OpenJDK does not find libpcsc, fails silently, causing smartcard applications to fail

[Sjors Gielen]

The current versions of OpenJDK do not correctly find the libpcsc native C library, causing them to remove PC/SC support silently. This breaks smartcard applications, as javax.smartcardio uses libpcsc to interface with smartcard terminals.

Please see the attached Example.java. It loads the default smartcardio terminal factory, and shows the type. Currently, Java JDK supports two terminal types[0]: "None" (a dummy type which always says there are no terminals) and "PC/SC" (interfaces with PC/SC terminals). The PC/SC terminal factory is the default, but if it cannot be loaded, the Java library silently falls back to "None".

Now, on Ubuntu, the library searches for the PC/SC library in /usr/lib and /usr/local/lib, but libpcsclite1 installs its library file in /lib/libpcsclite.so.1.0.0. Therefore, the JDK library fails to find the file, and silently disables smartcard terminal support. To see this, compile the attached Example.java normally and run it:

$ javac Example.java
$ java Example
Terminal factory type: None

 A workaround[0] is to set the Java system property sun.security.smartcardio.library to the correct location:

$ javac Example.java
$ java -Dsun.security.smartcardio.library=/lib/libpcsclite.so.1 Example
Terminal factory type: PC/SC

Note: you don't need to have any terminals attached to see this result.

I would like to request the JDK be patched to search for the PCSC library in the correct location, namely /lib, so PC/SC applications can work out-of-the-box without having to supply system properties every time Java is started.

[0] http://docs.oracle.com/javase/6/docs/technotes/guides/security/SunProviders.html#SunPCSCProvider

ProblemType: Bug
DistroRelease: Ubuntu 11.10
Package: openjdk-6-jdk 6b23~pre11-0ubuntu1.11.10
ProcVersionSignature: Ubuntu 3.0.0-13.22-generic 3.0.6
Uname: Linux 3.0.0-13-generic x86_64
ApportVersion: 1.23-0ubuntu4
Architecture: amd64
Date: Thu Dec 1 16:20:56 2011
EcryptfsInUse: Yes
InstallationMedia: Ubuntu 11.10 "Oneiric Ocelot" - Release amd64 (20111012)
ProcEnviron:
 PATH=(custom, no user)
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SourcePackage: openjdk-6
UpgradeStatus: No upgrade log present (probably fresh install)

[Sjors Gielen (sgielen)]

In openjdk-7 the same thing seems to happen, so also filing the bug there.

[Matthias Klose (doko)]

hmm, for both I get the same result, but with the proper property it takes longer:

$ time java -Dsun.security.smartcardio.library=/lib/libpcsclite.so.1 Example
Terminal factory type: None

real 0m10.024s
user 0m0.156s
sys 0m0.084s

$ time java Example
Terminal factory type: None

real 0m0.183s
user 0m0.144s
sys 0m0.072s

[Sjors Gielen (sgielen)]

What JDK are you using, and what version of libpcsclite1 is installed?

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Launchpad Janitor (janitor)]

This bug was fixed in the package openjdk-7 - 7~u3-2.1.1~pre1-1ubuntu1

---------------
openjdk-7 (7~u3-2.1.1~pre1-1ubuntu1) precise; urgency=low

  * Regenerate the control file.

openjdk-7 (7~u3-2.1.1~pre1-1) unstable; urgency=low

  * Update from the IcedTea7-2.1 release branch (20110410).
  * Install desktop files again, using the common /usr/bin/java
    interpreter name.
  * Build-depend on libpng-dev for newer releases. Closes: #662452.
  * Let dlopen handle finding the libpcsclite library. LP: #898689.
  * Build-depend on fonts-ipafont-mincho, fixing a build failure in the
    fontconfig compiler (find out why it breaks ...).
  * Build using gcc-4.7/gcj-4.7 for sid/wheezy, fix build failure.
  * Remove `-icedtea' suffix from the release identification.
  * Fix arm thumb build, update taken from IcedTea6.

openjdk-7 (7~u3-2.1-4) unstable; urgency=low

  [ Matthias Klose ]
  * Don't install the binary fontconfig file.

  [ Damien Raude-Morvan ]
  * Remove libxp-dev check in configure.ac, it's not needed anymore
    (Closes: #657260) and so drop build dependency on libxp-dev.
  * Fix FTBFS with glib 2.32 by adding explicit dependency gthread-2.0.pc
    (Closes: #665666).
  * Use libpng-dev instead of libpng12-dev for wheezy/sid (Closes: #662453).
 -- Matthias Klose <email address hidden> Wed, 11 Apr 2012 07:21:41 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package openjdk-6 - 6b24-1.11.1-4ubuntu1

---------------
openjdk-6 (6b24-1.11.1-4ubuntu1) precise; urgency=low

  * Regenerate the control file.

openjdk-6 (6b24-1.11.1-4) unstable; urgency=low

  * Install desktop files again, using the common /usr/bin/java
    interpreter name. LP: #969322.
  * Build-depend on libpng-dev for newer releases. Closes: #662452.
  * Let dlopen handle finding the libpcsclite library. LP: #898689.
  * Build-depend on fonts-ipafont-mincho, fixing a build failure in the
    fontconfig compiler (find out why it breaks ...).
  * Build using gcc-4.7/gcj-4.7 for sid/wheezy, fix build failure.
 -- Matthias Klose <email address hidden> Wed, 11 Apr 2012 08:15:00 +0200

[Christoph Anton Mitterer (calestyo)]

Matthias, when dlopen handles this now, why do you need to depend now on libpcsclite?

We can't continue just adding anything as a depends to the package,... as java has a giant standard library that may eventually use dozenzs of libraries.

[Sjors Gielen (sgielen)]

IMO, it could be a Recommends or Suggests, as long as the library is clear about what the user should do if the library is needed but not installed. I.e. a stderr warning like "libpcsc not found" would work.

[Matthias Klose (doko)]

it's a 43k library, and not worth the bug reports from users expecting this to work. and any other dlopened libraries are already dependencies.

[Valtteri Pihlajamäki (valtteric)]

This is reproducible with OpenJDK 11.0.2. Tested with Ubuntu 18.04 and Debian Stretch based Raspbian. Regression?