[Bug 2141785] Re: openjdk-25-jre-headless in jammy depends on openjdk-11

[Vladimir Petko]

ca-certificates-java no longer depend on JRE in noble and up, only jammy
needs to be updated.

** Also affects: ca-certificates-java (Ubuntu Questing)
   Importance: Undecided
       Status: New

** Also affects: openjdk-25 (Ubuntu Questing)
   Importance: Undecided
       Status: New

** Also affects: ca-certificates-java (Ubuntu Resolute)
   Importance: Undecided
       Status: Confirmed

** Also affects: openjdk-25 (Ubuntu Resolute)
   Importance: Undecided
       Status: Invalid

** Also affects: ca-certificates-java (Ubuntu Noble)
   Importance: Undecided
       Status: New

** Also affects: openjdk-25 (Ubuntu Noble)
   Importance: Undecided
       Status: New

** Also affects: ca-certificates-java (Ubuntu Jammy)
   Importance: Undecided
       Status: New

** Also affects: openjdk-25 (Ubuntu Jammy)
   Importance: Undecided
       Status: New

** Changed in: openjdk-25 (Ubuntu Questing)
       Status: New => Invalid

** No longer affects: openjdk-25 (Ubuntu Noble)

** No longer affects: openjdk-25 (Ubuntu Jammy)

** No longer affects: openjdk-25 (Ubuntu Questing)

** No longer affects: openjdk-25 (Ubuntu Resolute)

** Changed in: ca-certificates-java (Ubuntu Resolute)
       Status: Confirmed => Invalid

** Changed in: ca-certificates-java (Ubuntu Questing)
       Status: New => Invalid

** Changed in: ca-certificates-java (Ubuntu Noble)
       Status: New => Invalid

** Changed in: ca-certificates-java (Ubuntu Jammy)
       Status: New => Confirmed

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to openjdk-25 in Ubuntu.
https://bugs.launchpad.net/bugs/2141785

Title:
  openjdk-25-jre-headless in jammy depends on openjdk-11

Status in ca-certificates-java package in Ubuntu:
  Invalid
Status in openjdk-25 package in Ubuntu:
  Invalid
Status in ca-certificates-java source package in Jammy:
  Confirmed
Status in ca-certificates-java source package in Noble:
  Invalid
Status in ca-certificates-java source package in Questing:
  Invalid
Status in ca-certificates-java source package in Resolute:
  Invalid

Bug description:
  In an otherwise clean machine (e.g. docker run ubuntu:jammy), `apt
  install openjdk-25-jre-headless` will also install openjdk-11-jre-
  headless. This is undesirable because openjdk-11 is end-of-life.

  The openjdk-17-jre-headless and openjdk-21-jre-headless packages do
  not exhibit this problem.

  The issue seems to be the dependency chain in which openjdk-25-jre-
  headless has Depends: ca-certificates-java, ca-certificates-java has
  Depends: default-jre-headless | java8-runtime-headless, and default-
  jre-headless has Depends: openjdk-11-jre-headless

  openjdk-17 and openjdk-21 both have provides: java8-runtime-headless, and satisfy ca-certificates-java in that way. 
  Provides: java-runtime-headless (= 21), [... many javaN-runtime-headless ...], java8-runtime-headless

  So they can satisfy the `| java8-runtime-headless` branch of ca-
  certificates-java, and apt ends up installing only the requested
  openjdk version..

  
  But openjdk-25-jre-headless has only `Provides: java-runtime-headless (= 25)` and none of the other individual entries.

  These changes seem to be intentional on the debian side, see
  https://salsa.debian.org/openjdk-
  team/openjdk/-/commit/2fa0698ece274ae9e1539b5fa2289a59d332c6b3. And
  ca-certificates likewise dropped the depends entry in
  https://salsa.debian.org/java-team/ca-certificates-
  java/-/commit/ff1821043d4cd3fc8e4d5a49bed9304135a479e6

  But the security backport of openjdk-25-jre-headless is not consistent
  with the version of ca-certificates-java in jammy - either it needs
  the Provides: java8-runtime-headless put back, or ca-certificates-java
  needs the corresponding update to adjust its Depends.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ca-certificates-java/+bug/2141785/+subscriptions