jpackage with temurin 24 and ubuntu 22.04 broken ?

[kurt-2]

Some time (years) ago I used jpackage to create a .deb to install a little program of my own.

At that time I used openjdk 11 or 17 for that. In the meanwhile I installed temurin 24
according to the information on the homepage and it got updated by apt to 24.0.2.

I did not use jpackage since then anymore.

Now I get an error using jpackage from temurin 24:

Fehler: /usr/lib/jvm/temurin-24-jdk-amd64/lib/ct.sym wurde geändert

what means 'Error: ... has been changed'.

The sha256sum of the above file is:

cba4341869a8ed0c69196d68e38b5e648c880ec4c7de4fbfc326e87729f0420c

The temurin-installation gets updated by the normal update-process from Ubuntu (jammy, 22.04.5).

The used/installed temurin is:

openjdk version "24.0.2" 2025-07-15
OpenJDK Runtime Environment Temurin-24.0.2+12 (build 24.0.2+12)
OpenJDK 64-Bit Server VM Temurin-24.0.2+12 (build 24.0.2+12, mixed mode, sharing)

Using openjdk 21 the .deb gets created without errors.

I attached the script (jpkg) I use to create the .deb.

So hopefully someone has an idea if this is a bug or maybe just a new parameter missing.

Thanks in advance.

jpkg.txt

[karianna]

I'm not a jpackage expert, but from ChatGPT 4o researcher model:

Thanks for sharing your script and detailed setup. The error you’re encountering:

Fehler: /usr/lib/jvm/temurin-24-jdk-amd64/lib/ct.sym wurde geändert

Translated to English means:

Error: /usr/lib/jvm/temurin-24-jdk-amd64/lib/ct.sym has been modified

This issue relates to JEP 493 (Preview Feature in JDK 24), which introduces classfile API changes and includes major internal tooling shifts, including changes in how jpackage and related tooling interact with symbol files like ct.sym.

Why OpenJDK 21 Works but Temurin 24 Fails

•	OpenJDK 21 still uses the legacy ct.sym and class path mechanisms compatible with earlier jpackage behavior.
•	Temurin 24 has JEP 493 enabled, and its tooling is more strict and may include verification of ct.sym checksums or structure.
•	If ct.sym has been altered (by packaging tools, symlinks, incomplete updates, or manual edits), jpackage will reject it for consistency and security.

Possible Causes
1. Corrupt or inconsistent ct.sym file. It may have been altered during an update or copied from another JDK.
2. Temurin packaging or update issues. Some users have encountered this exact issue after an APT update. See related issues:
• https://github.com/adoptium/adoptium-support/issues
• https://bugs.openjdk.org/browse/JDK-8314397 (about jpackage and ct.sym)
3. jpackage in JDK 24 is stricter or changed implementation

Suggested Fixes or Workarounds

Option 1: Reinstall or Validate ct.sym

Reinstall Temurin 24 cleanly:

sudo apt remove temurin-24-jdk
sudo apt install temurin-24-jdk

Then check:

sha256sum /usr/lib/jvm/temurin-24-jdk-amd64/lib/ct.sym

Compare the result with a known good copy, or from another system.

Option 2: Use JDK 21 for Packaging

Since JDK 21 works fine and jpackage bundles a custom runtime anyway, it’s safe to use it for creating the .deb:

./jpkg --java 21

This avoids needing to troubleshoot JDK 24 internals for now.

Option 3: Use --runtime-image Instead (Optional)

Create a runtime with jlink, then pass it via:

jpackage --runtime-image /path/to/custom/runtime ...

This may bypass some of the internal JDK 24 checks.

⸻

💡 Recommendations
• Stick with JDK 21 for packaging, unless JDK 24 brings specific advantages you need.
• Report to Adoptium if you suspect this is a packaging bug (it might be):
https://github.com/adoptium/adoptium-support/issues
• For production builds, pin to a known working JDK version and checksum your ct.sym.

Let me know if you want help automating fallback logic in your script or generating a patched version of ct.sym.

[jerboaa]

@kurt-2 Does this reproduce when you don't use the .deb installer? What happens if you download the JDK 24 tarball, extract it somewhere and try to use the same jpackage command then? For context. JDK 24 enables JEP 493. See: https://adoptium.net/news/2025/03/eclipse-temurin-jdk24-JEP493-enabled

[kurt-2]

just downloaded and tried with jdk-24.0.2+12 (https://adoptium.net/de/download?link=https%3A%2F%2Fgithub.com%2Fadoptium%2Ftemurin24-binaries%2Freleases%2Fdownload%2Fjdk-24.0.2%252B12%2FOpenJDK24U-jdk_x64_linux_hotspot_24.0.2_12.tar.gz&vendor=Adoptium).

this is also the installed .deb version.

it worked as hoped and expected.

so it is a .deb-packaging problem ?

[jerboaa]

so it is a .deb-packaging problem ?

Yes, it appears so. Some distribution build scripts do special repacking of *.jar files (for - to me - unknown reasons). Maybe those run automatically when doing a debian package build. I'm not sure. Note that ct.sym is a zip/jar file. Maybe that is interfering. A work-around would be to pass --ignore-modified-runtime but that's not great as it turns off basically any file modification checking.

[kurt-2]

I update via apt from https://packages.adoptium.net/artifactory/deb.
So you're sure it gets repacked ?

[jerboaa]

I'm not very deep into Debian packaging and what the debian build scripts do when those *.deb files get produced from the tarball. We've established that the tarball, works, but the installer package don't. So it's an installer issue. Feel free to create an issue in https://github.com/adoptium/installer/issues