Package "ca-certificates-java"

ca-certificates-java (20260311ubuntu0.26.04.1) resolute-security; urgency=medium

  * debian/ca-certificates-java.postinst: reconcile package-managed aliases
    in /etc/ssl/certs/java/cacerts on upgrade from 20260311. The
    ca-certificates postinst shipped in resolute applied certificate
    changes without running the /etc/ca-certificates/update.d hooks, so
    the deferred update fed this package an empty change list and the
    keystore stopped receiving updates; it still trusts CAs that were
    removed from the system trust store since then, including the eMudhra
    root (LP: #2061817, Debian #1069251). Stale debian:-prefixed aliases
    are removed and current system/local CAs are re-imported. Non-debian:
    aliases are untouched.
  * Depend on the fixed ca-certificates version so future updates reach the
    trigger-safe Java hook.

 -- Vyom Yadav Mon, 02 Nov 2026 13:36:02 -0600