Debian Bookworm Docker镜像中ca-certificates-java安装失败求助

问题描述 #

基于最新Debian Bookworm镜像构建Docker容器，安装TeX Live时需依赖OpenJDK 17，但执行安装命令时，ca-certificates-java包配置失败，触发Java加载java.security文件的内部错误，导致OpenJDK相关包无法完成配置，具体报错如下：

#5 76.76 Setting up ca-certificates-java (20230103) ...
#5 77.12 Exception in thread "main" java.lang.InternalError: Error loading java.security file
#5 77.13    at java.base/java.security.Security.initialize(Security.java:106)
#5 77.13    at java.base/java.security.Security$1.run(Security.java:84)
#5 77.13    at java.base/java.security.Security$1.run(Security.java:82)
#5 77.13    at java.base/java.security.AccessController.doPrivileged(AccessController.java:318)
#5 77.13    at java.base/java.security.Security.<clinit>(Security.java:82)
#5 77.13    at java.base/sun.security.jca.ProviderList.<init>(ProviderList.java:178)
#5 77.13    at java.base/sun.security.jca.ProviderList$2.run(ProviderList.java:96)
#5 77.13    at java.base/sun.security.jca.ProviderList$2.run(ProviderList.java:94)
#5 77.13    at java.base/java.security.AccessController.doPrivileged(AccessController.java:318)
#5 77.13    at java.base/sun.security.jca.ProviderList.fromSecurityProperties(ProviderList.java:93)
#5 77.13    at java.base/sun.security.jca.Providers.<clinit>(Providers.java:55)
#5 77.13    at java.base/sun.security.jca.GetInstance.getInstance(GetInstance.java:156)
#5 77.13    at java.base/java.security.cert.CertificateFactory.getInstance(CertificateFactory.java:193)
#5 77.13    at org.debian.security.KeyStoreHandler.<init>(KeyStoreHandler.java:50)
#5 77.13    at org.debian.security.UpdateCertificates.<init>(UpdateCertificates.java:65)
#5 77.14    at org.debian.security.UpdateCertificates.main(UpdateCertificates.java:51)
#5 77.14 dpkg: error processing package ca-certificates-java (--configure):
#5 77.14  installed ca-certificates-java package post-installation script subprocess returned error exit status 1
#5 77.15 dpkg: dependency problems prevent configuration of openjdk-17-jre-headless:amd64:
#5 77.15  openjdk-17-jre-headless:amd64 depends on ca-certificates-java (>= 20190405~); however:
#5 77.15   Package ca-certificates-java is not configured yet.
#5 77.15 
#5 77.15 dpkg: error processing package openjdk-17-jre-headless:amd64 (--configure):
#5 77.15  dependency problems - leaving unconfigured
#5 77.15 dpkg: dependency problems prevent configuration of openjdk-17-jdk-headless:amd64:
#5 77.15  openjdk-17-jdk-headless:amd64 depends on openjdk-17-jre-headless (= 17.0.8+7-1~deb12u1); however:
#5 77.15   Package openjdk-17-jre-headless:amd64 is not configured yet.
#5 77.15 
#5 77.15 dpkg: error processing package openjdk-17-jdk-headless:amd64 (--configure):
#5 77.15  dependency problems - leaving unconfigured
#5 77.16 Processing triggers for sgml-base (1.31) ...
#5 77.21 Setting up libfontconfig1:amd64 (2.14.1-4) ...
#5 77.30 Processing triggers for libc-bin (2.36-9+deb12u1) ...
#5 77.46 Errors were encountered while processing:
#5 77.46  ca-certificates-java
#5 77.46  openjdk-17-jre-headless:amd64
#5 77.46  openjdk-17-jdk-headless:amd64
#5 77.52 E: Sub-process /usr/bin/dpkg returned an error code (1)
#5 ERROR: process "/bin/sh -c apt-get update -y && apt-get install -y software-properties-common &&     apt-add-repository 'deb http://security.debian.org/debian-security bookworm/updates main' && apt update -y &&     apt-get install -y openjdk-17-jdk-headless ca-certificates-java" did not complete successfully: exit code: 100

解决方案 #

方案1：预配置证书并跳过Java证书更新 #

在安装OpenJDK前，先处理系统证书，同时通过debconf设置跳过ca-certificates-java的默认密钥库配置：

FROM debian:bookworm

RUN apt-get update -y && \
    # 先安装并更新系统根证书
    apt-get install -y --no-install-recommends ca-certificates && \
    update-ca-certificates && \
    # 设置debconf选项，跳过Java证书库配置
    echo "ca-certificates-java ca-certificates-java/default-keystore select none" | debconf-set-selections && \
    # 安装OpenJDK及依赖
    apt-get install -y openjdk-17-jdk-headless && \
    # 强制完成所有包的配置
    dpkg --configure -a

方案2：精简依赖安装后修复配置 #

使用--no-install-recommends减少不必要的依赖，安装后手动修复证书配置：

FROM debian:bookworm

RUN apt-get update -y && \
    apt-get install -y --no-install-recommends software-properties-common && \
    apt-add-repository 'deb http://security.debian.org/debian-security bookworm/updates main' && \
    apt-get update -y && \
    # 忽略安装时的配置错误，先把包拉取下来
    apt-get install -y --no-install-recommends openjdk-17-jdk-headless || true && \
    # 强制更新证书
    update-ca-certificates -f && \
    # 重新配置所有未完成的包
    dpkg --configure -a

方案3：改用第三方预构建OpenJDK镜像 #

直接使用Adoptium提供的稳定OpenJDK镜像作为基础，避免Debian官方包的配置问题：

FROM eclipse-temurin:17-jdk-bookworm

# 安装TeX Live及所需依赖
RUN apt-get update -y && \
    apt-get install -y texlive-full

方案4：修复java.security文件权限 #

如果是文件权限异常导致无法加载配置文件，安装后手动调整权限并重新配置：

FROM debian:bookworm

RUN apt-get update -y && \
    apt-get install -y software-properties-common && \
    apt-add-repository 'deb http://security.debian.org/debian-security bookworm/updates main' && \
    apt-get update -y && \
    # 强制安装包，忽略临时配置错误
    apt-get install -y --force-yes openjdk-17-jdk-headless ca-certificates-java && \
    # 修复java.security文件的默认权限
    chmod 644 /usr/lib/jvm/java-17-openjdk-amd64/conf/security/java.security && \
    # 完成包配置
    dpkg --configure -a

内容的提问来源于stack exchange，提问作者Petra Boerner