--- Please enter the report below this line. ---

Hi,
today, I have upgraded sid.
ca-certificates it has report:

Elaborazione dei trigger per ca-certificates (20150426)...
Updating certificates in /etc/ssl/certs...
13 added, 6 removed; done.
Running hooks in /etc/ca-certificates/update.d...

org.debian.security.InvalidKeystorePasswordException: Cannot open Java
keystore. Is the password correct?
    at org.debian.security.KeyStoreHandler.load(KeyStoreHandler.java:68)
    at
org.debian.security.KeyStoreHandler.<init>(KeyStoreHandler.java:52)
    at
org.debian.security.UpdateCertificates.<init>(UpdateCertificates.java:65)
    at
org.debian.security.UpdateCertificates.main(UpdateCertificates.java:51)
Caused by: gnu.javax.crypto.keyring.MalformedKeyringException: incorrect
magic
    at
gnu.javax.crypto.jce.keyring.GnuKeyring.loadPrivateKeyring(libgcj.so.15)
    at gnu.javax.crypto.jce.keyring.GnuKeyring.engineLoad(libgcj.so.15)
    at java.security.KeyStore.load(libgcj.so.15)
    at org.debian.security.KeyStoreHandler.load(KeyStoreHandler.java:66)
    ...3 more
E: /etc/ca-certificates/update.d/jks-keystore exited with code 1.


Debian Release: stretch/sid
   500 unstable        www.deb-multimedia.org
   500 unstable        cdimage.debian.org
   500 stable          dl.google.com
   500 stable          deb.opera.com
--- Package information. ---
Depends          (Version) | Installed
==========================-+-===========
openssl         (>= 1.0.0) | 1.0.1k-3
debconf          (>= 0.5)  | 1.5.56
  OR debconf-2.0            |


Package's Recommends field is empty.

Package's Suggests field is empty.

Control: reassign -1 ca-certificates-java

This looks like a configuration problem, or a bug in the java hook.
Reassigning accordingly.

Cheers,

Hi Paride,.

The output above is the expected behavior when changing the keystore
password without storing it in the "storepass" variable in
/etc/default/cacerts:

  <https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=823590#34>

If you have not modified the default password, 20150426 is quite old,
I had not installed it on any of my machines, so I can not check old
logs.  However, I have successfully upgraded from 20170929~deb9u1 to
20170929~deb9u3 (thus within stretch) and from 20170929~deb9u3 to
20190405 (stretch to buster), thus I would say that this bug could be
closed.

Thx, bye,
Luca

Happened to me on a new server I received from a vendor with bullseye
preinstalled so I don't know exactly if they didn't mess with password
there but very unlikely they did. Upon upgrade to bookworm got those
persisting errors

    root@typhon:~# apt-get -f install
    Reading package lists... Done
    Building dependency tree... Done
    Reading state information... Done
    0 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
    5 not fully installed or removed.
    After this operation, 0 B of additional disk space will be used.
    Setting up ca-certificates-java (20230103) ...
    org.debian.security.InvalidKeystorePasswordException: Cannot open Java keystore. Is the password correct?
            at org.debian.security.KeyStoreHandler.load(KeyStoreHandler.java:68)
            at org.debian.security.KeyStoreHandler.<init>(KeyStoreHandler.java:52)
            at org.debian.security.UpdateCertificates.<init>(UpdateCertificates.java:65)
            at org.debian.security.UpdateCertificates.main(UpdateCertificates.java:51)
    Caused by: java.io.IOException: Keystore was tampered with, or password was incorrect
            at java.base/sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:795)
            at java.base/sun.security.util.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:222)
            at java.base/java.security.KeyStore.load(KeyStore.java:1479)
            at org.debian.security.KeyStoreHandler.load(KeyStoreHandler.java:66)
            ... 3 more
    Caused by: java.security.UnrecoverableKeyException: Password verification failed
            at java.base/sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:793)
            ... 6 more
    dpkg: error processing package ca-certificates-java (--configure):
     installed ca-certificates-java package post-installation script subprocess returned error exit status 1
    dpkg: dependency problems prevent configuration of openjdk-17-jre-headless:amd64:
     openjdk-17-jre-headless:amd64 depends on ca-certificates-java (>= 20190405~); however:
      Package ca-certificates-java is not configured yet.

    dpkg: error processing package openjdk-17-jre-headless:amd64 (--configure):
     dependency problems - leaving unconfigured
    dpkg: dependency problems prevent configuration of default-jre-headless:
     default-jre-headless depends on openjdk-17-jre-headless; however:
      Package openjdk-17-jre-headless:amd64 is not configured yet.

    dpkg: error processing package default-jre-headless (--configure):
     dependency problems - leaving unconfigured
    dpkg: dependency problems prevent configuration of openjdk-17-jre:amd64:
     openjdk-17-jre:amd64 depends on openjdk-17-jre-headless (= 17.0.6+10-1); however:
      Package openjdk-17-jre-headless:amd64 is not configured yet.

    dpkg: error processing package openjdk-17-jre:amd64 (--configure):
     dependency problems - leaving unconfigured
    dpkg: dependency problems prevent configuration of default-jre:
     default-jre depends on default-jre-headless (= 2:1.17-74); however:
      Package default-jre-headless is not configured yet.
     default-jre depends on openjdk-17-jre; however:
      Package openjdk-17-jre:amd64 is not configured yet.

    dpkg: error processing package default-jre (--configure):
     dependency problems - leaving unconfigured
    Errors were encountered while processing:
     ca-certificates-java
     openjdk-17-jre-headless:amd64
     default-jre-headless
     openjdk-17-jre:amd64
     default-jre
    E: Sub-process /usr/bin/dpkg returned an error code (1)
    root@typhon:~# cat /etc/default/cacerts
    # defaults for ca-certificates-java

    # The password which is used to protect the integrity of the keystore.
    # storepass must be at least 6 characters long. It must be provided to
    # all commands that access the keystore contents.
    # Only change this if adding private certificates.
    #storepass=''

    # enable/disable updates of the keystore /etc/ssl/certs/java/cacerts
    cacerts_updates=yes

The history of the package on the box:

root@typhon:~# zgrep ca-certifica /var/log/dpkg.log*
/var/log/dpkg.log:2023-02-18 19:57:08 upgrade ca-certificates:all 20210119 20211016
/var/log/dpkg.log:2023-02-18 19:57:08 status half-configured ca-certificates:all 20210119
/var/log/dpkg.log:2023-02-18 19:57:08 status unpacked ca-certificates:all 20210119
/var/log/dpkg.log:2023-02-18 19:57:08 status half-installed ca-certificates:all 20210119
/var/log/dpkg.log:2023-02-18 19:57:08 status unpacked ca-certificates:all 20211016
/var/log/dpkg.log:2023-02-18 19:57:47 upgrade ca-certificates-java:all 20190909 20230103
/var/log/dpkg.log:2023-02-18 19:57:47 status half-configured ca-certificates-java:all 20190909
/var/log/dpkg.log:2023-02-18 19:57:47 status unpacked ca-certificates-java:all 20190909
/var/log/dpkg.log:2023-02-18 19:57:47 status half-installed ca-certificates-java:all 20190909
/var/log/dpkg.log:2023-02-18 19:57:47 status unpacked ca-certificates-java:all 20230103
/var/log/dpkg.log:2023-02-18 20:00:22 configure ca-certificates:all 20211016 <none>
/var/log/dpkg.log:2023-02-18 20:00:22 status unpacked ca-certificates:all 20211016
/var/log/dpkg.log:2023-02-18 20:00:22 status half-configured ca-certificates:all 20211016
/var/log/dpkg.log:2023-02-18 20:00:23 status installed ca-certificates:all 20211016
/var/log/dpkg.log:2023-02-18 20:00:23 status triggers-pending ca-certificates:all 20211016
/var/log/dpkg.log:2023-02-18 20:00:34 configure ca-certificates-java:all 20230103 <none>
/var/log/dpkg.log:2023-02-18 20:00:34 status unpacked ca-certificates-java:all 20230103
/var/log/dpkg.log:2023-02-18 20:00:34 status half-configured ca-certificates-java:all 20230103
/var/log/dpkg.log:2023-02-18 20:04:35 trigproc ca-certificates:all 20211016 <none>
/var/log/dpkg.log:2023-02-18 20:04:35 status half-configured ca-certificates:all 20211016
/var/log/dpkg.log:2023-02-18 20:04:36 status installed ca-certificates:all 20211016
/var/log/dpkg.log:2023-02-18 20:08:47 configure ca-certificates-java:all 20230103 <none>
/var/log/dpkg.log:2023-02-18 20:08:47 status half-configured ca-certificates-java:all 20230103
/var/log/dpkg.log:2023-02-18 20:12:56 configure ca-certificates-java:all 20230103 <none>
/var/log/dpkg.log:2023-02-18 20:12:56 status half-configured ca-certificates-java:all 20230103
/var/log/dpkg.log:2023-02-18 20:13:14 configure ca-certificates-java:all 20230103 <none>
/var/log/dpkg.log:2023-02-18 20:13:14 status half-configured ca-certificates-java:all 20230103
/var/log/dpkg.log:2023-02-18 23:18:26 configure ca-certificates-java:all 20230103 <none>
/var/log/dpkg.log:2023-02-18 23:18:26 status half-configured ca-certificates-java:all 20230103
/var/log/dpkg.log:2023-02-18 23:18:33 configure ca-certificates-java:all 20230103 <none>
/var/log/dpkg.log:2023-02-18 23:18:33 status half-configured ca-certificates-java:all 20230103
/var/log/dpkg.log.4.gz:2022-10-27 16:05:17 install ca-certificates:all <none> 20210119
/var/log/dpkg.log.4.gz:2022-10-27 16:05:17 status half-installed ca-certificates:all 20210119
/var/log/dpkg.log.4.gz:2022-10-27 16:05:17 status unpacked ca-certificates:all 20210119
/var/log/dpkg.log.4.gz:2022-10-27 16:06:41 configure ca-certificates:all 20210119 <none>
/var/log/dpkg.log.4.gz:2022-10-27 16:06:41 status unpacked ca-certificates:all 20210119
/var/log/dpkg.log.4.gz:2022-10-27 16:06:41 status half-configured ca-certificates:all 20210119
/var/log/dpkg.log.4.gz:2022-10-27 16:06:42 status installed ca-certificates:all 20210119
/var/log/dpkg.log.4.gz:2022-10-27 16:06:42 status triggers-pending ca-certificates:all 20210119
/var/log/dpkg.log.4.gz:2022-10-27 16:07:42 trigproc ca-certificates:all 20210119 <none>
/var/log/dpkg.log.4.gz:2022-10-27 16:07:42 status half-configured ca-certificates:all 20210119
/var/log/dpkg.log.4.gz:2022-10-27 16:07:42 status installed ca-certificates:all 20210119
/var/log/dpkg.log.4.gz:2022-10-28 12:58:05 install ca-certificates-java:all <none> 20190909
/var/log/dpkg.log.4.gz:2022-10-28 12:58:05 status triggers-pending ca-certificates:all 20210119
/var/log/dpkg.log.4.gz:2022-10-28 12:58:05 status half-installed ca-certificates-java:all 20190909
/var/log/dpkg.log.4.gz:2022-10-28 12:58:05 status unpacked ca-certificates-java:all 20190909
/var/log/dpkg.log.4.gz:2022-10-28 13:00:19 configure ca-certificates-java:all 20190909 <none>
/var/log/dpkg.log.4.gz:2022-10-28 13:00:19 status unpacked ca-certificates-java:all 20190909
/var/log/dpkg.log.4.gz:2022-10-28 13:00:19 status half-configured ca-certificates-java:all 20190909
/var/log/dpkg.log.4.gz:2022-10-28 13:00:20 status triggers-awaited ca-certificates-java:all 20190909
/var/log/dpkg.log.4.gz:2022-10-28 13:00:37 trigproc ca-certificates:all 20210119 <none>
/var/log/dpkg.log.4.gz:2022-10-28 13:00:37 status half-configured ca-certificates:all 20210119
/var/log/dpkg.log.4.gz:2022-10-28 13:00:37 status installed ca-certificates-java:all 20190909
/var/log/dpkg.log.4.gz:2022-10-28 13:00:37 status installed ca-certificates:all 20210119