openjdk team mailing list archive

Thread
Date
[Bug 2003750] Re: Unable to install libreoffice due to openjdk-jre-headless/ca-certificates-java installation failure [original: Fails to configure in autopkgtest]

To: openjdk@xxxxxxxxxxxxxxxxxxx
From: Vladimir Petko <2003750@xxxxxxxxxxxxxxxxxx>
Date: Wed, 24 May 2023 23:46:19 -0000
Reply-to: Bug 2003750 <2003750@xxxxxxxxxxxxxxxxxx>
Sender: noreply@xxxxxxxxxxxxx
Xenial installation race condtion

** Description changed:

  [Impact]
  
  ca-certificates-java implementation historically relied on openjdk-jre-
  headless package being able to work without being configured (e.g.
  20190909ubuntu1.1), which may result in installation failure see LP:
  #2019908.
  
  ca-certificates-java 20230103 added hard dependency on openjdk package
  which caused a looping trigger.
  
  LP: #2019908 provided a fix for immediate problem - missing
  java.security file, but did not address the underlying issue - attempt
  to use the unconfigured package.
  
  The fix deployed to resolve this bug (LP: #2003750) removed dependency
  on openjdk package and ensured that certificate synchronisation by ca-
  certificates-java is performed only after openjdk jre is configured.
  This change will not need any future fixes in case of openjdk changes.
  
  In order to avoid issues such as LP: #2019908 in the future openjdk
  security releases, the fix for LP: #2003750 should be deployed to the
- supported releases (kinetic, jammy, focal, bionic).
+ supported releases (kinetic, jammy, focal, bionic, xenial).
  
+ Xenial contains only openjdk-8 which is not currently affected by LP:
+ #2019908, but has installation race condition (see attachment).
  
  [Test Plan]
  
  [Where problems could occur]
  
- This version of ca-certificates-java relies on openjdk package explicitly calling this trigger in ca-certificates-java. All supported openjdk packages (8,11,17,20,21) are updated to have this behaviour. 
+ This version of ca-certificates-java relies on openjdk package explicitly calling this trigger in ca-certificates-java. All supported openjdk packages (8,11,17,20,21) are updated to have this behaviour.
  Unsupported packages (any other openjdk version) that are still present in the archive:
-  - openjdk-18 (jammy, kinetic), 
-  - openjdk-16 (focal)
-  - openjdk-13 (focal)
- 
+  - openjdk-18 (jammy, kinetic),
+  - openjdk-16 (focal)
+  - openjdk-13 (focal)
  
  [Original Report]
  ca-certificates-java 20230103 fails to install in LibreOffice autopkgtests environment
  
  ...
  Setting up libebook1.2-dev:arm64 (3.46.3-1) ...
  dpkg: cycle found while processing triggers:
   chain of packages whose triggers are or may be responsible:
    ca-certificates-java -> ca-certificates-java
   packages' pending triggers which are or may be unresolvable:
    ca-certificates-java: /usr/lib/jvm
  dpkg: error processing package ca-certificates-java (--configure):
   triggers looping, abandoned
  Setting up junit4 (4.13.2-3) ...
  Setting up openjdk-17-jre:arm64 (17.0.6+10-0ubuntu1) ...
  Setting up maven-repo-helper (1.11) ...
  Setting up default-jre (2:1.17-74) ...
  Setting up openjdk-17-jdk-headless:arm64 (17.0.6+10-0ubuntu1) ...
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jar to provide /usr/bin/jar (jar) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jarsigner to provide /usr/bin/jarsigner (jarsigner) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/javac to provide /usr/bin/javac (javac) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/javadoc to provide /usr/bin/javadoc (javadoc) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/javap to provide /usr/bin/javap (javap) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jcmd to provide /usr/bin/jcmd (jcmd) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jdb to provide /usr/bin/jdb (jdb) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jdeprscan to provide /usr/bin/jdeprscan (jdeprscan) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jdeps to provide /usr/bin/jdeps (jdeps) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jfr to provide /usr/bin/jfr (jfr) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jimage to provide /usr/bin/jimage (jimage) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jinfo to provide /usr/bin/jinfo (jinfo) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jlink to provide /usr/bin/jlink (jlink) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jmap to provide /usr/bin/jmap (jmap) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jmod to provide /usr/bin/jmod (jmod) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jps to provide /usr/bin/jps (jps) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jrunscript to provide /usr/bin/jrunscript (jrunscript) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jshell to provide /usr/bin/jshell (jshell) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jstack to provide /usr/bin/jstack (jstack) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jstat to provide /usr/bin/jstat (jstat) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jstatd to provide /usr/bin/jstatd (jstatd) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/serialver to provide /usr/bin/serialver (serialver) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jhsdb to provide /usr/bin/jhsdb (jhsdb) in auto mode
  ...
  
  See attachment for full log of test case.

** Attachment added: "install.txt"
   https://bugs.launchpad.net/ubuntu/+source/ca-certificates-java/+bug/2003750/+attachment/5675499/+files/install.txt

** Description changed:

  [Impact]
  
  ca-certificates-java implementation historically relied on openjdk-jre-
  headless package being able to work without being configured (e.g.
  20190909ubuntu1.1), which may result in installation failure see LP:
  #2019908.
  
  ca-certificates-java 20230103 added hard dependency on openjdk package
  which caused a looping trigger.
  
  LP: #2019908 provided a fix for immediate problem - missing
  java.security file, but did not address the underlying issue - attempt
  to use the unconfigured package.
  
  The fix deployed to resolve this bug (LP: #2003750) removed dependency
  on openjdk package and ensured that certificate synchronisation by ca-
  certificates-java is performed only after openjdk jre is configured.
  This change will not need any future fixes in case of openjdk changes.
  
  In order to avoid issues such as LP: #2019908 in the future openjdk
  security releases, the fix for LP: #2003750 should be deployed to the
  supported releases (kinetic, jammy, focal, bionic, xenial).
  
  Xenial contains only openjdk-8 which is not currently affected by LP:
  #2019908, but has installation race condition (see attachment).
  
  [Test Plan]
  
+ autopkgtests should pass.
+ 
+ - Test package install in lxc container and ensure that race condition
+ is reproduced for each release - ca-certificates java are configured
+ before openjdk
+ 
+ ----------------------cut------------------------------------
+ for release in xenial bionic focal jammy kinetic; do
+     echo !!!!!!!!!!!!!!${release}!!!!!!!!!!!!!!!!!!!!
+     lxc launch images:ubuntu/${release} lp2019908
+     lxc exec lp2019908 -- apt install software-properties-common
+     lxc exec lp2019908 -- add-apt-repository ppa:vpa1977/ca-certificates-java-patch
+     lxc exec lp2019908 -- apt-get update
+     lxc exec lp2019908 -- apt-get -y install openjdk-17-jre-headless
+     lxc stop lp2019908
+     lxc delete lp2019908
+     echo !!!!!!TEST DONE for ${release}!!!!!!!!!
+ done
+ ----------------------cut------------------------------------
+ 
  [Where problems could occur]
  
- This version of ca-certificates-java relies on openjdk package explicitly calling this trigger in ca-certificates-java. All supported openjdk packages (8,11,17,20,21) are updated to have this behaviour.
+ This version of ca-certificates-java relies on openjdk package
+ explicitly calling this trigger in ca-certificates-java. All supported
+ openjdk packages (8,11,17,20,21) are updated to have this behaviour.
+ Unsupported 19 was also updated.
+ 
  Unsupported packages (any other openjdk version) that are still present in the archive:
   - openjdk-18 (jammy, kinetic),
   - openjdk-16 (focal)
   - openjdk-13 (focal)
+  - openjdk-9 (xenial)
+ 
+ We can update those packages in order to avoid issues.
  
  [Original Report]
  ca-certificates-java 20230103 fails to install in LibreOffice autopkgtests environment
  
  ...
  Setting up libebook1.2-dev:arm64 (3.46.3-1) ...
  dpkg: cycle found while processing triggers:
   chain of packages whose triggers are or may be responsible:
    ca-certificates-java -> ca-certificates-java
   packages' pending triggers which are or may be unresolvable:
    ca-certificates-java: /usr/lib/jvm
  dpkg: error processing package ca-certificates-java (--configure):
   triggers looping, abandoned
  Setting up junit4 (4.13.2-3) ...
  Setting up openjdk-17-jre:arm64 (17.0.6+10-0ubuntu1) ...
  Setting up maven-repo-helper (1.11) ...
  Setting up default-jre (2:1.17-74) ...
  Setting up openjdk-17-jdk-headless:arm64 (17.0.6+10-0ubuntu1) ...
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jar to provide /usr/bin/jar (jar) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jarsigner to provide /usr/bin/jarsigner (jarsigner) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/javac to provide /usr/bin/javac (javac) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/javadoc to provide /usr/bin/javadoc (javadoc) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/javap to provide /usr/bin/javap (javap) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jcmd to provide /usr/bin/jcmd (jcmd) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jdb to provide /usr/bin/jdb (jdb) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jdeprscan to provide /usr/bin/jdeprscan (jdeprscan) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jdeps to provide /usr/bin/jdeps (jdeps) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jfr to provide /usr/bin/jfr (jfr) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jimage to provide /usr/bin/jimage (jimage) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jinfo to provide /usr/bin/jinfo (jinfo) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jlink to provide /usr/bin/jlink (jlink) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jmap to provide /usr/bin/jmap (jmap) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jmod to provide /usr/bin/jmod (jmod) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jps to provide /usr/bin/jps (jps) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jrunscript to provide /usr/bin/jrunscript (jrunscript) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jshell to provide /usr/bin/jshell (jshell) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jstack to provide /usr/bin/jstack (jstack) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jstat to provide /usr/bin/jstat (jstat) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jstatd to provide /usr/bin/jstatd (jstatd) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/serialver to provide /usr/bin/serialver (serialver) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jhsdb to provide /usr/bin/jhsdb (jhsdb) in auto mode
  ...
  
  See attachment for full log of test case.

-- 
You received this bug notification because you are a member of OpenJDK,
which is subscribed to ca-certificates-java in Ubuntu.
https://bugs.launchpad.net/bugs/2003750

Title:
  Unable to install libreoffice due to openjdk-jre-headless/ca-
  certificates-java installation failure [original: Fails to configure
  in autopkgtest]

Status in ca-certificates-java package in Ubuntu:
  Fix Released

Bug description:
  [Impact]

  ca-certificates-java implementation historically relied on openjdk-
  jre-headless package being able to work without being configured (e.g.
  20190909ubuntu1.1), which may result in installation failure see LP:
  #2019908.

  ca-certificates-java 20230103 added hard dependency on openjdk package
  which caused a looping trigger.

  LP: #2019908 provided a fix for immediate problem - missing
  java.security file, but did not address the underlying issue - attempt
  to use the unconfigured package.

  The fix deployed to resolve this bug (LP: #2003750) removed dependency
  on openjdk package and ensured that certificate synchronisation by ca-
  certificates-java is performed only after openjdk jre is configured.
  This change will not need any future fixes in case of openjdk changes.

  In order to avoid issues such as LP: #2019908 in the future openjdk
  security releases, the fix for LP: #2003750 should be deployed to the
  supported releases (kinetic, jammy, focal, bionic, xenial).

  Xenial contains only openjdk-8 which is not currently affected by LP:
  #2019908, but has installation race condition (see attachment).

  [Test Plan]

  autopkgtests should pass.

  - Test package install in lxc container and ensure that race condition
  is reproduced for each release - ca-certificates java are configured
  before openjdk

  ----------------------cut------------------------------------
  for release in xenial bionic focal jammy kinetic; do
      echo !!!!!!!!!!!!!!${release}!!!!!!!!!!!!!!!!!!!!
      lxc launch images:ubuntu/${release} lp2019908
      lxc exec lp2019908 -- apt install software-properties-common
      lxc exec lp2019908 -- add-apt-repository ppa:vpa1977/ca-certificates-java-patch
      lxc exec lp2019908 -- apt-get update
      lxc exec lp2019908 -- apt-get -y install openjdk-17-jre-headless
      lxc stop lp2019908
      lxc delete lp2019908
      echo !!!!!!TEST DONE for ${release}!!!!!!!!!
  done
  ----------------------cut------------------------------------

  [Where problems could occur]

  This version of ca-certificates-java relies on openjdk package
  explicitly calling this trigger in ca-certificates-java. All supported
  openjdk packages (8,11,17,20,21) are updated to have this behaviour.
  Unsupported 19 was also updated.

  Unsupported packages (any other openjdk version) that are still present in the archive:
   - openjdk-18 (jammy, kinetic),
   - openjdk-16 (focal)
   - openjdk-13 (focal)
   - openjdk-9 (xenial)

  We can update those packages in order to avoid issues.

  [Original Report]
  ca-certificates-java 20230103 fails to install in LibreOffice autopkgtests environment

  ...
  Setting up libebook1.2-dev:arm64 (3.46.3-1) ...
  dpkg: cycle found while processing triggers:
   chain of packages whose triggers are or may be responsible:
    ca-certificates-java -> ca-certificates-java
   packages' pending triggers which are or may be unresolvable:
    ca-certificates-java: /usr/lib/jvm
  dpkg: error processing package ca-certificates-java (--configure):
   triggers looping, abandoned
  Setting up junit4 (4.13.2-3) ...
  Setting up openjdk-17-jre:arm64 (17.0.6+10-0ubuntu1) ...
  Setting up maven-repo-helper (1.11) ...
  Setting up default-jre (2:1.17-74) ...
  Setting up openjdk-17-jdk-headless:arm64 (17.0.6+10-0ubuntu1) ...
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jar to provide /usr/bin/jar (jar) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jarsigner to provide /usr/bin/jarsigner (jarsigner) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/javac to provide /usr/bin/javac (javac) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/javadoc to provide /usr/bin/javadoc (javadoc) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/javap to provide /usr/bin/javap (javap) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jcmd to provide /usr/bin/jcmd (jcmd) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jdb to provide /usr/bin/jdb (jdb) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jdeprscan to provide /usr/bin/jdeprscan (jdeprscan) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jdeps to provide /usr/bin/jdeps (jdeps) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jfr to provide /usr/bin/jfr (jfr) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jimage to provide /usr/bin/jimage (jimage) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jinfo to provide /usr/bin/jinfo (jinfo) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jlink to provide /usr/bin/jlink (jlink) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jmap to provide /usr/bin/jmap (jmap) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jmod to provide /usr/bin/jmod (jmod) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jps to provide /usr/bin/jps (jps) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jrunscript to provide /usr/bin/jrunscript (jrunscript) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jshell to provide /usr/bin/jshell (jshell) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jstack to provide /usr/bin/jstack (jstack) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jstat to provide /usr/bin/jstat (jstat) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jstatd to provide /usr/bin/jstatd (jstatd) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/serialver to provide /usr/bin/serialver (serialver) in auto mode
  update-alternatives: using /usr/lib/jvm/java-17-openjdk-arm64/bin/jhsdb to provide /usr/bin/jhsdb (jhsdb) in auto mode
  ...

  See attachment for full log of test case.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ca-certificates-java/+bug/2003750/+subscriptions
References

[Bug 2003750] [NEW] Fails to configure on autopkgtests arm64/armhf
From: Rico Tzschichholz, 2023-01-23