Package "ca-certificates-java"

ca-certificates-java (20190909ubuntu1.4) jammy-security; urgency=medium

  * debian/postinst: add heal_cacerts() to reconcile the
    /etc/ssl/certs/java/cacerts keystore with the current contents of
    /etc/ssl/certs once on upgrade. The ca-certificates postinst has
    been applying certificate changes without running the
    /etc/ca-certificates/update.d hooks, so this keystore stopped
    receiving updates in 2022 and still trusts CAs that were removed
    from the system trust store since then, including the eMudhra root
    (LP: #2061817, Debian #1069251). The reconciliation drops stale
    package-managed debian:-prefixed aliases and re-imports the current
    set. Non-debian: aliases are untouched; local CAs managed through
    /usr/local/share/ca-certificates are retained.
  * d/control: depend on ca-certificates (>= 20260816ubuntu0.22.04.2) so the
    one-time reconciliation cannot be installed without the fixed
    ca-certificates postinst; otherwise future updates would be lost again.

 -- Vyom Yadav Thu, 22 Oct 2026 18:52:38 +0530

  ca-certificates-java (20190909ubuntu1.2) jammy-security; urgency=medium

  * REGRESSION UPDATE: ca-certificates-java can fail to install with
    openjdk-17 (LP: #2019908).
    - d/postinst, d/jks-keystore.hook: copy java.security for import tool
  * d/t/*: add autopkgtests.

 -- Vladimir Petko <email address hidden> Thu, 18 May 2023 08:09:10 +1200