This bug was fixed in the package ca-certificates-java -
20260311ubuntu0.26.04.1
---------------
ca-certificates-java (20260311ubuntu0.26.04.1) resolute-security; urgency=medium
* debian/ca-certificates-java.postinst: reconcile package-managed aliases
in /etc/ssl/certs/java/cacerts on upgrade from 20260311. The
ca-certificates postinst shipped in resolute applied certificate
changes without running the /etc/ca-certificates/update.d hooks, so
the deferred update fed this package an empty change list and the
keystore stopped receiving updates; it still trusts CAs that were
removed from the system trust store since then, including the eMudhra
root (LP: #2061817, Debian #1069251). Stale debian:-prefixed aliases
are removed and current system/local CAs are re-imported. Non-debian:
aliases are untouched.
* Depend on the fixed ca-certificates version so future updates reach the
trigger-safe Java hook.
-- Vyom Yadav <[email protected]> Mon, 02 Nov 2026 13:36:02
-0600
** Changed in: ca-certificates (Ubuntu Noble)
Status: New => Fix Released
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2061817
Title:
[regression][security] ca-certificates.postinst does not feed
adds/removes to hooks
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/ca-certificates/+bug/2061817/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
