installation of ca-certificates-java fails

[cbuchner1]

my setup.sh script contains the installation of the OpenJDK Java JRE in combination with the ca-certificates.

sudo apt-get install -y default-jre default-jre-headless openjdk-21-jre
openjdk-21-jre-headless ca-certificates-java

However I get this error as part of the post installation script, which unfortunately makes the environment setup fail.

org.debian.security.UnableToSaveKeystoreException: There was a problem saving the new Java keystore.
at org.debian.security.KeyStoreHandler.save(KeyStoreHandler.java:86)
at org.debian.security.UpdateCertificates.finish(UpdateCertificates.java:108)
at org.debian.security.UpdateCertificates.main(UpdateCertificates.java:54)
Caused by: java.io.FileNotFoundException: /etc/ssl/certs/java/cacerts (No such file or directory)
at java.base/java.io.FileOutputStream.open0(Native Method)
at java.base/java.io.FileOutputStream.open(FileOutputStream.java:289)
at java.base/java.io.FileOutputStream.<init>(FileOutputStream.java:230)
at java.base/java.io.FileOutputStream.<init>(FileOutputStream.java:118)
at org.debian.security.KeyStoreHandler.save(KeyStoreHandler.java:82)
... 2 more
dpkg: error processing package ca-certificates-java (--configure):
installed ca-certificates-java package post-installation script subprocess returned error exit status 1

This ca-certificates-java is part of the dependencies for the CUDA toolkit 12.6 by nVidia, which is a required dependency for my current project.

Any way to make this installation succeed, or at least ignore the error and continue?

[cbuchner1]

I found a workaround by inserting this command at the beginning of the script. But the downside is that it will also ignore any other errors silently

# avoid individual commands failing from stopping the script (opposite of -euo pipefail)
set +euo pipefail

[mrveress]

For me - this setup script was a solution:

set -euo pipefail
export DEBIAN_FRONTEND=noninteractive
export PATH=/usr/sbin:/usr/bin:/sbin:/bin

# Here we are making sure the target dir exists and nothing is in the way
mkdir -p /etc/ssl/certs/java
rm -f /etc/ssl/certs/java/cacerts  # remove empty file or dangling symlink if present

# Install JRE (exactly JRE) + cert packages but without triggers
apt-get update -qq
apt-get -yqq --no-install-recommends -o Dpkg::Options::=--no-triggers install openjdk-21-jre-headless ca-certificates ca-certificates-java

# Now trigger only Java cert to generate /etc/ssl/certs/java/cacerts
dpkg --triggers-only ca-certificates-java || true
# And just in fact - repeat the same, but from other side 😄 
update-ca-certificates -f

# This item feels like optional, but still - ensure $JAVA_HOME sees that keystore path via symlink
# As I understand on Ubuntu OpenJDK this symlink may not exists until packages wiring it up.
if command -v java >/dev/null 2>&1; then
  SYS_JAVA_HOME="$(dirname "$(dirname "$(readlink -f "$(command -v java)")")")"
  if [ -d "$SYS_JAVA_HOME/lib/security" ] && [ ! -e "$SYS_JAVA_HOME/lib/security/cacerts" ]; then
    ln -s /etc/ssl/certs/java/cacerts "$SYS_JAVA_HOME/lib/security/cacerts" || true
  fi
fi

# Verify the keystore is real now (should list many entries)
keytool -list -keystore /etc/ssl/certs/java/cacerts -storepass changeit | head -n 5