The symlink created by the ebuild has the wrong directory structure. The directory structure is valid for the JDK but not on the JRE distribution. The JRE distrubtion doesn't have the 'jre' directory in the root directory. The symlink should be created in "${dest}"/lib/security/cacerts Reproducible: Always Steps to Reproduce: 1. Use any java application that connects to some SSL endpoint Actual Results: This leads to the following stacktrace: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty Expected Results: A successful connection to the SSL endpoint. # emerge --info =dev-java/openjdk-jre-bin-8.242_p08 Portage 2.3.89 (python 3.6.10-final-0, default/linux/amd64/17.0, gcc-9.2.0, glibc-2.29-r7, 4.19.44-gentoo x86_64) ================================================================= System Settings ================================================================= System uname: Linux-4.19.44-gentoo-x86_64-Intel-R-_Xeon-R-_CPU_E3-1231_v3_@_3.40GHz-with-gentoo-2.6 KiB Mem: 16384168 total, 476564 free KiB Swap: 4190204 total, 4190204 free Timestamp of repository gentoo: Mon, 13 Apr 2020 23:15:01 +0000 Head commit of repository gentoo: 96c435d4f93f31ddda4bfe6282e4c1461292460c Timestamp of repository slash: Tue, 14 Apr 2020 14:18:12 +0200 sh bash 4.4_p23-r1 ld GNU ld (Gentoo 2.33.1 p2) 2.33.1 app-shells/bash: 4.4_p23-r1::gentoo dev-java/java-config: 2.2.0-r4::gentoo dev-lang/perl: 5.30.1::gentoo dev-lang/python: 2.7.17-r1::gentoo, 3.6.10::gentoo, 3.7.6::gentoo dev-util/cmake: 3.16.5::gentoo dev-util/pkgconfig: 0.29.2::gentoo sys-apps/baselayout: 2.6-r1::gentoo sys-apps/openrc: 0.42.1::gentoo sys-apps/sandbox: 2.13::gentoo sys-devel/autoconf: 2.69-r4::gentoo sys-devel/automake: 1.16.1-r1::gentoo sys-devel/binutils: 2.33.1-r1::gentoo sys-devel/gcc: 9.2.0-r2::gentoo sys-devel/gcc-config: 2.2.1::gentoo sys-devel/libtool: 2.4.6-r6::gentoo sys-devel/make: 4.2.1-r4::gentoo sys-kernel/linux-headers: 4.19::gentoo (virtual/os-headers) sys-libs/glibc: 2.29-r7::gentoo Repositories: gentoo location: /usr/portage sync-type: rsync sync-uri: rsync://yeager.slash.co.za/gentoo-portage priority: -1000 sync-rsync-verify-jobs: 1 sync-rsync-verify-metamanifest: yes sync-rsync-extra-opts: sync-rsync-verify-max-age: 24 slash location: /usr/local/portage-slash sync-type: rsync sync-uri: rsync://raven.slash.co.za/slash-portage masters: gentoo priority: 9999 sync-rsync-extra-opts: ACCEPT_KEYWORDS="amd64" ACCEPT_LICENSE="@FREE fping intel-ucode vim.org Oracle-BCLA-JavaSE" CBUILD="x86_64-pc-linux-gnu" CFLAGS="-O2 -pipe" CHOST="x86_64-pc-linux-gnu" CONFIG_PROTECT="/etc /usr/share/gnupg/qualified.txt /var/bind" CONFIG_PROTECT_MASK="/etc/ca-certificates.conf /etc/env.d /etc/fonts/fonts.conf /etc/gconf /etc/gentoo-release /etc/php/apache2-php7.4/ext-active/ /etc/php/cgi-php7.4/ext-active/ /etc/php/cli-php7.4/ext-active/ /etc/revdep-rebuild /etc/sandbox.d /etc/terminfo" CXXFLAGS="-O2 -pipe" DISTDIR="/usr/portage/distfiles" EMERGE_DEFAULT_OPTS="--quiet-build --backtrack=30 --buildpkg --buildpkg-exclude 'virtual/* sys-kernel/*-sources'" ENV_UNSET="DBUS_SESSION_BUS_ADDRESS DISPLAY GOBIN PERL5LIB PERL5OPT PERLPREFIX PERL_CORE PERL_MB_OPT PERL_MM_OPT XAUTHORITY XDG_CACHE_HOME XDG_CONFIG_HOME XDG_DATA_HOME XDG_RUNTIME_DIR" FCFLAGS="-O2 -pipe" FEATURES="assume-digests binpkg-docompress binpkg-dostrip binpkg-logs buildpkg config-protect-if-modified distlocks ebuild-locks fixlafiles ipc-sandbox merge-sync multilib-strict network-sandbox news parallel-fetch pid-sandbox preserve-libs protect-owned qa-unresolved-soname-deps sandbox sfperms strict unknown-features-warn unmerge-logs unmerge-orphans userfetch userpriv usersandbox usersync xattr" FFLAGS="-O2 -pipe" GENTOO_MIRRORS="http://gentoo.mirror.ac.za http://ftp.leg.uct.ac.za/pub/linux/gentoo ftp://ftp.is.co.za/mirror/gentoo.org http://distfiles.gentoo.org http://www.ibiblio.org/pub/Linux/distributions/gentoo" LANG="en_ZA.utf8" LDFLAGS="-Wl,-O1 -Wl,--as-needed" LINGUAS="en en_GB en_ZA" MAKEOPTS="-j9" PKGDIR="/usr/portage/packages" PORTAGE_CONFIGROOT="/" PORTAGE_RSYNC_OPTS="--recursive --links --safe-links --perms --times --omit-dir-times --compress --force --whole-file --delete --stats --human-readable --timeout=180 --exclude=/distfiles --exclude=/local --exclude=/packages --exclude=/.git" PORTAGE_TMPDIR="/var/tmp" USE="acl amd64 bash-completion berkdb bzip2 cli cron crypt gdbm gzip iconv libtirpc logrotate lzma lzo mmxext multilib ncurses nls nptl openmp pam pcre readline seccomp split-usr sse sse2 sse3 sse4 sse4_1 sse4_2 ssl ssse3 threads unicode uuid vhosts vim vim-syntax xattr zip zlib zlibmmx" ABI_X86="64" ADA_TARGET="gnat_2018" ALSA_CARDS="ali5451 als4000 atiixp atiixp-modem bt87x ca0106 cmipci emu10k1x ens1370 ens1371 es1938 es1968 fm801 hda-intel intel8x0 intel8x0m maestro3 trident usb-audio via82xx via82xx-modem ymfpci" APACHE2_MODULES="authn_core authz_core socache_shmcb unixd actions alias auth_basic authn_alias authn_anon authn_dbm authn_default authn_file authz_dbm authz_default authz_groupfile authz_host authz_owner authz_user autoindex cache cgi cgid dav dav_fs dav_lock deflate dir disk_cache env expires ext_filter file_cache filter headers include info log_config logio mem_cache mime mime_magic negotiation rewrite setenvif speling status unique_id userdir usertrack vhost_alias" CALLIGRA_FEATURES="karbon sheets words" COLLECTD_PLUGINS="df interface irq load memory rrdtool swap syslog" CPU_FLAGS_X86="mmx mmxext sse sse2 sse3 ssse3 sse4 sse4_1 sse4_2" ELIBC="glibc" GPSD_PROTOCOLS="ashtech aivdm earthmate evermore fv18 garmin garmintxt gpsclock greis isync itrax mtk3301 nmea ntrip navcom oceanserver oldstyle oncore rtcm104v2 rtcm104v3 sirf skytraq superstar2 timing tsip tripmate tnt ublox ubx" INPUT_DEVICES="libinput keyboard mouse" KERNEL="linux" L10N="en en-GB en-ZA" LCD_DEVICES="bayrad cfontz cfontz633 glk hd44780 lb216 lcdm001 mtxorb ncurses text" LIBREOFFICE_EXTENSIONS="presenter-console presenter-minimizer" NGINX_MODULES_HTTP="access auth_basic autoindex brotli charset dav dav_ext fastcgi geo gunzip gzip headers_more map metrics mirror proxy push_stream referer rewrite sticky stub_status sub upstream_check upstream_hash upstream_ip_hash upstream_keepalive upstream_least_conn upstream_zone" NGINX_MODULES_STREAM="access geo map upstream_hash upstream_least_conn upstream_zone" OFFICE_IMPLEMENTATION="libreoffice" PHP_TARGETS="php7-2" POSTGRES_TARGETS="postgres10 postgres11" PYTHON_SINGLE_TARGET="python3_6" PYTHON_TARGETS="python2_7 python3_6" RUBY_TARGETS="ruby24 ruby25" USERLAND="GNU" VIDEO_CARDS="amdgpu fbdev intel nouveau radeon radeonsi vesa dummy v4l" XTABLES_ADDONS="quota2 psd pknock lscan length2 ipv4options ipset ipp2p iface geoip fuzzy condition tee tarpit sysrq steal rawnat logmark ipmark dhcpmac delude chaos account" Unset: CC, CPPFLAGS, CTARGET, CXX, INSTALL_MASK, LC_ALL, PORTAGE_BINHOST, PORTAGE_BUNZIP2_COMMAND, PORTAGE_COMPRESS, PORTAGE_COMPRESS_FLAGS, PORTAGE_RSYNC_EXTRA_OPTS ================================================================= Package Settings ================================================================= dev-java/openjdk-jre-bin-8.242_p08::gentoo was built with the following: USE="headless-awt -alsa -cups (-nsplugin) (-selinux) (-webstart)" ABI_X86="(64)"
The build removes the cacerts file from the correct place, but the resulting symlink to replace the cacerts file is in the wrong directory: openjdk-jre-bin-8.242_p08.ebuild rm -v lib/security/cacerts || die dosym ../../../../../etc/ssl/certs/java/cacerts \ "${dest}"/jre/lib/security/cacerts This should work: dosym ../../../../../etc/ssl/certs/java/cacerts \ "${dest}"/lib/security/cacerts PS: I'm curious as to why the elaborate directory structure in the symlink? Isn't it the same as (and more readable) to link it directly to /etc/ssl/certs/java instead of all the ../../ ?
The bug has been closed via the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=20ca6ab2c6fbb602f181301416406252dd840682 commit 20ca6ab2c6fbb602f181301416406252dd840682 Author: Georgy Yakovlev <gyakovlev@gentoo.org> AuthorDate: 2020-04-14 18:43:44 +0000 Commit: Georgy Yakovlev <gyakovlev@gentoo.org> CommitDate: 2020-04-14 18:44:14 +0000 dev-java/openjdk-jre-bin: revbump to fix cacert path Closes: https://bugs.gentoo.org/717444 Package-Manager: Portage-2.3.89, Repoman-2.3.20 Signed-off-by: Georgy Yakovlev <gyakovlev@gentoo.org> ...jdk-jre-bin-8.242_p08.ebuild => openjdk-jre-bin-8.242_p08-r1.ebuild} | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
(In reply to Nico Schlebusch from comment #1) > The build removes the cacerts file from the correct place, but the resulting > symlink to replace the cacerts file is in the wrong directory: > > openjdk-jre-bin-8.242_p08.ebuild > rm -v lib/security/cacerts || die > dosym ../../../../../etc/ssl/certs/java/cacerts \ > "${dest}"/jre/lib/security/cacerts > > This should work: > dosym ../../../../../etc/ssl/certs/java/cacerts \ > "${dest}"/lib/security/cacerts > > PS: I'm curious as to why the elaborate directory structure in the symlink? > Isn't it the same as (and more readable) to link it directly to > /etc/ssl/certs/java instead of all the ../../ ? it's a requirement for prefix. linking to absolute path will link to system ca certs. and prefix users want it linked to gentoo prefix cacerts.
and yeah, thanks for bug report =)
