Rundeck becomes broken after openjdk upgrades

[rubinlinux]

Describe the bug
The debian default configuration includes a package called 'unattended-upgrades' which updates packages over night when security vulnerabilities are identified. If this (or a manual update) upgrades openjdk, rundeck becomes unable to spawn jobs, with all jobs failing with the message:
Execute failed: java.io.IOException: Cannot run program "/bin/sh" (in directory "/var/lib/rundeck"): error=0, Failed to exec spawn helper: pid: 2697938, exit value: 1

I have had this happen simultaneously across 3 debian 12 machines the same night on 2 separate occations, which helped track down the problem.

My Rundeck detail

• Rundeck version: 5.0.1
• install type: deb
• OS Name/version: Debian 12
• DB Type/version: mariadb

To Reproduce

• Install debian 12 from sources prior to april 22, 2024, and install rundeck from apt repository. DO NOT UPGRADE IT YET
• Observe rundeck works normally
• Use apt upgrade to update openjdk from 17.0.10+7-1~deb11u1 to 17.0.11+9-1~deb11u1
• observe that rundeck can no longer spawn jobs

Expected behavior
rundeck should be restarted when openjdk updates so that it takes advantage of the upgraded openjdk and also does not break

Screenshots

[gschueler]

Rundeck is a Java application, so updating Java while it is running may cause issues. I would suggest not doing that. I'm not sure there's anything we can do about this.

[rubinlinux]

I would suggest not doing that

This happens automatically in the default configuriation without the user taking any action. I only followed the default debian install instructions.

Is there a better place to file this bug, then? Who packages rundeck for the apt repository for debian?

I followed the default install instructions and rundeck breaks every once and a while, and this is the cause. Seems weird to just let it be unreliable for everyone.

[gschueler]

@rubinlinux I moved this to the packaging repo. fyi here is where the dependencies are set in the debian package, is there a way to force it to not apply unattended upgrades to a specific package? https://github.com/rundeck/packaging/blob/main/buildSrc/src/main/groovy/org/rundeck/gradle/PackagingTask.groovy#L165-L171