The issue is easy to reproduce: just setup eg. a trixie Debian system
with ca-certificates, ca-certificates-java and default-jre-headless
installed. Then add Debian sid to the APT sources and reinstall the
package ca-certificates.
Typical output:
```
Updating certificates in /etc/ssl/certs...
rehash: warning: skipping ca-certificates.crt, it does not contain
exactly one certificate or CRL
5 added, 11 removed; done.
Processing triggers for ca-certificates (20260223) ...
Updating certificates in /etc/ssl/certs...
0 added, 0 removed; done.
Running hooks in /etc/ca-certificates/update.d...
done.
Processing triggers for ca-certificates-java (20240118) ...
done.
```
What's worth noting above is the duplicate line:
```
5 added, 11 removed; done.
[...]
0 added, 0 removed; done.
```
This line comes from update-ca-certificates. It's duplicated because the
postinst calls it twice: first time without hooks, and the second time
with hooks. However when it runs the second time, certificates were
already processed, that's why we get 0 added and 0 removed.
However, and that's the issue: the whole point with the hooks is that
update-ca-certificates is supposed to pass the list of added and removed
certificates to the hooks. And it doesn't, since this information is
only avail during the first run.
It looks like the whole thing has been broken for years and needs a
non-trivial overhaul to be functional again.
Best,
Arnaud
__
This is the maintainer address of Debian's Java team
<https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-java-maintainers>.
Please use
[email protected] for discussions and questions.
