Univention Bugzilla – Full Text Bug Listing |
Summary: | UCS 4.3 upgrade: univention-java is removed | ||
---|---|---|---|
Product: | UCS | Reporter: | Stefan Gohmann <gohmann> |
Component: | General | Assignee: | Stefan Gohmann <gohmann> |
Status: | CLOSED FIXED | QA Contact: | Jürn Brodersen <brodersen> |
Severity: | normal | ||
Priority: | P5 | CC: | hahn |
Version: | UCS 4.3 | Keywords: | interim-2 |
Target Milestone: | UCS 4.3 | ||
Hardware: | Other | ||
OS: | Linux | ||
What kind of report is it?: | Development Internal | What type of bug is this?: | --- |
Who will be affected by this bug?: | --- | How will those affected feel about the bug?: | --- |
User Pain: | Enterprise Customer affected?: | ||
School Customer affected?: | ISV affected?: | ||
Waiting Support: | Flags outvoted (downgraded) after PO Review: | ||
Ticket number: | Bug group (optional): | ||
Max CVSS v3 score: |
Description
Stefan Gohmann
2017-12-28 06:21:06 CET
The dependency of univention-java has been changed to openjdk-8-jre and icedtea-plugin: Fix: https://git.knut.univention.de/univention/ucs/commit/8fb4e2491e333ee40813a9a1ec3544463f3f1fc7 Changelog: https://git.knut.univention.de/univention/ucs/commit/47e7f693a4462ffbef8bb9a260120b8379e20cc8 Looks good. What I tested: Upgraded with univention-java -> openjdk-8-jre and icedtea-plugin are being installed -> OK Java seems to be working -> OK Changelog -> OK -> Verified It did not work for me in one case as there is multiple upgrade issue, one described in Bug #46320 comment 3: TL;DR: <https://lists.debian.org/debian-glibc/2014/08/msg00007.html> - Java has its own TZ datase, which is part of src:openjdk-X - it received quaterly updates - Debian maintains only src:tzdata - the data is compiled into the format required by OpenJDK - the compiler is only available with bin:OpenDJK <= 7 - OpenJDK-8 uses a new format - the compiler is no longer available in bin:openjdk-8 - Debian dropped the compilation from src:tzdata Another one is for the CA certificates: - Java has its own certificate store (based on libnss) - Debian integrates into its ca-certificate infrastructure - ca-certificates-java provides the hook /etc/ca-certificates/update.d/jks-keystore - for running it it requires a working JRE - but the JRE depends on ca-certificates-java, too - ergo there is a dependency loop - the loop propagates into the dpkg trigger mechanism: <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=864597> - Debian choose to not fix it correctly just before the Debian-Stretch release. - Instead ca-certificate-java was hacked: <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=864597> With UCS-4.3 we now have this situation: - openjdk-8-jre-headless Breaks: tzdata-java - openjdk-7-jre-headless Depends: tzdata-java - ca-certificates-java Depends openjdk-7-jre As openjdk-7-jre is installed and still available in UCS-4.3 (as it aggregates all previous Debian-Releases Wheezy, Jessie, Stretch), APT sees no reason to automatically remote it. The upgrade is blocked! The APT resolver seems to work on a score based on package relevance, so it is good to *not* reference specific packages: APT the assigns a lower score to them, making them easier to remove when blocking other required packages. Because of that "default-jre" should be used. 6f10524385 Bug #45959 java: Switch to default-jre db85258214 Bug #45959 java: Copyright 2018 67c9917794 Bug #45959 java: Switch to Architecture: all Package: univention-java Version: 10.0.0-3A~4.3.0.201802211147 Version: 10.0.0-4A~4.3.0.201802211150 Branch: ucs_4.3-0 I restored the old version of "ca-certificates-java" using OpenJDK-8 from <http://snapshot.debian.org/archive/debian/20170615T155207Z/pool/main/c/ca-certificates-java/> and added it to mirror/update_ucs43_mirror_from_debian.yml 28a36382 Bug #45959 mirror: Use old ca-certificates-java Ok Upgrade works for me -> Verified UCS 4.3 has been released: https://docs.software-univention.de/release-notes-4.3-0-en.html https://docs.software-univention.de/release-notes-4.3-0-de.html If this error occurs again, please use "Clone This Bug". |