package openjdk-8-jre-headless 8u282-b08-0ubuntu1~20.04 failed to install/upgrade: Versuch, gemeinsam benutztes »/etc/java-8-openjdk/security/java.security« zu überschreiben, welches verschieden von anderen Instanzen des Paketes openjdk-8-jre-headless:i386 ist

[Björn Wegner]

I wanted to install google-Chrome with instruction from this website https://linuxize.com/post/how-to-install-google-chrome-web-browser-on-ubuntu-20-04/ but could not end it and the problem occured

ProblemType: Package
DistroRelease: Ubuntu 20.04
Package: openjdk-8-jre-headless 8u282-b08-0ubuntu1~20.04
ProcVersionSignature: Ubuntu 5.4.0-52.57-generic 5.4.65
Uname: Linux 5.4.0-52-generic x86_64
ApportVersion: 2.20.11-0ubuntu27.10
AptOrdering:
 openjdk-8-jre:amd64: Install
 openjdk-8-jre-headless:amd64: Install
 openjdk-8-jre-headless:i386: Install
 NULL: ConfigurePending
Architecture: amd64
CasperMD5CheckResult: skip
Date: Sat Feb 20 12:20:16 2021
DpkgHistoryLog:
 Start-Date: 2021-02-20 12:19:17
 Commandline: apt --fix-broken install
 Requested-By: bjay (1000)
 Upgrade: openjdk-8-jre:amd64 (8u272-b10-0ubuntu1~20.04, 8u282-b08-0ubuntu1~20.04), openjdk-8-jre-headless:amd64 (8u272-b10-0ubuntu1~20.04, 8u282-b08-0ubuntu1~20.04), openjdk-8-jre-headless:i386 (8u265-b01-0ubuntu2~20.04, 8u282-b08-0ubuntu1~20.04)
ErrorMessage: Versuch, gemeinsam benutztes »/etc/java-8-openjdk/security/java.security« zu überschreiben, welches verschieden von anderen Instanzen des Paketes openjdk-8-jre-headless:i386 ist
InstallationDate: Installed on 2020-02-03 (382 days ago)
InstallationMedia: Ubuntu 18.04.3 LTS "Bionic Beaver" - Release amd64 (20190805)
Python3Details: /usr/bin/python3.8, Python 3.8.5, python3-minimal, 3.8.2-0ubuntu2
PythonDetails: /usr/bin/python2.7, Python 2.7.18, python-is-python2, 2.7.17-4
RelatedPackageVersions:
 dpkg 1.19.7ubuntu3
 apt 2.0.2ubuntu0.1
SourcePackage: openjdk-8
Title: package openjdk-8-jre-headless 8u282-b08-0ubuntu1~20.04 failed to install/upgrade: Versuch, gemeinsam benutztes »/etc/java-8-openjdk/security/java.security« zu überschreiben, welches verschieden von anderen Instanzen des Paketes openjdk-8-jre-headless:i386 ist
UpgradeStatus: Upgraded to focal on 2020-10-12 (131 days ago)

[Marc Deslauriers (mdeslaur)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. We appreciate the difficulties you are facing, but this appears to be a "regular" (non-security) bug. I have unmarked it as a security issue since this bug does not show evidence of allowing attackers to cross privilege boundaries nor directly cause loss of data/privacy. Please feel free to report any other bugs you may find.

[Thorsten Glaser (mirabilos)]

M-A coinstallability bug introduced by:

openjdk-8 (8u252-b09-1ubuntu1) focal; urgency=medium

  * Build without atk-wrapper on i386 in focal.

 -- Matthias Klose <email address hidden> Thu, 16 Apr 2020 10:47:49 +0200

@doko: what was the reason?

[Roman Shipovskij (roman-shipovskij)]

All architectures should build without atk-wrapper to fix this issue, atk-wrapper cause problems, for example:
https://bugs.launchpad.net/ubuntu/+source/java-atk-wrapper/+bug/1510009
And we use -Djavax.accessibility.assistive_technologies= to disable it.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Thorsten Glaser (mirabilos)]

Hi Roman,

are these problems still present in Ubuntu noble and Debian sid?

Do you have a reproducer?

Samuel is right in that we should not disable it by default *in general* so bugs get reported when things break. (On the other hand, I note that 11 and 17 just seem to disable it everywhere…)

My current plan is to disable it on Ubuntu up to and including jammy in addition to what is currently disabled (wheezy, jessie, precise, trusty). This leaves it enabled on mantic/noble and Debian stretch and sid; the former so there’s no change to the release under only ELTS and the latter for getting bugreports possibly.

[Roman Shipovskij (roman-shipovskij)]

Hi Thorsten,

I don't tried on Ubuntu noble or Debian sid, but I believe each distribution will have this issue just because packages for i386 and amd64 architectures contains different /etc/java-8-openjdk/security/java.security files, as result dpkg will not allow to install both packages simultaneously

The only way is to build without atk-wrapper for all architectures, not only for i386, what we do by itself

[Thorsten Glaser (mirabilos)]

Yes, yes, that’s the Multi-Arch problem.

But we can also just build *with* atk-wrapper on all architectures.

(Actually, we now build always with, just pre-disable it on the older releases.)

[Thorsten Glaser (mirabilos)]

Hi Roman,

Vladimir Petko and I found a solution that retains coïnstallability: on i386 for focal‥mantic, we fake having the wrapper (as in, all on-disc files are identical to amd64), but we don’t add the dependency and add a patch to change the exception to a warning for i386 only.

I’ll upload to Debian once the time_t-64 transition is progressed; you can Sync then.

[Roman Shipovskij (roman-shipovskij)]

Hi Thorsten,

I see openjdk-8 8u402-ga-2ubuntu1~22.04 just released, but problem still exists on jammy

Everything works fine when installing this version, but not when updating from initial version 8u312-b07-0ubuntu1

Steps to reproduce:

Install initial version of openjdk-8-jre-headless
apt install openjdk-8-jre-headless=8u312-b07-0ubuntu1 openjdk-8-jre-headless:i386=8u312-b07-0ubuntu1

Try to upgrade
apt install openjdk-8-jre-headless

The following additional packages will be installed:
  openjdk-8-jre-headless:i386
Suggested packages:
  fonts-nanum fonts-ipafont-gothic fonts-ipafont-mincho fonts-wqy-microhei fonts-wqy-zenhei libnss-mdns:i386 fonts-nanum:i386 fonts-ipafont-gothic:i386 fonts-ipafont-mincho:i386 fonts-wqy-microhei:i386
  fonts-wqy-zenhei:i386
The following packages will be upgraded:
  openjdk-8-jre-headless openjdk-8-jre-headless:i386
2 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 0 B/61.2 MB of archives.
After this operation, 61.4 kB of additional disk space will be used.
Do you want to continue? [Y/n]
(Reading database ... 223474 files and directories currently installed.)
Preparing to unpack .../openjdk-8-jre-headless_8u402-ga-2ubuntu1~22.04_i386.deb ...
De-configuring openjdk-8-jre-headless:amd64 (8u312-b07-0ubuntu1), to allow configuration of openjdk-8-jre-headless:i386 (8u312-b07-0ubuntu1) ...
update-alternatives: using /usr/lib/jvm/java-8-openjdk-i386/jre/bin/orbd to provide /usr/bin/orbd (orbd) in auto mode
update-alternatives: using /usr/lib/jvm/java-8-openjdk-i386/jre/bin/servertool to provide /usr/bin/servertool (servertool) in auto mode
update-alternatives: using /usr/lib/jvm/java-8-openjdk-i386/jre/bin/tnameserv to provide /usr/bin/tnameserv (tnameserv) in auto mode
Unpacking openjdk-8-jre-headless:i386 (8u402-ga-2ubuntu1~22.04) over (8u312-b07-0ubuntu1) ...
Preparing to unpack .../openjdk-8-jre-headless_8u402-ga-2ubuntu1~22.04_amd64.deb ...
Unpacking openjdk-8-jre-headless:amd64 (8u402-ga-2ubuntu1~22.04) over (8u312-b07-0ubuntu1) ...
dpkg: error processing archive /var/cache/apt/archives/openjdk-8-jre-headless_8u402-ga-2ubuntu1~22.04_amd64.deb (--unpack):
 trying to overwrite shared '/etc/java-8-openjdk/security/java.security', which is different from other instances of package openjdk-8-jre-headless:amd64
dpkg-deb: error: paste subprocess was killed by signal (Broken pipe)
Errors were encountered while processing:
 /var/cache/apt/archives/openjdk-8-jre-headless_8u402-ga-2ubuntu1~22.04_amd64.deb
E: Sub-process /usr/bin/dpkg returned an error code (1)

[Roman Shipovskij (roman-shipovskij)]

I just tried to build package with higher version to test upgrade and got the same error:

The following packages will be upgraded:
  openjdk-8-jre-headless openjdk-8-jre-headless:i386
2 upgraded, 0 newly installed, 0 to remove and 47 not upgraded.
Need to get 0 B/54.2 MB of archives.
After this operation, 77.8 kB of additional disk space will be used.
(Reading database ... 183946 files and directories currently installed.)
Preparing to unpack .../openjdk-8-jre-headless_8u402-ga-2ubuntu1~22.04.1_i386.deb ...
De-configuring openjdk-8-jre-headless:amd64 (8u402-ga-2ubuntu1~22.04), to allow configuration of openjdk-8-jre-headless:i386 (8u402-ga-2ubuntu1~22.04) ...
update-alternatives: using /usr/lib/jvm/java-8-openjdk-i386/jre/bin/orbd to provide /usr/bin/orbd (orbd) in auto mode
update-alternatives: using /usr/lib/jvm/java-8-openjdk-i386/jre/bin/servertool to provide /usr/bin/servertool (servertool) in auto mode
update-alternatives: using /usr/lib/jvm/java-8-openjdk-i386/jre/bin/tnameserv to provide /usr/bin/tnameserv (tnameserv) in auto mode
Unpacking openjdk-8-jre-headless:i386 (8u402-ga-2ubuntu1~22.04.1) over (8u402-ga-2ubuntu1~22.04) ...
Preparing to unpack .../openjdk-8-jre-headless_8u402-ga-2ubuntu1~22.04.1_amd64.deb ...
Unpacking openjdk-8-jre-headless:amd64 (8u402-ga-2ubuntu1~22.04.1) over (8u402-ga-2ubuntu1~22.04) ...
dpkg: error processing archive /var/cache/apt/archives/openjdk-8-jre-headless_8u402-ga-2ubuntu1~22.04.1_amd64.deb (--unpack):
 trying to overwrite shared '/etc/java-8-openjdk/security/java.security', which is different from other instances of package openjdk-8-jre-headless:amd64
dpkg-deb: error: paste subprocess was killed by signal (Broken pipe)
Errors were encountered while processing:
 /var/cache/apt/archives/openjdk-8-jre-headless_8u402-ga-2ubuntu1~22.04.1_amd64.deb
E: Sub-process /usr/bin/dpkg returned an error code (1)

As you can see the fix works only for fresh installation, but does not work for upgrade

[Roman Shipovskij (roman-shipovskij)]

To fix this issue, all architectures should build without atk-wrapper, not only i386

[Vladimir Petko (vpa1977)]

Hi,

I think the problem is that in ubuntu1 package I have rolled back initial Thorsten's fix and the package to be tested is ga-3 in Debian. I will raise a sync bug and sync ga-4 package to Noble[1].

[1] https://tracker.debian.org/news/1511914/accepted-openjdk-8-8u402-ga-3-source-into-unstable/

[Thorsten Glaser (mirabilos)]

8u402-ga-4 actually, but first we have to check if Ubuntu indeed stays with libcups2 (in which case that version should work) or also switches to libcups2t64 (in which case another change is needed). 8u402-ga-3 had a… tiny fuckup.

[Thorsten Glaser (mirabilos)]

According to https://launchpad.net/ubuntu/+source/cups/2.4.7-1.2ubuntu1 they did, so you’ll need https://evolvis.org/plugins/scmgit/cgi-bin/gitweb.cgi?p=alioth/openjdk-8.git;a=commitdiff;h=6586b716485710c94fa2bcb1b85989393f37d856 as well. I’m not uploading this as openjdk-8_8u402-ga-5 to Debian right now as it does not affect Debian and we have the t64 transition still going on and I want to keep buildd load down, but you can consider this as released and use it; I’ll ensure the next upload will have a larger version.

[Vladimir Petko (vpa1977)]

Thank you!!!

I will do it as a merge then.

[Thorsten Glaser (mirabilos)]

Hi again Vladimir,

I did upload a -6 today to temporarily disable the tests to help the ARM builders across the transition better, so you can also do a sync, I believe.

Disclaimer: I haven’t tested that on Ubuntu, only Debian, and not yet on t64-affected architectures (but the powerpc buildds should pick it up shortly; I was unable to make the armel and armhf ones meet the prerequisites because the main archive is more strict in which porter uploads it accepts than debian-ports are).

[Vladimir Petko (vpa1977)]

Hi,

trying to do a build in PPA before sync, but it keeps getting stuck ;(

[Thorsten Glaser (mirabilos)]

Stuck how? (Can you link to the PPA so I can peek at it?)

Did you add noble-proposed to the PPA’s sources?

[Thorsten Glaser (mirabilos)]

The (proper) fix is now included in the current packages, but t64 bootstrapping is a bit difficult.

When Vladimir promotes https://launchpad.net/~vpa1977/+archive/ubuntu/bootstrap-openjdk-lts/+sourcepub/15913967/+listing-archive-extra to noble-proposed, that one can then be used to build 8u402-ga-8 which I just uploaded to Debian, which can be sync-requested.

Then, backported versions of that to focal include the coïnstallability fix while not breaking due to lack of a11y on focal/i386.

[Vladimir Petko (vpa1977)]

Hi,

 A small correction to the attribution of t64 patch[1]

[1] https://salsa.debian.org/openjdk-team/openjdk/-/merge_requests/115

On Mon, Mar 25, 2024 at 4:20 PM Thorsten Glaser
<email address hidden> wrote:
>
> Hi again Vladimir,
>
> I did upload a -6 today to temporarily disable the tests to help the ARM
> builders across the transition better, so you can also do a sync, I
> believe.
>
> Disclaimer: I haven’t tested that on Ubuntu, only Debian, and not yet on
> t64-affected architectures (but the powerpc buildds should pick it up
> shortly; I was unable to make the armel and armhf ones meet the
> prerequisites because the main archive is more strict in which porter
> uploads it accepts than debian-ports are).
>
> --
> You received this bug notification because you are a member of OpenJDK,
> which is subscribed to openjdk-8 in Ubuntu.
> https://bugs.launchpad.net/bugs/1916327
>
> Title:
> package openjdk-8-jre-headless 8u282-b08-0ubuntu1~20.04 failed to
> install/upgrade: Versuch, gemeinsam benutztes
> »/etc/java-8-openjdk/security/java.security« zu überschreiben, welches
> verschieden von anderen Instanzen des Paketes openjdk-8-jre-
> headless:i386 ist
>
> Status in openjdk-8 package in Ubuntu:
> Fix Committed
>
> Bug description:
> I wanted to install google-Chrome with instruction from this website
> https://linuxize.com/post/how-to-install-google-chrome-web-browser-on-
> ubuntu-20-04/ but could not end it and the problem occured
>
> ProblemType: Package
> DistroRelease: Ubuntu 20.04
> Package: openjdk-8-jre-headless 8u282-b08-0ubuntu1~20.04
> ProcVersionSignature: Ubuntu 5.4.0-52.57-generic 5.4.65
> Uname: Linux 5.4.0-52-generic x86_64
> ApportVersion: 2.20.11-0ubuntu27.10
> AptOrdering:
> openjdk-8-jre:amd64: Install
> openjdk-8-jre-headless:amd64: Install
> openjdk-8-jre-headless:i386: Install
> NULL: ConfigurePending
> Architecture: amd64
> CasperMD5CheckResult: skip
> Date: Sat Feb 20 12:20:16 2021
> DpkgHistoryLog:
> Start-Date: 2021-02-20 12:19:17
> Commandline: apt --fix-broken install
> Requested-By: bjay (1000)
> Upgrade: openjdk-8-jre:amd64 (8u272-b10-0ubuntu1~20.04, 8u282-b08-0ubuntu1~20.04), openjdk-8-jre-headless:amd64 (8u272-b10-0ubuntu1~20.04, 8u282-b08-0ubuntu1~20.04), openjdk-8-jre-headless:i386 (8u265-b01-0ubuntu2~20.04, 8u282-b08-0ubuntu1~20.04)
> ErrorMessage: Versuch, gemeinsam benutztes »/etc/java-8-openjdk/security/java.security« zu überschreiben, welches verschieden von anderen Instanzen des Paketes openjdk-8-jre-headless:i386 ist
> InstallationDate: Installed on 2020-02-03 (382 days ago)
> InstallationMedia: Ubuntu 18.04.3 LTS "Bionic Beaver" - Release amd64 (20190805)
> Python3Details: /usr/bin/python3.8, Python 3.8.5, python3-minimal, 3.8.2-0ubuntu2
> PythonDetails: /usr/bin/python2.7, Python 2.7.18, python-is-python2, 2.7.17-4
> RelatedPackageVersions:
> dpkg 1.19.7ubuntu3
> apt 2.0.2ubuntu0.1
> SourcePackage: openjdk-8
> Title: package openjdk-8-jre-headless 8u282-b08-0ubuntu1~20.04 failed to install/upgrade: Versuch, gemeinsam benutztes »/etc/java-8-openjdk/security/java.security« zu überschreiben, welches versch...

[Thorsten Glaser (mirabilos)]

Thanks, committed the attribution fix to the git repo.