (vpa1977)]

Uncommented Breaks, uploaded new version of openjdk-19. Once it builds I will update autopkgtest results.

[Vladimir Petko (vpa1977)]

> Uncommented Breaks, uploaded new version of openjdk-19. Once it builds I will
> update autopkgtest results.

updated tests results

[Steve Langasek (vorlon)]

review: Needs Fixing

[Steve Langasek (vorlon)]

closing the version number gaps in the Breaks: is the last thing to change before sponsoring.

[Steve Langasek (vorlon)]

review: Approve

diff --git a/debian/ca-certificates-java.postinst b/debian/ca-certificates-java.postinst
index 94c6c03..f53c4ee 100644
--- a/debian/ca-certificates-java.postinst
+++ b/debian/ca-certificates-java.postinst
@@ -18,30 +18,6 @@ LOCALCERTSDIR=/usr/local/share/ca-certificates
 ETCCERTSDIR=/etc/ssl/certs
 CACERTS=$ETCCERTSDIR/java/cacerts
 
-setup_path()
-{
-	for version in 8 9 10 11 12 13 14 15 16 17 18 19 20 21 ; do
-		for jvm in \
-			java-${version}-openjdk-${arch} \
-			java-${version}-openjdk \
-			oracle-java${version}-jre-${arch} \
-			oracle-java${version}-server-jre-${arch} \
-			oracle-java${version}-jdk-${arch}
-		do
-			if [ -x /usr/lib/jvm/$jvm/bin/java ]; then
-				export JAVA_HOME=/usr/lib/jvm/$jvm
-				PATH=$JAVA_HOME/bin:$PATH
-				break 2
-			fi
-		done
-	done
-
-	if ! which java >/dev/null; then
-		echo "No JRE found. Skipping Java certificates setup."
-		exit 0
-	fi
-}
-
 check_proc()
 {
     if ! mountpoint -q /proc; then
@@ -90,7 +66,10 @@ update_cacerts()
 		exit 0
 	fi
 
-	setup_path
+	if ! which java >/dev/null; then
+		echo "No JRE found. Skipping Java certificates setup."
+		exit 0
+	fi
 
 	if [ -f /var/lib/ca-certificates-java/convert_pkcs12_keystore_to_jks ]; then
 		convert_pkcs12_keystore_to_jks
@@ -103,7 +82,17 @@ update_cacerts()
 
 		if [ -f "$CACERTS" ]; then
 			check_proc
-			cacerts_aliases=$(keytool -cacerts -storepass "$storepass" -list -rfc | sed -n 's/^Alias name: *debian://ip' | tr '\n' ' ')
+
+			# Java 8 does not have -cacerts option
+			if java -version 2>&1 | grep "1.8" > /dev/null ;
+			then
+				castore="-keystore ${CACERTS}"
+			else
+				castore="-cacerts"
+			fi
+
+			cacerts_aliases=$(keytool ${castore} -storepass "$storepass" -list -rfc | sed -n 's/^Alias name: *debian://ip' | tr '\n' ' ')
+
 			etc_ssl_certs_aliases=$(for pem in $pem_files ; do echo -n "$(basename "$pem" | tr A-Z a-z) "; done)
 			for alias in $cacerts_aliases ; do
 				case " $etc_ssl_certs_aliases " in
@@ -177,5 +166,9 @@ if [ "$1" = "triggered" ]; then
 			;;
 	esac
 
+	if [ ! -f $CACERTS ]; then
+		touch /var/lib/ca-certificates-java/fresh
+	fi
+
 	update_cacerts
 fi
diff --git a/debian/ca-certificates-java.triggers b/debian/ca-certificates-java.triggers
index bde4336..e97bbf5 100644
--- a/debian/ca-certificates-java.triggers
+++ b/debian/ca-certificates-java.triggers
@@ -1,3 +1,2 @@
-interest update-ca-certificates-java
-interest update-ca-certificates-java-fresh
-interest /usr/lib/jvm
+interest-await update-ca-certificates-java
+interest-await update-ca-certificates-java-fresh
diff --git a/debian/changelog b/debian/changelog
index c316775..b92bc31 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,21 @@
+ca-certificates-java (20230103ubuntu1) lunar; urgency=medium
+
+  * Resolve circular JRE dependency (LP: #2003750, LP: #1999103, LP: #2004061)
+    - debian/ca-certificates-java.postinst: remove setup_path from "configure"
+      stage.
+    - debian/ca-certificates-java.postinst: do "fresh" update if cacerts file is
+      not found. Certificates are refreshed only in response to the trigger
+      activated by OpenJDK packages.
+    - debian/ca-certificates-java.postinst: fix cacert enumeration command for
+      Java 8.
+    - debian/control: remove JRE dependency.
+    - debian/control: add Breaks condition.
+    - debian/tests: add smoke tests.
+    - debian/ca-certificates-java.triggers: remove file trigger /usr/jvm,
+      explicitly declare triggers as -await.
+
+ -- Vladimir Petko <[e-mail]>  Wed, 01 Mar 2023 13:31:58 +1300
+
 ca-certificates-java (20230103) unstable; urgency=medium
 
   * Promote again the JRE recommendation to a dependency. Otherwise
diff --git a/debian/control b/debian/control
index 87cfc5f..5545acd 100644
--- a/debian/control
+++ b/debian/control
@@ -1,7 +1,8 @@
 Source: ca-certificates-java
 Section: java
 Priority: optional
-Maintainer: Debian Java Maintainers <[e-mail]>
+Maintainer: Ubuntu Developers <[e-mail]>
+XSBC-Original-Maintainer: Debian Java Maintainers <[e-mail]>
 Uploaders: Matthias Klose <[e-mail]>,
            James Page <[e-mail]>
 Build-Depends:
@@ -20,7 +21,13 @@ Multi-Arch: foreign
 Depends:
  ca-certificates (>= 20210120),
  ${misc:Depends},
- default-jre-headless (>= 2:1.8) | java8-runtime-headless,
+Breaks: openjdk-8-jre-headless  (<<8u362-ga-0ubuntu2~),
+        openjdk-11-jre-headless (<<11.0.18+10-0ubuntu3~),
+        openjdk-17-jre-headless (<<17.0.6+10-1ubuntu1~),
+        openjdk-18-jre-headless (<<18.0.2+9-2ubuntu1~),
+        openjdk-19-jre-headless (<<19.0.2+7-0ubuntu4~),
+        openjdk-20-jre-headless (<<20~26ea-1ubuntu1~),
+        openjdk-21-jre-headless (<<21~7ea-1ubuntu1~)
 Description: Common CA certificates (JKS keystore)
  This package uses the hooks of the ca-certificates package to update the
  cacerts JKS keystore used for many java runtimes.
diff --git a/debian/tests/can-convert-keystore b/debian/tests/can-convert-keystore
 new file mode 100644
index 0000000..041189b
--- /dev/null
+++ b/debian/tests/can-convert-keystore
@@ -0,0 +1,24 @@
+#!/bin/bash
+set -e
+# GIVEN a PKCS12 Java keystore
+ETCCERTSDIR=/etc/ssl/certs
+CACERTS=$ETCCERTSDIR/java/cacerts
+rm $CACERTS
+keytool -importcert -noprompt -alias Amazon -file /etc/ssl/certs/Amazon_Root_CA_1.pem -trustcacerts -storepass changeit -storetype PKCS12 -keystore test.store 2> /dev/null
+apt-get remove -y ca-certificates-java
+
+mkdir -p /etc/ssl/certs/java/
+mkdir -p /var/lib/ca-certificates-java/
+mv test.store $CACERTS
+# WHEN ca-certificates-java is requested to convert the keystore
+touch /var/lib/ca-certificates-java/convert_pkcs12_keystore_to_jks
+
+# THEN conversion is successful
+output=`mktemp`
+apt-get install -y openjdk-8-jre-headless | tee ${output}
+
+if [[ $(grep -L "Entry for alias amazon successfully imported." ${output}) ]];
+then
+    echo "Certificates were not imported !!!"
+    exit 255
+fi
diff --git a/debian/tests/can-install-jre b/debian/tests/can-install-jre
 new file mode 100644
index 0000000..fd27d6e
--- /dev/null
+++ b/debian/tests/can-install-jre
@@ -0,0 +1,26 @@
+#!/bin/bash
+set -e
+versions=$(apt-cache search jre-headless | awk '{print $1}')
+for version in ${versions}
+do
+# WHEN openjdk-jre-headless package is installed from scratch
+
+    # Java 18 is EOL 09.2022 but is present in Lunar so that we could do clean
+    # builds. Ignore it in certificate tests
+    if [[ ${version} == "openjdk-18-jre-headless" ]];
+    then
+        continue
+    fi
+    output=`mktemp`
+    echo "installing ${version}"
+    apt-get install -y ${version} | tee ${output}
+# THEN installation is successfull
+# AND certificates are updated
+    if [[ $(grep -L "Adding debian:Amazon_Root_CA_1.pem" ${output}) ]]; then
+        echo "Certificates were not imported !!!"
+        exit 255
+    fi
+    rm $output
+    # purge in order to remove keytstore
+    apt-get purge -y ca-certificates-java ${version}
+done
 \ No newline at end of file
diff --git a/debian/tests/can-install-libreoffice b/debian/tests/can-install-libreoffice
 new file mode 100755
index 0000000..b1d9937
--- /dev/null
+++ b/debian/tests/can-install-libreoffice
@@ -0,0 +1,4 @@
+#!/bin/bash
+set -e
+
+apt-get install -y libreoffice
 \ No newline at end of file
diff --git a/debian/tests/can-install-multiple-jdks b/debian/tests/can-install-multiple-jdks
 new file mode 100755
index 0000000..614a9f6
--- /dev/null
+++ b/debian/tests/can-install-multiple-jdks
@@ -0,0 +1,13 @@
+#!/bin/bash
+set -e
+
+output=`mktemp`
+# WHEN multiple JDKs are installed
+apt-get install -y openjdk-11-jdk openjdk-17-jdk openjdk-8-jdk | tee ${output}
+
+# THEN installation is successful
+if [[ $(grep -L "Adding debian:Amazon_Root_CA_1.pem" ${output}) ]]; then
+    echo "Certificates were not imported !!!"
+    exit 255
+fi
+rm $output
diff --git a/debian/tests/control b/debian/tests/control
 new file mode 100644
index 0000000..17f2dac
--- /dev/null
+++ b/debian/tests/control
@@ -0,0 +1,9 @@
+Tests: can-convert-keystore
+Depends: default-jre-headless
+Restrictions: needs-root
+
+Tests: can-install-jre, can-install-multiple-jdks, can-install-libreoffice
+# No depends, this is a test for a clean install
+Depends:
+Restrictions: needs-root
+